I recently fell for a fake human-verification prompt that told me to press Win+R, paste text, and press Enter. The script ran before I realized it was malicious, and the existing Windows installation showed malware warnings, including Wacatac or possible infostealer detections.
To start over, I created an official Windows 11 installer on a separate, known-clean laptop, booted my PC from it, deleted every partition on the NVMe drive until it showed only unallocated space, and installed Windows again. I then ran Windows Update repeatedly until it reported that the system was fully up to date.
However, on this fresh installation, Windows Security displays "Threat service has stopped. Restart it now" when I open Virus & threat protection. Pressing the restart button either fails or leaves the error in place, so I cannot run a scan.
Is malware from the original installation likely to survive after deleting all partitions and reinstalling Windows? Could this instead be a current Windows or Defender update problem, and what is the safest way to repair or restart the Defender service?
2 Answers
Deleting every partition and installing Windows from official media should remove ordinary malware that was stored on the old Windows installation. Malware surviving that would generally require something unusual, such as a compromised firmware component or another device, which is not the normal explanation here. Since the problem appeared immediately after reinstalling, reinstalling again may be quicker than spending a long time repairing services.
This may be unrelated to the previous infection. There have been reports of Windows Security and Defender service failures after recent Microsoft security or Defender updates, including on more than one freshly updated computer. If the installation is only an hour old, check for additional Windows updates and known issues before assuming the malware returned.
The reinstall was completed about an hour ago, and the error appeared after I finished installing the available updates.