Before trying to clean anything, make sure it really is an infection. A large share of the "viruses" reported to us turn out to be fake alerts.
Windows 11 is far better protected than its predecessors, and classic infections have become rare on it. What is common, on the other hand, is adware, parasitic browser extensions, and web pages that imitate a security alert to get you to call a fake support line.
The signs of a genuine infection :
By contrast, a noisy web page announcing "Your PC is infected, call this number" is not an infection : it is a scam. Close the tab, or force the browser to close through Task Manager. Never call the number. We describe how it works on our scams and fake support page.
If you suspect a genuine infection, disconnect the machine from the internet. That prevents your data being sent out and further components being downloaded. Unplug the network cable or turn off the Wi-Fi.
Windows 11 includes an under-used and remarkably effective tool, which scans the machine before Windows starts - so before the malware can protect itself.
Open Windows Security, then Virus & threat protection, Scan options, and choose Microsoft Defender Offline scan. The machine restarts and scans for about fifteen minutes. Do not interrupt it.
Settings > Apps > Installed apps, then sort by install date. Unwanted software usually arrives in a group, on the same day, with generic names suggesting optimization, cleaning, weather or video codecs. Uninstall anything you do not recognise and did not deliberately install.
This is where most parasites live. In every browser installed, go through the extensions and remove anything you did not choose. Then check the home page and the default search engine. If the settings come back on their own after a restart, reset the browser completely.
From another machine, or once this one is confirmed clean : bank, email, shopping accounts. Email first - it is what allows everything else to be reset. Turn on two-factor authentication wherever it is available.
If your files are encrypted and a message demands payment, cleaning up will recover nothing : the encryption cannot be reversed without the key. Switch the machine off, do not pay, and disconnect any external drives and backups still plugged in before they are hit too. A police report can be filed, and some ransomware families have public decryption tools. Have the machine examined before doing anything else.
Cleaning up has its limits. We recommend a clean reinstall when the antivirus refuses to switch back on, when the symptoms return after a cleanup, or when the machine was used for banking during the infection. It takes longer, but it is the only real guarantee. Documents are of course transferred beforehand.
A cleanup can often be handled remotely, with no visit. If the machine is too unstable for that, we come to you or take it into the workshop.
Not necessarily. Microsoft Defender, built in and up to date, scores comparably to commercial products for home use. What matters is having only one active, and letting it update itself.
A classic virus, rarely. Ransomware, yes : it encrypts files and makes them unusable. That is why a backup kept disconnected from the machine remains the only truly reliable protection.
Never. No software company puts a phone number in an alert. That is the very mechanism of the fake tech support scam.
Would you rather we took care of it ? See our virus removal and cleanup service, in Lyon and across the Rhone.
Scanning and cleanup, remotely or at your home across the Rhone.
Automatic assistant: it can make mistakes. Never share a password or a card number.
