Memory-scanner.cc Pop-up Virus Removal – Full Windows Cleanup Guide

If you keep seeing a blank white window or a browser window that opens to Memory-scanner.cc, you are not alone. Reports show it can appear even when you are not browsing, which is a strong sign something on the PC is triggering the browser in the background.

In many cases, the website is not “magically popping up”. A potentially unwanted program (PUP), adware, or a more aggressive malware variant creates persistence on Windows, often via a Scheduled Task, and then abuses a legitimate Windows component called mshta.exe to launch the popup repeatedly.

This guide explains what it is, why it keeps returning, and how to remove the cause.

What is memory-scanner.cc?

Memory-scanner.cc is widely reported as a malicious or deceptive domain used in scammy popups, fake warnings, and redirections. The goal is usually one (or more) of the following:

• Scare you with fake alerts so you call a “support” number or install unwanted software
• Push you into downloading shady “cleaners”, extensions, or installers
• Redirect you through ad networks and tracking links
• Lead you into credential theft or other fraud flows

What makes this particular issue feel confusing is that users often see a blank white popup, not a typical browser tab. That often happens when the malware is launching the site through mshta.exe (Microsoft HTML Application Host). mshta.exe is a legitimate Windows file, but attackers commonly abuse it to execute remote scripts or open unwanted URLs.

Why it keeps popping up (the Scheduled Task trick)

A very common persistence method is a hidden or suspicious Scheduled Task that runs at logon, at startup, or every few minutes. That task launches something like:

• mshta.exe https://memory-scanner.cc/...
• a script (.vbs, .js, .bat) stored in %AppData%, %LocalAppData%, or C:\ProgramData\
• a browser with a forced URL argument

Microsoft community guidance for this exact domain points to Task Scheduler as the most likely root cause, and specifically warns not to delete mshta.exe itself, because it is a real Windows component.

You may also see security tools flagging “mshta launched with suspicious arguments”, which is a known technique for code execution and evasion.

Before you start: quick safety steps

1. Do not interact with the popup (no clicks, no downloads, no phone calls).
2. Create a System Restore Point if you can. Malware removal forums often recommend doing this before deeper cleanup steps.

Remove Memory-scanner.cc Pop-ups from Windows

• STEP 1: Use Rkill to terminate malicious processes
• STEP 2: Uninstall malicious programs from your computer
• STEP 3: Remove malicious browser policies from Windows
• STEP 4: Remove malicious files and folders from Windows
• STEP 5: Reset your browser settings to their defaults
• STEP 6: Use Malwarebytes to remove trojans and browser hijackers
• STEP 7: Use HitmanPro to scan your computer for rootkits and other malware
• STEP 8: Use AdwCleaner to remove adware and malicious browser policies

STEP 1: Use Rkill to terminate malicious processes

In this first step, we will download and run Rkill to terminate malicious processes that may be running on your computer.

RKill is a program that was developed at BleepingComputer.com that attempts to terminate known malware processes so that your normal security software can then run and clean your computer of infections. When RKill runs it will kill malware processes and then removes incorrect executable associations and fixes policies that stop us from using certain tools.

1. Download Rkill.

   You can download RKill to your computer from the below link. When at the download page, click on the Download Now button labeled iExplore.exe. We are downloading a renamed version of Rkill (iExplore.exe) because some malware will not allow processes to run unless they have a certain filename.

   

   RKILL DOWNLOAD LINK
   (The above link will open a new page from where you can download Rkill)

2. Run RKill.

   After downloading, double-click the iExplore.exe icon to kill malicious processes. In most cases, downloaded files are saved to the Downloads folder.
   The program may take some time to search for and end various malware programs.

   

   When it is finished, the black window will close automatically and a log file will open. Do not restart your computer. Proceed to the next step in this guide.

STEP 2: Uninstall malicious programs from your computer

In this second step, we will manually check if any unknown or malicious programs are installed on the computer. Sometimes adware and browser hijackers can have a usable Uninstall entry that can be used to remove them.

With the malicious programs removed, you’re ready for the next step in this guide.

STEP 3: Remove malicious browser policies from Windows

In this third step, we will download the Chrome Policy Remover file (credits to Stefan Van Damme) and remove the malicious browser policies. .

1. Download the Chrome Policy Remover

   Click the button below to download the Chrome Policy Remover for Windows — a small batch script that automatically removes the malicious policies that malware uses to lock your Chrome settings.

   

   DOWNLOAD CHROME POLICY REMOVER (FREE)
   (The link downloads the delete_chrome_policies file to your computer)
   Seeing a security warning? That’s expected — browsers and Windows flag all batch (.bat) files as a precaution, regardless of what they do. The Chrome Policy Remover is a trusted, widely used tool; click “Keep” to proceed with the download.

2. Run the file as administrator

   Right-click the “delete_chrome_policies.bat” file (usually in your Downloads folder) and select Run as administrator. Administrator rights are required because Chrome policies are stored in protected system settings — without them, the tool can’t remove the policies.

   

3. Confirm and let the script finish

   Windows will ask for confirmation before allowing the script to make changes — click “Yes” (or “Run“, depending on your Windows version). A Command Prompt window will open and the script will remove the policies automatically; this only takes a few seconds. When it’s done, close the window.

   

With the malicious policies removed, Chrome’s settings are unlocked again. In the next step, we’ll reset the browser to its defaults.

STEP 4: Remove malicious files and folders from Windows

In this fourth step, we will manually search and remove malicious scheduled tasks and folders on your computer.

1. Delete malicious scheduled tasks.

This infection may create a malicious scheduled task in the Task Scheduler to ensure that it is automatically reinstalled every 5 minutes after it has been deleted. This task may run at regular intervals to ensure that the infection persists on your system.

1. Search for “Task Scheduler” in the windows search as shown below..
   You can also open the Task Scheduler app by pressing the Windows + R buttons and then type “taskschd.msc” and press Enter.
2. In the Task Scheduler window, navigate to the Task Scheduler Library on the left side of the screen. Sort by Last Run Time and look for tasks that ran exactly when the popup appeared. Open suspicious tasks → Actions tab.
3. Locate the malicious scheduled task in the list of tasks. It may have a randomly generated nameor may be identified as a suspicious or unknown task. Right-click on the malicious task and select “Delete” from the menu. If you see memory-scanner.cc (or mshta.exe launching a URL or script), Disable, then Delete the task.

2. Delete malicious files located in AppData\Roaming folder

We will now delete the malicious file that is located in the AppData\Roaming folder.

1. Search for “Run” in the windows search as shown below, or press the Windows + R button to open the Run app.
2. In the run app text box, enter “%AppData%” and click OK. Windows will directly open up the Roaming folder which is inside the AppData folder.
   

   

3. In the AppData\Roaming folder, search and delete any unknown folders with names like Default, Chrome32, Energy, Bloom, and Travel (note that the actual name on your computer may be different, but you should look for programs with similar naming conventions).

3. Delete malicious files located in AppData\Local folder

Next, we will delete the malicious folders that are located in the AppData\Local folder and the malicious Chrome browser extensions.

1. Search for “Run” in the windows search as shown below, or press the Windows + R button to open the Run app.
2. In the run app text box, enter “%localappdata%” and click OK. Windows will directly open up the AppData\Local folder which is inside the AppData folder.
   

   

3. In the AppData\Local directory, search and delete the Default, WindowsApp and ServiceApp folders.

   Next, find the Google folder and go to Google > Chrome > User Data > Default (or Profile) > Extensions. Find the malicious extension folder within the Extensions folder and delete it. It may have a randomly generated name or may be identified as a suspicious or unknown extension.

   

4. Remove Chrome Shortcut Modification

This malware can hijack your browser shortcuts to target the malicious files. Here is a short guide on how to remove the Chrome shortcut modification:

1. Right-click on the Google Chrome shortcut on your desktop or Start Menu and select “Properties“.
2. Under the Shortcut tab, look for the “Target” field. This is where any added commands to the shortcut will be. Carefully examine the target path and remove any suspicious looking text that may have been appended, especially anything referencing the AppData folder.
   For example, remove text like “–load-extension=C:\Users%USERNAME%\AppData\Local\Default”.
   The target should point only to the chrome.exe file location, nothing more.
3. Click OK to save the changes and close Properties.
4. Launch Chrome again normally through the shortcut. The extension should no longer load on start up.

You can also right click the shortcut and select “Open File Location” to open the chrome.exe folder. Drag chrome.exe directly to your taskbar to create a clean shortcut.

Now that we have manually removed the malicious tasks and folders from your computer and cleaned your browser shortcuts, we can continue with the next step.

STEP 5: Reset your browser settings to their defaults

In this step, we will remove spam notifications,  malicious extensions, and change to default any settings that might have been changed by malware.
Please note that this method will remove all extensions, toolbars, and other customizations but will leave your bookmarks and favorites intact. For each browser that you have installed on your computer, please click on the browsers tab below and follow the displayed steps to reset that browser.

STEP 6: Use Malwarebytes to remove trojans and browser hijackers

In this step, we will install and run a scan with Malwarebytes Free to remove any infections, adware, or potentially unwanted programs that may be present on your computer.

Malwarebytes is one of the most popular and trusted anti-malware tools for Windows — and it’s completely free for removing infections. It catches threats that many antivirus programs miss, including adware, browser hijackers, and trojans. Follow the steps below to scan and clean your PC in just a few minutes.

1. Download Malwarebytes

   Click the button below to download the latest version of Malwarebytes for Windows from the official source. The free version is all you need — it will scan your computer and remove adware, browser hijackers, and other malicious software at no cost.

   

   DOWNLOAD MALWAREBYTES FOR WINDOWS (FREE)
   
   (The link opens in a new page where your download will start)

2. Install Malwarebytes

   When the download finishes, open your Downloads folder and double-click the MBSetup file. If Windows shows a User Account Control pop-up, click “Yes” to allow the installation.

   

3. Follow the On-Screen Prompts to Install Malwarebytes

   The setup wizard will walk you through a few quick screens:

   • Choose where you’re installing the program — “Personal Computer” or “Work Computer” — then click Next.

     

   • Malwarebytes will now install on your device. This usually takes under a minute.

     

   • When installation is complete, the “Welcome to Malwarebytes” screen will open automatically.

     

   • On the final screen, click Open Malwarebytes to launch the program.

     

4. Enable “Scan for Rootkits”

   Before scanning, turn on rootkit detection so Malwarebytes can find even the most hidden threats. Click the Settings gear icon on the left side of the screen.

   

   In the settings menu, find “Scan for rootkits” and click the toggle so it turns blue.

   

   Done? Click “Dashboard” in the left pane to return to the main screen.

5. Start the Scan

   Click the blue Scan button. Malwarebytes will automatically update its virus database and start checking your computer for malware.

   

6. Wait for the Scan to Finish

   The scan checks your entire system for browser hijackers and other malicious programs, so it can take several minutes. Feel free to do something else — just check back occasionally to see the progress.

   

7. Quarantine the Detected Threats

   When the scan is done, you’ll see a list of everything Malwarebytes found — malware, adware, and potentially unwanted programs. Click the “Quarantine” button to remove all of them at once.

   

   Malwarebytes will now remove the malicious files and registry entries and move them safely into quarantine.

   

8. Restart Your Computer

   Some threats can only be fully removed after a reboot. If Malwarebytes asks you to restart, click Yes. Once you’re logged back in, your PC is clean and you can continue with the next steps in this guide.

   

STEP 7: Use HitmanPro to scan your computer for rootkits and other malware

In this next step, we will scan the computer with HitmanPro to ensure that no other malicious programs are installed on your device.

HitmanPro is a second-opinion scanner — it’s designed to catch what your main antivirus might have missed. Instead of relying on a single detection engine, it checks the behavior of files in the locations where malware usually hides. Anything suspicious gets sent to the cloud, where it’s analyzed by two of the best antivirus engines available: Bitdefender and Kaspersky.

Good news: scanning is completely free, with no limits. You only need a license when it’s time to remove what was found — and even then, you can activate a free one-time 30-day trial to clean your PC at no cost. (A full license is $24.95 per year for 1 PC.)

1. Download HitmanPro

   Click the button below to download HitmanPro. Remember — the scan is free, so you have nothing to lose by checking your PC.

   DOWNLOAD HITMANPRO (FREE SCAN)
   (The link opens in a new page where your download will start)

2. Install HitmanPro

   When the download finishes, open your Downloads folder and double-click the file: “hitmanpro.exe” on 32-bit Windows, or “hitmanpro_x64.exe” on 64-bit Windows.

   

   If a User Account Control pop-up asks whether HitmanPro can make changes to your device, click “Yes” to continue.

   

3. Follow the On-Screen Prompts

   On the HitmanPro start screen, click “Next” to begin the system scan. No lengthy setup required — it goes straight to work.

   

   

4. Wait for the Scan to Finish

   HitmanPro will now check your computer for malicious programs. This usually takes just a few minutes thanks to its cloud-based scanning.
   

5. Review the Results and Click “Next”

   When the scan is done, HitmanPro will show you everything it found. Click “Next” to remove the detected threats.

   

6. Click “Activate Free License”

   To remove the malicious files, click the “Activate free license” button. This starts your free 30-day trial — no payment details needed — and unlocks the full cleanup.
   

   When the removal is complete, HitmanPro will show a summary of everything it cleaned. Click Next, then click Reboot if prompted. If there’s no reboot prompt, just click Close — your PC is clean.

STEP 8: Use AdwCleaner to remove adware and malicious browser policies

In this final step, we will download and install AdwCleaner to remove the malicious browser policies that were set by browser hijackers on your computer and delete malicious browser extensions.

AdwCleaner is a free on-demand scanner that specializes in adware, browser hijackers, and unwanted toolbars — the exact threats that mainstream antivirus programs often miss. It also includes tools that repair the damage malware leaves behind, like hijacked browser settings and malicious policies. It’s a quick scan that’s well worth running.

1. Download AdwCleaner

   Click the button below to download AdwCleaner — it’s free, portable, and requires no installation.

   

   DOWNLOAD ADWCLEANER (FREE)
   (The link opens in a new page where your download will start)

2. Run AdwCleaner

   Open your Downloads folder and double-click the file named “adwcleaner_x.x.x.exe“. There’s no installation — the program starts right away.
   

   If Windows asks whether you want to allow AdwCleaner to run, click “Yes“. When the license agreement appears, click I agree to continue.

   

3. Enable “Reset Chrome policies”

   This setting removes malicious browser policies — a trick malware uses to lock your browser settings so you can’t change them back. Click “Settings” on the left side of the window, then turn on “Reset Chrome policies“.

   

4. Start the Scan

   Click “Dashboard” on the left side of the window, then click the “Scan” button.

   

5. Wait for the Scan to Finish

   AdwCleaner will now check your computer for adware and other malware. This usually takes only a few minutes — it’s one of the fastest scanners around.

   

6. Quarantine the Detected Threats

   When the scan finishes, AdwCleaner will list everything it found. Click the “Quarantine” button to remove all the malicious items at once.

   

7. Click “Continue” to Finish the Cleanup

   Save any open work first — AdwCleaner needs to close your open programs before it can clean. When you’re ready, click the “Continue” button.
   

   AdwCleaner will now delete all detected malware from your computer. If it asks you to restart your PC, allow it — your computer will be clean when you log back in.

If the popups still come back

If you completed all steps and the site still appears, one of these is usually true:

• There is another Scheduled Task you missed (sometimes it is buried in subfolders under Task Scheduler Library)
• A startup entry is launching it (Task Manager → Startup tab)
• A malicious service is recreating tasks and policies
• Sync is reintroducing bad settings (Chrome or Edge sync)

At that point, re-check Task Scheduler and look specifically for tasks whose Actions reference:

• mshta.exe
• powershell.exe
• wscript.exe
• cmd.exe /c start http...
• any URL shorteners or unfamiliar domains

Also remember: mshta.exe itself is not what you delete. The fix is removing what is telling it to run a malicious URL.

How to avoid this infection in the future

• Avoid “free” installers, cracks, and fake driver updates.
• Be cautious with browser extensions. Recent campaigns have shown how extensions can become malicious over time.
• If a site shows urgent alerts, treat it as hostile. Universities and IT departments routinely warn that fake virus warnings are designed to push users into unsafe actions.
• Keep Windows and browsers updated, and leave SmartScreen and Safe Browsing enabled when possible.

The Bottom Line

Memory-scanner.cc popups are a symptom. The underlying cause is typically adware or malware persistence on Windows, very often a Scheduled Task abusing mshta.exe to open the site repeatedly.

If you remove the trigger (task, startup item, or script) and then clean the system with Malwarebytes, HitmanPro, and AdwCleaner, the popups usually stop for good.

FAQ

What is memory-scanner.cc?

Memory-scanner.cc is a suspicious domain associated with unwanted popups, scam redirects, and malware-driven browser launches. Many reports link it to persistence on Windows, where something on the PC repeatedly opens the site without user action.

Is memory-scanner.cc a real “virus” or just an annoying website?

The site itself is usually just the destination. The real problem is the trigger on your computer, commonly adware, a potentially unwanted program, or malware that forces Windows to open the URL repeatedly.

Why does it keep popping up even when I am not browsing?

A very common cause is a malicious Scheduled Task that runs at login, on a timer, or at startup and launches the URL automatically. Microsoft’s community guidance for memory-scanner.cc highlights Task Scheduler as the most likely persistence method.

Why do I sometimes see a blank white window instead of a normal browser tab?

In many infections, the popup is opened via mshta.exe (Microsoft HTML Application Host), which can show a simple blank window while it loads or executes web-based script content. Attackers are known to abuse mshta.exe as a “living off the land” technique to run code through a trusted Windows binary.

What is mshta.exe, and should I delete it?

Do not delete mshta.exe. It is a legitimate Windows component. The fix is to remove whatever is launching it with suspicious arguments (often a Scheduled Task or script).

Can this steal passwords or compromise my accounts?

It can, depending on what installed the popup trigger. mshta.exe abuse is a recognized technique used by real threats for execution, including running malicious scripts from a URL, which can lead to broader compromise. Treat it as potentially unsafe until the system is cleaned.

Is this caused by browser notifications?

Sometimes, but not always. If the site was allowed to send notifications, it can spam alerts even when the browser is closed. Also, the “memory-scanner.cc opens a window by itself” pattern is more consistent with a scheduled task or similar persistence than notifications alone.

Will resetting Chrome or Edge remove the problem?

Resetting the browser helps remove unwanted settings, extensions, and some hijacker changes, but it may not stop popups if a Scheduled Task or Windows-level malware is launching the site. Google still recommends resetting Chrome as part of cleanup for unwanted popups and malware symptoms.

How do I block memory-scanner.cc popups in Chrome?

You can block popups and redirects at the browser level, but this is best used as a backup, not the main fix. Chrome provides steps to block sites under Pop-ups and redirects and remove allowed entries.

What is the fastest way to confirm it is a Scheduled Task?

Open Task Scheduler and check tasks that ran at the exact time the popup appeared, then review the task’s Actions. Microsoft’s Q&A thread on memory-scanner.cc specifically calls out hidden tasks that run mshta.exe and point it to the domain.

If I remove one task but it comes back, what does that mean?

It usually means there is still a loader on the system that recreates tasks and policies, such as adware, a trojan, or another persistence mechanism. Malware-removal cases commonly report multiple malicious scheduled tasks tied to mshta.exe.

What security scans are most useful for this kind of issue?

Use reputable scanners that can detect adware, PUPs, and trojans, then remove what they find. Cases involving repeated mshta.exe popups often require more than one scan because the task is only a symptom of a broader infection.

How can I prevent this from happening again?

Avoid bundled installers, cracks, and “update” prompts from random sites. Keep your browser protections enabled, review extensions regularly, and block unknown sites from sending notifications or popups. Chrome also provides official guidance on removing unwanted popups and malware symptoms.