By Staff Start here: how to get malware removal help (Windows)

[Jack]

New help topics in this forum are opened with Get help. It takes a few minutes, and you can stop and come back later:

1. Answer a few questions about what happens and when it started.
2. Run FRST and attach FRST.txt and Addition.txt. Get help checks them on the spot. Only you, the helpers and the MalwareTips AI assistant can open your files; the topic itself is public.
3. A helper replies in your topic. You watch it by default and get an alert when they answer.

Open Get help →

Good to know​

• You are helped by volunteers in their free time, at no cost to you. Please be patient: your request won't be overlooked.
• Only the moderating team and the authorized Malware Removal helpers give removal instructions here. Run a fix only if it was written in your own topic: FRST fixes are made for one specific PC.
• Pirated software, cracks, keygens and "free" game repacks are the most common source of the infections we see. Tell us honestly what you installed. We will remove the malware, but we won't help keep or repair pirated software: see Piracy.
• We don't help with work or business machines. Contact your IT department instead.
• A Command Prompt window that flashes on screen is rarely malware. Ask in Troubleshooting Software, unless you also see clear signs of infection.
• Reply within 3 days, even if only to say you need more time. The forum rules apply.

Before you start​

• If you think passwords may have been stolen, change them from another, clean device (your phone is fine), starting with your email account.
• Don't delete files, folders, scheduled tasks or registry entries by hand, and don't run "cleaner" tools you found online. The logs we need are much more useful while everything is still in place.
• Don't restore anything from your antivirus quarantine, and don't add exclusions.

Reference: the preparation steps​

Get help asks for exactly this. Helpers can link this part when a member needs the steps again, for example for fresh logs.

Run FRST​

1. Download Farbar Recovery Scan Tool and save it to your Desktop. Almost every Windows 10/11 PC needs the 64-bit version (FRST64). If you are not sure, download both: only the correct one will start.
2. If your antivirus flags FRST, it is a false positive and you can allow it.
3. If Windows is not in English, rename the file to FRST64English.exe first, so the logs come out in English.
4. Right-click FRST64 and select Run as administrator. If Windows shows "Windows protected your PC", click More info → Run anyway. When the tool opens, click Yes on the disclaimer.
5. Make sure the Addition.txt box is ticked, then press Scan and wait.
6. FRST creates two logs in the same folder: FRST.txt and Addition.txt.

Microsoft Defender or your antivirus (if it found something)​

• Open Windows Security → Virus & threat protection → Protection history.
• Take a screenshot of each recent detection, with the card expanded so the threat name, date and time and Affected items are visible: press Win + Shift + S and drag over the card. Windows 11 saves it in Pictures → Screenshots; on Windows 10, click the notification that appears and save the picture.
• If you use another antivirus, take a screenshot of its detection log instead.

Optional: if you already use Malwarebytes, update it and run a Threat Scan, then export the report. To export it, open the Scanner card → Reports tab → eye icon → Export → Export to TXT. You don't need to install it just for this forum.

During the cleanup​

• Follow instructions only from the authorized helpers. Run a fix script only if it was written for your topic.
• Each time, post exactly what is asked (for example Fixlog.txt). Don't run extra tools in between unless asked.
• If you chose email notifications and none arrives within a day of a reply, check your spam folder.