Infected PC with CloudFlare+R PowerShell malware

Question

In trying to enter a website, I think I'm a victim of the fake CloudFlare Windows+R PowerShell attack. I believe I pasted and ran the malicious, encoded PowerShell command, which may have downloaded the information stealing malware. I tried running scans from Malwarebytes and Windows Defender but no dangerous malware was detected. Can anyone help me to clean this up?

Answer 1

Because the PowerShell command may have installed information-stealing malware that current scans did not detect, treat the device as potentially compromised and follow a layered cleanup and recovery approach.

1. Run stronger Microsoft malware scans

• First run the built-in Malicious Software Removal Tool:
  1. Press Windows key + R.
  2. Type %windir%\system32\mrt.exe and select OK.
  3. Approve the UAC prompt.
  4. Choose a Full scan and let it complete, removing anything it finds.
• Then run a Microsoft Defender Offline scan to catch hidden or persistent components:
  1. Select Start > Settings > Update & Security > Windows Security > Virus & threat protection.
  2. Under Current threats, select Scan options.
  3. Select Windows Defender Offline scan and then Scan now.
  4. The PC will restart and scan outside of Windows.

If malware keeps coming back or was only partially removed, repeat the offline scan until it reports clean.

2. Make sure Defender is fully updated and using cloud protection

Before and after scanning, ensure Microsoft Defender Antivirus is up to date and using cloud-based protection so it can detect newer threats:

1. Go to Start > Settings > Update & Security > Windows Security > Virus & threat protection.
2. Under Virus & threat protection settings, select Manage settings.
3. Confirm Cloud-delivered protection and Automatic sample submission are On.
4. Under Virus & threat protection updates, select Check for updates, then under Threat definitions, select Check for updates.

If suspicious files are still not detected, submit them to Microsoft for analysis using the file submission portal referenced in the context.

3. Assume possible data theft and protect accounts

Because information-stealing malware may have run, assume credentials and sensitive data could be exposed:

• From a separate, known-clean device, change passwords for:
  • Microsoft account
  • Email accounts
  • Banking, shopping, and other critical services
• Enable multi-factor authentication (MFA) wherever possible.
• Monitor financial accounts and important services for unusual activity.

4. If system behavior remains unstable, consider reset/reinstall

If after cleaning the system still shows signs of compromise or instability (unusual slowness, crashes, blocked security tools, browser redirections), malware may have made deeper or irreversible changes.

In that case, use Windows recovery options:

• Back up important files to an external location (preferably backups from before the infection, such as OneDrive versions).
• Use Reset this PC / recovery options for Windows 10 or 11 to reinstall Windows. Prefer a reset that reinstalls Windows while keeping personal files, or a full reinstall if needed.
• After reinstalling, immediately apply all Windows Updates and install current security software before restoring additional files.

5. Prevent future infections

• Use a modern browser such as Microsoft Edge with Microsoft Defender SmartScreen enabled to block malicious or compromised websites.
• Be cautious of any site that asks to run commands (especially via Windows+R or PowerShell) or to install “security” tools or browser updates via pop-ups.
• Avoid sites that provide illegal downloads or pirated content, which are common malware sources.

If at any point malware cannot be removed or the system remains suspicious, treat a full reset/reinstall as the safest option.

---

References:

• Antivirus and antimalware software: FAQ
• Troubleshoot problems with detecting and removing malware
• Microsoft resources and guidance for removal of malware and viruses
• Prevent malware infection
• Protect yourself from online scams and attacks