W11 issues with Viruses and Trojans, oh my!

Question

I have a W11 laptop that was subject to a virus/trojan attack. I got it fixed but it's back. Windows Defender say everything is hunky-dory, but the spambot actions (loading my screen with notices) still appears. I tried MalWareBots, but they only could tell me about ancient history data breaches. It cost me a lot of money to fix, and I can't afford to do that again.

Also those messages block buttons I need to communicate with others. What's the best thing to do?

Answer 1

Hi Thomas,

Since the problem came back after the laptop was previously cleaned, I’d suggest trying these steps yourself before paying for another repair:

1. Temporarily disconnect the laptop from the Internet if the pop-ups are making it difficult to use.
2. Make sure Windows and Microsoft Defender are fully updated, then go to Windows Security → Virus & threat protection → Scan options and run a Full scan.
3. If the problem is still there, run Microsoft Defender Offline. This is worth trying because the scan runs outside the normal Windows environment, which can help detect persistent malware.
4. You can also run Microsoft Safety Scanner as a second check. It’s a separate Microsoft malware-scanning tool and can sometimes detect things that a normal Defender scan doesn't.
5. After the scans, check Windows Security → Protection history to see if anything was detected. Also check Settings → Apps → Installed apps and remove anything you recently installed that you don't recognize.
6. If the messages only appear while you're browsing, check your browser's extensions and website notification permissions. Sometimes unwanted browser notifications can look like a virus even when Defender reports that the computer is clean.
7. If the same problem continues after these checks, back up your important personal files and consider doing a clean Windows installation rather than immediately paying for another repair.

Also, don't click on any suspicious "virus detected" messages or call phone numbers displayed in them. If you can, take a screenshot of one of the messages before closing it. The exact message, program name, or website shown could help identify what's actually causing the problem.

Since you've already spent money getting the laptop fixed, I'd start with Microsoft Defender Offline and Microsoft Safety Scanner before paying for another repair.

Answer 2

Hii,

If so, can you please take a screenshot of this message and post it here.

Have you had an adwcleaner analysis?

I believe it could be notification ads that appear due to the browser.

First, if you are using Edge or Chrome, you should do the following:

For Edge: Copy the link below, paste it into your address bar, and delete any sites you don't recognize: edge://settings/privacy/sitePermissions/allPermissions/notifications

Or:

Open the Edge browser > Select Settings > Privacy, search, and services > All permissions > Notifications

Remove any sites you don't recognize; the process is the same for Chrome.

https://support.microsoft.com/en-us/edge/manage-website-notifications-in-microsoft-edge

I also recommend running a scan with AdwCleaner; is free.

Thanks.

Answer 3

I assume you meant to write Malwarebytes.

Answer 4

1. Run a Microsoft Defender Offline scan. This is the best next step when malware appears to come back after cleanup, especially if it returns after restart or hides while Windows is running. Save open work first because the PC will restart.
   • Go to Start > Settings > Update & Security > Windows Security > Virus & threat protection
   • Under Current threats, select Scan options
   • Select Windows Defender Offline scan
   • Select Scan now
2. Make sure Microsoft Defender Antivirus is fully updated before scanning.
   • Go to Start > Settings > Update & Security > Windows Security > Virus & threat protection
   • Under Virus & threat protection updates, select Check for updates
   • Under Threat definitions, select Check for updates
3. Turn on the advanced protection features if they were disabled.
   • Go to Start > Settings > Update & Security > Windows Security > Virus & threat protection
   • Under Virus & threat protection settings, select Manage settings
   • Make sure Cloud-delivered protection is On
   • Make sure Automatic sample submission is On
4. If the same malware behavior continues, avoid revisiting any site or email attachment connected to the original infection. Repeated detection can happen because the malware is being downloaded again, or because a hidden component is reinstalling it.
5. If the popups and blocking behavior still continue after the offline scan, reset the PC. This is the documented next step when malware has caused persistent or irreversible changes. Back up files first. Restore files only from backups created before the infection, preferably from an external location or OneDrive version history. Backups stored on the PC during the infection may also be compromised.
6. After recovery or reset, immediately run Windows Update and update other software so known security issues are patched.

If Windows Defender reports threats but cannot remove them, also run Windows Update and, if needed, install the latest protection updates manually.

---

• Troubleshoot problems with detecting and removing malware
• Troubleshoot problems with detecting and removing malware
• Troubleshoot problems with detecting and removing malware
• Troubleshoot problems with detecting and removing malware
• Troubleshoot problems with detecting and removing malware
• Three easy steps to improve your cybersecurity