So you clicked the link, maybe an invoice that looked legit, maybe a login page that wasn't, and now your Windows 11 machine feels like it belongs to someone else. What do you actually do in the first ten minutes, before the malware finishes digging in? Not next week, not after you've read forty forum threads on your phone, but right now. That single question is where most phishing recovery goes right or goes badly wrong, and it's the one I get asked more than any other.
Most of what follows came straight out of a call with Raymond Holst, who runs a small accounting firm across town in Ballantyne. He phoned me the week a client forwarded his staff a booby-trapped invoice attachment and nobody in the office knew whether to click, delete, or unplug. His people aren't IT; Raymond needs steps that work without someone hovering over every machine, so I gave him the answers in the order the questions actually show up when a box gets hit. Same order here.
Windows 11 raised the floor on hardware security, insisting on a Trusted Platform Module (TPM) 2.0 chip before it'll even install, but a reinforced front door does nothing if you personally buzz the intruder in. A phishing click is exactly that: you turning the deadbolt for them. At that point the malware isn't a file waiting to be deleted. It's a squatter who has already changed the locks.
When to run a scan after noticing a threat
No. Every instinct says to launch a full scan and watch the numbers climb, but that's like spotting a burglar in your kitchen and starting a room-by-room inventory while he's still filling his bag. Lock the door first.
Pulling the network is that locked door. Yank the ethernet cable, kill the Wi-Fi, do it before anything else. Most phishing payloads are built to phone home the second they land, reaching out to some remote server for the next set of instructions or to start quietly shipping your files out the back. Cut the connection and you've snipped the thief's radio link to the rest of his crew. Need to look up a fix? Do it from your phone or a clean laptop, never the sick machine. The takeaway is blunt: your first move is to disconnect, not to scan.
A scan from inside Windows can lie to you
Here's the part most how-to guides skip. A scan you run from inside a live copy of Windows can come back clean and still be wrong. Some infections burrow in deep enough that the operating system can't be trusted to report honestly on itself. Picture a CCTV feed where the intruder has looped ten minutes of an empty hallway. The camera's on. It's just showing you a lie.
The fix is to scan from outside the running system. Windows 11 ships with Microsoft Defender Offline, which reboots into a trusted environment and checks the drive before the infected copy of Windows ever loads; a bootable rescue scanner on a USB stick does the same job. And before you treat any single hit as gospel, remember that telling a genuine infection from an antivirus getting overzealous and quarantining a clean file is its own judgment call—the first one worth making during an active recovery.
Working backwards from a live infection to figure out which link in the chain your protection actually missed is a rabbit hole of its own—I wrote it up separately in How to Stop Phishing Attacks After a Corporate Security Breach. Keeping malware from tunneling that deep in the first place is less about removal and more about the protection you configure before anything goes wrong.
Cleaning up with Safe Mode and registry checks
Yes, the offline scan is not the finish line. Once it's done, don't boot straight back into normal Windows. Come up in Safe Mode with Networking instead. Safe Mode loads only the essential drivers and skips most third-party startup junk, which is the digital version of cutting power to every room but the one you're standing in. It makes it far harder for a leftover payload to relaunch itself.
Automated tools miss persistence tricks even after scanning. A common one: the malware barely touches the temp folder but slips a command into a startup registry key, so the next time you log in it quietly re-downloads itself. Delete the visible "virus" and that key still sits there like a timer, inviting the intruder back in.
So I audit a few spots by hand in the Registry Editor. The two Run keys are the usual suspects—the per-user one under HKEY_CURRENT_USER and the machine-wide one under HKEY_LOCAL_MACHINE, both ending in Software\Microsoft\Windows\CurrentVersion\Run. Then Task Scheduler gets a look for anything I didn't create, especially entries with junk names like 'dh39sk2' pointed at some tucked-away folder in AppData. Find a task set to fire every hour into a hidden directory and you've found the thing that would have re-infected the machine by morning. The usable rule: removal isn't done until the startup and scheduled-task entries are clean, not just the files.
Repairing what the malware left broken
Getting the malware out is only half of it—the mess it leaves behind is the other half. Nasty payloads like to break Windows Update, switch off the firewall, or swap out core system files on their way in, partly to make themselves harder to remove. Two built-in commands clean most of that up: System File Checker (run sfc /scannow) and DISM, the image-servicing tool. Think of them as the structural engineers who walk through after the break-in and check whether anyone punched holes in the load-bearing walls.
Sometimes the OS stays twitchy even after the infection is gone—sluggish menus, high CPU sitting idle, the general sense that something's still off—because a swapped-out system file never got restored cleanly. When a machine is stuck in that gap between "scans clean" and "actually works right," a dedicated repair pass can rebuild the corrupted components without forcing a full reinstall; I get into which one I reach for in the Best Malware Removal and System Repair Tool for Slow Windows PCs. The point to hold onto: a system that boots is not the same as a system that's repaired.
Securing your passwords and browser after infection
Change them—all of them—but not from the machine you just cleaned. If you got phished, the attacker may be sitting on your credentials whether or not the malware is gone, so resetting passwords is non-negotiable. Do it from a device you know is safe while the recovered rig finishes its last checks. Resetting from the compromised PC first just hands the new keys straight back.
Browsers deserve a second look too. Phishing kits love to drop a malicious extension that logs keystrokes or quietly reroutes traffic long after the main infection is scrubbed. Open the extensions list and the Sync settings in Edge or Chrome—I've seen a compromised account syncing a bad extension out to every device the person had ever signed into, like a thief leaving a spare key under the mat of every house on the street. Pull anything you don't recognize, then sign out everywhere and back in.
The setup that keeps you off this page
The best malware removal is the attack that never lands, which is really a licensing-and-configuration question, not a heroics question. For a while my own answer was the free tier of Malwarebytes running a scheduled scan every night, and I told myself that was enough. It wasn't—a scan that only walks the halls at 2 a.m. is a night watchman who clocks in after the break-in, and scheduled-only coverage with no real-time protection is exactly the gap phishing walks through. That's the whole difference between a scanner reacting on a timer and one watching the door as it happens.
For a shop like Raymond's, the math is mostly about covering every machine on one manageable license and not getting ambushed by a renewal that quietly climbs when the year's up—grumble about the second part all you want, but budget for it. Kevin, a sysadmin I trade benchmark notes with over a private Discord, would just tell you to run Linux on everything (he does, on every box he personally owns)—which is great right up until your whole office lives in Windows 11.
After four years of paying for and breaking every suite I could get onto my own machines, I trust boring, layered defaults over any single clever product. The whiteboard over my desk in the spare room here in Matthews is nothing but install dates and renewal reminders, and the loudest thing that happens most days is the battery backup under the desk thumping over during a grid flicker while a scan keeps running like it never noticed. If you want the version of this that runs itself, I laid out the arm-it-and-forget-it settings in How to Configure Ransomware Protection Settings on a Home PC. Security isn't a thing you buy once—it's a row of locked doors and alarm sensors somebody has to actually arm every night.