Windows Security · Is My PC Hacked? · Lesson 4 of 5

Cleaning Up and Recovering

Scan deep, secure your accounts, and know when to reset or get help.

Scanning deep and starting fresh

After you remove anything suspicious, scan the PC to catch what you missed. Some harmful software hides while Windows is running. It can even block a normal scan.

That is what the Microsoft Defender Offline scan is for. It restarts the PC and scans before Windows starts, so hidden software has no chance to fight back.

1. Save your work and close your apps. The PC will restart.
2. Open Windows Security, then Virus & threat protection.
3. Click Scan options.
4. Choose Microsoft Defender Antivirus (offline scan), then Scan now.

The PC restarts, runs the scan, and restarts again when it is done. To see what it found, open Windows Security and go to Protection history.

Also install all waiting updates, as you learned in an earlier track. They close holes that attackers use.

Sometimes cleaning is not enough. Resetting the PC reinstalls Windows. It is the surest way to remove anything a stranger left behind. Consider it if:

• a scammer had remote control and you can't be sure what they did,
• fake errors or strange programs keep coming back,
• scans keep finding new threats.

Go to Settings, System, Recovery, then Reset PC. Keep my files removes apps and settings but keeps your documents. Remove everything wipes it all. Back up your files first either way.

Get professional help if this feels like too much, or if money or business data is involved. Choose a repair shop you find yourself, never one from a pop-up or a caller. For a work computer, tell your IT team right away.

Passwords, email rules and reporting

If someone got into your PC, assume they may have seen your passwords. Change them, but do it from a clean device. That means a phone, tablet, or another computer you trust. A keylogger is harmful software that records every key you press. If one is still on the PC, it could catch your new passwords too.

Change the most important ones first:

1. Your email, because it can reset every other password.
2. Your bank and payment accounts.
3. Your Microsoft account, then everything else.

As you learned in an earlier course, turn on two-step verification and use sign out everywhere to kick out anyone still signed in.

Next, check your email for forwarding rules. A forwarding rule sends copies of your mail to another address automatically. Attackers set one up quietly so they keep reading your mail after you change the password.

• In Outlook.com, open Settings, then Mail, and look at Forwarding and Rules.
• In Gmail, open Settings, See all settings, then Forwarding and POP/IMAP and Filters and Blocked Addresses.

Delete any rule or forwarding address you didn't make.

Finally, report what happened. It helps you and protects others.

• If you paid or shared card or bank details, call your bank or card company right away. Use the number on your card.
• Report tech support scams to Microsoft at microsoft.com/reportascam.
• In the United States, you can also report fraud to the FTC at reportfraud.ftc.gov.

Feeling embarrassed is normal. These scams fool careful people every day. Acting quickly is what counts.