: Apply all pending Windows and application updates to patch the vulnerabilities that allowed the initial infection.

: This tool can detect and remove deep-seated threats like rootkits that hide while the operating system is running.

: Immediately turn off Wi-Fi or unplug Ethernet cables. This prevents the malware from communicating with its command-and-control servers, exfiltrating data, or spreading to other devices on your network.

: Once the system is clean, change passwords for all major accounts and enable multi-factor authentication (MFA) .

: Some fake antivirus clones override the "shell" registry key to launch themselves instead of the Windows interface. You can check this in regedit under Software\Microsoft\Windows NT\CurrentVersion\Winlogon and ensure the "Shell" value is set to explorer.exe .

: Use Task Manager or MSConfig to disable any suspicious startup programs with random-letter filenames (e.g., "guard-abc.exe"). 5. Post-Removal Hygiene

: Use reputable tools such as Malwarebytes or Kaspersky to perform a deep scan. 4. Advanced Manual Cleanup (If Necessary)