How to Remove Fake Antivirus Software on Windows

What Causes This?

Fake antivirus software usually gets installed through deceptive pop-ups, bundled downloads, fake software updates, or malicious email attachments. Its goal is to scare you into paying for a useless “full version” or to trick you into giving up personal information. In many cases, it also changes startup settings, browser behavior, and security options so it keeps running after a restart.

Common Symptoms

• Constant virus warnings or security alerts from a program you don’t recognize
• Pop-ups telling you to pay immediately to remove threats
• Your browser redirects to suspicious websites or fake support pages
• Windows Security is disabled or you can’t open normal security tools
• The PC feels slower and unknown apps start automatically

How to Fix It Manually

1. Disconnect from the internet

   • Turn off Wi-Fi or unplug the Ethernet cable.
   • This can stop the fake antivirus from downloading more malware or sending data out.

2. Boot into Safe Mode

   • Press Windows + I to open Settings.
   • Go to System > Recovery.
   • Under Advanced startup, click Restart now.
   • After restart, choose Troubleshoot > Advanced options > Startup Settings > Restart.
   • Press 4 for Safe Mode or 5 for Safe Mode with Networking if you need internet access for antivirus updates.

3. End suspicious processes

   • Open Task Manager with Ctrl + Shift + Esc.
   • Look for unfamiliar apps using high CPU, memory, or showing suspicious names.
   • Right-click the suspicious process and choose Open file location to see where it runs from.
   • If it looks fake or is in a strange folder, go back, right-click it, and select End task.

4. Uninstall the fake program

   • Press Windows + I, then go to Apps > Installed apps.
   • Sort by Install date and look for recently installed unknown security tools or suspicious software.
   • Click the ... menu next to the app and choose Uninstall.
   • If it refuses to uninstall, note the program name and continue with the next steps.

5. Run Microsoft Defender Offline scan

   • Open Windows Security from the Start menu.
   • Go to Virus & threat protection.
   • Under Scan options, select Microsoft Defender Offline scan.
   • Click Scan now. Your PC will restart and scan before Windows fully loads, which can remove harder-to-delete threats.

6. Check startup items and browser extensions

   • Open Task Manager and click the Startup apps tab.
   • Disable unknown items by right-clicking them and choosing Disable.
   • In your browser, open the extensions or add-ons page and remove anything you don’t recognize.
     • Chrome: chrome://extensions
     • Edge: edge://extensions

7. Delete leftover files and temporary junk

   • Press Windows + R, type %temp%, and press Enter.
   • Delete the files you can. Skip any that are in use.
   • Also check C:\Program Files, C:\Program Files (x86), and C:\Users\YourName\AppData\Local for folders matching the fake antivirus name.
   • Empty the Recycle Bin when finished.

8. Review scheduled tasks and reset security settings

   • Press Windows + S, type Task Scheduler, and open it.
   • Check Task Scheduler Library for tasks with random names or tasks tied to the fake antivirus. Right-click and choose Delete.
   • Then open Windows Security and confirm Virus & threat protection is working again.
   • If your browser still acts strangely, reset it from the browser’s Settings menu.

Fix It Automatically with Kudu

Fake antivirus programs often leave behind startup entries, junk files, scheduled tasks, and other suspicious leftovers even after you remove the main app. Kudu can scan for these remnants, help clean them up safely, and make it easier to spot unwanted software that keeps coming back.

Download Kudu Free →