How to remove a trojan that disables your security software

A trojan that interferes with antivirus protection is especially dangerous because it removes one of the main defenses against further infection. It may stop security services, block malware scanners, change administrator settings, redirect browsers, or display fake warnings designed to pressure you into installing more malicious software.

Act quickly, but avoid random cleanup utilities advertised through pop-ups. A compromised computer may be reporting false results, and downloading tools from the infected system can expose you to additional threats. Use a separate trusted device whenever possible to obtain recovery software.

The steps below focus on Windows systems, where security-related trojans commonly target Microsoft Defender and third-party antivirus programs. If the computer contains sensitive business, financial, or medical information, professional incident-response support may be safer than attempting extensive repairs yourself.

Identify the infection and limit its reach

Common warning signs include antivirus protection that cannot be enabled, unfamiliar exclusions in Windows Security, disabled firewall settings, repeated browser redirects, and processes with unusual names using significant system resources. You may also notice that Task Manager, Registry Editor, or security websites will not open.

Disconnect the affected computer from Wi-Fi and wired networks as soon as practical. Unplug external drives and avoid signing in to email, banking, cryptocurrency, or social media accounts from that device. If the trojan has encrypted files or renamed documents, preserve the system and review this ransomware file recovery guide before deleting suspicious items.

Start Windows in a safer environment

Safe Mode loads Windows with a limited set of drivers and startup programs, which can prevent some trojans from launching. Hold Shift while selecting Restart, then choose Troubleshoot, Advanced options, Startup Settings, and Restart. Select Safe Mode without networking unless you specifically need an online recovery tool.

After signing in, check whether security software can open. Do not assume that a normal-looking desktop means the malware is gone. A trojan can remain dormant in scheduled tasks, startup folders, services, browser extensions, or user profile directories while waiting for regular mode to return.

If Safe Mode is blocked, use another computer to create a Windows installation or recovery drive. Boot from that trusted media and use its repair or offline scanning features. This prevents the active malware from controlling the environment in which its files are examined.

Restore access to security tools

Open Windows Security and inspect Virus & threat protection, Firewall & network protection, and App & browser control. Remove unfamiliar exclusions only after recording their locations. A malicious exclusion can allow an entire folder or process to bypass scanning.

Check Windows Services for important protection components, including Microsoft Defender Antivirus Service and Windows Security Service. Their startup configuration should not be altered casually, and a service that immediately stops may indicate remaining malware or policy manipulation. Avoid downloading unofficial registry scripts that promise to repair Defender with one click.

Use Microsoft Defender Offline when available. It restarts the system and scans before the usual Windows environment loads, making it harder for a rootkit or persistent trojan to hide. You can also use a reputable emergency rescue disk from a recognized security vendor, downloaded from its official website on a clean device.

Compare practical scanning options

Scanning method	Best use	Main limitation
Safe Mode scan	Removing basic startup malware	Some advanced threats can still load
Microsoft Defender Offline	Detecting persistent Windows threats	Requires a restart and may need recovery access
Reputable rescue disk	Scanning when Windows is heavily compromised	Must be created on a clean computer
Second-opinion scanner	Finding adware, PUPs, and missed trojans	It should come from a verified publisher
Professional analysis	Business systems, rootkits, or repeated reinfection	May involve cost and temporary device downtime

Run a full scan rather than a quick scan, and allow the scanner to quarantine or remove confirmed malicious files. Record detection names and file paths before cleanup. Those details can help identify whether the infection is a downloader, banking trojan, remote-access tool, or part of a wider compromise.

Remove persistence and repair damage

Review installed applications, browser extensions, startup entries, and scheduled tasks for software you do not recognize. Pay attention to items created shortly before the symptoms began. Do not delete legitimate system components solely because their names look unfamiliar; verify the publisher and file location first.

After malware removal, reset browser settings and uninstall extensions that were not intentionally added. Change passwords from a separate clean device, beginning with email and financial accounts. Enable multifactor authentication where possible, because a trojan may have captured saved credentials, cookies, or keystrokes.

If Windows remains unstable, use System Restore, Startup Repair, or a repair installation from trusted Windows media. Keep personal files only when their safety is reasonably established. For extensive corruption or repeated reinfection, a clean operating-system installation is often more reliable than endless manual edits. Review the site disclaimer for the educational scope of malware-removal information before proceeding.

Reduce the risk of another infection

Recovery is incomplete until security controls are working again and the original entry point has been addressed. Update Windows, browsers, drivers, and security products, then confirm that real-time protection and the firewall are active. Remove pirated applications, unauthorized activators, and suspicious browser notifications, which are frequent sources of trojans.

Use these safeguards after the system is clean:

• Keep automatic updates enabled for Windows and installed applications.
• Maintain offline or versioned backups that cannot be modified from the everyday user account.
• Download programs only from official websites or trusted app stores.
• Treat unexpected attachments, login pages, and urgent payment requests as suspicious.
• Use a standard user account for daily activity and reserve administrator access for necessary changes.

If security software is disabled again, isolate the computer immediately instead of repeatedly reinstalling antivirus products. Save relevant detection reports, note recent downloads or email attachments, and seek qualified assistance when the infection involves business accounts, confidential data, or signs of unauthorized remote access.

Use a clean device to secure your accounts, create trusted recovery media, and begin the scan-and-repair process before reconnecting the affected computer to the internet.