Step-by-step cleanup of a drive-by download infection on Windows

A drive-by download infection begins when a compromised website, malicious advertisement, or deceptive pop-up causes unwanted software to download without a clear user action. The downloaded file may be a trojan, spyware, ransomware loader, or browser hijacker. In some cases, the infection succeeds through an unpatched browser or Windows component before a file is visibly saved.

Typical warning signs include unexpected browser redirects, new extensions, security alerts from unfamiliar programs, high CPU or disk usage, and files appearing in the Downloads folder. Treat these symptoms seriously, especially if they began after visiting a questionable website or clicking a fake update notice.

The safest cleanup approach is methodical. Disconnect the affected computer, scan it with trusted tools, remove persistence mechanisms, restore browser settings, and verify that Windows and installed applications are fully patched.

Disconnect the computer and record symptoms

Unplug the Ethernet cable or disable Wi-Fi before removing anything. This can interrupt communication with a command-and-control server and reduce the chance of additional payloads being downloaded. Do not log in to banking, email, social media, or work accounts from the infected machine.

Write down what happened and when it started. Note the suspicious website, pop-up wording, downloaded filename, unusual process, or ransom message. If files have been encrypted, avoid renaming them or using random recovery utilities. Preserve a few affected files and any ransom note for later identification.

Start with trusted Windows security tools

If Windows is still responsive, open Windows Security from the Start menu rather than clicking a security warning displayed in the browser. Select Virus & threat protection, update security intelligence, and run a Full scan. A full scan takes longer than a quick scan but examines more locations where malware may hide.

After the scan, review detected items and quarantine them. Do not restore a file simply because its name looks familiar. If Windows Security cannot start, closes unexpectedly, or reports that settings are controlled by an unknown administrator, treat that behavior as a sign of deeper tampering.

Use Safe Mode when malware resists removal

Persistent threats may launch at startup and block security software. Restart Windows into Safe Mode, which loads a limited set of drivers and services. From there, remove suspicious applications and run another full scan. Microsoft Defender Offline can also scan before the normal Windows environment loads, making it useful against boot-time malware.

For a careful walkthrough of startup options, system checks, and removal techniques, follow these Safe Mode instructions. Create a restore point only after the system is clean; restoring to an earlier state can reintroduce malicious files or registry settings.

Remove the downloaded payload and persistence

In Safe Mode or normal Windows, inspect Settings > Apps > Installed apps and sort entries by installation date. Uninstall software that appeared around the time of the incident, particularly fake browser tools, media players, update utilities, or programs with no recognizable publisher. Avoid deleting legitimate drivers or security components based only on a vague name.

Check the Downloads folder, desktop, temporary folders, and browser download history. Delete the malicious installer after security tools have quarantined it. Then inspect Task Manager > Startup apps, browser extensions, scheduled tasks, and unfamiliar services. Disable or remove entries that launch an unknown executable from a temporary, roaming, or randomly named folder.

Location	What to check	Safe response
Installed apps	Recently added software and unknown publishers	Uninstall suspicious entries
Startup apps	Programs launching at sign-in	Disable unfamiliar items and investigate their file paths
Browser extensions	New or unrecognized add-ons	Remove them and reset browser settings
Scheduled tasks	Tasks created near the infection time	Disable suspicious tasks after checking the action
Downloads and temporary folders	Installers, scripts, and randomly named files	Quarantine or delete confirmed malware

Do not run registry cleaners or manually erase registry keys without a verified reason. Incorrect changes can damage Windows and make later forensic analysis harder. If a file is clearly malicious but cannot be removed, record its path and scan it with a reputable security product rather than opening it.

Repair browsers and check account security

A drive-by download often changes the browser even when the main payload has been removed. Remove unfamiliar extensions, restore the default search engine and homepage, and clear site permissions for notifications, pop-ups, and automatic downloads. Reset the browser if redirects continue, but save essential bookmarks first.

Review proxy settings, DNS configuration, and browser shortcuts. A hijacker may append a malicious URL to a shortcut or route traffic through an unwanted proxy. Change passwords from a separate, clean device and enable multifactor authentication if the infected computer was used for sensitive accounts. Follow current security news for emerging campaigns and newly abused vulnerabilities.

Recommended cleanup checks

Use the following checklist after the main removal steps:

• Run a second scan with a reputable on-demand malware scanner.
• Install Windows updates, browser updates, and security intelligence updates.
• Review recent sign-ins and revoke sessions that were active during the infection.
• Check personal files for encryption, deletion, or unexpected changes.
• Back up clean documents to an external drive or trusted cloud account.

Keep suspicious files isolated instead of sending them to contacts or uploading them to random analysis websites. If ransomware, credential theft, or repeated reinfection is involved, disconnect the device and seek qualified incident-response help before making extensive changes.

Verify the system and prevent another infection

Restart Windows normally and observe whether redirects, pop-ups, unknown processes, or security warnings return. Run another scan, confirm that Windows Security is active, and check that the firewall and automatic updates are enabled. Test network access only after the computer appears stable.

Reduce future exposure by keeping browsers patched, removing unused extensions, blocking intrusive notifications, and avoiding downloads offered through advertisements or unexpected alerts. For Windows-specific security guidance and maintenance resources, use the Windows security guide. Complete the cleanup, change exposed passwords from a clean device, and maintain a fresh backup so a future drive-by attack has fewer opportunities to cause lasting damage.