safe usage after being hacked

Run Microsoft Defender Offline, update Windows, and secure every account from a different trusted device; if an unknown person had remote access or suspicious behavior continues, perform a clean Windows installation rather than relying only on scans.

1. Check the computer before using it for sensitive activity

Until these checks are complete, avoid banking, shopping, email-password changes, or entering payment information on the affected computer.

1. Save any open work.
2. Open Start → Windows Security → Virus & threat protection → Scan options.
3. Select Microsoft Defender Offline scan → Scan now. The computer will restart and scan outside normal Windows, making persistent malware more difficult to hide.
4. After Windows restarts, open Windows Security → Protection history and review the result.
5. Then select Virus & threat protection → Scan options → Full scan → Scan now. A full scan checks every file and program. ^1^
6. Go to Settings → Windows Update → Check for updates and install everything offered. Restart, then check again until no further updates are available. Microsoft recommends applying all security updates after a suspected support scam or compromise. ^2^

If McAfee is currently your active antivirus, update it and run its full scan as well. Do not remove it merely to run these checks.

2. Remove unauthorized remote-access software

If either support session was not initiated by you through an independently verified McAfee or Microsoft support channel, treat it as potentially fraudulent.

1. Open Settings → Apps → Installed apps.
2. Sort by installation date.
3. Look for software installed during the incident, particularly remote-control or unfamiliar support applications.
4. Uninstall software that the unverified caller or pop-up instructed you to install.
5. Do not accept another remote connection unless you initiated the request through an official support channel. Microsoft specifically warns that remote helpers can see or control the PC and should be allowed only when trusted. ^3^

A browser warning or pop-up displaying a telephone number is not a Microsoft security alert—Microsoft error and warning messages do not include phone numbers. Remote-access scams may install malware or unwanted programs. ^2^

3. Secure accounts from another trusted device

Use a phone or another computer that was not involved in the incident:

1. Change the password for the primary email account first, because it can reset other accounts.
2. Change Microsoft, banking, shopping, social-media, and other important passwords.
3. Use a different, strong password for each account.
4. Review Microsoft-account security information and remove phone numbers, email addresses, or sign-in methods you do not recognize.
5. Enable Microsoft Authenticator or another supported multifactor sign-in method. Microsoft recommends keeping recovery information current and adding stronger sign-in methods. ^4^
6. For Outlook/Microsoft accounts, inspect connected accounts, forwarding, and automatic replies for unauthorized changes. Microsoft’s recovery sequence is to clean the PC first, then change the password and review account settings. ^5^

If payment information was disclosed or a payment was made, contact the bank or card issuer immediately and review transactions.

4. When a clean installation is appropriate

No scan can provide absolute certainty after an attacker had administrative or remote access. Perform a clean installation of Windows if:

• threats return after restarting;
• Defender reports a threat as only partially removed;
• unknown remote activity, pop-ups, account changes, or disabled security settings continue;
• the identity of the person who accessed the computer cannot be verified; or
• maximum assurance is required.

Back up only personal documents and photos—avoid copying unknown programs, scripts, or installers. Prefer a backup made before the incident because backups present during an infection may also have been modified. Microsoft recommends a clean installation when malware problems continue; it removes personal files, applications, and settings from the selected drive. ^6^

A clean installation is destructive. Create Windows installation media on a separate trusted PC, boot the affected computer from it, and choose the clean-install option. Microsoft documents that this removes personal files, apps, settings, and manufacturer customizations. ^7^

After reinstalling, fully update Windows before restoring files or signing into important accounts.

References

1. Virus and Threat Protection in the Windows Security App | Microsoft Support
2. Protect yourself from tech support scams | Microsoft Support
3. Solve PC problems remotely using Quick Assist | Microsoft Support
4. How to help keep your Microsoft account secure | Microsoft Support
5. How to recover a hacked or compromised Microsoft account | Microsoft Support
6. Recovery options in Windows | Microsoft Support
7. Reinstall Windows with the installation media | Microsoft Support