Safe Mode loads only the essential drivers and services, which often prevents the malware from launching automatically during startup. 3. Use Official Removal Tools

: Download this free tool on a clean computer and run it from a USB drive if your infected PC cannot access the web.

: Some fake antivirus clones override the "shell" registry key to launch themselves instead of the Windows interface. You can check this in regedit under Software\Microsoft\Windows NT\CurrentVersion\Winlogon and ensure the "Shell" value is set to explorer.exe .

: Apply all pending Windows and application updates to patch the vulnerabilities that allowed the initial infection.

: Use Task Manager or MSConfig to disable any suspicious startup programs with random-letter filenames (e.g., "guard-abc.exe"). 5. Post-Removal Hygiene