What to Do if Your Antivirus Stops Working

It’s an outrage! You installed an antivirus tool, just like PCMag told you to, but your device got infested with malware anyway! Before you totally fly off the handle, consider a few things. Are you sure you set your antivirus subscription for automatic renewal? Have you checked in case the antivirus is trying to tell you about a problem? Even if there’s nothing off-kilter, it’s still possible for software—even security software—to simply fail.

There are various scenarios in which ransomware, spyware, or some other malicious program could weasel its way onto a computer despite your antivirus protection. If this happens to you, don’t panic! Keep a clear head and follow the suggestions below to recover from the attack.

Did My Antivirus Stop Working?

Typically, the only time you notice an antivirus utility is when it pops up a notification patting itself on the back for detecting and eliminating a malware attack. Sure, some of them notify you when they’ve updated, others display a monthly report on just what they’ve done for you. But much of the time, your security protection should just hum along in the background.

That’s why it’s a good idea to check that your antivirus is working from time to time. Find its icon in the notification area at the bottom right of the screen. If you don’t see it, click the icon to show hidden items. In Windows 10 and Windows 11, that icon looks like an oversized caret ^. Right-click the antivirus icon and click the menu choice that opens it.

Just about every antivirus displays a green icon, banner, or image on its main window when all the settings are fine. If you see red, or yellow, something’s not right. Typically, the antivirus tells you what’s wrong, and often there’s a button or link to fix things. You might need to dig into settings to correct whatever problem is keeping you from seeing green.

Got green? That’s good, but while you’re here, check statistics like the most recent antivirus signatures update, the last program update, and the latest scan. You could also proactively tell the antivirus to check for updates now, and then run a full scan. Now it’s working for sure!

It’s Surprisingly Easy to Be More Secure Online

My Antivirus Stopped Working!

If your settings were wrong, or your antivirus wasn’t up to date, malware may have slipped past while it was indisposed. How would you know if you have malware?

Some infestations are blatant, revealing their presence by forcing pop-up ads even when you’re not using the browser, or redirecting your surfing to undesirable pages. Ransomware gets in your face, demanding cash to decrypt your important files. Some take advantage of your antivirus hiatus by electing themselves to fill the gap. They pretend to be security software, warning you of made-up malware dangers and offering to “fix” them, for a price. The boldest ones use the logos and styles of actual security tools. The one pictured just below tells you again and again that it’s Windows Defender…but it isn’t.

Other types of malware are more subtle. Did someone hack your passwords? A Trojan might have been involved. Social media malware makes posts as if they were your own, and goes on to infect friends who click links in the posts. And of course, at times there’s no sign at all that a malware attack took place—until you find your bank account drained, or your home loan declined due to some bozo destroying your credit.

How to Recover From a Malware Attack

It happens. Sometimes even though your antivirus is fully updated and functional, a wily zero-day new malware strain slips past it. If the antivirus doesn’t recognize the threat, either by its malware signature or its behavior, you need to bring in the SWAT team.

Most antivirus companies offer a rescue disk, in the form of an ISO file that you burn to CD or DVD, or install on a USB drive. Booting from the rescue disk launches a separate operating system, typically Linux-based, with an antivirus built in. If the malware eluded your antivirus because it hoodwinked Windows, the rescue disk can really help. Bitdefender Antivirus Plus makes cleanup even easier with the option to boot into Rescue Mode, no disk required.

First, check to see if your antivirus offers a rescue disk. Found it? Download and burn that disk now, while you can. Don’t wait until after malware is already running roughshod in your system.

You can also bring in an aggressive cleanup-only tool like Malwarebytes Free. Such tools often come with a warning that collateral damage is possible, but if you’ve got an active malware infestation, you’ll probably take the risk. Most are free, so if one doesn’t do the job, you can give the next contender a chance.

Norton AntiVirus Plus takes an unusual approach, as do the Norton security suite products. At the end of a scan, it says, “If you think there are still risks, click here”. Clicking launches Norton Power Eraser, Norton’s take on an aggressive cleanup tool. Even if you’re not a Norton user, you can download and run this tool at no cost.

Ransomware Encrypted My Files

If a Trojan or virus infests your system because your antivirus was out of date or just plain missed the attack, you can recover using the techniques described above. However, if ransomware was involved, you’re in deep trouble. Detecting and deleting the malicious program doesn’t do anything to restore your encrypted files.

You might consider biting the bullet and paying the ransom, but think twice before you do that. There’s no guarantee that paying up will get your files back, and no real incentive for the crooks to decrypt your files once you’ve paid. It’s not like you can report them to the Better Business Bureau.

If the encrypted files are important enough, hiring an expert to recover them might seem logical. Before you do, though, research the company thoroughly. A UK sting operation revealed that some so-called experts simply pay the ransom, and then charge you the ransom price plus their own cut.

In truth, there may be no need to hire an expert. When researchers crack a ransomware strain’s encryption, they typically make a decryption tool freely available. The ransom note almost always includes the name of the strain, and a web search on “ ransomware decryption tool” should turn up a solution, if one exists. Kaspersky, McAfee, and Trend Micro are among the many antivirus companies that offer such tools.

There is, of course, the possibility that your files are permanently gone, with no chance of recovery. If that thought fills you with dread, go right now and set up a comprehensive online backup system for your most important files. These days you can get terabytes of backup storage for a reasonable price. Now if ransomware strikes, you can use the techniques described above to eliminate the attacker and then simply restore your files from backup.

Get a New Antivirus

If malware eluded your antivirus even though it was fully up to date, well, it had just one job to do…and it failed. Not all security products are created equal. Independent antivirus testing labs hand out a wide range of test scores, from perfect to perfectly awful. We’ve put dozens of antivirus tools to the test (you can read about our antivirus testing procedures here), so if you’re thinking of a change, please peruse our detailed antivirus reviews to help you make the best choice. Let’s hope you never experience a failure of your antivirus protection.