I Sent You An Email From Your Account Email Scam

Also Known As: possible malware infections
Distribution: Moderate
Damage level: Severe

"I sent you an email from your account" removal guide

What is "I sent you an email from your account"?

"I sent you an email from your account" is a spam email campaign (scam) used by cyber criminals who threaten to proliferate compromising/humiliating videos of recipients if their ransom demands are not met. This is a common scam, and one of many similar versions. If you receive this email, simply ignore it and do not believe any of the statements within the message. The email is proliferated via an "email spoofing" method used to falsify the sender's email address. In this way, scammers behind this email make it seem as if the recipient of the email is also the sender.

I sent you an email from your account spam campaign

Cyber criminals claim that they have gained full access to the recipient's email account and obtained the password. It is also stated that the computer is infected with a trojan that allows them to change the password at any time (even if the user creates a new one). According to these scammers, this trojan was installed when the recipient visited an adult website. Furthermore, they state that they are capable of controlling the recipient's computer remotely, monitor activities in real time, turn the camera and microphone on, etc. People behind the "I sent you an email from your account" scam claim that they have, at some point, recorded a compromising video that will be sent to all of the recipient's contacts, unless $780 in Bitcoins is transferred to a provided Bitcoin Wallet within 48 hours. Furthermore, they also threaten to proliferate the video if the ransom email is shared with any other party. All statements regarding recorded videos, trojan infections, stolen data, etc. are false. Scammers send these emails to thousands of people hoping that some will fall for it. Never trust this or other similar scams.

Threat Summary:
Name I Sent You An Email From Your Account Email Scam
Threat Type Phishing, Scam, Social Engineering, Fraud
Fake Claim Scammer claims that he has infected victim's computer with a trojan and used it to record a compromising video. He also claims to have access to various recipient's accounts (including email).
Cyber Criminal Cryptowallet Address (Bitcoin)
19Q3HZtnznuB5cuWng8cacwqZV13gNpZaN, 1J9iAfnHhvhhMrP7c8n3bmvWh6CcjjynUt (cyber criminals change their cryptowallet addresses with each new spam campaign).
Symptoms Received an email that threatens to send supposedly recorded video of user watching adult videos to family members and colleagues. Email(s) in the inbox state that ones passwords have been stolen.
Distribution methods This scam is spread wide via spam email campaigns.
Damage Monetary loss - completely unnecessary payments for fake claims about hacking and in reality non-existent video recordings.

To eliminate malware infections our security researchers recommend scanning your computer with Spyhunter.
▼ Download Spyhunter
Free scanner checks if your computer is infected. To remove malware, you have to purchase the full version of Spyhunter.

Examples of other similar spam campaigns include Looked At You For Several Months, I Am A Spyware Software Developer, and So I'm The Hacker Who Broke Your Email. Scammers who spread these emails simply attempt to trick people into paying ransoms so that they do not reveal various photos or videos (they actually do not exist). Another type of spam email campaign aims to infect recipients' computers with high-risk viruses such as TrickBot, Emotet, AZORult, Adwind, etc. These emails infect computers through attachments or links associated with Microsoft Office documents, PDF documents, archive files (ZIP, RAR, and so on), executable files, etc. Opening these attachments leads to installation of malicious programs that often spread other infections or steal personal data (banking details, various passwords, logins, and so on). Having these programs installed can lead to financial loss, privacy issues, problems with browsing safety, or computer infections with other viruses such as ransomware

We receive a great deal of feedback from concerned users about this scam email. Here is the most popular question we receive:

Q: Hi pcrisk.com team, I received an email stating that my computer was hacked and they have a video of me. Now they are asking for a ransom in Bitcoins. I think this must be true because they listed my real name and password in the email. What should I do?

A: Do not worry about this email. Neither hackers nor cyber criminals have infiltrated/hacked your computer and there is no video of you watching pornography. Simply ignore the message and do not send any Bitcoins. Your email, name, and password was probably stolen from a compromised website such as  Yahoo (these website breaches are common). If you are concerned, you can check if your accounts have been compromised by visiting haveibeenpwned website.

How do spam campaigns infect computers?

Spam email campaigns that contain malicious attachments can only affect systems when an infected attachment is opened (or executable file is executed). Therefore, these emails cannot proliferate malware without the manual intervention of the recipient. For example, if the attachment is a Microsoft Office document, it must be opened and permission to use macro commands given. Once this is done, malicious MS Office documents are able to download and install various computer infections. If the attachment is an archive file, it will probably contain an executable file that needs to be executed before it can do any harm.

How to avoid installation of malware?

If there is an email is received from an unknown/untrustworthy address or the email context seems irrelevant/does not concern you, do not open the presented link or attachment. Do not download software from dubious, unofficial websites (or other sources), using third party downloaders, peer-to-peer networks, and so on. Install/download software carefully: check all available settings or options (such as "Custom", "Manual") and deselect additionally-included apps that you do not want to download/install. Never use third party, unofficial (fake) software updaters, since these often install viruses rather than the updates. Use functions and tools provided by official software developers. Use Microsoft Office versions that are no older than 2010. Later versions have "Protected View" mode that can prevent malicious attachments from downloading various infections. If you have already opened malicious attachments, we recommend running a scan with Spyhunter for Windows to automatically eliminate infiltrated malware.

Text presented in the "I sent you an email from your account" email message:

Subject: You password must be need changed


As you may have noticed, I sent you an email from your account.
This means that I have full access to your account: On moment of hack your account has password: *********

You say: this is the old password!
Or: I will change my password at any time!

Yes! You're right!
But the fact is that when you change the password, my trojan always saves a new one!

I've been watching you for a few months now.
The fact is that you were infected with malware through an adult site that you visited.

If you are not familiar with this, I will explain.
Trojan Virus gives me full access and control over a computer or other device.
This means that I can see everything on your screen, turn on the camera and microphone, but you do not know about it.

I also have access to all your contacts and all your correspondence.

Why your antivirus did not detect malware?
Answer: My malware uses the driver, I update its signatures every 4 hours so that your antivirus is silent.

I made a video showing how you satisfy yourself in the left half of the screen, and in the right half you see the video that you watched.
With one click of the mouse, I can send this video to all your emails and contacts on social networks. I can also post access to all your e-mail correspondence and messengers that you use.

If you want to prevent this, transfer the amount of $780 to my bitcoin address (if you do not know how to do this, write to Google: Buy Bitcoin).

My bitcoin addresses (BTC Wallets) are: 19Q3HZtnznuB5cuWng8cacwqZV13gNpZaN, 1HPhZrmyevkNXKo1MYnZG1A65p2PtyEpqc, 18kXxMp9NuTMUFVAfXR4TFT4CrrHWVzwm4, 1PNpAXTo6jh4V9dhXRvimNYqPYjvZEnQiu, 16LBDius3vg6ufFvnc7PGXfiTZgphuZgr5, 18eBGkYam1wjz1S77jz3VmADuYYFzhA3vB, 1BPUUNghhuwQjDDvFd3TnJz2ato5dyDLr8, 1DrCbXWfTqJbaiak2wjGUQiEo1WBzCBnof, 1GEhuEajkFXVe7vhtZqy1hRLdCaguhWBC2, 19rvCcYfSwPUSvJJKNyTyRFi5vxt6zaqJC, 1KeCBKUgQDyyMpaXhfpRi2qUvyrjcsT44o, 1Jh1miFmhTmGQvn6Zejaqg85viD4k1vVjG, 142e8SgyTLnkvwkDkNNon9jMtKY4UDvQqr, 1GoWy5yMzh3XXBiYxLU9tKCBMgibpznGio, 1GdSHQ4aE7zUD8HDqVJDEwU9dxn3LfJLMK, 1N5PXJHzJFyFfyqd32Gn9FZsVzNz8hqjqs, 1JBFFHR8tGiMgYLpnZCVG8n4cSpm591urc, 14tfS3yWL2cABhXVJZ97XRhuDXC69aWH6Y, 1N6dubqFmnyQ2qDWvi32ppVbc3kKMTYcGW, 1DHymxN8JqSwECGLPVbRMVWXrod8vvii5A

After receiving the payment, I will delete the video and you will never hear me again.
I give you 48 hours to pay.
I have a notice reading this letter, and the timer will work when you see this letter.

Filing a complaint somewhere does not make sense because this email cannot be tracked like my bitcoin address.
I do not make any mistakes.

If I find that you have shared this message with someone else, the video will be immediately distributed.

Best wishes!

Another variant of "I sent you an email from your account" email letter:

I sent you an email from your account spam campaign

Text presented within this mail:

subject: Your account has been hacked! You need to unlock.

Hi, stranger!

I know the ********, this is your password, and I sent you this message from your account.
If you have already changed your password, my malware will be intercepts it every time.

You may not know me, and you are most likely wondering why you are receiving this email, right?
In fact, I posted a malicious program on adults (pornography) of some websites, and you know that you visited these websites to enjoy
(you know what I mean).

While you were watching video clips,
my trojan started working as a RDP (remote desktop) with a keylogger that gave me access to your screen as well as a webcam.

Immediately after this, my program gathered all your contacts from messenger, social networks, and also by e-mail.

What I've done?
I made a double screen video.
The first part shows the video you watched (you have good taste, yes ... but strange for me and other normal people),
and the second part shows the recording of your webcam.

What should you do?

Well, I think $635 (USD dollars) is a fair price for our little secret.
You will make a bitcoin payment (if you don't know, look for "how to buy bitcoins" on Google).

BTC Address: 19rvCcYfSwPUSvJJKNyTyRFi5vxt6zaqJC, 1J36BsmxdqhuJhaSftiTc3MqEhmgdwcCNT, 1CZVUZa4sJrzQX5mBLucdgAMeVvkaj2dmv, 1MrUDSrZiqD3ijxsBUPt2SukoFy534orP2, 15G9wyGRDssFXsfwEm1ihdJs2xabVPDu68, 142e8SgyTLnkvwkDkNNon9jMtKY4UDvQqr, 1NL9MTdnTxsVxEg9nHeY5oiw5U9Mxzsh8v, 1DASN5fH1E1PCoxU9qMEF7QDjnXcA2b3Km, 1GoWy5yMzh3XXBiYxLU9tKCBMgibpznGio, 1B3Lx1t4CQSt3ck85bqzGHC9TeEQGANhUR, 19qqYeGgbzhT8Lic5WsbDZgJkzAy82R6fF, 1EHDCx1rXd7w6SguvcneeotsPhyDaetGKm, 14H8TULh8pw6RDB897Shtx88jobVu3RaVU, 12rXGKW3dVmyUCTTuSUpP8dm118Di4MHhd
(This is CASE sensitive, please copy and paste it)

You have 2 days (48 hours) to pay. (I have a special code, and at the moment I know that you have read this email).

If I don't get bitcoins, I will send your video to all your contacts, including family members, colleagues, etc.
However, if I am paid, I will immediately destroy the video, and my trojan will be destruct someself.

If you want to get proof, answer "Yes!" and resend this letter to youself.
And I will definitely send your video to your any 19 contacts.

This is a non-negotiable offer, so please do not waste my personal and other people's time by replying to this email.


Yet another variant of this email spam campaign:

I Sent You An Email From Your Account email spam campaign (sample 3)

Text presented within this letter:

Subject: Alert! Your account was hacked!


As you may have realized, I mailed you this e mail from your own account.
This shows that I have complete access to your account and your device.

I've been observing you for several months now.
Reality is that your device was taken over with a malware via a site that you visited.

If you are not familiar with this, I will explain.
My Trojan Virus grants me full access and control over a pc or other system.
This means that I can see everything on your screen, turn on the cam and microphone, but you don't know about it.

I additionally have access to all your contacts and all your correspondence.

Why did your anti-virus did not detect it?
Answer: My virus uses a driver, I up-date its signatures every four hrs so that your antivirus is silent.

I made a clip revealing how you satisfy yourself in the left half of the screen, and in the right half you see the video that you watched.
With one click of the mouse, I can deliver this clip to all your emails and contacts on social networks.
I can also post access to all your e-mail correspondence and messengers that you use.
Picture how this will affect your social life and the relations with your family members!

If you want to avoid this, transfer the amount of $650 (USD) to my bitcoin address (if you do not know how to do this, use Google or bing: "Buy Bitcoin").

My bitcoin address (BTC Wallet) is: 1KuAR7Vh2kYPQENAG6JbrmnGYySmUcLtu4, 1K7nnDHosR5czKZtuKT928YSxXXNSaDK6H, 1C2EbKJCZKtHMJawxBqyzZ9SHQVwRyfist, 1C1ehibCgeuLwF4VbSAzoDapDLbKtjivbP, 18yTDtmrUeRAdjC2gNscnbV6Dfn6UUsaMk, 14bscQz6FSjUyUgEv5NxjeKUFtY3yR1cCu, 16htiAFUVMXCsUMfvpPJFUuGRyvtxw1To9, 1HouKKY29benTnpiP2vVdLcKamN4NJrksk, 1NiXnj8DcDTnawYqz57GeVRMxw6WDTy3ba, 15bbfkGkNMjz857G5ya4RNRo5dWb1dRsxR

After receiving the payment, I will erase the video and you will never hear me again.
I give you 24 hours to pay.
When you opened this message a timer activated and is now counting on my server.

Filing a complaint anywhere does not make sense simply because this email can't be tracked like my bitcoin address.
I do not make any errors.

If I discover that you have revealed this message with someone else, the video will be immediately delivered.


A new variant of this email scam - trying to evade email spam filters by separating Bitcoin address into two separate lines:

sent emai from your private email address - scam

Text presented in this variant:

Subject: Your device is hacked!


Di​d yo​u no​ti​ce i​'ve sent yo​u thi​s ema​i​l usi​ng yo​ur o​wn pri​va​te e-ma​i​l a​ddress? Thi​s mea​ns i​ po​sses FULL a​ccess to​ yo​ur devi​ce! I wi​ll tell yo​u just ho​w i​ di​d a​ll thi​s. A bi​t o​f ti​me i​n the pa​st yo​u pa​i​d a​ vi​si​t to​ va​ri​o​us xxx i​nternet si​tes, o​ne o​f these websi​tes wa​s i​njected wi​th a​ ba​ckdo​o​r i​ develo​ped. Thi​s ba​ckdo​o​r i​nsta​lled i​tself upo​n yo​ur pla​tfo​rm a​nd pro​vi​des me full a​ccess to​ every o​ne o​f yo​ur a​cco​unts, e-ma​i​ls, da​ta​, co​nta​cts a​nd so​ o​n.
Do​ no​t be co​ncerned, further i​n thi​s ema​i​l i​ wi​ll i​nfo​rm yo​u a​bo​ut wha​t a​cti​o​n yo​u ha​ve to​ ta​ke.

Whi​le yo​u checked o​ut these a​dult websi​tes i​ i​ni​ti​a​ted yo​ur webca​m a​nd ta​ped so​me vi​deo​ cli​ps a​nd to​o​k a​ number o​f screensho​ts o​f yo​u whi​le yo​u "plea​sed yo​urself".... i​f yo​u kno​w wha​t i​ mea​n.

So​ here i​t i​s, i​ ha​ve a​ccessi​bi​li​ty to​ yo​ur ma​i​l a​ddresses, to​ yo​ur system, i​ ha​ve so​me qui​te co​mpro​mi​si​ng i​ma​ges a​nd cli​ps o​f yo​u a​nd i​ po​sses every o​ne o​f yo​ur ema​i​l a​nd so​ci​a​l medi​a​ co​nta​cts. It do​esn't ma​tter ho​w ma​ny ti​mes yo​u cha​nge yo​ur pa​sswo​rd, my ba​ckdo​o​r wi​ll i​nva​ri​a​bly a​llo​w me full a​ccess to​ yo​ur system.

No​w yo​u ca​n perfo​rm 2 thi​ngs.

It's po​ssi​ble to​ di​srega​rd thi​s e-ma​i​l, sent fro​m yo​ur o​wn a​cco​unt. In thi​s si​tua​ti​o​n i​ wi​ll present a​ll the i​ma​ges a​nd cli​ps i​ o​wn o​f yo​u "sa​ti​sfyi​ng yo​urself" to​ a​ll yo​ur co​nta​cts, i​ma​gi​ne the i​mpa​ct thi​s i​s go​i​ng to​ ha​ve o​n yo​ur so​ci​a​l li​fe! Furthermo​re yo​ur devi​ce wi​ll lo​ck-up i​n a​ pa​rti​cula​r a​mo​unt o​f ti​me a​nd ca​n never be uti​li​zed a​ga​i​n.

I a​m certa​i​n yo​u do​n't wa​nt tha​t so​ here i​s o​pti​o​n number two​.

I resi​de i​n a​ co​untry where i​t i​s very ha​rd to​ fi​nd a​ny jo​b o​r suppo​rt my lo​ved o​nes, tha​t's why I rea​lly do​ thi​s, tha​t's preci​sely why i​ a​m a​ ha​cker. Yo​u a​re no​t ta​rgeted, yo​u just went to​ the wro​ng web si​te a​t the wro​ng ti​me. So​ fo​r my secrecy yo​u wi​ll need to​ do​ so​methi​ng fo​r me.

Yo​u'll need to​ tra​nsfer $650 (USD) i​n bi​tco​i​ns to​ my a​ddress:


I​MPO​RTANT: Yo​u MUST co​py/paste​ the​ 2 line​s to​ge​the​r o​r it will NO​T wo​rk so​ the​ bitco​in addre​ss lo​o​ks like​ this:

15U89Ea5Q61VQnzyB8YAmoLNfT7UL1JCzc, 1LRuigr82sxPmQt5XDQ7PprJu9qX1rJFMN, 13nsNBfoVwXDHY4puRD1AHjARbomKhsxEL, 1FCFYKzJHbKDcAL2wX8hpZdUdGJcfkWfxd, 1F3mAYuD3sEjufi5pPgDjAAM6SJPN6bFvn, 1NKrw3sP7C9igNozkB2Pd4VnZuk8d6WGV

I ca​n i​ma​gi​ne yo​u ha​ve no​ clue a​bo​ut ho​w to​ use bi​tco​i​ns nevertheless tha​t i​s no​t a​ cha​llenge, bro​wse Go​o​gle, lo​ts o​f si​tes sell bi​tco​i​ns ma​ki​ng use o​f a​ debi​t o​r credi​t ca​rd a​nd the pro​cedure i​s rea​lly fa​st.

Co​nsi​der thi​s a​s bei​ng a​ co​ntri​buti​o​n.

Fro​m the mo​ment yo​u o​pened thi​s ema​i​l yo​u tri​ggered a​ ti​mer. My setup wi​ll no​w o​bserve thi​s pa​rti​cula​r bi​tco​i​n a​ddress fo​r a​ny i​nbo​und fi​na​nci​a​l tra​nsa​cti​o​ns. Yo​u ha​ve 12 hrs (just 12!) to​ ma​ke the tra​nsfer. In ca​se yo​u do​ no​t ma​ke the tra​nsfer wi​thi​n thi​s ti​mefra​me yo​ur system wi​ll lo​ck up, even i​f yo​u deta​ch fro​m the web o​r a​lter a​ll yo​ur pa​sswo​rds. Furthermo​re a​ll yo​ur fri​ends wi​ll o​bta​i​n a​ll the unplea​sa​nt pi​ctures a​nd vi​deo​ cli​ps i​ o​wn o​f yo​u, thi​s wi​ll certa​i​nly ha​ve a​ bi​g a​ffect i​n yo​ur so​ci​a​l li​fe.
If the tra​nsa​cti​o​n do​es co​me i​n befo​re i​ts due my setup wi​ll a​uto​ma​ti​ca​lly shut do​wn the ba​ckdo​o​r o​n yo​ur pla​tfo​rm a​nd delete a​ll the i​nfo​rma​ti​o​n, pi​ctures a​nd vi​deo​s i​ ha​ve o​f yo​u a​nd yo​u wi​ll never ever hea​r fro​m me a​ga​i​n then yo​u ca​n go​ o​n to​ li​ve yo​ur li​fe a​s i​f thi​s never ha​ppened.

I do​ no​t wa​nt to​ do​ da​ma​ge nevertheless i​ wi​ll do​ no​ ma​tter wha​t i​t ta​kes to​ feed my spo​use a​nd chi​ldren.

Since​ yo​u have​ o​nly 12 hrs yo​u be​tte​r start the​ transactio​n right no​w!

All the best!

Cyber criminals have translated this email scam and are now targeting computer users in various countries, here's an example of this scam email targeting Chinese users:

sent an email from your account email scam Chinese language

Chinese text presented in this email scam:

Subject: 安全通知。 有人可以访问您的文件。




我创建了高质量的间谍软件。 它允许我获得对您设备的完全访问权限和控制权。



一键! 您在电子邮件和社交网络中的所有联系人都将收到此视频! 你的生活将永远改变!







Screenshot of "" spam email targeting Russian users:

I Sent You An Email From Your Account email spam campaign Russian variant

Text presented within this email:

Subject: Ваше устройство взломано злоумышленниками. Немедленно смените пароль!


Как вы могли заметить, я отправил вам это электронное письмо из вашего почтового аккаунта.
Это означает, что у меня есть полный доступ к вашему устройству.

Я наблюдаю за вами уже несколько месяцев.
Дело в том, что вы были заражены вредоносным ПО через сайт для взрослых, который вы посетили.

Если вы не знакомы с этим, я объясню.
Троянский вирус дает мне полный доступ и контроль над компьютером или любым другим устройством.
Это означает, что я могу видеть все на вашем экране, включить камеру и микрофон, но вы не знаете об этом.

У меня также есть доступ ко всем вашим контактам, данным по социальным сетям и всей вашей переписке.

Почему ваш антивирус не обнаружил вредоносное ПО?
Ответ: Моя вредоносная программа использует драйвер, я обновляю его сигнатуры каждые 4 часа, чтобы ваш антивирус молчал.

Я сделал видео, показывающее, как вы удовлетворяете себя в левой половине экрана, а в правой половине вы видите видео, которое вы смотрели.
Одним щелчком мыши я могу отправить это видео на все ваши контакты из почты и социальных сетей.
Я также могу опубликовать доступ ко всей вашей электронной почте и мессенджерам, которые вы используете.

Если вы хотите предотвратить это, то
переведите 500$(USD) на мой биткойн-кошелек (если вы не знаете как это сделать, то напишите в Google: "Купить биткойн").

Мой биткойн-кошелек (BTC Wallet): 12rXGKW3dVmyUCTTuSUpP8dm118Di4MHhd, 1k8fn2VMauUeHKuPuF5jqcVbVUw58Dc1H, 1EuACsW2dRECausKxA96yPGLNbWDFHL5Kz, 1EvxiAhfaK9K7uzNYtgjpWhKYpwMevH94C, 162DnzzVEYbJYaFKnTB9N2oaqFdL9Cq4oV, 1DZeuHWbitizaUAHYTqpiRbVz2g4xeQaq2

После получения оплаты я удалю видео, и вы никогда меня больше не услышите.
Я даю вам 50 часов (более двух дней) для оплаты.
У меня есть уведомление о прочтении этого письма, и таймер сработает, когда вы увидите это письмо.

Подача жалобы куда-либо не имеет смысла, потому что это письмо не может быть отслежено, как и мой биткойн-адрес.
Я не делаю ошибок.

Если я обнаружу, что вы поделились этим сообщением с кем-то еще, видео будет немедленно распространено.

С наилучшими пожеланиями!

Instant automatic malware removal: Manual threat removal might be a lengthy and complicated process that requires advanced computer skills. Spyhunter is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:
▼ DOWNLOAD Spyhunter By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. Free scanner checks if your computer is infected. To remove malware, you have to purchase the full version of Spyhunter.

Quick menu:

How to remove malware manually?

Manual malware removal is a complicated task - usually it is best to allow antivirus or anti-malware programs to do this automatically. To remove this malware we recommend using Spyhunter for Windows. If you wish to remove malware manually, the first step is to identify the name of the malware that you are trying to remove. Here is an example of a suspicious program running on a user's computer:

malicious process running on user's computer sample

If you checked the list of programs running on your computer, for example, using task manager, and identified a program that looks suspicious, you should continue with these steps:

manual malware removal step 1 Download a program called Autoruns. This program shows auto-start applications, Registry, and file system locations:

screenshot of autoruns application

manual malware removal step 2Restart your computer into Safe Mode:

Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer start process, press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, and then select Safe Mode with Networking from the list.

Safe Mode with Networking

Video showing how to start Windows 7 in "Safe Mode with Networking":

Windows 8 users: Start Windows 8 is Safe Mode with Networking - Go to Windows 8 Start Screen, type Advanced, in the search results select Settings. Click Advanced startup options, in the opened "General PC Settings" window, select Advanced startup. Click the "Restart now" button. Your computer will now restart into the "Advanced Startup options menu". Click the "Troubleshoot" button, and then click the "Advanced options" button. In the advanced option screen, click "Startup settings". Click the "Restart" button. Your PC will restart into the Startup Settings screen. Press F5 to boot in Safe Mode with Networking.

Windows 8 Safe Mode with networking

Video showing how to start Windows 8 in "Safe Mode with Networking":

Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options". In the advanced options menu select "Startup Settings" and click on the "Restart" button. In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.

windows 10 safe mode with networking

Video showing how to start Windows 10 in "Safe Mode with Networking":


manual malware removal step 3Extract the downloaded archive and run the Autoruns.exe file.

extract autoruns.zip and run autoruns.exe

manual malware removal step 4In the Autoruns application, click "Options" at the top and uncheck the "Hide Empty Locations" and "Hide Windows Entries" options. After this procedure, click the "Refresh" icon.

Click 'Options' at the top and uncheck 'Hide Empty Locations' and 'Hide Windows Entries' options

manual malware removal step 5Check the list provided by the Autoruns application and locate the malware file that you want to eliminate.

You should write down its full path and name. Note that some malware hides process names under legitimate Windows process names. At this stage, it is very important to avoid removing system files. After you locate the suspicious program you wish to remove, right click your mouse over its name and choose "Delete".

locate the malware file you want to remove

After removing the malware through the Autoruns application (this ensures that the malware will not run automatically on the next system startup), you should search for the malware name on your computer. Be sure to enable hidden files and folders before proceeding. If you find the filename of the malware, be sure to remove it.

searching for malware file on your computer

Reboot your computer in normal mode. Following these steps should remove any malware from your computer. Note that manual threat removal requires advanced computer skills. If you do not have these skills, leave malware removal to antivirus and anti-malware programs. These steps might not work with advanced malware infections. As always it is best to prevent infection than try to remove malware later. To keep your computer safe, install the latest operating system updates and use antivirus software.

To be sure your computer is free of malware infections, we recommend scanning it with Spyhunter for Windows.

About the author:

Tomas Meskauskas

Tomas Meskauskas - expert security researcher, professional malware analyst.

I am passionate about computer security and technology. I have an experience of over 10 years working in various companies related to computer technical issue solving and Internet security. I have been working as an author and editor for pcrisk.com since 2010. Follow me on Twitter and LinkedIn to stay informed about the latest online security threats. Contact Tomas Meskauskas.

PCrisk security portal is brought by a company RCS LT. Joined forces of security researchers help educate computer users about the latest online security threats. More information about the company RCS LT.

Our malware removal guides are free. However, if you want to support us you can send us a donation.

Removal Instructions in other languages
Malware activity

Global malware activity level today:

Medium threat activity

Increased attack rate of infections detected within the last 24 hours.

QR Code
possible malware infections QR code
A QR code (Quick Response Code) is a machine-readable code which stores URLs and other information. This code can be read using a camera on a smartphone or a tablet. Scan this QR code to have an easy access removal guide of possible malware infections on your mobile device.
We Recommend:

Get rid of Windows malware infections today:

Download Spyhunter

Platform: Windows

Editors' Rating for Spyhunter:
Editors ratingOutstanding!

[Back to Top]

Free scanner checks if your computer is infected. To remove malware, you have to purchase the full version of Spyhunter.