us Technology & digital loss antivirus turned off • security app disabled • windows security disabled • microsoft defender off • mac security turned off • phone security disabled • sudden antivirus deactivated • security settings changed • possible malware infection • suspicious device behaviour • hacked device worry • can’t turn antivirus back on • antivirus keeps turning off • endpoint protection stopped • unknown admin change • unknown profile installed • ransomware early signs • accounts may be compromised • report to ic3

What to do if…
your antivirus or security app is suddenly disabled and you did not change it

Short answer

Assume compromise until proven otherwise: disconnect the device from the internet immediately and avoid logging into any accounts on it until you’ve checked things from a trusted device.

Do not do these things

Don’t keep using the device for email, banking, shopping, password managers, or work logins.
Don’t click pop-ups claiming “security disabled—click to fix” or install unknown “cleanup” apps.
Don’t search and download random tools; scammers heavily target people in this exact moment.
Don’t reconnect the device “just to update” if it keeps disabling security instantly—pause and contain first.
Don’t factory-reset immediately if this is a work device or you may need records of what happened.
Don’t click around “to investigate”. If you want a record, capture only what’s already visible; if unsure, take a photo of the screen with another device.

What to do now

Disconnect from the network.
Turn off Wi-Fi and Bluetooth, unplug ethernet, disable mobile data, or use airplane mode on phones/tablets. If you can’t reliably disconnect (or you see ransomware/extortion behaviour), power the device down.
Capture a minimal record (fast, low-risk).
Note the time/date, the security product name, what changed, and any warnings. Take a photo/screenshot of any alerts that are already visible (don’t click around).
From a different, trusted device, secure your critical accounts first.
Prioritize: email → Apple/Google/Microsoft account → banking/credit cards → work accounts.
- Change passwords from the trusted device.
- Turn on multi-factor authentication if available.
- If you reused passwords, change reused ones immediately.
Check for obvious non-malicious causes (without deep troubleshooting).
Sometimes one security product disables another, or a device management tool changes settings. Look for:
- A new antivirus/security suite you didn’t install.
- A new “work/school” management profile or administrator account you don’t recognize.
  If something looks unfamiliar, don’t remove it yet—just document it.
Run an offline scan if available.
On Windows, use Microsoft Defender Offline scan (it restarts into a recovery environment to scan). If you use another security product, use its official offline/boot scan option if it has one.
Only after containment: update and run a full scan.
If you must reconnect briefly, do it on a network you trust and only long enough to update the operating system and security tools, then run a full scan. Disconnect again if anything re-disables.
If protection still won’t stay on, treat it as serious.
- For a personal device: isolate it and plan for professional help or a clean reinstall after accounts are secured.
- For a work/school device: stop and contact IT/security. Don’t “fix it yourself” unless they instruct you.
Report if there’s any sign of crime, fraud, or extortion.
- File a report with the FBI’s Internet Crime Complaint Center (IC3).
- If identity theft or account takeover is involved, use IdentityTheft.gov for recovery steps.
- If financial accounts may be exposed, call your bank/card issuer using the number on the back of your card or your official app.

What can wait

You don’t have to decide right now whether to wipe the device—first isolate it and secure accounts.
You don’t have to figure out exactly what malware it is today.
You don’t have to pay or respond to threats today (if extortion/ransomware appears, keep the device offline and focus on containment and reporting).

Important reassurance

Security settings can change for benign reasons (updates, conflicting security products), but the safest first response is to assume compromise and reduce exposure. Disconnecting and slowing down is a practical move that prevents bigger harm.

Scope note

This is first-steps guidance to stabilize and prevent irreversible mistakes. Next steps (reinstalling, restoring backups, deeper investigation) depend on whether the device is personal, work-managed, or part of a broader incident.

Important note

This is general information, not professional security, legal, or law-enforcement advice. If this involves a workplace, school, healthcare, or sensitive data, follow your organization’s incident process and avoid actions that could destroy useful evidence.

Additional Resources

Support us

What to do if…your antivirus or security app is suddenly disabled and you did not change it