What to Do If a Virus Closes Your Browser
and Blocks Antivirus Downloads in Windows

Virus Closes Browser and Blocks Antivirus Downloads: Common Symptoms

Some malware is designed to defend itself. Instead of only displaying ads or stealing data, it may terminate browsers, block security websites, modify network settings, disable Windows Security, or close antivirus installers as soon as they start. This behavior usually means the infection is active and should be handled carefully.

First Actions When Malware Blocks Antivirus Downloads in Windows

Before trying random downloads or repeatedly opening the browser, isolate the computer and protect your accounts. This reduces the chance of data theft, lateral movement across your local network, or additional malicious downloads.

1. Disconnect from the internet. Unplug the Ethernet cable or turn off Wi‑Fi. If you need internet later for cleanup tools, reconnect only for that specific step.
2. Do not connect external drives containing important files. Some malware can copy itself to USB drives or encrypt attached storage.
3. Use a clean device for research and downloads. A phone, another PC, or a trusted work computer can be used to download rescue tools safely.
4. Back up critical documents only. Copy personal files such as documents and photos if necessary, but do not back up unknown .exe, .scr, .bat, .cmd, .js, or cracked software files.
5. Prepare for password changes later. Change passwords only after the infected PC is cleaned or from a different trusted device.

Boot Windows into Safe Mode to Stop Browser-Closing Malware

Safe Mode starts Windows with a minimal set of drivers, services, and startup programs. Many malicious background processes do not load there, which gives you a better chance to open security tools and repair system settings.

Method 1: Use Settings

1. Press Win + I to open Settings.
2. Go to System → Recovery.
3. Next to Advanced startup, click Restart now.
4. Open Troubleshoot → Advanced options → Startup Settings.
5. Click Restart, then press 4 for Safe Mode or 5 for Safe Mode with Networking.

Method 2: Use the Sign-In Screen

1. Hold Shift.
2. Click Power → Restart.
3. Follow Troubleshoot → Advanced options → Startup Settings → Restart.
4. Choose Safe Mode or Safe Mode with Networking.

Run Microsoft Defender Offline Scan When Antivirus Is Blocked

Microsoft Defender Offline is useful when malware is active inside Windows and prevents normal scanning. It restarts the computer into a separate scanning environment before Windows fully loads, making it harder for malware to hide or terminate the scan.

1. Open Start and search for Windows Security.
2. Go to Virus & threat protection.
3. Open Scan options.
4. Select Microsoft Defender Antivirus (offline scan).
5. Click Scan now and allow Windows to restart.

After the scan completes, Windows will restart normally. Open Windows Security → Virus & threat protection → Protection history to review detected and removed threats.

How to Download Antivirus Tools If the Virus Closes the Browser

When malware blocks antivirus downloads, changing the download method is often more effective than repeatedly trying the same browser. Use only trusted sources and avoid “cracked,” “portable,” or repacked security tools from random file-sharing sites.

Repair DNS, Proxy, Hosts File, and Browser Hijacker Settings

Browser-blocking malware often changes network settings so that antivirus websites cannot be reached. After the initial scan, check these Windows settings manually.

1. Disable suspicious proxy settings

1. Press Win + I.
2. Open Network & Internet → Proxy.
3. Turn off Use a proxy server unless you intentionally use one.
4. Keep Automatically detect settings enabled for most home networks.

2. Reset DNS and network configuration

Open Command Prompt as administrator and run:

ipconfig /flushdns
netsh winsock reset
netsh int ip reset

Restart the computer after running these commands.

3. Check the Windows hosts file

The hosts file can be abused to block antivirus websites or redirect them to fake pages. Open Notepad as administrator and check this file:

C:\Windows\System32\drivers\etc\hosts

For a normal home PC, the file usually contains only comments that start with #. Remove suspicious lines that redirect antivirus, Microsoft, browser, or banking domains to strange IP addresses.

4. Remove suspicious browser extensions

• Chrome: open chrome://extensions.
• Edge: open edge://extensions.
• Firefox: open about:addons.
• Remove extensions you did not install, especially “search,” “coupon,” “security,” “PDF,” or “download assistant” add-ons.

Remove Malicious Processes and Startup Entries That Relaunch the Virus

If the browser keeps closing after a scan, the malware may be relaunching from Startup, Task Scheduler, services, or a user profile folder. Check the common persistence locations below.

Check Task Manager Startup Apps

1. Press Ctrl + Shift + Esc.
2. Open the Startup apps tab.
3. Disable unknown entries with random names, no publisher, or suspicious paths.
4. Right-click an entry and choose Open file location before deleting anything.

Check Task Scheduler

1. Press Win + R, type taskschd.msc, and press Enter.
2. Open Task Scheduler Library.
3. Look for tasks that run from AppData, Temp, ProgramData, or unknown folders.
4. Disable suspicious tasks first. Delete them only after confirming they are not legitimate software tasks.

Check common malware folders

Malware often hides in user-writable folders. Look for recently created files with random names in:

%AppData%
%LocalAppData%
%Temp%
C:\ProgramData
C:\Users\Public

Run Full Malware Scans Correctly After the Browser Stops Closing

Once you can open security tools, run scans in the right order. A quick scan may remove the active loader, but a full scan is needed to find downloaded payloads, trojans, browser hijackers, and infected installers.

1. Update security definitions. Reconnect to the internet temporarily and update the antivirus database.
2. Run a full system scan. Include all local drives, not only the Windows folder.
3. Run a second-opinion scanner. Use one reputable additional scanner to catch threats missed by the first engine.
4. Scan external drives. Scan USB drives and external disks before opening files from them.
5. Restart and scan again. If detections return after reboot, persistence is still present.

After Removing the Virus: Secure Windows, Browsers, and Accounts

Removing the malware is only the first half of recovery. You also need to reverse policy changes, update software, and protect accounts that may have been exposed while the infection was active.

• Change important passwords from a clean device, especially email, banking, hosting, cloud storage, and social accounts.
• Enable two-factor authentication wherever possible.
• Update Windows from Settings → Windows Update.
• Update browsers and remove unknown extensions.
• Reset browser settings if search, homepage, or new tab pages are still hijacked.
• Check installed programs and remove unknown apps from Settings → Apps → Installed apps.
• Create a restore point after the system is clean.
• Back up important files to an external drive or cloud storage.

FAQ: Browser Closes and Antivirus Downloads Are Blocked by Malware

Recommended Fix Order for Browser-Blocking Malware in Windows

If a virus closes your browser and blocks antivirus downloads, treat the system as actively compromised. Do not keep using the PC normally. Isolate it, boot into Safe Mode, run an offline scan, repair network and browser settings, then perform full scans and secure your accounts.