When a computer exhibits hacking symptoms like blocked security permissions and system instability after a router change, the priority is isolating the machine from the network to prevent further data exfiltration. You must then boot into Safe Mode with Networking to bypass malware that blocks standard updates or scans, allowing you to run diagnostic tools and restore critical system integrity before attempting a full repair.
Immediate Network Isolation
The first step in resolving a compromised system is to cut off its ability to communicate with external servers or command-and-control centers. Since the user mentioned replacing the ATT router and changing passwords, it is possible the malware was installed prior to this change or has already propagated to other devices on the local network. Disconnecting the affected computer from the internet via the Ethernet cable or disabling Wi-Fi immediately stops active attacks. This isolation prevents the malware from downloading additional payloads or stealing more data while you work on fixing the second computer.
It is also crucial to check if the new router configuration inadvertently allowed access to vulnerable services. Ensure that UPnP (Universal Plug and Play) is disabled on the new ATT router unless absolutely necessary, as this feature can be exploited by malware to open ports for remote access. Changing the admin password of the router, as the user did, is a good step, but verifying that WPA3 encryption is enabled adds another layer of security against unauthorized wireless access. If the malware has already modified DNS settings on the infected machine, disconnecting the network ensures those changes do not redirect legitimate traffic to malicious sites during your troubleshooting session.
Booting into Safe Mode
Malware often hooks into system processes to prevent antivirus software from running or to block Windows Update. To bypass these restrictions, you need to start Windows in Safe Mode. In Safe Mode, only essential drivers and services are loaded, which typically excludes the malicious components that are blocking your security scans.
To enter Safe Mode, hold down the Shift key while clicking Restart in the Start menu. Once the system reboots to the blue recovery screen, select Troubleshoot, then Advanced options, Startup Settings, and finally Restart. After the restart, press 4 or F4 to start in Safe Mode. If the malware has deeply integrated itself into the kernel, you might need to use Option 5 (Safe Mode with Networking) if you need to download specific removal tools, though Option 4 is safer for initial inspection.
Once in Safe Mode, verify if you can now access the Task Manager. If the malware was blocking task management utilities, you should regain control here. Check the startup tab in Task Manager for any unfamiliar programs that launched automatically. Disabling these entries can stop the malware from persisting through reboots. This step is critical because many modern threats hide their processes from standard views but remain visible in Safe Mode due to reduced system complexity.
Handling Blocked Security Permissions
The user reported that security permissions were blocked. This often manifests as the inability to open the Windows Security app or run an antivirus installer. In Safe Mode, try opening the Services console by typing
services.msc in the Run dialog. Look for services related to Windows Defender or your third-party antivirus. If they are stopped, attempt to start them manually. If you receive an "Access Denied" error, the malware may have altered registry keys controlling service startup types.
You can check the registry by navigating to
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. Find the key for your security service and ensure the
Start value is set correctly (usually 2 for automatic). However, editing the registry carries risks, so proceed with caution. If you cannot modify these settings, it indicates a high level of compromise, and a clean install may be the only reliable solution.
Running Diagnostics and Scans
With network isolation and Safe Mode active, you can now perform effective diagnostics. Standard Windows Defender scans may still be limited if the malware has disabled real-time protection. Instead, use Microsoft Safety Scanner, a standalone tool that does not require installation and runs independently of the main antivirus engine. Download this tool on a separate, clean computer and transfer it via USB.
Run the scanner in Safe Mode. It will check for known threats and remove them without interfering with existing security software. If the system remains unstable, consider using a bootable USB drive created on a clean machine. Tools like Malwarebytes Bootable Rescue Disk can scan the hard drive without loading the operating system, bypassing any malware that hides when Windows is running.
If the Blue Screen of Death (BSoD) persists despite removing malware, hardware issues may be coincidental or caused by driver corruption from the infection. Refer to our guide on
Windows 10 BSOD Randomly: Continues BSOD After Fresh Reinstall with Factory Drivers for steps to diagnose memory or storage failures. The BSoD could be a result of the malware corrupting system files rather than a physical hardware defect.
Cleaning and Restoration
After scanning, reboot normally and monitor the system closely. Check Event Viewer for errors related to security events or driver failures. If the system feels sluggish or behaves erratically, the best course of action is a reset. Go to Settings > Update & Security > Recovery and choose Reset this PC. Select Keep my files if you want to preserve personal data, but note that applications will be removed. This process reinstalls Windows while keeping your documents, effectively wiping out most malware that resides in system directories.
If resetting fails or the malware returns, a full clean install from a bootable USB is required. Create the media using the Media Creation Tool on a clean PC. Before reinstalling, ensure you back up only your personal files (documents, photos) to an external drive. Do not back up application folders or system files, as they may contain infected executables.
For cases where the BSOD is linked to specific kernel errors, such as How to Fix BSOD ATTEMPTED_WRITE_TO_READONLY_MEMORY / KERNEL_SECURITY_CHECK_FAILURE Error on Windows 10/11, updating or rolling back drivers after the clean install can resolve stability issues. Always ensure you are installing drivers directly from the manufacturer’s website, not from generic Windows Update packages, to avoid compatibility conflicts.
Preventing Future Compromise
Once the system is stable, strengthen your defenses. Enable Controlled Folder Access in Windows Security to protect important directories from ransomware-like behavior. Use strong, unique passwords for all accounts, and enable Multi-Factor Authentication (MFA) wherever possible. Regularly update both Windows and all installed software to patch known vulnerabilities. Finally, maintain a habit of disconnecting the machine from the internet when performing sensitive tasks or if you suspect ongoing surveillance.
Frequently Asked Questions
Can I fix the hacked computer without losing my data?
Yes, you can attempt to remove the malware using Safe Mode and specialized scanners like the Microsoft Safety Scanner. However, if the system is severely corrupted, a Reset this PC operation is the safest way to keep your personal files while removing the infection.
Why did the BSoD start after the router change?
The router change likely coincided with the discovery of the hack, rather than causing the BSoD. The malware may have been present for some time, causing system instability. Alternatively, the malware might have attempted to propagate to other devices when the network topology changed, triggering aggressive defensive responses from the OS.
Is it safe to reconnect the computer to the new ATT router?
Only after you have confirmed the system is clean. Reconnecting a compromised machine can allow the malware to send stolen data to the attacker or infect other devices on the same network. Wait until you have successfully completed a full scan and verified system integrity.
What if Safe Mode doesn't let me run antivirus?
If Safe Mode is also blocked, the malware has deep kernel-level access. In this scenario, you must use a bootable rescue disk created on a different, clean computer. This tool scans the hard drive at a low level, bypassing the infected operating system entirely.
Should I format the hard drive completely?
Formatting is the most thorough way to ensure no malware remnants exist. However, it erases all data. If you must keep your files, use the Reset this PC feature with the option to remove everything and clean the drive, which is more secure than a simple reset.