What to do if…
your antivirus or security app is suddenly disabled and you did not change it

What to do now

1. Disconnect the device from networks.
   Turn off Wi-Fi and Bluetooth, unplug ethernet, and on a phone or tablet turn on airplane mode and check Wi-Fi and Bluetooth are also off. If you cannot reliably disconnect it, or you see ransomware, extortion, files being renamed, or files becoming unreadable, power the device down.

2. Make a short record without digging further.
   Write down the date and time, the security product name, the exact message shown, and what changed, such as “real-time protection off”, “tamper protection off”, “security app missing”, or “unknown profile installed”. Photograph the screen if the message is already visible.

3. Use a different trusted device to secure key accounts.
   Start with your email account, Apple, Google or Microsoft account, banking, password manager, and work accounts. Change passwords from the trusted device, especially any reused passwords, and turn on 2-step verification where available. Secure the email account used for password resets before less important accounts.

4. Check for simple explanations only if you can do it safely offline.
   Look for a newly installed antivirus or security suite you did not choose, an expired subscription message, a recent operating-system update, or an unfamiliar work, school, mobile-device-management, or configuration profile. If something is unfamiliar, note it rather than removing it blindly.

5. Run an offline or boot-time scan before normal use if available.
   On Windows, Microsoft Defender Offline scan can restart the device and scan without loading Windows in the usual way; follow the prompts in Windows Security. If you use another security product, use only that provider’s official offline, rescue, or boot scan option if it offers one.

6. Reconnect only for a limited update-and-scan step.
   If you need internet access to update the operating system or security tool, reconnect only on a known network, update the operating system and security definitions, run a full scan, then disconnect again if protection switches off or warnings return.

7. Escalate if protection will not stay enabled.
   For a personal device, keep it isolated and consider help from the device maker, the security software provider, or a reputable repair professional. For a work, school, healthcare, finance, or managed device, stop and contact the IT, helpdesk, or security team before trying a reinstall or reset.

8. Report fraud, cyber crime, or exposed financial details where relevant.
   If you are in England, Wales, or Northern Ireland and you think this involved fraud, cyber crime, stolen money, or stolen account access, report it through Report Fraud using a different device. If you are in Scotland, report cyber crime to Police Scotland using 101 for non-emergencies or 999 for emergencies. If bank details may be exposed, contact your bank using the number in your banking app or on your card, not a number from an email or text.