I think my device is already infected

The signs are specific: the browser redirects to pages you didn't open, popups appear when no browser is running, your existing antivirus flagged something and reported it couldn't be removed, or a process you don't recognize keeps reappearing in Task Manager. This is not the same question as 'should I get antivirus.' The threat may already be there.

Quick answer

Device is showing active symptoms right now→Malwarebytes — run the free on-demand scan first; it's widely used as an initial cleanup layer for PUP, adware, and stubborn malware that general AV reports as clean

Scan came back clean but symptoms continue→ESET — Advanced Memory Scanner catches fileless malware executing in memory, which file-based scanners structurally cannot detect

Machine is clean — want ongoing protection now→Bitdefender — Behavioral Shield and Ransomware Remediation are specifically designed for post-cleanup reinfection scenarios

When it matters

Most people shopping for antivirus are starting from a clean machine. This intent is for a different entry point — the machine is already behaving wrong, and the first priority is cleanup, not configuration.

Browser homepage changed without user action, or search results redirect through an unfamiliar intermediary
Popups or ads appear even when no browser is open
Your current antivirus flagged a threat, quarantined it, but symptoms persisted — or it reported 'removal failed'
The device became noticeably slower over days, not gradually over months, with no software changes
You see background processes that disappear when you search for them, or a process that restarts immediately after you close it
Security software was disabled and you didn't initiate that action

One symptom can have an innocent explanation. Two or more together — especially alongside a failed removal attempt — is a different situation. The priority changes from 'which AV should I get' to 'what do I run first on a machine that's already compromised.'

When it fails

Running a scanner is the right first move. But there are categories of infection where no software-based cleanup is reliable.

Rootkits embedded at the kernel level — they intercept scanner calls from inside the infected OS and can hide from every tool that runs within it
Firmware infections (UEFI or BIOS) — these survive an OS reinstall; software scanners can sometimes detect them but cannot remove them without hardware-level intervention
Damage already done: files encrypted by ransomware before detection are unrecoverable without backups; credentials exfiltrated before the scan ran are already exposed regardless of what happens next
Reinfection vectors still active — if the original entry point (a browser extension, a pirated installer, a compromised network share) is still present, cleanup only resets the clock

No scanner can guarantee full removal at the rootkit level. If Malwarebytes finds and removes the threat and symptoms stop, the machine is likely clean. If symptoms persist after a thorough scan, the infection may be operating at a depth no tool running inside a compromised OS can reliably reach. At that point, a clean OS reinstall is not a last resort — it is the structurally honest answer.

How providers fit

Malwarebytes fits if the device is showing active symptoms and no thorough cleanup scan has run yet. The free version is a pure on-demand scanner with no real-time component, which means it can run alongside any installed AV without conflicts. It has a documented track record among IT professionals as a first-response tool specifically for PUP, adware, and stubborn malware that full-suite products report as clean.

ESET fits if a standard scan came back clean but symptoms continue. Its Advanced Memory Scanner monitors code executing in memory — built specifically to catch fileless malware that never writes to disk and therefore never triggers file-based detection. ESET also includes a consumer-facing UEFI firmware scanner, which matters when symptoms survive an OS reinstall and the infection is suspected at the firmware level.

Bitdefender fits after cleanup is confirmed — not during it. Behavioral Shield monitors running processes for anomalous behavior in real time, and Ransomware Remediation automatically rolls back files if an encryption attempt is detected. That combination is designed to catch what gets past signature-based detection on a machine you want to keep clean going forward.

Bottom line

The sequence matters more than the brand. Malwarebytes first — free, on-demand, no conflicts. If it finds and removes the problem and symptoms stop, add Bitdefender for ongoing protection. If symptoms continue after cleanup, ESET's memory-level scanning is the next step before concluding that a reinstall is the only path forward.

Quick decision: my device is infected right now→Strong real-time protection once the machine is clean→Simple ongoing protection after cleanup→Protection that won't slow things down→