Captchadecode.com: what it is and how to remove it
Captchadecode.com is a push notification virus that seeks to infect your device to cause redirects and show tons of deceptive advertisements directly on your PC desktop or phone screen. If you didn't type in the article's culprit's address manually, but the treacherous portal still opens from time to time, you have an adware infection hiding in your device.
Facts checked October 6, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
Not sure whether the captchadecode[.]com command did anything? An automatic scan looks through the places it would hide.
Do it yourself · free Remove Captchadecode.com yourself 4 steps, about 12 minutes, no software needed.
Start the steps
Captchadecode.com: summary
| Distribution | Fake Flash Player updates, software bundles, file-sharing platforms |
|---|---|
| Damage | Malware infections, PUP installation, privacy issues |
| name | Captchadecode.com |
| Type | Push notification virus, adware, PUP |
| Symptoms of infection | Ads in the form of notifications pop-up on your screen and, if clicked, lead to untrustworthy websites; more than usual adverts of frequently visited pages; diminished browsing speed |
| Detection names | No Microsoft detection name is known |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 7 more facts
| Name | Captchadecode.com |
|---|---|
| Symptoms | A fake CAPTCHA asking to press Win+R |
| Evidence | 4 write-ups by security sites; details still limited |
| Imitates | A human-verification check |
| Domains | captchadecode[.]com |
| First seen | 23 July 2021 |
| Facts checked | 6 October 2026 |
Is the Captchadecode.com check real?
- Address:
captchadecode[.]com
From our report of Jul 2021 · not reviewed since
More from our earlier report on Captchadecode.com
- Check for any system irregularities and repair them by performing system diagnostics with the all-in-one optimizer
What the Captchadecode.com scammers want
From our report of Jul 2021 · not reviewed since
Captchadecode.com – a deceptive webpage that will bombard your screen with ads
Captchadecode.com is a push notification virus that seeks to infect your device to cause redirects and show tons of deceptive advertisements directly on your PC desktop or phone screen.
If you didn't type in the article's culprit's address manually, but the treacherous portal still opens from time to time, you have an adware infection hiding in your device.
The potentially unwanted program can cause various browsing issues, including covering your whole browser window with deceptive ads, collecting non-identifiable information (your IP address, geolocation, browser/device details, search inquiries, browsing history, etc.), causing redirects to affiliated websites, and so on.
Therefore, the adware can not only diminish your browsing experience but also endanger your privacy and security. We'll show you how to remove it safely. When it comes to Captchadecode.com, you must not accept its notifications at all costs, or you will be bombarded with ads.
Push notifications are great to receive breaking news, the latest sports updates, amazing shopping deals, etc. But they should be accepted only from legitimate sources as cybercriminals misuse this service to gain revenue from showing you deceptive ads.
Ads in the form of notifications, depending on what operating system you're using, appear on the top-right or bottom-right corners of your desktop or directly on your phone screen. They shouldn't be joked with, as by clicking them or trying to close them, you might end up on hazardous sites.
We're not saying that all affiliated sites will be riddled with malware, try to lure out your private details, or draw you into tech support scams, but do you really want to find that out by yourself? Please don't interact with them in any way and use our illustrated instructions to get rid of them.
What to do if you ran the Captchadecode.com command
Whether you ran the command decides everything else, so the first step checks that.
Step 1: Check whether the pasted command ran
The fake check asked you to press Windows + R, paste and press Enter. Open the same box and look at its drop-down history: a
powershell,mshtaor curl line you did not type yourself is the command Captchadecode.com gave.Once run, it fetches malware within seconds, so take the PC offline and follow all the remaining steps. If the history is empty or harmless, nothing was started on the Windows 11 or Windows 10 PC.
Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 2: Scan the PC, then run the offline scan
A scan finds the parts of Captchadecode.com that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options, start a Full scan and quarantine what it reports.
Follow it with Microsoft Defender Antivirus (offline scan) > Scan now, which restarts the PC and checks the disk while Windows and the malware are not running.
It takes about 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 3: Change passwords from another device and sign out other sessions
Captchadecode.com can copy saved passwords, cookies and session tokens and send them out in seconds, so cleaning the PC does not undo the theft.
Change your passwords on a device that was never infected, starting with the e-mail account, since every other reset goes through it. On each account, end all other sessions and check the recovery e-mail, phone number and forwarding rules.
Then turn on two-step verification. Sign in on the Windows 11 or Windows 10 PC again only after the offline scan is clean.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account
Step 4: Delete scheduled tasks that bring it back
Programs like Captchadecode.com add a scheduled task so they return after an uninstall or reopen a page at every sign-in. Start Task Scheduler, open Task Scheduler Library and sort by Last Run Time to see what ran recently.
On the Actions tab, a program in a user folder, a script or a web address is a warning sign; right-click such a task and choose Delete.
Tasks with names copying Google, Edge or Windows updaters but pointing to an odd folder are typical. The tool looks the same in Windows 11 and Windows 10.
Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs. Full procedure with screenshots: Remove what malware leaves behind in Windows
Stream videos without limitations, no matter where you are
There are multiple parties that could find out almost anything about you by checking your online activity.
While this is highly unlikely, advertisers and tech companies are constantly tracking you online. The first step to privacy should be a secure browser that focuses on tracker reduction to a minimum.
Even if you employ a secure browser, you will not be able to access websites that are restricted due to local government laws or other reasons. In other words, you may not be able to stream Disney+ or US-based Netflix in some countries. To bypass these restrictions, you can employ a powerful VPN, which provides dedicated servers for torrenting and streaming, not slowing you down in the process.
Data backups are important - recover your lost files
Ransomware is one of the biggest threats to personal data.
Once it is executed on a machine, it launches a sophisticated encryption algorithm that locks all your files, although it does not destroy them. The most common misconception is that anti-malware software can return files to their previous states. This is not true, however, and data remains locked after the malicious payload is deleted.
While regular data backups are the only secure method to recover your files after a ransomware attack, tools such as can also be effective and restore at least some of your lost data.
From our report of Jul 2021 · not reviewed since
Two options to remove potentially unwanted programs from your infected device
As we've mentioned earlier, Captchadecode.com redirect is caused by an adware infection.
These kinds of potentially unwanted programs can cause various browser and system issues. It's capable of causing redirects to any affiliated page on demand. Therefore you might be forcibly exposed to hazardous websites that could have various evil intentions.
Moreover, by collecting your browsing-related information, adware endangers your privacy and security. Advertisers generally use these sorts of details to customize ads delivered to you, making them almost irresistible to click. Therefore, the PUP should be dealt with immediately.
You have two options for adware removal. For the automatic one, you'll have to download a reliable anti-malware tool. So if you wish to delete all threats with a push of a button, download, install, update virus definitions, and perform a full system scan with it. Once it's finished, stick to what the trustworthy app recommends removing.
If you're willing to get your hands dirty and uninstall the adware yourself, let us help you by providing illustrated guidelines. Follow this step-by-step guide to remove Captchadecode.com adware from Windows:
For a long time, Apple products were thought to be virus-free and that no infection could get a hold of them. Well, those days are long gone. Cybercriminals have developed tons of malicious software for these devices. Therefore if any infection symptoms are visible on your Mac, please use this guide to remove adware from it:
To fully remove an unwanted app, you need to access Application Support, LaunchAgents, and LaunchDaemons folders and delete relevant files:
We know that there's a chance that you didn't find the necessary uninstaller and that the redirects, deceptive ads, and other browsing issues persist. That's why we strongly recommend downloading a trustworthy security tool and scanning your computer with it.
If for some reason, you didn't like the first recommended tool, you could try using the . It's as powerful as the first one, but its GUI (Graphic User Interface) might be more suitable for some users. It's your choice, but a full system scan needs to be performed to remove all PUPs.
Adware and similar programs are usually installed unknowingly via software bundles. All additional apps are installed when users rush through the process by choosing the Standard, Quick, Recommended mode. Proper security tools would identify the PUPs within the bundles and prevent you from installing them.
They would also block you from entering any high-risk portals and safeguard your device against the ever-growing numbers of severe malware that could cause terrible headaches and cost thousands in recovery. To sum up, a dependable security tool is a must for every user.
- Enter Control Panel into Windows search box and hit Enter or click on the search result.
- Under Programs, select Uninstall a program.
- From the list, find the entry of the suspicious program.
- Right-click on the application and select Uninstall.
- If User Account Control shows up, click Yes.
- Wait till the uninstallation process is complete and click OK.
- From the menu bar, select Go > Applications.
- In the Applications folder, look for all related entries.
- Click on the app and drag it to Trash (or right-click and pick Move to Trash)
- Select Go > Go to Folder.
- Enter /Library/Application Support and click Go or press Enter.
- In the Application Support folder, look for any dubious entries and then delete them.
- Now enter /Library/LaunchAgents and /Library/LaunchDaemons folders the same way and terminate all the related .plist files.
From our report of Jul 2021 · not reviewed since
Illustrated instructions to remove Captchadecode.com notifications from popular browsers
Ads presented by the article's culprit could redirect you to various shady websites.
Some of them might try to lure out your private info (name, address, email, credit card details, phone number, etc.); others could infect your device with malware instantly through the drive-by downloading technique.
Not all of the affiliated sites might be dangerous, but we don't recommend clicking on any of the ads to find out. Please don't even try to close the ads by pressing on the "X" button because it's usually programmed to misfunction and redirect to sponsored sites.
The good news is that after completing all the step-by-step instructions in this chapter in continuation, ads in the form of notifications, annoying you, and disturbing your peace, will be a thing of the past. The bad news is that you will have to get your hands dirty as no app can help you with that.
But that's what we're for. Our experts have prepared illustrated instructions for three browsers. Let's start with the most popular one. These instructions will help you to remove unwanted notifications from the Google Chrome browser:
If you're using a Mac, it's safe to assume that the push notification virus has infected your Safari browser. The only difference between Windows and macOS is that the notifications would continuously pop up in the top-right corner of your screen. Here's what you need to do to get rid of them:
Captchadecode.com also has the ability to infect the default Windows browser. The removal process is fairly simple, but for your convenience, we've added illustrated instructions for Edge aswell:
By scanning your infected device with reliable anti-malware software and cleaning all browsers installed on your system, the irritating and dangerous ads will stop. In the future, you have to be cautious about what notifications you accept.
If your kids or anyone else with less cybersecurity knowledge is using your device, then a reliable anti-malware tool is a must as it would block entrance to such pages. In addition, it wouldn't allow the installation of PUPs and prevent malware infections.
The last part of the removal is meant to restore the overall health of your device. IT specialists highly recommend entrusting this task to the system diagnostics software. It will automatically detect all virus damage and suggest repairing it. Furthermore, it will delete all tracking cookies from all browsers.
- Open the browser and go to Menu > Settings.
- Locate the Privacy and security section and pick Site Settings > Notifications.
- Look at the Allow section and look for a suspicious URL.
- Click the three vertical dots next to it and pick Block. This should remove unwanted notifications from Google Chrome.
- Click on Safari > Preferences...
- Go to the Websites tab and, under General, select Notifications.
- Select the web address in question, click the drop-down menu and select Deny.
- Open Microsoft Edge, and click the Settings and more button (three horizontal dots) at the top-right of the window.
- Select Settings and then go to Advanced.
- Under Website permissions, pick Manage permissions and select the URL in question.
- Toggle the switch to the left to turn notifications off on Microsoft Edge.
Questions about Captchadecode.com
I pressed Win+R and pasted the code from captchadecode[.]com. Am I hacked?
Assume yes and act now. The command a fake CAPTCHA on captchadecode[.]com copies to your clipboard downloads and runs malware, usually an information stealer or a remote access trojan, and stealers can copy browser passwords and cookies within a minute. Disconnect the PC from the internet.
Run a Microsoft Defender Offline scan, then remove new startup items, scheduled tasks and programs. From another device, change your e-mail password first, then banking and everything else saved in the browser, sign out of all sessions and turn on two-step verification. If crypto wallets were on the PC, move the funds from a clean device.
Why does captchadecode[.]com ask me to run a command to prove I am human?
Because the command is the attack. Real human checks, from Google, Cloudflare or anyone else, only ask you to click or solve a puzzle inside the page; none ever needs the Windows Run box. Criminals use this trick, called ClickFix, because browsers block malicious downloads but cannot stop you from running something yourself.
The page on captchadecode[.]com mimics a familiar verification box to make the request feel routine. If any page asks you to press Win+R, open PowerShell or paste anything into Windows, close it. That one rule defeats every ClickFix page.
Does a human-verification check know about Captchadecode.com?
Large brands such as a human-verification check are aware that scammers copy their names and logos, and most have pages where you can report such abuse. They do not run these pages and do not profit from the warnings themselves.
Sometimes an affiliate of an antivirus vendor sends traffic through fake alerts, which breaks the vendor's rules and gets the affiliate banned when reported. If you want to help, report the page address to the brand's security team and to your browser through its report option.
Why does my browser keep opening captchadecode[.]com?
Because something sends you there. The usual causes are a notification permission you gave to some site, an adware extension, or a site you visit often that shows redirect ads. The site itself cannot open on its own.
Remove unknown sites from the notification settings, check the extensions list, and do not restore the previous session when the browser starts. If the page appears even with the browser closed, look in Installed apps for programs you did not install. Running a scan with Windows Security afterwards confirms that nothing else is involved.
Why does Captchadecode.com use the a human-verification check design?
Because people see real a human-verification check checks every day and click through them without thinking. The attackers copy the familiar box, the colours and the wording, then add a few extra steps that look like part of the routine.
The trust in the real service is what makes the trick work. That is also why the page appears on ordinary websites: a hacked site with a familiar check feels safe. The extra keyboard steps are the only reliable sign, and they are always fake.
Which browser settings protect against fake alerts?
Three matter most. First, notifications: set your browser to ask before allowing them, and block sites you do not trust. Second, reputation checks: SmartScreen in Edge and Safe Browsing in Chrome warn you before known scam pages load, and Firefox has its own deceptive-content protection under Privacy & Security.
Third, pop-ups and redirects: keep the default blocking on. Add a reputable ad blocker if fake alerts keep reaching you through ads on sites you use. Review the notification list every few months.
Is my phone affected by Captchadecode.com?
Not through the PC. A scam page in a Windows browser cannot reach a phone, even if both use the same account. The sign reported, A fake CAPTCHA on captchadecode[.]com that asks you to paste a command, happened in a browser on the PC.
Phones can meet similar pages on their own, usually through ads or notifications, and the fix there is the same idea: remove notification permissions and unknown apps. If you used the phone to call a number shown on the page, follow the steps for callers in this guide.
The page will not close. What can I do?
Press Esc to leave full-screen mode, then close the tab. If the browser is frozen, open Task Manager with Ctrl + Shift + Esc, select the browser and click End task. When you restart the browser, do not restore tabs.
If the page loads again on start, open a new window and close the old one, then remove the page from the browser's startup settings. Restarting the PC also works. Nothing was installed by the page, so closing it by force is safe and loses nothing.
Why is pasting a command so dangerous?
Because it skips every protection that would stop a normal download. Browsers check files you download and SmartScreen checks programs you open, but a command you type yourself is trusted as your own action. Pages like Captchadecode.com exploit exactly this.
The command fetches and runs code in memory, often leaving little on the disk for a quick scan to find. That is why the advice is absolute: no website has a legitimate reason to make you paste anything into Run, Terminal or PowerShell.
Will Fortect remove Captchadecode.com?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Captchadecode.com, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Wikipedia: Potentially unwanted program (read October 6, 2026)
- Emsisoft: Drive-by downloads: Can you get malware just from visiting a website? (read October 6, 2026)
- Virusai: Virusai (read October 6, 2026)
- FTC: How to spot, avoid and report tech support scams (read October 6, 2026)
- FTC: How to recognize, remove and avoid malware (read October 6, 2026)