How to Get Rid of Malware Safely

Malware is software designed to harm a device, spy on activity, steal information, or take control of systems. Removing it can stop ongoing activity, but it does not automatically undo stolen information or make every compromised account safe. Work carefully, avoid suspicious pop-ups and phone numbers, and use a separate trusted device for sensitive account changes.

Before starting, note any warning messages and unusual behavior, such as unexpected browser redirects, unknown apps, or files that will not open. Do not click links in security alerts. A message claiming your computer is infected may itself be a scam.

What You’ll Need

A second, trusted device with internet access, if available, for account changes and downloading official support tools.
Access to the infected device’s built-in security software or a reputable security product obtained from its official source.
Your important account recovery options, such as a recovery email or phone, and a backup drive if you need to preserve personal files.
Time to let scans and updates finish. Keep the device plugged into power when appropriate.

Step-by-Step

Disconnect the device. Turn off Wi-Fi and unplug Ethernet. Disconnect external drives and other accessories that are not needed. If you suspect a work, school, or shared-network device is infected, contact its IT administrator promptly; do not connect it to another network to test it. Disconnecting limits communication with attackers and possible spread.
Stop using it for sensitive tasks. Do not sign in to banking, email, shopping, or work accounts on the suspected device. Avoid entering passwords, payment information, or recovery codes. Use a separate trusted device for those tasks. Do not shut down or restart if a clear warning says the device is being encrypted or files are rapidly changing; disconnect it and seek professional or IT help.
Decide whether to get help first. For a personal device, you can usually proceed with a security scan. For a work or school computer, follow the organization’s incident process. If the device contains sensitive business, legal, or irreplaceable data, or you suspect ransomware, stop and consult qualified IT support before attempting removal or reinstalling the system. Avoid paying or contacting a supposed attacker based on a pop-up.
Run the built-in security scan. On Windows, open Windows Security and check Virus & threat protection; menu names can vary slightly by version. On macOS, install available system updates and review unfamiliar apps, browser extensions, and login items; use a reputable security tool if you need a malware scan. On phones and tablets, use the platform’s built-in protections and official app store tools. Do not install random “cleaner” apps advertised by alerts.
Update the security tool, then scan. If it is safe to reconnect briefly, use the tool’s own update function or the vendor’s official website to get current protection definitions. Do not browse from suspicious links. Run a full or thorough scan, not just a quick check, and follow the security product’s instructions to quarantine or remove identified threats. Read alerts carefully before deleting files you recognize as important.
Use a trusted offline scan if needed. If malware blocks normal scans or returns after removal, use the operating system’s official offline scanning or recovery guidance, where available. Download any rescue tool only from the operating-system maker or security vendor, using a clean device. Avoid unfamiliar boot media or instructions that ask you to disable security protections without a clear, trusted reason.
Remove suspicious browser changes. After the device is scanned, remove extensions you do not recognize and restore the browser’s default search engine or home page if they were altered. Clear suspicious site permissions and notifications. Browser menus differ slightly by version. If redirects continue, use the browser maker’s official reset instructions, and save only bookmarks or files you trust.
Restart and scan again. Restart when the security tool recommends it, then run another scan. Check whether the original symptoms return. If the same detection reappears, do not keep dismissing it or repeatedly reinstalling unknown tools; disconnect again and contact the security vendor or a qualified technician.
Update the operating system and apps. Install updates through the device’s built-in settings or the software maker’s official source. Update browsers and remove apps you do not recognize. Menu paths can differ by version. Updates fix security weaknesses that malware may exploit, but they cannot prove that a device is clean by themselves.
Secure accounts from a clean device. Change passwords for email first, then other important accounts, especially if you entered credentials while the device may have been infected. Use unique passwords and turn on multifactor authentication where available. Review account recovery details, active sessions, forwarding rules, and recent sign-ins; sign out sessions you do not recognize. Contact the account provider through its official site if you cannot regain control.
Restore files cautiously. If files were damaged or encrypted, use a backup known to predate the infection, after the device is cleaned and updated. Scan the backup before restoring it. Do not connect a backup drive to an infected device. If you have no backup, a reputable technician may be able to assess recovery options; avoid tools that promise guaranteed recovery.
Reset or reinstall only if necessary. If malware persists, security software cannot remove it, or you need strong assurance, use the device maker’s official instructions to reset or reinstall the operating system. Back up only essential personal files and scan them; do not restore suspicious apps or system settings. A reset can erase data, so confirm what will be removed and have recovery information available before starting.

Common Mistakes

Do not trust a pop-up that gives a phone number, demands payment, or says to install remote-access software. Close the browser tab or app without following its instructions. Do not run several security products at once; they can conflict and make results harder to interpret. Avoid deleting system files manually, disabling protections, or downloading tools from ads and unofficial sites.

Another mistake is assuming that a clean scan proves accounts are secure. Malware may have copied passwords before removal. Change exposed credentials from a clean device and check account activity. Likewise, do not reconnect a backup drive or shared device until the infected system has been addressed.

Tips

Keep automatic operating-system, browser, and app updates enabled when practical.
Use a reputable security product and obtain it only from its official source or the device’s built-in store.
Keep more than one backup of important files when possible, with at least one copy disconnected from the computer.
Use unique passwords and multifactor authentication. Never share one-time login codes with someone who contacts you unexpectedly.
For a shared household device, tell other users not to sign in or connect backup drives until cleanup is complete.

Troubleshooting

The scan will not start: Disconnect from the network, restart if there is no sign of active file encryption, and try the operating system’s official offline scan or recovery guidance. If security tools are blocked, seek help from the device maker or a qualified technician rather than downloading a “fix” from a pop-up.

Malware returns after removal: Update the security software, run a full scan again, and check for suspicious apps or browser extensions. Reappearance can mean the threat was not fully removed or that a compromised account or synced setting is restoring changes. Contact the security vendor or a technician if it continues.

The device is locked or files are encrypted: Disconnect it from networks and external drives. Do not delete encrypted files or reset the device before getting advice, because this may remove useful recovery evidence or options. Contact your organization’s IT team if applicable, or a reputable incident-response professional.

You cannot access an account: Use the provider’s official account-recovery page from a clean device. Secure the associated email account first when possible, and contact the provider through a verified support channel. If payment details may have been exposed, contact your bank or card issuer using the number on the card or its official website.

Frequently Asked Questions

Can malware be removed without deleting my files?

Often, security software can quarantine or remove a threat without erasing personal files, but there is no guarantee. Back up only files you trust, and scan them before restoring them to a cleaned device.

Is a free malware scan enough?

A built-in or reputable free scanner may detect and remove many threats. Download it from an official source, keep it updated, and seek professional help if detections return or the device remains compromised.

Should I factory-reset an infected phone or computer?

Not as the first step in every case. A reset can remove persistent malware, but it also erases data and may restore infected files or settings if you bring them back carelessly; follow the maker’s guidance.

Can malware spread to other devices on my Wi-Fi?

Some threats can spread across networks, while others cannot. Disconnect the suspected device, avoid sharing files or drives with it, and contact your network administrator or IT support if other devices show unusual behavior.

How do I know the malware is gone?

A clean, updated scan and the disappearance of suspicious behavior are reassuring, but neither guarantees that stolen information or compromised accounts are resolved. Secure accounts separately and get expert help if warnings or symptoms return.

What should I do if I clicked a suspicious link?

Close the page, do not download or run anything, and scan the device. If you entered a password or payment details, change the password from a clean device and contact the relevant account provider or financial institution.

Further reading: Microsoft Support. Details can change, so check the official page for anything that matters to you. Spotted a mistake? Tell us. How we write an answer.