How do I remove malware from a computer?

Most reported malware is not malware: it is browser adware, unwanted extensions, or a scam page claiming an infection. Distinguishing those from a genuine compromise matters, because the response differs and because panic is exactly what scam pages are engineered to produce.

Safety

What you'll need

• Second device for password changes
• External drive for backup (optional)
• Reputable on-demand scanner (optional)

Step by step

1. Check whether it is genuine malware or a scam page.A full-screen warning with a phone number is a scam. Close the tab, or force-quit the browser. Real security software does not behave that way.
2. Disconnect from the internet.It stops data being sent out and stops additional components downloading.
3. Back up your personal files if you have not already, to an external drive.Files only — do not back up programs. Scan the backup before restoring anything.
4. Run a full scan with the built-in security software.Windows Defender is genuinely capable. On macOS, check for unexpected profiles and login items too.
5. Run a second scan with a reputable on-demand scanner.A second opinion from a different vendor catches things the first misses. Download it from the official site only.
6. Check browser extensions and remove anything you do not recognise.Browser adware is the most common real problem, and it lives in extensions rather than in the system.
7. Check startup programs and installed applications for anything unfamiliar.Sort installed programs by install date — anything that appeared when the problem started is suspect.
8. Change your passwords from a different, clean device.This is the step people skip. If a keylogger captured them, cleaning the machine does not protect the accounts.
9. If banking or financial details were on the machine, contact your bank.Speed matters. Do this from a different device.
10. If the infection persists after all that, wipe and reinstall.It is the only guaranteed removal. With a good backup it is a few hours rather than a disaster.

Tips

• Keeping the operating system and browser updated prevents the large majority of infections in the first place.
• Most real-world compromise now comes through phishing and fake downloads rather than exploits. Being careful about what you install matters more than which antivirus you run.
• If a machine is old and has been misbehaving for a long time, a clean reinstall is often faster than diagnosis.

Common mistakes

• Calling the number in a warning pop-up — It is always a scam. They will ask for remote access and payment to fix a problem that does not exist.
• Cleaning the machine but not changing passwords — If credentials were captured, the accounts remain compromised regardless of the machine's state.
• Downloading a 'cleaner' from a search advert — Fake security tools are themselves a common malware vector. Go to the official site directly.

Questions people ask