You clicked on a link, downloaded a file that seemed legitimate, or opened an attachment from a known sender, and suddenly everything changed. The pop-ups become more frequent, the websites that are opened in your browser are strange, your computer starts working slower, or you get even worse; you get a message requiring payment to release access to your files.
The feeling of “I have a virus” is the feeling that everybody knows about. You feel afraid. Did I lose everything? Is someone looking at me? Can I save my data without losing everything?
The good news is that in most cases yes, you can fix the problem. Learning how to deal with malware infection is not something complicated that can be done only by specialists; it is the process that anybody can perform. And when you learn the process of cleaning your PC, you will be able to prevent the infection.
So let me teach you how to deal with this situation.
First, let’s recognize what malware looks like
Before removal, it is useful to identify the cause of the problem, as not every PC problem is associated with malware; sometimes, a hardware failure or update is responsible for similar symptoms. However, certain characteristics strongly point at malware infections:
- Slow performance: Your PC becomes noticeably slower, takes ages to load, or fan activity increases drastically
- Unwanted modifications: There are new toolbars, add-ons, or search engines installed on your PC without your permission
- Pop-up messages and ads: Particularly, those telling to “update your software” or “clean your registry”
- Disabled antimalware software: You cannot enable or use your antivirus anymore
- Internet problems: Your connection becomes noticeably slow although you do not use the network
- Lost or corrupted files: The names or extensions are altered, and the files get locked or encrypted
When several features from the above list apply to your situation, it is safe to assume that there is malware infection on your PC. Let’s solve this problem.
Step 1: Disconnect Immediately
This is your first and foremost step. You should disconnect from the Internet by switching off your Wi-Fi or unplugging your Ethernet cable.
There are two reasons for this:
- Prevents data loss: Malware has many variants that are specifically developed for stealing your identity information or personal files. By disconnecting yourself from the network, you will prevent further transmission of your information to malicious entities.
- Prevents communication: Most variants of malware establish a connection with remote C&C servers. However, you will be able to block this process as long as your machine does not have Internet access.
In case you need to download an antivirus tool prior to proceeding with the removal, do that and then immediately disconnect yourself from the network.
Step 2: Boot into Safe Mode
After disconnecting from the Internet, reboot your computer into Safe Mode. Safe Mode will launch only necessary drivers and services; more importantly, malware cannot execute in this mode.
Windows: Reboot your computer, and when it starts to load, keep pressing the F8 or Shift+F8 key combination. You can also use Settings > Update & Security > Recovery > Advanced Startup to boot into Safe Mode.
For Mac:
- Apple Silicon Mac: Press the power button and keep holding it as you reboot, and continue holding it until the startup options appear, then choose Safe Boot.
- Intel-based Mac: Reboot your computer and keep pressing the Shift key until the login window appears.
Boot into Safe Mode and you will essentially park your malware. It will be unable to interfere with your efforts and make cleaning easier.
Step 3: Perform a Full Scan
Let the security tools do their job now.
The first step would be scanning using the antivirus software installed on your system. This would include Microsoft Defender for Windows users, which is actually pretty good. Ignore the default protection at your own risk.
The following are my recommendations:
- Update the definition of your antivirus software if possible. Malware changes every day, and having the latest definitions helps.
- Perform a full scan, not a quick scan. A quick scan will scan the common places, but a full scan will scan the whole system.
- An offline scan may be required when malware is heavily integrated into the system. In Windows, there is something called Microsoft Defender Offline Scan, which involves rebooting the computer and scanning before Windows starts.
When you scan using your primary antivirus but the situation is still unclear, use another scanner as an additional check. Some examples of free, reliable scanners include the following:
- Malwarebytes (provides only an on-demand scan for free users)
- ESET Online Scanner
It should be noted that when using two antivirus programs, you cannot use them at the same time because they will contradict each other and will leave vulnerabilities.
Step 4: Quarantine, Not Instantaneous Deletion
If the malware scan reveals a threat, you will have the choice between two options: quarantine and delete. You should always opt for quarantine first.
The reason for this is that when you quarantine the potentially malicious file, it is put into a safe environment that cannot be accessed or run by the computer, but the file can later be recovered in case your antivirus has made a mistake—and they do from time to time. This is particularly true if the file is unusual.
Only after a couple of days of being sure about it can you then permanently delete the quarantined files.
Step 5: Check Your Browser and Uninstall Any Unknown Software
Oftentimes, the malware will hide within your browser via extensions, altered settings, or even the browser’s cache.
Browser maintenance:
- Uninstall any unknown extensions and toolbars
- Reset your home page and your search engine
- Delete your browser history, cache, and cookies
Installed software:
- Go to Settings > Apps > Apps & Features (Windows) or Applications (Mac)
- Scan through the list and remove any software that you did not install yourself
Take care here; some legitimate programs go by odd names. If you are in doubt, do an internet search for the program’s name to be sure.
Step 6: Removing Remaining Damage
While malware attacks your files, it may damage registry entries, alter file associations, change system settings, and install some junk.
To clean up after the removal of the infection, consider doing the following:
- Use the system repair utility if one is available to you. There are some security packages that have modules to automatically fix your system’s damaged components.
- Remove temporary files. Look for “Disk Cleanup” in your Start menu and clear any temporary caches where malware may be hiding.
- Inspect your startup applications list, as there may be malware installed that starts on your system boot.
Step 7: Confirm Removal
A single scan is not sufficient to ensure the removal has been done successfully. After completing the removal step, run a second scan using an alternative scanner to the one used previously.
In case the second scan returns any threat, repeat the isolation procedure. Otherwise, you can confirm that the threat was removed successfully and proceed to reconnect to the internet.
Step 8: Reset Your Passwords
If you think that the malware may have recorded your keystrokes (keyloggers) or stolen your login credentials (info-stealers), then you should assume that your passwords are now compromised.
Reset passwords for:
- Emails (most important since they can reset passwords for all other accounts)
- Financial institutions/banks
- Social media accounts
- Accounts that hold any of your personal data
Do this on a clean computer, not the one you just cleaned up until you’re sure it’s clean.
Step 9: System Restore (If Necessary)
And what if none of the above worked, and the infection still remains?
In case you are dealing with any rootkit, bootkit, or more advanced ransomware, standard removal techniques will probably not work, in which case you may want to:
Option A: Restore System
If you have a restore point saved before the infection date, reverting to it will reverse most of the changes that malware did to your system.
Important exception: Don’t use System Restore in case of ransomware. Certain ransomware removes shadow copies, and restore does not do anything with encrypted files.
Option B: Complete System Reinstallation
There are instances when the only way to be sure you are completely clean is to format your hard drive and reinstall the operating system anew. This is what is termed the nuclear option. This method wipes out all your files along with your personal data. However, before choosing this method, ensure that you back up your data (after scanning it on a machine that is not infected).
More Insights: Specific Situations
When You Need an Expert
There are certain cases of malware that will be difficult to remove through normal means:
- Rootkits that conceal themselves in the kernel of the computer
- Bootkits that infect your master boot record
- Spyware that has been designed to be undetectable
- Ransomware, which has locked up crucial files
In any of these situations, or where the task proves too much for you, there is nothing wrong with reaching out to a computer technician.
For Mac Users
Macs are not safe either. In fact, the rate at which malware infects macOS is increasing compared to that of Windows computers.
The same applies to Macs. Unplug your Mac, boot into Safe Mode, scan for malware using a legitimate antivirus program, and use Activity Monitor to look for unusual activities.
For Mobile Devices
Mobile devices are also prone to attacks. Disconnect from Wi-Fi and mobile data, start up in Safe Mode (Android), and install a reliable mobile security program.
Prevention: The True Solution
Deleting malware is not easy or fun; preventing it from happening is a lot simpler, and that should encourage you to be more prepared in advance.
Keep Up with Your Updates
Your best preventive tool? Make sure all your software is updated.
More than 60% of all successful attacks are based on known exploits for which patches exist but were not applied. Why waste time finding complicated ‘zero-day’ exploits when users fail to update their browsers, operating systems, and plugins?
Automatically update:
- Windows/macOS
- Web Browsers (Chrome, Firefox, Edge)
- Browser Extensions
- All Applications Installed
Don’t Trust It Online
The majority of malware infections arise due to phishing emails, malicious downloads, and compromised websites.
- Do not download anything except from verified sources. Downloading files from third-party download sites, torrenting sites, and “free” cracked versions of software are the most popular vectors for infection by trojans and ransomware.
- Hover before clicking. When receiving an email, hover over links to see the destination. If it does not correspond to the claimed sender, do not click.
- Beware of urgency. Phishing emails cause panic: “Your account will be suspended!” This way they try to distract you from thinking logically.
Layered Protection Strategy
There is no single security software that will protect against all threats. These include:
- Real-time antivirus to track file activities
- Firewall that controls network traffic
- Browser-based blocking of malicious advertising networks
- DNS-based filtering of malicious websites
Use Good Credentials Practices
Credential theft ranks among the topmost objectives of malware:
- Employ a password manager to create and save unique, complex passwords for each account
- Do not use the same passwords everywhere.
- Make sure to enable two-factor authentication (2FA) wherever you can
Even if a password is compromised, it will be impossible to gain unauthorized access with 2FA.
Back Up Your Data
No security measure is completely secure, even when it is implemented perfectly. By having backups done on a regular basis, you will be able to recover from ransomware attacks or infections without having to pay ransoms.
Back up using external devices or cloud-based storage solutions, but make sure that the backups are offline when they are not being used.
Further Information and Assistance
Free and trustworthy scanning solutions:
- Malwarebytes (malwarebytes.com): An outstanding on-demand scanning tool for cross-referencing
- ESET Online Scanner: A free one-off scanning solution
- Microsoft Defender Offline Scan Available on Windows 10/11
Communities and discussion boards:
- BleepingComputer (bleepingcomputer.com) Malware removal assistance forums run by experts
- Microsoft Q&A official support from Microsoft technicians
To learn more:
- Have I Been Pwned (haveibeenpwned.com) Find out whether your credentials have been compromised due to any data breach
- VirusTotal (virustotal.com): Upload any suspicious files that you can scan using multiple antivirus solutions
Please note that although VirusTotal is useful for validating any suspicions, you should never upload personal files that contain any private data.
Conclusion
Malware removal is not witchcraft; it is a systematic process that follows a defined procedure. Disconnect, boot safely, scan completely, clean any resulting damage, check, and secure your system.
The fear and uncertainty you experienced when first suspecting malware were natural reactions. However, by using this guide, you are now in command of the situation. Once your computer is cleaned, you will know what to look for before your next infection.
Keep curious, keep skeptical, and keep backups.
Explore Our Cybersecurity Category. And if you are reading it up to here, leave a sweet comment to motivate us to write blog everyday.
