What to do if your computer has a virus

If your computer is infected with a virus, the first step is to disconnect it from the internet — unplug the ethernet cable or turn off Wi-Fi — so the virus cannot spread to other devices or send your data elsewhere. Then restart your computer in Safe Mode, which loads only essential programs and makes it harder for malware to run. From there, you can use antivirus software to scan and remove the infection.

The exact steps depend on whether you use Windows, Mac, or Linux, and on how badly the virus has damaged your system. Some viruses can be removed with a single scan. Others hide in places that standard antivirus tools miss, or they prevent antivirus software from running at all. If your computer is severely infected — if it will not start, or if the virus blocks every attempt to remove it — you may need to wipe the drive and reinstall your operating system.

Key Takeaways

  • Disconnect from the internet immediately by unplugging your ethernet cable or disabling Wi-Fi, so the virus cannot spread or steal data in real time.
  • Restart in Safe Mode (Windows: hold Shift while restarting; Mac: restart and hold Command-S) to prevent the virus from loading alongside your normal programs.
  • Download antivirus software on a clean device, transfer it to an external drive, and run it on the infected computer to scan and remove the threat.
  • If the virus blocks antivirus tools or prevents your computer from starting, you may need to back up your files and reinstall your operating system from scratch.
  • Change your passwords from a different device after removal, because the virus may have recorded them while it was running.

How to restart your computer in Safe Mode

On Windows: Shut down your computer completely. Turn it back on and immediately hold down the Shift key while it boots. Keep holding Shift until you see the Windows boot menu. Select "Troubleshoot," then "Advanced Options," then "Startup Settings." Click "Restart." When the menu appears, press 4 or F4 to enter Safe Mode with Networking (you need networking to download antivirus tools).

On Mac: Shut down your computer. Turn it back on and immediately hold Command-S until you see text on a black screen. This is Single-User Mode, which is Mac's equivalent of Safe Mode. Type exit and press Enter to move to the normal login screen, then log in. Your Mac will load in Safe Mode.

Safe Mode loads only the bare minimum — your operating system and essential drivers — so viruses and other malware often cannot run. This gives you a window to scan and remove the infection before the virus can interfere.

Using antivirus software to find and remove the virus

If you can still use your infected computer, download antivirus software directly onto it. Reputable free options include Malwarebytes, Windows Defender (built into Windows 10 and later), and Avast. Download the installer, run it, and let it scan your entire hard drive. The scan can take 30 minutes to several hours depending on how much data you have. When it finishes, review the results and let the software remove anything it flags as malicious.

If the virus prevents you from downloading or running antivirus software, use a clean device — a phone, tablet, or another computer — to download the antivirus installer to an external USB drive. Plug the USB drive into the infected computer while it is in Safe Mode, and run the installer from there. The virus is less likely to block software running from an external drive.

After the scan completes and the software removes threats, restart your computer normally and run the scan again. Viruses sometimes hide in places the first scan misses, so a second pass catches what the first one did not.

When antivirus software cannot remove the virus

Some viruses are designed to resist removal. They may hide in the boot sector (the part of your drive that loads before your operating system), lock down your system so antivirus tools cannot run, or disguise themselves as legitimate system files so the antivirus software is afraid to delete them. If you have run antivirus scans in Safe Mode and the virus is still there, or if your computer will not start at all, you have reached the point where reinstalling your operating system is usually the fastest solution.

Before you reinstall, back up any files you need. Plug an external hard drive into your computer, copy your documents, photos, and other personal files to it, and scan that external drive with antivirus software before you use those files again. The virus may have infected your files as well, though this is less common with most malware.

To reinstall Windows, go to microsoft.com/software-download/windows on a clean computer, download the Windows installation media onto a USB drive, plug that drive into your infected computer, and follow the on-screen prompts. The process erases your hard drive and installs a fresh copy of Windows. For Mac, restart while holding Command-R to enter Recovery Mode, then use Disk Utility to erase your drive and reinstall macOS.

Protecting your accounts after removal

While the virus was running, it may have recorded your passwords, credit card numbers, or other sensitive information. Change your passwords from a different device — a phone, tablet, or a different computer — as soon as the virus is removed. Start with your email account, because email is the master key to resetting passwords for everything else. Then change passwords for your bank, social media, and any other accounts that contain sensitive data.

If you used the same password for multiple accounts, change all of them. If you have a password manager like Bitwarden or 1Password, change the master password first, then update the passwords it stores. Consider placing a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — if you are worried the virus captured financial information.

How viruses get onto computers in the first place

Most viruses arrive through email attachments, downloads from untrusted websites, or software that looks legitimate but is not. A file named "invoice.exe" or "document.pdf.exe" is almost always malicious — legitimate documents do not have .exe extensions. Links in emails from people you do not know, or from accounts that have been hacked, often lead to malware downloads.

Keeping your operating system and software up to date closes the holes that viruses use to get in. Windows Update, macOS updates, and security patches for your browser and other programs fix vulnerabilities as soon as they are discovered. Running antivirus software continuously in the background catches most threats before they can do damage. And being skeptical of unexpected attachments and downloads — even from people you know — stops many infections before they start.

Frequently Asked Questions

How do I know if my computer actually has a virus?

Common signs include your computer running much slower than normal, programs crashing or freezing, pop-up windows appearing constantly, your antivirus software being disabled without your action, or your browser homepage changing on its own. The only way to be certain is to run an antivirus scan. If the scan finds nothing, the slowness is usually caused by something else — a full hard drive, too many programs running at startup, or aging hardware.

Is it safe to use my computer while the antivirus scan is running?

It is safe, but the scan will run much slower if you are using the computer at the same time. Let the scan finish without interruption if you can. If you must use the computer, close other programs and avoid opening large files or streaming video.

Can a virus spread to my phone or tablet from my computer?

Most computer viruses cannot infect phones or tablets because they run different operating systems. However, if you sync files between devices, or if you log into accounts on both, a virus on your computer could potentially steal passwords and use them to compromise your phone. Change your passwords from a clean device after removing a virus.

What if I cannot get into Safe Mode?

If your computer will not start at all, or if Safe Mode will not load, you will need to reinstall your operating system. Download the installation media on a clean computer, create a bootable USB drive, and follow the reinstallation steps for your operating system. This erases your drive, so back up important files first if you can.

Should I pay for antivirus software or use the free version?

Free antivirus software like Malwarebytes and Windows Defender removes most viruses just as effectively as paid versions. Paid versions usually add features like real-time monitoring, a VPN, or password management, but for basic virus removal, free tools are sufficient. Do not pay for antivirus software you find through a pop-up or email — those are often scams.