How to remove a virus from your computer: a step-by-step guide for Windows and Mac

Windows and macOS both include built-in tools that find and remove malware, so you can start a cleanup without buying anything. The order matters: contain the problem, scan with up-to-date security software, remove whatever let the malware in, and only then change your passwords. Not sure anything is wrong yet? Start with our guide to the warning signs, since a slow laptop isn't always an infected one.

First steps before you remove anything

The FTC's advice starts before any scan. If you clicked a suspicious link, opened an unexpected attachment or see signs of malware, stop logging in to accounts that use passwords or other sensitive information, such as banking and shopping sites. Criminals use malware to steal usernames, passwords and account numbers, the FTC notes. Those logins can wait until the computer is clean.

Should you disconnect from the internet?

In our view, it's a sensible first move. NIST's malware-handling guide treats disconnecting an infected computer from the network as a basic way to contain an isolated infection. It also warns that going offline doesn't guarantee the malware stops doing damage on the computer itself, so start the cleanup soon. Reconnect briefly to update your security software before you scan: Windows Security uses security intelligence every time a scan is run, Microsoft notes, and you can check for the latest version yourself.

Should you back up an infected computer?

Yes, if the files matter, because some fixes later in this guide reinstall the operating system. Microsoft advises backing up the files you want to keep before a reset, and Apple suggests a backup before reinstalling macOS. Keep that copy apart from older backups, since NIST notes that malware can be captured in a backup. Scan the drive before you open anything from it later, as the FTC recommends for external drives.

How to remove a virus from a Windows PC

Windows 10 and 11 include Microsoft Defender Antivirus in the Windows Security app. Microsoft says it scans your device automatically, but you can run an extra scan at any time. If you use another company's antivirus, Defender turns itself off, so scan with that program instead. The steps below go from the simplest to the most thorough.

Run a full scan in Windows Security

1. Update first: in Windows Security, go to Virus & threat protection > Protection updates > Check for updates.
2. Then select Virus & threat protection > Scan options > Full scan > Scan now. A full scan checks every file and program on the device, so it takes a while.
3. Microsoft suggests restarting and starting the scan before you open other apps. Free up space on the system drive if it's nearly full, since Defender needs room to quarantine and remove malware.
4. Keep cloud-delivered protection and automatic sample submission on (Virus & threat protection > Virus & threat protection settings > Manage settings), which Microsoft says significantly increases the chances of detecting never-before-seen malware.

What does protection history tell you?

Open Protection history in Windows Security to see what Defender did. A "Threat quarantined" card means the item is blocked but not yet deleted, and selecting Remove deletes it. For "Threat found - action needed", Microsoft advises choosing Quarantine whenever you aren't sure the item is safe. "Remediation incomplete" means the cleanup didn't finish, and the card lists the extra steps to take. Events stay in the list for two weeks.

What is a Microsoft Defender Offline scan?

Some malware hides while Windows is running, so Microsoft's offline scan restarts the PC and scans from a trusted environment before Windows loads. Microsoft recommends it when the same malware keeps returning, since a hidden component may be reinstalling it after each restart. Save your work, go to Virus & threat protection > Scan options, choose Microsoft Defender Antivirus (offline scan) and select Scan now. The scan takes about 15 minutes, Microsoft says, and the results then appear in Protection history. If BitLocker encrypts the system drive, Microsoft advises suspending BitLocker protection first; otherwise you may be asked for the recovery key when the PC restarts into the scan. The offline scan doesn't apply to ARM editions of Windows, and it won't run if the Windows Recovery Environment is turned off.

Should you scan in Safe Mode?

For malware that hides from a running Windows, Microsoft's troubleshooting guide recommends the offline scan and doesn't mention Safe Mode, so we'd start there. Safe Mode is a troubleshooting tool that starts Windows with a limited set of files and drivers, which helps you rule out default settings and basic drivers as the cause of a problem. To reach it on Windows 11, go to Settings > System > Recovery (on Windows 10, Update & Security > Recovery), select Restart now next to Advanced startup, then choose Troubleshoot > Advanced options > Startup Settings > Restart. Pick Enable Safe Mode, or Safe Mode with Networking to stay online, and have your BitLocker key if the device is encrypted.

Microsoft's other removal tools

The Malicious Software Removal Tool arrives through Windows Update, usually monthly, and stays quiet unless it finds an infection. Microsoft is clear about its limits: it targets only specific, widespread malware, can't remove malware that isn't running and doesn't replace an antivirus. For a broader on-demand scan, Microsoft offers Safety Scanner as a separate download. It expires 10 days after you download it, so get a fresh copy before each scan.

Remove suspicious apps, extensions and browser settings

• Uninstall programs before you reset a browser, as Google advises. Go to Start > Settings > Apps > Installed apps and select More > Uninstall next to anything you don't recognize.
• Include any remote-access app that a caller or a pop-up talked you into installing. Microsoft lists removing it as the first step after a tech support scam.
• In Edge, select Extensions to the right of the address bar, then More actions > Remove from Microsoft Edge > Remove for any extension you don't know.
• In Chrome, Google's steps are More > Settings > Reset settings > Restore settings to their original defaults > Reset settings. Google says your bookmarks and saved passwords won't be deleted, though you'll need to turn back on any extensions you trust.
• Our browser hijacker guide walks through Chrome, Edge, Safari and Firefox in more detail.

How to remove malware from a Mac

Macs can get malware too. Apple says viruses, worms, trojan horses and other harmful programs can get onto a Mac through items downloaded from email, messages and websites. If macOS warns that something you downloaded is malware, Apple's advice is to move it to the Trash and then empty the Trash. Much of the rest happens automatically.

Does macOS remove malware on its own?

Partly. macOS has built-in antivirus technology called XProtect, and Apple updates its malware signatures automatically, separately from system updates. When XProtect finds known malware, it blocks it, moves it to the Trash and alerts you, and it can also clean up infections once Apple sends updated information. Background security-configuration updates remove known malicious software that's already installed when you restart, which is why Apple's fix for stubborn adware includes updating macOS and restarting. Check that these updates are switched on:

• macOS Tahoe 26 or later: System Settings > General > Software Update, click the More Info button next to Automatic Updates and turn on "Install system data files and security updates".
• Also in Tahoe 26 or later: System Settings > Privacy & Security > Background Security Improvements, with Automatically Install turned on.
• macOS Sequoia, Sonoma and Ventura: the same More Info button shows "Install Security Responses and system files". Keep it on.
• Then install any pending macOS update and restart the Mac.

Remove unwanted apps and login items

1. Quit the app and find it in the Finder, usually in the Applications folder.
2. If it came with an Uninstall or Uninstaller app, use that: Apple calls it the best way to delete the app along with any login items, extensions or other data it stored elsewhere.
3. Otherwise, drag the app to the Trash, enter an administrator password if asked, and choose Finder > Empty Trash.
4. If the Mac says the app is in use, restart or start up in safe mode and try again, Apple suggests.
5. Then open System Settings > General > Login Items & Extensions (Login Items in macOS Sonoma and Ventura), select any login item you don't recognize and click the Remove button below the list, and review which apps are allowed to run in the background.

Clean up Safari

Go to Safari > Settings > Extensions, select any extension you don't recognize and click Uninstall, or delete the app that installed it. Apple notes that extensions may be able to access the content of the webpages you visit. The Websites tab lets you block pop-ups, and the Security tab turns on warnings about fraudulent websites. If a bad page keeps coming back, quit Safari and hold Shift as you open it, so it doesn't reopen the old windows and tabs.

When the malware won't go away

Microsoft gives two common reasons a threat returns. You can catch it again from the same website or email, so avoid sites that offer illegal downloads. Or a hidden component quietly reinstalls it after a restart, which the offline scan is designed to catch. If neither fix works, rebuild: NIST calls it the most reliable way to restore a computer's integrity after a long or unknown infection or one involving rootkits, and recommends it when a computer stays unstable after cleaning.

Reset this PC or reinstall Windows

Reset this PC reinstalls Windows. Keep my files removes apps and settings but keeps your personal files, while Remove everything deletes your files too. On Windows 11, go to Settings > System > Recovery > Reset PC; on Windows 10, it's Settings > Update & Security > Recovery, then Get started. If a scan doesn't fix a suspected infection, Microsoft's recovery page points to reinstalling Windows from installation media with the clean installation option, which removes your personal files, apps and settings. Have your BitLocker recovery key ready, and don't restart the PC yourself if the screen goes dark mid-reset, which Microsoft warns can make it fail.

Reinstall or erase macOS

Reinstalling macOS from macOS Recovery doesn't remove your apps or personal data, Apple says, so delete unwanted apps first. For a clean slate, Erase All Content and Settings erases all of your data, settings and apps while keeping macOS installed. In System Settings it's under General > Transfer or Reset; on macOS Monterey, open System Preferences and choose Erase All Content and Settings from the System Preferences menu. It needs macOS Monterey or later on a Mac with Apple silicon or the Apple T2 Security Chip. Back up first, because everything else on the Mac is erased.

Can you restore a backup without bringing the virus back?

Use a backup made before the infection whenever you can. Microsoft favors backups kept in an external location such as OneDrive, and warns that backups sitting on the PC during an infection may already have been changed by the malware. On a Mac, Migration Assistant restores from Time Machine and lets you pick an older backup and choose which kinds of files to bring back. In our view, the cautious route is to restore only your personal files and reinstall apps from official sources.

After the cleanup: secure your accounts

Once the computer is clean, change your passwords and turn on two-factor authentication, the FTC advises, in case the malware gave someone access to your accounts. Microsoft's steps for a hacked account put a full antivirus scan before the password change. Microsoft also advises against signing in to email and social media from untrusted devices. Our advice: if you aren't sure the computer is clean yet, change your passwords from another device you trust. Give each account a new, strong password, and change any you reused elsewhere.

Which accounts should you secure first?

• Email, because the FTC notes that whoever controls your inbox can use password-reset links to take over your other accounts.
• Banking, credit cards, payment apps and your tax filing site.
• Social media, then the sites you shop on.
• Where you can, use an authenticator app or a security key instead of text-message codes. The FTC calls security keys the strongest method.

Check your accounts for signs of misuse

• Sign out of all devices, so anyone else who is logged in gets kicked out.
• Delete email forwarding rules you didn't create, and review connected accounts and automatic replies.
• Confirm that the recovery email addresses and phone numbers on each account are yours.
• Check bank and card statements and report transactions you don't recognize. If you think your personal information was stolen, IdentityTheft.gov can give you a recovery plan.

Fake "virus removal" scams

Some virus warnings are scams themselves. In the pattern the FTC describes, a pop-up from a seemingly well-known company, or a caller posing as a technician, gets you on the phone; the scammer then asks for remote access, pretends to find a malicious program and offers to remove it for a fee. Payment is often demanded in gift cards, wire transfers, cryptocurrency or a payment app, which are hard to reverse. Microsoft adds that scammers may spoof caller ID or lock the browser in full-screen pop-ups.

Is a virus pop-up with a phone number real?

No. The FTC says genuine security pop-ups never ask you to call a phone number, and Microsoft says its error and warning messages never include one. Apple's advice is not to believe pop-ups about viruses, not to call or click, and to close the Safari window or tab, since some pop-ups have fake close buttons. If you think something really is wrong, the FTC suggests updating your security software and running a scan yourself.

What if you gave a scammer remote access?

1. Uninstall any apps the scammer had you install.
2. Update your security software, run a full scan and delete anything it flags.
3. Install all available security updates, and consider resetting the device if fake error messages keep appearing, as Microsoft suggests.
4. Change your passwords and turn on two-factor authentication, starting with any password you gave the scammer.
5. If you paid, ask your card company to contest the charge, and report the scam to the FTC at ReportFraud.ftc.gov.

When a third-party antivirus helps

You don't need to buy anything to clean up an infection: Windows includes Microsoft Defender Antivirus, which Microsoft's troubleshooting guide calls a robust antimalware product, and macOS has XProtect built in. Microsoft notes that anti-malware from other companies is also an option. The FTC's advice is to use security software, keep it updated and set it to scan new files automatically. No scanner catches everything, though, and the FTC notes that malware can go undetected, at least for a while.

When is a third-party antivirus worth adding?

• In our view, a second opinion makes sense when symptoms persist after clean scans. On Windows, Microsoft's own on-demand option is Safety Scanner.
• When you want protection for several computers and phones managed in one place. Check which devices each plan covers.
• Only one at a time. Microsoft warns that running more than one antivirus can slow a PC, make it unstable or cause unexpected restarts.
• Never from a pop-up, an ad or a cold call. The FTC warns against clicking software ads; type the vendor's web address yourself.

How to keep it from coming back

• Keep the operating system, browser and apps updating automatically, and remove software and extensions you don't use, as Microsoft advises.
• Move off Windows 10 if you can. After October 14, 2025, Microsoft stopped providing free software updates, technical help and security fixes for it.
• Download software only from the developer's site or an official store, and skip key generators, which Microsoft says often install malware too.
• Read each installer screen. Microsoft notes you can usually decline bundled toolbars by clearing a check box.
• On a Mac, allow apps only from the App Store, or from the App Store and Known Developers (older Apple pages say identified developers), and override a warning that Apple can't check an app only if you're certain of its source.
• Use a standard, non-administrator account day to day, and keep tamper protection on in Windows Security.
• Back up with the 3-2-1 rule Microsoft recommends: three copies, in at least two places, one of them offline.

Contain it, then scan it. Remove whatever let it in. Change your passwords from a device you trust. And never call the number in a pop-up.