Security
Cleaning malware off a computer safely
Hijacked browser, unwanted programs, ransomware warnings. What to isolate, what to remove, and when a clean install is the only answer.
Read before you start
Some malware steals passwords as it runs. Change passwords from a clean device afterwards, starting with email.
This guide is for you if
- Browser hijacked and ads everywhere
- Programs installing themselves
- Machine slow, hot and noisy all the time
Step by step
Work top to bottom0 of 6 steps done
Disconnect from the network
Unplug the cable or turn off Wi-Fi. This stops data leaving the machine and stops the malware pulling more payloads while you work.
Get into Safe Mode
Windows: hold Shift on Restart → Troubleshoot → Startup Settings → Safe Mode with Networking. macOS: start in Safe Mode by holding Shift on Intel, or holding power on Apple silicon.
Remove the obvious programs and extensions
Uninstall anything you did not install deliberately, remove unknown browser extensions and reset browser settings. Check startup apps and scheduled tasks for leftovers.
Scan with two tools
Run Windows Security's full offline scan, then a second-opinion scanner such as Malwarebytes. Remove what is found and repeat until both come back clean.
One scanner will always miss things the other catches.
Decide whether to trust it
If it is a business machine, or the infection involved ransomware or remote access, a clean reinstall is the only reliable answer.
Rebuild, restore and harden
Reinstall the OS if needed, restore files from a backup taken before the infection, then enable automatic updates, a password manager and two-factor authentication.