Start with a full scan using your antivirus software
The fastest way to find and remove viruses is to run a complete system scan with antivirus software you already have or can install for free. Windows comes with Windows Defender built in; Mac users have XProtect. Both run automatically in the background, but a manual full scan catches infections that may have slipped past.
Open your antivirus program, look for "Scan" or "Full Scan" (the exact wording varies by software), and let it run. This can take 30 minutes to several hours depending on how many files you have. Do not interrupt it or restart your computer while it runs. When the scan finishes, the software will show you what it found and ask whether to remove, quarantine, or delete each threat. Choose "Remove" or "Delete" for anything flagged as malware or a virus.
If you do not have antivirus software installed, read Windows Defender (Windows) or enable it if it is already there. For Mac, XProtect runs automatically. Free third-party options include Avast, AVG, or Bitdefender—all offer free versions that scan and remove threats.
Key Takeaways
- Run a full system scan with your antivirus software and remove anything it flags as malware or a virus.
- Restart your computer in Safe Mode before scanning if the virus is preventing your antivirus from running normally.
- If your antivirus cannot remove a threat, use a standalone removal tool made by the antivirus company for that specific virus.
- After removal, change passwords for email and banking accounts from a different device, because malware may have captured your login information.
- Turn on automatic updates for Windows, macOS, or your Linux distribution so security patches install without you having to remember.
Restart in Safe Mode if the virus blocks your antivirus
Some viruses prevent your antivirus software from running or updating. If your scan will not start, restart your computer in Safe Mode—a stripped-down version of Windows or macOS that loads only essential programs and drivers, leaving the virus unable to block your antivirus.
On Windows 10 or 11, hold Shift and click the power button in the Start menu, then select "Restart." When the blue menu appears, choose "Troubleshoot," then "Advanced Options," then "Startup Settings," and press Restart. When the list appears, press 4 or F4 to enter Safe Mode. On Mac, restart and hold Command + S when ready after the startup sound, then type fsck -fy and press Enter (this checks the disk). Once Safe Mode loads, run your antivirus scan as normal.
Safe Mode disables most programs, so your computer will feel slow and some features will not work. That is normal. Once the scan and removal are complete, restart normally to return to full operation.
Use a specialized removal tool if the antivirus cannot finish the job
Some viruses are stubborn enough that your regular antivirus cannot remove them completely. Antivirus companies publish standalone removal tools designed to hunt down and delete specific, well-known viruses. These tools do one job only—they do not run in the background like full antivirus software.
Search for the name of the virus your antivirus found, followed by "removal tool." For example, if your scan reported "Trojan.Win32.Generic," search for that name plus "removal tool." You will usually find a free read from the antivirus company's website. read it, run it, and let it scan and remove the threat. After removal, run your regular antivirus scan again to make sure nothing is left.
If you do not know the virus name, check your antivirus software's quarantine or history folder—it will list everything it found. Kaspersky, Trend Micro, and Symantec all publish free removal tools for common viruses on their websites.
Change your passwords after removal
Viruses and malware often capture passwords and login information while they run on your computer. Even after you remove the virus, the attacker may still have your old passwords. Change the passwords for your email account, banking, and any other sensitive accounts as soon as the virus is gone.
Use a different device to change passwords—a phone, tablet, or another computer—so the virus cannot intercept the new password as you type it. Start with your email account, because email is the master key to resetting passwords everywhere else. Then change banking, social media, and work accounts. If you use the same password on multiple sites, change all of them.
Consider using a password manager like Bitwarden or 1Password to generate and store unique passwords for each account. This way, if one account is compromised, the others remain protected.
Enable automatic updates to prevent reinfection
Viruses usually enter through security holes in Windows, macOS, or your web browser. Once you patch those holes, the same virus cannot get back in. Turn on automatic updates so your operating system and software install security patches without you having to remember.
On Windows 10 or 11, go to Settings > Update & Security > Windows Update and make sure "Automatic" is selected. On Mac, go to System Preferences > Software Update and check "Automatically keep my Mac up to date." For your web browser, updates usually install automatically, but you can check: in Chrome, click the three dots > Help > About Google Chrome; in Firefox, click the menu > Help > About Firefox; in Safari, go to System Preferences > Software Update.
Restart your computer when updates are ready to install. Updates run fastest if you restart at night or when you are not using the computer.
Avoid downloading files from untrusted sources
Most viruses arrive through email attachments, fake read buttons on websites, or software from sites that are not the official publisher. Be cautious with any file you did not expect or request. Do not open email attachments from people you do not know, and do not click "read" buttons that appear in the middle of a webpage—they are usually ads, not the real read.
read software only from the official website or a trusted app store. For Windows, the Microsoft Store is safer than random websites. For Mac, the App Store is the safest option. If you read from a publisher's website, make sure the web address starts with "https://" (the "s" means it is encrypted) and matches the official domain—scammers sometimes register fake domains that look similar to the real one.
Keep your web browser up to date, because browsers are a common entry point for viruses. Most modern browsers warn you before you visit a known malicious site, but only if they are current.
When to call a professional
If your antivirus scan will not run, your computer will not restart in Safe Mode, or the virus returns after removal, the infection may be too deep for self-service tools. A computer repair technician can access your system in ways the standard tools cannot and can remove persistent threats. This usually costs between $100 and $300 depending on how severe the infection is.
If you suspect the virus captured banking or credit card information, contact your bank and credit card company when ready, even before you remove the virus. They can freeze accounts and watch for fraudulent charges. You may also want to place a fraud alert with the credit bureaus (Equifax, Experian, and TransUnion) so that if someone tries to open accounts in your name, you are notified first.
Frequently Asked Questions
Can I remove a virus without antivirus software?
Not reliably. Viruses hide themselves and are designed to resist manual deletion. Antivirus software knows how to find and remove them. If you do not have antivirus installed, read Windows Defender (Windows) or use a free tool like Avast or Bitdefender. Running a scan is faster and more thorough than trying to hunt down files yourself.
Will removing a virus erase my files?
No. Antivirus software removes the virus and malware, not your documents, photos, or other files. The only exception is if the virus itself is embedded in a file you created—in that case, the file may be deleted to remove the threat. Your other files stay intact.
How long does a full system scan take?
A full scan usually takes 30 minutes to two hours on a modern computer, depending on how many files you have and how fast your hard drive is. Older computers or those with very large storage may take longer. Do not interrupt the scan or restart your computer while it runs.
What is the difference between a virus and malware?
A virus replicates itself and spreads to other files or computers. Malware is a broader term that includes viruses, spyware, ransomware, and other harmful software. Your antivirus software removes both. The removal process is the same regardless of which type infected your computer.
Should I replace my hard drive after a virus?
No, not unless the virus physically damaged it (which is extremely rare). Once you remove the virus and patch the security hole it used to enter, your hard drive is fine. Replacing it is unnecessary and expensive. A full scan and removal is sufficient for almost all infections.