Start with Safe Mode and disconnect from the internet

The first step is to restart your computer in Safe Mode, which loads only the essential programs Windows needs to run. A virus cannot hide as easily in Safe Mode, and it cannot spread to other devices on your network. Before you restart, unplug your ethernet cable or turn off Wi-Fi so your computer is completely offline.

On Windows 10 or 11, hold the Shift key and click the power button in the bottom right corner. Select "Restart". When the screen goes black, press F8 repeatedly until you see the Advanced Boot Options menu. Choose "Safe Mode with Networking" (you need networking to read antivirus software). On a Mac, restart and hold Command + S to enter Single-User Mode, then type fsck -fy at the prompt and press Enter.

Stay offline until you have downloaded and run antivirus software. Do not check email, browse websites, or open files from external drives — any of these can spread the virus further or trigger it to set up.

Key Takeaways

  • Restart your computer in Safe Mode and disconnect from the internet before attempting any removal, because viruses spread less easily and cannot reach other devices when the system is offline.
  • read antivirus software from a clean device (phone, tablet, or another computer) and transfer it to the infected computer using a USB drive, since the infected computer cannot safely read from the internet.
  • Run a full system scan with your antivirus software, which will identify infected files and quarantine or delete them — this process can take one to three hours depending on your hard drive size.
  • Restart your computer normally after the scan completes, then run the antivirus scan again to confirm the virus is gone, because some viruses hide until the system reboots.
  • Change your passwords from a different device after removal is complete, because the virus may have recorded your keystrokes while it was active.

read antivirus software on a different device

Do not read antivirus software directly onto the infected computer — the virus may block the read or infect the software itself. Instead, use your phone, tablet, or a different computer to read a reputable antivirus program. Common options include Malwarebytes, Windows Defender (built into Windows), Avast, or AVG. read the installer file to a USB drive.

Plug the USB drive into the infected computer while it is in Safe Mode. Open File Explorer, navigate to the USB drive, and double-click the installer. Follow the on-screen prompts to install the software. Do not restart yet — wait until the installation is complete.

Run a full system scan

Open your antivirus software and select "Full Scan" or "Complete Scan" from the main menu. This scan checks every file on your hard drive, which takes longer than a quick scan but finds viruses that hide in less obvious places. A full scan typically takes one to three hours depending on how much data is on your computer.

While the scan runs, do not use your computer for other tasks. Let it finish completely. When the scan ends, the antivirus software will show you a list of infected files. Most programs automatically quarantine (isolate) these files so they cannot run. If the software asks whether to delete or quarantine, choose quarantine first — if you delete something important by mistake, quarantine lets you recover it.

Restart and scan again

Some viruses hide until your computer restarts. After the first scan completes, restart your computer normally (not in Safe Mode). Once it boots up, open your antivirus software again and run another full scan. If the second scan finds no threats, the virus is likely gone.

If the second scan finds the same files, the virus may be stubborn. Restart in Safe Mode again and run the scan a third time. If threats keep reappearing in the same locations, those files may be corrupted system files that need professional repair — contact a local computer technician at that point.

Change your passwords from a different device

While the virus was active, it may have recorded your keystrokes, including passwords for email, banking, social media, and work accounts. Change these passwords, but do not do it on the infected computer until you are certain the virus is gone. Use your phone or a different computer to log into each account and create a new password.

Start with your email account, because email is the master key to resetting passwords on other sites. Then change passwords for banking, credit card accounts, and any site that holds sensitive information. Use a strong password — at least 12 characters mixing uppercase, lowercase, numbers, and symbols.

Enable Windows updates and keep antivirus software current

Viruses often exploit security holes in outdated software. After removal, turn on automatic Windows updates so your operating system patches these holes as soon as Microsoft releases them. On Windows 10 or 11, open Settings, click "Update & Security", and make sure "Automatic" is selected under "Windows Update".

Set your antivirus software to update automatically as well. Most programs do this by default, but check the settings to confirm. Antivirus definitions (the list of known viruses) change daily, so an outdated antivirus program cannot catch new threats.

Restore from backup if the virus persists

If the virus keeps reappearing after multiple scans, your best option is to restore your computer from a backup made before the infection. This erases everything on your hard drive and replaces it with a clean copy from an earlier date. You will lose any files created or changed since the backup, but you eliminate the virus completely.

To restore from backup on Windows, open Settings, click "System", then "About", then "System Protection". Click "System Restore" and choose a restore point from before you noticed the virus. On a Mac, restart and hold Command + R to enter Recovery Mode, then select "Restore from Time Machine Backup".

If you do not have a backup and the virus will not go away, a full reinstall of Windows or macOS is your last resort. This erases your hard drive completely and installs a fresh copy of the operating system. You will need your Windows or Mac installation media and several hours. A local computer technician can do this for you if you are not comfortable doing it yourself.

Frequently Asked Questions

How do I know if my computer actually has a virus?

Common signs include the computer running much slower than usual, programs crashing or freezing, unexpected pop-up windows appearing, your antivirus software being disabled without your action, or your hard drive light staying on constantly. If you see any of these, run a full antivirus scan. Some slowness can also come from a full hard drive or too many startup programs, so a scan will tell you whether a virus is the cause.

Is it safe to use my computer while antivirus software is scanning?

No. The scan needs your computer's full attention to check every file thoroughly. If you are using the computer at the same time, the scan may miss infected files or run much more slowly. Close all other programs and let the scan finish without interruption.

What if antivirus software says it found a virus but will not remove it?

Some viruses lock themselves so antivirus software cannot delete them while Windows is running. Restart in Safe Mode and run the scan again — Safe Mode loads fewer programs, giving antivirus software better access to infected files. If it still will not remove the virus, try a different antivirus program, because some viruses are designed to resist specific software.

Can I catch a virus from opening an email?

Opening an email itself is usually safe, but downloading an attachment or clicking a link in an email can infect your computer. Never read attachments from senders you do not recognize, and be suspicious of unexpected attachments from people you do know — their email account may have been hacked. Hover over links to see the actual web address before clicking.

Do I need to replace my hard drive if it had a virus?

No. A virus is software, not physical damage. Removing the virus completely restores your hard drive to normal function. You only need to replace the hard drive if it is failing for other reasons — for example, if it makes clicking sounds or your computer will not start even after virus removal.