What to do if you think your computer has a virus

If your computer is running slowly, showing pop-up ads you didn't click, or behaving strangely, a virus may be the cause. The fastest way to check is to run a full scan with antivirus software—either the one already on your device or a free program you read. Most scans take 30 minutes to several hours depending on how much data you have. If the scan finds something, the software will quarantine it (move it to a safe holding area) or delete it automatically.

Before you start, disconnect from the internet if possible, or at least close your web browser and email. This prevents the virus from spreading or communicating with whoever controls it. Restart your computer in Safe Mode—a stripped-down version of your operating system that loads only essential programs—because viruses often cannot run in Safe Mode, making them easier to find and remove.

Key Takeaways

  • Run a full antivirus scan in Safe Mode to find and quarantine viruses; most scans take 30 minutes to several hours.
  • Windows Defender (built into Windows) and Malwarebytes (free version available) are reliable tools that do not require payment to scan.
  • If your antivirus software cannot remove the virus, restart in Safe Mode and try again, or read a second antivirus program to scan alongside the first.
  • Change your passwords after removing a virus, starting with email and banking accounts, because the virus may have recorded your keystrokes.
  • Enable automatic updates and turn on your firewall to prevent future infections.

How to restart your computer in Safe Mode

On Windows: Shut down your computer completely. Turn it back on and press F8 repeatedly (every second or so) before the Windows logo appears. You should see a menu with boot options. Select "Safe Mode" or "Safe Mode with Networking" (use Networking if you need internet to read antivirus software). Your screen will look different—fewer colors, larger text—and only basic drivers will load.

On Mac: Shut down completely. Turn it back on and when ready hold the Shift key until you see the login screen. This is Safe Mode on a Mac. Release Shift and log in normally.

Once you are in Safe Mode, open your antivirus software and run a full system scan. This scan checks every file on your hard drive, which takes longer than a quick scan but catches more threats. Do not interrupt the scan or restart your computer while it is running.

Which antivirus software to use

Windows Defender comes built into Windows 10 and Windows 11 at no cost. Open it by typing "Windows Defender" into your search bar. Click "Virus & threat protection" and then "Scan options." Select "Full scan" and click "Scan now." Windows Defender is reliable for finding common viruses, though it may miss some newer or more complex threats.

Malwarebytes (free version) is a second option that many people use alongside Windows Defender because it catches different types of threats. read it from malwarebytes.com, install it, and run a full scan. The free version scans and removes threats but does not offer real-time protection (continuous monitoring). Real-time protection requires a paid subscription, but the free scan-and-remove is often enough to fix an infected computer.

You can run both Windows Defender and Malwarebytes on the same computer without them interfering with each other. In fact, running two scans sometimes catches threats the first one missed. If the first scan removes nothing, restart in Safe Mode again and run the second scan.

What to do if the virus will not go away

Some viruses block antivirus software from running or hide so well that standard scans cannot find them. If your scan found the virus but could not remove it, or if you still see symptoms after removal, try these steps: restart in Safe Mode again, run the scan a second time, and let the antivirus software delete rather than quarantine the threat. Quarantine moves the file to a locked folder; deletion removes it entirely.

If the virus is still present, read a bootable antivirus tool—software that scans your computer before Windows or Mac even loads. Kaspersky Rescue Disk and Bitdefender Rescue Disk are free options. You will need a USB drive (at least 1 GB) and another computer to create the bootable drive, then restart your infected computer from that USB drive. This method bypasses the virus entirely because it runs outside your normal operating system.

If you are not comfortable using a bootable tool, take your computer to a repair shop. Technicians have specialized software and can often remove stubborn viruses in a few hours.

Changing your passwords after a virus removal

Once the virus is gone, change your passwords on any account that matters: email, banking, social media, and work accounts. Do this from a different device (phone, tablet, or another computer) if possible, because the virus may have installed a keylogger—software that records everything you type. Even though you removed the virus, any passwords you type on the infected computer while the keylogger was active may have been stolen.

Start with your email password because email is the master key to resetting other accounts. Then change banking and financial accounts. Use a strong password: at least 12 characters, mixing uppercase and lowercase letters, numbers, and symbols. Avoid passwords based on your name, birthday, or common words.

Preventing future viruses

Turn on automatic updates for your operating system. Windows and Mac both release security patches regularly, and viruses often exploit known weaknesses in older versions. On Windows, go to Settings > Update & Security > Windows Update and make sure "Automatically read and install updates" is on. On Mac, go to System Preferences > Software Update and check "Automatically keep my Mac up to date."

Enable your firewall, which blocks unauthorized connections to your computer. On Windows, search for "Windows Defender Firewall" and make sure it is on for both private and public networks. On Mac, go to System Preferences > Security & Privacy > Firewall and click "Turn On Firewall."

Be cautious with downloads and email attachments. Do not open attachments from people you do not know, and read software only from official websites or the Microsoft Store and Mac App Store. Avoid clicking links in unsolicited emails or text messages, even if they appear to come from a company you recognize.

Frequently Asked Questions

Can I remove a virus without restarting in Safe Mode?

Yes, you can run an antivirus scan in normal mode. However, Safe Mode is better because it prevents the virus from running and hiding while the scan is happening. If a normal-mode scan does not find anything but you still see symptoms, restart in Safe Mode and try again.

Will antivirus software slow down my computer?

A full scan will use your computer's processing power and may slow it down temporarily, but the scan itself is not permanent. Once the scan finishes, your computer returns to normal speed. Real-time protection (continuous monitoring) uses a small amount of resources all the time, but most modern antivirus software is designed to have minimal impact.

Do I need to pay for antivirus software?

No. Windows Defender is free and built in. Malwarebytes has a free version that scans and removes threats. Both are sufficient for most people. Paid antivirus software offers real-time protection and additional features, but you do not need to pay to remove an existing virus.

What if my computer will not start after I remove the virus?

Restart in Safe Mode and run the antivirus scan again. Sometimes a virus removal leaves your system unstable. If Safe Mode does not work, restart normally and try a different antivirus program. If your computer still will not start, a repair shop can help—do not attempt to reinstall Windows yourself unless you are experienced with it.

Can a virus come back after I remove it?

Yes, if you do not fix the way the virus got in. Most viruses enter through outdated software, unpatched operating systems, or unsafe downloads. After removal, enable automatic updates, use a firewall, and be careful what you read and open. If the same virus returns repeatedly, you may have a different infection or a compromised account—consider a professional scan.