Virus & Spyware Removal

Not all malware is the same. Misidentifying it leads to the wrong fix -- or making it worse. Adware: your browser shows extra ads, new toolbars appeared, your homepage or search engine changed, you're being redirected to random sites. Annoying, not catastrophic. Fixable without data loss. Spyware / keylogger: often invisible. Signs include: unfamiliar programs in Task Manager, webcam light flickering, browser saved passwords mysteriously used somewhere else, or a slow machine with no obvious resource hog. More dangerous -- assume passwords are stolen. Fake antivirus / scareware: a popup (not your real antivirus) is claiming your machine is infected and demanding you call a number or pay to clean it. These are themselves malware. Do not interact with the popup beyond force-closing it. Browser hijacker: homepage changed, search engine redirected, new extensions you didn't install, constant redirects to sketchy sites. Usually bundled with free software you installed. Ransomware: your files have unfamiliar extensions (.locked, .encrypted, .wncry), you see a ransom note, or files simply won't open. THIS IS AN EMERGENCY. Stop reading, disconnect from the internet now, and skip to step 02. Cryptominer: computer is slow, fan runs constantly at high speed, CPU is pegged at 80--100% even when you're not doing anything heavy. The malware is using your computer to mine cryptocurrency.

For ransomware: unplug the ethernet cable and turn off Wi-Fi right now. The ransomware may still be in the process of encrypting files -- cutting the network connection can limit damage (some variants need to communicate with a command server to get the encryption key). Do NOT restart the machine. Do NOT try to run a scan while it's active. Call a professional. For all other malware: disconnect from the network while you work. This prevents the malware from downloading additional payloads, contacting its command server, or exfiltrating data while you're trying to clean it. On Windows: click the network icon in the taskbar → click your Wi-Fi network → Disconnect. Or simply unplug the ethernet cable. You'll reconnect in Safe Mode when needed. If you have other devices on the same network (other computers, phones, smart home devices): they are probably not infected from a Windows virus, but be aware. Change your Wi-Fi password after cleanup is complete. Also: if you use cloud storage (OneDrive, Dropbox, Google Drive), pause sync NOW. Ransomware will encrypt your local files and the sync client will helpfully upload the encrypted versions to the cloud, overwriting your good backups.

Safe Mode loads Windows with only essential drivers and services -- most malware doesn't load in Safe Mode, making it much easier to find and remove. Windows 10/11: Hold Shift and click Start → Power → Restart. From the blue 'Choose an option' screen: Troubleshoot → Advanced options → Startup Settings → Restart. When it restarts, press F5 to select 'Safe Mode with Networking.' (You want Networking so you can download tools if needed.) Alternatively: search 'msconfig' in Start → Boot tab → check 'Safe boot' and 'Network' → OK → Restart. Remember to uncheck Safe boot after cleanup or it will always boot into Safe Mode. Mac: restart and hold Shift until you see the Apple logo and a progress bar. Safe Mode on Mac runs a disk check and clears caches on boot -- it takes longer than a normal startup. In Safe Mode, the screen may look different (lower resolution, basic taskbar). That's normal. Open Task Manager and check running processes -- you may immediately see the malware absent that was consuming resources before. If you can't enter Safe Mode because the machine won't boot at all: you'll need to use a bootable USB scanner (Kaspersky Rescue Disk or Windows Recovery Environment).

Malwarebytes is the most effective free malware removal tool available. It catches things Windows Defender misses, especially adware, PUPs (potentially unwanted programs), and browser hijackers. Download it from malwarebytes.com (use a clean device if the infected machine can't reach the internet safely -- download to USB and transfer). Install on the infected machine and select the free trial option during setup -- you don't need to buy; the free version scans and removes. Run a full scan (not a quick scan): open Malwarebytes → Scanner → Advanced Scanners → Full Scan → Scan. This takes 20--60 minutes depending on drive size. When it finishes: review everything it found. Malwarebytes will categorize items as Malware, PUP (Potentially Unwanted Program), or Adware. Quarantine everything it recommends. After quarantine: Malwarebytes will ask to restart. Let it. Then boot back into Safe Mode and run Malwarebytes again -- a second pass often catches things the first pass missed after the first-pass removals. Common finds: browser hijackers bundled with free software, adware injecting ads into legitimate sites, fake system optimizers that are actually spyware, and trojans that piggyback on pirated software.

Windows Defender Offline scan is different from a normal Defender scan. It runs before Windows fully loads -- catching rootkits and persistent malware that hide from in-OS scans by embedding into boot processes. To run it: Windows Security → Virus & Threat Protection → Scan Options → Microsoft Defender Antivirus Offline Scan → Scan Now. The machine will restart, run the scan from a protected environment, and then restart again into Windows with results. This scan takes 10--15 minutes and requires no extra downloads -- it's built into Windows 10 and 11. Alternatively, if the machine is heavily compromised and you want a second opinion: download Kaspersky Rescue Disk (kaspersky.com/downloads/free-rescue-disk) on a clean machine, write it to a USB with Rufus, and boot the infected machine from that USB. This scanner is completely independent of Windows and catches things even an offline Windows scan can miss. For Mac: Malwarebytes for Mac (free version available) is the equivalent tool. Apple's built-in XProtect and Gatekeeper handle most Mac threats automatically, but Malwarebytes catches adware and PUPs that slip through. After both scans complete with no threats found, you're ready to move to browser cleanup and password changes.

Scans don't always catch everything -- especially browser extensions installed as 'legitimate' add-ons that have since been acquired by adware companies. Uninstall suspicious programs: Settings → Apps → Installed Apps → sort by Install Date. Anything installed around the time problems started is a prime suspect. Look for: toolbars, 'system optimizers,' 'registry cleaners,' VPN trials you didn't install, PDF converters, browser 'speed boosters,' and anything with a name you don't recognize. When in doubt, Google the exact program name + 'malware' before removing. Clean browser extensions -- do this in every browser you use: Chrome: chrome://extensions -- remove anything you didn't deliberately install. Then: chrome://settings/clearBrowserData -- check all boxes including cached images, cookies, saved passwords (you'll re-enter them from your password manager) -- Time range: All time → Clear data. Firefox: Menu → Add-ons and Themes → Extensions -- remove unknowns. Then Settings → Privacy & Security → Clear Data. Reset browser homepage and search engine: Chrome Settings → On startup → set to your preference. Chrome Settings → Search engine → change from any hijacker back to Google. Edge, Brave, Opera: same process -- extensions panel, then settings for search engine and startup page. If browsers are heavily compromised: consider resetting them entirely. Chrome: Settings → Reset settings → Restore settings to their original defaults. This removes all extensions, clears cookies, and resets homepage -- you'll need to reinstall legitimate extensions manually.

This is the most important step and the one most people skip. Don't skip it. Use a DIFFERENT device -- your phone, a tablet, a family member's computer -- anything that was not connected to the infected machine and has not been used on the same Wi-Fi during the infection period. Change passwords in this priority order: 1. Email accounts (Gmail, Outlook, iCloud) -- these are the master keys to everything else. Someone with your email can reset every other password. 2. Financial accounts -- banking, investment, PayPal, Venmo, Zelle. 3. Work accounts -- Microsoft 365, Slack, Google Workspace. 4. Shopping -- Amazon, eBay, any stored credit card. 5. Social media -- Facebook, Instagram, LinkedIn. 6. Everything else -- streaming, gaming, utilities. Enable two-factor authentication (2FA) on everything that offers it: -- Use an authenticator app (Google Authenticator, Authy, or Microsoft Authenticator) rather than SMS when available -- SMS 2FA can be SIM-swapped. -- Email accounts MUST have 2FA. This is non-negotiable. -- Banks: enable 2FA and sign up for transaction alerts. If you weren't using a password manager: now is the time. Install Bitwarden (free) or 1Password on a clean device, generate new unique passwords for every account as you change them, and save them in the manager. Finally: notify your bank that you may have had credentials compromised. They can flag your account for suspicious activity monitoring.

The malware is gone. Now make sure it doesn't come back -- because whatever behavior let it in the first time hasn't changed yet. Windows Defender settings: -- Make sure real-time protection is ON: Windows Security → Virus & Threat Protection → Manage Settings → Real-time protection toggle. -- Turn on cloud-delivered protection and automatic sample submission in the same panel -- this feeds new threat data to Microsoft faster. -- Enable Controlled Folder Access (same settings panel) to protect Documents, Pictures, and Desktop from unauthorized changes -- this is a direct defense against ransomware. Browser hardening: -- Install uBlock Origin (free, open-source ad blocker) in every browser. It blocks malicious ads that deliver drive-by infections. This single extension prevents more infections than most antivirus software. -- Set Chrome to block third-party cookies: Settings → Privacy and Security → Third-party cookies → Block. -- Never allow browser notifications from sites you don't trust. If a site asks "Allow notifications?" click Block. Malicious notification permissions are a growing infection vector. Email and download habits: -- Never open attachments from unknown senders. This is how most infections start. -- Never download software from anywhere other than the official developer's website or ninite.com. -- If a popup says "Your computer is infected -- call this number" it is lying. Close it with Task Manager. Always. -- If a deal seems too good to be true, the software is free, and you didn't search for it -- close the tab.

Don't declare victory after one scan. Run through this checklist over the next 48 hours: ✓ Restart normally (not Safe Mode) and check Task Manager -- no suspicious processes hogging CPU or memory ✓ Open your browser -- homepage is correct, search engine is correct, no rogue extensions ✓ Visit a few normal websites -- no redirects, no extra ads, no popups ✓ Check Windows Security -- no active threats, real-time protection shows ON ✓ Run one final Malwarebytes scan from normal mode -- should come back clean ✓ Cloud sync (OneDrive, Dropbox) re-enabled and files are intact -- not encrypted or corrupted ✓ All passwords changed from a clean device (not this one -- until this checklist is complete) ✓ 2FA enabled on email, banking, and work accounts ✓ Browser notification permissions reviewed -- block anything you didn't intentionally allow Monitor for 48 hours: -- If the machine stays clean, fast, and stable for 2 full days of normal use, you're good. -- If symptoms return, the malware survived your cleanup -- it may have persistence mechanisms you didn't catch. At this point, consider a full Windows reinstall (reset this PC → Remove everything) or calling a professional. Set a calendar reminder to run Malwarebytes monthly. Prevention is cheaper than recovery.