How to Remove Viruses

On Windows

Open Windows Defender if possible. Windows Defender is a virus prevention program built into Windows. To open the program, you'll click Start , type windows defender, and click Windows Defender Security Center in the search results. The Windows Defender window immediately appears on the screen.

If you can't open Windows Defender because of a virus, skip this and the next step.

Start the quick scan program on Windows Defender. You can do this by clicking the Virus & threat protection tab in the left pane of the Windows Defender window and clicking Scan now . This allows Windows Defender to search, isolate and remove common viruses.

You may have to click ☰ in the upper left corner of the window to see the Virus & threat protection tab .

This is not effective against strong viruses, but you may be able to remove some malicious files by doing this before continuing the operation.

Restart the computer into Safe Mode. This is a version of a computer operating system that only loads necessary files and services, making it impossible for viruses to function. You can restart your computer into Safe Mode by doing the following:

Click Start , then click the Power icon .

Hold down the key ⇧ Shiftwhile clicking Restart in the Power menu.

Click Troubleshooting on the blue screen.

Click Advanced Options , then click Startup Settings .

Click Restart , then press 5 to select "Safe Mode with Networking." If "Safe Mode with Networking" is set to another key, use that key.

Open Disk Cleanup. Once your computer has booted into Safe Mode, you can open Disk Cleanup by clicking Start , typing disk cleanup, and clicking Disk Cleanup at the top of the Start menu.

Delete temporary files and system information. Do the following:

Click Clean up system files . It's in the bottom left corner of the window.

Check all the boxes in the middle of the window (you'll have to scroll down to see the last few boxes).

Click OK , then click Delete Files when asked.

Open Windows Defender. Click Start , enter windows defender, and click Windows Defender Security Center .

Click Virus & threat protection . This is the option on the left side of the window.

You may have to click ☰ in the upper left corner of the Windows Defender window.

Click Scan Options . You'll find this link below the to Scan now button in the middle of the page.

Make sure the "Full scan" box is checked. It's the box at the top of the page. The full scan will clean your computer in depth, but you should note that Windows Defender will take more than an hour to complete the full scan.

Click Scan now . This button displays at the bottom of the scan selection list. Windows Defender will proceed to scan your computer.

Delete the malicious program you just found. When malicious programs are detected, Windows Defender notifies you and may ask you to confirm removal of those programs. If so, follow the onscreen instructions to remove the malicious program.

Download and extract Autoruns. This is a Microsoft tool that shows you which programs have started in the current session. Here's how to download and extract the program:

Visit https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns in your computer's browser.

Click the Download Autoruns and Autorunsc link near the top of the page.

Double-click the downloaded ZIP folder.

Click Extract all , then click Extract when asked.

Open the extracted folder, then double-click the Autoruns file to open Autoruns.

Use Autoruns to delete malicious files. Autoruns will give you a list of programs and files that start automatically when you turn on your computer. You can use this list to determine which services have viruses:

Find suspicious services in the Autoruns list.

Find out information about that service online to confirm it is a virus, remember to note the deletion instructions.

Delete the service and associated files or folders.

Repeat this process until you have removed all suspicious services from the Autoruns menu.

Change your browser's home page if necessary. A common virus strategy is to set a malicious website or advertisement as the browser's home page. You can return your browser settings to normal when your computer is in Safe Mode to avoid other dangerous problems.

In some serious cases, computer viruses will damage browser files, making it impossible to make changes using the browser settings. If so, you need to uninstall the browser and reinstall it later.

Restart the computer into Safe Mode. You'll do this by repeating the procedure you applied earlier to boot your computer into Safe Mode.

Perform an offline scan of Windows Defender. Offline scanning can find viruses or malware that you and a previous scan missed:

Open Windows Defender.

Click Virus & threat protection in the left pane.

Click the Run a new advanced scan link.

Check the "Windows Defender Offline scan" box.

Click Scan now .

Wait for your computer to restart, then follow the Windows Defender instructions on the screen.

Restart the computer again. This time, click Start , click Power , and click Restart without pressing the key ⇧ Shift. The computer will boot normally and no longer have viruses.

Reinstall Windows if necessary. If you cannot remove the virus and cannot afford a professional repair service to neutralize the virus, the best remaining option is to reinstall Windows and start fresh.

You can back up files to avoid data loss, but be aware that this will also back up viruses.

If you have enough money, take your computer to a professional repair service before performing this step. They can help you remove viruses.

On Mac

Force shutdown of 'stubborn' malicious programs. If a program (or group of programs) is preventing you from restarting your Mac, handle the problematic programs this way:

Click Spotlight in the top right corner of the screen.

Type activity monitor, then double-click Activity Monitor in the search results.

Click the CPU tab .

Select the program or service you want to disable.

Click the X in the upper left corner of the Activity Monitor window.

Click Force Quit when asked.

Boot your Mac into Safe Mode. Safe Mode prevents all basic Mac programs from starting, making it easier to find and remove viruses:

Click Apple menu .

Click Restart. in the menu.

Click Restart when asked.

Press the key ⇧ Shiftimmediately.

Release the key ⇧ Shiftwhen you see the login window appear.

Download and install Malwarebytes. Here's a free virus prevention program you can use to identify and remove viruses on your Mac:

Visit https://www.malwarebytes.com/mac-download/ using a web browser.

Double click on the downloaded PKG file.

Follow the instructions to install Malwarebytes.

Open Malwarebytes. Click Spotlight , type malwarebytes, and double-click Malwarebytes in the Spotlight search results.

Click the Dashboard (Overview) tab. It's the option on the left side of the Malwarebytes window.

Click Scan now . You'll find this option in the middle of the Malwarebytes window. The Malwarebytes program immediately scans your Mac for viruses after just one click.

This process can take more than an hour to complete.

Delete found viruses. Once the scan is complete, you can remove the virus by clicking the Scan tab and clicking Confirm in the middle of the page.

If Malwarebytes cannot find a virus, you will not see the Confirm option here.

Remove malicious applications (if necessary). Some applications are classified as malicious without necessarily being viruses; Common examples include toolbar applications and some third-party virus scanners (except Malwarebytes). You can remove apps from your Applications folder (and Mac) by doing the following:

Open Finder .

Click Applications on the left side of the page.

Find the app you want to delete.

Drag the application icon to the trash.

Click and hold the trash icon, then click Empty Trash when asked.

Delete files related to malicious applications. Although deleting the app will minimize its impact on your Mac, you'll still need to delete the data in the app's folder in case it contains malicious files or scripts:

Open Spotlight, then type ~Libraryand press ⏎ Return.

Find the folder of the app you deleted (the name of the app is still in the folder).

Drag the folder to the trash.

Empty the trash by clicking and holding the icon, then clicking Empty Trash .

Delete the Downloads folder. If you think you've accidentally downloaded a file that activates a virus on your Mac, delete the Downloads folder by opening Finder, clicking Downloads on the left side of the window, selecting the files in the Downloads folder, and moving them to the trash.

Change your browser's home page if necessary. A common virus strategy is to set a malicious website or advertisement as the browser's home page. You can return your browser settings to normal when your computer is in Safe Mode to avoid other dangerous problems.

Restart your Mac. Click the Apple menu, click Restart. , and click Restart when asked. This will reboot the Mac into normal mode. Now the virus on the computer has been removed.

Reinstall your Mac's operating system (if necessary). In severe cases where a virus has damaged your entire Mac and you can't afford professional repair, reinstalling the operating system is the best option to restore your Mac.

You can back up files to avoid data loss, but be aware that this will also back up viruses.

If you have enough money, take your computer to a professional repair service before performing this step. They can help you remove viruses.