How to clean an infected computer, step by step

Cleaning an infected computer works when you do it in the right order: cut the network, write down what you saw, get your files off, scan from outside the running system, check what starts with the machine, and only then change your passwords, from a different device. Skipping straight to a scan is the usual mistake, because a scanner running inside a compromised system is being asked to catch something that may be hiding from it. There is also a decision to make early rather than late. If credentials were stolen, if ransomware is involved, or if the machine matters for money or work, a wipe and reinstall is faster and more trustworthy than any cleanup, and pretending otherwise costs you a weekend.

The first ten minutes

Disconnect the machine from the network. Turn off wifi and unplug the cable. This stops data leaving, stops remote control, and stops anything spreading to other machines and network drives on the same connection. Leave the computer switched on for now unless files are visibly being encrypted, in which case shut it down.

Then write things down while they are fresh: what you saw, the exact wording of any message, the time it started, what you installed or opened just before, and whether anyone had remote access. Photograph the screen with your phone. This is not paperwork for its own sake. It decides which of the paths below you take, and it is what your bank or your employer will ask for.

Do not start deleting things yet, and do not run three different cleaners. If somebody was on your machine through remote support software, the sequence in the tech support scam playbook describes what they usually did while they were there.

Decide early whether this is a cleanup or a rebuild

The honest reason to rebuild is not that cleanup never works. It is that you cannot prove it worked. A scanner tells you what it recognized, never what it missed, so after a serious compromise a clean install is the only state you can actually trust. On modern systems this is a two hour job, most of it unattended, and it usually ends with a computer that runs better than it did.

Back up your files, not your programs

Before you scan or reinstall, get your documents, photos and anything irreplaceable onto an external drive. Copy data only. Do not copy installed programs, and do not restore a whole system image made after the infection started, because that brings the problem back with it.

Two cautions. Plug the external drive in only while the machine is disconnected from the network, and afterwards scan that drive from a healthy computer before you copy anything back. Second, be wary of documents with macros and of executable files. If you already keep versioned copies of everything, this step is a formality, which is the whole argument for the arrangement described in the 3-2-1 backup rule in real life.

Scan from a position of strength

A scan is more reliable when the suspect software is not running. Work down this list and stop when something works.

1. Update the scanner first. Reconnect briefly, let the security software update its definitions, then disconnect again.
2. Windows offline scan. Open Windows Security, then Virus and threat protection, then Scan options, and choose the Microsoft Defender offline scan. The machine restarts into a small environment and checks the disk before Windows loads, which defeats most hiding tricks.
3. Safe mode. On Windows, hold Shift while choosing Restart, then Troubleshoot, Advanced options, Startup Settings, Restart, and pick safe mode with networking. On a Mac with Apple silicon, hold the power button until startup options appear, choose your disk, then hold Shift and click Continue in Safe Mode. On an Intel Mac, hold Shift during boot. Safe mode loads fewer startup items, so removals that failed before often succeed.
4. A second opinion scanner. One on demand scanner from an established security vendor, downloaded on a clean machine to a USB stick, run once, then uninstalled. Two resident antivirus products fighting each other is worse than one.
5. Rescue media. Several major vendors publish a bootable rescue image you write to a USB stick on a healthy computer. The infected machine never boots its own operating system at all. This is the strongest option short of reinstalling.

Let every scan finish and quarantine what it finds rather than deleting immediately, then restart and scan again. A clean second pass matters more than the first one. If detections keep returning, something is putting them back, and you have your answer about rebuilding. Which family you are dealing with changes what to worry about next, and those differences are set out in the plain English guide to malware families.

Check what starts with the machine, and what the browser is doing

Most persistence is boring: something arranges to launch at startup. On Windows, look at Startup apps in Task Manager, Installed apps sorted by install date, Task Scheduler for tasks that run a program or open a page, and Services for anything with a blank or odd publisher. A startup inspection tool such as Microsoft's Autoruns shows all of these in one list if you are comfortable reading it.

On a Mac, check System Settings, then General, then Login Items and Extensions, then look for configuration profiles under Device Management and remove any you did not install. Mac cases are far more often bundled adware than deep infection.

Then the browser, which is where the visible damage usually lives: extensions you did not add, a changed default search engine, a site allowed to send notifications, and a web address appended to the shortcut target on Windows. The full sequence is in fixing a hijacked browser, and the reason to be strict about add-ons is explained in the permission that reads every page.

Recover your accounts from a different device

Timing matters here. Change passwords after the machine is clean or rebuilt, never before, or you will type the new ones into a compromised keyboard. Use a phone or another computer that was never affected.

1. Email first, because every other reset runs through it. Then banking and payment accounts, then anything that stores card details, then social accounts.
2. In each account, use the option called sign out of all devices or manage sessions. This kills stolen session cookies, which otherwise keep working even after a password change.
3. Check your email settings for forwarding rules, filters that delete alerts, and changed recovery addresses or phone numbers. Attackers set these up so you never see the warning messages, and almost nobody looks.
4. Turn on or re-enroll two step sign in where it was missing, and treat any password reused elsewhere as already gone.
5. If a phishing page or a fake login started all this, the tighter first response is in what to do in the ten minutes after clicking a phishing link.

What to do next

If the machine was simply carrying adware, you are likely done after the browser cleanup and two clean scans. Keep watching for a week: unexplained fan noise, a browser that opens by itself, or detections that return all mean the job is not finished.

If you are rebuilding, do it properly. On Windows, reset the PC with the remove everything option, or better, install from a USB installer made on a clean computer. On a Mac, start up in recovery, erase the disk in Disk Utility, and reinstall macOS. Then install applications from their original sources rather than from a saved folder of installers, copy your data back from the drive you scanned, and set up backups before you do anything else. If the trigger was encrypted files and a ransom note, do not rebuild until you have read how ransomware unfolds and what to do first, because the order of operations is different and evidence matters.