Finding a malware infection on your computer is an emotional and technical whirlwind. From the uncertainty of what was stolen to the stress of the cleanup, the experience is taxing enough to derail your entire week.
Now that scammers are increasingly using AI, malware is even more difficult to detect, and trusted tactics for removing viruses aren't always effective. Even if you used to rely on your spam folder to get rid of malicious emails or your antivirus software to spot viruses, malware is creeping past those safeguards.
CNET's latest antivirus survey shows that 88% of US adults with a laptop have taken action against potential malware over the past year. Among computer users who came across malware, 60% manually deleted the file or closed the website or pop-up, while 35% immediately ran an anti-malware scan.
If your device is compromised, having established protocols can help you respond to phishing and malware threats effectively. CNET antivirus editor Moe Long shared his personal recovery playbook for neutralizing threats. While there isn't just one "magic fix" for every virus, his advice provides a solid roadmap for navigating a security breach.
The best way to mitigate damage depends on your operating system and the specific type of attack you're facing. If you think your computer is at risk, start with these high-priority steps to quarantine and remove the virus and regain your security.
At CNET, we regularly test the best antivirus based on performance, protection and value. We recently retested antivirus software in March, with Malwarebytes and Bitdefender sharing the crown for our favorite services.
1. Disconnect the device from Wi-Fi
As soon as you sense your device has been compromised, disconnect it from your Wi-Fi in your device's settings.
"You want to avoid potentially infecting other devices on your home network, so getting that device offline ASAP is crucial," says Long.
Your device automatically reconnects to your network, so go an extra step by changing your network's password or blocking your device from the network through your internet service provider's app or website. And most importantly, make sure infected devices aren't on the network when you do.
2. Connect the infected device to a guest network
If your device is infected with malware, you'll need to isolate the device and the threat, but you may still need to connect to the internet. Quarantining the infected device could help reduce the risk of other devices, such as your tablet or phone, becoming infected. Think of it as putting the device in its own sandbox.
One way to isolate an infected device is to connect it to a guest network before attempting to remove malware. Make sure the infected device is the only one connected to the guest network before removing malware. You can turn on or add a guest network on your internet provider's app or website.
3. Use antivirus software and remove the malware threat
Effective malware removal is rarely a linear process. It depends on the threat and how deeply the virus has embedded itself.
"If I were worried about losing important data, I'd start figuring out how to go about removing the threat," says Long.
If you want to try removing the threat by deleting the malicious file yourself, you may be able to avoid a factory reset and keep all your files.
The first step to removing malware may be scanning your device for malware with antivirus software and following the removal steps that your antivirus software program suggests. That may mean deleting the infected file or uninstalling any potentially infected files.
Once you're confident the malware is gone, download another antivirus scanner, such as Bitdefender or Malwarebytes, our Editors' Choice winners, to confirm it's been removed from your device. Long says once he feels certain the threat of malware is gone, he'd run at least two different antivirus programs to be as comprehensive as possible.
Lastly, be sure to take additional steps to secure your personal data, such as changing all your passwords and using a password manager. And get identity theft protection so you can take action right away if your personal data has been compromised.
4. Perform a factory reset or completely wipe your hard drive
Long says that if you're unable to remove the threat, do a factory reset. Resetting the device to its original state could remove the malware by erasing all apps and data via the device's settings.
Even though a factory reset could work, be aware that it might not succeed if there's a rootkit or malware that's deeply embedded in your device's kernel or firmware, Long says.
In that case, Long says to wipe the hard drive clean using a third-party tool or the computer's settings, make sure all threats are deleted, then reinstall the operating system from an external device, using installation media like an operating system install disc or USB to get a clean version of his operating system.
But if you go the route of a factory reset or wiping your hard drive and reinstalling your operating system, make sure you don't restore data from a backup version, just in case it was infected with malware. That includes resisting the urge to back up your messages and photos from the cloud. Otherwise, you could be in a Sisyphean cycle of resetting your device only to end up back where you started, with an infected machine.
For more advice about protecting your devices, check out our picks for the best antivirus software and why you may want to upgrade your computer's default antivirus.
