Personal Security

How to Spot and Remove Malware

Common signs that a phone or computer may be infected with malware, plus general, careful steps to contain, clean and recover a device.

On this page
  1. What malware is
  2. Signs a device may be infected
  3. Step 1: Contain the problem
  4. Step 2: Scan with trusted security software
  5. Step 3: Remove what you do not recognize
  6. Step 4: Change your passwords, from a clean device
  7. When to reset or reinstall
  8. Seek help when needed
  9. Preventing a repeat

What malware is

Malware is a general term for software designed to do something harmful or unwanted on your device. That can mean stealing passwords, showing intrusive ads, locking files until a ransom is paid, spying through the camera or microphone, or using your device’s power for someone else’s benefit. The word covers many types, but the practical advice for noticing and cleaning most of them is similar.

Signs a device may be infected

No single symptom proves an infection, since ordinary problems cause many of the same effects. But several signs together deserve attention:

  • The device suddenly becomes much slower, or the battery drains faster than usual.
  • Pop-ups appear even when no browser is open, or your browser home page and search engine change without your input.
  • Programs or toolbars you do not remember installing show up.
  • Security software is disabled, or you cannot open it.
  • Files are renamed, missing or inaccessible, or a message demands payment.
  • Friends tell you they received odd messages from your accounts.
  • On a phone, an unfamiliar app appears, mobile data use jumps, or the device becomes unusually warm.

If you see one of these, do not panic. Think about what changed recently: a new download, a link you clicked, or an attachment you opened.

Step 1: Contain the problem

Disconnect the device from the internet by turning off Wi-Fi or unplugging the network cable. This can limit what the software can send out or download. Avoid logging in to important accounts from the affected device while you investigate, since a password typed there could be captured.

If you suspect ransomware, which displays a demand for payment, do not assume that paying will restore your files. Outcomes are uncertain, and it is usually better to seek reputable help and rely on backups.

Step 2: Scan with trusted security software

Run a full scan using a reputable security tool. Many operating systems include a built-in scanner, and it is a reasonable first choice. If the infected system blocks it, many tools can run a scan before the main system loads, often called an offline or boot-time scan. Follow the tool’s instructions for removing or quarantining whatever it finds.

Be wary of pop-ups claiming your device is infected and urging you to install a cleaner. These are a common way of spreading malware in the first place. Understanding how firewalls and antivirus fit together helps you judge what a legitimate tool can and cannot do.

Step 3: Remove what you do not recognize

After the scan, look through your installed apps and browser extensions. Remove anything you did not knowingly install or no longer use. In your browser, check the home page, default search engine and extensions, and reset the settings if they have been changed. On a phone, review the apps list and the apps with device administrator access, and uninstall anything suspicious.

Step 4: Change your passwords, from a clean device

Once you are confident the device is clean, or from a different device you trust, change the passwords for important accounts, beginning with email and banking. Turn on two-factor authentication where possible so a stolen password alone does not give access. If you reused a password across accounts, change it everywhere, since password reuse allows one capture to affect many accounts. Keep a watch on bank statements and account activity for the next few weeks.

When to reset or reinstall

Sometimes a clean-up does not give you full confidence, especially if the infection was deep or you cannot be sure everything was removed. In that case, the most reliable option is generally to back up your personal files, taking care to avoid copying suspicious programs, and then reset the device to factory settings or reinstall the operating system. Restore only your own documents and photos, then reinstall apps from official sources.

This is where regular backups pay off. A good backup strategy means a reset is an inconvenience instead of a loss.

Seek help when needed

If the device is used for work, holds sensitive business data, or you are not comfortable with these steps, ask a qualified technician or your workplace IT support. Reporting the incident early is useful at work, where an incident response process may exist.

Preventing a repeat

After cleaning up, think about how the infection got in, and close that route:

  • Keep your operating system and apps updated, since attackers often use known flaws that updates fix.
  • Download software only from official stores or the developer’s own site.
  • Be careful with attachments and links, particularly from unexpected senders, because phishing emails are a common delivery method.
  • Review app permissions on your phone and remove access that is not needed.

Malware removal can be straightforward or frustrating depending on the case. A cautious approach, containing the device, scanning, cleaning, changing passwords and resetting when in doubt, covers most situations. No method is guaranteed, so staying alert and keeping backups is the best long-term protection.

The complete guide to personal security

5 Ways to Boost Your Online Security
Read the guide

Keep exploring

Guides from other topics

All topics →