How to Remove Malware From a PC, Mac or Phone

How to remove malware comes down to the same steps on any device: disconnect from the internet, stop signing in to accounts, update your security software, run a full scan, and uninstall any app or extension you don't recognize. On Windows, add a Microsoft Defender offline scan. On a Mac, update macOS and restart. On Android, use Play Protect and safe mode. On iPhone, update iOS and delete unknown apps and profiles. If signs persist, back up your files and reset. Then change your passwords from a clean device, because removal doesn't undo what malware already took.

Before You Start: Three Quick Checks

The steps in this guide come from Microsoft, Apple, Google and US government guidance, checked on November 6, 2026. Menu names can differ by software version and phone maker. Each check below sends you down a different path, so start here.

1. Is this a work or school device? Stop here and call IT. CISA's recovery guidance says to contact them immediately, because a quick response limits damage to your computer and others on the network. Don't delete anything or reset the device first.
2. Is it only a pop-up telling you to call a number? Don't call. The FTC warns that scammers use fake security pop-ups to get remote access to your device and charge you for a problem that doesn't exist. If a pop-up or locked screen won't close, the FBI's IC3 advises shutting the device down, even if the message says not to. Victims who waited and restarted usually found it gone. This is a form of social engineering, and it may not involve malware at all.
3. Do you see a ransom note or encrypted files? Jump to the "If It's Ransomware" section. A normal cleanup won't bring those files back.

If none of these applies, do two things right away:

• Disconnect from the internet. CISA says this keeps an attacker or virus from reaching your data or using your computer to attack others. You'll need to reconnect briefly to download updates. Do only that, then disconnect again.
• Stop signing in to accounts on this device. The FTC lists this as the first step, including shopping and banking sites.

Signs You Might Have Malware

The FTC and Google list similar warning signs. No single sign proves an infection, so what matters is the pattern. This table is our practical reading of those signs.

Some malware shows no signs at all. That's especially true of infostealers, which quietly copy saved passwords and browser data. The same goes for many keyloggers, so our guide on how to find and remove a keylogger covers the extra checks they need. Our guide to the types of malware explains how each kind behaves.

Choose Your Device

The same four-step path works on every platform: update and scan, remove what you didn't install, go deeper, and reset only as a last resort. Stop as soon as the signs are gone and a fresh scan comes back clean.

How to Remove Malware From a Windows PC

Windows includes Microsoft Defender Antivirus, so you don't need to buy anything to start. If you run another antivirus, update it and use its full scan in place of step 2.

1. Update first. Go to Start, then Settings, then Windows Update, and check for updates. If you're still on Windows 10, Microsoft ended support on October 14, 2025, so free security fixes have stopped.
2. Run a full scan. Open Windows Security, select Virus & threat protection, then Scan options, and start a full scan. Microsoft suggests restarting and scanning before you open other apps. It also warns that low disk space can stop a threat from being removed.
3. Uninstall what you don't recognize. Go to Settings, Apps, then Installed apps. Next, check Settings, Apps, Startup and turn off anything suspicious.
4. Run a Microsoft Defender offline scan. It's in the same Scan options list. Microsoft says it runs after a restart, without loading Windows, so persistent malware has a harder time hiding. Save your work first, because the PC restarts. Afterward, check the results in Protection history. If you ever allowed a threat by accident, select it under Allowed threats and choose Don't allow.
5. Get a second opinion. Microsoft Safety Scanner is a free on-demand tool that expires 10 days after download, so get a fresh copy each time. The Malicious Software Removal Tool targets only specific widespread threats and doesn't remove spyware, so a clean result from it proves little. Type Microsoft's address yourself or use the links here, since the FTC warns about bogus software ads in search results.
6. Clean the browser. Remove extensions you don't need or trust, then reset browser settings. In Chrome, that's under More, Settings, Reset settings.

If a scan won't run: try Safe Mode, which starts Windows with a limited set of files and drivers. From the Windows Recovery Environment, select Troubleshoot, Advanced options, Startup Settings, Restart, then choose option 4, or option 5 if you need the internet. If your drive is encrypted, have your BitLocker key ready. If security tools stay blocked even then, move on to a reset.

How to Remove Malware From a Mac

Macs have built-in protection, but it runs on its own. Apple describes XProtect as antivirus technology that detects, blocks and removes known malware automatically, and its documentation doesn't describe a manual scan. So your job is mainly to update and remove the source. The first three steps are Apple's own adware and malware guidance.

1. Update macOS, or restart if you're current. Go to Apple menu, System Settings, General, Software Update. Apple says macOS includes a built-in tool that removes known malware when restarting.
2. Check your Applications folder. Open Finder, select Applications, and look for apps you don't expect. If one has its own uninstaller, use that. Otherwise, drag it to the Trash and empty the Trash.
3. Check browser extensions. In Safari, open Settings, then Extensions, and turn off or uninstall anything unnecessary. In Chrome, remove unknown extensions and reset settings.
4. Check what opens at login. Go to System Settings, General, Login Items & Extensions. Remove unfamiliar items and review App Background Activity.
5. Check profiles. Go to System Settings, General, Device Management. A personal Mac often has nothing listed here. Remove a profile you can't explain, but leave it alone on a work Mac and ask IT.
6. Test in safe mode. Safe mode stops login items and non-essential extensions from loading. If the problem disappears there, software that loads at startup is the likely cause. On Apple silicon, hold the power button until startup options load, select your disk, hold Shift, and click Continue in Safe Mode. On Intel, hold Shift during startup.

If you want a second opinion, use an on-demand scanner from a reputable security company. The FTC suggests checking independent review sites first. Don't override a macOS security warning unless you're certain where the app came from.

How to Remove Malware From an Android Phone

Android's main tool is Google Play Protect. These steps follow Google's malware removal guide.

1. Turn on Play Protect and scan. Open the Play Store, tap your profile icon, then Play Protect. In its settings, turn on Scan apps with Play Protect. If you installed apps from outside the Play Store, also turn on Improve harmful app detection. Go back to Play Protect and tap Scan. If it flags an app, tap Uninstall.
2. Install updates. Open Settings, then System, then Software update. Security & privacy has separate entries for security and Google Play system updates. Exact labels differ by phone.
3. Uninstall apps you don't trust. Open Settings, Apps, See all apps, choose the app, and tap Uninstall. Google's guidance covers apps you don't need, don't trust or got from outside the Play Store.
4. If Uninstall won't work, remove admin rights. A device admin app must be unregistered as an administrator before it can be uninstalled. Search your Settings for "device admin" and turn off the app there. On a work-managed phone, ask IT first.
5. Use safe mode for stubborn problems. Google's steps are to press and hold the power button, touch and hold Power off, and confirm. The method varies by maker, and safe mode removes some Home screen widgets, so take a screenshot first. Then remove recently downloaded apps one at a time, restarting normally after each one to see if the problem has stopped.
6. Stop browser notifications. If the alerts come from a website, turn off that site's notification permission in Chrome. These alerts can look like virus warnings, but the fix is a setting, not a cleanup.
7. Run a Security Checkup. Go to Google's Security Checkup and fix anything it flags.

How to Remove Malware From an iPhone

iOS is built to limit what any app can do. Apple says all third-party apps are sandboxed, which is designed to stop them from reading other apps' data or changing the device. In our view, most "iPhone virus" scares turn out to be scam pop-ups, spam calendars or unwanted profiles, so start with those.

1. Update iOS. Go to Settings, General, Software Update.
2. Deal with pop-ups safely. Apple says some pop-ups have fake close buttons, so don't tap inside them. Close the tab instead, and turn on Block Pop-ups and Fraudulent Website Warning under Settings, Apps, Safari. Then use Clear History and Website Data on the same screen.
3. Remove spam calendars. In the Calendar app, tap Calendars, tap the info button next to the unknown calendar, then tap Delete Calendar or Unsubscribe.
4. Delete apps you don't recognize. Touch and hold the app, tap Remove App, then Delete App.
5. Check for profiles. Go to Settings, General, VPN & Device Management. If you see a profile that shouldn't be there, select it, tap Delete Profile, and restart. If the phone belongs to a school or business, check with the administrator first.
6. Review access. Safety Check, under Settings, Privacy & Security, shows the people, apps and devices with access to your information.

If Apple sends you a threat notification, take it seriously. Apple calls these high-confidence alerts of individually targeted spyware attacks, and says the vast majority of users will never be targeted. Lockdown Mode is built for that small group, not for everyday cleanup.

When to Reset Your Device

A reset is the last step, but it's also the most thorough one. Google and CISA both point to resetting or reinstalling when other steps fail.

In DeepStrike's view, a reset is the right call when any of these is true:

• The same signs come back after you've worked through your device's steps.
• Security tools stay disabled, or scans can't finish.
• You found a remote access tool you can't explain, or a stranger had control of the device. The FTC's scam guidance stops at updating and scanning, but a reset is the more cautious choice.
• A scan found software built to steal data, and you want certainty.

Before you start, back up personal files only: documents and photos, not apps or installers. Apple warns that if you're erasing because of suspected malicious software, restoring from a backup may reinstall it. The same logic applies to other platforms. Scan your files again once the device is clean.

A few platform details matter here:

• Windows: Microsoft's reset options include Keep my files, which removes apps and settings, and Remove everything. We suggest Remove everything if you can restore files from a backup, because a malicious file you kept would survive the other option. Cloud download gets a fresh copy of Windows.
• Mac: Erase All Content and Settings keeps the installed macOS. Older Macs need the erase-and-reinstall route on the same page.
• Android: If you recently reset your Google password, wait 24 hours before a factory reset. When you set the phone up again, Motorola suggests choosing Set up as new and restoring one app at a time.
• iPhone: Follow Apple's erase steps, then set the phone up as new.

There is one exception. A bootkit such as BlackLotus sits in the boot process rather than in normal files, and the NSA published a dedicated mitigation guide for it in June 2023. If signs return right after a clean reset, contact the device maker.

If It's Ransomware

Ransomware needs different handling, because removing it doesn't unlock your files.

1. Isolate the device. CISA's checklist says to unplug the network cable or remove the device from Wi-Fi. Power it down only if you can't disconnect it, because that can destroy evidence in memory.
2. Report it. Report the demand to the FTC and the FBI's IC3. CISA also advises consulting federal law enforcement about possible decryptors.
3. Recover from a clean backup. Reset the device first, then restore your files, so you aren't restoring onto an infected system.

The WannaCry case shows how far ransomware can spread across networks, so a business should treat it as an incident, not a cleanup.

What to Do After You Remove Malware

Removal stops the malware, but it doesn't undo what the malware already collected. The order below is our suggestion, and the actions come from official guidance.

1. Use a clean device. The FTC says to change your passwords and turn on two-factor authentication. The Identity Theft Resource Center recommends doing it on a trusted device you know isn't compromised.
2. Start with email. Password resets for most other accounts run through your inbox, so securing it first protects the rest.
3. Move to money. Update bank, card and payment logins. If you paid a scammer by card or bank transfer, the FTC says to report it to your card company or bank and ask them to reverse the charge.
4. Change reused passwords. The FTC says to change the password anywhere else you used it. Our roundup of compromised credential statistics shows why reuse matters.
5. End old sessions. Stolen browser sessions can keep an attacker signed in, so remove devices you don't recognize. Use Google's Security Checkup or Apple's Safety Check, plus each important account's security page.
6. Watch and report. Review statements for charges you don't recognize. If you think someone stole your information, get a recovery plan at IdentityTheft.gov. Report scams at ReportFraud.ftc.gov and online crime at IC3.

Finally, confirm the fix. Restart, scan again, and use the device normally for a few days. Check other devices that shared the same files or accounts, too.

How to keep it from coming back

• Turn on automatic updates and leave real-time protection and Play Protect on.
• Get apps from official stores or the developer's own site. Google warns that encrypted archives can bypass antivirus scans, so be wary of password-protected ZIP files.
• Don't click software ads or pop-up download offers. Go to the official site by typing its address.
• Treat unexpected links and attachments with suspicion. Our guide to spear phishing shows how convincing targeted messages can be.
• Keep backups of your files, as CISA recommends, so a reset never means losing them.

For Organizations: Removal Is Not the Same as Response

The steps above fit a personal device. On a business network, one infected laptop raises a bigger question: what else did the attacker reach? A quick wipe can destroy the evidence you need to answer it.

• Follow your plan. A written incident response plan sets out who decides and who gets called. NIST SP 800-61 Rev. 3, published in April 2025, is the current US reference.
• Preserve before you rebuild. CISA's checklist calls for a system image and memory capture from a sample of affected devices, and for preserving volatile evidence. It also advises coordinated isolation, so attackers don't see the response and move laterally.
• Assume credentials are exposed. CISA notes that breaches often involve mass credential theft, so reset and review access beyond the first machine.
• Don't rely on file scans alone. Fileless malware leaves few disk artifacts, so endpoint behavior and logs matter as much as a clean scan.

Testing shows whether this works before a real incident does. A tabletop exercise rehearses the decisions, breach and attack simulation checks that controls still alert, and an internal penetration test measures how far an attacker could get from one compromised machine.

DeepStrike's penetration testing services are built for organizations and include manual testing and red team engagements, with reports and fix recommendations. If you want to find out what one infected endpoint could lead to, talk to our team.

Frequently Asked Questions

Can I remove malware myself?

Usually, yes. The FTC's steps are written for ordinary consumers: update your security software, scan and change your passwords. If you need help, it suggests the device maker, a tech support company you trust or a knowledgeable friend. Reach them yourself, never through a pop-up. Work devices should go to IT.

How do I check if I have malware?

Run a full scan in Windows Security on a PC or Play Protect on Android. On a Mac, update, restart and check your apps and login items. On iPhone, check apps and profiles. Then compare what you see with the signs table above. A clean scan is good evidence, but it isn't proof.

Does malware go away on its own?

Don't count on it. A restart can clear some problems, and macOS removes known malware when restarting, but persistent malware reloads itself. Fake pop-ups are different, since they often vanish once you shut down and restart the device.

What is the hardest malware to remove?

Rootkits and bootkits are among the hardest, because they hide from or load before the operating system. Our types of malware guide explains both. They're the reason a reset isn't an absolute guarantee.

Does a factory reset remove all malware?

It removes the apps and data on the device, which makes it the strongest fix most people have. It won't help if you restore an infected backup afterward, it doesn't undo stolen passwords, and boot-level malware is an exception.

Can iPhones get malware?

Yes, though sandboxing limits what apps can do. The serious cases Apple describes are targeted spyware attacks against a small number of people. Scam pop-ups and spam calendars are the more familiar annoyances.

Next Step

Start with the steps for your device, and stop when the signs are gone and a new scan is clean. Then secure your accounts from a clean device. If the problem keeps coming back, back up your files and reset.

About The Author

Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.

Sources and References

• FTC: Malware: How To Protect Against, Detect, and Remove It
• FTC: How To Spot, Avoid, and Report Tech Support Scams
• CISA: Recovering from Viruses, Worms, and Trojan Horses
• CISA: I've Been Hit By Ransomware!
• FBI IC3: Tech Support Fraud
• NIST: SP 800-61 Rev. 3
• NSA: Guide to Mitigate BlackLotus Threat
• Microsoft: Virus and Threat Protection in the Windows Security App
• Microsoft: Troubleshoot problems with detecting and removing malware
• Microsoft: Reset your PC
• Microsoft: Safety Scanner
• Microsoft: Malicious Software Removal Tool (KB890830)
• Apple: Block pop-up ads and windows in Safari
• Apple Platform Security: Protecting against malware in macOS
• Apple: Restore device to factory settings
• Apple: Erase your Mac and reset it to factory settings
• Apple: How to factory reset your iPhone
• Google: Remove malware or unsafe software
• Google: Remove unwanted ads, pop-ups and malware
• Google: Reset your Android device to factory settings
• Identity Theft Resource Center: When Your Computer or Phone Is Hacked