Contain first, then scan from trusted tools, and only reinstall when the infection persists or the system cannot be trusted. Disconnect a computer showing ransomware or signs of an active compromise from Wi‑Fi and Ethernet, do not attach backup drives, and involve your organization’s IT or security team if it is a work or school device. For a suspicious pop-up alone, do not panic: Microsoft notes that slowdowns, crashes, blocked pages and pop-ups can have causes other than malware. Investigate with the security tools already built into your operating system rather than downloading a supposed fix from an advert, caller or unexpected warning.
1. Contain the computer before trying to clean it
Containment limits what malware can reach and preserves options for recovery. The right response depends on the symptom and the computer’s role.
As an Amazon Associate I earn from qualifying purchases.
For ransomware or an active compromise
- Disconnect the affected computer from Wi‑Fi and unplug its Ethernet cable when you can do so safely.
- Do not connect USB backup disks, shared storage or other computers. Ransomware can encrypt files that become reachable after connection.
- Leave existing evidence intact if the machine belongs to an employer, school or other managed environment. Contact the IT or security team instead of resetting it yourself.
- If the incident affects an organization, follow its incident-response plan. CISA recommends taking an infected system off the network and securing backups offline; that guidance is written for ransomware response, so treat it as a cautious containment measure rather than a mandatory reaction to every browser pop-up.
For a one-off warning or suspicious behavior
Close the browser tab or application without calling a phone number shown in the message. Do not install a “support” utility offered by a stranger, and never paste commands into Windows Run or macOS Terminal because a pop-up or caller told you to. Fake security alerts, impostor support calls and instructions to paste commands are common social-engineering patterns documented by Apple.
Preserve data and observations
- Write down the time the problem began, the exact alert text, affected files and any account credentials entered afterward.
- Photograph or screenshot an alert only if doing so does not require interacting with it.
- Do not delete logs, ransom notes or suspicious messages on a managed device; your IT team may need them.
- Keep the computer powered as directed by your organization. For a personal machine, shut it down if continuing to run it risks encryption or further damage.
- Note whether the warning appears only in a browser, after a particular download, or before Windows or macOS starts. That distinction helps separate a web scam from a system-level problem.
2. Protect accounts from a separate device
Removing a malicious file does not undo passwords, sessions or payment details that may already have been exposed. Use a different device that you know is clean to change passwords, beginning with email and financial accounts when relevant. Use unique passwords and review active sessions, signed-in devices and recovery addresses or phone numbers. Enable multifactor authentication wherever it is offered.
#1 Best Overall
- High-speed USB 3.0 performance of up to 150MB/s(1) [(1) Write to drive up to 15x faster than standard USB 2.0 drives (4MB/s); varies by drive capacity. Up to 150MB/s read speed. USB 3.0 port required. Based on internal testing; performance may be lower depending on host device, usage conditions, and other factors; 1MB=1,000,000 bytes]
- Transfer a full-length movie in less than 30 seconds(2) [(2) Based on 1.2GB MPEG-4 video transfer with USB 3.0 host device. Results may vary based on host device, file attributes and other factors]
- Transfer to drive up to 15 times faster than standard USB 2.0 drives(1)
- Sleek, durable metal casing
- Easy-to-use password protection for your private files(3) [(3)Password protection uses 128-bit AES encryption and is supported by Windows 7, Windows 8, Windows 10, and Mac OS X v10.9 plus; Software download required for Mac, visit the SanDisk SecureAccess support page]
Do not use the possibly infected computer to reset an important password until it has been assessed. A password change made on a compromised system could be captured again. Save evidence of unauthorized transactions and contact the bank, service provider or employer through a phone number or website you locate independently, not through the warning itself.
If an Apple Account may be exposed
Apple’s account-recovery guidance says to change the password, inspect account details, remove unknown devices, verify control of associated email addresses and phone numbers, and turn on two-factor authentication. Do not assume that deleting an app reverses unauthorized purchases, messages or transfers; contact the affected service or financial institution through its official channel.
3. Choose a recovery path
There is no scanner that can promise a computer is clean. Make the decision using recurrence, severity, platform, available backups and how much disruption or data loss you can accept. A single browser redirect may justify investigation and a normal scan; a threat that returns after every restart, changes security settings or damages Windows deserves a more disruptive response.
Recommended Free Tools
| Situation | Least-disruptive next step | When to escalate | Main consequence |
|---|---|---|---|
| Windows computer with a single suspected file and no recurring warning | Update Microsoft Defender and run a scan. | Escalate if the threat returns, the scan fails or system changes cannot be reversed. | A normal scan usually lets you keep working after it finishes. |
| Windows threat returns after restart or hides while Windows is running | Run Microsoft Defender Offline. | Use reset or a clean installation if detection or damage persists. | The computer restarts and scans outside the normal Windows environment. |
| Windows system is damaged, removal fails or you cannot trust the installation | Use Windows recovery options or clean-install media. | Restore only from a known-clean backup after reinstalling. | A clean installation removes Windows, personal files, apps and settings from the selected drive. |
| Mac reports a downloaded item as malware | Move the item to Trash and empty Trash; update macOS and use trusted app sources. | Contact Apple Support or a reputable security professional if the problem persists or compromise is serious. | The consumer Mac guidance covered here centers on the detected item and safe software practices, not a universal eradication command. |
| Credentials were entered into a suspicious page or caller gained access | Change passwords from a clean device and review sessions and recovery details. | Notify the service, bank or organization involved. | Account recovery is required even after the computer appears normal. |
Scan, reset or reinstall?
A regular scan is appropriate when the system remains usable, the warning is isolated and no evidence suggests persistence. An offline scan is the middle step for malware that returns or hides during normal startup. Resetting or clean-installing is justified when removal fails, Windows components are irreversibly changed, the machine will not boot, or you cannot establish a trustworthy state. The cost is downtime and possible loss of files, applications and settings, so verify your backup before choosing it.
4. Windows: scan with Microsoft Defender, then escalate
Prepare Windows Security
- Save your work and close unnecessary applications.
- Open Windows Security from the Start menu.
- Choose Virus & threat protection, then open Protection updates and select Check for updates. Current protection updates improve the chance of detecting recent threats.
- Make room on the system drive if Windows reports insufficient space. Microsoft lists low disk space as a reason a scan may not complete.
- If the computer is still connected to a network and the incident appears active, contain it first. Do not connect backup media merely to make a copy before you know whether ransomware is running.
Run a regular scan
From Virus & threat protection, start the available scan. A restart followed by a scan before opening other apps can help because fewer programs are active. Let the scan finish, review the detection name and action taken, and restart if Windows requests it. A clean result means Defender did not detect a threat in that scan; it is not proof that every compromise or account exposure has been resolved.
Record the detection name and whether Windows quarantined, removed or merely blocked the item. If the same alert appears again, note when it returns and what you did immediately beforehand. Repeated detections can indicate a surviving component, a repeatedly downloaded file or a changed system setting rather than a one-time file.
Rank #2
- Large Data Storage Capacity: Flash Drive with 128GB capacity, meet your needs of daily use on work, school, home and travelling for photos, music, videos, files storage and transfer
- Easy to use: The thumb drive is plug and play without any software installation; Supports Windows 7/8/10 / Vista / XP / Unix / 2000 / ME / NT Linux and Mac OS, also compatible with USB 2.0 and 1.1 ports; Storage is fast, safe and stable
- Wide Compatibility: USB flash drive support TV, desktop, notebook computer, car, audio and other device; It is your great data storage and transfer companion with traveling and working
- Retractable Desgin: The usb drive's retractable design can effectively protect the USB interface; The capless design can avoid losing of cap; Weight: 7g, Size: 2.6 × 0.8 × 0.4 inch. Portable to take your digital world anywhere
- What You Get: 1 x 128GB USB Flash Drive Thumb Drive, All of usb drives have been rigorously tested and formatted before leaving the factory; The default format of the USB stick is exFAT
Use Defender Offline for recurring or hidden malware
If the same threat returns after a restart, or normal scans cannot remove it, choose Scan options and select Microsoft Defender Offline scan, then start the scan. Save all work first: Windows restarts and scans outside the usual desktop. Microsoft describes it this way: “Microsoft Defender Offline is a scanning tool that works outside of Windows, allowing it to catch and clean infections that hide themselves when Windows is running.” After the scan, Windows starts again and reports the result in Windows Security.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Because the computer reboots, close documents and disconnect anything you do not want the scan or restart to access. If the offline scan cannot run, update Windows, free disk space and seek help rather than downloading an unverified replacement utility.
Understand the Malicious Software Removal Tool
Microsoft’s Windows Malicious Software Removal Tool is a post-infection tool for specific prevalent threats. It is not a full antivirus and does not replace ongoing protection. Use it only as an additional, targeted removal step when its scope matches the detected threat; do not treat it as a universal cleaner or as proof that an unrelated infection has been removed.
When Windows recovery is safer than repeated scans
Escalate when malware returns after Defender Offline, security settings keep changing, important Windows functions are damaged, or you cannot establish what the system has done. Microsoft’s recovery guidance lists reset and reinstall choices. A clean installation from installation media is the stronger option when malware is suspected and other recovery choices fail.
Before proceeding, make a written inventory of files you need and confirm that a backup predates the infection. A clean installation removes Windows, personal files, apps and settings from the selected drive. It is not a repair that preserves everything. If the infected computer will not start, Microsoft says to create installation media on another working PC. A USB flash drive is practical for carrying that media, but the drive itself does not detect or remove malware.
Free tools Windows power users keep installed
One-click scans. No signup required.
- On a separate, working computer, create official Windows installation media.
- Back up only files you have assessed as necessary, preferably to storage that remains disconnected until the installation is complete. Do not copy unknown programs or executable files simply because they are convenient.
- Start the affected computer from the installation media and follow the Windows setup instructions for a clean installation.
- After Windows starts, apply Windows updates and protection updates before restoring files or installing extra software.
- Install applications again from their official sources, then scan restored files with updated protection.
- Record which drive and partitions you select. Choosing the wrong drive can erase data you intended to keep.
If you cannot identify a trustworthy backup or the machine contains sensitive business evidence, stop before wiping the drive and obtain professional help.
Rank #3
- What You Get - 2 pack 64GB genuine USB 2.0 flash drives, 12-month warranty and lifetime friendly customer service
- Great for All Ages and Purposes – the thumb drives are suitable for storing digital data for school, business or daily usage. Apply to data storage of music, photos, movies and other files
- Easy to Use - Plug and play USB memory stick, no need to install any software. Support Windows 7 / 8 / 10 / Vista / XP / Unix / 2000 / ME / NT Linux and Mac OS, compatible with USB 2.0 and 1.1 ports
- Convenient Design - 360°metal swivel cap with matt surface and ring designed zip drive can protect USB connector, avoid to leave your fingerprint and easily attach to your key chain to avoid from losing and for easy carrying
- Brand Yourself - Brand the flash drive with your company's name and provide company's overview, policies, etc. to the newly joined employees or your customers
5. Mac: remove the detected item and keep recovery conservative
When macOS identifies a downloaded item as malware
Apple’s Mac malware guidance says the safest action is to move the downloaded item to Trash and then Empty Trash. Do not open it again or grant it additional permissions. If the item is in a download folder or an email attachment, remove duplicate copies as well.
Prevent a repeat download
- Keep macOS updated so its built-in security checks have current protections.
- Install apps from the App Store or directly from a developer you trust.
- Pay attention to macOS warnings about an app’s source, signature or developer. Do not bypass those checks merely to run an unsolicited utility.
- Reject browser pop-ups that claim Apple has detected a virus and provide a phone number.
- Do not paste Terminal commands supplied by a pop-up, email or caller, even when the message claims the command will “verify” or “clean” the Mac.
If the Mac still behaves as compromised
The consumer instructions in these sources do not provide a complete, universal Mac malware-eradication sequence for every persistent infection. If unknown apps return, account access changes, security warnings continue or sensitive data may have been exposed, contact Apple Support or a reputable security professional. Avoid generic advice to delete hidden system files or install a third-party “cleaner”; an incorrect deletion can damage macOS while leaving the underlying compromise unresolved.
Tell the adviser what macOS reported, when the item was downloaded, whether credentials were entered and whether other devices share the same account. That information helps determine whether the problem is a blocked download, an unwanted application or a broader account compromise.
6. Restore files without reintroducing the infection
Use a backup made before the incident
The safest restore point is a backup created before the first suspicious behavior and stored separately from the computer. Offline media and services with version history are preferable because malware may alter backups that were mounted or reachable during the infection. Microsoft warns that backups left on the PC during an infection might already have been modified.
Do not choose the newest backup automatically. Compare its date with the first warning, ransom note, unexplained account activity or other symptom. If every available copy was connected during the incident, ask a professional to assess it before restoring.
Restore in a controlled order
- Finish the scan, reset or clean installation first.
- Update the operating system and built-in protection before connecting restore media.
- Restore personal documents, photos and other data before optional programs.
- Scan restored files with current protection. Treat installers, scripts, macros and executable files with extra caution.
- Reinstall applications from official sources rather than copying program folders from the old system.
- Apply application updates and restart when requested.
- Keep the backup disconnected again after the required files are copied.
If a restored file triggers a detection, isolate it and do not keep retrying the restore. Find an earlier version or a clean replacement instead. A backup that contains altered documents, encrypted copies or a malicious installer is not a safe recovery point.
Rank #4
- High-speed USB 3.0 performance of up to 150MB/s(1) [(1) Write to drive up to 15x faster than standard USB 2.0 drives (4MB/s); varies by drive capacity. Up to 150MB/s read speed. USB 3.0 port required. Based on internal testing; performance may be lower depending on host device, usage conditions, and other factors; 1MB=1,000,000 bytes]
- Transfer a full-length movie in less than 30 seconds(2) [(2) Based on 1.2GB MPEG-4 video transfer with USB 3.0 host device. Results may vary based on host device, file attributes and other factors]
- Transfer to drive up to 15 times faster than standard USB 2.0 drives(1)
- Sleek, durable metal casing
- Easy-to-use password protection for your private files(3) [(3)Password protection uses 128-bit AES encryption and is supported by Windows 7, Windows 8, Windows 10, and Mac OS X v10.9+; Software download required for Mac, visit the SanDisk SecureAccess support page]
7. Verify recovery and harden the computer
Check the machine
- Run an updated security scan after restoration.
- Confirm that unexpected browser extensions, startup items, user accounts and remote-access tools are gone.
- Check that operating-system updates and application updates complete normally.
- Watch for the original symptom returning, but remember that slowness, crashes and pop-ups can have non-malware causes.
- Confirm that firewall and security settings have not been silently disabled or changed.
Check accounts and devices
From a clean device, review sign-in history, active sessions, trusted devices, recovery email addresses and phone numbers. Sign out unknown sessions, replace reused passwords and enable multifactor protection. For financial or workplace accounts, report suspicious activity through the service’s official support channel.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Improve future recovery
- Keep at least one backup disconnected or protected by version history.
- Test that you can restore a file before you need the backup.
- Keep macOS or Windows and installed applications current.
- Use built-in security controls and obtain software from trusted sources.
- Teach household users not to call numbers in pop-ups, surrender remote control to unsolicited callers or paste commands supplied by messages.
- Keep a simple inventory of essential applications and license information so a reinstall does not depend on unknown downloads.
8. When to get professional help
Seek expert assistance when ransomware is active, the machine belongs to an organization, the system will not boot, important files or evidence must be preserved, account takeover is suspected, or a clean installation would create unacceptable loss. CISA’s malware guidance points consumers toward reputable experts rather than a particular vendor. For ransomware affecting an organization, CISA recommends contacting law enforcement; household cases should follow applicable local reporting options.
Ask a prospective helper what they will preserve, whether they will reinstall or attempt forensic recovery, and what data loss is possible. Do not grant remote access to an unsolicited caller claiming to be from Microsoft or Apple. Use contact details obtained from the company’s official website or your organization’s directory.
The practical endpoint is not merely a scan that says “clean.” It is a computer rebuilt or verified to a level you can accept, data restored from a trustworthy point, and accounts secured from a known-clean device.
Frequently Asked Questions
How do I remove malware from my computer?
Contain an active compromise, avoid pop-up fixes and use the operating system’s trusted security tools. On Windows, update Microsoft Defender, run a scan and use Defender Offline if the same threat returns. On a Mac, move a downloaded item identified as malware to Trash and empty Trash. Persistent or serious cases may require a reset, clean installation or professional help.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesHow do I know if malware is still on my PC?
A recurring detection after restart, changing security settings, damaged Windows functions or repeated unknown apps are reasons to escalate. A clean scan only means that tool did not detect a threat at that time; it cannot prove that every compromise or stolen credential has been resolved. Slowdowns, crashes and pop-ups can also have non-malware causes.
Best Value
- COMPATIBILITY: Designed for both Windows 11 Professional and Home editions, this 16GB USB drive provides essential system recovery and repair tools
- FUNCTIONALITY: Helps resolve common issues like slow performance, Windows not loading, black screens, or blue screens through repair and recovery options
- BOOT SUPPORT: UEFI-compliant drive ensures proper system booting across various computer makes and models with 64-bit architecture
- COMPLETE PACKAGE: Includes detailed instructions for system recovery, repair procedures, and proper boot setup for different computer configurations
- RECOVERY FEATURES: Offers multiple recovery options including system repair, fresh installation, system restore, and data recovery tools for Windows 11
Should I disconnect my computer from the internet?
For ransomware or signs of an active compromise, disconnect Wi‑Fi and Ethernet and do not attach backup drives. This cautious containment step is not necessary for every isolated browser pop-up, but it is appropriate when files are being encrypted or the system is actively communicating unexpectedly.
When should I use Microsoft Defender Offline?
Use it when the same Windows threat returns after a restart or a normal scan cannot remove it. Save work first because the computer restarts and scans outside the usual Windows environment, where malware that hides during normal operation may be easier to detect.
Will a clean Windows installation delete my files?
Yes. A clean installation from installation media removes Windows, personal files, applications and settings from the selected drive. Confirm a pre-infection backup and the drive selection before proceeding. If the computer will not start, create the media on another working PC.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Can I restore the newest backup after malware?
Not automatically. Prefer a backup made before the first suspicious behavior and stored separately or protected by version history. Backups reachable from the infected computer may have been modified. Scan restored files and reinstall applications from official sources.
What should I do if I entered a password into a suspicious page?
Use a known-clean device to change the password, starting with email and financial accounts when relevant. Review active sessions, devices and recovery details, sign out anything unfamiliar and enable multifactor authentication. Contact the affected service or bank through its official channel.
Is a USB flash drive a malware cleaner?
No. It is useful for carrying official Windows installation media, especially when another working computer must create it. The drive itself does not detect or remove malware.
The Bottom Line
Contain active threats, use trusted built-in tools, and choose reinstall only when persistence or damage outweighs the disruption. Restore from a pre-infection backup, reinstall software from official sources, and secure exposed accounts from a known-clean device.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
