Don't Panic — But Do Act Fast
Discovering malware on your computer is unnerving. But the first hour matters more than the next ten. Here is a calm, practical sequence to follow.
Step 1 — Disconnect from the Network
Pull the Ethernet cable. Disable Wi-Fi. Switch on airplane mode. This single action stops:
- Lateral spread to other devices.
- Ongoing data exfiltration.
- Communication with the attacker's command-and-control server.
Do not shut down the computer yet. Memory may contain forensic evidence.
Step 2 — Stop Working
Do not "just finish this one thing". Every file you save, every page you load, may be observed. Close all applications.
Step 3 — Identify What Was Found
Note down:
- The exact name of the threat as reported by the scanner.
- The full path of the infected file.
- The time of detection.
- Any actions the AV claims to have taken.
This information will be useful in step 5.
Step 4 — Run a Full Scan
Run a full system scan (not a quick scan) with at least one reputable antivirus. If the AV that found the threat is the one already installed, consider also using a second-opinion scanner — a single-engine miss is common. Online file scanners can help inspect specific suspicious files.
Step 5 — Research the Threat
Use the reported threat name as a search query. Look for:
- What kind of malware it is (trojan, ransomware, infostealer, miner).
- What it does — most threat names map to public technical write-ups.
- What it steals — credentials? cookies? cryptocurrency wallets? everything?
- Whether it persists — does it survive a reboot?
This determines what you must change next.
Step 6 — Rotate Compromised Credentials
If the malware was a password stealer, an infostealer, or a RAT, assume everything on the machine is compromised. From a different, trusted device:
- Change passwords for email, banking, work accounts, and cloud services.
- Invalidate active sessions wherever possible (most services offer "log out everywhere").
- Rotate any API keys, SSH keys, or cloud credentials stored on the machine.
- Enable MFA on every account that supports it, if you haven't already.
Step 7 — Decide: Clean or Reinstall?
For low-impact malware (adware, PUPs), a thorough clean with multiple AV tools is usually sufficient.
For anything serious — rootkits, RATs, ransomware, advanced infostealers — the only safe answer is reinstall the operating system from scratch. Removal tools cannot guarantee no remnants. Cleaning a serious infection is like patching a sinking boat: technically possible, but you will be cleaning forever.
Step 8 — Restore from Backups Carefully
If you restore from backup, restore data only, not system files or applications, and only data that predates the infection.
Step 9 — Identify the Entry Vector
Ask: how did this get in?
- A specific email attachment?
- A pirated application?
- A browser extension?
- An exposed network service?
If you cannot identify and close the door, you will be repeating this process.
Step 10 — Prevent the Next One
- Keep the OS, browser, and applications fully patched.
- Use a reputable AV with real-time protection.
- Be cautious with email attachments and downloads.
- Run MFA on everything important.
- Back up regularly using the 3-2-1 rule.
- Scan unknown files with Virus Purge or similar before opening.
When to Call a Professional
If the affected machine handles sensitive personal data, financial systems, or business information — or if you suspect ransomware or a sophisticated targeted attack — engage a professional incident-responder. The cost of expert help is almost always less than the cost of a half-done DIY recovery.