Guide
Suspect a virus or malware? What not to do first
A scary popup, a browser that's suddenly behaving strangely, or a machine that's crawling for no clear reason — the instinctive first moves people make are often exactly the wrong ones. Here's what to avoid.
Most malware isn't just trying to break your computer — a lot of it is specifically designed to provoke a panicked reaction, because panic makes people do things they'd never normally do: call a fake support number, type in a password to "verify" an account, or download a second piece of software to "fix" the first problem. Slowing down before reacting is genuinely the single most protective thing you can do in the moment.
Don't call the number on the popup
A full-screen warning claiming your computer is infected, often with a countdown timer or a loud alarm sound, and a phone number to call for "support" is one of the most common scams in circulation. Real security software does not lock your screen and demand a phone call. The number on that popup connects to a scammer, not a legitimate technician — and the longer that call goes on, the more likely you are to be talked into giving remote access to your computer or paying for a fake fix.
Don't enter passwords into anything that popped up unprompted
If a window appears asking you to "verify your identity" or "confirm your account" in response to a security warning, treat it as hostile until proven otherwise. Legitimate security checks don't work that way. If you're genuinely unsure whether an account needs attention, close everything and navigate to that service directly by typing the address yourself, rather than clicking anything in the popup or following a link it provided.
Don't download a second "cleaner" tool to fix the first problem
A common pattern: one piece of unwanted software prompts you to download another program that claims it will remove the first one. Sometimes that second download is legitimate. Often it's more of the same, or worse. Stacking multiple unfamiliar "cleaner" or "optimizer" downloads on top of each other, especially under pressure to act fast, tends to make a machine harder to untangle, not easier.
Don't assume a factory reset is the only way to fix it
A lot of people avoid dealing with a suspected infection at all because they assume the fix means wiping the whole computer and losing everything on it. That's usually not true. A proper cleanup removes the infection while leaving personal files intact. Assuming the worst and putting off dealing with it only gives whatever's on the machine more time to do damage or spread further.
What is reasonable to do in the moment
- Close the browser tab or window entirely, using the taskbar or task manager if a fake warning won't let you click a normal close button.
- If you're worried the machine is actively doing something in the background (unexpected network activity, unfamiliar programs launching on their own), disconnecting it from WiFi is a reasonable, low-risk step while you sort out next steps.
- If you already entered a password somewhere you now suspect was fake, change that password from a different, trusted device as soon as you can — email and banking accounts first.
- Write down or screenshot what you saw (the exact wording of a warning, a phone number, a program name) before closing it — that detail is genuinely useful for diagnosing what actually happened.
Why we don't publish a removal checklist here
Figuring out exactly what's on a machine and safely removing it — without missing something that reinstalls itself, and without accidentally deleting something that isn't actually the problem — depends heavily on what the specific infection actually is. A guide generic enough to publish for every possible infection would be too vague to be genuinely useful, and specific self-removal steps for the wrong kind of infection can make things worse. That's a diagnosis-first job, not a one-size-fits-all checklist.
Dealing with popups, a hijacked browser, or a machine that's suddenly slow?
Tell us what you're seeing and where you're located — we'll follow up to schedule an on-site cleanup. See our virus & malware removal page for how the process works.
Request Service