This guide is for the moment after something has gone wrong: you ran a file you now doubt, an installer added things you did not want, or the device has started behaving oddly. The steps come from the UK National Cyber Security Centre (NCSC), the US Federal Trade Commission (FTC) and CISA, which publish recovery advice for ordinary users. If the device belongs to an employer or school, stop here and contact its IT support instead: they may need to investigate before anything is changed.
Signs something is wrong
Sometimes it is obvious: security software reports an infection, or a screen demands payment to unlock your files, which is ransomware. Otherwise, the NCSC and the FTC list signs that a device may be infected:
- the device runs slowly, freezes, crashes or restarts by itself;
- programs or apps close or open on their own;
- pop-up boxes appear from programs you do not recognise, asking you to do unexpected things;
- the browser's home page changes, it redirects you to sites you did not choose, or new toolbars or add-ons appear;
- you get a flood of pop-up adverts, including on sites where you would not expect them;
- operating system tools such as Task Manager or Activity Monitor stop working;
- friends receive emails or messages from you that you did not write.
The NCSC adds a warning: if someone phones to tell you that your device is infected and offers to help, that is a common scam. Hang up.
First: stop and do not sign in
The FTC's first step, if you think you clicked a link or opened a file that downloaded malware, is to stop logging into online accounts with usernames, passwords or other sensitive information, such as shopping or banking, until the device is clean. Malware is often designed to capture exactly those details.
If the file has not been run yet, delete it. If it has, carry on with the steps below for your type of device.
Cleaning a computer
The NCSC sets out the steps for a PC or laptop in order:
- Update the device and its programs. The FTC likewise says to update your security software so it has the latest protections.
- Run a scan with your antivirus product and follow its advice. The FTC suggests that if you have no security software, you install some, finding recommendations from independent review sites. This site does not recommend any product.
- If the scan cannot clean the device, wipe it and reinstall everything, starting with the operating system. The NCSC says you may need expert help for this, and also if the browser is so badly affected that you cannot download security software at all.
- Restore your files from the last known good backup. See the backups section below.
If an unwanted program was added by an installer rather than being outright malware, uninstalling it through the operating system's normal list of installed apps, and then removing any unfamiliar browser extensions, may be enough. That is this site's practical suggestion rather than a step the sources list; run a scan afterwards either way to confirm nothing else came with it.
Cleaning a phone or tablet
The NCSC notes that phones and tablets usually cannot be cleaned by an antivirus product the way computers can. Its advice is that the safest solution is a factory reset, which you can normally find in the device's settings, though the name of the option varies. A factory reset erases the device, so you will need your backup afterwards. If a reset does not fix the problem, the NCSC says you will need expert help.
On Android, Google Play Protect may already have flagged, disabled or removed a harmful app; if it sent a notification, follow it to uninstall the app.
Example: putting the steps in order
This is an invented example and describes no real person or device. After installing a "free" game from an unfamiliar site, someone's laptop shows a new toolbar and constant pop-up adverts. They stop signing in to their bank on that laptop, update it and its security software, and run a full scan, which finds and removes two programs. The toolbar remains, so they uninstall it from the list of installed apps. Then, from their phone, they change their email password and turn on 2-step verification, and they watch their bank statements for the next few weeks.
Securing your accounts
Once the device is clean, or from a different device you trust, deal with your accounts. Changing passwords on a device that is still infected may hand the new ones straight to the attacker.
- Change passwords. CISA says to change your passwords if you believe your computer is infected, including any website passwords that were saved in the browser. The NCSC says to change the password for any account that was hacked and for any other account using the same password, because criminals try one stolen password on many accounts.
- Turn on 2-step verification. The FTC and the NCSC both advise it. The NCSC explains that it stops a criminal who knows your password from getting in, and suggests starting with email and banking.
- Check your email settings. The NCSC warns that criminals often set up forwarding rules so that copies of your emails, including password reset messages, go to them. Remove any rule you did not create.
- Sign out everywhere. The NCSC suggests logging all devices and apps out of an account after changing its password.
- Watch your money. CISA advises looking for unauthorised or unusual activity on your accounts, especially bank accounts, and contacting the provider at once if you find any. The NCSC also suggests checking bank statements and telling your contacts to be wary of recent messages from you.
If a scammer was involved
If the problem started with a pop-up or phone call and you gave someone access to your computer, paid them, or shared details, the FTC's tech support guidance applies. If you gave a scammer your username and password, change it right away, and change it anywhere else you used the same one. If you paid, contact your bank or card provider; the NCSC gives the same advice and says to report the call. Then treat the computer as possibly compromised and follow the cleaning steps above, because remote access may have been used to install software.
Backups and restoring
A recent backup turns a bad download from a disaster into an inconvenience. The NCSC advises restoring from the last known good backup, accepting that anything not backed up may be lost, because trying to rescue files from an infected device risks carrying the infection over to the clean one. For organisations it adds that backups should be scanned for malware before files are restored, and that at least one backup should be kept offline, separate from the device, because ransomware actively targets backups. The same logic suits a household.
On ransom demands, the NCSC is clear that even if you pay, there is no guarantee you will get your computer or files back.
After recovery, the NCSC's list for staying safe is short: keep the device and apps up to date, back up your data, check the device is encrypted, and for computers make sure antivirus is installed and updating regularly.
Reporting it
- United States: the FTC asks people to report adverts, websites or emails they think are spreading malware, ransomware demands and tech support scams at ReportFraud.ftc.gov. If you think someone stole your information, it points to IdentityTheft.gov for a recovery plan.
- United Kingdom: the NCSC says to report scam calls about infected devices to Report Fraud, and to tell your bank or card provider if you paid.
- Elsewhere: look for your national cyber security agency or consumer protection body.
That is the last guide. Keep the download checklist to hand.