Key takeaways
- Pop-ups, a changed homepage, unknown programs and a switched-off antivirus are the common signs.
- Disconnect from the internet, then run Windows Security's full scan and its offline scan.
- From a different device, change your important passwords and turn on two-step verification.
- Never pay a ransom, never call numbers on pop-ups, and never give remote access to strangers.
Quick answer: is it really a virus?
Many problems blamed on viruses are not. A slow laptop is more often a full drive, too many startup programs, or an ageing hard drive. A browser that shows adverts is more often a website you allowed to send notifications. The difference matters, because the cure is different.
Signs that really do point to malware:
- Pop-ups and adverts appearing on the desktop when no browser is open.
- Your homepage or search engine changed, or search results take you to strange sites.
- New toolbars, extensions or programs you did not install.
- The fan runs hard and the laptop is busy even when you are doing nothing, and Task Manager shows a program you do not recognise using lots of processor power.
- Windows Security or your antivirus is switched off and will not turn back on.
- Files will not open, have strange new extensions, or a message demands payment.
- Friends tell you they received messages or emails from you that you did not send.
- Your data bundle disappears faster than normal.
One sign alone is not proof. Two or three together make malware likely. A scan will help confirm it.
Fake virus alerts and pop-ups: not always an infection
A page that suddenly says "Your computer is infected! Call this number" or plays an alarm is almost always a fake alert on a website, not a real scan of your laptop. It is a scam designed to make you call a number or install something.
- Do not click anything in the alert and do not call the number.
- If the page will not close, press Ctrl + Shift + Esc to open Task Manager, select the browser and choose End task. When the browser reopens, do not restore the previous session.
- Run a Windows Security scan anyway, to be sure nothing was installed.
If pop-ups appear in the corner of the screen even when the browser is closed, or from a particular website, check browser notifications. In Chrome: Settings, Privacy and security, Site settings, Notifications. In Edge: Settings, Cookies and site permissions, Notifications. Remove sites you do not recognise, or block them all.
Real Windows security alerts never ask you to call a phone number. If a caller says they are from Microsoft or from your internet provider and that your laptop has a problem, hang up.
Step 1: Disconnect and protect your accounts
Turn off Wi-Fi (click the network icon and switch Wi-Fi off, or switch on Airplane mode) and unplug any network cable. This stops malware sending your data or receiving instructions while you clean it.
Do not log in to banking or email on this laptop until it has been cleaned. If you must act urgently, such as an unusual bank alert, use your phone or another trusted device.
Unplug flash drives and external drives, because malware can spread to them. Do not open files from them until they have been scanned.
Step 2: Run a full scan with Windows Security
Windows Security (Microsoft Defender) is built in to Windows 10 and 11 and is good enough for most people when kept up to date. You may need to briefly reconnect to the internet so it can update its definitions, then disconnect again before scanning.
- Open the Start menu, type Windows Security and open it.
- Click Virus & threat protection.
- Under Current threats, click Scan options.
- Select Full scan and click Scan now. It can take an hour or more. Let it finish.
- If it finds threats, click Start actions or Clean threats, and choose Remove.
If Windows Security will not open or will not turn on, malware may have disabled it. In that case use the offline scan below and a second scanner.
Step 3: Run the Microsoft Defender Offline scan
Some malware hides while Windows is running. The offline scan restarts the laptop into a special environment and scans before the malware loads.
- In Windows Security, go to Virus & threat protection, then Scan options.
- Choose Microsoft Defender Antivirus (offline scan) and click Scan now.
- Click Scan when asked. Your laptop restarts, runs for around fifteen minutes, then returns to Windows.
For a second opinion you can download the free Microsoft Safety Scanner from Microsoft's own website. It is a one-off scanner and expires after about ten days, so download a fresh copy each time. Only run one real-time antivirus at a time, because two installed antivirus programs conflict. Download scanners only from the maker's official site, never from search adverts.
Step 4: Remove unknown programs and browser extensions
Programs
Open Settings, then Apps, then Installed apps (Windows 10: Apps & features). Sort by install date. Look at recently installed items you do not recognise and uninstall them. Common offenders include "PC cleaner", "driver updater", "PDF converter", "video downloader" and odd-named search tools.
Startup items
Press Ctrl + Shift + Esc, open the Startup apps tab (Startup in Windows 10), and disable anything unfamiliar that is enabled and has a high impact.
Browser extensions
In Chrome, go to the three dots, Extensions, Manage extensions. In Edge, go to the three dots, Extensions, Manage extensions. Remove any extension you did not knowingly install, and anything with a strange name.
Reset the browser
If the homepage or search engine keeps changing back: in Chrome, Settings, Reset settings, Restore settings to their original defaults. In Edge, Settings, Reset settings, Restore settings to their default values. This keeps your bookmarks and passwords but turns off extensions and clears temporary data.
Step 5: Secure your accounts and tell the right people
Do this from your phone or another clean device, after the laptop is cleaned if possible.
- Change passwords, starting with your email, because anyone who controls your email can reset every other account. Then banking, mobile money, social media, and any account that holds your card details. Use a different, long password for each.
- Turn on two-step verification where available, so a password alone is not enough.
- Check your email settings for forwarding rules or unknown recovery phone numbers and addresses that you did not add. Remove them.
- Review account activity on Google, Microsoft and social media, and sign out of all other devices.
- If you entered card or bank details, or notice transactions you did not make, contact your bank immediately and ask to block or change the card.
- Warn your contacts if messages were sent in your name, so they do not click anything.
If a message demands payment or your files are locked
This is ransomware. The criminals encrypt your files and ask for money. Paying does not guarantee you get the files back, and it marks you as someone who pays.
- Do not pay and do not contact the sender.
- Switch the laptop off and disconnect it from the network so it does not spread to other computers.
- Do not delete anything and do not reinstall Windows, because that destroys evidence and any chance of recovery.
- If you have a backup on a drive or cloud service that was not connected at the time, your files may be safe. Restore them after the laptop has been cleaned.
- The public website nomoreransom.org lists free decryption tools for some ransomware families.
- Take the laptop to a technician and say that you want to preserve the drive.
When to stop and call a technician, and how to prevent a repeat
Get help if Windows Security will not turn on or keeps being turned off, scans find threats that return after removal, the laptop will not start, files are locked, or you handle sensitive client or school data on the laptop. A technician can remove deeper infections, repair Windows, and check that nothing is still running in the background. A reinstall of Windows is a last step, and a clean install after a backup is the surest way to remove deep infections, as long as you back up your files first and scan them.
To prevent a repeat:
- Keep Windows, your browser and your apps updated.
- Avoid cracked software, activators and "free" versions of paid software. They are the main route for malware on many laptops.
- Be cautious with unknown flash drives and with files received on WhatsApp, email or Telegram, especially .exe, .zip, .js and .iso files.
- Download programs from the maker's official site, and untick bundled extras during setup.
- Use a standard (non-administrator) Windows account for daily work.
- Keep a backup on a drive that is not plugged in all the time, plus a cloud copy.
Frequently asked questions
How do I know if my laptop has a virus?
Look for pop-ups when no browser is open, a changed homepage or search engine, unknown programs, a switched-off antivirus, high processor use from programs you do not recognise, and files that will not open. A full Windows Security scan and the offline scan help confirm it.
Is Windows Security enough to protect my laptop?
For most people, yes, if it is switched on, updated and combined with careful habits such as avoiding cracked software and suspicious links. Do not run two antivirus programs at once. Extra tools are rarely needed unless you have special requirements, and a technician can advise.
Should I reinstall Windows after a virus?
Only as a last step. Try a full scan, an offline scan and removal of unknown programs first. If infections return, a clean reinstall is the surest cure. Back up your important files first and scan them before restoring, because malware can hide in your files.
Can a virus steal my passwords and bank details?
Some malware records keystrokes or steals saved browser passwords. If you suspect an infection, use another device to change your important passwords, turn on two-step verification and check your bank account. Contact your bank at once if you see transactions you did not make.
Can my phone or other devices get infected from my laptop?
Malware on a laptop can spread through shared drives, flash drives and network connections, and stolen passwords can be used on other devices. Disconnect the laptop, scan any drives it touched, and change your passwords from a clean device.
What if the virus scan finds nothing but my laptop is still slow?
Then the problem may not be malware. Check Task Manager for programs using high processor, memory or disk, limit startup apps, free up drive space, and check the drive health. A failing hard drive, too little RAM or overheating can all feel like a virus.
We repair laptops and build websites and business systems. Have a question this guide did not answer? Message us.
This guide is general advice. Every device and business is different, so if you are unsure, ask a technician before you act.
