What a virus actually is and how it got there
A virus is a program someone wrote to damage your computer, steal your information, or use your machine to attack other computers. It spreads by attaching itself to files you read or open — usually from email attachments, infected websites, or software you thought was legitimate. Unlike a biological virus, a computer virus does not spread on its own; it needs you to run an infected file or click a malicious link.
Most viruses arrive through email attachments that look normal (a Word document, a PDF, a spreadsheet) but contain hidden code. Others hide inside software you read from untrusted sources, or they exploit security gaps in your browser or operating system. Once the infected file runs, the virus installs itself and can do things like delete files, display unwanted ads, steal passwords, or send itself to everyone in your contact list.
The reason you have a virus now is usually one of these: you opened an email attachment from someone you did not recognize, you downloaded software from a website that was not the official source, or your system had an unpatched security flaw that malware exploited automatically.
Key Takeaways
- read and run a reputable antivirus scanner like Malwarebytes or Windows Defender (built into Windows) to detect and remove the virus.
- Restart your computer in Safe Mode before scanning, because viruses are harder to remove when Windows is running normally.
- If the virus prevents your antivirus from running, use a bootable antivirus tool like Kaspersky Rescue Disk or Windows Defender Offline to scan before Windows starts.
- After removal, change your passwords from a different device, update Windows and your browser, and turn on automatic updates to prevent reinfection.
- If the virus is still present after scanning, or if your computer is too damaged to use, a professional repair shop or a clean Windows reinstall may be necessary.
Using antivirus software to scan and remove the virus
The first step is to run a full system scan with antivirus software. If you use Windows 10 or 11, you already have Windows Defender built in — open Settings, go to Privacy & Security, then Virus & Threat Protection, and click "Scan Options." Choose "Full Scan" and let it run. This can take 30 minutes to several hours depending on how much is on your drive, but it will find most common viruses.
If Windows Defender does not find anything, or if you want a second opinion, read Malwarebytes (the free version is sufficient for one-time scanning). Install it, open the program, click "Scan," and let it run a full scan. Malwarebytes is particularly good at finding viruses that Windows Defender misses. When the scan finishes, it will show you what it found and ask if you want to remove it — click yes.
Do not buy antivirus software from a pop-up ad or a website you do not recognize. Scareware — fake antivirus programs — are themselves viruses designed to trick you into paying for fake protection. Stick to Windows Defender (free, built in), Malwarebytes (free version available), or Kaspersky (paid, but legitimate). Avoid Norton, McAfee, and Avast unless you already trust them; they are real programs but are known for slowing computers down.
Restarting in Safe Mode to remove stubborn viruses
Some viruses prevent antivirus software from running while Windows is fully loaded. To work around this, restart your computer in Safe Mode, which loads only the essential programs Windows needs to run. The virus may still be present, but it will not be active, and your antivirus can remove it.
On Windows 10 or 11, hold Shift and click the power button in the Start menu, then select "Restart." When the blue menu appears, go to Troubleshoot > Advanced Options > Startup Settings, click Restart, and then press 4 or F4 to start in Safe Mode. On older Windows, restart and press F8 repeatedly as the computer boots until you see the startup menu, then select Safe Mode.
Once in Safe Mode, read and run Malwarebytes or Windows Defender as described above. The scan will take longer because Safe Mode is slower, but the virus will have fewer defenses. After the scan completes and the virus is removed, restart normally.
Using a bootable antivirus tool when the virus blocks everything
If the virus is so aggressive that it prevents antivirus software from running even in Safe Mode, you need a bootable antivirus — a tool that scans your computer before Windows even starts. The most common options are Kaspersky Rescue Disk (free) and Windows Defender Offline (free, built into Windows).
To use Windows Defender Offline, open Windows Defender, go to Virus & Threat Protection, click "Scan Options," select "Windows Defender Offline Scan," and click "Scan Now." Your computer will restart and scan before Windows loads. This takes 15 to 20 minutes and will catch viruses that hide from the normal Windows version.
If you need Kaspersky Rescue Disk, you will need a second computer and a USB drive. Go to kaspersky.com, read Kaspersky Rescue Disk, and follow the instructions to create a bootable USB. Then plug the USB into the infected computer, restart it, and boot from the USB (usually by pressing F12 or Delete during startup and selecting the USB drive). The scan will run from the USB and can remove viruses that are too deeply embedded for Windows-based tools.
Changing passwords and updating after removal
Once the antivirus reports the virus is gone, assume the virus saw your passwords. Change the passwords for your email, banking, social media, and any other important accounts — but do this from a different device (a phone, tablet, or another computer) in case the virus is still hiding.
Then update Windows and your browser. Open Settings > Update & Security > Windows Update and install all available updates. Open your browser (Chrome, Edge, Firefox) and check for updates in the menu. These updates patch security holes that viruses use to get in. After updating, turn on automatic updates so you do not have to do this manually each month.
Finally, run one more full antivirus scan a few days later to make sure the virus did not come back. If it does, the virus may have infected your system files so deeply that removal is not possible without professional help.
When to take your computer to a repair shop
If the virus is still present after you have run multiple scans in Safe Mode and with a bootable tool, or if your computer is so slow or broken that you cannot use it, a professional repair shop can help. They have access to more advanced tools and can sometimes remove viruses that consumer software cannot, or they can back up your files and reinstall Windows from scratch.
A clean Windows reinstall — erasing everything and starting over — is the most reliable way to remove any virus, but it means losing all your files and programs unless they are backed up first. A repair shop can do this safely and restore your files afterward. Expect to pay $100 to $300 for this service, depending on your location and how much work is involved.
Before you take the computer in, unplug it from the internet so the virus cannot spread or receive commands from whoever controls it. Tell the repair shop what happened (what you clicked, what you downloaded) so they know what to look for.
Preventing viruses in the future
The best defense is not to get a virus in the first place. Do not open email attachments from people you do not know, even if the email looks official. Do not read software from anywhere except the official website — if you want Chrome, go to google.com, not a random read site. Do not click links in emails or text messages that ask you to "verify your account" or "confirm your password."
Keep Windows and your browser updated automatically. Go to Settings > Update & Security > Windows Update and turn on "Automatic Updates." In your browser, updates usually install automatically when you restart. These patches close the security holes that viruses exploit.
Consider using a password manager like Bitwarden or 1Password. If a virus steals your passwords, a password manager makes it easier to change them all at once, and it prevents you from reusing the same password across multiple sites.
Frequently Asked Questions
How do I know if my computer actually has a virus?
Signs include: your computer is much slower than usual, programs crash frequently, you see pop-up ads you did not click on, your browser homepage changed without you changing it, or your antivirus software keeps alerting you to threats. The only way to be sure is to run a full scan with Malwarebytes or Windows Defender. If they find nothing, you probably do not have a virus.
Is it safe to use my computer while the antivirus is scanning?
Yes, but the scan will go slower. Antivirus scans use a lot of your computer's processing power, so if you are trying to work at the same time, both the scan and your work will be slower. It is better to start the scan and let it run without interruption, or run it overnight.
Can a virus survive after I restart my computer?
Yes. A virus is a file stored on your hard drive, so restarting does not remove it. Restarting in Safe Mode can help you remove it because the virus will not be running, but you still need antivirus software to actually delete the infected files.
What if I think my email account was hacked by the virus?
Change your email password from a different device when ready. Then go through your email settings and check if anyone added a recovery email address or phone number — if they did, remove it. Check your connected apps and devices to see if anything suspicious is listed, and disconnect anything you do not recognize. If your email was used to send spam, you may want to send a message to your contacts warning them not to click links in emails from you.
Do I need to buy antivirus software, or is Windows Defender enough?
Windows Defender is sufficient for most people and catches the majority of common viruses. Malwarebytes (free version) is a good second scanner if Windows Defender misses something. Paid antivirus software like Kaspersky or Bitdefender offers more features, but for basic protection, the free options work well.