I think I have a virus. How do I know? What do I do?

First, if you're seeing any suspicious behavior, immediately stop using your computer normally.  Close any open programs.  Don't sign in to anything, and definitely don't use the web to buy anything.

If you're still able to browse the web properly, and you're on a PC, go to Malwarebytes.org and download their software. The program will be called mbam-setup-<a number>.exe, where <a number> is the current version of the software.  If the file you're downloading doesn't begin with "mbam", you've either got the wrong file or your web browser is being redirected, and in that case we'll come back to you.



If Malwarebytes installs correctly, go ahead and update it and then open the program.


Don't bother with the trial of the full version, and start a quick scan.  Now, go make a snack while that runs.

If it comes up completely clean, I'm astonished; it will almost always find at least some tracking cookies that web sites use to follow your behavior.  Whatever it does find, it's generally safe to allow it to clean up. WARNING, sometimes a virus has so badly infected your system that cleaning it up will break your installation.  In this case, you will have to reinstall Windows and all of your software, but it is likely that you would have had to do so anyway.

When Malwarebytes is done with the cleanup, it will probably ask you to restart your computer.  If it doesn't, go ahead and restart it anyway.  Now, run a second scan with Malwarebytes and also with your antivirus program. If and only if these scans also come up clean can you consider it safe to use your computer again.  Install system updates immediately, and keep installing them going forward.  If they don't come up clean, allow them to do whatever cleanup they recommend, and also download Microsoft's own removal tool.

If, and only if, after running these three tools--Malwarebytes, your antivirus scanner, and Microsoft's tool--your computer still seems infected, you should download and run ComboFix.  This is a big, bad removal tool that is capable of ripping some really nasty viruses out by their rootkits.  It is also capable of completely ruining your operating system in ways that the previous tools can only dream of.  But if you have a virus infection, you are done using that computer until it's clean.  Then, install any system updates that are available, and keep installing them going forward.

After Combofix runs, scan again with the three previous tools.  If they come up clean, you're in good shape.  If they don't, you need to decide whether you have any data on your computer that you haven't backed up or stored elsewhere.  If you're properly backed up, and you have the CDs to install any software that you didn't download, wipe and reinstall your computer using the instructions that should have come with it.  If you're not backed up, shame on you; your punishment is that you're done with this blog post and now you have to hunt down a computer professional to attempt further cleanup.  We've gone as far as I can take you.

If your computer isn't behaving well enough to let you download the Malwarebytes file, especially if it won't boot at all, shut it down and find, borrow, or beg for another computer.  Download the Kaspersky Rescue CD, and either burn it to a disk or make a USB key using the instructions that they give you.  Boot your computer from that CD/USB, and follow the instructions that you see.  Once that's done, attempt to boot into the operating system again; if you're successful, follow the steps above starting from the Malwarebytes download.  If it doesn't boot after the rescue CD, you're also stuck reinstalling the operating system or finding a computer professional, as above.

On a Mac, you should run a scan with your antivirus program (or install Sophos if you don't yet have one, shame on you), and also install any system updates available, which will close security holes as well as run the Flashback and Mac Defender removal tools, which will clean up the best known problem pieces.  Because Mac malware is a relatively smaller problem, sophisticated removal tools like Malwarebytes don't really exist yet.

Likewise, Linux does not yet have similar easy-to-use tools, but it's much less likely to get infected.  You should still be using an antivirus program, though, and can run a scan with that.  If you suspect an infection on your Linux machine has gotten through your antivirus, you'll probably be stuck manually tracking down the infection or reinstalling.

If you're not seeing suspicious behavior, you may still be infected--a well written virus can sit in the background and do whatever its tasks are without letting you know.  It's worth your while to tell your antivirus program to scan periodically, as well as to install Malwarebytes as above and run a manual scan with that every month or so.  Passive antivirus that runs in the background only offers so much protection.