To scan for malware safely, update your system, disconnect from suspicious sites, run the built-in security scanner, review unusual apps and browser extensions, and use a reputable second-opinion tool only if needed. After cleanup, reduce future risk with updates, backups, safer downloads, and stronger account protection.
TL;DR: Do not click pop-up warnings or download random cleanup tools. Use trusted security tools, scan carefully, remove suspicious items, change important passwords from a clean device, and improve prevention habits afterward.
Recognize warning signs without panicking
Malware can cause pop-ups, browser redirects, unknown programs, disabled security settings, slow performance, unusual account activity, or files that suddenly become inaccessible. But those symptoms can also come from ordinary software bugs or browser extensions. Start with evidence, not fear.
CISA's CISA malware guidance defines malware as malicious code that can disrupt service, steal information, or gain access to systems. The practical takeaway for home users is that malware is serious, but the safest response is calm and methodical.
Step 1: Stop making the problem worse
If a browser warning or pop-up says your device is infected, do not call the number, click the download button, or enter payment details. Close the tab or browser. If the page will not close, restart the device. Disconnect from Wi-Fi only if you suspect active account theft, ransomware, or unusual network traffic.
Use another trusted device to change passwords for email, banking, and password-manager accounts if you think credentials were stolen. Do not change passwords from a computer you believe is actively compromised until you have scanned it.
Step 2: Update before scanning
Security tools work best when definitions and system components are current. Install operating system updates and security updates first if the device is stable enough. Then update the browser and key apps. If updates fail repeatedly, write down the error and continue with the scan.
On Windows, the built-in security app is the safest starting point for most users. If you need a Microsoft second-opinion tool, use the official Microsoft Safety Scanner page rather than a search ad or third-party download site.
Step 3: Run the scan in a sensible order
Start with a quick scan if you need an initial answer fast. Then run a full scan when the computer can stay on for a longer period. If the tool offers an offline scan, use it when malware appears persistent or interferes with normal scanning.
After the scan, read the results carefully. Quarantined items are usually isolated. Removed items should no longer run. Potentially unwanted apps may not be traditional malware, but they can still add ads, toolbars, tracking, or performance problems.
Step 4: Review browsers and extensions
Many infections feel like computer-wide malware but live mainly in the browser. Check the home page, search engine, notification permissions, and extensions. Remove extensions you do not recognize or no longer use. Block site notifications from unknown websites. Clear suspicious site data if redirects continue.

The FTC malware advice warns that malware can show up through unwanted pop-ups, unexpected settings changes, or programs that appear without permission. Browser cleanup directly addresses those symptoms.
Step 5: Remove suspicious apps carefully
Open the installed apps list and sort by install date. Look for unfamiliar programs installed around the time the problem began. Search only official vendor names or reputable security resources before removing unfamiliar system components. Do not delete files manually from system folders unless a trusted tool tells you to.
If the computer became slow around the same time, compare malware symptoms with ordinary performance causes. Our guide on slow-computer troubleshooting explains safe cleanup steps that do not damage the operating system.
Step 6: Change passwords and check accounts
After the device scans clean, change passwords for important accounts, especially email, banking, cloud storage, and social profiles. Enable multifactor authentication where possible. Review account recovery email addresses, forwarding rules, recent logins, and connected apps.
If any financial account or business account shows unauthorized activity, contact the provider directly through its official website or app. Do not use links from suspicious messages.
What to do if malware keeps coming back
Persistent symptoms may require deeper action:
- Run an offline scan.
- Use a reputable second-opinion scanner from the official source.
- Restore the browser profile or create a new profile.
- Uninstall recently added apps.
- Restore from a known-clean backup.
- Reset the operating system only after backing up important files.
- Get professional help for suspected ransomware, business devices, or sensitive data exposure.
Document what changed
After a successful cleanup, write down what the scanner found, which apps or extensions were removed, and which passwords were changed. This record helps if symptoms return. It also prevents you from reinstalling the same risky extension or downloader later. For a shared family computer or small office device, a short cleanup note can save hours because the next person will know what was already tested.
Also watch the device for a few days. A single clean scan is reassuring, but repeated browser redirects, new pop-ups, or disabled security settings mean the root cause may still be present.
Reduce future infection risk
Prevention is easier than cleanup. Keep the operating system updated, download apps from official sources, avoid cracked software, back up files, use a password manager, enable multifactor authentication, and teach household or team members not to trust urgent pop-ups.
Network security matters too. A weak router password or outdated firmware can expose devices. Our guide to router mistakes that lead to weak coverage and security problems explains the home-network side of safer computing.
A scan is only one part of recovery
Scanning is the beginning, not the whole solution. The safer process is to stop risky clicks, update tools, run trusted scans, review browsers and apps, secure accounts, and improve habits. That gives you a cleaner device and a lower chance of facing the same infection again.