Choose a guide to protect devices, understand email and network defenses, or learn from older outbreaks. The full computer-virus and malware response guide remains below, with steps for Windows, macOS, devices and accounts.
Malware is software used to cause harm or gain unauthorized access. A computer virus is one type that spreads by infecting other code or files. An unexpected pop-up, slow computer or security alert deserves investigation, but each points to a different next step.
Use this guide for computers you own or administer. For a work device, suspected ransomware, sensitive-data exposure or several affected machines, contact the designated incident responder before cleanup. Cleaning or resetting a machine can remove information needed to understand the incident.
Choose a protection or outbreak guide
Explore 21 guides by the task or evidence you need to understand. For a suspected infection, start with the response guide.
Protect devices
- Antivirus Protection: What You Need and How to Check It
Check what protects your computer, what it covers, and when additional software helps.
- Spyware: Warning Signs, Exposure, and Recovery
Understand suspicious monitoring and decide what needs checking on the device and in your accounts.
- Phone Malware: Cabir History and Today’s Android and iPhone Risks
Separate old Bluetooth-worm stories from the checks relevant to your phone today.
Protect email
- Email Sender Authentication: SPF, DKIM, DMARC, and Their Limits
Learn what sender checks establish and why an authenticated message can still be deceptive.
- Email Security Gateways: Filtering, Quarantine, and What Gets Through
Follow a message through filtering and quarantine, and see what your team still needs to check.
- Exchange Edge Transport: Mail Flow, Boundaries, and Responsibilities
Trace Exchange mail through the Edge role and identify the owners of connectors, synchronization, certificates and monitoring.
- SpamSquelcher and the Challenge of Accurate Spam Filtering
Evaluate spam filtering through missed junk, blocked legitimate mail, delay and the effort needed to resolve mistakes.
Protect networks and web services
- Containing Malware Inside a Network: Segmentation and Device Isolation
Map internal connections and understand how isolation and segmentation limit an outbreak.
- Network Antivirus Firewalls: Traffic Inspection, Coverage, and Limits
Find out which traffic a network firewall inspects, what its verdict means and where other controls are needed.
- Virus Filtering on Wi-Fi: Guest Access and Returning Devices
Plan wireless access for guest, managed and returning devices using ownership, required resources and current evidence.
- Web Service Security: Access, XML Parsing, and Resource Limits
Review a web service through its access rules, XML processing, resource limits and evidence of correct behavior.
Learn from outbreaks and reporting
- Sasser: How a Worm Spread Without an Email Attachment
See why an exposed, unpatched service could be enough for a worm to spread.
- Mydoom: Deceptive Email, Backdoors, and the Scope of Recovery
Follow a deceptive attachment from the first click to the recovery questions a backdoor creates.
- Zotob: What the Patch-to-Outbreak Timeline Teaches
Understand the gap between a security update being released and every exposed system being protected.
- Doomjuice: How One Infection Enabled Another
See how an existing backdoor let a second worm in, and why recovery needs a wider check.
- Nimda: How a Blended Worm Spread and What Defenders Learned
Follow one outbreak across mail, websites and shared files to understand layered defenses.
- Goner: A Screensaver Lure That Attacked Security Software
Understand the 2001 screensaver lure and why recovery must also check the tools meant to protect a computer.
- Netsky.B: Deceptive Filenames and Shared-Folder Spread
Follow Netsky.B through deceptive attachment names and shared folders, and learn what file presentation can establish.
- Bagle.C: Forged Senders, Harvested Addresses, and Misleading Clues
Use Bagle.C to understand forged email identities, harvested addresses and the evidence needed to assess account compromise.
- Sober: What Signature and Behavior Detection Can Establish
Separate variant names, detection signals and prevention claims when interpreting malware reports.
- Computer Virus Rewards: Mydoom, Security Bounties, and Reporting Crime
Understand the historical Mydoom reward and distinguish crime tips, incident reports and vulnerability-bounty submissions.
Match the evidence to the first action
| Observation | What it establishes | First useful action |
|---|---|---|
| A webpage says the computer is infected and gives a phone number | The page is displaying a claim. | Close the page without calling or installing anything; open the actual security app independently. |
| A security app identifies a threat | The scanner detected something under its current rules. | Record the detection, file and action; check whether it was blocked, quarantined or allowed. |
| Files change unexpectedly or a ransom note appears | There may be an active incident affecting data. | Disconnect the affected device from networks and contact the responder from a separate trusted device. |
| An account has unfamiliar activity | The account may be compromised, with or without local malware. | Secure it from a trusted device and review sessions, recovery and forwarding settings. |
| The computer is slow or crashes | There is a symptom with several possible causes. | Record when it happens; review storage, updates and security results before choosing a remedy. |
A browser notification may persist because a site has notification permission. Removing that permission and scanning through the real security app is more useful than following the alert's sales pitch. The FTC's tech-support scam guidance explains why unexpected support warnings deserve an independent check.
Contain an apparent active incident
Disconnect Wi-Fi and wired networking on the affected machine to reduce communication and spread. Keep backup drives disconnected and avoid attaching them for an improvised rescue. Use another trusted device or phone to contact help and record the time, symptoms and recent actions.
The CISA-led ransomware response guide prioritizes isolation and preserving evidence. It treats power-down as a fallback when network disconnection is impossible because shutdown loses volatile evidence. Follow your responder's instructions for a business incident; avoid experimenting with removal tools or deleting files before they assess the system.
Record the visible message or detection name without opening more suspicious content. Note affected accounts and shared storage. A ransom note or scanner result is a starting point for investigation; it does not establish that every affected file or account has been found.
For managed systems, explore internal-network containment and isolation.
Windows: use the actual protection interface
For an ordinary personal-device investigation, open Windows Security from Windows itself and choose Virus & threat protection. Check which antivirus provider is active. Update its security intelligence, run the appropriate scan and review the recorded actions. When another provider manages protection, use its supported procedure.
Microsoft documents quick, full, custom and offline scans. A full scan covers the device more broadly than a quick scan. Microsoft Defender Offline restarts into the Windows Recovery Environment; save work first and have any required device-recovery information available. Read the result after Windows returns.
Inspect Protection History and resolve allowed threats only through the documented controls. If the same detection returns, protection is disabled unexpectedly or the machine remains unreliable, stop repeating scans and seek qualified help or a supported clean reinstall. Verify the support status of the installed Windows edition and update channel as part of recovery.
Compare your options in the antivirus protection guide.
macOS: preserve its built-in protections
Install supported macOS and security updates, and inspect any warning through the operating system. Avoid overriding an untrusted-app warning simply to make a downloaded program run. Review unexpected login items, browser extensions and notification permissions, recording changes you make.
Apple describes Gatekeeper, notarization and XProtect as layers for preventing, detecting and remediating malware. Their presence reduces risk while leaving a need to investigate persistent symptoms. macOS does not use the Windows Security scan workflow.
If an untrusted program executed, remote-control access was granted or problems persist, contact Apple support or a qualified responder through a channel you find independently. On a managed Mac, let the administrator inspect device management and security tooling before removing it.
Recover the device and the accounts
- Establish a trustworthy system. Follow the security provider's remediation or the manufacturer's clean-reinstallation process. Preserve needed incident evidence before erasure.
- Secure exposed accounts from a trusted device. Change exposed or reused passwords, revoke unauthorized sessions, and review recovery methods and mailbox rules.
- Restore from a suitable backup. Choose a known-good point, inspect the data and reinstall applications from trusted sources. Avoid restoring the suspicious installer or automatically recreating the same unwanted setup.
- Verify normal operation. Check updates, active protection, scan results, restored files and important account activity. Keep watching for recurrence.
- Close the entry point. Address the unsafe download, exposed remote access, compromised credential or missing update that the investigation identified.
If unwanted monitoring is suspected, use the spyware exposure guide. For email-related risks, compare sender authentication and mail filtering.
Earlier reports retained for historical reference
These two pages retain their original-era coverage. Dates identify the reports, not current product availability or remediation advice. The renovated outbreak studies appear in the library above.
- Spam Cube — March 14, 2006. A home-network anti-spam appliance announcement.
- Netsky C Worm — February 25, 2004. A dated Netsky.C report with period indicators.
For the everyday next steps, use the spam and phishing guide and account authentication guide. The incident record below helps capture observations and actions without placing passwords or recovery codes in a troubleshooting note.