What do I do if a work computer or phone has a virus or malware?

The short version

• Disconnect first. Turn off Wi-Fi or unplug the network cable so the malware can’t spread or send data out.
• Stop signing in to email, banking or anything else on that device until it’s clean.
• Scan with the built-in tools: Windows Security on a PC, macOS’s own protection on a Mac, Play Protect on Android.
• Change passwords from a clean device and turn on two-step login.
• Reset the device if the problems come back, after backing up your files.

How do I know a device has malware?

The FTC’s malware guide lists the common signs:

• The computer suddenly slows down, freezes or crashes.
• The browser’s home page changes, or it sends you to sites you didn’t choose.
• New toolbars or add-ons appear in the browser.
• You see a flood of pop-up ads, even on sites that don’t run ads.
• Task Manager or Activity Monitor won’t open.
• Emails or social posts go out that you didn’t write.

One sign alone can be a normal fault. Two or three together, especially messages you didn’t send, deserve action today.

A frightening pop-up that says “your PC is infected, call this number” is usually not malware on the computer. It’s a scam web page. Close the browser and don’t call.

What do I do in the first hour?

1. Disconnect the device from Wi-Fi and wired networks. Leave it switched on if you plan to have someone look at it.
2. Don’t sign in to business email, banking or payroll on it.
3. Tell whoever handles your IT, and anyone who shares files with that device.
4. Run a full scan with the steps below.
5. From a different, clean device, change the passwords for email, banking and anything you used on the infected one. Turn on two-step login.
6. Watch for fallout: messages sent in your name, forwarding rules you didn’t set, odd payments. If an account was taken over, follow the first hour after an account takeover.

How do I scan a Windows PC?

Windows includes Microsoft Defender in the Windows Security app. Microsoft’s support page describes an offline scan, which runs before Windows starts and can catch malware that hides while Windows is running:

1. Save your open files. The PC will restart.
2. Open Windows Security and select Virus & threat protection.
3. Under Current threats, select Scan options.
4. Choose Microsoft Defender Antivirus (offline scan), then Start an offline scan.
5. After the restart, check the results under Protection history.

What about a Mac?

macOS checks apps before they open and has a built-in scanner, XProtect, that Apple updates on its own, separately from system updates. Apple’s platform security guide says it can block known malware, move it to the Trash and remove infections that already ran.

What you can do:

• Install every macOS update, so the latest protection is in place.
• In System Settings, then Privacy & Security, set Allow applications from to App Store or App Store and Known Developers, as Apple’s Mac guide explains.
• Delete apps and browser extensions you don’t recognize.

What about phones?

iPhone and iPad: keep iOS updated in Settings, then General, then Software Update, and turn on Automatic Updates, per Apple’s update guide. Only install apps from the App Store. On phones, the real risk is usually a phishing link or fake sign-in page, not a virus. See how to spot a phishing email.

Android: Google Play Protect scans apps when you install them and checks the phone regularly. Google’s Play Protect page says to open the Play Store, tap your profile icon, then Play Protect, then Settings, and keep Scan apps with Play Protect on. If it flags an app, uninstall it.

When should I wipe and reset the device?

Reset it when the scan can’t clean it, when the problems come back after cleaning, or when you suspect ransomware. A reset is the only way to be sure. Before you do:

• Back up documents and photos, not programs. Programs can carry the infection back.
• Scan the backup on a clean computer before you restore it.
• Reinstall apps from the official store or the maker’s site.

If files are already locked and there’s a ransom note, stop and read how to handle ransomware first.

What are the common mistakes?

• Calling the number in a pop-up. Real security warnings don’t ask you to phone anyone.
• Changing passwords on the infected device. Malware can capture the new ones as you type.
• Turning off built-in protection because a second antivirus product said to. Running two at once can cause problems, but one must stay on.
• Ignoring update prompts. Many infections use holes that an update already fixed, which is why CISA says to install updates promptly and turn on automatic updates.
• Running an old system. A computer or phone that no longer gets security updates stays exposed however careful you are. See what end of life means.

What if this didn’t work?

If scans keep finding the same thing, or you think business data was taken, get professional help. Report cyber incidents to CISA through its online form, and call your bank at once if payments are involved. If customer data may have been exposed, read what to do after a data breach.

How much does it cost, and how long does it take?

The built-in tools are free. A scan takes from a few minutes to an hour, depending on the device and how much is on it. A full reset and restore takes half a day or more per computer, which is why backups and updates cost less than a cleanup.

How does E-3 handle this?

E-3 looks after websites, hosting and business email, not office computers or phones. If malware sent messages from your email, or you think a website login was captured, call us so we can change the website passwords and check the site. Sites on our website care plan have daily backups and security alerts. Put office devices in your security plan under whoever handles your IT.

Related questions

• How do I secure office computers, phones and Wi-Fi?
• What do I do in the first hour after an account takeover?
• How do I protect my business from ransomware?
• What does end of life mean for software?
• Stay safe online: every guide in one place

Sources

1. Malware: How To Protect Against, Detect, and Remove It (FTC Consumer Advice, April 2025)
2. Secure Your Business (CISA)
3. Update Software (CISA Secure Our World)
4. Virus and threat protection in the Windows Security app (Microsoft Support)
5. Protect your Mac from malware (Apple Support)
6. Protecting against malware in macOS (Apple Platform Security)
7. Update your iPhone or iPad (Apple Support)
8. Use Google Play Protect to help keep your apps safe (Google Play Help)