# How to protect your computer from malware on Windows and Mac

> Protect a Windows PC or Mac from malware: automatic updates, built-in protection, careful downloads, a standard account, backups, and what to do if infected.

- URL: https://computese.com/how-to-protect-your-computer-from-malware-in-2024/
- Author: Duong Quan Nguyen, CEO, Computese
- Published: 2024-09-28
- Updated: 2026-09-25
- Topics: Security, IT support

## In short
- Most infections start with someone running something they should not. In Microsoft's Digital Defense Report 2025, pages that trick people into pasting a command (ClickFix) were 47% of the initial access its Defender Experts saw, ahead of phishing at 35%.
- On Windows, keep updates, Microsoft Defender Antivirus, SmartScreen and Smart App Control on, work in a standard account and leave Office's block on internet macros in place. On a Mac, keep updates on and let Gatekeeper, notarization and XProtect work.
- Install software only from the Microsoft Store, the Mac App Store or the developer's own site typed into the address bar. Cracked apps, search ads and fake update pages are how infostealers and trojans arrive.
- Never paste a command that a web page, pop-up or message tells you to run. No real CAPTCHA, update or support page needs the Run dialog, PowerShell or Terminal.
- If a computer is infected: disconnect it, scan it (Microsoft Defender Offline on Windows), change passwords and sign out every session from a clean device, restore files from a backup, and reset or reinstall when you cannot trust it.

To protect your computer from malware, keep Windows or macOS and every app updating automatically, leave the built-in protection switched on, install software only from official sources, use a standard account for everyday work, never paste a command a web page asks you to run, and keep a backup that stays disconnected from the computer.

Each of those habits closes a route that infections actually use. This guide explains the main types of malware and what each one does, how malware reaches Windows PCs and Macs as of September 2026 (drawing on Microsoft's threat reports and CISA and FBI advisories), the protection built into each system and how to check it, the signs of an infection, and what to do after one. Choosing an antivirus product has its own guide, [how to choose antivirus software](https://computese.com/choose-the-right-antivirus-software-for-your-pc/); here it gets one line: on most home computers, start with the protection the system already includes.

## What malware is, and the main types

Malware is software that works against the person using the device. [NIST's glossary](https://csrc.nist.gov/glossary/term/malware) defines it as hardware, firmware or software intentionally placed in a system for a harmful purpose. The [FTC](https://consumer.ftc.gov/articles/malware-how-protect-against-detect-and-remove-it) puts it in consumer terms: harmful software installed without your knowledge, used to steal usernames, passwords and account numbers, show you unwanted ads, or lock your files until you pay.

The names you will read describe different things: how the malware spreads (virus, worm), how it gets you to run it (trojan), what it does once running (ransomware, spyware, infostealer, cryptominer) and how it hides (rootkit, fileless techniques). One infection is often several of these at once.

| Type                                 | What it does                                                                                                                                                                                                                                                                     | How it usually arrives                                                    |
| ------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------- |
| Virus                                | [Inserts a copy of itself](https://csrc.nist.gov/glossary/term/virus) into other programs and runs when they run                                                                                                                                                                 | Infected programs and files passed between computers                      |
| Worm                                 | [Copies itself and spreads](https://learn.microsoft.com/en-us/defender-endpoint/malware/worms-malware) from device to device, often by exploiting security flaws                                                                                                                 | Network shares, removable drives, email and file sharing                  |
| Trojan                               | Poses as a legitimate app and [cannot spread on its own](https://learn.microsoft.com/en-us/defender-endpoint/malware/trojans-malware); once run, it installs other malware, sends out passwords or hands over control                                                            | Downloads that use the names of real apps                                 |
| Ransomware                           | [Encrypts files](https://www.cisa.gov/stopransomware/ransomware-101) so they cannot be used, demands a ransom for the key, and often threatens to leak stolen data as well                                                                                                       | Often the last step, after other malware or stolen passwords open the way |
| Spyware and keyloggers               | Gathers information about you [without your knowledge](https://csrc.nist.gov/glossary/term/spyware); a keylogger [records what you type](https://attack.mitre.org/techniques/T1056/001/) to capture passwords                                                                    | Trojans and bundled software                                              |
| Adware and potentially unwanted apps | [Shows ads, inserts them into web pages or bundles other software](https://learn.microsoft.com/en-us/defender-endpoint/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus); not classed as malware, but it makes real infections more likely and harder to spot | Software bundlers and download sites                                      |
| Infostealer                          | Takes [saved passwords, session cookies, autofill data and cryptocurrency wallets](https://www.microsoft.com/en-us/security/blog/2025/05/21/lumma-stealer-breaking-down-the-delivery-techniques-and-capabilities-of-a-prolific-infostealer/) from browsers and apps              | Malvertising, cracked software, fake CAPTCHA pages, phishing              |
| Rootkit                              | Changes how the operating system reports on itself so malware stays hidden, [potentially for years](https://learn.microsoft.com/en-us/defender-endpoint/malware/rootkits-malware)                                                                                                | Built into other malware families                                         |
| Fileless malware                     | Runs in memory or through built-in tools such as [PowerShell and WMI](https://learn.microsoft.com/en-us/defender-endpoint/malware/fileless-threats), leaving little or nothing on disk                                                                                           | Pasted commands, exploits, malicious scripts                              |
| Cryptominer (coin miner)             | [Uses your processor](https://learn.microsoft.com/en-us/defender-endpoint/malware/coinminer-malware) to mine cryptocurrency for someone else                                                                                                                                     | Email attachments, exploit kits, scripts running on web pages             |

The type to understand first in 2026 is the infostealer. [Microsoft's Digital Defense Report 2025](https://go.microsoft.com/fwlink/?linkid=2338388), published in October 2025, calls the rapid rise of infostealers one of the most concerning trends of its reporting year (July 2024 to June 2025): families such as Lumma Stealer, RedLine, Vidar and Atomic Stealer are now used as the first stage of an attack, and the passwords and browser session tokens they collect are sold on to other criminals, including ransomware groups. In one two-month window, [between March 16 and May 16, 2025](https://blogs.microsoft.com/on-the-issues/2025/05/21/microsoft-leads-global-action-against-favored-cybercrime-tool/), Microsoft identified more than 394,000 Windows computers infected with Lumma alone. Keyloggers also come in hardware form, a small adapter between keyboard and computer, which our guide to [snooping attacks](https://computese.com/understanding-snooping-attacks-how-they-work/) covers.

## How malware gets onto a computer in 2026

The same [Digital Defense Report](https://go.microsoft.com/fwlink/?linkid=2338388) lists the initial access methods that Microsoft's Defender Experts service saw in its notifications over the year:

| Initial access method                            | Share of attacks |
| ------------------------------------------------ | ---------------- |
| ClickFix (pasting a command a web page supplies) | 47%              |
| Phishing                                         | 35%              |
| Password spray                                   | 10%              |
| Drive-by compromise and SEO poisoning            | 7%               |
| Exploiting a vulnerability                       | 1%               |

Two cautions before reading much into it. These are detections from a managed service that watches organizations, not every home PC, and password spraying targets accounts rather than computers. The lesson still carries over: the two largest routes, and most of the rest, need a person to paste, open or download something. When Microsoft's incident responders looked at confirmed breaches instead, [28% began with phishing or social engineering](https://www.microsoft.com/en-us/security/security-insider/threat-landscape/microsoft-digital-defense-report-2025), 18% with unpatched web-facing systems and 12% with exposed remote services.

### Fake CAPTCHA and "fix it" pages (ClickFix)

ClickFix is the technique behind that 47%. A web page shows something familiar, such as a CAPTCHA check, a browser crash page or a message about a missing Word extension, and offers a way through. Clicking the button quietly copies a command to your clipboard, and the page tells you to press the Windows key and R, paste and press Enter, or to paste into Windows Terminal or PowerShell. [Microsoft Threat Intelligence](https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/) reported in August 2025 that these campaigns target thousands of enterprise and end-user devices every day, that recent lures imitate Google reCAPTCHA and Cloudflare Turnstile, and that most attack paths end in PowerShell or HTA scripts. The Digital Defense Report adds that these commands pull their payload straight into memory, a fileless process that traditional security tools often miss. MITRE ATT&CK tracks the technique as [Malicious Copy and Paste (T1204.004)](https://attack.mitre.org/techniques/T1204/004/).

![A browser shows a fake verification box. An orange clipboard carries a hidden command from the page into a command window on a laptop, which then pulls a package down from the internet.](https://computese.com/images/blog/how-to-protect-your-computer-from-malware-in-2024/clickfix.72b4a65280-1536.webp)

*The page downloads nothing: you carry the command across yourself, which is how ClickFix gets past defences that watch downloads.*

It is not limited to one gang or one operating system. [CISA and the FBI](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-203a) describe Interlock ransomware actors using fake CAPTCHAs this way, and name Lumma Stealer and DarkGate as other malware delivered through ClickFix. In a June 2025 campaign that Microsoft analyzed, the command copied for Mac users asked repeatedly for the account password, then used it to strip the downloaded file's quarantine attribute and bypass macOS security before launching Atomic macOS Stealer (AMOS).

### Phishing links and attachments

Phishing is the second route: an email or message that impersonates a brand or a colleague, usually with urgency, and leads to a link or an attachment. Microsoft describes Lumma campaigns built around fake hotel reservation confirmations and cancellations, and [CISA's advisory on LummaC2](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141b) (May 21, 2025) lists spearphishing links and attachments as a frequent way in, alongside fake CAPTCHAs. Office documents with macros used to be the classic attachment; Office for Windows now blocks macros in files from the internet by default, as described in the Windows section below.

### Malvertising, search poisoning and fake downloads

Searching for software is itself a risk. Criminals buy search ads that point to a copy of a real vendor's site, and the [FBI warned in December 2022](https://www.ic3.gov/PSA/2022/PSA221221) that these ads appear at the very top of results with minimal distinction from genuine ones. Microsoft saw ads on queries such as "Notepad++ download" and "Chrome update" lead to cloned vendor sites that delivered Lumma Stealer. In [December 2024 it detected a malvertising campaign](https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/) that started on illegal streaming sites, redirected visitors to payloads hosted on GitHub, and affected nearly one million devices. SEO poisoning is the same trick played through ordinary search results, and the Digital Defense Report names both as common delivery routes for infostealers.

![A search results page whose top sponsored result leads to an orange lookalike download site, while a result lower in the list leads to the real vendor's site.](https://computese.com/images/blog/how-to-protect-your-computer-from-malware-in-2024/malvertising.f122456250-1536.webp)

*The ad sits above the real result and the copy looks identical; typing the vendor's address skips the question entirely.*

### Cracked software and fake updates

Pirated software is a delivery channel, not a bargain. Microsoft found cracked and pirated versions of legitimate applications bundled with Lumma and shared on file-sharing platforms; the modified installers show nothing unusual and run the malware after launch. Fake updates work the same way. The Interlock advisory describes drive-by downloads from compromised legitimate websites, and payloads disguised as Google Chrome or Microsoft Edge browser updates or, more recently, as updates for common security software.

### USB drives and other removable media

Removable media is an old route that has not gone away. [MITRE ATT&CK](https://attack.mitre.org/techniques/T1091/) documents malware copied to USB drives that relies on AutoRun or on a file renamed to look legitimate, and notes that a phone plugged in over USB can appear as a drive too. Microsoft lists removable drives among the ways worms spread. The FTC's advice is to scan USB thumb drives and external drives with security software before using them.

### Unpatched software

An unpatched browser, operating system or plug-in lets malware in without any download prompt. An exploit uses the flaw to get past the system's safeguards, and exploit kits on compromised pages, or in ads on legitimate ones, probe each visitor for several flaws at once ([Microsoft](https://learn.microsoft.com/en-us/defender-endpoint/malware/exploits-malware)). Exploits were only 1% of the initial access in Microsoft's notifications, but they need no mistake from you, which is why updates come first in both lists below.

## Protect a Windows PC, layer by layer

Windows 11 includes most of what a home PC needs. The work is making sure each layer is on and stays on. If you are setting up a new computer, our [Windows 11 setup guide](https://computese.com/how-to-set-up-windows-for-a-new-computer/) covers these settings at first start.

| Layer                          | What it stops                                           | Where to check it                            |
| ------------------------------ | ------------------------------------------------------- | -------------------------------------------- |
| Windows Update and app updates | Exploits of known flaws                                 | Settings > Windows Update                    |
| Microsoft Defender Antivirus   | Known and suspicious files as you open or download them | Windows Security > Virus & threat protection |
| Microsoft Defender SmartScreen | Reported phishing and malware sites, unknown downloads  | Windows Security > App & browser control     |
| Smart App Control              | Untrusted and unsigned apps                             | Windows Security > App & browser control     |
| A standard account             | Malware running with administrator rights               | Settings > Accounts > Other users            |
| Office macro blocking          | Macros in documents from the internet                   | On by default; leave the warning alone       |

### 1. Keep Windows and your apps updated

Security updates close the flaws that exploits use. Windows 10 [reached end of support on October 14, 2025](https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/windows-10-support-has-ended-on-october-14-2025), and Microsoft warns that a PC without security updates is at greater risk from viruses and malware; consumer Extended Security Updates can cover a Windows 10 PC until October 12, 2027, as a bridge to Windows 11. Turn on automatic updates for Windows, your browser and every other app. Our guide to [updating your computer or phone](https://computese.com/how-to-update-your-computer-or-phone/) covers Windows, macOS and Linux.

### 2. Leave Microsoft Defender Antivirus on

The [Windows Security app](https://support.microsoft.com/en-us/windows/security/windows-security/stay-protected-with-the-windows-security-app) brings together Microsoft Defender Antivirus, Windows Firewall and Smart App Control. With real-time protection on, Defender scans files as you open and download them; if it is off, they are not scanned. Two further settings are worth switching on:

- **Controlled folder access**, Defender's ransomware protection, lets only trusted apps change files in protected folders. It is [off by default](https://learn.microsoft.com/en-us/defender-endpoint/controlled-folder-access-overview); turn it on under Virus & threat protection > Ransomware protection.
- **Memory integrity**, under Device security > Core isolation, uses hardware virtualization to make it [harder for malicious programs to hijack the PC through low-level drivers](https://support.microsoft.com/en-us/windows/security/windows-security/device-security-in-the-windows-security-app). It needs virtualization enabled in the PC's firmware.

### 3. Keep SmartScreen on

[Microsoft Defender SmartScreen](https://learn.microsoft.com/en-us/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/) checks the sites you visit against a list of reported phishing and malware sites, and checks what you download against files known to be unsafe and files that are well known and frequently downloaded. A new installer it has never seen triggers a warning. For a "Notepad++" installer from a cloned site, that warning may be the only signal you get, so treat it as a stop sign rather than a formality.

### 4. Turn on Smart App Control

[Smart App Control](https://support.microsoft.com/en-us/windows/security/threat-malware-protection/smart-app-control-frequently-asked-questions) on Windows 11 checks every app you try to run. If Microsoft's cloud security service predicts the app is safe, it runs; if the service believes it is malicious or potentially unwanted, it is blocked; if the service cannot decide, the app runs only when it has a valid signature. There is no exception for individual apps, so an unsigned tool you rely on means switching the feature off. You will find it under [App & browser control > Smart App Control settings](https://support.microsoft.com/en-us/windows/security/windows-security/app-browser-control-in-the-windows-security-app); it is not available on Windows 10. Smart App Control used to be available only on a fresh installation of Windows 11, and some Microsoft pages still say so, but the FAQ, revised in August 2026, says recent Windows updates let you turn it on without a clean install.

### 5. Use a standard account for everyday work

An administrator can change settings, install software and access every file, and malware that runs in an administrator's session starts with the same power. Microsoft's [guidance on user accounts](https://support.microsoft.com/en-us/windows/security/identity-signin/manage-user-accounts-in-windows) says it is safer to have fewer administrators and to use standard accounts for day-to-day activities. The switch takes a few minutes:

1. Create a second account and make it an administrator: **Settings > Accounts > Other users**, add the account, then **Change account type** to Administrator.
2. Sign in with the new administrator account, open the same page and change your everyday account's type to **Standard User**.
3. Use the everyday account for mail, browsing and work. When something needs administrator rights, [User Account Control](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/user-account-control/) stops and asks first, instead of letting the change happen silently.

### 6. Leave Office's macro block in place

VBA macros in Office files were for years a common way to deliver malware and ransomware, so Microsoft changed the default: Office on Windows [blocks macros in files from the internet](https://learn.microsoft.com/en-us/microsoft-365-apps/security/internet-macros-blocked), such as email attachments, in Access, Excel, PowerPoint, Project, Publisher, Visio and Word. The change started rolling out to Current Channel with version 2206 on July 27, 2022. Office recognizes such files by their Mark of the Web, which Windows adds to browser downloads and email attachments. If an unexpected document tells you to unblock it in its file properties so the "content" can load, delete it instead.

## Protect a Mac: updates, Gatekeeper and XProtect

Macs get malware too. Atomic, a macOS infostealer, accounted for 21% of the infostealer notifications in the Digital Defense Report's top five, second only to Lumma at 51%, and ClickFix pages now serve Terminal commands to Mac visitors. [Apple's platform security guide](https://support.apple.com/guide/security/protecting-against-malware-sec469d47bd8/web) describes three layers of defence built into macOS:

1. **Prevent launch.** Apps come from the App Store or, if from elsewhere, must pass Gatekeeper and notarization. [Notarization](https://support.apple.com/en-us/102445) means the developer submitted the app to Apple, which scanned it for known malware; Gatekeeper checks the Developer ID signature and the notarization, and asks for your approval before downloaded software opens for the first time.
2. **Block.** XProtect, the antivirus built into macOS, uses signatures Apple updates automatically and separately from system updates; by default the Mac checks for them daily. Apple can also revoke the notarization of an app later found to be malicious, and Gatekeeper then blocks it.
3. **Remediate.** XProtect includes an engine that removes malware that has already run, using updates Apple delivers automatically, and keeps checking for infections periodically.

Your part is small but it matters:

- **Keep macOS updated** in **System Settings > General > Software Update**, and use its settings to download and install updates automatically ([Apple](https://support.apple.com/en-us/108382)).
- **Do not override Gatekeeper for software you are unsure of.** Since macOS Sequoia, you [can no longer Control-click to open](https://developer.apple.com/news/?id=saqachfa) software that is not signed correctly or notarized; you have to allow it in **System Settings > Privacy & Security**. A download page that walks you through that screen, or tells you to paste a command into Terminal, is the attack.
- **Use a standard account day to day.** The first account created on a Mac is an administrator, which [can install apps, change settings and manage other users](https://support.apple.com/guide/mac-help/change-users-groups-settings-mtusr001/mac). Create a separate administrator for changes and a standard account for daily use.

## Download and browse safely

Most of the routes above end with you running something. These habits remove most of them:

1. **Get apps from the store first.** Microsoft advises downloading software [only from official websites or the Microsoft Store](https://learn.microsoft.com/en-us/defender-endpoint/malware/unwanted-software); Apple calls the App Store the safest place to get Mac apps.
2. **Type the vendor's address instead of clicking a search ad.** Both the FBI and the FTC give this advice; bookmark the download pages of software you update by hand.
3. **Never install cracked or pirated software**, key generators or "free" copies of paid apps. They are a standard infostealer carrier.
4. **Update your browser from its own settings or menu**, never from a web page that says you need an update.
5. **Read installers before clicking Next.** Bundled offers are how adware and potentially unwanted apps arrive; decline them, and keep reputation-based protection on in App & browser control, which also covers potentially unwanted apps.
6. **Scan USB drives** and external disks before opening files on them, and do not plug in drives you found.
7. **Never call a number shown in a pop-up.** The FTC notes that fake security warnings lead to scammers who ask for remote access, run a fake diagnostic test and charge you to fix a problem that does not exist.

> [!WARNING]
> No real CAPTCHA, browser update or support page needs you to open the Run dialog, PowerShell or Terminal and paste something. If a page asks you to, close the tab. If you already pressed Enter, treat the computer as infected and follow the steps below.

## Signs your computer has malware

Even with security software running, the FTC warns, malware can go undetected for a while. These symptoms, drawn from the FTC's list and the UK National Cyber Security Centre's [guidance on infected devices](https://www.ncsc.gov.uk/guidance/hacked-device-action-to-take), are worth a scan:

| Sign                                                                            | What it can mean                                      |
| ------------------------------------------------------------------------------- | ----------------------------------------------------- |
| The computer slows down, freezes, crashes or restarts by itself                 | Malware using resources, or a cryptominer             |
| The browser's home page changes or redirects you to sites you did not choose    | Adware or a browser hijacker                          |
| New toolbars, add-ons or programs you did not install, which are hard to remove | Unwanted software or a trojan's companions            |
| Pop-up ads everywhere, including on sites that never show them                  | Adware                                                |
| Task Manager or Activity Monitor will not open                                  | Malware protecting itself from being found            |
| Contacts receive messages from you that you did not send                        | An account taken over, possibly with stolen passwords |
| Programs open or close on their own                                             | Remote control by a trojan                            |

The absence of symptoms proves little. [CISA](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141b) notes that LummaC2 can send off credentials, wallets and MFA details without immediate detection, and a rootkit exists to make the system lie about what is running. If you ran something suspicious, or pasted a command, act on that alone.

## What to do if your computer is infected

Work through these in order. The first two steps contain the damage; the rest undo it.

1. **Disconnect it.** Turn off Wi-Fi and unplug the network cable. CISA's [#StopRansomware Guide](https://www.cisa.gov/stopransomware/ransomware-guide) advises isolating affected devices this way, and powering them down only if you cannot disconnect them. Until the computer is clean, stop signing in to email, banking or shopping sites on it, as the FTC advises.
2. **Scan it.** On Windows, update Microsoft Defender Antivirus, then run an offline scan: **Windows Security > Virus & threat protection > Scan options > Microsoft Defender Antivirus (offline scan) > Scan now**. The PC [restarts and scans without loading Windows](https://support.microsoft.com/en-us/windows/security/threat-malware-protection/virus-and-threat-protection-in-the-windows-security-app), so persistent malware has a harder time hiding, and the results appear afterwards under **Protection history**. On a Mac, XProtect removes known malware using updates Apple delivers automatically, so install the latest macOS updates, restart, and delete any app you did not install.
3. **Change your passwords from a clean device**, such as your phone or another computer, starting with your email account, then banking, then every password the infected computer's browsers had saved.
4. **Sign out every session and check your mail rules**, as described below.
5. **Restore your files from a backup.** The NCSC advises restoring from the last backup you know was good, rather than copying files off the infected device and carrying the infection with them. Our guide to [recovering deleted files on Windows](https://computese.com/how-to-recover-deleted-files-on-windows/) covers File History, OneDrive and Windows Backup.
6. **Reset or reinstall the operating system when you cannot trust the computer** (details below).

### Run a Microsoft Defender Offline scan

The offline scan is worth the restart. Microsoft says it [takes about 15 minutes](https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-offline) and runs from outside the normal Windows kernel, so it can reach malware that hides from Windows, such as rootkits that overwrite the master boot record. It needs the Windows Recovery Environment (WinRE) to be enabled; if WinRE is off, the scan does not run and no error appears. Check its status from a terminal opened as administrator:

```powershell
reagentc /info
```

### Why a new password is not enough

Two things on an infected computer outlive a password change. A keylogger captures whatever you type next, including the new password, which is why you change passwords from another device. And an infostealer takes session cookies as well as saved passwords. A session cookie is the token a site keeps in your browser after you sign in, and a stolen one lets someone use the site [as you, without your password](https://attack.mitre.org/techniques/T1539/), which can get around some multi-factor authentication. After changing a password, the NCSC advises [logging out every device and app](https://www.ncsc.gov.uk/guidance/recovering-a-hacked-account) still signed in to the account, checking your email for forwarding rules you did not create, and turning on two-step verification. Our guide to [staying safe online](https://computese.com/cyber-it-security/) covers passkeys and password managers, which make the next incident smaller.

![Malware on a laptop sends a key, a wallet and an orange session cookie to an attacker's server, which uses the cookie to enter a website without passing its padlocked sign-in gate.](https://computese.com/images/blog/how-to-protect-your-computer-from-malware-in-2024/cookie.90331e8a22-1536.webp)

*A stolen session cookie is a sign-in that already happened, so signing out every session matters as much as a new password.*

### When to reset or reinstall

Reset or reinstall if the scan cannot remove the malware, if it keeps coming back, if a rootkit was found, if ransomware ran, or if you pasted a command and cannot say what it did. After a rootkit, Microsoft says, you cannot trust anything the device reports about itself.

On Windows, [Recovery options](https://support.microsoft.com/en-us/windows/experience/backup-recovery/recovery-options-in-windows) offers **Reset this PC**, which reinstalls Windows and lets you remove everything; for a suspected infection, Microsoft points to reinstalling from installation media created on another working PC, which removes everything from the device. On a Mac, use [Erase All Content and Settings](https://support.apple.com/en-us/102664) in **System Settings > General > Transfer or Reset**, which erases your data, settings and apps. Reinstalling macOS from Recovery on its own [does not remove apps or personal data](https://support.apple.com/en-us/102655), so it is not a cleanup. Afterwards, reinstall apps from their official sources and restore your files from the backup. Microsoft notes one limit: malicious code hidden in firmware can survive an operating system reinstall, though it describes such malware as requiring a high level of sophistication.

> [!IMPORTANT]
> If ransomware encrypted your files, CISA and the FBI do not encourage paying: payment does not guarantee the files will be recovered, and it can embolden attackers and fund other crime. The recovery plan is a backup that was not connected when the attack ran, because, as the #StopRansomware Guide warns, many ransomware variants look for reachable backups and delete or encrypt them. In the US, report the attack to the FTC at ReportFraud.ftc.gov.

## Protecting the computers in a small business

Everything above applies to a business, with two differences: someone has to confirm that every layer stays on across every device, and one infected laptop can expose shared mailboxes, files and customer data. That calls for [central device management](https://computese.com/how-to-manage-cybersecurity-on-your-devices/), endpoint detection and response (EDR) instead of antivirus alerts that only the person at the keyboard sees, patching on a schedule, and no local administrator rights for daily users. Our [small business cybersecurity checklist](https://computese.com/cybersecurity-best-practices/) puts those controls in priority order.

Our [IT support service](https://computese.com/services/it-support/) covers endpoint security for small teams: EDR such as Microsoft Defender for Business, patching for operating systems and apps, and removing local admin rights, alongside device management. The websites and servers a business exposes to the internet need a different check, which our [security scanning](https://computese.com/services/security-testing/) service runs on a schedule, ranking what it finds with, among other signals, [CISA's catalogue of known exploited vulnerabilities](https://www.cisa.gov/known-exploited-vulnerabilities-catalog). More guides on the subject are under [security](https://computese.com/category/security/).

## Key terms
- **Malware**: Software, firmware or hardware deliberately placed on a system for a harmful purpose: viruses, worms, trojans, ransomware, spyware, infostealers, rootkits, cryptominers and more.
- **Trojan**: Malware disguised as a legitimate app. It cannot spread on its own, so it needs you to download and run it; it then installs other malware, sends out passwords or hands an attacker control.
- **Infostealer**: Malware that collects saved browser passwords, session cookies, autofill data and cryptocurrency wallets and sends them to the attacker. Lumma, RedLine, Vidar and Atomic are examples.
- **ClickFix**: A social engineering technique in which a web page, often a fake CAPTCHA or error message, copies a malicious command to your clipboard and tells you to paste it into the Run dialog, PowerShell or Terminal.
- **Rootkit**: Malware that intercepts and changes how the operating system reports on itself, so that it and other malware stay hidden. A device with a rootkit cannot be trusted to describe its own state.
- **Fileless malware**: Malicious code that runs in memory or through built-in tools such as PowerShell and WMI, writing little or nothing to disk, which makes it harder for file scanning to find.
- **Potentially unwanted app (PUA)**: Software that is not classed as malware but shows ads, bundles other programs or slows the computer. Adware is one kind, and PUAs make real infections more likely.
- **Session cookie**: The token a website stores in your browser after you sign in so you stay signed in. Stolen, it lets someone use the session without your password, and can get around some multi-factor authentication.
- **Smart App Control**: A Windows 11 feature that lets an app run only if Microsoft's cloud service predicts it is safe or, when the service cannot decide, the app carries a valid signature. Unsigned unknown apps are blocked.
- **Gatekeeper and notarization**: macOS checks that software from outside the App Store is signed by an identified developer and notarized, meaning Apple scanned it for known malware, and asks for your approval before it first opens.

## Common questions

### What are the main types of malware?

Viruses and worms, which spread; trojans, which pose as legitimate apps; ransomware, which encrypts files for a ransom; spyware and keyloggers; adware and potentially unwanted apps; infostealers, which take passwords and session cookies; rootkits, which hide other malware; fileless malware; and cryptominers. Microsoft's 2025 report singles out the rapid rise of infostealers.

### How can I tell if my computer has malware?

Common signs are a computer that slows down, freezes or restarts by itself, a browser home page that changes or redirects, new toolbars or add-ons, pop-up ads on sites that never show them, disabled Task Manager or Activity Monitor, and messages sent from your accounts that you did not write. Some infections show no sign at all, so run a scan whenever you have opened, downloaded or pasted something suspicious.

### Can Macs get malware?

Yes. Atomic, a macOS infostealer, accounted for 21% of the infostealer notifications in Microsoft's Digital Defense Report 2025, and ClickFix pages have targeted Mac users with Terminal commands. macOS blocks most of it with Gatekeeper, notarization and XProtect, as long as you keep macOS updated, do not override Gatekeeper for software you are unsure of and never paste commands from a web page.

### Is it safe to paste a command a website tells me to run?

No. That is how ClickFix works: a fake CAPTCHA, error or update page copies a command to your clipboard and asks you to paste it into the Run dialog, PowerShell or Terminal, which installs malware. If you already did it, disconnect the computer, scan it and change your passwords from another device.

### How do I remove malware from my computer?

Disconnect it from the network, update your security software and run a full scan; on Windows, also run a Microsoft Defender Offline scan, which checks the PC before Windows loads. Then change your passwords from a clean device. If the malware keeps coming back, or you cannot trust the computer, reset or reinstall the operating system and restore your files from a backup.

### Should I pay if ransomware encrypts my files?

CISA and the FBI do not encourage paying, because payment does not guarantee your files will be recovered and can encourage further attacks. Restore from a backup that was disconnected when the attack happened, and report the attack; in the US, the FTC takes reports at ReportFraud.ftc.gov.

## Sources
1. [Glossary: malware](https://csrc.nist.gov/glossary/term/malware), NIST Computer Security Resource Center
2. [Malware: How To Protect Against, Detect, and Remove It](https://consumer.ftc.gov/articles/malware-how-protect-against-detect-and-remove-it), U.S. Federal Trade Commission
3. [Glossary: virus](https://csrc.nist.gov/glossary/term/virus), NIST Computer Security Resource Center
4. [Worms](https://learn.microsoft.com/en-us/defender-endpoint/malware/worms-malware), Microsoft Learn
5. [Trojan malware](https://learn.microsoft.com/en-us/defender-endpoint/malware/trojans-malware), Microsoft Learn
6. [Ransomware 101](https://www.cisa.gov/stopransomware/ransomware-101), CISA
7. [Glossary: spyware](https://csrc.nist.gov/glossary/term/spyware), NIST Computer Security Resource Center
8. [Input Capture: Keylogging (T1056.001)](https://attack.mitre.org/techniques/T1056/001/), MITRE ATT&CK
9. [Detect and block potentially unwanted applications](https://learn.microsoft.com/en-us/defender-endpoint/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus), Microsoft Learn
10. [Lumma Stealer: Breaking down the delivery techniques and capabilities of a prolific infostealer](https://www.microsoft.com/en-us/security/blog/2025/05/21/lumma-stealer-breaking-down-the-delivery-techniques-and-capabilities-of-a-prolific-infostealer/), Microsoft Threat Intelligence
11. [Rootkits](https://learn.microsoft.com/en-us/defender-endpoint/malware/rootkits-malware), Microsoft Learn
12. [Fileless threats](https://learn.microsoft.com/en-us/defender-endpoint/malware/fileless-threats), Microsoft Learn
13. [Coin miners](https://learn.microsoft.com/en-us/defender-endpoint/malware/coinminer-malware), Microsoft Learn
14. [Microsoft Digital Defense Report 2025](https://www.microsoft.com/en-us/security/security-insider/threat-landscape/microsoft-digital-defense-report-2025), Microsoft
15. [Microsoft Digital Defense Report 2025 (full report, PDF)](https://go.microsoft.com/fwlink/?linkid=2338388), Microsoft
16. [Microsoft leads global action against favored cybercrime tool](https://blogs.microsoft.com/on-the-issues/2025/05/21/microsoft-leads-global-action-against-favored-cybercrime-tool/), Microsoft On the Issues
17. [Think before you Click(Fix): Analyzing the ClickFix social engineering technique](https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/), Microsoft Threat Intelligence
18. [User Execution: Malicious Copy and Paste (T1204.004)](https://attack.mitre.org/techniques/T1204/004/), MITRE ATT&CK
19. [#StopRansomware: Interlock (AA25-203A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-203a), CISA and FBI
20. [Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations (AA25-141B)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141b), CISA and FBI
21. [Cyber Criminals Impersonating Brands Using Search Engine Advertisement Services to Defraud Users](https://www.ic3.gov/PSA/2022/PSA221221), FBI Internet Crime Complaint Center
22. [Malvertising campaign leads to info stealers hosted on GitHub](https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/), Microsoft Threat Intelligence
23. [Replication Through Removable Media (T1091)](https://attack.mitre.org/techniques/T1091/), MITRE ATT&CK
24. [Exploits and exploit kits](https://learn.microsoft.com/en-us/defender-endpoint/malware/exploits-malware), Microsoft Learn
25. [Windows 10 support has ended on October 14, 2025](https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/windows-10-support-has-ended-on-october-14-2025), Microsoft Support
26. [Stay protected with the Windows Security app](https://support.microsoft.com/en-us/windows/security/windows-security/stay-protected-with-the-windows-security-app), Microsoft Support
27. [Protect folders from ransomware with controlled folder access](https://learn.microsoft.com/en-us/defender-endpoint/controlled-folder-access-overview), Microsoft Learn
28. [Device security in the Windows Security app](https://support.microsoft.com/en-us/windows/security/windows-security/device-security-in-the-windows-security-app), Microsoft Support
29. [Microsoft Defender SmartScreen overview](https://learn.microsoft.com/en-us/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/), Microsoft Learn
30. [Smart App Control frequently asked questions](https://support.microsoft.com/en-us/windows/security/threat-malware-protection/smart-app-control-frequently-asked-questions), Microsoft Support
31. [App & browser control in the Windows Security app](https://support.microsoft.com/en-us/windows/security/windows-security/app-browser-control-in-the-windows-security-app), Microsoft Support
32. [Manage user accounts in Windows](https://support.microsoft.com/en-us/windows/security/identity-signin/manage-user-accounts-in-windows), Microsoft Support
33. [User Account Control](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/user-account-control/), Microsoft Learn
34. [Macros from the internet are blocked by default in Office](https://learn.microsoft.com/en-us/microsoft-365-apps/security/internet-macros-blocked), Microsoft Learn
35. [Protecting against malware in macOS](https://support.apple.com/guide/security/protecting-against-malware-sec469d47bd8/web), Apple Platform Security
36. [Safely open apps on your Mac](https://support.apple.com/en-us/102445), Apple Support
37. [Updates to runtime protection in macOS Sequoia](https://developer.apple.com/news/?id=saqachfa), Apple Developer
38. [Update macOS on Mac](https://support.apple.com/en-us/108382), Apple Support
39. [Change Users & Groups settings on Mac](https://support.apple.com/guide/mac-help/change-users-groups-settings-mtusr001/mac), Apple Support
40. [Unwanted software](https://learn.microsoft.com/en-us/defender-endpoint/malware/unwanted-software), Microsoft Learn
41. [How to recover an infected device](https://www.ncsc.gov.uk/guidance/hacked-device-action-to-take), UK National Cyber Security Centre
42. [#StopRansomware Guide](https://www.cisa.gov/stopransomware/ransomware-guide), CISA
43. [Virus and threat protection in the Windows Security app](https://support.microsoft.com/en-us/windows/security/threat-malware-protection/virus-and-threat-protection-in-the-windows-security-app), Microsoft Support
44. [Microsoft Defender Offline scan in Windows](https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-offline), Microsoft Learn
45. [Steal Web Session Cookie (T1539)](https://attack.mitre.org/techniques/T1539/), MITRE ATT&CK
46. [Recovering a hacked account](https://www.ncsc.gov.uk/guidance/recovering-a-hacked-account), UK National Cyber Security Centre
47. [Recovery options in Windows](https://support.microsoft.com/en-us/windows/experience/backup-recovery/recovery-options-in-windows), Microsoft Support
48. [Erase your Mac and reset it to factory settings](https://support.apple.com/en-us/102664), Apple Support
49. [How to reinstall macOS](https://support.apple.com/en-us/102655), Apple Support
50. [Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog), CISA