Believe in software 2 0

Prevent and remove viruses and other malware

What is a computer virus?

A computer virus is a small software program that spreads from one computer to the next and disrupts computer operations. A computer virus can damage or delete data on one computer, use an e-mail program to spread the virus to other computers, or even delete everything on the disk.

Computer viruses are often spread through email attachments or chat messages. Therefore, you should never open an email attachment unless you know who sent the message or you are not expecting the email attachment. Viruses can be disguised as attachments to funny pictures, greeting cards, or audio and video files. Computer viruses are also spread through downloads on the Internet. They can be hidden in pirated software or in other files or programs that you may download.

Symptoms of a computer virus

For information about symptoms of a computer virus, go to
Microsoft PC Security website.

What is a worm?

A worm is computer code that is spread without user interaction. Most worms start out as email attachments that infect a computer when opened. The worm scans the infected computer for files, such as address books or temporary web pages, that contain e-mail addresses. The worm uses the addresses to send infected e-mails and often impersonates (or spoofs) the sender addresses in later e-mails. This way, the infected messages will look like they came from someone you know. The worms are then automatically spread via email, networks, or operating system security risks and often overwhelm these systems before the cause is known. Worms are not always destructive to computers. However, they usually cause problems with the performance and stability of computers and networks.

What is a trojan?

A Trojan is a malware program that is contained in other programs. It reaches the computer via a permitted program, for example a screen saver. It then places code on the operating system that enables a hacker to gain access to the infected computer. Trojans are usually not self-propagating. They are spread by viruses, worms, or downloaded software.

What is spyware?

Spyware can be installed on your computer without you noticing. These programs can change the configuration of your computer or collect data for advertising purposes and personal information. Spyware can track internet browsing habits and also redirect your web browser to another website that you did not want to open.

What is unauthorized security software?

An unauthorized security software program is trying to trick you into believing that a virus has infected your computer. You will usually be asked to download or purchase a product that will remove the virus. The names of these products often include words such as antivirus, shield, security, protection, or fixer. This makes them sound legitimate. They often run after you've downloaded them or the next time you start your computer. Unauthorized security software can prevent applications such as Internet Explorer from opening. Unauthorized security software may also indicate that legitimate and critical Windows files are infected. Typical error messages or pop-up messages include the following phrases:

Your computer is infected!
This computer is infected with spyware or adware.

Note: If you see a message in a pop-up dialog box similar to this warning, you should press ALT + F4 on your keyboard to close the dialog box. Do not click in the dialog box. If a warning like this continues to appear when you try to close the dialog box, it strongly suggests that the message is malicious.

Are you sure you want to leave this page?
Your computer is infected! They can lead to data loss and file corruption and must be dealt with as soon as possible. Press "CANCEL" to prevent this. Return to System Security and download the solution to secure your PC.
Click OK to continue or Cancel to stay on the current page.

If you see such a message, do not download or purchase the software.

What is malware?

The term malware is used to refer to malicious software designed to cause damage or undesired actions to a computer system. Examples of malware include:

  • Viruses

  • worms

  • Trojans

  • Spyware

  • Unauthorized security software

Remove malware such as viruses, spyware, or unauthorized security software

Removing a computer virus or spyware can be difficult without the assistance of malicious software removal tools. Some computer viruses and other unwanted software reinstall themselves after viruses and spyware are detected and removed. Fortunately, updating your computer and using malicious software removal tools can help you permanently remove unwanted software.

For more information about how to remove a computer virus and spyware, see the following article in the Microsoft Knowledge Base:

2671662: Microsoft Resources and How to Remove Malicious Software and Viruses Note: If you cannot access the Internet on your computer, try another computer to follow the steps in the section on resetting your Internet Explorer proxy settings on the computer that may be infected.

To remove a computer virus and other malware, follow these steps in order.

Install the latest updates through Microsoft Update

Note: A computer virus may prevent you from accessing the Microsoft Update website to install the latest updates. You should set the Automatic Updates service to run automatically so that you don't miss any critical updates on your computer. For more information, see the following Microsoft Knowledge Base article:

306525: How to configure and use the Automatic Updates feature in Windows

  1. Click Start, and then type Windows Update in the search box.

  2. In the results pane, click Windows Update.

  3. Click Check for Updates.

  4. Follow the instructions to download and install the latest Windows updates.

Using Microsoft Safety Scanner (Free)

Microsoft provides a free online tool that scans for potential threats and removes them from your computer. To run the scan, go to the Microsoft Safety Scanner website.

Use the Windows Malicious Software Removal Tool

For more information about the Microsoft Malicious Software Removal Tool, see the following article in the Microsoft Knowledge Base:

890830: Remove malware using Windows Malicious Software Removal Tool
Manually remove the unauthorized security software

If the Microsoft Safety Scanner or Windows Malicious Software Removal Tool cannot find or remove the malicious security software, follow these steps:

  1. Make a note of the name of the unauthorized security software. In this example it is called XP Security Agent 2010.

  2. Restart your computer.

  3. Press the F8 key repeatedly when the computer manufacturer's logo appears.

  4. Use the arrow keys to highlight Safe Mode with Networking and press ENTER when prompted.

  5. Click the Start button and see if you can see the malicious security software in the Start menu. If it isn't listed here, click All Programs and scroll to the name of the rogue security software.

  6. Right-click the name of the rogue security software program, and then click Properties.

  7. Click the Link tab.

  8. In the Properties dialog box, check the path of the rogue security software program listed under Destination. For example C: \ Program Files \ XP Security Agent 2010.

    Note: The folder name is often a random number.

  9. Click Open File Path.

  10. In the Program Files window, click Program Files on the address bar.

  11. Scroll until you see the folder containing the rogue security software program. For example XP Security Agent 2010.

  12. Right-click the folder, and then click Delete.

  13. Restart your computer.

  14. Go to the Microsoft Safety Scanner website.

  15. Click the Download Now button and then click Run.

  16. Follow the instructions to scan your computer and remove any unauthorized security software.

If you suspect that your computer has been infected by unauthorized security software that has not been identified using Microsoft security solutions, you can use the Microsoft Malware Protection Center to submit samples.

For more information about malicious security software, visit the Beware of False Virus Alerts website.

Install and run Microsoft Security Essentials or Windows Defender

Microsoft offers a free malware removal program called Microsoft Security Essentials that helps protect your computer from infection. To install Microsoft Security Essentials:

  1. Go to the Microsoft Security Essentials website.

  2. Click Download for Free.

  3. Click Run, and then follow the instructions to install Microsoft Security Essentials.

  4. After the installation, restart your computer.

  5. Click Start, All Programs, and then Microsoft Security Essentials.

  6. On the Home tab, select Full Scan, and then click Scan Now.

Install Windows Defender Offline

Windows Defender Offline is an anti-malware tool that removes hard-to-clean viruses that start before Windows starts. To use Windows Defender Offline:

  1. On an uninfected computer, go to the What is Windows Defender Offline website.

  2. Depending on your operating system, click on Download the 32-bit version or download to 64-bit version. Go to the website My PC is running 32-bit or 64-bit Windows if you're not sure which operating system you're running.

  3. Click Save As when prompted, and then save the file to a DVD, CD, or USB flash drive.

  4. Insert the DVD, CD, or USB memory stick on the infected computer, and then restart the computer.

  5. When prompted, press a key to select an option to start your computer, such as F12, F5, or F8, depending on the computer you are using.

  6. Use the arrow keys to scroll to the drive where you installed the Windows Defender Offline file. Windows Defender Offline will start and immediately check for malware.

For more information about how to remove a computer virus, see the Removing a computer virus website.

Protect your computer from malware

You can take steps to protect your computer from malware.

Activate the firewall

  1. Click the Start button and then click Control Panel.

  2. In the Search box, enter firewall, and then click Windows Firewall.

  3. In the left pane, click Turn Windows Firewall on or off (you may be asked for your administrator password).

  4. Under each network location, click Active (Recommended) (Windows Vista) or Turn on Windows Firewall (Windows 7), then click OK.

Go to the Enable or Disable Windows 7 Firewall website for more information on how to enable your firewall in Windows 7.

Keep your computer up to date

For more information about how to set automatic updates in Windows, see the following article in the Microsoft Knowledge Base:

306525: How to configure and use the Automatic Updates feature in Windows
Install and keep up-to-date with Microsoft Security Essentials

For more information about installing and using Microsoft Security Essentials, see the Microsoft Security Essentials website.

Preventing malware downloads

Here are a few tips to help you protect yourself from downloading unwanted software:

  • Download programs only from websites that you trust. If you are not sure whether you can trust a program that you want to download, it is a good idea to use your favorite search engine to see if anyone has reported it contains spyware.

  • Read all security warnings, license agreements, and privacy notices associated with the software you are downloading.

  • Never click Agree or OK to close a window that is suspected of being spyware. Instead, click the red “x” in the corner of the window or press ALT + F4 on your keyboard to close a window.

  • Be wary of popular "free" music and movie file-sharing programs, and make sure you can understand all of the software that came with those programs.

  • Use a standard user account instead of an administrator account. For more information, see the Why Use a Standard Account Instead of an Administrator Account Web site.

For more information about how to protect your computer from viruses, see the Improve your defense against malware and protect your PC.

Reset your Internet Explorer proxy settings

Malicious software can modify Internet Explorer proxy settings. These changes, in turn, can prevent you from accessing Windows Update or Microsoft security websites.

To change your Internet Explorer proxy settings, click the Fix it button or link. In the File Download dialog box, click Run and follow the steps in the Fix it wizard.


  • This wizard may only be available in English. The automatic correction also works for other language versions of Windows.

  • If you are not using the computer that is having the problem, save the automatic fix to a USB flash drive or CD, and then run it on the computer that has the problem.

To change your Internet Explorer proxy settings manually:

  1. click on begin and then on To run.

  2. Copy and paste the following code into the box To run a:

    reg add "HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Internet Settings" / v ProxyEnable / t REG_DWORD / d 0 / f

  3. click on OK.

  4. click on begin and then on To run.

  5. Copy and paste the following code into the box To run a:

    reg delete "HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Internet Settings" / v ProxyServer / f

  6. click on OK.

For more information about how to reset your Internet Explorer proxy settings, see the following Microsoft Knowledge Base article:

2289942: Reset your Internet Explorer proxy settings
Getting help about computer viruses and security

For the United States
Would you like to chat with a real person? Our Answer Tech-trained experts are available to assist:

Answer Desk

For United States and Canada
Protect your computers from viruses and malware:

Virus Solution and Security Center

Assistance with installing updates:

Windows Update: FAQ

Security solutions for IT professionals:

TechNet Security Troubleshooting and Support

Support by country:

International support

If you are using a PC with Windows 8, click here for more information on how to protect your PC from viruses, or click here for more information on how to scan for and remove viruses.

For locations outside of North America
For virus and security support for locations outside North America, go to the Microsoft Support website.