Malware in 2026 rarely announces itself with pop-ups. Modern threats — infostealers, ransomware droppers, cryptominers, and RATs — run silently, sometimes for weeks, before you notice anything. But systematic removal is still achievable without reinstalling your OS if you catch it early. Here is the complete step-by-step process for every major platform.
What changed in 2026
- Infostealers dominate. The most common malware now targets browser cookies, saved passwords, and crypto wallets — not ransomware. Removal alone isn't enough; you must treat credentials as compromised.
- AI-generated phishing improved delivery. More devices get infected via convincing fake installers downloaded from search ads, not email. Check what you downloaded in the last 30 days.
- macOS is no longer "safe by default." Notarization bypasses via side-loading and fake PDF apps made Mac infections routine by 2026.
- Mobile threats grew. Android sideloading and cloned apps in third-party stores pushed mobile malware into the mainstream threat landscape.
Signs you are infected
| Symptom |
Likely cause |
| CPU/GPU pegged at 80–100% idle |
Cryptominer |
| Browser redirects, new toolbar |
Adware / browser hijacker |
| Files encrypted, ransom note |
Ransomware |
| Slow startup, mystery background processes |
RAT or infostealer |
| Accounts logged in from unknown locations |
Infostealer, session-cookie theft |
Step-by-step: Windows
- Disconnect Wi-Fi/ethernet immediately.
- Boot into Safe Mode with Networking (hold Shift → Restart → Troubleshoot → Advanced → Startup Settings → F5).
- Run Windows Defender Offline Scan — it runs before Windows fully loads and catches rootkits.
- Run a second-opinion scanner. Malwarebytes Free, HitmanPro, or Emsisoft Emergency Kit are the 2026 standard second-pass tools. Download on a clean device and transfer via USB if needed.
- Check startup programs — open Task Manager → Startup tab. Kill anything unfamiliar. Cross-reference at startup.run or VirusTotal.
- Check browser extensions — remove every extension you did not explicitly install.
- Reboot normally, rescan. If the threat reappears, assume a rootkit and go to the nuclear option below.
Step-by-step: macOS
- Disconnect from the network.
- Check Login Items (System Settings → General → Login Items) — remove anything suspicious.
- Check LaunchAgents and LaunchDaemons — open
~/Library/LaunchAgents and /Library/LaunchAgents. Unknown .plist files here are red flags.
- Run Malwarebytes for Mac (free tier is enough for scanning) or CleanMyMac X's malware module.
- Check browser extensions in Safari, Chrome, and Firefox separately.
- Verify system integrity — run
csrutil status in Terminal; if SIP is disabled and you did not disable it, treat the Mac as fully compromised.
Step-by-step: Android
- Enable airplane mode.
- Boot into Safe Mode (hold Power → long-press "Power off" → tap Safe Mode).
- Settings → Apps → See all apps — sort by install date. Uninstall anything unfamiliar installed around the time symptoms started.
- Check Device Admin apps (Settings → Security → Device Admin). Legitimate apps rarely need this; malware often does to prevent removal.
- Run a Play Protect scan — Settings → Google → Security → Google Play Protect.
- If still infected, factory reset. Android malware that survives Safe Mode removal is almost always easier to erase than remove.
How to pick a scanner
| Tool |
Platform |
Best for |
| Windows Defender Offline |
Windows |
Rootkits, pre-boot scan |
| Malwarebytes Free |
Windows/Mac |
Second-opinion general scan |
| HitmanPro |
Windows |
Cloud-based second scan |
| Malwarebytes for Mac |
macOS |
Adware, browser hijackers |
| Google Play Protect |
Android |
First-pass app scan |
Never pay for a scanner that cold-called you via a pop-up. Legitimate scanners do not do that.
After cleaning: essential hardening
- Change all passwords from a known-clean device — not the one you just cleaned.
- Revoke active sessions on Google, Microsoft, and banking accounts.
- Enable 2FA on every account that supports it. See How to set up two-factor authentication in 2026.
- Audit your router — some malware pivots to routers. See How to secure your router in 2026.
- Enable automatic OS updates — the vast majority of infections exploit patched vulnerabilities on unpatched systems.
Common mistakes
Scanning while still online. Malware phones home and may download fresh copies. Disconnect first.
Running only one scanner. Detection rates vary. No single tool catches 100%. Always run a second pass.
Changing passwords on the infected machine. If a keylogger is running, the new password is also compromised.
Skipping the browser extensions check. Browser hijackers are frequently overlooked and survive AV scans.
Assuming it is clean because scans come back empty. Advanced rootkits and firmware implants can hide from OS-level scans. If behavior persists, reinstall.
What to skip
- "Free virus removal" pop-ups — these are the infection vector, not the cure.
- Manual registry editing tutorials from random forums — more likely to break Windows than remove malware.
- Paying ransomware operators — payment does not guarantee decryption, funds further attacks, and often triggers follow-up targeting.
FAQ
Should I just reinstall Windows?
If scans keep finding threats or behavior persists, yes — a clean reinstall from a verified ISO is faster and more reliable than chasing a persistent rootkit.
Can malware survive a factory reset?
Rarely, but it exists (firmware-level implants, modified recovery partitions). If you're dealing with a targeted attack, consult a professional.
How do I know which process is malware?
Open Task Manager, right-click a suspicious process, and "Open file location." Upload the file to VirusTotal. Unknown processes in AppData\Roaming or Temp are red flags.
Is antivirus enough to prevent re-infection?
No. AV is a last line of defense. Patching, avoiding pirated software, and using a password manager to avoid phishing are far more effective.
Where to go next
See How to secure your router in 2026, How to set up two-factor authentication in 2026, and How to recover a hacked account in 2026.