How do I remove a computer virus?

[This information is preliminary and subject to change.]

If your computer is infected with a virus, you'll want to remove it as quickly as possible. A fast way to check for viruses is to use an online scanner, such as the Microsoft Safety Scanner. The safety scanner is a free program that helps you identify and remove viruses, clean up your hard disk, and generally improve your computer's performance.

To try a different scanner, follow the links to other companies that provide them on the Windows Security software providers webpage.

If you can connect to the Internet

If you can reach a website using your web browser, run an online scan.

To run the Microsoft Safety Scanner

  1. Go to the Microsoft Safety Scanner webpage to download the scanner.

  2. Click Download Now, and then follow the instructions on the screen.

If you can't connect to the Internet

If you can't get to the Microsoft Safety Scanner online, try restarting your computer in safe mode with networking enabled.

To restart in Safe Mode with networking enabled

  1. Restart your computer.

  2. When you see the computer manufacturer's logo, press and hold the F8 key.

  3. On the Advanced Boot Options screen, use the arrow keys to highlight Safe Mode with Networking, and then press Enter.

  4. Log on to your computer with a user account that has administrator rights.

  5. Follow the steps above to run the Microsoft Safety Scanner.

If you still can't access the Internet after restarting in safe mode, try resetting your Internet Explorer proxy settings. The following steps reset the proxy settings in the Windows‌ registry so that you can access the Internet again.

To reset Internet Explorer proxy settings

  1. In Windows Developer Preview, click the Start button Picture of the Start button. In the search box, type run, and then, in the list of results, click Run.

    -or-

    In Windows Vista, click the Start button Picture of Start button, and then click Run.

    -or-

    In Windows XP, click Start, and then click Run.

  2. Copy and paste or type the following text in the Open box in the Run dialog box:

    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 0 /f

  3. Click OK.

  4. In Windows Developer Preview, click the Start button Picture of the Start button. In the search box, type run, and then, in the list of results, click Run.

    -or-

    In Windows Vista, click the Start button Picture of Start button, and then click Run.

    -or-

    In Windows XP, click Start, and then click Run.

  5. Copy and paste or type the following text in the Open box in the Run dialog box:

    reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer /f

  6. Click OK.

Restart Internet Explorer and then follow the steps listed previously to run the scanner.

Remove a virus manually

Sometimes a virus must be removed manually. This can become a technical process that you should only undertake if you have experience with the Windows registry and know how to view and delete system and program files in Windows.

First, identify the virus by name by running your antivirus program. If you don't have an antivirus program or if your program doesn't detect the virus, you might still be able to identify it by looking for clues about how it behaves. Write down the words in any messages it displays or, if you received the virus in email, write down the subject line or name of the file attached to the message. Then search an antivirus vendor's website for references to what you wrote down to try to find the name of the virus and instructions for how to remove it.

Recovery and prevention

After the virus is removed, you might need to reinstall some software or restore lost information. Doing regular backups on your files can help you avoid data loss if your computer becomes infected again. If you haven't kept backups in the past, we recommend that you start now.