Phone or computer hacked: how to clean it up

1. Disconnect from the internet (unplug ethernet, turn off Wi-Fi) to stop the malware from spreading.

   More detail

   Why this matters: many strains of malware actively communicate with the attacker, exfiltrate files, or spread to other devices on your network. Cutting the connection contains the damage. How: turn off Wi-Fi from the system tray / control center, and physically unplug any ethernet cable.

2. Do NOT pay any ransomware demand — it rarely results in file recovery and funds criminal activity.

   More detail

   Studies (Sophos, FBI) consistently show that paying does not reliably restore files: many victims either receive no decryptor, get a broken one, or are extorted again. Payment also marks you as a willing target. Check NoMoreRansom.org first — free decryptors exist for many strains.

3. Do NOT turn off the computer if you see ransomware — keep it on for forensics, but stay disconnected.

   More detail

   Some ransomware encryption keys live only in memory (RAM). Powering off destroys them and removes any chance a researcher could recover your files. Disconnect from the network, but leave the device on.

4. If someone has remote access right now: shut the device down.

   More detail

   If you can see the cursor moving on its own, or a tech-support scammer is currently connected via TeamViewer/AnyDesk, immediately hold the power button to force shutdown. This is one of the only situations where pulling the plug is the right move.

1. Boot into Safe Mode and run a reputable malware scanner.

   MalwarebytesBitdefender Free
   More detail

   Safe Mode loads only essential drivers, which usually prevents malware from auto-starting and hiding from scanners. On Windows: hold Shift while clicking Restart → Troubleshoot → Advanced → Startup Settings → Safe Mode with Networking. On Mac: hold Shift during boot. Then download and run a reputable scanner.

2. Follow the scanner's removal instructions for anything found.

3. If ransomware: check if a free decryptor exists for your strain.

   NoMoreRansom.org

4. Change passwords for all accounts accessed from the infected device — from a DIFFERENT, clean device.

5. Assume saved passwords / autofill data in the browser are compromised.

6. Notify your employer if this is a work device — they may have an incident response team.

7. 🇺🇸 US

   Report ransomware or major malware incidents to the FBI.

   IC3.gov
8. 🇨🇦 CA

   Report cybercrime to the RCMP's National Cybercrime Coordination Centre or the CAFC.

   cybercrime.rcmp-grc.gc.caCAFC · 1-888-495-8501

1. If malware can't be removed: back up important files to an external drive (scan it too), then wipe and reinstall the OS.

2. Restore files from a clean backup that pre-dates the infection.

3. Update your operating system and all software to the latest versions.

4. Install and configure a reputable antivirus / endpoint protection tool.

5. Review your router — some malware changes DNS settings. Check or factory reset it.

6. Enable automatic OS and software updates going forward.

1. Keep OS, browsers, and software fully up to date.

2. Use a reputable antivirus that runs in real time.

3. Back up important files regularly (3-2-1 rule: 3 copies, 2 media, 1 offsite).

4. Avoid clicking links or attachments in unexpected emails.

5. Be cautious about what you download and install.

Related situations