I think I have a virus

First — take a breath. Most of the time what looks like a virus is actually a scam pop-up trying to trick you into calling a fake "tech support" number. Follow these steps and you'll be fine.

Step 1: Don't panic, don't click anything

• Do not click any buttons inside the suspicious window — even ones that say "Close" or "OK". Sometimes the whole window is one big trick button.
• Do not let anyone you didn't call yourself take remote control of your computer.
• Do not enter any passwords or credit card numbers.
• Do not install any software the pop-up tells you to install.

Step 2: Take a picture with your phone

Use your phone's camera to take a clear photo of the screen — the whole pop-up, any phone numbers shown, and any error codes. This helps me figure out exactly what you're dealing with.

Step 3: Close the bad window

Try these in order. Stop as soon as the pop-up is gone:

1. Press Alt + F4 on your keyboard (hold the Alt key and tap F4). This closes the active window.
2. If that doesn't work, press Ctrl + Alt + Delete all at once. A blue screen appears — click Task Manager. Find your web browser in the list (Chrome, Edge, Firefox, etc.), click it once, then click End task at the bottom right.
3. If nothing works, just hold the computer's power button down for 10 seconds to force it off. That's safe to do in this situation.

Step 4: Disconnect from the internet (if you think something is actively running)

This is mainly for situations where you're seeing files getting encrypted, strange messages popping up repeatedly, or your computer is doing things you didn't ask it to.

1. Wifi: click the wifi icon in the bottom-right of your screen and click your wifi name to disconnect. Or just turn off your router.
2. Wired internet: unplug the ethernet cable from the back of the computer.

This won't fix the problem, but it stops anything bad from spreading or sending your information out.

Step 5: If you already clicked, paid, or gave someone access

This part is important. Don't be embarrassed — these scams trick smart people every day. The sooner we move, the better the outcome.

• If you gave anyone remote access to your computer (Anydesk, TeamViewer, Logmein, anything they had you install) — that person may have done things you didn't see. Keep the computer off and call me right away.
• If you paid someone with a gift card (Apple, Google Play, Steam, Target, etc.) — those cards are almost impossible to refund, but call the store you bought them from anyway and tell them it was a scam. Sometimes they can cancel the card if you act within minutes.
• If you paid with a credit card — call your credit card company right away (the number on the back of the card) and report fraud. They can usually reverse the charge.
• If you gave them your bank login — call your bank right away from a different phone (not the one they called you on, if applicable). Ask them to lock your account and watch for suspicious transfers.
• If you gave them your password for email, Apple, Google, or Microsoft — change it from a different device (your phone, a different computer) before doing anything else. See our password help article.

Step 6: Call me

Once you've done the above, get in touch and I'll handle the rest. I'll check whether anything is actually installed on the computer, clean up any leftover damage, and make sure your accounts are locked down properly.

Quick warning signs that something is wrong

• Pop-ups that won't close, with loud beeping or a robot voice telling you to call a number.
• Your home page in the browser changed and you can't change it back.
• New programs you didn't install showing up.
• Your computer is suddenly very slow with the fan running constantly.
• Files have weird new extensions like .crypto, .locked, or .encrypted, and you can't open them.
• A message demanding payment in Bitcoin or gift cards to "unlock" your files.
• Friends say they got strange emails or messages "from you" that you didn't send.