What should I do if my computer has a virus?

Note: For a list of resources to help you find information about particular viruses, see the "More information" section of What are viruses, worms, and Trojan horses?

Don't panic if your computer seems to have a virus. Common software problems, such as program execution errors and corrupted files, can create symptoms that appear to be virus-related; it is important to distinguish between virus symptoms and those that come from corrupted system files. Try to rule out more standard causes before suspecting a virus. For example, if you just installed new software, try uninstalling it and see if the problems disappear.

However, if your computer begins to act strangely or is unable to do things it has always done in the past, it may be infected with a virus. Symptoms such as longer-than-normal program load times, unpredictable program behavior, inexplicable changes in file sizes, inability to boot, strange graphics appearing on your screen, or unusual sounds may indicate a virus on your system.

If you cannot boot your computer, contact your campus Support Center.

Note: The University Information Security Office (UISO) recommends that you run the latest version of Symantec virus protection software (available to IU students, faculty, and staff free of charge via IUware) for your operating system. Be sure to upgrade safely, update your virus definitions daily, and scan your computer weekly. See In Windows, how do I safely upgrade to the latest Symantec Endpoint or AntiVirus software?

See:

• Windows: In Symantec/Norton AntiVirus for Windows, how do I schedule automatic LiveUpdates and virus scans?
• Mac OS and OS X: In Symantec Endpoint Protection for Mac OS X, how do I schedule automatic LiveUpdates and virus scans?

If your antivirus software finds a virus, it will give you the option to repair, delete, or quarantine the infected file. The quarantine option simply copies the infected file to an isolated directory (called the quarantine folder) on your hard drive, which protects it from access by users or other files. If your antivirus software can't repair the file (e.g., if the damage is too extensive or is the result of an unknown virus), it copies the file into the quarantine folder and deletes it from the drive.

If you have had infected files, once your virus software has cleaned them, you may need to do additional work to repair them. The easiest solution is to open the cleaned file, select all the information in the document, and copy and paste it into a new document. Files that have been cleaned often seem to have some file corruption remaining even though the virus and the macros have been removed. If garbage or unwanted words have been introduced into your files, you may be able to use the search and replace function of your word processing or spreadsheet application to eliminate them.

If the infected file was a Microsoft Word file, as a final step you can delete the normal.dot file (called the normal file on a Mac). This file's location varies depending on how Word was installed, so the best way to find it is to use the Start menu's Find option (in Windows), or, with the Finder active on a Mac, from the File menu, select Find...  (look for the Normal.dotm document in your home folder Library; open Application Support, then Microsoft, then Office, and finally User Templates). The next time you open Word, it will automatically recreate a correct version of this file.

Note: With certain system-level infections, antivirus software cannot entirely remove or repair viral problems and cannot account for changes that may have been made during the infection. In these cases, you will need to perform a clean installation of the operating system. For more, see In Windows, how do I safely rebuild my computer?

Comments/Questions/Corrections