What should I do if my computer has a virus?

Note: For a list of resources to help you find information about particular viruses, see the "More information" section of What are computer viruses, and where can I find more information?

First, do not panic if your computer seems to have a virus. Common software problems, such as program execution errors and corrupted files, can create symptoms that appear to be virus-related; it is important to distinguish between virus symptoms and those that come from corrupted system files. Try to rule out more standard causes before suspecting a virus. For example, if you just installed new software, try uninstalling it and see if the problems disappear.

But if your computer begins to act strangely or is unable to do things it has always done in the past, it may be infected with a virus. Symptoms such as longer-than-normal program load times, unpredictable program behavior, inexplicable changes in file sizes, inability to boot, strange graphics appearing on your screen, or unusual sounds may indicate a virus on your system.

If you cannot boot your computer, contact your campus Support Center.

Note: The University Information Security Office (UISO) recommends that you run the latest version of Symantec/Norton AntiVirus software (available to IU students, faculty, and staff for free via IUware) for your operating system, being sure to upgrade safely (see In Windows, how do I safely upgrade to the latest Symantec Endpoint or AntiVirus software?) and to update your virus definitions daily and scan your computer weekly. For instructions, see:

• Windows: In Symantec/Norton AntiVirus for Windows, how do I schedule automatic LiveUpdates and virus scans?
• Mac OS and OS X: In Symantec AntiVirus for Mac OS X, how do I schedule automatic LiveUpdates and virus scans?

If SAV/NAV finds a virus, it will give you the option to repair, delete, or quarantine the infected file (the quarantine option is not available in Mac OS). The quarantine option simply copies the infected file to an isolated directory (called the quarantine folder) on your hard drive, which protects it from access by users or other files. If SAV/NAV can't repair the file (e.g., if the damage is too extensive or is the result of an unknown virus), it copies the file into the quarantine folder and deletes it from the drive.

If you have had infected files, once your virus software has cleaned them, you may need to do additional work to repair them. The easiest solution is to open the cleaned file, select all the information in the document, and copy and paste it into a new document. Files that have been cleaned often seem to have some file corruption remaining even though the virus and the macros have been removed. If garbage or unwanted words have been introduced into your files, you may be able to use the search and replace function of your word processing or spreadsheet application to eliminate them.

If the infected file was a Microsoft Word file, as a final step you can delete the normal.dot file (called the normal file on a Mac). This file's location varies depending on how Word was installed, so the best way to find it is to use the Start menu's Find option (in Windows), or, with the Finder active on a Mac, from the File menu, select Find... . The next time you open Word, it will automatically recreate a correct version of this file.

Note: With certain system-level infections, antivirus software cannot entirely remove or repair viral problems and cannot account for changes that may have been made during the infection. In these cases, you will need to perform a clean installation of the operating system. For more, see In Windows, how do I safely rebuild my computer?

Also see:

• What should I do if I receive a computer virus alert message via email?
• What is Microsoft Word's macro virus protection tool, and how do I activate it?
• At IU, where can I scan removable media for viruses?
• What is security software?