Viruses, pop-ups and scams: how to tell, and what to do

1. 01The most important thing on this page
2. 02So how do you tell if it is real?
3. 03What to do right now if you think you are infected
4. 04What proper removal actually involves
5. 05Do you need to pay for antivirus?
6. 06The habits that actually keep you safe

Most of what frightens people about viruses is not the virus. It is the scam wrapped around it. So this covers both: how to tell whether something is genuinely wrong with your computer, how to recognise the con that is trying to look like a virus, and what actually protects you.

The most important thing on this page

A full-screen warning telling you that your computer is infected and giving you a phone number to call is the scam. Every time. There is no exception to this.

Microsoft does not do this. Apple does not do this. No legitimate antivirus program does this. Your real security software puts a small, calm notification in the corner and quietly deals with the problem; it does not take over your screen, play an alarm sound, or ask you to ring anybody.

What that page is really doing is buying a phone call. The person who answers will be friendly, competent-sounding, and will ask for remote access to “fix” it. What follows is a few hundred dollars for nothing, often a subscription you did not understand you were agreeing to, and sometimes genuine malware installed while they had control, by someone who has now seen your banking.

If one of these is on your screen right now: do not call the number. Close the browser, and if it will not close, hold the power button until the machine shuts off. That is safe to do. Nothing has actually happened to your computer yet. A web page cannot infect you just by being open, and shutting down clears it. If it comes back every time you open your browser, that is worth having looked at properly.

The same applies to the phone call version, where someone rings claiming to be from Microsoft, Apple, or your internet provider, saying they have detected a problem. Nobody detects problems on your personal computer from a call centre. Hang up. You are not being rude; you are ending a robbery.

So how do you tell if it is real?

Actual infections are quieter than the fake ones. The things I look for:

• Pop-ups and adverts appearing outside the browser, or on sites that never had them. Adverts on a normal web page are just adverts. Adverts on your desktop are not.
• Your browser homepage or search engine has changed, and changing it back does not stick. Classic hijack behaviour.
• New toolbars, extensions or programs you did not install.
• The machine is working hard while you are doing nothing: fans running, everything sluggish. Some malware simply uses your computer, for crypto mining or sending spam.
• Your security software has been switched off and will not turn back on. Malware disabling defences is a strong signal.
• Friends receiving messages or emails from you that you did not send.
• Files that have been renamed with an odd extension and will not open, plus a note demanding payment. That is ransomware and it is a different, more serious situation.

Worth saying plainly: a slow computer on its own is usually not a virus. Nine times out of ten it is a mechanical hard drive, not enough memory, or heat. People often pay for virus removal when what they needed was a drive upgrade.

What to do right now if you think you are infected

1. 1.Stop doing anything sensitive on it. No banking, no shopping, no logging into anything that matters, until it is clean.
2. 2.Disconnect it from the internet if you suspect ransomware, to stop it spreading to other machines and to network drives.
3. 3.Do not pay anyone, whether it is a pop-up, a phone call, or a ransom note. Paying a ransom frequently buys nothing.
4. 4.Change important passwords from a different device: your phone, or another computer. Changing them on the infected machine just hands the new ones over.
5. 5.If money is involved, call your bank. If you gave someone remote access or card details, that call is more urgent than the computer repair.
6. 6.Get it properly cleaned before you trust it again.

What proper removal actually involves

Running one free scanner and calling it done is not removal. Modern infections install several components in different places, and a single scan routinely leaves parts behind that reinstall the rest within a day or two.

What I do, from $69, is hands-on rather than one-click: scan with several tools that catch different things, examine what is actually set to start with Windows and remove what should not be there, clean out browser extensions and hijacked settings, check your accounts have not been tampered with, then confirm the machine is genuinely clean rather than temporarily quiet. I also tell you how it got in, because otherwise the same thing happens again in a month.

Occasionally, with something deeply embedded or with ransomware, the honest answer is a clean Windows reinstall from $89 rather than a clean-up. I will tell you when we are in that territory and why.

Do you need to pay for antivirus?

For most people, no. Windows Defender is built into Windows, it is genuinely good now, and it is quietly doing its job without asking you for anything. It is what I recommend to the large majority of people who ask.

What I would avoid is stacking multiple security programs. They interfere with each other, they slow the machine down, and the nagging ones, perpetually warning you about “issues” to sell an upgrade, train people to click through warnings, which makes them less safe rather than more.

The habits that actually keep you safe

Almost every infection I clean up arrived through a person, not a hole in the software. Which is good news, because it means the fixes are behaviours rather than purchases.

• Install updates. Unglamorous and the single most effective thing on this list. Most malware exploits a hole that was patched months ago.
• Download software from the maker’s own site, never from an ad at the top of search results. Those ads are one of the most common infection routes I see, and they look identical to the real thing.
• Treat unexpected attachments and links as guilty until proven innocent, including from people you know. A compromised account sends real-looking mail. If a message is unexpected, urgent, and wants you to click, that combination is the warning.
• Use a different password for your email than for anything else. Email is the master key: whoever controls it can reset everything else.
• Turn on two-factor authentication for email and banking. It is a minor inconvenience that defeats the majority of account takeovers.
• Slow down when something is urgent. Every one of these scams works by creating panic. “Your account will be closed today”, “you have been charged $499”, “your computer is infected, call now”. Real organisations do not operate on that footing.
• Keep a backup. It is the one thing that turns ransomware from a catastrophe into an annoyance.

And there is no judgement here, ever. Falling for one of these is not stupidity. They are professionally built to work on intelligent, busy people, and I have cleaned up after doctors, accountants and engineers. Whatever is on your computer stays your business. I am not there to comment on it, only to fix it.

If something feels wrong, call or text (604) 817-1069 and describe it. If it is a five-minute reassurance, that is free. If it needs work, it starts with the flat $40 diagnostic, credited to the repair.