Clicking a bad link doesn't always mean you're infected, but it's worth working through this checklist rather than hoping for the best.

Cleanup Steps

1. Disconnect from the internet to stop any malware from downloading additional payloads or exfiltrating data.
2. Run a full scan with your existing antivirus/endpoint protection. On a managed business device, let your IT team or MSP run this rather than installing a new tool yourself — a second product can conflict with the one already managing the machine.
3. If the scan finds something, follow its removal or quarantine prompts, then reboot and run a second scan to confirm it's actually gone.
4. If the computer is behaving abnormally and a normal scan can't keep up (constant pop-ups, browser hijacked, programs won't open), boot into Safe Mode and run the scan from there — malware has fewer ways to interfere when Windows loads with only essential drivers and services.
5. Update everything — Windows, your browser, and all installed applications — once the machine is clean, since malware often exploits a known, already-patched vulnerability.
6. Change your passwords from a separate, known-clean device once you're confident the machine is clean, starting with anything you were logged into during the incident.

Common Questions

My antivirus says the computer is clean — can I trust that?

Generally yes for common malware, but keep an eye on the machine for a few days afterward. If anything still seems off (new browser extensions, unexpected outbound network activity, unusually slow performance), have IT do a deeper check rather than assuming it's fine.

Do I need to fully reinstall Windows?

Not usually, for typical malware caught and removed promptly. A full reinstall is the safer option specifically after ransomware, rootkits, or when you can't otherwise confirm the infection is fully gone.