Malware Explained: What It Is, How to Spot It and How to Remove It

Malware is any software designed to damage, spy on or take control of a device without the owner’s permission, and almost every computer, phone and tablet can be targeted. Whether you use Windows 11, a Mac, an iPhone or an Android phone, knowing how malware works, how to check for it and how to remove it will save you time, money and stress.

This guide explains what malware is, what it can do, how infections happen, and how to scan for and remove malware on each major platform. It finishes with practical steps to avoid getting infected in the first place.

What Is Malware?

Malware, short for “malicious software”, is a program or file built to harm a device, steal data or give an attacker unauthorised access. It covers a wide family of threats, including viruses, worms, trojans, ransomware, spyware, adware, rootkits and keyloggers.

What unites them is intent. Legitimate software does what you expect and asks for your consent. Malware hides its purpose, runs without your approval and works for someone else’s benefit, usually financial gain.

Malware affects individuals, small businesses and large organisations alike. Attackers rarely care who you are; they care whether your device, accounts or files can be used or sold.

Is Malware a Virus?

Not exactly: a virus is one type of malware, but not all malware is a virus. “Malware” is the umbrella term, and a computer virus is a specific kind that attaches itself to a legitimate file or program and spreads when that file is opened or shared.

Other types behave differently:

Worms spread across networks on their own, with no user action needed.
Trojans pose as useful software but carry a hidden payload.
Ransomware locks or encrypts your files and demands payment.
Spyware quietly records your activity and personal information.
Adware floods you with unwanted adverts, and sometimes tracks you.

People often say “I have a virus” when they mean “I have malware”. The distinction matters because the right removal approach depends on the type of threat.

How Does Malware Work?

Most malware follows the same basic lifecycle: it gets onto a device, runs, hides and then carries out its purpose.

Delivery. The malware arrives through an email attachment, a malicious link, a fake download, an infected USB drive or a security flaw in outdated software.
Execution. It runs, often because you were tricked into opening or installing it, or because it exploits a vulnerability that needs no action from you.
Persistence. It sets itself up to survive a restart, for example by adding itself to startup items, scheduled tasks or browser extensions.
Evasion. It tries to avoid detection by disguising its name, disabling security tools or running quietly in the background.
Payload. It does its job: stealing passwords, encrypting files, displaying ads, mining cryptocurrency or giving an attacker remote access.

Many modern threats also contact a remote server to receive instructions or send stolen data, which is why unusual network activity can be a warning sign.

What Can Malware Do?

Malware can do anything from mildly annoying you to wiping out a business, depending on its type. Common effects include:

Stealing personal data, such as passwords, banking details and identity documents
Encrypting files and demanding a ransom to restore access
Spying on you through keystroke logging, screen capture, the microphone or the camera
Hijacking your device to send spam, attack other systems or mine cryptocurrency
Redirecting your browser and injecting adverts or fake search results
Slowing or crashing your device and corrupting or deleting data
Giving attackers remote access to your files, accounts and network

The consequences go beyond the device itself. Stolen credentials can lead to drained bank accounts, hijacked email and social media, and fraud committed in your name.

What Are Malware Attacks?

A malware attack is any attempt by a criminal to install malicious software on a victim’s device or network in order to profit from it or cause harm. Attacks can be broad and automated, or carefully targeted at one person or organisation.

Common attack types include:

Phishing and malicious attachments: an email or text that looks legitimate and pushes you to open a file or link.
Ransomware attacks: files are encrypted and a payment is demanded, often with a threat to leak the data.
Drive-by downloads: simply visiting a compromised website installs malware, usually through an unpatched browser or plug-in.
Trojan and fake software attacks: a cracked game, free tool or fake update hides a malicious payload.
Malvertising: adverts, including on legitimate sites, redirect to malicious pages or push downloads.
Supply chain attacks: attackers compromise a trusted software vendor or update so that many customers are infected at once.
Infected removable media: USB drives that carry malware into otherwise isolated systems.

In New Zealand, incidents can be reported to the National Cyber Security Centre (NCSC), which helps track and respond to cyber threats.

What Is PUP Malware?

A PUP, or potentially unwanted program, is software you did not knowingly choose that behaves in unwanted ways, even though it may not be strictly illegal. PUPs sit in a grey area between harmless software and true malware, which is why security tools often label them “PUP” or “PUA” (potentially unwanted application) rather than “malware”.

Typical PUPs include:

Browser toolbars and extensions that change your homepage or search engine
Adware that shows pop-ups and banner adverts
Fake “system optimisers” and “driver updaters” that exaggerate problems to sell you a fix
Bundled software installed alongside a free download

PUPs usually arrive bundled with free software, with an opt-out checkbox buried in the installer. They can slow your device, track your browsing and expose you to riskier content. Treat them as a warning sign and remove them, because the same installer that delivered a PUP can easily deliver something worse.

How Do You Get Malware?

You usually get malware by interacting with something that looks safe but is not, though some infections need no action at all. The most common routes are:

Email and message attachments, especially invoices, courier notices and “urgent” documents
Links in emails, texts and social media, which lead to fake login pages or malicious downloads
Pirated or cracked software, key generators and game “mods”
Fake updates and fake alerts, such as a pop-up claiming your browser or Flash is out of date or your device is infected
Untrusted app sources, including apps installed outside the official stores
Outdated software, where known security flaws have not been patched
Public USB chargers and unknown USB drives
Compromised websites and adverts, which can attempt to infect you without a click

A useful rule of thumb: if something creates urgency, offers something for nothing or asks you to bypass a security warning, treat it as suspicious.

Signs Your Device May Be Infected

A sudden change in how your device behaves is the clearest sign of malware, although none of these symptoms proves an infection on its own. Watch for:

Noticeably slower performance, freezing or frequent crashes
Unexpected pop-ups, adverts or browser redirects
A new homepage, search engine, toolbar or extension you did not add
Apps or programs you do not recognise
Battery draining faster than usual, or the device running hot while idle
Unusually high data usage
Security software that has been switched off and will not turn back on
Files that are missing, renamed or locked, or a ransom message
Contacts receiving messages you did not send

If you notice several of these together, move on to scanning your device.

How to Scan for Malware

The most reliable way to scan for malware is to run a full scan with reputable security software that is fully up to date. The same general process works on any platform:

Update first. Install pending operating system and app updates, and make sure your security software has the latest definitions.
Disconnect if you suspect a serious infection. Turn off Wi-Fi or unplug the network cable to stop data leaving the device.
Run a full scan, not just a quick scan. A full scan checks every file and takes longer, so leave the device plugged in.
Run a second opinion scan. A reputable on-demand scanner can catch what your main security tool missed.
Review the results. Quarantine or remove everything flagged, then restart and scan again to confirm the device is clean.
Check what you cannot scan. Review installed apps, browser extensions and startup items by hand, because some PUPs and adware are not always flagged.

If a scan keeps finding threats that return after removal, or your security software will not run, the infection may be deep enough to need an offline scan or a full reset. The platform sections below cover those steps.

How to Check for Malware on Windows 11

Windows 11 includes Microsoft Defender, which is built into the Windows Security app and is enough for most home users. To check for malware:

Open Start, type Windows Security and open the app.
Select Virus & threat protection.
Under Current threats, choose Scan options.
Select Full scan and click Scan now. A full scan can take an hour or more.
If you suspect something is hiding from normal scans, choose Microsoft Defender Antivirus (offline scan) instead. Your PC will restart and scan before Windows fully loads.
When the scan finishes, open Protection history to see what was found and what action was taken.

Also check these manually:

Settings > Apps > Installed apps for programs you do not recognise
Task Manager > Startup apps for unfamiliar items set to run at sign-in
Your browser’s extensions list for anything you did not install

Make sure real-time protection is switched on under Virus & threat protection settings, and run Windows Update regularly.

How to Check for Malware on Mac

Macs are less commonly targeted than Windows PCs, but they are not immune, and adware, trojans and info-stealers do exist for macOS. Apple builds in protections such as Gatekeeper and XProtect, but there is no simple “scan” button, so checking involves a few manual steps:

Update macOS. Go to System Settings > General > Software Update and install everything available. Apple delivers malware definition updates this way.
Check your Applications folder. Look for apps you do not remember installing, including “cleaners” and “optimisers”.
Review login items. In System Settings > General > Login Items & Extensions, look for unfamiliar items that start automatically.
Open Activity Monitor. Under the CPU and Memory tabs, look for unknown processes using a lot of resources.
Check browser extensions and settings. In Safari, Chrome or Firefox, remove any extension you did not add and confirm your homepage and search engine are what you chose.
Look for configuration profiles. If Profiles appears in System Settings and you do not use a work or school profile, investigate anything listed.
Run an on-demand scan with a reputable Mac security app for a second opinion.

Also be wary of pop-ups claiming your Mac is infected. These are one of the most common Mac scams.

How to Check for Malware on iPhone

iPhones are among the most locked-down consumer devices, so true malware is rare, but scams, malicious profiles and compromised accounts are real risks. iOS has no built-in virus scanner and apps cannot scan other apps, so checking means looking for signs of tampering:

Update iOS. In Settings > General > Software Update, install the latest version, which includes security fixes.
Review your apps. Scroll through the App Library and delete anything you do not recognise.
Check for configuration profiles. Go to Settings > General > VPN & Device Management. If you see a profile you did not install, it may be malicious.
Check battery and data use. In Settings > Battery and Settings > Mobile Service, look for apps using far more than expected.
Review Safari. Look for odd redirects, repeated pop-ups, or unexpected notification permissions in your Safari and website settings.
Check your Apple Account. Look at Settings > [your name] for devices you do not recognise, and review recent sign-in activity.
Run Safety Check. In Settings > Privacy & Security > Safety Check, you can review who and what has access to your information.

A jailbroken iPhone has far weaker protections and is much more exposed to malware. If your iPhone has been jailbroken, restoring it to a standard state is strongly recommended.

How to Remove Malware

To remove malware, isolate the device, clean it with security software, remove anything suspicious by hand and then secure your accounts. Follow these steps on any platform, then use the device-specific sections below:

Back up your important files. Copy documents and photos to an external drive or cloud storage. Avoid backing up programs or system files, which could carry the infection with them.
Disconnect from the internet to stop the malware sending data or receiving instructions.
Boot into safe mode where possible. This loads only essential software, which can stop some malware from running.
Delete suspicious programs and extensions that you do not recognise.
Run a full scan with reputable security software and remove or quarantine everything it finds.
Restart and scan again to confirm that nothing returns.
Change your passwords from a different, clean device, starting with email, banking and any accounts that matter most. Turn on two-factor authentication.
Update everything so the weakness that let the malware in is closed.

If the malware keeps coming back, or you are dealing with ransomware or signs of stolen banking details, a full reset of the device is the safest option. For ransomware or fraud, contact your bank and report the incident to the NCSC.

How to Get Rid of Malware on Mac

Most Mac malware is removed by deleting the unwanted app and its persistence items, then scanning to confirm. Work through these steps:

Back up your files to an external drive or cloud storage.
Disconnect from the internet.
Quit and delete suspicious apps. Open Activity Monitor, quit any suspicious process, then drag the app from the Applications folder to the Bin and empty it.
Remove login items. In System Settings > General > Login Items & Extensions, remove anything unfamiliar.
Remove configuration profiles you did not install, if a Profiles entry appears in System Settings.
Clean up your browsers. Remove unknown extensions, reset your homepage and search engine, and clear cookies and cache.
Run a scan with a reputable Mac security tool and remove what it finds.
Update macOS and change your passwords from a clean device.

If the problem returns, back up your files and reinstall macOS. Use System Settings > General > Transfer or Reset > Erase All Content and Settings on a recent Mac, or macOS Recovery on older ones. Restore only your personal files afterwards, not old apps.

How to Remove Malware from iPhone

On an iPhone, removal usually means updating iOS, deleting suspicious apps and profiles, and clearing browser data. Try these steps in order:

Update iOS in Settings > General > Software Update.
Restart your iPhone. This can end some browser-based pop-up problems.
Delete suspicious apps. Press and hold the app icon and choose Remove App > Delete App.
Remove unknown profiles in Settings > General > VPN & Device Management.
Clear Safari data. Go to Settings > Apps > Safari > Clear History and Website Data (on older iOS versions, this is under Settings > Safari). Also review website notification permissions.
Change your Apple Account password and any other passwords you used on the phone. Turn on two-factor authentication.
Restore from a clean backup. If problems continue, back up, then use Settings > General > Transfer or Reset iPhone > Erase All Content and Settings. Set the phone up again and restore from a backup made before the problem started.

If you are at higher risk of targeted attacks, Lockdown Mode (in Settings > Privacy & Security) offers extra protection.

How to Remove Malware from Android

On Android, the usual fix is to run Google Play Protect, boot into safe mode and uninstall the offending app. Menu names vary slightly between manufacturers, but the process is the same:

Run Play Protect. Open the Google Play Store, tap your profile picture, then Play Protect > Scan.
Restart in safe mode. Hold the power button, then press and hold Power off and confirm Safe mode. Third-party apps are disabled, which can stop malware from running.
Uninstall suspicious apps. Go to Settings > Apps, find anything unfamiliar or recently installed, and tap Uninstall.
Remove device admin rights. If an app will not uninstall, check Settings > Security (or Security & privacy) > Device admin apps and revoke its access first.
Clear browser data and remove unwanted notification permissions in Chrome.
Update Android and your apps in Settings > System > Software update and in the Play Store.
Change your passwords, starting with your Google account, and turn on two-factor authentication.
Factory reset if needed. If the malware persists, back up your photos and contacts, then use Settings > System > Reset options > Erase all data (factory reset). Reinstall apps only from the Play Store.

Avoid installing apps from outside Google Play, since that is the most common way Android malware spreads.

How to Avoid Malware

You can avoid most malware by keeping devices updated, being sceptical of unexpected messages, and installing software only from trusted sources. The most effective habits are:

Install updates promptly for your operating system, browser and apps, and turn on automatic updates.
Use reputable security software on Windows and Android, and keep built-in protections like Defender, Gatekeeper and Play Protect switched on.
Think before you click. Be cautious with unexpected attachments, links and urgent requests, even from people you know. If in doubt, contact the sender another way.
Download only from official sources, such as the App Store, Google Play, the Microsoft Store or the developer’s own website.
Avoid pirated software and cracked games.
Use strong, unique passwords with a password manager, and turn on two-factor authentication.
Do not use an administrator account for everyday work on a computer.
Back up regularly, keeping one copy offline or in the cloud, so ransomware cannot take your only copy hostage.
Be careful on public Wi-Fi, and use a reputable VPN if you must handle sensitive information.
Do not call numbers or follow instructions from pop-up warnings. Genuine security alerts do not ask you to phone a number or pay for support.

Good habits matter more than any single tool, and they cost nothing.

Malware FAQ and Key Takeaways

Can malware be completely removed? Yes, in most cases. Where a clean removal cannot be confirmed, a factory reset removes it for certain.

Can I get malware just by visiting a website? It is possible through drive-by downloads, but much more likely if your browser or operating system is out of date.

Do Macs and iPhones get malware? Yes, though less often than Windows and Android. Scams, adware and malicious profiles are the main risks.

Is free antivirus good enough? For most home users, the built-in protection on Windows 11 and macOS combined with safe habits is a solid baseline.

What should I do first if I think I’m infected? Disconnect from the internet, scan, and change your passwords from a different, clean device.

Key takeaways:

Malware is an umbrella term, and a virus is just one type.
Most infections start with a click, a download or an unpatched weakness.
Scan with trusted tools, then check apps, extensions and startup items by hand.
If in doubt, back up and reset the device.
Updates, backups and healthy scepticism prevent most problems.