Malware and spyware explained: signs, checks and removal

Malware and spyware are unwanted software that runs on a computer, phone or tablet without the owner’s agreement. Some malware steals passwords or money, some locks files, and spyware quietly watches what a person does. This guide explains the main types, how they get onto devices, the warning signs the Australian Signals Directorate (ASD) lists, and how to check and remove malware using the tools built into Windows, macOS, iPhone and Android.

What malware is

ASD’s ACSC describes malware as “any type of code or program that is used for a malicious purpose”. It often isn’t the whole attack, just one stage of it. ASD gives examples such as stealing data that is later used for extortion or identity theft, or recording keystrokes to capture usernames and passwords.

ASD lists these common types:

• Viruses and worms. Code that copies itself. A virus attaches to files or programs; a worm can spread between devices on its own.
• Trojans. Malware disguised as something useful, such as a free tool, game or “update”, so the person installs it themselves.
• Keyloggers. Software that records what is typed, including passwords.
• Adware. Software that floods the device with ads or redirects the browser.
• Ransomware. Malware that locks or encrypts files and demands payment. See how ransomware works and what limits the damage.
• Spyware. Software that collects information about what a person does on a device and sends it to someone else.

Infostealers

An information stealer (infostealer) is a kind of malware that grabs stored data and sends it to criminals. ASD’s information stealer advisory lists what they target: saved passwords (especially in web browsers), authentication cookies, autofill data, credit card details, browsing history, chat logs and cryptocurrency wallets. ASD notes that stolen authentication cookies “could effectively bypass MFA requirements”. That is why infostealers are closely linked to password attacks.

Stalkerware

Stalkerware is spyware installed on someone’s phone or computer by a person they know, usually without their knowledge, to track messages, location or activity. It is a safety issue as well as a security one, and it is covered separately below.

How malware gets onto devices

ASD’s malware page lists these common routes:

• links in scam emails, texts or instant messages, often from someone pretending to be a trusted person or organisation (see how phishing, smishing and vishing work)
• files with a different file extension than expected, such as a program file when a PDF or photo was expected
• chargers, cables and USB drives (“Malware can be delivered through chargers, cables, USB mass storage/flash drives and many more”)
• images in emails (“Viruses can attach themselves to images”)
• apps from third-party download sites that aren’t widely known to be legitimate, online ads or peer-to-peer networks
• apps received from contacts, for example by email or USB stick.

ASD’s infostealer advisory adds malicious search results, malicious ads, cracked or pirated software, social media advertisements and posts, and fake browser updates. Browser add-ons are another route; see malicious browser extensions and how to remove them.

A fictional example

Priya searches for a free PDF editor and clicks an ad at the top of the results. The site, pdftools.example, offers a download called PDF-Editor-Setup.exe. It installs and seems to work. A week later her email provider warns of a sign-in from another country, and her browser opens pages she didn’t choose. The “editor” was a trojan carrying an infostealer, which copied the passwords saved in her browser.

Warning signs ASD lists

ASD’s recovery page lists these signs that a device may have malware:

• unusual account activity, such as logins from an unusual location or time, or passwords changed so you can’t get into an account
• the device running slowly, overheating, the battery draining quickly or the fan working harder than usual
• new programs, toolbars or icons that weren’t installed by the owner
• files that won’t open, or ransom demands
• unfamiliar error messages
• the browser opening pages the person didn’t mean to visit
• pop-up ads urging an update or download
• someone knowing things they could only have learned from the device.

None of these proves malware on its own. Old hardware, a full disk or a buggy update can cause similar symptoms.

How to check for and remove malware with built-in tools

Windows, macOS and Android include built-in malware protection, and iPhone settings show whether a profile controls the device. For when a paid product adds something, see the antivirus software guide.

Windows: Microsoft Defender Antivirus

Windows includes Microsoft Defender Antivirus in the Windows Security app. Microsoft says its real-time protection “continuously monitors your device for potential threats”, scanning files as they are opened or run.

Based on Microsoft’s instructions (checked October 2026). Menus can change between versions; Microsoft’s guides to the Windows Security app and removing malware have the latest steps.

1. Open the Windows Security app and select Virus & threat protection.
2. Run a Quick scan, or select Scan options for a Full scan or a Custom scan (chosen files or folders).
3. For stubborn malware, Microsoft describes the Microsoft Defender Antivirus (offline scan): save open files and close apps, go to Virus & threat protection > Scan options, select it, then select Scan now. The scan takes several minutes and the PC restarts.
4. Afterwards, go to Virus & threat protection > Protection history in Windows Security to see what was found. Microsoft says the offline scan automatically detects and removes or quarantines malware.

Mac: app sources and built-in protection

Apple’s Mac User Guide explains a setting that controls where apps can come from. Based on Apple’s instructions (checked October 2026); Apple’s guide has the latest steps.

1. Choose Apple menu > System Settings, then click Privacy & Security.
2. Under Security, use the menu next to Allow applications from to choose App Store or App Store and Known Developers.

Apple says of the App Store option: “This is the most secure setting to protect your system from malware.” Apple also says macOS “checks the app before it opens the first time to be certain it hasn’t been modified since the developer shipped it.” ASD’s recovery page says “MacOS devices come with antivirus software called XProtect pre-installed”; Apple’s page doesn’t name it.

iPhone and iPad: profiles and sharing

A configuration profile can give an organisation control over a device. Apple’s Personal Safety User Guide explains how to find unknown ones (checked October 2026):

1. Go to Settings > General > VPN & Device Management. If no profiles appear, Apple says none are installed.
2. Select an unknown profile, choose to delete it and follow the onscreen prompts.
3. Restart the device.

Apple notes that “When you remove a profile, all of its settings and information are deleted”, and that for a device owned by a school or employer, to “check with your system administrator before deleting any apps or profiles”. Apple says Safety Check (iPhone with iOS 16 or later) “enables you to quickly review, update, and stop sharing your information with individual people and apps”; see Apple’s Safety Check guide.

Android: Google Play Protect

Google says Play Protect checks apps from the Play Store before they’re downloaded, scans the device for harmful apps from other sources, warns about potentially harmful apps, and can disable or remove them. Google says “Google Play Protect is on by default”. Based on Google’s instructions (checked October 2026); Google’s Play Protect guide has the latest steps.

1. Open the Google Play Store app.
2. At the top right, tap the profile icon, then Play Protect, then Settings.
3. Check that Scan apps with Play Protect is turned on.

More device settings are in the security basics guides for Windows, Mac, iPhone and Android.

What ASD says to do if a device is infected

ASD’s “Recover from malware” steps:

1. Don’t type passwords on the infected device. ASD warns that keyloggers can capture them.
2. Disconnect. On a computer, turn off Wi-Fi and Bluetooth, and disconnect other networks, devices and external storage.
3. Scan. Check antivirus is on and its signatures are up to date (ASD names Microsoft Defender on Windows 10/11 and XProtect on macOS), then run a full scan.
4. Reset if signs remain. Back up important data and check the backup isn’t infected, never connecting it to the infected device. ASD describes a factory reset for phones and tablets, and wiping and reinstalling the operating system for computers, then restoring only data believed to be clean.
5. Change passwords on a clean device. ASD lists cloud storage, email, social media, online banking and business accounts as the most important, and describes turning on multi-factor authentication wherever it’s supported.
6. Report through ReportCyber, and to Scamwatch if a scam was involved.
7. Get help from the ACSC 24/7 hotline, 1300 CYBER1 (1300 292 371), or an IT professional.

ASD’s page has separate steps for phones and computers; this is a summary.

If someone may be monitoring a device (stalkerware)

Stalkerware is different from ordinary malware because the person who installed it may notice when it is removed. 1800RESPECT says that changing device or account settings to regain control “could be unsafe”, and suggests making a safety plan first. It also notes that some people choose to use a new device for private conversations.

eSafety’s guide for frontline workers lists signs to document, such as apps the person doesn’t remember downloading, a battery draining faster than usual, a slower device and unexplained spikes in data use. It notes that any of these can have other causes.

1800RESPECT’s own site lists its phone line as 1800 737 732 and its text number as 0458 737 732, both 24 hours a day, 7 days a week. In an emergency, call 000.

Things to watch for

• Fake virus warnings. Pop-ups that claim a device is infected and give a phone number are often scams. See remote access scams.
• “Cleaner” apps from ads. ASD lists online ads as a source of malicious downloads.
• Turning protection off. Microsoft says: “While real-time protection is off, files you open or download won’t be scanned for threats.”
• Backups on an infected device. ASD warns against connecting backups to a device that may still be infected.

Common questions

How do I know if my computer has malware?

No single sign proves it, but ASD lists signs that a device may have malware. They include logins from unusual places, a device running slowly or overheating, new programs or toolbars nobody installed, the browser opening unexpected pages, and pop-ups urging a download. Old hardware, a full disk or a buggy update can cause similar symptoms. See warning signs ASD lists.

How can I tell if my phone has spyware?

There’s no single test. The signs ASD and eSafety describe include apps the owner doesn’t remember installing, faster battery drain, slowness, unexplained spikes in data use and someone knowing things only the device would show. eSafety notes that any of these can have other causes. On iPhone, Apple describes checking VPN & Device Management for unknown profiles. See iPhone and iPad: profiles and sharing.

How do I remove malware from my computer?

ASD’s recovery steps start with not typing passwords on the device and disconnecting it from networks, then running a full scan with up-to-date antivirus. If signs remain, ASD describes backing up important data and wiping and reinstalling the operating system. On Windows, Microsoft describes full and offline scans in the Windows Security app. See what ASD says to do if a device is infected.

Does Windows have built-in antivirus?

Yes. Windows includes Microsoft Defender Antivirus in the Windows Security app. Microsoft says its real-time protection “continuously monitors your device for potential threats”, and the app offers quick, full, custom and offline scans. For when a paid product adds something, see the antivirus software guide. The steps are under Windows: Microsoft Defender Antivirus.

Can a Mac get malware?

Yes. ASD’s recovery steps cover macOS, and ASD says Macs come with antivirus software called XProtect pre-installed. Apple’s Mac User Guide describes a setting that controls where apps can come from, and says of the App Store option: “This is the most secure setting to protect your system from malware.” See Mac: app sources and built-in protection.

What do I do if I think someone has put spyware on my phone?

1800RESPECT says changing device or account settings to regain control “could be unsafe”, and suggests making a safety plan first. It notes some people choose to use a new device for private conversations. 1800RESPECT’s phone line is 1800 737 732 and its text number is 0458 737 732, both 24/7. In an emergency, call 000. See if someone may be monitoring a device.

Where to get official help

• ASD’s ACSC: Recover from malware and the 24/7 hotline 1300 CYBER1 (1300 292 371).
• ReportCyber at cyber.gov.au, and Scamwatch at scamwatch.gov.au/report-a-scam.
• IDCARE: 1800 595 160 (individuals), 1800 595 170 (small business).
• 1800RESPECT: 1800 737 732, 24/7. Emergency: 000.