Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Start with safety, not deletion. Spyware can monitor messages, email, location, photos, passwords, or browsing. If an abusive partner or ex-partner might be involved, assume that removing it could alert them or destroy evidence. Use a different trusted device for help, preserve evidence first, and avoid signing in to sensitive accounts on the suspect device. For ordinary malware, disconnect from sensitive work, update the device’s security tools, run a full scan, then change passwords and enable two-factor authentication from a clean device.
What spyware is—and why removal is different
Google defines malware as “harmful software that’s installed on your device without your knowledge.” The Federal Trade Commission (FTC) describes spyware, also called stalkerware, as software or an app that someone installs on a phone or other device without the owner’s knowledge. It may capture location, messages, email, photos, videos, keystrokes, or online activity, and some products allow remote control.
There are two different problems to distinguish:
- Ordinary malware: unwanted software installed through a malicious download, attachment, website, fake update, or compromised account. The priority is containment, scanning, cleanup, and account recovery.
- Stalkerware: monitoring software potentially installed by a partner, ex-partner, family member, or other person with physical access. The priority is personal safety, evidence preservation, and a controlled replacement or reset.
Symptoms alone cannot prove spyware. Battery drain, crashes, or a person knowing private information can have innocent explanations. Treat several signs together as a reason to investigate without confronting a suspected abuser from the monitored device.
Warning signs on a phone
- Battery life suddenly becomes much worse, even though your usage has not changed.
- Mobile-data use rises unexpectedly; check which app is responsible rather than relying on the total.
- The phone becomes hot while idle, restarts without explanation, or shows unusual slowdowns.
- An app you do not remember installing appears, or a familiar app has unusually broad permissions such as location, microphone, accessibility, notifications, or device administration.
- Another person knows your exact location, private conversations, searches, or photographs without an obvious explanation.
- Unknown Bluetooth-tracker alerts or repeated location notifications appear.
None of these signs is conclusive. A failing battery, poor cellular signal, legitimate cloud synchronization, or an operating-system update can produce similar behavior.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Warning signs on a Windows PC, Mac, or browser
- Persistent pop-ups, redirects, a changed homepage or search engine, or new toolbars and extensions.
- Sluggish performance, freezes, crashes, repeated system errors, or high processor, memory, disk, or network activity while idle.
- Task Manager on Windows or Activity Monitor on Mac is disabled, closes unexpectedly, or shows an unfamiliar process that returns after termination.
- Security software, updates, or firewall settings are disabled without your action.
- Messages, posts, or emails are sent from your accounts when you did not send them.
- Browser extensions return after removal, or you are repeatedly signed out of accounts.
Google’s malware-removal guidance specifically lists unwanted extensions, changed search settings, redirects, pop-ups, slow or malfunctioning devices, and unexpected security sign-outs as indicators to investigate.
Do this first if abuse or stalking may be involved
Do not investigate, call an advocate, contact law enforcement, or change passwords from a potentially monitored phone or computer. Use a friend’s device, a library computer, or a newly purchased phone that the suspected person cannot access. A sudden reset can erase location history, messages, screenshots, or other evidence and may warn the person monitoring you.
- Assess immediate danger. If you believe physical harm is possible, prioritize a safe place and local emergency or domestic-violence services. Do not announce your plan on the suspect device.
- Preserve evidence before changing anything. Photograph or export relevant messages, account alerts, app listings, permission screens, and device information using a safe device or camera. Keep original files and record dates and times.
- Secure a separate communication channel. Create or use an account unknown to the suspected person. Avoid syncing it to the old device.
- Plan replacement or reset. The FTC advises considering a new phone or a full factory reset. Do not restore a complete device backup when stalkerware is suspected; it can reinstall the monitoring app.
- Get specialist help independently. Contact the manufacturer, a domestic-violence advocate, or a reputable technician using contact information obtained on a trusted device—not a phone number shown in a pop-up.
How to check and clean a Windows PC
1. Stop exposing sensitive information
Until you finish checking, avoid entering banking, email, password-manager, health, or work credentials on the suspect computer. If possible, disconnect it from the internet after saving evidence; do not use an infected computer to change the passwords protecting your other devices.
2. Update Microsoft Defender
- Open Windows Security.
- Select Virus & threat protection.
- Under Virus & threat protection updates, choose Check for updates so the security intelligence is current.
Microsoft says Defender can block malware, notify you, and try to remove it when possible. Its anti-malware protection is also available for Mac and Android in supported configurations.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
3. Remove software you do not need
Open Settings > Apps > Installed apps (the wording can vary by Windows release). Sort by installation date and investigate programs you do not recognize. Search the publisher and file name from a clean device before removing anything that could be a business, accessibility, driver, or security component. Uninstall suspicious software, restart, and check whether the symptom returns.
4. Run a full scan
- Open Windows Security > Virus & threat protection > Scan options.
- Select Full scan and start it. A full scan can take considerably longer than a quick scan.
- Quarantine or remove detections, restart when prompted, and run another scan to confirm the result.
5. Use Microsoft Defender Offline when malware persists
Choose Windows Security > Virus & threat protection > Scan options > Microsoft Defender Offline scan. Save work first: Windows restarts and scans before the normal desktop loads, which can prevent persistent malware from hiding. Review the result in Protection history after Windows starts.
6. Check the browser
Remove extensions you did not install, restore a trusted homepage and search engine, clear notification permissions for unknown sites, and update the browser. If an extension returns, scan again and check whether another program or managed policy is reinstalling it.
Free tools Windows power users keep installed
One-click scans. No signup required.
How to check and clean a Mac
Review software and extensions
Open Applications and remove software you do not recognize after verifying that it is not required by your employer or a hardware driver. In each browser, review extensions, notification permissions, homepage, search engine, and site permissions. Remove untrusted items and restart.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Update macOS and account security
Install the latest available macOS and browser updates through Apple’s normal update mechanism. Review System Settings for unfamiliar users, login items, profiles, remote-management settings, and sharing services. Check Apple Account devices and sign out of anything you do not recognize.
Erase and reinstall if compromise remains likely
If unsafe software keeps returning or account access remains unexplained, back up only trusted personal files—documents, photographs, and videos you have checked—and erase and reinstall macOS using Apple’s current instructions. Do not copy unknown applications, installers, browser extensions, scripts, or configuration profiles into the clean installation. Afterward, update macOS before restoring files and reinstall software only from trusted sources.
How to check an Android phone
Review apps and permissions
- Open Settings > Apps (the exact label differs by manufacturer) and sort by recently installed or recently used.
- Remove apps you do not recognize. If an app cannot be uninstalled, check whether it has device-administrator or accessibility control; revoke that control first if it is safe to do so.
- For unfamiliar apps, open Permissions and inspect location, microphone, camera, contacts, SMS, phone, files, notifications, and accessibility access.
- Install Android system and security updates, then restart.
Use unwanted-tracking detection
Apple’s safety guidance states that Android 6.0 and later provides unwanted-tracking detection. Earlier devices may need an update or Google’s Tracker Detect app. Investigate unknown Bluetooth-tracker alerts separately from app spyware: a tracker can follow a person even when no malicious app is installed.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Reset when removal cannot be trusted
If stalkerware cannot be confidently removed, preserve evidence first and perform a factory reset. An Internet Crime Complaint Center (IC3) advisory describes a factory reset as the only way to ensure permanent removal of a mobile spyware app. The reset erases local data, so plan a safe backup and reinstall carefully rather than restoring the entire phone image.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
How to check an iPhone or iPad
Update and inspect access
Install the latest available iOS or iPadOS update. Review unfamiliar apps, Apple Account devices, trusted phone numbers, recovery methods, and sharing settings. Check whether someone else is signed in to the Apple Account or has access through Family Sharing, location sharing, or device-management settings.
Respond to tracker alerts
Apple documents AirTag and Find My alerts on iOS/iPadOS 14.5 or later, and unknown Bluetooth-tracker detection on iPhone with iOS 17.5 or later. Follow the alert’s identification and disablement instructions, and document the alert before removing a tracker if doing so is safe and evidence matters.
Reset only after safety planning
If abuse is suspected, preserve evidence before erasing the device. A reset may remove local spyware but will not secure an account that the other person still controls. Change account credentials from a trusted device and review signed-in devices before setting up the iPhone or iPad again.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Cleanup versus a factory reset
| Approach | Best use | What it does | Main risk or limitation |
|---|---|---|---|
| Built-in scan and manual removal | Ordinary malware with a clear detection | Updates signatures, finds malicious files, quarantines software, and removes unwanted apps or extensions | Can miss deeply persistent or intentionally hidden monitoring; symptoms may return |
| Independent technician or manufacturer support | Inconclusive scans, unusual account behavior, or high-value devices | Provides device-specific diagnosis and recovery guidance | Use independently obtained contact details; a compromised device may display fraudulent support numbers |
| Factory reset or operating-system reinstall | Mobile stalkerware that cannot be confidently removed, or persistent compromise | Erases local apps and data and installs a clean operating system | Deletes local files, may destroy evidence, and can reintroduce spyware if a complete backup is restored |
| New phone or computer | Credible stalking risk or a device whose integrity cannot be established | Creates a clean starting point when configured safely | Accounts, SIM/eSIM access, cloud backups, and shared recovery methods still need to be secured |
Back up safely before resetting
Back up irreplaceable files to a secure external hard drive or vetted cloud service before a reset. CISA recommends encrypted backups and secure storage. Use a backup made before the suspected infection only for personal files you can inspect; do not restore applications, installers, browser extensions, configuration profiles, or a full phone image when stalkerware is possible.
Best Value
- High capacity in a small enclosure – The small, lightweight design offers up to 6TB* capacity, making WD Elements portable hard drives the ideal companion for consumers on the go.
- Plug-and-play expandability
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
- Photographs and videos: copy only files you recognize and open them from the backup to verify they are intact.
- Documents: scan files on a clean computer before opening macros, scripts, or installers.
- Contacts and calendars: export them separately if possible instead of restoring every device setting.
- Messages and evidence: preserve an immutable copy in a location the suspected person cannot access.
Secure accounts after cleanup
Use a trusted device—not the cleaned device until you are confident it is safe—to complete these steps:
- Change the email password first, because email often controls password resets for every other account.
- Change Apple, Google, Microsoft, banking, social-media, work, and password-manager passwords. Use unique passwords that were never entered on the suspect device.
- Enable two-factor authentication, preferably with an authenticator app or hardware security key when appropriate.
- Review recovery email addresses, phone numbers, passkeys, trusted devices, app passwords, forwarding rules, and active sessions. Remove anything unfamiliar.
- Run Google’s Security Checkup or the equivalent security review for each major account.
- Install operating-system, browser, and application updates before signing back in.
A reset does not undo an attacker’s access to an online account. Account recovery and session revocation are separate tasks.
Built-in tools or third-party scanners?
| Option | Advantages | When to choose it | Important caution |
|---|---|---|---|
| Built-in security tools | Already installed, integrated with the operating system, and less likely to introduce another unwanted program | First-line checks on Windows, Android, macOS, iPhone, and iPad | Keep the operating system and detection data current; a clean result is not proof that stalkerware is absent |
| Reputable third-party scanner | Can provide an additional detection engine or specialized analysis | Only after updating the operating system and checking the vendor independently from a trusted device | A fake “virus scan” pop-up can itself be malware; never call its displayed number or install its suggested tool blindly |
| Professional help | Useful when scans conflict, symptoms persist, or evidence and safety are important | Complex compromise, work devices, or suspected stalking | Use a manufacturer or technician contact obtained independently and explain the safety concern before handing over the device |
Common mistakes and how to avoid them
- Changing passwords on the suspect device: a keylogger may capture the new credentials. Use a trusted device instead.
- Deleting the suspicious app immediately: this can destroy evidence and alert an abuser. Document first when safe.
- Restoring the entire backup after a reset: it can reinstall the same app or configuration. Restore selected, verified files only.
- Trusting one symptom: battery drain and heat have many causes. Combine device, app, account, and physical-safety evidence.
- Calling a pop-up number: obtain support details from the manufacturer’s official site or documentation using another device.
- Ignoring account access: spyware removal does not revoke cloud sessions, forwarding rules, recovery methods, or shared location access.
- Resetting a work-managed device without approval: preserve evidence and contact your organization’s security team from a clean channel; a reset may violate retention requirements.
When to stop troubleshooting and get help
Contact the device manufacturer or a reputable technician from a separate trusted device when scans are inconclusive, software returns after removal, the device remains compromised, or you cannot safely identify what changed. The FTC specifically recommends the manufacturer or a trusted technical-support company. For suspected stalking, involve a qualified advocate before resetting if doing so will not increase danger. If you have evidence of account fraud, extortion, or unauthorized access, preserve it and use the appropriate local reporting channel.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsQuick Recap
A practical decision path
- Could someone close to you be monitoring you? If yes, switch to a trusted device, preserve evidence, and make a safety plan before deleting anything.
- Is the problem limited to pop-ups, redirects, or one suspicious download? Update security tools, uninstall the unwanted software, run a full scan, and check browser extensions.
- Does the detection return, or is account access unexplained? Revoke sessions and recovery access from a clean device, then seek professional help.
- Can you verify that the mobile device is clean? If not, back up only trusted files and factory-reset it; do not restore a complete backup.
- After recovery: update everything, reinstall only trusted apps, enable two-factor authentication, and monitor account and device behavior.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
