You discover your computer is infected with a virus. Common advice suggests immediately disconnecting from the internet. Unplug the network cable, turn off Wi-Fi—the idea is to buy time to remove the malware. But does this advice hold up? Is disconnecting your PC from the internet truly necessary or even beneficial? The answer isn’t straightforward.
Disconnecting your infected computer from the internet has two potential benefits. First, some malware, like Remote Access Trojans (RATs), can grant an attacker complete control over your system. Other types of malware might steal your personal data. Severing the internet connection can prevent further data exfiltration while you remove the threat.
Second, ransomware often not only encrypts your data but also uploads it to the attacker’s servers. They then threaten to publish this data if you don’t pay the ransom. A quick disconnect can prevent this data theft.
Avira Rescue SystemBootable rescue systems like Avira’s can find malware even if Windows won’t start.
However, most antivirus software performs significantly better with an active internet connection. This is because antivirus vendors maintain vast online databases of malware signatures (fingerprints of dangerous files). Some antivirus programs also rely on a file’s reputation—its origin and prevalence on other systems—which requires internet access for up-to-date information.
AV-Comparatives’ tests highlight the difference between online and offline scans. For instance, Avira detects 99.1% of malware online versus 92.5% offline. Microsoft Defender’s detection rate drops from 95.8% online to 77.0% offline, while McAfee’s plummets from 99.2% to 65.2%.
AV-ComparativesAntivirus software generally performs better with an internet connection.
These figures suggest performing a virus scan without internet access isn’t ideal. However, full system scans can take hours. If you suspect an infection, start with a quick scan, which typically completes within minutes. While the quick scan runs, download an updated second scanner onto a USB drive. A bootable rescue disk, like the Avira Rescue System, is a good choice. Restart your PC from the USB drive and perform a full scan.
If you still suspect malware persists, disconnecting from the internet for a deeper analysis can be prudent. This allows you to investigate without worrying about further data compromise.
