Malware that specifically targets personal devices is growing more common and more dangerous. According to Moonlock Lab’s 2025 macOS threat report, there’s been a 67% increase in registered backdoors and a 17% increase in info stealers compared to 2024.
So, with such threats on the rise, how can you make sure your Mac is ever fully clean? Does a factory reset really remove all viruses and malware? In this guide, we’ll help explain what resetting your device does, when it might not be the correct path, and what to do instead.
What happens when you perform a factory reset?
Does a factory reset remove malware? To answer that question, we first need to understand what a factory reset is and what happens when you do one.
A factory reset completely wipes all of the contents of your iPhone or MacBook and puts everything back the way it was when it first rolled out of the factory. In other words, the result is a completely clean device with freshly reinstalled apps.
By wiping everything, a factory reset will remove all viruses and malware from the device. However, this solution isn’t foolproof. A factory reset can’t remove firmware-level threats or rootkits installed on your Mac. Those will remain and attack your device again even after the reset is complete.
In the past, returning your Mac to fresh-out-of-the-box condition was a long, drawn-out process. But with newer Macs, a factory reset is much quicker and painless.
Can a factory reset get rid of malware from your device?
Will a factory reset erase everything? No, unfortunately, you can’t count on a factory reset to remove all malware.
A factory reset will eliminate most malware. Garden-variety threats like trojans, spyware, or adware will be cleansed from your machine. But other types of malware can be more deeply rooted. If, for example, you have malware in the firmware or rootkit of your MacBook, a factory reset probably won’t remove it.
Firmware- or rootkit-level malware usually resides deep inside the operating system. They can be in the boot process or within modified firmware. For example, Thunderstrike 2 was a 2015 proof-of-concept Mac firmware worm. Its persistence proved that malicious code could survive disk wipes and macOS reinstallation. Such threats can infect your device from compromised apps, drive-by downloads, or malicious attachments.
It is entirely possible that the malware was even preinstalled by a hacker who then sold the laptop to you. You could also be the target of a government (in which case, it might be quicker and safer to smash the laptop and walk away).
Before we move on, keep in mind that MacBooks are notoriously locked down, making it difficult to access the deepest parts of the system. And remember that Macs can get viruses, despite what Apple enthusiasts will insist on telling you.
Persistent firmware malware may require Apple Support to revive or restore the Mac’s firmware. A typical factory reset or antivirus software won’t be enough. Instead, it’s better to take a few extra minutes and use antimalware software that detects threats before they get lodged deep into your device.
Try Moonlock, which combines regular device scans with Apple’s built-in security features to keep your device safe from harm. You can also set Moonlock’s Malware Scanner to run scheduled Quick, Balanced, or Deep scans, allowing it to monitor your device around the clock for threats.
How can a virus return after a factory reset?
As we said previously, performing a factory reset to get rid of a virus will be effective in the majority of cases. The process will remove most malware and viruses.
If you’ve tried a factory reset and the virus or malware is still present, there are some possible reasons why your MacBook factory reset wasn’t effective.
You have firmware-level malware
If you have firmware-level malware, a factory reset won’t be enough to remove spyware, virus, or malware in general. Some types of malware can persist in the Master Boot Record, Volume Boot Record, or UEFI/firmware. These are all areas that a standard, user-initiated factory reset doesn’t rewrite. A professional, however, is able to reflash the device’s firmware or replace the affected hardware altogether.
Infected external or peripheral devices
Even a freshly reset Mac can become infected immediately after if its environment isn’t clean. If you connect to a compromised Wi-Fi router, printer, webcam, or USB device, your Mac will get infected again.
Infected Time Machine backups
The most common reason is that your Time Machine backup contains the malware. When you restore your MacBook with the infected backup, you end up restoring the malware as well.
The malware is in your iCloud account
If your backup is stored in iCloud, the malware could also be there. Even a factory reset of your MacBook won’t work if iCloud simply syncs the malware back to your computer and any other connected devices.
Infected apps
If the malware entered your MacBook through a malicious app, reinstalling that app is going to reinstall the malware, too. It’s not just apps — this can happen with browser extensions or cracked software from pirate download sites.
Will a factory reset eliminate hackers from my device?
A factory reset will remove any malware and system changes that a hacker made on your device, essentially reversing their damage. However, the method they used to gain access to your device may remain a threat.
A factory reset is a simple way to get rid of 99% of malware; however, we should never assume that firmware-level infections cannot survive it.
Mykhailo Pazyniuk, Malware Analyst at Moonlock
If, for example, a hacker took advantage of a Mac vulnerability or installed a rogue app, then that will be fixed with a factory reset. But if they gained access through a weakness in your network, a factory reset of your device isn’t going to fix the problem. The malware may be removed, but further action will need to be taken to ensure that the incident isn’t repeated.
Here are a few steps to take:
- Change your accounts and Apple ID passwords from a clean device.
- Enable 2-factor authentication wherever it’s available.
- Sign out of all active sessions you don’t recognize.
- Update your Wi-Fi router’s password and firmware.
- Check all connected devices for malware.
- Remove unknown and unused apps and browser extensions.
- Review account recovery details for recent changes.
- Monitor your bank and email for suspicious activity.
How to factory reset your Mac to remove a virus
As we just mentioned, the Mac factory resetting process has become much easier on modern Macs. So, if you think it’s the best option to ensure the safety of your device, it may be worth it.
First, make sure you disable Find My and FileVault on the Mac or MacBook. Also ensure that you have the activation codes for any software you want to reinstall after the rest is complete. Additionally, save the 2FA keys or QR codes needed to recover one-time passwords in apps such as Google Authenticator.
A word of caution: If you aren’t sure where the virus or malware came from, you may be better off restoring your Mac from a backup. And be careful about which files you plan to reinstall manually. You don’t want to inadvertently put a virus back onto your freshly reset computer.
On Macs running macOS Monterey or later, you can use Apple’s built-in Erase Assistant. It provides a guided alternative to manually erasing your device’s drive in Disk Utility, walking you through the steps necessary to remove accounts, settings, apps, and restore personal data before installing the system.
To factory reset your Mac, simply do the following:
- Go to System Settings > General > Transfer or Reset.
- Click Erase all Contents and Settings.
To use Apple’s Erase Assistant, click on the Apple icon in the top left corner of your screen, then System Preferences.
- From the drop-down menu, click Erase All Content and Settings…
- In the new window, click Continue,
- then Erase All Content & Settings in red.
After you enter your administrator password, the Mac will begin the process of wiping itself. Make a cup of coffee and wait.
Once the process has finished, do not restore from iCloud unless you know for sure when the virus entered your machine and you have a backup dated before that time.
Factory Reset Assistant failed? Here’s how to manually factory reset your Mac
If you want to easily and quickly reset your Mac, you can use the built-in Factory Reset Assistant. However, there are several scenarios in which this tool might not work.
Here are some cases when Factory Reset Assistant may not work:
- Not signed in as an administrator
- Forgetting to turn off FileVault or iCloud
- The Mac is company-owned (Remote Management will stop you)
- Forgetting to deactivate Activation Lock
- Corrupt system files or a damaged hard disk on the Mac
If running Factory Reset Assistant isn’t an option, the only way to remove a virus is to carry out a factory reset using Recovery mode. This will manually erase the hard drive and reinstall macOS.
If you factory reset your Mac, don’t use an iCloud backup unless you are certain that the backup is free of malware.
To access the recovery menu, you first need to verify the type of MacBook you have.
Go to the Apple menu and select About This Mac. Look at the Chip category. If you see the letters M1, M2, M3, or M4, you have an Apple Silicon Mac. If it says Intel, then you have an older Intel-based Mac. This is important to note because the process slightly differs depending on the type of Mac you have.
If you have an Apple Silicon Mac:
- Completely shut down your Mac.
- Restart by holding the power button, and don’t release your finger until you see “Loading startup options.”
- Click Options, then click the Continue button.
If you have an older Intel Mac:
- Restart the Mac.
- As soon as you begin the restart process, hold down the Command and R keys. Do not release your finger until the Apple logo appears.
In both cases, you will be taken into the Recovery menu. If you have locked down the firmware, you will need a password to remove that lock. If you don’t know the password, you cannot reset the system. The same goes for FileVault. If you’re unable to unlock it, you’re out of luck.
Once inside the Recovery menu, you can:
- Erase and reformat the hard drive using Disk Utility
- Reinstall macOS entirely
- Run commands on Terminal
- Access the Safari browser, which is useful if you need to make any Google searches
How can you reset your iPhone to remove a virus?
When all else fails, a factory reset is your last resort. By permanently deleting all files, clearing the cache, logging out of accounts, and restoring all settings to their default, you effectively remove all trojans, spyware, or viruses that might be hiding on your phone. It’s unfortunate that you might lose all data that wasn’t backed up before your iPhone got infected, but it’s necessary to fully clean your device.
Resetting your iPhone is also a quick and easy process. The same caveats apply — disable Find My, don’t restore it from a backup, and be cautious about what files you choose to reinstall. Otherwise, the process is rather simple:
- Go to the Settings app on your iPhone.
- Tap General, then Transfer or Reset iPhone.
- Tap Erase all Content and Settings (note that Reset will only change settings back to their defaults but won’t erase anything, including malware).
- If asked, enter your iPhone passcode.
- Tap Continue to confirm your choices.
When the process is complete, your iPhone will look and feel like a brand new phone straight from the factory.
What to do if the virus comes back after a factory reset
Once you perform a factory reset on your MacBook, the viruses and malware that were present on your machine will be gone. But what if lightning strikes twice, and you end up with a new virus or malware incident? Moonlock can help detect malware reintroduced through an infected data backup or a reinstalled app, ensuring your Mac doesn’t get reinfected.
Use Moonlock
Contrary to popular belief, Macs aren’t fully impenetrable and still need an antivirus solution, as the built-in security features can only do so much. The best and most efficient way to check for malware and viruses on your device is to use Moonlock for scanning and removal.
With features such as Real-time protection, you can rely on Moonlock to always keep an eye on your device, immediately notifying you when malware is detected. It’s a lightweight, fast, and powerful app that you can leave to run in the background at all hours of the day.
Once you sign up for a free trial, here’s what to do to check the health of your device:
- Open Moonlock, making sure it has all the access permission necessary for it to do its job.
- Navigate to the Malware Scanner tab in the left sidebar (look for the cool sunglasses icon). This opens the malware scan and removal tool.
- From the drop-down menu, select whether you’d like to run a Quick, Balanced, or Deep scan, then click Scan.
- Once Moonlock finds the malware that’s been bothering you, it’ll immediately put all infected files in Quarantine, isolating them from the rest of your device.
- In Quarantine, you’ll get the chance to inspect the infected files and select them for safe removal.
This only takes a couple of minutes, and it doesn’t take long when you conduct regular scans, keeping your device clean at all times.
Analyze where the viruses and malware are coming from
Getting a virus or malware once could be put down to bad luck. But if it happens a second time, maybe you have an unplugged gap in your defenses.
Here are a few actions to increase your cybersecurity on your Mac:
- Check to see if a macOS update is waiting.
- Update all of your installed apps. Ensure that you know all of the apps and that there are no suspicious programs present.
- Look over your Wi-Fi network for vulnerabilities. Is it password-protected, for example? Is the firmware up-to-date?
- Check your other devices. Are all other devices on your network virus-free?
- Is your Mac Firewall turned on?
- Do you have FileVault enabled? This is to stop anyone from accessing your data without a password.
- Enable 2-factor or multi-factor authentication on your Apple ID, email, banking, and other sensitive accounts.
- Review browser extensions, login items, and connected devices to remove anything unfamiliar or unused.
- Change important passwords while using a known, clean device and sign out of any unknown or old sessions.
You don’t need to worry about keeping track of all the necessary security configurations, looking up guides on how to manually enable or disable a feature in your settings.
Moonlock’s System Protection combs through all the built-in security settings and tools from Apple, simplifying the steps you need to take for optimal security and privacy.
What types of malware can survive a factory reset, and which can’t?
Will a factory reset remove ransomware, spyware, or a virus? The success rate of a factory reset cleaning your Mac will depend on the type of malware and where it’s stored:
- Viruses, adware, most spyware, and keyloggers: A standard factory reset can successfully remove the majority of these. Usually, these varieties of malware hide within compromised apps and user data, both of which a factory reset wipes completely.
- Ransomware: The ransomware itself can usually be removed with a simple factory reset. However, it won’t restore any of the files it has already encrypted, and you’ll need to restore those from a clean backup.
- Kernel-level rootkits: Most firmware-linked and kernel-level variants persist following a device factory reset. Depending on the specific infection, you might need something more advanced to remove it fully.
- Boot-sector and UEFI/firmware malware: These threats are nearly impossible to remove with a simple factory reset, and they’re likely to survive reformatting or macOS reinstallation. This is because they reside outside ordinary system storage and aren’t affected by file deletion.
Essential tips for safeguarding your MacBook against viruses
To avoid having to deal with MacBook viruses ever again, here are some tips to help you practice better security.
Never click on links from uncertain sources
If someone who you don’t know or someone you don’t completely trust sends you a suspicious email link or SMS link, don’t click it. It could lead to a malware-infected website or download a malicious file.
Put a strong password on your Wi-Fi network
Anyone looking to break into your Wi-Fi network is going to have an easy time of it if there’s no password blocking their way. Always put a very strong password on your network so only authorized visitors can get in.
And while we’re on the topic, don’t give your network a name that makes it obvious that it’s yours. If a hacker is specifically looking for you, a network with your name on it is like opening the door and waving them in.
Enable a VPN
It verges on impossible for a hacker to monitor your internet traffic if that traffic is being diverted through an encrypted VPN tunnel. That’s why using Moonlock’s VPN is a strong component of ensuring that viruses and malware are a thing of the past.
A VPN will block your real IP address and send everything through an encrypted server, bypassing anyone who may be attempting to eavesdrop on what you’re doing. It’s one of the best cybersecurity investments you’ll ever make.
Put a password on your Mac screen
A hacker doesn’t always need digital access to your Mac. They could simply sit in front of it and introduce malware directly. You only need to turn your back for 5 minutes.
Always make sure your Mac has a password to unlock the screen, and make sure you go to the lock screen before you leave the Mac unattended.
Only install apps from the Apple App Store
Another tried and true method for hackers is tricking you into installing compromised apps.
Anything that is in the Apple App Store for macOS or iOS has been vetted by Apple, examined for malware, and verified. However, while the App Store significantly reduces the risk, there have been rare cases of malicious apps slipping through. So you can be mostly assured that if you only download from there, you’ll generally be OK.
Keep your macOS and apps updated
There’s never any guarantee that your Mac will remain vulnerability-free. This is why Apple regularly pushes out updates. The same goes for apps. Developers bring out updates to squash bugs and seal up security holes.
Don’t be lackadaisical about this. Installing updates and patches is a very important part of Mac security. Check for new updates regularly or turn on the Automatic Updates option.
When you want to kill a virus or erase malware, the simplest and fastest solution is to wipe and factory reset your machine. Moonlock antivirus will detect and remove viruses and malware itself, but for peace of mind, resetting your device is the next best thing to do.
This is an independent publication, and it has not been authorized, sponsored, or otherwise approved by Apple Inc. Mac, MacBook, macOS, iPhone, and iOS are trademarks of Apple Inc.
