# How do you clean a computer after a phishing click?

A network tool cannot clean a device; that is the job of your endpoint protection and, when in doubt, a reinstall. A practical order: disconnect the device from the network but keep it powered on, so IT can capture evidence if needed. Run a full scan with your endpoint detection and response (EDR) or antivirus tool, and check for new programs, browser extensions, scheduled tasks and startup items. If anything suspicious ran, or the device belongs to an administrator or someone in finance, the safer choice is to wipe it and reinstall from a known-good image, then restore files from backup, rather than trust a cleanup. Before reconnecting, change the user's passwords from another device. Once it is back, keep an eye on its network behaviour for a few weeks: NetSenX can show whether it starts regular outbound connections or unusual traffic again.

FAQ: [Phishing and e-mail aftermath](https://netsenx.com/en/faq/phishing) · https://netsenx.com/en/faq/how-to-clean-a-device-after-a-phishing-click

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/what-is-ndr

## Related questions

- [After a phishing click, how do attackers get from one laptop to the rest of the network?](https://netsenx.com/en/faq/how-attackers-move-from-a-phished-laptop-to-the-network)
- [Should employees report a phishing e-mail even if they did not click it?](https://netsenx.com/en/faq/should-employees-report-phishing-they-did-not-click)
- [Does security awareness training stop phishing?](https://netsenx.com/en/faq/does-security-awareness-training-stop-phishing)
- [What is spear phishing?](https://netsenx.com/en/faq/what-is-spear-phishing)
- [What are smishing and vishing?](https://netsenx.com/en/faq/what-is-smishing-and-vishing)