Remove Malware & Viruses on Windows PC: Step-by-Step

This guide walks you through removing malware and viruses from a Windows PC using built-in tools and a few free utilities. You’ll learn how to disconnect from the internet, boot into Safe Mode, run full scans, and clean up leftover files. No advanced skills are needed—just follow the steps in order.

What You’ll Need

A Windows PC (Windows 10 or 11 recommended)
Another device (phone or another computer) to download tools if needed
A USB flash drive (optional, for transferring tools)
Patience—full scans can take an hour or more

Step-by-Step

Disconnect from the internet. Unplug the Ethernet cable or turn off Wi-Fi. This stops malware from communicating with its command server or spreading to other devices.
Boot into Safe Mode. Restart your PC. As it reboots, press and hold the Shift key and click Restart from the power icon. Choose Troubleshoot → Advanced options → Startup Settings → Restart. After the restart, press 4 or F4 to enter Safe Mode (or 5/F5 for Safe Mode with Networking if you need internet for tools).
Open Windows Security. In Safe Mode, go to Start → Settings → Privacy & Security → Windows Security (or search “Windows Security” in the Start menu).
Run a full scan. Click Virus & threat protection → Scan options → select Full scan → click Scan now. Let it complete—this can take 30 minutes to several hours. If threats are found, Windows will list them; click Remove or Quarantine for each.
Run Microsoft Defender Offline scan (if full scan finds nothing). In Windows Security, go to Virus & threat protection → Scan options → Microsoft Defender Offline scan → Scan now. Your PC will restart and scan before Windows loads, catching deeply embedded malware.
Use a second opinion scanner. Download Malwarebytes (free version) from another device and transfer it via USB, or use Safe Mode with Networking to download it directly. Install and run a Threat Scan. Quarantine anything it finds.
Check startup programs. Press Ctrl+Shift+Esc to open Task Manager. Click the Startup tab. Look for unfamiliar programs with “Enabled” status. Right-click any suspicious entry and choose Disable. If you’re unsure, search the name online from another device.
Clear temporary files. Open Disk Cleanup (search in Start). Select your system drive (usually C:), click OK, then check Temporary files and Recycle Bin. Click OK to delete. This removes malware remnants and speeds up the system.
Reset browser settings. Open your browser (Edge, Chrome, Firefox). Go to settings and look for “Reset” or “Restore settings to original defaults.” This removes malicious extensions, homepage hijackers, and unwanted toolbars.
Update everything. After rebooting normally, run Windows Update (Settings → Update & Security → Windows Update) and install all pending updates. Update your browsers and any software you use regularly.
Change your passwords. From a different device, change passwords for your email, banking, and social media accounts. Use strong, unique passwords or a password manager.
Enable ransomware protection. In Windows Security, go to Virus & threat protection → Manage ransomware protection → turn on Controlled folder access. This blocks unauthorized apps from modifying your documents.

Common Mistakes

Running a scan while connected to the internet. Malware can hide or fight back if it’s online. Always disconnect first.
Skipping Safe Mode. Many viruses won’t load in Safe Mode, making them easier to remove. Running scans in normal mode may miss them.
Only using one scanner. No single tool catches everything. A second opinion scanner like Malwarebytes catches what Windows misses.
Ignoring browser extensions. Even after a clean scan, a malicious extension can re-infect your browser. Reset browser settings.
Not backing up important files. If malware corrupts files, you may lose data. Back up to an external drive or cloud before starting (if you can do so safely).

Tips

Use an external drive for backups. If your PC is infected, backing up to the same drive won’t help. Use a USB drive or cloud service (from another device).
Keep Windows Defender always on. It’s built-in and effective. Don’t disable it unless you’re installing a third-party antivirus.
Enable automatic updates. Regular updates patch security holes that malware exploits.
Be cautious with email attachments and downloads. Most infections come from phishing emails or fake downloads.
Use a standard user account. Admin accounts give malware more power. Use a standard account for daily tasks.

Troubleshooting

If Windows Security won’t open or scan: Restart in Safe Mode and try again. If it still fails, download Malwarebytes AdwCleaner (free) and run it—it targets stubborn malware that blocks security tools.

If your PC is still slow after removal: Some malware leaves behind corrupted system files. Run sfc /scannow in an elevated Command Prompt (Start → type “cmd” → right-click → Run as administrator). This repairs Windows system files.

If malware returns after reboot: You may have a rootkit. Use Microsoft Defender Offline scan again, or create a bootable rescue disk (like Kaspersky Rescue Disk) on another PC and boot from it.

If you can’t boot into Safe Mode: Use Windows Recovery Environment (WinRE). Restart your PC 3 times, interrupting during boot. Choose Advanced options → Startup Settings → Restart → press 4.

If you lose important files: Try restoring from a backup. If no backup exists, some files may be recoverable with free tools like Recuva, but success isn’t guaranteed.

Frequently Asked Questions

Can I remove malware without Safe Mode?

Yes, but it’s harder. Many viruses hide from scanners when Windows is fully loaded. Safe Mode prevents them from starting, so removal is more effective.

Is Windows Defender enough?

For most users, yes. Windows Defender is a solid antivirus. However, adding a second scanner like Malwarebytes for periodic checks is a good extra layer.

Will I lose my files when removing malware?

Usually not. Quarantining or deleting malware won’t touch your personal files. However, some ransomware encrypts files, making them unrecoverable without backups.

How do I know if my PC is infected?

Common signs: sudden slowdowns, pop-up ads, browser homepage changes, unknown programs starting, or high network activity. Run a full scan if you notice any.

What if the malware is a ransomware that locked my files?

Do not pay the ransom. Disconnect the PC, and try restoring from backups. Some ransomware has free decryption tools—search for the specific ransomware name from another device.

Should I reinstall Windows to be safe?

If removal steps don’t work or you want absolute certainty, a clean install (reset Windows) is the most reliable option. Back up your files first, then use Settings → Update & Security → Recovery → Reset this PC.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →