How to Remove Trojan From Windows 10 Safely

This guide walks you through removing a trojan from a Windows 10 PC using built-in tools and a few free utilities. A trojan is malware disguised as a legitimate file; once executed, it can steal data, install more malware, or give an attacker remote control. You’ll learn how to disconnect from the internet, run offline scans, delete stubborn files, and restore your system to a clean state. Before starting, back up important personal files to an external drive or cloud service—but do not back up program files or anything you suspect is infected.

What You’ll Need

Another device (phone or second computer) to download tools and look up instructions if your PC becomes unusable.
An external USB drive (at least 16 GB) if you need to create a bootable rescue disk.
Your Windows 10 installation media or access to the “Reset this PC� recovery options (built-in).
Patience—some scans take hours.

Step-by-Step

Disconnect from the internet. Unplug the Ethernet cable or turn off Wi-Fi. This stops the trojan from sending data out or downloading more payloads.
Boot into Safe Mode with Networking (if you need internet for scans) or plain Safe Mode. Click Start > Power, hold Shift, and click Restart. Choose Troubleshoot > Advanced options > Startup Settings > Restart, then press 4 or F4 for Safe Mode, or 5/F5 for Safe Mode with Networking. If the PC won’t boot normally, force restart three times to trigger the recovery menu.
Open Windows Security (built-in antivirus). Go to Settings > Update & Security > Windows Security > Virus & threat protection. Click “Scan options� and choose “Microsoft Defender Offline scan.� This runs before Windows fully loads, which catches trojans that hide from normal scans. Click “Scan now� and let it restart and scan—this can take 15 minutes to over an hour.
Run a full scan with Windows Security. After the offline scan finishes and you’re back in Windows, open Windows Security again, click “Scan options,� choose “Full scan,� and run it. This checks every file and program on the drive.
Use a second opinion scanner. Download Malwarebytes Free (from the official site) on a clean device, transfer it via USB, install it, and run a “Threat scan.� Malwarebytes catches trojans that Windows misses. Update it first if it asks.
Check startup programs and scheduled tasks. Press Ctrl+Shift+Esc to open Task Manager. Go to the “Startup� tab and disable anything you don’t recognize. Also open Task Scheduler (type “Task Scheduler� in Start) and look under “Active tasks� for suspicious entries—right-click and disable or delete anything with random names or odd paths like C:\Users\Public or Temp folders.
Remove suspicious files manually (only if you’re confident). If scans flag specific files but can’t delete them, restart in Safe Mode and delete them from File Explorer. Right-click the file, choose Properties, and note the path. In Safe Mode, navigate there and press Shift+Delete. If the file is locked, use the “Take ownership� option in Properties > Security > Advanced, then try again.
Clear temporary files and browser data. Trojans often hide in Temp folders. Type “Disk Cleanup� in Start, select your drive, check “Temporary files� and “Temporary Internet Files,� and clean. In your browser, clear cache, cookies, and saved passwords—the trojan may have stolen them anyway.
Change your passwords. After the trojan is removed, change passwords for email, banking, and social media from a clean device. Enable two-factor authentication where possible.
Run a final full scan. Do one more Windows Security full scan and one Malwarebytes scan to confirm nothing remains.
If the trojan persists, reset Windows. Go to Settings > Update & Security > Recovery > “Reset this PC.� Choose “Remove everything� and then “Change settings� to enable “Clean data?� (this overwrites the drive, making recovery harder for malware). This reinstalls Windows and removes all installed programs—back up personal files first.

Common Mistakes

Staying online during the scan. The trojan can re-infect you or send your data while you scan.
Only running a “Quick scan.� Quick scans miss trojans buried in system folders or registry entries. Always run Full and Offline scans.
Deleting system files by mistake. Don’t delete anything from C:\Windows unless a reputable scanner specifically names it as malware.
Ignoring the “Quarantine� option. Deleting a file outright can break a legit program if the scanner misidentifies it. Quarantine first, test your system, then delete after a week.
Reusing the same passwords after cleanup. The trojan may have already stolen them.

Tips

Keep Windows Update on automatic—patches close the holes trojans use.
Use a standard (non-admin) account for daily work. Trojans run with your permissions, so an admin account gives them more power.
Enable “Controlled folder access� in Windows Security > Virus & threat protection > Ransomware protection. It blocks unauthorized apps from changing your documents.
Download software only from official vendor sites. Cracked or “free� versions of paid apps are a top trojan source.
After cleanup, review your browser extensions and remove any you didn’t install.

Troubleshooting

Windows Security won’t run or is disabled. Some trojans disable the antivirus. Restart in Safe Mode with Networking and run Malwarebytes first. If Windows Security still won’t start, run “sfc /scannow� in an elevated Command Prompt (Start > type “cmd� > right-click > Run as administrator).
The trojan comes back after a scan. It’s likely hiding in a system restore point or a boot sector. Disable System Restore (right-click This PC > Properties > System Protection > Configure > Disable), then run the offline scan again. Also check for a second user account the trojan created—Settings > Accounts > Family & other users.
You can’t boot into Windows at all. Use the Windows 10 installation USB to boot, choose “Repair your computer,� then Troubleshoot > Advanced options > Startup Repair. If that fails, use “Reset this PC� from that menu, choosing “Remove everything.�
Files are encrypted with a ransom note. This is ransomware, not just a trojan. Do not pay. Restore from backups, or use the free decryptors listed on the No More Ransom project website (check with a clean device).
Your browser redirects to ads even after scans. The trojan may have changed proxy settings. Go to Settings > Network & Internet > Proxy and turn off “Use a proxy server.� Reset your browser to default settings.

Frequently Asked Questions

Can a trojan survive a Windows reset?
Yes, if it’s in the boot sector or firmware, or if you chose “Keep my files.� Choose “Remove everything� with “Clean data� enabled to overwrite the drive.

Is Windows Defender enough to remove a trojan?
Usually yes, especially with the Offline scan. Adding Malwarebytes gives a second detection engine and catches more.

How did I get a trojan?
Most commonly from email attachments, fake downloads, pirated software, or malicious ads. Trojans often arrive disguised as invoices, PDFs, or installer files.

Should I pay a ransom if a trojan encrypts my files?
No. Paying funds criminals and doesn’t guarantee decryption. Restore from backups or try free decryptor tools.

How long does a full scan take?
On a typical hard drive, 1–3 hours. On an SSD, 30–60 minutes. Let it finish—stopping early leaves malware behind.

Do I need to reinstall Windows after removing a trojan?
Not always. If scans come back clean and your system behaves normally, you’re likely fine. If you notice odd behavior later, do a clean install.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →