How to Remove Malware From Windows

How to remove malware from Windows is an important skill for anyone who notices suspicious activity on their computer. Malware can cause Windows to behave unusually, slow down the system, display unwanted advertisements, or potentially expose personal information to attackers.

If you suspect that your Windows PC has been infected, acting quickly can reduce the potential damage.

The good news is that many malware infections can be removed using tools already available in Windows. More serious infections may require additional security software or professional assistance.

Here’s how to approach malware removal safely.

What Are the Signs of Malware on Windows?

Before removing malware, it’s useful to recognize the warning signs.

A computer may be infected if you notice:

• Unexpected pop-ups or advertisements
• Significant performance problems
• Unknown applications appearing on the computer
• Browser redirects or unfamiliar extensions
• Unusual network activity
• Security software being disabled unexpectedly
• Programs opening or closing without your permission
• Files being modified or becoming inaccessible
• Unknown processes consuming large amounts of system resources

These symptoms don’t automatically mean your computer contains malware. Hardware problems, unwanted software, browser extensions, and Windows issues can produce similar behavior.

However, unusual activity is a good reason to perform a security scan.

Disconnect the Computer From the Internet

If you strongly suspect an active malware infection, consider disconnecting the computer from the internet temporarily.

You can disable Wi-Fi or disconnect the Ethernet cable.

This can help limit communication between malicious software and remote servers and can reduce the risk of malware sending information or downloading additional components.

Don’t stay offline indefinitely, however. Security tools and Windows updates may need an internet connection to obtain the latest security information.

Run a Microsoft Defender Scan

Windows includes Microsoft Defender Antivirus, which provides built-in protection against many types of malware.

Start by opening Windows Security.

Then go to:

Virus & threat protection → Scan options

You can start with a Quick scan, but if you have strong reason to believe the system is infected, a more thorough scan is preferable.

A Full scan examines more files and can take considerably longer depending on the amount of data stored on your PC.

If Windows Security detects malware, follow its recommended removal or quarantine actions.

Source: Pureinfotech

Run Microsoft Defender Offline

Some malware can be difficult to remove while Windows is running because malicious processes may actively protect themselves.

In these situations, Microsoft Defender Offline can be useful.

It allows Windows Defender to scan the system in a different environment before the normal Windows operating system fully loads.

You can find the option under:

Windows Security → Virus & threat protection → Scan options → Microsoft Defender Antivirus (offline scan)

Windows will restart the computer and perform the scan.

Save your work before starting the process because your computer will restart.

Keep Windows and Security Software Updated

Malware developers often take advantage of known vulnerabilities in outdated software.

Make sure Windows is fully updated and that Microsoft Defender has the latest security intelligence.

Go to:

Settings → Windows Update

Then check for available updates.

You should also update commonly targeted applications such as web browsers, PDF readers, and other frequently used software.

Keeping software updated doesn’t remove an existing infection by itself, but it can help close security vulnerabilities that malware may exploit.

Remove Suspicious Applications

Check the applications installed on your computer.

Open:

Settings → Apps → Installed apps

Look for software you don’t recognize or applications that appeared around the same time you noticed suspicious behavior.

Before removing something, verify what it is. Some unfamiliar applications are legitimate Windows components, hardware utilities, or software installed by another program.

If you’re unsure about an application, research its official name before uninstalling it rather than deleting random system files.

Check Your Browser Extensions

Malicious or unwanted browser extensions can cause redirects, advertisements, tracking, and other problems.

Open your browser’s extension or add-on settings and review everything that’s installed.

Remove extensions that:

• You don’t recognize
• You no longer use
• Were installed without your knowledge
• Have suspicious permissions
• Cause unexpected redirects or advertisements

You should also check your browser’s default search engine and homepage if they have changed unexpectedly.

Start Windows in Safe Mode

If malware keeps restarting or interfering with security software, Safe Mode can sometimes make troubleshooting easier.

Safe Mode starts Windows with a limited set of drivers and services.

This can make it easier to identify suspicious software or run security tools when malicious programs normally start with Windows.

However, Safe Mode isn’t a magic malware removal tool. Modern malware can use different techniques to remain persistent, so you should still perform proper security scans.

Check Windows Startup Programs

Some malicious applications configure themselves to start automatically when Windows boots.

You can review startup applications through:

Settings → Apps → Startup

Disable suspicious programs that you don’t recognize, but don’t randomly disable Windows components or legitimate drivers.

If you’re unsure about an entry, research it before changing its settings.

Use a Reputable Malware Scanner

If Microsoft Defender doesn’t resolve the problem and suspicious behavior continues, you can use a reputable second-opinion malware scanner.

Only download security software from the vendor’s official website.

Avoid downloading antivirus programs from pop-ups, advertisements, file-sharing sites, or suspicious websites. Some fake security programs are actually malware themselves.

Using multiple antivirus products with real-time protection simultaneously can also cause conflicts, so understand how the additional scanner works before installing it.

Reset Your Browser if Problems Continue

If your browser continues displaying unwanted redirects or advertisements after removing suspicious extensions, consider resetting the browser.

A browser reset can restore important settings to their defaults and remove unwanted configuration changes.

Before resetting, make sure you understand what information may be affected, such as extensions, customized settings, or locally stored browser data.

Change Important Passwords

If you believe malware may have stolen your credentials, removing the malware isn’t enough.

Change passwords for important accounts, particularly:

• Email
• Banking
• Social media
• Cloud storage
• Work accounts
• Password managers

Use a different, strong password for each important account.

Where available, enable two-factor authentication or passkeys for additional protection.

If you suspect that your Google account may have been compromised, you can also read our guide on How to Protect Your Google Account From Hackers.

Check Your Accounts for Suspicious Activity

After dealing with malware, review your important online accounts.

Look for:

• Unrecognized login attempts
• Unknown devices
• Unexpected password changes
• New recovery information
• Unusual emails
• Unknown third-party applications
• Suspicious transactions

If you discover unauthorized activity, follow the affected service’s official account recovery and security procedures.

When Should You Reset or Reinstall Windows?

Sometimes malware removal isn’t the best option.

If the infection is particularly serious, keeps returning, or you cannot establish confidence that the system is clean, resetting or reinstalling Windows may be the safer approach.

Before doing this, back up important personal files carefully.

Be cautious about restoring executable files, suspicious programs, or other potentially infected files from the backup.

For particularly serious cases—especially ransomware or malware affecting sensitive business systems—consider getting professional assistance rather than experimenting with random removal tools.

How to Prevent Malware in the Future

Removing malware is only half the job. Preventing another infection is just as important.

Keep Windows and your applications updated, use reputable security software, and avoid downloading programs from untrusted websites.

You should also be careful with email attachments and unexpected links.

Phishing attacks are one of the most common ways attackers trick people into downloading malware or revealing credentials. Our guide on What Is Phishing? explains how these attacks work and what to look for.

Other useful habits include:

• Don’t use pirated software
• Download applications from trusted sources
• Don’t ignore security warnings
• Keep backups of important files
• Use strong, unique passwords
• Enable multi-factor authentication
• Review browser extensions regularly
• Avoid clicking suspicious pop-ups

Final Thoughts

Knowing how to remove malware from Windows can help you respond quickly when your computer starts behaving suspiciously.

Start with Microsoft Defender, keep Windows updated, remove suspicious applications and browser extensions, and use additional reputable security tools when necessary.

For serious infections, don’t keep experimenting with questionable removal utilities. Protect your important files, secure your online accounts, and consider resetting Windows or getting professional help if you cannot establish that the system is clean.

Good cybersecurity isn’t only about removing threats after an infection. Keeping your software updated, using reliable security tools, maintaining backups, and recognizing suspicious activity can significantly reduce the chances of becoming infected in the first place.