SecurityWindows

How to Remove Malware From a Windows PC (2026)

TG By The TechFix Guide Editorial Team  ·  Updated  ·  How we check our guides
A focused woman at a home office desk running a security scan on a laptop under warm lamp light, an external hard drive and coffee cup beside her, moody teal and amber tones

Sudden pop-ups, a browser homepage you never chose, a fan that spins when nothing is running — sooner or later many Windows PCs pick up something unwanted. The word "virus" covers a whole zoo of malware: adware, browser hijackers, trojans, spyware, ransomware. Whatever the flavor, the cleanup routine below handles the vast majority of cases using tools already built into Windows. Work through the steps in order, and resist the urge to skip straight to the drastic ones.

Signs You Actually Have Malware (and When You Don't)

Real warning signs: a homepage or search engine that changes itself, new toolbars or programs you did not install, pop-ups outside the browser, files that suddenly will not open, friends receiving messages you never sent, or security tools that refuse to launch. Less alarming: a generally slow PC (usually just startup bloat or a failing drive), one weird ad inside a sketchy website (that is the site's problem, not your infection), or a dramatic web pop-up claiming your PC is infected — real antivirus alerts never arrive as browser pop-ups asking you to call a phone number.

Step 1: Update Before You Scan

Malware often dodges outdated protection, so start by updating. Open Settings → Windows Update and install everything pending. Then open Windows Security (search for it in the Start menu), go to Virus & threat protection → Check for updates, and update the security intelligence. It takes minutes and noticeably improves the scan's catch rate.

Step 2: Run a Full Scan With Windows Security

In Windows Security → Virus & threat protection, click Scan options and choose Full scan rather than the quick scan — it checks every file and typically takes one to three hours. Let it finish and quarantine whatever it finds. For a second opinion on stubborn machines, Microsoft's free Microsoft Safety Scanner (download it from microsoft.com) runs alongside Defender and catches things a sabotaged antivirus might miss.

Should you disconnect from the internet? Only in two cases: ransomware is actively encrypting files, or you have concrete reason to believe data is being stolen right now. Otherwise stay connected so the scanner can pull the latest definitions — a disconnected scan is a weaker scan.

Step 3: Check What's Installed and What Starts With Windows

Scanners miss some adware because it hides as a "helpful" utility. Open Settings → Apps → Installed apps, sort by install date, and uninstall anything you do not recognize — especially browser "assistants", free PDF converters, and driver updaters you never deliberately installed. Search the exact name before removing; a few odd-looking entries are legitimate Windows components. Then open Task Manager (Ctrl + Shift + Esc) → Startup apps and disable suspicious entries so they cannot relaunch at boot. This is also the moment to uninstall any "PC cleaner" or "booster" programs — they usually cause more problems than they solve.

Step 4: Boot Into Safe Mode and Rescan

If problems return after cleaning, run the full scan again from Safe Mode, where most malware cannot start. Hold Shift while clicking Restart from the power menu, then choose Troubleshoot → Advanced options → Startup Settings → Restart and press 4. Safe Mode loads a minimal Windows with no third-party startup items; run another full scan from there and repeat the installed-apps review while you are in it.

Step 5: Clean Up Your Browser

Browser hijackers often survive PC-level scans because they live inside your browser profile, not in Windows. In each browser you use:

  • Extensions: Remove everything you did not install yourself (menu → Extensions in both Chrome and Edge).
  • Search engine and homepage: Reset them in settings — hijackers love replacing the default search with an obscure site that pays them per click.
  • Reset as a last resort: If the browser stays broken, use its built-in reset (Chrome: Settings → Reset settings). It keeps your bookmarks and passwords but removes extensions and resets startup behavior.

Step 6: Assume Passwords Are Compromised

Spyware exists to steal credentials, so after any confirmed infection, treat your passwords as leaked. From a different, clean device — or after the cleanup is fully complete — change the passwords that matter most: your email account first, since it can reset everything else, then banking, then shopping and work accounts. Turn on two-factor authentication wherever it is offered; a stolen password paired with 2FA is nearly worthless to an attacker. Then keep an eye on bank and card statements for a few weeks.

If the Malware Keeps Coming Back

Persistent reinfection usually means one of three things: a leftover scheduled task or account restoring the payload, a second device on your network that is itself infected, or rootkit-level persistence. Create a new local user account and see whether the problem follows you there. Scan the other PCs and phones that share your network. If it still returns, the clean-slate option is Settings → System → Recovery → Reset this PC with Remove everything — time-consuming, but it erases every software-level infection in one pass. Back up your files first, and scan the backups before restoring them onto the fresh system.

What About Paid Antivirus?

Windows Security (Defender) has earned strong independent test scores for years and covers the malware most home users will ever meet. Paid suites add extras — password managers, VPNs, firewall controls, identity monitoring — that some people genuinely value, but they are not required for a clean PC, and the cleanup above works the same either way. If you do use a third-party antivirus, do not run two real-time scanners at once; they fight over the same files and slow each other down. Pick one, keep it updated, and let it do its job.

Keeping It Out for Good

  • Let Windows Update and Defender run automatically. Most infections exploit bugs that were patched months ago.
  • Skip cracked software and "free" activation tools. They are the single biggest malware delivery channel on home PCs.
  • Read installer screens. Uncheck the bundled toolbars and offers that ride along with free software.
  • Work in a standard user account instead of an administrator account, so malware needs an explicit approval prompt to change system settings.
  • Keep backups on an external drive. It turns ransomware from a disaster into an annoyance.
The pattern that works: update, full scan, review what starts with Windows, clean the browser, change key passwords. In that order — and the machine is almost always clean by step five.

Malware cleanup is rarely dramatic; it is a checklist, and Windows gives you every tool on it for free. Run the steps above at the first weird sign, and the pop-up zoo moves out before it unpacks.