Skip to content
Home » Blog » How to Remove Malware from Your PC Using Windows Tools: A Complete Beginner’s Guide

How to Remove Malware from Your PC Using Windows Tools: A Complete Beginner’s Guide

featured image

Introduction

Your computer is running slower than usual. Pop-ups keep appearing out of nowhere. Your browser homepage changed without your permission. Sound familiar? You’re likely dealing with malware, and you’re not alone—millions of PCs get infected every year.

The good news? You don’t need expensive antivirus software or technical expertise to fight back. Windows comes equipped with powerful built-in security tools that can detect and remove most malware threats completely free. In this comprehensive tutorial, you’ll learn how to use Windows Security, Windows Defender Offline Scan, and other native Windows utilities to clean your infected PC and restore it to peak performance.

By the end of this guide, you’ll know exactly how to identify malware symptoms, run thorough system scans, remove malicious software, and prevent future infections—all using tools already installed on your computer.

What You’ll Need Before You Start

Before diving into malware removal, gather these essentials:

Required:

  • A Windows 10 or Windows 11 PC (these instructions work for both)
  • Administrator access to your computer
  • Stable internet connection (for definition updates)
  • At least 30 minutes of uninterrupted time
  • External backup of important files (optional but highly recommended)

Optional Enhancements:

  • USB flash drive (8GB minimum) for creating Windows Defender Offline media
  • Notepad for documenting suspicious programs you find
  • Second device to research unfamiliar processes

Quick Setup Tips:

  • Ensure your PC is plugged into power—scans can take time and drain battery
  • Close unnecessary programs to speed up the scanning process
  • Disconnect from the internet temporarily if you suspect active malware transmission

Step-by-Step Tutorial

Step 1: Enter Windows Safe Mode with Networking

Instruction: Restart your PC in Safe Mode to prevent malware from running while you clean your system.

  1. Click the Start menu and select the Power icon
  2. Hold down the Shift key while clicking Restart
  3. When the “Choose an option” screen appears, select Troubleshoot > Advanced options > Startup Settings > Restart
  4. After your PC restarts, press 5 or F5 to select “Enable Safe Mode with Networking”

Why This Matters: Safe Mode loads only essential Windows files and drivers, preventing most malware from launching automatically. The “with Networking” option keeps your internet connection active so you can download updates and definition files.

Example: Your screen may look different in Safe Mode—lower resolution, different colors, and “Safe Mode” watermarked in the corners. This is completely normal.

Tip: If your PC won’t boot normally due to malware, you can also access Safe Mode by interrupting the boot process three times (turn off your PC during startup three consecutive times).

Step 2: Update Windows Security Definitions

Instruction: Ensure you have the latest malware definitions before scanning.

  1. Open Settings by pressing Windows key + I
  2. Navigate to Privacy & Security > Windows Security (on Windows 11) or Update & Security > Windows Security (on Windows 10)
  3. Click Virus & threat protection
  4. Under “Virus & threat protection updates,” click Check for updates
  5. Wait for the update to complete

Why This Matters: Malware evolves constantly. Microsoft releases definition updates multiple times daily to detect the newest threats. Scanning with outdated definitions is like fighting with yesterday’s intelligence.

Example: You should see a timestamp showing when definitions were last updated. If it’s been more than a week, your protection has been compromised.

Tip: If updates fail to download, temporarily disable any third-party security software that might be blocking Windows Security.

Step 3: Run a Quick Scan with Windows Security

Instruction: Start with a fast scan of your system’s most vulnerable areas.

  1. In Windows Security, stay on the Virus & threat protection page
  2. Click Quick scan under “Current threats”
  3. Wait for the scan to complete (typically 5-15 minutes)
  4. Review any threats detected

Why This Matters: A Quick Scan examines folders where malware typically hides—startup folders, system directories, and registry keys. It’s the fastest way to catch common infections.

Example Output:

  • No threats found: Proceed to Step 4 for a deeper scan
  • Threats found: Windows Security will display threat names and severity levels. Click Start actions to quarantine or remove them.

Tip: Don’t skip this step even if you plan to run a full scan. Quick scans can identify and neutralize threats that might interfere with more comprehensive scans.

Step 4: Perform a Full System Scan

Instruction: Conduct a thorough examination of every file on your PC.

  1. In Virus & threat protection, click Scan options
  2. Select Full scan
  3. Click Scan now
  4. Allow the scan to complete (this can take 1-3 hours depending on your drive size)

Why This Matters: While Quick Scans target high-risk areas, Full Scans examine every single file, folder, and running program on your system. This catches hidden malware that cleverly disguises itself in unexpected locations.

Example: The scan progress shows which files are being checked. You might see it examining hundreds of thousands of files. Don’t interrupt this process.

Tip: Full scans are resource-intensive. Your computer may run slowly during the scan. Plan to run this when you don’t need your PC for other tasks, or let it run overnight.

Step 5: Run Windows Defender Offline Scan

Instruction: Use Microsoft’s most powerful scanning tool that runs before Windows loads.

  1. In Virus & threat protection, click Scan options
  2. Select Microsoft Defender Offline scan
  3. Click Scan now
  4. Save any open work—your PC will restart automatically
  5. The scan runs from a minimal trusted environment (takes about 15 minutes)
  6. Your PC restarts again when complete

Why This Matters: Rootkits and advanced malware can hide from traditional scans by embedding themselves in Windows. Offline scanning runs before Windows starts, detecting threats that would otherwise remain invisible or block removal attempts.

Example: During the offline scan, you’ll see a blue screen with scanning progress. This is normal—let it complete without interruption.

Tip: This is the “nuclear option” for stubborn infections. If previous scans found threats but couldn’t remove them, the offline scan often succeeds where others failed.

Step 6: Remove Suspicious Programs Manually

Instruction: Uninstall any programs you don’t recognize or didn’t intentionally install.

  1. Press Windows key + I to open Settings
  2. Go to Apps > Installed apps (Windows 11) or Apps > Apps & features (Windows 10)
  3. Sort by Install date to see recently added programs
  4. Look for unfamiliar programs, especially those with:
    • Random names or characters
    • No publisher information
    • Installation dates matching when problems started
  5. Click the three dots (or program name) and select Uninstall

Why This Matters: Not all malware is detected by scans. Some potentially unwanted programs (PUPs) like adware, toolbars, and browser hijackers slip past security because they’re technically “legitimate” software—just deceptive and harmful.

Example Suspicious Programs:

  • PC Speed Booster 2024
  • MySearchProtect
  • Coupon extensions you don’t remember installing
  • Programs with publishers like “Unknown” or random strings

Tip: When in doubt, search “[program name] malware” online to verify if it’s legitimate. Be cautious—some malware disguises itself with names similar to real Windows programs (like “svch0st” instead of “svchost”).

Step 7: Reset Your Web Browsers

Instruction: Remove malicious extensions and restore browser settings.

For Microsoft Edge:

  1. Open Edge and click the three dots (⋯) in the top-right
  2. Go to Settings > Reset settings
  3. Click Restore settings to their default values
  4. Click Reset

For Google Chrome:

  1. Open Chrome and click the three dots (⋮)
  2. Go to Settings > Reset settings
  3. Click Restore settings to their original defaults
  4. Click Reset settings

For Mozilla Firefox:

  1. Click the menu (≡) and select Help > More troubleshooting information
  2. Click Refresh Firefox
  3. Confirm by clicking Refresh Firefox again

Why This Matters: Malware frequently targets browsers to steal data, redirect searches, and display ads. Browser hijackers change your homepage, default search engine, and install malicious extensions. Resetting removes these modifications.

Example: After resetting, your browser will look like a fresh installation—all extensions removed, homepage restored to default, and cache cleared. You’ll need to sign back into websites.

Tip: Before resetting, export your bookmarks if you want to keep them. Most browsers offer a bookmark export function in their settings.

Step 8: Clean Temporary Files with Disk Cleanup

Instruction: Delete leftover malware files hiding in temporary folders.

  1. Press Windows key + R to open Run dialog
  2. Type cleanmgr and press Enter
  3. Select your C: drive and click OK
  4. Check these boxes:
    • Temporary files
    • Temporary Internet files
    • Recycle Bin
    • Thumbnails
  5. Click Clean up system files for additional options
  6. Check Windows Update Cleanup and Previous Windows installations if available
  7. Click OK, then Delete Files

Why This Matters: Malware often leaves traces in temporary folders even after removal. These remnants can reinstall the infection or contain harvested personal data. Cleanup tools remove these digital footprints.

Example: You might free up several gigabytes of space. The more files deleted, the more potential hiding spots for malware you’ve eliminated.

Tip: For even more thorough cleaning, run Storage Sense from Settings > System > Storage, which automates regular temporary file removal.

Step 9: Check Windows Startup Programs

Instruction: Prevent malware from launching automatically when Windows starts.

  1. Press Ctrl + Shift + Esc to open Task Manager
  2. Click the Startup tab
  3. Review all listed programs
  4. Right-click any suspicious or unfamiliar programs
  5. Select Disable (not uninstall—you can re-enable if needed)

Why This Matters: Malware achieves persistence by adding itself to Windows startup. Even after removal, startup entries can resurrect infections. Disabling suspicious startup items breaks this cycle.

Example Legitimate Startup Programs:

  • Microsoft OneDrive
  • Graphics card utilities (NVIDIA, AMD)
  • Cloud storage services (Dropbox, Google Drive)

Example Suspicious Startup Programs:

  • Programs with no name or random characters
  • Entries pointing to folders in AppData or Temp directories
  • Anything you don’t recognize or use

Tip: Google any program name you’re unsure about before disabling. Some legitimate Windows services sound strange but are essential (like “Microsoft Windows Search Indexer”).

Step 10: Update Windows and Restart Normally

Instruction: Install all pending Windows updates and exit Safe Mode.

  1. Open Settings > Windows Update
  2. Click Check for updates
  3. Install all available updates (this may require multiple restarts)
  4. After updates complete, restart your PC normally (not in Safe Mode)
  5. Verify your PC boots correctly and malware symptoms are gone

Why This Matters: Many malware infections exploit security vulnerabilities in outdated Windows versions. Updates patch these holes, preventing reinfection. Restarting normally confirms your system is stable and clean.

Example: You might see updates for Windows Defender, .NET Framework, and Windows features. Install everything—security updates are critical.

Tip: Enable automatic updates to stay protected: Settings > Windows Update > Advanced options > turn on “Receive updates for other Microsoft products.”

Explaining the Why Behind Each Step

Understanding the strategy behind malware removal helps you recognize infections faster and respond more effectively in the future:

Safe Mode Strategy: Malware can’t defend itself or hide when its processes aren’t running. Safe Mode creates a controlled environment where you have the advantage.

Layered Scanning Approach: Different scan types catch different threats. Quick scans find obvious infections, full scans catch hidden files, and offline scans neutralize rootkits. Using all three ensures comprehensive coverage.

Manual Removal Necessity: Automated tools can’t catch everything. PUPs and adware often operate in legal gray areas that scans ignore. Manual inspection catches these borderline threats.

Browser Reset Importance: Browsers are the gateway to the internet and prime targets for data theft. Compromised browsers can leak passwords, banking information, and personal data. Resetting neutralizes these risks.

Startup Management: Malware survival depends on persistence. By controlling what launches with Windows, you prevent reinfection and reduce system resource drain.

Common Mistakes & How to Avoid Them

Mistake 1: Skipping Safe Mode

The Problem: Scanning in normal mode allows malware to actively interfere with removal attempts. Some infections can terminate antivirus processes or hide files being scanned.

The Solution: Always start malware removal in Safe Mode. If malware prevents Safe Mode access, use the three-interrupt boot method or create Windows installation media to access recovery options.

Mistake 2: Ignoring Windows Updates

The Problem: Running scans on an outdated Windows version is like locking your door but leaving windows open. Malware exploits known vulnerabilities that patches have already fixed.

The Solution: Update Windows before scanning. If your system is severely compromised and won’t update, perform a manual update using the Windows Update Catalog.

Mistake 3: Only Running One Type of Scan

The Problem: A single Quick Scan might miss 80% of infections. Different malware types hide in different ways, requiring different detection methods.

The Solution: Run all three scan types (Quick, Full, and Offline) in sequence. This layered approach ensures maximum detection and removal.

Mistake 4: Reinstalling Removed Programs

The Problem: Some users see programs get removed and think “I might need that” before reinstalling them. If Windows Security flagged it, there’s a reason.

The Solution: Only restore quarantined items if you’re absolutely certain they’re false positives. Research the program name online first. When in doubt, leave it removed.

Mistake 5: Forgetting About Browser Extensions

The Problem: Browser resets remove extensions, but users often reinstall the same extensions that contained malware without realizing it.

The Solution: After resetting browsers, only reinstall extensions from official stores (Chrome Web Store, Firefox Add-ons) and verify they’re legitimate by checking reviews, download counts, and developer information.

Advanced Tips & Alternative Methods

Take Prevention Further

Enable Ransomware Protection:

  1. Go to Windows Security > Virus & threat protection
  2. Click Manage ransomware protection
  3. Turn on Controlled folder access
  4. Add important folders for extra protection

Use Windows Sandbox for Suspicious Files: Windows Pro and Enterprise users can test suspicious downloads in isolated environments:

  1. Enable Windows Sandbox in Windows Features
  2. Launch Sandbox from the Start menu
  3. Test questionable files safely—anything malicious stays contained

Create a System Restore Point: After cleaning your PC, preserve this clean state:

  1. Search for Create a restore point in Start menu
  2. Click Create
  3. Name it “Post-Malware Cleanup”
  4. Use this if infections return

Alternative Scanning Tools

While Windows tools handle most threats, stubborn infections may require additional help:

Malwarebytes Free: Download from the official Malwarebytes website for complementary scanning. Their threat database often catches PUPs Windows Security misses.

ESET Online Scanner: A free, no-installation browser-based scanner available at ESET’s website for second opinions on suspicious files.

Process Explorer: Microsoft’s advanced Task Manager alternative (part of Sysinternals Suite) helps identify malicious processes by their behavior and signatures.

If All Else Fails: Reset Windows

For severe infections that resist removal:

  1. Go to Settings > System > Recovery
  2. Under “Reset this PC,” click Reset PC
  3. Choose Remove everything for maximum cleanliness
  4. Select Cloud download for the cleanest Windows installation
  5. Follow the prompts (this takes 30-60 minutes)

This nuclear option reinstalls Windows while optionally preserving your personal files. It’s effective but time-consuming.

Conclusion

Congratulations! You’ve learned how to remove malware using Windows’ powerful built-in security tools—no expensive software required. By following this tutorial, you’ve protected your personal information, improved system performance, and gained valuable technical skills.

Key Takeaways:

  • Safe Mode gives you the advantage when fighting malware
  • Layered scanning (Quick, Full, and Offline) catches more threats than single scans
  • Manual checks find PUPs that automated tools miss
  • Browser resets eliminate data-stealing extensions
  • Prevention through updates and monitoring beats dealing with infections

Next Steps: Practice good security hygiene to stay malware-free:

  • Run weekly Quick Scans with Windows Security
  • Keep Windows updated automatically
  • Think before clicking suspicious email links
  • Download software only from official websites
  • Use strong, unique passwords for all accounts
Tags: