How to Remove Malware From a Windows PC: A Beginner’s Guide

Malware on a Windows PC can be stressful, especially when you are not sure what has been infected or what you should remove.

The good news is that Windows already includes security tools that can help detect, quarantine, and remove many common threats.

For beginners, the safest approach is to work step by step.

Do not immediately delete random system files, disable security features, or reset the entire computer before you understand the situation.

This guide explains how to remove suspected malware from a Windows PC, how to use Windows Security and Microsoft Defender, when a deeper scan may be appropriate, and what to do if the problem continues.

1. Confirm That Something Actually Looks Wrong

Before trying to remove malware, identify why you suspect an infection.

Possible warning signs include:

Unexpected antivirus warnings
Browser redirects
Strange advertisements or pop-ups
Unknown applications
New browser extensions
Security features becoming disabled
Files becoming inaccessible
Programs launching unexpectedly
Unfamiliar account activity
Problems beginning after a suspicious download

One symptom alone does not prove malware.

Slow performance, for example, can also result from low storage, hardware problems, software bugs, or too many background applications.

Look at the overall pattern.

If you are unsure whether the symptoms point to malware, review these common malware warning signs first.

2. Stop Using Suspicious Programs

If you know which download or application caused the problem, stop opening or running it.

Do not repeatedly test the suspicious file.

Do not:

Reinstall it
Disable antivirus so it can run
Restore it from quarantine
Add it to an antivirus exclusion
Give it administrator permission

If the suspicious program is currently open, close it when possible.

3. Disconnect From the Internet When There Is Active Suspicious Activity

You do not need to disconnect every computer simply because you suspect malware.

However, disconnecting the affected PC from the internet may be useful if you believe:

Someone is remotely controlling the computer
Data is actively being stolen
Unknown software is communicating with an attacker
Ransomware or another serious attack is currently occurring

You can temporarily turn off Wi-Fi or unplug the Ethernet cable while investigating.

Do not remain disconnected longer than necessary if you need internet access to update security tools or obtain trusted support.

4. Do Not Enter Important Passwords on a Suspected Infected PC

If you think the computer may contain credential-stealing malware, avoid entering sensitive passwords until you have investigated the device.

For important accounts, use another trusted device when possible.

This is especially important for:

Email
Banking
Password managers
Social media
Cloud storage
Work accounts

If you already entered an important password after the suspected infection began, consider changing it from a trusted device after securing the account.

5. Open Windows Security

Windows users can begin with the built-in Windows Security app.

Open:

Start → Windows Security

Then select:

Virus & threat protection

This area provides access to Microsoft Defender Antivirus scanning and threat-management features when Defender is your active antivirus.

If another trusted antivirus product is currently active, its controls may differ.

6. Update Windows and Security Protection

Before scanning, make sure Windows and your security protection are current.

Open:

Settings → Windows Update

Install important available updates.

Updated security intelligence gives antivirus software newer information about known threats.

If malware appears to prevent Windows Update or antivirus updates from working, that is another reason to investigate more deeply.

7. Start With a Quick Scan

In Windows Security, select:

Virus & threat protection → Quick scan

A Quick scan checks areas where threats are commonly found.

For many ordinary situations, this is a sensible first step.

Allow the scan to finish.

Do not keep opening suspicious applications while the scan is running.

8. Review the Scan Result Carefully

If no threats are found, that is reassuring, but it is not absolute proof that the computer is clean.

If Defender finds something, pay attention to the recommended action.

The detection may be:

Malware
A potentially unwanted application
Suspicious software
Another security concern

Do not automatically override a detection because you recognize the filename.

9. Open Protection History

After the scan, review:

Windows Security → Virus & threat protection → Protection history

Protection History can show recent detections and security actions.

Look for entries such as:

Threat found
Threat blocked
Quarantined item
Action needed
Potentially unwanted application
Remediation incomplete

This is one of the most useful places to understand what Windows Security has actually detected.

10. Understand Quarantine

When antivirus software quarantines a file, it isolates the item so it cannot operate normally.

For a beginner, quarantine is often preferable to immediately restoring a suspicious file.

Do not restore something merely because:

You want the program to work
A download website says the detection is false
Someone in a forum says to ignore Defender
The installer told you to disable antivirus

Only restore a detected item when you have independently verified that it is legitimate.

11. Remove Confirmed Threats

If Windows Security identifies a malicious item and recommends removal, follow the security guidance shown by Windows.

After removal:

Restart the computer if requested.
Run another scan.
Review Protection History again.
Check whether the original symptoms continue.

A second clean scan after remediation is more reassuring than simply assuming the first removal solved everything.

12. Run a Full Scan When You Have Stronger Concerns

If you continue to suspect malware, use:

Windows Security → Virus & threat protection → Scan options → Full scan

A Full scan examines more files and running programs than a Quick scan.

It can take significantly longer.

You do not need to run one constantly.

It is more appropriate when:

Malware was detected
Suspicious behavior continues
You opened an unknown executable
A Quick scan did not resolve your concern

Allow the scan to complete.

13. Use Microsoft Defender Offline for Persistent Malware

If you have stronger reason to believe malware is hiding or interfering with normal Windows scans, Microsoft Defender Offline can provide a deeper check.

Open:

Windows Security → Virus & threat protection → Scan options → Microsoft Defender Offline scan

Save your work first.

The computer will restart and the scan runs outside the normal Windows environment.

This can make it more difficult for certain persistent threats to hide or interfere with scanning.

After Windows starts again, review Protection History for the result.

14. Do Not Use Defender Offline as a Daily Routine

Microsoft Defender Offline is useful for deeper investigation, but it is not something beginners need to run every day.

Use it when there is a meaningful reason, such as:

Repeated malware detections
A threat that keeps returning
Suspicious behavior after ordinary scans
Concern about persistent malware

Routine everyday security should rely more on real-time protection, updates, safe browsing, and normal scans when needed.

15. Consider Microsoft Safety Scanner as Another Microsoft Tool

Microsoft also provides Microsoft Safety Scanner.

It is an on-demand malware scanning tool designed to find and remove malware from Windows computers.

It can be useful when you want another Microsoft malware check.

Download security tools only from Microsoft's official website.

Do not search for “Microsoft malware cleaner” and download a random program from an advertisement or unknown website.

Fake antivirus and fake cleaning tools are common scam techniques.

16. Consider a Reputable Second-Opinion Scanner

An established on-demand malware scanner can sometimes provide an additional opinion.

For example, Malwarebytes Free can be used for manual malware scanning and cleanup.

A second scanner may be useful when:

Defender removed something but symptoms continue
You want an additional check
Adware or potentially unwanted software is suspected
You recently ran a suspicious file

Do not install several random antivirus programs.

More security software does not automatically mean more security.

17. Avoid Running Multiple Real-Time Antivirus Products Without Understanding Them

Two real-time antivirus products attempting to perform the same role can sometimes create unnecessary complexity or conflicts.

For most beginners, a simpler arrangement is better.

For example:

Keep one primary real-time antivirus active
Use a reputable additional scanner on demand when necessary

If you install another antivirus product, understand how it interacts with Microsoft Defender Antivirus.

18. Review Recently Installed Applications

Malware or unwanted software may have arrived with another program.

Open:

Settings → Apps → Installed apps

Review programs installed around the time the problem started.

Look for:

Unknown applications
Fake cleaners
Strange browser tools
Remote-access software you did not intentionally install
Programs with suspicious names

Do not randomly remove unfamiliar Microsoft or Windows components.

Research unknown software before uninstalling it.

19. Uninstall Known Suspicious Applications

If you know a suspicious application was installed during the incident, uninstall it.

After uninstalling:

Restart Windows when appropriate
Run another malware scan
Check whether related files or extensions remain

Remember that uninstalling a malicious application does not always guarantee that every component has been removed.

That is why follow-up scanning is important.

20. Review Startup Applications

Malicious or unwanted programs may try to start automatically with Windows.

Open:

Task Manager → Startup apps

Review what launches when the computer starts.

Disable an unfamiliar startup entry only after investigating what it belongs to.

Do not disable random Windows or hardware-related components simply because you do not recognize their names.

21. Check Browser Extensions

If the problem involves redirects, advertisements, fake search pages, or unwanted browser behavior, review browser extensions.

Remove extensions that:

You did not install
Appeared around the time the problem started
Have an uncertain source
Request unnecessary permissions
Produce suspicious behavior

Keep only extensions you actually need and trust.

22. Check Browser Notification Permissions

Sometimes a computer appears “infected” when the real problem is a website that was allowed to send browser notifications.

These notifications may display:

Fake virus warnings
Scam advertisements
Fake Microsoft alerts
Misleading update messages

Review your browser's notification permissions.

Remove suspicious or unfamiliar websites.

A fake browser notification does not necessarily mean Windows itself contains malware.

23. Review Your Downloads Folder

Check the Downloads folder for the file that may have caused the incident.

Be cautious with unfamiliar:

.exe
.msi
.zip
.rar
Scripts
Documents

Do not reopen suspicious files.

If a malicious download has already been quarantined or removed by security software, avoid restoring it without a verified reason.

24. Check Whether Security Settings Were Changed

Malware may sometimes attempt to weaken security.

Review:

Microsoft Defender status
Real-time protection
Windows Firewall
App & browser control
Browser security settings

If an important security feature was unexpectedly disabled, turn it back on after determining that no legitimate security application disabled it intentionally.

25. Check Important Online Accounts

Malware removal and account recovery are separate tasks.

If you suspect credential-stealing malware, review important accounts from a trusted device.

Look for:

Unknown sign-ins
Password changes
Unfamiliar devices
Recovery-information changes
Emails you did not send

If an account may be compromised:

Change the password.
Use a new and unique password.
Enable two-factor authentication.
Sign out unfamiliar sessions.
Review recovery information.

Do not reuse the old compromised password.

26. Change Reused Passwords

If the potentially stolen password was used on multiple websites, change those accounts too.

Password reuse makes credential theft significantly more damaging.

A password manager can help you create and store unique passwords for different services.

If your browser or antivirus detects malware, do not assume your online accounts are automatically safe.

Device security and account security should both be reviewed.

27. Back Up Important Personal Files Carefully

If malware is suspected, protecting irreplaceable data is important.

Consider backing up:

Photos
Documents
Personal videos
Work files
Other important personal data

However, be cautious about copying suspicious executable files or unknown installers into your backup.

A backup should help preserve important personal data, not preserve the malware you are trying to remove.

28. Do Not Depend on One Backup

For important files, having more than one copy is safer than relying on a single PC.

A useful backup strategy may include:

An external drive
A reputable cloud backup or synchronization service
Another secure storage location

If ransomware is actively encrypting files, disconnecting backup drives that are not currently needed may help reduce additional exposure.

29. What If Malware Keeps Returning?

If the same threat continues to appear after removal:

Update Windows
Update security intelligence
Run another scan
Use a Full scan
Consider Microsoft Defender Offline
Review recently installed applications
Review browser extensions
Consider a reputable second-opinion scanner

Repeated detections can indicate that the original source of the infection has not been removed.

Do not keep allowing the same detected item.

30. When Should You Consider Resetting Windows?

Resetting or reinstalling Windows is a major step and should not normally be your first response.

However, it may become appropriate when:

Malware remains persistent
Security tools cannot restore confidence in the system
A scammer had deep remote access
Important Windows components appear compromised
The system remains unstable after cleanup
You cannot determine whether the device is trustworthy

Windows provides recovery options including Reset this PC and reinstalling Windows.

Understand what will happen to your files, applications, and settings before proceeding.

31. Back Up Before a Reset or Reinstallation

Before using destructive recovery options, protect important personal files where practical.

Be particularly careful with:

Documents
Photographs
Videos
Work files
Financial records

Do not blindly preserve suspicious programs or installers.

Also make sure you have access to:

Important account passwords
Recovery codes
Software licenses where needed
Required installation media or account details

A Windows reinstall can remove applications and, depending on the method, may remove personal data.

32. What If a Scammer Had Remote Access?

Treat unauthorized remote access as a more serious incident.

If a scammer controlled your computer:

Disconnect the device from the network
Remove remote-access software they installed
Run malware scans
Review installed programs
Review account activity
Change sensitive passwords from a trusted device
Contact financial institutions if payment information was exposed

If you cannot regain confidence in the device, consider professional help or Windows recovery/reinstallation.

33. Do Not Pay for Fake Malware Removal

Be cautious of websites or callers claiming:

They detected hundreds of viruses
Your Windows license is infected
You must call immediately
Only their paid cleaner can fix the problem
Microsoft personally contacted you

Legitimate Windows security warnings do not require you to call random numbers displayed in browser pop-ups.

Use Windows Security and trusted official support channels.

34. Do Not Download “Cleaner” Tools From Random Ads

Searching for malware removal software can expose beginners to more questionable downloads.

Avoid downloading security tools from:

Pop-up advertisements
Sponsored links you have not verified
Unknown download portals
Forums linking to unfamiliar executables

Use the security vendor's official website.

35. How Do You Know the Malware Is Gone?

There is no single perfect test.

Confidence improves when several things are true:

Follow-up scans are clean
Protection History shows no unresolved threat
Security settings remain enabled
Suspicious programs have been removed
Browser behavior returns to normal
No unexplained pop-ups or redirects remain
Account activity appears normal
The same detection does not return

Continue monitoring the PC after cleanup.

36. What If the Scan Is Clean but the Computer Is Still Slow?

Do not assume malware is responsible for every performance issue.

Other causes include:

Low free storage
Too many startup programs
Aging hardware
Background updates
Browser extensions
Driver problems
Software bugs

Once malware has been reasonably ruled out, troubleshoot the performance problem separately.

37. A Simple Malware Removal Checklist

Use this as a beginner-friendly sequence:

38. How to Reduce the Chance of Another Infection

After cleanup:

Keep Windows updated
Keep real-time antivirus protection enabled
Keep Windows Firewall enabled
Use Microsoft Defender SmartScreen or equivalent web protection
Download software from official sources
Avoid cracked or pirated programs
Be cautious with email attachments
Scan suspicious files before opening them
Recognize phishing messages
Use unique passwords
Enable two-factor authentication
Maintain backups

Malware prevention is usually easier than malware removal.

Final Verdict

Removing malware from a Windows PC should be a step-by-step process.

Start with the built-in Windows Security tools.

Update protection, run a Quick scan, review Protection History, and remove or quarantine confirmed threats.

If the problem continues, move to a Full scan or Microsoft Defender Offline.

A reputable additional scanner can provide a useful second opinion.

Then investigate how the malware may have entered the system.

Review recently installed applications, startup programs, browser extensions, downloads, and account activity.

Do not reset the entire computer unless there is a meaningful reason.

For serious or persistent compromise, Windows recovery or reinstallation may eventually be the safest way to restore confidence in the system.

Most importantly, prevention should continue after cleanup.

Keep Windows updated, use real-time security protection, download software carefully, recognize phishing attempts, use strong account security, and maintain reliable backups.

Guide note: This article reflects Microsoft Windows security and recovery guidance available in August 2026. Windows Security menus, scan options, recovery tools, and product behavior can change. Always review Microsoft's current official guidance before using destructive recovery or reinstall options.