How to Remove Malware From Windows: The Ultimate Step-by-Step Guide (2026)

Is your computer running sluggishly, bombarding you with strange pop-ups, or redirecting your browser to sketchy websites? You might be dealing with malware.

Malware (malicious software)—including viruses, spyware, ransomware, and adware—can compromise your personal data, slow down your system, and even lock you out of your files. Fortunately, removing it is entirely possible if you follow the right procedure.

In this comprehensive, SEO-optimized guide, you will learn how to safely detect, isolate, and completely remove malware from your Windows PC, along with essential tips to keep your system secure.

Step 1: Disconnect From the Internet (Isolate the PC)

Before running any scans, you must stop the malware from communicating with its command-and-control server or spreading to other devices on your network.

• Unplug the Ethernet cable or turn off Wi-Fi immediately.
  
  
• Keeping the PC offline prevents ransomware from encrypting cloud storage or stealing your personal data.
  
  

Step 2: Boot Into Safe Mode (Recommended)

Malware often runs in the background, actively blocking antivirus software from detecting or deleting it. Booting Windows into Safe Mode loads only essential drivers and services, preventing malicious programs from starting up.

How to enter Safe Mode in Windows 10/11:

1. Open the Start Menu, click the Power icon, then hold down the Shift key while clicking Restart.
   
   
2. Navigate to Troubleshoot > Advanced options > Startup Settings > Restart.
   
   
3. Once your PC reboots, press 4 or F4 to Enable Safe Mode.
   
   

Step 3: Delete Temporary Files

Malware often hides inside temporary folders. Clearing these out frees up space and occasionally removes simple adware or dormant infection files.

1. Press Windows Key + R to open the Run dialog box.
   
   
2. Type %temp% and press Enter.
   
   
3. Select all files (Ctrl + A) and delete them (Shift + Delete). Note: Skip any files that Windows says are currently in use.
   
   
4. Repeat the process for the temp folder (type temp in the Run box).
   
   
5. Empty your Recycle Bin.
   
   

Step 4: Run a Full Antivirus and Anti-Malware Scan

With your PC isolated and running in Safe Mode, it is time to clean the system using reputable security tools.

A. Windows Security (Built-in Defender)

1. Search for Windows Security in the Start Menu.
   
   
2. Go to Virus & threat protection > Scan options.
   
   
3. Select Microsoft Defender Offline scan (this scans and removes stubborn malware before Windows fully boots) and click Scan now.
   
   

B. Use a Second-Opinion On-Demand Scanner

Even if you use Windows Defender, running a secondary portable scanner catches threats that slipped through the cracks. Recommended tools include:

• Malwarebytes Free: Highly effective at catching adware, PUPs (Potentially Unwanted Programs), and trojans.
  
  
• HitmanPro: Deep behavioral scanner for advanced threats.
  
  

Download and run these tools, let them complete a full system scan, and quarantine/delete any detected threats.

Step 5: Check Installed Apps and Browser Extensions

Sometimes malware isn't a hidden virus, but an unwanted program or malicious browser extension you accidentally installed.

A. Remove Suspicious Programs

1. Open Settings (Windows Key + I) > Apps > Installed apps (or Apps & features).
   
   
2. Sort by date or review the list carefully. Look for software you don't recognize, free toolbars, or shady utility apps.
   
   
3. Click the three dots next to the unwanted app and select Uninstall.
   
   

B. Clean Your Web Browsers (Chrome, Edge, Firefox)

Malware loves hijacking browser settings, changing your default search engine, or installing rogue extensions.

• Remove Extensions: Open your browser settings, go to Extensions, and remove anything unfamiliar or suspicious.
  
  
• Reset Settings: Go to browser settings > Reset/Restore settings to their original defaults to clear modified homepages and search engines.
  
  

Step 6: Clean Up the System Registry (Advanced)

If malware altered your registry keys to maintain persistence:

1. Press Windows Key + R, type regedit, and press Enter.
   
   
2. Navigate to: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run.
   
   
3. Look for unfamiliar registry entries pointing to strange file paths. Caution: Do not delete keys unless you are certain they belong to malware, as deleting critical system keys can break Windows.
   
   

Step 7: Reconnect and Secure Your PC

Once your scans come back clean and your system is running normally, restart your PC normally (exit Safe Mode) and reconnect to the internet.

To prevent future infections, practice these cybersecurity best practices:

• Keep Windows Updated: Always install the latest security patches.
  
  
• Use a Reliable Antivirus: Keep real-time protection active.
  
  
• Avoid Phishing Links: Never download cracked software, pirated media, or click unknown email attachments.
  
  
• Back Up Regularly: Keep an offline backup of important files to protect against ransomware.
  
  

Frequently Asked Questions (FAQ)

How do I know if my PC has malware?

Common signs include sudden system slowdowns, unexpected pop-up ads, high CPU/disk usage when idle, disabled security tools, or missing personal files.

Can Windows Defender remove all malware?

Windows Defender is powerful and handles most standard threats, but pairing it with an on-demand scanner like Malwarebytes ensures a higher success rate against specialized adware and trojans.

What should I do if malware locks my files (Ransomware)?

Do not pay the ransom. Disconnect the PC immediately, check if decryption tools are available on sites like NoMoreRansom.org, or restore your files from a clean backup.