How to Remove Malware from Your PC: A Complete Step-by-Step Guide

Finding out your computer is infected with malware triggers a specific kind of panic. There is the immediate concern about what data the attacker has accessed, followed by confusion about which removal steps to trust. The internet is full of malware removal guides that recommend downloading unfamiliar scanner tools from questionable websites, which is exactly the kind of advice that leads to secondary infections.

This guide walks through a proven removal sequence used by IT support professionals. Each step builds on the previous one, and the order matters. Skipping steps or performing them out of sequence can leave remnants of the infection that reactivate after you think the problem is solved.

Warning Signs: How to Know You Are Infected

Malware does not always announce itself with a ransom note on your screen. Many infections operate quietly in the background, collecting data or using your system resources for the attacker's purposes. Recognizing the signs early limits the damage. Here are the most common indicators that your computer has been compromised:

Unexpected system slowdown: If your computer suddenly becomes sluggish without explanation, particularly during tasks that previously ran normally, malware may be consuming CPU, memory, or disk resources in the background. Open Task Manager (Ctrl+Shift+Esc) and sort processes by CPU usage. Unknown processes consuming high percentages are a red flag.

Pop-up ads appearing on the desktop: Adware infections display advertisements outside of a browser context, meaning pop-ups appear even when no browser window is open. These pop-ups often contain aggressive scare tactics like "Your computer is infected" warnings designed to trick you into calling a fake tech support number or installing additional malware disguised as a cleanup tool.

Browser redirects: Your searches go to an unfamiliar search engine, or clicking links takes you to pages that are not what the link text described. The infection has modified your browser settings, installed a malicious extension, or is intercepting DNS requests to redirect traffic through the attacker's servers.

Unknown programs in your applications list: Open Settings > Apps > Installed Apps in Windows 11 (or Programs and Features in Windows 10). Sort by install date. Applications you did not install that appeared recently, especially those with generic names like "PC Optimizer" or "Driver Updater," are suspicious. Bundled software from legitimate installers is common, but truly unknown entries warrant investigation.

Disabled security software: Malware often disables Windows Defender, Windows Firewall, or third-party antivirus before beginning its main activity. If you open Windows Security and find real-time protection turned off without your action, the cause may be a script or executable that modified registry keys controlling security settings.

Unusual network activity: If your internet connection seems slow despite normal local performance, open Resource Monitor (type "resmon" in Start) and check the Network tab. A process sending large amounts of data to an unknown IP address is a strong indicator of a data exfiltration or botnet infection.

Step 1: Disconnect from the Internet Immediately

The first action when you suspect malware is to disconnect the computer from the internet. Unplug the Ethernet cable or turn off WiFi. This stops the malware from communicating with its command-and-control server, prevents additional payloads from being downloaded, and blocks data exfiltration of your files, passwords, and browsing history.

Many malware variants, particularly ransomware and information stealers, are designed to phone home within seconds of execution. If the malware has been running for hours or days, the damage from internet access has already occurred. But if you caught the infection early, disconnecting can stop the attack mid-execution and limit what data leaves your machine.

Do not disconnect by simply turning off the router if other devices on the network need internet access. Disconnect the infected computer specifically, either through the physical Ethernet cable or the WiFi toggle in Windows. If you are on a laptop, the hardware WiFi switch or Airplane Mode is the fastest way.

Step 2: Boot into Safe Mode

Safe Mode starts Windows with only the essential drivers and services. Most malware launches automatically at startup through registry run keys, scheduled tasks, or service entries. By booting into Safe Mode, you prevent the malware from loading, which gives your scanning tools a clean environment to detect and remove the infection without the malware actively fighting back.

To enter Safe Mode on Windows 10 or 11, hold the Shift key while clicking Restart from the Start menu. On the blue recovery screen, select Troubleshoot, then Advanced Options, then Startup Settings, then Restart. After the restart, press 4 or F4 for standard Safe Mode, or 5 or F5 for Safe Mode with Networking if you need to download scanner tools.

Safe Mode with Networking is useful for downloading Malwarebytes and other removal tools, but it also provides the malware with internet access if it manages to load. The safest approach is to download the necessary tools on a clean computer, transfer them via USB drive, and then boot into standard Safe Mode without networking for the actual scanning.

Step 3: Run Malwarebytes

Malwarebytes is the most effective first-pass scanner for consumer malware removal. Its detection engine focuses on actively circulating threats, adware, browser hijackers, and potentially unwanted programs (PUPs) that traditional antivirus engines sometimes ignore. In controlled tests against a library of current malware samples, Malwarebytes detected and removed 94% of threats on first scan, higher than any single competitor.

Download Malwarebytes from the official website on a clean computer, transfer the installer to the infected machine via USB, and install in Safe Mode. Before running the scan, go to Settings > Security and enable "Scan for rootkits." This adds rootkit detection, which scans system areas where malware hides at the kernel level. Rootkit scanning increases scan time by approximately 50% but catches threats that a standard scan misses.

Run a full Threat Scan rather than a quick scan. The full scan examines all files, running processes, registry entries, and startup items. On a typical computer with a 256GB SSD, this takes 15-30 minutes. When the scan completes, quarantine all detected items and restart the computer normally to verify the threats have not returned.

Step 4: Run HitmanPro as a Second-Opinion Scanner

No single scanner catches everything. HitmanPro, now owned by Sophos, is a cloud-based second-opinion scanner that cross-references suspicious files against multiple antivirus engines simultaneously. It uses engines from Bitdefender, Kaspersky, and Sophos in a single scan, which catches threats that Malwarebytes detects and misses, and vice versa.

HitmanPro runs without installation. Download the executable, run it, and select "No, I only want to perform a one-time scan." The scan completes in 2-5 minutes because it focuses on active threats and suspicious file locations rather than scanning every file on disk. Quarantine all detected items and restart.

Using two scanners in sequence, Malwarebytes followed by HitmanPro, is standard procedure in professional malware removal because the detection engines are complementary. Malwarebytes excels at adware, browser hijackers, and PUPs. HitmanPro excels at trojans, rootkits, and fileless malware that hides in system memory or the registry. Together, they cover the threat spectrum more completely than either alone.

Step 5: Delete Temporary Files

Malware often hides in temporary folders because these locations are less likely to be included in routine scans and users rarely inspect their contents. Deleting temporary files removes many malware hiding spots and also speeds up subsequent scans by reducing the number of files that must be examined.

The fastest method is Windows' built-in Disk Cleanup tool. Open the Start menu, type "Disk Cleanup," and run the tool. Select the system drive, typically C:, and check "Temporary files," "Temporary Internet Files," "Recycle Bin," and "Thumbnails." Click "Clean up system files" and repeat to remove Windows Update leftovers and system error memory dump files. This clears several gigabytes of unnecessary data, including potential malware remnants.

For a more thorough cleanup, manually delete the contents of these folders after running Disk Cleanup:

• C:\Windows\Temp\
• C:\Users\[YourUsername]\AppData\Local\Temp\
• C:\Users\[YourUsername]\AppData\Local\Microsoft\Windows\INetCache\

Some files in these folders may be in use and refuse deletion. Skip them. The goal is to remove as many malware staging areas as possible, not to delete every temporary file on the system.

Step 6: Check and Clean Browser Extensions

Malicious browser extensions are a persistent infection vector because they are not files on disk but components installed inside the browser profile. Even after malware files are removed, a compromised extension can reinfect the system by redirecting to malicious sites or injecting scripts into every page you visit.

Open each browser installed on the system and check the extensions or add-ons page. In Chrome, navigate to chrome://extensions/. In Firefox, go to about:addons. In Edge, go to edge://extensions/. Remove any extension you do not recognize or did not install intentionally. Pay special attention to extensions with names like "PDF Converter," "Video Downloader," or "Coupon Finder." Legitimate extensions with these names exist, but malware often uses functional-sounding names to avoid suspicion.

If the browser's built-in search engine has been changed to an unfamiliar service, go to the browser settings and reset the default search engine to Google, Bing, or DuckDuckGo. Check the "Manage search engines" list for entries you did not add and remove them.

Step 7: Reset Browser Settings Completely

Removing individual extensions is not always sufficient because malware can modify browser settings that are not visible in the standard interface. Homepage redirects, proxy configurations, and custom DNS settings can survive extension removal. Resetting the browser to its default state clears all of these modifications.

In Chrome, go to Settings > Reset settings > Restore settings to their original defaults. This disables all extensions, clears temporary data, and resets the homepage, new tab page, search engine, and pinned tabs. Your bookmarks, history, and saved passwords are preserved. In Firefox, go to Help > More Troubleshooting Information > Refresh Firefox. In Edge, go to Settings > Reset settings > Restore settings to their default values.

After the reset, reinstall only the extensions you trust and verify their authenticity by checking the developer name, review count, and last update date. Extensions from developers you do not recognize with few reviews and no recent updates are higher risk.

Step 8: Change All Passwords from a Clean Device

If the malware was an information stealer, which is the most common malware category in 2024, your saved browser passwords, session cookies, and autofill data may have been exfiltrated. Information stealers extract browser-stored credentials within seconds of execution and upload them to the attacker's server. Assume every password saved in your browser has been compromised.

Do not change passwords on the infected computer. If any remnant of the malware remains, you will hand the attacker your new passwords as you type them. Use a known-clean device, such as a phone or a computer that was never connected to the same network as the infected machine.

Prioritize passwords in this order: email accounts first, because email accounts can reset passwords for every other service. Then financial accounts: banking, PayPal, investment platforms, and cryptocurrency exchanges. Then social media, cloud storage, and work accounts. Finally, shopping sites, forums, and other lower-priority services. Use a password manager to generate and store the new passwords rather than trying to remember them.

Step 9: Restore from Backup if Needed

If the malware caused data loss, such as ransomware encrypting files or a wiper deleting documents, restore from your most recent backup before the infection date. Verify that the backup itself is clean by scanning it with Malwarebytes before restoring. Some malware variants deliberately infect backup files and network shares to prevent recovery.

If you do not have a backup, this experience is a strong argument for starting one. Cloud backup services like Backblaze ($7 per month for unlimited storage) and local backup tools like Windows File History (built into Windows) are the two most straightforward options for preventing data loss from future infections.

Preventing Future Infections

After removing malware and resetting passwords, take steps to reduce the likelihood of reinfection. Install a reputable antivirus with real-time protection that scans files as they are downloaded and blocks malicious websites before they load. Norton 360, Bitdefender Total Security, and free options like Kaspersky Free all provide effective real-time protection that would have likely stopped the initial infection.

Keep Windows and all software updated. Enable automatic updates for Windows and set browsers to update automatically. Outdated software with known vulnerabilities is the second most common infection vector after user-downloaded files. Patch management tools like Patch My PC can automate updates for third-party software that does not update itself.

Use a standard user account for daily computing rather than an administrator account. Malware executing under a standard account has fewer system permissions, limiting its ability to modify system files, install kernel drivers, or disable security software. Create a separate administrator account for software installation and system changes, and use the standard account for everything else.