How to Remove Malware from Computer in 12 Proven Ways

What to Do Immediately If You Suspect Malware

Your first actions should limit further damage. The correct response depends partly on what happened:

If the computer belongs to an employer, school, or other organization, contact its IT or security team before making changes. The organization may need to preserve logs or other evidence.

How to Tell If Your Computer Has Malware

Malware can affect performance, browsers, files, security settings, and online accounts. Common warning signs include:

• Sudden crashes or unexplained performance problems
• Browser redirects, persistent pop-ups, or changed search settings
• Unknown applications or browser extensions
• Unrecognized programs launching at startup
• Disabled antivirus or firewall protection
• Failure to access Windows Update or security websites
• Unexplained email, banking, or social-media activity
• Files that have been renamed, modified, deleted, or encrypted
• Unexpected remote-control software

The strongest evidence is a confirmed detection from a reputable security tool or a clear connection between suspicious activity and a file, installer, script, or command you ran.

How to Remove Malware from Windows 10 or 11

The following process explains how to remove malware from Windows 11 and Windows 10 using Microsoft Defender as the primary tool. Menu names may vary slightly by Windows version and device configuration.

Method 1. Update Windows Security

Update Microsoft Defender's security intelligence before running a scan. These updates help Defender recognize newly identified threats.

• Open "Start" and search for "Windows Security."

• Select "Virus & threat protection."

  

• Under "Virus & threat protection updates," select "Protection updates."

• Select "Check for updates."

• Install available Windows updates from "Settings > Windows Update" when possible.

Windows normally obtains security intelligence through Windows Update, but Microsoft also provides a manual update option in Windows Security. Reconnect only as long as needed if you previously isolated the computer.

If malware like blocks updates or prevents Windows Security from opening, continue to Microsoft Defender Offline or use a reputable second-opinion scanner downloaded on a clean device.

Method 2. Run a Full Malware Scan

Use a full scan when you suspect an active infection. A quick scan checks common malware locations, while a full scan examines every file and running program on the device.

• Open "Windows Security."

• Select "Virus & threat protection."

• Select "Scan options."

• Choose "Full scan > Scan now."

  

• Allow the scan to finish.

A full scan can take a long time, especially on a computer with large drives or many archives. Keep the computer connected to power and close unnecessary applications.

Method 3. Quarantine or Remove Detected Threats

Open "Protection history" after the scan and review each detection. Windows Security may offer actions such as quarantine, remove, or allow.

• Quarantine: Isolates the detected item so it cannot run normally. This is useful when you need time to verify a detection.
• Remove: Deletes the detected threat from the computer.
• Allow: Tells Windows Security not to act on the item.

Removing or quarantining malware like infostealer malware does not reverse information theft, restore encrypted files, or terminate account sessions that an attacker already obtained.

Method 4. Run Microsoft Defender Offline

Use Microsoft Defender Offline if malware returns, interferes with normal scans, or may be hiding while Windows is running.

• Open "Windows Security."

• Select "Virus & threat protection."

• Select "Scan options."

• Choose "Microsoft Defender Antivirus (offline scan)."

• Select "Scan now."

• Approve the restart.

The scan runs in the Windows Recovery Environment without loading the normal Windows session, which makes it harder for persistent malware to hide or defend itself. The computer restarts automatically when the scan finishes.

Review the result under "Windows Security > Virus & threat protection > Protection history." Microsoft documents the current scan options in its Windows Security guidance.

Method 5. Remove Suspicious Apps and Programs

After detected threats have been handled, remove applications that were installed as part of the incident.

• Open "Settings > Apps > Installed apps" in Windows 11 or "Settings > Apps > Apps & features" in Windows 10.

• Sort the list by installation date if that option is available.

• Look for programs installed around the time the problem began.

• Verify the program and publisher before removing it.

• Select the confirmed suspicious application and choose "Uninstall."

• Follow the prompts and restart if required.

Do not delete unfamiliar files from Windows system folders just because their names look unusual. Also, deleting the original installer does not remove components the installer may already have added.

If you cannot verify an application, search for documentation from its legitimate publisher or ask a qualified technician.

Method 6. Check Startup Apps and Scheduled Tasks

Malware sometimes creates a startup entry or scheduled task so it can return after a restart.

To review startup applications:

• Open "Settings > Apps > Startup," or right-click "Start" and open "Task Manager."

• Select "Startup."

  

• Look for entries connected to the confirmed suspicious program.

• Disable an entry only after identifying what it belongs to.

You can also open "Task Scheduler" and review the "Task Scheduler Library" for tasks created around the suspected infection time. Check the task's author, trigger, and referenced program.

Method 7. Remove Untrusted Browser Extensions

Remove extensions you did not install, no longer need, or cannot verify.

In Chrome:

• Open the three-dot menu.

• Select "Extensions > Manage extensions."

  

• Review each extension.

• Select "Remove" for an untrusted extension.

Other browsers provide a similar extensions or add-ons page. Pay particular attention to extensions that can read site data, control downloads, change search settings, or manage a proxy or VPN.

If an extension returns after removal, another installed program or synchronized browser profile may be restoring it. Continue with a browser reset and another malware scan.

Method 8. Reset Your Browser Settings

Reset an affected browser if redirects, unwanted search engines, pop-ups, or modified startup pages continue after removing extensions.

For Chrome:

• Open "Settings."

• Select "Reset settings."

  

• Select "Restore settings to their original defaults."

• Confirm with "Reset settings."

According to Google Chrome Help, this resets items such as the search engine, startup pages, content settings, cookies, and extensions without deleting saved bookmarks or passwords.

Other browsers have their own reset or refresh process. A browser reset corrects browser configuration; it does not remove malware elsewhere in Windows.

Method 9. Scan Your Computer with a Second Malware Removal Tool

Use a reputable on-demand scanner as a second opinion when:

• Windows Security cannot complete a scan.
• A threat keeps returning.
• Malware appears to interfere with Microsoft Defender.
• You need a scanner designed for a specific threat.

Download the tool from the provider's official website, preferably using a clean device. Avoid search advertisements, download portals, and unofficial mirrors.

Do not run multiple real-time antivirus products simultaneously unless their vendors explicitly support that configuration. Competing real-time scanners can cause conflicts without guaranteeing better detection.

Method 10. Restart Windows in Safe Mode If Malware Persists

Safe Mode starts Windows with a limited set of files, drivers, and services. This can make troubleshooting easier when unwanted software interferes with normal Windows operation.

To enter Safe Mode:

• Open "Settings > System > Recovery" in Windows 11, or "Settings > Update & Security > Recovery" in Windows 10.

• Under "Advanced startup," select "Restart now."

• Choose "Troubleshoot > Advanced options > Startup Settings > Restart."

• Select "Enable Safe Mode."

  

You may need the BitLocker recovery key if device encryption is enabled. Use standard Safe Mode rather than Safe Mode with Networking unless the removal procedure requires internet access.

Method 11. Restart Your Computer and Scan Again

Restart Windows normally after completing the removal steps. Then:

• Confirm that Windows Security is enabled.

• Update its security intelligence again.

• Run another full scan.

• Review "Protection history."

• Check whether removed applications, extensions, or startup entries have returned.

• Test whether Windows Update and security websites work normally.

• Watch for the original symptoms.

A system appears more likely to be clean when follow-up scans find no additional threats, protection remains enabled, unwanted browser changes do not return, and suspicious account or network activity stops.

A clean scan is not an absolute guarantee. Escalate if high-risk symptoms continue or if the computer handled valuable business, financial, or confidential information.

Method 12. Reset or Reinstall Windows as a Last Resort

Consider a reset or clean reinstallation when:

• Malware repeatedly returns after offline and second-opinion scans.
• Security settings cannot be restored.
• Unauthorized remote access occurred.
• The infection made extensive system changes.
• You cannot determine whether the computer is trustworthy.
• A qualified professional recommends rebuilding the system.

• Reset this PC: Reinstalls Windows may let you keep personal files, but it removes applications and resets settings.
• Clean reinstallation: Uses installation media and is more thorough, but it normally removes files, applications, and settings.

How to Recover Files After a Malware Infection

After removing malware, your computer may appear normal again, but your files may still be missing, damaged, or inaccessible. Malware can affect data before detection, and some files may also be lost during the cleanup process, system reset, or reinstallation.

Before using the computer normally again, check whether important photos, documents, videos, or other files are missing. If you do not have a clean backup, data recovery software may help find recoverable files.

4DDiG Data Recovery is designed for situations where files are deleted, lost, formatted, or become inaccessible after malware attacks or system cleanup. It can scan internal drives, external hard drives, USB drives, and SD cards to help locate recoverable data.

Before recovery, make sure the malware has been removed. Then follow these steps:

• Install and launch 4DDiG. If possible, install the program on a different drive to reduce the risk of overwriting lost data.

  

• Select the location where files were lost. Choose the affected drive, partition, USB device, or SD card, then click "Scan."

  

• Scan for lost files. 4DDiG will search for deleted, missing, or inaccessible files. You can filter results by file type to locate specific photos, videos, documents, or other data faster, then click "Recover".

  

• Recover files to another safe location. Select the files you want and save them to a different drive or partition instead of the original affected location.

  

After recovery, scan the recovered files before opening them. Avoid restoring suspicious executable files, scripts, installers, macros, or unknown archives that may contain malware.

What to Do After Removing Malware from Your Computer

After removing malware, secure any accounts that may have been exposed and make sure the computer remains stable.

Secure Your Accounts

Use a clean device to change passwords for your primary email, password manager, banking, work, cloud storage, and other important accounts. If you reused the same password elsewhere, change it there too.

Sign out of other active sessions, review recognized devices and recovery information, and remove unfamiliar connected apps or account changes.

Enable Two-Factor Authentication

Turn on two-factor authentication where available. An authenticator app, security key, or passkey can add another layer of protection if a password was exposed.

Check for Suspicious Activity

Review email, banking, payment, social-media, cloud, and work accounts for unauthorized activity. Report suspicious transactions or account changes promptly.

Confirm the Computer Is Clean

Run another malware scan and make sure Windows Security remains enabled. Check that browser redirects, suspicious startup items, unwanted extensions, and other original symptoms do not return.

How to Prevent Malware Infections

Reducing malware risk mainly comes down to using trusted software sources, checking downloads before opening them, and keeping Windows protected and up to date.

Download Software From Trusted Sources

Prefer the Microsoft Store, the developer's official website, or its official GitHub Releases page. Avoid unfamiliar download portals, and do not assume the first search result is legitimate.

Check the Website and Installer

Verify the website domain before downloading. Watch for misspellings, unusual subdomains, or unexpected domain extensions.

For Windows installers, check the file's digital signature when available and confirm that the signer matches the expected publisher.

Scan Suspicious Downloads Before Opening Them

Use Microsoft Defender or another reputable security scanner before running an unfamiliar file. Do not reopen a suspicious file simply to test whether it is safe.

Keep Windows Protection and Updates Enabled

Keep Microsoft Defender, SmartScreen, Windows, browsers, and frequently used applications updated. Do not disable security protections just to run an installer.

Conclusion

Removing malware requires more than a single antivirus scan. Isolate the PC, run updated security scans, secure exposed accounts, and confirm that suspicious activity does not return.

Recover files from a clean backup whenever possible. If important data is missing after malware removal, 4DDiG can help scan for deleted, lost, or inaccessible files. Save recovered files to another safe location and check them before use.