How to Remove Malware From Windows
Removing malware reliably means removing the mechanism that restores it, not just the file you can see.
1. Contain
Disconnect from the network if data theft or ransomware is possible. Stop entering passwords on the machine.
2. Scan and quarantine
Run a threat scan with an updated database, quarantine everything you cannot positively identify as legitimate, and reboot when prompted.
3. Hunt the persistence
- Task Manager → Startup: disable entries you do not recognize.
- Task Scheduler: look for tasks running executables from AppData, Temp or ProgramData.
- services.msc: check for recently created services with random names.
- Browsers: remove unknown extensions and reset search and homepage settings.
4. Escalate to Safe Mode
If detections return, boot into Safe Mode with Networking and repeat the scan with rootkit detection enabled. Most persistence mechanisms do not load there.
5. Verify
Two consecutive clean scans across a reboot, plus normal CPU and network behavior at idle, is the practical definition of clean. Then follow the post-infection checklist.
When to reinstall Windows instead
Credential-stealing families, bootkits and repeat re-infection all argue for a clean install. It is often the faster path, and it is the only one that gives certainty. Back up documents, not programs.
Frequently asked questions
Can I remove malware without any software?
Sometimes, for simple adware, by uninstalling programs and resetting browsers. For anything else a scanner finds components manual inspection misses.
Does System Restore remove malware?
Rarely and unreliably. Many families disable restore points or reinstall themselves afterwards.
Malware-Bytes.net is an independent information resource about malware protection for Windows. We are not Malwarebytes, and this site is not the official Malwarebytes website or support channel. Malwarebytes is a trademark of Malwarebytes Inc.