Malware can cause serious problems on a Windows PC, including slow performance, unwanted pop-ups, browser redirects, suspicious applications, and unauthorized changes to system settings. In some cases, malware can also put personal information and important files at risk.
Fortunately, you can remove many types of malware by using reliable security software. Windows includes Microsoft Defender Antivirus, while third-party security applications can provide additional scanning and protection features.
This guide explains how to remove malware with security software, how to perform different types of scans, and what to do if malware continues to appear after removal.
What Is Malware?
Malware is a broad term for malicious software designed to damage systems, steal information, disrupt operations, or gain unauthorized access.
Common types of malware include:
- Viruses: Malicious programs that can modify or damage files.
- Trojans: Programs that appear legitimate but perform malicious actions.
- Spyware: Software designed to monitor activity or collect information.
- Ransomware: Malware that can encrypt files and demand payment.
- Adware: Software that displays unwanted advertisements.
- Worms: Malware that can spread between computers or networks.
- Rootkits: Malicious software designed to hide deep within a system.
Because malware behaves differently depending on its type, a complete security scan is often necessary when you suspect an infection.
Signs Your Windows PC May Have Malware
Not every performance problem is caused by malware. However, several unusual symptoms can indicate a potential infection.
Watch for signs such as:
- Windows suddenly becomes unusually slow.
- Unknown applications appear on the computer.
- Your browser redirects to unfamiliar websites.
- Excessive pop-ups appear.
- Your homepage or search engine changes without permission.
- Security settings are unexpectedly disabled.
- Unknown processes consume significant CPU or memory.
- Files become inaccessible or unexpectedly change.
- You receive unusual security warnings.
- Network activity increases when the computer is idle.
If several of these symptoms occur together, running a malware scan is a sensible troubleshooting step.
Before Removing Malware
Before starting the removal process, take a few precautions.
Disconnect From the Internet if Necessary
If you suspect that malware is actively communicating with a remote server, disconnect your computer from the internet temporarily.
You can disable Wi-Fi or unplug an Ethernet cable. This can help limit network communication while you investigate the problem.
However, keep in mind that security software may need an internet connection to download the latest security intelligence and updates. If possible, update your security software before disconnecting.
Save Important Work
Save documents and close applications before starting a deep malware scan.
Avoid opening suspicious files or launching unfamiliar applications while troubleshooting the computer.
Update Your Security Software
Security software is most effective when its malware definitions and detection engine are current.
For Microsoft Defender Antivirus, open Windows Security and check for security intelligence updates through Windows Update.
Third-party security applications generally provide their own update option.
How to Remove Malware With Microsoft Defender Antivirus
Microsoft Defender Antivirus is built into supported versions of Windows and can detect and remove many common malware threats.
Follow these steps to perform a scan.
1. Open Windows Security
Press Windows + S and search for:
Windows Security
Open the application from the search results.
2. Open Virus & Threat Protection
Select Virus & threat protection.
This section provides access to Microsoft’s antivirus scanning and threat-management features.
3. Check for Updates
Look for the protection update section and select the option to check for updates if available.
Installing the latest security intelligence helps Defender recognize newer threats.
4. Run a Quick Scan
Select Quick scan to check common locations where malware may be found.
A quick scan is useful when you want to perform an initial security check without waiting for a full system scan.
If Windows Security reports a threat, follow its recommended action to quarantine or remove the detected item.
Run a Full Malware Scan
If you suspect that malware is present despite a clean quick scan, perform a full scan.
A full scan examines a much larger portion of the system and can take significantly longer.
To run it:
- Open Windows Security.
- Select Virus & threat protection.
- Choose Scan options.
- Select Full scan.
- Click Scan now.
Keep the computer powered on while the scan is running.
You can continue using Windows during some scans, but demanding applications may make the process take longer.
Use Microsoft Defender Offline Scan
Some malware can attempt to hide while Windows is running. In such situations, an offline scan can be useful.
Microsoft Defender Offline runs outside the normal Windows environment, allowing Defender to examine the system before Windows fully loads.
To access it:
- Open Windows Security.
- Select Virus & threat protection.
- Choose Scan options.
- Select Microsoft Defender Antivirus (offline scan).
- Click Scan now.
Windows will restart the computer and perform the scan.
Important
Save your work before starting an offline scan because the computer will restart.
This option is particularly useful when a suspected threat is difficult to remove during normal Windows operation.
How to Remove Malware With Third-Party Security Software
You can also use a reputable third-party antivirus or anti-malware application.
The exact interface varies between products, but the general process is similar.
Step 1: Install Security Software From a Trusted Source
Download the security application from the vendor’s official website or another trusted distribution channel.
Avoid downloading antivirus software from random pop-ups claiming that your computer is infected.
Step 2: Update the Malware Database
Launch the security application and check for updates.
The program should download the latest malware definitions and detection updates before scanning.
Step 3: Run a Quick Scan
Start with a quick or smart scan to identify common threats.
If the software detects malware, review the results before taking action.
Step 4: Quarantine Detected Threats
Most security applications provide a quarantine feature.
Quarantining isolates suspicious files so they cannot normally execute.
If the security software confirms that an item is malicious, follow its recommended removal procedure.
Step 5: Run a Deep Scan
If you suspect a serious infection, run a full, deep, or custom scan.
A deeper scan can take considerably longer but provides a more thorough examination.
Quarantine vs. Delete: Which Should You Use?
Security software may give you several options when it detects a suspicious file.
Quarantine moves the file into an isolated location where it cannot normally run. This provides a safer way to deal with uncertain detections.
Delete permanently removes the detected file from the system.
In general, quarantine is useful when you want the security software to isolate the item while you verify whether it is actually malicious. If the software identifies the file as confirmed malware, removal may be appropriate.
Be careful when manually deleting files from system directories. Removing a legitimate Windows file can cause additional problems.
Restart Windows After Malware Removal
After security software removes or quarantines malware, restart the computer when prompted.
A restart can help complete the removal process and allow security components to reload normally.
After restarting, run another scan if the security application recommends it.
Check for Malware That Starts Automatically
Some malicious programs attempt to launch whenever Windows starts.
You can review startup applications through Task Manager.
Press:
Ctrl + Shift + Esc
Then select Startup apps.
Look for unfamiliar programs, but do not disable an item simply because its name is unfamiliar. Some legitimate Windows components and installed applications may have technical names.
If you identify a suspicious startup item, research the application or let your security software determine whether it is malicious before removing it.
Check Your Browser After Malware Removal
Malware and potentially unwanted software can modify browser settings.
After removing a threat, check:
- Homepage settings
- Default search engine
- Installed extensions
- Notification permissions
- Proxy settings
- Saved passwords and account security
- Recently installed applications
Remove extensions you do not recognize.
If browser behavior remains abnormal, resetting the browser settings may help restore its default configuration.
What to Do If Malware Keeps Returning
Sometimes malware appears to return after removal. This can happen if another malicious component reinstalls it.
Try the following steps:
Run a Full Scan
A quick scan may not identify every component of an infection. Perform a full scan with your security software.
Run an Offline Scan
Use Microsoft Defender Offline or an equivalent trusted security feature if the threat appears difficult to remove.
Remove Suspicious Applications
Open Settings > Apps > Installed apps and review recently installed software.
Uninstall applications you recognize as unwanted, but avoid removing legitimate system components without confirmation.
Check Browser Extensions
Malicious or unwanted browser extensions can restore unwanted settings or redirect websites.
Remove extensions you do not recognize.
Update Windows
Install available Windows security updates. Vulnerabilities in outdated software can increase the risk of malware infections.
Scan External Drives
If you regularly connect USB drives or external storage, scan them as well. Malware can sometimes spread through removable storage.
How to Protect Windows From Future Malware Infections
Removing malware is only part of the solution. Good security habits can reduce the chance of another infection.
Keep Windows Updated
Install security updates regularly. Updates can fix vulnerabilities that attackers may exploit.
Keep Antivirus Protection Enabled
Avoid disabling real-time protection unless you have a specific and legitimate reason.
If you use third-party antivirus software, understand how it interacts with Windows Security before changing security settings.
Download Software Carefully
Download applications from official websites or reputable stores.
Be particularly cautious with cracked software, unauthorized activators, suspicious browser extensions, and unofficial installers.
Avoid Suspicious Email Attachments
Do not open unexpected attachments simply because the message appears to come from a familiar company or contact.
Verify the sender and context before opening files.
Use Strong, Unique Passwords
If malware may have exposed account credentials, change passwords from a clean device when appropriate.
Using unique passwords for important accounts can limit the damage if one credential is compromised.
Enable Multi-Factor Authentication
Multi-factor authentication adds another verification step when signing into supported accounts.
It can provide additional protection even if a password is compromised.
Can Security Software Remove All Malware?
No security software can guarantee detection of every possible malicious program.
New malware can appear before security vendors have complete detection information. Some threats also use techniques designed to evade traditional antivirus detection.
For this reason, malware protection should combine security software with safe browsing habits, regular updates, cautious software installation, backups, and account security.
When You Should Reset or Reinstall Windows
If malware continues to survive multiple scans, causes persistent system problems, or compromises important system components, a Windows reset or clean installation may become necessary.
Before taking this step, back up important personal files carefully.
Do not blindly copy suspicious executable files or unknown applications into the new installation.
For particularly serious infections involving sensitive information, consider seeking professional assistance rather than repeatedly attempting manual removal.
Final Thoughts
Learning how to remove malware with security software can help you respond quickly when a Windows PC behaves suspiciously. Start by updating your security software, then perform a quick scan followed by a full scan when necessary.
For threats that are difficult to remove while Windows is running, an offline scan can provide another layer of detection. After removing malware, restart Windows, check for suspicious applications and browser extensions, and install available security updates.
Most importantly, malware prevention should be an ongoing process. Keeping Windows and security software updated, downloading applications carefully, avoiding suspicious files, and maintaining reliable backups can significantly improve your overall security.