Before You Begin: Signs Your PC May Be Infected
Malware doesn't always make itself obvious. Your PC might be compromised if you notice: unusually slow performance, frequent crashes or BSODs (Blue Screen of Death), programs opening or closing on their own, unexpected network activity, or antivirus alerts you've been dismissing.
If you're experiencing any of these, follow the steps below carefully and in order.
Step 1: Disconnect from the Internet
Before doing anything else, disconnect your PC from the internet — either by unplugging the Ethernet cable or turning off Wi-Fi. Many malware types communicate with remote servers to receive instructions or exfiltrate your data. Cutting the connection limits the damage while you clean the system.
Step 2: Boot into Safe Mode
Safe Mode starts Windows with the minimum set of drivers and programs — most malware cannot run in this environment.
- Press Windows + R, type
msconfig, and press Enter - Go to the Boot tab and check Safe boot → Minimal
- Click OK and restart your PC
Alternatively, hold Shift while clicking Restart and navigate to Troubleshoot → Advanced Options → Startup Settings → Restart → Safe Mode with Networking.
Step 3: Delete Temporary Files
Malware often hides in temporary file directories. Before scanning, clear these out:
- Press Windows + R, type
%temp%, and delete all files in the folder - Also run the built-in Disk Cleanup utility (search for it in the Start Menu)
This can also speed up the subsequent scan.
Step 4: Run a Malware Scan
Use at least two scanning tools for the best results — no single scanner catches everything.
- Windows Defender (built-in): Open Windows Security → Virus & Threat Protection → Scan Options → Full Scan
- Malwarebytes Free: Download from malwarebytes.com, install, update definitions, and run a full scan
- HitmanPro: A second-opinion scanner that's effective against rootkits and persistent threats
Quarantine or delete everything the scanners flag. Restart your PC between scans when prompted.
Step 5: Check for Suspicious Startup Programs
Malware often adds itself to startup to persist after reboots. To review what's running at startup:
- Press Ctrl + Shift + Esc to open Task Manager
- Click the Startup tab
- Look for anything unfamiliar or with an unknown publisher
- Right-click suspicious entries and choose Disable
For a deeper view, use Autoruns from Microsoft Sysinternals — it shows every program set to run automatically on your system.
Step 6: Check Installed Programs
Go to Settings → Apps → Installed Apps and sort by install date. Remove anything you don't recognise, especially items installed around the time your issues began.
Step 7: Scan for Rootkits
Rootkits are particularly dangerous — they hide deep in your system and can survive standard scans. Use GMER or Kaspersky TDSSKiller (both free) to specifically scan for rootkit activity.
Step 8: Restore Browser Settings
Malware often modifies browser settings. Reset all your browsers to defaults and remove unfamiliar extensions (see our adware removal guide for detailed steps).
Step 9: Change Your Passwords
Once your system is clean, change passwords for important accounts — especially email, banking, and social media. Do this from a different, trusted device if possible, in case a keylogger was active.
When to Consider a Full Reinstall
If malware persists after all the above steps, or if you suspect a serious rootkit or ransomware infection, a clean reinstall of Windows may be the safest option. Windows 10 and 11 both include a Reset this PC option under Settings → System → Recovery that can reinstall the OS while keeping your files.
Removing malware takes patience, but working through these steps methodically will resolve the vast majority of infections.