Erasing malware requires disconnecting from the internet, booting into Safe Mode, deleting temporary files, and running a full scan with Windows Security or a tool like Malwarebytes.
One wrong click can silently open the door to a computer threat that slows your machine, hijacks your browser, or steals your data. The fix isn’t complicated, but the order matters. Starting the wrong way gives malware a chance to hide again. This walkthrough covers the exact sequence that works on Windows 10, Windows 11, and recent versions of macOS, using tools already on your computer or available from trusted sources for free.
Disconnect From The Internet
The first step is also the easiest to skip. Unplug the Ethernet cable or click the Wi-Fi icon in the taskbar and turn off the network connection. Cutting internet access stops malware from phoning home to a command server or downloading additional payloads. Keep the machine offline until every cleaning step is done.
Boot Into Safe Mode
Running a scan inside Safe Mode prevents most malware from loading at startup, so detection rates go way up. On Windows 10 and 11, the menu path is Settings > System > Recovery > Advanced startup > Restart now. After the reboot, navigate Troubleshoot > Advanced options > Startup Settings > Restart, then press 4 (F4) for standard Safe Mode. Pressing 5 (F5) adds networking support if you need to download a removal tool after booting.
On Windows 10, a faster method works: hold the Shift key while clicking Power > Restart right from the sign-in screen. The same recovery menu appears.
Delete Temporary Files
Malware often hides inside temp folders, and clearing them out removes some threats outright while speeding up the scan that follows. Open Settings > System > Storage > Temporary files, select the file categories shown, and click Remove files. The Disk Cleanup tool works just as well — type “Disk Cleanup” into the search bar, pick the system drive, check all boxes, and click Clean up system files.
Run The Right Scan On Windows
Windows comes with a capable scanner built in, but the default Quick Scan misses the deep infections. Open Windows Security by typing its name into the search bar, then go to Virus & threat protection > Scan options. Select Full scan and let it run — this sweeps every file and running program on the system.
If the Full scan finds nothing but the computer still behaves oddly, the hidden infection may be evading detection inside a normal Windows environment. The next step is the Microsoft Defender Antivirus Offline Scan, which boots and runs before Windows loads. Back in the Scan options screen, pick Microsoft Defender Antivirus offline scan and click Scan now. The computer restarts, spends about fifteen minutes checking the system from a clean boot environment, then reboots back into Windows with the results.
Common Malware Removal Mistakes To Avoid
Most removal attempts fail for the same few reasons. Skipping Safe Mode lets malware regenerate after a scan. Relying on a Quick Scan instead of a Full or Offline Scan misses deeply buried threats. Running one tool and stopping — without also uninstalling suspicious apps or resetting browser settings — often leaves enough behind that the infection returns within a day.
| Scan Type | What It Covers | Best Used When |
|---|---|---|
| Quick Scan | Running processes and startup locations | Routine weekly check; not for active infections |
| Full Scan | All files, programs, and memory | First step in any removal attempt |
| Offline Scan | Boots before Windows; catches deeply hidden malware | When Full scan finds nothing but symptoms remain |
| Malwarebytes | PUPs, adware, and threats Defender may miss | Second-opinion scan after Windows Security |
| MSRT Tool | Specific prevalent malware strains only | Targeted removal after an MSRT alert |
Check For Suspicious Programs And Extensions
Malware often arrives disguised as a tool, a browser extension, or a login item. Open Settings > Apps > Installed apps and sort by installation date. Any program you don’t recognize that appeared around the time the trouble started should be uninstalled immediately. In Chrome, go to Settings > Extensions and remove anything unfamiliar. Firefox and Edge have a similar path. Finally, check Settings > Apps > Startup and disable anything that looks out of place — malware often sets itself to run at every boot.
Run A Second Scanner For Stubborn Infections
Windows Security catches a lot but not everything. Malwarebytes is free for on-demand scanning and excels at finding adware, browser hijackers, and potentially unwanted programs (PUPs) that other tools miss. Download it from the official malwarebytes.com site only, install it, and run a scan. If it finds threats, quarantine them, restart normally, then scan again to confirm the system is clean.
One point of honesty here: free antivirus tools don’t always remove every remnant of aggressive malware on the first pass. If Windows Security and Malwarebytes both finish a full scan with no findings and the computer still has visible problems like a hijacked browser or locked files, consider a factory reset. On Windows 11, go to Settings > System > Recovery > Reset this PC. Choose Remove everything to wipe the drive completely. Back up important files before doing this — a reset erases all personal data.
After The Malware Is Gone
Erasing the infection is half the job. The cleanup afterward matters just as much. Change every password you entered while the machine was infected — email, banking, social media, and streaming services all count. Enable two-factor authentication (2FA) on each account for a durable layer of protection. Reconnect to the internet, run one more Full scan to confirm nothing came back, and you’re done.
| Situation | Best Action | Time Estimate |
|---|---|---|
| One rogue app causing pop-ups | Boot Safe Mode + Microsoft Defender Full Scan + uninstall the app | 30–45 minutes |
| Browser keeps redirecting | Safe Mode + delete temp files + reset browser + Offline Scan | 1–2 hours |
| PC runs slow, scans find nothing | Offline Scan + Malwarebytes scan + check startup items | 2–3 hours |
| Screen locked with ransom demand | Do not pay — disconnect internet, boot into Safe Mode, run Offline Scan; prepare to factory reset | 30 min–4 hours |
| Mac shows adware behavior | Install Malwarebytes for Mac, run scan, uninstall suspicious login items, reset browser | 1 hour |
References & Sources
- Microsoft. “Microsoft resources and guidance for removal of malware and viruses.” Official procedure for Windows Security, Safe Mode, and Offline Scan.
