Computers & Electronics
9,320 views
25 min · 2 min read
7 steps
Advanced

How to remove malware from a Windows computer using free tools

Cleaning malware from a Windows PC is doable with patience and the right free tools. Follow a careful sequence of scans, removals, and recovery actions to minimize data loss and restore performance.

Verified by pleasexplain editors
  1. Step 1: Disconnect from the network

    Unplug Ethernet or turn off Wi‑Fi to stop the malware from communicating or spreading. This reduces risk while you analyze and remove infections, and keeps backups from being corrupted during repair.

    [Illustration: Image of a laptop being unplugged from an Ethernet cable and Wi‑Fi toggle switched off in Settings.]

  2. Step 2: Boot into Safe Mode

    Restart into Safe Mode with Networking (press Shift+Restart → Troubleshoot → Advanced Options → Startup Settings → Restart → choose 4 or 5). Safe Mode loads minimal drivers so many malware programs won’t run, making detection and removal more effective.

    [Illustration: Screenshot of Windows Advanced Startup options with Safe Mode choices highlighted.]

  3. Step 3: Create a recovery backup

    Copy essential files (Documents, Photos) to an external drive or cloud service using a clean machine or a Linux live USB; avoid copying executable files. This preserves data if you need to reinstall Windows and prevents reintroducing malware.

    [Illustration: Photo of external USB drive and folders being copied from a file explorer window.]

  4. Step 4: Run Windows Defender full scan

    Open Windows Security and run a Full scan (not Quick); this scan can take 1–3 hours depending on disk size. Defender is built‑in and detects many threats; note and quarantine any findings before proceeding.

    [Illustration: Windows Security app with Full scan option and progress bar on screen.]

  5. Step 5: Use a second opinion scanner

    Download and run a free standalone scanner like Malwarebytes (portable or full) and hit Scan; allocate 30–90 minutes depending on system. These tools often find PUPs and remnants Defender may miss; quarantine and remove all confirmed items.

    [Illustration: Installer window of a second antivirus tool and a scan progress dialog showing threats found.]

  6. Step 6: Clean up with adware removers

    Run an adware/PUA cleaner such as AdwCleaner and follow prompts to Clean and reboot when requested; this typically takes under 15 minutes. These focused tools remove browser hijackers, unwanted toolbars, and startup entries left by malware.

    [Illustration: AdwCleaner scan results listing browser items and a Clean button ready to be clicked.]

  7. Step 7: Repair system and reset if needed

    If symptoms persist, run SFC and DISM (open admin Command Prompt: sfc /scannow then DISM /Online /Cleanup-Image /RestoreHealth) taking about 30–60 minutes. If problems remain, perform a Windows Reset keeping files or a clean reinstall as a last resort.

    [Illustration: Command Prompt window showing sfc /scannow running, and Windows Reset settings screen.]


  • Keep Windows and all software updated; install cumulative updates within 24 hours when possible.
  • Run full antivirus scans weekly and quick scans daily for ongoing protection.
  • Use unique strong passwords and enable multi-factor authentication where available.
  • Create system restore points before making registry or system changes; set them up weekly.
  • Store backups on an external drive disconnected after backup, or use versioned cloud storage.
  • Consider using a separate admin and daily user account; run day‑to‑day activities on a standard account.

  • Do not run random executable attachments or installers from unknown sources; they often contain malware.
  • Avoid downloading tools from unverified sites; use official vendor pages or trusted repositories to prevent fake cleaners.
  • Don’t delete system files or registry keys unless guided by reputable instructions; deleting the wrong item can break Windows.
  • If ransomware encrypts files, do not pay demands; consult professionals and use backups — paying does not guarantee recovery.

Was this guide helpful?