How to Remove Malware Yourself
— A Step-by-Step Guide
Malware removal is one of the most common jobs in my shop, and I'll let you in on something: the tools I use are mostly free, and the process isn't complicated. It just needs to be done in the right order. Most people can do this at home if they follow the steps carefully. I'm going to walk you through the exact process I use — from the moment I suspect a machine is infected to the point where I'm confident it's clean. If you've already read our 7 Signs Your Computer Has Malware guide and you're pretty sure you're dealing with an infection, this is your next stop.
If you suspect your computer has been used for banking, shopping, or anything involving passwords while it was infected, change those passwords from a different device (your phone, a friend's computer) before you start the cleanup. Don't change passwords on the infected machine — the malware may be logging your keystrokes.
1 Disconnect from the Internet
The very first thing I do when I suspect malware is disconnect the machine from the network. Malware often communicates with remote servers — sending your data out, downloading additional malware, or receiving instructions. Cutting the connection stops that immediately.
Wired connection: Unplug the Ethernet cable.
Wi-Fi: Click the network icon in the taskbar (bottom-right corner) and click the Wi-Fi toggle to turn it off. You can also turn on Airplane mode, but be aware — Airplane mode disables Bluetooth too, which means your Bluetooth mouse will stop working. If that's your situation, just turn off Wi-Fi directly and leave Bluetooth alone, or grab a wired mouse if you have one handy.
Keep the internet off until you've finished the cleanup. You'll need to reconnect briefly to download scanning tools if you don't have them already — do that quickly, then disconnect again.
2 Boot into Safe Mode
Safe Mode starts Windows with only the bare minimum drivers and services — no startup programs, no unnecessary background processes, and most importantly, most malware won't run in Safe Mode. This gives your scanning tools a much better chance of finding and removing infections that would normally be actively hiding or protecting themselves.
Windows 11/10:
1. Press Windows + R, type msconfig, and press Enter.
2. Click the Boot tab.
3. Check Safe boot and select Network (this lets you access the internet in Safe Mode if you need to download tools).
4. Click OK, then Restart.
Your computer will restart into Safe Mode. You'll know you're in Safe Mode because the desktop will say "Safe Mode" in the corners and the screen resolution may look different.
Important: When you're done with the cleanup and want to go back to normal mode, repeat the steps above and uncheck Safe boot, then restart. If you forget this step, your computer will keep booting into Safe Mode every time.
3 Run Windows Defender Full Scan
Start with what's already on your machine. Windows Defender (called Windows Security in Windows 10 and 11) has improved dramatically over the years and is now a genuinely capable antivirus. A full scan checks every file on your system, not just the usual suspect locations.
1. Open Windows Security — press the Windows key and type "Windows Security."
2. Click Virus & threat protection.
3. Click Scan options, select Full scan, and click Scan now.
This will take a while — anywhere from 30 minutes to a couple of hours depending on how much data is on your drive. Let it finish completely. If it finds threats, follow the prompts to quarantine or remove them.
Tip: If malware is blocking Windows Security from opening, skip ahead to the offline scan in Section 4.
4 Run a Windows Defender Offline Scan
Some malware — rootkits, bootkits, and other deeply embedded infections — can hide from antivirus tools while Windows is running normally. An offline scan restarts your computer into a special recovery environment and scans before Windows fully loads. This catches things that a normal scan can't reach.
1. Go to Windows Security → Virus & threat protection → Scan options.
2. Select Microsoft Defender Antivirus (offline scan) and click Scan now.
3. Your computer will restart and run the scan outside of Windows. This takes about 15–20 minutes.
When it finishes, your PC will restart normally. Open Windows Security and check Protection history to see what was found and removed.
5 Run Malwarebytes Free (The Second Opinion)
This is the tool I recommend for every malware cleanup, and it's the one I reach for the most in my shop. Malwarebytes is specifically designed to catch things that traditional antivirus programs miss — especially adware, browser hijackers, potentially unwanted programs (PUPs), and trojans. Think of it as a second opinion from a specialist.
The free version is all you need for this job. It does on-demand scanning and removal without requiring a subscription. When you install it, you'll get a 14-day trial of the premium version — the real-time protection features are nice, but the free scanner is what we're here for.
1. Reconnect to the internet briefly and download Malwarebytes Free from malwarebytes.com. (Tip: searching for "download mbam" in your browser should also get you there quickly — "MBAM" is the shorthand most technicians use for it.)
2. Install it and run a full Threat Scan. During the setup it will ask if this is a personal or business machine — I would typically go with Personal. Then it will want to install Browser Guard as well — I usually say "no thanks" to that for this situation only because it just takes extra time. You can always install it later if you like.
3. When it finishes, review the results. Malwarebytes will list everything it found, categorized by threat type. Click Quarantine to remove them all.
4. Restart your computer if prompted. Depending on how serious the threats are, sometimes you have to reboot and sometimes you don't.
Disconnect from the internet again after downloading if you're still in cleanup mode.
6 Clean Up with AdwCleaner
By the time you get to this stage you are probably clean. However, if your main problem is browser-related — constant pop-ups, redirects to strange websites, a homepage that keeps changing, or a search engine you didn't choose — AdwCleaner is the targeted tool for that. It's made by the same company as Malwarebytes and focuses specifically on adware, browser hijackers, toolbars, and bundled junk that piggybacks on free software downloads.
1. Download AdwCleaner from malwarebytes.com/adwcleaner — it's a small standalone program that doesn't even need to be installed. Just download and run it.
2. Click Scan Now. The scan is fast — usually under a minute.
3. Review the results and click Clean & Repair.
4. Your computer will restart to finish the cleanup.
I almost never have to use AdwCleaner because Malwarebytes does such a good job, but occasionally I use it and it's been a good tool over the years.
7 Clean Your Browser Extensions and Settings
Even after the scanning tools have done their work, malicious browser extensions and hijacked settings can persist. Extensions are one of the most common ways malware maintains a foothold — they survive malware scans because the browser treats them as something you chose to install.
Chrome: Go to chrome://extensions in the address bar. Remove anything you don't recognize or didn't install yourself. Then go to Settings → Search engine and make sure it's set to Google or Bing (or whatever you prefer — personally I like Brave Search). Check Settings → On startup to make sure it's not set to open some random page.
Edge: Go to edge://extensions and do the same thing.
Firefox: Go to Menu → Add-ons and themes → Extensions.
If your browser is still acting up after removing suspicious extensions, reset it to default settings. In Chrome or Brave: Settings → Reset settings → Restore settings to their original defaults. This wipes all extensions, clears cookies and temporary data, and resets your homepage and search engine. You'll need to sign back in to your websites, but it's a clean slate.
8 Check Your Startup Programs and Scheduled Tasks
Some malware sets itself up to run every time your computer starts, or creates scheduled tasks that re-download the infection on a timer. Even after a successful scan, it's worth checking these two areas to make sure nothing is lurking.
Startup programs: Press Ctrl + Shift + Esc to open Task Manager, click the Startup apps tab. Look for anything unfamiliar — especially programs with vague names, no publisher listed, or ones you definitely didn't install. Right-click and Disable anything suspicious.
Scheduled tasks: Press the Windows key, type Task Scheduler, and open it. In the left panel, click Task Scheduler Library. Scan through the list for anything that looks out of place — tasks with random names, tasks that run programs from unusual locations (like Temp folders or AppData), or tasks created around the time you first noticed the infection. Right-click suspicious tasks and choose Delete.
If you're not sure whether something is legitimate, search for its name online before removing it. But if the name looks like random characters (e.g., "xk4r2m.exe"), it's almost certainly malware.
9 When Malware Fights Back
Sometimes you'll encounter malware that actively resists removal — it blocks your antivirus from opening, it disables Safe Mode, it kills Task Manager, or it keeps coming back no matter how many times you scan. This is the point where most people give up, but there are still options.
If malware blocks scanning tools: Try running the scanner from a USB drive. Download Malwarebytes or Windows Defender offline scan tools on a clean computer, put them on a USB stick, and run them on the infected machine.
If malware keeps coming back after removal: It's likely reinstalling itself through a scheduled task, a rootkit, or a compromised system file. Run the Windows Defender offline scan (Section 4) — this scans outside of Windows where rootkits can't hide. If that doesn't work, try Microsoft's Safety Scanner (a standalone tool available from microsoft.com that doesn't need installation).
If nothing works: At this point, a clean install of Windows is often the fastest and most reliable solution. Back up your important files (documents, photos — not programs, as they may be infected), wipe the drive, and start fresh. See Section 9 of our How to Speed Up an Old PC guide for a step-by-step walkthrough of a clean install.
If you're dealing with ransomware (your files are encrypted and someone is demanding payment): do not pay. There's no guarantee you'll get your files back, and paying funds criminal operations. Check nomoreransom.org — it's a legitimate project backed by Europol and major security companies that provides free decryption tools for many known ransomware variants. If your variant isn't listed, a technician may be able to help with data recovery options.
If your "infection" is a full-screen browser pop-up telling you to call a phone number because "your computer is infected" — that pop-up IS the scam. Your computer is probably fine. Don't call the number. Press Ctrl + W to close the tab, or Alt + F4 to close the browser entirely. If it won't close, press Ctrl + Alt + Delete, open Task Manager, and force-close the browser from there. For more on these tactics, read our guide on AI Scams & Deepfakes in 2026.
10 After the Cleanup: Staying Clean
Removing malware is only half the job. The other half is making sure it doesn't happen again. Here's what I tell every client who picks up a cleaned machine from my shop:
1. Keep Windows updated. Security patches fix the vulnerabilities malware uses to get in. Don't skip them — at most, delay them by a week. See our Windows Update Errors guide if updates are giving you trouble.
2. Use a reputable antivirus. Windows Defender is solid for most people. If you want extra protection, see our Best Antivirus Software 2026 guide for our tested recommendations.
3. Be careful what you download. Most malware gets in because someone downloaded something they shouldn't have — a "free" version of paid software, a game crack, a program from a sketchy website. If something is supposed to cost money and you're getting it free from a random site, assume it comes with malware attached.
4. Don't click links in unexpected emails or texts. Even if they look legitimate. Go to the website directly by typing the address yourself. AI-generated phishing emails are nearly perfect now — see our AI Scams guide for more on that.
5. Use an ad blocker. A browser extension like uBlock Origin blocks malicious ads that can infect your computer just by loading on a page — you don't even have to click them. It's free, lightweight, and one of the single best security tools you can install.
6. Keep Malwarebytes Free around. Even if you don't pay for the premium version, having the free scanner installed and running it once a month is a solid habit. Think of it like a checkup.
Malware Putting Up a Fight?
Some infections are stubborn — rootkits, ransomware, and deeply embedded trojans don't always cooperate with DIY removal. If you've tried the steps above and things still aren't right, or if you'd rather have a professional handle it from the start, that's what I'm here for.
If you're in the Nanaimo, BC area, BigMike Computer Services does malware removal, full system cleanups, and security hardening. Over 30 years of doing this work, and malware cleanup is still one of the busiest parts of the job.
Visit BigMike Computer Services →— BigMike | Computer Repair Technician, Nanaimo BC
📧 BigMikeNanaimo@gmail.com