Quick Fix
For a suspected Windows infection, stop sensitive logins, isolate the PC when compromise is credible, and run the active antivirus from Windows Security. Review its findings, use an eligible offline scan for persistent threats, and recover accounts from a trusted device. Browser notification spam needs a different first response; ransomware or a work-managed PC needs prompt specialist help. A clean scan alone is not proof of complete recovery.
This guide follows the practical cleanup sequence: identify the warning, contain a real infection, scan and review results, then restore protection and account access. It covers Windows 11 and the relevant Windows 10 controls, with separate support and hardware limits. Keep recovery keys and backups available before actions that restart or erase the computer.
What Should You Do First if You Suspect Malware?
Disconnect a genuinely compromised PC from Ethernet and Wi-Fi, and separate backup drives you do not need for the response. Isolation can limit communication or spread; it does not remove malware. A browser notification or slow computer alone does not prove infection. For a warning confined to the browser, begin with our fake virus pop-up removal guide instead of erasing Windows.
Disconnect an At-Risk PC Without Losing Your Recovery Options
For a wired connection, unplug the network cable. Disconnect Wi-Fi or turn off its adapter as appropriate. On a work or school computer, contact the responsible IT team from another device before changing software or deleting evidence.
Keep the suspected device away from shared storage while deciding the next step. Disconnect non-essential external drives rather than exposing a working backup to a suspected infection. Preserve a note of the warning, timing and actions already taken for the person helping with recovery.
For suspected ransomware, follow CISA’s containment guidance: disconnect affected equipment from the network; power it down if you cannot disconnect it and need to prevent further spread. Shutdown loses volatile evidence, so involve the incident responder where available. Do not turn an unwanted browser notification alone into an unnecessary wipe or recovery operation.
Protect Important Files and Accounts Before Cleanup
Stop logging into sensitive accounts, including email, banking, and shopping sites, while the PC’s trustworthiness remains in doubt. The Federal Trade Commission’s guidance on malware recommends avoiding usernames and passwords on a potentially infected device, since malware can capture keystrokes or steal saved credentials.
If you have a recent backup, check that it predates the infection before relying on it. A backup made while malware was active may contain infected files.
Check Whether the Warning Is Genuine
Not every alert claiming “your PC is infected” is real. Rogue security software, sometimes called scareware, imitates legitimate antivirus alerts to trick you into paying for fake protection or giving a scammer remote access.
Never call the number in a pop-up warning or grant a stranger remote access. Open Windows Security yourself from Start to check the actual protection status. A browser window copying Microsoft’s colours or logo is not proof that it is a genuine diagnostic.
Follow the Safest Route for Your Symptoms
Slow performance, pop-ups or a changed home page can have several causes, including unwanted software or browser settings. Locked files with a ransom note, repeated security detections or disabled protection need a more urgent response. Identify the actual behaviour before choosing the route below.
Keep a recovery record before the next step
Write down what first happened, when it started, the active antivirus, the exact detection name and the action it reports. Note whether the problem appears in one browser or across Windows, whether a file was downloaded or opened, and whether anyone obtained a password or remote access. Keep passwords, recovery keys and sensitive documents out of public help requests.
Use that record to decide whether you need a browser-permission fix, a completed security scan or professional recovery. For each action, record the outcome rather than simply “done”: quarantined, restart requested, unresolved, cancelled or no threat detected. Those states mean different things. A warning still visible in history can describe an earlier action; check its date and current status before treating it as a new infection.
Before a restart or clean installation, confirm that you can access the account and encryption recovery information you will need. Before restoring data, decide which backup is appropriate and which files require review. Keep an untouched copy of important evidence when someone is helping with an incident, and ask them before cleaning or overwriting it.
For a household PC, one short written timeline can prevent repeated scans and contradictory advice. For a managed PC, give the record to the responsible team and follow their response process. Keep backups separate from the suspected machine until you have a recovery plan; do not connect the only good copy of your files simply to see whether it still opens.
How Do You Scan with Windows Security?
Windows Security provides the protection dashboard on Windows 10 and 11. Check which antivirus is active: a compatible third-party product can take over antivirus duties. Use the active provider’s current instructions and update it before scanning when it is safe to do so.
Run a Quick Scan, Then a Full Scan
- Open the Start menu, type “Windows Security,” and open the app.
- Select “Virus & threat protection.”
- Click “Quick Scan” to check the areas where malware most commonly hides.
A quick scan checks common locations. Review its result before deciding whether to run a broader scan. You do not have to run every scan type in a rigid sequence regardless of the problem; follow the security app’s recommendations and the symptoms you are investigating.
- Return to “Virus & threat protection” and select “Scan options.”
- Choose “Full scan.”
- Click “Scan now.”
Microsoft’s scan-options guide describes a full scan as checking files and programs across the device. It can take considerable time; let it finish and review the completed result rather than treating a started scan as a completed check.
Review Detections and Quarantine Decisions
Review the detected threat, action and any restart instruction in Windows Security. Quarantine isolates a detected item; it is not permission to restore it because you recognise the filename. If an essential file appears falsely detected, use the security provider’s review process instead of broadly excluding a folder from protection.
Before relying on the results, check that automatic protections are switched on. Under “Virus & threat protection settings,” confirm that cloud-delivered protection and automatic sample submission are on. Microsoft notes that these features significantly increase the chances of catching new threats, according to Microsoft’s malware troubleshooting guidance.
Use Microsoft Defender Offline Scan for Stubborn Threats
An offline scan can help investigate persistent malware outside normal Windows operation. Before starting, read Microsoft’s requirements: the documented Windows 11 route is x64, not ARM; Defender must be the primary antivirus and Windows Recovery Environment must be enabled.
Have administrator access, save your work and locate the BitLocker recovery key. Microsoft advises suspending BitLocker before this scan; follow its linked procedure or ask your IT administrator, then restore protection afterwards. This scan restarts the device.
- Go to “Virus & threat protection.”
- Under “Current threats,” select “Scan options.”
- Choose “Microsoft Defender Offline scan” and click “Scan now.”
After Windows returns, read Protection history for the result. A missing scan option or restart without a scan is not a clean result. Check compatibility and recovery requirements instead of disabling boot security or repeatedly forcing restarts.
Read the Scan Outcome Before Choosing the Next Action
Open the relevant card in Protection History. Microsoft distinguishes an action-needed alert, a quarantined item, a blocked threat and incomplete remediation. Check the date, location and requested action rather than treating every historical card as a new infection.
| Reported state | What it tells you | Safer next decision |
|---|---|---|
| Action needed | A possible threat still needs a decision | Use quarantine when safety is uncertain; do not allow it just to dismiss the alert |
| Quarantined | The detected item is isolated, not yet removed | Keep it isolated while investigating; restore only after a justified false-positive review |
| Blocked | Defender reports blocking and removing that threat | Review its source and any wider exposure; that one action is not a whole-system guarantee |
| Remediation incomplete | Cleanup did not finish successfully | Read the card’s remaining steps or get qualified support |
Protection History is not a permanent incident archive: Microsoft says entries remain for two weeks. Preserve a private note of an important detection and its outcome while it is available, without posting account secrets or personal file contents publicly. An older entry disappearing from the list is not itself proof that a threat was removed.
What Can You Do if Symptoms Remain?
A clean scan does not identify every cause of pop-ups or poor performance. Browser notification permissions, an unwanted extension, a changed setting or a non-malware fault may need separate investigation. Match the remaining symptom to the relevant setting instead of repeatedly installing scanners.
Uninstall Suspicious Apps and Check Browser Changes
Review Settings → Apps → Installed apps on Windows 11, or Apps & features on Windows 10. Compare publisher, installation date and purpose before uninstalling a suspect program. Do not remove unfamiliar system components merely because you do not recognise their names. On a managed computer, have IT review the finding.
Review browser extensions and remove a confirmed unwanted addition. Check notification permissions, home page and search engine separately. A browser reset changes settings and can affect extensions or site state, so read its confirmation first. The linked pop-up guide covers this narrower cleanup.
Choose a Reputable Second-Opinion Scanner
A second-opinion scan is an optional escalation, not a promise of better detection or a requirement to buy a subscription. Malwarebytes and AdwCleaner are separate products to assess against the problem; our Malwarebytes review explains that buying decision. Avoid running several competing real-time antivirus products merely to add more scans.
The Microsoft Safety Scanner runs on demand and expires ten days after download. Obtain a fresh copy for current definitions. It is not ongoing real-time protection and does not replace a supported antivirus product.
If considering another tool such as ESET Online Scanner, read its current official download, compatibility and scan instructions. Do not assume that a web-labelled scanner requires no download or installation. Keep a note of detections and completed actions so support can distinguish a new finding from the same unresolved threat. Never download a cleaner from a warning pop-up.
Try Safe Mode if Security Tools Will Not Run
If security tools will not open, seek the active provider’s recovery instructions or trusted technical help. Safe Mode uses a limited set of services and drivers, but does not guarantee removal or that every scanner will work there.
Microsoft’s startup-settings instructions use Windows Recovery Environment, then Troubleshoot → Advanced options → Startup Settings → Restart. Have the BitLocker recovery key available. Choose plain Safe Mode when networking is unnecessary; Safe Mode with Networking deliberately adds network access. Do not reconnect an active compromise simply because an old tutorial always selects networking.
Know When to Stop Troubleshooting and Reinstall Windows
Persistent detections, damaged Windows components or a serious compromise can justify a clean reinstall. First decide what data and evidence must be preserved. Microsoft’s recovery guidance distinguishes reset and installation-media options. A clean installation can erase files, apps and settings; a reset that keeps files is a different operation.
Create official installation media using a trusted device and arrange safe backups before proceeding. Do not blindly restore unknown installers, executables or the complete old environment. If ransomware has encrypted valuable files, preserve a separate copy and seek specialist advice before destructive changes. A technician can help when the scope or recovery options are unclear.
Restore Files in Stages and Recheck the Original Cause
Choose a trusted recovery point and preserve the original backup before modifying it. A recent copy is not automatically a clean copy: consider when the unwanted activity began and whether the backup includes the same installer, browser extension or settings that may have introduced it. On a ransomware case, involve the responder before reconnecting shared storage or overwriting encrypted files.
After a clean recovery, apply applicable operating-system and app security updates and confirm the active antivirus and firewall. Reinstall applications from genuine sources, then restore needed documents cautiously rather than copying every old executable and configuration back at once. If the original warning returns after one restoration step, stop and record which source or action preceded it. Do not repeatedly reconnect the only good backup to an unresolved compromise.
Device recovery and account recovery are separate. From a trusted device, review important accounts for unfamiliar sessions, recovery addresses, registered passkeys and delegated access as appropriate. Changing a password does not necessarily end every existing session. Follow the service’s own controls, and involve your bank or the affected provider promptly if there is unauthorised activity.
How Do You Secure Your PC After Cleanup?
Return to sensitive use cautiously after supported cleanup, updates and restored protection. A stopped symptom and a clean scan are useful checks, not proof that no account data was stolen. Repeated detections or protection that cannot stay enabled need further investigation.
Check Whether the Symptoms Have Stopped
Monitor your PC for a few days after cleanup rather than assuming it’s fixed as soon as a scan shows zero threats. Watch for the original symptoms returning, including slow performance, pop-ups, or a changed browser home page.
If symptoms return, review the finding and active protection, then use an eligible offline scan or qualified support. Repeated clean-scan messages alone do not explain a persistent problem.
Update Windows and Restore Everyday Protection
Install applicable Windows security updates and update your apps. In Windows Security, confirm the intended active antivirus provider and firewall. A compatible third-party antivirus may supply real-time protection instead of Defender; do not force both engines to run.
If you use third-party antivirus or firewall software, make sure it’s updated to the latest version too. Outdated security software can miss newer threats even when it’s running.
Recover Accounts from a Trusted Device
Use a trusted device to recover important accounts; do not wait for the suspect PC to finish scanning if credentials may already be exposed. The FTC advises using a different computer for password changes. Start with email and other high-value accounts, review the service’s recovery and sign-in options, and enable two-factor authentication where available.
A password manager makes this easier by generating and storing strong, unique passwords for every account. This reduces the chance that one reused password gives an attacker access to multiple accounts.
Windows 10 needs a separate support check
Windows 10’s ordinary support ended on 14 October 2025. A working scanner or new antivirus definitions do not restore operating-system security updates. Check your edition, update history and any eligible Extended Security Updates arrangement; enterprise and consumer coverage differ. Microsoft’s current US consumer guidance provides limited critical and important updates through 12 October 2027 for eligible enrolled Windows 10 22H2 devices; enrollment options vary by region. Plan a move to a supported system rather than treating malware removal as a substitute for patch support.
Finish Recovery Before Returning to Sensitive Use
Start with the actual warning and active antivirus, contain a credible infection, then review completed scan actions rather than counting the number of tools installed. Keep the browser-only route separate from a system compromise, and treat ransomware, repeated detections and work-managed equipment as reasons to escalate.
Recovery also means securing accounts from a trusted device, restoring protection, checking Windows support and avoiding the same suspicious download. If you cannot establish that the system is trustworthy, get qualified help with clean recovery before returning to sensitive use.
Frequently Asked Questions
How do I tell if my Windows PC has malware?
Unexpected pop-ups, redirects, disabled security tools or sudden poor performance warrant investigation, but no single symptom proves infection. Open the actual security app, scan with the active provider and check browser settings separately.
Can I remove malware from a Windows laptop for free?
Windows Security provides built-in scanning when Microsoft Defender is active, and Microsoft Safety Scanner is an on-demand option. A scan may remove detected threats, but no free or paid tool guarantees complete recovery from every compromise.
Does the Malicious Software Removal Tool replace Microsoft Defender?
No. Microsoft describes MSRT as removing selected prevalent malware families, rather than providing ongoing antivirus protection. Use a supported real-time security product for continuing protection.
Can I remove malware using Command Prompt or PowerShell?
These tools can assist trained diagnosis, but random deletion commands are not a safe substitute for supported antivirus and recovery instructions. A wrong command can damage Windows or destroy useful evidence.
What should I do if malware returns after a scan?
Review the detection and active protection. Use an eligible offline scan or qualified support for persistent threats. Check trusted backups and clean installation options before destructive recovery; repeated clean-scan messages alone do not settle the cause.
Sources and Image Credits
Sources: Windows scan options; Protection History; Defender Offline requirements; Windows recovery options; Safety Scanner; MSRT’s separate role; FTC malware guidance; CISA ransomware guidance.
Illustrations: Impulsec.
Share this article
Stuart Kerr Spindlow is Impulsec’s Publisher, Chief Editor and Lead Reviewer. He writes and maintains coverage of consumer cybersecurity and digital-safety software, with a focus on practical suitability, limitations and the evidence behind product claims. Read Stuart’s full profile.