How to Remove Malware From a PC (and Know It Is Gone)

Updated: October 2026

A pop-up that won't close, a fan that never idles, a browser homepage nobody chose: the ticket says "virus" and the user wants it fixed before lunch. One scan and a closed ticket is how the same machine comes back a week later, sometimes with a stolen password attached. This guide covers how to remove malware from a PC the way a technician does it, from the first triage question to proof that it's gone.

TL;DR

• Confirm it's malware first. Slow boots and full disks have boring causes; unknown startup entries, disabled protection and new admin accounts don't.
• Cut the PC off the network, then protect the accounts that were used on it. Credentials are often the real target.
• Preserve evidence before cleaning when the device belongs to a business, holds regulated data or might end up in an insurance claim.
• Update Microsoft Defender, run a full scan, then an offline scan from the Windows Recovery Environment. Add one portable second-opinion scanner.
• Hunt persistence with Autoruns: Run keys, scheduled tasks, services, WMI subscriptions, browser extensions and policies.
• After an infostealer, reset passwords from a clean device and revoke sessions, because stolen cookies survive a password change.
• Reimage when you can't prove the machine is clean. Verify either way, days later, not minutes.

Before You Start: Is It Malware?

Plenty of "virus" tickets are something else. A disk at 99% is often Windows Update or a search indexer. A browser full of ads can be one bad extension the user installed on purpose. A fan at full speed can be a stuck driver. Treating every slow PC as an infection wastes hours and trains users to cry wolf.

If you need a refresher on the families and how they behave, start with what malware is. This guide assumes you know the difference and need to get it off a machine.

Signals that deserve a full removal procedure:

• Microsoft Defender or real-time protection is off and the user didn't turn it off
• Unknown entries in startup, scheduled tasks or services, especially unsigned files in AppData or ProgramData
• A new local administrator account, or a new remote access tool nobody installed
• Browser settings the user can't change, with a "managed by your organization" banner on a home PC
• Password reset emails, MFA prompts or sign-ins from places the user has never been
• Outbound connections from processes with random names, or from a legitimate name in the wrong folder

That last one catches a lot of people. A process called svchost.exe running from C:\Users\Public is not Windows. Our guide to svchost.exe covers where the real one lives and how to check.

If the user clicked something specific, like an attachment or a cracked installer, ask for the exact file and time. For the first steps after a suspected trojan click, see our section on what to do after a click. Then come back here for the full cleanup.

The Removal Order

Order matters more than tools. Scanning before isolating lets the malware keep talking to its operator while you work. Cleaning before preserving evidence destroys what an insurer or forensics firm will ask for. Resetting passwords on the infected machine hands the new passwords to the same keylogger.

This guide follows ten steps. Triage comes first, then isolation and evidence. Microsoft Defender's full and offline scans do the bulk of the removal, with a second-opinion scanner behind them. Then you hunt persistence by hand, clean the browsers and reset credentials from a clean device. The last two steps are the clean-or-reimage decision and a verification pass days later.

Isolation and evidence take minutes. Skipping them is where cleanups go wrong.

Step 1: Isolate the PC and the Accounts

Disconnect the network, don't power off. Pull the cable and turn off Wi-Fi, or disable the adapters from an elevated prompt. A powered-on, offline machine stops talking to its command server and keeps its memory intact. A powered-off machine loses whatever lived only in RAM.

If the device runs an EDR product that supports network isolation, use that instead. It blocks everything except the security console, so you can keep investigating remotely.

Then think about accounts. Which users signed in on this machine in the last few weeks? Did anyone type a domain admin password into it, or use an RDP session from it? Any credential entered on an infected PC should be treated as exposed. For a business device, disable or reset the privileged ones now, from a different machine. The full credential cleanup comes later in Step 7, but admin accounts can't wait.

If the malware is encrypting files, stop and switch playbooks. A ransomware attack needs containment across the whole network, not a single-PC cleanup.

Step 2: Preserve Evidence When It Matters

Not every infection needs forensics. A home PC with adware can go straight to cleanup. Preserve evidence first when any of these apply: the device belongs to a business, it holds personal or regulated data, the company has cyber insurance, or there's a chance of legal action or law enforcement involvement.

Insurers often require you to call their hotline before remediation. Cleaning first can put the claim at risk. Our incident response guide covers who to call and in what order.

A lightweight preservation pass takes about fifteen minutes:

powershell
# Work from a USB drive or a folder you'll copy off
mkdir C:\IR
# Event logs
wevtutil epl Security C:\IR\Security.evtx
wevtutil epl System C:\IR\System.evtx
wevtutil epl "Microsoft-Windows-Windows Defender/Operational" C:\IR\Defender.evtx
# Everything that starts automatically, with hashes and signature checks
autorunsc64.exe -accepteula -a * -c -h -s * > C:\IR\autoruns-before.csv
# Running processes and network connections
Get-Process | Select Name, Id, Path | Export-Csv C:\IR\processes.csv
Get-NetTCPConnection | Export-Csv C:\IR\connections.csv

Write down a timeline as you go: when the user noticed, what they clicked, what you changed and when. If a memory image matters, capture it with a dedicated tool before anything else and before any reboot. Copy the folder off the machine and hash it.

The autoruns-before.csv file does double duty. It's evidence, and it's the baseline you'll diff against in the verification step.

Step 3: Run Microsoft Defender Full and Offline Scans

Microsoft Defender Antivirus ships with Windows, and it's the right first tool. Start by making sure it's working, because disabling it is one of the first things malware does.

powershell
Get-MpComputerStatus | Select AMServiceEnabled, RealTimeProtectionEnabled, IsTamperProtected, AntivirusSignatureLastUpdated
Get-MpPreference | Select ExclusionPath, ExclusionProcess, ExclusionExtension

Real-time protection off or tamper protection disabled on a machine where nobody touched it is a finding in itself. So is an exclusion for a folder like C:\Users\Public or a process in AppData. Remove exclusions you didn't set. If someone on your team disabled Defender during a software install, our walkthrough on disabling Defender temporarily shows how to confirm it came back on.

Update signatures, then run a full scan. The network is off, so update from a clean machine's offline package or reconnect briefly behind a restrictive firewall rule.

powershell
Update-MpSignature
Start-MpScan -ScanType FullScan
Get-MpThreatDetection

A full scan checks every file on the disk while Windows runs. That's the weakness: rootkits and some loaders hide files from a running Windows. The offline scan fixes that. In Windows Security, go to Virus & threat protection, then Scan options, and choose Microsoft Defender Antivirus (offline scan). The PC restarts into the Windows Recovery Environment, scans before the normal Windows loads, then restarts again. Results show up in Protection history. The PowerShell equivalent is Start-MpWDOScan.

Microsoft also publishes the Malicious Software Removal Tool, released monthly and already on machines that take Windows Update. Run it with mrt.exe for one more pass against prevalent families. Microsoft is clear about its scope: "It is strictly a post-infection removal tool." It doesn't replace real-time protection.

For a broader view of where built-in protection stops, see our guide to antivirus software.

This short walkthrough shows the offline scan from start to Protection history:

Step 4: Get a Second Opinion

Every engine has blind spots, so one clean result from one vendor is weak evidence. Run one on-demand scanner from a different vendor. Portable scanners like ESET Online Scanner, Emsisoft Emergency Kit or the free Malwarebytes scanner are common choices. They don't install a second real-time engine, which avoids two products fighting over the same files.

Two rules keep this step useful. Run it after Defender, not instead of it. And read the detections, don't just click "quarantine all". A hit on a remote access tool the client uses on purpose is a policy question. A hit on a cracked installer in Downloads tells you how the infection started.

Treat "potentially unwanted program" detections seriously on business devices. Toolbars, fake optimizers and bundled adware aren't always malicious, but they inject ads, change browser settings and phone home. They're also the easiest route for the next infection.

This r/techsupport thread is a familiar ticket: a user who can't get rid of malware after the first attempts. The manual steps below are the next move.

Step 5: Hunt Persistence With Autoruns

Scanners find files they recognize. Persistence is how malware survives a reboot, and it's where "I removed it but it came back" comes from. A scheduled task that re-downloads the payload every hour will outlive any scan that only deletes the payload.

Autoruns from Microsoft Sysinternals shows every place Windows starts code automatically, in one window. Run it as administrator, then set three options: hide signed Microsoft entries, verify code signatures, and check hashes against VirusTotal. That shrinks thousands of entries to a list you can read. Unsigned files, files missing from disk and files in user-writable folders like AppData, Temp or ProgramData go to the top of the list.

The tabs that matter most, and what to look for:

WMI event subscriptions deserve a manual look because they don't show up in Task Manager or the Startup list. An attacker binds a filter (an event, such as "every 60 seconds") to a consumer (a command to run). Three queries show all of it:

powershell
Get-CimInstance -Namespace root/subscription -ClassName __EventFilter
Get-CimInstance -Namespace root/subscription -ClassName CommandLineEventConsumer
Get-CimInstance -Namespace root/subscription -ClassName __FilterToConsumerBinding

Some management software uses WMI subscriptions legitimately, so research an entry before you delete it. A consumer that runs PowerShell with an encoded command is not legitimate.

Services and scheduled tasks are Windows' version of long-running background processes. Our explainer on daemons and services covers how they start and why attackers like them.

Delete in the right order: disable the entry, kill the process, delete the file, then remove the entry. Deleting a file while its watchdog task is still active just invites a re-download. Reboot, open Autoruns again, and confirm nothing came back.

Microsoft's own Autoruns demo is worth the time if you haven't used every tab:

Step 6: Clean the Browsers

The browser is where users feel the infection, and it has its own persistence. Check each installed browser, not only the default.

Open the extensions page (chrome://extensions or edge://extensions) and remove anything the user can't explain. Sort out duplicates of legitimate extensions too, since copycats with the same icon are common. Then open chrome://policy or edge://policy. On a home or unmanaged PC, any policy is suspicious, and a force-installed extension explains why the user "can't remove it". Delete the policy values under HKLM\SOFTWARE\Policies\Google\Chrome or HKLM\SOFTWARE\Policies\Microsoft\Edge, then remove the extension.

Next, the settings malware changes to redirect traffic:

powershell
netsh winhttp show proxy
Get-DnsClientServerAddress -AddressFamily IPv4
Get-Content C:\Windows\System32\drivers\etc\hosts

A proxy nobody configured, DNS servers that aren't the router or company resolver, or hosts file entries for banks and search engines all need reverting. Check site notification permissions too: fake "click allow to continue" pages turn into a stream of scareware pop-ups that look like an infection long after the malware is gone.

Finish with the browser's reset option (Settings, then Reset settings) and clear cached data. If the browser syncs to an account, the bad extension and settings can sync back from the cloud, so clean the synced profile or sign it out before resetting.

Step 7: Reset Credentials After an Infostealer

Infostealers are built to grab saved browser passwords, autofill data, crypto wallets and session cookies, then send them to the attacker. The cookies are the dangerous part. A stolen session cookie lets an attacker load the user's mailbox without the password or the MFA prompt, and a password change alone doesn't always end that session.

Do every reset from a clean device. The infected PC may still have a keylogger, and new passwords typed into it are new passwords stolen.

The order matters, because some accounts can reset others. Start with email, since it receives every other reset link. Then the password manager, if the user has one, followed by banking, payroll and payment accounts. Work identity comes next: Microsoft 365, Google Workspace or your SSO provider. Finish with everything else saved in the browser.

For each account, change the password, sign out of all sessions, and review the MFA methods and recovery options for anything the attacker added. In Microsoft Entra ID, an admin disables the account and selects Revoke sessions on the user's page, or runs Revoke-MgUserSignInSession. That revokes refresh tokens. Microsoft's documentation notes that access tokens last an hour by default, and that app-issued session tokens end on the app's own terms, so check the apps that matter most.

For on-premises Active Directory, Microsoft recommends resetting a compromised account's password twice to reduce pass-the-hash risk. Check mailboxes for new inbox rules and forwarding addresses, a common next step after a stolen session.

When to Reimage Instead of Clean

Cleaning is worth it when you can see the whole infection: one known family, detections that match what Autoruns shows, persistence you found and removed, and a clean rescan. Reimaging is the call when you can't prove that. A reimage takes a predictable amount of time. An uncertain cleanup can run for hours and still leave something behind.

Reimage when any of these are true:

• An attacker had hands-on-keyboard access, or a remote access trojan ran with admin rights
• Ransomware ran on the device, even if it was stopped
• Detections keep coming back after a clean scan
• You found a rootkit, unsigned kernel drivers or tampering with boot settings
• Domain admin or other privileged credentials were used on the machine
• You've spent more time investigating than a reimage would take

For a single PC, Windows' Reset this PC with "Remove everything" and "Cloud download" gets you a fresh copy of Windows. On a managed fleet, wipe through your MDM or reinstall from known-good media. Either way, restore user files from a backup made before the infection, or scan restored files before users touch them. Don't restore executables, scripts or browser profiles from the infected account.

A reimage doesn't reach firmware. UEFI bootkits such as BlackLotus exist, and they survive a disk wipe. They're rare on typical office PCs, but if the offline scan flags boot components or reinfections survive a reimage, escalate to a specialist or replace the hardware.

This r/antivirus thread asks the wipe-or-clean question directly:

How to Know the Malware Is Gone

"Zero threats found" means the scanner didn't recognize anything. It doesn't prove the machine is clean. Verification is a separate step with its own checks, and it happens after the machine has run normally for a few days.

Run the same Autoruns export you took in Step 2 and diff it against the baseline. Every entry you removed should be gone, and nothing new should appear that you didn't install.

powershell
autorunsc64.exe -accepteula -a * -c -h -s * > C:\IR\autoruns-after.csv
Compare-Object (Import-Csv C:\IR\autoruns-before.csv) (Import-Csv C:\IR\autoruns-after.csv) -Property "Entry Location", Entry, "Image Path"

Then check four more things. Defender is healthy: real-time and tamper protection on, signatures current, no exclusions you didn't set. A new full scan comes back clean. Established network connections map to processes you recognize (Get-NetTCPConnection -State Established plus the owning process). And sign-in logs for the user's accounts show no unfamiliar locations since the reset.

Ask the user, too. The same pop-up, the same redirect or the same "your account was used" email is the fastest reinfection signal you'll get. Schedule a follow-up check at one week. If anything comes back, reimage instead of cleaning twice.

If you look after many PCs, the PowerShell commands above work well as a saved script, so every cleanup gets the same checks.

The Malware Removal Checklist

Use this table as the ticket template. The right-hand column is what goes in the notes, so the next technician can see what was checked.

On a fleet, the same checks become a script. OpenFrame, an open, AI-native infrastructure layer for IT and security, can run an autorunsc export or a Defender status check across a client's devices and collect the output in one place.

Malware Removal, in Short

Removing malware from a PC takes a sequence of steps. Isolate first, preserve what you might need, let Defender's full and offline scans do the heavy lifting, then find the persistence the scanners missed. Treat credentials as stolen after anything that looks like an infostealer, and reimage whenever you can't prove the machine is clean. Then check again a week later.

If the cleanup turned up signs of a wider breach, move from single-PC removal to the playbooks in our guide to incident response.