How to Remove Malware and Viruses from Windows 10/11 (4-Step Process)

How to Remove Malware and Viruses from Windows 10 & 11

To remove malware and viruses from Windows 10 or Windows 11, run three free scanners in sequence: Norton Power Eraser for stubborn rootkits, Malwarebytes AdwCleaner for adware and browser hijackers, and Malwarebytes Free for a final deep scan. Quarantine every detection, reboot between scans, and finish with a Windows Security full scan to confirm the system is clean. For an infected machine that won’t boot or behaves erratically after cleanup, the safest path is a clean Windows reinstall.

Applies to: Windows 10 (22H2) and Windows 11 (23H2, 24H2, 25H2) | Last updated: April 30, 2026

How to Remove Malware and Viruses from Windows 10 & 11

Key Takeaways

  • Run cleanup tools in this order: Norton Power Eraser, AdwCleaner, Malwarebytes Free, then a Windows Security full scan. Layered scanning catches what any single tool misses.
  • If the PC is too infected to download tools normally, boot into Safe Mode with Networking first — most malware doesn’t load there.
  • Reboot between every scan. Some malware re-attaches itself if you launch the next tool before the system has dropped its file locks.
  • If symptoms persist after a full clean (popups, browser redirects, ransomware encryption), reinstall Windows. Some rootkits embed themselves below the OS and cleanup tools cannot reach them.
  • Change passwords from a known-good device after cleanup. Assume credentials stored in browsers, email clients, and password managers were exfiltrated before the malware was removed.

Quick Steps

  1. Disconnect from the internet (unplug ethernet, disable Wi-Fi) to stop further data exfiltration.
  2. Reconnect briefly to download Norton Power Eraser, AdwCleaner, and Malwarebytes Free, then disconnect again.
  3. Run Norton Power Eraser, remove detections, reboot.
  4. Run AdwCleaner, quarantine detections, reboot.
  5. Run Malwarebytes Free full scan, quarantine detections, reboot.
  6. Open Windows Security > Virus & threat protection > Scan options > Full scan, run, reboot.
  7. Change passwords for email, banking, and any account stored in your browser — from a clean device.

In This Guide

Preparation: Disconnect and Boot Safe Mode

Before running any scanner, isolate the infected PC. Most modern malware sends data to a command-and-control server continuously — credentials, banking sessions, browser cookies. Pulling network access cuts that loop and prevents the malware from downloading new payloads while you clean up.

  1. Unplug the ethernet cable, or click the Wi-Fi icon in the system tray and turn off Wi-Fi.
  2. Reconnect just long enough to download Norton Power Eraser, AdwCleaner, and Malwarebytes Free.
  3. Disconnect again before running the first scan.

If the malware is so aggressive that browsers redirect or scanners refuse to launch, boot into Safe Mode with Networking:

  1. Hold Shift and click Restart from the Start menu’s power icon.
  2. On the recovery screen, choose Troubleshoot > Advanced options > Startup Settings > Restart.
  3. Press 5 for Safe Mode with Networking.

Step 1: Run Norton Power Eraser

Norton Power Eraser performing a deep scan for stubborn malware on a Windows 11 PC.

Norton Power Eraser is a free portable scanner from Norton designed for malware that hides from regular antivirus — rootkits, fake system tools, and threats that disguise themselves as legitimate Windows processes. It uses an aggressive heuristic engine, which means it occasionally flags legitimate-but-uncommon software as suspicious. Read each detection before clicking Fix.

  1. Download the latest Norton Power Eraser executable.
  2. Right-click the file and choose Run as administrator.
  3. Accept the EULA and click Scan.
  4. When the scan finishes, review each detection. Tick the obvious threats and click Fix Now.
  5. Reboot when prompted.

Step 2: Run Malwarebytes AdwCleaner

Malwarebytes AdwCleaner ready to scan a Windows 10 computer for adware and browser hijackers.

AdwCleaner is the specialist for adware, browser hijackers, search-bar redirects, and “potentially unwanted programs” (PUPs). If your browser keeps opening pop-ups, defaults to Yahoo or Bing when you set it to Google, or shows ads in places that shouldn’t have them, AdwCleaner is the tool that cleans it up.

  1. Download AdwCleaner from the official Malwarebytes site.
  2. Run it, accept the EULA, and click Scan Now.
  3. Click Quarantine on the results screen — adware rarely produces false positives, so trust the detections.
  4. Reboot when prompted to finish removal.

Step 3: Run Malwarebytes Free

Malwarebytes Free running a full system scan and inspecting startup items, registry keys, and file system.

Malwarebytes in its free form is the most thorough on-demand scanner of the three. It checks memory, startup entries, the registry, and the file system in one pass, and its detection engine is independent of Microsoft’s, so it catches things Defender misses.

  1. Install Malwarebytes from the official site. The installer offers a 14-day Premium trial that auto-reverts to Free.
  2. Open Malwarebytes, click Scan, and let it complete the full scan (10-30 minutes).
  3. Click Quarantine All on the detections screen.
  4. Reboot when prompted.
  5. After reboot, open Settings > General and turn off “Start Malwarebytes at Windows startup” so it doesn’t conflict with Windows Security going forward.

Step 4: Windows Security Full Scan

The last sweep uses Microsoft Defender, which is built into Windows Security. Defender’s detection rates are competitive with paid suites, and it has access to Microsoft’s cloud-based threat intelligence — useful for catching brand-new threats the on-demand scanners haven’t been updated for yet.

  1. Open Settings > Privacy & security > Windows Security > Virus & threat protection.
  2. Click Scan options, choose Full scan, and click Scan now.
  3. For deeper protection, also run Microsoft Defender Offline scan — it reboots Windows into a minimal pre-OS environment and scans without the malware able to interfere.

After the Cleanup: Passwords and Recovery

A successful malware cleanup gets your computer back to a working state. It does not undo what the malware already did. Assume that anything stored in your browser, email client, or password manager during the infection has been exfiltrated.

  • Change all passwords from a clean device — phone, tablet, or another known-good PC. Email first (it controls password resets for everything else), then banking, then social and shopping accounts.
  • Enable two-factor authentication on every account that supports it. Authenticator apps are stronger than SMS.
  • Sign out of all sessions on Google, Microsoft, Apple, Facebook — these accounts have a “sign out from all devices” option that invalidates stolen session cookies.
  • Check banking statements for the next 30 days for unauthorised charges.

For ongoing prevention going forward, see my free antivirus stack guide and use my Winhance utility to lock down telemetry, optional Windows AI components, and risky default settings.

When to Reinstall Windows Instead

Some malware embeds itself below the operating system in firmware (UEFI), or makes so many changes that scanning tools cannot fully restore the system. If any of these apply, reinstalling Windows is faster and more certain than continued cleanup:

  • Symptoms persist after all four scans complete clean.
  • Ransomware has encrypted your files (no decryptor will recover them — restore from backup, then reinstall).
  • The PC was running cracked software, “free” key generators, or pirated games — those almost always come with persistent malware.
  • Windows boots oddly slowly, freezes randomly, or shows BSODs that weren’t there before.

For a clean reinstall, see my Rufus bootable USB guide and the UnattendedWinstall answer-file project, which both produce a fresh Windows install with sane defaults already applied.

Frequently Asked Questions

Why use three different scanners instead of just one?

No single scanner catches everything. Norton Power Eraser is aggressive about rootkits but generates false positives. AdwCleaner specialises in adware. Malwarebytes Free is the deepest general scan. Layering them catches threats any individual tool misses while keeping false positives to a minimum.

Will running these tools delete my files?

None of them delete personal files like Documents, Pictures, or Desktop content. They quarantine system-level malware components — executables, scheduled tasks, registry entries. If you’re worried, create a System Restore Point before starting, or copy critical files to an external drive first.

My PC won’t connect to the internet — how do I download the tools?

Download them on a clean device (your phone, a friend’s PC), copy to a USB drive, and plug it into the infected PC. If even Safe Mode doesn’t restore network access, that’s a strong signal to skip cleanup and reinstall Windows.

How do I know the cleanup actually worked?

If the final Windows Security full scan and Defender Offline scan both come back clean, and the symptoms (popups, redirects, slowdowns) stop after a couple of reboots, the system is clean. Run Malwarebytes once a week for the next month to catch anything that re-emerges.

Should I keep Malwarebytes installed permanently?

Yes — keep the Free version installed and run a weekly scan. The free version doesn’t include real-time protection (so it won’t conflict with Windows Security), but it’s the strongest free on-demand scanner available.

Similar Posts