Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Start with a Microsoft Defender scan in Windows Security, review its findings, and use Microsoft Defender Offline if the same threat returns. If scans cannot resolve the problem, protect your files before considering Windows recovery or a clean installation. A slow PC, pop-ups, or browser redirects can be reasons to scan, but they do not prove malware is present.

1. Run a scan with Windows Security

Open Windows Security, select Virus & threat protection, and check for protection and security-intelligence updates before scanning. Menu names can vary by Windows version, language, or device management; on a work- or school-managed PC, follow your IT team’s instructions.

  1. In Windows Security, open Virus & threat protection.
  2. Check for updates to protection and security intelligence, and install available updates.
  3. Run a Quick scan as an immediate first check.
  4. If you want Windows to examine every file and program, open Scan options and choose Full scan. To check selected locations, choose Custom scan.

A full scan may take longer depending on the number of files and the device. Microsoft describes Quick, Full, and Custom scans as different coverage choices; a quick result is not the same as checking every file and program.

2. Check what Defender found

In Windows Security > Virus & threat protection, review the current threat and scan information. After a Microsoft Defender Offline scan, check Protection history for results. Read the action and status shown there rather than assuming that an item was removed simply because a scan completed.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

If you are unsure what a displayed finding means or what action to take, use the details shown in Windows Security and Microsoft’s guidance for that detection. Do not try to remove suspected malware by deleting unfamiliar Windows or application files by hand.

3. Use Defender Offline if a threat returns

If the same threat reappears after a normal scan or restart, run Microsoft Defender Offline. Malware may have a hidden component that reinstalls a detected threat when Windows starts normally. Offline scanning runs after a restart, outside the usual Windows session, which can make it harder for persistent malware to hide.

  1. Save open work, because the PC will restart.
  2. Open Windows Security > Virus & threat protection > Scan options.
  3. Select Microsoft Defender Offline scan, then start the scan.
  4. After Windows starts again, open Protection history to review the results.

4. Remove unwanted apps separately

An app you do not want is not necessarily malware. For software you recognize and no longer need, use Settings > Apps to uninstall it, then run a Defender scan. If unwanted software persists, an Offline scan is an escalation option. Avoid manually removing unfamiliar system files: deleting a legitimate file can damage Windows or another app without removing the underlying cause.

5. Choose the next step based on persistence and data risk

Use the least disruptive option that fits the problem. Scans are the initial check; recovery and reinstallation have greater consequences for apps, settings, and personal files.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Option When to use it Disruption and data impact
Quick or Full Defender scan Initial check; use Full when you want every file and program examined. Low disruption. Scan time varies with the files and device.
Defender Offline A threat returns or may be hiding while Windows runs. Restarts the PC; save open work first.
Reset this PC Ordinary troubleshooting has not resolved the problem. The selected reset option determines whether personal files are retained or removed; apps and settings are affected.
Clean installation from installation media Infection is still suspected and other recovery options are inadequate. Most disruptive: removes Windows, personal files, apps, and settings from the selected drive.

6. Back up before Windows recovery

If scans do not resolve the issue, or malware has caused changes you cannot reverse, consider Windows recovery. Before resetting or reinstalling, protect important files. Prefer a backup made before the suspected infection and stored separately from the affected PC; files left on the infected machine may have been altered.

For a clean installation, confirm which drive is selected and that your backup is usable. Make sure you have any recovery credentials you need before starting. Microsoft’s installation-media route may require creating media from another working PC; a clean install removes the contents described in the table from the selected drive.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

7. Verify cleanup and update Windows

After the scan or recovery, review Protection history and run another scan if concern remains. Install available updates for Windows, your browser, and your applications to reduce exposure to known security issues.

Windows 10 stopped receiving free software updates, technical assistance, and security fixes through Windows Update after October 14, 2025. If you are still using Windows 10, account for that loss of free security updates when deciding how to keep the PC protected.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What the Malicious Software Removal Tool does

Microsoft’s Malicious Software Removal Tool targets specific prevalent threats; it is not a replacement for a full antimalware product and is not the first choice for comprehensive cleanup. For a threat that persists, Microsoft points users toward Defender Offline or Safety Scanner rather than treating the tool as a complete scan-and-cleanup solution.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.