You can try to remove malware from a Windows PC without installing a paid or third-party antivirus by using the antimalware protection already built into Windows: update Microsoft Defender’s security intelligence, run a full scan, then use Microsoft Defender Offline if the threat persists. This still uses antivirus scanning; deleting suspicious files by hand is not a reliable substitute. The steps below apply to Windows, not macOS or other operating systems.
Before you start: treat symptoms as clues, not proof
Unusually slow performance, unexpected pop-ups, browser redirects, or changes in battery life or data use can be signs of malware, but none confirms an infection on its own. Microsoft recommends investigating with a scan rather than assuming a symptom identifies a virus. See Microsoft’s guidance on protecting a PC from viruses.
Save open work before running an offline scan, because the computer restarts. If you may need to reset or reinstall Windows, first back up files you need to keep. A backup is not automatically safe just because it is a backup: when possible, restore from one made before the suspected infection. If this is a work- or school-managed PC, contact your organization’s IT team before attempting recovery.
Run a full scan with Windows Security
Windows Security uses Microsoft Defender, so this method avoids installing third-party antivirus but does not avoid antivirus protection. Microsoft’s Windows Security guidance recommends keeping security intelligence current and scanning for threats.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
#1 Best Overall
- POWERFUL, LIGHTNING-FAST ANTIVIRUS: Protects your computer from viruses and malware through the cloud; Webroot scans faster, uses fewer system resources and safeguards your devices in real-time by identifying and blocking new threats
- IDENTITY THEFT PROTECTION: Protects your usernames, account numbers and other personal information against keyloggers, spyware and other online threats targeting valuable personal data
- REAL-TIME ANTI-PHISHING: Proactively scans websites, emails and other communications and warns you of potential danger before you click to effectively stop malicious attempts to steal your personal information
- ALWAYS UP TO DATE: Webroot scours 95% of the Internet three times per day including billions of web pages, files and apps to determine what is safe online and enhances the software automatically without time-consuming updates
- Open Windows Security.
- Open Virus & threat protection and check for security intelligence updates. Install any available updates before scanning.
- Choose Scan options, select Full scan, then start the scan.
- Allow the scan to finish. If Windows Security finds a threat, follow its recommendation to quarantine or remove it. Do not allow a detected file unless you know and trust the file and its publisher.
A full scan checks files and programs on the device within the running Windows installation. Microsoft also suggests uninstalling software you do not need, but removing an unfamiliar or unwanted app alone does not establish that malware has been removed. Continue scanning or escalate if unwanted behavior persists.
Use Microsoft Defender Offline if the threat persists
If malware persists or returns, Microsoft Defender Offline can scan outside the normal Windows session. Microsoft says it runs in the Windows Recovery Environment, where persistent malware may have more difficulty hiding or defending itself. The PC restarts, so save open work first. See Microsoft’s Defender Offline instructions.
Rank #2
![Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41qw3FS3qLL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 3 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
- Open Windows Security.
- Go to Virus & threat protection, then select Scan options.
- Select Microsoft Defender Offline scan and start the scan.
- Let the PC restart and complete the scan. After Windows starts again, check Protection history for the result.
If Windows Security reports that malware was only partially removed, or the threat returns, Microsoft also identifies the Malicious Software Removal Tool as a possible further step. Neither that tool nor Defender Offline guarantees cleanup; use recovery if the suspected infection continues.
Choose the next step based on persistence and disruption
| Option | Where it works | Disruption and use |
|---|---|---|
| Windows Security full scan | Within the running Windows installation; checks files and programs. | Start here. It does not require reinstalling Windows. |
| Microsoft Defender Offline | After a restart, in the Windows Recovery Environment. | Use if a threat persists or returns. Save work because the PC restarts. |
| Clean installation from Windows installation media | Replaces Windows on the selected drive. | Most disruptive option here: it removes Windows, personal files, apps, and settings from that drive. |
Escalate to a clean Windows installation only if needed
Microsoft’s Windows recovery guidance says to try a Windows Security virus scan first. If the suspected infection continues, it recommends a clean installation using Windows installation media. This is a destructive recovery step, not a routine first scan: it removes Windows, personal files, apps, and settings from the selected drive.
Rank #3
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
- Back up files you need before reinstalling, and prefer a backup made before the suspected infection when possible.
- Microsoft says installation media can be created using another working PC.
- If the affected computer belongs to an employer or school, ask its IT team to handle or approve the recovery.
After installation, restore only the files you need and be cautious about bringing back files or software that may have been involved in the infection.
Quick Recap
Best Value
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Rank #4
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
