Safe Mode is a Windows troubleshooting startup option, but it is not the tool Microsoft recommends for malware that keeps returning. For recurring or hard-to-remove threats, run Microsoft Defender Antivirus (offline scan): it restarts the PC and scans in Windows Recovery Environment, outside the normal Windows session. Save open work first.
When malware symptoms call for a scan
A sudden slowdown, a sharp drop in battery life, increased data use, unexpected ads or pop-ups, and browser redirects can be clues of malware. Any one of them can also have another cause, so treat symptoms as a reason to check the PC—not proof that it is infected. Microsoft lists these signs as reasons to start a scan.
Update Defender and scan from Windows
For a first check, update Microsoft Defender’s security intelligence, then run a full scan. Windows Security also offers quick and custom scans. A clean result is useful, but it cannot prove that the PC has never been compromised.
- Open Windows Security.
- Select Virus & threat protection.
- Choose Protection updates and check for updates to security intelligence; the label may vary by Windows release.
- Return to Virus & threat protection, select Scan options, choose Full scan, then select Scan now.
See Microsoft’s guidance on protecting a PC from unwanted software and Windows Security scan options.
#1 Best Overall
Run Defender Offline for malware that returns
If Defender detects the same malware again after a restart, Microsoft recommends Windows Defender Offline. A component can reinstall a detected threat, so removing one visible file may not resolve the cause. The offline scan restarts the PC and runs in Windows Recovery Environment without loading the normal Windows session, making it harder for persistent malware to hide or defend itself. It is distinct from Safe Mode.
- Save open work and close apps; the scan restarts the PC.
- In Windows Security, open Virus & threat protection > Scan options.
- Select Microsoft Defender Antivirus (offline scan), then start the scan.
- Allow the PC to restart and the scan to finish. Windows restarts again when scanning is complete.
- After signing back in, open Windows Security > Protection history to review the result.
Menu wording or availability can vary slightly by Windows version and device configuration. Microsoft’s instructions for the offline scan describe this restart-and-scan process. Its recurring-malware guidance specifically recommends Defender Offline when the same malware keeps infecting a PC.
Rank #2
Where Safe Mode fits—and where it does not
Safe Mode starts Windows with a limited set of files and drivers. It is useful when diagnosing a Windows startup or software problem, but Microsoft’s cited malware guidance does not establish it as a cleanup method for persistent threats or guarantee that a normal Defender scan works the same way in every Safe Mode configuration.
To use Safe Mode for general troubleshooting, follow Microsoft’s Safe Mode startup instructions. If the issue is malware that may hide during normal Windows operation, use the Defender Offline steps above rather than treating Safe Mode as a substitute.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsReview the result and decide what to do next
Protection history shows Defender’s actions and threat events. Microsoft says it retains events for two weeks; administrator privileges are required to view threat details. Check the recorded action and threat details after the PC restarts. See Microsoft’s Protection History guidance.
If the same detection appears again, follow Microsoft’s recurring-malware troubleshooting rather than assuming that deleting a single file will stop it. If malware caused irreversible changes, Microsoft says you may consider resetting the PC. Back up wanted files and settings first; when possible, use an external backup. Restore only files you trust, not suspicious programs or executables.
Rank #4
Microsoft’s troubleshooting guidance covers the recurring detection and reset contingency. A reset can remove apps and settings, so review Microsoft’s Windows reset options and backup requirements for your version before proceeding.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
