Search guides

Fix Windows that has malware that will not remove

We'll boot Safe Mode, run Defender and Malwarebytes, use Safety Scanner and offline scan—or tell you when to reinstall or call a pro.

Troubleshooting · Home maintenance
45–90 min
What you'll need
  • Internet (for Safe Mode with Networking)
Step 1 of 5

Quick triage — pick your path

Get started

Choose the option that matches what you see. You can jump straight to that section.

Show full guide

Steps

Goal: Boot Safe Mode, run Defender and Malwarebytes, then Safety Scanner and offline scan.

  • Boot Safe Mode with Networking. Run Defender full scan, then Malwarebytes.
  • Good: Malware removed. Restart to normal.
  • Bad: Run Safety Scanner and Windows Defender Offline.

Safe Mode scan

Goal: Remove malware when it is not running.

  • Boot Safe Mode with Networking. Windows Security, full scan. Remove threats.
  • Good: Malware removed.
  • Bad: Run Malwarebytes.

Malwarebytes

Goal: Second opinion—catches adware and PUPs.

  • Download Malwarebytes. Run full scan. Remove threats.
  • Good: Malware removed.
  • Bad: Run Safety Scanner and Defender Offline.

When to get help

Call a technician if:

  • Malware persists after offline scan.
  • You suspect ransomware.
  • You are unsure about these steps.

Verification

  • Defender and Malwarebytes show no threats.
  • Browser homepage and extensions are correct.
  • No popups or redirects.

Escalation ladder

Work from the device outward. Stop when the problem is fixed.

  1. Safe Mode Boot Safe Mode with Networking.
  2. Defender full scan Windows Defender full scan.
  3. Malwarebytes Malwarebytes full scan.
  4. Safety Scanner and Offline Microsoft Safety Scanner; Defender Offline.
  5. Reinstall or call a pro Reset Windows or technician.

What to capture if you need help

Before calling support or posting for help, have these ready. It speeds everything up.

  • Malware or threat name
  • Whether Safe Mode helped
  • Scanners used
  • Steps already tried

Did you try Safe Mode?

Malware often blocks removal in normal mode.

Boot Safe Mode with Networking. Run Defender full scan. Good: Malware removed—restart to normal. Bad: Run Malwarebytes.

Yes No

You can change your answer later.

Boot Safe Mode

Restart, Startup Settings, Safe Mode with Networking. Run Defender full scan.

Done

Did Malwarebytes help?

Malwarebytes catches adware and PUPs.

Download and run Malwarebytes. Full scan. Good: Malware removed. Bad: Run Safety Scanner and Offline scan.

Yes No

You can change your answer later.

Offline scan

Defender Offline. If still not removed, reinstall Windows or call a pro.

Done

Malware removed

Restart to normal. Reset browser settings. Remove suspicious programs. Run a quick scan to confirm.

Done

Reviewed by Blackbox Atlas

Frequently asked questions

Why would malware not remove?
The malware is running and blocks removal, or it reinstalls. Safe Mode and multiple scanners increase the chance of removal.
What is the difference between virus and malware?
Virus is a type of malware. Malware includes adware, PUPs, trojans, and more. The removal process is similar.
When should I use Malwarebytes?
As a second scanner after Defender. Malwarebytes often catches adware and PUPs that Defender may miss.

Rate this guide

Was this helpful?

Continue to