Search guides

Fix Windows that has virus that will not remove

We'll boot Safe Mode, run full and offline scans, and use Safety Scanner—or tell you when to reinstall or call a pro.

Troubleshooting · Home maintenance
30–90 min
What you'll need
  • Internet (for Safe Mode with Networking)
  • USB drive (for offline scan if needed)
Step 1 of 5

Quick triage — pick your path

Get started

Choose the option that matches what you see. You can jump straight to that section.

Show full guide

Steps

Goal: Boot Safe Mode, run full and offline scans, and use Safety Scanner.

  • Disconnect from the internet. Boot Safe Mode with Networking. Run full Defender scan.
  • Good: Virus removed. Restart to normal.
  • Bad: Run Microsoft Safety Scanner, then Windows Defender Offline.

Safe Mode scan

Goal: Remove the virus when it is not running.

  • Boot Safe Mode with Networking. Windows Security, full scan. Remove threats.
  • Good: Virus removed.
  • Bad: Run Microsoft Safety Scanner.

Offline scan

Goal: Scan before Windows loads so the virus cannot hide.

  • Windows Security, Scan options, Offline scan. Restart. Scan runs before Windows.
  • Good: Virus removed.
  • Bad: Reinstall Windows or call a technician.

When to get help

Call a technician if:

  • The virus persists after offline scan.
  • You suspect ransomware—do not pay without professional advice.
  • You are unsure about these steps.

Verification

  • Windows Defender shows no threats.
  • Full scan finds nothing.
  • PC behaves normally; no odd popups or slowdowns.

Escalation ladder

Work from the device outward. Stop when the problem is fixed.

  1. Disconnect Unplug network to limit spread.
  2. Safe Mode Boot Safe Mode with Networking.
  3. Full scan Windows Defender full scan in Safe Mode.
  4. Safety Scanner Microsoft Safety Scanner full scan.
  5. Offline scan Windows Defender Offline.
  6. Reinstall or call a pro Reset Windows or technician.

What to capture if you need help

Before calling support or posting for help, have these ready. It speeds everything up.

  • Virus or threat name
  • File path if shown
  • Whether Safe Mode helped
  • Steps already tried

Did you try Safe Mode?

Viruses often block removal in normal mode.

Boot Safe Mode with Networking. Run full Windows Defender scan. Good: Virus removed—restart to normal. Bad: Run Microsoft Safety Scanner.

Yes No

You can change your answer later.

Boot Safe Mode

Restart, Startup Settings, Safe Mode with Networking. Run full Defender scan.

Done

Did Safety Scanner help?

Different engine may catch the virus.

Download and run Microsoft Safety Scanner. Full scan. Good: Virus removed. Bad: Run Windows Defender Offline.

Yes No

You can change your answer later.

Offline scan

Windows Security, Scan options, Offline scan. Restart. Scan runs before Windows. If still not removed, reinstall Windows or call a pro.

Done

Virus removed

Restart to normal mode. Run a quick scan to confirm. Keep Defender updated.

Done

Reviewed by Blackbox Atlas

Frequently asked questions

Why would a virus not remove?
The virus is running and blocks removal, or it reinstalls itself. Safe Mode stops most viruses from loading, so removal can succeed.
What is Windows Defender Offline?
A bootable scan that runs before Windows loads. Catches viruses that hide when Windows is running.
When should I call a technician?
When Safe Mode and offline scan do not remove it, or you suspect ransomware or a severe infection.

Rate this guide

Was this helpful?

Continue to