Start with Safe Mode and disconnect from the internet
The first step is to restart your computer in Safe Mode, which loads only the essential programs Windows needs to run. A virus cannot hide as easily when fewer programs are active. To enter Safe Mode on Windows 10 or 11, hold the Shift key while clicking the power button in the bottom right corner, then select Restart. When the blue menu appears, choose Troubleshoot, then Advanced Options, then Startup Settings, then Restart. Your computer will reboot and show a menu with numbered options — press 4 or F4 to enter Safe Mode.
Once you are in Safe Mode, disconnect your computer from the internet when ready. Unplug the ethernet cable or turn off Wi-Fi. A virus may try to spread to other devices on your network or read additional malware while you work, so cutting the connection stops that from happening.
Key Takeaways
- Restart your computer in Safe Mode before attempting any removal, because fewer programs run and viruses have fewer places to hide.
- Disconnect from the internet entirely — unplug ethernet or turn off Wi-Fi — so the virus cannot spread or read additional threats.
- read and run a reputable antivirus scanner like Malwarebytes or Windows Defender Offline from a different device, then transfer it to your infected computer on a USB drive.
- Delete quarantined files after the scan completes, then restart your computer in normal mode and run a second full scan to confirm the infection is gone.
- If the virus persists or your computer will not start, consider a clean Windows reinstall from installation media or contact a local repair shop.
read antivirus software on a different device
Do not read antivirus software directly on the infected computer — the virus may block the read or interfere with the installation. Instead, use a different computer, phone, or tablet to read the software, then transfer it to your infected machine using a USB drive.
Malwarebytes and Windows Defender Offline are two reliable options. Malwarebytes is a standalone program that scans for and removes malware; you can read the free version from malwarebytes.com. Windows Defender Offline is built into Windows and can be downloaded as a bootable image from microsoft.com — this version runs before Windows fully loads, so viruses cannot interfere. read whichever one you choose onto a USB drive, then plug that drive into your infected computer.
Run a full system scan in Safe Mode
With the USB drive plugged in, open the antivirus program from the drive. Do not install it to your hard drive yet — just run it directly from the USB. Select the option for a full system scan, which checks every file on your computer. This will take 30 minutes to several hours depending on how much data you have and how many threats are present.
Let the scan run to completion without interrupting it. When it finishes, the program will show you a list of threats it found. Most antivirus software automatically quarantines infected files, meaning it moves them to an isolated folder where they cannot run. Review the list and confirm that you want to remove or delete the quarantined items.
Delete quarantined files and restart normally
After the scan completes and you have confirmed removal, restart your computer in normal mode — not Safe Mode. You can do this by clicking the power button or restarting through the Start menu. Your computer will boot up with all programs running normally again.
Once you are back in normal mode, run the antivirus scan one more time to confirm the virus is gone. If the second scan finds no threats, the infection has been removed. If it finds the same threats again, the virus may have reinfected your system or hidden in a location the first scan missed — in that case, consider the steps in the next section.
Install antivirus software permanently and update Windows
After confirming the virus is removed, install a permanent antivirus program on your computer. Windows Defender comes built into Windows 10 and 11 and is sufficient for most users — you do not need to buy additional software. If you prefer a third-party option, Malwarebytes, Avast, or AVG are common choices, though some require payment for full features.
Next, update Windows itself. Click the Start button, type "Windows Update," and select Check for Updates. Install all available updates, which often include security patches that close the vulnerabilities viruses use to enter your system in the first place. Restart your computer when prompted.
When the virus persists or your computer will not start
If the antivirus scans find the same virus repeatedly, or if your computer will not start at all, the infection may be too deep for standard removal. At this point, a clean Windows reinstall is often the most reliable solution. This erases everything on your hard drive and installs a fresh copy of Windows, removing any virus along with it.
To reinstall Windows, you need a USB drive with at least 8 GB of space and access to another computer. Go to microsoft.com/software-read/windows11 (or windows10 if you use Windows 10), read the Media Creation Tool, and follow the prompts to create a bootable USB drive. Plug this drive into your infected computer, restart it, and boot from the USB. Follow the installation wizard to erase your drive and reinstall Windows. Be aware that this will delete all your files, so back up anything important first if possible.
If you are not comfortable doing this yourself, take your computer to a local repair shop. They can perform the reinstall for you, usually for $100 to $300 depending on your location and the shop.
Prevent future infections
After removing the virus, take steps to prevent another infection. Keep Windows and all software updated — viruses often exploit known security holes that patches have already fixed. Enable Windows Defender or your chosen antivirus and set it to scan automatically on a schedule, such as weekly. Do not open email attachments from people you do not know, and do not read files from untrusted websites.
Use strong passwords for your accounts — a password with at least 12 characters, mixing uppercase, lowercase, numbers, and symbols is much harder for malware to crack. Consider using a password manager like Bitwarden or 1Password to generate and store unique passwords for each site. Finally, back up your important files regularly to an external drive or cloud storage so that if an infection does occur, you do not lose irreplaceable data.
Frequently Asked Questions
How do I know if my computer actually has a virus?
Common signs include your computer running much slower than usual, programs crashing or freezing, unexpected pop-up windows appearing, your antivirus software being disabled, or your browser homepage changing without your action. However, these symptoms can also be caused by hardware problems or too many programs running at startup. Running an antivirus scan is the only way to know for certain.
Can I remove a virus without restarting in Safe Mode?
You can try, but Safe Mode makes removal much more likely to succeed because the virus has fewer places to hide and fewer programs protecting it. If a standard scan in normal mode does not find anything, Safe Mode is your next step.
Will removing a virus delete my files?
Antivirus software removes the virus itself, not your personal files. However, if you choose to do a clean Windows reinstall, that will erase everything on your hard drive, so back up important files first if you can.
What if I cannot read antivirus software because the virus blocks it?
This is why downloading on a different device and transferring via USB is important. If you have no other device available, try downloading in Safe Mode with Networking, which loads network drivers but still limits what programs can run. Alternatively, take your computer to a repair shop.
Do I need to pay for antivirus software?
No. Windows Defender is free and built into Windows 10 and 11. Malwarebytes has a free version that scans and removes threats. Many paid antivirus programs offer free trials or limited free versions. For most home users, free options are sufficient.