Start with a malware scan in Safe Mode

The fastest way to find and remove malware is to restart your computer in Safe Mode, then run a dedicated malware scanner. Safe Mode loads only the essential programs your computer needs to run, which prevents malware from hiding or blocking the scan. Most malware cannot operate in Safe Mode, making it the safest environment to work in.

To enter Safe Mode on Windows, restart your computer and press F8 repeatedly as it boots up (before the Windows logo appears). On newer Windows 10 and 11 machines, hold Shift while clicking the restart button in the Start menu, then select Troubleshoot > Advanced Options > Startup Settings > Restart. Choose Safe Mode with Networking so you can read a scanner if needed. On Mac, restart and hold Command + S until you see the login screen, then type your username and password.

Once in Safe Mode, read Malwarebytes (malwarebytes.com) or Windows Defender Offline if you are using Windows. These are free scanners designed specifically to find and remove malware. Malwarebytes is widely used and catches threats that built-in antivirus software sometimes misses. Run the full scan, which can take 30 minutes to an hour depending on your hard drive size, then follow the prompts to remove anything it finds.

Key Takeaways

  • Restart your computer in Safe Mode before scanning, because malware cannot run or hide in that environment.
  • read Malwarebytes or Windows Defender Offline and run a full scan to find and remove infections.
  • If your browser has been hijacked, reset it to default settings and remove unfamiliar extensions after the malware scan is complete.
  • Update your operating system and all software when ready after removing malware, because outdated programs are how malware gets in.
  • If the malware returns or your computer still runs slowly after removal, you may need to wipe and reinstall Windows.

Check your browser for hijacking and unwanted extensions

Malware often changes your browser's homepage, search engine, or adds fake toolbars and extensions that you did not install. These slow your computer and can steal your search history or passwords. After running your malware scan, open your browser and look for anything unfamiliar in the address bar or toolbar.

In Chrome, click the three-line menu in the top right, go to Settings, then select Extensions. Delete anything you do not recognize. Next, go to Settings > Search Engine and make sure it is set to Google (or your preferred engine). In Firefox, click the menu button, select Add-ons, then Extensions, and remove unfamiliar items. Check Settings > Search to reset your search engine. In Edge, click the three-dot menu, select Settings > Privacy, Search, and Services, and reset your homepage and search engine to their defaults.

If your browser will not let you change these settings, or if the unwanted homepage keeps returning, the malware may still be active. Run another full scan in Safe Mode, or consider a factory reset of Windows (see the final section below).

Update Windows and all your software when ready

Malware spreads through security holes in outdated operating systems and programs. Once you have removed the infection, close the door by updating everything. This is the single most important step to prevent reinfection.

On Windows, click the Start button, type "Windows Update," and select Check for Updates. Install all available updates and restart your computer as prompted. This can take 20 to 45 minutes. While updates run, also update your other software: web browsers, Adobe Reader, Java, and any programs you use regularly. Most programs have an automatic update option in their settings menu, or you can visit the publisher's website and read the latest version.

On Mac, click the Apple menu, select System Settings (or System Preferences on older versions), then Software Update. Install all updates and restart. Then open the App Store, click Updates, and install any pending app updates.

Turn on real-time antivirus protection

Windows Defender (built into Windows 10 and 11) and macOS's built-in XProtect provide real-time protection against known malware. Real-time protection scans files as you read them, before malware can run. Make sure this feature is turned on.

On Windows, click the Start button, type "Windows Security," and open it. Select Virus & Threat Protection. Under Virus & Threat Protection Settings, make sure Real-Time Protection is toggled on (the switch should be blue). On Mac, open System Settings > Privacy & Security and scroll down to confirm that XProtect is active (you cannot turn it off, but you can see its status).

Real-time protection is not perfect — it catches known threats but not brand-new ones — so it works best alongside safe browsing habits. Do not read files from untrusted websites, do not open email attachments from people you do not know, and do not click links in suspicious emails or text messages.

Recognize common ways malware gets onto your computer

Understanding how malware spreads helps you avoid it in the future. The most common entry points are outdated software (which is why updates matter), fake read buttons on websites, email attachments, and malicious links in emails or text messages.

Fake read buttons usually appear on sites offering free software or media. The real read button is often small and straightforward to miss; the fake one is large and prominent. Before downloading anything, check the website's URL to make sure it is the official source. If you want VLC media player, go to videolan.org, not a third-party site. Avoid downloading software from file-sharing sites or torrent sites unless you are certain of the source.

Email attachments are another common vector. Do not open attachments from people you do not know, and be suspicious of unexpected attachments from people you do know — their email account may have been compromised. If someone sends you a file you were not expecting, ask them about it before opening it.

Perform a full Windows reinstall if malware persists

If malware keeps returning after scanning and updating, or if your computer runs so slowly that it is unusable, a full reinstall of Windows may be necessary. This erases everything on your hard drive and installs a fresh copy of Windows, removing any malware that might be hiding in system files.

Before you start, back up any files you want to keep to an external hard drive or cloud storage (Google Drive, OneDrive, or Dropbox). Then go to Settings > System > Recovery and select Reset This PC. Choose Remove Everything. Windows will ask whether you want to read a fresh copy or use local reinstall files; choose read if you have a fast internet connection, as it is more reliable. The process takes 30 minutes to an hour and requires your computer to restart several times.

After Windows reinstalls, you will need to reinstall your programs and restore your files from backup. This is time-consuming but guarantees that malware is gone. If you are not comfortable doing this yourself, a local computer repair shop can do it for you, usually for $100 to $200.

Frequently Asked Questions

Can I remove malware without restarting in Safe Mode?

You can try, but Safe Mode is much more effective because malware cannot run or block the scanner. If you scan in normal mode and the scan finds nothing, restart in Safe Mode and scan again. Many infections hide from standard scans.

Is Malwarebytes better than Windows Defender?

Malwarebytes is specifically designed to find and remove active infections, while Windows Defender is designed for ongoing protection. Use Malwarebytes to remove an existing infection, then rely on Windows Defender (or another antivirus) for daily protection going forward. They work well together.

Why does my computer still run slowly after I removed the malware?

Malware sometimes damages system files or leaves behind programs that slow your computer even after the main infection is gone. Run a second full scan in Safe Mode. If it still runs slowly, check your startup programs (Settings > Apps > Startup on Windows) and disable anything you do not recognize. If that does not help, a Windows reinstall is the most reliable fix.

How long does a full malware scan take?

A full scan with Malwarebytes or Windows Defender typically takes 30 minutes to an hour, depending on how many files are on your hard drive. Do not interrupt the scan or restart your computer while it is running. Let it finish completely.

What should I do if malware blocked my antivirus software?

Restart in Safe Mode with Networking and run your scan from there. Safe Mode prevents malware from running, so it cannot block the scanner. If you cannot restart in Safe Mode, read Malwarebytes on another computer, transfer it to a USB drive, and run it from the USB drive on the infected computer.