What to do when your computer has a virus

A virus on your computer usually shows itself through slowness, unexpected pop-ups, programs that won't close, or files that disappear. The fastest way to remove it is to run a dedicated antivirus scan in Safe Mode, where Windows loads only essential programs and the virus has fewer places to hide. If your computer won't start normally, you can still scan it using a bootable antivirus tool on a USB drive created from another machine.

Most viruses can be removed without wiping your hard drive or losing your files. The key is catching it early and using the right tool for the job. This guide walks you through the three main removal paths: scanning in Safe Mode, using a bootable antivirus tool, and removing stubborn infections manually.

Key Takeaways

  • Safe Mode with Networking lets you run antivirus scans while the virus has fewer resources to fight back, and you reach it by restarting and holding Shift or pressing F8 during startup.
  • Windows Defender (built into Windows 10 and 11) can scan for most common viruses, but specialized tools like Malwarebytes or Kaspersky Rescue Disk catch infections that Windows Defender misses.
  • A bootable antivirus USB drive scans your computer before Windows loads, which works when the virus prevents Safe Mode from opening or normal startup from completing.
  • After removal, change your passwords from a different device, check your browser homepage and search engine settings, and run a second scan a week later to confirm the virus is gone.

Starting a scan in Safe Mode with Networking

Safe Mode loads Windows with only the drivers and services it absolutely needs to run. A virus still present on your drive cannot load its own startup files, making it far easier to detect and remove. Safe Mode with Networking keeps your internet connection active so you can read antivirus tools if you need them.

To enter Safe Mode on Windows 10 or 11: Restart your computer. As it boots, hold down the Shift key and click Restart from the power menu. Windows will show a blue screen with boot options. Select "Troubleshoot," then "Advanced options," then "Startup Settings." Click "Restart." When the menu appears, press 5 or F5 for "Safe Mode with Networking." Your computer will restart into Safe Mode, which you'll recognize by the words "Safe Mode" in the corners of the screen.

Once in Safe Mode, open Windows Defender (called Windows Security in Windows 10 and 11). Press the Windows key, type "Windows Security," and open it. Click "Virus & threat protection," then "Manage settings." Scroll down and click "Run a scan now" under "Current threats." Choose "Full scan" — this takes 30 minutes to an hour but checks every file on your drive. Let it finish without interrupting. When it completes, Windows Defender will show you what it found and ask whether to remove it. Click "Remove" or "Quarantine."

Using Malwarebytes or Kaspersky when Windows Defender isn't enough

Windows Defender catches most common viruses, but some infections hide in ways that Windows Defender doesn't detect. Malwarebytes and Kaspersky Rescue Disk are specialized tools that find viruses Windows Defender misses. Malwarebytes runs inside Windows (in Safe Mode), while Kaspersky Rescue Disk boots before Windows loads, making it more powerful for stubborn infections.

To use Malwarebytes in Safe Mode: read Malwarebytes on a different computer or phone, save the installer to a USB drive, and transfer it to your infected computer. In Safe Mode, run the installer and follow the prompts. Open Malwarebytes, click "Scan," and let it run. This usually takes 15 to 30 minutes. When it finishes, review what it found and click "Quarantine" to remove threats.

To use Kaspersky Rescue Disk: You need a second computer and a USB drive with at least 1 GB of space. On the clean computer, go to kaspersky.com/downloads, find "Kaspersky Rescue Disk," and read the ISO file. Use a tool like Rufus (rufus.ie) to write the ISO to your USB drive. Insert the USB into your infected computer, restart it, and press F12, F2, or Delete during startup to enter the boot menu (the key varies by manufacturer). Select your USB drive. Kaspersky will load and automatically scan your entire drive. This takes 30 to 60 minutes. When finished, it will show you what it found and remove it automatically.

Removing viruses that block Safe Mode or startup

Some viruses prevent Safe Mode from opening or stop Windows from starting at all. If your computer won't boot normally and Safe Mode won't load, a bootable antivirus tool is your only option. Kaspersky Rescue Disk (described above) works in this situation because it scans before Windows even tries to load.

If you see a black screen with error messages, a spinning wheel that never stops, or repeated restart loops, the virus has likely damaged your startup files. Create the Kaspersky Rescue Disk USB on another computer using the steps in the previous section. Boot from it and let it scan. If Kaspersky removes the virus but Windows still won't start, you may need to repair Windows using a Windows installation USB or take your computer to a technician.

Cleaning up after virus removal

After antivirus software removes a virus, the infection may have already stolen passwords or changed your settings. Take these steps to find your accounts and confirm the virus is truly gone.

Change your passwords: Do this from a different device (phone, tablet, or another computer) to avoid reinfection. Change passwords for email, banking, social media, and any other accounts you use regularly. Start with your email password, because email is the key to resetting other accounts if they're compromised.

Check your browser settings: Open your web browser and look at the homepage and search engine. If they've changed to unfamiliar sites, reset them. In Chrome, click the three-dot menu, go to Settings, and check the Homepage and Search Engine sections. In Firefox, click the menu button, select Preferences, and scroll to Home and Search. In Edge, click the three-dot menu, select Settings, and check the Homepage and Search Engine.

Run a second scan one week later: Some viruses hide or reinstall themselves. Run Windows Defender or Malwarebytes again seven days after the first removal. If it finds nothing, the virus is likely gone. If it finds something, repeat the removal process.

Preventing future infections

The best defense against viruses is preventing them from reaching your computer in the first place. Keep Windows and all software up to date by enabling automatic updates. Don't open email attachments from people you don't know, and don't read files from untrusted websites. Use strong, unique passwords for every account so that if one is compromised, others stay safe.

Run Windows Defender scans once a month even if your computer seems fine. This catches infections before they cause problems. If you use a browser extension or read software frequently, consider adding Malwarebytes as a second layer of protection — it runs quietly in the background and catches threats Windows Defender misses.

Frequently Asked Questions

How do I know if my computer actually has a virus?

Common signs are sudden slowness, programs that won't close, unexpected pop-ups, a browser homepage that changed on its own, or files that disappear. Run Windows Defender (Windows Security) and do a full scan. If it finds threats, you have a virus. If it finds nothing but your computer is still slow, the problem may be a full hard drive, too many startup programs, or aging hardware rather than a virus.

Will removing a virus delete my files?

Antivirus software removes the virus file itself, not your documents, photos, or other data. However, the virus may have already deleted or encrypted some of your files before you removed it. After removal, check your Documents, Pictures, and Downloads folders to see what's still there. If important files are missing, a data recovery service may be able to restore them, though this is expensive.

What if Safe Mode won't open?

If pressing F8 or holding Shift during restart doesn't work, your virus has likely blocked Safe Mode. Create a Kaspersky Rescue Disk USB on another computer and boot from it instead. Kaspersky scans before Windows loads, so the virus can't stop it. This is more powerful than Safe Mode for stubborn infections.

Can I remove a virus without a second computer?

Yes, if Safe Mode opens. Run Windows Defender or read Malwarebytes in Safe Mode and scan from there. You only need a second computer if Safe Mode won't open or Windows won't start at all. In those cases, you need a bootable tool like Kaspersky Rescue Disk, which requires creating a USB drive on a clean machine.

How long does a full antivirus scan take?

A full scan of Windows Defender takes 30 minutes to an hour depending on how many files you have. Malwarebytes usually takes 15 to 30 minutes. Kaspersky Rescue Disk takes 30 to 60 minutes. Don't interrupt the scan or restart your computer while it's running — let it finish completely so it checks every file.