How to Remove Malware from Windows: A Calm, Complete Cleanup Guide

'Malware' covers four different animals, and the treatment differs:

• Adware/PUPs: pop-ups, a new default search engine, toolbars. Annoying, not dangerous. Most common by far.
• Browser hijackers: redirects and fake search results, lives almost entirely in extensions and shortcuts.
• Info-stealers: silent — steals saved passwords and session cookies. No symptoms; found via breach alerts or strange logins. Treat as urgent (password rotation is step one).
• Ransomware: files encrypted, ransom note on screen. Do NOT pay; disconnect and see the recovery section below.

Slow PC + pop-ups + unknown programs = adware bundle. Clean PC + a stranger logging into your email = stealer. Different diseases, different medicine.

1. Disconnect the Wi-Fi/ethernet if you suspect a stealer or ransomware — stop the bleeding before cleaning.
2. Back up what matters — documents and photos to an external drive. Some cleanup tools quarantine aggressively; don't lose the family archive to a false positive.
3. Boot to Safe Mode (Settings → Recovery → Advanced startup → Restart now → Troubleshoot → Startup Settings → Safe Mode with Networking) — most malware's persistence mechanisms don't load here.
4. Full scan with Windows Security (built-in, genuinely good — see our antivirus comparison), then a second-opinion scan with the free Malwarebytes, which specializes in exactly the PUPs Defender ignores. Quarantine everything both find.
5. Uninstall the unknowns: Settings → Apps — remove anything you don't recognize, especially recently installed 'helpers,' 'optimizers,' and PDF converters. Sort by install date; your memory of 'I never installed that' is the best detector.
6. Browser surgery (below) — this is where most reinfections happen.
7. Reboot normally and verify — symptoms gone, startup list clean, Task Manager idle.

Adware's favorite home is the browser, and it hides in three places:

• Extensions: remove every extension you don't actively use or recognize — including ones 'that were always there.' Malicious updates turn old extensions bad overnight.
• Search engine and homepage: reset the default search to your choice and remove unknown 'search engines' from settings — hijackers register themselves there.
• Shortcuts: right-click your browser shortcut → Properties → Target field: delete anything appended after chrome.exe" (a URL there means every launch opens the hijacker's page).

If the browser still misbehaves, a full profile reset (Settings → Reset settings) is scorched earth that works — you'll re-login and re-add extensions from scratch, which is the point.

Cleaning without prevention is a subscription, not a fix:

• Rotate passwords from a clean device — email first (see our breach response guide), then banking. Any password saved in the browser during infection must be considered stolen; a password manager with 2FA is the recovery path.
• Enable 2FA everywhere it matters — our 2FA guide prioritizes by blast radius.
• Check Task Manager's Startup tab weekly for a month — reinfections announce themselves there first.
• Update everything: Windows, browsers, the PDF reader — outdated software is how round two happens.

Ransomware: disconnect immediately, do not pay (payment funds crime and often returns broken decryptors), check No More Ransom for a free decryptor, and restore from backups. This is why the 3-2-1 backup habit is the only real ransomware insurance.

Info-stealers: assume every browser-saved password and active login session is compromised. The order matters: from a clean device (or phone), change the email password first, kill all sessions everywhere you can, then rotate the rest via your password manager. Card data saved in browsers? Call the bank.

And the honest note: if symptoms survive Safe Mode, two scanners, extension removal, AND a clean reinstall — stop. Reinstall with all partitions formatted, and if it persists even then, that's firmware-level, which means professional tools or a new machine. Don't pour weeks into a haunted box.