How to Remove Malware from Windows 11: A Step-by-Step Guide for 2026

Malware can turn a perfectly functional Windows 11 computer into a slow, unstable, and potentially unsafe machine. Suspicious pop-ups, unexpected browser redirects, and unfamiliar programs running in the background may indicate an infection. Fortunately, Windows 11 includes powerful security tools that can detect and remove many threats without expensive software or advanced technical knowledge.

This guide explains how to remove malware Windows 11 users encounter in 2026, using Microsoft Defender, Safe Mode, offline scanning, and trusted secondary scanners. The instructions apply to Windows 11 24H2, 25H2, and compatible newer releases, including 26H2.

Quick answer: To remove malware from Windows 11, disconnect from the internet, open Windows Security, update Microsoft Defender, and run a full virus scan. Quarantine detected threats, then use Microsoft Defender Offline for persistent infections. If problems continue, restart in Safe Mode, remove suspicious applications, and run a second scan with Malwarebytes. Finally, update Windows and secure your accounts.

How to Tell If Your Windows 11 PC Has Malware

Malware includes viruses, trojans, spyware, ransomware, and other software designed to compromise your computer. Some infections are obvious, while others operate quietly for weeks.

According to Microsoft’s security guidance, unexpected slowdowns, excessive resource consumption, pop-up advertisements, and browser redirects can indicate malicious activity.

Common warning signs include:

• Sudden performance problems: Your PC becomes unusually slow, freezes, or consumes excessive CPU and memory.
• Unexpected pop-ups: Fake security warnings or advertisements appear even when you are not browsing.
• Browser changes: Your homepage or default search engine changes without permission.
• Unknown startup programs: Unfamiliar applications launch automatically when Windows starts.
• Disabled security features: Antivirus protection, firewall settings, or Windows Update stop functioning.
• Suspicious account activity: You receive unfamiliar login alerts or discover unauthorized account changes.

These symptoms do not automatically prove an infection. Outdated drivers, legitimate background applications, and browser extensions can cause similar problems. A proper malware scan helps distinguish genuine threats from ordinary software issues.

Step 1: Disconnect Your PC from the Internet

If you strongly suspect an active infection, disconnect your computer from Wi-Fi or unplug its Ethernet cable. This can interrupt malware attempting to contact external servers, download additional components, or transmit stolen information.

To disconnect Wi-Fi, select the network icon in the Windows 11 taskbar, open Quick Settings, and turn off Wi-Fi.

If files are being encrypted or a ransom message appears, disconnect immediately. Avoid connecting external drives or other storage devices until the situation is understood.

Some later steps require internet access to download updated security definitions. Reconnect briefly when necessary, preferably after stopping obvious suspicious activity, and avoid signing into sensitive accounts on the affected computer.

Step 2: Run a Full Scan with Microsoft Defender

Windows Security, which includes Microsoft Defender Antivirus, is built into Windows 11 and provides antivirus protection by default when another compatible antivirus product is not managing protection.

Microsoft Defender is a sensible first choice because it integrates directly with Windows and does not require purchasing a separate subscription.

Update Your Virus Definitions

Before scanning, reconnect to a trusted network if necessary and update your antivirus intelligence.

1. Open Start and search for Windows Security.
2. Select Virus & threat protection.
3. Under Virus & threat protection updates, select Protection updates.
4. Click Check for updates.
5. Wait until the latest available security intelligence is installed.

Updated definitions improve the scanner’s ability to identify recently discovered malicious files.

Perform a Full System Scan

1. Open Windows Security.
2. Select Virus & threat protection.
3. Under Current threats, click Scan options.
4. Select Full scan.
5. Click Scan now and allow the process to finish.
6. Review detected threats and follow the recommended actions.

A full scan examines files and running applications throughout the system. Depending on storage capacity, file count, and computer performance, it may require considerably more time than a quick scan.

Microsoft documents these scanning options in its Windows Security guidance.

Step 3: Quarantine or Remove Detected Threats

When Microsoft Defender finds suspicious software, it may quarantine the file, remove it, or request further action.

Quarantine isolates a detected file so it cannot operate normally. This is generally preferable to immediately deleting unfamiliar files because antivirus software can occasionally produce false positives.

Open Windows Security, select Virus & threat protection, and review Protection history.

Examine each detection’s name, affected file path, and recommended response. Remove confirmed malware, but investigate detections involving legitimate business applications or important system components before overriding anything.

Do not restore suspicious files merely because an application stops working. If Defender identifies a malicious installer, download a clean replacement from the original software publisher after the infection is resolved.

Step 4: Use Microsoft Defender Offline for Stubborn Malware

Some malware hides while Windows is running, interferes with security software, or reinstalls itself after every restart.

Microsoft Defender Offline addresses this problem by scanning outside the normal Windows environment. Microsoft recommends offline scanning when persistent malware continues returning after removal.

How to Start an Offline Scan

1. Save open documents and close running applications.
2. Open Windows Security and select Virus & threat protection.
3. Click Scan options.
4. Choose Microsoft Defender Antivirus (offline scan).
5. Select Scan now and confirm the restart.
6. Allow the scan to complete without interrupting the computer.

Your computer restarts into a recovery environment, performs the scan, and returns to Windows afterward. Review Protection history to inspect the results.

This technique can detect certain persistent threats that resist ordinary scanning, although it cannot guarantee removal of every sophisticated infection.

Step 5: Boot Windows 11 into Safe Mode

If malware prevents normal cleanup, Safe Mode can provide a less complicated environment for troubleshooting.

According to Microsoft’s Windows startup documentation, Safe Mode loads only essential services and drivers. This limits the background components running while you investigate suspicious software.

Enter Safe Mode

1. Open Settings and navigate to System > Recovery.
2. Under Advanced startup, select Restart now.
3. After restarting, choose Troubleshoot > Advanced options.
4. Select Startup Settings and click Restart.
5. Press 4 or F4 to start Safe Mode.

Choose Safe Mode with Networking only if internet access is essential. Ordinary Safe Mode reduces unnecessary network exposure during investigation.

Inside Safe Mode, uninstall suspicious applications through Settings > Apps > Installed apps. Focus on unfamiliar software installed around the time problems began.

Safe Mode does not automatically remove malware, and some security tools cannot perform all their functions there. Restart normally after cleanup and repeat the appropriate scans.

Step 6: Run a Second Malware Scan with Malwarebytes

If Microsoft Defender reports a clean system but suspicious behavior persists, a reputable second-opinion scanner can help.

Malwarebytes offers Windows malware scanning and removal capabilities, including detection of potentially unwanted programs. Its free scanning option can complement Microsoft’s built-in protection.

Download Malwarebytes only from its official website. Avoid third-party download portals, fake antivirus advertisements, and websites demanding immediate payment to remove an alleged infection.

Install the scanner, update its detection database, and run a threat scan. Review the findings carefully before quarantining detected items.

Microsoft Defender vs Malwarebytes vs Defender Offline

You usually do not need several real-time antivirus products running simultaneously. Use one primary protection solution and a compatible on-demand scanner when additional verification is necessary.

Step 7: Remove Suspicious Startup Apps and Browser Extensions

Even after successful malware removal, unwanted software may leave startup entries, browser extensions, or altered settings behind.

Check Windows Startup Applications

Press Ctrl + Shift + Esc to open Task Manager, then select Startup apps. Review unfamiliar entries and disable suspicious programs while investigating their publisher and installation location.

Disabling startup entries prevents some unwanted applications from launching automatically, but it does not necessarily uninstall them.

Inspect Browser Extensions

In Chrome, open the Extensions management page. In Microsoft Edge, open Extensions and manage installed add-ons.

Remove extensions you do not recognize or no longer trust. Restore your preferred homepage, default search provider, and notification permissions.

If fraudulent security notifications continue, inspect which websites have permission to send browser notifications. Many frightening pop-ups are notification abuse rather than actual Windows system warnings.

Step 8: Update Windows and Repair Remaining Damage

After removing confirmed threats, install available Windows security updates. Supported Windows versions receive patches that address vulnerabilities malware may exploit.

As of October 2026, Microsoft’s Windows 11 release information lists version 26H2, released September 29, 2026. Windows 11 25H2 also remains supported. Windows 11 24H2 Home and Pro reached the end of servicing on October 13, 2026, making an upgrade particularly important for those editions.

Open Settings > Windows Update and select Check for updates. Install compatible updates, restart, and check again.

If Windows components remain damaged, open Terminal as administrator and run the following commands separately:

DISM /Online /Cleanup-Image /RestoreHealth

sfc /scannow

These built-in tools repair certain Windows component and system-file problems. They are not replacements for antivirus scanning.

If scans repeatedly detect the same infection, consider reinstalling Windows using trusted installation media. For serious compromises, a clean installation is generally more dependable than assuming every hidden component has been removed.

Step 9: Protect Your Accounts and Prevent Reinfection

Malware removal does not reverse stolen passwords, copied documents, or unauthorized account access.

From a separate trusted device, change passwords for your email, banking, work, and other sensitive accounts if credential theft is possible. Review active sessions, revoke unfamiliar devices, and enable multifactor authentication.

Our guide to the best 2FA apps explains available authentication options.

Keep Microsoft Defender real-time protection, firewall protection, and browser security features enabled. Install applications from reputable publishers and avoid pirated installers or unexpected attachments.

Review cybersecurity basics to strengthen everyday security habits. Learning how to spot a phishing email also helps prevent malware infections that begin with deceptive messages.

Frequently Asked Questions

1. Can Windows 11 remove malware automatically?

Yes. Microsoft Defender Antivirus provides built-in real-time protection that can detect, block, quarantine, and remove many known threats automatically. However, automated protection cannot identify every infection. If your computer behaves suspiciously, manually update security intelligence, run a full scan, and use Microsoft Defender Offline when persistent malware is suspected.

2. Is Microsoft Defender enough to remove viruses from Windows 11?

Microsoft Defender is sufficient for many common infections and is a practical starting point for most Windows 11 users. Its full and offline scanning options cover different situations. However, no antivirus detects everything. If symptoms continue despite clean results, an additional scan with Malwarebytes or professional investigation may be appropriate.

3. How do I remove malware from Windows 11 without installing software?

Open Windows Security, update Microsoft Defender, and perform a full scan. Quarantine confirmed threats, then run Microsoft Defender Offline if necessary. You can also use Safe Mode to uninstall suspicious programs and inspect startup applications. These methods rely on Windows features and do not require downloading third-party antivirus software.

4. Does resetting Windows 11 remove all malware?

A complete Windows reinstallation from trusted media can remove most ordinary malware, especially when existing system partitions are deleted during installation. However, firmware-level threats and contaminated backups require separate attention. Windows Reset with Keep my files is less comprehensive than a clean installation. Always preserve essential personal data carefully before reinstalling.

5. How do I know if malware is completely gone?

Run updated full and offline scans, verify that suspicious startup processes and browser changes have disappeared, and monitor your computer after restarting. Clean scan results and normal behavior provide useful reassurance but cannot guarantee complete removal. Repeated detections, unexplained account activity, or persistent security failures warrant deeper investigation or reinstallation.

Conclusion: The Safest Way to Remove Windows 11 Malware

Removing malware from Windows 11 usually does not require paid antivirus software or complicated technical procedures. Start by containing the suspected infection, updating Microsoft Defender, and performing a full scan. Escalate to offline scanning, Safe Mode, and a trusted second-opinion scanner when necessary.

After cleanup, restore Windows updates, investigate unauthorized account activity, and strengthen login security. If the infection repeatedly returns or sensitive information may have been compromised, prioritize a clean installation and account recovery over repeated superficial scans.

The key takeaway: Use Windows 11’s built-in security tools first, verify the results, and address the underlying cause to reduce the likelihood of another infection.