Skip to content
FixingHacks
Code on a screen representing cybersecurity

How to Remove Malware from Windows 11 Without Losing Your Files

Clean adware, browser hijackers, and stubborn malware on Windows 11 using Safe Mode, Windows Security, and reputable scanners — without formatting first.

9 min readmalware, adware, Windows 11

Pop-ups, a mystery toolbar, fans screaming at idle — classic malware week. You can usually clean Windows 11 without formatting, if you work carefully: isolate, scan in Safe Mode, reset browsers, rotate passwords.

Do not call the number on a full-screen virus warning. Do not install three “optimizers” from banner ads. Use Defender + one reputable second opinion (affiliate card). For encryption attacks, also read ransomware protection. Entry vector education: phishing.

Symptoms vs other problems

Symptom Could be malware Could also be
High CPU idle Miner / adware Chrome, Update
New homepage / redirects Hijacker Extension you forgot
Security Center disabled Malware IT policy
Random pop-ups Adware / scam pages Bad website only
Files renamed .encrypted Ransomware Stop; disconnect

Phase 0 — protect what matters

  1. Unplug Ethernet / disconnect WiFi if the PC is actively spraying spam (optional if you need Networking for updates/scans)
  2. Copy critical documents to an external drive — do not copy mystery .exe installers
  3. From another clean device, change passwords for email/banking after you finish cleanup (or now if you already typed secrets into a fake site)
  4. Create a restore point only on a PC you still mostly trust — skip if ransomware is active

Phase 1 — Safe Mode

  1. Settings → System → Recovery → Advanced startup → Restart now
  2. Troubleshoot → Advanced options → Startup Settings → Restart
  3. Press 5 for Safe Mode with Networking (or 4 without if you will scan offline)

If Windows will not boot normally, force WinRE with three interrupted starts — same idea as BSOD / black screen recovery paths.

Phase 2 — Microsoft Defender deep scans

In Safe Mode or normal mode:

  1. Open Windows Security → Virus & threat protection
  2. Scan options → Full scan
  3. Then Microsoft Defender Offline scan — PC reboots into a special scanner that catches stubborn boot threats
  4. Review Protection history — quarantine everything obvious

Keep Real-time protection on afterward. If another AV already owns the PC, use that product’s full scan + its rescue mode.

Phase 3 — one second-opinion remover

Install one well-known on-demand cleaner from its official site (examples people use: Malwarebytes free scan, ESET Online Scanner, etc. — pick a vendor you trust; the affiliate card points at a reputable option).

  • Run an elevated full scan
  • Remove PUPs/adware it finds
  • Uninstall the second tool’s trial real-time hooks if you only wanted on-demand — do not run dual real-time forever

Phase 4 — browsers and hijackers

For each browser you use (Edge, Chrome, Firefox):

  1. Remove unknown extensions
  2. Reset settings to defaults
  3. Clear shortcuts that launch Something.exe http://weird-search
  4. Check homepage/search engine

Chrome-specific performance leftovers: Chrome high CPU.

Uninstall mystery programs:

Settings → Apps → Installed apps — sort by install date — remove crack tools, “Player,” “Optimizer,” “Codec,” fake Flash updaters.

Phase 5 — startup, tasks, and hosts

  1. Task Manager → Startup apps — disable unknowns
  2. taskschd.msc — look for recently created tasks running from %Temp% or user Downloads
  3. Advanced users: check C:\Windows\System32\drivers\etc\hosts for sketchy redirects (do not break localhost entries)
  4. msconfig clean boot if something still launches

Phase 6 — secure the accounts

Assume stealer malware if you entered passwords:

  1. From a clean device, change email passwords first
  2. Enable 2FA
  3. Review forwarding rules in Gmail/Outlook
  4. Revoke unknown sessions / app passwords
  5. Put logins in a password manager

Phase 7 — system file repair

After cleanup:

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

Reboot. Update Windows. Re-enable Controlled folder access.

When to reset or reinstall

Situation Action
Adware gone, PC feels normal Done — monitor a week
Security tools cannot stay on Reset this PC / clean install
Banking trojans confirmed Clean install + financial fraud monitoring
Ransomware, no backups Offline scan attempts; restore from offline backup; do not pay lightly
Hardware miner implant (rare) Professional help

Reset this PC → Keep my files is a middle path; still reinstall apps from official sources only.

Prevention that works

  • UAC left on
  • SmartScreen on
  • No pirated software
  • Ad blockers from reputable sources
  • VPN only from audited vendors (VPN setup) — fake VPN ads are malware droppers
  • Weekly glance at Startup apps

Cleanup order (print this)

  1. Isolate / back up docs
  2. Safe Mode
  3. Defender full + Offline
  4. One second-opinion scan
  5. Reset browsers; uninstall PUPs
  6. Startup + Task Scheduler hygiene
  7. Password + 2FA rotation
  8. DISM/SFC
  9. Reset Windows only if trust is gone

Most home infections are adware and hijackers. Patient Safe Mode scans beat panic formatting — and beat anything a pop-up support scammer wants you to install.

Second opinions without AV pile-ups

Run one on-demand second scanner, remove what it finds, then uninstall its real-time trial if you do not want two shields. Overlapping real-time AVs cause disk spikes and missed detections. After cleanup, re-enable Controlled folder access, rotate passwords with a password manager, and turn on 2FA. If the infection arrived by email, rehearse phishing recognition with your household.

When Reset is the honest answer

If Security Center cannot stay enabled, browser hijacks return daily, or a banking trojan was confirmed, back up documents only (not EXEs) and Reset or clean-install. Encrypt the recovered files’ trust: open Office docs with caution. Fake “support” pop-ups that ask you to call a number or install remote tools are part of the attack — close them from Task Manager.

After cleanup week one, watch Startup apps daily and decline any unexpected “PC cleaner” prompts that appear in the browser — those are often the same adware family returning through a leftover scheduled task.

Frequently Asked Questions

Do I need to reinstall Windows to remove malware?

Not usually. Safe Mode scans and browser resets clear most adware. Reinstall if a rootkit persists or banking credentials were stolen and you cannot trust the PC.

Is Malwarebytes safe to use alongside Windows Security?

Yes for on-demand second-opinion scans. Avoid installing five overlapping real-time suites at once.

What are signs of malware?

New browser homepage, pop-ups, unknown startup programs, disabled Security Center, and sudden crypto-mining CPU heat.

Should I pay for a support pop-up cleaner?

No. Full-screen ‘call this number’ warnings are tech-support scams. Close the browser from Task Manager and scan offline.

Will System Restore remove malware?

Not reliably — malware can infect restore points. Scan first; restore only as a supplement.

Related fixes