The honest framing for malware removal on Windows is that it is a sequential recovery protocol where the order of steps matters more than which specific tools you pick at each step. Most articles in this category present ranked lists of scanners as if the choice between them is the important decision; the realistic situation is that the steps matter substantially, the order of steps matters substantially, and the specific tool used at each step matters less than getting through the protocol completely. Users who run a single scanner and declare themselves clean often have remaining infections; users who follow a sequential multi-tool protocol typically achieve actual cleanup.
This matters because malware in 2026 is sophisticated enough that single-tool scans frequently miss components. Different scanners catch different threat categories. Different scanning approaches (signature-based, behavioural, cloud-assisted, offline) find different things. Persistence mechanisms (scheduled tasks, registry entries, browser extensions, services) survive scans that focus only on file-based threats. The realistic clean state requires verification by multiple independent tools, not faith in any single one.
This guide is structured as the actual protocol rather than as a tool comparison. For broader context on the Windows security software stack that supports this protocol, our guide to the best software and apps covers the adjacent categories.
Step 0: Before You Begin — Critical Preparation
Before running any tools, several preparation steps determine whether the cleanup will succeed.
Disconnect the computer from the internet if you suspect active malware. Unplug the ethernet cable or disable wifi. This prevents the malware from continuing to communicate with command-and-control servers, exfiltrating data while you work, or spreading to other devices on your network. Some scanning operations require internet (for cloud-based detection), but the protocol below identifies which steps need network and lets you control when.
Back up any irreplaceable data to external storage before starting. The realistic risk is not that scanners destroy data — they generally do not — but that some recovery situations escalate to requiring Windows reinstallation. If you have unbacked-up data when this happens, you may lose it. A few minutes copying critical files to an external drive before cleanup avoids this risk entirely.
Document the symptoms you are seeing. Specific symptoms (browser hijacks, popup ads, ransom demands, slow performance, unfamiliar processes) point to different malware categories and matter for verifying that cleanup actually worked. Writing down what you observed before cleanup gives you a reference for confirming that the symptoms are gone afterwards.
Boot to Safe Mode with Networking for the bulk of the cleanup. Safe Mode loads minimal Windows components, which prevents most malware from running during cleanup. Press Shift+Restart from the Windows sign-in screen, then navigate to Troubleshoot → Advanced Options → Startup Settings → Restart, then press 5 for Safe Mode with Networking. The networking is needed for the cloud-assisted scanners; for the offline scan in Step 4, you will boot differently.
Have administrative access to the computer. Most scanning tools require administrator privileges to inspect protected areas. If you are working on a managed work computer where you do not have admin access, contact IT support rather than attempting cleanup with limited privileges that will produce incomplete results.
For users facing immediate active threats (ransomware encrypting files, banking trojans potentially compromising accounts), the protocol below may need to be adjusted for urgency. Disconnect from network immediately, then proceed through the steps as quickly as practical, then change passwords on all important accounts from a different clean computer.
Step 1: Malwarebytes Scan in Safe Mode
The first scanning step uses Malwarebytes (malwarebytes.com) specifically because of its strong detection of adware, potentially unwanted programs (PUPs), and browser hijackers — the threat categories that account for most modern Windows infections. The free version handles this step adequately.
If Malwarebytes is not already installed, download the installer from the official Malwarebytes website on a clean computer and transfer it via USB drive to the infected computer. Avoid downloading directly on the infected computer where browser modifications may redirect downloads to malicious alternatives. Install in Safe Mode by running the installer with administrator privileges.
Run a full scan rather than a quick scan. The full scan takes longer (often 30-60 minutes depending on drive size and contents) but checks substantially more locations than the quick scan. The quick scan is appropriate for routine maintenance; for active cleanup, the full scan is necessary.
When the scan completes, review the findings and quarantine everything Malwarebytes flags. The realistic situation is that you cannot assess individual findings with confidence as a typical user — trust the tool’s recommendations rather than trying to second-guess them. Quarantine moves the files to a protected location where they cannot run; if you discover later that something legitimate was incorrectly flagged, you can restore it from quarantine.
Restart the computer when Malwarebytes prompts. The restart completes the cleanup of items that were locked while Windows was running. After restart, return to Safe Mode for the next step.
Step 2: AdwCleaner for Specific Adware and Toolbars
AdwCleaner (free; from Malwarebytes; malwarebytes.com/adwcleaner) targets specifically the adware, toolbars, and browser modifications that ordinary scanners sometimes miss. While Malwarebytes catches most of this category, AdwCleaner is specifically tuned for it and finds residual components that the main scan can leave behind.
The case for running AdwCleaner separately even though Malwarebytes already covers similar territory is the specific focus. AdwCleaner’s database is maintained specifically for adware and PUP signatures, with detection patterns that the broader Malwarebytes scanner may apply less aggressively. The combination of both produces more thorough cleanup than either alone.
Download AdwCleaner from the official source, transfer to the infected computer if needed, and run as administrator. The tool does not require installation — it runs as a portable executable. The scan is quick (typically 5-15 minutes) and the cleanup is straightforward.
When the scan completes, review the findings and clean them. Restart when prompted. After restart, return to Safe Mode for the next step.
Step 3: HitmanPro for Second-Opinion Cloud Scanning
HitmanPro (30-day free trial provides full functionality for one-time cleanup; hitmanpro.com) provides cloud-assisted second-opinion scanning that catches threats the previous tools may have missed. The product uses multiple antivirus engines through cloud queries, which produces broader detection than any single scanner.
The case for HitmanPro at this protocol stage is the multi-engine approach. After Malwarebytes and AdwCleaner have handled most of the cleanup, HitmanPro’s cloud scanning catches residual threats that survived. The 30-day trial provides full functionality for the one-time use case this protocol addresses.
HitmanPro requires internet access (which is why Safe Mode with Networking matters) because the detection happens via cloud queries. The scan is reasonably fast (typically 5-15 minutes) and the findings are presented clearly.
When the scan completes, review and remove findings. The product asks for the 30-day trial activation when you attempt to remove threats; this provides full functionality temporarily without payment commitment. Restart when prompted and return to Safe Mode for the next step.
Step 4: Windows Defender Offline Scan
The previous steps run while Windows is running (even in Safe Mode), which means rootkit-style malware that loads before Windows fully starts could potentially hide from the scans. The Windows Defender Offline Scan (from microsoft.com) addresses this by running before Windows starts, in a minimal environment that malware cannot subvert.
To trigger the offline scan: Settings → Privacy & Security → Windows Security → Virus & Threat Protection → Scan Options → Microsoft Defender Antivirus (offline scan) → Scan Now. The system will warn that it will restart automatically and may take 15-20 minutes. Save any open work, close applications, and proceed.
The computer restarts to a special pre-boot environment where Windows Defender scans without normal Windows running. You cannot use the computer during this scan. When complete, the computer boots normally, and the scan results appear in the Windows Security app.
The case for this specific step is the rootkit detection. Most modern malware does not use rootkit techniques (the techniques are technically difficult and less commonly used in mass-distribution malware), but some specific threat categories do, and the offline scan catches them where running-Windows scans cannot.
Review the findings and ensure any detected threats are removed. After the offline scan completes, the computer should be substantially cleaner than before this protocol started.
Step 5: Browser Cleanup and Reset
Browser-based malware persistence is one of the most common failure modes of malware removal — the scanners clean the file system but miss browser-level modifications that produce ongoing problems. Manual browser cleanup is necessary to address this.
For each browser you use, the cleanup involves several specific actions.
Review installed extensions and remove anything you do not specifically recognise. Chrome: Menu → More Tools → Extensions. Firefox: Menu → Add-ons and Themes → Extensions. Edge: Menu → Extensions. Safari: Safari Menu → Settings → Extensions. Remove all extensions you did not deliberately install, particularly any that appeared recently or that you cannot identify the purpose of.
Check the homepage and search engine settings. Browser hijackers often change these to redirect through their own services. Restore to your preferred homepage and search engine through the browser settings.
Clear browser data — cookies, cached files, browsing history. While most of this is benign, malicious cookies that track you across sites and cached scripts that may have been compromised get cleared by this step.
If the browser has been significantly compromised, the more aggressive option is to reset the browser to defaults through its settings. This removes all extensions, custom settings, and configuration that may have been modified by malware. Bookmarks and saved passwords typically survive the reset, but verifying this in your specific browser before resetting is worthwhile.
For Chrome specifically, signing out of your Google account and back in after browser reset ensures sync state is refreshed. Similar logic applies to Firefox accounts and Microsoft accounts in Edge.
Step 6: Check Persistence Mechanisms
Beyond what scanners detect automatically, manual review of common persistence mechanisms catches malware components that survived the scanning steps. This step requires more technical comfort than the automated steps above.
Task Scheduler (Search → Task Scheduler): look for unexpected scheduled tasks with cryptic names or unfamiliar publishers, and disable suspicious ones rather than deleting them initially. Startup Programs (Task Manager → Startup tab): disable unfamiliar programs that launch with Windows. Services (Search → Services): look for unusual services, focusing on those with cryptic names, no description, or unusual languages. Installed Apps (Settings → Apps → Installed apps sorted by Install date): investigate recently installed applications you do not recognise. For technical users, Microsoft’s Autoruns from Sysinternals provides comprehensive visibility into all persistence mechanisms in one tool.
Step 7: Verify Cleanup and Restore Network
Before reconnecting to the internet and resuming normal use, verifying that the cleanup actually worked matters substantially.
Boot normally (not Safe Mode) and observe whether the original symptoms persist. Browser hijacks should be gone. Popup ads should not appear during normal use. Performance should match what you remember from before the infection. Any persistence of the original symptoms indicates incomplete cleanup that warrants returning to the protocol.
Run a final clean scan with Microsoft Defender. Settings → Privacy & Security → Windows Security → Virus & Threat Protection → Quick scan. If Defender flags additional findings on this scan, the cleanup is not complete and further investigation is needed.
Reconnect to the internet and observe network activity. The Network tab in Task Manager (Performance → Network) shows ongoing network activity. Unusual sustained activity when you are not actively using the internet may indicate residual malware still attempting to communicate with command servers.
Change passwords on important accounts (email, banking, work systems) from this computer if you are confident it is clean, or from a different computer if there is any doubt. Modern malware often includes keyloggers or credential theft components, so account compromise is a realistic risk that warrants response even after the local malware is removed.
Enable two-factor authentication on accounts that did not already have it. This prevents future password compromise from leading to immediate account takeover. Our Windows antivirus comparison covers the prevention category that reduces the likelihood of future infections requiring this protocol.
When Reinstallation Is the Right Answer
One framing point worth making explicitly: for some infections, the protocol above is the wrong response and clean Windows reinstallation is the appropriate path. Understanding when each approach makes sense affects your strategic response.
Reinstallation is the right response when: infections have included credential theft or keylogger components, rootkits have been detected, the system has been infected for an unknown extended period, multiple cleanup attempts have not produced certainty about cleanliness, or the system contains business-critical data where complete cleanliness assurance matters.
The protocol above is the right response when: the infection appears to be straightforward adware or browser hijacker, you caught the infection quickly before it could establish deep persistence, reinstallation would lose substantial setup work and the infection severity does not justify it, and you have appropriate backups in case the protocol does not produce full cleanup.
For users facing serious infections (ransomware, banking trojans, advanced persistent threats), the realistic recommendation is often to back up data immediately and proceed to Windows reinstallation rather than spending substantial time on removal attempts that may not achieve certainty. The time invested in removal sometimes exceeds the time for reinstallation, and reinstallation produces guaranteed clean state that removal attempts cannot. Our data recovery software comparison covers the related category for situations where data backup before reinstallation matters.
What This Protocol Cannot Fix
The honest framing about what this protocol cannot address.
Encrypted files from ransomware: the protocol removes ransomware but does not decrypt files. Recovery requires either backups or finding a publicly-available decryptor for the specific ransomware strain. Compromised credentials: the protocol does not undo credential theft that happened while malware was active. Account-level response (password changes, two-factor authentication, breach monitoring) is the appropriate fix. Financial losses already incurred: these require response through your bank, credit card company, and relevant law enforcement rather than technical cleanup. Hardware-level compromises (rare but real in targeted attacks): require professional assessment rather than DIY cleanup. Our firewall software comparison covers the related security category that contributes to comprehensive protection.
The Prevention That Makes This Protocol Unnecessary
One framing point worth making: malware infections that require this protocol are largely preventable through specific practices that most users could adopt without significant inconvenience.
Keep Windows and applications updated promptly. Most successful infections exploit vulnerabilities that have already been patched. Enabling automatic updates and not delaying restarts when prompted addresses this directly.
Run as a non-administrator user for daily computing. Configure Windows with a separate administrator account used only when needed and a regular account for daily use. Most malware requires administrator privileges to do serious damage; running as non-administrator prevents many infections from succeeding even when malicious code executes.
Be skeptical of download sources. Software from unfamiliar publishers, “free” versions of commercial software from unauthorised sources, browser extensions from unknown developers, and email attachments from unexpected senders all account for substantial infection rates. Defaulting to skepticism about sources prevents most infections.
Use a reputable browser with appropriate security settings. The major browsers (Chrome, Firefox, Edge, Safari) have invested substantially in security features that prevent many infection attempts. Using these with default settings or stricter security settings produces meaningful protection.
Implement proper backup posture. Even if all prevention fails, proper backups make malware infections an inconvenience (restore from backup, address the underlying compromise) rather than a disaster (lose data permanently). Our malware removal tool comparison covers the tool category that supports this protocol for users wanting to understand the individual tools in depth.
The Practical Recommendation
For most users in 2026 facing Windows malware infections, the answer is to follow the sequential recovery protocol above rather than rely on any single tool. The protocol order matters: preparation (disconnect, backup, Safe Mode), then Malwarebytes for the bulk of cleanup, then AdwCleaner for specific adware residuals, then HitmanPro for second-opinion cloud scanning, then Windows Defender Offline Scan for rootkit-level coverage, then browser cleanup for browser-level persistence, then manual check of persistence mechanisms, then verification before resuming normal use. The realistic outcome of completing the entire protocol is meaningful cleanup that single-scanner approaches cannot match. For serious infections where the protocol produces uncertain results, Windows reinstallation is the appropriate response rather than continued cleanup attempts. The wrong move is treating malware removal as a tool selection decision rather than as a protocol — users who run one scanner and declare themselves clean frequently miss components that the multi-tool protocol catches. Follow the protocol, accept that it takes hours rather than minutes, and improve the prevention practices that reduce the likelihood of future infections requiring this kind of recovery.
