How to Remove Malware From Windows 10 (2025 Guide)

Over 560,000 New Malware Samples Appear Every Day — Here's How to Fight Back

The AV-TEST Institute registers more than 560,000 new malicious programs and potentially unwanted applications daily as of 2025. That’s not a typo. And Windows 10 remains the single biggest target because it still runs on roughly 60% of all Windows desktops worldwide, according to StatCounter’s June 2025 data.

So if your Windows 10 PC is acting strange — sluggish startups, browser redirects, pop-ups you didn’t ask for, programs you don’t recognize — you’re probably not imagining things. Something got in.

The good news: most malware infections on Windows 10 are fixable without wiping your hard drive or paying someone $200 at a repair shop. You just need to follow the right steps in the right order. I’ll walk you through the entire process, from the quick built-in scans to the deeper cleanup that most guides skip entirely.

Step 1: Disconnect and Boot Into Safe Mode

Why You Should Go Offline First

Before you touch anything else, unplug your Ethernet cable or turn off Wi-Fi. Malware often phones home — sending your data to a remote server, downloading additional payloads, or receiving instructions. Cutting the internet connection is like slamming the door on a burglar who’s still carrying stuff out of your house.

How to Enter Safe Mode on Windows 10

Safe Mode loads Windows with only the bare minimum drivers and services. That matters because many types of malware hook into startup processes and background services. In Safe Mode, those hooks don’t load, which makes the malware easier to find and remove.

1. Press Windows + I to open Settings.
2. Go to Update & Security → Recovery.
3. Under Advanced startup, click Restart now.
4. When the blue screen appears, choose Troubleshoot → Advanced options → Startup Settings → Restart.
5. After the restart, press F5 to select Safe Mode with Networking.

Pick “with Networking” specifically — you’ll need internet access briefly to update your scanning tools. Just don’t go browsing around while you’re in this state.

Clear Temporary Files While You’re Here

This step gets glossed over in most guides, but it genuinely speeds up your malware scans. Temp folders are a favorite hiding spot for malicious executables.

1. Press Windows + R, type %temp%, and hit Enter.
2. Select everything in the folder (Ctrl + A) and delete it. Skip any files that say they’re in use.
3. Next, open Disk Cleanup by searching for it in the Start menu. Select your C: drive, check Temporary files, Thumbnails, and Windows Update Cleanup, then click OK.

On a PC that hasn’t been cleaned in a while, this alone can free up several gigabytes and eliminate malware staging files in one shot.

Step 2: Run Windows Security (Microsoft Defender) Scans

Windows 10 ships with Microsoft Defender Antivirus built in, and it’s genuinely decent for catching known threats. Don’t skip this step even if you plan to use other tools — think of it as your first pass with a metal detector before you bring in the ground-penetrating radar.

Full Scan

1. Open Settings → Update & Security → Windows Security.
2. Click Virus & threat protection.
3. Under Scan options, select Full scan and click Scan now.

A full scan checks every file on every drive. It can take 30 minutes to over an hour depending on how much data you have. Let it finish completely.

Microsoft Defender Offline Scan

If the full scan finds nothing but your PC still feels wrong, run the offline scan. This restarts your computer into a special environment outside of Windows, where rootkits and boot-sector malware can’t hide behind running processes.

1. Go back to Virus & threat protection → Scan options.
2. Select Microsoft Defender Offline scan.
3. Click Scan now. Your PC will restart automatically.

The offline scan takes about 15 minutes. Your computer will reboot back into normal Windows when it’s done, and you can check results under Protection history.

What Defender Is Good At — and Where It Falls Short

Defender handles traditional viruses, trojans, and ransomware well. AV-TEST’s 2025 evaluations gave it perfect scores for detecting widespread malware. But — and this is a significant “but” — Defender isn’t designed to catch everything that makes your PC miserable. Spyware, adware, browser hijackers, tracking cookies, potentially unwanted programs (PUPs), and leftover registry entries from removed infections all tend to slip through. Defender treats many of these as low-priority or ignores them entirely.

That’s not a knock on Microsoft. Defender is an antivirus. It’s built to stop viruses. But malware in 2025 is a much broader category than just viruses, and the stuff Defender misses is often exactly what’s causing your symptoms.

Step 3: Clean Up What Antivirus Misses

This is where most “how to remove malware from Windows 10” guides end. Run Defender, quarantine the threats, done. But if you’ve ever followed those steps and your PC still felt off — browser homepage changed, weird toolbars, sluggish performance, ads appearing on sites that shouldn’t have them — you already know that antivirus alone doesn’t finish the job.

The gap exists because antivirus software focuses on executable threats: files that can run code and damage your system. It’s less interested in the debris field that infections leave behind, or the low-grade spyware that technically isn’t a “virus” but is absolutely harvesting your browsing habits and selling them to data brokers.

SpyZooka: Filling the Gaps Antivirus Leaves Behind

SpyZooka, built by ZookaWare LLC (a Miami-based company that’s been developing Windows security tools since 2004), is specifically designed for this cleanup layer. Its Deep Spyware Scanner targets spyware, adware, browser hijackers, keyloggers, PUPs, and rootkits — with over 10,000 new threat definitions added daily. That’s a different threat database than what Defender uses, focused on a different category of problem.

The free version — which has no time limit and doesn’t require a credit card — includes a registry cleaner, junk file removal, browser and cookie cleanup across Chrome, Edge, Firefox, Opera, and Brave, plus a startup optimizer that rates every program launching at boot as Safe, Caution, or Slow. For a post-infection cleanup, those tools matter. Malware often leaves behind broken registry entries, tracking cookies, modified startup items, and cached files that keep causing problems long after the main executable is quarantined.

The Pro version ($39.95/year for one PC) adds real-time protection that blocks spyware before it installs, automated scheduled scans, and priority US-based support. If you’re dealing with a recurring infection — the kind where you clean it up and it comes back a week later — real-time monitoring is what breaks that cycle.

Manual Cleanup Steps You Should Do Regardless

Even with scanning tools, some manual checks are worth your time:

• Check installed programs. Go to Settings → Apps → Apps & features. Sort by install date. Anything you don’t recognize that appeared around the time your problems started? Uninstall it.
• Review browser extensions. Open each browser you use and check the extensions page. Malware loves to install browser add-ons that redirect searches or inject ads. Remove anything you didn’t deliberately install.
• Check your default browser and homepage. Go to Settings → Apps → Default apps. If your default browser changed without your input, that’s a hijacker. In your browser settings, verify your homepage and default search engine.
• Look at scheduled tasks. Open Task Scheduler (search for it in Start). Malware sometimes creates scheduled tasks that re-download the infection after you remove it. Look for tasks with generic names or paths pointing to AppData or Temp folders.

That last one — scheduled tasks — is the single most overlooked persistence mechanism. I’ve seen people remove the same adware three times before realizing a scheduled task was reinstalling it every six hours.

Windows Defender vs. Dedicated Spyware Removal: What Each Actually Does

People often assume that if they have antivirus, they’re covered. That’s like assuming your smoke detector also checks for carbon monoxide. Both protect your house, but they detect fundamentally different threats.

The two categories complement each other. Running both doesn’t create conflicts — they’re scanning for different things in different places. Defender watches for malicious executables trying to run. A spyware removal tool like SpyZooka cleans up the tracking, the junk, the registry damage, and the low-level nuisances that Defender was never built to handle.

I should qualify something here: Defender can detect some PUPs if you manually enable the setting through PowerShell or Group Policy. But it’s off by default, and most people don’t know it exists. The practical reality for most Windows 10 users is that PUPs and adware sail right past Defender untouched.

How to Tell if Your PC Still Has Malware After Cleaning

You’ve run the scans, removed the threats, cleaned the temp files, and checked your browser extensions. How do you know if it actually worked?

Signs the Infection Is Gone

• Your browser homepage and search engine stay where you set them
• No more unexpected pop-ups or redirects
• Task Manager (Ctrl + Shift + Esc) shows normal CPU and memory usage at idle — typically under 5% CPU and under 60% RAM with no apps open
• Your PC boots in a reasonable time (under 90 seconds for most systems with an SSD)
• No unfamiliar processes running in Task Manager

Signs Something Is Still Lurking

• High CPU or disk usage at idle, especially from processes with generic or randomized names
• Browser settings keep reverting after you change them
• New programs or browser extensions appear without your input
• Your antivirus or security tools won’t open or update — some malware specifically targets security software
• Unusual outbound network activity (check Resource Monitor → Network tab)

If you’re seeing the second set of symptoms after a thorough cleanup, you’re likely dealing with a rootkit or a persistence mechanism you haven’t found yet. SpyZooka’s System Report feature can help here — it generates a full inventory of running processes, browser extensions across all browsers, scheduled tasks, network connections, startup items, and installed drivers. That kind of comprehensive snapshot makes it much easier to spot the one thing that doesn’t belong.

And if nothing works? A clean Windows reinstall is always the nuclear option. It’s annoying, but it’s guaranteed. Back up your personal files to an external drive first, then use Windows 10’s built-in Reset feature (Settings → Update & Security → Recovery → Reset this PC → Remove everything). Just make sure you scan that backup drive before restoring files to your fresh installation.

Keeping Malware Off Your PC Going Forward

Removing malware is the urgent problem. Preventing it from coming back is the actual goal. A few habits make a dramatic difference:

Keep Windows and all software updated. The Cybersecurity and Infrastructure Security Agency (CISA) reports that the majority of exploited vulnerabilities in 2024 had patches available before the attacks occurred. People just hadn’t installed them. Turn on automatic updates in Windows (Settings → Update & Security → Windows Update → Advanced options) and use a software updater to catch third-party programs that Windows Update doesn’t cover. SpyZooka’s free version includes one that flags outdated programs with known security vulnerabilities.

Don’t download software from random sites. Stick to official websites and verified sources. “Free” versions of paid software from download aggregator sites are one of the most common spyware delivery mechanisms in 2025. If a deal looks too good to be real, it’s probably bundled with something you don’t want.

Use a standard user account for daily tasks. Most people run Windows as an administrator all the time. That means any malware you accidentally run also has admin privileges. Create a standard user account for everyday use and only switch to admin when you need to install something. It’s a minor inconvenience that blocks a huge percentage of drive-by infections.

Enable User Account Control (UAC) and leave it on. Yes, the prompts are mildly annoying. They’re also the reason malware can’t silently install itself. Search “UAC” in the Start menu, open Change User Account Control Settings, and set it to the second-highest level.

Be skeptical of browser notifications. Many malware infections in 2025 start with users clicking “Allow” on a browser notification prompt from a sketchy website. Once allowed, that site can push fake virus warnings and scam ads directly to your desktop. If you accidentally allowed one, go to your browser’s notification settings and revoke it.

One last thing — and I realize this sounds obvious, but it bears repeating: back up your files. An external drive, a cloud service, anything. The worst-case scenario with malware isn’t the infection itself. It’s losing irreplaceable photos, documents, or work because you had to wipe the drive and had no backup. Ransomware specifically exploits this — it doesn’t need to be sophisticated if your only copy of everything is on the encrypted drive.

Malware removal on Windows 10 isn’t complicated. It just requires doing the steps in order: disconnect, Safe Mode, temp file cleanup, Defender scan, dedicated spyware scan, manual checks, and then prevention habits going forward. Most infections clear up within an hour if you’re methodical about it.