Knowing how to remove viruses from your PC is one of the most practical skills a Windows user can have. Most infections are removable. However, the steps you follow — and the order you follow them in — make a real difference to how completely the threat is eliminated.
This guide covers everything you need. First, we look at how to spot an infection. Then, we walk through each removal step in order. Finally, we explain what to do after the scan to keep your PC protected going forward.
Ratings note: Ratings are based on results from independent security labs (AV-Test, AV-Comparatives) and professional review platforms.
How Common Are PC Viruses in 2026?
Before walking through how to remove viruses from your PC, it helps to understand the scale of the problem. These figures show why having a removal plan matters.
450K+
New malware samples created every day globally
33%
Of Windows PCs will encounter malware at some point
58%
Of infections arrive silently — no obvious warning sign
92%
Of malware enters via email attachments or the browser
Importantly, over half of all infections show no immediate warning signs. Consequently, many users only discover a problem when damage has already been done. Acting early — and following the right steps — significantly improves your chances of a full recovery.
Signs Your PC Has a Virus Before You Scan
Recognising the warning signs helps you act sooner. Furthermore, some symptoms are subtle enough that users often assume it is a hardware issue rather than malware.
🐢
Sudden, unexplained slowdown
Malware often runs hidden background processes that consume CPU and RAM, leaving less power for your actual tasks.
📢
Frequent pop-ups or unexpected ads
Adware injects advertising into browsers and sometimes into the desktop itself — even on sites that do not normally show heavy ads.
🌐
Browser redirects or homepage changes
A browser hijacker has modified your settings if your searches redirect to unfamiliar sites or your homepage changed on its own.
📧
Contacts receiving strange messages from you
If friends report receiving odd emails or messages from your account, malware may have accessed your credentials or contact list.
🔒
Files locked or renamed with unknown extensions
This is a clear sign of ransomware. Acting immediately — before encryption completes — may limit the damage significantly.
📊
High CPU or disk usage at idle
Cryptomining malware consumes large amounts of processing power in the background, often while your screen is idle or the PC is locked.
If you notice any of these signs, move to the removal steps below without delay. Additionally, avoid entering passwords or accessing banking sites until the scan is complete.
How to Remove Viruses from Your PC: Step-by-Step
Follow these steps in order for the most thorough result. Skipping steps — especially the first two — can allow some malware to interfere with the scan or continue running during removal.
1
Disconnect from the internet
Unplug your Ethernet cable or turn off Wi-Fi immediately. This stops the virus from sending data to an external server, downloading additional payloads, or receiving instructions from a remote attacker. Do not reconnect until the scan is finished.
⚡ Do this first — before opening any app
2
Restart in Safe Mode (for severe infections)
Safe Mode loads only the essential Windows processes. As a result, most malware cannot start or hide itself during this mode. To enter it, hold Shift while clicking Restart, then choose Troubleshoot → Advanced Options → Startup Settings → Restart → press F4. For mild slowdowns, Safe Mode is optional — but for serious infections, it is worth the extra step.
3
Update your antivirus definitions
Before running any scan, open your antivirus and check for definition updates. Antivirus tools identify threats by matching files against a database of known malware. Therefore, out-of-date definitions may miss threats that were discovered in recent days or weeks. Reconnect to the internet briefly to update, then disconnect again before scanning.
💡 Outdated definitions = missed threats
4
Run a full system scan — not a quick scan
A Quick Scan only checks the most common infection locations. A Full Scan examines every file on your drives, including less obvious hiding spots that malware frequently uses. Choose Full Scan in your antivirus settings and allow it to run without interruption. Depending on your drive size and PC speed, this typically takes between 20 and 60 minutes.
⚠️ Do not use your PC during the scan
5
Review detected threats and remove them
Once the scan is complete, your antivirus will present a list of flagged items. Review each one carefully. Move confirmed threats to quarantine first — this isolates them without permanently deleting them. Then delete items your antivirus has identified as malware. If you are uncertain about a specific file, search its name online before removing it.
6
Restart your PC normally
After removing threats, restart your PC. Some malware components can only be fully removed after a reboot, as Windows releases locked files during shutdown. Restart before running any further scans.
7
Run a second scan to confirm the PC is clean
After restarting, reconnect to the internet briefly, update definitions once more, and run a second full scan. A clean result on the second scan is a strong sign that the infection has been fully removed. If threats continue to reappear, the malware may have embedded itself more deeply — in that case, consider a dedicated malware removal tool or a Windows reinstall as a last resort.
✅ Two clean scans = peace of mind
What if the antivirus cannot remove a file?
Sometimes, a file is flagged but cannot be removed because it is actively running or locked by Windows. In that case, try removing it from Safe Mode, where fewer background processes are active. Alternatively, schedule a scan at startup — before Windows fully loads — which some antivirus tools support.
What Antivirus Can — and Cannot — Remove from Your PC
Antivirus software is powerful, but it has genuine limits. Understanding what it can remove helps set realistic expectations. Equally, knowing the limits helps you plan for situations where extra steps are needed.
Threat or Damage Type
Antivirus Result
Viruses and trojans
Removes
Spyware and keyloggers
Removes
Adware and browser hijackers
Removes
Worms and self-replicating malware
Removes
Active ransomware (before full encryption)
Can stop — varies
Files already encrypted by ransomware
Cannot recover
Rootkits (deep system embedding)
Partial — may need reinstall
Windows system files corrupted by malware
Cannot repair — use Windows tools
Stolen passwords or data already sent
Cannot undo — change credentials
Ransomware-encrypted files are particularly important to understand. Antivirus can remove the ransomware itself. However, it cannot decrypt files that were already locked before it intervened. This is why real-time protection and regular backups are so important — they prevent the damage rather than trying to reverse it.
When to consider a full Windows reinstall
A reinstall is rarely necessary. However, it becomes the safer option when: multiple scans continue finding the same threats, the PC is behaving erratically after cleaning, or a rootkit has been confirmed. A clean Windows installation removes virtually everything, including threats that antivirus software cannot fully address.
What to Do After Removing Viruses from Your PC
Removing the infection is the first step. However, equally important is making sure it cannot happen again in the same way. These actions reduce the risk of reinfection significantly.
🔑
Change all important passwords
Start with email, banking, and any accounts where sensitive information is stored. Even if the virus did not appear to target credentials, it is safer to assume they may have been exposed.
🔄
Update Windows and all software
Many infections exploit unpatched vulnerabilities. Keeping Windows, browsers, and plugins up to date closes the gaps that malware commonly uses to enter.
💾
Set up automatic backups
A backup protects you if ransomware strikes in the future. Use an external drive or a cloud service. Backups should run automatically and regularly — not just when you remember.
🛡️
Enable real-time antivirus protection
Real-time scanning catches threats as they arrive, before they have a chance to install. Make sure this is turned on in your antivirus settings — not just scheduled scanning.
🔍
Review browser extensions and startup programs
Malware often installs browser extensions or adds itself to startup. Check both in your browser settings and in Windows Task Manager → Startup Apps and remove anything unfamiliar.
🧠
Be more careful about what you download
Most infections begin with a file download or a deceptive link. Avoiding cracked software, unknown installers, and suspicious email attachments removes the most common entry points.
💡 Prevention tip: Real-time protection is more effective than reactive scanning. If your current antivirus only offers manual scans, consider upgrading to a tool with always-on protection. For more detail on how well Norton handles this, see our
guide on what Norton protects against.
Which Antivirus Works Best for Virus Removal?
Not all antivirus tools perform equally well when it comes to removing active infections. Based on results from independent security labs, the tools below consistently score well on malware detection and removal rates.
Norton 360
Norton is one of the most consistently tested antivirus tools available. It scores highly in both detection and removal across independent lab tests. Its Full Scan is thorough, and its real-time protection catches most threats before they need to be removed manually. For a detailed look, see our full Norton antivirus review.
Bitdefender
Bitdefender is particularly strong on detection accuracy. It regularly scores at or near the top in independent lab tests. Its removal engine handles both common malware and more complex threats effectively. Furthermore, it has a lighter performance footprint than some competitors.
Windows Defender (built-in)
Defender is sufficient for basic threats. However, it scores lower than paid tools in removal tests — particularly for newer, more sophisticated malware. It is a reasonable safety net, but not the strongest option when dealing with an active infection.
⚠️ Important: Never run two antivirus programs simultaneously. They can conflict with each other, slow your system significantly, and in some cases reduce overall protection. Choose one tool and use it consistently.
Summary
Knowing how to remove viruses from your PC correctly makes a significant difference. Disconnecting first, using Safe Mode for serious infections, updating definitions before scanning, and running two full scans gives you the most thorough result. Moreover, acting on the post-removal steps closes the vulnerabilities that allowed the infection in the first place.
For most users, a reliable antivirus with real-time protection is the most practical long-term solution. If you are not yet using one — or want to compare options — our full antivirus comparison covers the top tools for Windows in 2026.
Frequently Asked Questions
Can antivirus remove all types of viruses from a PC?
+
Most antivirus tools can remove common viruses, trojans, adware, and spyware. However, they cannot recover files already encrypted by ransomware, repair system files damaged before removal, or guarantee that every zero-day threat is caught immediately. Running a second scan after the first removal confirms whether the PC is fully clean.
How long does a full antivirus scan take?
+
A full system scan typically takes between 20 and 60 minutes. This depends on how many files are stored on your drives and the speed of your PC. Quick scans take only 5–10 minutes but check only the most common infection locations. For a suspected virus, always run a full scan — not a quick one.
Is it safe to delete all quarantined files?
+
Generally yes, if your antivirus has confirmed them as threats. Quarantine isolates files without permanently deleting them, giving you time to review. If you are uncertain about a specific file, search its name online first. Files confirmed as malware can be safely removed from quarantine.
What if my PC is still slow after removing the virus?
+
A virus can modify system settings or damage files that persist after removal. If your PC remains slow after a clean scan, try running the Windows System File Checker (sfc /scannow in Command Prompt), checking for unwanted startup programs, or performing a system restore to a point before the infection occurred.
Do I need to reinstall Windows after a virus?
+
Not usually. Antivirus software removes most threats without needing a full reinstall. However, severe infections — particularly rootkits that embed deep into the operating system — can leave damage that is hard to fully clean. In those cases, a fresh Windows installation is the safest option, especially if your antivirus continues to find threats after multiple scans.
Can I remove a virus without antivirus software?
+
It is possible in limited cases — for example, by manually deleting a known malicious file or using Windows’ built-in tools. However, most modern malware hides itself, replicates, and embeds into system processes in ways that are very difficult to address manually. Using dedicated antivirus software is far more reliable and significantly more thorough.
