How to Remove a Virus or Malware From Your PC
Constant pop ups, a browser that opens on a search page you did not choose, adverts appearing over websites that never had them, or a full screen warning telling you to ring a support number urgently. These are the signs of an infection, and the great majority of them are adware, browser hijackers or scareware rather than anything that destroys files. The order you tackle them in matters, because removing the visible symptom without removing what put it there means it comes straight back. Here is the process we use, in the order we use it.
If a full screen warning is demanding you ring a number, do not ring it
The single most damaging thing that happens to people we help is not the malware itself. It is the phone call. A convincing looking page claims your computer is infected or your bank details are compromised, and displays a support number. Nobody legitimate, and certainly not Microsoft, will ever put a phone number on a warning screen. The people who answer will ask for remote access and then for payment.
These pages are almost always just a web page in full screen mode, not an infection at all. Closing the browser properly removes the whole thing.
- Press Escape to leave full screen mode, or press Alt and F4 together to close the window.
- If the page will not close, press Ctrl, Shift and Escape to open Task Manager, select your browser in the list and click End task.
- Reopen the browser and, if it offers to restore the previous session, decline.
- If you have already rung a number and let someone connect, disconnect the computer from the internet, ring your bank, and get the machine checked properly.
Uninstall anything you did not deliberately install
Most adware arrives as an ordinary installed program, bundled alongside something you did want, such as a free PDF tool, a video converter or a driver updater. Windows lists it like any other application, which makes it straightforward to remove once you know to look.
Sort the list by install date. A cluster of unfamiliar names all installed on the same day tells you exactly when the problem started and usually what you were installing at the time.
- Open Settings, then Apps, then Installed apps.
- Change the sort order to Install date so the newest appear first.
- Look for anything you do not recognise, especially names containing search, coupon, shopping, cleaner, driver updater or PC optimiser.
- Click the three dots beside each one and choose Uninstall.
- If an uninstaller asks why you are removing it or tries to talk you out of it, continue anyway.
- Restart the computer when you have finished.
Scan with Windows Security, then with a second opinion scanner
Windows Security is built into Windows 11 and is genuinely capable. Its normal quick scan checks only the usual hiding places, so for a suspected infection you want the offline scan, which restarts the machine and scans before Windows loads. That catches things that protect themselves once the system is running.
After that, a second opinion scanner from a different vendor is worth running, because adware and browser hijackers sit in a grey area that antivirus products sometimes ignore. Malwarebytes Free is the usual choice. Download it only from the vendor's own website, never from a link in a pop up.
- Click Start, type Windows Security and open it.
- Choose Virus and threat protection, then Scan options.
- Select Microsoft Defender Antivirus Offline Scan and click Scan now. Save your work first, because the machine will restart.
- When it comes back, install Malwarebytes Free from malwarebytes.com and run a full scan.
- Quarantine everything it finds, then restart again.
Reset the browser and clean out notifications
Even after the malware is gone, the browser often keeps the damage. The two things left behind are extensions that redirect your searches and website notification permissions that push adverts to your desktop even when the browser is closed. Those desktop adverts are what people most often mistake for a persistent virus.
Resetting a browser clears extensions, start page and search settings. It does not delete your bookmarks or saved passwords, which are held in your Google or Microsoft account.
- In Chrome or Edge, open Settings, then Privacy and security, then Site settings, then Notifications.
- Remove every site allowed to send notifications that you did not knowingly permit.
- Go to Extensions, then Manage extensions, and remove anything unfamiliar.
- Open Settings, then Reset settings, and choose Restore settings to their original defaults.
- Set your home page and default search engine back to what you want.
Change the passwords that matter
If the machine was infected with anything that logged keystrokes, or if you gave a caller remote access at any point, cleaning the computer is only half the job. Assume the passwords typed on that machine are compromised.
Change them from a different device, such as your phone, and start with email. Email is the master key, because anyone with it can reset everything else through the forgotten password link.
- Change your email password first, from a phone or another computer.
- Turn on two factor authentication on your email account.
- Change your online banking password and check recent transactions.
- Change any password reused across several sites.
- Sign out of all other sessions using the security settings in your email account.
When to get help
Adware, browser hijackers, unwanted toolbars, fake warning pages and desktop advert notifications are exactly the sort of thing we clear remotely, usually inside an hour, while you watch every step. We can also check the places malware hides that the steps above do not reach, such as scheduled tasks, browser policies set by an installer, and proxy settings that quietly route your traffic elsewhere.
Two situations need more care. If the machine has been hit by ransomware and your files have been encrypted and renamed, stop using it and ring us before doing anything else, because the wrong move can destroy the only chance of recovery. And if someone was given remote access and then had access to online banking, treat it as a fraud matter first and a computer matter second. Ring your bank, then ring us on 028 9623 7853.
Frequently Asked Questions
Is Windows Security good enough on its own?
For most home users, yes. Windows Security is a capable antivirus and it updates automatically. Where it is weaker is adware and browser hijackers, which is why we pair it with an occasional on demand scan from a second vendor rather than replacing it with a paid suite.
Does a virus mean I need to wipe and reinstall Windows?
Rarely. The large majority of infections we see are adware or hijackers that can be removed cleanly with your files and programs left in place. A full reinstall is reserved for deeply embedded infections or for machines where someone was given remote control and we cannot be confident about what was changed.
Why do I still get adverts on my desktop after removing the virus?
Almost always website notification permissions rather than an infection. A site was allowed to send notifications and now pushes adverts through the browser even when no window is open. Remove the permission in your browser's notification settings and they stop immediately.
Can you remove malware remotely, or does the computer need to come in?
If the computer reaches the desktop and connects to the internet, we can almost always deal with it remotely in one session. A machine that will not boot, or one hit by ransomware, needs to come to the workshop.
Let us fix it remotely
If you would rather not work through this yourself, we can connect to your computer over the internet and fix it while you watch. Most problems in this guide are sorted in a single session, and remote support is no fix no fee.
Need Immediate Remote Support?
Jump right into a remote support session with our expert technicians. Quick, efficient, and hassle-free.