How to remove a virus with Windows Security

If you use Norton, McAfee or another antivirus, it replaces Defender's real-time scanning. You can still follow these steps using that product's own full scan, or use the Defender Offline scan in step 4, which works either way.

1. Save your work and disconnect from shared drives

   Save and close open files. If the PC is connected to a shared network drive or an external backup drive, disconnect it until the PC is clean, so nothing spreads to it.

2. Update Microsoft Defender

   Open Windows Security, choose Virus & threat protection, then under Virus & threat protection updates select Protection updates, then Check for updates. Fresh definitions help Defender recognise the newest threats.

3. Run a full scan

   Go back to Virus & threat protection, select Scan options, choose Full scan, then Scan now. It can take an hour or more. You can keep using the PC, but it may be slower.

   When it finishes, select Start actions if any threats are listed. Defender quarantines or removes them.

4. Run a Microsoft Defender Offline scan

   Some malware hides while Windows is running. The offline scan restarts the PC into a separate environment and scans before Windows loads.

   In Scan options, choose Microsoft Defender Offline scan, then Scan now. The PC restarts, the scan takes about 15 minutes, and Windows starts again on its own.

   Save everything first. The PC restarts without asking again. If your drive is encrypted with BitLocker, you may be asked for the recovery key. You can find it in your Microsoft account at aka.ms/myrecoverykey.

5. Review what was found

   In Virus & threat protection, open Protection history. Each entry shows what was found and what was done. Only choose Allow if you are certain a file is safe, for example a program you wrote yourself.

6. Uninstall programs you do not recognise

   Open Settings, then Apps, then Installed apps, and sort by Install date. Uninstall anything you did not mean to install, such as "PC optimisers", unfamiliar browsers or toolbars. Search the name first if you are unsure.

7. Clean up your browser

   If your homepage, search engine or pop-ups were affected, follow our browser reset guide. Scans clean files, but some browser settings have to be reset by hand.

8. Get a second opinion if problems continue

   Microsoft offers a free, standalone tool called the Microsoft Safety Scanner. Search for it and download it only from Microsoft's own website. It runs once without installing and expires after 10 days, so download a fresh copy each time.

   If malware stops scans from running at all, start the PC in Safe Mode with Networking and scan from there.

9. Secure your accounts and stay updated

   • From a different device you trust, change the passwords for your email first, then banking and shopping accounts.
   • Turn on two-step verification wherever it is offered.
   • Install all pending Windows updates and update your browser.
   • Keep a backup of important files on a drive you disconnect after each backup, or in cloud storage.

   Last resort: if the PC still misbehaves after all of this, Settings, then System, then Recovery, then Reset this PC reinstalls Windows. Choose Keep my files if you can, but back up your documents first anyway.