Skip to main content
Malware infections can range from mildly disruptive adware to devastating ransomware that encrypts your entire file system. Catching the warning signs early, acting quickly to isolate the affected machine, and following a structured removal process dramatically improves your chances of a full recovery without data loss.

​
Recognizing Infection Symptoms

Before running any tools, confirm that you are actually dealing with malware rather than a hardware or software misconfiguration. Common indicators include:
Open Task Manager (Ctrl + Shift + Esc) and check the CPU and Disk columns. If an unknown process is consistently consuming 80–100 % of resources, it may be a cryptominer or worm.
Persistent advertisement pop-ups outside of a browser window, a changed default homepage, or a new search engine you did not install all point to adware or a browser hijacker.
Open your browser’s extension manager and look for items you do not recognise. In Chrome: Menu → More Tools → Extensions. In Edge: Menu → Extensions.
A full-screen message demanding payment in cryptocurrency, along with files that have been renamed with an unfamiliar extension (e.g., .locked, .encrypt, .ryuk), is a clear ransomware indicator. Stop all activity immediately and move to isolation.
Malware frequently attempts to disable security software. If Windows Security shows a red status or your antivirus product cannot be opened, treat the machine as compromised.

​
Step-by-Step Removal Process

1

Immediately Isolate the Machine

Disconnect the computer from all networks to prevent the malware from spreading, phoning home, or exfiltrating data.
  • Unplug the Ethernet cable.
  • Turn off Wi-Fi (physical toggle or Fn + F2 on most laptops).
  • Disable Bluetooth if it is enabled.
Do not shut down the machine if you suspect ransomware — some variants delete shadow copies on shutdown. Keep it powered on but fully isolated until you are ready to run scans.
If the device is managed by your organisation, notify the IT Security team immediately so they can begin an incident record before you proceed.
2

Boot Into Safe Mode with Networking

Running removal tools in Safe Mode prevents many malware strains from loading alongside Windows.
  1. Press Windows + R, type msconfig, and press Enter.
  2. Go to the Boot tab, check Safe boot, and select Network.
  3. Click OK and restart.
You need networking enabled in Safe Mode so you can download updated scanner definitions in the next steps.
3

Run a Windows Defender Offline Scan

Windows Defender Offline runs before Windows fully loads, allowing it to catch rootkits and boot-sector malware that can hide from a standard scan.Option A — From Windows Security (GUI):
  1. Open Windows Security → Virus & threat protection.
  2. Under Current threats, click Scan options.
  3. Select Microsoft Defender Offline scan and click Scan now.
  4. The machine will restart and scan automatically (allow 15–30 minutes).
Option B — From PowerShell (elevated):
Review the results under Protection history after Windows restarts.
4

Run Malwarebytes as a Second-Opinion Scanner

No single scanner detects everything. Malwarebytes is widely used as a complementary tool because it uses a different detection engine and excels at adware and PUP (Potentially Unwanted Program) removal.
  1. Download the free version from https://www.malwarebytes.com on a clean machine and transfer it via a freshly formatted USB drive.
  2. Install and immediately click Update Database before scanning.
  3. Select Threat Scan and click Scan Now.
  4. When the scan completes, click Quarantine to isolate all detected items.
  5. Restart when prompted.
The free tier of Malwarebytes is sufficient for on-demand scanning. You do not need to activate a trial or purchase a licence to complete a manual cleanup.
5

Audit and Clean Startup Items

Many malware strains survive reboots by registering themselves as startup entries. Remove any you cannot identify.Using MSConfig (basic):
Disable any entry with an unknown publisher or suspicious file path.Using Sysinternals Autoruns (advanced — recommended):
  1. Download Autoruns from https://learn.microsoft.com/sysinternals/downloads/autoruns.
  2. Run as Administrator.
  3. Go to Options → Scan Options and enable Check VirusTotal.com.
  4. Look for entries highlighted in red (file not found) or yellow (unsigned).
  5. Right-click any suspicious entry and select Delete.
Deleting the wrong startup entry can prevent legitimate software or system components from loading. If unsure, disable rather than delete, then test the system.
6

Verify No Malicious Scheduled Tasks Remain

Sophisticated malware often uses the Windows Task Scheduler to re-download itself after removal.
Open Task Scheduler (taskschd.msc) and review flagged tasks. Delete any with random-looking names or pointing to %TEMP%, %APPDATA%, or unknown executables.
7

Clear Browser Data and Reset Extensions

Even after system-level cleanup, malicious browser extensions or cached redirect scripts can persist.
  1. Open your browser’s extension page and remove any unknown extensions.
  2. Reset the browser to defaults: Settings → Reset settings → Restore settings to their original defaults.
  3. Clear all browsing data including cached images, cookies, and site data for All time.
  4. Confirm your homepage and default search engine are set to your preferred values.
8

Apply Post-Cleanup Hardening

Cleaning the infection is only half the job. Close the doors that allowed it in.
Enable Controlled Folder Access in Windows Security → Virus & threat protection settings to protect Documents, Desktop, and Pictures from unauthorised writes by future ransomware.

​
Escalation

Escalate immediately if any of the following apply. Do not attempt further self-remediation.
  • You see a ransomware notice and files have been encrypted.
  • The infection has spread to network shares or other machines.
  • Malware persists after two full scan cycles.
  • A domain administrator account appears to have been compromised.
  • Any patient, financial, or personally identifiable data may have been exfiltrated.
Submit an incident ticket including: the machine hostname, your username, the time you first noticed symptoms, which tools you ran, and screenshots of any detections. Your IT Security team will take over the investigation and determine whether a full reimaging is required.