# How to Remove a Virus or Malware from Windows 11

URL: https://www.mytechnician.tech/tips/remove-virus-malware-windows-11/
Published: 2026-05-20 | Updated: 2026-08-07 | Author: Ankit Kumar
Tags: Windows 11, Security, Fix, Troubleshooting
Summary: Pop-ups, unknown toolbars, or a PC that slowed overnight—run Windows Defender offline, cut startup malware, and clean browsers without sketchy 'cleaner' apps.
Recommended app: Ultimate PC Repair Tool — https://www.mytechnician.tech/apps/my-technician/ (Microsoft Store: https://apps.microsoft.com/detail/9PH863L9C6HC?hl=en-us&cid=mytechnician-web). Optional; every step below uses built-in Windows tools.

## The Problem
Browser homepages changed themselves, ransom notes appeared, or Task Manager shows a weird process eating CPU you never installed. Most infections on Windows 11 are adware and browser hijackers—not Hollywood ransomware—but they still need a methodical cleanup, not ten random downloaders from page-one ads.

> **Defender icon grayed out or won't turn on?** Fix that first—[Windows Defender not working](https://www.mytechnician.tech/tips/fix-windows-defender-not-working/)—or malware may be blocking scans.

## Symptoms
* New toolbars, extensions, or search engines you did not install.
* Pop-ups on the desktop even when the browser is closed.
* Antivirus disabled, updates failing, or **Security** settings locked.
* Sudden [100% disk or RAM usage](https://www.mytechnician.tech/tips/how-to-fix-100-disk-usage-windows-11/) from an unknown process.

## The Fix: Step-by-Step

### Step 1: Disconnect and Back Up What Matters
1. Unplug Ethernet or disconnect Wi-Fi if you suspect password stealers or ransomware—stops exfiltration while you work.
2. Copy irreplaceable photos and documents to a USB drive **before** heavy cleaning (not after—you might quarantine something you need). See [back up with File History](https://www.mytechnician.tech/tips/backup-pc-windows-backup-file-history/) for a proper routine later.

### Step 2: Run Microsoft Defender Offline Scan
1. **Settings** → **Privacy & security** → **Windows Security** → **Virus & threat protection**.
2. **Scan options** → **Microsoft Defender Antivirus (offline scan)** → **Scan now**.
3. The PC reboots and scans before Windows fully loads—this catches rootkits that hide during normal boot.

### Step 3: Full Scan and Remove Quarantined Items
1. Back in **Virus & threat protection** → **Quick scan** → then **Scan options** → **Full scan**.
2. **Protection history** → remove or quarantine everything flagged. Restart when prompted.

### Step 4: Boot Into Safe Mode for Stubborn Malware
1. **Settings** → **System** → **Recovery** → **Advanced startup** → **Restart now**.
2. **Troubleshoot** → **Advanced options** → **Startup Settings** → **Restart** → press **4** for Safe Mode.
3. Run another full scan. Fewer apps load, so malware services often fail to start.

### Step 5: Clean Browsers and Startup
1. Remove suspicious extensions in Chrome/Edge/Firefox (**Extensions** → trash unknown entries).
2. Reset the browser: Edge → **Settings** → **Reset settings** → restore defaults (bookmarks can stay if you pick the right option).
3. `Ctrl + Shift + Esc` → **Startup apps** → disable entries with no publisher or random names. Details: [disable startup programs](https://www.mytechnician.tech/tips/disable-startup-programs-speed-up-boot/).

### Step 6: Uninstall Junk You Did Not Install
**Settings** → **Apps** → **Installed apps** → sort by **Install date** → uninstall recent unknown programs ("PC Optimizer," "Driver Updater," etc.).

### Step 7: Check Persistence (Advanced)
1. `Win + R` → `msconfig` → **Services** → check **Hide all Microsoft services** → disable suspicious non-Microsoft services temporarily → reboot and retest.
2. **Task Scheduler** (`taskschd.msc`) → **Task Scheduler Library** → delete tasks pointing to `%Temp%` or random folders.

## What Not to Do
* Do not install "free antivirus" from banner ads—many are malware themselves.
* Browser locked with a toll-free "virus" number? That is usually [fake antivirus scareware](https://www.mytechnician.tech/tips/remove-fake-antivirus-scareware-windows-11/)—reset the browser before a full malware sweep.
* Do not pay ransom without talking to IT or law enforcement; payment does not guarantee decryption.

## After Cleanup
* [Run a deeper system check](https://www.mytechnician.tech/apps/windows-troubleshooter/) with PC-Troubleshooter to catch broken services, bad drivers, and registry leftovers malware leaves behind.
* Change passwords from a **clean** device (email, banking) if you had a keylogger suspicion.
* Files renamed with a strange extension and a ransom note on screen? Stop and follow [hit by ransomware: what to do first](https://www.mytechnician.tech/tips/what-to-do-if-hit-by-ransomware/) instead — disconnecting comes before scanning.
* Turn on [BitLocker](https://www.mytechnician.tech/tips/enable-bitlocker-drive-encryption-windows-11/) on laptops if the edition supports it.
* If the PC still acts infected after offline scan + Safe Mode, [reinstall Windows](https://www.mytechnician.tech/tips/reinstall-windows-without-losing-data/) or [wipe before selling](https://www.mytechnician.tech/tips/wipe-pc-before-selling-donating/) on a spare drive is sometimes faster than chasing every registry key.

If it keeps coming back, the file was never the problem — [clear the scheduled tasks and startup entries](https://www.mytechnician.tech/tips/remove-malicious-scheduled-tasks-startup-persistence-windows-11/) that keep restoring it, check for a [cryptominer](https://www.mytechnician.tech/tips/remove-cryptominer-malware-windows-11/) if the fans are loud with nothing open, and go to [rootkit and bootkit removal](https://www.mytechnician.tech/tips/remove-rootkit-bootkit-windows-11/) when even an offline scan comes back clean.

---
Source: https://www.mytechnician.tech/tips/remove-virus-malware-windows-11/ — My Technician, free Windows 10/11 troubleshooting guides.
Related tool: Ultimate PC Repair Tool (Ultimate PC Repair Tool is a Windows diagnostic and repair toolkit with system analysis, automated troubleshooting, and hardware checks for Windows 10/11.) — https://www.mytechnician.tech/apps/my-technician/
More guides: https://www.mytechnician.tech/llms.txt