Removing Malware From a Windows PC: Safe Mode to Autoruns

A single infected PC is a manageable problem if you work in the right order. Most cleanups fail because the malware is still running while you try to remove it, or because it comes back on the next reboot from a startup entry nobody checked.

This is the order that works. It uses only free tools from Microsoft. And it ends with a decision most people skip: whether the machine should be cleaned at all, or simply rebuilt.

Before you touch anything

Disconnect the machine from the network first. Pull the cable, turn off Wi-Fi, and if it is a laptop, disable Bluetooth. Malware that phones home can download a second stage, exfiltrate files or pull in ransomware while you are working. Isolation stops all of that.

Then decide what you are looking at. A browser hijacker or adware bundle is a cleanup job. Anything that touched credentials, a banking trojan, an information stealer, a remote access tool the user did not install, means every password used on that machine is compromised and the machine should be rebuilt, not cleaned.

• If this is a domain-joined business PC, tell whoever runs your EDR or security before you do anything. They may want the machine as is.
• Change the user's passwords from a different, clean machine, starting with email and anything financial.

Step one: Safe Mode and a first look

Safe Mode loads Windows with a minimum set of drivers and services, and most malware that hooks into normal startup does not run. That gives you a machine you can work on.

1. Hold Shift and click Restart from the Start menu, then Troubleshoot > Advanced options > Startup Settings > Restart, and press 4 for Safe Mode. Or run msconfig, Boot tab, Safe boot, Minimal.
2. Open Task Manager and the Startup tab. Note anything with no publisher, a random name, or a path under AppData, Temp or ProgramData.
3. Open Settings > Apps > Installed apps, sort by install date, and uninstall anything recent that the user did not add.
4. Do not delete suspicious files yet. Note the paths. Deleting a component while its partner still runs can trigger a reinstall or leave the machine unbootable.

Step two: Microsoft Defender Offline scan

Defender Offline boots a small recovery environment before Windows loads and scans the disk from outside the running system. Rootkits and anything that hides from a live scan cannot hide from this. It is built into Windows 10 and 11 and needs nothing downloaded.

Before running it, update Defender's definitions from a clean network connection if you can get one safely, or accept that the offline image will use whatever it has. The scan takes fifteen to thirty minutes and the machine reboots twice.

1. Windows Security > Virus and threat protection > Scan options > Microsoft Defender Offline scan > Scan now.
2. After the machine returns to Windows, open Windows Security > Virus and threat protection > Protection history and read what was found and where.
3. Run a second full scan from inside Windows: Start-MpScan -ScanType FullScan. Two clean results in a row are the bar.

# Update definitions, run the offline scan, then a full scan on return
Update-MpSignature
Start-MpWDOScan
# after reboot:
Start-MpScan -ScanType FullScan
Get-MpThreatDetection | Sort-Object InitialDetectionTime -Descending | Select-Object -First 20

Step three: Autoruns, the part everyone skips

Autoruns from Microsoft Sysinternals shows every place Windows can start something automatically: Run keys, services, drivers, scheduled tasks, Winlogon hooks, browser helper objects, WMI subscriptions, and dozens more. Malware survives reboots by living in one of these, and a scanner that deletes the file but leaves the entry leaves a broken pointer that some droppers use to reinstall.

Run it as administrator with Options > Hide Microsoft Entries and Options > Verify Code Signatures enabled. What is left is third-party and unsigned, and it is a short list on a healthy machine.

• Look at Logon, Scheduled Tasks, Services, Drivers and WMI tabs first. Highlighted yellow entries point at files that no longer exist; pink entries are unsigned.
• Uncheck an entry to disable it rather than deleting. Reboot, confirm the machine is fine, then delete.

Step four: decide whether to keep it

A cleaned machine is a machine you hope is clean. A reimaged machine is one you know is clean. If the malware was an information stealer, a remote access trojan or anything your EDR flags as a known ransomware precursor, reimage. If the user's data is in OneDrive or on a server, reimaging is often faster than a thorough cleanup anyway.

If you do keep it, finish properly. Reset every browser, clear saved passwords and re-enter them from the password manager, check that Defender's real-time protection and tamper protection are back on, install pending Windows updates, and watch the machine's network activity for a few days.

1. Reset Windows: Settings > System > Recovery > Reset this PC > Remove everything. Choose Cloud download so the image comes from Microsoft rather than the local recovery partition.
2. Rejoin the domain or Entra ID, reinstall the EDR agent, and let policy reapply.

Frequently asked questions

Takeaway

Cut the network, work from Safe Mode, scan from outside Windows with Defender Offline, and audit every startup location with Autoruns. Then be honest about whether the machine is trustworthy. When credentials were involved, the fastest path to a clean machine is a fresh install and a password reset, not another scan.