How to Remove Malware From Windows 11 for Free

Learning how to remove malware from Windows 11 free can save you a costly repair bill, and in most cases you do not need to buy anything at all. Windows 11 already includes Microsoft Defender, a capable built-in antivirus, and several trusted free scanners can give you a second opinion when Defender alone is not enough. This guide walks you through the whole cleanup in order, from spotting the infection to scanning, removing browser hijackers, repairing Windows files, and changing your passwords safely.

Malware is a broad word for any software that harms your PC or steals your information. It includes viruses, ransomware, spyware, adware, browser hijackers, and fake system cleaners that pretend to fix problems while creating new ones. Most infections arrive through a single careless click: a fake download button, an email attachment, a pirated program, or a free tool bundled with extra software you never asked for. The good news is that the same free tools Microsoft and security researchers recommend are enough to remove most infections, as long as you follow the steps in order and do not skip the second scan.

Do not pay for a random cleaner that pops up on your screen, and do not call a phone number shown in a browser warning. Those pop-ups are almost always part of the scam. Real Microsoft warnings never ask you to call a support number or pay with gift cards. If a warning locks your browser, close the browser, restart your PC, and start the cleanup below instead.

Signs Your Windows 11 PC Has Malware

Not every slow PC is infected, so check for a pattern before you start. One strange symptom can have a harmless cause, but several together are a strong warning. Look for your browser homepage or search engine changing without your permission, new toolbars and extensions you did not install, and pop-up ads appearing even when the browser is closed. Watch for programs opening on their own, files disappearing or appearing in strange folders, and your mouse or keyboard behaving as if someone else is using the PC.

Performance clues matter too. A sudden drop in speed, a fan that runs loudly while you do nothing, high CPU or disk use in Task Manager with no program open, and a battery that drains much faster than usual can all point to hidden malware running in the background. So can repeated crashes, Windows settings that keep changing back, and security warnings from Windows itself. If friends tell you they received strange emails or messages from your accounts, treat that as an urgent sign that an infection may have stolen a password.

Write down anything odd you notice before you start. That list helps you judge later whether the cleanup worked, and it tells you which passwords and accounts to check first. If your files are encrypted and a ransom note appears, stop here: do not pay, disconnect the PC from the internet, and seek help from a trusted professional, because free removal tools cannot always undo ransomware encryption.

Step 1: Disconnect From the Internet and Prepare

Start by disconnecting the infected PC from the internet. Turn off Wi-Fi or unplug the network cable. This stops most malware from sending your data out, downloading more malware, or receiving new instructions, and it stops the infection spreading to other devices on your home network. You will need the internet again later to download a second scanner, so keep your phone or another clean device handy for downloads if you need it.

Next, back up only the files you cannot replace, and do it carefully. Copy documents, photos, and other personal files to an external drive, but do not copy programs, installers, or anything from your Downloads folder without checking it first, because installers are a common hiding place for malware. Do not back up to the same drive, and scan the backup later before you open it on a clean PC. If you already have a recent backup, skip this step and move on, because speed matters once an infection is active.

Finally, close every program and save your work. Do not try to uninstall the malware by deleting files by hand. Modern malware hides copies of itself in several places, so deleting one file usually does nothing, and deleting the wrong Windows file can break your PC. The scanners in the next steps are designed to find those hidden copies safely.

Step 2: Start Windows 11 in Safe Mode

Safe Mode starts Windows with only the essential drivers and programs, which makes it harder for malware to run and hide. To enter it, open Settings, go to System, then Recovery, and click Restart now next to Advanced startup. When the blue Choose an option screen appears, choose Troubleshoot, then Advanced options, then Startup Settings, and click Restart. After the PC restarts, press 5 for Safe Mode with Networking, because you will need the internet for updates and downloads in the next steps.

If Windows will not start normally at all, you can reach the same screen by turning the PC off and on three times in a row while it is starting up. Windows should then show the Automatic Repair screen, where you can choose Advanced options and follow the same path. Do not worry if the screen looks plain in Safe Mode, with large text and a black desktop background. That is normal, and it is a sign that most third-party programs, including most malware, are not running.

Once you are in Safe Mode with Networking, open Windows Update in Settings and install any pending updates before you scan. Outdated security definitions are one reason infections slip through, and Defender updates its detection database several times a day. Then continue to the full scan below while you are still in Safe Mode.

Step 3: Run a Full Scan With Microsoft Defender

Microsoft Defender is already installed on Windows 11, it is free, and it is the first tool you should use to remove malware from Windows 11 free. A quick scan checks only the places malware usually hides, so run a full scan instead. Open Settings, go to Privacy and security, then Windows Security, then Virus and threat protection. Click Scan options, choose Full scan, and click Scan now. The scan checks every file on your PC, so it can take an hour or more on a large drive. Let it finish, even if it looks stuck at one percentage for a while.

When the scan finishes, Defender shows what it found. Choose Remove or Quarantine for every threat it lists, then restart your PC when it asks you to. Quarantine is safe: it locks the file away so it cannot run, and you can delete it from the quarantine list later. Do not choose Allow or Restore for anything Defender flagged unless you are certain it is a program you trust and you know why it was flagged.

If Defender finds nothing but the symptoms continue, run a Microsoft Defender Offline scan as well. Go back to Scan options, choose Microsoft Defender Offline scan, and click Scan now. Your PC will restart into a special environment outside Windows, where stubborn malware cannot hide behind running programs. The offline scan takes about 15 minutes, and your PC restarts again when it finishes. Microsoft explains Windows Security on its official site at Microsoft Windows, where you can also check the latest security features built into Windows 11.

Step 4: Run a Second Free Scanner for a Second Opinion

No single scanner catches everything, so a second opinion is worth the extra time. Malwarebytes Free is a trusted on-demand scanner that does not replace Defender, and its free version is enough for a cleanup. Download it only from the official Malwarebytes website, install it, decline the free trial of the paid version if you do not want it, and run a full Threat Scan. When it finishes, quarantine everything it finds and restart your PC.

Another useful free option is the Microsoft Safety Scanner, a standalone tool you download fresh each time you use it, because it expires after ten days. Run it as a second check if Malwarebytes and Defender disagree, or if you want a tool from Microsoft itself that does not install anything permanent. Use only one real-time antivirus at a time, though. Running two real-time scanners together slows your PC and can cause false alarms, so use the second tool for on-demand scans only and leave Defender as your main protection.

Be careful where you download these tools. Search results for free antivirus software are full of fake download sites that install the very malware you are trying to remove. Type the official address yourself, or use the link from a trusted guide, and check that the download comes from the company that makes the tool. Our roundup of the best free antivirus software for Windows in 2026 compares the free options that are safe to install, and our comparison of Windows Defender vs free antivirus explains when Defender alone is enough and when a second tool helps.

Step 5: Remove Browser Hijackers and Unwanted Programs

Many infections live in the browser, not in Windows itself, so a clean Defender scan is not the end of the job. Open Settings, go to Apps, then Installed apps, and sort the list by install date. Uninstall anything you do not recognise, anything installed on the day the problems started, and any toolbar, coupon tool, or fake cleaner you did not choose to install. If you are unsure about a program, search its exact name on a clean device before you remove it, because some entries belong to your PC maker or to hardware drivers.

Next, check your browsers one by one. In Chrome, Edge, and Firefox, open the extensions page and remove every extension you did not install yourself, especially search helpers, coupon finders, and PDF converters that appeared out of nowhere. Then reset the browser settings to their defaults. In Chrome this is under Settings, then Reset settings, then Restore settings to their original defaults. In Edge it is under Settings, then Reset settings. Resetting removes hijacked homepages, search engines, and notification permissions, but it keeps your bookmarks and saved passwords.

Also check the programs that start with Windows, because malware often adds itself there so it returns after every restart. Our guide to how to check which programs start with Windows shows you how to review the startup list in Task Manager and disable anything suspicious. If an unknown program keeps coming back after you disable it, that is a sign the infection is still active, so repeat the Defender and Malwarebytes scans in Safe Mode before you move on.

Step 6: Repair Windows Files Damaged by Malware

Malware often damages Windows system files, so your PC can stay unstable even after the infection is gone. The free System File Checker can repair many of those files. Right-click the Start button, choose Terminal (Admin) or Windows PowerShell (Admin), and click Yes when Windows asks for permission. Type sfc /scannow and press Enter, then wait while Windows checks and repairs protected system files. Do not close the window until the scan reaches 100 percent and reports its result.

If System File Checker reports that it found corrupt files but could not fix some of them, run the Deployment Image Servicing and Management tool next. In the same admin window, type DISM /Online /Cleanup-Image /RestoreHealth and press Enter. This tool downloads clean copies of damaged Windows files from Microsoft, so it needs an internet connection and can take 10 to 20 minutes. When it finishes, run sfc /scannow again, then restart your PC. If errors continue after both tools, a repair install using the Windows 11 installation media is the next step, and our guide to how to clean install Windows 11 from a USB drive explains the full reset and reinstall process for a PC that cannot be repaired.

Also check Windows Update again after the repair. Install every security update it offers, then restart and check once more until no updates remain. Malware often returns through the same unpatched weakness, so a fully updated PC is much harder to infect a second time. While you are there, turn on tamper protection in Windows Security, under Virus and threat protection, then Manage settings, so malware cannot quietly turn Defender off.

Step 7: Change Your Passwords and Check Your Accounts

Once the scans are clean, assume the malware may have seen your passwords and act accordingly. Change your Microsoft account password first, then your email password, then your banking and other important accounts. Do this from a clean device if you can, or from the cleaned PC only after both scans have come back clean. Use a different password for every important account, and turn on two-factor authentication wherever it is offered, because a stolen password alone is then not enough to get into your account.

Check each important account for signs of misuse. Look in your email Sent folder and in your bank and shopping accounts for messages, purchases, or settings changes you did not make. Check whether your email address has appeared in a known data breach, and review the recent sign-in activity pages for Microsoft and Google accounts. If you find unauthorised activity, report it to the service, sign out all other sessions, and change the password again from a clean device. Our guide to how to keep your Windows PC safe from hackers walks through these account checks in more detail.

Do not reuse the same password across sites, and do not store passwords in your browser without a master password. A free password manager is a safer place for them, and it can generate long, random passwords you never have to remember. If you want help choosing one, see our roundup of the best free software for managing passwords.

How to Stay Malware-Free After the Cleanup

Prevention is easier than another cleanup, and most of it is free. Keep Windows Update set to automatic, keep Defender turned on, and keep your browser and other programs updated, because most infections use old, known weaknesses rather than new tricks. Turn on Controlled folder access in Windows Security if you want extra protection against ransomware, and test it with your own programs first, because it can block legitimate apps until you allow them.

Be careful with downloads. Get software only from the Microsoft Store or from the official website of the company that makes it, and avoid download sites that wrap programs in their own installers. Read each installer screen and decline extra offers, toolbars, and free trials you did not ask for. Never open an attachment you were not expecting, even if it looks like it came from someone you know, and never enable macros in a document unless you are certain it is safe.

Finally, make a backup you can trust. Use File History or another backup tool to keep a regular copy of your personal files on an external drive, and disconnect that drive when the backup finishes, so ransomware cannot encrypt it too. With Defender running, updates automatic, a second on-demand scan every month or two, and a clean backup, most Windows 11 users never need paid antivirus software at all.

Frequently Asked Questions

Can Windows Defender remove malware for free?

Yes. Microsoft Defender is included with Windows 11 at no extra cost, and a full scan can remove most common viruses, spyware, and adware. It is a real antivirus, not a trial, and it updates automatically through Windows Update. A second on-demand scan is still a good idea when the symptoms continue after Defender reports a clean PC.

Is Malwarebytes Free safe to use?

Yes, when you download it from the official Malwarebytes website. The free version is an on-demand scanner, so it does not run all the time and does not conflict with Defender. Avoid copies of Malwarebytes offered on other download sites, because fake versions are a common way to spread malware.

How long does a full malware scan take?

A full Defender scan usually takes between 30 minutes and two hours, depending on how many files you have and how fast your drive is. A Malwarebytes Threat Scan is usually faster, often 10 to 30 minutes. Let each scan finish completely, because stopping early can leave hidden copies behind.

Will removing malware delete my files?

Removing malware should not delete your personal files, but it can delete infected files that cannot be cleaned, and it can remove programs that were bundled with malware. That is another reason to back up your documents and photos before you start, and to scan that backup before you use it again.

What should I do if the malware keeps coming back?

Repeat the full Defender scan and the Malwarebytes scan in Safe Mode with Networking, then check your startup programs, browser extensions, and installed apps again for anything you missed. If the infection returns a third time, run a Microsoft Defender Offline scan, and if that still fails, back up your personal files and reset Windows with the Reset this PC option in Settings, choosing Remove everything only after your backup is safe.

Conclusion

You can remove malware from Windows 11 free, with tools that are already on your PC or available as trusted free downloads. Disconnect from the internet, start in Safe Mode, run a full Microsoft Defender scan, get a second opinion from Malwarebytes Free, clean up your browsers and startup programs, repair Windows files, and then change your passwords. That sequence removes most infections completely, and the prevention habits at the end of this guide make a repeat infection much less likely. If the symptoms are gone, the scans are clean, and your accounts show no strange activity, your PC is ready to use again.