How to Remove a Virus from Your Computer: Free Tools That Actually Work (2026)

Most "I have a virus" calls in 2026 aren't actually viruses in the old sense. They're adware, browser hijackers, scareware popups, or PUPs (potentially unwanted programs) bundled with free software downloads. Real ransomware is rare for home users — but when it hits, it hits hard.

The good news: you don't need to buy antivirus software to clean a typical infection. Here's the exact workflow I run when an infected machine comes in.

Before anything else: disconnect from the internet

Unplug the Ethernet cable or click the WiFi icon and disconnect. This stops the malware from phoning home, downloading more components, or spreading to other devices on your network.

If you suspect ransomware (files renamed, ransom note on desktop, files won't open) — also unplug any external drives. Ransomware spreads through connected USB drives and network shares within minutes.

Step 1: Boot into Safe Mode with Networking

Safe Mode loads only essential Windows drivers — most malware can't auto-start there.

1. Settings → System → Recovery → Advanced startup → Restart now.
2. After reboot: Troubleshoot → Advanced options → Startup Settings → Restart.
3. Press 5 for "Safe Mode with Networking" so you can still download tools.

If you can't reach Settings (some malware locks you out), force three failed boots by holding the power button as Windows starts loading. Windows enters Automatic Repair on the fourth boot, and you can reach the same menu from there.

Step 2: Run Windows Defender's offline scan

This is the single most underused free malware tool in 2026. Windows Defender Offline reboots your computer to a clean environment and scans before Windows fully loads — so rootkits and stealthy malware can't hide.

Windows Security → Virus & threat protection → Scan options → Microsoft Defender Antivirus (offline scan) → Scan now.

It takes 15–30 minutes, reboots automatically. Quarantine anything it finds.

This step alone resolves about 40% of the infected machines that come into my shop.

Step 3: Run Malwarebytes Free

Defender is excellent at known threats. Malwarebytes is excellent at adware, PUPs, and browser-junk that Defender doesn't flag.

Download Malwarebytes Free from malwarebytes.com — only from the official site, never from a Google ad result. Install, open, click Scan. About 20 minutes.

When it finishes, click Quarantine on everything it found (it defaults to selecting everything safe to quarantine). Reboot when prompted.

The free version doesn't run continuously, which is fine — you're using it for one-time cleanup, not ongoing protection. Defender handles continuous protection.

Step 4: Run AdwCleaner (also free, also from Malwarebytes)

Browser hijackers and toolbar leftovers often survive the first two scans. AdwCleaner from malwarebytes.com specifically targets these. Run it. It restarts your browsers to clear their settings, removes adware, deletes Chrome/Edge extensions you didn't install.

Step 5: Reset your browsers

Even after the scans, malicious extensions or modified shortcuts can persist. Reset each browser:

• Chrome: Settings → Reset settings → Restore settings to their original defaults.
• Edge: Settings → Reset settings → Restore settings to their default values.
• Firefox: Help → More troubleshooting information → Refresh Firefox.

This wipes extensions, custom search engines, and homepage hijacks. Bookmarks and saved passwords are preserved.

Also check your browser shortcut on the desktop — right-click → Properties → Target field. If it ends with anything other than chrome.exe, msedge.exe, or firefox.exe, malware has tampered with it. Delete that line so only the executable path remains.

Step 6: Check installed programs and startup entries

Settings → Apps → Installed apps. Sort by install date. Anything you don't recognize, installed recently, with names like "PC Optimizer," "Driver Booster," "MyPCFix," "System Toolkit" — uninstall. These are PUPs, not real tools.

Task Manager → Startup apps. Disable anything you don't recognize.

Step 7: Run a second-opinion scanner

For peace of mind, run one more scanner that uses a different engine than Defender or Malwarebytes:

• ESET Online Scanner (free, eset.com) — browser-based, no install needed
• HitmanPro (free 30-day trial, hitmanpro.com) — uses cloud-based reputation engine

If both come back clean, your machine is genuinely clean. If they find something, quarantine, reboot, rescan with Defender to confirm.

Step 8: Change your passwords (from a different device)

If the infection was active for any length of time, assume credentials were captured. From a different device (your phone or another computer), change:

• Email password (most important — controls password resets for everything else)
• Bank, credit card, and payment service passwords
• Anything you logged into during the infection window

Enable two-factor authentication on each. Don't use the infected computer until it's fully cleaned, even to "just check email."

Special case: Ransomware

If your files are encrypted with a strange extension and there's a ransom note demanding payment:

• Do not pay. Less than 50% of payments result in files being recovered, and you mark yourself as a paying target.
• Disconnect immediately — internet, external drives, anything attached.
• Check nomoreransom.org — Europol's free decryptor library covers many older strains.
• Restore from backup if you have one (this is why I'm religious about the 3-2-1 rule).
• Call a pro before reinstalling anything. Some ransomware leaves backdoors that survive reformat.

A clean Windows reinstall is the safest path forward post-ransomware. Files that aren't backed up are often lost — yet another reason to set up backups before you need them.

Special case: Scareware popups that won't close

You get a fake "Microsoft Support" popup saying your PC is infected, with a phone number to call. Never call those numbers — they're scammers, not Microsoft.

To close:

1. Press Alt + F4 to close the browser tab/window.
2. If that doesn't work, open Task Manager (Ctrl + Shift + Esc) and End Task on your browser.
3. Reopen your browser, choose "Don't restore" when it offers to reopen the malicious tab.
4. Run the scans above to be safe.

These popups themselves usually aren't actual malware — they're web ads. But they're a sign you're browsing sites pushing aggressive ad networks, often the same sites that do deliver malware.

After cleanup: prevent the next infection

• Use Windows Defender as your primary antivirus. It's genuinely good now and free. Skip paid suites.
• Don't install anything from Google ad results. Always go to the official site directly. Most malware in 2026 comes from typosquatted Google Ads pretending to be popular software downloads.
• Use uBlock Origin in your browser. It blocks malicious ads at the source.
• Don't pirate software — cracked downloads are by far the most common infection vector I see.
• Run Malwarebytes once a month as a second-opinion scan, even if everything seems fine.

If your computer is still slow or behaving weird after a thorough clean, the malware may have left damaged files behind. See why is my computer so slow for the next layer of cleanup. If you've gone through everything and it still won't behave, see computer repair cost in Connecticut for what professional cleaning runs.

For small business owners reading this — if you're dealing with malware on company machines more than once a year, the calculus changes. Recurring infections point to a security posture problem, not just bad luck. See when should a small business hire IT help vs DIY for whether managed IT makes sense at your size.

FAQ

Do I need paid antivirus in 2026? For most home users, no. Windows Defender plus careful browsing habits beats most paid suites. Paid antivirus makes sense for small businesses that need centralized management and policy enforcement.

Is Malwarebytes free version enough? For one-time cleanup, yes. For continuous real-time protection, the free version doesn't include it — Defender handles that role.

Can malware survive a Windows reinstall? Standard "Reset This PC" can miss firmware-level malware (UEFI rootkits), though these are rare for home users. A full clean install from a Windows USB and full drive wipe is the gold standard for genuinely infected machines.

Why did my antivirus miss it in the first place? No antivirus catches everything. Brand-new threats slip past until signatures are updated, social-engineering tricks bypass technical protections, and you (the user) clicking through warnings is the most common bypass of all.

Should I just buy a new computer if I've been infected? Almost never. A thorough clean — or worst case a clean Windows reinstall — restores the machine completely. The hardware isn't damaged by malware.

If your machine is heavily infected, slow even after cleanup, or you suspect ransomware, CT Tech Express handles professional malware removal in central CT. Call (860) 398-9221 or book online.