How to Remove Malware from a Windows PC: Incident Response Checklist

Overview

Use this guide when a Windows computer shows signs such as unexpected pop-ups, browser redirects, unfamiliar applications, disabled security tools, unusual account activity, or a malware alert. It is designed for IT generalists, small-business owners, and users managing a limited number of endpoints.

The correct response depends on the scenario. A potentially unwanted browser extension is different from an active ransomware event or a device that may have exposed business credentials. If regulated data, financial systems, privileged accounts, or multiple computers may be involved, escalate according to your organization’s incident-response process before deleting files or rebuilding systems.

For a single Windows PC, work through the following order:

1. Contain the device: reduce its ability to communicate with other systems or the internet.
2. Record what happened: note alerts, times, symptoms, affected accounts, and recent user actions.
3. Scan and investigate: use trusted, updated malware protection software and check likely persistence points.
4. Protect identities: change exposed passwords from a known-clean device and review active sessions.
5. Recover deliberately: patch, restore only trustworthy data, and reimage when confidence in the installation is low.

Do not assume that a clean scan proves the computer is safe. Malware may be missed, removed incompletely, or replaced by another unwanted program. The level of confidence you need should match the importance of the device and the data it handles.

Checklist by scenario

Scenario 1: Suspicious behavior, but no confirmed compromise

• Disconnect the PC from Wi-Fi or wired networking if the behavior is active or unexplained. Avoid using removable drives until the situation is clearer.
• Write down the visible symptoms, including unusual windows, URLs, file names, warnings, and the time they appeared. Take a screenshot if it can be done safely.
• Do not call a phone number shown in a pop-up, install a “support” tool requested by a web page, or grant remote access to an unknown person.
• From Windows Security or the organization’s approved endpoint product, update protection components and run a full scan.
• Run an offline or boot-time scan when available and appropriate. This can help inspect the system before the normal Windows environment and startup programs are fully active.
• Review installed applications, browser extensions, startup entries, scheduled tasks, and recently downloaded files. Remove only items you can identify with reasonable confidence.
• Apply Windows, browser, application, and firmware updates after the immediate investigation, following your normal change process.

If the device belongs to a business, record the detection name, file path, user, hostname, and scan result in your ticketing or incident log. A central endpoint product can make this easier across a fleet; see the small-business endpoint security checklist for broader controls.

Scenario 2: A confirmed infection or stolen credentials

• Isolate the device from the network. If it is managed, use the endpoint console’s isolation feature where available rather than improvising firewall changes.
• Identify accounts used on the computer, including email, Microsoft 365, VPN, browser-saved logins, finance systems, and administrator accounts.
• Using a known-clean device, change passwords for exposed accounts. Revoke active sessions and tokens where the service supports it, and check for unfamiliar recovery methods, forwarding rules, or newly registered authentication devices.
• Preserve the alert details and relevant logs before deleting files if your organization may need investigation or legal review.
• Run the approved full and offline scans. Do not install several competing real-time antivirus products on the same Windows installation; use the organization’s selected tool and a separate on-demand scanner only when appropriate.
• Check whether other devices received the same email, downloaded the same file, or used the same compromised credentials.
• Only reconnect the PC after scans, account protection, patching, and validation are complete.

For future deployment planning, compare endpoint options in the best antivirus for small business guide, or review the Microsoft Defender for Business deployment guide if your environment uses Microsoft tools.

Scenario 3: Ransomware or suspicious file encryption

• Disconnect the affected computer and any clearly connected systems as quickly and safely as possible. Do not browse shared folders from another machine to investigate.
• Do not delete ransom notes, rename encrypted files, or repeatedly reboot without recording what you observed. Preserve a small sample of relevant files and messages if doing so does not worsen the incident.
• Identify the scope: affected endpoints, shared drives, cloud storage, backups, administrator accounts, and the approximate start time.
• Protect backups from further access. Treat a backup as untrusted until it has been checked and its restore point verified.
• Use your documented escalation process and involve qualified incident-response support when the event affects business operations or multiple systems.
• Do not assume that paying or obtaining a decryption tool will remove the underlying access. Credentials, persistence, and exposed services still need investigation.

Once containment is established, use the ransomware recovery checklist for small business to organize restoration, validation, and communications.

Scenario 4: Browser hijacking or unwanted software

• Close suspicious tabs without clicking their page controls. If a tab will not close normally, end the browser process through Task Manager.
• Remove unfamiliar extensions, notifications permissions, search providers, and recently installed programs.
• Reset the browser only after saving legitimate business settings and confirming the organization’s approved configuration.
• Scan downloaded files and run a full endpoint scan. Check startup items and scheduled tasks if the behavior returns after a reset.
• Review saved passwords and active browser sessions from a clean device if credentials may have been entered into a suspicious page.

Preventive controls such as DNS filtering and carefully managed browser extensions can reduce repeat incidents. The guides to DNS filtering for small business and browser security extensions for business cover those decisions separately.

What to double-check

• Persistence: Review startup applications, scheduled tasks, services, browser extensions, and recently created user accounts. Record questionable entries before removal when evidence may matter.
• Accounts: Check sign-in history, mailbox forwarding rules, sent mail, cloud sessions, VPN access, and administrator membership. Malware removal does not reverse credential theft.
• Data: Verify that important files open correctly and that restored data comes from a known-good source. Scan files before returning them to production systems.
• Network exposure: Confirm that remote access tools, exposed management ports, shared folders, and Wi-Fi credentials have not created a route back into the environment.
• Security coverage: Confirm that real-time protection, tamper controls, firewall settings, updates, and reporting are enabled. If you are evaluating protection products, use an antivirus performance comparison alongside detection and management requirements.
• User activity: Determine whether the initial event came from a malicious link, an attachment, a cracked application, a fake update, or an exposed remote service. This points to the prevention step that matters most.

If the device remains unstable, security controls cannot be trusted, or you cannot explain what changed, reimaging is often more defensible than trying to prove every component is clean. Before rebuilding, confirm that business data is backed up, licenses and recovery keys are available, and the organization knows how to restore the device securely.

Common mistakes

• Continuing to work normally: Every extra login, download, or shared-drive connection can increase exposure.
• Installing random cleanup tools: Fake security software can add risk and may destroy useful evidence. Use tools approved by your organization or obtained directly from a trusted vendor.
• Changing passwords on the infected PC: Use a known-clean device when possible, especially for administrator, email, banking, and identity-provider accounts.
• Deleting before documenting: A rushed cleanup can remove alert details needed to determine scope or identify the initial access method.
• Restoring everything immediately: Backups, browser profiles, scripts, and installers can reintroduce the problem if they were created or modified during the incident.
• Stopping after the scan says clean: Complete account review, patching, persistence checks, and validation before declaring recovery.
• Ignoring the rest of the fleet: Search for the same detection, file hash, sender, URL, or login activity on other endpoints and cloud services.

When to revisit

Keep this checklist with your incident-response notes and review it before seasonal planning cycles, after a malware event, and whenever workflows or security tools change. Revisit it when you adopt a new endpoint platform, move services to the cloud, permit more remote work, change backup architecture, or add new administrators.

At minimum, schedule a practical review that confirms:

1. Every supported Windows device has an identified protection and update owner.
2. Staff know how to report a suspicious link, attachment, pop-up, or QR code phishing scam without interacting further.
3. Administrators can isolate a device and revoke sessions quickly.
4. Backups are separated from ordinary user access and have been tested through a restoration exercise.
5. The organization has a clear threshold for cleaning, monitoring, or reimaging a device.

For a final prevention pass, pair this article with the safe suspicious-link checklist and the small-business endpoint security checklist. The goal is not merely to remove today’s malware; it is to make the next detection faster to contain, easier to investigate, and less disruptive to recover from.