Guide
How to remove a virus from Windows 11 and 10, for free
You don't need to pay for a clean-up tool. Windows already includes what you need. Follow these steps in order, and stop to get help if you see a ransom note or anything involving your bank.
Stop first if: you see a ransom note (disconnect from the network and unplug backup drives), or you think someone has remote access to your computer (disconnect from the internet and call your bank if you've used banking on it).
Step 1: Back up the files you can't lose
Copy documents and photos to an external drive or cloud storage you trust. Don't back up programs or downloads, which may carry the infection.
Step 2: Update Windows Security
Open Windows Security → Virus & threat protection → Protection updates → Check for updates. Make sure real-time protection is on.
Step 3: Run a full scan
Windows Security → Virus & threat protection → Scan options → Full scan → Scan now. It can take an hour or more. When it finishes, choose to remove or quarantine anything it finds.
Step 4: Run a Microsoft Defender Offline scan
Some malware hides while Windows is running. Go to Scan options → Microsoft Defender Offline scan → Scan now. Save your work first: the computer restarts and scans before Windows loads, which takes about 15 minutes.
Step 5: Remove what scanners don't call a virus
- Settings → Apps → Installed apps: sort by install date and uninstall anything you don't recognise, especially "PC optimisers", toolbars and VPNs you didn't choose.
- Browser extensions: remove anything unfamiliar in Edge, Chrome or Firefox.
- Reset your browser (Settings → Reset settings) to remove a hijacked homepage or search engine.
- Startup apps: in Task Manager → Startup apps, disable anything suspicious.
Step 6: If problems continue, use safe mode
Go to Settings → System → Recovery → Advanced startup → Restart now, then Troubleshoot → Advanced options → Startup Settings → Restart, and choose safe mode with networking. Run the full scan again and remove apps from there. Malware is often unable to start in safe mode.
Step 7: Secure your accounts
From a different, clean device, change passwords for email, banking and anything you logged into on the infected laptop. Turn on multi-factor authentication. Check recent activity on your email and bank accounts.
Step 8: Last resort, reset Windows
If infections keep coming back, use Settings → System → Recovery → Reset this PC. Choosing "Remove everything" gives the cleanest result; restore your files from the backup in step 1 afterwards, scanning them first.
Keep it clean
Turn on automatic updates, keep real-time protection on, enable ransomware protection, and use a standard account day to day. CitadelLite Free Anti-Virus watches these settings and fixes them in one click.
Frequently asked questions
Do I need to reinstall Windows to remove a virus?
Usually not. A full scan plus a Microsoft Defender Offline scan removes most common malware. If infections keep coming back, or you suspect a password stealer or remote-access tool, resetting Windows after backing up your files is the safest option.
Are online virus clean-up tools safe?
Be careful. Fake 'PC cleaner' and 'virus removal' downloads are a common way malware spreads. Use the tools built into Windows, or software downloaded directly from a well-known publisher's own website.
Will removing the virus recover my encrypted files?
No. If ransomware encrypted your files, removing it stops further damage but does not decrypt them. Restore from a backup, and get professional help.
Help shape CitadelGate before launch
We are looking for a small number of South African MSPs and IT teams to pilot AI-assisted ticket remediation on test devices first. No cost, no commitment.