Remove Malware from Windows 11 Free: A Built-In Cleanup Walkthrough

Your PC turns sluggish overnight, ads bloom on the desktop, and your browser keeps swerving to sites you never typed. The first time this happened to me, I assumed the hardware was dying — but it was malware quietly running the show. Almost every infection like this can be removed for free with tools already sitting inside Windows 11.

Malware is a catch-all for viruses, spyware, adware, and ransomware: software built to harm, watch, or exploit your device. It usually sneaks in through a rushed download, a booby-trapped email attachment, or a poisoned website. Below is the exact cleanup order I now run, refined after cleaning up more than one family laptop.

Quick Answer

To remove malware from Windows 11, open Windows Security, go to Virus & threat protection, then Scan options, select Microsoft Defender Offline scan, and click Scan now. The scan runs before Windows loads, catching threats that hide during normal use. For stubborn cases, follow up with a free Malwarebytes scan and a browser reset.

What Are the Signs Your Windows 11 PC Has Malware?

Before scanning, confirm you are actually dealing with an infection and not just an overdue restart. Watch for these symptoms:

• Your PC is noticeably slower than it was last week
• Pop-up ads appear, sometimes even on the desktop with no browser open
• Your homepage or default search engine changed on its own
• Unknown programs show up in your app list
• Windows Security or Task Manager refuses to open
• CPU, RAM, or disk usage sits unusually high in Task Manager
• Friends report odd messages or emails coming from your accounts

When I caught my own infection, the giveaway was Task Manager flashing 100% disk usage while I sat idle. If you spot two or more of these signs, scan right away.

Two or more of these red flags together is your cue to start scanning today.

How Do You Update Microsoft Defender Before Scanning?

Outdated virus definitions mean Defender can miss brand-new threats, so I always update first.

1. Click Start, type Windows Security, and open the app.
2. Click Virus & threat protection.
3. Under “Virus & threat protection updates,” click Check for updates.
4. Wait for the update to finish before moving on.

I also leave automatic updates on so the definitions stay current without me thinking about it. Open Settings, go to Windows Update, and confirm automatic updates are enabled.

Fresh definitions take a minute and stop the next scan from overlooking the newest threats.

How Do You Run a Full Scan with Microsoft Defender?

Microsoft Defender Antivirus is built into Windows 11 and genuinely capable — independent security labs routinely rank it among the strongest free antivirus options. A Full scan is where I start.

1. In Windows Security, click Virus & threat protection.
2. Click Scan options.
3. Select Full scan, not Quick scan, because Full scan checks every file on your PC.
4. Click Scan now.

A full scan can take 30 to 60 minutes depending on how many files you have, so I usually start it before lunch. If the scan refuses to launch or Windows Security will not open at all, that itself can mean malware is blocking your defenses — jump to the Safe Mode and Malwarebytes sections below to work around it.

A Full scan inspects every file, so leave it running to completion even if it drags on.

What Does a Microsoft Defender Offline Scan Do?

Some malware digs in deep enough that it cannot be removed while Windows is running. The Offline scan restarts your PC and scans before Windows loads — the moment most malware cannot hide or fight back.

1. Go to Windows Security, then Virus & threat protection, then Scan options.
2. Select Microsoft Defender Offline scan.
3. Click Scan now, then confirm by clicking Scan.
4. Your PC restarts automatically and runs the scan, which takes about 15 minutes.

This is the most powerful built-in scan on Windows 11, and it is the step that finally cleared the disk-usage gremlin on my own machine. Use it whenever you suspect something serious.

Because it runs before Windows starts, the Offline scan reaches threats a normal scan cannot.

How Do You Scan in Safe Mode for Stubborn Infections?

If malware keeps interrupting your scans, boot into Safe Mode first. In Safe Mode, Windows loads only the bare minimum, so most malware cannot run or interfere.

1. Click Start, then Settings, then System, then Recovery.
2. Under “Advanced startup,” click Restart now.
3. Choose Troubleshoot, then Advanced options, then Startup Settings, then Restart.
4. Press 4 to start in Safe Mode.
5. Once in Safe Mode, repeat the Full scan and Offline scan steps above.

Safe Mode strips the system down so blocked scans can finally finish.

Is Malwarebytes Free Worth Running as a Second Opinion?

No single tool catches everything. Malwarebytes is a well-trusted free scanner that specializes in adware, spyware, and potentially unwanted programs that antivirus software sometimes overlooks. I run it as a second opinion after Defender.

1. Download Malwarebytes from malwarebytes.com — the free version is enough.
2. Install and open the application.
3. Click Scan and let it run to completion.
4. Review any detected items and click Quarantine to remove them.
5. Restart your PC when prompted.

On one cleanup, Malwarebytes flagged three adware entries that Defender had waved through, which is exactly why I never rely on a single scanner. Here is how the two free options compare:

Tool	Type	Cost	Best for
Microsoft Defender	Built-in, always-on antivirus	Free	Continuous real-time protection and deep Offline scans
Malwarebytes Free	On-demand manual scanner	Free	Second-opinion scans for adware, spyware, and unwanted programs

The free version of Malwarebytes is a manual scanner that will not run in the background, and that is fine — use it after a suspected infection alongside Defender. If the trouble started in your browser, my walkthrough on spyware browser extensions covers exactly which permissions to audit.

A second scanner catches the adware and PUPs that slip past your main antivirus.

How Do You Remove Suspicious Startup Programs?

Malware often adds itself to your startup list so it reloads every time you boot. Cleaning this list is an essential step.

1. Press Ctrl + Shift + Esc to open Task Manager.
2. Click the Startup apps tab.
3. Look for any program you do not recognize or did not install yourself.
4. Right-click a suspicious entry and select Disable.

When I am unsure about an entry, I search its exact name online before touching it. Disabling is safe — you can re-enable anything you actually need later.

Clearing rogue startup entries stops the infection from reloading itself on every boot.

How Do You Reset Your Browser Settings After Adware?

Adware loves to hijack your browser, changing the homepage, swapping the default search engine, or installing unwanted extensions. A reset clears all of it.

In Google Chrome:

1. Click the three-dot menu in the top right, then Settings.
2. Scroll down and click Reset settings.
3. Click Restore settings to their original defaults, then Reset settings.

Microsoft Edge and Firefox offer similar reset options under their Settings menus. Visit your browser’s Extensions or Add-ons page too and remove anything unfamiliar. Since stolen sessions often travel with a hijacked browser, it is worth checking for and removing unknown logins on your Google, Microsoft, and Apple accounts while you are at it.

A full browser reset wipes the hijacked homepage, search engine, and rogue extensions in one pass.

How Do You Repair Damaged System Files with SFC?

Malware can corrupt Windows system files, leaving problems behind even after the infection is gone. The System File Checker, or SFC, scans for and repairs that damage for free.

1. Click Start and search for Command Prompt.
2. Right-click it and choose Run as administrator.
3. Type sfc /scannow and press Enter.
4. Wait for the scan to finish, which takes 10 to 15 minutes.
5. Restart your PC when it completes.

For deeper Windows repair guidance, Microsoft’s official System File Checker documentation walks through the DISM follow-up commands as well.

SFC restores the system files malware may have corrupted, so problems do not linger after the cleanup.

Common Mistakes to Avoid

1. Only running a Quick Scan. Quick scans check just the most common hiding spots. Fix: use a Full scan or Offline scan for a thorough clean-up.
2. Downloading “anti-malware” tools from pop-up ads. “Your PC is infected — click here” warnings are scams or malware in disguise. Fix: download only from trusted sites like malwarebytes.com or microsoft.com.
3. Skipping the browser reset. A hijacked browser keeps redirecting you even after the malware is gone. Fix: always reset settings and review your extensions.
4. Paying for “PC cleaner” tools that appear after a scare. Legitimate removal is free. Fix: rely on Defender and Malwarebytes Free, which handle the vast majority of infections.
5. Not restarting after quarantine. Some files are removed only on reboot. Fix: always restart after any scan that detects threats.

Frequently Asked Questions

Does Windows 11 have built-in malware protection?

Yes. Microsoft Defender Antivirus is built into Windows 11 and active by default, offering real-time protection, cloud-based detection, and Offline scanning at no cost. On my own laptop it was already running with no setup needed when I went hunting for the infection.

How do I know if my PC has a virus?

Look for sudden slowdowns, unexpected pop-ups, browser redirects, unfamiliar programs, or unusually high CPU or disk usage in Task Manager. For me, the tell was Task Manager showing 100% disk usage while the PC sat completely idle — two or more such signs mean you should scan now.

Is the Malwarebytes free version good enough?

Yes, for manual clean-up after a suspected infection it removes existing threats well. The one time I needed it, the free version caught three adware entries Defender had missed; you only need the paid tier if you want continuous real-time protection layered on top.

Can malware survive a Windows 11 reset?

Very rarely. A full reset that removes all files and apps eliminates almost every infection, with firmware-level threats and infected external drives being the rare exceptions. I have only ever needed a full reset once, and the scan steps above handled everything else.

How long does a full Microsoft Defender scan take?

Usually 30 to 60 minutes, depending on how many files you have. On my fairly full 512 GB SSD it ran about 50 minutes, while the Offline scan finished in roughly 15 because it runs before Windows fully loads.

What should I do if malware keeps coming back?

Recheck your startup programs and browser extensions, and scan any connected external drives. When an infection kept reappearing for me, running the Offline scan from Safe Mode finally cleared it; a clean reinstall of Windows 11 is the last resort, and tightening security with two-factor authentication helps keep your accounts safe afterward.

Conclusion

Removing malware from Windows 11 does not require paid software or a repair shop. Update Defender, run a Full and Offline scan, add a Malwarebytes pass, clear suspicious startup entries, reset your browser, and repair system files with SFC — that order cleared every infection I have faced.

Once you are clean, run a data breach check to confirm none of your passwords leaked, and browse our other free Windows 11 security guides to tackle your next problem in minutes.