You can remove many viruses from Windows 10 without buying or installing third-party antivirus software by using the security and recovery tools already included with Windows. These include Windows Security, Microsoft Defender Offline, Safe Mode, startup controls, application removal and Windows recovery options.
There is, however, an important distinction to understand. Windows Security includes Microsoft Defender Antivirus, so removing malware “without antivirus” usually means removing it without a separate commercial antivirus product. Trying to clean a seriously infected computer without using any malware-scanning tool at all is unreliable.
For minor infections, suspicious browser extensions or unwanted applications, Windows’ built-in tools may be enough. what is anti-malware,,For ransomware, persistent malware, stolen administrator access or an infection that returns after removal, resetting or completely reinstalling Windows is usually safer than manually deleting files.
Windows 10 also reached the end of ordinary support on 14 October 2025. In 2026, removing the current infection is only part of the solution. The computer must also receive Extended Security Updates or move to a supported operating system, preferably Windows 11 where the hardware allows it.
This guide explains how to get rid of viruses on Windows 10 without third-party antivirus software, how to recognise serious virus symptoms and when a complete reinstall is the safest option.
First, Confirm That the Problem Could Be Malware
A slow computer does not automatically have a virus. Windows updates, low storage space, damaged system files, ageing hardware and too many startup programs can create similar symptoms.
Malware becomes more likely when several unusual changes appear together. The browser may redirect searches, unfamiliar applications may appear, security settings may switch off or advertisements may open outside normal websites.
Other warning signs include files changing without explanation, unusually high network activity, unknown administrator accounts and messages being sent from your email or social-media accounts.
Ransomware symptoms are more obvious. Documents may suddenly become unreadable, filenames may acquire unfamiliar extensions and a payment demand may appear. Shared folders and connected drives can also be affected.
Do not spend too long trying to prove that malware is present before protecting the computer. If files are actively changing, security tools have stopped working or the device is sending suspicious messages, treat the situation as a possible infection.
Understand What “Without Antivirus” Really Means
Windows 10 comes with Windows Security, which includes Microsoft Defender Antivirus. It may already be scanning files and monitoring activity even if you have never installed a separate security product.
Therefore, the safest interpretation of removing a virus without antivirus is removing it without purchasing or downloading third-party antivirus software. The built-in Windows tools should still be used.
Completely manual removal is risky because malware does not always use an obvious filename. A malicious program may imitate a Windows process, create several components or return through a startup entry after one file is deleted.
Deleting the wrong system file can also make Windows unstable or unable to start. For this reason, avoid guides that tell you to delete unfamiliar files or registry entries without first identifying them accurately.
Built-in scanning, quarantine and recovery options provide a much safer route.
1. Disconnect the Computer from the Internet
If you believe malware is active, disconnect the computer from Wi-Fi, Ethernet and any unnecessary network connections.
This may interrupt communication between the malware and an external attacker. It can also reduce the chance of a worm spreading to other devices or ransomware affecting shared network folders.
To disconnect Wi-Fi, select the network icon on the taskbar and switch Wi-Fi off. For a wired connection, unplug the Ethernet cable.
Do not immediately turn the computer off if it contains important unsaved work or belongs to an organisation with an incident-response procedure. Sudden shutdown can remove useful evidence from memory. For an ordinary personal computer, however, disconnecting from the network is a sensible early precaution.
You may need to reconnect briefly later to obtain Microsoft updates or official security tools. Do this only after deciding what needs to be downloaded, and avoid ordinary browsing while the device remains under investigation.
2. Disconnect External Drives
Remove external hard drives, USB sticks, memory cards and other storage that is not required for the clean-up.
Viruses may infect files stored on removable devices, while ransomware can encrypt any connected location that the affected account can modify. Leaving a backup drive connected can turn a recoverable computer infection into permanent data loss.
Do not immediately connect those drives to another computer. If they contain infected files, this may transfer the problem to the clean device.
After the main computer has been cleaned or reinstalled, scan external storage before opening its files. Restore only documents that you recognise and genuinely need.
3. Protect Essential Files Carefully
Before making major recovery changes, decide which personal files must be preserved. These may include photographs, school or work documents and records that cannot be downloaded again.
Avoid copying applications, installers, scripts, cracked software or unfamiliar archive files. These are more likely to carry the infection into the repaired system.
Documents can also contain malicious macros, so backing up everything without review is not risk-free. Copy only essential personal data and keep the backup disconnected until Windows has been cleaned or reinstalled.
If ransomware has already encrypted files, copying the encrypted versions will not make them usable. Nevertheless, preserving a copy may be worthwhile in case a legitimate recovery method becomes available later.
Do not pay a ransom merely because a message promises a recovery key. Payment does not guarantee that files will be restored, and the attackers may already have copied information.
4. Open Windows Security
Windows Security is the main built-in place for checking and removing malware.
Select Start, type Windows Security, and open the application. Choose Virus & threat protection.
Check whether Microsoft Defender Antivirus is active. If another antivirus product was previously installed, Defender may have been placed into a limited or disabled state. An expired third-party program may also have left the computer poorly protected.
Look at Protection history to see whether Windows has already detected, blocked or quarantined anything. An alert may show the name of the threat, the affected file and the action taken.
Do not automatically restore a quarantined file because you recognise its application name. Malware is often hidden inside otherwise familiar folders or installers.
5. Update Microsoft Defender Security Intelligence
A scan is more useful when Microsoft Defender has current information about known malware.
Within Virus & threat protection, find the protection or security-intelligence update section and check for updates. Reconnect to the internet briefly if this is required, then disconnect again before continuing if the infection appears active.
Updating the scanner does not update the whole operating system. Windows Update must still be checked separately later.
If malware prevents security updates from downloading, blocks the Windows Security app or immediately turns protection off again, this suggests a more persistent infection. Move to the offline scan or recovery options rather than repeatedly trying the same normal scan.
6. Run a Quick Scan
A quick scan examines common locations where active malware is likely to be found.
Open Windows Security, select Virus & threat protection, and choose Quick scan. Allow the scan to finish without running unnecessary applications.
If a threat is found, follow Windows Security’s recommended action. The tool may quarantine, block or remove the affected item.
Quarantine is safer than manually deleting a suspicious file. It prevents the item from running normally while keeping it available for review if the detection later proves incorrect.
A quick scan is useful as an initial check, but it does not examine every file. If symptoms continue or you opened a suspicious attachment, follow it with a full scan.
7. Run a Full Scan
A full scan checks every accessible file and running program on the device. It can take much longer than a quick scan, particularly when the computer has a large drive or many files.
In Windows Security, open Virus & threat protection, select Scan options, choose Full scan, and start the scan.
Avoid downloading files, checking email or browsing while the scan runs. These activities add more content and may expose accounts if the device is compromised.
When the scan finishes, review the result rather than assuming the problem is solved. If malware was found, restart the computer if Windows requests it and run another scan afterwards.
Repeated detections of the same threat may mean that another component is reinstalling it. A full scan performed inside normal Windows may also struggle with malware that is active and protecting itself. This is when Microsoft Defender Offline becomes especially useful.
8. Use Microsoft Defender Offline
Microsoft Defender Offline scans the computer after restarting it into a trusted recovery environment. Because normal Windows and most startup applications are not running, persistent malware has fewer opportunities to hide or interfere.
Save any open work first. Then go to:
Start > Settings > Update & Security > Windows Security > Virus & threat protection > Scan options
Choose Microsoft Defender Offline scan, then select Scan now.
The computer will restart and perform the scan. It should return to Windows when the process finishes.
After signing in, open Windows Security and check Protection history for detections and actions.
An offline scan is one of the most important built-in options for malware removal. It can identify threats that start before ordinary scanning tools or that attempt to disable security while Windows is operating normally.
However, even a clean offline scan is not absolute proof that the device was never compromised. Malware may already have stolen passwords or changed online accounts before it was removed.
9. Start Windows 10 in Safe Mode
Safe Mode starts Windows with a reduced set of drivers, services and startup applications. It can make it easier to remove a suspicious program that continually restarts during normal use.
Safe Mode is not an antivirus product and does not automatically remove malware. Its purpose is to reduce background activity so that troubleshooting becomes easier.
To enter Safe Mode in Windows 10, open:
Settings > Update & Security > Recovery
Under Advanced startup, choose Restart now. After the computer restarts, select:
Troubleshoot > Advanced options > Startup Settings > Restart
Choose 4 or F4 for Safe Mode. Choose the networking version only when an internet connection is genuinely required. Remaining offline is safer during an active infection.
Once in Safe Mode, you can uninstall recently added suspicious applications, check startup entries and remove browser extensions. Do not manually delete files simply because their names look unfamiliar.
Some legitimate drivers and services will not work in Safe Mode, so unusual appearance or reduced functionality is normal.
10. Uninstall Suspicious or Unwanted Programs
Review applications installed shortly before the symptoms began.
Open Start > Settings > Apps > Apps & features. Sort the applications by installation date if that option is available.
Look for programs you do not recognise, software installed through a suspicious download or utilities that began displaying pop-ups. Uninstall them through Windows rather than deleting their folders manually.
Be cautious with applications published by Microsoft, the computer manufacturer or recognised hardware companies. An unfamiliar name is not automatically malicious.
If the uninstall option fails in normal Windows, try again in Safe Mode. Persistent malware may protect its files or restart its processes while the computer is operating normally.
After removing a suspicious application, restart the computer and run another full or offline scan.
11. Review Startup Applications
Malware and unwanted software may configure themselves to run whenever the user signs in.
Press Ctrl + Shift + Esc to open Task Manager. Select the Startup or Startup apps tab.
Review the programs enabled at startup. Disable an entry when you recognise it as unwanted or when it clearly relates to a suspicious application you have removed.
Disabling a startup item does not delete the program. It simply prevents that entry from starting automatically. This makes it a useful diagnostic step but not a complete malware-removal method.
Avoid disabling security software, hardware drivers or services you do not understand. Randomly turning off startup entries may affect sound, touchpads, graphics or other legitimate functions.
If an unknown item returns after being disabled, another component may be recreating it. Run Microsoft Defender Offline or consider resetting Windows.
12. Clean Up the Browser
Some apparent computer viruses are actually malicious extensions, browser hijackers or unwanted notification permissions.
Open the browser’s extension or add-on page and remove anything you did not deliberately install. Pay particular attention to extensions connected with search tools, coupons, video downloading or supposed security warnings.
Review the home page, default search engine and startup-page settings. If they repeatedly change back, an installed application may be controlling them.
Remove notification permission from websites that send misleading virus alerts or advertisements. A browser notification can appear outside the main webpage and may look similar to a Windows warning.
Clear temporary browsing data and reset browser settings if redirections continue. A reset usually removes extensions and restores defaults, but review what information will be affected before confirming.
If you use more than one browser, check each one. A suspicious extension in one browser will not necessarily appear in another.
13. Check Download and Temporary Folders
The malicious installer or attachment may still remain in the Downloads folder even after its active component has been removed.
Review recently downloaded files and delete items connected with the infection. This might include an unexpected attachment, fake update or unofficial program installer.
Empty the Recycle Bin afterwards so that the file is not accidentally restored.
Do not open a suspicious file to confirm what it contains. The fact that it is currently inactive does not mean it is safe.
Temporary-file clean-up can remove leftover material, but it should not be treated as the main cure. Malware may store files in several locations, and random deletion can miss the active component.
14. Use Microsoft’s Additional Removal Tools Carefully
Microsoft provides tools such as the Windows Malicious Software Removal Tool and Microsoft Safety Scanner.
The Malicious Software Removal Tool targets particular widespread malware families and is commonly delivered through Windows Update. It is not a replacement for complete real-time protection.
Microsoft Safety Scanner is an on-demand tool designed to find and remove malware from Windows computers. It can be useful when the ordinary Windows Security scan is unavailable or when a second Microsoft scan is needed.
Download these tools only from Microsoft’s official service. Search advertisements and imitation download pages may distribute unsafe programs using similar names.
These tools are optional. Microsoft Defender Offline and a clean Windows reinstall remain stronger options when malware is persistent.
15. Install Windows and Application Updates
Once the active infection appears contained, reconnect to a trusted network and check for updates.
In Windows 10, open:
Settings > Update & Security > Windows Update
Install available security updates and restart as required. Update the web browser, office software, PDF reader and other frequently used applications as well.
This stage is essential because the malware may have entered through a known vulnerability. Removing the malicious file without correcting the weakness could allow reinfection.
There is now an additional issue for Windows 10 users. Ordinary Windows 10 support ended on 14 October 2025. In 2026, a computer should either be enrolled in Microsoft’s Extended Security Updates programme, upgraded to Windows 11 or replaced with a supported device.
Cleaning an unsupported computer but leaving it without new security updates is only a temporary solution.
16. Do Not Rely on System Restore Alone
System Restore can return certain system settings, drivers and installed programs to an earlier point. It may help when unwanted software or a faulty change began recently.
However, System Restore is not a reliable standalone malware-removal method. Personal files may remain unchanged, and malicious content can exist outside the items restored.
Some malware may also affect restore points or remain active after the restoration.
Use System Restore as a troubleshooting option rather than proof that the system is clean. Run a Microsoft Defender Offline scan after restoring and continue monitoring the computer.
For serious infections, resetting or reinstalling Windows provides greater assurance.
17. Reset Windows 10 When Malware Persists
If the infection returns, security tools remain disabled or the computer behaves unpredictably, use Reset this PC.
In Windows 10, go to:
Settings > Update & Security > Recovery
Under Reset this PC, select Get started.
Windows may offer a choice between keeping personal files and removing everything. Keeping files is more convenient, but it may preserve a harmful document or other infected content.
For a serious malware infection, Remove everything provides a cleaner starting point. A cloud download can obtain new Windows installation files rather than relying entirely on local files that may be damaged.
Back up essential personal data first, and make sure you know the passwords and licence information required to reinstall legitimate applications.
After the reset, install security updates before restoring files or browsing normally.
18. Use a Clean Installation for the Strongest Assurance
A clean installation removes the existing Windows installation, applications, settings and files before installing a fresh copy.
This is more disruptive than a scan or reset, but it is often the most reliable choice after a serious compromise. It is especially appropriate when malware obtained administrator access, created hidden persistence or repeatedly returned after removal.
Create installation media from an official Microsoft source using a separate, trusted computer. Back up only necessary personal documents, and assume that applications and settings will need to be recreated.
During installation, delete or format the existing Windows partitions only when you understand which drive contains the operating system and have safely backed up necessary information.
After installation, activate Windows, apply all updates and install programs from official sources. Do not restore suspicious installers or the same unofficial software connected with the original infection.
Where possible, install Windows 11 rather than returning to unsupported Windows 10.
19. Handle Ransomware Differently
Ransomware should be treated as a serious security incident, not merely an unwanted application.
Disconnect the affected computer from networks and remove connected external drives. Do not continue opening files or attempting repeated restarts while encryption appears active.
Preserve the ransom note and information about the first affected files, but do not follow links or contact details without reliable advice.
A ransomware incident may also involve data theft. Even if the malware is removed, passwords and confidential information may have been exposed.
For a personal device, a clean installation followed by restoration from an unaffected backup is often the safest recovery route. For a business device, report the incident immediately and follow the organisation’s incident-response process.
Do not connect backups until the repaired system is clean and the original infection route has been closed.
20. Change Passwords from a Clean Device
Malware removal does not reverse credential theft. A virus, trojan or spyware infection may have copied passwords, browser cookies or login sessions.
Use a different, clean device to change passwords for email, banking, cloud storage, social media and other important accounts. Begin with email because it can often be used to reset passwords elsewhere.
Use unique passwords and enable multi-factor authentication. Review active sessions and sign out devices you do not recognise.
Check email forwarding rules and recovery addresses. An attacker may create a hidden rule that sends copies of messages to another account.
Do not change passwords from the infected computer until it has been cleaned or reinstalled. Otherwise, the new password may be stolen as well.
21. Verify That the Virus Is Gone
After removal or recovery, observe the computer for recurring symptoms.
Windows Security should remain active, security-intelligence updates should succeed and repeated scans should not find the same threat. Browser settings should remain stable, and unknown startup items should not return.
Check whether unexplained network use, pop-ups or account alerts continue. Review Protection History for new detections.
A clean scan is reassuring, but it is not an absolute guarantee. If the computer still behaves suspiciously after an offline scan and application clean-up, do not continue attempting increasingly complicated manual repairs. Reset or reinstall Windows.
Certainty matters more than preserving every existing application on a device used for financial, legal, school or business information.
22. Prevent the Virus from Returning
Use real-time Windows Security protection and keep it updated. Leave Windows Firewall switched on and download software only from recognised publishers.
Avoid pirated programs, unofficial activation tools and fake system cleaners. These commonly ask users to weaken security before installation.
Treat unexpected email attachments and links carefully, even when they appear to come from a known person. Genuine accounts can be compromised.
Keep at least one backup separate from the computer. Cloud synchronisation is useful, but harmful file changes may synchronise too, so it should not be the only recovery method.
Most importantly, move away from unsupported Windows 10 when possible. Malware removal cannot permanently compensate for an operating system that no longer receives normal security fixes.
Common Mistakes During Manual Malware Removal
The most dangerous mistake is deleting registry entries or system files based only on an unfamiliar name. Legitimate Windows components often have technical names, and removing them can damage the operating system.
Another mistake is downloading multiple free “virus cleaners” from search advertisements. Some are potentially unwanted programs, while others may create new infections.
Users also reconnect backup drives too soon, restore the same suspicious installer or change passwords on the still-infected computer.
Safe Mode is sometimes misunderstood as a virus-removal tool. It only reduces the software running in the background; it does not prove the system is clean.
Finally, many people continue using Windows 10 without current security updates. Cleaning today’s virus while leaving known vulnerabilities open makes another infection more likely.
Frequently Asked Questions
Can I remove a virus from Windows 10 without installing antivirus?
Yes. Windows 10 includes Windows Security and Microsoft Defender Antivirus, so you can scan and remove many threats without installing a third-party antivirus product.
Can I remove a virus without using any antivirus tool?
Manual removal is possible in limited cases, such as uninstalling an obvious unwanted application. It is not reliable for persistent or hidden malware. Use Windows Security or reinstall Windows for stronger assurance.
Does Windows 10 have built-in virus protection?
Yes. Windows Security includes Microsoft Defender Antivirus, firewall controls and several scan options.
What is Microsoft Defender Offline?
It is a built-in scan that restarts the computer and checks it from a trusted environment. This makes it harder for active malware to hide or interfere.
Does Safe Mode remove viruses?
No. Safe Mode starts Windows with fewer programs and services, making troubleshooting easier. You must still scan, uninstall or remove the threat.
Will resetting Windows 10 remove malware?
A reset can remove many infections, especially when you choose to remove everything. A clean installation provides greater assurance after a serious compromise.
what is anti-malware & Does System Restore remove a virus?
It may reverse some changes but should not be relied upon as complete malware removal. Scan the system afterwards.
What should I do if Windows Security will not open?
Try Microsoft Defender Offline or use Windows recovery options. Persistent interference with security tools may justify resetting or reinstalling Windows.
Can ransomware be removed without antivirus?
The ransomware program may be removed through an offline scan or clean reinstall, but encrypted files may remain inaccessible. Recovery usually depends on clean backups.
Is Windows 10 still safe to use in 2026?
Ordinary Windows 10 support ended on 14 October 2025. Consumer ESU can provide critical and important security updates until 13 October 2026, but upgrading to a supported operating system is the safer long-term option.
Conclusion
You can get rid of many viruses on Windows 10 without purchasing third-party antivirus software. Windows Security, Microsoft Defender Offline, Safe Mode and Windows recovery tools provide several built-in options.
Begin by disconnecting the computer and external drives, then protect only the personal files you genuinely need. Run quick, full and offline scans, review suspicious applications and clean up browser extensions and startup items.
Avoid risky manual deletion of system files and registry entries. Malware may use misleading names, several components or hidden persistence that is difficult to identify safely.
When an infection returns, disables security tools or involves ransomware, resetting or completely reinstalling Windows is safer than repeatedly attempting partial removal.
Finally, remember that Windows 10 reached the end of ordinary support on 14 October 2025. Virus removal should be followed by ESU enrolment, an upgrade to Windows 11 or replacement with a supported device.
Removing the immediate malware solves only one part of the problem. Keeping the operating system supported, protecting accounts and maintaining clean backups are what prevent the next infection from causing the same damage.