Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsSafe Mode can help troubleshoot Windows, but it is not Microsoft’s recommended way to remove malware that returns after a restart. For that situation, Microsoft recommends Microsoft Defender Antivirus (offline scan): it restarts the PC and scans in Windows Recovery Environment, outside the normal Windows session. Save your work first, then check Protection history when Windows starts again.
When malware symptoms are a reason to scan
A sudden slowdown, shorter battery life, increased data use, unexpected ads or pop-ups, and browser redirects can be clues that prompt a malware scan. None proves infection on its own; other software, settings, or hardware issues can cause similar symptoms.
As an Amazon Associate I earn from qualifying purchases.
Microsoft lists these signs as reasons to scan, not as a diagnosis.
Update Defender and run a scan in Windows
- Update security intelligence. In Windows Security, check for the latest Microsoft Defender Antivirus security intelligence before scanning. Microsoft recommends using current security intelligence when checking for unwanted software.
- Run a full scan. Open Windows Security > Virus & threat protection > Scan options, select Full scan, and start it. Windows Security also provides quick and custom scan options.
Microsoft’s unwanted-software guidance recommends updating security intelligence and running a full scan. A clean result is useful, but it does not prove that a PC has never been compromised.
#1 Best Overall
- A compact, plug-and-stay, high-speed USB 3.2 flash drive that’s ideal for adding more storage to laptops, game consoles, in-car audio and more
- Simple, fast way to add up to 16GB of storage to your device [1GB=1,000,000,000 bytes - Actual user storage less]
- Write faster than standard USB 2.0 drives(1) [(1) Up to 130MB/s read speed; USB 3.2 Gen 1 or USB 3.0 port required; Based on internal testing; performance may be lower depending on host device; 1MB=1,000,000 bytes]
- Move a full-length movie faster than standard USB 2.0 drives(2) [(2) Write faster than standard USB 2.0 drives (4MB/s); USB 3.2 Gen 1 or USB 3.0 port required; Results may vary based on host device, file attributes and other factors]
- Keep private files private with included SanDisk SecureAccess software(3) [(3) Password protection uses 128-bit AES encryption and is supported by Windows 7, Windows 8, Windows 10 and macOS v10.9+ (Software download required for Mac, visit the official SanDisk website for SecureAccess details)]
Run Microsoft Defender Offline for malware that returns
If the same threat is detected again after a restart, use the offline scan rather than assuming Safe Mode is an equivalent cleanup option. Microsoft explains that a component can reinstall detected malware, leading to another detection after reboot. Its guidance says: “If the same malware keeps infecting your PC, use Windows Defender Offline to look for and remove recurring malware.”
- Save open files and close your apps. The scan restarts your PC.
- Open Windows Security > Virus & threat protection > Scan options.
- Select Microsoft Defender Antivirus (offline scan), then choose Scan now and confirm if prompted.
- Let the PC restart and complete the scan. Defender Offline runs in Windows Recovery Environment without loading the normal Windows session; Windows restarts after scanning finishes.
- After Windows starts, open Windows Security > Protection history to review the result and any actions taken.
Microsoft says the offline environment makes persistent malware harder to hide or defend itself: “This happens after a restart, without loading Windows, so any persistent malware has a more difficult time hiding or defending itself.” Menu wording can vary slightly by Windows release or device configuration.
See Microsoft’s Defender Offline instructions for scan options and behavior, and its recurring-malware troubleshooting guidance for why a detection may return.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- WHAT YOU GET: FixMeStick Virus Removal Tool for Apple Macs (Macs from 2006 to 2017. 2018 and later systems are NOT compatible. Special instructions required for FileVault. A minimum of 512 MB of RAM. Not compatible with Fusion Drive and RAID storage systems. Not compatible with Bluetooth mice or keyboards. Can’t decrypt files encrypted by ransomware.), Getting Started Guide, our virus removal guarantee backed by our friendly Canadian based Customer Support Team.
- EXPERT TECHNOLOGY ANYONE CAN USE: plug it in and the FixMeStick reboots your computer from a system on the stick to remove viruses that snuck past your antivirus software.
- REMOVES THE LATEST THREATS: The FixMeStick automatically updates its engines for up-to-the-second detection and removal of the latest threats.
- SAVE TIME: Save a trip to the repair store and run the FixMeStick once a month from the comfort and privacy of home. FixMeStick removes viruses, Trojans, rootkits, ransomware, or other malware lurking on your system.
- PEACE OF MIND: As Macs become more popular more hackers are creating viruses specifically targeting them. Feel confident and secure knowing your Mac is clean with the FixMeStick.
Where Safe Mode fits—and where it does not
Safe Mode is a diagnostic startup option for troubleshooting Windows when normal startup is problematic. It is reached through Windows Recovery Environment startup settings. That makes it useful for investigating startup or software problems, but it does not make Safe Mode interchangeable with Defender Offline.
Microsoft’s malware guidance specifically recommends Defender Offline for a threat that returns after restart. It does not establish that an ordinary Defender scan is available or behaves identically in every Safe Mode configuration. If malware may be hiding while Windows runs, follow the offline-scan steps above. For Safe Mode startup instructions, see Microsoft’s Safe Mode guide.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Review detections and decide what to do next
Check Protection history
Protection history shows Defender actions and threat events. Microsoft says events remain there for two weeks; administrator privileges are required to view threat details. If you cannot see a detail, check that you are using an administrator account. See Microsoft’s Protection history guidance.
Rank #3
- RANSOMWARE, PC FAILURE, WATER SPILLS! We've made backing up your computer so easy, you won't have to think about it.
- BACK UP CLEAN FILES ONLY - ensures you have a clean version of your files in case something bad happens to your computer.
- EASY TO USE: plug it in to clean viruses and malware from your PC and automatically back up the clean files right onto the stick.
- NO CLOUD: You have full control of your files, all the time - They're not on some cloud somewhere - they're on your BackMeUp stick!
- WHAT YOU GET: FixMeStick with BackMeUp, Unlimited Use on up to 5 PCs for 2 Years, Getting Started Guide.
If the same detection appears again
Do not assume that deleting one visible file will remove the cause. Microsoft’s troubleshooting guidance describes cases where another component silently reinstalls the detected malware. Follow Defender’s recommended actions and use the offline scan; if the detection persists, consult Microsoft’s recurring-malware troubleshooting steps.
Recommended Free Tools
If the infection caused lasting damage
Microsoft says a PC reset may be considered if malware has caused irreversible changes. Before resetting or reinstalling, back up wanted files and settings. When possible, use an external backup. Avoid copying suspicious executable files or blindly restoring a system image that may contain the infection. A backup drive is only for safeguarding files; it does not detect or remove malware.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
