Windows viruses vary a lot as to what they do. So, how you can deal with an infection will depend upon whether Windows still loads or not. But whatever situation you're in, we're here to help you remove that virus and get your computer working again.

Not sure if it's a virus? Here are a few things that indicate malware is at work:

  • Windows is running abnormally slowly
  • You're seeing lots of pop-up messages that you didn't see before
  • Programs start up that you don't recognise
  • You can't access your files

How to remove a virus from Windows

If you have antivirus software installed, run a scan. If that fails to detect anything, follow these steps carefully and in order, and do not restart your machine until you've completed every step:

  1. Some malicious programs will actively try and stop you removing them. To combat this download and run rkill
  2. Download and install the latest version of Malwarebytes. Launch the program, then go to Settings > Protecton > Scan for rootkits. Return to the dashboard and click Scan Now
  3. Install and launch Malwarebytes ADWcleaner, then click Scan

This should find and remove the virus. And you should now be able to use your PC as normal.

How to remove a virus when Windows doesn't work

If you can't get into Windows to run a virus scan, you'll need to create a recovery tool that you can use to boot up your computer. Of course, in order to do that, you will need access to a second PC or laptop and USB stick which can be wiped of any existing contents.

Next, download the Norton Bootable Recovery Tool

Although we've said to use a USB memory stick you can also use a writable CD or DVD if that's all you have. Insert the disc into the drive (of a DVD burner). Browse to the Norton Bootable Recovery Tool file you just downloaded, right-click NBRT.iso and choose 'Burn disc image'. In the Windows Image Burner select the disc drive and click Burn.

If you’re using a USB stick instead of a disc you should download and install the Rufus tool. 

Insert your USB stick into a port on the working PC. Under Format Options select 'ISO Image' from the drop-down menu next to 'Create a bootable disk using'. Click the disc drive icon, navigate to the Norton Boot Recovery Tool file and select NBRT.iso. Click Start, then Ok. Note that this will erase all files on the USB stick.

Now insert your recovery disc or USB drive into the infected PC.

Turn on the machine, but rather than letting it try to start Windows, you need to enter the BIOS menu. A key on your keyboard - often F2 but you should see a message on-screen telling you which key to press - will allow you to open the BIOS.

Look for the Boot options, then set the disc or USB drive as the first drive. The exact process varies because each BIOS is different, but it should be fairly obvious.

Save your changes and exit the BIOS. Your machine will now boot up from the specified drive.

If a boot menu appears on the 'Welcome to NBRT page' select Boot, then follow the prompts to begin a scan

Once complete you'll be presented with any found threats and recommended next steps. Be sure to 'fix' only genuine threats because your actions cannot be undone.

Once you're happy with your selections click Fix, and OK when prompted for confirmation. Click Reboot when the process has finished

How to stop your Windows computer getting another virus

The best way to keep your computer safe on the internet is to ensure that your antivirus is up to date. Windows 10 has a built-in firewall, and an effective antivirus in the form of Windows Defender.

Extra protection is always a good idea though, and these are our recommendations for the best antivirus software.

Also, take care not to open email attachments unless you are certain about what they contain and who they are from, and to download software only from trusted sources. When you are browsing the web double-check the address of the website to ensure it is the real deal and not a fake one looking to steal your login details or trick you into downloading malware.

Check out more tips for staying safe from ransomware.

Related articles for further reading