Is your antivirus disabled or infected? Is your PC too slow to install protection? Here are 5 proven techniques to remove viruses manually using Windows’ built-in tools. It is possible to remove a virus without antivirus software.
Why remove a virus manually
Emergency situations where manual removal becomes necessary: an antivirus blocked by the malware, a PC too infected to install new software, a work environment without administrator rights, or a computer too old for modern solutions.
Some sophisticated viruses deliberately disable Windows Defender and block the installation of third-party antivirus software. They modify the system registry to prevent any attempt at automatic cleanup.
Removing a virus without antivirus software helps you understand the infection: locate the malicious files, identify suspicious processes and clean up traces in the registry. This knowledge makes you more effective against future attacks.
Warning: these methods require precision. An incorrect change can damage Windows. Back up your important data before any manual intervention.
Method 1: Task Manager and Safe Mode
Restart in Safe Mode: hold Shift and click “Restart” → Troubleshoot → Advanced options → Startup Settings → “Enable Safe Mode”.
In Safe Mode, open Task Manager (Ctrl+Shift+Esc) and examine the “Processes” tab. Look for suspicious processes: random names, abnormal CPU/memory usage, unusual locations.
End the malicious processes: right-click → “End task”. Note the file location (right-click → “Open file location”) before deleting it.
Go to the folders you identified and delete the malicious files manually. Empty the Recycle Bin immediately to avoid any accidental restore.
Method 2: Cleaning up with built-in Windows tools
Windows Defender Offline works even if real-time protection is disabled. Settings → Update & Security → Windows Security → Virus & threat protection → Scan options → “Microsoft Defender Offline scan”.
System File Checker (SFC) repairs system files corrupted by viruses: open cmd as administrator → sfc /scannow. Allow 20-30 minutes for the full scan.
DISM (Deployment Image Servicing and Management) restores Windows’ integrity: DISM /Online /Cleanup-Image /RestoreHealth after SFC. These Microsoft tools remove 70% of common infections.
Advanced disk cleanup: cleanmgr /sageset:1 → tick all the boxes → OK → cleanmgr /sagerun:1 to clean up the temporary files where malware often hides.
Method 3: Manual removal via the Registry Editor
Back up the registry before making changes: regedit → File → Export → save it to external media.
Autostart locations to check:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Delete suspicious entries: random names, paths to temporary folders, .tmp or .exe files in unusual locations (%temp%, %appdata%).
Search by keyword: press Ctrl+F in regedit and search for the name of the virus you identified earlier. Carefully delete every reference you find.
Method 4: Free Microsoft rescue tools
Microsoft Safety Scanner (microsoft.com/safety/pc-security): a one-off antivirus with no installation, valid for a single scan over 10 days. Perfect for infected PCs that cannot install a permanent antivirus.
Windows Malicious Software Removal Tool: a Microsoft tool distributed via Windows Update that specialises in common infections. Run MRT from the Run dialog (Windows+R).
Microsoft Defender Offline: a bootable USB version that runs before Windows starts. Download it from a clean PC, create the rescue drive and boot from it.
These official Microsoft tools guarantee full compatibility with Windows and proven effectiveness against recent malware.
Method 5: System Restore and recovery points
Open System Restore: Control Panel → System → System Protection → “System Restore”. Choose a restore point from before the infection.
A restore undoes system changes (software, registry) without affecting your personal files. It is effective against viruses that modify Windows’ configuration.
Advanced alternative: Settings → Update & Security → Recovery → “Reset this PC” → “Keep my files”. This reinstalls Windows while preserving your data.
Immediately create a new restore point after cleaning to make future recovery easier in case of reinfection.
Prevention after manual cleanup
Install an antivirus immediately after cleaning: Windows Defender (free), Bitdefender or Kaspersky. Enable automatic Windows updates to close the security holes that were exploited.
Change all your passwords from a clean device, check your bank and email accounts, and watch for any suspicious activity. Viruses often steal data before they are detected.
Make regular backups to disconnected external media. It is your insurance against future infections and ransomware that encrypts your files.
You now know how to remove a virus without antivirus software!
Leave a Reply