Blog
How to remove viruses, spyware and trojans: theory and practice
Short answer: the most effective way to remove a virus, spyware or trojan is to scan the disk without booting the infected Windows (with a bootable antivirus or Live CD), end suspicious processes, and if all that fails, restore the system. In this long class I first explain the theory to avoid infections and then the practice to clean the computer. My rule: if after 30 minutes to an hour of cleaning the problem is still there, it is better to format and reinstall.
If you are searching for how to remove a virus from a PC, how to remove spyware or trojans manually or when to reinstall Windows after an infection, the order matters. First decide how much time the cleanup is worth, then scan without starting the infected Windows, then use safe mode and Task Manager if needed, and finally restore or reinstall.
Below I expand my video with a symptoms checklist, a first-response plan, a decision table, a prevention routine and an FAQ. This is general guidance from my experience as a technician. If the computer holds important data, back it up before you start (preferably by connecting the drive to another computer or booting from a rescue disk) and do not enter passwords on an infected PC.
In this article
- First: how to avoid viruses
- Decide how much time it is worth
- Scan with a bootable antivirus (Live CD)
- Boot into safe mode
- Find the process in Task Manager
- Run System Restore, then clean the browsers
- Signs your PC may be infected
- First-response plan
- Clean up or reinstall?
- After the cleanup
- Safe habits that prevent infections
- Frequently asked questions
- Watch the video
First: how to avoid viruses
These habits prevent most infections, for your own computer and to explain to your customers:
- Do not visit dangerous sites: adult sites, unknown "free" game sites and hacking sites often carry malicious code.
- Do not install cracked or pirated software: the cracks and patches that "unlock" programs like Photoshop or Office often bring viruses or trojans. If you do not want to pay, Linux and its free software are an alternative.
- Be careful with free software and trials: many installers from download sites add toolbars and other programs. Download from the manufacturer's site and choose the custom install to uncheck what you do not want.
- Be careful with flash drives, SD cards and external disks: they can carry hidden files like autorun.inf that run something when connected.
- Check external devices with a Live CD, which never gets infected.
- Use a limited user account (PC or Mac) instead of the administrator for everyday work.
- Put a password on the administrator account, so a virus has a harder time taking control.
- Set up OpenDNS on the router to filter dangerous sites for every computer on the network.
Step 1: Decide how much time it is worth
In my experience, if cleaning takes more than 30 minutes or an hour, the practical move is to erase and reinstall: in less than an hour you have everything working. If you prefer to clean, follow the steps.
- My rule. If cleaning takes more than 30 to 60 minutes, a clean reinstall is often faster and safer.
- Back up first. Save documents, photos and other personal data. Do not copy programs or unknown files.
- Consider the risk. If the PC has banking, work or customer data, change passwords from a clean device.
Step 2: Scan with a bootable antivirus (Live CD)
Several antivirus vendors (Microsoft Essentials, AVG and others are mentioned in the video) offer an ISO image on their site. Download it and burn it on another computer that is not infected, then boot the sick PC from that CD, DVD or USB. That way the whole hard drive is checked without using the infected Windows, and nothing interferes with the process. If you need to boot from USB, see how to make a bootable USB.
Another option, which I do not recommend as much, is to remove the drive and connect it as a secondary disk to a healthy computer to scan it from there.
- Use another computer to download and prepare the rescue disk or USB.
- Boot from it so Windows does not start and cannot hide the infection.
- Update, then scan the whole drive and review what it finds before you delete anything.
Step 3: Boot into safe mode
If you have to work from Windows, start in safe mode (or safe mode with networking if you need internet). If you can, use safe mode without networking. The msconfig tool helps you configure the startup and see what loads when the computer starts.
- Safe mode loads fewer programs, so many threats do not start.
- Without networking is safer if you do not need internet.
- Look at startup items with msconfig or the Startup tab in Task Manager.
Step 4: Find the process in Task Manager
If the virus is still there after all of that, open Task Manager with Ctrl + Shift + Esc and look at the programs still running. When you identify the name of the virus or suspicious program, try to end it. If it will not close, write the name down on paper so you can find it and rename or delete it.
- Open Task Manager with Ctrl + Shift + Esc.
- Check unknown names. Search for the exact process name on a clean device before you end it.
- Write down names and locations of anything suspicious.
Step 5: Run System Restore, then clean the browsers
If you found and removed the viruses but the computer still does strange things, or the antivirus did not catch everything, run System Restore to go back to a point before the infection.
Chrome, Firefox or Internet Explorer often end up full of junk toolbars and extensions. Check the installed extensions in each browser and remove any you do not recognize.
- System Restore returns system files to an earlier point and may not fix everything.
- Browser cleanup. Remove unknown extensions and reset the browser settings if the home page or search engine changed.
- Change passwords after the PC is clean.
Signs your PC may be infected
| Symptom | What it may mean |
|---|---|
| Browser home page or search engine changed | Unwanted extension or adware |
| Pop-ups when the browser is closed | Adware or unwanted software |
| PC is much slower than before | Unwanted programs running in the background |
| Antivirus turned off by itself | Possible malware |
| Unknown programs or toolbars | Bundled software or adware |
| Files locked or ransom message | Ransomware. Disconnect from the network and ask for expert help |
First-response plan
- Disconnect from the internet and the local network.
- Do not log in to banking or email on the PC.
- Back up the personal files you need, ideally from a clean environment.
- Scan with a rescue disk.
- If problems remain, use safe mode, Task Manager and System Restore.
- If it takes more than an hour, back up and reinstall.
- Change your passwords from another device.
Clean up or reinstall?
| Situation | Better choice |
|---|---|
| A single unwanted toolbar | Clean up |
| Several unknown programs and many symptoms | Reinstall |
| Ransomware | Reinstall after getting expert help, and restore from backups |
| You have no time to monitor the cleanup | Reinstall |
| Important system files are damaged | Reinstall |
After the cleanup
- Install Windows updates and update your programs.
- Use the built-in security tools or a trusted antivirus from the maker's own site.
- Create a standard user account for everyday work and keep the administrator account for installs.
- Back up your files regularly to an external drive or a cloud service.
- Review browser extensions every few months.
Safe habits that prevent infections
Avoid cracked software and sites that offer it, because many carry unwanted code. Download programs from the manufacturer's site, and read each installer screen so you can uncheck extra offers. Be careful with flash drives and email attachments. Use a router or DNS service that filters dangerous sites if you want an extra layer, and keep your system updated.
For related guides, see how to make a bootable macOS USB without extra software, how to block spammers in a WhatsApp group and how to disable Windows efficiency mode.
Frequently asked questions
What is the safest way to scan an infected PC?
Boot from a bootable antivirus (Live CD) burned on another healthy computer, so the whole disk is scanned without using the infected Windows.
When should I format instead of cleaning?
If cleaning takes more than 30 minutes to an hour, it is better to erase and reinstall.
How do I open Task Manager?
With Ctrl + Shift + Esc. There you can see running programs and end the suspicious one.
Why should I avoid cracked programs?
Because cracks and patches often carry viruses or trojans that can steal information, for example credit card data.
Do Linux or Mac get infected?
They can get some viruses or spyware, but far fewer than Windows, which is the most attacked system.
What is the best way to remove a virus?
Scan with a bootable rescue disk, so Windows does not start. Then use safe mode and Task Manager if something remains.
When should I reinstall Windows?
If cleaning takes more than 30 to 60 minutes, or if you are not sure the PC is clean, back up your data and reinstall.
Is it safe to use the PC while it is infected?
Avoid banking and password entry until the PC is clean.
Does System Restore remove all viruses?
Not always. It can help, but you should still scan the PC.
Should I change my passwords after a cleanup?
Yes, from a clean device.
Watch the video
Comments
Comments appear after Gabriel reviews them.
Loading comments…