Best Malware Removal Tools for Windows

Quick picks

Best overall: Malwarebytes Free — a thorough on-demand scanner that excels at adware and unwanted programs.
Best built-in option: Microsoft Defender Offline scan — scans before Windows loads to catch hidden malware.
Best portable scanner: Emsisoft Emergency Kit — runs from a folder or USB drive with no installation.
Best for adware and hijackers: Malwarebytes AdwCleaner — fast, free, and focused on browser junk.
Best one-time online scan: ESET Online Scanner — free, uses ESET's detection engine, and uninstalls afterward.
Best when Defender is broken: Microsoft Safety Scanner — a standalone Microsoft scanner that needs no installation.

How we chose

Ability to find and remove real malware, adware, and potentially unwanted programs, based on vendor track record and independent reputation.
Whether the tool runs alongside your existing antivirus without conflicts.
Clear results that explain what was found and let you quarantine items rather than delete them outright.
Genuinely free use, or clearly stated limits on what the free version can do.
Options for badly infected PCs, such as portable mode, offline scanning, or working when Windows Security is broken.
Active development: every tool here is still maintained and receiving detection updates.

1. Most people cleaning up an infected PC

Malwarebytes Free

Malwarebytes is one of the best-known cleanup tools for Windows. The free version runs full on-demand scans for malware, adware, and potentially unwanted programs, shows exactly what it found, and quarantines detections so you can restore anything flagged by mistake. It installs alongside Microsoft Defender or another antivirus without conflicts. A new install includes a 14-day Premium trial with real-time protection, after which it reverts to a manual scanner unless you subscribe. That makes it an easy tool to keep installed for occasional second-opinion scans.

Pros

Strong at adware and potentially unwanted programs
Quarantine lets you undo false positives
Runs alongside your main antivirus
Easy for beginners

Cons

No real-time protection once the Premium trial ends
Regular prompts to upgrade to Premium

Pricing: Free for manual scans and removal; includes a 14-day Premium trial, and Premium is a paid subscription.

Get Malwarebytes Free

2. Rootkits and malware that hides while Windows runs

Microsoft Defender Offline scan

Built into Windows 10 and 11, the offline scan restarts your PC into a trusted environment and scans before Windows fully loads, so malware that hides itself or blocks removal while Windows is running can be found and cleaned. Start it from Windows Security > Virus & threat protection > Scan options, choose Microsoft Defender Antivirus (offline scan), and select Scan now. Save your work first, because the PC restarts. Results appear afterward in Protection history. It costs nothing, needs no download, and uses Microsoft's current definitions.

Pros

Free and already on your PC
Scans outside the running copy of Windows
No third-party software needed

Cons

Restarts the PC and takes it out of use while it runs
Less helpful if malware has already disabled Defender

Pricing: Free and included with Windows 10 and Windows 11.

See how to run it

3. Badly infected PCs and USB rescue toolkits

Emsisoft Emergency Kit

Emsisoft Emergency Kit is a free, fully portable scanner: download it, extract it to a folder or USB drive, and run it without installing anything. That matters when malware blocks installers or your main antivirus. It uses Emsisoft's dual-engine scanning technology, can update itself and its detection data before scanning, and includes a command-line scanner for advanced use. Detections go to quarantine. Emsisoft is also known for publishing free ransomware decryption tools, which are worth checking if files have been encrypted. It requires 64-bit Windows 10 or later.

Pros

No installation, runs from a USB drive
Dual-engine detection
Command-line scanner for advanced use

Cons

On-demand only, with no real-time protection
Large download because detection data is bundled

Pricing: Free to download and use for scanning and removal.

Get Emsisoft Emergency Kit

4. A free one-time second opinion from a major vendor

ESET Online Scanner

ESET Online Scanner is a small free download that pulls in ESET's current detection engine and runs a one-time scan, with a choice of full, quick, or custom scans and an option to detect potentially unwanted applications. It can remove or quarantine what it finds and doesn't conflict with your existing antivirus, because it doesn't provide real-time protection. When you're done, you can uninstall it. It's a good pick when you want a different engine from Microsoft or Malwarebytes to double-check a PC.

Pros

Free, from a long-established security vendor
Different engine from Defender and Malwarebytes
Optional detection of potentially unwanted apps

Cons

Windows only
Needs an internet connection to download its detection engine

Pricing: Free; ESET sells separate paid HOME Security plans for real-time protection.

Get ESET Online Scanner

5. Adware, unwanted toolbars, and browser hijackers

Malwarebytes AdwCleaner

AdwCleaner is a small, free Malwarebytes tool focused on the junk that full antivirus often treats as low priority: adware, unwanted toolbars, potentially unwanted programs, and browser hijackers that change your homepage or search engine. It runs without a full installation, scans quickly, and quarantines what it removes, so you can restore items if needed. Its settings also include optional basic repair actions, such as resetting browser policies, which can help with 'managed by your organization' hijacks. It isn't a full antivirus, so use it alongside one.

Pros

Free and fast
Targets adware and hijackers specifically
Quarantine and restore options

Cons

Not a replacement for real-time antivirus
Narrow focus, so pair it with a full malware scan

Pricing: Free.

Get AdwCleaner

6. A fast, cloud-assisted extra check

HitmanPro

HitmanPro, now part of Sophos, is a quick, lightweight scanner designed to run alongside your existing antivirus. It looks for suspicious files and behavior and checks them against cloud-based threat intelligence, so the download is small and scans are short. Scanning is free, but removing what it finds requires activating a free 30-day trial and then buying a license. That makes it best as an occasional second opinion or a short-term cleanup tool rather than something to keep paying for if you already have good protection.

Pros

Small download and quick scans
Designed to coexist with other antivirus
Backed by an established security vendor

Cons

Removal needs a trial activation and then a paid license
Requires an internet connection for cloud checks

Pricing: Free to scan, with a 30-day free trial for removal; ongoing use requires a paid license.

Visit HitmanPro

7. A free Microsoft scan when Defender isn't working

Microsoft Safety Scanner

Microsoft Safety Scanner is a free, portable scan tool from Microsoft that uses the same security intelligence as Defender. It's useful when Windows Security won't open or Defender has been disabled, because it runs as a standalone file with no installation. Each download expires 10 days later, so download a fresh copy before every scan. It only scans when you run it and doesn't replace real-time antivirus. Detailed results are logged to %SYSTEMROOT%\debug\msert.log, and you can simply delete the file when you're done.

Pros

Free and from Microsoft
Works even when Windows Security is broken
No installation required

Cons

Each download expires after 10 days
Basic interface with limited on-screen reporting

Pricing: Free.

Get Microsoft Safety Scanner

Buying guide

Second-opinion scanners vs real-time protection

Real-time antivirus, such as Microsoft Defender or a paid suite, runs constantly and blocks threats as files open, downloads arrive, and programs start. A second-opinion scanner runs only when you start it. It uses a different detection engine to double-check the PC, which helps because no single engine catches everything. The tools on this list are designed to work alongside your main antivirus without conflicts, so you don't need to uninstall anything to use them. What you shouldn't do is install two full real-time antivirus products at once. Use a scanner when something feels wrong, after removing an infection, or as an occasional check, and keep real-time protection on in between.

Which tool to use for which problem

Start with what's already on your PC: a Microsoft Defender full scan, then an offline scan for anything that hides or resists removal. For general cleanup, Malwarebytes Free is the easiest second opinion. If your homepage or search engine keeps changing or you're seeing ad pop-ups, run AdwCleaner. If malware blocks installers, or you're cleaning someone else's PC from a USB drive, use Emsisoft Emergency Kit. If Windows Security won't open, Microsoft Safety Scanner and ESET Online Scanner work independently of Defender. HitmanPro is a fast extra check, but expect to activate its trial if you need it to remove anything. Running two or three scanners one after another is fine; running them all at the same time isn't.

Download safely and remove carefully

Fake 'virus removal' tools are a common way to spread malware, so download scanners only from the vendor's official website, never from pop-ups, ads, or third-party download sites. Be wary of copies of discontinued tools, too: Norton says Norton Power Eraser was discontinued in April 2026 and no longer works, so copies still offered elsewhere are outdated at best. Before a big cleanup, create a restore point by searching Start for 'Create a restore point' and selecting Create on the System Protection tab. Choose Quarantine rather than permanent deletion so you can restore anything flagged by mistake, and review 'potentially unwanted' detections, since some may be tools you installed on purpose.

When a scanner isn't enough

Scanners are good at removing known malware, but some situations call for more. If ransomware has encrypted your files, disconnect the PC, don't pay, and check Emsisoft's free decryptors and the No More Ransom project before restoring from backup. If an infection keeps returning after several clean scans, something persistent remains, and resetting Windows with Remove everything is the reliable fix. If you found remote-access software you didn't install, or malware that steals passwords, assume your accounts are exposed: change passwords from a clean device and turn on two-factor authentication. And if the PC belongs to your employer or school, stop and contact IT rather than cleaning it yourself.

FAQ

Can I run a malware removal tool alongside my antivirus?

Yes. Every tool on this list is an on-demand scanner designed to coexist with Microsoft Defender or a paid antivirus. They only run when you start them, so they don't fight your main antivirus over files. Just avoid running several scanners at the same moment, and don't install a second full real-time antivirus suite alongside your existing one.

Are free malware removal tools safe to use?

The ones here are. Malwarebytes Free, AdwCleaner, Emsisoft Emergency Kit, ESET Online Scanner, and Microsoft Safety Scanner are free from well-established security companies. The risk comes from fake removal tools advertised in pop-ups or on unfamiliar download sites, which are often malware themselves. Always download from the vendor's official website, and be suspicious of any tool that finds problems and then demands payment to fix them.

What happened to Norton Power Eraser?

Norton says it discontinued Norton Power Eraser on April 30, 2026, and the tool no longer works or receives updates; its capabilities now live in Norton's paid security apps. If you relied on it as a free, aggressive scanner, the Microsoft Defender Offline scan, Emsisoft Emergency Kit, and Malwarebytes Free cover similar ground. Avoid downloading old copies from third-party sites.

Do I need Safe Mode to remove malware?

Not always. Many infections come off with a normal scan. Safe Mode with Networking helps when malware restarts itself, blocks your scanner, or stops files being deleted, because only essential Windows components load. The Microsoft Defender Offline scan goes a step further by scanning before Windows starts. If your drive uses BitLocker or device encryption, have your recovery key ready before restarting into Safe Mode.

Will these tools remove ransomware?

They can remove the ransomware program itself, but they can't decrypt files that have already been encrypted. For that, check whether a free decryptor exists through Emsisoft's decryptor collection or the No More Ransom project, and otherwise restore from a backup that wasn't connected during the attack. After any ransomware incident, resetting Windows is the safest way to make sure nothing remains.

Which scanner is best for adware and pop-ups?

Malwarebytes AdwCleaner is the most focused option for adware, unwanted toolbars, and browser hijackers that change your search engine or homepage. Run it first, then follow up with Malwarebytes Free or a Microsoft Defender full scan to catch anything more serious that came in the same bundle. If pop-ups appear in the corner of your screen, also check your browser's notification permissions.

Related guides

How to Remove Malware from Windows

The full step-by-step cleanup process, from disconnecting to resetting Windows.

Browser Hijacker Removal

Fix a changed search engine or homepage in Chrome, Edge, and Firefox.

Best Antivirus for Windows 11

Real-time protection picks to keep the PC clean after you've removed an infection.

Windows Defender vs Bitdefender

Whether the built-in antivirus is enough, or a paid suite is worth it.