Antivirus and antimalware: a practical Windows recovery guide

Suspected malware is not the time to install several resident antivirus products at once. A better approach is sequential: isolate the computer, scan outside the running Windows installation, use a few independent on-demand scanners, then check what is configured to start automatically.

This guide is for home Windows PCs. In a business environment, or where company data may be exposed, contact the IT or security team first. If the PC is unstable, encrypting files, or showing a ransom demand, avoid rushed actions that could destroy useful evidence.

Principles before the first scan

1. Disconnect the suspected PC from the network, both Wi-Fi and Ethernet. If password theft is plausible, do not enter more passwords on it.
2. From another trusted device, change passwords for email, the password manager, banking, and important accounts; revoke active sessions where available.
3. Preserve important documents if appropriate, but do not run programs or macros from them. For a serious incident, notes, screenshots, and a timeline may also be valuable.
4. Download tools only from the links below or the vendors’ official sites. Ideally, download and update them on a known-clean computer.

Important: One active resident antivirus is enough. The tools in this article are primarily temporary, manually run second opinions. Do not run multiple products with permanent real-time protection at the same time.

A recommended toolkit

Tool	Role	How to use it
Microsoft Defender Offline	Scans outside the running Windows installation; useful for suspected stealthy malware	Start here
ESET Online Scanner	Independent one-time full scan	Main second opinion
Malwarebytes Free	Malware scan and cleanup	Second opinion after ESET
Malwarebytes AdwCleaner	Adware, PUPs, browser hijackers, and unwanted changes	Use for redirects, pop-ups, or unwanted extensions
Emsisoft Emergency Kit	Portable emergency scanner	Useful in a USB kit and as another check
Microsoft Safety Scanner	Portable, manually run Microsoft scanner	Download a fresh copy; it expires after 10 days
HitmanPro	Fast supplementary scan	Optional third opinion; trial available
Autoruns	Inspects automatic-start locations	Advanced persistence check

Modern Microsoft Defender is not merely an emergency default: independent AV-Comparatives testing continues to include it among current products. A particular test result is not a universal ranking, however — methods, threats, and settings differ. For recovery, current definitions, different detection approaches, and a sensible decision about whether to trust the system matter more.

Step-by-step recovery process

1. Run Microsoft Defender Offline

In Windows Security, open Virus & threat protection → Scan options → Microsoft Defender Offline scan → Scan now. The PC restarts and the scan runs outside ordinary Windows, reducing the chance that active malware can interfere with it.

If the system drive uses BitLocker, have the recovery key available. Microsoft recommends suspending BitLocker protection before this step, otherwise Windows may ask for the key during the restart.

After Windows starts again, run a Defender full scan and install available updates.

2. Run an independent ESET Online Scanner scan

Download ESET Online Scanner from its official page, run it, and choose a full scan. Enable detection of potentially unwanted applications (PUA/PUP) if the interface offers it. Review detections before removal to make sure an item is not software you intentionally use.

3. Target adware and browser changes

If the homepage or search engine changes, advertisements or pop-ups appear, or unknown extensions are installed, run AdwCleaner first. It specifically targets adware, PUPs, and browser hijackers.

Then run Malwarebytes Free as a wider scan. You do not need to keep the PC online between scanners; connect only when you need to update definitions or download a tool.

4. Confirm the result with another portable scanner

Emsisoft Emergency Kit is well suited to a prepared USB toolkit. Update it on a trusted device, transfer it to the suspected PC, and scan. For a higher-confidence check, add Microsoft Safety Scanner or HitmanPro.

Safety Scanner is not a replacement for resident protection, and it expires 10 days after download. Download a new copy for a later scan.

5. Inspect persistence and network activity

Antivirus mostly answers whether a file resembles a known threat. It does not always answer what has been configured to start automatically.

The most useful tools in the Sysinternals Suite are:

• Autoruns — logon items, services, drivers, scheduled tasks, and other automatic-start mechanisms;
• Process Explorer — processes, signatures, and loaded DLLs;
• TCPView — active network connections;
• Sigcheck — file signatures and hashes.

In Autoruns, enable signature verification and first investigate unknown, unsigned, or suspicious entries. Do not blindly delete Microsoft entries, drivers, or device-vendor software; establish where an item came from and what it does. Autoruns can disable an entry instead, which is a safer first action than deletion.

6. Finish the recovery and choose one resident product

Install updates for Windows, browsers, Office, drivers, and frequently used applications. Remove obsolete or unnecessary software, review browser extensions, and check proxy and DNS settings.

Finally, keep exactly one resident antivirus. Current Microsoft Defender is a sensible choice for many users. If you prefer another product, you can consider a trial of ESET HOME Security. Before installing a different resident product, remove the previous one according to the vendor’s instructions.

When scanning is not enough

Several clean scanner results do not prove that a PC is trustworthy. If there is evidence of an infostealer, remote-access trojan (RAT), bootkit/rootkit, compromised administrator account, or stolen keys and passwords, the safer response is to re-establish trust with a clean installation:

1. From a clean device, back up documents and data — not applications or executable files.
2. Create official Windows 11 installation media on a blank USB drive. Creating it erases the USB drive’s contents.
3. Wipe the system partitions and install Windows from that media.
4. Install updates first, then applications only from trusted sources.
5. Scan data before restoring it, and rotate all important passwords again from a clean device.

Antivirus cleanup removes known artefacts. A clean installation restores the operating system’s trust boundary. For a PC used for banking, SSH keys, API keys, password managers, or corporate access, that distinction is important.

What to keep on a recovery USB drive

On a known-clean computer, prepare a folder with Emsisoft Emergency Kit, AdwCleaner, Safety Scanner, HitmanPro, and Sysinternals Suite. Before using it, check each tool’s official source and update its definitions. Include Windows installation media as well, and store the BitLocker recovery key securely — but not in the same unprotected USB folder.

This toolkit does not replace backups. Regular, tested backups and an updated system remain the most reliable foundation for recovery.

Michael Princ