How to Clean Malware Safely Without Losing Files

How to Clean Malware Safely Without Losing Files

A browser that opens unfamiliar pages, files that will not open, or a sudden stream of security warnings can make it tempting to click the first “fix” button you see. That is often how a minor infection becomes a bigger problem. Knowing how to clean malware safely means containing the threat first, protecting your accounts and data, then removing it methodically rather than taking risky shortcuts.

Malware is a broad term covering viruses, spyware, ransomware, unwanted browser extensions and other malicious software. Some infections are noisy, while others quietly collect passwords or use your device in the background. The right response depends on what has happened, how valuable the data is, and whether the computer is connected to a home or business network.

Start by containing the problem

If you suspect malware, disconnect the affected computer from the internet straight away. Turn off Wi-Fi, unplug the network cable and disconnect any shared drives or external storage that are not essential. This can stop an infection communicating with an attacker, spreading across a network, encrypting shared files or downloading further harmful software.

Do not immediately switch the PC off if it is displaying a ransomware message, unusual error code or clear evidence of unauthorised activity. Take a photograph of the screen with your mobile phone first. For a business, record the time the issue was noticed, the user involved and any suspicious messages or files. This information helps an IT professional understand what happened and whether other devices may be affected.

Avoid logging into email, online banking, Microsoft 365 or other important services from the suspected device. If you must change passwords, use a separate, known-clean device. Changing them on an infected computer can simply hand the new passwords to an attacker.

Check whether it is really malware

Not every slow PC has an infection. A full hard drive, failing hardware, an incomplete Windows update or too many programs running at start-up can all create similar symptoms. However, malware is more likely when you see unexplained pop-ups, new toolbars, security software disabled without permission, browser searches redirected, unfamiliar programs installed or account activity you do not recognise.

Be particularly cautious with pop-ups claiming that your computer is infected and urging you to call a number, install a cleaner or pay immediately. Genuine security alerts do not normally demand payment by telephone, gift card or cryptocurrency. Close the browser window if possible. If it will not close, use Task Manager to end the browser task rather than calling the number shown.

For organisations, one unusual device should be treated as a possible wider security incident until checks prove otherwise. A single compromised staff account can expose shared documents, customer information and cloud services, even where the original PC appears to be the only affected machine.

How to clean malware safely, step by step

Once the device is isolated, begin with a reputable security scan. Windows Security, built into supported versions of Windows, is a sensible first option when it is functioning normally. Update its definitions if this can be done safely, then run a full scan rather than relying only on a quick scan. A full scan takes longer but examines more of the system.

If the computer is behaving erratically or security tools will not run, restart into Safe Mode. This starts Windows with only essential services and can prevent some malicious programs from loading. From there, run a full scan and follow the tool’s recommendation to quarantine or remove detected threats. Quarantine is useful because it isolates a suspicious file while allowing it to be restored if it turns out to be legitimate.

Do not install several random “free cleaners” found through a web search. Rogue security programs often imitate trusted software and may add more unwanted applications. Use recognised security software obtained from its official publisher, and keep it updated.

After the initial scan, inspect the areas malware commonly changes. Check recently installed applications, browser extensions and your browser’s search engine and homepage settings. Remove extensions you do not recognise, especially those that claim to offer coupons, faster searching or video downloads. Review start-up applications too, as malware may configure itself to reopen whenever Windows starts.

The safest order is usually:

• isolate the device from networks and removable storage;
• scan with trusted, updated security software;
• remove or quarantine confirmed threats;
• restart and scan again to check for persistence;
• update Windows, browsers and installed applications; and
• change important passwords from a separate clean device.

A second scan after restarting matters. Some threats use scheduled tasks, hidden start-up entries or secondary files to reinstall themselves after the first removal attempt.

Protect files without spreading the infection

Backups are valuable, but copying everything from an infected PC without checking it can carry the problem into your backup. If you need to preserve documents, photos or work files, copy only essential personal data after scanning it. Avoid transferring program files, unknown downloads, executable files and browser extensions.

Ransomware needs a more cautious approach. Do not pay the ransom on impulse. Payment does not guarantee a decryption key, and it can encourage further criminal activity. Do not delete encrypted files either, as a suitable recovery option may become available later. Preserve the affected device, disconnect it, and seek expert advice before attempting recovery.

For business users, restore data only from backups that pre-date the incident and have been checked for integrity. It is worth confirming that backup accounts, storage locations and administrator credentials have not also been compromised. A backup is only useful if it is separate from the affected system and can be restored reliably.

Secure your accounts after removal

Removing malware does not automatically secure accounts that may have been exposed. From a clean device, change passwords for email first, then banking, cloud storage, work accounts, shopping sites and social media. Email is the priority because password resets for many other services are sent there.

Use unique passwords for every important account and enable multi-factor authentication where available. Check sign-in history, recovery email addresses, forwarding rules and connected devices. Attackers sometimes create hidden email forwarding rules so they can continue receiving messages after a password is changed.

If financial details may have been exposed, contact your bank using the number on its official website, statement or card. Monitor transactions and report anything unfamiliar promptly. For businesses, consider whether customer, employee or supplier information may be involved. Security and data protection obligations can depend on the information affected, so early professional assessment is sensible.

When a clean reinstall is the better choice

A security scan can remove many common infections, but it cannot always provide certainty. A full reinstall of Windows is often the safest option where there are signs of a serious compromise, such as ransomware, a remote access tool you did not install, repeated reinfection, disabled security controls or suspicious administrator accounts.

Reinstalling takes more time and requires a verified backup, but it gives a clean foundation. For a home PC, that may be the right trade-off if the machine contains years of personal photos and online accounts. For a business, rebuilding an affected device may be quicker and safer than trying to prove every malicious component has been removed.

Before wiping anything, make sure essential files are identified, licences and account details are available, and backups have been checked. If the device is part of a managed workplace environment, involve the IT provider before taking action. Deleting evidence or reconnecting too soon can make an incident harder to investigate.

Reduce the chance of another infection

The practical defences are straightforward: keep Windows, browsers and apps updated; use reputable security protection; back up important files regularly; and be cautious with unexpected attachments, QR codes and login requests. Most successful infections begin with a convincing message rather than an advanced technical attack.

For businesses, staff awareness, limited user permissions, multi-factor authentication and managed patching make a meaningful difference. Good cybersecurity is not about making work difficult. It is about creating enough checks that one rushed click does not become a costly outage.

If you are unsure whether a device is clean, do not guess with personal data or business systems at stake. Andromeda Solutions can assess suspicious PCs, remove malware safely and help put the right protections in place, so you can get back to using your technology with confidence.