Removing malware without formatting may be possible, but it should not turn into a race to “delete suspicious things” until the computer appears normal. The priority is to contain the device, preserve important data and evidence, run trusted tools, and decide whether the installation can still be trusted.
This URL received 21 impressions in 90 days for “remove virus without formatting.” The page therefore survives, but with a safer workflow than the previous version: no blind Registry edits, no disabling processes merely because of their names, and no assumption that every infection can be recovered without reinstalling.
1. If you suspect active data theft, contain first
Temporarily disconnect the network when you see signs such as:
- windows or processes appearing by themselves;
- browser redirection;
- antivirus disabled without explanation;
- unknown account logins;
- encrypted files;
- unusual network activity;
- account security alerts.
If the device belongs to an organization, do not begin improvised cleanup before notifying IT or security. The organization may need to preserve logs, identify other affected devices, or follow an incident-response procedure.
2. Do not use the compromised computer to change passwords
If you suspect an infostealer, keylogger, or remote access, change important credentials from another device you consider clean.
Prioritize:
- primary email;
- password manager;
- banking and payment accounts;
- work accounts;
- social networks;
- services where you reused the same password.
Close active sessions when the service allows it and enable multifactor authentication. Changing a password from a potentially compromised machine may expose the new credential too.
3. Update security intelligence and run Windows Security
On Windows 10 and 11, Microsoft Defender Antivirus is part of Windows Security when another product has not taken over that role.
Microsoft recommends keeping security intelligence current and running a full scan when malware is suspected. Open:
Windows Security → Virus & threat protection → Scan options
Start with a full scan when the system is stable enough to operate.
Do not interpret “no threats found” as absolute proof that the computer is clean. It is one signal in the assessment.
4. Use Microsoft Defender Offline for persistent malware
If the threat returns, interferes with antivirus, or appears to hide while Windows is running, Microsoft Defender Offline can scan after a restart, outside the normal Windows session.
Save your work first because the computer will restart.
Microsoft documents this scan specifically for threats that may defend themselves or hide while Windows is running.
5. Review installed applications, but do not delete by intuition
You can review recently installed applications and browser extensions, particularly when symptoms began after installing questionable software.
Avoid rules such as:
“If the name looks strange, delete it.”
Legitimate software may use unfamiliar names, while malware may imitate official ones.
Before uninstalling something:
- verify publisher and origin;
- check when it was installed;
- determine whether it belongs to known software;
- review antivirus detections;
- document what you are changing.
6. Do not edit the Registry as a routine cleanup step
The old version of this article recommended manually checking Registry Run keys and deleting “suspicious” entries. That is poor general advice for beginners.
A Registry entry does not prove that a file is malware, and deleting the wrong one can break legitimate software or login behavior.
Manual Registry editing should be reserved for a specific, documented diagnosis, not included in a universal virus-removal recipe.
7. Check browser extensions and settings
When the main symptom occurs in the browser:
- review installed extensions;
- remove those you confirm you do not need or did not authorize;
- verify the search engine and home page;
- review site-notification permissions;
- check whether the browser is controlled by policies you do not recognize;
- update the browser.
A page that displays aggressive notifications does not necessarily mean the whole Windows installation is infected. It may be a browser permission or an extension.
8. Back up data before destructive recovery
If you can still access important documents, prepare a backup before reinstalling, but avoid moving executables and suspicious files without review.
A useful backup may prioritize:
- documents;
- photographs;
- projects;
- work files;
- required exports.
Then scan the backup from a trusted environment before restoring it to the rebuilt system.
9. When should you stop trying to “clean” and reinstall?
A clean reinstall may be the more reasonable choice when:
- you can no longer trust the system state;
- malware returns after scans;
- security tools were altered;
- unauthorized administrative access occurred;
- ransomware or deep compromise is involved;
- the computer holds sensitive information and you need a known-good state;
- investigation time exceeds the cost of rebuilding the system.
The question is not only “can I make the symptoms disappear?” but “can I trust this installation again?”
10. After cleanup or reinstall
Complete the recovery:
- install operating-system updates;
- update browsers and applications;
- remove software you no longer use;
- enable backups;
- review accounts and sessions;
- change affected credentials from a clean device;
- enable MFA;
- confirm Windows Security is working;
- observe the computer during the following days.
For a business incident, document the date, symptoms, affected accounts, tools used, and outcome.
Avoid fake “antivirus” and cleanup utilities
A desperate search for “remove virus” can lead to installers that claim to find hundreds of problems and then demand payment or install more unwanted software.
Start with operating-system vendor tools and known sources. Microsoft maintains current documentation on virus and threat protection and malware detection and removal troubleshooting.
What if the computer will no longer be used?
Do not donate an infected computer on the assumption that another organization will “clean it later.” If you plan to hand over, sell, or recycle a computer, resolve data security first and confirm the recipient's conditions.
Crezendo evaluates technology-donation inquiries case by case; it does not automatically accept devices “in any condition.” Use the donation page when the equipment has been identified and you can describe its condition.
A safer workflow in summary
- contain when there is active risk;
- change credentials from another device when required;
- update and run a full scan;
- use Defender Offline when the threat persists;
- review the browser and applications using evidence;
- avoid indiscriminate manual edits;
- back up important data;
- reinstall when the system can no longer be trusted;
- close the incident with updates, MFA, and backups.
Removing malware without formatting is a possible objective, not an obligation. When trust in the system is gone, a clean rebuild may be safer and faster than continuing to chase symptoms.
