How to Remove a Virus From Your Computer Without Antivirus Software

Manually remove viruses on Windows 10

Ones and zeros behind a golden skull and crossbones.

 Gerd Altmann/Pixabay

Anyone who uses the internet can get a computer virus. There are countless antivirus programs that detect and remove malware, but it's also possible to manually uninstall suspicious software in Windows 10 without an antivirus tool.

Instructions in this article apply to Windows 10, but you can follow the same steps in older versions of Windows.

Causes and Symptoms of Computer Viruses

Viruses are downloaded from the web or external devices such as USB drives. They are often disguised as innocuous files, such as documents or videos. Signs that your computer is infected include:

  • You receive error messages while performing mundane tasks.
  • You keep seeing strange pop-up windows.
  • Your browser homepage redirects you to unfamiliar websites.
  • Your computer suddenly starts running slow or crashing.

How to Remove a Virus From Windows 10 Without Antivirus Software

No matter how your computer contracts a virus, the removal process is the same. Follow these steps until your problem is resolved.

  1. Look for any newly installed software. Go to Settings > Apps and scroll through the list of Apps & features. If you find something you don’t recognize, select the app, and then select Uninstall.

    Look up unknown apps online before uninstalling in case it is something your PC needs. 

    Windows settings to add or remove apps.
  2. Check the Task Manager for any suspicious or unfamiliar services. To access Task Manager, press Ctrl + Shift + Esc on your keyboard. Select the Services tab and look through the list that's provided. If you see anything unfamiliar or suspicious, right-click the service and select Stop.

    Windows services shown from the task manager.
  3. Check for any unusual apps in your Startup. With the Task Manager still open, select the Startup tab. If you find a suspicious file, select it, and then select Disable.

    A process in Startup task manager is selected.
  4. Check for unknown processes. With the Task Manager still open, select the Processes tab. If you find something out of the ordinary, select the item, then select End task.

    You can also access most of these settings with the System Configuration utility.

    Ending a task in system processes.
  5. Open the Command Prompt as an administrator. If problems persists and you can't remove the virus via your App Settings, you can uninstall it using the Command Prompt if you know the file's location.

    Type Command in the Windows search box, then right-click Command Prompt and select Run as administrator.

    You must have the administrator password to use the Command Prompt.

    Searching for command Prompt in Windows.
  6. Open the drive. In the Command Prompt window, enter the letter of the drive containing the suspected virus followed by a colon. For example:

    C:

    If done correctly, the Command Prompt window should look like the screenshot below:

    A command prompt window has been opened up.
  7. Locate the file path. Enter CD\filepath where filepath is the location or the suspected virus. For example:

    cd\demo
    Changing to another directory in command prompt.
  8. Open the directory. Enter dir to see the contents of the directory (minus any hidden files or folders).

    Command prompt showing the contents of the demo directory.
  9. Search for hidden files and folders. To display hidden files/folders with the attrib command, enter:

    Attrib -s -h *.* /s /d

    This command tells attrib to clear system attributes (-s) and clear hidden file attributes (-h) in all (*.*) subfolders (/s) and directories (/d).

    System files will give you an Access Denied error when trying to change file attributes.

    Running the attrib command.
  10. Reveal hidden files and folders. Enter dir again to see if any hidden files or folders appear. Look for files with extensions like autorun.inf, .exe, .vbm, etc.

    If no new files appear, then there may be no hidden files to display.

    Doing another directory listing to see any changes.
  11. Delete the suspicious file. Once you’ve found the suspicious file, enter del filename.extension. For example:

    del autorun.inf

    When asked if you're sure you want to delete the file, enter Y for yes.

    Deleting a possibly infected file.
  12. Enter dir again to list all files. The offending file should be gone.

    The file has been deleted through the command prompt.