How to remove what malware leaves behind in Windows

Windows 11 and 10

Written for Windows 11 (26H2) and Windows 10 (22H2). The tools are the same; where a menu differs, the Windows 10 name is given in brackets.. Steps checked against Microsoft Support, Microsoft Learn and our Windows 11 screenshots on October 4, 2026.

Do the steps in this order: what restarts the program first (tasks, startup, services), then its files, then the browser shortcuts. Use an administrator account. If something you need stops working, every change here except deleting files can be undone.

1. Uninstall the program first, if it is still listed in Settings > Apps > Installed apps (Apps & features in Windows 10).

   Note its name, publisher and install date: the leftovers usually carry the same name or were created on the same day.

2. Open Task Scheduler from the Start menu and select Task Scheduler Library.

   Select each task you do not recognise and read the Actions tab. A task that starts a file in %AppData%, %LocalAppData% or %Temp%, runs powershell or wscript with a long line, or opens a web address is suspicious. Right-click it and choose Delete. Check the subfolders in the library too; adware often puts its task in a folder named like a real updater.

   

3. Open Task Manager with Ctrl + Shift + Esc, select Startup apps (the Startup tab in Windows 10) and disable entries you do not recognise.

   Right-click an entry and choose Open file location first, so you know which file to delete later. An empty Publisher column is a warning sign.

4. Check the registry startup keys that Task Manager does not always show.

   Back up the registry first (Back up the registry before editing it On uGetFix). Press Windows + R, type regedit and open, one by one, HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, ...\RunOnce, and the same two keys under HKEY_LOCAL_MACHINE. Delete a value only when its data points to the program you removed or to a file in %AppData% or %Temp% that you identified as malicious.

5. Press Windows + R, type services.msc and look for a service with the program's name or a random name.

   Double-click it and read Path to executable. If it points to the program's folder, set Startup type to Disabled and click Stop. Do not disable services from Microsoft or your hardware makers.

6. Delete the program's folders.

   Paste these into the File Explorer address bar one at a time: %LocalAppData%, %AppData%, %ProgramData%, C:\Program Files, C:\Program Files (x86). Delete folders with the program's or publisher's name, or with random names created on the install date that hold .exe, .dll, .js or .ps1 files. If a file is in use, restart and delete it before opening anything else, or do it in Safe Mode (Start Windows or a Mac in Safe Mode On uGetFix).

7. Check the browser shortcuts: right-click each one > Properties > Shortcut tab > Target.

   The target must end with the browser's program file in quotes, for example "C:\Program Files\Google\Chrome\Application\chrome.exe". Remove any web address after it and click OK. For a taskbar shortcut, right-click the icon, then right-click the browser name in the menu to reach Properties.

   

8. Restart Windows and check that nothing came back, then run a full scan.

   Look again at Task Scheduler, Startup apps and the folders you cleaned. Finish with a Microsoft Defender full scan and an offline scan (Run a Microsoft Defender Offline scan).

Keep notes as you go: the task name, the file path and the registry value. If the program returns, they show which piece you missed.

Browser settings changed by the program (search engine, start page, extensions) are fixed in the browser: see reset your browser and remove a browser extension.