Step-by-Step How-To · 5 min read
How to Use Safe Mode to Remove Malware on Windows
Safe mode starts Windows with a minimal set of drivers and services, which prevents most malicious components from loading and makes them deletable.
Published 2026-08-09 · Last updated 2026-08-09
Entering safe mode on Windows 10 and 11
Hold Shift while choosing Restart from the Start menu, then select Troubleshoot, Advanced options, Startup Settings, Restart, and choose safe mode with networking so scanners can still update their definitions.
What to do once you are in
Run a full antivirus scan, then an on-demand second-opinion scan. Clean temporary files first if the disk is nearly full — scans and quarantines need free space.
Deleting what could not be removed before
Files locked by a running malicious process while Windows was in normal mode are usually deletable here, and stubborn startup entries can be cleared without something re-adding them.
When safe mode is not enough
Malware that loads before Windows, or a rootkit, needs Microsoft Defender Offline or vendor rescue media that boots outside the installed system entirely.
Frequently asked questions
- Should I use safe mode with or without networking?
- With networking, so scanners can download current definitions. Do not browse or sign into accounts while in that state.
- Why will Windows not leave safe mode?
- A boot configuration flag may still be set. Clear the safe boot option in System Configuration and restart.