How to Remove Spyware from a PC: Step-by-Step Guide (2026)

Spyware is malware designed to watch you quietly — logging keystrokes, capturing screenshots, harvesting passwords, or tracking your browsing — and send that data to someone else. Because it tries to stay hidden, you often notice it only through side effects: a sluggish PC, unexpected pop-ups, a browser homepage you didn’t set, or strange network activity. This guide walks through removing it cleanly.

These steps are written for Windows, the most common target. Work through them in order — each one closes a hiding place the previous step might have missed.

Signs you might have spyware

• The PC suddenly feels slow or the fan runs constantly when idle.
• Your browser homepage or default search engine changed by itself.
• New toolbars or extensions you didn’t install appear.
• You see unfamiliar programs in the Start menu or task manager.
• Friends report messages from your accounts that you didn’t send.

None of these alone proves an infection, but several together are a strong signal.

Step 1: Disconnect and back up what’s clean

If you suspect active spyware (especially keyloggers or info-stealers), disconnect from the internet to stop it sending data. If you have important files, copy them to an external drive — but don’t copy executables or installers you’re unsure about.

Step 2: Run a full scan with Microsoft Defender

Windows includes Microsoft Defender, which can catch most common spyware:

1. Open Windows Security (search it in the Start menu).
2. Go to Virus & threat protection → Scan options.
3. Choose Full scan (not Quick) and start it. A full scan checks every file and takes a while — let it finish.
4. Follow the prompts to quarantine or remove anything it finds, then reboot.

Step 3: Run a second-opinion on-demand scanner

Some spyware is missed by any single engine. Run a reputable on-demand scanner as a second opinion — well-known options include the free Malwarebytes scanner and ADWCleaner (which targets adware, PUPs, and browser hijackers). Running an on-demand scanner alongside Defender is fine because it scans on request rather than running a second real-time engine. Quarantine what it flags and reboot.

Step 4: For deep infections, use Microsoft Defender Offline

Some spyware loads early and hides from a normal scan. Microsoft Defender Offline reboots the PC into a minimal environment and scans before Windows (and the malware) fully loads:

1. Windows Security → Virus & threat protection → Scan options.
2. Choose Microsoft Defender Offline scan and run it.
3. The PC restarts, scans, and removes threats it finds before booting back to Windows.

Step 5: Clean the browser

Spyware and adware frequently hook into the browser. In each browser you use:

• Open the extensions/add-ons page and remove anything you don’t recognize.
• Reset the homepage and default search engine to what you want.
• Clear cookies and cache.
• If problems persist, use the browser’s Reset settings option (Chrome: Settings → Reset settings; Edge: Settings → Reset settings) to restore defaults without losing bookmarks.

Step 6: Check installed programs and startup items

• Settings → Apps → Installed apps: sort by install date and uninstall anything suspicious you don’t recognize from around when problems started.
• Task Manager → Startup apps: disable unknown items that launch at boot.
• Optionally check the hosts file (C:\Windows\System32\drivers\etc\hosts) — some malware adds entries to redirect sites. It should normally contain only comments and localhost lines; remove unfamiliar redirects if you understand what you’re editing.

Step 7: Update everything and reboot

Install pending Windows updates and update your browser. Many spyware infections exploit outdated software, so closing those holes prevents reinfection.

Step 8: Change your passwords from a clean device

This step matters most and is the one people skip. If spyware was active, assume it captured passwords you typed or that were saved in your browser. After the PC is clean, change passwords for important accounts — email first, then banking and anything reusing the same password. Do this from a device you trust, not the freshly cleaned PC, until you’re confident it’s clean. Enable two-factor authentication wherever possible.

When to consider a clean reinstall

If scans keep finding the same threat, the PC behaves strangely after cleanup, or it was infected with something serious like a rootkit, the most reliable fix is to back up your files, reset Windows, and reinstall. Windows 10/11 includes a built-in reset (Settings → System → Recovery → Reset this PC) that can remove everything and start fresh.

FAQ

Can free tools remove spyware? Yes — Microsoft Defender plus a free on-demand scanner removes most common spyware. Deep infections may need Defender Offline or a clean reinstall.

Will resetting my browser remove spyware? It removes browser-based hijackers and unwanted extensions, but not spyware living elsewhere on the system. Run full system scans as well.

How do I keep spyware from coming back? Keep Windows and your browser updated, avoid cracked software and shady downloads, don’t open unexpected attachments, and don’t grant admin rights to programs you don’t trust.