Security Tips

Which Malware Removal Tool Is Best? Free Scanners Compared

By Best Paid Antivirus Editorial DeskOctober 23, 20269 min read

There is no single best malware removal tool. On a Windows PC, the order that works best is: a full scan with the Microsoft Defender that is already built in, then a Microsoft Defender Offline scan if the problem comes back, then one free second-opinion scanner such as Malwarebytes Free, ESET Online Scanner or Microsoft Safety Scanner. Use one second-opinion tool at a time, download it only from the maker's own website, and remove Norton Power Eraser from your list: Norton discontinued it on April 30, 2026.

Most "best removal tool" lists rank products as if they all do the same job. They don't. A cleanup scanner, a boot-time scanner and a full antivirus suite solve different problems, and picking the right one for the problem in front of you matters more than any ranking.

Three different jobs, three different tools

Before you download anything, work out which of these situations you are in:

"Something is wrong right now." Pop-ups, a hijacked browser home page, a sudden slowdown, or a security warning you did not expect. You need a thorough scan with tools that can remove what they find.
"I cleaned it, but I want to be sure." Your antivirus says the threat is gone, but you want a second opinion from a different detection engine.
"It keeps coming back." The same threat reappears after every cleanup, or your antivirus will not start or update. Something may be hiding below Windows itself, and you need a scan that runs before Windows loads.

Microsoft lists the usual warning signs as a device that suddenly runs much slower, drains its battery faster, uses more data than expected, shows unexpected ads or pop-ups, or redirects you to sites you did not mean to visit. The FTC gives a similar list for any computer or phone.

The tools worth knowing about in 2026

Microsoft Defender full scan (built in, free)

If you use Windows 10 or 11 and have not installed another antivirus, Microsoft Defender Antivirus is already running. Its quick scan only checks the places malware usually hides. For a suspected infection, open Windows Security, go to Virus & threat protection, select Scan options, then run a Full scan. Check for protection updates first, so it scans with the newest definitions.

For many everyday infections, this is all you need. If you are wondering whether Defender is strong enough for daily protection, our separate guide on whether Windows Defender is enough covers that question.

Microsoft Defender Offline (built in, for stubborn threats)

This is the most underused tool on the list. Microsoft describes it as a scan that boots and runs from a trusted environment, outside the normal Windows kernel, so it can reach malware that tries to hide from Windows, such as rootkits and threats that infect the master boot record. Microsoft's own help pages say that for the most complete scan, you should run Microsoft Defender Offline.

You start it from the same Scan options page by choosing Microsoft Defender Offline scan. Your PC restarts and the scan runs before Windows loads, so save your work and close your apps first. When Windows starts again, the results appear in Protection history.

Video: Microsoft Defender Offline scan | Windows 11 (all versions) by NetITGeeks (YouTube)

Microsoft Safety Scanner (free, portable)

Safety Scanner is a separate download from Microsoft that finds and removes malware and tries to reverse changes made by the threats it finds. It does not install anything and only scans when you run it. It is useful when Defender itself has been switched off or damaged by malware.

Two details catch people out. First, Microsoft says each download expires 10 days after you download it, so always get a fresh copy before you scan. Second, it does not replace your antivirus: it has no real-time protection. Its detailed results are saved in a log file called msert.log in the Windows debug folder. To remove the tool afterwards, simply delete the file you downloaded.

Malwarebytes Free (free, on-demand)

Malwarebytes Free is one of the best-known second-opinion scanners. Malwarebytes itself sums up the difference clearly: the free scanner finds and removes infections already on your device, while the paid Premium version adds real-time protection that blocks threats before they arrive. In practice, the free version is a cleanup tool, not a shield.

Because the free version does not run in real time, it can sit alongside Microsoft Defender as an occasional scanner. If you are weighing it against a full paid suite, see our Malwarebytes vs Norton comparison.

ESET Online Scanner (free, one-off)

ESET Online Scanner is a free one-time scanner for Windows from the company behind ESET NOD32. ESET says it needs no credit card and removes viruses, Trojans, spyware and other threats. Like the others in this group, it is a cleanup tool and does not give you ongoing protection. It is a good pick for a second opinion because its detection engine is different from Microsoft's.

Kaspersky Virus Removal Tool (check where you live)

Kaspersky still publishes a free Virus Removal Tool. If you are in the United States, the US Department of Commerce has prohibited Kaspersky from providing its cybersecurity and antivirus products and services to US persons, so this is not a sensible choice there. Outside the US, the decision is yours. Our article on whether Kaspersky is safe to use explains the background.

Norton Power Eraser: discontinued

Many older guides still recommend Norton Power Eraser. Norton's support site now says the tool was discontinued on April 30, 2026, and is no longer supported or functional, with its features folded into Norton's main security apps. If a website still offers a Power Eraser download, treat that file with suspicion: it is not coming from Norton and it will not help you.

A cleanup order that works

Back up important files first. Copy documents and photos to an external drive or cloud storage before you start removing things. Do not back up programs or downloaded installers you are unsure about.
Update and run a Defender full scan. Let it quarantine or remove anything it finds, then restart.
Run a Defender Offline scan if the full scan finds nothing but the symptoms continue, or if the same threat keeps returning.
Get one second opinion. Pick one of Malwarebytes Free, ESET Online Scanner or Microsoft Safety Scanner. Running three scanners back to back rarely finds more and can produce confusing false positives.
Clean up what scanners miss. Remove browser extensions you do not recognise, reset your browser settings, block sites that send you notifications, and check the apps that start with Windows in Task Manager under Startup apps.
Secure your accounts from a clean device. If you typed passwords on the infected PC, change your email, banking and other important passwords from another device you trust, and turn on two-step verification.
Reset Windows as a last resort. If the infection survives all of the above, back up your personal files and reset or reinstall Windows. It is slower, but it is the most reliable way to remove an infection that keeps returning.

If ransomware has encrypted your files, a removal tool will not bring them back. Follow the steps in our ransomware protection guide instead and read it before you even think about paying.

Mistakes that make things worse

Installing a "cleaner" from a pop-up. A web page cannot scan your computer. Warnings that say you have dozens of viruses and offer a download or a support phone number are scams, and the download is often the real malware. The FTC warns against calling numbers in these pop-ups.
Running two real-time antivirus products together. Two always-on scanners can slow your PC and interfere with each other. One real-time product plus an occasional on-demand scan is fine.
Downloading tools from mirror sites. Get every scanner from its maker's own website, never from download portals or links in emails.
Stopping after the scan. If passwords may have been stolen, changing them matters more than the cleanup itself.

What about Macs and phones?

On a Mac, Apple says its built-in XProtect technology both blocks known malware and acts to remediate malware that has managed to run, so keeping macOS updated is the first step. Our best antivirus for Mac guide covers when extra protection is worth it. On Android, start with Google Play Protect and safe mode, as described in our guide to removing a virus from an Android phone.

When a paid antivirus makes more sense

Removal tools fix a problem after it happens. If you keep needing them, the real issue is prevention: real-time protection, web and phishing blocking, and ransomware protection. Microsoft Defender covers the basics for many people, and our list of the best free antivirus options shows the free alternatives. A paid suite is worth it mainly when you want extras such as stronger scam and phishing filtering across several devices, family features, or support you can call.

Frequently asked questions

Is Microsoft Defender good enough to remove malware?

For most common infections, yes, especially when you combine a full scan with a Defender Offline scan. Microsoft itself recommends the offline scan for the most complete check. Use a second-opinion scanner if you want extra confidence.

Can I run Malwarebytes Free and Microsoft Defender at the same time?

Yes. Malwarebytes Free only scans when you start it, so it does not compete with Defender's real-time protection.

Why does Microsoft Safety Scanner stop working after a few days?

Microsoft designed each download to expire 10 days after you get it, so it is never used with old definitions. Download a fresh copy each time you need it.

Does resetting Windows remove all malware?

A full reset that removes everything gets rid of almost all malware. Threats that live in firmware or the boot record are rare, but if you suspect one, run a Defender Offline scan before resetting.

Sources

Mobile Security

How to Remove a Virus From an Android Phone, Step by Step

8 min read