If malware is slowing your PC, blocking security tools, or repeatedly coming back after removal, Safe Mode can help you work in a cleaner Windows environment.
This guide explains how to boot Windows in Safe Mode for malware removal and why each method matters.
What Safe Mode does during malware cleanup
Safe Mode starts Windows with a minimal set of drivers, services, and startup programs.
That limited environment reduces the chance that malicious software will load automatically, hide processes, or interfere with antivirus scans.
For malware removal, the main advantage is control.
You can often stop active threats from running, run scans with fewer interruptions, and remove suspicious files more reliably.
Safe Mode is not a full cure by itself, but it is a strong first step before using trusted security tools such as Microsoft Defender, Malwarebytes, or other reputable scanners.
When to use Safe Mode instead of normal startup
Safe Mode is most useful when malware causes one or more of these problems:
- Security software will not open or update
- The PC is extremely slow, unstable, or crashing
- Unknown pop-ups, browser redirects, or fake alerts keep appearing
- Suspicious programs relaunch after you close them
- You cannot complete a scan because the malware blocks it
If you only want a routine scan and the system appears stable, normal mode is usually fine.
But if you suspect active persistence mechanisms, Safe Mode often gives you a better chance of cleanup.
How to boot Windows in Safe Mode for malware removal
The exact steps depend on whether Windows loads normally.
Use the method that matches your situation.
If Windows starts normally
- Open Settings.
- Go to System or Update & Security, then choose Recovery.
- Under Advanced startup, select Restart now.
- After the PC restarts, choose Troubleshoot.
- Select Advanced options, then Startup Settings.
- Click Restart.
- When the Startup Settings screen appears, press:
- 4 or F4 for Safe Mode
- 5 or F5 for Safe Mode with Networking
- 6 or F6 for Safe Mode with Command Prompt
For malware removal, standard Safe Mode is usually the safest starting point.
Choose Safe Mode with Networking only if you need internet access to download definitions, tools, or updates.
If Windows will not boot normally
When the PC is stuck in a crash loop or malware prevents a normal login, you can still reach Safe Mode through the Windows Recovery Environment (WinRE).
- Turn the PC on and, as soon as Windows begins loading, hold the power button to force shutdown.
- Repeat this process two or three times until Windows shows Preparing Automatic Repair or the recovery screen.
- Select Advanced options.
- Go to Troubleshoot > Advanced options > Startup Settings.
- Restart and choose the Safe Mode option with 4, 5, or 6.
This route is common when ransomware, adware, or a rogue startup entry prevents access to the desktop.
Which Safe Mode option should you choose?
Windows offers several Safe Mode variants, and the right one depends on your cleanup plan.
- Safe Mode: Best for most malware removal tasks.
It loads minimal services and prevents many threats from starting.
- Safe Mode with Networking: Useful if you need to download antivirus updates, second-opinion scanners, or removal instructions from a trusted source.
- Safe Mode with Command Prompt: Helpful for advanced troubleshooting, registry work, or scripted cleanup, but it is not necessary for most users.
If you are unsure, start with standard Safe Mode.
You can always reboot and try the networking option later if your security tools need updates.
What to do after entering Safe Mode
Once you are in Safe Mode, focus on a deliberate cleanup sequence instead of randomly deleting files.
1. Update your security tools
If networking is available, update Microsoft Defender or your trusted antivirus product.
Fresh signatures improve detection of current threats, including trojans, browser hijackers, and spyware.
2. Run a full or offline scan
Use a complete system scan rather than a quick scan.
Microsoft Defender Offline scan can be especially valuable because it checks the system outside normal Windows startup conditions.
Other reputable tools, such as Malwarebytes, ESET Online Scanner, or Bitdefender, may also help identify bundled adware and persistent threats.
3. Review startup items and installed apps
Check suspicious startup entries, recent programs, browser extensions, and unfamiliar applications.
Many unwanted programs survive by launching at sign-in or by installing as browser add-ons.
4. Remove suspicious files carefully
Only remove files or programs that your security tool identifies or that you can clearly trace to a malicious source.
Deleting the wrong system file can damage Windows and make recovery harder.
5. Change important passwords later from a clean device
If you suspect credential theft, do not change passwords on the infected computer until it has been cleaned and verified.
Use a known-clean phone or another computer for email, banking, and account recovery.
Common mistakes to avoid during malware removal
Safe Mode helps, but cleanup can still go wrong if you rush.
Avoid these errors:
- Using untrusted “free cleanup” tools from random websites
- Disabling security protections without a clear reason
- Deleting system files based only on file names
- Ignoring browser settings, extensions, and saved login sessions
- Assuming one scan means the machine is clean
Malware often uses multiple persistence methods, including scheduled tasks, services, startup folders, registry run keys, and browser-based reinfection.
A careful review matters as much as the scan itself.
How to exit Safe Mode and return to normal startup
After cleanup, restart the PC and confirm that Windows starts normally.
If the computer keeps returning to Safe Mode, you may have a boot setting enabled.
To turn it off, open System Configuration by typing msconfig in the Start menu, then choose the Boot tab and clear Safe boot.
Restart the PC afterward.
If the system still behaves strangely after exiting Safe Mode, repeat the scans and inspect common reinfection points such as browsers, extensions, scheduled tasks, and remote access software.
When Safe Mode is not enough
Some threats are harder to remove, especially rootkits, bootkits, and advanced ransomware.
If scans keep finding the same malware, Windows files are damaged, or you cannot trust the system after cleanup, consider these next steps:
- Run Microsoft Defender Offline scan
- Use a second-opinion scanner from a reputable vendor
- Restore the system from a clean backup or restore point
- Seek professional help for business-critical devices
- Reinstall Windows if the infection is severe or persistent
For high-risk infections, a clean reinstall may be the fastest way to restore trust in the device, especially if the malware tampered with security controls or system integrity.
Safe Mode best practices for a cleaner cleanup
- Disconnect external drives unless you need them for recovery files
- Keep one trusted browser tab open only if networking is required
- Use updated antivirus signatures before scanning
- Document suspicious filenames and locations before deleting them
- Back up essential personal files after the system is verified clean
Knowing how to boot Windows in Safe Mode for malware removal gives you a practical advantage when threats resist normal cleanup.
Used correctly, Safe Mode can reduce interference, improve scan accuracy, and help you remove malicious software with less risk.