Best Malware Removal Tools in 2026: 6 Safe Scanners

The first ten minutes matter more than the scanner brand

If files are being renamed or encrypted, an unknown remote-control window appears, the mouse moves by itself, accounts send messages without you, or an antivirus reports an information stealer, treat it as an incident rather than a slow-computer problem. Disconnect Wi-Fi and Ethernet. Don't plug in a backup drive. Don't keep signing into email, banking, a password manager or an employer VPN from that device.

For a home computer with a single suspicious download and no evidence of account access, isolation followed by the existing antivirus and an offline scan is proportionate. For ransomware or a work device, CISA's ransomware checklist starts with identifying and immediately isolating affected systems. It also warns that powering a system down destroys volatile evidence, so an organization should follow its incident-response plan and preserve memory and logs when capable. A home user who can't disconnect a spreading machine may still need to power it off; a company should call its security team first.

Malware removal tools compared by the job they actually do

“Free” means the removal role shown in this table can be used without buying a subscription as checked July 23, 2026. It doesn't mean every feature, business use case or support service is free. Follow each vendor's current license.

Why this ranking has no made-up “removes 100%” score

Most current consumer lab reports measure whether an installed security product blocks malicious URLs, files and behavior before compromise. That's valuable prevention evidence. It isn't a controlled comparison of how six standalone scanners repair the same already infected machines. A product's 99.x% real-world protection result can't honestly be relabeled as a 99.x% malware-removal rate.

The cleanup problem is also stateful. One machine may have a browser extension and scheduled task; another may have a boot-level component, stolen browser cookies and a modified recovery environment. A scanner can quarantine the executable while leaving passwords, OAuth tokens, remote sessions, altered policies or encrypted files unresolved. The absence of another detection after reboot is evidence, not proof of trust.

We therefore rank documented role, update path, environment, scope, reversibility and lifecycle. We also disclose freshness problems. Emsisoft's current Emergency Kit page still lists version 2025.7.0.12683 from June 27, 2025. That doesn't automatically make its self-updating definitions stale, but it's less reassuring than a clearly refreshed program build. ESET's current help remains active and a 3.4.1.0 service release was announced in June 2026. Microsoft Safety Scanner publishes the current intelligence version and deliberately expires each copy after ten days.

Detailed verdicts: what each scanner is good for

1. Malwarebytes Free — the least confusing broad cleanup choice

Malwarebytes built its reputation around second-opinion cleanup, and the 2026 free boundary remains useful. The vendor's current Free-versus-Paid matrix lists Quick and Custom scans as free on Windows and Mac. Scheduled threat scans, real-time malware and ransomware protection, exploit protection and web protection require a paid plan. That makes the free app a scanner and cleaner, not a permanent antivirus substitute.

Choose it when the installed antivirus reports clean but the browser still redirects, a suspicious process remains, or you want a readable second opinion. Quarantine first, restart, then inspect what changed. Don't assume every potentially unwanted program is malicious; installers and administration tools can trigger policy-based detections. If the only symptom is a hijacked homepage or injected ads, AdwCleaner is the narrower first pass.

Limit: installing another large app on a badly compromised machine gives malware more opportunity to interfere. For a returning detection or suspected rootkit, run Defender Offline first. For a business device, use the organization's approved EDR and incident process rather than a personal utility.

2. Microsoft Defender Offline — use the restart to your advantage

Defender Offline starts outside the ordinary Windows kernel. Microsoft recommends it when the same malware keeps returning because it can target threats that hide while Windows is running. Save work first: the PC restarts. In Windows Security open Virus & threat protection, choose Scan options, select Microsoft Defender Offline scan, and start it.

This is the best first escalation when Defender repeatedly removes the same item, a rootkit is suspected, or a normal scan can't complete. It isn't a bootable repair service for every unbootable PC, and it doesn't revoke stolen credentials. After the restart, review Protection history, update Windows and the browser, and follow with one second-opinion scanner.

Limit: if malware has damaged the recovery environment or Windows won't start, the built-in workflow may be unavailable. Move to official Windows Recovery options or a clean reinstall rather than downloading an old rescue ISO from a mirror.

3. Emsisoft Emergency Kit — portable, practical and narrowly scoped

Emsisoft describes Emergency Kit as a portable UI and command-line toolkit with malware detection, quarantine/removal, artifact cleanup and restoration of some damaged settings. It can update software and detections with one click. Because it expands to a folder instead of registering as a permanent protection suite, a technician can keep a clean copy ready and discard it after the incident.

It's the best option here for a technician servicing multiple personal Windows PCs or for a user who doesn't want another resident security suite. Update it on a known-clean environment when possible. Copy it only on media you're willing to wipe afterward; a USB drive attached to an infected machine shouldn't be trusted automatically on the next machine.

Limit: the current requirements are 64-bit Windows 10 or later, so it isn't a solution for 32-bit or very old Windows. The visible program build on the vendor page dates to June 2025. Verify the official page and update successfully before relying on a stored copy.

4. ESET Online Scanner — a strong free full-scan second opinion

ESET Online Scanner is designed for a one-time Windows scan. Its current help documents saved scan logs, quarantine restoration and an optional periodic scan. The periodic mode is a monthly quick check of commonly infected areas and requires administrator rights; it shouldn't be confused with real-time protection.

Use ESET when you want a second engine after the installed product has finished, especially when you need a full scan and a log to review. Enable potentially unwanted application detection consciously: it may surface bundlers, remote administration tools and software you chose to install. Read each result before deletion.

Limit: “Online Scanner” still downloads a Windows launcher and detection data. It doesn't scan an iPhone through a web page, and it isn't the old bootable SysRescue environment. ESET explicitly says SysRescue Live is terminated and only partially replaced by Online Scanner.

5. Microsoft Safety Scanner — fresh, official and deliberately temporary

Microsoft Safety Scanner is a portable manual scanner for Windows. It tries to reverse changes made by identified threats and writes detailed results to %SYSTEMROOT%\debug\msert.log. Microsoft provides separate 32-bit and 64-bit downloads.

The ten-day expiry is a useful safety property: the executable isn't intended to sit forgotten in a downloads folder for a year. Download a fresh copy from Microsoft whenever you need another scan. This is a good choice when Windows Security is present but you want a disposable Microsoft scan with an inspectable log.

Limit: it runs only when invoked and doesn't replace real-time protection. If a threat hides from the running OS, Defender Offline is the better Microsoft path.

6. Malwarebytes AdwCleaner — targeted cleanup for an ugly browser

Malwarebytes scopes AdwCleaner to adware, potentially unwanted programs and browser hijackers. That narrow role is useful when search redirects, unwanted extensions, notification spam or bundled software are the problem. It's faster to understand than throwing a full security suite at every browser preference.

Review the proposed repairs. Some organizations intentionally deploy browser policies, proxy settings or remote-support software that can resemble unwanted changes. Quarantine and a saved log are safer than blindly deleting every line.

Limit: a browser cleanup doesn't rule out an information stealer, rootkit or lateral movement. Follow serious symptoms with Defender Offline and a broad second opinion, or reinstall.

A safe malware-removal workflow for a home Windows PC

1. Isolate the PC. Disconnect network access and external backup/storage devices. Photograph the warning or ransom note with another device if you need a record.
2. Decide whether this is bigger than DIY. Work data, active ransomware, a remote attacker, financial access, administrator credentials or multiple affected devices justify professional/organizational incident response.
3. Use a clean device for preparation. Read official instructions, download tools to fresh removable media if necessary, and contact banks or work support without using the suspected PC.
4. Update the existing antivirus and scan. If Windows is stable, update intelligence and run a full scan. Microsoft advises cloud-delivered protection and automatic sample submission for Defender.
5. Run outside the normal OS when persistence is suspected. Save work and run Defender Offline. Review Protection history after Windows returns.
6. Use one second opinion. Run Malwarebytes Free, ESET Online Scanner, Emsisoft Emergency Kit or Safety Scanner—not four simultaneously. Quarantine first and save the scan log.
7. Patch and inspect persistence. Update Windows, browsers and exposed applications. Check extensions, proxy settings, startup apps and newly created administrator accounts. Don't “fix” unknown registry entries from a forum checklist.
8. Recover accounts from a trusted device. After the affected system is cleaned or reinstalled, change high-value passwords from a known-clean device, revoke active sessions, rotate recovery codes and enable phishing-resistant MFA where available. A cleaner can't invalidate stolen cookies or tokens.
9. Back up data, not the infection. Copy irreplaceable documents after scanning. Avoid restoring executables, scripts, cracked software, browser profiles or full system images created after the compromise.
10. Monitor, then make a trust decision. Recurring detections, unknown sign-ins, security settings that revert, or unexplained admin accounts mean the cleanup failed. Reinstall from trusted media.

Microsoft's account-recovery guidance says to clear malware before changing a compromised Microsoft password. The practical refinement is to perform urgent containment and account recovery from a separate trusted device when the infected device may still be monitored.

What not to do on an infected computer

When a clean reinstall is safer than another scan

No scanner can give a mathematical guarantee that a hostile administrator, rootkit or credential stealer left nothing behind. Microsoft itself recommends reset, restore or reinstall when malware caused irreversible changes. Prefer reinstalling from trusted media when any of these apply:

• Ransomware executed, even if a decryptor or backup restores files.
• An information stealer, remote-access trojan or unknown administrator account was confirmed.
• Security settings, services or detections return after offline and second-opinion scans.
• The machine handled domain-admin, business VPN, wallet seed, signing key or password-manager access.
• Windows Update, Defender, Recovery or system files remain damaged.
• You can't establish when the compromise started or which persistence mechanisms ran.

A reinstall isn't magic if the same malicious installer, compromised browser sync, infected macro, exposed remote desktop or stolen cloud account is restored immediately. Patch first, restore only known-good data, rotate credentials and remove the original entry point.

Malware removal on Mac, Android and iPhone is a different problem

Mac

Malwarebytes Free provides manual Mac scans, but start with Apple's own signals: Gatekeeper, XProtect and notarization checks. Apple advises trashing an item identified as malware. Remove unknown profiles, login items and browser extensions, update macOS, and erase/reinstall from Recovery if administrator-level compromise remains plausible.

Android

A current Android security app can scan installed packages, but persistent symptoms may come from device-admin rights, accessibility abuse, sideloaded APKs, notification permissions or a compromised Google account. Remove unknown administrator/accessibility apps, update Android and Play system components, run Play Protect, and factory-reset when the device remains controlled. Don't restore the same suspect APK.

iPhone and iPad

Ordinary third-party apps can't perform a Windows-style full filesystem malware scan on iOS. Security apps focus on malicious links, breach monitoring, unwanted calendars, network protection and account risk. Update iOS, remove unknown profiles/VPNs, review Apple Account devices and sessions, and erase/restore when compromise is credible. A website claiming to scan every iPhone file from Safari isn't doing that.

Retired and limited tools that current lists still recommend

Norton's EOL notice is unambiguous: Power Eraser stopped being supported and functional after April 30, 2026, and Norton offers no standalone replacement. ESET likewise says SysRescue Live is terminated. Don't resurrect either from a third-party archive because an old article still ranks it.

Microsoft's MSRT documentation says the monthly tool targets specific prevalent malware families and directs users to Defender Offline or Safety Scanner for comprehensive detection and removal. It's a useful background safety net, not the only incident tool.

What current community discussions add—and what they can't prove

Current r/antivirus and support discussions repeatedly point home users toward Malwarebytes, ESET Online Scanner, Emsisoft Emergency Kit and Defender Offline as second opinions. They also frequently recommend reinstalling after a serious compromise. That's useful directional evidence about workflows people can actually follow, not a controlled efficacy ranking. We found no credible reason to copy usernames, isolated scan screenshots or vote counts into a universal “best” claim.

The pattern worth keeping is escalation: built-in full/offline scan, one reputable second opinion, then reinstall when persistence or credential theft is plausible. The pattern to reject is a 12-tool checklist run without reading detections or preserving logs.