Even though there are a lot of antivirus programs you can use to get rid of viruses and malware, sometimes you might need to deal with a suspicious file or folder on your own. It’s very important to know that the steps we’ll talk about later for using Command Prompt (CMD) in Windows 11 or 10 are meant for dealing with specific suspected files in certain folders, not for scanning your whole computer for viruses.
This method is just an extra step, not a replacement for regular virus scans. You should always use Windows Defender or a good third-party antivirus software to check your entire system first. With that in mind, let’s look at how to use CMD to remove suspected viruses manually in Windows.
Why use Command Prompt for manual virus removal
Command Prompt lets you talk directly to the Windows OS and work with files. If a virus is messing with your antivirus software, or if it’s a new virus that your antivirus software doesn’t know yet, CMD can come in handy. It allows you to go straight to the file and change things so you can delete it more easily.
But you need to know what you’re doing with CMD because a wrong command can cause serious problems with your PC.
Also see: How to Scan an .exe File for Viruses to Check If It’s Safe
Things to consider before using CMD to delete infected files
There are some important things that you should know first before you proceed:
- This method is not about guessing where viruses might be; it’s about dealing with specific suspicious files or folders. Make sure you know which files might be causing trouble, maybe because your computer is acting weird or another scanning tool gave you a clue.
- It’s often a good idea to start your computer in Safe Mode when trying to get rid of infected files. Safe Mode runs with just the basic stuff your computer needs, which makes it tough for stubborn viruses to hide or protect themselves.
- Make sure you have administrator rights on your computer. You’ll need this to run certain commands and change file properties.
- If you’re not sure about a command or a step, stop and look it up or ask someone who knows.
Common virus: What is Trojan:Win32/Casdet!rfn and How to Remove it
Remove virus files using CMD in Windows 11 or 10
Now that you know what we’re trying to do and know the risks, below are the steps to get rid of a virus file using CMD in Windows 11 or 10.
- Start CMD with administrator rights:
- Click on the Start button.
- Type “cmd” in the search bar.
- Right-click on “Command Prompt” from the search results and select “Run as administrator”.
- Handy guide: How to Run CMD, PowerShell or Regedit as SYSTEM in Windows 11
- Go to the folder you think has the virus:
- In CMD, you usually start in your user folder. Use the “cd” command to go to other folders. For example,
cd Downloadswill take you to your Downloads folder. Learn more: How to change directory or drive in CMD. - To go back up one level in the folder structure, type
cd ...
- In CMD, you usually start in your user folder. Use the “cd” command to go to other folders. For example,
- Show files and folders:
- Type “dir” to see all the files and folders where you are. This helps if you’re not sure of the file name you’re after.
- Use
dir /ato see all files, even hidden ones. Bad files often hide to avoid being seen.
- Change file properties:
- If you find a sketchy file, you might need to change its settings. Use the “attrib” command for this.
- For instance, if a file called “autorun.exe” is hidden and read-only, you can make it visible and editable by typing
attrib -h -r autorun.exe.
- This will make the file visible and ready for changes.
- Related resource: How to Unhide a File or Folder in Windows 11
- Delete the bad file:
- Once you’re sure the file is harmful and you’ve backed up important stuff, use the “del” command to get rid of it. For example,
del autorun.exe. - You can also use:
del /F /Q autorun.exe. Here, “/F” makes sure read-only files get deleted, and “/Q” means it won’t ask you before deleting.
- If a message says the file is being used, you might need to restart in Safe Mode and try again. Safe Mode stops most programs from running, which helps in deleting stubborn files.
- Learn more: How to Force Delete a File in Use by Another Program on Windows 11/10
- Once you’re sure the file is harmful and you’ve backed up important stuff, use the “del” command to get rid of it. For example,
- Check startup programs:
- Many bad programs try to start automatically when your computer turns on. You can see which programs these are with the “wmic” command.
- Type
wmic startup list fullto see all programs that start with Windows. If you see something suspicious, write down where it’s located.
- See also: How to Disable Startup Services on Windows 11 or 10
- Clean out temporary folders:
- Bad software often hides or keeps copies in temporary folders. It’s smart to clean these out now and then.
- Go to the temp folder with
cd %temp%. - Type
del *.*to remove all files. Be careful, this deletes all temp files, but it’s usually safe. However, it’s good to be cautious.
- Useful tip: How to Delete a Ghost File or Folder in Windows 11/10
Emphasizing again, although CMD can be a strong tool to delete files that are difficult to remove, it’s not actually a solid way to find malware on your system. Whenever in doubt about a possible infection on your computer, always do a full scan with either Windows Defender or a trusted antivirus program first.
On this page, we include four practical methods to help you remove viruses and help restore virus removed or deleted files with powerful EaseUS file recovery software. If you are in this dilemma, follow fixes here to clean up the virus and bring your files back:
| Workable Solutions | Step-by-step Troubleshooting |
|---|---|
| Fix 1. Remove Virus with CMD | Run Command Prompt as Administrator or EaseUS M Tool > Clear virus with attrib -s -h -r /s /d *.*…Full steps |
| Fix 2. Run Antivirus | Run installed antivirus software, execute clean operation if the virus is detected…Full steps |
| Fix 3. Run Windows Defender | Go to Settings > «Update & Security» > «Windows Security» > «Virus & threat protection» …Full steps |
| Fix 4. Format Infected Device | If the hard drive partition or external storage device was infected by a virus, formatting it can help…Full steps |
What Damage Could Viruses Do
We loathe computer viruses, undoubtedly. But do you know exactly how viruses can damage your computer? There are many types of viruses, and they behave in different ways. To sum it up, a computer virus is simply a type of program that causes your computer to act in an undesirable way. It can be a dangerous infiltration designed to drag your computer down, erase important files, track your habits, or give hackers access to your personal information… A virus is a great nuisance. Some viruses like the Locky virus and CryptoLocker, also known as ransomware, delete computer files, encrypt them, even change the file extension to .locky or .encypt. Other viruses hide files and leave users with nowhere to unhide them.
How to Recover Files Deleted/Hidden by Viruses
Using CMD commands can only help remove the virus but can do nothing to restore damaged and lost files for the virus infection. EaseUS Data Recovery Wizard can recover lost data in various severe cases.
- Recover lost or deleted files due to virus attack
- recover files from emptied Recycle Bin on Windows 10/11 or recover deleted files from Trash Bin on Mac
- Recover lost files from HDD, SSD, USB flash drive, pen drive, SD card, external hard drive, and more devices
- Support repairing corrupted files after the data recovery
Learn the 3-step file recovery in the following guides.
Step 1. Select the virus infected drive to scan
Run EaseUS virus file recovery software on your Windows PC. Select the disk attacked by the virus to scan for lost or hidden files. Note that:
- If it’s an HDD where files were hidden or deleted by virus, it’s better to install the software on a different volume or an external USB drive to avoid data overwriting.
- If the infected device is an external hard drive, flash drive or memory card, it doesn’t matter to install the software on the local drive of the computer.
Step 2. Check all scanned results
EaseUS Data Recovery Wizard will immediately start a scan process to find your deleted or hidden files on the virus infected hard drive. To quickly locate the wanted files, you can use the Filter or search box feature to display only the pictures, videos, documents, emails, etc.
Step 3. Preview and recover deleted/hidden files
When the process finishes, you can preview the scanned files. Select the files you want and click the «Recover» button. You should save restored files to another secure location or Cloud drive, not where they were lost.
It’s certainly true that a virus is something you will want to remove once you find it. Among the multiple choices, many users attempt to remove viruses using CMD.
Why Can You Remove a Virus Using CMD
In fact, using command lines doesn’t directly check and remove viruses from your computer or external storage device. CMD helps to achieve your goal of removing viruses by showing the hidden viruses on a partition or drive. Afterward, you can delete the suspicious files. Since viruses always conceal themselves, you need to make them appear and then delete the virus files. Then how can you show the potentially hidden virus files using CMD? All you need is the attrib command.
The attrib command is a Command Prompt command used to display, set, or remove the attributes of the files or folders in the selected location. By canceling the «hidden» attribute of the virus, you can see it appearing in the folder. And then you will know where to find and remove it.
Now, follow the steps below to delete viruses from your computer or storage device using CMD.
Step 1. Type cmd in the search bar, right-click «Command Prompt» and choose «Run as an administrator».
Step 2. Type F: and press «Enter». (Replace «F» with the drive letter of the infected partition or device.)
Step 3. Type attrib -s -h -r /s /d *.* and hit «Enter».
Step 4. Type dir and hit «Enter». Now you will see all the files under the assigned drive. (The dir command displays a list of a directory’s files and subdirectories.)
Step 5. For your information, a virus name may contain words like «autorun» and with «.inf» as the extension. Thus, if you find such suspicious files, type del autorun.inf to remove the virus.
Here are the basic attributes of the ‘attrib’ command:
R – represents the «Read-only» attribute of a file or folder. Read-only means the file cannot be written on or executed.
H – the «Hidden» attribute.
A – stands for «Archiving» which prepares a file for archiving.
S – the «System» attribute changes the selected files or folders from user files into system files.
I — «not content indexed file» attribute.
The «attrib» Syntax:
ATTRIB [+ attribute | – attribute] [pathname] [/S [/D]]
In the above command, let’s see what the different parameters and switches are:
‘+ / –’: To enact or to cancel the specified attribute.
‘attribute’: As explained above.
‘/S’: Searching throughout the entire path including subfolders.
‘/D’: Include any process folder.
‘pathname’: Path where the target file or folder is located.
Here is the proper syntax order for attrib command:
ATTRIB [+R | -R] [+A | -A ] [+S | -S] [+H | -H] [+I | -I] [drive:][path][filename] [/S [/D] [/L]]
- Warning
- Be careful while using the Command Prompt. Improper use of cmd can result in system damage. So, perform data recovery in advance, and then continue with the CMD method.
If you receive the message «Access denied», you should:
- Make sure you have run Command Prompt as an administrator
- Make sure the file/folder is not in use
- Check the permission of the current account and make sure you have full control over the file/folder (right-click the file/folder/partition and go to «Security»)
- Use CHKDSK command to check for file system errors (run Command prompt and enter chkdsk /f [drive letter]:)
Manual execution of the command line is suitable for computer professionals, since incorrect commands can do more harm than good. Therefore, for security and usability, we strongly recommend you try an automatic command line alternative — EaseUS CleanGenius. It is a practical tool that enables you to check and fix file system errors, enable/disable write protection and update your system with one-click instead of typing intricate command lines.
Follow the simple steps below to show hidden files with this 1-click-fix software.
Step 1. DOWNLOAD EaseUS CleanGenius for Free.
Step 2. Start EaseUS CleanGenius, choose «Optimization» on the left panel. Next, click «File Showing» on the right panel.
Step 3. Select the hard drive and click «Execute».
Step 4. After the operation completes, click the here link to check the hidden files.
3 Other Ways to Remove Virus
In addition to using CMD, there are other methods available to remove a virus from your computer or storage device, like using antivirus software, Windows Defender, and formatting the storage device.
Method 1. Run Antivirus
Almost every computer has antivirus software installed. Whenever you find your computer is infected by a virus, running the antivirus software may help. We recommend TotalAV, a powerful antivirus & security software that can quickly scan your system and protect your computer.
TOTALAV
TotalAV is an Award Winning Antivirus and Security Software. It Provides Real-Time Protection from Viruses, Malware & Online Threats.
Method 2. Run Windows Defender Antivirus
Windows Defender Antivirus is the built-in antivirus protection in Windows 10/11. It provides protection against viruses, malware, and spyware for your computer and connected devices. If you don’t have third-party antivirus software, using the built-in utility is advisable.
Step 1. Go to «Settings» > «Update & Security» > «Windows Security».
Step 2. Click «Virus & threat protection».
Step 3. In the «Threat history» section, click «Scan now» to scan for viruses on your computer.
Method 3. Format the Infected Device
The format is the process of erasing the existing files on the selected partition or drive. It will certainly remove the virus, too. Since formatting, a partition/drive will cause data loss, make sure you don’t have any important files stored on the device.
How to Prevent Virus or Malware Infections
Except for knowing how to cope with a virus attack, you should also know how to prevent virus infection on your computer or external storage device. For you to protect your computer or USB drives better, here are some feasible tips on virus prevention you:
Install professional antivirus software on your computer and keep it updated
Be cautious with the origins of the programs you want to install
Avoid suspicious websites and think before you make a click
Make sure the network connection is safe
Besides, regularly making backups of your files with free backup software is also recommended to avoid complete data loss that may be caused by a virus infection.
The Bottom Line
Removing a virus using CMD is a roundabout solution. Yet it works in some cases. If the attrib command fails, try the three more tips provided to get rid of the malicious file. Besides, virus attacks are always accompanied by data loss. In that case, use the hard drive recovery software — EaseUS Data Recovery Software to rescue the lost files as soon as possible.
Use CMD to Remove Virus FAQs
Do you have more questions about using CMD to remove viruses? You will learn more by keep reading.
How can I remove the shortcut virus?
We will recommend 5 ways to help you remove shortcut viruses:
- 1. Remove shortcut virus using CMD.
- 2. Create a BAT file to remove the virus.
- 3. Use antivirus tools to remove shortcut viruses.
- 4. Remove the shortcut virus on the source PC.
- 5. Delete suspicious keys.
How do I remove a hidden virus from my computer?
You can remove a hidden virus with Windows built-in utility:
- 1. Open Security settings on Windows.
- 2. Select «Virus & threat protection» and click «Scan options».
- 3. Select «Windows Defender Offline scan».
- 4. View the results after scanning.
How do I know if my computer has a hidden virus?
There are some signs that appear if your computer has a hidden virus:
- 1. Your computer is running slowly.
- 2. Blue/black screen of death error.
- 3. There are many pop-ups.
- 4. Your files are missing suddenly.
- 5. Your computer warns you of a lack of storage space.
Viruses, malware, trojans, worms! These evil things can penetrate your computer through numerous ways like internet browsing, from USB devices, phishing links in your email and also by installing infected software.
Most of these viruses make your computer slow and eat up valuable memory as well as storage space. Some more powerful viruses are meant to contaminate our operating system too and steal personal information and banking data.
Also Read- Best Free Antivirus Software For Windows 10
The conventional method to identify and remove such unwanted programs from your computer is to install anti-virus software and scan your computer for any viruses/trojans/worms that exist and quarantine them.
However, there are some computer users out there who use unconventional methods to find such a virus and remove them without using any antivirus software.
Today we are discussing such an unconventional method by using Command Prompt or DOS Prompts to identify and remove viruses.
Also Read- A-Z Windows CMD Commands List
The method is simple and straight which even a layman computer user can proceed with, just follow the steps given below :
Remove Computer Viruses Using CMD, without any antivirus
The Command Prompt or CMD/DIS Prompt is a command-line utility program on Windows 10.
Though the command prompt is rarely used by layman PC/laptop users, it is a powerful utility in the hands of pro hackers.
CMD has access to reconstruct all Windows system files by using various attributes like removing the hidden attributes which a virus normally uses.
One of the leading causes of virus infections in computers and the CMD method work on USB to remove its viruses and secure your computer.
Step 1. Click on Start and type cmd. Now right-click on the cmd icon and select run as administrator.
Running the command as administrator is important as you need to access the system files which are not usually visible in guest accounts.
Now command prompt window will open, now select your drive from which you want to remove a virus.
Step 2. Let us suppose your USB has a virus and your USB drive is F. Type “F:” without quotation on Command line.
Step 3. Now the C: will change to F: Now you need to type “dir F:” in CMD and hit enter. It will show you the directory of the F drive.
Step 4. So now type the following command to show all the hidden and system files on your USB drive. Type “dir F: attrib -s -h /s /d *.*” without quotations and press enter. Typing this command will explore your selected drive and will load all the files including hidden and system files on your drive.
Step 5. In this window, you will notice unusual file.exe and extension if your computer has been infected with a virus like the dreaded autorun.inf virus.
Rename it using this command line rename filename.extension new filename. Usage > C://rename autorun.inf (new filename)
That’s it! Now you can identify all the viruses in your PC and USB and delete them without any help of anti-virus software. You can delete the autorun.inf by typing in the command “del autorun.inf” or del :”yourfilename”
- To run a full virus scan on Windows 10, open Windows Security > Virus & threat protection > Scan options, select “Full scan,” and click “Scan now.”
- Alternatively, you can use Command Prompt and PowerShell commands to run a malware scan on your computer.
UPDATED 1/7/2025: On Windows 10, Microsoft Defender Antivirus automatically checks and scans your computer for threats such as viruses, spyware, ransomware, rootkits, and other malware and hackers. However, sometimes, you may still need to perform a scan manually to ensure that the installation and data have not been compromised.
If you suspect a virus or other malware has infected your computer (or you want to perform a maintenance scan), Microsoft Defender Antivirus allows you to perform three types of manual scans on Windows 10, including quick, custom, and full scans using the Windows Security app, Command Prompt, and PowerShell.
In this guide, I’ll teach you to perform a virus scan using the built-in anti-malware program on Windows 10.
- Run full virus scan from Windows Security
- Run full virus scan from Command Prompt
- Run full virus scan from PowerShell
Run full virus scan from Windows Security
To run a full virus scan on Windows 10, use these steps:
-
Open Start on Windows 10.
-
Search for Windows Security and click the top result to open the app.
-
Click on “Virus & threat protection” from the left navigation pane.
-
Click on Scan options under the “Current threats” section.
-
Select the Full scan option to check the entire system for viruses and any other type of malware.
-
Click the Scan now button.
Once you complete the steps, Microsoft Defender Antivirus will scan your device for viruses and other types of malware. If any threats are detected, the antivirus automatically removes (or quarantines) them.
Also, depending on the amount of data, this process can take a long time. If you have a lot of files, it is recommended to start the scan when you are done using the device for the day and let the scan run overnight.
Run full virus scan from Command Prompt
To run a Microsoft Defender Antivirus full scan from Command Prompt, use these steps:
-
Open Start.
-
Search for Command Prompt, right-click the top result, and select the Run as administrator option.
-
Type the following command to locate the latest version of Microsoft Defender Antivirus installation and press Enter:
cd C:\ProgramData\Microsoft\Windows Defender\Platform\4*
-
Type the following command to run a full virus scan and press Enter:
mpcmdrun -scan -scantype 2
After you complete the steps, the anti-malware solution will scan the device for malware. As you run the command, you will notice the “Start scanning” message. Once the scan is complete, you will see the “Scan finished” message.
Run full virus scan from PowerShell
To start a full scan with Microsoft Defender Antivirus from PowerShell, use these steps:
-
Open Start.
-
Search for PowerShell, right-click the top result, and select the Run as administrator option.
-
Type the following command to start a full malware scan and press Enter:
start-mpscan -scantype fullscan
Once you complete the steps, Microsoft Defender Antivirus will perform a full scan to check, detect, and remove viruses and any other type of malware it might be able to find.
Update January 7, 2025: This guide has been updated to ensure accuracy and reflect changes to the process.
Last Updated :
18 Jun, 2024
Viruses and malware can wreak havoc on your computer, causing slow performance, data loss, and security breaches. While there are numerous antivirus programs available, using Command Prompt offers a powerful and direct method to remove viruses without the need for additional software. CMD is a built-in tool in Windows that can help you identify and eliminate malicious files effectively. Let’s dive in and learn how to use CMD for virus removal.
Methods to Remove Virus Using Command Prompt
In this short guide for beginners, you’ll learn straightforward steps to leverage CMD to scan for and erase malicious software. With some basic commands, you can keep your computer safe.
Method 1: Remove the Virus Using Del Command
Step 1: Open the Command Prompt
In the search bar, type «CMD» then right-click on «Command Prompt» and choose «Run as administrator». Running Command Prompt as an administrator gives it extended permissions needed to access all files and folders.
Step 2: Select the Infected Drive
Type the drive letter of the infected drive followed by a colon (for example «E:») and press «Enter». This will switch you to the drive that contains the virus or malware. Replace ‘X’ with the appropriate infected drive letter.
Step 3: Key Attributes
Type «attrib -s -h -r -a /s /d» and press «Enter». This will remove key attributes from files that might prevent deletion. The attributes that are removed are system, hidden, read-only, archive, files in subfolders, and empty folders. Removing attributes allows infected files and folders to be deleted.
Command: attrib -h -s -r /s /d *.*
Output 1:
Output 2:
Step 4: Delete the Program
Now type «del autorun.inf» and press Enter. This deletes the autorun.inf file which is commonly used by viruses and malware to execute automatically. Getting rid of this can disable some infections. Find the Suspicious file or Program that doesn’t belong to your computer to delete the file enter the following command.
Command: del ( Enter_the_Program_name_here )
Output:
Method 2: Remove the Virus Using Taskkill Command
Step 1: Open the Command Prompt
Open Command Prompt as an administrator like before by searching for CMD, right-clicking Command Prompt, and select «Run as administrator».
Step 2: List the Files using Tasklist Command
Type «tasklist» and hit enter. This displays a list of currently running processes and programs on your computer.
Command: tasklist
Output:
Step 3: Check for the Suspicious Programs
Carefully look through the list and identify any suspicious processes that could be caused by a virus infection. These may have random or unusual names. In my case, I don’t have any viruses so for a demonstration I’m gonna Choose some of my unnecessary Programs.
Step 4: Delete the Program
In my case, I don’t have any viruses so for a demonstration I’m gonna Choose some of my unnecessary Programs and delete them by using the taskkill Command.
Read this to know more about Taskkill Command here
Command: taskkill /F /IM ( Enter_Your_Program_Name_Here )
After, entering the command you will see the message like SUCCESS: The process has been terminated which means that our virus is been Successfully deleted.
Conclusion
Using CMD commands to remove viruses is a powerful and efficient method to enhance your computer’s security. By following the steps outlined in this guide, you can effectively identify and eliminate malicious files without relying on third-party software. Run antivirus scans for extra protection. Even without being an expert, these basic steps help safeguard your computer effectively.
Also Read
- How to Safely Remove Malware on Windows? [8 Methods]
- How to Find Trojan on Computers?
- How to Delete Temporary Files in Windows 10?
- How to Automatically Delete Old Files in Windows 11?