Safe Mode strips Windows down to only its essential drivers and services, which is exactly why it's such an effective environment for removing malware — most infections rely on normal startup processes to load, hide, and defend themselves, and Safe Mode simply doesn't run them. This guide covers every practical way to get into Safe Mode, even when malware is actively interfering with normal startup, and how to make the most of it once you're there.

Why Safe Mode Matters for Malware Removal

In a normal Windows session, active malware can:

  • Actively block or disable your antivirus software
  • Reinstall itself immediately after deletion via a background "watchdog" process
  • Hide its own files and processes from Task Manager and File Explorer
  • Interfere with downloading or running removal tools

In Safe Mode, only core Windows drivers and a minimal set of services load. Most malware persistence mechanisms — startup entries, scheduled tasks, and injected services — simply don't run, which means the malware can't actively resist removal the way it can in a normal session.

Safety warning: Before starting any malware removal, back up important personal files (documents, photos) to a USB drive or external disk if you haven't recently, ideally from a state where you're reasonably confident the files themselves aren't infected. This protects your data in case removal requires a more drastic step later, such as a full reinstall.

Safe Mode With Networking vs Plain Safe Mode

  • Plain Safe Mode loads only essential drivers and no network connection — the most restrictive environment, best when malware is actively spreading over the network (a worm) or you already have removal tools saved locally.
  • Safe Mode with Networking adds network drivers, letting you download updates and removal tools directly — necessary if you haven't already got Malwarebytes or similar downloaded, but be aware some malware can still attempt limited network activity in this mode.

For most home users, start with Safe Mode with Networking so you can download Malwarebytes if you don't already have the installer, then consider plain Safe Mode for a second, more restricted scan pass if problems persist.

Method 1: From Within Windows (Settings)

Use this if Windows currently starts normally and you can reach the desktop.

  1. Open Settings > System > Recovery.
  2. Under Advanced startup, click Restart now.
  3. After the PC restarts to a blue menu, choose Troubleshoot > Advanced options > Startup Settings.
  4. Click Restart.
  5. Once the PC restarts again, you'll see a numbered list of options — press 4 or F4 for Safe Mode, or 5/F5 for Safe Mode with Networking.

Method 2: From the Sign-In Screen

Use this if you can reach the login screen but don't want to fully log in first, or normal login is behaving oddly.

  1. On the sign-in screen, hold Shift and click Power > Restart.
  2. Windows restarts into the same blue recovery menu described above.
  3. Follow the same path: Troubleshoot > Advanced options > Startup Settings > Restart, then press 4 or 5.

Method 3: Using System Configuration (msconfig)

Use this if you can reach the desktop and want Safe Mode to persist across multiple restarts automatically (useful for a longer removal session).

  1. Press Win + R, type msconfig, and press Enter.
  2. Go to the Boot tab.
  3. Under Boot options, tick Safe boot and choose Minimal (plain Safe Mode) or Network (Safe Mode with Networking).
  4. Click OK and restart when prompted.
  5. Important: once you've finished malware removal, return to msconfig > Boot and untick Safe boot, then restart — otherwise Windows will keep booting into Safe Mode every time.

Method 4: When Windows Won't Start Normally at All

If malware has damaged Windows badly enough that it won't boot to a login screen:

  1. Force a restart by holding the power button during startup, and repeat this three times — Windows will detect the repeated failed boots and automatically enter the Windows Recovery Environment (WinRE).
  2. From WinRE's blue menu, follow the same path: Troubleshoot > Advanced options > Startup Settings > Restart, then choose Safe Mode.
  3. Alternatively, boot from a Windows installation USB drive (created on another PC using the Media Creation Tool) and choose Repair your computer from the installer screen to reach the same recovery menu.

Pro tip: If you don't have a Windows installation USB ready and can't get into Safe Mode by any other route, create one on a different, known-clean computer using Microsoft's official Media Creation Tool — this also lets you run offline scanning tools directly from the USB drive without booting the infected Windows installation at all.

What to Do Once You're in Safe Mode

  1. If you're in Safe Mode with Networking, download Malwarebytes from the official malwarebytes.com site (if not already on the machine) and install it.
  2. Run a full/threat scan, not a quick scan — Safe Mode's reduced background activity makes a full scan faster and more thorough than usual.
  3. Quarantine everything detected.
  4. Open Task Manager and check the Startup apps tab even in Safe Mode — you can still disable unfamiliar entries here ready for the next normal boot.
  5. Check Task Scheduler for suspicious scheduled tasks pointing to files in Temp, AppData, or unfamiliar folders, and delete them.
  6. Restart normally and run a further scan with Windows Defender (Virus & threat protection > Microsoft Defender Offline scan) to confirm nothing survived.

Troubleshooting Safe Mode Itself

  • F8 doesn't work on modern PCs: fast SSD boot times mean the classic F8-at-startup method rarely catches in time on Windows 10/11 — use the Settings or forced-restart methods above instead.
  • Safe Mode option missing from Startup Settings: some OEM fast-boot configurations hide it; use the "hold Shift while clicking Restart" method, or boot from installation media if that also fails.
  • PC won't restart out of Safe Mode: check msconfig > Boot for a lingering "Safe boot" tick box, as described in Method 3 — this is the most common cause of getting stuck in a Safe Mode loop.
  • Malware still active even in Safe Mode: this suggests a rootkit that hooks into the boot process itself, at which point booting from a separate rescue USB (such as the Malwarebytes rescue disk or Windows Defender Offline scan, which effectively does this automatically) becomes necessary, since even Safe Mode still uses the potentially compromised Windows kernel.

Safe Mode is one of the most effective free tools you have against active malware precisely because it denies the infection the normal startup environment it depends on — always attempt removal here before considering a full reinstall.

Was this guide helpful? Explore more Malware Removal guides, or browse all Security & Performance articles.