How to Detect and Remove Spyware From Your Windows PC
Spyware is one of the most insidious threats facing Windows users today. Unlike ransomware that announces itself loudly, spyware operates in the shadows — quietly logging your keystrokes, harvesting passwords, monitoring your browsing habits, and transmitting sensitive data to remote servers. By the time most users realize something is wrong, the damage is already done.
In this guide, you'll learn exactly how to detect spyware on your Windows PC, remove it completely, and put defenses in place to prevent future infections.
Having this problem on your own PC?
Describe what's happening and get a real AI diagnosis in seconds — no account needed.
Warning Signs Your PC May Have Spyware
Spyware rarely announces itself, but it does leave clues. Watch for these red flags:
Sluggish performance — Your PC suddenly feels slow even when running basic tasks
Unexplained network activity — Data is being sent or received when you're not actively browsing
Browser hijacking — Your homepage, search engine, or new-tab page changed without your input
Unfamiliar programs — New toolbars, extensions, or applications appeared that you didn't install
Excessive pop-up ads — Ads appear even when your browser is closed
Disabled security software — Your antivirus or Windows Defender was turned off without your knowledge
Overheating or high CPU usage — Background processes are consuming resources you can't account for
If you notice two or more of these symptoms simultaneously, treat it as a strong indicator of spyware infection and act immediately.
Step 1: Run a Full System Scan With Windows Defender
Windows 10 and 11 include Windows Defender (Microsoft Defender Antivirus), which can catch many common spyware variants. Start here before reaching for third-party tools.
Open Windows Security from the Start menu
Click Virus & threat protection
Select Scan options → Full scan
Click Scan now and wait for the process to complete
For a command-line scan, open PowerShell as Administrator and run:
Start-MpScan -ScanType FullScanAfter the scan, review the Protection history section for any detected threats and follow the prompts to quarantine or remove them.
Step 2: Use Malwarebytes for a Second-Opinion Scan
No single tool catches everything. Malwarebytes is widely regarded as one of the best second-opinion scanners for spyware and adware that Defender may miss.
Download Malwarebytes from the official site (malwarebytes.com)
Install and run a Threat Scan
Quarantine all detected items
Restart your PC when prompted
The free version is sufficient for on-demand scanning. Running both Defender and Malwarebytes gives you layered coverage against different spyware families.
Step 3: Check Running Processes for Suspicious Activity
Spyware often hides as a background process with a generic or misleading name. Use Task Manager and Resource Monitor to investigate:
Press Ctrl + Shift + Esc to open Task Manager
Click More details if in compact view
Sort by CPU or Network to surface high-activity processes
Right-click any suspicious process → Open file location to inspect the executable
For deeper inspection, use the built-in command:
netstat -bThis lists all active network connections alongside the executable responsible — a powerful way to catch spyware phoning home.
You can also check the Startup tab in Task Manager (msconfig → Startup) for programs that launch automatically and shouldn't be there.
Step 4: Audit Browser Extensions and Reset If Needed
Browser-based spyware often installs as an extension. Audit every installed extension:
Chrome: chrome://extensions/
Edge: edge://extensions/
Firefox: about:addons
Remove any extension you don't recognize or didn't intentionally install. If your browser behavior is still abnormal after removing suspicious extensions, perform a full browser reset:
In Chrome: Settings → Reset and clean up → Restore settings to their original defaults
In Edge: Settings → Reset settings → Restore settings to their default values
A reset clears injected homepage settings, search engine hijacks, and persistent adware scripts.
Step 5: Check the Windows Registry for Persistence Keys
Advanced spyware embeds itself in the Windows Registry to survive reboots. Use Registry Editor carefully:
Press Win + R, type regedit, press Enter
Navigate to:
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Look for entries pointing to unfamiliar executables or temp folder paths
Warning: Only delete registry entries you can positively identify as malicious. Incorrect deletions can destabilize Windows. When in doubt, use a dedicated removal tool rather than editing the registry manually.
Step 6: Use DiagnoseMyPc to Identify Underlying Issues
After removing spyware, your system may still show performance problems caused by the infection — corrupted startup entries, degraded disk health, or misconfigured security settings. This is where DiagnoseMyPc becomes invaluable.
DiagnoseMyPc scans your entire system and surfaces hardware and software issues that spyware may have introduced or exploited:
Identifies abnormal CPU and memory usage patterns
Flags startup programs that shouldn't be running
Checks disk health for signs of corruption
Reports on system configuration vulnerabilities
Running a full diagnostic after a spyware removal gives you a clean baseline and confirms your system is truly back to normal — not just superficially clean.
Preventing Future Spyware Infections
Removal is only half the battle. Adopt these habits to stay protected:
Keep Windows updated — Run winver to check your build and enable automatic updates via Settings → Windows Update
Enable real-time protection — Never disable Windows Defender or your antivirus for convenience
Download software only from official sources — Avoid bundled installers from third-party download sites
Use a standard user account — Limit daily use to a non-administrator account to reduce spyware's ability to install system-level components
Enable SmartScreen — Windows SmartScreen blocks known malicious downloads and websites
Audit installed programs regularly — Go to Settings → Apps → Installed apps monthly and remove anything unfamiliar
Use a DNS-level blocker — Services like Cloudflare 1.1.1.1 or NextDNS can block spyware domains before they load
When to Consider a Clean Windows Reinstall
If spyware has deeply embedded itself — particularly rootkit-level infections — no amount of scanning may fully clean the system. Signs you may need a fresh Windows install:
Security tools are repeatedly disabled after re-enabling them
Spyware reappears after removal within hours
System files are corrupted (sfc /scannow reports unfixable errors)
You cannot trust the integrity of your operating system
A clean reinstall via Windows Reset (Settings → System → Recovery → Reset this PC → Remove everything) is the nuclear option but guarantees a clean slate.
Take Control of Your PC's Security Today
Spyware thrives on neglect — outdated software, unchecked browser extensions, and infrequent scans create the perfect environment for it to operate undetected. By following the steps in this guide, you can detect, remove, and prevent spyware from compromising your Windows PC.
For a comprehensive health check that goes beyond spyware removal, try DiagnoseMyPc — the free diagnostic tool that gives you a complete picture of your system's hardware health, performance bottlenecks, and security posture. Run your first scan today at diagnosemypc.com and know exactly what's happening inside your PC.
Found this helpful?
Share it with someone who could use it.
DiagnoseMyPC Team
Expert PC diagnostics and troubleshooting guides to help you keep your Windows system running smoothly.
Get the free Windows Troubleshooting Checklist
Subscribe and instantly download our 50-point Windows troubleshooting checklist — plus practical fixes, performance tips, and security alerts from the DiagnoseMyPC team.
No spam. Unsubscribe anytime.
Frequently Asked Questions
How do I know if my PC has malware?
Common signs include sudden slowdowns, pop-ups, unfamiliar programs, high network or CPU usage when idle, and browser changes you didn't make. An AI diagnosis can flag suspicious activity in your system data — run a free scan at diagnosemypc.com to check.
Is Windows Defender enough to protect my PC?
For most home users, Windows Defender plus safe browsing habits and regular updates is solid protection. The bigger risks are outdated software, weak passwords, and clicking malicious links — good habits matter more than any single tool.
What should I do first if I think I've been hacked?
Disconnect from the internet, change important passwords from a different device, run a full security scan, and check for unfamiliar programs or startup entries. A diagnosis helps confirm what changed on your system so you know exactly what to clean up.
Does this tool make changes to my PC without asking?
No. The analyzer only reads the diagnostic data you choose to share and shows you any recommended fixes first. You stay in complete control of what actually runs on your computer.
