My PC Is Infected and Windows Wont Cooperate - How Do I Clean It Offline
Pop-ups keep coming, unknown programs run by themselves, and your antivirus has been disabled or simply finds nothing while the PC crawls. That is exactly when you stop fighting the infection from inside the infected Windows — boot from your toolkit USB and scan the drive while the malware is asleep.
🎥 The toolkit USB that boots this clean scanning environment is built step by step in the video
Modern malware defends itself: running inside Windows, it can hide its files from your antivirus, block security tools and reinstall itself after every cleanup. Offline scanning removes that home advantage. When you boot Strelec or MediCat from USB, the infected Windows never starts — its files just sit on the disk, inert, where a scanner can see and remove them honestly. One limit, stated plainly: an offline scan removes malware, but it cannot decrypt files already encrypted by ransomware — if your documents have strange new extensions and a ransom note, data recovery is a separate problem.
TASK MANAGER — WHAT AN INFECTED PC OFTEN LOOKS LIKE
unknown_update.exe
CPU 98%
svchost_helper.exe
CPU 87%
Google Chrome
CPU 12%
Microsoft Word
CPU 4%
📷 A classic symptom — processes you never installed eating the whole CPU while your real programs crawl
1
Boot the Toolkit and Get It Online If You Can
Boot your Ventoy USB and choose Sergei Strelec WinPE or MediCat
If a LAN cable is available, plug it in — both toolkits include network support, and a wired connection usually works in PE without any setup
Wi-Fi inside WinPE works on many machines but not all; do not waste an hour fighting it — the wired cable or the bundled offline definitions are both fine
Being online matters for one reason: fresh virus definitions. A scanner with today's definitions catches far more than one using the set from when the toolkit was downloaded
2
Update Definitions, Then Choose a Full Scan of the Windows Drive
Strelec and MediCat both carry portable antivirus and anti-malware scanners in their program menus (portable scanners of the Dr.Web CureIt! type are a common inclusion). Whichever scanner your build has, the usage pattern is the same:
Open the scanner and run its definition update first, if you are online
Choose Full scan / Custom scan — not the quick scan
Select the internal drive that contains the infected Windows (identify it by the Windows and Users folders; its letter differs inside PE)
Set the action for found threats to Quarantine rather than immediate delete — quarantine lets you undo a false positive
3
Run the Scan to Completion — Then a Second Opinion ⭐
Start the scan and let it finish, even if it takes an hour — stopping early leaves the infection's second half behind
Review the results and quarantine or remove everything found
Now run a second scanner from a different maker over the same drive. No single engine catches everything; the second pass is what separates a real cleanup from a hopeful one
Note what was found — the names tell you whether this was a simple adware bundle or something that steals passwords, which decides Fix 5
SCAN RESULTS — WHAT A FINDING LIST LOOKS LIKE
Trojan:Win32/WacatacQuarantined
PUA:Win32/PresenokerRemoved
Adware browser extension files (3)Removed
Remaining files on driveNo threats found on second pass
📷 Real detection names follow this pattern — a family name, and the action the scanner took
Both the scanning environment and the toolkits themselves come from the one USB built on screen in the video above — prepare it on a clean PC, then use it on the infected one.
4
Clean the Leftovers in Windows Startup
After the malware files are gone, Windows may still try to launch them at every login and show "file not found" errors, or the infection's entries may sit waiting in startup.
Boot back into the cleaned Windows
Open Task Manager → Startup apps and disable anything you do not recognize
Check your browsers: remove unknown extensions, and confirm the homepage and search engine are the ones you chose
Delete leftover scheduled tasks with random names via Task Scheduler if you find them
5
Finish Inside Windows — and Judge the Damage Honestly
Run a full scan with your regular, now-working antivirus inside Windows
Install pending Windows updates — many infections entered through an unpatched hole
If the infection was a password-stealing type, change important passwords (email, banking) from a different, clean device
If Windows remains unstable or damaged after cleaning, the honest fix is to rescue your files from WinPE (see this site's data rescue guide) and reinstall — a cleaned-but-broken system is not a victory
💾 Ransomware is the exception to everything above: if your files end in strange extensions and a ransom note is on the desktop, an offline scan will stop the malware spreading but will not bring the files back. Do not pay, do not keep using the PC for important work, and keep the drive as-is if the data matters — recovery, where possible at all, works from backups or specialist tools, not from antivirus.
🎥 Build the Cleaning Toolkit in Video
One Ventoy USB with Strelec and MediCat — the full build is shown in the video, ready before the day you need it.
Scanners act on infected program files and known malware locations, and this guide uses quarantine rather than instant deletion, so a mistaken detection can be restored. Your documents and photos are not what these tools target — though a heavily infected system file that Windows needs can occasionally be among the casualties, which is why Fix 5 includes a repair/reinstall judgement.
Why did my normal antivirus find nothing while the PC was clearly infected?
Because the malware was running with the same or higher privileges than the antivirus and actively hiding from it — a standard trick. Offline, the malware is just files on a disk: it cannot hide, cannot fight back, and cannot reinstall itself mid-scan.
The scans are clean now, but the PC is still slow. What else could it be?
Infection is only one cause of slowness. A failing hard disk, bad RAM, overheating or a Windows installation damaged by the infection (or by its removal) all feel similar. Use the same toolkit USB to check disk health and test the RAM before blaming a virus that is no longer there.
This guide is based on Technical Anshu's "One USB = All Tools" video • Stuck on a step? Ask in the video comments — you'll get help there 🙏