
Honest PC Virus & Malware Removal for Windows 10 and Windows 11
If your PC is doing things it shouldn't (browser hijacked to weird search pages, pop-ups everywhere, programs running you didn't install, the whole machine slowed to a crawl, or worse, a ransom note demanding bitcoin) we can help. We're a drop-off computer repair shop in Amherst, NY, and PC virus and malware removal is one of our core services. Bring the machine in, we run a real diagnostic, we tell you what's actually going on, and we give you a quote before any work starts. No upsells, no fake urgency, no "your computer has 1,247 critical errors that must be fixed immediately" routine.
Windows is the bigger malware target. There are roughly five times more Windows machines in the world than Macs, so attackers spend most of their effort there. The threat landscape on PC is wider than on Mac: drive-by infections from malicious websites and ad networks, exploited Office documents and PDFs, phishing emails that drop trojans, ransomware operators who specifically target Windows networks, fake software updaters, malicious browser extensions, and the steady drumbeat of bundled adware that comes with free software downloads. Modern Windows 11 has genuinely good built-in protection, but no defense catches everything, and human behavior (clicking the wrong link, opening the wrong attachment, downloading the wrong installer) still bypasses every security layer in the world.
The first thing worth knowing: a slow PC is not always infected. We see a lot of customers convinced they have a virus when what they actually have is a five-year-old laptop with a spinning hard drive that's failing, or a desktop with so much accumulated junk that Windows can't get out of its own way. We'll run the diagnostic, we'll tell you the truth, and if you don't have malware we won't sell you malware removal. We service every kind of Windows machine: Dell, HP, Lenovo, ASUS, Acer, MSI, Microsoft Surface, custom-built desktops, gaming rigs, Windows tablets, and the older machines still running Windows 10 because their hardware can't do Windows 11.
What's Actually on Infected PCs These Days
The malware landscape on Windows is broad. Here's what we actually see come through the shop, in roughly the order of frequency:
- Adware and PUPs (Potentially Unwanted Programs): by far the most common category. These arrive bundled with free software, "free PDF converter" tools, fake browser extensions, and "PC speedup" utilities. Symptoms: pop-up ads, browser homepage changes, search hijacks, and a general sense that the machine is doing things you didn't ask it to do. Annoying but rarely dangerous. Cleanable.
- Browser hijackers: a specific subcategory of adware that specializes in your browser. Your homepage gets pointed at a weird search portal, your default search engine changes, you get redirected to ad-stuffed pages when you try to visit normal sites. Common ones include various Yahoo redirects, Bing-Yahoo hybrids, and search portals named after random words. They install through browser extensions, modified shortcuts, registry tweaks, and sometimes group policy changes.
- Tech support scareware: the "your computer has 1,247 critical errors, call this number" pop-up. This is a hugely profitable scam that costs people thousands of dollars when they fall for it. The pop-up itself is what we're removing. If you actually called the number and gave them remote access, that becomes a much bigger cleanup because we have to assume the entire machine is compromised.
- Trojans: programs that pretended to be something legitimate (a free game, a "video codec," a cracked piece of software) and turned out to be malicious. Trojans can do anything: install backdoors, steal saved passwords, log keystrokes, recruit your computer into a botnet that attacks other systems, mine cryptocurrency in the background. Common delivery: pirated software, fake software cracks, malicious email attachments.
- Stealers: a specific category of trojan that goes after credentials. Modern stealers like RedLine, Raccoon, and Lumma scrape saved passwords from your browsers, cookies that let attackers bypass two-factor authentication, cryptocurrency wallet files, gaming account credentials, and sometimes screenshots of your activity. Stealers ship the haul to attackers and then often delete themselves, so you might not even know your data was taken.
- Ransomware: the worst of them. Ransomware encrypts your files and demands payment for the decryption key. Modern ransomware encryption is essentially unbreakable, which is the whole point of the attack. We can clean the ransomware off the machine so it's safe to use again, restore your files from backup if you have one, and pull any unencrypted shadow copies the ransomware missed. We do not pay ransoms on your behalf and we strongly advise against paying. Roughly half the time the attackers don't actually decrypt your files even after you pay.
- Fake software updates: a pop-up tells you Flash, your browser, Chrome, or some plugin needs updating. You click it. You install something that looks like an update but is actually a trojan. Real software updates do not work this way. Browsers update themselves silently. Flash hasn't existed since 2020. Anyone telling you to "update Flash" is lying.
- Malicious Office documents: Word documents, Excel spreadsheets, and PDFs that contain macros, embedded scripts, or exploits that drop malware when you open them. This is how a lot of business infections start: an employee gets an email that looks like a legitimate invoice or document, opens it, clicks "enable content" when prompted, and a trojan drops onto the system. Modern Office is more cautious about macros than older versions, but the technique still works on people.
- Cryptojackers: malware that uses your PC\'s processor and graphics card to mine cryptocurrency for the attacker. Symptoms: machine running hot, fan blasting at full speed, performance trash even when you're not doing much, electricity bill creeping up. Almost always comes from a malicious browser extension, a compromised website, or pirated software.
- Rootkits and bootkits: rare but real. These embed themselves below the operating system, in the boot process or kernel, and survive normal cleanup attempts. Modern Windows with Secure Boot makes these much harder than they used to be, but we still occasionally see machines so deeply compromised that the only fix is a clean reinstall plus a firmware refresh.
Signs Your PC Is Infected
Some signs are obvious, some are subtle. Worth a look at the machine if you\'re seeing more than one or two of these:
- Pop-up ads on your desktop, including in apps that aren\'t web browsers
- Your browser homepage or search engine has changed by itself
- You\'re being redirected to websites you didn\'t click on, especially weird ones
- Programs you don\'t remember installing are showing up in the Start menu or system tray
- Windows Defender or your antivirus has been disabled and won\'t turn back on
- The machine is running hot, the fan is constantly spinning fast, and the battery dies quickly
- Programs are crashing more than usual or refusing to start
- The cursor is moving on its own, or windows are opening and closing without input
- You can\'t access certain websites, especially security-related ones (Microsoft, Malwarebytes, antivirus vendors)
- Friends or coworkers are getting messages or emails from your account that you didn\'t send
- Files have been renamed with strange extensions (.locky, .crypto, .encrypted, random hex strings) and you can\'t open them
- A full-screen warning is telling you to call a phone number or pay to "fix" your computer
- Windows is asking for your password to authorize things you didn\'t initiate
- Your browser bookmarks or saved passwords are missing or have been changed
- Task Manager shows processes you don\'t recognize using a lot of CPU or memory
If you\'re seeing the ransom-style warnings (encrypted files, demand for payment, countdown timer) please don\'t try to fix it yourself and don\'t pay. Disconnect the PC from your network so it can\'t spread, and call us to schedule a drop-off. The faster we get to it, the better the chances of recovering anything.
How Our PC Virus Removal Process Works
Every infected PC that comes through our shop goes through the same general flow. The exact tools and steps vary based on what we find, but the rhythm is consistent:
- Scheduled drop-off and intake.You call to schedule, you bring the PC in at the agreed time. We talk through what\'s been happening: when the symptoms started, what you might have clicked or installed, what error messages you\'ve seen. This conversation often gives us a real clue about which type of infection we\'re dealing with before we even boot the machine.
- Free diagnostic.We boot the PC and inspect what\'s actually going on: running processes, scheduled tasks, registry run keys, services, browser extensions, hosts file, and the usual hiding spots. We run multiple scanners with different detection engines because no single product catches everything. We figure out what we\'re dealing with before quoting any work.
- Honest quote.We tell you what we found and what the cleanup looks like. If it\'s a quick adware removal, the quote reflects that. If it\'s a deep infection that needs a Windows reinstall, the quote reflects that too. You decide whether to proceed. The diagnostic is free and you can take the machine elsewhere with no charge if you\'d prefer.
- Targeted cleanup.For most infections (we estimate 70 percent), we can do a targeted cleanup: removing malicious files, registry entries, scheduled tasks, services, browser extensions, and shortcuts. We then verify the symptoms are actually resolved by using the machine normally, not just by running another scan.
- Clean Windows reinstall when needed.For the remaining 30 percent (deep infections, system file modifications, persistent malware) we recommend a full reinstall. We back up your personal files first, wipe the drive, install a fresh copy of Windows, restore your files, and reinstall the software you need. This is the most thorough fix and the only way to be certain on serious infections.
- Hardening and verification.Before you pick up the PC, we make sure Windows Defender is on and current, check that critical security updates are installed, remove suspicious browser extensions you may not have intended to install, and verify the machine behaves normally across reboots. We\'re not just running a scan and calling it done.
- Pickup and walkthrough.When you come to pick up the PC, we\'ll walk you through what we found and the small handful of habits that prevent reinfection. Two minutes here saves a lot of grief later.
Why We Don\'t Do Remote PC Virus Removal
You\'ll see services online offering remote virus removal, where they connect to your PC over the internet and clean it from wherever they are. Some of these services are legitimate. We don\'t operate that way, and there\'s a real reason: when malware has compromised a PC, the malware itself can interfere with cleanup tools. Some infections actively block antivirus software from running. Some hide in places that only show up when you boot from external media (which is hard to do remotely). And worst case, if the infection includes a keylogger or remote access trojan, the technician on the other end of a remote session is potentially exposing themselves to whatever\'s on your machine, with no real way to verify the cleanup is complete.
When the PC is physically in our shop, we can boot from clean external media, run scanners offline, manually inspect the file system and registry, and verify the machine is genuinely clean before it goes back to you. It\'s a longer process than a remote session, but it\'s the difference between actually fixing the problem and putting a band-aid on it.
We also won\'t ask you for remote access over the phone. If anyone calls you claiming to be from Microsoft, your ISP, "Windows technical support," or any similar-sounding outfit, asking for remote access to fix a problem they say you have, that\'s the scam. Microsoft does not call you. Your ISP does not call you about viruses. Apple does not call you about your Windows PC.
How Windows 10 vs Windows 11 Affects the Cleanup
The general approach is the same on both, but a few things differ in practice. Windows 11 has stricter requirements for low-level drivers and kernel-mode software, which makes some categories of malware harder to install in the first place. Secure Boot is required by default on Windows 11, which prevents most bootkit-style infections. Microsoft Defender on Windows 11 is also somewhat more aggressive about blocking ransomware-like behavior than on Windows 10.
That said, the bulk of malware we see on PCs (adware, browser hijackers, scareware, trojans, stealers) targets the user rather than the operating system. Whether you\'re on Windows 10 or Windows 11 doesn\'t much matter to those threats. They get installed because the user clicked something, typed a password, and approved an installation. No version of Windows protects you from yourself.
Older Windows machines (Windows 7, Windows 8.1) are a separate conversation. Microsoft stopped issuing security updates for those versions years ago, which means new vulnerabilities don\'t get patched. We can still clean infections off them, but we\'ll have an honest discussion about whether the machine should be upgraded to Windows 10 or 11, or whether the hardware is old enough that the right answer is replacement. Purchase consulting is a free conversation if you\'re weighing options.
Common PC Infection Scenarios We See in Western New York
Patterns repeat. Here are the situations we end up handling most often in the shop, all anonymized:
The "Free PDF converter" home PC
Someone needed to convert a PDF, searched for a free tool, downloaded the first thing that looked legitimate, and now the browser has three new toolbars, the homepage points to a search portal nobody asked for, and ads are showing up everywhere. This is the most common thing we see. The actual PDF converter (if it even works) came bundled with adware that took over the system. Routine cleanup. We use these visits as a teaching moment: free software bundled with installers is the single largest source of home PC adware, and the "express install" option almost always means "install three other things you didn\'t ask for."
The "Microsoft called me" PC
Someone got a phone call (or saw a pop-up that gave them a phone number to call) claiming to be Microsoft technical support. The caller said the PC was infected, asked for remote access, "fixed" it, and charged a few hundred dollars on a credit card. Sometimes the caller also installed actual remote access software while they were in there, or set up scheduled tasks to "monitor" the machine. We treat these PCs as fully compromised, which means a clean reinstall plus changing all important passwords from a different device. The hardest part is convincing the customer they got scammed, because the caller was very convincing and they paid real money.
The home office PC after a phishing email
Someone in the household opened an email that looked like it was from a vendor, a bank, or a colleague. The email had an attachment or a link. They opened it. Now Windows Defender is showing alerts, the browser is acting weird, and they\'re worried because they do their banking on this machine. We treat these as potentially serious because phishing emails often lead to credential theft, not just adware. We clean the machine, and we have a serious conversation about changing the bank password, the email password, and any account that uses the same password. Sometimes we recommend a clean reinstall just to be safe.
The student\'s gaming laptop loaded with sketchy stuff
Common during summer when kids are home from school. The pattern: a teenager installed "free Roblox" something, cracked Minecraft mods, free game cheats, or pirated software. Now the laptop has a buffet of adware, a few cryptojackers, occasionally a stealer that grabbed their gaming credentials. Cleanup is straightforward once we know what we\'re looking at. We sometimes also recommend setting up a separate Windows user account with limited permissions so the same thing doesn\'t happen again.
The small business PC after a fake invoice
An employee at a Western New York small business opened an email that looked like an invoice from a vendor. The PDF attachment had a malicious payload. Now the machine is acting strange and the business owner is worried because that PC has access to QuickBooks, customer files, and payroll. This is the dangerous one because business malware is often trying to spread to other machines on the network, capture credentials, or position itself for a ransomware attack. We isolate the machine, clean it thoroughly, and have a serious conversation with the owner about backup, email security, and whether other machines on the network should be checked too.
The ransomware call
The phone rings, someone\'s files are encrypted with strange extensions, there\'s a ransom note on the desktop demanding payment in bitcoin within 72 hours. We handle these regularly. The honest conversation: the encryption itself is usually unbreakable, the ransomware needs to come off the machine before it can be safely used, and recovery depends entirely on whether they have a working backup. We do not pay ransoms, we strongly advise against paying, and we work with the customer on what\'s actually recoverable.
Why Choose Us for PC Virus Removal in the Amherst & Buffalo Area
You have options. There are big-box retailer service counters at Best Buy, there are national chains, there are remote services online, and there are other local shops. Here\'s what\'s true about us:
The work happens here in Amherst. Your PC doesn\'t get shipped to a warehouse. We don\'t subcontract. The same shop that quoted you the work is the shop that does the work. If you have a question while we have your machine, you call our shop and you get the person actually working on it.
We diagnose before we quote. We don\'t estimate over the phone. We don\'t guess. We look at the PC, we tell you what we found, and then we tell you what it costs. The diagnostic is free, and if you don\'t have a virus we won\'t charge you for virus removal.
We don\'t upsell. If your PC needs virus removal, that\'s what we\'ll quote. We don\'t slip in "while we\'re at it" charges or sell you software subscriptions you don\'t need. If we think there\'s something else worth doing (an SSD upgrade for a slow machine, a backup setup since you just learned what ransomware is) we\'ll mention it once and let you decide.
We do both Windows and Mac. A lot of repair shops only really know one platform well. We work on PCs every day: Dell, HP, Lenovo, ASUS, Surface, custom builds, gaming rigs, business laptops, the lot. We also handle Mac, which is rarer in our business but a core part of what we do. Mac virus removal is its own page if you also have a Mac.
Drop-off only, by appointment, on purpose. We don\'t do on-site, we don\'t do remote, and we don\'t do walk-ins. Working on a machine in the shop with proper tools and clean media is how you actually fix problems. The appointment system means every PC gets real attention rather than getting buried in a queue.
We\'re located on North French in the Amherst / Tonawanda area, easy access from the I-290, Sheridan Drive, Maple Road, and Niagara Falls Boulevard. Customers regularly drive in from across Western New York: Williamsville, Tonawanda, Kenmore, North Buffalo, the UB North Campus area, and the surrounding Amherst neighborhoods. Parking is right at the building.
How Pricing Works for PC Virus Removal
We don\'t post a flat rate, and there\'s a real reason for it: the right price genuinely depends on what we find. A basic adware cleanup on a relatively healthy machine is one thing. A fully infected PC that needs a clean Windows reinstall plus data backup plus software reinstallation is a totally different scope of work. Quoting either one without looking at the machine would mean either overcharging easy jobs or underquoting hard ones.
What we can promise:
- The diagnostic is free. We look at your machine and tell you what\'s wrong before we quote anything.
- You get a real quote with a real number before any work happens. No "we\'ll figure it out as we go."
- No surprise charges. The price we quote is the price you pay, unless we find something genuinely unexpected, and we call you first if that happens.
- You can walk away after the diagnostic with no charge. If you decide not to do the work or want a second opinion elsewhere, that\'s fine. Take your PC and go.
Get a Free Quote on PC Virus Removal
Call 716-771-2536 or request a quote online. Tell us briefly what\'s happening with your PC and we\'ll set up a drop-off time and give you an honest answer about what it\'ll take to fix.
How to Avoid Reinfection on Your PC
We\'ll cover this when you pick up the machine, but here\'s the short version. Most PC infections are preventable, and the prevention isn\'t complicated.
Don\'t install free software from random websites. If you need a free PDF reader, get it from the actual maker\'s site, not from "freepdfdownload-deals.net" or whatever shows up in a search ad. Free software bundled with installers is the single biggest source of home PC adware. The "express install" option almost always means "install three other things you didn\'t ask for." Always pick custom install and uncheck everything you don\'t recognize.
Don\'t click pop-ups telling you Flash, Java, your browser, or any plugin needs updating. Real updates don\'t work that way. Browsers update themselves silently. Flash hasn\'t existed since 2020.
Don\'t open email attachments you weren\'t expecting, even if they look like they\'re from someone you know. Email addresses are easy to fake, and a lot of business email accounts get compromised and used to send malware to the contact list. If you weren\'t expecting an attachment, call or text the person and ask before opening.
Don\'t call phone numbers from pop-up "virus warnings." Microsoft, Apple, and your ISP do not warn you about viruses with pop-ups that include phone numbers. That\'s the scam.
Keep Windows updated. Microsoft\'s monthly security updates patch real vulnerabilities, and skipping them leaves doors open that don\'t need to be open. Same goes for browser updates and updates to anything that touches the internet.
Back up your important files. We can fix almost anything, but ransomware that\'s already encrypted your files is the one situation where prevention is dramatically better than recovery. We can set up a backup the next time you bring the PC in if you don\'t have one yet.
What to Do Right Now If You Think Your PC Is Infected
If you\'re reading this on the infected machine, a few quick things while you wait to schedule a drop-off:
Stop using the PC for anything sensitive. No banking, no logging into email, no entering passwords or credit card numbers. The longer the malware is active, the more it can do.
If you can, disconnect from the internet. Unplug the ethernet cable, turn off Wi-Fi, or unplug the router for a minute. This stops most malware from talking to its operators and prevents it from spreading to other machines on your network. It also halts ransomware in progress from encrypting more files.
Don\'t try to clean it yourself by downloading random tools you find through a search. A lot of "free virus removal" tools are themselves malware, especially the ones that show up in search ads. Even legitimate tools can be tricky on an active infection.
Don\'t pay any pop-up demanding payment, and don\'t call any phone number a pop-up tells you to call. Tech support scams cost people thousands of dollars and we see victims of them every month.
If you already entered passwords or financial info on the PC after you suspect the infection started, change those passwords from a different device (your phone is fine). Start with email and banking. Call your bank if a payment method was used.
Then call us at 716-771-2536 to schedule a drop-off. We\'ll set up a time, you bring the PC in, and we\'ll get to work.
Service Areas for PC Virus Removal
Customers regularly drop off PCs from across Western New York:
- Amherst, NY
- Buffalo, NY
- Williamsville, NY
- Tonawanda, NY
- Cheektowaga, NY
- Clarence, NY
- Kenmore, NY
- Lancaster, NY
Got a Mac instead?
We service both. View our Mac virus removal page for Apple-specific details, or our general virus removal overview covers both platforms.
Frequently Asked Questions
PC and Windows-specific questions we hear at the counter.
