Clear malware traces using Windows Disk Cleanup

When malicious software runs on a Windows PC, it often leaves behind temporary clutter that helps it survive a reboot. Cached installers, prefetch data and leftover log files can be used by threats to reload themselves after a quick restart. Australian home users in Sydney, Melbourne and Brisbane are usually advised to flush these junk locations before running a full antivirus scan.

Windows includes a built-in utility called Disk Cleanup, originally designed to free storage by removing old update files and cached thumbnails. Used correctly, it also strips out temporary traces that worms, trojans and browser hijackers drop onto the system drive. It is not a replacement for a dedicated scanner, but it works well as a supporting step.

Australia's eSafety landscape makes this kind of routine housekeeping more relevant every year. The Australian Cyber Security Centre reports that small household networks on the NBN are increasingly being targeted. The Privacy Act 1988 and its Notifiable Data Breaches scheme mean careless handling of infected files can have legal consequences for businesses, fitting within the ACSC's Essential Eight model.

The steps below cover preparing a Windows machine, running Disk Cleanup with the extra system files option, choosing which categories to target, pairing the process with a dedicated malware tool and locking down the system against reinfection. Browse broader worm guidance if you suspect an active infection rather than leftover clutter.

Cleanup location	What it normally contains	Worth removing when malware is suspected
Windows Temp folder	Installer extracts, app cache	Yes, almost always
Downloaded Program Files	Legacy ActiveX controls	Yes if unrecognised
Windows Update Cleanup	Superseded update packages	Yes, safe to delete
Thumbnails	Image previews	Only if a thumbnail exploit is suspected
Recycle Bin	User-deleted files	Empty after scanning
Prefetch data	Boot-time loading hints	Usually safe to remove

Preparing a Windows machine before cleanup

A few quick precautions make Disk Cleanup more effective and prevent accidental data loss. First, confirm the system clock, date and time are accurate, since some malware alters them to defeat scheduled scans. Users on Telstra, Optus or Aussie Broadband connections should disconnect from public Wi-Fi at cafés and libraries in places such as Bondi or South Bank before starting.

Back up anything that matters, especially browser bookmarks, tax records and small-business invoices kept on the desktop. An external drive or a reputable cloud service works well, but never store backups on the same drive you are about to clean. The ACSC recommends keeping at least one offline copy because ransomware often tries to encrypt connected backups.

Pre-cleanup checklist

• Disconnect from the internet and any mapped network shares.
• Confirm Windows Update has run recently, then pause it manually.
• Open Task Manager and end any process you do not recognise.
• Note licence keys for paid software in case a clean reinstall is needed later.

Running Disk Cleanup with the system files option

Standard Disk Cleanup only touches user-level temp files, but the real prize is the system-level sweep. Click Start, type "Disk Cleanup", launch the app, choose the system drive (usually C:) then press the button labelled "Clean up system files". Administrator permission is required because Windows protects many of these locations.

A new list of categories appears, including Windows Update Cleanup, Windows Defender files, delivery optimisation files and various diagnostic dumps. Tick the boxes you are comfortable with and leave alone anything you do not recognise. Categories showing zero kilobytes simply mean there is nothing to clean.

The whole process rarely takes more than ten minutes on a modern SSD. Restarting afterwards lets services that depended on cached data rebuild fresh, which alone often fixes the sluggish behaviour common on older laptops shared by students in Adelaide and Perth.

Targeting temporary files created by specific threats

Browser hijackers typically drop shortcut targets and helper files inside %AppData% and %Temp%, often pointing to renamed copies of the offending executable. Worms, by contrast, prefer recovery entries and scheduled tasks in places such as C:\Windows\Temp and the Prefetch folder.

To inspect what is there, press Windows + R, type %temp% and sort by date modified. Anything newer than your last known clean boot is a candidate for removal. Repeat for C:\Windows\Temp (administrator rights required) and for the Prefetch folder, though the latter is best left alone unless the entries are clearly malicious.

These locations are covered in dedicated browser hijacker guides when symptoms point to a hijacked homepage rather than a deeper infection. Once identified, the files can be dragged to the Recycle Bin or removed from inside Disk Cleanup's expanded view.

Pairing Disk Cleanup with a dedicated malware scanner

Disk Cleanup removes the clutter but does not quarantine running processes. The next step is to boot into Safe Mode, launch a reputable on-demand scanner and run a full system sweep. This second layer catches anything that survived the temp purge, including dormant payloads hiding inside restore points.

Reporting scam messages to the ACCC's Scamwatch service helps Australian authorities track new waves of attacks, particularly during tax time when ATO-themed lures spike. If a small business is involved, an IT provider can assess whether the Notifiable Data Breaches scheme applies to the incident.

Steps to take once the scan finishes

• Allow the scanner to quarantine every flagged file rather than trying to clean in place.
• Restart the PC before reconnecting to the home network.
• Change passwords for online banking, email and myGov from a separate, clean device.
• Run a quick boot-time scan if the security tool supports one.

Locking down the system after the cleanup

A clean system only stays clean if it is maintained. Australian households should treat routine housekeeping as a recurring chore rather than a one-off reaction. The ACSC's Essential Eight encourages businesses to keep patching current, restrict admin rights and back up regularly, and home users benefit from the same habits.

A short follow-up routine every few weeks keeps temp directories from growing back into a hiding place. For broader coverage of digital threats and removal walkthroughs, the Pc Malware Expert homepage collects current guides on worms, hijackers, ransomware and prevention.