How to Use Safe Mode With Networking for Malware Removal

Windows Safe Mode with Networking starts the operating system with a limited set of drivers and services while retaining internet access. This can make it easier to download a trusted scanner when ransomware, a browser hijacker, or a persistent trojan blocks normal Windows tools.

The mode is useful because many malicious programs launch during a standard Windows session. With fewer startup components active, security software may be able to detect and remove files that were previously locked or protected by a running process.

Before changing settings, save any available work and record important symptoms. Note pop-ups, suspicious browser extensions, unusual CPU use, ransom messages, and the approximate time the problem began. If banking, email, or social media accounts may have been exposed, use a different clean device to change passwords.

Australian users should also be cautious when downloading “fixes” from search advertisements or unsolicited support calls. The Australian Cyber Security Centre and Scamwatch regularly warn about fake security software, remote-access scams, and impersonation attempts. Use the malware publisher’s official website or a reputable cybersecurity resource such as Pc Malware Expert to identify legitimate tools.

Prepare Before Entering Safe Mode

Disconnect external storage drives, including USB sticks and portable hard drives, unless they are needed for a verified backup. Malware can spread to removable media, and ransomware may encrypt connected files. If possible, copy essential documents to a clean, trusted location before beginning any removal work.

Have an administrator account available and make sure you know whether the computer uses Wi-Fi or Ethernet. Safe Mode with Networking may load only a basic network driver, so an Ethernet cable connected to an NBN router can be more reliable than wireless on some Windows laptops. Avoid public Wi-Fi in places such as a Melbourne café or a Sydney airport while downloading security software.

If Windows is unstable, write down the names of suspicious applications and browser extensions first. Do not open unknown attachments or revisit malicious pages to test whether the problem has disappeared. For a worm that may have used an address book, review guidance on email-spreading worms before contacting your email contacts.

Enter Safe Mode With Networking

On Windows 10 or Windows 11, open Settings, select System, choose Recovery, and click Restart now beside Advanced startup. Older Windows 10 installations may show this option under Update & Security and then Recovery. After the blue recovery screen appears, select Troubleshoot, Advanced options, Startup Settings, and Restart.

When the numbered list appears, press 5 or F5 for Enable Safe Mode with Networking. If the function keys do not respond, try the number row rather than the numeric keypad. Windows should start with “Safe Mode” displayed in the corners of the desktop.

Method	When to use it	Main steps
Settings recovery	Windows still opens normally	Settings → Recovery → Advanced startup → Startup Settings → F5
Shift and Restart	You need a quicker route from the sign-in screen	Hold Shift, select Power → Restart, then follow the recovery menus
System Configuration	You can reach the desktop but need repeated Safe Mode boots	Run msconfig, open Boot, select Safe boot and Network, then restart
Installation or recovery media	Windows cannot reach the recovery menu	Boot from trusted media and open the Windows recovery environment

Another route is to hold Shift while selecting Restart from the Start menu or sign-in screen. If Windows cannot boot normally, interrupting startup several times may open Automatic Repair, where the same advanced options are available. Use the System Configuration method carefully: clear the Safe boot setting after cleaning, or Windows may continue starting in Safe Mode.

Download and Run Trusted Scanners

Once the desktop loads, open a browser and download a reputable malware removal tool from its official publisher. Do not install several real-time antivirus products at once, since they can conflict and make diagnosis harder. A second-opinion scanner, Microsoft Defender, or a vendor-specific cleanup utility may be appropriate depending on the infection.

Check the website address carefully and avoid installers promoted through pop-ups. Verify the publisher, read the file name, and scan the downloaded installer before opening it if your existing security software still works. Run a full scan rather than a quick scan when time permits, and quarantine detected items instead of manually deleting system files.

Safe Mode is also useful for a secondary check after the first tool reports a clean result. Instructions for an ESET Online Scanner can help with an additional browser-based assessment, although online scanners may require normal Windows components or a supported browser.

Work Safely While Connected

Networking makes downloading tools possible, but it also gives active malware a route to communicate with command-and-control servers. Keep the session brief and use it only for updates, scanning, and downloading from trusted sources. Do not sign in to banking, email, cloud storage, or workplace systems from the infected computer.

If a tool cannot update, try a direct Ethernet connection, temporarily restart the router only if necessary, or download the installer on a separate clean computer and transfer it using a newly formatted USB drive. A failed network connection does not prove that the malware has been removed. Some threats deliberately block security websites or alter DNS settings.

Australian businesses and individuals should consider whether personal information was accessed. The Privacy Act 1988 and the Notifiable Data Breaches scheme can create reporting obligations for organisations holding affected information. Home users should contact their bank promptly if payment details were exposed, while businesses may need advice from their privacy officer or the Office of the Australian Information Commissioner.

Return to Normal Windows and Verify

After scans finish, restart the computer normally and confirm that Safe Mode is no longer active. If you used msconfig, open it again, select the normal startup configuration, and clear Safe boot. Reconnect external drives only after they have been scanned on a clean system.

Update Windows, browsers, browser extensions, and security software. Remove unknown programs from Apps, review startup entries in Task Manager, and reset suspicious browser settings. Check whether redirects, fake alerts, high resource use, or unfamiliar processes have returned.

If symptoms continue, avoid repeatedly deleting random files. Preserve relevant logs, disconnect the computer from sensitive networks, and seek assistance from a qualified technician or your organisation’s IT team. A clean backup, multi-factor authentication, and separate administrator account can reduce the impact of a future infection.