iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
You generally cannot build a complete, reliable list of every Windows file and registry setting a capable attacker changed. An intruder who has enough access can alter or hide changes, and a clean malware scan does not prove that nothing remains. That makes the useful question a recovery question: can you return to a state you trust, and if not, how do you rebuild it without carrying the problem forward?
Leo A. Notenboom answered the underlying question in his Ask Leo! article of May 22, 2019, with a two-word reply: “You cannot.” This guide keeps that answer at its core, then explains the two recovery paths the article describes and how to choose between them.
Why a complete list of changes is not available
After a compromise, the machine itself is the evidence, and the attacker controls part of that evidence. A sufficiently capable attacker may have been able to access or change almost anything on the system and conceal those changes. Rootkits are one example: they can modify a system so that their files and activity are hidden from standard file and folder listings.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Not every incident involves a rootkit, and not every incident has the same reach. But the practical consequence is the same in each case. You cannot assume that the files you can see, or the settings you can inspect, represent the full set of changes. Treat any list you assemble as a partial picture.
#1 Best Overall
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
What malware scans tell you and what they cannot
Running a full scan with an existing anti-malware utility, and often an additional specialised tool, is the normal first step. These tools can detect many threats and sometimes repair the damage they find. They are worth running because they can surface real findings, such as known malicious files or altered settings they recognise.
A scan’s result has limits, though. A detection is useful information, but silence is not proof. Any scan can miss something it was not designed to recognise, and an attacker who has hidden changes may have hidden them from the same tools. Use scan output to inform your decision, not to certify the machine as clean.
Path 1: restore a complete image made before the compromise
If you have a complete system image taken before the hack, restoring it is the most direct way to return to a known prior state. Restoring it does not tell you what was changed. It replaces the system with a version that existed before the attacker was present, which is a different and often more useful outcome.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11This path depends on conditions you need to check first:
Rank #2
- Does Not Fix Hardware Issues - Please Test Your PC hardware to be sure everything passes before buying this USB Windows 11 Software Recovery USB.
- Make sure your PC is set to the default UEFI Boot mode, in your BIOS Setup menu. Most all PC made after 2013 come with UEFI set up and enabled by Default
- Does Not Include A KEY CODE, LICENSE OR A COA. Use your Windows KEY to preform the REINSTALLATION option
- Free tech support
- The image is complete, meaning it captures the whole system rather than only selected folders.
- You know approximately when the compromise occurred, so you can choose an image taken before that point.
- Images were made often enough that a clean one actually exists. If the only backups were taken after the intrusion began, they are not a safe restore point.
- You accept that data created after the image date will be lost unless you recover it from other sources, and you should decide deliberately which of that data to recover.
Do not assume that any backup taken from the infected machine is automatically safe. Its date and its completeness matter more than its existence.
Path 2: preserve needed data, reinstall, and restore selectively
If no suitable image exists, the Ask Leo! article recommends preserving the data you need, reformatting the drive, reinstalling Windows and then reinstalling your applications. You then restore your data carefully, only as needed. The article acknowledges that this is time-consuming. It argues, however, that it can be more reassuring than continuing to use a machine that may still be compromised.
A practical sequence looks like this:
- Copy only the personal data you need, such as documents, photos and project files, to separate storage. Leave out program folders, system files and anything you cannot confidently identify.
- Reformat the drive and reinstall Windows from trusted installation media rather than from a copy that may have been on the infected system.
- Reinstall applications from their original installers or official sources, not from copies stored on the old system.
- Restore data selectively. Bring back documents and similar files, and check anything that runs or carries settings before you rely on it.
- Change passwords and account credentials from a device you know is clean, since the attacker may have captured them.
The steps above are general good practice that follow from the article’s approach. The article does not give current Windows menu paths for these tasks, so use the installation and reset options that your current Windows version provides.
Choosing between the two paths
The article describes two paths and does not measure how long either takes or how often each succeeds. The comparison below uses the factors the article itself points to.
Rank #3
![Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Key Card]](https://m.media-amazon.com/images/I/41yAvGpNlWL._SL160_.jpg)
- ONGOING PROTECTION Install protection for up to 3 PCs, Macs, iOS & Android devices - A card with product key code will be mailed to you (select ‘Download’ option for instant activation code)
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
| Factor | Restore a complete pre-compromise image | Reinstall and restore selectively |
|---|---|---|
| What you need | A complete image taken before the compromise | Your personal data, trusted installation media and application installers |
| Confidence in the starting point | Depends on the image date relative to the intrusion date | High for the operating system and applications, provided the install media is trusted |
| Effort | Restore the image, then check what changed since it was made | Time-consuming, as the article states; the source gives no duration |
| Handling of personal data | Data created after the image date must be recovered separately or accepted as lost | You choose exactly what to restore, which limits reintroducing problems |
| Main risk | Restoring an image that was already compromised | Restoring a compromised file or setting by mistake |
If you have a verified pre-compromise image with a known date, that path usually gives you a clearer starting point. If you do not, or you cannot establish when the intrusion began, the reinstall path is the more defensible choice.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Preparing for the next incident
The only lasting protection the article points to is regular, complete backups. An external hard drive is a sensible storage category for keeping complete images, since it lets you keep copies separate from the machine they protect. The article does not recommend any brand, model, capacity or performance level, and a backup drive cannot tell you what an attacker changed on a machine that has already been compromised. Its value lies only in having a restore point that predates any future incident.
Keep at least one image stored apart from the computer, and check that the images you keep are actually restorable before you need them.
Note on the source: the Ask Leo! article dates from 2019. Its core point about post-compromise certainty still applies, but the Windows steps and security tools it discusses are not current. Confirm present-day recovery options against the current Windows documentation.
Quick Recap
The Bottom Line
“”
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
