Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesIf a malware test has left Windows behaving suspiciously, stop testing on that installation and start with Windows Security. If the same malware returns, run Microsoft Defender Offline. Use System Restore only for a suitable recent system change; if the infection persists or Windows cannot be recovered, back up what you safely can and consider Reset this PC or a clean installation. The right choice depends on whether you need to preserve files and whether Windows still starts.
Choose the recovery step that fits the problem
Microsoft’s recommended first step when you suspect infection is a virus scan with Windows Security. Escalate to recovery only when the scan, removal prompts, and—if malware returns—an offline scan do not resolve the issue, or Windows will not start.
| Option | What it changes | When it may fit | Important limitation |
|---|---|---|---|
| Microsoft Defender Offline | Restarts the PC and scans outside the ordinary Windows session. | Malware keeps returning or you are concerned it may hide while Windows is running. | Save open work first. Check Protection history after the restart. Microsoft Defender Offline |
| System Restore | Reverts system files, registry settings, installed programs, and settings to a restore point. | A recent driver, app, update, or settings change caused the problem and a suitable restore point exists. | Designed not to affect personal files, but it can undo recent apps, drivers, updates, or settings. System Restore |
| Reset this PC — Keep my files | Reinstalls Windows and preserves personal files while removing apps and settings. | Windows needs reinstalling and retaining personal files is important. | Back up first; have the BitLocker recovery key ready for an encrypted device. Reset your PC |
| Reset this PC — Remove everything | Reinstalls Windows and removes personal files, apps, and settings. | A more complete reset is appropriate and files are backed up or expendable. | Destructive to local data. The optional “Clean data” setting makes deleted-file recovery harder before transfer or disposal, but Microsoft says it does not meet government or industry erasure standards. Reset your PC |
| Clean installation from installation media | Reinstalls Windows from USB installation media; a clean installation removes everything on the selected drive. | Infection is suspected to remain or other recovery options have failed. | Back up needed files first. A device maker’s recovery media may include drivers and factory apps tailored to your PC. Reinstall Windows with installation media |
Start with a scan, then go offline if malware returns
Run a Windows Security scan
When Windows starts, open Settings > Privacy & security > Windows Security, then choose Virus & threat protection and run a scan. Review the findings and follow Windows Security’s removal prompts. Do not enter passwords or use sensitive accounts from a system you do not trust.
Run Microsoft Defender Offline for recurring malware
- Save open work. The offline scan restarts the PC.
- In Windows Security, open Virus & threat protection and find the scan options.
- Select Microsoft Defender Offline scan and start it.
- After Windows restarts, review Protection history for scan results and actions.
The scan runs in Windows Recovery Environment without loading the usual Windows session, which can help when malware is active or difficult to remove in a normal session. See Microsoft’s Microsoft Defender Offline instructions.
#1 Best Overall
Use System Restore for a recent system change—not as a malware guarantee
System Restore rolls system state back to a restore point; it is not a dependable promise of malware removal. It is most relevant if the trouble began after a recent app, driver, update, or settings change and a suitable restore point exists. It is designed not to affect personal files, but it can affect software and system settings installed or changed since that point.
Start System Restore from Windows
- Open Control Panel and search for Recovery.
- Choose Open System Restore. Alternatively, run
rstrui.exe. - Select a restore point from before the problem began.
- Choose Scan for affected programs, when available, to review likely application and driver changes.
- Confirm only if the changes shown are acceptable, then follow the prompts.
Start System Restore from Windows Recovery Environment
If Windows will not start, enter Windows Recovery Environment (WinRE), then select Troubleshoot > Advanced options > System Restore. WinRE may launch automatically after repeated startup failures; Windows installation media can also provide access to recovery tools. An encrypted device may request its BitLocker recovery key.
Rank #2
There is a current version-specific caveat: Microsoft Learn reports that after the July 2026 security update, restore points on Windows 11 versions 24H2, 25H2, 26H1 and Windows Server 2025 must pass specified security checks to be restorable when Virtualization-Based Security is enabled and running. A restore point that fails those checks cannot be used on those versions. Check the device’s version and update state before relying on an older point. Microsoft Learn: restore-point security checks.
Reset Windows when it needs reinstalling
Reset this PC reinstalls Windows. Keep my files retains personal files but removes apps and settings; Remove everything also deletes personal files. Back up important files before beginning, and locate the BitLocker recovery key if the drive is encrypted.
Free tools Windows power users keep installed
One-click scans. No signup required.
Reset from Windows or WinRE
- From Windows, open Settings > System > Recovery > Reset PC. If Windows does not start, enter WinRE and choose Troubleshoot > Reset this PC.
- Choose Keep my files or Remove everything based on what you need to preserve.
- Choose Cloud download or Local reinstall, then read the summary before confirming.
- Let the reset finish. Microsoft warns that the screen may remain black for a long time; do not force a restart while the process is running.
If malware is suspected to remain in the Windows installation, a reset may not be the right endpoint. Microsoft identifies a clean installation from installation media as an option that can help remove malware from the Windows installation; it removes everything on the selected drive. Use Microsoft’s installation-media instructions and your PC maker’s guidance. If the affected PC cannot boot, prepare media on another working PC. OEM recovery media may include device-specific drivers and factory apps that generic Microsoft media does not.
Protect files and access before destructive recovery
- Prefer a known-good backup from before the incident, stored separately. Microsoft also describes cloud backup with version history as a possible recovery source.
- Do not treat a Windows Recovery Drive as a backup of documents or photos; it does not contain personal files. Create a Recovery Drive
- Find and verify access to the BitLocker recovery key before using WinRE or resetting an encrypted device. Recovery may require it to unlock the drive.
- If this is a work- or school-managed PC, contact its IT team, especially if recovery options fail.
Windows 10 users should account for ended support
Windows 10 support ended on October 14, 2025. Microsoft no longer provides free software updates through Windows Update, technical assistance, or security fixes after that date. If you are still using Windows 10, its unsupported status is a security consideration when deciding what to do after recovery; check Microsoft’s current migration guidance and any applicable extended-security options. Microsoft: Reset your PC · Microsoft: Windows recovery environment
Quick Recap
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
