Stop testing on the affected PC and do not use it for sensitive accounts until you trust it again. Start with a Windows Security virus scan; if malware keeps returning, run Microsoft Defender Offline. If those steps do not resolve the problem—or Windows will not start—use Windows recovery options, choosing the least destructive one that fits. A restore point is not a guaranteed malware-removal method; when infection may remain, a clean installation can remove everything from the selected drive.
Choose a recovery path
| Situation | Next step | What to keep in mind |
|---|---|---|
| Windows starts and malware has not been confirmed as persistent | Run a Windows Security virus scan and follow its removal prompts. | Review the scan findings and Protection history. |
| The same malware returns | Save open work, then run Microsoft Defender Offline. | The PC restarts and scans outside the ordinary Windows session. |
| The issue followed a recent app, driver, update, or settings change | Consider System Restore if a suitable restore point exists. | It can reverse system changes but does not remove personal files; it may affect recently installed software and settings. |
| Windows will not start | Enter Windows Recovery Environment (WinRE) and use its repair tools. | WinRE may start automatically after repeated boot failures; Windows installation media can also provide access. |
| Earlier options fail or infection may remain | Back up important files, then consider Reset this PC or a clean installation. | A clean installation from installation media removes everything on the selected drive. |
Microsoft’s guidance for suspected infection is to start with a Windows Security virus scan: Recovery options in Windows. The options below differ in how much of Windows and your data they change.
As an Amazon Associate I earn from qualifying purchases.
Run Windows Security and Defender Offline first
Run a virus scan
When Windows is usable, open Windows Security and run a virus scan from Virus & threat protection. Review what it finds and follow the offered removal steps. Avoid signing in to sensitive accounts on a system you do not trust.
Use Microsoft Defender Offline if malware returns
Save open work before starting: the offline scan restarts the PC and scans in the Windows Recovery Environment without loading the usual Windows session. In Windows Security, open Virus & threat protection, choose Scan options, select Microsoft Defender Offline scan, and start the scan. After Windows restarts, check Protection history for the outcome. See Microsoft’s instructions for Windows Security and Microsoft Defender Offline.
#1 Best Overall
- Dual USB-A & USB-C Bootable Drive – compatible with nearly all Windows PCs, laptops, and tablets (UEFI & Legacy BIOS). Works with Surface devices and all major brands.
- Fully Customizable USB – easily Add, Replace, or Upgrade any compatible bootable ISO app, installer, or utility (clear step-by-step instructions included).
- Complete Windows Repair Toolkit – includes tools to remove viruses, reset passwords, recover lost files, and fix boot errors like BOOTMGR or NTLDR missing.
- Reinstall or Upgrade Windows – perform a clean reinstall of Windows 7 (32bit and 64bit), 10, or 11 (amd64 + arm64) to restore performance and stability. (Windows license not included.). Includes Full Driver Pack – ensures hardware compatibility after installation. Automatically detects and installs drivers for most PCs.
- Premium Hardware & Reliable Support – built with high-quality flash chips for speed and longevity. TECH STORE ON provides responsive customer support within 24 hours.
Protect files and prepare before recovery
- Back up important files separately. If possible, use a known-good backup from before the incident. Do not assume files copied from a potentially compromised PC are safe to restore without checking them. Microsoft also describes cloud backup with version history as a possible recovery source.
- Do not mistake a Recovery Drive for a file backup. A Recovery Drive contains Windows recovery tools, not personal documents or photos. See Create a recovery drive.
- Find the BitLocker recovery key. An encrypted device may require it to access recovery tools or complete a reset. Retrieve it before entering WinRE or beginning recovery.
- Use a separate working PC if needed. If the affected computer cannot boot, prepare Windows installation media on another PC using Microsoft’s current instructions.
Microsoft advises backing up important files before resetting Windows. Recovery can be disruptive, and a reset or clean installation may remove data depending on the option selected.
Use System Restore for a recent system change—not as malware insurance
System Restore returns system files, registry settings, installed programs, and settings to the state captured in a restore point. It is designed not to affect personal files, but it can roll back recently installed apps, drivers, updates, and settings. Use it when a recent system change caused trouble and a suitable restore point exists; do not rely on it as a dependable way to remove persistent malware.
- In Windows, open Control Panel, search for Recovery, and choose Open System Restore. You can also run
rstrui.exe. - In WinRE, choose Troubleshoot > Advanced options > System Restore.
- Select a restore point and use Scan for affected programs where available to see which apps may be removed or restored.
- Proceed only if the likely changes are acceptable. If prompted on an encrypted device, enter the BitLocker recovery key.
Microsoft Learn notes a version-specific restriction: after the July 2026 security update, on Windows 11 versions 24H2, 25H2, 26H1 and Windows Server 2025, restore points must pass specified security checks to be restorable when Virtualization-Based Security is enabled and running. A restore point that fails those checks cannot be used on those versions. Check the device’s version and update status before relying on an older restore point: VBS security checks for System Restore.
Free tools Windows power users keep installed
One-click scans. No signup required.
Reset this PC: decide whether to keep personal files
Reset this PC reinstalls Windows. From Windows, open Settings > System > Recovery > Reset PC. From WinRE, choose Troubleshoot > Reset this PC. Select a reset option, then choose Cloud download or Local reinstall as offered. Microsoft’s current instructions are at Reset your PC.
| Option | What it does | When it may fit |
|---|---|---|
| Keep my files | Reinstalls Windows and preserves personal files, but removes apps and settings. | Windows needs reinstalling and you need to retain personal files. Back up first. |
| Remove everything | Reinstalls Windows and removes personal files, apps, and settings. | You have backed up files or do not need them, and a more complete reset is appropriate. |
The optional “clean data” setting is intended to make recovery of deleted files harder before transfer or disposal; Microsoft says it does not meet government or industry data-erasure standards. During a reset, the screen may remain black for a long time. Do not force a restart while the process is running.
Rank #2
- High-speed USB 3.0 performance of up to 150MB/s(1) [(1) Write to drive up to 15x faster than standard USB 2.0 drives (4MB/s); varies by drive capacity. Up to 150MB/s read speed. USB 3.0 port required. Based on internal testing; performance may be lower depending on host device, usage conditions, and other factors; 1MB=1,000,000 bytes]
- Transfer a full-length movie in less than 30 seconds(2) [(2) Based on 1.2GB MPEG-4 video transfer with USB 3.0 host device. Results may vary based on host device, file attributes and other factors]
- Transfer to drive up to 15 times faster than standard USB 2.0 drives(1)
- Sleek, durable metal casing
- Easy-to-use password protection for your private files(3) [(3)Password protection uses 128-bit AES encryption and is supported by Windows 7, Windows 8, Windows 10, and Mac OS X v10.9 plus; Software download required for Mac, visit the SanDisk SecureAccess support page]
Clean-install Windows if infection may remain
If malware persists or other recovery options have failed, Microsoft identifies a clean installation from installation media as an option that may help remove malware from the Windows installation. It is more destructive than a reset: a clean installation removes everything on the selected drive, including files, apps, and settings.
- Back up any needed files if it is safe to do so, and make sure you have the BitLocker recovery key.
- On a working PC, follow Microsoft’s current instructions to create Windows installation media: Reinstall Windows with the installation media.
- Follow the device manufacturer’s instructions to boot from the media and install Windows. Verify the selected drive carefully because its contents will be removed.
Manufacturer recovery media may include drivers and factory apps tailored to the device; generic Microsoft media may not. Follow the PC maker’s official guidance if those components matter or installation media does not work as expected.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
If Windows cannot start, open WinRE
Windows Recovery Environment (WinRE) is a set of built-in tools for troubleshooting and fixing common system problems. It may launch automatically after repeated startup failures. You can also access its repair tools by starting from Windows installation media. Microsoft explains entry methods and available tools in Windows recovery environment.
From WinRE, choose Troubleshoot > Advanced options for tools such as System Restore, or choose Troubleshoot > Reset this PC to reset. If the device is managed by an employer or school, contact its IT team when recovery options fail rather than attempting a reinstall that could affect managed settings or access.
Windows 10 support status
Windows 10 support ended on October 14, 2025. Microsoft says free software updates, technical assistance, and security fixes are no longer provided after that date. If the recovered PC runs Windows 10, account for that unsupported status when deciding how to keep the device secure; consult Microsoft’s current guidance on migration or applicable extended-security options.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
