Recommended Free Tools
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
A PC that will not start after a suspected virus attack may have malware damage, but a failed update, corrupted Windows files, a driver problem, a failing drive, or a BitLocker prompt can look similar. Start by isolating the computer, then use Windows Recovery Environment (WinRE) to try the least destructive repairs. If malware is confirmed or you cannot trust the installation, back up carefully selected files and reinstall Windows from clean installation media.
First, identify where startup stops
“Won’t boot” can mean several different things. The point at which the failure happens helps distinguish a Windows problem from a power or hardware fault—and prevents you from trying antivirus fixes on a PC that has not reached Windows.
| What you see | What it may indicate | What to do |
|---|---|---|
| No lights, fans, or display | Power, charger, battery, monitor, RAM, or other hardware trouble. Malware is less likely to be the immediate cause if the PC never reaches its startup checks. | Check the power source and display, disconnect peripherals, and seek hardware help if it still shows no signs of life. |
| Manufacturer logo, then a black screen or error | Windows, boot configuration, storage, driver, or encryption trouble. | Try WinRE and its recovery options. If the drive is missing or failing, stop and prioritize data recovery. |
| Windows logo, then a blue screen, restart, or automatic-repair loop | Possible damaged system files, a failed update, a driver conflict, or malware-related changes. | Try Startup Repair first, then consider System Restore, uninstalling a recent update, or an offline scan. |
| BitLocker recovery screen | Windows is requesting the recovery key; a boot, firmware, or hardware change can trigger this without malware. | Find the recovery key before resetting or reinstalling. Do not wipe the drive just because this screen appeared. |
| Ransom note or files with unfamiliar extensions | Possible ransomware. | Disconnect the PC from networks and external drives. Preserve the note and seek incident-response help before repair attempts if the files matter. |
Other clues—security tools being disabled, unexpected account activity, or a warning shown only in a web browser—can inform your suspicion, but none alone proves that malware caused the startup failure. A browser pop-up is not the same as a Windows Security detection. Do not call numbers in pop-ups or install remote-access software at an unsolicited caller’s direction.
Isolate the PC and protect your files
For a personal home computer, disconnect Ethernet and turn off Wi-Fi if you can do so without navigating into Windows. Unplug USB drives, memory cards, and other external storage; do not connect a backup drive until the PC is known to be clean. Avoid downloading “repair” utilities from pop-ups, search ads, or unfamiliar websites.
#1 Best Overall
- Dual USB-A & USB-C Bootable Drive – compatible with nearly all Windows PCs, laptops, and tablets (UEFI & Legacy BIOS). Works with Surface devices and all major brands.
- Fully Customizable USB – easily Add, Replace, or Upgrade any compatible bootable ISO app, installer, or utility (clear step-by-step instructions included).
- Complete Windows Repair Toolkit – includes tools to remove viruses, reset passwords, recover lost files, and fix boot errors like BOOTMGR or NTLDR missing.
- Reinstall or Upgrade Windows – perform a clean reinstall of Windows 7 (32bit and 64bit), 10, or 11 (amd64 + arm64) to restore performance and stability. (Windows license not included.). Includes Full Driver Pack – ensures hardware compatibility after installation. Automatically detects and installs drivers for most PCs.
- Premium Hardware & Reliable Support – built with high-quality flash chips for speed and longevity. TECH STORE ON provides responsive customer support within 24 hours.
If the device belongs to work or school, or ransomware, data theft, or valuable business files may be involved, contact the organization’s IT or security team before shutting down, reinstalling, or deleting anything. A connected system may allow continued attacker activity, but powering it off or changing it can also remove volatile evidence. The right choice depends on the incident-response goal; CISA’s compromised-system guidance explains why both containment and evidence preservation matter.
If you used the affected PC to access important accounts, use a separate, trusted device to change passwords for email, banking, cloud storage, and other high-value accounts. Review account sessions and enable multifactor authentication where available.
Enter Windows Recovery Environment
WinRE provides repair tools without requiring a normal Windows startup. If Windows fails to start repeatedly, it may open automatically. From its recovery screen, choose Troubleshoot, then Advanced options. Menu labels can vary slightly by Windows version and device.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
If WinRE does not appear, use a separate, trusted computer to create official Windows installation media on a USB drive, then start the affected PC from that media. On the setup screen, choose the repair option rather than installing Windows if you want to try recovery tools first. The key for choosing a boot device varies by manufacturer and firmware, so check the PC maker’s instructions rather than relying on one function key.
WinRE or an offline scan may ask for a BitLocker recovery key. If your key is saved with your Microsoft account, look it up from another trusted device. Without the key, encrypted files may remain inaccessible even if the drive is healthy. Microsoft’s recovery-options guide covers Windows recovery choices; available options depend on the PC’s configuration.
Try the least-destructive repairs first
-
Startup Repair: In WinRE, select Troubleshoot → Advanced options → Startup Repair. This is the usual first repair when Windows will not start. It may fix some boot problems, but a successful repair does not prove malware has been removed.
-
System Restore: If Startup Repair fails, select Troubleshoot → Advanced options → System Restore and choose a restore point from before the suspected infection or the change that preceded the failure. A restore point may not exist. Restoring can undo drivers, apps, and system changes, and it is not a guarantee of complete malware removal. It may also require the BitLocker key.
Recommended: PC Feels Slow? A Free Scan Shows What's Dragging Windows Down →Recommended: Update Every Outdated Driver on Your PC in One Scan - Free →Recommended: Fix Windows Errors and Clear Junk Files in Minutes - Free Scan →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Uninstall a recent update: If the failure began just after a Windows update, choose Troubleshoot → Advanced options → Uninstall Updates. This is a way to test whether the update caused the problem, not a malware-removal method.
-
Safe Mode: If WinRE offers Startup Settings, you may be able to restart into Safe Mode. It can help you remove a recently installed program or run a scan, but it is not guaranteed to bypass malware and may be unavailable if startup components are damaged.
Microsoft’s recovery guidance recommends Startup Repair for a PC that will not start, followed by System Restore when repair fails and a usable restore point exists. It also lists reinstallation from installation media when recovery options do not work or infection is suspected.
Run an offline malware scan
If you can reach the Windows desktop, Microsoft Defender Offline restarts into a separate scanning environment. Save open work first, then go to Windows Security → Virus & threat protection → Scan options → Microsoft Defender Offline scan → Scan now. Microsoft designed it to look for threats that can hide while Windows is running. It is useful, not infallible; a scan result does not by itself establish that every system change has been reversed.
Rank #2
- High-speed USB 3.0 performance of up to 150MB/s(1) [(1) Write to drive up to 15x faster than standard USB 2.0 drives (4MB/s); varies by drive capacity. Up to 150MB/s read speed. USB 3.0 port required. Based on internal testing; performance may be lower depending on host device, usage conditions, and other factors; 1MB=1,000,000 bytes]
- Transfer a full-length movie in less than 30 seconds(2) [(2) Based on 1.2GB MPEG-4 video transfer with USB 3.0 host device. Results may vary based on host device, file attributes and other factors]
- Transfer to drive up to 15 times faster than standard USB 2.0 drives(1)
- Sleek, durable metal casing
- Easy-to-use password protection for your private files(3) [(3)Password protection uses 128-bit AES encryption and is supported by Windows 7, Windows 8, Windows 10, and Mac OS X v10.9 plus; Software download required for Mac, visit the SanDisk SecureAccess support page]
If Windows will not start, a trusted vendor’s rescue USB can scan the internal drive without launching the installed copy of Windows. Create the USB on a clean computer, download software only from the vendor’s official site, and follow its instructions. Microsoft Defender Offline also depends on WinRE and Defender configuration; it may request the BitLocker recovery key. See Microsoft’s Defender malware-removal guidance and Defender Offline documentation.
Do not install or run multiple real-time antivirus products together as a troubleshooting shortcut. They can conflict, and installing a third-party product may change whether Defender is active or passive. Use one trusted product at a time; Microsoft explains this in its antivirus-provider guidance.
Optional: check Windows system files from WinRE
If you are comfortable using Command Prompt, an offline System File Checker scan can check Windows system files. It does not investigate malware or repair every boot problem. Stop if you are unsure which volume is Windows; never format or delete a partition as part of this check.
In WinRE, open Troubleshoot → Advanced options → Command Prompt. Drive letters can change in recovery, so do not assume Windows is on C:. One way to inspect volumes is:
diskpart
list volume
exitThen check likely volumes for a Windows directory (for example, dir D:Windows). When you identify the correct volume, substitute its letter in the command below. Microsoft documents this offline SFC form for boot troubleshooting:
sfc /scannow /offbootdir=C: /offwindir=C:WindowsFor example, if Windows is on D:, use /offbootdir=D: /offwindir=D:Windows. Boot-repair commands such as bootrec are not universal fixes: the correct approach depends on whether the machine uses UEFI/GPT or legacy BIOS/MBR. If you do not know the disk layout or exact error, get qualified help instead of running commands at random.
Recover important files carefully
Before resetting or reinstalling, decide whether you have a usable backup and whether any files on the PC are irreplaceable. If the drive appears to be failing, repeated startup attempts and do-it-yourself copying may make recovery harder; stop and consult a data-recovery professional.
- Copy only what you need: Prioritize personal documents, photos, and other known data. Avoid copying programs, installers, scripts, browser extensions, cracked software, or unknown archives, which can carry malware forward.
- Treat recent files cautiously: Files created or changed during the suspected infection deserve extra scrutiny. Scan recovered files from a clean system before opening them.
- Use known-good backups: Prefer backups made before the infection and kept externally or with version history. A drive connected during infection may have been altered; Microsoft recommends restoring from a clean pre-infection backup in its malware guidance.
- Ransomware is different: A reinstall cannot decrypt files that ransomware already encrypted. Preserve encrypted copies and the ransom note; do not overwrite the only copies by restoring files over them.
Reset or clean-install Windows?
These options are not interchangeable. A repair tries to fix the existing installation; a reset reinstalls Windows using a built-in recovery path; a clean install starts Windows from installation media and lets you choose which partitions to remove or replace. A clean install is generally the stronger choice when malware is confirmed, returns after removal, security settings were tampered with, or you cannot trust the existing Windows installation.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →| Option | Best suited to | Main trade-off |
|---|---|---|
| Reset this PC — Keep my files | A usable Windows recovery path, backed-up or recovered data, and no need to preserve apps and settings. | Apps and settings are removed or reset. Retained files may still be unsafe; keeping them is not a malware guarantee. |
| Reset this PC — Remove everything | A more complete reset when you have secured the data you need. | Personal files, apps, and settings are removed. It is not the same as preserving forensic evidence. |
| Clean install from official installation media | Confirmed or persistent infection, failed recovery tools, or an installation whose integrity cannot be trusted. | Can erase data on selected partitions and requires reinstalling apps and restoring safe files. Partition choices matter. |
Before a clean install, prepare a separate working computer, official Windows installation media on a blank USB drive, necessary files backed up, and the BitLocker recovery key if encryption is enabled. Confirm the Windows edition and activation situation, and check the PC maker’s recovery or driver information if needed. Follow Microsoft’s recovery-options guidance and official installation instructions. A standard reinstall addresses the Windows installation and disk areas you select; it does not guarantee removal of a rare firmware-level threat or prevent reinfection from unsafe files.
After Windows starts again
- Install Windows and application updates before returning to routine use. If this PC is still on Windows 10, note that Microsoft support ended on October 14, 2025; plan a supported operating system or device where possible. See Microsoft’s Windows 10 support information.
- Run a full scan with one trusted security product and remove software you do not recognize or trust.
- From a clean device, change passwords and review email, banking, cloud, and browser sessions for suspicious access.
- Restore only known-good files, preferably from a pre-infection backup. Scan them before opening them.
- Reconnect backup drives and shared storage only after the PC is clean or reinstalled. Check other computers that shared files or accounts if they may also be affected.
When to get professional help
Stop experimenting and seek an experienced data-recovery or security professional if the drive may be failing, valuable files have no backup, ransomware is involved, the machine is managed by work or school, credentials may have been stolen, BitLocker access repeatedly fails, or you suspect a bootkit or firmware problem. For business devices, contact IT/security first; reinstalling can destroy evidence or remove organization-specific recovery tools.
Windows 10 and Windows 11 recovery options are broadly covered by Microsoft’s recovery guidance, but exact menu labels and availability vary by edition and device. In either version, the safest sequence is to isolate, diagnose, try reversible recovery steps, scan offline where possible, and reinstall from trusted media if Windows integrity cannot be restored.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
