DriversRecommendedOutdated drivers can make a good PC feel brokenScan driver issues before chasing fixes manually.Scan NowHalloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsClean PCRecommendedOne scan can reveal what keeps slowing WindowsLook for cleanup and repair opportunities.Run Scan×
FREEDOM251

Freedom251 › Blog › backups

Windows Malware Removal FAQ: Safe Mode, Backups, Reset, and Clean Reinstall (2026)

By Freedom251 Team · · 7 min read

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Start with a Microsoft Defender scan in Windows Security. If the same threat returns after a restart, run Microsoft Defender Offline; it scans before normal Windows processes load. Preserve a pre-infection backup outside the PC, then choose Reset this PC or a clean installation only when scanning and troubleshooting cannot remove the problem.

What should I do first if Windows reports malware?

Disconnect the computer from untrusted networks if you suspect active remote control, but keep power connected so scans and recovery can finish. Do not open suspicious files or plug in backup drives yet. Record the threat name and the date Windows detected it; that information helps you decide whether a later alert is the same infection or a different file.

As an Amazon Associate I earn from qualifying purchases.

  1. Open Windows Security from the Start menu.
  2. Select Virus & threat protection, install any available security-intelligence update under Protection updates, and run a Full scan.
  3. Allow Windows Security to quarantine or remove what it finds, then restart when prompted.
  4. Check the protection history after the restart. If the identical threat is detected again, escalate to Microsoft Defender Offline rather than repeatedly running the same scan.

Microsoft explains that a recurring detection can indicate a hidden component that reinstalls the malware while Windows is running. Its malware-removal guidance recommends Defender Offline for that situation. The offline scan restarts the PC, so save open work first; it examines the system outside the normal Windows environment, where some malware cannot conceal itself.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Does Safe Mode remove malware?

Safe Mode starts Windows with a limited set of drivers and services, but current Microsoft malware-removal guidance does not establish it as the general procedure for deleting an infection. Booting into Safe Mode is therefore not a guarantee that malware is gone. For a threat that reappears after a restart, the evidenced escalation is Defender Offline.

#1 Best Overall
5-in-1 Win Repair & Reinstall Bootable USB Flash Drive – Fix, Recover, or Reinstall Windows 11 (amd64 + arm64) / 10/7 - Includes PE Tools, Driver Pack, Antivirus, Data Recovery & Password Reset
  • Dual USB-A & USB-C Bootable Drive – compatible with nearly all Windows PCs, laptops, and tablets (UEFI & Legacy BIOS). Works with Surface devices and all major brands.
  • Fully Customizable USB – easily Add, Replace, or Upgrade any compatible bootable ISO app, installer, or utility (clear step-by-step instructions included).
  • Complete Windows Repair Toolkit – includes tools to remove viruses, reset passwords, recover lost files, and fix boot errors like BOOTMGR or NTLDR missing.
  • Reinstall or Upgrade Windows – perform a clean reinstall of Windows 7 (32bit and 64bit), 10, or 11 (amd64 + arm64) to restore performance and stability. (Windows license not included.). Includes Full Driver Pack – ensures hardware compatibility after installation. Automatically detects and installs drivers for most PCs.
  • Premium Hardware & Reliable Support – built with high-quality flash chips for speed and longevity. TECH STORE ON provides responsive customer support within 24 hours.

Use Safe Mode only when a separate, version-specific Microsoft troubleshooting procedure calls for it—for example, to diagnose a driver or startup conflict that prevents Windows Security from opening. The exact startup path differs among Windows releases and recovery states. Do not substitute Safe Mode for an offline malware scan, and do not assume that a successful Safe Mode boot proves the system is clean.

What is the correct way to run Microsoft Defender Offline?

  1. In Windows Security, open Virus & threat protection and choose Scan options.
  2. Select Microsoft Defender Offline scan, read the restart warning, and save all work.
  3. Start the scan. Windows restarts into a dedicated environment and scans before the ordinary desktop loads.
  4. After Windows starts again, return to Protection history to review the result and remove or quarantine anything identified.

Labels can vary slightly by Windows edition. Microsoft documents the offline option and its purpose in Windows Security’s unwanted-software protection guidance. If Windows Security cannot launch, Microsoft also points to the standalone Microsoft Safety Scanner as a supplementary diagnostic tool. It is not a replacement for keeping real-time antivirus protection enabled.

Is the Malicious Software Removal Tool enough?

No. The Windows Malicious Software Removal Tool (MSRT) targets a limited set of specific, prevalent malware families. It is designed to find and remove those families, not to provide the broad, continuous detection and prevention supplied by antivirus protection. Microsoft’s MSRT documentation directs readers to Defender Offline or Microsoft Safety Scanner when comprehensive detection and removal are needed.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Can I restore a backup after a malware infection?

Use a backup created before the infection and stored somewhere the infected Windows installation could not modify. Microsoft specifically recommends an external copy or cloud storage that offers version history. A backup left on the PC during the infection may already contain altered or malicious files.

Separate file backup from recovery media

A Windows Recovery Drive is bootable recovery material, not a copy of your documents, photos, or other personal files. Creating one does not preserve those files. Keep a separate backup set for personal data, ideally with more than one dated version.

Handle files from the suspect system cautiously

Copying files off a potentially infected PC is not proof that the files are safe. Prefer older, known-good versions; scan restored files before opening them; and avoid restoring executable files, scripts, installers, or macros unless you can verify their origin. If the backup contains only files changed during the incident, treat it as untrusted until checked on a clean system.

What should I back up before resetting Windows?

Back up irreplaceable documents, photos, browser data, license information, and any application-specific data you can verify. Use storage that is disconnected after the copy or a cloud service with version history. Do not use the same USB drive for both an unverified backup and recovery media.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Microsoft’s Reset this PC instructions also say to have the BitLocker recovery key available when the device is encrypted. You may be asked for it during recovery. Check that you can sign in to the account holding the key before starting; otherwise, an otherwise successful reset can leave you unable to unlock the drive.

Should I use “Keep my files” or “Remove everything”?

Reset this PC reinstalls Windows, but the selected option controls what is erased. The following comparison reflects Microsoft’s documented choices:

Rank #2
SANDISK 128GB Ultra Flair, USB-A Flash Drive, Up to 150MB/s Read Speeds | USB Flash Drive, Up to 15x Faster than standard 2.0, Password Protection, Durable, Sleek Metal Casing, USB 3.0, Silver/Black
  • High-speed USB 3.0 performance of up to 150MB/s(1) [(1) Write to drive up to 15x faster than standard USB 2.0 drives (4MB/s); varies by drive capacity. Up to 150MB/s read speed. USB 3.0 port required. Based on internal testing; performance may be lower depending on host device, usage conditions, and other factors; 1MB=1,000,000 bytes]
  • Transfer a full-length movie in less than 30 seconds(2) [(2) Based on 1.2GB MPEG-4 video transfer with USB 3.0 host device. Results may vary based on host device, file attributes and other factors]
  • Transfer to drive up to 15 times faster than standard USB 2.0 drives(1)
  • Sleek, durable metal casing
  • Easy-to-use password protection for your private files(3) [(3)Password protection uses 128-bit AES encryption and is supported by Windows 7, Windows 8, Windows 10, and Mac OS X v10.9 plus; Software download required for Mac, visit the SanDisk SecureAccess support page]
Choice Personal files Apps and settings Windows source When it fits
Keep my files Retained Removed Cloud download or local reinstall Windows is damaged and you need to preserve documents, with a separate verified backup as protection.
Remove everything Removed Removed Cloud download or local reinstall You can restore data from a known-good external backup and want a more disruptive reset.
Cloud download Depends on the reset choice Removed by reset Fresh Windows copy downloaded from Microsoft Local Windows files are corrupted or missing.
Local reinstall Depends on the reset choice Removed by reset Files already on the PC You need to reinstall without downloading; the image may not include the latest updates.

In Windows 11, the usual path is Settings > System > Recovery > Reset this PC. On Windows 10, it is generally Settings > Update & Security > Recovery. Because labels and availability vary by release, follow the choices shown on your device and read the final deletion summary before confirming.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

When is a clean Windows installation warranted?

Microsoft’s recovery guidance says to scan first when infection is suspected. If the problem continues, a clean installation from Windows installation media can remove Windows, personal files, applications, and settings from the selected drive. That is a complete data-loss operation for that drive, not an in-place repair. Read the drive-selection screen carefully and disconnect other storage you do not intend to erase.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

A clean install is reasonable when Defender Offline and normal troubleshooting cannot stop a recurring threat, when malware has made irreversible system changes, or when you cannot establish that the existing Windows installation is trustworthy. It is not automatically required for every detection. If the infection is removed and system behavior is normal, reinstalling solely because an alert once appeared creates avoidable disruption.

Reset versus installation media

Question Reset this PC Clean installation from media
Personal files Kept only with “Keep my files”; otherwise removed. Removed from the selected drive.
Apps and settings Removed. Removed.
Source of Windows Local files or a cloud download. External installation media.
Preparation Backup, BitLocker key, and time to reinstall applications. Verified backup, installation media, product/account access, and careful drive selection.
Best use Repairing damaged Windows when you accept removal of apps and settings. Starting from a known-clean Windows installation after persistent or serious compromise.

Neither procedure is the same as certified secure erasure. Microsoft’s reset interface may offer an option to clean the drive, but its consumer clean-data feature is not described as meeting a government or industry data-erasure standard.

How do I create and use a Windows Recovery Drive?

  1. Find an empty USB drive and verify its contents. Creating recovery media erases data already on that drive.
  2. Search Windows for Recovery Drive, open the utility, and follow its wizard to create the drive.
  3. Store the finished USB somewhere safe and label it with the Windows device it was created for.
  4. If Windows will not start, boot the affected PC from the USB (the boot-menu key depends on the manufacturer), then choose the available recovery option.

Microsoft’s Recovery Drive instructions emphasize that the USB contains recovery tools, not personal files. The related warning also says the process erases existing USB data. Microsoft does not establish one universal minimum capacity, speed, brand, or model; check the wizard and your device documentation instead of relying on a generic USB specification.

What if malware returns after a reset?

First determine whether the alert concerns a file you restored, a downloaded installer, or the Windows installation itself. Disconnect the suspect backup, run Windows Security and Defender Offline again, and review Protection history. If the threat persists before any personal files or third-party applications are restored, stop using that installation and perform a clean installation from trusted media.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

After recovery, install Windows updates, update security intelligence, enable real-time protection, and reinstall applications only from their official, trusted sources. Change passwords from a separate clean device when account theft is possible, beginning with email and any account that can reset other passwords.

Does Windows 10 still receive security fixes?

Microsoft states that Windows 10 support ended on October 14, 2025. After that date, Microsoft no longer provides free software updates through Windows Update, technical assistance, or security fixes for Windows 10, as noted in its Reset this PC guidance. Removing malware does not restore that ongoing support. If the hardware supports a supported Windows release, plan the upgrade; otherwise, understand that the cleaned Windows 10 installation remains outside Microsoft’s normal security-update lifecycle.

Quick decision checklist

  • One detection, no recurrence: update security intelligence, run a full scan, quarantine the item, and monitor.
  • Same threat after restart: run Microsoft Defender Offline before attempting a reset.
  • Need your files: locate a pre-infection external or versioned-cloud backup; do not trust a backup that lived on the infected PC without checking it.
  • Windows is damaged but the infection is contained: consider Reset this PC, choosing “Keep my files” or “Remove everything” with full awareness of what each deletes.
  • Persistent compromise or untrustworthy installation: use clean installation media after securing backups and the BitLocker recovery key.
  • Creating recovery media: use an empty USB because the process erases its existing contents; keep personal-file backups separately.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

backupsClean installMalware RemovalMicrosoft DefenderReset this PCSafe ModeWindows

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Recommended PC Tool
Recommended PC Tool
Outdated Drivers Are Slowing You DownFree scan - exact matches
Windows Errors? Fix Them Before They SpreadFree repair scan

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.