DEV Community

Darkssel
Darkssel

Posted on

How to Restore Your System After a Malware Attack or Major Crash (Without Losing Your Files)

#windows #security #malware #recovery

Your PC was working fine yesterday.

Today, it's a mess.

Pop-ups everywhere. Files missing. Programs crashing. Or worse — your PC won't even boot.

You might think:

"Do I have to wipe everything and start from scratch?"

Not necessarily.

Yes, malware attacks and major crashes are serious. But there's a way to recover your system — without losing your important files, photos, and documents.

This guide walks you through exactly how to restore your system after a malware attack or major crash — step by step.

Before You Start: The Golden Rule

Don't panic.

A clean install of Windows wipes everything. It's the nuclear option — and it should be your last resort, not your first instinct.

The approach below uses Windows' built-in recovery tools that can:

  • Remove most threats
  • Repair damaged system files
  • Restore your PC to a working state
  • Keep your personal files intact

Let's go.

Step 1: Disconnect from the Internet Immediately

If you suspect a malware attack, the first thing you should do is cut off its communication.

What to do:

  • Unplug your Ethernet cable
  • Turn off Wi-Fi (click the network icon → Disconnect)

Why this matters: Many malware variants communicate with remote servers to download more components or send stolen data. Disconnecting the internet limits the damage.

Step 2: Enter Safe Mode

Safe Mode loads Windows with a limited set of drivers and services, which can prevent some malware from starting automatically.

How to enter Safe Mode:

  1. Restart your PC
  2. As soon as the manufacturer logo appears, hold the power button to force shutdown
  3. Repeat this 2–3 times
  4. Windows will display "Preparing Automatic Repair"
  5. Click Advanced options → Troubleshoot → Advanced options → Startup Settings → Restart
  6. Press 4 for Safe Mode (or 5 for Safe Mode with Networking)

Once in Safe Mode: You have a cleaner environment to work in — some malware may not be active in this state.

Step 3: Run a Full Malware Scan

Now that you're in Safe Mode, it's time to clean.

How to run a full scan with Windows Security:

  1. Open Windows Security (search "Windows Security" in Start)
  2. Go to Virus & threat protection
  3. Click Scan options
  4. Select Full scan
  5. Click Scan now
  6. Wait for the scan to complete (may take 30–60 minutes)

Alternative (if Windows Security fails):

  • Download Malwarebytes or HitmanPro on another PC and transfer it via USB
  • Install and run it according to the tool's current instructions

Pro tip: For deeper cleaning, run a second scan with a different tool. Malwarebytes and HitmanPro are excellent second opinions.

Step 4: Run System File Checker (SFC) and DISM

Malware often corrupts system files. Repairing them can restore stability.

How to run SFC and DISM:

  1. Open Command Prompt as Administrator
  2. Run: 

DISM /Online /Cleanup-Image /RestoreHealth
Enter fullscreen mode Exit fullscreen mode
  1. Wait for completion (10–15 minutes)
  2. Run: 

sfc /scannow
Enter fullscreen mode Exit fullscreen mode
  1. Wait for completion
  2. Restart your PC

Note: If you can't boot normally, run these from WinRE → Command Prompt.

Step 5: Remove Suspicious Startup Programs and Services

Malware often adds itself to startup so it runs every time you boot.

How to check:

  1. Open Task Manager (Ctrl + Shift + Esc)
  2. Go to the Startup tab
  3. Disable anything you don't recognize

Check scheduled tasks:

  1. Press Win + R, type taskschd.msc, press Enter
  2. Look for unfamiliar tasks with random names or suspicious paths
  3. Disable or delete them

Check services:

  1. Press Win + R, type services.msc, press Enter
  2. Look for unfamiliar services
  3. Research online before disabling anything

Want to monitor these changes automatically?

Manually checking processes and startup entries can help during recovery, but it isn't practical to do every day. If you want to know when a new process starts or a startup entry changes after your system has been cleaned, SysPulse can monitor these events in the background and send Telegram alerts.

Learn more about SysPulse

SysPulse is a monitoring tool, not an antivirus or malware-removal utility. It is designed to help you stay aware of system changes after recovery.

Step 6: Perform a System Restore (If Available)

If the attack happened recently, you can roll back.

How to do it:

  1. Boot into WinRE (Advanced options)
  2. Go to Troubleshoot → Advanced options → System Restore
  3. Select a restore point from before the problem started
  4. Follow the on-screen instructions

Note: System Restore doesn't affect your personal files — only system settings and installed programs.

Step 7: Reset Windows 11 (Keep Your Files)

If nothing else works, a reset can reinstall Windows while keeping your files.

How to do it:

  1. Boot into WinRE (Advanced options)
  2. Go to Troubleshoot → Reset this PC
  3. Select Keep my files
  4. Choose Cloud download or Local reinstall (Cloud is recommended)
  5. Follow the prompts

What happens: Windows is reinstalled, but your Documents, Pictures, Music, and Videos folders remain.

What you lose: Installed apps and settings — but not your personal files.

Step 8: After Recovery — Restore Your Files and Monitor Your System

Once your PC is back to normal, it's important to:

  1. Restore backed-up files from external storage
  2. Reinstall essential apps (browser, office tools, etc.)
  3. Update Windows to the latest version
  4. Update drivers (especially graphics and network drivers)
  5. Review startup entries and recently installed software
  6. Set up monitoring to catch unexpected system changes early

At this stage, a lightweight monitor can provide an additional layer of visibility.

SysPulse can:

  • Detect new processes and show their full file paths
  • Monitor CPU and RAM anomalies
  • Detect USB connections in real-time
  • Detect startup changes
  • Send Telegram alerts for monitored events
  • Use less than 30MB of RAM

You can set it up and let it monitor your PC in the background, so you can receive an alert when a monitored event occurs.

Visit SysPulse

Summary Table

Step Action Keeps Files?
Disconnect from internet Cut off malware communication ✅ Yes
Enter Safe Mode Run Windows with minimal drivers ✅ Yes
Run malware scan Remove threats ✅ Yes
Run SFC / DISM Repair system files ✅ Yes
Remove startup items Stop suspicious persistence ⚠️ Depends on the item
System Restore Roll back recent changes ✅ Yes
Reset Windows Choose "Keep my files" ✅ Yes
After recovery Monitor system changes ✅ Yes

Final Thought

A malware attack or major crash is scary — but you don't have to lose everything.

Start with the simple steps:

  1. Disconnect from the internet
  2. Enter Safe Mode
  3. Run a full scan
  4. Repair system files

If those don't work, move to System Restore or a Windows Reset (keep my files).

The key: Don't panic. Work through the steps in order. And once you're back up and running, consider a monitoring tool to catch future issues early.

Have questions about recovering your system? Drop a comment below — I read every one.

Stay secure!

Top comments (0)