A stubborn infection has a way of coming back. You run a scan, remove what it finds, and for a few days everything looks normal — then the browser redirects return, or Microsoft Defender quietly switches itself off again. When cleanup stops being believable, a full wipe is the honest answer. It gives you a known-good starting point instead of a machine you keep second-guessing. What follows covers the entire job: deciding whether a reset is really needed, backing up without carrying the infection along, wiping the drive, and locking down the fresh install.

Is a Factory Reset Actually Necessary?

Not every infection deserves a nuke-and-pave. A single adware bundle or a nuisance toolbar can usually be removed by hand. But some signs point to something deeper: pop-ups that reappear within days, unfamiliar user accounts, Defender turning itself back off, a browser homepage you never set, unexplained outbound network traffic, or scheduled tasks and services you don't recognize.

Before wiping, give yourself one honest attempt at removal. A Windows Defender Offline Scan runs before Windows loads, which lets it catch threats that hide from a running system. Bootable rescue media from a reputable security vendor works the same way. If a scan from outside Windows still finds something, or the symptoms return after a clean reboot, stop trying to negotiate. Reinstalling Windows is the only way to be sure what code is running.

Back Up What You Can't Replace

Assume anything on the drive is contaminated until proven otherwise. Copy data files, not the whole machine, and be deliberate about it:

• Personal files: documents, photos, videos, spreadsheets, source code, project folders. Copy the folders directly to an external drive.
• Email and contacts: export mail to a file from inside your mail client, or confirm that everything important lives on the provider's server.
• Browser bookmarks: export them as an HTML file. Do not copy the browser profile folder itself.
• Licences and settings notes: product keys, VPN configuration details, printer names, app preferences. Store credentials in a password manager, never in a plain text file on the backup drive.
• A list of software you'll need to reinstall, so you aren't rebuilding from memory next week.

Skip Program Files, the Windows folder, most of AppData, and every old installer you've collected. A malicious browser extension lives inside your browser profile, so copying that folder wholesale is a great way to reinfect a brand-new PC. Treat the backup drive as suspect: scan restored files on the clean system before opening them, and keep the drive unplugged during the reinstall.

Build Your Recovery Kit Before You Touch Anything

1. A USB flash drive of 8 GB or more. Everything on it will be erased.
2. Windows installation media, created with Microsoft's official Media Creation Tool on a different, trusted computer if possible.
3. Your BitLocker or device-encryption recovery key, if the drive is encrypted. A clean install removes the encryption along with the partitions, but you'll want the key if you ever need to read the old drive.
4. Your Microsoft account sign-in, or the product key if your licence isn't digital.
5. Drivers and firmware downloaded from your PC manufacturer's support page, saved to the USB or a second drive.
6. Your Wi-Fi password and any VPN details.

Wiping the Drive

Unplug the network cable or disable Wi-Fi first. Whatever is running on that machine doesn't need internet access while you work.

Route 1: Reset This PC

Go to Settings > System > Recovery > Reset this PC, choose Remove everything, then click Change settings and turn on Clean data. That option overwrites the drive rather than just marking files as deleted, and it takes considerably longer. The catch is that this reset runs from inside the infected copy of Windows. That's fine most of the time, but it isn't a guarantee.

Route 2: Clean Install From USB

This is the more thorough option, and the one to choose if the machine was hit by ransomware or anything that ran with system privileges. Boot from the USB stick (the boot-menu key varies by manufacturer — often F12, F10, Esc or F2), choose Custom: Install Windows only, then delete every partition on the system drive until you're left with a single block of unallocated space. Select it and let Windows create its own partitions. Unplug external and secondary drives first so you don't wipe the wrong disk.

If malware ran with administrator or system rights, don't try to preserve the old Windows install. You want it gone, not cleaned.

Order Matters After the Install

1. Keep the backup drive disconnected for now.
2. Connect to the internet and let Windows Update run until it reports nothing left. Reboot and check again.
3. Install chipset, graphics and network drivers from the manufacturer, then apply any firmware updates.
4. Confirm Defender and the firewall are both on.
5. Restore files in small batches — documents first, then media — scanning each batch before you open anything.
6. Reinstall programs from fresh downloads, never from installers copied off the old drive.
7. Set the browser up clean. Signing into sync immediately can pull back an extension you didn't want, so check the extension list first.
8. Only then reconnect email clients, cloud storage and work accounts.

What a Reset Doesn't Fix

The PC is only one piece of a compromised setup. Your accounts, your router and your other devices all keep the original problem alive. Change passwords from a different, clean device, starting with your email address. Sign out of all active sessions, enable two-factor authentication, and open each provider's account activity page to look for logins you don't recognize. Check your phone, tablet and any other computers on the same network.

If your router's admin password was changed or its settings look unfamiliar, reset it to factory defaults, update its firmware and change the Wi-Fi password. In rare cases malware can linger in a device's firmware, which no reinstall will touch.

Keeping the Fresh Install Clean

A wipe buys you a clean slate, not immunity. Keep an offline backup that isn't permanently connected, avoid cracked software, leave automatic updates on, and don't disable Defender for convenience. Be cautious with the files you restored — if anything behaves strangely, delete it rather than troubleshoot it.

If this is a work machine, or the infection reached business accounts or shared files, tell IT or a security professional before reconnecting it to a company network. They can check what else was exposed while the malware was running. For anything involving financial or legal exposure, get advice from a qualified professional rather than relying on a clean reinstall to close the matter.

Photo: Kamil Čičila / Pexels