When a serious virus hits your PC, the first thing to do is stay calm and act methodically: an unstable Windows system can be recovered if you follow a clear order and use the right tools. In this guide, we explain how to diagnose, clean, and repair your system using built-in utilities (SFC and DISM), trusted third-party tools, and, if there's no alternative, a clean reinstall.
In addition to restoring stability, it's crucial to prevent collateral damage: data theft, reinfections, or file corruption. You'll learn how to isolate the system, analyze and disinfect malware, repair critical system files, and implement preventative measures to avoid recurrence.
Signs of serious infection and damage to Windows
Before attempting any repairs, it's advisable to confirm whether the problem is related to malware or corrupted system files. These are common signs of infection and corruption :
- Strange alerts that do not come from your real antivirus, pop-ups and “ads” that push you to pay for miracle fixes (ransomware, scareware).
- Browser hijacked, automatic redirects to dubious websites or inability to change the home page.
- Blocking executables (.exe or .msi) and Microsoft installer errors that prevent programs or cleaning tools from opening.
- Forced changes to the desktop: : unmovable background, empty menus (Start > Programs) or disappearance of shortcuts.
- Antivirus icon missing or disabled, as well as suspicious processes that reappear after closing them.
- Strange entries in Device Manager and hidden devices that expose malicious kernel-mode drivers.
Not everything is malware; there are also "mechanical" causes: power outages, freezes during updates, faulty hard drives, massive bloatware, or defective software. These factors damage critical system files and cause everything from blue screens to the inability to start Windows.
Before touching anything: Isolate, safe mode and rapid diagnosis
To break the chain of infection and prevent data exfiltration, the first step is to isolate the computer. Disconnect from the internet immediately (both wired and Wi-Fi) and do not plug in any USB devices until the system is stable.
The next step is to boot into Safe Mode (preferably with networking only if you're going to download trusted tools). This boot mode loads the bare minimum , usually neutralizes malware injected at startup, and allows you to operate your computer.
If the tools fail to start because the .exe files are blocked by malware, there's a classic trick: rename the .exe file to .com and run it; in many infections, this bypasses the shell hook and allows the cleaner or installer to open.
To refine your advanced diagnosis, you can review processes and startup entries using utilities like Process Explorer and Autoruns (run them as administrator). Persistent infections often reveal themselves in these views, especially if they load unusual drivers or scheduled tasks.
Before running long scans, delete temporary files to lighten the load on the scanners. Use Disk Cleanup and Internet Options to clear caches and residual files; this reduces noise and speeds up the antivirus software.
Repair system files with SFC and DISM
Even after a severe infection, if you remove the malware, corrupted system files may remain . This is where two built-in utilities come into play: SFC (System File Checker) and DISM (Deployment Image Servicing and Management).
SFC compares each protected file with its trusted copy in the Windows File Protection cache and replaces corrupted files with correct versions. DISM validates and repairs the entire Windows image by comparing it to a clean local or online reference.
Run SFC in Windows 7, 8/8.1, 10, and 11
The process is identical in Windows 7 through 11. Open the Start menu, type "cmd", right-click, and select Run as administrator . Confirm the prompt and launch:
sfc /scannowanalyzes and repairs protected files; it may take a while.
At the end, you will see one of these typical messages and its practical meaning. Interpret them as follows :
- “Windows Resource Protection did not find any integrity violations.” — There is no system corruption; your problem may be due to another cause.
- “Found corrupted files and successfully repaired them.” — Arrangement applied using the local cache.
- “It found corrupted files and was unable to repair some of them.” — The cache used by SFC is also corrupted; go to DISM to repair the image and run SFC again.
- “Could not perform the requested operation.” — Try in Safe Mode, use DISM and repeat SFC.
Run SFC when Windows won't boot
If you cannot start the system, use Windows recovery media (USB/DVD). Boot from it and under "Choose an option," go to Troubleshoot > Command Prompt. Run SFC, pointing to the installation :
- Windows 11/10/8/8.1 and 7:
sfc /scannow /offbootdir=C:\ /offwindir=C:\Windowsadjust the drive letter depending on the case.
Repair the image with DISM
If the WFP cache is corrupted, DISM is the next step. Open CMD as administrator and use these switches, from least to most "deep":
/checkhealthquick check of recorded problems./scanhealthfull scan that detects corruption and records it without repairing it./restorehealthscanning and repair against a clean local or online image.
Recommended command for hot repair: dism /online /cleanup-image /restorehealth. When I'm done, CFS happens again To consolidate the restoration. If you want to clean components, add: dism /online /cleanup-image /startcomponentcleanup.
Important version note: Modern DISM is not available in Windows 7. For cases where SFC doesn't resolve the issue, use Microsoft's System Update Readiness Tool (SURT) , a similar utility for repairing maintenance stack inconsistencies.
Official Microsoft updates and tools
After cleaning and repairing, it's a good idea to update your system. Go to Settings > Update & Security and apply the latest cumulative updates: they fix bugs and strengthen your system against vulnerabilities.
For disinfection and second opinions, use Microsoft's antimalware tools (for example, Microsoft Defender and its offline options). These utilities help eliminate any residual threats that may still be lurking after the initial cleanup.
If the situation is complex (for example, the computer won't start or remains unstable), access the advanced recovery options in Windows 10/11. From there you can perform Startup Repair, System Restore to a previous point, or even "Reset this PC" while preserving your files.
To maintain optimal performance, it's worth following official optimization recommendations (managing startup programs, disk space, drivers, etc.). A well-maintained system is less likely to corrupt files during crashes or updates.
Malware Removal: Deep Scan and Clean
Remove the malware first, then repair Windows: doing it the other way around can mask the infection or allow it to reinstall itself. Combine an on-demand scanner with your resident antivirus to increase the detection rate.
Types of protection to consider: Real-time antivirus monitors continuously, while on-demand scanners scan when you run them. Don't run two resident engines at the same time ; you can use several on-demand scanners for comparison.
A recommended workflow using well-known third-party tools is as follows: download, update, and run a quick scan with your favorite on-demand scanner (e.g., Malwarebytes). If it detects malicious objects, remove them and restart when prompted; then, complete the scan with a full scan.
If the scanner crashes immediately upon launch, the infection is likely aggressive and blocking the tool. At that point, after backing up your personal files, seriously consider reinstalling ; it's usually faster and ensures the root of the problem is eliminated.
During the cleanup, pay attention to startup entries and kernel-mode drivers that load as hidden Plug and Play programs; these can block the antivirus. In Device Manager, enable "Show hidden devices" to locate them and facilitate disinfection.
Remember: no antivirus detects 100% of variants . That's why it's good practice to confirm results with a second on-demand scanner and, if the system is stable, finish with a full scan of the resident antivirus to verify that there is no more malicious activity.
Good practices and prevention of reinfections
Once it's clean and repaired, it's time to reinforce good habits. Keep Windows and applications updated with critical and security patches available through Windows Update and the official updaters for each software.
When it comes to email, practice "healthy skepticism": don't open attachments or links from unknown senders , and be wary of alarmist messages. If you have any doubts, delete the email or check with the service's official support.
It's essential to have an active and up-to-date real-time antivirus . If you don't want to pay, there are reliable free alternatives that are more than adequate for standard use.
Scan removable media before using it (USB drives, external hard drives, DVDs). Avoid running files with risky extensions received via email or chat: .exe, .pif, .com, .src, unless they come from a 100% trusted source.
Review activity on your sensitive online accounts (banking, email, social media) after the incident and change your passwords . If you use backups, scan them to confirm you didn't save the infection; if scanning isn't feasible (e.g., cloud backups), it's usually safer to restore old backups and create new ones.
When nothing works: Clean reinstallation of Windows
There are cases where the infection or damage is so extensive that the safest solution is to start from scratch. A clean reinstall resolves 100% of infections when performed correctly and is usually faster than chasing a persistent rootkit.
Key recommendations: Always respect the licensed edition (Home, Pro, Single Language, etc.). During installation, omit the product key ; when you boot into the internet, Windows will activate automatically if the hardware matches the digital license.
Before formatting, back up your personal files and do not restore potentially infected executables or installers. After installation, apply all updates , install official drivers, and then your security suite and applications.
If you prefer not to format, Windows 10/11 offers "Reset this PC" with the option to keep your files. It's less drastic and may be sufficient if the infection was contained and has already been removed, but if you're unsure whether it persists, a clean installation is more reliable.
If you're facing a serious virus, think of this as a flexible roadmap: isolate the computer, disinfect with reliable scanners, repair system integrity with SFC and DISM, and update Windows . If symptoms persist or tools are blocked, consider a clean reinstall and strengthen your preventative measures to get your Windows running smoothly again and, above all, protected.