A Windows reset removes most consumer malware reliably, but not the classes built to survive one: browser-level hijacks that live in synced settings, seeded files restored from cloud storage, and rare boot-level infections. Reset is step one of a cleanup, not proof of one.
The pop-ups have won, the browser opens on a page you never chose, and every well-meaning friend has said the same word: reset. It's the standard advice for a locked-up machine, and it comes with an unspoken promise that factory settings mean factory-clean.
The advice isn't wrong, and it's worth saying so plainly. For the majority of consumer infections (adware, unwanted toolbars, run-of-the-mill trojans) a reset genuinely does remove them, and starting over beats hours of manual prodding for most home machines.
The catch is in the small print of that promise. Certain malware survives a reset by design, and one survival mechanism in particular is having a moment: the infection that hides in your synced settings or your cloud storage and gets reinstalled onto the fresh system the moment you sign back in. The machine locks up again within days, the panic returns, and now you're cleaning it twice.
Here's the point: treat a reset as step one of a cleanup with a verification step, not as the cleanup itself. Know what survives, know the five tells that it did, and know when a reset alone is the wrong tool.
Can malware survive a Windows reset?
Yes. A reset removes the malware that lives in Windows itself, and preserves anything that lives outside it: in firmware, in your cloud-synced settings, or in the files you restore afterwards. Whether yours survived depends on which of those places it calls home.
| Persistence mechanism | Lives where | Survives a reset? | Notes |
|---|---|---|---|
| Run-of-the-mill adware, toolbars, trojans | Windows and Program Files | No | Reset removes these reliably |
| Browser-policy hijacks (search engine locked, extensions returning) | Browser + Windows policies; sometimes synced to your account | Often yes | Re-imported with synced settings or a seeded extension |
| Scheduled-task and startup re-seeders | Windows Task Scheduler, startup folders | Mixed | Tasks die with Windows; the re-seeder file often survives in restored data |
| Cloud-sync re-infection | Your OneDrive/backup copy | Yes, by definition | Reset wipes the PC, not the cloud; signing in re-downloads a seeded file |
| Firmware/bootkit-level infections (UEFI) | Motherboard flash | Yes | Rare, genuinely serious, beyond consumer tooling |
That cloud row is the one modern households keep meeting. Everything synced is waiting patiently for you after the reset, which is wonderful for photos and less wonderful when the thing waiting is the infection. Restoring a full system image after a reset imports the old machine's problems along with its pictures; restore data selectively and re-run a scan before reopening anything.
One distinction matters here. Cloud Download versus Local Reinstall changes where the fresh Windows copy comes from, not what survives: Microsoft's reset documentation (checked 2026-09-07) describes Cloud Download as pulling the latest copy from the cloud and Local Reinstall as rebuilding from files already on the PC. Cloud Download is the better choice on a suspect machine because it rebuilds from a source the malware never touched.
Does resetting your PC remove all viruses?
No. It removes what lives in Windows, and Windows alone. The distinction between "removes most malware" and "removes all malware" is where a cleanup succeeds or quietly fails.
The reset options themselves have different depths. Keep my files reinstalls Windows but touches little else, so it is the weakest choice for an infection: the malware's data and often its schedule survive. Remove everything is the proper choice, and its Clean data toggle overwrites the drive rather than simply clearing the index. And Microsoft's documentation carries a line worth quoting in full, because it changes what "clean" means: "The data erasure functionality is targeted at consumers and does not meet government and industry data erasure standards." Your reset is a good broom. It is not a certified wipe.
For the same reason, treat a reset aimed at "selling the laptop" with the same scepticism as one aimed at malware; the caveat applies to both. If a machine must be provably clean for its next owner, that's a data-destruction conversation, not a settings conversation.
How do you tell if malware is still there after a reset?
Give it 48 hours of normal use and check five things: your browser's homepage and search engine, your extensions list, what runs at startup, idle CPU usage, and your installed-apps list. A surviving infection shows itself in one of them.
| Check | Where | Healthy looks like |
|---|---|---|
| Homepage and search engine | Browser settings | What you chose, and it stays chosen |
| Extensions | Browser add-ons page | Only what you installed on purpose |
| Startup items | Task Manager → Startup apps | Nothing unfamiliar, nothing re-appearing |
| Idle CPU | Task Manager → Performance | Single digits to low teens at rest |
| Installed apps | Settings → Apps | No strangers, nothing 're-appearing' you didn't reinstall |
The browser checks catch the most common survivor. A hijack that returns your search engine to some unfamiliar "helper" site within a day or two of the reset didn't survive in Windows; it survived in your synced browser settings or an extension you re-imported, which means the fix is a sign-out, a settings purge and a sign back in rather than a second reset.
Idle CPU is the subtle one, and worth the thirty seconds it takes. Malware often makes its living sending your data somewhere, and a machine that sits at 40% usage with nothing open is telling you something is working in the background. Nothing in the checklist replaces certainty, though; it's a smoke detector, not a survey.
What should you do before you reset an infected PC?
Save the selected data you care about, change your critical passwords from a different device, and only then reset. The order protects two things: your photos from the reset, and your accounts from the malware.
Selective is the operative word for the backup. Copy out documents and photos by hand or restore them into a fresh folder set; do not restore a full system image onto the new Windows install, because that image contains everything the malware needed to come back. This is also the moment a proper automated backup setup earns its keep, since it gives you a clean, dated copy to fall back on instead of a desperate last one.
The password half matters more than the reset half. Assume anything typed on the infected machine was seen, and change those credentials from a different, clean device: email first (it resets every other password), then banking, then shopping sites with saved cards. The NCSC's guidance on recovering an infected device (checked 2026-09-07) makes the same sequence its structure: confirm the infection, fix it, then deal with what happens after the fix.
When is a professional clean the right call after a reset?
Call it in when any of the five tells fires after a reset, when the infection touched banking or credentials, or when the machine locks up again despite a clean reinstall. Those are the signatures of something that survived, and surviving things are usually past the reach of guesswork. A professional diagnosis also tells you which situation you are actually in before more resets.
A professional clean differs from a second reset in having evidence at both ends. Mine runs remotely over a screen-share you watch from start to finish, at published rates (£25 per 15 minutes), with the five tells checked, persistence hunted properly (scheduled tasks, policies, startup entries, extensions, seeded files), and a before-and-after account of what was found and removed; where a fix isn't possible, the no-fix-no-fee (t&cs) promise applies. If the original infection arrived as a fake "Microsoft support" pop-up with a phone number, treat that as the credential-theft event it usually is; the NCSC's scam-reporting guidance (checked 2026-09-07) covers reporting, which is free and takes a minute.
Two honest boundaries. A Windows 10 machine past end of support re-infected after a reset will keep earning that state; no amount of cleaning beats a supported OS (the Windows 10 end-of-support options are worth a read in that case). And firmware-level infections are rare but real; they're beyond remote tooling, and any honest technician will tell you so and help you plan around it.
Reset and malware FAQs
Will a factory reset remove a hacker's remote access?
Usually yes on the PC itself, but assume any passwords typed while they had access were seen: change them from a different device, and check email rules and app authorisations afterwards.
Does Cloud Reset remove malware better than a local reinstall?
For infections, yes, on balance. Cloud Download rebuilds Windows from a fresh copy Microsoft hosts, so a corrupted or tampered local recovery image can't reinfect the rebuild.
Can a virus be hiding in OneDrive or my backup?
The malware itself doesn't run from cloud storage, but a seeded infected file will re-download onto a clean PC when you sync. Restore data selectively and scan before reopening anything.
Should I change passwords before or after resetting?
Before, and from a different device. The infected machine may be logging what you type, so the reset removes the listener but the passwords need changing regardless.
The reset did its job; the question that remains is whether the infection had a life outside Windows, and the checklist above answers it in a day or two. Verified-clean beats probably-clean, and it costs one careful evening.
The pattern behind this whole article is bigger than one bad week: the conveniences that make modern Windows pleasant (synced settings, cloud everything) are the same bridges malware uses to outlive a reinstall. Virus removal with verification is the short-term answer, backups that you can trust are the medium-term one. If you're in Ascot, Sandhurst or Bray and the five tells have fired, some background on who you'd be calling is here; the machine that came back once will come back twice until it's cleaned properly.