When malware disables Windows System Restore

System Restore can return Windows to an earlier configuration, but it is not a backup of personal files. When malware disables the Windows System Restore function, it may be protecting its own foothold while removing a convenient recovery route. Treat the infection and the loss of recovery options as two connected problems.

First, disconnect the computer from the internet and record what you can see, including alerts, ransom notes and changed browser settings. Avoid random “System Restore fix” downloads from search advertisements; they can introduce another infection.

This guide covers Windows 10 and Windows 11, including offline scanning, persistence checks, data preservation and restoring protection for Australian home users and small businesses. Organisations with managed devices should involve their IT team or incident-response provider.

Disconnect and contain the damage

Switch off Wi-Fi, unplug Ethernet and stop using the PC for email, banking or work files. A day that moves between home broadband in Sydney, a Melbourne café hotspot and an office VPN still needs one clean break: remove the infected machine from every network. Isolation limits remote control and new downloads, but not local activity already underway.

If files are visibly being encrypted, seek qualified recovery advice before repeatedly restarting the machine. Photograph messages, record when they appeared and avoid wiping the disk; readable files and evidence may help a recovery tool. Disconnection alone will not stop encryption already running locally.

Use a separate, trusted device for essential accounts. After cleanup, change banking and email passwords, including those used for myGov and other Australian services. For a work computer, involve your internal IT team or an Australian incident-response provider before moving files or logs.

Identify and remove the infection

Open Windows Security and review Virus & threat protection alerts. Run a full scan, then select Microsoft Defender Offline scan. In Windows 11, choose Settings > Privacy & security > Windows Security > Virus & threat protection > Scan options. If the interface has been hijacked, use trusted installation media rather than its controls.

Create Windows installation media on a clean machine using Microsoft’s official tool, and boot it to reach Windows Recovery Environment. After an offline scan, inspect recently installed programs, browser extensions, startup entries and scheduled activity, removing items you can confidently identify as malicious. Do not delete unfamiliar system files or registry values by name, and avoid reconnecting the PC to download tools.

An offline cleanup needs supporting precautions. If the scan also finds a keylogger, follow the keylogger removal guide, then reset affected passwords from a clean device and revoke active sessions where supported. Removing a malicious file does not automatically remove the credentials or browser data it may already have exposed.

Choose a recovery route

Decide whether you need to undo system changes, remove persistence, preserve encrypted files or repair Windows itself. An inappropriate repair can overwrite useful evidence or reduce the chances of successful decryption.

Use symptoms and scan results to choose the least destructive response. Confirm that a restore point predates the infection before relying on it, and back up irreplaceable data whenever possible. System Restore captures protected system files and settings, not personal documents.

Condition	Safer response	Useful outcome	Important limitation
Restore points visible	Scan, then restore a confirmed-clean point	May undo unauthorised changes	Does not remove every threat or recover files
Restore option unavailable	Use recovery media and an offline scan	Recovers access without an old snapshot	May need administrator access and more cleanup
Encryption is progressing	Isolate and preserve the current state	Preserves options for a reputable decryptor	No method guarantees every file can be decrypted
Startup damage is extensive	Use an official in-place repair	Replaces core files while keeping most data	May leave malicious accounts or tasks

A repair installation differs from resetting Windows or erasing the disk. Follow Microsoft’s media instructions and keep files and applications where supported. If a professional examination is affordable, obtain it before repeated repairs alter the evidence.

Restore Windows recovery options

After cleanup, run another full and offline scan. Confirm that alerts are clear and Windows starts normally before changing recovery settings. On a personal PC, search for “Create a restore point” in Settings and enable System Protection where your edition provides it; on managed devices, ask the administrator to review the policy.

Some malware targets restore policies or interferes with the Volume Shadow Copy service behind restore points. Check the official System Protection controls and service status using trusted Microsoft documentation. Avoid registry “fix” scripts from unknown sites. If protection remains missing, a clean Windows repair or reinstall may be the dependable solution.

Create a fresh restore point after cleaning and confirm that it appears in the protection interface. Restore points help with configuration, but cannot rescue files already encrypted, deleted or corrupted.

Prevent recurrence and protect Australian data

Microsoft Defender is included with Windows, while standalone antivirus subscriptions are sold by Australian retailers such as JB Hi-Fi and Harvey Norman. Compare protection, support and privacy terms rather than installing overlapping products. Enable updates, use a standard account for daily work and protect the administrator account with a unique passphrase.

Australian organisations should assess whether an incident triggers notification under the Privacy Act 1988 and the Notifiable Data Breaches scheme administered by the OAIC. Use a documented incident process covering containment, evidence and communication, and avoid pasting personal information into public troubleshooting forums.

Keep two or more backup copies, including one offline or in a separate location, and test that important files can be restored. Before paying for a commercial cleanup or decryptor, read the removal disclaimer and check the publisher, refund terms and independent reviews. A credible tool should explain what it can repair and what it cannot.