What to do if a potential malware survives a pc reset?

Global.wsw still running after a full reset (including drive clean and cloud download) indicates either:

• A persistent malware component that standard cleanup did not fully remove, or
• System damage or deceptive software that continues to reintroduce or mimic the process.

Because a reset with drive cleaning and fresh download did not eliminate it, the next steps should focus on deeper malware removal and, if needed, a full reinstall with careful restore of only clean data.

Recommended sequence:

1. Run the Malicious Software Removal Tool (MSRT)

• Open a Run prompt (Windows logo key + R).
• Enter:
  • %windir%\system32\mrt.exe
• Select OK and, if prompted, allow changes.
• In MSRT, choose a full scan and let it complete; follow prompts to remove any malicious software.
• Restart the PC when the tool requests it.

MSRT can detect and remove specific prevalent malware and may prompt to remove malicious files or change back modified settings. Some data loss is possible if infected files must be cleaned.

2. Run Microsoft Defender Offline If the same threat or suspicious behavior persists, use Microsoft Defender Offline to catch hidden components that reload the process:
3. Open Settings > Update & Security > Windows Security > Virus & threat protection.
4. Under Current threats, select Scan options.
5. Choose Windows Defender Offline scan and select Scan now.
6. The PC will restart and run an offline scan; let it complete and follow any prompts.

This helps remove malware that hides while Windows is running.

3. Ensure Windows and security definitions are fully updated After cleaning:

• Install all available Windows Updates.
• Confirm Microsoft security software is up to date (definitions and platform updates). Updates normally install via Windows Update.

4. If malware has caused irreversible changes If Global.wsw or related symptoms persist even after MSRT and Defender Offline:

• Treat the system as potentially irreversibly compromised.
• Back up only personal files (documents, photos, etc.) to an external location or cloud (such as OneDrive). Avoid backing up executables, installers, or unknown scripts that might reintroduce malware.
• Use installation media to reinstall Windows, which removes malware more thoroughly than an in-place reset when system damage is severe.
• After reinstalling, immediately apply all Windows updates and reinstall apps from trusted sources only.

5. If a reset/reinstall is repeated If another reset is needed:

• Prefer a full reinstall using recovery drive or installation media rather than relying solely on Reset if the first Reset did not fully clean the system.
• When using Reset, choose “Keep my files” only if absolutely necessary; otherwise, a full reinstall removes all apps and settings and is more thorough.

6. If threats are only partially removed If security software reports a threat as “partially removed”:

• Run MSRT as above.
• Restart the PC.
• Manually install the latest Windows updates.
• If needed, follow advanced troubleshooting guidance and use Microsoft Defender Offline again.

If, after these steps, Global.wsw or similar suspicious processes still appear, treat the device as untrusted until a clean reinstall has been completed and only verified-clean data has been restored.

References:

• Antivirus and antimalware software: FAQ
• Remove specific prevalent malware with Windows Malicious Software Removal Tool (KB890830)
• Troubleshoot problems with detecting and removing malware
• Recovery options in Windows