Get it actually gone, not just quiet

When a machine gets reinfected a day after being cleaned, it was almost never reinfected. Something on the box survived. We start every cleanup by enumerating persistence rather than by running another scanner. That means walking registry Run and RunOnce keys, scheduled tasks (especially ones with innocuous Microsoft-sounding names), Windows services with unsigned binaries, WMI event subscriptions, startup folders, Winlogon shell and userinit values, DLL search-order hijacks sitting next to legitimate executables, and browser policy keys such as Chrome's forced-extension list, which quietly reinstalls a hijacker every time the browser launches.

Not everything called a virus is one

A large share of what walks in the door is adware, a browser hijack or a scam, not malware in the classic sense. Search redirects and injected ads usually trace to a malicious extension, a modified browser shortcut with a URL appended to the target, a proxy or DNS override, or a policy key. Endless popups claiming your PC is infected, complete with a phone number and a siren noise, are a tech support scam page abusing full-screen mode. Nothing is infected until you call the number and let them in.

Browser notification spam deserves special mention because it fools experienced users. A site asks for permission to send notifications, someone clicks allow, and now fake virus warnings arrive on the desktop even when the browser is closed. There is no malware to remove. The fix is revoking the notification permission, and no scanner will ever find it.

When we clean, and when we rebuild

We clean when the infection is well understood and its scope is limited: adware, a hijacked browser, a bundled toolbar, a single known trojan caught early by EDR before it executed fully. We rebuild when we find anything that touched the boot path or the credential store, bootkits and UEFI-level persistence, rootkits hiding processes from the OS, or an infostealer that had free run of the machine.

That last category is the important one. Modern commodity malware is mostly credential theft. It scrapes saved browser passwords, session cookies, VPN profiles, saved RDP credentials, crypto wallets and Windows Credential Manager entries, then exfiltrates them within minutes of landing. Once that has happened the machine can be perfectly clean and you still have a problem, because the attacker has your logins and, worse, valid session tokens that can bypass MFA. Cleaning the machine does not un-steal them.

So our rule is blunt. If there is credible evidence of credential theft, or if the persistence mechanism is not fully explained, we recommend a flat rebuild from known-good media. Reimaging a workstation takes a few hours. Untangling a compromised Microsoft 365 tenant takes days.

Whichever path we take, the credential work is not optional. From a known-clean device, change passwords for email, banking, payroll, remote access and anything reused, do not do this from the infected machine. Then revoke active sessions in Microsoft 365 or Google Workspace so stolen cookies stop working, re-register MFA methods, and check the mailbox for the tell that gets missed constantly: inbox rules quietly forwarding or deleting messages, and unfamiliar OAuth app grants. Our free breach check and dark web scan are a useful sanity pass afterward.

Timing matters more than most people realize. The window between an infostealer landing and the stolen data being used is often hours, not days, and the machine frequently looks and behaves completely normally throughout. That is why we treat “it seems fine now” as an observation rather than an all-clear, and why the first instruction we give over the phone is to disconnect the machine from the network while leaving it powered on. Pulling the network cable stops exfiltration and lateral movement immediately; pulling the power destroys the volatile evidence that tells us what ran and what it reached.

For businesses there is a further step home users can skip: containment and scope. One infected endpoint on a domain is a question, not an answer. We isolate it, check whether the same credentials were used elsewhere, look for lateral movement, and review whether this was a precursor. Infostealer and loader infections are frequently the reconnaissance stage that precedes a ransomware event days or weeks later, which is why our ransomware protection work treats a single minor infection as a serious signal rather than a nuisance.

If we cannot explain how it got persistence, we do not tell you it is clean.Orca IT, Gilbert AZ