If you clean a host and the malware comes back after reboot, you missed the persistence. Attackers plant a mechanism that re-launches their payload automatically - so remediation means removing both the payload and the persistence.
The usual hiding spots
- Run / RunOnce keys -
HKCU\...\CurrentVersion\Runexecutes at logon. Simple and common. - Scheduled tasks (Event ID 4698) - run on a trigger or schedule, often with innocuous names.
- Services (Event ID 7045) - run as SYSTEM at boot.
- WMI event subscriptions - a stealthy, fileless trigger (
__EventFilter+CommandLineEventConsumer). - Startup folder, DLL search-order / COM hijacks, IFEO debuggers, and BITS jobs.
How to find it
- Autoruns (Sysinternals) enumerates virtually every autostart location at once - the first tool to reach for.
- Alert on new services (7045), new scheduled tasks (4698), and Run-key writes to suspicious paths (%APPDATA%, %TEMP%).
- A classic tell: a "system" binary name in the wrong place (e.g.
svchost.exein %APPDATA% - the real one lives in System32).
Full remediation = payload removed + persistence removed + confirmed it doesn't return on the next reboot/logon.