Remove Malware Startup Entries and Scheduled Tasks

The Problem

You found the bad file. You deleted it, ran a scan, restarted — and two days later it is back.

That is persistence. Modern malware never relies on a single file. It plants several independent ways to bring itself back: a scheduled task that runs every ten minutes, a Windows service, a registry Run key, a shortcut in the Startup folder, and often a browser policy on top. Removing one leaves the others to restore it, which is why partial cleanups fail and people end up reinstalling Windows unnecessarily.

This guide is the systematic sweep: six places to check, what a legitimate entry looks like in each, and how to remove the rest safely.

Have not run a scan yet? Do that first — remove virus and malware, including the offline scan. This guide is what you do when the scan comes back clean but the problem returns.

Before You Start

Create a restore point. You are going to delete services and registry entries, and a wrong one can stop Windows booting cleanly.

Work in Safe Mode with Networking if the malware is actively running — most persistence mechanisms do not start there, which makes them easier to remove.

The Fix: Step-by-Step

Step 1: Startup Apps

Ctrl + Shift + Esc → Startup apps.
Sort by Publisher. Anything with a blank publisher deserves scrutiny.
Right-click → Open file location on anything unfamiliar.

Legitimate entries point into C:\Program Files, C:\Program Files (x86), or a vendor folder in %LocalAppData%\Programs, and are signed. Suspicious entries point into %Temp%, %AppData%\Roaming with a random name, or C:\ProgramData\<random>.

Disable rather than delete at this stage — you can re-enable if you disable something you needed. Note the file path first.

Step 2: The Startup Folders

Two folders Windows runs at sign-in that Task Manager does not always show clearly:

Win + R → shell:startup (your account) Win + R → shell:common startup (all users)

Both should be empty or contain a handful of shortcuts you recognise. Delete anything else, and check the shortcut Target before you do — a shortcut pointing at powershell.exe with a long encoded argument is malware, not a program.

Step 3: Registry Run Keys

Win + R → regedit. Check all four:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

Read the Data column, which holds the full command. Delete values whose command:

Runs powershell.exe or cmd.exe with -enc, -EncodedCommand, -w hidden, or -nop.
Points into %Temp%, %AppData%, or ProgramData with a random filename.
Uses mshta.exe, rundll32.exe, or regsvr32.exe against a URL.

Export the key first (File → Export) so you can restore it if you cut too deep.

Step 4: Scheduled Tasks — Where Most Persistence Hides

Win + R → taskschd.msc → expand Task Scheduler Library.

Work through the root and the subfolders. For each unfamiliar task, check three tabs:

Triggers — repeating every 1–15 minutes, or "at log on of any user", is a strong signal.
Actions — the program and arguments. Same red flags as Step 3.
General — "Run with highest privileges" combined with a hidden window.

Genuine Microsoft tasks live under Microsoft\Windows\... and are numerous — do not clear that tree wholesale. Malicious tasks usually sit at the library root or in a folder named after nothing in particular, and often mimic real names with a small difference (GoogleUpdateTaskMachineUAC versus GoogleUpdateTasksMachineUA).

Right-click → Disable first, restart, confirm the problem stops, then Delete.

To list tasks that run from user-writable paths in one pass, use Terminal (Admin):

schtasks /query /fo LIST /v | findstr /i "TaskName Task_To_Run" | findstr /i "AppData Temp ProgramData"

Step 5: Services

Win + R → services.msc.

Sort by Description. A service with no description at all is unusual for legitimate software. Double-click anything suspicious and read Path to executable — the same path rules apply.

To remove a confirmed bad service, from Terminal (Admin):

sc stop "ServiceName"
sc delete "ServiceName"

Use the service's real name from the General tab, not its display name.

Step 6: WMI Subscriptions

A quieter technique: a permanent WMI event subscription that relaunches malware on a system event. Check from Terminal (Admin):

Get-WMIObject -Namespace root\Subscription -Class __EventFilter
Get-WMIObject -Namespace root\Subscription -Class CommandLineEventConsumer

A clean home PC returns nothing, or only entries from a known management tool. Anything referencing PowerShell or a script path is malicious. Remove with:

Get-WMIObject -Namespace root\Subscription -Class CommandLineEventConsumer | Where-Object { $_.Name -eq "BadName" } | Remove-WMIObject

Step 7: Browser Policies

Malware increasingly persists in the browser rather than Windows. Check for forced extensions and locked settings:

reg query "HKLM\SOFTWARE\Policies\Google\Chrome" /s
reg query "HKLM\SOFTWARE\Policies\Microsoft\Edge" /s

On a personal PC, entries here that you did not create should be deleted. Details in remove malicious browser extensions.

Step 8: Confirm It Is Gone

Restart normally.
Leave the PC idle for 30 minutes.
Re-check Startup apps, Task Scheduler, and Services for anything that has reappeared.
Run a Microsoft Defender Offline scan as a final pass.

If an entry regenerates, something you have not found yet is recreating it — go to remove a rootkit or bootkit.

Where to Look First, by Symptom

| Symptom | Most likely persistence | |---|---| | Process returns minutes after being killed | Scheduled task with a short repeat | | Returns only after a restart | Run key or Startup folder | | Returns after a clean scan | Service, or WMI subscription | | Browser settings revert | Browser policy key | | Survives Safe Mode | Driver or rootkit |

What Not to Do

Do not delete Microsoft's own scheduled tasks under Microsoft\Windows. Windows Update, defragmentation, and telemetry tasks live there and removing them breaks maintenance.
Do not use a registry cleaner for this. They target unrelated leftovers and will not find a deliberately hidden entry.
Do not stop at the first find. Malware plants several. Work through all seven steps even after removing something obvious.

FAQ

Why does malware come back after antivirus removes it?

Antivirus removes files it recognises. If a scheduled task or service survives and points at a downloader, the next time it runs it fetches a fresh copy — often a variant the scanner has not seen. Removing the persistence is what makes removal stick.

How do I know a scheduled task is malicious rather than software I installed?

Check the action path. Legitimate software runs from Program Files or a named vendor folder and is signed. Also check the task's creation date against when you installed anything. A task created at 3am on a day you installed nothing is not yours.

Is it safe to disable everything in Startup apps?

Yes, from a stability standpoint — startup entries are convenience, not requirements. You will lose auto-start for things like cloud sync and messaging apps until you re-enable them. Disabling everything is also a useful diagnostic; see disable startup programs to speed up boot.

What if I delete the wrong registry key?

Export before you delete, and you can restore by double-clicking the .reg file. If you skipped that, a restore point rolls the registry back — which is why Step 0 is creating one.

Do I need third-party tools like Autoruns?

Not for this. Every location above is reachable with built-in Windows tools. Sysinternals Autoruns from Microsoft consolidates them into one view and is genuinely useful, but download it only from Microsoft's own site — fake copies are a known infection route.

Should I just reinstall Windows instead?

If the machine is critical, the infection is unknown, or entries keep regenerating, a clean install is faster and more certain than a long hunt. Back up your data first and scan the backup before restoring: reinstall Windows without losing data.

Still Not Working?

Entries that reappear immediately after deletion, in Safe Mode, point to something running below Windows — a malicious driver or a bootkit. Continue with remove a rootkit or bootkit, then turn on Memory Integrity to block the driver route once you are clean.