# Remove Malware Startup Entries and Scheduled Tasks

URL: https://www.mytechnician.tech/tips/remove-malicious-scheduled-tasks-startup-persistence-windows-11/
Published: 2026-08-07 | Author: Ankit Kumar
Tags: Windows 11, Security, Fix, Troubleshooting, System
Summary: Malware you deleted keeps coming back? It left a scheduled task, service, or Run key behind. Here is how to find and clear every persistence point in Windows 11.
Recommended app: PC-Troubleshooter — https://www.mytechnician.tech/apps/windows-troubleshooter/ (Microsoft Store: https://apps.microsoft.com/detail/9N7RWKW8SP24?hl=en-us&cid=mytechnician-web). Optional; every step below uses built-in Windows tools.

## The Problem
You found the bad file. You deleted it, ran a scan, restarted — and two days later it is back.

That is **persistence**. Modern malware never relies on a single file. It plants several independent ways to bring itself back: a scheduled task that runs every ten minutes, a Windows service, a registry Run key, a shortcut in the Startup folder, and often a browser policy on top. Removing one leaves the others to restore it, which is why partial cleanups fail and people end up reinstalling Windows unnecessarily.

This guide is the systematic sweep: six places to check, what a legitimate entry looks like in each, and how to remove the rest safely.

> **Have not run a scan yet?** Do that first — [remove virus and malware](https://www.mytechnician.tech/tips/remove-virus-malware-windows-11/), including the offline scan. This guide is what you do when the scan comes back clean but the problem returns.

## Before You Start
[Create a restore point](https://www.mytechnician.tech/tips/create-system-restore-point-windows-11/). You are going to delete services and registry entries, and a wrong one can stop Windows booting cleanly.

Work in [Safe Mode with Networking](https://www.mytechnician.tech/tips/how-to-enter-safe-mode-windows-11/) if the malware is actively running — most persistence mechanisms do not start there, which makes them easier to remove.

## The Fix: Step-by-Step

### Step 1: Startup Apps
1. `Ctrl + Shift + Esc` → **Startup apps**.
2. Sort by **Publisher**. Anything with a blank publisher deserves scrutiny.
3. Right-click → **Open file location** on anything unfamiliar.

**Legitimate** entries point into `C:\Program Files`, `C:\Program Files (x86)`, or a vendor folder in `%LocalAppData%\Programs`, and are signed.
**Suspicious** entries point into `%Temp%`, `%AppData%\Roaming` with a random name, or `C:\ProgramData\<random>`.

Disable rather than delete at this stage — you can re-enable if you disable something you needed. Note the file path first.

### Step 2: The Startup Folders
Two folders Windows runs at sign-in that Task Manager does not always show clearly:

`Win + R` → `shell:startup` (your account)
`Win + R` → `shell:common startup` (all users)

Both should be empty or contain a handful of shortcuts you recognise. Delete anything else, and check the shortcut **Target** before you do — a shortcut pointing at `powershell.exe` with a long encoded argument is malware, not a program.

### Step 3: Registry Run Keys
`Win + R` → `regedit`. Check all four:

```
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
```

Read the **Data** column, which holds the full command. Delete values whose command:

* Runs `powershell.exe` or `cmd.exe` with `-enc`, `-EncodedCommand`, `-w hidden`, or `-nop`.
* Points into `%Temp%`, `%AppData%`, or `ProgramData` with a random filename.
* Uses `mshta.exe`, `rundll32.exe`, or `regsvr32.exe` against a URL.

Export the key first (**File** → **Export**) so you can restore it if you cut too deep.

### Step 4: Scheduled Tasks — Where Most Persistence Hides
`Win + R` → `taskschd.msc` → expand **Task Scheduler Library**.

Work through the root and the subfolders. For each unfamiliar task, check three tabs:

* **Triggers** — repeating every 1–15 minutes, or "at log on of any user", is a strong signal.
* **Actions** — the program and arguments. Same red flags as Step 3.
* **General** — "Run with highest privileges" combined with a hidden window.

Genuine Microsoft tasks live under `Microsoft\Windows\...` and are numerous — do not clear that tree wholesale. Malicious tasks usually sit at the library root or in a folder named after nothing in particular, and often mimic real names with a small difference (`GoogleUpdateTaskMachineUAC` versus `GoogleUpdateTasksMachineUA`).

Right-click → **Disable** first, restart, confirm the problem stops, then **Delete**.

To list tasks that run from user-writable paths in one pass, use **Terminal (Admin)**:

```
schtasks /query /fo LIST /v | findstr /i "TaskName Task_To_Run" | findstr /i "AppData Temp ProgramData"
```

### Step 5: Services
`Win + R` → `services.msc`.

Sort by **Description**. A service with no description at all is unusual for legitimate software. Double-click anything suspicious and read **Path to executable** — the same path rules apply.

To remove a confirmed bad service, from **Terminal (Admin)**:

```
sc stop "ServiceName"
sc delete "ServiceName"
```

Use the service's real name from the **General** tab, not its display name.

### Step 6: WMI Subscriptions
A quieter technique: a permanent WMI event subscription that relaunches malware on a system event. Check from **Terminal (Admin)**:

```
Get-WMIObject -Namespace root\Subscription -Class __EventFilter
Get-WMIObject -Namespace root\Subscription -Class CommandLineEventConsumer
```

A clean home PC returns nothing, or only entries from a known management tool. Anything referencing PowerShell or a script path is malicious. Remove with:

```
Get-WMIObject -Namespace root\Subscription -Class CommandLineEventConsumer | Where-Object { $_.Name -eq "BadName" } | Remove-WMIObject
```

### Step 7: Browser Policies
Malware increasingly persists in the browser rather than Windows. Check for forced extensions and locked settings:

```
reg query "HKLM\SOFTWARE\Policies\Google\Chrome" /s
reg query "HKLM\SOFTWARE\Policies\Microsoft\Edge" /s
```

On a personal PC, entries here that you did not create should be deleted. Details in [remove malicious browser extensions](https://www.mytechnician.tech/tips/remove-malicious-browser-extensions-windows-11/).

### Step 8: Confirm It Is Gone
1. Restart normally.
2. Leave the PC idle for 30 minutes.
3. Re-check Startup apps, Task Scheduler, and Services for anything that has reappeared.
4. Run a **Microsoft Defender Offline scan** as a final pass.

If an entry regenerates, something you have not found yet is recreating it — go to [remove a rootkit or bootkit](https://www.mytechnician.tech/tips/remove-rootkit-bootkit-windows-11/).

## Where to Look First, by Symptom

| Symptom | Most likely persistence |
|---|---|
| Process returns minutes after being killed | Scheduled task with a short repeat |
| Returns only after a restart | Run key or Startup folder |
| Returns after a clean scan | Service, or WMI subscription |
| Browser settings revert | Browser policy key |
| Survives Safe Mode | Driver or rootkit |

## What Not to Do
* **Do not delete Microsoft's own scheduled tasks** under `Microsoft\Windows`. Windows Update, defragmentation, and telemetry tasks live there and removing them breaks maintenance.
* **Do not use a registry cleaner** for this. They target unrelated leftovers and will not find a deliberately hidden entry.
* **Do not stop at the first find.** Malware plants several. Work through all seven steps even after removing something obvious.

## FAQ

### Why does malware come back after antivirus removes it?
Antivirus removes files it recognises. If a scheduled task or service survives and points at a downloader, the next time it runs it fetches a fresh copy — often a variant the scanner has not seen. Removing the persistence is what makes removal stick.

### How do I know a scheduled task is malicious rather than software I installed?
Check the action path. Legitimate software runs from `Program Files` or a named vendor folder and is signed. Also check the task's creation date against when you installed anything. A task created at 3am on a day you installed nothing is not yours.

### Is it safe to disable everything in Startup apps?
Yes, from a stability standpoint — startup entries are convenience, not requirements. You will lose auto-start for things like cloud sync and messaging apps until you re-enable them. Disabling everything is also a useful diagnostic; see [disable startup programs to speed up boot](https://www.mytechnician.tech/tips/disable-startup-programs-speed-up-boot/).

### What if I delete the wrong registry key?
Export before you delete, and you can restore by double-clicking the `.reg` file. If you skipped that, a restore point rolls the registry back — which is why Step 0 is creating one.

### Do I need third-party tools like Autoruns?
Not for this. Every location above is reachable with built-in Windows tools. Sysinternals Autoruns from Microsoft consolidates them into one view and is genuinely useful, but download it only from Microsoft's own site — fake copies are a known infection route.

### Should I just reinstall Windows instead?
If the machine is critical, the infection is unknown, or entries keep regenerating, a clean install is faster and more certain than a long hunt. Back up your data first and scan the backup before restoring: [reinstall Windows without losing data](https://www.mytechnician.tech/tips/reinstall-windows-without-losing-data/).

## Still Not Working?
Entries that reappear immediately after deletion, in Safe Mode, point to something running below Windows — a malicious driver or a bootkit. Continue with [remove a rootkit or bootkit](https://www.mytechnician.tech/tips/remove-rootkit-bootkit-windows-11/), then turn on [Memory Integrity](https://www.mytechnician.tech/tips/enable-core-isolation-memory-integrity-windows-11/) to block the driver route once you are clean.

Related: [remove cryptominer malware](https://www.mytechnician.tech/tips/remove-cryptominer-malware-windows-11/), [how to read Event Viewer](https://www.mytechnician.tech/tips/how-to-read-event-viewer-find-crash-cause/), [how to use Task Scheduler](https://www.mytechnician.tech/tips/how-to-use-task-scheduler-windows-11/).

---
Source: https://www.mytechnician.tech/tips/remove-malicious-scheduled-tasks-startup-persistence-windows-11/ — My Technician, free Windows 10/11 troubleshooting guides.
Related tool: PC-Troubleshooter (PC-Troubleshooter is a system diagnostic and repair tool for Windows 10 and Windows 11—hardware, drivers, network, and common fixes in one app.) — https://www.mytechnician.tech/apps/windows-troubleshooter/
More guides: https://www.mytechnician.tech/llms.txt