Rightek Rescue · Guides · Malware keeps coming back
Antivirus says it's clean, but it keeps coming back?
This is one of the most misunderstood problems in computing, and the confusion costs people days. Your antivirus is often telling the truth: the malicious file really is gone. What it does not remove is everything that file changed on the way through — and those changes keep working perfectly well after the thing that made them has been deleted.
What you're seeing
- Searches redirect somewhere you did not choose, or a new search engine keeps reappearing
- A homepage or new-tab page that resets itself however many times you change it
- Browser extensions you did not install, sometimes greyed out so you cannot remove them
- Security and antivirus websites that will not load while everything else does
- Antivirus reporting the machine clean, repeatedly, while all of the above continues
Why it happens
Antivirus is built to find and delete malicious files. It is not built to audit every configuration change a file made while it was running. So a scan can be entirely successful and the machine still misbehaves, because the damage is now ordinary settings that simply happen to be wrong. The usual hiding places:
- The hosts file. A plain text file that overrides DNS. Two lines in it can send every antivirus vendor's website to nowhere, which is why you cannot download a second opinion.
- Proxy settings. A proxy quietly enabled in Windows or in the browser routes your traffic through someone else's server.
- Browser policies. Enterprise policy entries that lock a homepage or search provider. This is the mechanism behind extensions you cannot remove and settings that revert instantly.
- Scheduled tasks and startup entries. A task that re-downloads the payload on a schedule. Delete the file all you like; the task fetches it back.
- DNS servers. Changed on the network adapter, or on the router itself — in which case every device in the house is affected and reinstalling Windows changes nothing.
Fix it yourself — the manual steps
1. Check the hosts file
Open Notepad as administrator, then open
C:\Windows\System32\drivers\etc\hosts. Every line should start with
#, which marks it as a comment. Anything else — particularly entries pointing
security vendors at 127.0.0.1 or 0.0.0.0 — should be deleted. Save
the file.
2. Turn off any proxy
Settings → Network & Internet → Proxy. Unless your workplace set one up deliberately, "Use a proxy server" should be off and "Automatically detect settings" on. Check each browser separately too, since Chrome and Edge can carry their own.
3. Remove browser policies
This is the step nearly everyone misses, and it is usually the one that fixes it. In Chrome go to
chrome://policy, in Edge edge://policy. On a home machine that page
should be empty. Entries such as HomepageLocation or DefaultSearchProviderURL
that you did not set are the reason your settings keep reverting — policies override user
choices by design, which is what makes them so effective when abused.
Clearing them means removing the corresponding keys under
HKEY_LOCAL_MACHINE\SOFTWARE\Policies in the registry, and this is the point where
working by hand gets genuinely risky — the wrong deletion in there causes new problems. If
you are not comfortable in the registry, this is the step to hand over.
4. Audit scheduled tasks and startup
Open Task Scheduler and look through the Task Scheduler Library for anything with a random-looking name or a task that runs a program from a temp folder. Then open Task Manager → Startup and disable anything you do not recognise. If something reappears after you delete it, a task is recreating it.
5. Check your DNS — and your router
In Network & Internet → Advanced network settings, check the DNS server assignment on your adapter. Unless you chose otherwise it should be automatic. Then check the router's own DNS settings, because a router-level change affects every device in the house and survives any amount of work on the PC.
6. Reset the browsers properly
Only after the policies are gone — resetting first just lets the policy reapply. Chrome: Settings → Reset settings. Edge: Settings → Reset settings. Firefox: Help → More troubleshooting information → Refresh Firefox.
7. Scan from outside Windows
Anything that hides while Windows is running cannot hide from a scanner that runs before Windows starts. An offline scan from bootable media catches the class of infection that survives every in-Windows scan.
⚡ The one-click way: let Rightek Rescue do it
Rescue audits the leftovers directly — hosts file, proxy, browser policies, scheduled tasks, DNS and startup entries — and shows you what was changed before it changes anything back. It also checks offline from the USB, where the malware isn’t running and can’t interfere. On any working PC: download Rescue, put it on a USB (one click makes it bootable), boot the affected PC from it, and choose Fix My PC. The diagnosis is free and it tells you what it found before it changes anything.
FAQ
My antivirus says the PC is clean. Why is it still doing this?
Because antivirus removes malicious files, not the configuration those files changed. Once a hosts entry, a proxy setting or a browser policy exists, it is an ordinary Windows setting that happens to be wrong — there is nothing malicious left for a scanner to detect.
Why do my browser settings revert the moment I change them?
Almost always a browser policy. Policies exist so that workplaces can enforce settings, and they override user choices by design. Check chrome://policy or edge://policy — on a home machine that page should be empty.
I cannot reach any antivirus website. Is that related?
Yes, and it is deliberate. Blocking security vendors stops you fetching a tool that would remove the infection. It is usually done through the hosts file or a proxy, both of which are the first two steps in this guide.
Will reinstalling Windows definitely fix it?
Usually, but not always, and it is a heavy answer to a light problem. If the DNS change is on your router rather than your PC, a reinstall changes nothing at all and you will conclude the infection survived a wipe. Check the router before going nuclear.
Is my personal information at risk?
Treat it as though it was. If something was running with enough access to change system settings, assume it could read what you typed. Change important passwords from a different, known-clean device, and enable two-factor authentication where it is offered.