Clean a Trojan That Returns Through Scheduled Tasks

A Trojan that comes back after removal often has a persistence mechanism hidden in Windows Task Scheduler. The malicious task may launch a file from AppData, download a replacement payload, or run a PowerShell command each time you sign in, start the computer, or connect to the internet.

This behaviour can look like a failed antivirus cleanup. Pop-ups, browser redirects, high CPU usage, disabled security tools, and unfamiliar network activity may disappear briefly before returning. A repeat infection usually means the trigger and the main malware file have not both been removed.

The steps below are designed for a Windows 10 or Windows 11 computer in Australia. If the device belongs to a business, school, or healthcare organisation, preserve evidence and contact the administrator before deleting tasks or resetting the system.

Sign	What it may indicate	Useful response
Threat returns after reboot	Scheduled task or startup entry	Review Task Scheduler and startup locations
New file appears in AppData	Downloader or copied payload	Quarantine the file and scan its parent folder
PowerShell opens briefly	Script-based launcher	Inspect task actions and command arguments
Browser settings change	Trojan, adware, or hijacker component	Reset the browser after malware removal
Security tools stop working	Tampering or elevated privileges	Use Safe Mode or Microsoft Defender Offline

Recognise the reinfection pattern

Record what happens and when it happens. A task set to run at logon may restore the Trojan immediately after you enter your password, while a task triggered every few minutes can make manual removal appear ineffective. Note suspicious filenames, pop-up wording, affected browsers, and any recent software installation.

Disconnect the computer from Wi-Fi or unplug its Ethernet cable before examining the infection. On an NBN connection, this prevents the compromised PC from contacting a command-and-control server while you work. Leave other household devices connected unless the router itself shows signs of tampering.

Isolate and prepare the Windows PC

Save essential documents to a clean external drive or trusted cloud account, but avoid copying executable files, scripts, cracked software, or unknown archives. Do not back up the entire user profile without checking it, because a malicious file can travel with the backup.

Sign in with an account that has administrator rights, then update Microsoft Defender if the computer can be safely connected for a short period. You can also download a reputable scanner from its official website using a separate clean device. Residents in Sydney, Melbourne, Brisbane, or regional areas should be wary of fake “technician” phone calls claiming to fix an NBN or Microsoft problem.

Inspect scheduled tasks safely

Open Task Scheduler by searching for it from the Start menu. Select Task Scheduler Library, then review tasks whose actions launch files from AppData, Temp, Downloads, removable drives, or oddly named folders. Suspicious actions may contain powershell.exe, wscript.exe, mshta.exe, cmd.exe, or a long encoded command.

Check the Triggers and Actions tabs, along with the task author and creation date. A recently created task with a random name, missing description, or action pointing to an unfamiliar executable deserves attention. Do not delete tasks simply because they are unfamiliar; Windows, graphics drivers, and Australian banking or accounting software can create legitimate entries.

For a broader listing, open Command Prompt as administrator and run:

schtasks /query /fo LIST /v > "%USERPROFILE%\Desktop\tasks.txt"

Review the saved file and record suspicious task names before disabling anything. In Task Scheduler, choose Disable first and restart the computer. If the Trojan does not return, export or photograph the task details, then delete the confirmed malicious entry. The command schtasks /delete /tn "TaskName" /f can remove a known task, but the exact path must be copied carefully.

Remove the payload and its persistence

After disabling the task, locate the file shown in its action. Use Properties to check its path, publisher, and creation date. If Windows refuses deletion, do not keep repeatedly opening it. Submit the file to your security software for quarantine, or start Windows in Safe Mode and remove the confirmed malicious file there.

Safe Mode loads fewer services and can prevent the Trojan from launching. In Windows, open Settings > System > Recovery > Advanced startup, select Restart now, then choose Troubleshoot > Advanced options > Startup Settings > Restart and press the key for Safe Mode. The exact menu wording can vary between Windows versions.

Check secondary launch points

A scheduled task may be only one layer. Inspect Settings > Apps > Startup, the Startup folders, and common registry locations such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Microsoft Sysinternals Autoruns can provide a detailed view, but disable entries rather than deleting them until their purpose is clear.

Look for services, browser extensions, WMI subscriptions, and shortcuts with unexpected command-line arguments. A Trojan may use a legitimate-looking name while pointing to a hidden file in a user folder. If the malware recorded microphone or video-call activity, review this spyware removal guide for related checks.

Scan, patch, and restore

Run a full Microsoft Defender scan, followed by Microsoft Defender Offline scan from Windows Security > Virus & threat protection > Scan options. An offline scan restarts the computer into a trusted environment, which can detect malware that hides while Windows is running. A second opinion from a well-known on-demand scanner can help identify a downloader or infostealer that Defender missed.

Install Windows updates, browser updates, and security patches for applications such as Java, Adobe software, and document tools. Remove pirated programs and unofficial activators, which are frequent Trojan delivery methods in the Australian software market. If the infection altered system files, use an administrator Command Prompt and run sfc /scannow, followed by DISM /Online /Cleanup-Image /RestoreHealth if required.

Verify the machine stays clean

Reconnect the network only after the scans finish and the suspicious task remains disabled or removed. Restart the computer several times, wait through the usual trigger period, and confirm that no unknown process, pop-up, browser change, or scheduled task returns. Check Windows Security protection history and review recent login activity for unfamiliar access.

Change passwords from a separate clean device, beginning with email, banking, cloud storage, and social media accounts. Turn on multifactor authentication and contact your bank promptly if credentials or payment information may have been exposed. Australian users can also report relevant scams or identity concerns through Scamwatch and their financial institution.

Keep reliable backups that are disconnected when not in use, enable automatic updates, and avoid granting administrator rights to everyday accounts. Guidance from Pc Malware Expert can help with related ransomware, spyware, browser hijacker, and file-recovery checks when the scheduled-task infection forms part of a wider compromise.