You delete the file. You reboot. The malware comes back. You delete it again, reboot again, and it's still there — because you removed the payload, not the mechanism that launches it. That mechanism is called persistence, and it is the difference between malware that dies and malware that survives.
Any serious implant makes itself a permanent resident. The entire persistence layer is a set of operating-system features that run code at startup or on a schedule — and attackers abuse each one. A persistence hunter is a scanner that walks every one of these surfaces and shows you exactly what is surviving reboot on your machine.
The six surfaces malware lives on
These are the persistence mechanisms that matter in practice:
- WMI event consumers — permanent subscriptions that fire a payload on a system event or schedule. Almost invisible to casual inspection.
- Scheduled tasks — task entries that run a hidden binary at login or on an interval.
- Registry Run / RunOnce — the classic autorun keys, plus Startup folder shortcuts.
- Hijacked services — a legitimate service whose ImagePath was re-pointed to attacker code. Runs as SYSTEM.
- COM objects — class registrations overridden so an innocent app loads the payload instead.
- Process injection — code running inside a trusted process's memory, with no file on disk at all.
Most scanners check the file and stop. A persistence hunter checks the hook: what entry point would re-launch that file on boot.
Why deleting the payload isn't enough
Every one of those surfaces is a legitimate operating-system feature. The registry needs autorun keys. Windows needs scheduled tasks. WMI needs event consumers. That's exactly why persistence is so effective — the mechanism is trusted, so malware hides behind it.
Signature detection is built to recognize known malicious files. But a hijacked service is just a string in the registry pointing at a file. A WMI consumer is a set of WMI classes that any admin could create. There's no malicious file to fingerprint — the malice is in the path and the relationship. Behavior is invisible to a signature scan.
What a persistence hunt looks like
A real hunt enumerates each surface and resolves every entry to three answers: the exact registry key or object, the binary path it launches, and the PID currently running it. Consider the shape of a sweep:
# WMI event consumers (permanent) C:\> wmic /namespace:\\root\subscription path __EventConsumer # Scheduled tasks pointing outside System32 C:\> schtasks /query /fo csv | findstr /i "Users AppData Temp" # Run/RunOnce keys C:\> reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run # Service image paths (should live in System32) C:\> wmic service where "PathName not like '%System32%'" get Name,PathName
Each command is trivial on its own. The value is doing all of them at once, correlating the results, and mapping every hook to its process. That correlation — task X launches binary Y, which owns PID Z and injected into process W — is the actual product.
Process hollowing: persistence with no file
The sneakiest mechanism doesn't touch the disk at all. Process hollowing spawns a legitimate process (say svchost.exe), unmaps its image, writes attacker code into the freed memory, and resumes the thread. To the OS and to most tooling, a trusted binary is running. To the attacker, it's a clean execution context.
You cannot find a hollowed process by scanning files. You find it by scanning memory: checking whether a process's private memory regions contain executable code that didn't come from its own image. That's a scan most antivirus never runs.
How MalwareProof hunts it
MalwareProof is a native C++ persistence hunter. It walks all six surfaces — WMI consumers, scheduled tasks, Run/RunOnce keys, service image paths, COM registrations and process memory — and reports exact paths, registry keys and PIDs. It runs entirely locally, offline, in under a minute, with zero telemetry. Nothing leaves the machine.
The free audit shows everything. One-Click Auto-Purge (Standard, $9/30d) removes confirmed hooks and rolls back entry points. Live autorun shielding comes with Pro ($29/90d); forensic JSON/HTML export and CLI come with Business ($99/365d), handing analysts the full persistence→process→PID chain.
FAQ
What is malware persistence? The mechanisms malware uses to re-launch itself after a reboot: WMI consumers, scheduled tasks, Run/RunOnce keys, hijacked services, COM overrides and injected processes.
How do I find persistence hooks? Enumerate each surface and resolve every entry to its binary path and PID. MalwareProof automates the whole sweep locally and offline.
How do I remove persistence safely? Confirm the hook traces to an unexpected binary, then remove the entry point and roll back any re-pointed path. MalwareProof's One-Click Auto-Purge does this automatically.
From here, read the practical Windows defense guide or how EDR catches behavior like this.