You scan, you find something with a name like xrtsvc32.exe, you delete it, and the scanner goes green. Four days later the pop-ups are back and your fans are spinning like a hairdryer. Nothing failed. The removal was just incomplete — spyware almost never lives in one tidy folder, and the leftovers are exactly what puts it back.

Mistake 1: Deleting the obvious file and calling it done

Spyware rarely arrives as a polite program with an entry in Add or Remove Programs. It arrives as a service, a scheduled task, a browser extension, or a DLL that a legitimate Windows process loads on its behalf. When you kill the process and empty the folder in AppData, you have removed the visible part. The component that recreates it is still sitting there, waiting for the next reboot or the next network connection.

Before you delete anything, slow down and document what you are looking at: the full file path, the exact service name, the publisher listed on the file, and where it launched from. A screenshot takes fifteen seconds and saves an hour of re-cleaning. Also check paths carefully — malware loves names like "Windows Update Service," but real Windows components live in System32 and carry a valid digital signature. Deleting genuine system files is how people break their PC and then blame the spyware for it.

Mistake 2: Cleaning only your own user profile

Windows does not have one user folder. It has one per account, plus folders for accounts that never appear on the login screen. Spyware dropped into another profile can keep running its tasks and keep pulling the payload back into yours, no matter how many times you clean your own desktop.

Open Settings and check every account listed under Accounts. On Windows Pro, use Computer Management to view local users and groups, and look for stale accounts nobody remembers creating. Then browse C:\Users and compare folders to real accounts — the Default folders are normal, but a folder named after someone who no longer uses the machine is worth investigating. If you find an account you cannot explain, disable it, watch whether anything breaks, then remove it properly rather than deleting the folder by hand.

Mistake 3: Leaving services, tasks, and startup entries alive

This is the part most quick cleanups skip. Malware needs something to survive a reboot, and Windows offers several ways to arrange that. Check these places deliberately, not casually:

• Task Scheduler. Look for tasks set to run at logon or boot with random names, long strings of characters, or no description.
• Services. Open services.msc and sort by startup type. Any service pointing to a file inside AppData, Temp, or ProgramData deserves scrutiny.
• Startup entries and Run keys. Check the Startup folder and the Run keys under both HKCU and HKLM in the registry.
• Browser extensions, homepage, and search engine. Reset anything you did not set yourself.
• Hosts file and DNS settings. Redirected DNS is a classic way to keep you on poisoned pages.

If editing the registry makes you nervous, that instinct is healthy. Create a restore point and a backup first, use a reputable removal tool for the registry side, or hand the job to a technician. A wrong deletion here can leave Windows unable to boot.

Mistake 4: Cleaning while the spyware is still running

Deleting files under a live infection is like mopping a floor while the tap is on. The malware can block your tools, protect its own files, or simply reinstall itself mid-cleanup. Reboot into Safe Mode first (hold Shift while choosing Restart, or use msconfig), and then run a boot-time scan as well as your regular one. On Windows, the built-in offline scan restarts the machine and checks it before the operating system loads, which catches things a normal scan cannot touch.

Update your tools before you disconnect from the network, then pull the cable or drop the Wi-Fi. No re-downloading while you work.

Mistake 5: Signing back into the same browser profile and sync

If a rogue extension slipped into Chrome, Edge, or Firefox while you were signed in, it may already be sitting in your synced profile. Remove it locally and sync can push it straight back — or worse, deliver it to a brand-new install the moment you log in.

Change your account passwords first, from a different, clean device: email, banking, work accounts, everything important. Turn on two-factor authentication where it is available and review the list of devices and active sessions in your account settings, signing out anything you do not recognise. Anything you typed on an infected machine should be treated as exposed. Assume it. Change it.

Mistake 6: Restoring a backup that already contained the infection

System Restore feels like a reset button, but a restore point from three weeks ago includes whatever was on the machine three weeks ago — including the spyware. The same applies to backup images and folder-level backups. Restore documents, photos, and media. Skip program folders, AppData, browser profiles, and anything executable unless you know its source.

If you cannot date the infection, you cannot trust the backup.

Mistake 7: Ignoring the router, the phone, and the USB stick

Spyware often arrives through something you have not fixed yet: a router still using its factory admin password, a phone with a bad app, a shared drive on the network, a cracked installer, or a fake "your player needs an update" pop-up. On the router, change the admin credentials, update the firmware, check the DNS settings, and disable remote administration. If more than one device on your network shows symptoms, treat the whole network, not just the laptop that complained loudest. And tell IT before you start if the machine is a work laptop — some monitoring software looks like spyware, and some cleanups break tools your employer needs.

A removal routine that actually holds

1. Disconnect from the network and write down everything you find before deleting it.
2. Update your tools, then scan in Safe Mode and run a boot-time or offline scan.
3. Remove persistence first — services, scheduled tasks, startup entries, extensions — then delete the files. Check every user profile.
4. Change passwords from a clean device, enable two-factor, and end unknown sessions.
5. Reset browser sync and remove extensions you did not install.
6. Reboot twice, scan again, and watch startup items and network activity for a few days.
7. Close the entry point: router, other devices, and whatever let the spyware in.

Re-infection is rarely bad luck. It is a leftover you have not found yet — a service still set to start, a profile nobody opened, a backup from the wrong week. Work through the list, and the second cleanup is usually the last one.

Photo: Athena Sandrini / Pexels