Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Finding and removing a threat actor’s persistent access is an investigation, not a single malware scan or password change. You must preserve evidence, determine how the actor can still return, contain the danger without destroying useful data, remove every discovered access path, close the weakness that enabled the intrusion, and monitor for re-entry.
Search four connected areas: endpoints and servers, identities and privileges, network paths, and cloud or SaaS configurations. A clean result in one area does not prove the environment is clean. Persistence can survive reboots, credential changes and other interruptions, and an actor may delete the artifacts that would have exposed it.
What persistent access means
Persistence is any mechanism that lets an intruder retain or regain access after a restart, a password change, a temporary outage or another interruption. MITRE ATT&CK defines it as techniques used to keep access across “restarts, changed credentials, and other interruptions that could cut off their access.” That definition is broader than a file-based backdoor.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Examples include a newly created account, an altered administrator role, a stolen session token, an additional SSH key, an email-forwarding rule, a scheduled task, a service, a startup entry, a web shell, a cloud application integration, a registered device or continued use of a valid account. An attacker may also preserve access indirectly by changing a firewall rule, DNS setting, route or remote-access configuration.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Persistence is difficult to remove because several mechanisms can coexist. An actor who entered through a vulnerable internet-facing device may later create accounts, add keys, register a device and deploy a service. Removing the first malware sample leaves those alternate routes intact. Conversely, an apparent persistence artifact can be a legitimate management tool or automation job. Every finding needs context and corroboration.
Set the response sequence before making changes
When the risk is immediate, safety and containment take priority. When the situation is stable enough to investigate, preserve volatile and historical evidence before making changes. CISA’s joint guidance, Technical Approaches to Uncovering and Remediating Malicious Activity (revised September 1, 2020), warns that premature mitigation can alter volatile data, alert an actor or cause the actor to change tactics.
Use a trusted communication channel
Assume that ordinary email, chat and shared documents may be monitored if accounts or endpoints are compromised. Coordinate through an out-of-band channel that the suspected environment does not control. Limit the incident team to people who need the information, record decisions and preserve the time and source of every collected artifact.
Preserve before you quarantine when circumstances allow
Collect relevant logs, process and service inventories, authentication records, network evidence, cloud audit trails and copies of suspicious files before disruptive actions. Capture volatile information, such as running processes, active connections and logged-in sessions, while the system is still running if your response plan and safety controls permit it. Store copies in a protected location with access logging and integrity controls.
Do not delay urgent containment merely to obtain a perfect image. If an active actor is stealing data, moving laterally or threatening safety, isolate the affected system or account under the incident plan, then document what was changed and what evidence may have been lost.
Scope the compromise across four evidence layers
A useful investigation correlates host, identity, network and cloud evidence. The following table shows what to review and the question each layer answers.
| Layer | Review | Question to answer |
|---|---|---|
| Endpoints and servers | Processes, parent-child process trees, services, startup items, scheduled tasks, installed applications, execution artifacts, local and domain accounts, event logs, antivirus results, listening ports, DNS settings, static routes and recent connections | What can execute or accept a connection on this machine, and when did it appear? |
| Identity and access | Authentication events, new accounts, privilege changes, group membership, unusual login sources, device registrations, SSH keys, delegated mail access, tokens, roles and service principals | Which identities or credentials could still be used, and what can they reach? |
| Network | DNS queries and resolvers, proxy records, remote desktop, VPN and SSH sessions, remote-control tools, ports, routes, traffic timing and volume, ingress and egress connections | Where is the environment communicating, and is a route still open? |
| Cloud and hosted services | Audit logs, cloud credentials and roles, application integrations, OAuth-style grants, storage access, API keys, mail rules and administrative changes | Can the actor return through a service even after local machines are cleaned? |
Endpoints and servers
Start with systems that were directly exposed, showed suspicious activity, held sensitive data or had administrative access to other systems. Review running processes and their parent-child relationships rather than looking only for a known filename. Hash background executables, compare their locations and names with the organization’s normal software, and investigate binaries that run from user-writable or unusual directories.
Inventory services, installed applications, startup entries, autoruns, scheduled tasks and other execution artifacts. On Windows, include Scheduled Tasks, Group Policy Objects, Windows Management Instrumentation storage, the Registry and Autoruns. On Linux and Unix systems, examine cron entries, systemd units, password and log files, kernel modules, journald records and additional SSH authorized keys. Check local and domain accounts, recently added users, unusual usernames and unexpected changes to administrative groups.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Inspect listening ports, recent connections, DNS configuration and static routes. Compare the findings with the machine’s documented role. A database server initiating interactive remote sessions, a workstation listening on an unapproved port or a server using an unfamiliar resolver deserves investigation even when antivirus reports no malware.
Identity and access systems
Review successful and failed logins, source addresses, device names, authentication methods, time of day and impossible or unusual travel patterns. Look for accounts created shortly before the suspected incident, privilege escalation, membership changes, new service accounts, delegated mailbox access, added SSH keys and newly registered devices.
Search for valid-account abuse rather than assuming every malicious session has a distinctive indicator. An actor may use a legitimate administrator account, a stolen token or a credential that was created after the initial compromise. Compare identity changes with endpoint and network timelines so that a suspicious login is tested against the device that supposedly made it.
Free tools Windows power users keep installed
One-click scans. No signup required.
Network paths
Use DNS, proxy, firewall, VPN, remote-desktop, SSH and flow records to reconstruct ingress and egress. Investigate unexpected resolvers, unauthorized zone transfers, newly exposed ports, routing changes, unapproved remote-access tools and connections to known indicators. Look at timing and volume: periodic low-volume callbacks can be as important as a large transfer.
Retain relevant proxy and network data long enough to compare the suspicious period with normal activity. CISA recommends investigating both ingress and egress visibility; a lack of outbound records can indicate a logging gap rather than an absence of communication.
Cloud and service configurations
Local cleanup does not remove access granted in a hosted service. Review cloud audit logs for added credentials, roles, service principals, application integrations, delegated email access, storage permissions, API keys and registered devices. Check administrative and security settings for forwarding rules, new OAuth-style grants, disabled alerts and changes to logging.
Use the service’s own audit trail and identity records to identify who made each change, from which source and with which authentication method. Revoke or rotate exposed keys and grants only after preserving the records needed to establish scope, unless immediate abuse requires faster action.
Hunt with indicators and behavior, not indicators alone
CISA recommends combining indicator-of-compromise searches with frequency, pattern and analyst-led anomaly analysis. Search known hashes, domains, addresses, filenames and account names, but also ask whether activity fits the organization’s normal pattern.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
- Timing: Does the process, login or connection occur outside the account or system’s normal operating window?
- Source and destination: Is the endpoint contacting a location or service it has never used, or is an administrator connecting from an unexpected device?
- Ports and protocols: Is a service using a port or protocol that its documented role does not require?
- File location, name and size: Is an executable or script in a temporary, profile or otherwise unusual directory, or does its name imitate a legitimate component?
- Frequency: Does a task run at an unusual interval, or do repeated authentication attempts form a new pattern?
- Relationships: Does the parent process, account, device or network route make sense for the action?
Confirm suspicious findings against at least one additional source. A scheduled task may be an approved backup job; a new administrator may be part of a documented change. The combination of an unexplained task, an unusual binary, a matching outbound connection and a new account is materially stronger than any one item.
Use MITRE ATT&CK as a coverage checklist
MITRE ATT&CK Enterprise Persistence is useful for checking whether the investigation covers common technique families. Relevant examples include account manipulation, created accounts, added cloud credentials or roles, email delegation, SSH authorized keys, device registration, startup execution, services, cloud application integrations, server components such as web shells and valid-account abuse.
ATT&CK lists techniques and relationships; a technique match is a lead, not proof of compromise. Map each suspected technique to evidence, affected assets, the identity or process involved and the action needed to remove it. The Enterprise Persistence page was last modified April 25, 2025. Technique details and platform behavior can change, so confirm implementation details against current guidance for the technologies in scope.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteContain without creating a blind spot
Containment should reduce the actor’s ability to operate while preserving enough visibility to understand the scope. The correct balance depends on immediate risk, the value of volatile evidence and the availability of clean replacement systems.
| Situation | Possible action | Main trade-off |
|---|---|---|
| Active theft, destructive behavior or safety risk | Isolate the host or account immediately using the incident plan | Fast risk reduction, but volatile evidence and live-session context may be lost |
| Suspicious but not actively harmful | Collect volatile data and logs, then quarantine with documented timing | Better investigation quality, with a short period of continued exposure |
| Compromised internet-facing device | Restrict external access and preserve the device for forensic handling or replacement | Reduces ingress while recovery may require service disruption |
| Suspected identity compromise | Disable or restrict the account after collecting authentication and privilege evidence | Stops use of the account, but may alert the actor and leave alternate credentials active |
Do not preemptively block every suspected adversary address if doing so would reveal the investigation or cause the actor to switch infrastructure. Coordinate blocking, isolation and notification decisions, and record exact times, systems and rules changed.
Eradicate every access mechanism
Eradication is complete only when the access paths are removed and the weakness that enabled them is addressed. Work from the scoped evidence rather than from the most visible symptom.
- List each confirmed or plausible access path. Record the affected host, account, key, token, service, task, cloud grant, network rule, initial vulnerability and supporting evidence. Mark assumptions separately from confirmed findings.
- Remove unauthorized execution and access objects. Delete or disable malicious services, scheduled tasks, startup entries, web shells, scripts, accounts, keys, tokens, forwarding rules, device registrations, application grants and cloud roles. Preserve copies and metadata before deletion when safe.
- Quarantine compromised hosts. Restrict network access according to the response plan. Investigate connected shares and removable media, because they can spread malicious files or expose additional systems.
- Reimage or remove confirmed compromised hosts. For systems with untrusted administrative control, rebuilding from a known-good source is generally more reliable than deleting selected files. Validate the image and restore only required data and configurations.
- Remediate credentials and privileges. Reset or rotate affected credentials and tokens, remove unauthorized privilege, review group membership and restrict access to the minimum required. Include accounts and devices that may have been exposed, not only the account observed in a malicious login.
- Patch and correct the initial weakness. Fix the vulnerability or configuration error that enabled entry, starting with the known point of compromise. Examine externally facing devices for prior compromise rather than assuming that patching one system closes the route.
- Recheck dependent systems. Search other hosts, accounts, shares, cloud services and network devices for the same indicators and behaviors. A single compromised administrator or server can leave related persistence elsewhere.
Why a password reset is not enough
CISA warns that an actor may possess multiple credentials, create new ones or forge tickets. A reset can also leave active sessions, tokens, SSH keys, application grants and device registrations usable. Treat credential remediation as a planned scope decision: identify affected accounts and devices, preserve authentication evidence, revoke sessions or tokens where supported, rotate secrets used by services, and review every place the credentials were reused.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Directory compromise requires special care
If an attacker gained control of directory services or may have stolen the directory database, a narrow reset can leave the environment exposed. Credential remediation may need to be broad and sequenced carefully to avoid breaking service dependencies or allowing the actor to regain control during the reset. Follow incident-specific expert and vendor guidance for the exact directory recovery order.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Close the original route into the environment
Removing persistence while leaving the entry weakness open invites a repeat compromise. Depending on the findings, corrective work may include patching an internet-facing application, removing an exposed remote service, tightening VPN or remote-desktop policy, correcting a misconfigured firewall, replacing weak authentication, limiting administrative interfaces, fixing excessive cloud permissions or repairing logging and monitoring gaps.
Review externally facing devices, management interfaces, remote-access tools and service accounts. Confirm that the corrected control is active on every relevant device, not just the system where the intrusion was first noticed. Document exceptions and assign owners and deadlines for changes that cannot be made immediately.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Verify that the actor is gone
Verification is an active search, not a clean scan result. Continue centralized logging and endpoint monitoring while the environment returns to normal. Re-run searches for the indicators and behaviors discovered during scoping, and compare new activity with the baseline established before remediation.
- Review identity and privilege changes for unauthorized accounts, roles, keys, grants and device registrations.
- Check that removed services, tasks, startup items, web shells and cloud integrations have not reappeared.
- Search DNS, proxy, VPN, SSH, remote-desktop and firewall records for recurring or new connections.
- Confirm that rebuilt hosts use known-good images and that restored data was checked before reintroduction.
- Test alerting for the behaviors that mattered in this incident, including unusual administrator logins, new persistence objects and unexpected egress.
- Keep secure, tested backups and maintain network segmentation so a later discovery does not become a lateral-spread event.
Set a documented monitoring period appropriate to the systems and evidence. Do not declare success merely because the original indicator disappears; an actor can remove artifacts to hide evidence, and the absence of a persistence object does not prove that none existed. MITRE ATT&CK’s Clear Persistence technique, last modified May 12, 2026, describes this concealment behavior.
Common mistakes and how to correct them
Relying on antivirus or one endpoint scan
Malware detection can miss valid-account abuse, cloud grants, SSH keys, scheduled tasks and configuration changes. Correct this by correlating endpoint, identity, network and cloud evidence.
Changing every password immediately without a plan
An uncoordinated reset can destroy useful evidence, interrupt recovery and leave alternate credentials active. Preserve authentication records, identify affected accounts and devices, then execute a staged reset and revocation plan.
Blocking one address and closing the case
Infrastructure can change, and the actor may have local or cloud persistence that does not depend on the blocked address. Search for related behaviors and access objects before declaring eradication.
Deleting suspicious files before collecting evidence
Deletion can remove timestamps, parent-process relationships and clues about lateral movement. Capture the relevant artifacts first when safety permits, and record any emergency action that occurred before collection.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Cleaning only the first compromised machine
Administrative credentials, shared folders, removable media and cloud services can extend the compromise. Expand the search to systems and identities that the host could reach.
Assuming missing artifacts prove no persistence
An actor may clean up after use or operate through legitimate accounts and services. Treat absence as a limitation of the evidence, not as proof that the access path never existed.
When to bring in incident-response specialists
Escalate when the actor had administrative or directory control, multiple systems are involved, evidence may be needed for legal or regulatory purposes, cloud and on-premises records conflict, destructive activity is occurring, or the internal team cannot validate eradication. Specialist support can provide subject-matter expertise, technical collection and an independent check that residual access will not cause a follow-on compromise.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsCISA and partner agencies specifically recommend considering a third-party incident-response organization to provide expertise and technical support, ensure that the actor is eradicated and avoid residual issues after the incident is closed. Select support that can work across the affected endpoint, identity, network and cloud technologies, and establish evidence handling, communications and decision authority before handing over access.
Governance and recovery after eradication
Record the initial access route, persistence mechanisms, affected assets, evidence collected, containment actions, credential scope, vulnerabilities corrected and validation searches performed. NIST SP 800-61 Rev. 2 describes incident response as necessary for rapidly detecting incidents, minimizing loss and destruction, mitigating exploited weaknesses and restoring services. That objective continues after the visible threat is removed.
Use the findings to improve centralized and remote log collection, endpoint monitoring, alerting, access controls, segmentation, backup testing and recovery exercises. Update normal baselines and detection rules with the behaviors observed, while avoiding rules so narrow that a changed filename or address would evade them.
Finally, verify that restored services, credentials and administrative paths are operating as intended. Keep the incident record, evidence and lessons learned under the organization’s retention and legal requirements, and review current government and technology-vendor guidance because platforms and attacker techniques change.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
