You are 100% correct sir. I ran malwarebytes and it showed nineteen "backdoors" and trojan this and that, both files and registry entries. MB only quarantines, so I manually cleaned each file and registry entry, ran another scan, deleted all old restore points and it appears to be clean today. The files were all "win update" .vbs files, including logon. It got really granular into the registry- good learning experience at least. Anything else I should look for? Any scanner or tools I can use for a more precise check?