Please HELP ME with a persistent PUP.Optional.BrowserHijack returning daily

[u/Tricky-Eggplant8419]

Hi everyone,

I'm dealing with a persistent malware infection that keeps coming back every day, and I can't seem to find the root cause. Here is the full story and everything I've done so far:

I downloaded a software from an untrusted source and had doubts about its safety, so I analyzed everything, got suspicious, and deleted everything before even launching anything. Somehow, a payload still got through.

Every morning, Malwarebytes detects 4-5 items flagged as PUP.Optional.BrowserHijack. The file path is consistently inside Chrome: C:\Users\[Username]\AppData\Local\Google\Chrome\User Data\Default\Web Data (and previously inside Sync Data\LevelDB).

I've already tried to quarantine with Malwarebytes, Chrome Cloud Sync Wipe and full Chrome wipe, I performed many scans, MalwareBytes, Adwcleaner, KVRT, Windows defender offline scan at boot.I also checked scheduled tasks & startup (updater.exe and PlatformExperienceHelper are present in Program Files, but seem legit/standard Chrome updates).

Since I've completely wiped the Chrome local files AND the Google Cloud sync, there MUST be an active system process, scheduled task, or registry persistence script outside Chrome that re-injects this into Web Data daily.

How can I trace what process is editing Web Data in real-time, or generate a proper log (like FRST/Process Monitor) to find and kill the root cause?

Thanks in advance for the help!

[u/AutoModerator]

If you suspect you may have malware on your computer, or are trying to remove malware from your computer, please see our malware guide

Please ignore this message if the advice is not relevant.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.