I’m no expert but wouldn’t disabling system restore and a boot time scan help here?
I’ll get my coat and leave if this has already been tried btw!