Can Malware Survive A Clean Windows Reinstall?

A customer brought in her PC a few days ago after a "Microsoft" tech called her, remote connected and hacked away. I scanned it with Malwarebytes AdwCleaner and found a toxic waste dump of issues, some of which had been around for over a year. Rather than mess with cleaning and repairing Windows, I moved the few photos stored on it to a USB and did a clean reinstall of Windows 10 from a USB image.

Booted from USB, chose fresh install, deleted all existing partitions on the hard drive, had the installer create new partitions and the Windows install finished, seemingly OK. Set up the PC using her existing Microsoft ID and password.

When it finished, the desktop background was a picture of her cat - the same picture that was on the PC before the reformat/reinstall. Absolutely nothing had been added or transferred back to the PC at this point.

I've never seen a complete reinstall of Windows 10 (even set up with a Microsoft account) save and reset a custom background picture. Given this, I'm wondering what else may still be left.

• Can a virus or malware still hide on a hard drive after a reformat by Windows install? I've Googled this with mixed answers.

• If not, can a Microsoft account (including OneDrive) automatically reinstall viruses/malware? The keyword is "automatically," not merely by OneDrive backing up an .exe file that could reinstall the malware only if manually clicked/ran by the user.

Any thoughts would be appreciated. Thanks.

 

Existing Microsoft account login is whats replicating so yes......its the cloud!

I always do clean installs without logging to MS accounts or even entering a key, these can be done after install completes and displays the Widows logo background which is default.

 

A format and clean install would certainly remove anything malicious locally...…...Most Cloud providers today offer 'state of the art' security including One Drive and Dropbox etc.
Stringent testing is performed on all upload files and the bad is forbidden a seat (so to speak).
Zero day is a danger, although highly sophisticated and unlikely...…..how do you protect against what you don't know?

You should be clear reconnecting and sharing in the cloud once you have completed install.