Likely hiding in the restore files
A lot of people run the fix without shutting down restore and it immediately becomes reinfected