Thanks for reaching out, and I'm sorry you're dealing with this — being locked in a fight over your own devices for this long is exhausting, and we want to help you get to a clean, stable setup.
When someone appears to keep regaining access no matter what you try, it's usually not the individual device that's the weak point — it's one of three things staying compromised in the background: (1) a key account/password (especially your email), (2) your network/router or ISP account, or (3) something persisting on the machine that a scan alone won't clear. Chasing the VPN toggle by itself won't fix it, so the goal is to reset all three at once. Here's the order that tends to actually work:
- Use a separate, known-clean device (a phone on mobile data, or a device you trust) for the next steps — don't do them on the machine you think is affected.
- Secure your email first, then your other key accounts. Change the password on your primary email, then anything financial, and turn on two-factor authentication (2FA) for each. Email is the master key attackers use to reset everything else.
- Lock down your network. Change your router's admin password and Wi-Fi password, update its firmware, and change the password on your Starlink/ISP account with 2FA enabled. Attackers often ride the account or router, not the laptop — which is why a new connection got "taken over" so fast.
- Do a full clean reinstall of the affected computer (back up your files first, then factory-reset/reinstall the OS from official media). A reinstall removes persistence that scanning may miss.
- Reset any accounts you use on that machine once it's clean, so nothing you log back into hands access straight back.
The combined account + network + clean-reinstall reset above is what usually breaks the cycle, even without any specific security product installed.
