Welcome to MT!
One point you should note is that to stop malware, you shouldn't rely on just anti-malware; you have to do some secure configuration of windows as well. Anti-malware is mostly a blacklist, and behavioral detection is also based on past observations. So any tinkering and modification of the malware by the hacker will fool the anti-malware. More or less, that results in a zero-day malware, one that bypasses your defenses. So it is prudent that you eliminate some attack vectors, like for example setting Powerhell execution policy or stopping dated technologies like DCOM if your site doesn't use it.