Start::
CloseProcesses:

2026-06-18 11:08 - 2026-06-18 11:08 - 000000000 ____D C:\Users\q7062\AppData\Local\UpdatesWin
2026-06-18 11:08 - 2026-06-18 11:08 - 000000000 ____D C:\Users\q7062\AppData\Local\Features
2026-06-18 11:08 - 2026-06-18 11:08 - 000000000 ____D C:\Users\q7062\AppData\Local\DiagnosticsNET
Edge HKLM-x32\...\Edge\Extension: [jcpgbnbdnakoblgfkbgggankeidkfcdl]
CHR HKLM-x32\...\Chrome\Extension: [llbcnfanfmjhpedaedhbcnpgeepdnnok]
2026-06-18 22:41 - 2024-09-07 02:36 - 000000000 ____D C:\Users\q7062\AppData\Roaming\RenPy
CustomCLSID: HKU\S-1-5-21-3761831582-1735635451-1424092898-1002_Classes\CLSID\{3faa4380-a399-11cf-a466-00805fe418f6}\InprocServer32 -> C:\Program Files\Autodesk\DWG TrueView 2025 - English\en-US\dwgviewrficn.dll => No File
CustomCLSID: HKU\S-1-5-21-3761831582-1735635451-1424092898-1002_Classes\CLSID\{d1b22d3d-8585-53a6-acb3-0e803c7e8d2a}\localserver32 -> "C:\Users\q7062\AppData\Local\Microsoft\Teams\current\Teams.exe" --toast => No File
FirewallRules: [{3CD87966-0408-4093-9597-6A8115FBABCE}] => (Allow) D:\SoftEther VPN Client Developer Edition\vpncmd.exe => No File
FirewallRules: [{9BC7D97F-3C43-4862-A714-922B1FBD228B}] => (Allow) D:\SoftEther VPN Client Developer Edition\vpncmgr.exe => No File
FirewallRules: [{15919684-FF04-4E57-8C54-DC5CA17521C5}] => (Allow) D:\SoftEther VPN Client Developer Edition\vpnclient.exe => No File
FirewallRules: [UDP Query User{48DD3C37-2E76-4DF2-BC94-14D8D95BCDFB}D:\games\dodi-repacks\hitman world of assassination\_peacock-v6.5.1-cracked\nodedist\node.exe] => (Allow) D:\games\dodi-repacks\hitman world of assassination\_peacock-v6.5.1-cracked\nodedist\node.exe => No File
FirewallRules: [TCP Query User{797071AF-9697-4FDD-AEFB-59B61C2AFD89}D:\games\dodi-repacks\hitman world of assassination\_peacock-v6.5.1-cracked\nodedist\node.exe] => (Allow) D:\games\dodi-repacks\hitman world of assassination\_peacock-v6.5.1-cracked\nodedist\node.exe => No File
FirewallRules: [UDP Query User{1232B1E3-22AD-41B4-937A-042202B830AB}D:\steamlibrary\steamapps\common\dishonored\binaries\win32\dishonored.exe] => (Allow) D:\steamlibrary\steamapps\common\dishonored\binaries\win32\dishonored.exe => No File
FirewallRules: [TCP Query User{65355780-024F-4E9C-86FE-EB771434A53F}D:\steamlibrary\steamapps\common\dishonored\binaries\win32\dishonored.exe] => (Allow) D:\steamlibrary\steamapps\common\dishonored\binaries\win32\dishonored.exe => No File
FirewallRules: [{BFAC7BEF-DB33-455C-8137-AE41FDF1411C}] => (Allow) D:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File
FirewallRules: [{E64870A1-2B2F-477E-92A6-B88C9A9DC4F7}] => (Allow) D:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File
FirewallRules: [{0C8F2CAA-3C61-4DA5-AE1D-305F1B7DC1B1}] => (Allow) D:\Program Files (x86)\Steam\steam.exe => No File
FirewallRules: [{7E8BE627-0BA1-4E90-912B-8CE9273BAF8D}] => (Allow) D:\Program Files (x86)\Steam\steam.exe => No File
FirewallRules: [UDP Query User{A385275F-9CD9-44C1-A1D2-0057A439BFB9}C:\program files (x86)\steam\steamapps\common\baldurs gate 3\bin\bg3.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\baldurs gate 3\bin\bg3.exe => No File
FirewallRules: [TCP Query User{378B6608-D208-4569-BA9D-929783FA1EDE}C:\program files (x86)\steam\steamapps\common\baldurs gate 3\bin\bg3.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\baldurs gate 3\bin\bg3.exe => No File
FirewallRules: [UDP Query User{8B86B944-C164-4EC5-A86F-37A56709DED3}C:\program files (x86)\steam\steamapps\common\baldurs gate 3\bin\bg3_dx11.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\baldurs gate 3\bin\bg3_dx11.exe => No File
FirewallRules: [TCP Query User{657FD425-B411-460E-A5C7-0279B1A62CE8}C:\program files (x86)\steam\steamapps\common\baldurs gate 3\bin\bg3_dx11.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\baldurs gate 3\bin\bg3_dx11.exe => No File
FirewallRules: [{59A9756F-D33C-4E64-9551-52CB5AE8B8FB}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\DARK SOULS III\Game\DarkSoulsIII.exe => No File
FirewallRules: [{BFFA3947-539F-4141-BD43-4544792027E1}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\DARK SOULS III\Game\DarkSoulsIII.exe => No File
FirewallRules: [UDP Query User{2F313BBB-557C-4266-AD64-477F479D1977}C:\program files (x86)\airdroid cast\airdroidcast.exe] => (Allow) C:\program files (x86)\airdroid cast\airdroidcast.exe => No File
FirewallRules: [TCP Query User{212AD97C-F351-4A58-865E-EDE16810368D}C:\program files (x86)\airdroid cast\airdroidcast.exe] => (Allow) C:\program files (x86)\airdroid cast\airdroidcast.exe => No File
FirewallRules: [{882CAF36-5370-4C87-A99E-BA99C1ED2BB7}] => (Allow) C:\Users\q7062\AppData\Roaming\Zoom\bin\airhost.exe => No File
FirewallRules: [{4267CD19-F4CC-4BC1-8480-946B673CBDD2}] => (Allow) C:\Users\q7062\AppData\Roaming\Zoom\bin\airhost.exe => No File
FirewallRules: [{1FDA967C-A9D5-4E2A-871E-AE7EF872981C}] => (Allow) C:\Users\q7062\AppData\Roaming\Zoom\bin\Zoom.exe => No File
FirewallRules: [{519AA9BC-1F67-4031-9C36-07448D44D848}] => (Allow) C:\Program Files\LogiOptionsPlus\logioptionsplus.exe => No File
FirewallRules: [{CDE13B3D-073E-4D9F-B998-A2497EC79AB4}] => (Allow) C:\Program Files\LogiOptionsPlus\logioptionsplus.exe => No File
FirewallRules: [{52A48751-65D5-4B0D-A8EF-EC731BD75AC4}] => (Allow) C:\Program Files\LogiOptionsPlus\logioptionsplus.exe => No File
FirewallRules: [{620E1566-C021-4435-B447-90AA8517BE62}] => (Allow) C:\Program Files\LogiOptionsPlus\logioptionsplus.exe => No File
FirewallRules: [{ADB72482-2896-4AD6-A48E-56CFE9E76649}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File
FirewallRules: [{1B1FE154-6374-4B27-A368-F5707B535BAC}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File
FirewallRules: [TCP Query User{D0E393BF-51B6-4825-9BC6-84A5602D0C15}C:\users\q7062\appdata\local\discord\app-1.0.9008\discord.exe] => (Allow) C:\users\q7062\appdata\local\discord\app-1.0.9008\discord.exe => No File
FirewallRules: [UDP Query User{15D05397-C32E-46A6-BC6C-CEE8B82F7390}C:\users\q7062\appdata\local\discord\app-1.0.9008\discord.exe] => (Allow) C:\users\q7062\appdata\local\discord\app-1.0.9008\discord.exe => No File
FirewallRules: [TCP Query User{2859AFCD-D6DC-4585-AC3F-C5E62FC63FEF}C:\users\q7062\onedrive\desktop\tandis.v2022.05.04\tandis.v2022.05.04\tandis.exe] => (Allow) C:\users\q7062\onedrive\desktop\tandis.v2022.05.04\tandis.v2022.05.04\tandis.exe => No File
FirewallRules: [UDP Query User{9B854B2C-B9AF-48EE-A2C7-2596B8822615}C:\users\q7062\onedrive\desktop\tandis.v2022.05.04\tandis.v2022.05.04\tandis.exe] => (Allow) C:\users\q7062\onedrive\desktop\tandis.v2022.05.04\tandis.v2022.05.04\tandis.exe => No File
FirewallRules: [TCP Query User{BBA7AE34-7F73-4122-9079-088BDE2D1B54}C:\users\q7062\onedrive\desktop\new folder (3)\shape of dreams.exe] => (Allow) C:\users\q7062\onedrive\desktop\new folder (3)\shape of dreams.exe => No File
FirewallRules: [UDP Query User{5260757C-5C42-4308-9D07-A37414BC7282}C:\users\q7062\onedrive\desktop\new folder (3)\shape of dreams.exe] => (Allow) C:\users\q7062\onedrive\desktop\new folder (3)\shape of dreams.exe => No File
FirewallRules: [TCP Query User{73DD30C5-AB20-4A3E-AE25-5BD9BBB5C443}C:\users\q7062\onedrive\desktop\my.card.is.better.than.your.card\game\mycardisbetterthanyourcard.exe] => (Allow) C:\users\q7062\onedrive\desktop\my.card.is.better.than.your.card\game\mycardisbetterthanyourcard.exe => No File
FirewallRules: [UDP Query User{449A76EE-CDB9-49D6-A770-04A0C494E3D1}C:\users\q7062\onedrive\desktop\my.card.is.better.than.your.card\game\mycardisbetterthanyourcard.exe] => (Allow) C:\users\q7062\onedrive\desktop\my.card.is.better.than.your.card\game\mycardisbetterthanyourcard.exe => No File
FirewallRules: [{BCF0FE79-C7B0-46B5-A6E5-8020B416B83B}] => (Allow) C:\Program Files\Achievement Watcher\node\node.exe => No File
FirewallRules: [TCP Query User{27398A21-A95B-4D98-A0F2-6BC133353D4E}C:\program files\achievement watcher\node\node.exe] => (Allow) C:\program files\achievement watcher\node\node.exe => No File
FirewallRules: [UDP Query User{503FBD95-7B4B-4C45-995B-4707DEB9452D}C:\program files\achievement watcher\node\node.exe] => (Allow) C:\program files\achievement watcher\node\node.exe => No File
FirewallRules: [TCP Query User{64E661E1-F4E7-414B-9172-5688FEDE42AE}C:\users\q7062\onedrive\desktop\7.days.to.end.with.you.v1.2.02\7.days.to.end.with.you.v1.2.02\seven days to end with you.exe] => (Allow) C:\users\q7062\onedrive\desktop\7.days.to.end.with.you.v1.2.02\7.days.to.end.with.you.v1.2.02\seven days to end with you.exe => No File
FirewallRules: [UDP Query User{A441E1DD-9244-49AA-A8CE-2755D4A60E64}C:\users\q7062\onedrive\desktop\7.days.to.end.with.you.v1.2.02\7.days.to.end.with.you.v1.2.02\seven days to end with you.exe] => (Allow) C:\users\q7062\onedrive\desktop\7.days.to.end.with.you.v1.2.02\7.days.to.end.with.you.v1.2.02\seven days to end with you.exe => No File
FirewallRules: [TCP Query User{61E2C568-8A69-4AA3-975E-F6F0E24EF410}C:\users\q7062\desktop\my.card.is.better.than.your.card.build.21130410\mycardisbetterthanyourcard.exe] => (Allow) C:\users\q7062\desktop\my.card.is.better.than.your.card.build.21130410\mycardisbetterthanyourcard.exe => No File
FirewallRules: [UDP Query User{E87ED057-C049-4B9A-8F77-D9B2D6A63C01}C:\users\q7062\desktop\my.card.is.better.than.your.card.build.21130410\mycardisbetterthanyourcard.exe] => (Allow) C:\users\q7062\desktop\my.card.is.better.than.your.card.build.21130410\mycardisbetterthanyourcard.exe => No File
FirewallRules: [TCP Query User{823CD1BA-BEAC-4139-814E-6B09F99A017B}C:\program files (x86)\epic games\botanymanorruzat\botany manor.exe] => (Allow) C:\program files (x86)\epic games\botanymanorruzat\botany manor.exe => No File
FirewallRules: [UDP Query User{F9284E37-A23F-4E60-8C25-A13DB8790AFB}C:\program files (x86)\epic games\botanymanorruzat\botany manor.exe] => (Allow) C:\program files (x86)\epic games\botanymanorruzat\botany manor.exe => No File
FirewallRules: [TCP Query User{C4F0E23A-67EC-4DFF-B20C-E198195FEB8C}C:\users\q7062\desktop\skewer squad\skewer squad.exe] => (Allow) C:\users\q7062\desktop\skewer squad\skewer squad.exe => No File
FirewallRules: [UDP Query User{1652BE10-97CC-4197-BE81-CFD64565D012}C:\users\q7062\desktop\skewer squad\skewer squad.exe] => (Allow) C:\users\q7062\desktop\skewer squad\skewer squad.exe => No File
FirewallRules: [TCP Query User{EE7791DF-8E0B-47D1-B529-D2287E66121A}C:\users\q7062\desktop\shape of dreams\shape of dreams.exe] => (Allow) C:\users\q7062\desktop\shape of dreams\shape of dreams.exe => No File
FirewallRules: [UDP Query User{C711911E-7718-4630-B9B2-FE0366252462}C:\users\q7062\desktop\shape of dreams\shape of dreams.exe] => (Allow) C:\users\q7062\desktop\shape of dreams\shape of dreams.exe => No File
FirewallRules: [TCP Query User{A5EA41A1-26A7-4283-BF79-970893FCB240}D:\games\shapeofdreams\shape of dreams.exe] => (Allow) D:\games\shapeofdreams\shape of dreams.exe => No File
FirewallRules: [UDP Query User{E3ABFAA6-52F2-40D9-A755-08DC88DC116C}D:\games\shapeofdreams\shape of dreams.exe] => (Allow) D:\games\shapeofdreams\shape of dreams.exe => No File
FirewallRules: [TCP Query User{4C853B4F-0222-435D-96AF-1FA764A5F6AC}C:\users\q7062\desktop\rune dice.steamgg.net\rune dice.exe] => (Allow) C:\users\q7062\desktop\rune dice.steamgg.net\rune dice.exe => No File
FirewallRules: [UDP Query User{BF490F57-CCB7-489D-8567-04EB6995F15A}C:\users\q7062\desktop\rune dice.steamgg.net\rune dice.exe] => (Allow) C:\users\q7062\desktop\rune dice.steamgg.net\rune dice.exe => No File
FirewallRules: [TCP Query User{00A1BE48-AF54-45E0-87EF-35EAD75E6FD0}D:\games\love is all-yesterday-steamgg.net\love is all around echoes of yesterday\wdhd5.exe] => (Allow) D:\games\love is all-yesterday-steamgg.net\love is all around echoes of yesterday\wdhd5.exe => No File
FirewallRules: [UDP Query User{BA7A8D11-671D-4E7D-8171-678E4821BB45}D:\games\love is all-yesterday-steamgg.net\love is all around echoes of yesterday\wdhd5.exe] => (Allow) D:\games\love is all-yesterday-steamgg.net\love is all around echoes of yesterday\wdhd5.exe => No File
FirewallRules: [TCP Query User{335C5576-2CB6-489F-9F38-EABED4514A76}D:\games\love is all around echoes of yesterday\wdhd5.exe] => (Allow) D:\games\love is all around echoes of yesterday\wdhd5.exe => No File
FirewallRules: [UDP Query User{99CA9F24-6BCD-408C-82CD-D36B60FCDA77}D:\games\love is all around echoes of yesterday\wdhd5.exe] => (Allow) D:\games\love is all around echoes of yesterday\wdhd5.exe => No File
FirewallRules: [TCP Query User{D0F3002E-C211-4862-95D8-C9544B2DAC61}D:\games\five.hearts.under.one.roof.2.build.22809208\five hearts under one roof season 2\fhuor2.exe] => (Allow) D:\games\five.hearts.under.one.roof.2.build.22809208\five hearts under one roof season 2\fhuor2.exe => No File
FirewallRules: [UDP Query User{AD40D3B2-110D-4E7A-97F5-9A25C8BA92B4}D:\games\five.hearts.under.one.roof.2.build.22809208\five hearts under one roof season 2\fhuor2.exe] => (Allow) D:\games\five.hearts.under.one.roof.2.build.22809208\five hearts under one roof season 2\fhuor2.exe => No File
FirewallRules: [TCP Query User{AE80F438-B6B2-4A8C-9CE6-D8318BA12EA4}D:\games\hello love 18 again-steamgg.net\hello love 18 again\你好！我们还有场恋爱没谈.exe] => (Allow) D:\games\hello love 18 again-steamgg.net\hello love 18 again\你好！我们还有场恋爱没谈.exe => No File
FirewallRules: [UDP Query User{A2A7A1D0-D2E9-401F-819A-A1DD3411E794}D:\games\hello love 18 again-steamgg.net\hello love 18 again\你好！我们还有场恋爱没谈.exe] => (Allow) D:\games\hello love 18 again-steamgg.net\hello love 18 again\你好！我们还有场恋爱没谈.exe => No File
FirewallRules: [TCP Query User{CEC6D943-D321-425B-B330-B77CD722847A}D:\games\hello love 18 again\你好！我们还有场恋爱没谈.exe] => (Allow) D:\games\hello love 18 again\你好！我们还有场恋爱没谈.exe => No File
FirewallRules: [UDP Query User{74828A81-0458-4028-BFA7-7B732723E8DC}D:\games\hello love 18 again\你好！我们还有场恋爱没谈.exe] => (Allow) D:\games\hello love 18 again\你好！我们还有场恋爱没谈.exe => No File
FirewallRules: [TCP Query User{D3043A1F-82DD-4891-AD04-11C6E4A44E02}D:\games\bento.blocks.build.22165772\bentoblocks.exe] => (Allow) D:\games\bento.blocks.build.22165772\bentoblocks.exe => No File
FirewallRules: [UDP Query User{08F353C7-B7B6-4E77-90B7-B132CAA62B58}D:\games\bento.blocks.build.22165772\bentoblocks.exe] => (Allow) D:\games\bento.blocks.build.22165772\bentoblocks.exe => No File
Task: {077BA067-7C15-40F0-B22E-C9DC2A54B4A2} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe  (No File)
Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe  (No File)

CHR StartupUrls: Default -> "hxxp://www.omniboxes.com/?type=hp&ts=1424703245&from=amt&uid=WDCXWD3200AAJS-08L7A0_WD-WCAV2AA0485704857","hxxps://www.google.com.hk/","hxxp://www.omniboxes.com/?type=hppp&ts=1424703275&from=amt&uid=WDCXWD3200AAJS-08L7A0_WD-WCAV2AA0485704857"

2026-06-18 23:57 - 2026-06-18 23:57 - 000000000 ____D C:\Users\q7062\AppData\Local\Intel
2026-06-18 23:53 - 2026-06-18 23:55 - 000000000 ____D C:\SexyClick_ZhouNingSexSlave.rar_Archive_full_7205
2026-06-18 11:08 - 2026-06-18 23:37 - 000000000 ____D C:\Users\q7062\AppData\Roaming\FirstLoveExperience

Comment: This snippet removes all Windows Defender exclusions
DeleteKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\TemporaryPaths
StartPowershell:
Try {
    $Paths=(Get-MpPreference).ExclusionPath
    $Extensions=(Get-MpPreference).ExclusionExtension
    $Processes=(Get-MpPreference).ExclusionProcess
    
    foreach ($Path in $Paths) { 
        Remove-MpPreference -ExclusionPath $Path -force -ErrorAction Stop
    }
    foreach ($Extension in $Extensions) { 
        Remove-MpPreference -ExclusionExtension $Extension -force -ErrorAction Stop
    }
    foreach ($Process in $Processes) { 
        Remove-MpPreference -ExclusionProcess $Process -force -ErrorAction Stop
    }
}
Catch {
    Write-Error "Error occurred while removing Windows Defender exclusions: $_"
}
EndPowershell:


StartPowerShell:
# This snippet re-enables Windows Defender and applies optimized settings to ensure high protection against malware

# Enable real-time protection
Set-MpPreference -DisableRealtimeMonitoring $false

# Enable behavioural protection
Set-MpPreference -DisableBehaviorMonitoring $false

# Enable PUP detection
Set-MpPreference -PUAProtection Enabled

# Enable cloud protection to level 4 - aggressively block unknowns and apply additional protection measures, alternatively use 2 for lower protection or 0 for default
Set-MpPreference -CloudBlockLevel 4

# Send advanced information about malicious/unwanted software present on your device
Set-MpPreference -MAPSReporting 2

# Send safe samples automatically to Microsoft
Set-MpPreference -SubmitSamplesConsent 1

# Enables inspection of HTTP traffic to detect malicious websites
Set-MpPreference -EnableNetworkProtection Enabled

# Enables block at first seen
Set-MpPreference -DisableBlockAtFirstSeen $false

# Allows scanning of archive files, such as .zip and .cab files for malware/PUP
Set-MpPreference -DisableArchiveScanning $false

# Enables automatic scanning of USB & removal drives
Set-MpPreference -DisableRemovableDriveScanning $false

# Enables scanning of network files
Set-MpPreference -DisableScanningNetworkFiles $false

# Forces signature check before running a scan
Set-MpPreference -CheckForSignaturesBeforeRunningScan $true

# Extends cloud check timer from default 10 to 30 seconds
Set-MpPreference -CloudExtendedTimeout 30

# Enables automatic scanning of all downloaded files and attachments
Set-MpPreference -DisableIOAVProtection $false

# Enables script detection
Set-MpPreference -DisableScriptScanning $false

# Disables automatic exclusions from scanning
Set-MpPreference -DisableAutoExclusions 1

# Enables scanning of mapped network drives
Set-MpPreference -DisableScanningMappedNetworkDrivesForFullScan 0

# Enables scanning of email files
Set-MpPreference -DisableEmailScanning 0

# Enables blocking of malicious domains and IP's on DNS level
Set-MpPreference -EnableDnsSinkhole $true

# Enables signature updates every 12 hours
Set-MpPreference -SignatureUpdateInterval 12

# Enables automatic quarantine for threats labelled as high and severe
Set-MpPreference -HighThreatDefaultAction Quarantine
Set-MpPreference -SevereThreatDefaultAction Quarantine

# Updates signatures
Update-MpSignature
EndPowerShell:


StartPowershell:
# Replace /scanonly with /clean if you also want to delete items -- however, this will activate a trial license on the system, I do not recommend it
$hmpExe  = "$env:TEMP\HitmanPro_x64.exe"
$logFile = "$env:TEMP\HitmanPro_ScanLog.txt"
Invoke-WebRequest -Uri "https://dl.surfright.nl/HitmanPro_x64.exe" -OutFile $hmpExe -UseBasicParsing
$proc = Start-Process $hmpExe -ArgumentList "/ews","/scanonly","/noinstall","/log=`"$logFile`"","/logtype=txt" -Wait -PassThru
if (!(Test-Path $logFile)) { Write-Host "Scan failed (exit $($proc.ExitCode))"; exit 1 }
Get-Content $logFile -Encoding Unicode
EndPowershell:

StartPowerShell:
# Downloads newest AdwCleaner version directly from Malwarebytes, performs an update, scans, cleans and writes the log in console
# Does not clean preinstalled objects, only PUP/Adware
# If you would like to delete preinstalled objects, add an argument /preinstalled to the /clean argument
# If you would like to only scan with it, change the argument from /clean to /scan
# NOTE: For the sake of users from Asia (primarily China), do not use the clean option. It will very likely remove a lot of their important software.
New-Item -ItemType Directory -Force -Path "$env:SystemDrive\AdwCleaner" | Out-Null
Invoke-WebRequest -Uri "https://adwcleaner.malwarebytes.com/adwcleaner?channel=release" -OutFile "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe"
Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/eula" -Wait -WindowStyle Hidden
$logFile = "$env:SystemDrive\AdwCleaner\AdwCleanerOutputFRST.txt"
Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/noreboot /clean" -Wait -WindowStyle Hidden -RedirectStandardOutput $logFile
Get-Content $logFile -Encoding Unicode
Remove-Item -Path $logFile -Force -ErrorAction SilentlyContinue
EndPowerShell:

Comment: Verify that Discord does not have any injected code to intercept personal data. If anything is prompted here, it needs to be checked that it isn't malicious code.
Powershell: @("$env:APPDATA","$env:LOCALAPPDATA") | ForEach-Object { Get-ChildItem $_ -Recurse -Filter "index.js" -ErrorAction SilentlyContinue } | Where-Object { $_.FullName -match "discord_desktop_core" } | ForEach-Object { Write-Host "--- $($_.FullName) ---"; (Get-Content $_.FullName -Raw).Substring(0,[Math]::Min(2000,(Get-Content $_.FullName -Raw).Length)) }


Comment: Remove unwanted files from common folders using native removal power of Farbar to include remove on reboot if needed. Please double check the user does not have any applications incorrectly installed in the directories listed below.
C:\ProgramData\*.a3x
C:\ProgramData\*.ahk
C:\ProgramData\*.au3
C:\ProgramData\*.bat
C:\ProgramData\*.cab
C:\ProgramData\*.cmd
C:\ProgramData\*.com
C:\ProgramData\*.dll
C:\ProgramData\*.exe
C:\ProgramData\*.hta
C:\ProgramData\*.jar
C:\ProgramData\*.js
C:\ProgramData\*.jse
C:\ProgramData\*.lnk
C:\ProgramData\*.pif
C:\ProgramData\*.ps1
C:\ProgramData\*.py
C:\ProgramData\*.pyc
C:\ProgramData\*.pyd
C:\ProgramData\*.scr
C:\ProgramData\*.tmp
C:\ProgramData\*.vbe
C:\ProgramData\*.vbs
C:\ProgramData\*.wsf
C:\ProgramData\*.wsh
C:\ProgramData\*.zip
C:\ProgramData\*.rar
C:\ProgramData\*.7z
C:\Users\*\AppData\Roaming\*.au3
C:\Users\*\AppData\Roaming\*.bat
C:\Users\*\AppData\Roaming\*.cab
C:\Users\*\AppData\Roaming\*.cmd
C:\Users\*\AppData\Roaming\*.com
C:\Users\*\AppData\Roaming\*.dll
C:\Users\*\AppData\Roaming\*.exe
C:\Users\*\AppData\Roaming\*.hta
C:\Users\*\AppData\Roaming\*.jar
C:\Users\*\AppData\Roaming\*.js
C:\Users\*\AppData\Roaming\*.jse
C:\Users\*\AppData\Roaming\*.lnk
C:\Users\*\AppData\Roaming\*.pif
C:\Users\*\AppData\Roaming\*.ps1
C:\Users\*\AppData\Roaming\*.py
C:\Users\*\AppData\Roaming\*.pyc
C:\Users\*\AppData\Roaming\*.pyd
C:\Users\*\AppData\Roaming\*.scr
C:\Users\*\AppData\Roaming\*.tmp
C:\Users\*\AppData\Roaming\*.vbe
C:\Users\*\AppData\Roaming\*.vbs
C:\Users\*\AppData\Roaming\*.wsf
C:\Users\*\AppData\Roaming\*.wsh
C:\Users\*\AppData\Roaming\*.zip
C:\Users\*\AppData\Roaming\*.rar
C:\Users\*\AppData\Roaming\*.7z
C:\Users\CurrentUserName\AppData\Local\*.a3x
C:\Users\CurrentUserName\AppData\Local\*.ahk
C:\Users\CurrentUserName\AppData\Local\*.au3
C:\Users\CurrentUserName\AppData\Local\*.bat
C:\Users\CurrentUserName\AppData\Local\*.cab
C:\Users\CurrentUserName\AppData\Local\*.cmd
C:\Users\CurrentUserName\AppData\Local\*.com
C:\Users\CurrentUserName\AppData\Local\*.dll
C:\Users\CurrentUserName\AppData\Local\*.exe
C:\Users\CurrentUserName\AppData\Local\*.hta
C:\Users\CurrentUserName\AppData\Local\*.jar
C:\Users\CurrentUserName\AppData\Local\*.js
C:\Users\CurrentUserName\AppData\Local\*.jse
C:\Users\CurrentUserName\AppData\Local\*.lnk
C:\Users\CurrentUserName\AppData\Local\*.pif
C:\Users\CurrentUserName\AppData\Local\*.ps1
C:\Users\CurrentUserName\AppData\Local\*.py
C:\Users\CurrentUserName\AppData\Local\*.pyc
C:\Users\CurrentUserName\AppData\Local\*.pyd
C:\Users\CurrentUserName\AppData\Local\*.scr
C:\Users\CurrentUserName\AppData\Local\*.tmp
C:\Users\CurrentUserName\AppData\Local\*.vbe
C:\Users\CurrentUserName\AppData\Local\*.vbs
C:\Users\CurrentUserName\AppData\Local\*.wsf
C:\Users\CurrentUserName\AppData\Local\*.wsh
C:\Users\CurrentUserName\AppData\Local\*.zip
C:\Users\CurrentUserName\AppData\Local\*.rar
C:\Users\CurrentUserName\AppData\Local\*.7z
C:\Users\CurrentUserName\AppData\Roaming\*.a3x
C:\Users\CurrentUserName\AppData\Roaming\*.ahk
C:\Users\CurrentUserName\AppData\Roaming\*.au3
C:\Users\CurrentUserName\AppData\Roaming\*.bat
C:\Users\CurrentUserName\AppData\Roaming\*.cab
C:\Users\CurrentUserName\AppData\Roaming\*.cmd
C:\Users\CurrentUserName\AppData\Roaming\*.com
C:\Users\CurrentUserName\AppData\Roaming\*.dll
C:\Users\CurrentUserName\AppData\Roaming\*.exe
C:\Users\CurrentUserName\AppData\Roaming\*.hta
C:\Users\CurrentUserName\AppData\Roaming\*.jar
C:\Users\CurrentUserName\AppData\Roaming\*.js
C:\Users\CurrentUserName\AppData\Roaming\*.jse
C:\Users\CurrentUserName\AppData\Roaming\*.lnk
C:\Users\CurrentUserName\AppData\Roaming\*.pif
C:\Users\CurrentUserName\AppData\Roaming\*.ps1
C:\Users\CurrentUserName\AppData\Roaming\*.py
C:\Users\CurrentUserName\AppData\Roaming\*.pyc
C:\Users\CurrentUserName\AppData\Roaming\*.pyd
C:\Users\CurrentUserName\AppData\Roaming\*.scr
C:\Users\CurrentUserName\AppData\Roaming\*.tmp
C:\Users\CurrentUserName\AppData\Roaming\*.vbe
C:\Users\CurrentUserName\AppData\Roaming\*.vbs
C:\Users\CurrentUserName\AppData\Roaming\*.wsf
C:\Users\CurrentUserName\AppData\Roaming\*.wsh
C:\Users\CurrentUserName\AppData\Roaming\*.zip
C:\Users\CurrentUserName\AppData\Roaming\*.rar
C:\Users\CurrentUserName\AppData\Roaming\*.7z

Comment: Force policy removal
C:\Windows\System32\GroupPolicyUsers
C:\Windows\System32\GroupPolicy

Comment: System repair commands
CMD: DISM.exe /Online /Cleanup-image /Restorehealth
CMD: SFC.exe /scannow

Comment: Network reset commands
CMD: netsh int ip reset
CMD: netsh int ipv6 reset
CMD: ipconfig /flushDNS
CMD: netsh winsock reset catalog

Comment: Additional temp file removal
C:\Windows\System32\config\systemprofile\AppData\Local\*.tmp
C:\WINDOWS\system32\*.tmp
C:\WINDOWS\syswow64\*.tmp
C:\Users\CurrentUserName\AppData\Local\Temp\*
C:\Windows\Temp\*
C:\Windows\SystemTemp\*

EmptyTemp:
End::