Malware Log Analysis

Start:: SystemRestore: On CreateRestorePoint: CloseProcesses: Avira Update Helper (HKLM-x32\...\{25A7DD46-F34D-4979-9C3D-BFB147368DD6}) (Version: 1.8.1695.6 - Avira) Hidden IE trusted site: HKU\.DEFAULT\...\webcompanion.com -> hxxp://webcompanion.com Startup: C:\Users\okko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitCleaner Tasker.lnk [2024-11-30] <==== ATTENTION ShortcutTarget: BitCleaner Tasker.lnk -> C:\Users\okko\AppData\Roaming\BitCleaner\BitCleaner Tasker.exe (BINARYLABS LIMITED -> Binarylabs LTD) <==== ATTENTION Startup: C:\Users\okko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mhelper.lnk [2024-11-30] ShortcutTarget: mhelper.lnk -> C:\Users\okko\AppData\Roaming\SEO\mhelper\mhelper.exe (BUSINESS CONVERS TRACK S.R.L. -> Business Convers Track S.R.L.) Startup: C:\Users\okko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OHIG_net6_lts.lnk [2026-08-28] <==== ATTENTION ShortcutTarget: OHIG_net6_lts.lnk -> C:\Users\okko\AppData\Local\Temp\56prl9woX23JN3ck\BuilderBeta.exe (Autodesk, Inc. -> Autodesk, Inc.) <==== ATTENTION Startup: C:\Users\okko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SearchEngineOptimizer.lnk [2024-11-30] <==== ATTENTION ShortcutTarget: SearchEngineOptimizer.lnk -> C:\Users\okko\AppData\Roaming\SEO\SEO.exe (BUSINESS CONVERS TRACK S.R.L. -> Business Convers Track S.R.L.) <==== ATTENTION Task: {9E3D82D5-5BF4-4966-9105-BB4DBA43CE77} - System32\Tasks\OBUpdate => C:\Users\okko\AppData\Local\OneBrowser\Update\OBUpdateService.exe [3309584 2025-07-08] (WORK PRODUCT, INC. -> WORK PRODUCT, INC.) <==== ATTENTION C:\Users\okko\AppData\Local\Temp\56prl9US1D6Gno1h C:\Users\okko\AppData\Local\Temp\56prl9woX23JN3ck C:\Users\okko\AppData\Local\Temp\56prl9ebngEGt2jf C:\Users\okko\AppData\Local\OneBrowser 2026-08-29 13:05 - 2026-08-29 13:05 - 000000000 ____D C:\Users\okko\AppData\Local\Yandex 2026-08-28 14:37 - 2026-09-02 16:05 - 000000000 ____D C:\ProgramData\AMDBase_lts 2026-08-28 14:37 - 2026-08-28 14:37 - 001784392 _____ (The Xreveal Team) C:\Users\okko\FluxOrchestrat.exe 2026-08-28 14:37 - 2026-08-28 14:37 - 000000000 ____D C:\Users\okko\AppData\Roaming\AMDBase_lts C:\Program Files (x86)\Lavasoft Folder: C:\Users\okko\AppData\LocalLow\Saikey Studios Folder: C:\.cache CHR DefaultSearchURL: Default -> hxxps://hcm-20eu.org/?token=ED5SNyNPXQFGMkNJX0BQR1MfAjJVa3Y8LgtHQlsJVFQlAhgPWwMFBEBVdF0LBkRkW0xGRwBXQmJCR1hVBQAJRlZ1WQwEQ2dXRkI&q={searchTerms} CHR DefaultSearchKeyword: Default -> hcm-20eu.org HKU\S-1-5-18\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe --minimize (No File) <==== ATTENTION HKU\S-1-5-18\...\RunOnce: [Bddci4RebootPending] => [X] HKU\S-1-5-18\...\RunOnce: [WebProtectionRebootPending] => [X] Task: {077BA067-7C15-40F0-B22E-C9DC2A54B4A2} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe (No File) Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe (No File) Task: {F9A75809-82E8-471E-9238-3EE8898937AA} - System32\Tasks\Opera scheduled Autoupdate 1732991783 => C:\Users\okko\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --scheduledtask --bypasslauncher $(Arg0) (No File) S2 CompanionService; C:\Program Files (x86)\Lavasoft\Web Companion\Application\CompanionService.WinService.exe (No File) <==== ATTENTION S2 DCIService; C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe (No File) <==== ATTENTION S3 EAAntiCheat; system32\drivers\eaanticheat.sys (No File) 2026-02-17 16:44 - 2026-02-17 16:44 - 000000048 ____R () C:\Users\okko\AppData\Local\0119AC2FC90D95AC063B177717B7B3B6 2024-12-06 18:03 - 2024-12-06 18:03 - 000000048 ____R () C:\Users\okko\AppData\Local\098AB26706994CDB2162DCD92216123D 2025-03-10 14:45 - 2025-03-10 14:45 - 000000048 ____R () C:\Users\okko\AppData\Local\50C64F86DCE2004244F2D6CD01EB8CE4 2025-11-16 20:22 - 2025-11-16 20:22 - 000000048 ____R () C:\Users\okko\AppData\Local\FA1B7E1020A459A55A714E95599E50C0 CustomCLSID: HKU\S-1-5-21-3741004620-3314273801-3775595941-1001_Classes\CLSID\{89b2b650-c4dd-d68b-46e7-3176f1973c8b}\localserver32 -> "C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe" -ToastActivated => No File AlternateDataStreams: C:\WINDOWS\tracing:? [16] AlternateDataStreams: C:\ProgramData\mntemp:8EAD8B3507 [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk:BE32D07BC5 [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox Privater Modus.lnk:83A68E50E4 [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Thunderbird.lnk:4D17D28237 [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wireshark.lnk:6E485D5009 [3442] AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [10414] FirewallRules: [UDP Query User{C5444050-F0F2-4AE3-86C5-E3892F2770DC}C:\program files (x86)\steam\steamapps\common\red dead redemption 2\rdr2.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\red dead redemption 2\rdr2.exe => No File FirewallRules: [TCP Query User{9F89127F-5D5E-45AF-905D-4A22F52594A2}C:\program files (x86)\steam\steamapps\common\red dead redemption 2\rdr2.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\red dead redemption 2\rdr2.exe => No File FirewallRules: [UDP Query User{69ABA1C7-688E-4DC1-992E-338F160F5463}C:\program files (x86)\steam\steamapps\common\fragpunk\fragpunk\binaries\win64\fragpunk.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\fragpunk\fragpunk\binaries\win64\fragpunk.exe => No File FirewallRules: [TCP Query User{6788D75A-E253-46D8-843C-9BC5AF911B06}C:\program files (x86)\steam\steamapps\common\fragpunk\fragpunk\binaries\win64\fragpunk.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\fragpunk\fragpunk\binaries\win64\fragpunk.exe => No File FirewallRules: [UDP Query User{4DDF5939-D9A3-44CB-A6E9-C8D3153DD7B6}C:\program files (x86)\steam\steamapps\common\dueprocess\dueprocess.exe] => (Block) C:\program files (x86)\steam\steamapps\common\dueprocess\dueprocess.exe => No File FirewallRules: [TCP Query User{5D150864-5C65-4612-B056-60D2E376761B}C:\program files (x86)\steam\steamapps\common\dueprocess\dueprocess.exe] => (Block) C:\program files (x86)\steam\steamapps\common\dueprocess\dueprocess.exe => No File FirewallRules: [UDP Query User{4C7632D3-8794-4215-94CA-B9372FF846C4}C:\program files (x86)\steam\steamapps\common\minecraftdungeons\dungeons\binaries\win64\dungeons-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\minecraftdungeons\dungeons\binaries\win64\dungeons-win64-shipping.exe => No File FirewallRules: [TCP Query User{9D673957-EA10-4EF2-9EAA-9A610CBE33F3}C:\program files (x86)\steam\steamapps\common\minecraftdungeons\dungeons\binaries\win64\dungeons-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\minecraftdungeons\dungeons\binaries\win64\dungeons-win64-shipping.exe => No File FirewallRules: [UDP Query User{43406C48-2296-407B-8D12-C81708C70D27}C:\program files (x86)\steam\steamapps\common\cyberpunk 2077\bin\x64\cyberpunk2077.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\cyberpunk 2077\bin\x64\cyberpunk2077.exe => No File FirewallRules: [TCP Query User{95A4E252-450B-41FB-BE45-C86B55A674E8}C:\program files (x86)\steam\steamapps\common\cyberpunk 2077\bin\x64\cyberpunk2077.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\cyberpunk 2077\bin\x64\cyberpunk2077.exe => No File FirewallRules: [UDP Query User{EDC0FA2D-FFC4-49C4-B1F5-B4476445199C}C:\users\okko\appdata\local\ubisoft\r6siege\scimitar_engine_win64_2022_flto_dx12.exe] => (Allow) C:\users\okko\appdata\local\ubisoft\r6siege\scimitar_engine_win64_2022_flto_dx12.exe => No File FirewallRules: [TCP Query User{7D8916A4-4320-4AA8-B609-170060D470A4}C:\users\okko\appdata\local\ubisoft\r6siege\scimitar_engine_win64_2022_flto_dx12.exe] => (Allow) C:\users\okko\appdata\local\ubisoft\r6siege\scimitar_engine_win64_2022_flto_dx12.exe => No File FirewallRules: [UDP Query User{308C4B45-E864-4412-BA8E-514F5DD449EE}C:\program files (x86)\steam\steamapps\common\marvelrivals\marvelgame\marvel\binaries\win64\marvel-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\marvelrivals\marvelgame\marvel\binaries\win64\marvel-win64-shipping.exe => No File FirewallRules: [TCP Query User{CAAA7325-E2DD-4AFB-AC2A-AD471D07AC67}C:\program files (x86)\steam\steamapps\common\marvelrivals\marvelgame\marvel\binaries\win64\marvel-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\marvelrivals\marvelgame\marvel\binaries\win64\marvel-win64-shipping.exe => No File FirewallRules: [UDP Query User{6A6F8387-E251-4916-BBBF-2EBE447A5FE8}C:\program files\epic games\fortnite\engine\binaries\win64\epicwebhelper.exe] => (Allow) C:\program files\epic games\fortnite\engine\binaries\win64\epicwebhelper.exe => No File FirewallRules: [TCP Query User{27149DED-B6E7-498D-9C2B-EBE31A497549}C:\program files\epic games\fortnite\engine\binaries\win64\epicwebhelper.exe] => (Allow) C:\program files\epic games\fortnite\engine\binaries\win64\epicwebhelper.exe => No File FirewallRules: [{A748FF85-F4E4-44A9-97F4-E6C9985CFC1D}] => (Allow) C:\Users\okko\AppData\Local\Programs\Opera\opera.exe => No File FirewallRules: [UDP Query User{A2381F06-9E11-4722-A468-0A2144C48022}C:\users\okko\appdata\local\discord\app-1.0.9172\discord.exe] => (Block) C:\users\okko\appdata\local\discord\app-1.0.9172\discord.exe => No File FirewallRules: [TCP Query User{C5780042-C22C-4FFD-9506-932F0FD34783}C:\users\okko\appdata\local\discord\app-1.0.9172\discord.exe] => (Block) C:\users\okko\appdata\local\discord\app-1.0.9172\discord.exe => No File FirewallRules: [UDP Query User{AACBEDDB-DAE2-4151-BC41-E1E2F65946BC}C:\program files (x86)\steam\steamapps\common\battlefield 1\bf1.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\battlefield 1\bf1.exe => No File FirewallRules: [TCP Query User{15D38870-CB0A-44A5-AFF1-8D3AF5E692D6}C:\program files (x86)\steam\steamapps\common\battlefield 1\bf1.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\battlefield 1\bf1.exe => No File FirewallRules: [UDP Query User{69A793D6-5918-4611-8E89-58B733CB9D94}C:\program files (x86)\steam\steamapps\common\total war warhammer iii\warhammer3.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\total war warhammer iii\warhammer3.exe => No File FirewallRules: [TCP Query User{D6D506F3-AC36-41EC-B30C-857F7D31586F}C:\program files (x86)\steam\steamapps\common\total war warhammer iii\warhammer3.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\total war warhammer iii\warhammer3.exe => No File FirewallRules: [{7363AD58-37E5-4239-B790-9BF3D335D173}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Total War WARHAMMER III\launcher\launcher.exe => No File FirewallRules: [{16E42A77-0630-4DC9-B2D2-62EDE9DC63F1}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Total War WARHAMMER III\launcher\launcher.exe => No File FirewallRules: [UDP Query User{B12B69F7-BCD3-40F6-8B6D-BB67465B37FC}C:\program files (x86)\steam\steamapps\common\battlefield 2042\bf2042.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\battlefield 2042\bf2042.exe => No File FirewallRules: [TCP Query User{B02141C7-0A9C-48C0-8E2E-483A91E1EE57}C:\program files (x86)\steam\steamapps\common\battlefield 2042\bf2042.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\battlefield 2042\bf2042.exe => No File FirewallRules: [UDP Query User{7967A833-1F97-4D00-A3DA-7D918A283757}C:\users\okko\appdata\local\discord\app-1.0.9161\discord.exe] => (Block) C:\users\okko\appdata\local\discord\app-1.0.9161\discord.exe => No File FirewallRules: [TCP Query User{D357DABF-C64D-409B-BE80-5C98EBD12FBA}C:\users\okko\appdata\local\discord\app-1.0.9161\discord.exe] => (Block) C:\users\okko\appdata\local\discord\app-1.0.9161\discord.exe => No File FirewallRules: [UDP Query User{9ED6A543-D0A4-4A4F-A5A9-0C408BA7DC1C}C:\program files (x86)\call of duty\_retail_\cod.exe] => (Allow) C:\program files (x86)\call of duty\_retail_\cod.exe => No File FirewallRules: [TCP Query User{CDC2A324-A5D4-476D-BF9B-466D69207B99}C:\program files (x86)\call of duty\_retail_\cod.exe] => (Allow) C:\program files (x86)\call of duty\_retail_\cod.exe => No File FirewallRules: [UDP Query User{43564278-D85E-4A4E-A2AD-B6ECF5B927A4}C:\program files (x86)\steam\steamapps\common\foxhole\war\binaries\win64\war-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\foxhole\war\binaries\win64\war-win64-shipping.exe => No File FirewallRules: [TCP Query User{BD3CBF25-2629-45D9-8A4E-16B34300B613}C:\program files (x86)\steam\steamapps\common\foxhole\war\binaries\win64\war-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\foxhole\war\binaries\win64\war-win64-shipping.exe => No File FirewallRules: [{FC1C6569-D7AA-4DC7-80FE-E53BE49DAE12}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Tom Clancy's Rainbow Six Siege\RainbowSix_Vulkan.exe => No File FirewallRules: [{022BB692-7320-4797-AC32-CBDB3353BC45}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Tom Clancy's Rainbow Six Siege\RainbowSix_Vulkan.exe => No File FirewallRules: [{11B9C80B-72EE-4556-9EB6-886015DB9450}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Albion Online\launcher\AlbionLauncher.exe => No File FirewallRules: [{84661F48-3668-40EF-92E9-DB8ED0813D5C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Albion Online\launcher\AlbionLauncher.exe => No File FirewallRules: [UDP Query User{8F111534-7F83-46CA-8E92-CCD549C3D0A8}C:\program files (x86)\steam\steamapps\common\the first descendant\m1\binaries\win64\m1-win64-shipping.exe] => (Block) C:\program files (x86)\steam\steamapps\common\the first descendant\m1\binaries\win64\m1-win64-shipping.exe => No File FirewallRules: [TCP Query User{6E4345FF-DE8B-46B3-94FB-C0B05C0CCD26}C:\program files (x86)\steam\steamapps\common\the first descendant\m1\binaries\win64\m1-win64-shipping.exe] => (Block) C:\program files (x86)\steam\steamapps\common\the first descendant\m1\binaries\win64\m1-win64-shipping.exe => No File FirewallRules: [{598AE073-2F13-4715-B25F-4D37CA06A8FD}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Enlisted\bpreport.exe => No File FirewallRules: [{9831F2A9-A3D7-4C57-964E-D29475FA72A1}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Enlisted\bpreport.exe => No File FirewallRules: [UDP Query User{63641B09-924D-43FD-91FE-551B0C01AB21}C:\program files (x86)\steam\steamapps\common\vrising\vrising_server\vrisingserver.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\vrising\vrising_server\vrisingserver.exe => No File FirewallRules: [TCP Query User{49E271A0-F279-444A-819E-8D1EED046874}C:\program files (x86)\steam\steamapps\common\vrising\vrising_server\vrisingserver.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\vrising\vrising_server\vrisingserver.exe => No File FirewallRules: [{F6C524AC-7E5A-4C1A-A779-694F65709278}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\ELDEN RING\Game\start_protected_game.exe => No File FirewallRules: [{255C6D81-D797-40E9-9E7E-D8289A45B652}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\ELDEN RING\Game\start_protected_game.exe => No File FirewallRules: [{86B4BFE8-3F96-433D-BA35-47DB90216D6A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\killingfloor2\Binaries\Win64\KFGame.exe => No File FirewallRules: [{24B2515B-91F9-42D4-82C7-5F89AAC23552}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\killingfloor2\Binaries\Win64\KFGame.exe => No File FirewallRules: [UDP Query User{7796F2C1-154F-47F4-8CA3-4AC2EB221E0D}C:\program files (x86)\steam\steamapps\common\paladins\binaries\win64\paladins.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\paladins\binaries\win64\paladins.exe => No File FirewallRules: [TCP Query User{178640CA-40D8-4536-BAD3-EE37504AB215}C:\program files (x86)\steam\steamapps\common\paladins\binaries\win64\paladins.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\paladins\binaries\win64\paladins.exe => No File FirewallRules: [UDP Query User{F3F484D3-3176-4EBC-A211-5D30125651BA}C:\program files (x86)\steam\steamapps\common\mission 202\binaries\win64\rxgame-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\mission 202\binaries\win64\rxgame-win64-shipping.exe => No File FirewallRules: [TCP Query User{AD5C03AD-F80C-4C79-AA54-16C4391D9629}C:\program files (x86)\steam\steamapps\common\mission 202\binaries\win64\rxgame-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\mission 202\binaries\win64\rxgame-win64-shipping.exe => No File FirewallRules: [UDP Query User{C1D218AA-F09E-439C-82B6-2537F7CF2913}C:\users\okko\appdata\local\ubisoft\r6siege\y9s1.2.0_c8178548_d1893250_s58856_69866602\2375863535\rainbowsix.exe] => (Block) C:\users\okko\appdata\local\ubisoft\r6siege\y9s1.2.0_c8178548_d1893250_s58856_69866602\2375863535\rainbowsix.exe => No File FirewallRules: [TCP Query User{5CB9BBC6-31FA-4585-8372-2A7DF73FACBB}C:\users\okko\appdata\local\ubisoft\r6siege\y9s1.2.0_c8178548_d1893250_s58856_69866602\2375863535\rainbowsix.exe] => (Block) C:\users\okko\appdata\local\ubisoft\r6siege\y9s1.2.0_c8178548_d1893250_s58856_69866602\2375863535\rainbowsix.exe => No File FirewallRules: [UDP Query User{F15B801F-2B59-48C8-9F40-50DCD8A59021}C:\program files (x86)\steam\steamapps\common\planetside 2\planetside2_x64.exe] => (Block) C:\program files (x86)\steam\steamapps\common\planetside 2\planetside2_x64.exe => No File FirewallRules: [TCP Query User{3F491754-143F-445A-9273-043DE938A023}C:\program files (x86)\steam\steamapps\common\planetside 2\planetside2_x64.exe] => (Block) C:\program files (x86)\steam\steamapps\common\planetside 2\planetside2_x64.exe => No File FirewallRules: [{9B6D107F-1554-4CC4-AA35-40D5C2235929}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Apex Legends\EasyAntiCheat_launcher.exe => No File FirewallRules: [{21E59516-FA07-43E8-B0FE-44F133CFCC37}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Apex Legends\EasyAntiCheat_launcher.exe => No File FirewallRules: [UDP Query User{EF9E20E7-FDAC-40D5-8F71-D4A6E17D62C9}C:\program files (x86)\steam\steamapps\common\titanfall2\titanfall2.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\titanfall2\titanfall2.exe => No File FirewallRules: [TCP Query User{F08BCD23-8C08-49B0-BB6B-755655B8330C}C:\program files (x86)\steam\steamapps\common\titanfall2\titanfall2.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\titanfall2\titanfall2.exe => No File FirewallRules: [UDP Query User{FAE9F7D0-1AC1-474C-9853-4A9764CCFCED}C:\program files (x86)\steam\steamapps\common\destiny 2\destiny2.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\destiny 2\destiny2.exe => No File FirewallRules: [TCP Query User{68642648-42E6-4B00-807C-33A6E46099AA}C:\program files (x86)\steam\steamapps\common\destiny 2\destiny2.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\destiny 2\destiny2.exe => No File FirewallRules: [UDP Query User{7DEA7C49-DBDE-4409-9971-0A9FFCC5FB23}C:\program files (x86)\steam\steamapps\common\hawked\mglauncher\mgl.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\hawked\mglauncher\mgl.exe => No File FirewallRules: [TCP Query User{B5D87A8E-502C-4935-9814-42FE554F2ED2}C:\program files (x86)\steam\steamapps\common\hawked\mglauncher\mgl.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\hawked\mglauncher\mgl.exe => No File FirewallRules: [UDP Query User{FAB9B777-5BDD-4F29-BDA8-EE7DEDDC6A98}C:\program files (x86)\steam\steamapps\common\century\century\binaries\win64\century-win64-shipping.exe] => (Block) C:\program files (x86)\steam\steamapps\common\century\century\binaries\win64\century-win64-shipping.exe => No File FirewallRules: [TCP Query User{3D3F2BE3-55AD-4503-BB77-A195CDBE4BB0}C:\program files (x86)\steam\steamapps\common\century\century\binaries\win64\century-win64-shipping.exe] => (Block) C:\program files (x86)\steam\steamapps\common\century\century\binaries\win64\century-win64-shipping.exe => No File FirewallRules: [{FAB99038-B919-4DC3-B5BE-7AC4F2DBE9A4}] => (Allow) C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe => No File FirewallRules: [{B1B5D0DB-1441-4FAF-9A36-3D113E906435}] => (Allow) C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe => No File FirewallRules: [UDP Query User{FC9B052F-D0AB-4617-BDED-981B35B7D483}C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe] => (Allow) C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe => No File FirewallRules: [TCP Query User{7B8D99D5-AB83-4B5F-B945-A8243FC372AA}C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe] => (Allow) C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe => No File FirewallRules: [{4EADE363-2428-42D9-A58F-DAD77E1B0A05}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File FirewallRules: [{613A7224-FF7D-423A-AE29-0B0EFE46EEEF}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File FirewallRules: [TCP Query User{DCE67CA1-1500-46CC-A050-A885BC02393C}C:\users\okko\appdata\local\discord\app-1.0.9205\discord.exe] => (Allow) C:\users\okko\appdata\local\discord\app-1.0.9205\discord.exe => No File FirewallRules: [UDP Query User{669CBF20-2056-4525-8AAB-DA080BBEF802}C:\users\okko\appdata\local\discord\app-1.0.9205\discord.exe] => (Allow) C:\users\okko\appdata\local\discord\app-1.0.9205\discord.exe => No File FirewallRules: [TCP Query User{6A64246F-2E81-4B35-8193-2A554BCB95A7}C:\program files (x86)\steam\steamapps\common\wrap house simulator demo\wraphousesimulator\binaries\win64\wraphousesimulator-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\wrap house simulator demo\wraphousesimulator\binaries\win64\wraphousesimulator-win64-shipping.exe => No File FirewallRules: [UDP Query User{50D2C6BB-71A8-4145-987F-C824781E3CAB}C:\program files (x86)\steam\steamapps\common\wrap house simulator demo\wraphousesimulator\binaries\win64\wraphousesimulator-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\wrap house simulator demo\wraphousesimulator\binaries\win64\wraphousesimulator-win64-shipping.exe => No File FirewallRules: [TCP Query User{368EE532-1CAD-41D4-BD1A-3E19B9B1F35E}C:\program files (x86)\steam\steamapps\common\skate\skate.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\skate\skate.exe => No File FirewallRules: [UDP Query User{926199E0-6009-4C54-9C3E-14D9EBEFEEA7}C:\program files (x86)\steam\steamapps\common\skate\skate.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\skate\skate.exe => No File FirewallRules: [TCP Query User{1DCC06BA-D70E-4448-96CC-86E59DCF9617}C:\program files (x86)\call of duty\_retail_\cod24\cod24-cod.exe] => (Allow) C:\program files (x86)\call of duty\_retail_\cod24\cod24-cod.exe => No File FirewallRules: [UDP Query User{0A48FC17-BB19-446F-BB70-11E0331CB62A}C:\program files (x86)\call of duty\_retail_\cod24\cod24-cod.exe] => (Allow) C:\program files (x86)\call of duty\_retail_\cod24\cod24-cod.exe => No File FirewallRules: [{09231517-CF2E-4458-9E94-EE734EAAE4EA}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Ready Or Not\Engine\Binaries\Win64\CrashReporter.exe => No File FirewallRules: [{BAAAC9D9-0C45-4BA9-AF23-5EEC19820B03}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Ready Or Not\Engine\Binaries\Win64\CrashReporter.exe => No File FirewallRules: [TCP Query User{C8D8F85D-EC6C-4B37-886F-8FE0870E3A2A}C:\program files (x86)\steam\steamapps\common\ready or not\readyornot\binaries\win64\readyornotsteam-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\ready or not\readyornot\binaries\win64\readyornotsteam-win64-shipping.exe => No File FirewallRules: [UDP Query User{1BEB654C-59ED-4267-B113-89F1D74D52F6}C:\program files (x86)\steam\steamapps\common\ready or not\readyornot\binaries\win64\readyornotsteam-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\ready or not\readyornot\binaries\win64\readyornotsteam-win64-shipping.exe => No File FirewallRules: [TCP Query User{CC339952-DE85-4419-B846-E0A41B166118}C:\program files (x86)\steam\steamapps\common\arc raiders\pioneergame\binaries\win64\pioneergame.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\arc raiders\pioneergame\binaries\win64\pioneergame.exe => No File FirewallRules: [UDP Query User{6AAECBDF-8758-4D5A-B21A-434E5F09A800}C:\program files (x86)\steam\steamapps\common\arc raiders\pioneergame\binaries\win64\pioneergame.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\arc raiders\pioneergame\binaries\win64\pioneergame.exe => No File FirewallRules: [TCP Query User{673039D9-82D8-425D-8A1E-9A65A01EE609}C:\program files (x86)\steam\steamapps\common\tom clancy's rainbow six siege\rainbowsix.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\tom clancy's rainbow six siege\rainbowsix.exe => No File FirewallRules: [UDP Query User{0369395E-8F14-4976-8FC7-571AC700AD64}C:\program files (x86)\steam\steamapps\common\tom clancy's rainbow six siege\rainbowsix.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\tom clancy's rainbow six siege\rainbowsix.exe => No File FirewallRules: [TCP Query User{036CEB9F-4E0E-443C-A3D9-B1E7E65E0E7F}C:\users\okko\downloads\battelfield 6\hf.v2025.12.19.all.dlc.uncensored\hf.v2025.12.19.all.dlc.uncensored\hf.v2025.12.19.all.dlc.uncensored\handymanfantasy.exe] => (Block) C:\users\okko\downloads\battelfield 6\hf.v2025.12.19.all.dlc.uncensored\hf.v2025.12.19.all.dlc.uncensored\hf.v2025.12.19.all.dlc.uncensored\handymanfantasy.exe => No File FirewallRules: [UDP Query User{5B76F8BE-4202-4D69-B9E2-66B6C45C9905}C:\users\okko\downloads\battelfield 6\hf.v2025.12.19.all.dlc.uncensored\hf.v2025.12.19.all.dlc.uncensored\hf.v2025.12.19.all.dlc.uncensored\handymanfantasy.exe] => (Block) C:\users\okko\downloads\battelfield 6\hf.v2025.12.19.all.dlc.uncensored\hf.v2025.12.19.all.dlc.uncensored\hf.v2025.12.19.all.dlc.uncensored\handymanfantasy.exe => No File FirewallRules: [TCP Query User{B3849610-FE01-4255-807D-7AAD36E12413}C:\users\okko\downloads\battelfield 6\peeping.dorm.manager\peeping.dorm.manager\peeping dorm manager\peeping dorm manager.exe] => (Allow) C:\users\okko\downloads\battelfield 6\peeping.dorm.manager\peeping.dorm.manager\peeping dorm manager\peeping dorm manager.exe => No File FirewallRules: [UDP Query User{F19EB102-ED4B-43F7-A84A-2851EFAA9E3E}C:\users\okko\downloads\battelfield 6\peeping.dorm.manager\peeping.dorm.manager\peeping dorm manager\peeping dorm manager.exe] => (Allow) C:\users\okko\downloads\battelfield 6\peeping.dorm.manager\peeping.dorm.manager\peeping dorm manager\peeping dorm manager.exe => No File FirewallRules: [TCP Query User{96C36AAA-C679-4916-BAF2-CFBC8DAF51AE}C:\program files (x86)\steam\steamapps\common\arc raiders\pioneergame\binaries\win64\pioneergame-d.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\arc raiders\pioneergame\binaries\win64\pioneergame-d.exe => No File FirewallRules: [UDP Query User{A55CE52F-619C-46F4-B362-BB3D3176258C}C:\program files (x86)\steam\steamapps\common\arc raiders\pioneergame\binaries\win64\pioneergame-d.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\arc raiders\pioneergame\binaries\win64\pioneergame-d.exe => No File FirewallRules: [TCP Query User{F616BC26-9F3F-46CF-8397-CF5339FFCDB5}C:\users\okko\downloads\battelfield 6\the_censor-dx_v5.0.5s\the censor\thecensor.exe] => (Allow) C:\users\okko\downloads\battelfield 6\the_censor-dx_v5.0.5s\the censor\thecensor.exe => No File FirewallRules: [UDP Query User{D074169B-4FCA-4DCB-A28A-7D1022EFD414}C:\users\okko\downloads\battelfield 6\the_censor-dx_v5.0.5s\the censor\thecensor.exe] => (Allow) C:\users\okko\downloads\battelfield 6\the_censor-dx_v5.0.5s\the censor\thecensor.exe => No File FirewallRules: [TCP Query User{A0041DF1-7915-4A2F-861D-8D3CDCE7ED1E}C:\users\okko\downloads\battelfield 6\v-lover.final.dlc\v-lover!.final.dlc\become a vtuber!\v-lover.exe] => (Allow) C:\users\okko\downloads\battelfield 6\v-lover.final.dlc\v-lover!.final.dlc\become a vtuber!\v-lover.exe => No File FirewallRules: [UDP Query User{D462354E-AC5E-4C11-8B4B-DC4B608AE876}C:\users\okko\downloads\battelfield 6\v-lover.final.dlc\v-lover!.final.dlc\become a vtuber!\v-lover.exe] => (Allow) C:\users\okko\downloads\battelfield 6\v-lover.final.dlc\v-lover!.final.dlc\become a vtuber!\v-lover.exe => No File FirewallRules: [TCP Query User{4B7DFF7E-3F1E-46A7-9428-DEF5DA8B08C9}C:\users\okko\downloads\battelfield 6\rebirth.mr.wang\rebirth.mr.wang\rebirth - mr wang\rebirth mr wang.exe] => (Block) C:\users\okko\downloads\battelfield 6\rebirth.mr.wang\rebirth.mr.wang\rebirth - mr wang\rebirth mr wang.exe => No File FirewallRules: [UDP Query User{82B03AAB-9588-480B-92A6-2EE90EC5973D}C:\users\okko\downloads\battelfield 6\rebirth.mr.wang\rebirth.mr.wang\rebirth - mr wang\rebirth mr wang.exe] => (Block) C:\users\okko\downloads\battelfield 6\rebirth.mr.wang\rebirth.mr.wang\rebirth - mr wang\rebirth mr wang.exe => No File FirewallRules: [{524DEF57-3E5B-4014-8571-72007D12B122}] => (Allow) C:\Program Files (x86)\Overwolf\0.305.0.9\OverwolfBrowser.exe => No File FirewallRules: [{5A325278-B669-4AE6-BA65-0CA82D8F472E}] => (Allow) C:\Program Files (x86)\Overwolf\0.305.0.9\OverwolfBrowser.exe => No File FirewallRules: [{F024E54D-46B5-4DEE-A83C-DB7C02B3C975}] => (Block) C:\Program Files (x86)\Overwolf\0.305.0.9\OverwolfBrowser.exe => No File FirewallRules: [{6F7E7915-BAC7-4578-8AC6-8D7F401D743B}] => (Block) C:\Program Files (x86)\Overwolf\0.305.0.9\OverwolfBrowser.exe => No File Comment: Service / Driver Status (thanks to AdvancedSetup) Comment: 0 = Boot Comment: 1 = System Comment: 2 = Automatic Comment: 3 = Manual / Demand Comment: 4 = Disabled Comment: R = Running Comment: S = Stopped Comment: U = Unknown / unable to determine service state cleanly Comment: === rifteyy's default non-intrusive fixlist template === Comment: The following are done automatically with this fixlist: Comment: Hardens Windows Defender (for maximum efficiency DISABLE TAMPER PROTECTION) Comment: Checks and corrects the default Windows PATH environmental variable Comment: Checks for internet connection, valid DNS Comment: Checks for Windows RE status Comment: Checks and repairs WMI repository Comment: Checks Windows activation status Comment: Checks if TPM, Secure Boot are available and their status Comment: Restores original Windows services configuration Comment: Restores PowerShell execution policy Comment: Rebuilds performance counter library values Comment: Resynchronizes performance counter library values to WMI Comment: Enables file extensions Comment: Enables recovery environment Comment: Scans with HitmanPro from Sophos Comment: Scans and cleans with AdwCleaner from Malwarebytes Comment: Lists environment variables Comment: Lists Windows Defender properties, settings Comment: Lists drive info, identify possible damaged drives from Event Logs Comment: Lists Discord's "index.js" files that are often targeted by malware (to store and execute malicious code) Comment: Lists recent BSOD's Comment: Lists all installed applications, folder contents along with SHA256 for purposes of identifying installed app malware Comment: Lists 30 recent scheduled tasks Comment: Lists recent Run (Windows + R) executed commands, can identify ClickFix attacks Comment: Removes unwanted files (e.g. .exe, .com, .dll) from common folders (e.g. C:\ProgramData, AppData\Roaming) - these are not supposed to store any executable file types Comment: Removes generic filetypes associated with RenPyLoader from common folders Comment: Removes cache from Chrome, Firefox, Opera, Opera GX, Brave, Vivaldi, LibreWolf, Mullvad Browser, Zen and from Roblox, Fortnite, Discord, OBS Studio Comment: Removes policies Comment: Removes active BITS tasks Comment: Resets network Comment: Resets icon cache Comment: Removes proxy servers Comment: Removes temporary files Comment: Repairs system files Comment: List environment variables StartPowerShell: $key = Get-Item -Path "HKCU:\Environment" -ErrorAction SilentlyContinue if ($key) { $path = "HKCU\Environment" foreach ($name in $key.GetValueNames()) { $value = $key.GetValue($name, $null, [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames) "$path|$name=$value" } } $key = Get-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" -ErrorAction SilentlyContinue if ($key) { $path = "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" foreach ($name in $key.GetValueNames()) { $value = $key.GetValue($name, $null, [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames) "$path|$name=$value" } } Get-ChildItem Env: | Sort-Object Name | ForEach-Object { "SET|$($_.Name)=$($_.Value)" } Get-ChildItem Registry::HKEY_USERS | Where-Object { $_.PSChildName -match '^S-1-5-21-\d+-\d+-\d+-\d+$' } | ForEach-Object { $sid = $_.PSChildName $envPath = "Registry::HKEY_USERS\$sid\Environment" if (Test-Path $envPath) { $key = Get-Item -Path $envPath foreach ($name in $key.GetValueNames()) { $value = $key.GetValue($name, $null, [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames) "HKEY_USERS\$sid\Environment|$name=$value" } } } EndPowerShell: StartPowerShell: # Checks default Windows PATH entries and repairs missing ones. $ErrorActionPreference = 'Continue' function Expand-PlainPath { param([string]$Entry) return [Environment]::ExpandEnvironmentVariables($Entry).TrimEnd('\') } # Templates expanded once to plain paths (C:\Windows\..., C:\Users\...) $systemDefaults = @( (Expand-PlainPath '%SystemRoot%\system32') (Expand-PlainPath '%SystemRoot%') (Expand-PlainPath '%SystemRoot%\System32\Wbem') (Expand-PlainPath '%SystemRoot%\System32\WindowsPowerShell\v1.0') (Expand-PlainPath '%SystemRoot%\System32\OpenSSH') ) $userDefaults = @( (Expand-PlainPath '%USERPROFILE%\AppData\Local\Microsoft\WindowsApps') ) function Get-NormalizedPathEntries { param([string]$Raw) if ([string]::IsNullOrWhiteSpace($Raw)) { return @() } return @( $Raw -split ';' | Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | ForEach-Object { [Environment]::ExpandEnvironmentVariables($_.Trim().TrimEnd('\')).ToLowerInvariant() } ) } function Get-CombinedPathEntries { $machineRaw = [Environment]::GetEnvironmentVariable('Path', 'Machine') $userRaw = [Environment]::GetEnvironmentVariable('Path', 'User') return Get-NormalizedPathEntries -Raw ($machineRaw + ';' + $userRaw) } function Test-InPath { param( [string]$PlainPath, [string[]]$NormalizedEntries ) $key = $PlainPath.TrimEnd('\').ToLowerInvariant() return $NormalizedEntries -contains $key } function Add-ToPath { param( [string]$PlainPath, [ValidateSet('Machine', 'User')] [string]$Scope ) # always store plain path, never %VAR% form $toAdd = $PlainPath.TrimEnd('\') $current = [Environment]::GetEnvironmentVariable('Path', $Scope) if ([string]::IsNullOrWhiteSpace($current)) { [Environment]::SetEnvironmentVariable('Path', $toAdd, $Scope) return } $normalized = Get-NormalizedPathEntries -Raw $current $key = $toAdd.ToLowerInvariant() if ($normalized -contains $key) { return } $newPath = $current.TrimEnd(';') + ';' + $toAdd [Environment]::SetEnvironmentVariable('Path', $newPath, $Scope) } function Write-Result { param( [string]$Entry, [string]$Status ) $label = $Entry.PadRight(58) Write-Output ("{0} {1}" -f $label, $Status) } function Repair-AndVerify { param( [string]$PlainPath, [ValidateSet('Machine', 'User')] [string]$Scope ) if (-not (Test-Path -LiteralPath $PlainPath)) { Write-Result -Entry $PlainPath -Status 'ATTENTION !!! MISSING (no folder, cannot repair)' return 'failed' } if ($Scope -eq 'Machine') { $isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()). IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) if (-not $isAdmin) { Write-Result -Entry $PlainPath -Status 'ATTENTION !!! MISSING (need Admin to repair)' return 'failed' } } try { Add-ToPath -PlainPath $PlainPath -Scope $Scope } catch { Write-Result -Entry $PlainPath -Status "ATTENTION !!! MISSING (repair failed: $_)" return 'failed' } # re-query PATH from registry and verify plain path is present $after = Get-CombinedPathEntries if (Test-InPath -PlainPath $PlainPath -NormalizedEntries $after) { Write-Result -Entry $PlainPath -Status 'ATTENTION !!! MISSING -> repaired (verified)' return 'repaired' } Write-Result -Entry $PlainPath -Status 'ATTENTION !!! MISSING (repair ran, still missing after re-check)' return 'failed' } $combined = Get-CombinedPathEntries $hadMissing = $false $repairFailed = $false $repairedList = [System.Collections.Generic.List[string]]::new() Write-Output 'PATH CHECK' Write-Output ('-' * 72) foreach ($entry in $systemDefaults) { if (Test-InPath -PlainPath $entry -NormalizedEntries $combined) { Write-Result -Entry $entry -Status 'OK' continue } $hadMissing = $true $result = Repair-AndVerify -PlainPath $entry -Scope Machine if ($result -eq 'repaired') { [void]$repairedList.Add($entry) $combined = Get-CombinedPathEntries } else { $repairFailed = $true } } foreach ($entry in $userDefaults) { if (Test-InPath -PlainPath $entry -NormalizedEntries $combined) { Write-Result -Entry $entry -Status 'OK' continue } $hadMissing = $true $result = Repair-AndVerify -PlainPath $entry -Scope User if ($result -eq 'repaired') { [void]$repairedList.Add($entry) $combined = Get-CombinedPathEntries } else { $repairFailed = $true } } Write-Output ('-' * 72) if (-not $hadMissing) { Write-Output 'RESULT: all default PATH entries present' } elseif ($repairedList.Count -gt 0 -and -not $repairFailed) { Write-Output "RESULT: $($repairedList.Count) missing entry/entries repaired and verified - open a new terminal" } elseif ($repairedList.Count -gt 0 -and $repairFailed) { Write-Output "RESULT: $($repairedList.Count) verified, some still missing - open a new terminal / run as Admin" } else { Write-Output 'RESULT: missing entries not repaired (run as Admin for System PATH)' } if ($repairedList.Count -gt 0) { Write-Output '' Write-Output 'REPAIRED:' foreach ($item in $repairedList) { Write-Output " $item" } } if ($hadMissing -or $repairFailed) { exit 1 } exit 0 EndPowerShell: Comment: Verify Windows activation CMD: C:\Windows\System32\cscript.exe c:\windows\system32\slmgr.vbs /xpr & C:\Windows\System32\cscript.exe c:\windows\system32\slmgr.vbs /dlv Comment: Check TPM and Secure Boot status StartPowershell: [PSCustomObject]@{ "TPM Detected" = (Get-Tpm).TpmPresent; "TPM Enabled" = (Get-Tpm).TpmEnabled; "Secure Boot On" = (Confirm-SecureBootUEFI) } EndPowershell: StartPowerShell: # Check for internet connection $ErrorActionPreference = 'Continue' $dnsServers = @( '1.1.1.1' '8.8.8.8' ) $hosts = @( 'google.com' 'cloudflare.com' 'malwarebytes.com' ) function Write-Result { param( [string]$Label, [string]$Status ) Write-Output ("{0} {1}" -f $Label.PadRight(42), $Status) } function Test-DnsServer { param([string]$Server) $pingOk = $false try { $pingOk = Test-Connection -ComputerName $Server -Count 1 -Quiet -ErrorAction SilentlyContinue } catch { } $resolveOk = $false try { $result = Resolve-DnsName -Name 'google.com' -Server $Server -Type A -DnsOnly -ErrorAction Stop $ip = ($result | Where-Object { $_.IPAddress } | Select-Object -First 1).IPAddress if ($ip) { $resolveOk = $true } } catch { } # resolve is what matters; ping may be blocked if ($resolveOk) { return 'OK' } if ($pingOk) { return 'FAIL' } return 'FAIL' } function Test-HostReachable { param([string]$HostName) try { $dns = Resolve-DnsName -Name $HostName -Type A -ErrorAction Stop $resolvedIp = ($dns | Where-Object { $_.IPAddress } | Select-Object -First 1).IPAddress if (-not $resolvedIp) { return 'FAIL' } } catch { return 'FAIL' } try { $null = Invoke-WebRequest -Uri "https://$HostName" -UseBasicParsing -TimeoutSec 10 -MaximumRedirection 5 -ErrorAction Stop return 'OK' } catch { if ($_.Exception.Response) { return 'OK' } return 'FAIL' } } $failed = 0 Write-Output 'INTERNET CHECK' Write-Output ('-' * 72) Write-Output 'DNS SERVERS' foreach ($server in $dnsServers) { $status = Test-DnsServer -Server $server Write-Result -Label $server -Status $status if ($status -eq 'FAIL') { $failed++ } } Write-Output '' Write-Output 'HOSTS' foreach ($h in $hosts) { $status = Test-HostReachable -HostName $h Write-Result -Label $h -Status $status if ($status -eq 'FAIL') { $failed++ } } Write-Output ('-' * 72) if ($failed -eq 0) { Write-Output 'RESULT: all checks passed' exit 0 } Write-Output "RESULT: $failed check(s) failed" exit 1 EndPowerShell: StartPowershell: # Replace /scanonly with /clean if you also want to delete items -- however, this will activate a trial license on the system, I do not recommend it $hmpExe = "$env:TEMP\HitmanPro_x64.exe" $logFile = "$env:TEMP\HitmanPro_ScanLog.txt" Invoke-WebRequest -Uri "https://dl.surfright.nl/HitmanPro_x64.exe" -OutFile $hmpExe -UseBasicParsing $proc = Start-Process $hmpExe -ArgumentList "/ews","/scanonly","/noinstall","/log=`"$logFile`"","/logtype=txt" -Wait -PassThru if (!(Test-Path $logFile)) { Write-Host "Scan failed (exit $($proc.ExitCode))"; exit 1 } Get-Content $logFile -Encoding Unicode EndPowershell: StartPowerShell: # Downloads newest AdwCleaner version directly from Malwarebytes, performs an update, scans, cleans and writes the log in console # Does not clean preinstalled objects, only PUP/Adware # If you would like to delete preinstalled objects, add an argument /preinstalled to the /clean argument # If you would like to only scan with it, change the argument from /clean to /scan # NOTE: For the sake of users from Asia (primarily China), do not use the clean option. It will very likely remove a lot of their important software. New-Item -ItemType Directory -Force -Path "$env:SystemDrive\AdwCleaner" | Out-Null Invoke-WebRequest -Uri "https://adwcleaner.malwarebytes.com/adwcleaner?channel=release" -OutFile "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/eula" -Wait -WindowStyle Hidden $logFile = "$env:SystemDrive\AdwCleaner\AdwCleanerOutputFRST.txt" Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/noreboot /clean" -Wait -WindowStyle Hidden -RedirectStandardOutput $logFile Get-Content $logFile -Encoding Unicode Remove-Item -Path $logFile -Force -ErrorAction SilentlyContinue EndPowerShell: Comment: List drive info, identify possible damaged drives (thanks to AdvancedSetup from Malwarebytes for parts of these) StartPowerShell: param( [int]$MaxEvents = 5000 ) $GPTTypeMap = @{ 'EBD0A0A2-B9E5-4433-87C0-68B6B72699C7' = 'Microsoft Basic Data' 'E3C9E316-0B5C-4DB8-817D-F92DF00215AE' = 'Microsoft Reserved (MSR)' 'DE94BBA4-06D1-4D40-A16A-BFD50179D6AC' = 'Windows Recovery Environment (WinRE)' 'C12A7328-F81F-11D2-BA4B-00A0C93EC93B' = 'EFI System Partition' '21686148-6449-6E6F-744E-656564454649' = 'BIOS Boot Partition' 'A19D880F-05FC-4D3B-A006-743F0F84911E' = 'OEM Partition' '5808C8AA-7E8F-42E0-85D2-E1E90434CFB3' = 'Cluster Metadata Partition' '48465300-0000-11AA-AA11-00306543ECAC' = 'Apple HFS/HFS+' '7C3457EF-0000-11AA-AA11-00306543ECAC' = 'Apple APFS' '0FC63DAF-8483-4772-8E79-3D69D8477DE4' = 'Linux Filesystem' '0657FD6D-A4AB-43C4-84E5-0933C84B4F4F' = 'Linux Swap' 'E6D6D379-F507-44C2-A23C-238F2A3DF928' = 'Linux LVM' } $MBRTypeMap = @{ '01'='FAT12';'04'='FAT16 <32M';'05'='Extended';'06'='FAT16';'07'='IFS/NTFS/exFAT/HPFS';'0B'='FAT32 CHS';'0C'='FAT32 LBA';'0E'='FAT16 LBA' '0F'='Extended LBA';'82'='Linux Swap';'83'='Linux Native';'8E'='Linux LVM';'A5'='FreeBSD';'A6'='OpenBSD';'A8'='Mac OS X';'AB'='Mac OS X Boot' 'AF'='Mac OS X HFS';'EE'='EFI GPT Protective';'EF'='EFI System Partition' } function Get-PartitionTypeInfo { param($Partition) $guid = $null if ($Partition.GptType) { $guid = ($Partition.GptType -replace '[{}]', '').ToUpper() } if ([string]::IsNullOrWhiteSpace($guid) -or $guid -eq '00000000-0000-0000-0000-000000000000') { $guid = switch ($Partition.Type) { "System" { "C12A7328-F81F-11D2-BA4B-00A0C93EC93B" } "Reserved" { "E3C9E316-0B5C-4DB8-817D-F92DF00215AE" } "Basic" { "EBD0A0A2-B9E5-4433-87C0-68B6B72699C7" } "Recovery" { "DE94BBA4-06D1-4D40-A16A-BFD50179D6AC" } default { $null } } } if ($guid) { $name = $GPTTypeMap[$guid] if ($name) { return "$name (GPT GUID: $($guid.ToLower()))" } else { return "Unknown/Custom (GPT GUID: $($guid.ToLower()))" } } if ($Partition.MbrType) { $code = ($Partition.MbrType.ToString() -replace '^0x', '').PadLeft(2, '0').ToUpper() $name = $MBRTypeMap[$code] if ($name) { return "$name (MBR code: 0x$code)" } else { return "Unknown/Custom (MBR code: $($Partition.MbrType))" } } return $Partition.Type } function Get-DrMapping { param([int]$MaxEvents) $map = @{} try { $events = Get-WinEvent -FilterHashtable @{ LogName = 'System'; ProviderName = 'disk' } -MaxEvents $MaxEvents -ErrorAction Stop } catch { return $map } foreach ($e in $events) { if ($e.Message -match 'Harddisk(\d+)\\DR(\d+)') { $n = [int]$Matches[1] $dr = [int]$Matches[2] if (-not $map.ContainsKey($n)) { $map[$n] = $dr } } } return $map } $drMap = Get-DrMapping -MaxEvents $MaxEvents $physicalDisks = Get-PhysicalDisk | Select-Object DeviceId, FriendlyName, SerialNumber, MediaType, @{N='SizeGB';E={[math]::Round($_.Size / 1GB,2)}} foreach ($pd in $physicalDisks) { $devId = [int]$pd.DeviceId $drSuffix = if ($drMap.ContainsKey($devId)) { "\DR$($drMap[$devId])" } else { '\DR? (no event seen yet)' } Write-Host "" Write-Host "<=== \Device\Harddisk$devId$drSuffix ($($pd.FriendlyName)) ===>" Write-Host " DeviceId: $devId | Serial: $($pd.SerialNumber) | Media: $($pd.MediaType) | Size: $($pd.SizeGB) GB" try { $partitions = Get-Partition -DiskNumber $devId -ErrorAction Stop if (-not $partitions) { Write-Host " (no partitions found)" continue } foreach ($part in $partitions) { $driveLetter = if ($part.DriveLetter) { "$($part.DriveLetter):" } else { 'no letter' } $sizeGB = [math]::Round($part.Size / 1GB, 2) $typeInfo = Get-PartitionTypeInfo -Partition $part Write-Host " [PARTITION $($part.PartitionNumber)] Drive: $driveLetter - $sizeGB GB - $typeInfo" } } catch { Write-Host " [ERROR] cannot read partitions for disk $devId" } } if ($drMap.Count -eq 0) { Write-Host "" Write-Host "Note: no \Device\HarddiskN\DRx entries found in the last $MaxEvents System log events. Increase -MaxEvents, or the DR number will only appear once Windows actually logs a disk event for that drive (e.g. a bad block warning)." } EndPowerShell: Comment: Verify that Discord does not have any injected code to intercept personal data. If anything is prompted here, it needs to be checked that it isn't malicious code. Powershell: @("$env:APPDATA","$env:LOCALAPPDATA") | ForEach-Object { Get-ChildItem $_ -Recurse -Filter "index.js" -ErrorAction SilentlyContinue } | Where-Object { $_.FullName -match "discord_desktop_core" } | ForEach-Object { Write-Host "--- $($_.FullName) ---"; (Get-Content $_.FullName -Raw).Substring(0,[Math]::Min(2000,(Get-Content $_.FullName -Raw).Length)) } StartPowerShell: # Basic BSOD listings $ccKey = "HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl" $cfg = Get-ItemProperty $ccKey -ErrorAction SilentlyContinue $dumpTypeMap = @{0='None';1='Complete';2='Kernel';3='Minidump';7='Automatic'} Write-Output "--- Configuration ---" Write-Output ("Dump Type: {0} ({1})" -f $cfg.CrashDumpEnabled, $dumpTypeMap[$cfg.CrashDumpEnabled]) Write-Output ("Full Dump Path: {0}" -f $(if($cfg.DumpFile){[Environment]::ExpandEnvironmentVariables($cfg.DumpFile)}else{"$env:SystemRoot\MEMORY.DMP"})) Write-Output ("Minidump Folder: {0}" -f $(if($cfg.MinidumpDir){[Environment]::ExpandEnvironmentVariables($cfg.MinidumpDir)}else{"$env:SystemRoot\Minidump"})) Write-Output ("Auto Reboot: {0}" -f $(if($cfg.AutoReboot -eq 0){'Disabled'}else{'Enabled'})) Write-Output "--- Found Dump Files ---" $full = if($cfg.DumpFile){[Environment]::ExpandEnvironmentVariables($cfg.DumpFile)}else{"$env:SystemRoot\MEMORY.DMP"} if (Test-Path $full) { Get-Item $full | Select Name,Length,LastWriteTime | Format-Table -AutoSize } $mini = if($cfg.MinidumpDir){[Environment]::ExpandEnvironmentVariables($cfg.MinidumpDir)}else{"$env:SystemRoot\Minidump"} if (Test-Path $mini) { Get-ChildItem $mini -Filter *.dmp | Select Name,Length,LastWriteTime | Format-Table -AutoSize } Write-Output "--- BugCheck Reasoning (recent events) ---" $map = @{ '0x0000000A'='IRQL_NOT_LESS_OR_EQUAL - faulty/outdated driver accessed memory at high IRQL' '0x0000001E'='KMODE_EXCEPTION_NOT_HANDLED - unhandled kernel exception, often driver/hardware' '0x0000002E'='DATA_BUS_ERROR - typically bad RAM or hardware fault' '0x0000003B'='SYSTEM_SERVICE_EXCEPTION - exception in a system service, often driver-related' '0x00000050'='PAGE_FAULT_IN_NONPAGED_AREA - bad RAM or faulty driver/antivirus' '0x0000007A'='KERNEL_DATA_INPAGE_ERROR - disk-related problem' '0x0000007B'='INACCESSIBLE_BOOT_DEVICE - system could not find/access the boot device' '0x0000007E'='SYSTEM_THREAD_EXCEPTION_NOT_HANDLED - almost always a faulty driver' '0x0000007F'='UNEXPECTED_KERNEL_MODE_TRAP - hardware issue (CPU/RAM/overclocking)' '0x0000009F'='DRIVER_POWER_STATE_FAILURE - driver failed to respond to a power state change' '0x000000C2'='BAD_POOL_CALLER - driver mishandling memory (pool corruption)' '0x000000D1'='DRIVER_IRQL_NOT_LESS_OR_EQUAL - typically a network or GPU driver' '0x000000EF'='CRITICAL_PROCESS_DIED - a critical system process died, often malware/system corruption' '0x00000116'='VIDEO_TDR_FAILURE - GPU driver failed to respond in time (timeout)' '0x00000124'='WHEA_UNCORRECTABLE_ERROR - hardware fault (CPU/RAM/PSU/overclocking)' '0x00000133'='DPC_WATCHDOG_VIOLATION - faulty driver or storage subsystem issue' '0x00000139'='KERNEL_SECURITY_CHECK_FAILURE - corrupted kernel structure, possibly malware' } $events = Get-WinEvent -FilterHashtable @{LogName='System';Id=1001} -MaxEvents 100 -ErrorAction SilentlyContinue | Where-Object { $_.ProviderName -match 'WER-SystemErrorReporting' } | Select-Object -First 5 if (-not $events) { Write-Output "No BugCheck events found in the log." } foreach ($ev in $events) { $code = if ($ev.Message -match 'bugcheck was:\s*(0x[0-9A-Fa-f]+)') { $matches[1] } else { $null } Write-Output ("Time: {0}" -f $ev.TimeCreated) Write-Output ("Code: {0}" -f $(if($code){$code}else{'not recognized'})) if ($code -and $map.ContainsKey($code.ToUpper())) { Write-Output ("Meaning: {0}" -f $map[$code.ToUpper()]) } elseif ($code) { Write-Output "Meaning: unknown code, look up at learn.microsoft.com/windows-hardware/drivers/debugger/bug-check-code-reference2" } Write-Output "" } EndPowerShell: StartPowerShell: # This snippet lists all installed apps and their folder contents along with SHA256 hashes. Useful for troubleshooting malware abusing installed app entry. param( [switch]$Recurse, [int]$MaxFilesPerApp = [int]::MaxValue ) $uninstallPaths = @( 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*' ) $script:msiInstaller = $null function Get-MsiInstallLocation { param([string]$ProductCode) if (-not $script:msiInstaller) { try { $script:msiInstaller = New-Object -ComObject WindowsInstaller.Installer } catch { return $null } } try { $loc = $script:msiInstaller.ProductInfo($ProductCode, 'InstallLocation') if ([string]::IsNullOrWhiteSpace($loc)) { $loc = $script:msiInstaller.ProductInfo($ProductCode, 'InstallSource') } if ([string]::IsNullOrWhiteSpace($loc)) { return $null } return $loc } catch { return $null } } function Get-CleanPath { param([string]$RawValue) if ([string]::IsNullOrWhiteSpace($RawValue)) { return $null } $s = $RawValue.Trim() if ($s.StartsWith('"')) { $endQuote = $s.IndexOf('"', 1) if ($endQuote -gt 0) { return $s.Substring(1, $endQuote - 1) } } if ($s -match '^(.*?\.exe)\b') { return $Matches[1] } return $s } function Format-FileSize { param([long]$Bytes) if ($Bytes -ge 1GB) { return '{0:N2} GB' -f ($Bytes / 1GB) } if ($Bytes -ge 1MB) { return '{0:N2} MB' -f ($Bytes / 1MB) } if ($Bytes -ge 1KB) { return '{0:N2} KB' -f ($Bytes / 1KB) } return "$Bytes B" } $script:PeExtensions = @('.exe', '.dll', '.sys', '.ocx', '.cpl', '.scr', '.drv', '.efi', '.msi', '.msp', '.msu') function Test-IsPeFile { param([string]$Extension) return $script:PeExtensions -contains $Extension.ToLower() } function Get-SignatureInfo { param([string]$Path, [string]$Extension) if (-not (Test-IsPeFile -Extension $Extension)) { return [PSCustomObject]@{ Signer = 'N/A (not PE)'; Status = 'NotApplicable'; Valid = $false } } $result = [PSCustomObject]@{ Signer = 'Unsigned'; Status = 'NotSigned'; Valid = $false } try { $sig = Get-AuthenticodeSignature -LiteralPath $Path -ErrorAction Stop $result.Status = $sig.Status.ToString() $result.Valid = ($sig.Status -eq 'Valid') if ($sig.SignerCertificate) { if ($sig.SignerCertificate.Subject -match 'CN=([^,]+)') { $result.Signer = $Matches[1].Trim('"') } else { $result.Signer = $sig.SignerCertificate.Subject } if (-not $result.Valid) { $result.Signer += " [INVALID: $($result.Status)]" } } elseif ($sig.Status -eq 'NotSigned') { $result.Signer = 'Unsigned' } else { $result.Signer = "Unknown [$($result.Status)]" } } catch { $result.Signer = 'Verification error' $result.Status = 'Error' $result.Valid = $false } return $result } $rawApps = Get-ItemProperty -Path $uninstallPaths -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName -and $_.DisplayName.Trim() -ne '' } | Select-Object @{Name = 'Name'; Expression = { $_.DisplayName } }, @{Name = 'Version'; Expression = { $_.DisplayVersion } }, @{Name = 'Publisher'; Expression = { $_.Publisher } }, @{Name = 'InstallFolder'; Expression = { if ($_.InstallLocation -and $_.InstallLocation.Trim() -ne '') { $_.InstallLocation } elseif ($_.UninstallString -match 'MsiExec\.exe.*?(\{[0-9A-Fa-f\-]{36}\})') { $productCode = $Matches[1] $msiLoc = Get-MsiInstallLocation -ProductCode $productCode if ($msiLoc) { $msiLoc } else { "MSI: $productCode (location not found)" } } elseif ($_.UninstallString) { $_.UninstallString } else { 'N/A' } } } | Sort-Object Name -Unique foreach ($app in $rawApps) { $versionText = if ($app.Version) { $app.Version } else { '?' } $publisherText = if ($app.Publisher) { $app.Publisher } else { '?' } Write-Host "" Write-Host "<=== $($app.Name) [$versionText] ($publisherText) ===>" if ($app.InstallFolder -eq 'N/A' -or $app.InstallFolder -match '^MSI: .* \(location not found\)$') { Write-Host " Path: $($app.InstallFolder)" continue } $cleanPath = Get-CleanPath -RawValue $app.InstallFolder $exists = $false try { $exists = Test-Path -LiteralPath $cleanPath -ErrorAction Stop } catch [System.UnauthorizedAccessException] { Write-Host " Path: $cleanPath" Write-Host " [ACCESS DENIED]" continue } catch { Write-Host " Path: $cleanPath" Write-Host " [ERROR] cannot access" continue } if (-not $exists) { Write-Host " Path: $cleanPath" Write-Host " [NOT FOUND]" continue } $rootItem = Get-Item -LiteralPath $cleanPath -Force $created = $rootItem.CreationTime.ToString('dd/MM/yyyy HH:mm:ss') $modified = $rootItem.LastWriteTime.ToString('dd/MM/yyyy HH:mm:ss') if ($rootItem.PSIsContainer) { $subFolders = Get-ChildItem -LiteralPath $cleanPath -Directory -Force -ErrorAction SilentlyContinue $gciParams = @{ LiteralPath = $cleanPath; File = $true; Force = $true; ErrorAction = 'SilentlyContinue' } if ($Recurse) { $gciParams['Recurse'] = $true } $allFiles = Get-ChildItem @gciParams Write-Host " Path: $cleanPath | Created: $created | Modified: $modified | Files: $($allFiles.Count) | Folders: $($subFolders.Count)" foreach ($dir in $subFolders) { $dCreated = $dir.CreationTime.ToString('dd/MM/yyyy HH:mm:ss') $dModified = $dir.LastWriteTime.ToString('dd/MM/yyyy HH:mm:ss') $dFileCount = (Get-ChildItem -LiteralPath $dir.FullName -File -Force -ErrorAction SilentlyContinue).Count Write-Host (" [DIR] {0} - {1} - {2,10} - {3}" -f $dCreated, $dModified, "$dFileCount files", $dir.FullName) } } else { $allFiles = @($rootItem) Write-Host " Path: $cleanPath | Created: $created | Modified: $modified | Files: 1" } if ($allFiles.Count -eq 0) { continue } $shown = $allFiles | Select-Object -First $MaxFilesPerApp foreach ($f in $shown) { $hash = 'N/A' try { $hash = (Get-FileHash -LiteralPath $f.FullName -Algorithm SHA256 -ErrorAction Stop).Hash } catch { $hash = 'HASH-ERROR' } $size = Format-FileSize -Bytes $f.Length $fcreated = $f.CreationTime.ToString('dd/MM/yyyy HH:mm:ss') $fmod = $f.LastWriteTime.ToString('dd/MM/yyyy HH:mm:ss') $sigInfo = Get-SignatureInfo -Path $f.FullName -Extension $f.Extension Write-Host (" [{0}] {1} - {2} - {3,10} - Signer: {4} - {5}" -f $hash, $fcreated, $fmod, $size, $sigInfo.Signer, $f.FullName) } } EndPowerShell: Comment: List 30 recent scheduled tasks Powershell: Get-ScheduledTask | select -first 30 | Get-ScheduledTaskInfo Comment: List recent Run (Windows + R) executed commands, useful for identifying ClickFix attacks Powershell: (Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" -ErrorAction SilentlyContinue).PSObject.Properties | Where-Object { $_.Name -match "^[a-z]$" } | ForEach-Object { Write-Host "$($_.Name): $($_.Value)" } Comment: Remove unwanted files from common folders using native removal power of Farbar to include remove on reboot if needed. Please double check the user does not have any applications incorrectly installed in the directories listed below. C:\ProgramData\*.csproj C:\ProgramData\*.a3x C:\ProgramData\*.ahk C:\ProgramData\*.au3 C:\ProgramData\*.bat C:\ProgramData\*.cab C:\ProgramData\*.cmd C:\ProgramData\*.com C:\ProgramData\*.dll C:\ProgramData\*.exe C:\ProgramData\*.hta C:\ProgramData\*.jar C:\ProgramData\*.js C:\ProgramData\*.jse C:\ProgramData\*.lnk C:\ProgramData\*.pif C:\ProgramData\*.ps1 C:\ProgramData\*.py C:\ProgramData\*.pyc C:\ProgramData\*.pyd C:\ProgramData\*.scr C:\ProgramData\*.tmp C:\ProgramData\*.vbe C:\ProgramData\*.vbs C:\ProgramData\*.wsf C:\ProgramData\*.wsh C:\ProgramData\*.zip C:\ProgramData\*.rar C:\ProgramData\*.7z C:\Users\*\AppData\Roaming\*.csproj C:\Users\*\AppData\Roaming\*.au3 C:\Users\*\AppData\Roaming\*.bat C:\Users\*\AppData\Roaming\*.cab C:\Users\*\AppData\Roaming\*.cmd C:\Users\*\AppData\Roaming\*.com C:\Users\*\AppData\Roaming\*.dll C:\Users\*\AppData\Roaming\*.exe C:\Users\*\AppData\Roaming\*.hta C:\Users\*\AppData\Roaming\*.jar C:\Users\*\AppData\Roaming\*.js C:\Users\*\AppData\Roaming\*.jse C:\Users\*\AppData\Roaming\*.lnk C:\Users\*\AppData\Roaming\*.pif C:\Users\*\AppData\Roaming\*.ps1 C:\Users\*\AppData\Roaming\*.py C:\Users\*\AppData\Roaming\*.pyc C:\Users\*\AppData\Roaming\*.pyd C:\Users\*\AppData\Roaming\*.scr C:\Users\*\AppData\Roaming\*.tmp C:\Users\*\AppData\Roaming\*.vbe C:\Users\*\AppData\Roaming\*.vbs C:\Users\*\AppData\Roaming\*.wsf C:\Users\*\AppData\Roaming\*.wsh C:\Users\*\AppData\Roaming\*.zip C:\Users\*\AppData\Roaming\*.rar C:\Users\*\AppData\Roaming\*.7z C:\Users\CurrentUserName\AppData\Local\*.csproj C:\Users\CurrentUserName\AppData\Local\*.a3x C:\Users\CurrentUserName\AppData\Local\*.ahk C:\Users\CurrentUserName\AppData\Local\*.au3 C:\Users\CurrentUserName\AppData\Local\*.bat C:\Users\CurrentUserName\AppData\Local\*.cab C:\Users\CurrentUserName\AppData\Local\*.cmd C:\Users\CurrentUserName\AppData\Local\*.com C:\Users\CurrentUserName\AppData\Local\*.dll C:\Users\CurrentUserName\AppData\Local\*.exe C:\Users\CurrentUserName\AppData\Local\*.hta C:\Users\CurrentUserName\AppData\Local\*.jar C:\Users\CurrentUserName\AppData\Local\*.js C:\Users\CurrentUserName\AppData\Local\*.jse C:\Users\CurrentUserName\AppData\Local\*.lnk C:\Users\CurrentUserName\AppData\Local\*.pif C:\Users\CurrentUserName\AppData\Local\*.ps1 C:\Users\CurrentUserName\AppData\Local\*.py C:\Users\CurrentUserName\AppData\Local\*.pyc C:\Users\CurrentUserName\AppData\Local\*.pyd C:\Users\CurrentUserName\AppData\Local\*.scr C:\Users\CurrentUserName\AppData\Local\*.tmp C:\Users\CurrentUserName\AppData\Local\*.vbe C:\Users\CurrentUserName\AppData\Local\*.vbs C:\Users\CurrentUserName\AppData\Local\*.wsf C:\Users\CurrentUserName\AppData\Local\*.wsh C:\Users\CurrentUserName\AppData\Local\*.zip C:\Users\CurrentUserName\AppData\Local\*.rar C:\Users\CurrentUserName\AppData\Local\*.7z C:\Users\CurrentUserName\AppData\Roaming\*.csproj C:\Users\CurrentUserName\AppData\Roaming\*.a3x C:\Users\CurrentUserName\AppData\Roaming\*.ahk C:\Users\CurrentUserName\AppData\Roaming\*.au3 C:\Users\CurrentUserName\AppData\Roaming\*.bat C:\Users\CurrentUserName\AppData\Roaming\*.cab C:\Users\CurrentUserName\AppData\Roaming\*.cmd C:\Users\CurrentUserName\AppData\Roaming\*.com C:\Users\CurrentUserName\AppData\Roaming\*.dll C:\Users\CurrentUserName\AppData\Roaming\*.exe C:\Users\CurrentUserName\AppData\Roaming\*.hta C:\Users\CurrentUserName\AppData\Roaming\*.jar C:\Users\CurrentUserName\AppData\Roaming\*.js C:\Users\CurrentUserName\AppData\Roaming\*.jse C:\Users\CurrentUserName\AppData\Roaming\*.lnk C:\Users\CurrentUserName\AppData\Roaming\*.pif C:\Users\CurrentUserName\AppData\Roaming\*.ps1 C:\Users\CurrentUserName\AppData\Roaming\*.py C:\Users\CurrentUserName\AppData\Roaming\*.pyc C:\Users\CurrentUserName\AppData\Roaming\*.pyd C:\Users\CurrentUserName\AppData\Roaming\*.scr C:\Users\CurrentUserName\AppData\Roaming\*.tmp C:\Users\CurrentUserName\AppData\Roaming\*.vbe C:\Users\CurrentUserName\AppData\Roaming\*.vbs C:\Users\CurrentUserName\AppData\Roaming\*.wsf C:\Users\CurrentUserName\AppData\Roaming\*.wsh C:\Users\CurrentUserName\AppData\Roaming\*.zip C:\Users\CurrentUserName\AppData\Roaming\*.rar C:\Users\CurrentUserName\AppData\Roaming\*.7z Comment: RenPyLoader hollowed installed app generic removal C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.cmd C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.props C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.targets C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.tmp C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.csproj C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.user C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.cmd C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.cache C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.config C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.bat C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.cfg C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.props C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.targets C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.tmp C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.csproj C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.user C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.cmd C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.cache C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.config C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.bat C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.cfg C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.props C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.targets C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.tmp C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.csproj C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.user C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.cmd C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.cache C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.config C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.bat C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.cfg C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.props C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.targets C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.tmp C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.csproj C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.user C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.cmd C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.cache C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.config C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.bat C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.cfg C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.props C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.targets C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.tmp C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.csproj C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.user C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.cmd C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.cache C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.config C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.bat C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.cfg C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.props C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.targets C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.tmp C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.csproj C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.user C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.cmd C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.cache C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.config C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.bat C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.cfg C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.props C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.targets C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.tmp C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.csproj C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.cmd C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.user C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.cache C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.config C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.bat C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.cfg Comment: Remove cache C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\ C:\Users\CurrentUserName\AppData\Local\Roblox\UniversalApp\WebView2\EBWebView\Default\Cache\Cache_Data\ C:\Users\CurrentUserName\AppData\Local\FortniteGame\Saved\webcache\ C:\Users\CurrentUserName\AppData\Local\FortniteGame\Saved\webcache_4147\ C:\Users\CurrentUserName\AppData\Local\FortniteGame\Saved\webcache_4430\ C:\Users\CurrentUserName\AppData\Roaming\discord\Cache\Cache_Data\ C:\Users\CurrentUserName\AppData\Roaming\obs-studio\plugin_config\obs-browser\Cache\Cache_Data\ StartPowerShell: $ProfilesDirectory = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList').ProfilesDirectory $DisplayNames = @{ "chrome" = "Chrome" "firefox" = "Firefox" "opera" = "Opera" "operagx" = "Opera GX" "brave" = "Brave" "msedge" = "Edge" "vivaldi" = "Vivaldi" "librewolf" = "LibreWolf" "mullvad" = "Mullvad Browser" "zen" = "Zen" } $ProcessNameMap = @{ "operagx" = "opera" "mullvad" = "mullvadbrowser" } $trueCacheNames = @("Cache", "Code Cache", "DawnCache", "GPUCache", "GrShaderCache", "ShaderCache", "Shared Dictionary\cache") function Get-CacheDirs { param([string]$BrowserName, [string]$ProfilesDirectory) switch ($BrowserName) { "chrome" { $dir = "$ProfilesDirectory\*\AppData\Local\Google\Chrome\User Data" Get-ChildItem $dir -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName } } "firefox" { $dir = "$ProfilesDirectory\*\AppData\Local\Mozilla\Firefox\Profiles" Get-ChildItem $dir -Directory -Recurse -Include "cache2" -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName + '\entries' } } "opera" { $dir1 = "$ProfilesDirectory\*\AppData\Local\Opera Software" $r1 = Get-ChildItem $dir1 -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName } $dir2 = "$ProfilesDirectory\*\AppData\Roaming\Opera Software" $r2 = Get-ChildItem $dir2 -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName } $r1 + $r2 } "operagx" { $dir1 = "$ProfilesDirectory\*\AppData\Local\Opera Software\Opera GX Stable" $r1 = Get-ChildItem $dir1 -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName } $dir2 = "$ProfilesDirectory\*\AppData\Roaming\Opera Software\Opera GX Stable" $r2 = Get-ChildItem $dir2 -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName } $r1 + $r2 } "brave" { $dir = "$ProfilesDirectory\*\AppData\Local\BraveSoftware\Brave-Browser\User Data" Get-ChildItem $dir -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName } } "msedge" { $dir = "$ProfilesDirectory\*\AppData\Local\Microsoft\Edge\User Data" Get-ChildItem $dir -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName } } "vivaldi" { $dir = "$ProfilesDirectory\*\AppData\Local\Vivaldi\User Data" Get-ChildItem $dir -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName } } "librewolf" { $dir = "$ProfilesDirectory\*\AppData\Local\LibreWolf\Profiles" Get-ChildItem $dir -Directory -Recurse -Include "cache2" -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName + '\entries' } } "mullvad" { $dir = "$ProfilesDirectory\*\AppData\Local\Mullvad\MullvadBrowser\Profiles" Get-ChildItem $dir -Directory -Recurse -Include "cache2" -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName + '\entries' } } "zen" { $dir = "$ProfilesDirectory\*\AppData\Local\zen\Profiles" Get-ChildItem $dir -Directory -Recurse -Include "cache2" -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName + '\entries' } } } } function Format-Size { param([long]$Bytes) if ($Bytes -ge 1GB) { return '{0:N2} GB' -f ($Bytes / 1GB) } if ($Bytes -ge 1MB) { return '{0:N2} MB' -f ($Bytes / 1MB) } if ($Bytes -ge 1KB) { return '{0:N2} KB' -f ($Bytes / 1KB) } return "$Bytes B" } $BrowserKeys = @('chrome', 'firefox', 'opera', 'operagx', 'brave', 'msedge', 'vivaldi', 'librewolf', 'mullvad', 'zen') foreach ($key in $BrowserKeys) { $procName = if ($ProcessNameMap.ContainsKey($key)) { $ProcessNameMap[$key] } else { $key } Get-Process -Name $procName -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue } Start-Sleep -Seconds 5 $grandBytes = 0L $grandFiles = 0 $anyFound = $false foreach ($key in $BrowserKeys) { $cacheDirs = Get-CacheDirs -BrowserName $key -ProfilesDirectory $ProfilesDirectory if (-not $cacheDirs -or $cacheDirs.Count -eq 0) { continue } $anyFound = $true $displayName = $DisplayNames[$key] $browserBytes = 0L $browserFiles = 0 foreach ($cacheDir in $cacheDirs) { if (-not (Test-Path $cacheDir)) { continue } $items = Get-ChildItem -Path $cacheDir -Force -Recurse -ErrorAction SilentlyContinue $files = $items | Where-Object { -not $_.PSIsContainer } $bytes = ($files | Measure-Object -Property Length -Sum).Sum if (-not $bytes) { $bytes = 0 } $browserFiles += $files.Count $browserBytes += $bytes Get-ChildItem -Path "$cacheDir\*" -Force -ErrorAction SilentlyContinue | Remove-Item -Force -Recurse -ErrorAction SilentlyContinue } $grandBytes += $browserBytes $grandFiles += $browserFiles Write-Host ("{0,-16} freed {1,10} ({2} files)" -f $displayName, (Format-Size $browserBytes), $browserFiles) } if (-not $anyFound) { Write-Host "No cache found for any installed browser." } Write-Host "" Write-Host ("Total freed: {0} ({1} files)" -f (Format-Size $grandBytes), $grandFiles) EndPowerShell: Comment: Windows Recovery Environment (Windows RE) status and enable CMD: C:\Windows\System32\reagentc.exe /info CMD: C:\Windows\System32\reagentc.exe /enable Comment: Disable hidden file extensions REG: reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f REG: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt" /v "CheckedValue" /t REG_DWORD /d 0 /f Comment: Verify WMI repository, repair & verify again CMD: C:\Windows\System32\wbem\winmgmt.exe /verifyrepository CMD: C:\Windows\System32\wbem\winmgmt.exe /salvagerepository CMD: C:\Windows\System32\wbem\winmgmt.exe /verifyrepository Comment: To rebuild the performance counter library values CMD: "%WINDIR%\SYSTEM32\lodctr.exe /R" CMD: "%WINDIR%\SysWOW64\lodctr.exe /R" CMD: "C:\Windows\SYSTEM32\lodctr.exe /R" CMD: "C:\Windows\SysWOW64\lodctr.exe /R" Comment: Resync performance counter library values to WMI as well CMD: C:\Windows\System32\wbem\winmgmt.exe /resyncperf Comment: Force policy removal C:\Windows\System32\GroupPolicyUsers C:\Windows\System32\GroupPolicy CMD: C:\Windows\System32\gpupdate.exe /force Comment: Enable recovery environment CMD: C:\Windows\System32\bcdedit.exe /set {default} recoveryenabled yes Comment: Restore original Windows services configuration StartPowerShell: Set-Service -Name "Netlogon" -StartupType Manual Set-Service -Name "BITS" -StartupType Manual Set-Service -Name "Dhcp" -StartupType Automatic Set-Service -Name "EventLog" -StartupType Automatic Set-Service -Name "EventSystem" -StartupType Automatic Set-Service -Name "nsi" -StartupType Automatic Set-Service -Name "RasMan" -StartupType Manual Set-Service -Name "SDRSVC" -StartupType Manual Set-Service -Name "SstpSvc" -StartupType Manual Set-Service -Name "TrustedInstaller" -StartupType Manual Set-Service -Name "VSS" -StartupType Manual Set-Service -Name "Winmgmt" -StartupType Automatic Set-Service -Name "wuauserv" -StartupType Manual EndPowerShell: Comment: BITS reset Startbatch: @echo off C:\Windows\System32\net.exe stop BITS C:\Windows\System32\ipconfig.exe /flushdns ren "%programdata%\Microsoft\Network\Downloader\qmgr*.*" qmgr*.*.old C:\Windows\System32\net.exe start BITS Endbatch: cmd: C:\Windows\System32\bitsadmin.exe /reset /allusers Comment: Reset the Windows Update download cache and update catalog database CMD: C:\Windows\System32\net.exe stop wuauserv /y CMD: C:\Windows\System32\net.exe stop cryptSvc /y CMD: C:\Windows\System32\net.exe stop bits /y CMD: C:\Windows\System32\net.exe stop msiserver /y Unlock: C:\Windows\SoftwareDistribution CMD: ren C:\Windows\SoftwareDistribution SoftwareDistribution.old Unlock: C:\Windows\System32\CatRoot2 CMD: ren C:\Windows\System32\CatRoot2 CatRoot2.old CMD: C:\Windows\System32\net.exe start wuauserv /y CMD: C:\Windows\System32\net.exe start cryptSvc /y CMD: C:\Windows\System32\net.exe start bits /y CMD: C:\Windows\System32\net.exe start msiserver /y Comment: Resets icon cache StartBatch: del /a /q "%localappdata%\IconCache.db" del /a /f /q "%localappdata%\Microsoft\Windows\Explorer\iconcache*" del /a /f /q "%localappdata%\Microsoft\Windows\Explorer\thumbcache*" EndBatch: Comment: Enable automatic restart after a crash, enable automatic updates StartRegedit: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl] "AutoReboot"=dword:00000000 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU] "NoAutoUpdate"=- EndRegedit: Comment: Reset PowerShell execution policy Powershell: Set-ExecutionPolicy Unrestricted -Scope CurrentUser -Force Comment: Fully reset the Windows network stack, WinHTTP proxy settings, DNS cache, and BITS transfer queue. Comment: Thanks to AdvancedSetup from Malwarebytes StartBatch: C:\Windows\System32\ipconfig.exe /flushdns C:\Windows\System32\ipconfig.exe /release C:\Windows\System32\netsh.exe winsock reset catalog C:\Windows\System32\netsh.exe int ip reset C:\Windows\System32\netsh.exe winhttp reset proxy C:\Windows\System32\netsh.exe winhttp reset autoproxy C:\Windows\System32\netsh.exe winhttp reset tracing EndBatch: Comment: Additional temp file removal C:\Windows\System32\config\systemprofile\AppData\Local\*.tmp C:\WINDOWS\system32\*.tmp C:\WINDOWS\syswow64\*.tmp C:\Users\CurrentUserName\AppData\Local\Temp\* C:\Windows\Temp\* C:\Windows\SystemTemp\* C:\Windows\Prefetch\* Comment: System repair commands CMD: C:\Windows\System32\SFC.exe /scannow CMD: C:\Windows\System32\DISM.exe /Online /Cleanup-image /Restorehealth CMD: DISM.exe /Online /Cleanup-Image /StartComponentCleanup /ResetBase Comment: Remove set proxy servers RemoveProxy: Comment: Remove temporary files via FRST EmptyTemp: End::