Accounts hacked - Infostealer Trojan Infection

Also try the command as follows:

DISM /Online /Cleanup-Image /RestoreHealth /Source:WIM:C:\Image\Sources\install.wim /LimitAccess

Edited by JSntgRvr, 12 April 2024 - 09:35 PM.

No, the new command doesn't work either. This time i get

Error: 87

Looking this up online i found a potential solution; somebody used a "Tech Bench Upgrade Program ISO" to repair his Windows Image (https://answers.microsoft.com/en-us/windows/forum/all/resolved-dism-error-0x800f081f-the-source-files/1a58faa1-6e7a-4eac-8327-5e6888e0d57b)

The link for the Upgrade program ISO in the above discussion doesn't work.

From this page https://www.tenforums.com/windows-10-news/212442-kb5036892-windows-10-cumulative-update-build-19045-4291-22h2.html

I have found this link 

https://uupdump.net/selectlang.php?id=f4fcb90a-fde2-4bfa-8fc7-84ff8628643d

which supposedly will create an up to date .iso file.

I am waiting for your further instructions before downloading anything.

Here is the CBS.log

Edited by geofish, 13 April 2024 - 05:10 AM.

You already have the iso. What you need to do is a Repair with an in-place upgrade. You can find the instructions here:

Repair Install Windows 10 with an In-place Upgrade | Tutorials (tenforums.com)

Give it a try.

Thank you JSntgRvr,

I will try to do the repair install as soon as possible.

Just to be clear, there is a chance that my computer is still infected, right?

And this repair install will not affect my installed programs and settings, other than the things mentioned in the guide (fonts, icons, languages)?
 

According to the guide I must have an amount of free space on my C: drive. I am confused because there are two different instructions in the guide

A. at least 8.9 GB+ whatever Windows is currently using 

B. at least 20GB 

if a) is correct, then I need 8.9GB + 36.7GB (the size of my current Windows folder) = 45.6GB

Right now i have only 3.5GB free on my C: drive. I believe that before we begun these procedures i had close to 18GB of free space on my C: drive.

The .iso file on my desktop takes up 4.5GB, I believe i can move this to the D: drive.

The Image folder takes up almost 9GB on my C: drive. Can I simply delete this?

The FRST folder takes up 9GB on my C: drive. Can I delete this?

I could also disable the hyberfil.sys and pagefile.sys to free up 19GB.

This would sum up to ~45GB of free space.

If I clear temporary files and perform a disk cleanup then i might reach the required free space without needing to uninstall any programs.

Do you suggest any other tricks to free up space?

I dont have a Windows.old folder.

Is there any way to make the Windows folder smaller?

According to the guide I have to disable any 3rd party antivirus software.

I only use Windows Defender, but as I mentioned in my earlier post, I have setup the HardConfigurator and SimpleWindowsHardening programs to "Harden" the Windows Defender AV. I believe it would be best to disable these before attempting the repair, do you agree?

Edited by geofish, 13 April 2024 - 02:06 PM.

You can delete the Image folder. You will need the iso fie to create the Installation media. Remove Programs you do not use. 

7-Zip 19.00 (x64) (HKLM\...\7-Zip) (Version: 19.00 - Igor Pavlov)
A1TriggerGate version 1.4 (HKLM-x32\...\{B069846D-66D2-4A30-BB1C-0ADAA50E89DB}_is1) (Version: 1.4 - Alex Hilton / A1AUDIO.DE)
Ableton Live 11 Suite (HKLM\...\{7A330287-7165-47F2-B54D-C875E51DE1FB}) (Version: 11.0.0.0 - Ableton) Hidden
Ableton Live 11 Suite (HKLM-x32\...\{1debf041-c42f-4aca-839d-550648c00239}) (Version: 11.0.0.0 - Ableton)
Ableton Push Driver v5.50.0 (HKLM\...\{8CE98F88-3F07-4338-A036-B66414F3FD66}) (Version: 5.50.0 - Ableton) Hidden
Acer Quick Access (HKLM\...\{8BBF04F1-C68A-441C-B5EF-446EE9960EAF}) (Version: 2.01.3028 - Acer Incorporated)
Adobe Acrobat (64-bit) (HKLM\...\{AC76BA86-1033-FFFF-7760-BC15014EA700}) (Version: 24.001.20643 - Adobe)
Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 5.11.0.522.1 - Adobe Inc.)
Adobe Genuine Service (HKLM-x32\...\AdobeGenuineService) (Version: 8.4.0.63 - Adobe Inc.)
Adobe Illustrator 2019 (HKLM-x32\...\ILST_23_1) (Version: 23.1 - Adobe Systems Incorporated)
Adobe Refresh Manager (HKLM-x32\...\{AC76BA86-0804-1033-1959-018244601067}) (Version: 1.8.0 - Adobe Systems Incorporated) Hidden
Analog Lab V 5.8.0 (HKLM-x32\...\Analog Lab V_is1) (Version: 5.8.0 - Arturia)
ARIA Engine v1.9.7.3 (HKLM\...\ARIA Engine_is1) (Version: v1.9.7.3 - Plogue Art et Technologie, Inc)
Arturia Pigments (HKLM\...\Pigments_is1) (Version: 3.0.0.1375 - Arturia & Team V.R)
Arturia Software Center 2.7.1 (HKLM-x32\...\Arturia Software Center_is1) (Version: 2.7.1 - Arturia)
Arturia USB MIDI Driver v1.3.0 (HKLM-x32\...\Software_Arturia_arturiausbmidi_Setup) (Version: 1.3.0 - Arturia)
Audacity 3.0.2 (HKLM-x32\...\Audacity_is1) (Version: 3.0.2 - Audacity Team)
AutoCAD 2023 Shared (HKLM\...\{28B89EEF-6101-0000-4102-CF3F3A09B77D}) (Version: 24.2.161.0 - Autodesk) Hidden
AutoCAD 2023 Shared Language Pack - English (HKLM\...\{28B89EEF-6101-0409-5102-CF3F3A09B77D}) (Version: 24.2.153.0 - Autodesk) Hidden
Autodesk AutoCAD 2023 - English (HKLM\...\{73A78CE1-E03A-3415-826E-91A699E39B17}) (Version: 24.2.53.0 - Autodesk, Inc.)
Autodesk Identity Manager (HKLM\...\Autodesk Identity Manager) (Version: 1.10.4.0 - Autodesk)
Autodesk Interoperability Engine Manager (HKLM\...\{C4EFAB73-D98A-3676-A3F8-142FC78E0EF3}) (Version: 1.0.0.11 - Autodesk.com) Hidden
Autodesk Inventor Interoperability 2023 (HKLM\...\{E2B54F9E-FF26-47AE-9AE1-D7AFBC32DE0C}) (Version: 27.0.13400.0000 - Autodesk) Hidden
Autodesk Material Library 2023 (HKLM-x32\...\{8E133591-B0FD-4DB0-B60E-FB593CAF72B0}) (Version: 21.0.1.1 - Autodesk)
Autodesk Material Library Base Resolution Image Library 2023 (HKLM-x32\...\{3B564A94-BA47-4E42-ACD6-B5C35291210B}) (Version: 21.0.1.1 - Autodesk)
Autodesk Network License Manager (HKLM\...\{4BE91685-1632-47FC-B563-A8A542C6664C}) (Version: 11.16.2.0 - Autodesk, Inc.)
AutoHotkey 1.1.32.00 (HKLM\...\AutoHotkey) (Version: 1.1.32.00 - Lexikos)
Backmask version 1.0 (HKLM\...\{8A6411FB-7E85-4B61-9624-C624C89B9A07}_is1) (Version: 1.0 - Freakshow Industries)
BIG-IP Edge Client (HKLM-x32\...\{6D4839CB-28B4-4070-8CA7-612CA92CA3D0}) (Version: 72.23.0718.0858 - F5 Networks, Inc.)
BIG-IP Edge Client Components (All Users) (HKLM-x32\...\F5 Networks Client Components) (Version: 72.2023.0718.0858 - F5 Networks, Inc.)
Bitdefender Agent (HKLM\...\Bitdefender Agent) (Version: 27.0.1.266 - Bitdefender)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Brave (HKLM-x32\...\BraveSoftware Brave-Browser) (Version: 123.1.64.122 - Brave Software Inc)
BS.Player FREE (HKLM-x32\...\BSPlayerf) (Version: 2.74.1085 - AB Team, d.o.o.)
CanoScan Toolbox Ver4.9 (HKLM-x32\...\{CA9BCD4D-B782-4637-8F1F-F9A328D3C244}) (Version:  - )
Cardinal version 22.10 (HKLM\...\Cardinal_is1) (Version: 22.10 - DISTRHO)
Chrome Remote Desktop Host (HKLM-x32\...\{B3DF9767-C635-4558-A655-D586070E2CE3}) (Version: 124.0.6367.18 - Google LLC)
Core Temp 1.15.1 (HKLM\...\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1) (Version: 1.15.1 - ALCPU)
CPUID HWMonitor 1.41 (HKLM\...\CPUID HWMonitor_is1) (Version: 1.41 - CPUID, Inc.)
DAEMON Tools Lite (HKLM\...\DAEMON Tools Lite) (Version: 10.11.0.1001 - Disc Soft Ltd)
Discord (HKU\S-1-5-21-1286322575-3200454710-2639170948-1001\...\Discord) (Version: 0.0.311 - Discord Inc.)
Dolby Audio X2 Windows API SDK (HKLM\...\{F994125B-7BF5-4A38-A569-82833CEB24DC}) (Version: 0.8.4.83 - Dolby Laboratories, Inc.)
DumpsterFire version 1.01 (HKLM\...\{B2F19491-19F8-4116-966F-06B581001600}}_is1) (Version: 1.01 - Freakshow Industries)
Efx REFRACT 1.0.0 (HKLM-x32\...\Efx REFRACT_is1) (Version: 1.0.0 - Arturia)
ELAN FingerPrint (HKLM\...\ElanFP) (Version: 1.6.10.1102 - ELAN Microelectronic Corp.)
ELAN HIDI2C Filter Driver X64 13.6.7.2_WHQL (HKLM\...\Elantech) (Version: 13.6.7.2 - ELAN Microelectronic Corp.)
Electric Sheep 3.0.2 (HKLM-x32\...\Electric Sheep) (Version: 3.0.2 - Electricsheep)
Electric Sheep HD version 20200622 (HKLM-x32\...\{4914324E-3650-433D-8127-3D98A5DA489D}_is1) (Version: 20200622 - Electric Sheep HD)
Epic Games Launcher Prerequisites (x64) (HKLM\...\{66C5838F-B854-4A55-89E6-A6138747A4DF}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden
Eventide Ensemble Bundle (HKLM\...\Eventide Ensemble Bundle_is1) (Version: 2.14.4 - Eventide)
Exponential Audio Excalibur (HKLM\...\Excalibur_is1) (Version: 5.0.0 - Exponential Audio)
Exponential Audio PhoenixVerb (HKLM\...\PhoenixVerb_is1) (Version: 6.0.1 - Exponential Audio)
FabFilter Total Bundle (HKLM\...\FabFilter Total Bundle_is1) (Version: 2019.03.13 - FabFilter)
Focusrite Audio Drivers 4.119.13.33 (HKLM\...\Focusrite Audio Drivers_is1) (Version: 4.119.13.33 - Focusrite Audio Engineering, Ltd.)
Focusrite Control 3.17.0.179 (HKLM\...\Focusrite Control_is1) (Version: 3.17.0.179 - Focusrite Audio Engineering Ltd.)
Fraqtive 0.4.8 (64-bit) (HKLM\...\Fraqtive) (Version: 0.4.8 - Michał Męciński)
Geeks3D FurMark 1.21.1.0 (HKLM-x32\...\{2397CAD4-2263-4CD0-96BE-E43A980B9C9A}_is1) (Version:  - Geeks3D)
Genshin Impact (HKLM\...\Genshin Impact) (Version: 2.31.0.0 - COGNOSPHERE PTE. LTD.)
Ghostscript GPL 8.64 (Msi Setup) (HKLM-x32\...\_{06CD45E6-FF5E-4D8E-BC01-B276A90DADF2}) (Version: 8.64 - Corel Corporation)
Ghostscript GPL 8.64 (Msi Setup) (HKLM-x32\...\{06CD45E6-FF5E-4D8E-BC01-B276A90DADF2}) (Version: 8.64 - Corel Corporation) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 123.0.6312.122 - Google LLC)
Image Composite Editor (HKLM\...\{92AB5708-1AAA-4B1B-A8D5-45CF3AD77519}) (Version: 2.0.3 - Microsoft Corporation)
Infected Mushroom - Gatekeeper version 1.2 (HKLM\...\{B6807461-431E-433F-9D7F-9D38A96ADA7C}_is1) (Version: 1.2 - Polyverse Music, Inc.)
Infected Mushroom - I Wish version 1.01 (HKLM\...\{25772CF9-4EEE-4D1A-9FE7-29A4B91B3422}_is1) (Version: 1.01 - Polyverse Music, Inc.)
IrfanView 4.66 (64-bit) (HKLM\...\IrfanView64) (Version: 4.66 - Irfan Skiljan)
iZotope Nectar 3 Elements (HKLM\...\Nectar 3 Elements) (Version: 3.8.0 - iZotope, Inc.)
iZotope Ozone 9 (HKLM\...\Ozone 9_is1) (Version: 9.1.0 - iZotope)
iZotope Stutter Edit (HKLM\...\Stutter Edit_is1) (Version: 1.0.5c - iZotope)
iZotope Trash 2 (HKLM\...\Trash 2_is1) (Version: 2.0.5d - iZotope)
JACK2 version v1.9.17 (HKLM\...\JACK2_is1) (Version: v1.9.17 - jackaudio.org)
LatencyMon 6.71 (HKLM\...\LatencyMon_is1) (Version:  - Resplendence Software Projects Sp.)
Launcher Prerequisites (x64) (HKLM-x32\...\{c6c5a357-c7ca-4a5f-9789-3bb1af579253}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden
LibreOffice 7.5.2.2 (HKLM\...\{B722792A-A194-4906-97A9-58CA688304E8}) (Version: 7.5.2.2 - The Document Foundation)
Limbo v3.0.0.1a (12082) (HKLM-x32\...\{8E776FF8-LIMB-432B-BD2A-OBSCURE151A9}_is1) (Version:  - Playdead)
Little Nightmares II - Enhanced Edition (HKLM-x32\...\{10FF8C5E-3590-4DD5-99C8-5B1B5E90698F}_dixen18_is1) (Version:  - dixen18)
Logitech Options (HKLM\...\LogiOptions) (Version: 10.10.58 - Logitech)
Malwarebytes version 4.6.11.320 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 4.6.11.320 - Malwarebytes)
Mario Kart 8 Deluxe (HKLM-x32\...\Mario Kart 8 Deluxe_is1) (Version:  - )
Mario Party Superstars (HKLM-x32\...\Mario Party Superstars_is1) (Version:  - )
MeldaProduction Audio Plugins 14 (HKLM-x32\...\MeldaProduction Audio Plugins 14) (Version:  - MeldaProduction)
Melodics version 3.1.1856.0 (HKLM\...\Melodics_is1) (Version: 3.1.1856.0 - )
Mendeley Desktop 1.19.4 (HKLM-x32\...\Mendeley Desktop) (Version: 1.19.4 - Mendeley Ltd.)
Microsoft .NET Core Host - 3.1.10 (x64) (HKLM\...\{52B42932-15C1-45D4-8904-FC3117EEE69B}) (Version: 24.104.29419 - Microsoft Corporation) Hidden
Microsoft .NET Core Host FX Resolver - 3.1.10 (x64) (HKLM\...\{752B4412-A129-4CB2-AD96-B6D97EAD3090}) (Version: 24.104.29419 - Microsoft Corporation) Hidden
Microsoft .NET Core Runtime - 3.1.10 (x64) (HKLM\...\{396D7BC8-E3C8-4B3E-8C60-D50D94FDF09D}) (Version: 24.104.29419 - Microsoft Corporation) Hidden
Microsoft .NET Core Runtime - 3.1.10 (x64) (HKLM-x32\...\{4714dd0a-ebab-4f59-a708-f8d7a793b3f5}) (Version: 3.1.10.29419 - Microsoft Corporation)
Microsoft 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 16.0.17425.20146 - Microsoft Corporation)
Microsoft ASP.NET Core 3.1.10 - Shared Framework (HKLM-x32\...\{6efe3294-03d8-4977-9c67-9f57ab075130}) (Version: 3.1.10.20520 - Microsoft Corporation)
Microsoft ASP.NET Core 3.1.10 Shared Framework (x64) (HKLM\...\{7BEAA207-E3EB-3948-BBB3-336B04D8A2F1}) (Version: 3.1.10.20520 - Microsoft Corporation) Hidden
Microsoft Edge (HKLM-x32\...\Microsoft Edge) (Version: 123.0.2420.81 - Microsoft Corporation)
Microsoft Edge WebView2 Runtime (HKLM-x32\...\Microsoft EdgeWebView) (Version: 123.0.2420.81 - Microsoft Corporation)
Microsoft Keyboard Layout Creator 1.4 (HKLM-x32\...\{99E66BC9-E4B6-485F-ABFC-31EFCE36DFDF}) (Version: 1.4.6000 - Microsoft Corp.)
Microsoft OneDrive (HKLM\...\OneDriveSetup.exe) (Version: 24.055.0317.0002 - Microsoft Corporation)
Microsoft Update Health Tools (HKLM\...\{1FC1A6C2-576E-489A-9B4A-92D21F542136}) (Version: 3.74.0.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.61030 (HKLM\...\{37B8F9C7-03FB-3253-8781-2517C99D7C00}) (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.61030 (HKLM\...\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}) (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 (HKLM-x32\...\{B175520C-86A2-35A7-8619-86DC379688B9}) (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 (HKLM-x32\...\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}) (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{b3c7f59f-dc40-4be9-829c-77dd292978ea}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40664 (HKLM-x32\...\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}) (Version: 12.0.40664.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.40664 (HKLM-x32\...\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}) (Version: 12.0.40664.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.40664 (HKLM\...\{010792BA-551A-3AC0-A7EF-0FAB4156C382}) (Version: 12.0.40664 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.40664 (HKLM\...\{53CF6934-A98D-3D84-9146-FC4EDF3D5641}) (Version: 12.0.40664 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.40664 (HKLM-x32\...\{D401961D-3A20-3AC7-943B-6139D5BD490A}) (Version: 12.0.40664 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.40664 (HKLM-x32\...\{8122DAB1-ED4D-3676-BB0A-CA368196543E}) (Version: 12.0.40664 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (HKLM-x32\...\{8bdfe669-9705-4184-9368-db9ce581e0e7}) (Version: 14.36.32532.0 - Microsoft Corporation)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (HKLM-x32\...\{410c0ee1-00bb-41b6-9772-e12c2828b02f}) (Version: 14.36.32532.0 - Microsoft Corporation)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (HKLM\...\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}) (Version: 14.36.32532 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (HKLM\...\{D5D19E2F-7189-42FE-8103-92CD1FA457C2}) (Version: 14.36.32532 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (HKLM-x32\...\{C2C59CAB-8766-4ABD-A8EF-1151A36C41E5}) (Version: 14.36.32532 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (HKLM-x32\...\{73F77E4E-5A17-46E5-A5FC-8A061047725F}) (Version: 14.36.32532 - Microsoft Corporation) Hidden
Microsoft Visual Studio Tools for Applications 2017 (HKLM-x32\...\{5a7dc0ad-cdb2-43b5-8b82-f81065fe6092}) (Version: 15.0.26717 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2017 x64 Hosting Support (HKLM\...\{10AB056B-1B8C-3E9E-95CC-43C33EB88513}) (Version: 15.0.26717 - Microsoft Corporation) Hidden
Microsoft Visual Studio Tools for Applications 2017 x86 Hosting Support (HKLM-x32\...\{AB46A6EF-12D2-3146-A38D-1D6FF1AFFF69}) (Version: 15.0.26717 - Microsoft Corporation) Hidden
MIDI Control Center 1.17.2 (HKLM\...\MIDI Control Center_is1) (Version: 1.17.2 - Arturia)
MiKTeX 2.9 (HKU\S-1-5-21-1286322575-3200454710-2639170948-1001\...\MiKTeX 2.9) (Version: 2.9 - MiKTeX.org)
MISHBY version 1.01 (HKLM\...\{8437C1FD-5B4B-4DE9-90B5-0AB18C2FD0A0}}_is1) (Version: 1.01 - Freakshow Industries)
MOTU M Series (HKLM\...\com_motu_installer_core_uac_is1) (Version: 4.0.9.2368 - MOTU, Inc.)
Mp3tag v3.11 (HKLM-x32\...\Mp3tag) (Version: 3.11 - Florian Heidenreich)
MSI Afterburner 4.6.2 (HKLM-x32\...\Afterburner) (Version: 4.6.2 - MSI Co., LTD)
Native Instruments Guitar Rig 7 (HKLM-x32\...\Native Instruments Guitar Rig 7) (Version: 7.0.1.0 - Native Instruments)
NetLimiter (HKLM\...\{62394CDE-18AB-492D-B110-6D26DF85D767}) (Version: 5.3.8.0 - Locktime Software) Hidden
NetLimiter (HKLM-x32\...\NetLimiter 5.3.8.0) (Version: 5.3.8.0 - Locktime Software)
NoteBook FanControl (HKLM-x32\...\{6ccab7ac-feb0-4395-97e3-75cd6f6c407b}) (Version: 1.6.3.0 - Stefan Hirschmann - StagWare)
NoteBook FanControl (HKLM-x32\...\{C027E819-C64C-443E-B6D5-755FE4A7A925}) (Version: 1.6.3.0 - Stefan Hirschmann - StagWare) Hidden
Notepad++ (64-bit x64) (HKLM\...\Notepad++) (Version: 8.6.2 - Notepad++ Team)
NVIDIA FrameView SDK 1.3.8513.32290073 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_FrameViewSdk) (Version: 1.3.8513.32290073 - NVIDIA Corporation)
NVIDIA GeForce Experience 3.27.0.120 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 3.27.0.120 - NVIDIA Corporation)
NVIDIA Graphics Driver 546.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 546.65 - NVIDIA Corporation)
NVIDIA HD Audio Driver 1.3.40.14 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.40.14 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.21.0713 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.21.0713 - NVIDIA Corporation)
Office 16 Click-to-Run Extensibility Component (HKLM\...\{90160000-008C-0000-1000-0000000FF1CE}) (Version: 16.0.17425.20146 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (HKLM\...\{90160000-007E-0000-1000-0000000FF1CE}) (Version: 16.0.17425.20146 - Microsoft Corporation) Hidden
PACE License Support Win64 (HKLM\...\{01421942-1A1E-4035-B183-DD9BCA94E339}) (Version: 5.7.0.4246 - PACE Anti-Piracy, Inc.) Hidden
PACE License Support Win64 (HKLM-x32\...\InstallShield_{01421942-1A1E-4035-B183-DD9BCA94E339}) (Version: 5.7.0.4246 - PACE Anti-Piracy, Inc.)
PaulXStretch version 1.6.0 (HKLM\...\PaulXStretch_is1) (Version: 1.6.0 - )
Plogue AlterEgo v1.573 (HKLM\...\__ARIA_1019___is1) (Version: v1.573 - Plogue)
Pocket Dimension version 1.0 (HKLM\...\{C2288D66-1B82-468A-95E6-06D400AF3FD2}}_is1) (Version: 1.0 - Freakshow Industries)
Polyspace R2019b (HKLM\...\Polyspace R2019b) (Version: 3.1 - MathWorks)
Polyverse Music Gatekeeper (HKLM\...\Gatekeeper_is1) (Version: 1.2.0 - Polyverse Music)
Polyverse Music Manipulator (HKLM\...\Manipulator_is1) (Version: 1.0.1 - Polyverse Music)
Portal version 1.0.1 (HKLM\...\Portal_is1) (Version: 1.0.1 - Output)
Product Portal (HKLM-x32\...\Product Portal) (Version:  - iZotope, Inc.)
RAPID Mode (HKLM\...\{431CA680-1FEF-46E2-9634-C0F3E85B56E0}) (Version: 1.0.1.105 - Samsung Electronics Co., Ltd.) Hidden
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 10.0.15063.31235 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.8295 - Realtek Semiconductor Corp.)
Recuva (HKLM\...\Recuva) (Version: 1.53 - Piriform)
Revo Uninstaller 2.4.5 (HKLM\...\{A28DBDA2-3CC7-4ADC-8BFE-66D7743C6C97}_is1) (Version: 2.4.5 - VS Revo Group, Ltd.)
RivaTuner Statistics Server 7.2.3 (HKLM-x32\...\RTSS) (Version: 7.2.3 - Unwinder)
Samsung Magician (HKLM-x32\...\{29AE3F9F-7158-4ca7-B1ED-28A73ECDB215}_is1) (Version: 6.0.0.100 - Samsung Electronics)
ShaperBox v2.1.0 (HKLM\...\ShaperBox 2_is1) (Version: 2.1.0 - CableGuys & Team V.R)
Signal 6.6.0 (HKU\S-1-5-21-1286322575-3200454710-2639170948-1001\...\7d96caee-06e6-597c-9f2f-c7bb2e0948b4) (Version: 6.6.0 - Signal Messenger, LLC)
Slate Digital Fresh Air (HKLM\...\{af2fe7e8-08f8-4c81-b875-ec4c7a97a204}Slate Digi~4955043A_is1) (Version: 1.0.8 - Slate Digital)
Sonic Academy KICK 2 (HKLM\...\KICK 2_is1) (Version: 1.1.1 - Sonic Academy)
soothe2 audio processor version 1.3.1 (HKLM-x32\...\{8E8F4A61-FA08-4CAB-8F5A-AF25CEE4F3FE}_is1) (Version: 1.3.1 - oeksound)
SPC Gear GK550 Omnis Kailh RGB (HKLM-x32\...\{12F382E1-63D4-4B94-BD32-5F845E74FC79}) (Version: 1.00 - COOLING.PL Zdziech Spolka Jawna)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Synapse Audio DUNE 3 (HKLM\...\DUNE 3_is1) (Version: 3.2.0.5 - Synapse Audio)
TeamViewer (HKLM-x32\...\TeamViewer) (Version: 15.52.4 - TeamViewer)
Thermo Scientific TM Avizo Software 2019.1 (HKLM\...\Avizo Software 2019.1_is1) (Version: 2019.1. - )
Unfiltered Audio Plugins Bundle (HKLM\...\Unfiltered Audio Plugins Bundle_is1) (Version: 2022.3 - Unfiltered Audio & Team V.R)
Update for Windows 10 for x64-based Systems (KB5001716) (HKLM\...\{B9A7A138-BFD5-4C73-A269-F78CCA28150E}) (Version: 8.94.0.0 - Microsoft Corporation)
US - Custom - Custom (HKLM\...\{E2280A27-9AD8-45F3-866A-14318CEE3A19}) (Version: 1.0.3.40 - Company)
Valhalla DSP bundle 2021.4 (HKLM\...\ValhallaDSP bundle_is1) (Version: 2021.4 - Valhalla DSP, LLC & Team V.R)
VCV Rack (HKLM\...\VCV Rack) (Version: 1.1.6 - VCV)
Vital version 1.5.5 (HKLM\...\Vital_is1) (Version: 1.5.5 - )
VLC media player (HKLM\...\VLC media player) (Version: 3.0.11 - VideoLAN)
Voltage Modular (HKLM\...\Voltage Modular) (Version: 1.3.16 - Cherry Audio)
Voxengo PHA-979 (HKLM\...\Voxengo PHA-979_is1) (Version: 2.9 - Voxengo)
Voxengo SPAN (HKLM\...\Voxengo SPAN_is1) (Version: 3.10 - Voxengo)
Vulkan Run Time Libraries 1.0.33.0 (HKLM\...\VulkanRT1.0.33.0) (Version: 1.0.33.0 - LunarG, Inc.) Hidden
Vulkan Run Time Libraries 1.0.33.0 (HKLM\...\VulkanRT1.0.33.0-2) (Version: 1.0.33.0 - LunarG, Inc.)
Waves Central (HKLM\...\{ab507e17-892b-5203-838d-d58d8d09c50f}) (Version: 11.0.58 - Waves Audio Ltd)
Waves SoundGrid Drivers 9.7.99.1159 (HKLM\...\Waves SoundGrid Drivers_is1) (Version:  - Waves Audio Ltd.)
Windows PC Health Check (HKLM\...\{6798C408-2636-448C-8AC6-F4E341102D27}) (Version: 3.6.2204.08001 - Microsoft Corporation)
Windscribe (HKLM\...\{fa690e90-ddb0-4f0c-b3f1-136c084e5fc7}_is1) (Version: 2.7.14 - Windscribe Limited)
Yuzu EA (HKLM-x32\...\Yuzu EA_is1) (Version:  - )
Zebralette3 0.0.1 (HKLM\...\Zebralette3_is1) (Version:  - )
Zoom (HKU\S-1-5-21-1286322575-3200454710-2639170948-1001\...\ZoomUMX) (Version: 5.13.11 (13434) - Zoom Video Communications, Inc.)
Zynaptiq INTENSITY (HKLM\...\INTENSITY_is1) (Version: 1.2.0 - Zynaptiq)

Edited by JSntgRvr, 13 April 2024 - 03:02 PM.

Its really not easy for me to do the repair install if most of the programs wont work afterwards. I use all of these programs, and it will take me weeks to bring everything back to a working state.

I might consider buying a new computer and keep using this one only offline from now on.

Im trying to understand the situation here, do you believe there is a chance that my computer is still infected?

Do I have to repair the corrupted files to get rid of any potential malware? Are there alternative ways to repair the corrupted files?

What about the DISM RestoreHealth? Maybe I can try another .iso file?

Edited by geofish, 13 April 2024 - 05:53 PM.

The computer will work as it is. No need to recover unless it crashes. Make sute you have the installation media handy, just in case, as well as the product key.

Lets clean-up.
 
Use this application to remove tools used and their quarantined items:
 
Please download KpRm by Kernel-panik and save to your Desktop.

• Click on KpRm.exe to run the tool.

Vista/Windows 7/8/10 users right-click and select Run As Administrator.

• Put a check mark next to these items:

- Delete tools

- Create Restore Point

- Delete now

• Click the "Run" button.

• When the tool has finished, it will create and open a log report and delete itself.

A few final recommendations:
 
The following information will help you to keep your computer and data safer as well as improve your overall privacy

• Recommend using a Password Manager for all websites, etc. that require a password. Never use the same password on more than one site.
  https://www.howtogeek.com/780233/best-password-manager/
• Make sure you're backing up your files https://forums.malwarebytes.com/topic/136226-backup-software/
• Keep all software up to date - PatchMyPC - https://patchmypc.com/home-updater#download     https://patchmypc.com/about-us
• Keep your Operating System up to date and current at all times - https://support.microsoft.com/en-us/windows/windows-update-faq-8a903416-6f45-0718-f5c7-375e92dddeb2
• Further tips to help protect your computer data and improve your privacy: https://forums.malwarebytes.com/topic/258363-tips-to-help-protect-from-infection/
• Please consider installing the following Content Blockers for your Web browsers if you haven't done so already. This will help improve overall security

Malwarebytes Browser Guard

•   Google Chrome: https://chrome.google.com/webstore/detail/malwarebytes-browser-guar/ihcjicgdanjaechkgeegckofjjedodee
•   Microsoft Edge: https://support.malwarebytes.com/hc/en-us/articles/4413298736787-Install-Malwarebytes-Browser-Guard-on-Microsoft-Edge-browser
•   Mozilla Firefox: https://addons.mozilla.org/en-US/firefox/addon/malwarebytes/

uBlock Origin

• Google Chrome: https://chrome.google.com/webstore/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm
• Microsoft Edge: https://microsoftedge.microsoft.com/addons/detail/ublock-origin/odfafepnkmbhccpbejgmiehpchacaeak
• Mozilla Firefox: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin

Cybersecurity basics & protection
 
Everything you need to know about cybercrime
https://www.malwarebytes.com/cybersecurity
 
Further reading if you'd like to keep up on the malware threat scene: Malwarebytes Blog  https://blog.malwarebytes.com/
 
Please review the following to help you better protect your computer and privacy
 
Tips to help protect from infection
 
Hopefully, we've been able to assist you with correcting your system issues.
 
Thank you for using BleepinComputers. Please tell your friends and family if they too need assistance with malware removal

so that means that the malware is gone? I can login to my accounts again from this computer without fear?

This is amazing news! thank you for the cleaning and all the recommendations and tips!

Would you like to explain to me what you accomplished with the FRST fixlist? was there still malware on my system that you removed?

Yes. I see no malware in your system.

The Fixlist empty weird files in the ProgramData folder as well as Orphaned entries. In addition emptied the following:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Discord cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin

We also reset some of the settings to default.

Thanks my friend! you can't believe how grateful I am!
my past 2 weeks have been such a nightmare, now I can finally relax!