DoesNotBelong

v12.2.9 (10.13.2026) - Database update - +Trojan.Rugmi - Registry whitelist updated - +TheAeroClock by Nenad Hrg v12.2.8 (10.12.2026) - Processes whitelist updated - DrWeb's spider agent - Database updated - Minor various - Security audit updated - Event ID 4672 no longer tracked. This felt too spammy to continue to allow to remain - GUPRepair updated - Added support for Windows 10 21H1 systems. This module responsible for restoring Windows Update services when broken by a specific BitCoinMiner

v12.2.7 (10.11.2026) - Database update - Medium various v12.2.6 (10.10.2026) - Minor adjustment to recent TROJ.Injector.AutoIt detection

v12.2.5 (10.07.2026) - Database update - Medium various v12.2.4 (10.04.2026) - Cache cleaning: +MSTeams v12.2.3 (09.30.2026) - Added new detections for TROJ.BTCMiner.GoogleUP & Trojan.Rugmi - Miscellaneous logs updated to the month of October 2026

v12.2.2 (09.27.2026) - The tool now attempts to fetch updates from ./downloads/DoesNotBelong.exe

v12.2.0 (09.26.2026) - Added new detections for Trojan.Rugmi & RacingSim v12.1.9 (09.25.2026) - Added new detections for Trojan.Rugmi v12.1.8 (09.20.2026) - Completed detections for Reason. Product that often seems to be silently installed without user consent. - Updated AV detections: +Avira - Optimization update: +Services - Updated autostarts whitelist: +UniGetUI v12.1.7 (09.17.2026) - Added new detections for Trojan.Rugmi - Process whitelist update: +Windows Defender component - Bug fix attempt: Some users have reported that the script hangs on stage 2 (Registry scan), effort was made to resolve this issue.

v12.1.6 (09.16.2026) - Database update: +Medium various v12.1.5 (09.14.2026) - Database update: +Small various - AV detection update: +Malwarebytes

v12.1.4 (09.10.2026) - Database update: +Small various - Optimization update - Resorts and other maintenance v12.1.3 (09.08.2026) - Added new detections for Trojan.Rugmi v12.1.2 (09.08.2026) - Database update: +Small various v12.1.1 (09.07.2026) - Database update: +Small various - Recent CpuVendor portion is now translated into remaining 30 languages v12.1.0 (09.07.2026) - Database update: +Chrome extensions from https://socket.dev/blog/chrome-edge-extension-wallet-drainer (Thanks Severnyj for bringing to my attention) - New: The tool will now also provide CpuVendor information in the log's header

v12.0.9 (09.05.2026) - Added new detections for TROJ.BitCoinMiner and RISK.NetSupport - Improved version detection for Brave Browser

v12.0.8 (08.31.2026) - Database update: +Rugmi v12.0.7 (08.30.2026) - Database update: +Adware.WorldWideWeb variant - Bug fix - Attrib.exe being used incorrectly in relation to Adware.WorldWideWeb heuristics - Miscellaneous logs update - September 2026 - Improved clean up routine for NetSupport Remote Access Tool in randomized folders

v12.0.6 (08.29.2026) - Database update - +Medium various - Improved detection for NetSupport Remote Access Tool in randomized folders - Process whitelist update - +Norton AV v12.0.5 (08.25.2026) - Database update - +Small various