DoesNotBelong

DoesNotBelong Changelog ===================== v9.6.7 (11.12.2025) - Database update - Bleeping goodies v9.6.6 (11.11.2025) - Database update - New Sys32 Heur v9.6.5 (11.10.2025) - Database update - Rugmi v9.6.4 (11.08.2025) - Database update v9.6.3 (11.08.2025) - Database update - New AIH check v9.6.2 (11.07.2025) - Database update - PSChecks - Process whitelist updated - Rising AV v9.6.1 (11.06.2025) - Database update - Backdoors + Intel 2.0 Telemetry - Other scan logs dates updated to month of November v9.6.0 (11.05.2025) - Database update v9.5.9 (11.03.2025) - Database update v9.5.8 (11.03.2025) - Database update - Optimizations v9.5.7 (11.02.2025) - Database update v9.5.6 (11.01.2025) - Database update - Process whitelist updated - Miscellaneous check for Lightspeed Filter Agent added v9.5.5 (11.01.2025) - Resolved an issue with latest 25H2 Windows Update Repair module which was affecting 24H2 from being enabled. v9.5.4 (11.01.2025) - Database update - Reddit gatherings - Windows Update Repair - Now offers support to 25H2 operating systems - Fixed false positive - Shorcut LDMultiPlayer.lnk v9.5.3 (10.31.2025) - Database update - Java Stealer v9.5.2 (10.30.2025) - Database update - Fast! / PCAppStore v9.5.1 (10.28.2025) - Database update - Public ClientRuntime v9.5.0 (10.28.2025) - General improvements mostly tied to attrib.exe usage v9.4.8 (10.26.2025) - Database update - Backdoor.Remcos v9.4.7 (10.26.2025) - Database update - TROJ.BTCMiner.GoogleUP v9.4.6 (10.25.2025) - Database update - TROJ.BTCMiner.GoogleUP - Removed Intel Graphics Experience Package detection v9.4.5 (10.25.2025) - Database update - TROJ.BTCMiner.GoogleUP v9.4.4 (10.25.2025) - Database update - TROJ.BTCMiner.GoogleUP v9.4.3 (10.24.2025) - Database update - New generic 'Temper' v9.4.2 (10.23.2025) - Database update - InfoForge, ScriptMaster - Microsoft Performance Counter files are no longer deleted. Now using lodctr /r instead - Removed provisioning packages that may have been out of place from detection v9.4.1 (10.21.2025) - Database update - Google extension, ValidateAdminCodeSignatures (ineffective) - Fixed false positive - Roaming\afuwinX64 (most likely BIOS util) v9.4.0 (10.19.2025) - Database update - Backdoor.Remcos - Additional TwTmp check - Removed the clearing of the CBSTemp folder due to potentially causing the script to have to enumerate more entries than anticipated v9.3.9 (10.17.2025) - Database update - Sys32 Dirs v9.3.8 (10.14.2025) - Database update - Zden, Intel Telemetry - AV detection updated + Sophos Enterprise v9.3.7 (10.12.2025) - Large update on how deletions occur to increase the success rate against more stubborn files / folders. v9.3.6 (10.12.2025) - Database update PCAppStore - Miscellaneous logs updated to month of October v9.3.5 (10.11.2025) - Database update PCAppStore ShiftBrowser. BrowserCore v9.3.4 (10.09.2025) - Database update - secure\QtWebKit4.dll v9.3.3 (10.07.2025) - Database update v9.3.2 (10.05.2025) - Database update v9.3.1 (10.05.2025) - Improved Stage 1 - Process killing. Any console errors should now be gone. Tested on Windows 10 and 11 x64 - On newer systems without WMIC.exe, powershell.exe is now able to terminate suspicious processes impersonating legitimate files even if they include encoded UTF8 - UTF16 filepaths. This should alleviate all previous 'binary file matches' found in logs - Fixed a bug that would occur during Packages scan. Wrong file read v9.3.0 (10.04.2025) - Improved Stage 1 - Process killing - Added a link for reporting bugs via Github to the log header - Added Donation Link line to footer of log. Donating helps me stay enthusiastic and motivated to continue finding improvements to the program - Removed detection for font cache for now. It may return later v9.2.9 (10.03.2025) -Updated resource icon v9.2.8 (10.01.2025) -Updated database: BitCoinMiner. figmaUpdater v9.2.7 (09.29.2025) -Updated database: Rugmi & BitCoinMiner -Bug fix: Database related v9.2.6 (09.29.2025) -Updated database

* Database updated * Task whitelist updated

* Task whitelist updated. Microsoft Intune related tasks * Database updated

* Task whitelist updated

* Added translations: Scottish Gaelic & Filipino

* Added automatic cleanup and repair of this registry value: HKLM\System\CurrentControlSet\Control\Lsa\\Authentication Packages. Tampered with by ScreenConnect * Added automatic cleanup for MountPoints2 registry keys. * Added a network repair routine for a particular case of ReasonLabs DNS install * Added Packages (AppXPackages) automatic clean up * Database updated

* Expanded on Registry searches. Now includes MountPoints2 locations * More fine tuning of AppXPackage removal. Supress error messages and continue. Trying to avoid having the Package itself prompt the user to restart before the tool can finish.

* Database update

* Database update * Stage 8 - Apply Fixes is now a bit more descriptive of which fixes are being carried out. There are currently 3: * * Repairing Network Connections. Please wait... * * Repairing Windows Update. Please wait... * * Repairing hijacked shorcuts. Please wait... * Added 'Computername' to the log header * Translations for these new items have also been added

* Database update * In the case of particular miner (TROJ.BTCMiner.GoogleUP) which breaks Windows Update functionality, the tool now stops the relevant services and a few others related to Windows Update before patching the registry for a greater chance of success. Afterwards, the services are restarted. This hopefully eliminates the need for the user to patch the registry while in Safe Mode, where those services are already in a stopped state.