DoesNotBelong is a lightweight and specialized program for additional system scanning that compliments the main antivirus. It helps to identify threats not detected by the main antivirus and is useful if you suspect an infection despite a “clean” scan result.
The name, DoesNotBelong, comes from its ability to find and remove files in locations where files do not belong.
How to run a scan on your computer
- Download DoesNotBelong.exe to your Desktop.
- Right-mouse click the saved file and select ‘Run as administrator’ to begin the scan.
- It is recommended to temporarily disable your antivirus software so it does not interfere with the scanner. Watch this video if you’d like to understand more of why sometimes antivirus detects unknown, new, or rarely downloaded software.
- Review the report which is created when the scan is complete. The log file can be found on your desktop or at C: That’s it! The tool removes itself after execution, which is also part of maintaining a clean PC so you don’t have to waste time trying to uninstalling or deleting it afterwards
FEATURES:
- Non-essential processes are closed for a brief period
- Full RunOnce registry cleaning.
- Full Task Scheduler cleaning.
- Checks for important files typically required by the operating system. If a file is missing, it is reported in the log’s Miscellaneous section.
- Clears these Event Viewer Logs: Application, Security, Setup, System, and ForwardedEvents.
- Clears caches from the following programs if they are installed: Microsoft Edge, Google Chrome, Vivaldi, Brave, Yandex, Mozilla Firefox, Floorp, Waterfox, Opera, Comodo Dragon, SteamLabs OBS, OBS Studio, Discord, DirectX, Java, Wire, Steam, uTorrent, Battle.net, CurseForge, LibreWolf, Mullvad, WoW, CRL URL Cache(?).
- Creates a System Restore Point named ‘DoesNotBelong PRESCAN’. Use this if there are any accidents caused by the tool. It is advised to create your own Restore Point first because the tool only allows 13 seconds to do the job before it moves on.
- Deletes BitsTransfer Jobs(?)
- Deletes Temporary Internet Files. Does not delete cookies so your existing logins are not affected.
- Lists any exclusions set for Windows Defender. This information is reported to the log’s Miscellaneous section. It can be useful to find the origin of the infection.
- Removes all push notifications(?) from Chromium based browsers. Supports up to 3 different profiles of Microsoft Edge, Google Chrome, Vivaldi, Brave, Yandex, Opera, and Comodo Dragon. The tool does not discriminate on which browser push notifications are good or bad. They are all considered bad by the tool. Video evidence of this type of automatic remediation here.
- These can also be accessed manually from within the affected browser using chrome://settings/content/notifications, edge://settings/content/notifications, brave://settings/content/notifications, etc… in the browser address bar. The tool is simply providing an automated way of handling this process.
- Reverses damage caused by a malware infection. This includes several types of registry hijacks, missing service keys, all of which may tampering with the ability to utilize other antivirus software. An example can be found in the video demonstration here.
- Shows crash dumps which can be analyzed using WinDbg in the Miscellaneous section.
- Shows event viewer logs from Windows Defender if the event ID # was equal to 3002. The purpose of this is a current work in progress related to BlackLotus. This alone is not evidence of an infection.
- Lists the filepaths, size, and creation date of logs from HitmanPro, Malwarebytes, and Sophos if they are from the current month. The quarantine contents of DrWeb, Farbar Recovery Scan Tool (FRST), and TDSSKiller are also appended to the Miscellaneous section of the report.
- Turns off the ‘Show me suggested content in the Settings app’ feature of Windows 10 and 11. More of a personal preference, but most users would consider this an annoyance created by the Windows operating system. [1]
Additional Information
- It is a portable program, and therefore, does not get added to the ‘Programs and Features’ list.
- A log file is created at C: and the Desktop after it runs so you can review the results: DoesNotBelong_[date]_[time].txt
- Both 32-bit and 64-bit of Windows 10 and 11 are supported. Older operating systems are not supported at this time and the script will close itself to prevent its use.
- The tool can also be run from Safe Mode or Safe Mode with Networking.
- Multiple languages are supported: English, Arabic, Bulgarian, Chinese, Czech, Dutch (Thanks to Maxstar), French, German (Thanks to MKDB), Greek, Hindi, Italian, Japanese, Korean, Polish (Thanks to Picasso), Portuguese, Russian (Thanks to Dragokas), Serbian, Spanish, Swedish, Turkish.
SUPPORT THE PROJECT:
Comments