I believe I may have installed malware. How can I check, and ideally get rid of it?

I know you've you've fixed most of this, but I prepared a Fixlist to sort out the hijacked services and other things that haven't been addressed.

• Download Fixlist.txt and save it in the Downloads folder where FRST64.exe is located.
• Close any apps with unsaved work.
• Run FRST64.exe and click "Fix".
• The computer will reboot to complete the process.

Please upload Fixlog.txt so I can check if any further action is needed.

Hello Tage,

Welcome to Microsoft Q&A forum. It's my pleasure to help you today.

I understand your concern that your computer might be affected with malware. I have checked the file you sent, while it is long and complicated, the main cause it pointed out is there is a few suspicious services and files.

For the files, the report shows that there is a suspicious file reside in these locations:

1. C:\ProgramData\Microsoft\WinMSIPS.{the computer GUID}\WmiPrvSE.exe. Task name:10714DESKTOP-HFETI7B
2. C:\Users<PII removed>\AppData\Roaming\WindowsSystemDiagnostics.{GUID}\svchost.exe. Task name: WindowsSystemUpdate

Why it is suspicious:

1. WmiPrvSE.exe and svchost.exe is a legitimate Windows process. However, they can only reside in C:\Windows\System32 as they are system files.
2. The location is not a location of system executables.
3. The folders itself is not a standard Windows folder.
4. No system app should run in the "Roaming" folder, this folder is where legitimate app store user data across sessions. So, it could be overlooked by detection.

The file also indicated that a few Registry entry restriction. It might also prevent your computer from working normally. And there are some suspicious services as well. Also, I see that the default browser of your PC is LibreWolf, may I know if this is the one you are using?

Since there are a lot of suspicious activity and anomalies in this. The best way forward is to reinstall Windows to reinstall all malware possible. However, here is a few things we can do before that.

• Run full scan using Windows Defender. Please open Windows Defender or any antivirus tool that you are using and perform a full system scan. You should quarantine any anomalies found.
• Remove the task from Task Scheduler
  1. Type Task Scheduler on the search bar and press Enter.
  2. Find and remove the 2 task names above.
• Remove the suspicious entry from registry. Disclaimer: Generally, modifying registry subkeys or work group is intended for advanced users, administrators, and IT Professionals. It can help fix some problems, however, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For further protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click How to back up and restore the registry in Windows - Microsoft Support to view the article.
  1. Type "regedit" on the search bar and press Enter.
  2. Find and delete the entry in these location:
     • HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
     • HKLM\SOFTWARE\Policies\Microsoft\MRT
  3. Restart your PC.
• Check running services.
  1. Type "Services" on the search bar and press Enter.
  2. Find the services called slump, swell, wellwellwell, pure and disable them.
  3. Check those service WaaSMedicSvc, usosvc, wuaueng, dosvc and make sure that they are running. They are core Windows Update Services.
• Remove suspicious file.
  1. Open file explorer and navigate to the 2 locations above.
  2. Delete the folder along with the executables file in it.

Disclaimer: Due to the big scale of the malware intrusion to your computer, I recommend that we try to perform a clean install to get your computer back into a working condition. Please ensure that you backup any important data, including Documents, Pictures, Videos, and more.   

You can find the installation file and the ISO file for your Windows 10 in the Microsoft website. To make sure that all the malware is gone we highly recommend you install Windows 10 while remove all files.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

-