A relentless malware cyber attack. Please assist.

A list of all files including hidden folders on my drive:

02/04/2025 11:34 pm .

05/02/2025 12:57 pm ..

14/02/2025 12:33 pm .android

23/02/2025 03:36 am .dotnet

22/01/2025 09:29 am .SOClassCache

05/02/2025 01:08 pm .templateengine

22/01/2025 09:24 am .vscode

20/01/2025 07:27 am 3D Objects

02/02/2025 06:19 am AppData

02/02/2025 05:21 am Application Data [C:\Users\me\AppData\Roaming]

02/02/2025 06:25 am Contacts

02/02/2025 05:21 am Cookies [C:\Users\me\AppData\Local\Microsoft\Windows\INetCookies]

02/04/2025 12:14 pm Desktop

02/04/2025 08:13 am Documents

03/04/2025 07:08 am Downloads

02/02/2025 06:25 am Favorites

05/03/2025 11:28 am 8,388,608 GLOBOList2.mdf

05/03/2025 11:28 am 8,388,608 GLOBOList2_log.ldf

02/02/2025 06:25 am Links

02/02/2025 05:21 am Local Settings [C:\Users\me\AppData\Local]

02/02/2025 06:25 am Music

02/02/2025 05:21 am My Documents [C:\Users\me\Documents]

02/02/2025 05:21 am NetHood [C:\Users\me\AppData\Roaming\Microsoft\Windows\Network Shortcuts]

02/04/2025 10:28 am 12,582,912 NTUSER.DAT

02/02/2025 05:21 am 1,441,792 ntuser.dat.LOG1

02/02/2025 05:21 am 1,040,384 ntuser.dat.LOG2

03/04/2025 08:07 am 1,048,576 NTUSER.DAT{2ad838bb-efea-11ee-a54d-000d3a94eaa1}.TxR.0.regtrans-ms

02/04/2025 11:34 pm 1,048,576 NTUSER.DAT{2ad838bb-efea-11ee-a54d-000d3a94eaa1}.TxR.1.regtrans-ms

02/04/2025 11:34 pm 1,048,576 NTUSER.DAT{2ad838bb-efea-11ee-a54d-000d3a94eaa1}.TxR.2.regtrans-ms

03/04/2025 08:05 am 65,536 NTUSER.DAT{2ad838bb-efea-11ee-a54d-000d3a94eaa1}.TxR.blf

03/04/2025 08:07 am 65,536 NTUSER.DAT{2ad838bc-efea-11ee-a54d-000d3a94eaa1}.TM.blf

02/04/2025 11:34 pm 524,288 NTUSER.DAT{2ad838bc-efea-11ee-a54d-000d3a94eaa1}.TMContainer00000000000000000001.regtrans-ms

03/04/2025 08:13 am 524,288 NTUSER.DAT{2ad838bc-efea-11ee-a54d-000d3a94eaa1}.TMContainer00000000000000000002.regtrans-ms

02/02/2025 06:25 am 20 ntuser.ini

20/01/2025 07:36 am OneDrive

02/02/2025 06:25 am Pictures

02/02/2025 05:21 am PrintHood [C:\Users\me\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]

02/02/2025 05:21 am Recent [C:\Users\me\AppData\Roaming\Microsoft\Windows\Recent]

02/02/2025 06:25 am Saved Games

02/02/2025 06:25 am Searches

02/02/2025 05:21 am SendTo [C:\Users\me\AppData\Roaming\Microsoft\Windows\SendTo]

06/02/2025 10:09 am source

02/02/2025 05:21 am Start Menu [C:\Users\me\AppData\Roaming\Microsoft\Windows\Start Menu]

02/02/2025 05:21 am Templates [C:\Users\me\AppData\Roaming\Microsoft\Windows\Templates]

01/03/2025 06:41 am Videos

30/03/2025 06:45 am WPS Cloud Files

          13 File(s)     36,167,700 bytes

          33 Dir(s)  152,609,837,056 bytes free

I only just installed the virtual machines because I saw in video online that they are not affected by malware. So if they don't lose free space I might try a workaround to fix this issue once and for all requiring the vms, but I don't know how practical that will really be. My other thing to try as well is booting up from an external or usb. And leaving all internal hds clean. That will be an incredible inconvenience.

The new volume you see there in this gaming pc is the only one that doesn't appear to be affected. When I refreshed this pc link the 155gb went to 163gb. the new volume isn't in use, nothing is installed on it. I moved items from the local disk to the new volume before I formated disc c, that is why you see the free space being used on new volume d. I understand though that normally a filler virus generally duplicates files on the system and turns them into .exe files . I don't get what is being done only that the only discs that are being affected are the ones that have windows installed. Not externals or usbs, any ways to fix this issue no matter how unconventional please let me know.

Something you should know as well about the modem, I had to reset it yesterday to log into it, so I was locked out of it for a really long time, I can't imagine anyone else getting access to it. Let me know what you think.

This is someone else's pc. I can guarantee you they don't download anything. Can this be a program that the person installed on our devices to make it look like our free space is going down exponentially? I had a laptop running ubuntu once and the same thing happened. All the hard drives, except the one that is not in use but in my gaming, pc is like that.

I run boot time scan from AVG on my pc and that makes the free space from disappearing, but any other different scan does not stop the free space from disappearing. I recently installed and downloaded other stuff on my machine, but the issue predates it. Formatting the pcs and reinstalling windows gets rid of the issue but as soon as we get connected to the internet again the free space starts to go down. This person's pc recently stopped working and could not be used because it showed it reached max capacity and had to be reformatted. But the same thing started all over again, it has nothing to do with any websites visited, just being connected to the internet starts to make the pc look like it is getting full.

Running a boot scan and disconnecting the pc from the internet preserves the free space completely. I have run Microsoft scan using windows+r, I selected all options to block exploits in windows 11, I even disabled all inbound and outbound rules, still it persists. But the image above hasn't run any type of antivirus scan since it was formatted and Windows reinstalled.

No one else understands this issue. Even connected to a hotspot or data, this issue persists so switching providers won't matter. That is why I believe it is an issue with the modem, or this is something installed on our pcs at first that causes this issue. The virus scanner doesn't even say it found or deleted any virus which makes me equally suspicious. Is there a way to have the hard drive show that it is not in use, like on the gaming pc but still able to use the hard drive?

A part of me feels that it may not be a virus, it might actually be malicious software that is installed on our systems, to make it appear that the pcs are getting filled to capacity but even that doesn't make sense. Please assist.

Is there a modem I can buy that will instantly not allow any connections unless to manually open ports for each programme used?

Also the issue predates all the files you see installed on all the drives, very recently I reformatted and reinstalled windows on all the drives except the new volume you see in the picture in my post below. And that is the only one that appears to be unaffected.

Your help is greatly appreciated.

The Boot scan only restores 1or 2gbs of free space.