Windows 10: what is regid. 1993-06.com.microsoft

it is a folder i recently saw on my computer and i want to know if it is safe and it also has something to do with Netsupport client application i saw it running in my task manager.

:)

 

popup netsupport Your demonstration period has expired (01-Jan-2022)"

Hi

Found the problem

svrwebui in c\programdata\regid.1993-06.com. Microsoft

 

In temp files, an .exe appearing every minute, is it a virus?

Everything was successfully removed. There was Net Support remote access software which means an attacker could have run other malware, stolen passswords, recorded your screen etc.

NetSupport Manager - Wikipedia.

And VirusTotal

A golang generic trojan.

Now that the malware is removed it would be a good idea to change any important passwords and setup MFA where possible.

~~~~

There's just some harmless leftovers from Net Support to remove.

• Highlight all the code below including start and end, then press ctrl + C to copy it
  
• FRST will read these instructions from the clipboard
  
• Run FRST and press 'Fix'
  

Start::

2024-02-12 02:01 - 2021-07-13 12:04 - 000376072 ____A [2B75E4A56F5ECFEDDEF0328575F15F40] (Microsoft Windows -> Adobe Systems Incorporated) C:\ProgramData\regid.1993-06.com.microsoft\atmfd.dll

2024-02-12 02:01 - 2024-01-24 11:21 - 000000629 ____A [04823EA098DE976A156A8B48D01113AA] () C:\ProgramData\regid.1993-06.com.microsoft\client32.ini

2024-02-12 02:01 - 2024-01-24 11:21 - 000000643 ____A [3CAD9CFD6ED922FC86D44CA4E6BBA354] () C:\ProgramData\regid.1993-06.com.microsoft\client32u.ini

2024-02-12 02:01 - 2016-12-07 01:33 - 000328056 ____A [C94005D2DCD2A54E40510344E0BB9435] (NetSupport Ltd -> NetSupport Ltd) C:\ProgramData\regid.1993-06.com.microsoft\HTCTL32.DLL

2024-02-12 02:01 - 2015-04-24 05:57 - 000773968 ____A [0E37FBFA79D349D672456923EC5FBBE3] (Microsoft Corporation -> Microsoft Corporation) C:\ProgramData\regid.1993-06.com.microsoft\msvcr100.dll

2024-02-12 02:01 - 2007-07-06 02:37 - 000000328 ____A [26E28C01461F7E65C402BDF09923D435] () C:\ProgramData\regid.1993-06.com.microsoft\nskbfltr.inf

2024-02-12 02:01 - 2015-04-30 08:17 - 000006458 ____A [88B1DAB8F4FD1AE879685995C90BD902] () C:\ProgramData\regid.1993-06.com.microsoft\NSM.ini

2024-02-12 02:01 - 2022-09-27 13:35 - 000000195 ____A [E9609072DE9C29DC1963BE208948BA44] () C:\ProgramData\regid.1993-06.com.microsoft\NSM.LIC

2024-02-12 02:01 - 2010-04-27 06:56 - 000000046 ____A [3BE27483FDCDBF9EBAE93234785235E3] () C:\ProgramData\regid.1993-06.com.microsoft\nsm_vpro.ini

2024-02-12 02:01 - 2016-12-07 01:37 - 000033144 ____A [34DFB87E4200D852D1FB45DC48F93CFC] (NetSupport Ltd -> NetSupport Ltd) C:\ProgramData\regid.1993-06.com.microsoft\pcicapi.dll

2024-02-12 02:01 - 2016-12-07 01:37 - 000018808 ____A [104B30FEF04433A2D2FD1D5F99F179FE] (NetSupport Ltd -> NetSupport Ltd) C:\ProgramData\regid.1993-06.com.microsoft\PCICHEK.DLL

2024-02-12 02:01 - 2016-12-07 01:37 - 003740024 ____A [D3D39180E85700F72AAAE25E40C125FF] (NetSupport Ltd -> NetSupport Ltd) C:\ProgramData\regid.1993-06.com.microsoft\PCICL32.DLL

2024-02-12 02:01 - 2016-12-07 01:32 - 000063864 ____A [6FCA49B85AA38EE016E39E14B9F9D6D9] (NetSupport Ltd -> NetSupport Ltd) C:\ProgramData\regid.1993-06.com.microsoft\remcmdstub.exe

2024-02-12 02:01 - 2016-12-07 01:40 - 000396664 ____A [2C88D947A5794CF995D2F465F1CB9D10] (NetSupport Ltd -> NetSupport Ltd) C:\ProgramData\regid.1993-06.com.microsoft\TCCTL32.DLL

2024-02-12 02:01 - 2024-01-02 21:50 - 000120232 ____A [95B1C32D1E392F13554E789365A92B39] (NETSUPPORT LTD. -> NetSupport Ltd) C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe

End::

~~~

If there's nothing further, you can completely remove FRST by renaming it to uninstall.exe and running it - a reboot is required.

Also, if you would mark the thread as answered, by pressing Yes below the post(s) that provided the solution...that'd be awesome.

Good luck!

 

"regid.1991-06.com.microsoft_Windows-10-Pro.swidtag" file was last modified today in my computer

I'm a windows 11 pro user. Today, I saw a folder called "regid.1991-06.com.microsoft" in ProgramData folder. When I go inside, there's a file called "regid.1991-06.com.microsoft_Windows-10-Pro.swidtag". In properties it shows that it was in my computer when I started to use it. When I seached this in bing copilot it shows that it is created by microsoft for the development of windows 10. But as I said, from the start I'm using windows 11. What is this? Do I need to delete this folder? Please advise.