Windows 10: windows security detects a file that has probably been removed yet it appears again

so a clearer explaination, lately windows security has been popping up a warning about a file called puabundler:win32/utorrent_bundleinstallerI have already deleted that file and everytime i press "remove" it asks me to do a scan, i do the scan and it pops up again, some sort of loop. detects files > choose the option to remove it > "please scan for potential threats" > scans > same thing pops up again.Windows 10 pro latestLatest windows security version

:)

 

Recent File List

Remove-ItemProperty -Path "Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List" -name file1

Remove-ItemProperty -Path "Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List" -name file2
Remove-ItemProperty -Path "Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List" -name file3
Remove-ItemProperty -Path "Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List" -name file4
Remove-ItemProperty -Path "Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List" -name file5
Remove-ItemProperty -Path "Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List" -name file6
Remove-ItemProperty -Path "Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List" -name file7
Remove-ItemProperty -Path "Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List" -name file8
Remove-ItemProperty -Path "Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List" -name file9
...

you get the idea. ( too lazy to put it in a for loop and test it.

or just open regedit and remove all the fileX from that key.

 

Removing a "hidden" user and user files

Thanks for your patience. I was able with "Net User" to remove the left over user. It no longer appears when I invoke Net User.

Now for the user's folder which remains behind. After performing the series of steps that you suggested, I attempted to delete this folder. The result again was an error message about permission


"Administrators" appears on the list in the list of advanced security.