Infected Sys files | And modified boot files

Question

Infected Sys files | And modified boot files

Ardian Watzky 0

Hello everyone,

I am experiencing a serious issue with my Windows system and I hope someone here can help.

No matter how many times I completely reinstall Windows — even after performing a fresh, clean installation — data rapidly starts accumulating in the ProgramData folder. Within a short period of time, it grows extremely fast, up to 60 GB.

The strange part is:

I cannot delete the files.

The folder fills up very quickly after installation.

This happens even after formatting the drive and doing a completely new Windows setup.

Because of this behavior, I am concerned that there might be some kind of persistent malware or rootkit on the system.

I have already used Farbar Recovery Scan Tool (FRST) and I can upload the FRST logs if needed for analysis. If i can get a proper clean Fixlist from you, i would appreciate!

Please let me know what additional information you need. I would really appreciate guidance on how to properly investigate and fix this issue.

Thank you very much for your help.

Ardian Watzky 0 Reputation points

2026-02-22T07:46:17.7966667+00:00

I will provide the logs for you FRST.txt
Ardian Watzky 0 Reputation points

2026-02-22T07:46:59.9966667+00:00

Addition.txt

1 answer

Your answer

Ardian Watzky 0 Reputation points

2026-02-22T07:46:17.7966667+00:00

I will provide the logs for you FRST.txt
Ardian Watzky 0 Reputation points

2026-02-22T07:46:59.9966667+00:00

Addition.txt

Answer 1

It sounds like you are dealing with a serious issue that could be related to persistent malware or rootkits, especially since the problem persists even after a clean installation of Windows. Here are some steps you can take to investigate and potentially resolve the issue:

Use Safe Mode: Boot your system into Safe Mode to limit the number of drivers and services running. This can help in identifying and removing malicious files. To enter Safe Mode, you can follow these steps:
- Go to Settings > Update & Security > Recovery.
- Under Advanced startup, click Restart now.
- After your PC restarts, select Troubleshoot > Advanced options > Startup Settings > Restart.
- Once it restarts again, select 4 or F4 to start in Safe Mode.
Run Malware Scans: Since you mentioned using the Farbar Recovery Scan Tool, ensure you also run a full scan with a reputable antivirus or anti-malware tool. Tools like Malwarebytes or Windows Defender can help identify and remove threats.
Check for Rootkits: Use specialized tools like Kaspersky's TDSSKiller or GMER to scan for rootkits specifically. These tools are designed to detect and remove hidden malware that traditional antivirus software may miss.
Analyze FRST Logs: If you have logs from the Farbar Recovery Scan Tool, they can provide insight into what might be causing the issues. You can share these logs with a knowledgeable community or a professional for analysis.
Monitor ProgramData Growth: After taking the above steps, monitor the ProgramData folder to see if the issue persists. If it continues to grow rapidly, it may be worthwhile to investigate which specific files are being created or modified within that folder.
Consider a Full Disk Wipe: If the problem continues after all these steps, you might want to consider a full disk wipe using a tool that can securely erase all data, followed by a fresh installation of Windows. This can help eliminate any hidden malware that might be residing on the disk.
Backup Important Data: Before proceeding with any major changes, ensure that you have backups of your important files, as some of these steps may result in data loss.

If you need further assistance, feel free to ask or provide the FRST logs for more detailed help.