Security issue. System getting compromised after a fresh install.

[Deepak5j]

[HotCakeX]

Hi, to avoid guessing, we’ll need to separate actual security indicators from normal Windows behavior that can look suspicious. Some things like WAN Miniport, Connected Devices Platform, Xbox-related services, credential storage, and resume/background services can exist on Windows 11 even if you do not actively use those features. That does not automatically mean someone has access, but abnormal events or unexpected configuration changes are definitely worth checking.

Event logs can have lots of insights and information about the system activity but it's hard to manually review them, let's do some other tasks first.

Since you mentioned "immediate neighbor get access to my laptop", try changing your WIFI router's password, then install the Harden System Security app from: https://apps.microsoft.com/detail/9p7ggfl7dx57

Use the default selected preset and apply the recommended security measures. wait for it to complete then restart your system. If you're not using Windows Hello, it's a good idea to set it up: https://support.microsoft.com/en-us/windows/configure-windows-hello-dae28983-8242-bb2a-d3d1-87c9d265a5f0

Once you do all of them, make sure Windows is fully up to date and then perform a full scan in Microsoft Defender: https://support.microsoft.com/en-us/defender/how-to-start-a-scan-for-viruses-or-malware-in-microsoft-defender

More about Defender: https://support.microsoft.com/en-us/windows/virus-and-threat-protection-in-the-windows-security-app-1362f4cd-d71a-b52a-0b66-c2820032b65e

[Deepak5j]

[HotCakeX]

The WAN miniport is normal, it's not a sign of malware activity. The credential manager looks normal too based on what I'm seeing.

if you want you could do a clean install of the OS this way:

1. Backup all the files you wish to keep from the C drive to another drive.
2. Create a bootable OS flash drive on another device/PC, one that is safe: https://www.microsoft.com/en-us/software-download/windows11
3. Use that flash drive to clean install the OS, wipe the C partition, EFI partition, boot partition, System partition and any other non-normal partition during Windows installation. You can just delete them, along with the C partition, which turns them into one unallocated space, then create 1 new partition from that unallocated space and install the new OS there. All of the required system partitions will be automatically recreated.
4. After clean install, use Secure DNS in Windows, something like Cloudflare's 1.1.1.1.
5. Use the Harden System Security app to harden your system.
6. Update the OS and keep it up to date.
7. Don't install 3rd party apps as much as possible.
8. Use Windows Sandbox for any suspicious of one-time use programs you need to install and use.
9. Don't install browser add-ons or only install those that are absolutely necessary.

Keep doing that and everything should be OK.

[Deepak5j]

[HotCakeX]

Online Microsoft account is preferred because then you can use Windows Hello for login, authentication, passkeys etc. making things safer.

That SID prefix is associated with Windows app capability / app container security identities, not a normal local user account. It's not an indicator of compromise. It does not mean someone has access to your PC, and it is not evidence of malware by itself. Capability SIDs of packaged apps can be part of Windows/app permission rules and removing them from filesystem or registry ACLs can break Windows features or app behavior.

[Deepak5j]

[HotCakeX]

Which setting is not being enabled? Screenshots can help too.

You shouldn't be manually removing things from System32!

The account that has Windows Hello authentication instead of a regular password.

[Deepak5j]

[HotCakeX]

When you navigate to each page in the app for the first time after launch, the security measures are not verified automatically, you have to press the verify button and then you will see if they are applied or not. It can be instant or take few seconds depending on what is being verified. So please press the "Verify all" button and then you will see the results.

[HotCakeX]

When you restart your system or close/reopen the app, you need to naturally press the verify button again. I don't see any problem in the screenshot you shared. another screenshot you tried to upload wasn't successfully uploaded.

[HotCakeX]

They are permanent, the problem is that you are using Home edition of the OS which doesn't support many security measures. Microsoft only offers them starting with Pro edition.

Can you please show me where you see the RemoteShutodwn ?

[Harvester57]

All SIDs you are showing are legitimate Windows built-in SIDs, there is nothing wrong here (why they are not translated is a minor question though). gpedit.msc is not available on Home editions, so again, nothing strange or abnormal here.

[Harvester57]

Have you tried a basic Google search for this SID ? S-1-15-3 SIDs are built-in Windows SIDs use to describe Capabilities: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers#capability-sids

There is nothing wrong with this.

Regarding gpedit.msc, you can enable it on Home editions, but keep in mind that most settings wil lbe written to REgistry but not necessarily applied.

[Harvester57]

These are legitimate Microsoft drivers, nothing suspicious here.

The two commands you are showing are failing because you are not escaping properly the parameters, in PowerShell you need to use the following (I advise against running this on your system though):

icacls C:\Windows\System32\drivers\swenum.sys /deny "SYSTEM:(RX)" /deny "Administrators:(RX)"

[Harvester57]

From Gemini, about what the DriverStore is, and I'd advise you to ask an AI to explain to you the concepts you are lacking for now to understand what you are doing:

The DriverStore (C:\Windows\System32\DriverStore) is a secure, centralized cryptographic repository introduced in Windows Vista to manage all third-party and inbox device drivers. It serves as the trusted single source of truth for driver staging and installation.

When a device is connected or a driver package is installed, the operating system executes a process called staging. During staging, Windows verifies the driver package's digital signature, validates the syntax of the .inf configuration file, and checks that all required binaries are explicitly declared. Once validated, the entire package is copied into a isolated subdirectory within System32\DriverStore\FileRepository.

Mechanisms of Execution: Why the Paths Differ
The common assumption that all executing drivers must reside directly in C:\Windows\System32\drivers is incorrect. While legacy operating systems and traditional installation models copied .sys binaries directly into System32\drivers, modern Windows architectures utilize the DriverStore path directly for specific runtime configurations.

[Deepak5j]

[Harvester57]

What is the rationale for you to want to remove this ? Did you do a research or ask any AI to explain to you what this emulated device is used for ? Or do you just want to uninstall random stuff on your computer for no reasons ?

[pingu-the-penguin]

@Deepak5j I don't believe that any of this shows that your device is getting compromised at all. As others have pointed out, this all looks quite normal and expected of a standard Windows installation. You seem to be messing with Windows system components that you do not understand or have "scary" names but are actually just normal and probably needed by the system which is why they keep getting re-installed.

You seem to be misunderstanding a few things about what capabilities are available to certain Windows editions and misunderstanding how this app works as well which aren't indicators of compromise.

Unless there are clear indicators of compromise, which there doesn't seem to be, you can relax and assume your laptop is fine. Additionally, most of this discussion doesn't seem to have much to do with this app and this discussion doesn't seem like the right place to have it.

[HotCakeX]

Closing this as completed because as others have mentioned, everything presented so far indicate that there is nothing wrong with your system and this thread is going a little bit off topic. If you actually come across any issues with any of the apps in this repo or have questions about them, please open new discussions/issues. Thanks

[Deepak5j]

I asked this to be discussed on some non-pubic platform like email. Security issues and hacking related are not solve such that in open public. Resources and facts are not shared openly.