I had multiple accounts hacked recently, and I wasn't sure how. I started getting Windows Defender notifications for this, "Trojan:Win32/Ravartar!rfn". The affected items, "amsi: \Device\HarddiskVolume4\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
I used Hitman Pro to remove whatever it detected, and if I remember correctly, it found two items and removed them. However, I continue to get that every time I launch my computer, and I remove it every time with Windows Defender. Hitman Pro has not picked anything up since the initial removal. I can even see PowerShell flash open and close for a second whenever my computer starts up. I've done a full Windows Defender scan and an offline Windows Defender scan. I'm not sure if anything turned up from the offline scan or not.
I have downloaded FRST, and my keywords are "FIRST.txt: mighty-scroll" and "Addition.txt: verdant-boss"
I have also installed and used Gridinsoft Anti-Malware. I have not restarted my computer since doing a full scan with Gridinsoft.
UPDATE: I re-did the malware analysis for FRST and got new codes "FIRST.txt: crafted-throne" and "Addition.txt: royal-saber".