Task: {0ed742eb-771d-447f-a4e4-64c6fd2882f4} - no filepath 2021-10-20 14:50 - 2021-10-20 14:50 - 000000000 ____D C:\Program Files\ENE (If an entry is included in the fixlist, the file/folder will be moved.) (If an entry is included in the fixlist, the file/folder will be moved.) Microsoft Visual Studio Installer (HKLM\\{6F320B93-EE3C-4826-85E0-ADF79F8D4C61}) (Version: 3.0.3444.25014 - Microsoft Corporation) "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{e62b268c-ea0c-4217-bfa2-7bd1145ba5a0}" => removed successfully I have just completed what you have told me to do, and it seems to be working. Resetting Compartment, OK! (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\wlanext.exe 0.0.0.0 watson.ppe.telemetry.microsoft.com Description: ==================== Codecs (Whitelisted) ==================== Task: {1539d558-2bfa-453d-a38e-aa8bbec05194} - no filepath Faulting package-relative application ID: Motherboard: Micro-Star International Co., Ltd. MEG X570 UNIFY (MS-7C35) HKU\S-1-5-21-326566074-3447909417-183555969-1001\\Run: [Windows Driver Installation Service] => C:\Windows\SysWOW64\Windows Driver Installation Service\Windows Driver Installation Service.exe vs_communitymsires (HKLM-x32\\{C1C3D2B9-781E-4D38-BF06-1D1FF670FA95}) (Version: 17.0.31709 - Microsoft Corporation) Hidden "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{16be7f3f-fa2f-44f1-b9e0-bb9be341d6ea}" => removed successfully i scanned using norton power eraser, but it returned with no results. 2021-10-03 18:36 - 2019-03-19 15:52 - 000000000 ____D C:\Windows\system32\oobe "HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\mpcmdrun.exe" => not found 2021-09-30 14:33 - 2021-09-30 14:33 - 001993216 _____ (GIGABYTE) [File not signed] C:\Program Files (x86)\GIGABYTE\RGBFusion\AACPCIeSSD_Lib.dll Task: {68703689-47bd-47ee-9cf2-e91abb43a182} - no filepath 2020-11-05 14:16 - 2020-11-05 14:16 - 000268800 _____ (GIGABYTE Technology Co.,Ltd.) Task: {43f54ace-856e-4b50-9808-1588b79b7c18} - no filepath Task: {ed48b1d9-cb70-4ae5-8deb-ce6ddd63422a} - no filepath Description: The rules engine failed to evaluate the rules. "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{013418b8-2dc1-4fb4-9c18-21dcfcb620cb}" => removed successfully S3 SIVDriver; C:\Windows\system32\Drivers\SIVX64.sys [205552 2021-02-13] (RH Software Ltd -> Ray Hinchliffe) 2021-10-09 21:21 - 2021-10-09 21:21 - 000058304 _____ (Intel Corporation ) C:\Windows\system32\Drivers\49306c4f52694d3265464132623078796254466e4e6d52774d324e545a315a7664556830.sys It has done this 1 time(s). Faulting module name: SinEx 4.2.0 BETA Woofer [All Winver].exe, version: 0.0.0.0, time stamp: 0x616e2119 Error Code: 0x80070006 Security intelligence Version: AV: 1.351.958.0, AS: 1.351.958.0, NIS: 1.351.958.0 Restarting the service or rebooting the VM did not solved the problem. Resetting Subinterface, OK! ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_5292bbfbf575e2d2\nvshext.dll [2021-10-07] (Nvidia Corporation -> NVIDIA Corporation) Task: {9ab420ae-8543-428c-9838-410f79c8d585} - no filepath 2021-10-02 23:35 - 2021-10-02 23:35 - 000001738 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Blend for Visual Studio 2022 Preview.lnk Restart the computer to complete this action. Windows SDK AddOn (HKLM-x32\\{E18618EC-D9DB-4BCE-B382-85ADA2CBB340}) (Version: 10.1.0.0 - Microsoft Corporation) "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8c4fdb45-99dd-42f3-8984-07e5f8dff7f4}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8457ad0b-1c75-431d-a5ae-ee1aed76a239}" => removed successfully 2021-10-04 18:09 - 2021-10-04 18:09 - 000008192 _____ C:\Windows\system32\config\userdiff Task: {4fb942bf-3d44-41ff-bc65-52cd12996f26} - no filepath Task: {a68a203b-7eaa-4914-a565-5ff9759ae2a4} - no filepath "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{bd098352-5f63-4d2b-8e01-ba6a347a2975}" => removed successfully R1 npcap; C:\Windows\system32\DRIVERS\npcap.sys [74744 2021-04-22] (Insecure.Com LLC -> Insecure.Com LLC.) Python Launcher (HKLM-x32\\{B6EF11B6-0882-43B1-AA75-4D3BD32A144A}) (Version: 3.9.7427.0 - Python Software Foundation) 2021-09-29 10:31 - 2021-10-24 17:56 - 000000000 ____D C:\Users\Pepega Name: SettingsModifier:Win32/PossibleHostsFileHijack Task: {4de67c63-be14-4dd1-af32-f53029177ebc} - no filepath ENE_EHD_M2_HAL (HKLM\\{37A48B7F-D4EA-4863-844E-A284E2AA3C5D}) (Version: 1.0.8.13 - ENE TECHNOLOGY INC.) Hidden 2021-10-15 11:58 - 2021-10-15 11:58 - 000000828 _____ C:\Users\Pepega\Desktop\LDMultiPlayer4.lnk 2021-10-24 14:58 - 2021-10-24 14:58 - 000000000 ____D C:\ProgramData\Sophos HKU\S-1-5-21-326566074-3447909417-183555969-1001\SOFTWARE\Policies\Microsoft\Edge => removed successfully 2021-10-03 18:05 - 2021-10-03 18:05 - 000000000 ____D C:\Users\Pepega\AppData\Local\Apple Computer It has done this 1 time(s). Task: {4972aadd-d0db-4681-984f-17b847488bc9} - no filepath 2021-10-02 23:02 - 2021-01-08 13:21 - 001147352 _____ (Realtek ) C:\Windows\system32\Drivers\rt640x64.sys 2021-10-04 09:35 - 2021-10-04 09:35 - 000000000 ____D C:\Users\Pepega\Desktop\rkill In bios, its not showing up all of my SSDs, but at no point is it Description: The server Microsoft.Windows.Cortana_1.13.0.18362_neutral_neutral_cw5n1h2txyewy!CortanaUI did not register with DCOM within the required timeout. 2021-10-13 22:14 - 2021-10-07 19:32 - 001450200 _____ C:\Windows\SysWOW64\vulkaninfo.exe Task: {53092fd3-455c-4d74-9110-8a5211ddb6c2} - no filepath Task: {29ad0c16-34a9-49f9-a1d8-81f44fff082d} - no filepath FirewallRules: [{A73419CB-E557-4602-83F3-EED8A5A67B9A}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (Valve -> Valve Corporation) Task: {a4a7b095-aaa9-401c-a9d7-8abe8ea301af} - no filepath Task: {51006d50-cfd3-4b5a-af95-e596678bbea8} - no filepath "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{e21ec10f-b0f2-4d8c-ac9d-e74491370460}" => removed successfully The file will not be moved.) 2021-10-24 18:02 - 2021-10-24 20:25 - 000072704 _____ (Microsoft Windows Operating System) C:\Users\Pepega\AppData\Local\Update.exe vs_Graphics_Singletonx86 (HKLM-x32\\{7DDDDC70-9531-49E9-8002-9FAB2B87B54A}) (Version: 17.0.31710 - Microsoft Corporation) Hidden Task: {2a965443-ec13-4b75-abf9-394d697f739d} - no filepath HKU\S-1-5-21-326566074-3447909417-183555969-1001\\StartupApproved\Run: => "EpicGamesLauncher" 2021-10-02 23:25 - 2021-10-02 23:26 - 000000000 ____D C:\Windows\SysWOW64\1031 FirewallRules: [Microsoft-Windows-Unified-Telemetry-Client] => (Block) C:\Windows\system32\svchost.exe (Microsoft Windows Publisher -> Microsoft Corporation) 0.0.0.0 telecommand.telemetry.microsoft.com FirewallRules: [{c3fd991f-853b-41ba-b492-a58509655958}] => (Allow) C:\Program Files\ldplayerbox\LdVBoxHeadless.exe (Shanghai Changzhi Network Technology Co., Ltd. -> Oracle Corporation) The file will not be moved unless listed separately.) Detection Type: Concrete 2021-10-04 18:19 - 2019-03-19 15:52 - 000000000 ____D C:\Windows\system32\MsDtc 2021-10-02 23:03 - 2021-10-02 23:04 - 000000000 ____D C:\Program Files (x86)\NVIDIA Corporation (If an entry is included in the fixlist, it will be removed from the registry. GroupPolicy: Restriction ? Task: {0ffde93b-8785-42a8-8c6c-2672d544280d} - no filepath 2021-10-24 20:19 - 2021-10-24 20:37 - 000000000 ____D C:\Users\Pepega\AppData\Local\CrashDumps Task: {960b6a6a-dc34-4565-96a7-4db5fb5b3ff9} - no filepath 2021-10-02 23:04 - 2021-09-14 14:39 - 000078192 _____ C:\Windows\system32\FvSDK_x64.dll CustomCLSID: HKU\S-1-5-21-326566074-3447909417-183555969-1001_Classes\CLSID\{917E8742-AA3B-7318-FA12-10485FB322A2}\localserver32 -> "C:\Users\Pepega\AppData\Local\Microsoft\OneDrive\21.170.0822.0002\Microsoft.SharePoint.exe" => No File "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{977e0d72-710d-4264-bfbf-105f17f81aa3}" => removed successfully Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION FF Extension: (BetterTTV) - C:\Users\Pepega\AppData\Roaming\Mozilla\Firefox\Profiles\q42kwfcc.default-release\Extensions\firefox@betterttv.net.xpi [2021-10-19] Task: {6ee54cdc-f0d4-4cad-be32-be99498e56b8} - no filepath right now the only solution i have is to run task manager or processhacker in the background of my pc as the miners have a script to stop mining whenever those exes are open Task: {95bbc0e1-37d1-403e-badd-d7f7c4fc36d1} - no filepath Error: (10/24/2021 07:27:46 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) 2021-10-02 23:19 - 2021-10-02 23:19 - 000000000 ____D C:\Program Files\Microsoft Visual Studio The NVIDIA LocalSystem Container service terminated unexpectedly. I assume this app is the cpu miner, it has a script that utilizes .net framework to mine, the exe that it uses to mine is RegAsm.exe, and mines at only 50% cpu, i was only able to see that it was using 50% cpu in process explorer. 2021-10-20 14:48 - 2021-10-20 14:50 - 000000000 ____D C:\Program Files (x86)\GIGABYTE Task: {1539d558-2bfa-453d-a38e-aa8bbec05194} - no filepath "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4972aadd-d0db-4681-984f-17b847488bc9}" => removed successfully ========= End of CMD: ========= CustomCLSID: HKU\S-1-5-21-326566074-3447909417-183555969-1001_Classes\CLSID\{47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1}\localserver32 -> "C:\Users\Pepega\AppData\Local\Microsoft\OneDrive\21.170.0822.0002\Microsoft.SharePoint.exe" => No File Task: {00f722c3-08dc-4b10-b10e-91a3004714f3} - no filepath 2021-10-02 23:03 - 2021-09-14 14:39 - 000069856 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys Task: {cefea723-c2e4-4ec0-b440-c45c5526fda8} - no filepath ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2021-06-11] (win.rar GmbH -> Alexander Roshal) Task: {14B4F718-04DD-467B-A775-E906F62BB732} - System32\Tasks\NvTmRep_CrashReport4_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvBackend\NvTmRep.exe [1261424 2021-09-14] (NVIDIA Corporation -> NVIDIA Corporation) (If an entry is included in the fixlist, the process will be closed. Resetting , OK! FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2021-10-16] (Adobe Inc. -> Adobe Systems) FirewallRules: [UDP Query User{019D75AB-C81F-411D-9974-8F4883C85907}C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe] => (Allow) C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe (Epic Games Inc. -> Epic Games, Inc.) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe R2 NahimicService; C:\Windows\system32\NahimicService.exe [1633288 2020-12-10] (A-Volute SAS -> Nahimic) FirewallRules: [{6044C6B5-9B61-4F44-874F-BF6511DBDB68}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe (NVIDIA Corporation -> NVIDIA Corporation) 2021-10-03 15:48 - 2019-03-19 15:52 - 000000000 ___RD C:\Windows\ImmersiveControlPanel Startup: C:\Users\Pepega\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Thing2.bat [2021-10-24] () [File not signed] 2021-10-03 16:54 - 2021-10-03 16:54 - 000000223 _____ C:\Users\Pepega\Desktop\Apex Legends.url Task: {7d4dac2b-fbf4-45de-adae-6a9396b9ca9c} - no filepath "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8a8c9b4d-3ba3-4f5f-8da4-8714c002e24f}" => removed successfully at System.Windows.Forms.Clipboard.GetDataObject(Int32, Int32) "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{b3eb79cd-689d-4158-bea3-8771c38a327c}" => removed successfully Faulting application start time: 0x01d7c8b2547f9944 Task: {f31abc37-3a79-4244-9a4b-03a808823654} - no filepath 2021-10-02 23:25 - 2021-10-02 23:26 - 000000000 ____D C:\Windows\SysWOW64\2052 (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\cmd.exe Windows Firewall is enabled. Detection Type: Concrete WinAppDeploy (HKLM-x32\\{2ADF1977-BF31-E127-B651-AC28A8658317}) (Version: 10.1.19041.685 - Microsoft Corporation) Hidden FF Extension: (Video Ad-Block, for Twitch) - C:\Users\Pepega\AppData\Roaming\Mozilla\Firefox\Profiles\q42kwfcc.default-release\Extensions\{3385c2d8-dcfd-4f92-adb7-5d8429dee164}.xpi [2021-10-23] Task: {d7495c49-8426-461c-8455-350522fba9cb} - no filepath SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp//www.bing.com/search?q={searchTerms}&FORM=IE8SRC FirewallRules: [{F7197523-B9AE-42F6-9BCD-3487235CDA82}] => (Allow) C:\Program Files\BlueStacks_nxt\HD-Player.exe => No File FirewallRules: [TCP Query User{CF0A0468-41A2-4CF4-BDA6-1586AE73104D}C:\windows\microsoft.net\framework64\v4.0.30319\vbc.exe] => (Allow) C:\windows\microsoft.net\framework64\v4.0.30319\vbc.exe (Microsoft Corporation -> Microsoft Corporation) Task: {1a105416-49db-4c94-a1d7-5a3597878e9a} - no filepath Detection Source: Real-Time Protection "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{78bdf1d8-0a82-4ea3-8ac6-e6a6e95fd874}" => removed successfully Dec 16, 2019. 2021-10-02 22:51 - 2019-03-19 15:52 - 000000000 ____D C:\Windows\system32\FxsTmp Task: {519e0c96-0a46-4c15-840e-41ed3cda1aef} - no filepath Result of scheduled keys to remove after reboot: 2021-10-24 13:24 - 2021-10-24 15:28 - 000000000 ____D C:\Users\Pepega\Desktop\resources "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{252c0390-ef87-47eb-805e-da800dd5671d}" => removed successfully Faulting application path: D:\Cheetos\Woofing\Cinx Archieves\SinEx 4.2.0 [BETA]\SinEx 4.2.0 BETA Woofer [All Winver].exe U4 npcap_wifi; no ImagePath WinRT Intellisense PPI - en-us (HKLM-x32\\{15E29AFF-CB19-A20B-9A81-B0765A63115F}) (Version: 10.1.19041.685 - Microsoft Corporation) Hidden 2021-10-18 20:24 - 2021-10-18 20:24 - 000000000 ____D C:\Users\Pepega\AppData\Local\AMD ==================== MBR & Partition Table ==================== 2021-10-24 12:40 - 2021-10-24 17:27 - 000036208 _____ (Sysinternals - www.sysinternals.com) C:\Windows\system32\Drivers\PROCEXP152.SYS Severity: Medium "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{560963e7-8fb3-45a5-b560-b69102dfab6a}" => removed successfully go to : C:\Program Files (x86)\GIGABYTE\AORUS LCD Panel Setting\Updater and run Updater.exe, check if it is Running from C:\Users\Pepega\Downloads It has done this 1 time(s). Description: The WinRing0_1_2_0 service failed to start due to the following error: The file will not be moved unless listed separately.) Task: {a2a9bb80-76ce-4752-9e44-f43e01b26a35} - no filepath Python 3.9.5 Utility Scripts (64-bit) (HKLM\\{420E50F6-A8E8-4098-A321-7DF6B3C3BA82}) (Version: 3.9.5150.0 - Python Software Foundation) Hidden Process Name: C:\Users\Pepega\AppData\Local\Discord\app-1.0.9003\Discord.exe C:\WINDOWS\system32\*.tmp "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{b086bb79-9ed7-4043-ab6c-148342fcf383}" => removed successfully 2021-10-13 16:38 - 2021-10-13 16:41 - 000000000 ____D C:\Program Files\Wireshark Task: {b19f8042-93dc-47e1-87f7-7ad8cb0032d9} - no filepath NVIDIA Control Panel -> C:\Program Files\WindowsApps\NVIDIACorp.NVIDIAControlPanel_8.1.961.0_x64__56jybvy8sckqj [2021-10-03] (NVIDIA Corp.) AMD Ryzen Master (HKLM\\AMD Ryzen Master) (Version: 2.8.0.1937 - Advanced Micro Devices, Inc.) R2 NVDisplay.ContainerLocalSystem; C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_5292bbfbf575e2d2\Display.NvContainer\NVDisplay.Container.exe -s NVDisplay.ContainerLocalSystem -f %ProgramData%\NVIDIA\NVDisplay.ContainerLocalSystem.log -l 3 -d C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_5292bbfbf575e2d2\Display.NvContainer\plugins\LocalSystem -r -p 30000 -cfg NVDisplay.ContainerLocalSystem\LocalSystem Process Name: Unknown 2021-10-24 13:01 - 2021-10-24 17:56 - 000000410 __RSH C:\ProgramData\ntuser.pol icecap_collection_neutral (HKLM-x32\\{519060B0-9C83-4D54-97A7-32C2350583C9}) (Version: 17.0.31709 - Microsoft Corporation) Hidden Boot Mode: Normal 2021-10-18 19:32 - 2021-07-29 05:27 - 048046994 _____ C:\Windows\system32\Drivers\RTAIODAT.DAT Python 3.9.5 Core Interpreter (64-bit symbols) (HKLM\\{7AE79937-D0A7-4D36-9965-5E91E22E5FFA}) (Version: 3.9.5150.0 - Python Software Foundation) Hidden "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6298650e-c3bc-47e3-a571-b4eea94ac419}" => removed successfully
the aorus lcd panel service service terminated unexpectedly
22 mayo, 2023
the aorus lcd panel service service terminated unexpectedly