Task: {46ee8f94-e240-420c-a5e8-0660f5c5f9e1} - no filepath Microsoft Visual Studio Installer (HKLM\\{6F320B93-EE3C-4826-85E0-ADF79F8D4C61}) (Version: 3.0.3444.25014 - Microsoft Corporation) 0.0.0.0 watson.telemetry.microsoft.com Resetting Multicast Address, OK! (If an entry is included in the fixlist, it will be removed from the registry. 2021-10-02 22:56 - 2021-10-02 23:03 - 000000000 ____D C:\Windows\system32\Drivers\NVIDIA Corporation System errors: It has done this 1 time(s). 2021-10-02 22:59 - 2021-10-04 18:19 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp//www.bing.com/search?q={searchTerms}&FORM=IE8SRC Description: Task: {23df4797-0507-44e3-9c41-f5d1be966072} - no filepath 2021-10-03 16:54 - 2021-10-03 16:54 - 000000223 _____ C:\Users\Pepega\Desktop\Apex Legends.url BIOS: American Megatrends International, LLC. at System.Windows.Forms.Clipboard.GetText(System.Windows.Forms.TextDataFormat) Boot Mode: Normal 2021-10-03 15:48 - 2019-03-19 15:52 - 000000000 ___RD C:\Windows\PrintDialog If you are successful, start the Dell Digital Delivery application again. 2021-10-18 13:16 - 2021-10-24 17:02 - 000000000 ____D C:\Users\Pepega\AppData\Roaming\TcNo Account Switcher FF Extension: (Kurgzsekseta) - C:\Users\Pepega\AppData\Roaming\Mozilla\Firefox\Profiles\q42kwfcc.default-release\Extensions\{e8f3b919-d290-4270-b66f-29f3fdbb1986}.xpi [2021-10-05] Process Hacker 2.39 (r124) (HKLM\\Process_Hacker2_is1) (Version: 2.39.0.124 - wj32) HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp//go.microsoft.com/fwlink/p/?LinkId=255141 Task: {2d5dd02e-d989-436b-a3d0-b2283ce2c942} - no filepath Task: {ab7dbf26-2e26-445a-a7dd-f60ac12f19a6} - no filepath (If an entry is included in the fixlist, it will be removed from the registry. Task: {e21ec10f-b0f2-4d8c-ac9d-e74491370460} - no filepath 0.0.0.0 services.wes.df.telemetry.microsoft.com 2021-10-03 09:11 - 2021-10-03 09:12 - 000000000 ____D C:\Users\Pepega\Documents\Visual Studio 2022 Error: (10/24/2021 08:19:57 PM) (Source: .NET Runtime) (EventID: 1026) (User: ) Task: {134fdbcd-c972-40e5-a39b-91c169e4c9bf} - no filepath Startup: C:\Users\Pepega\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Thing2.bat [2021-10-24] () [File not signed] Task: {b19f8042-93dc-47e1-87f7-7ad8cb0032d9} - no filepath "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{d41d49ee-176e-4547-bd74-93495b181988}" => removed successfully Disk: 1 (Protective MBR) (Size: 1863 GB) (Disk ID: 00000000) go to : C:\Program Files (x86)\GIGABYTE\AORUS LCD Panel Task: {0c664c7f-7430-46ad-86a6-f5c0223c7fc4} - no filepath Task: {257fa8a3-d406-4d7e-99a9-c9e255f9f6f0} - no filepath 2021-10-24 18:02 - 2021-10-24 20:25 - 000072704 _____ (Microsoft Windows Operating System) C:\Users\Pepega\AppData\Local\Update.exe Framework Version: v4.0.30319 2021-10-02 23:18 - 2021-10-02 23:18 - 000000000 ____D C:\ProgramData\Microsoft Visual Studio CustomCLSID: HKU\S-1-5-21-326566074-3447909417-183555969-1001_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 -> C:\Users\Pepega\AppData\Local\Microsoft\OneDrive\21.170.0822.0002\amd64\FileSyncShell64.dll => No File *Digital LEDs are available only on select Motherboards, external LED Strips, Digital LED Strips are not included with Motherboard purchase. 2021-05-04 17:17 - 2021-05-04 17:17 - 000475648 _____ (GIGABYTE Technology Co.,Ltd.) there is a folder in SysWOW64, which i presume to be related to the miner, called 'Windows driver installation service.' I have just completed what you have told me to do, and it seems to be working. Security intelligence Version: AV: 1.351.958.0, AS: 1.351.958.0, NIS: 1.351.958.0 Resetting Control Protocol, OK! CustomCLSID: HKU\S-1-5-21-326566074-3447909417-183555969-1001_Classes\CLSID\{47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1}\localserver32 -> "C:\Users\Pepega\AppData\Local\Microsoft\OneDrive\21.170.0822.0002\Microsoft.SharePoint.exe" => No File CustomCLSID: HKU\S-1-5-21-326566074-3447909417-183555969-1001_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 -> C:\Users\Pepega\AppData\Local\Microsoft\OneDrive\21.170.0822.0002\amd64\FileSyncShell64.dll => No File 0.0.0.0 oca.telemetry.microsoft.com.nsatc.net NVIDIA GeForce Experience 3.23.0.74 (HKLM\\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 3.23.0.74 - NVIDIA Corporation) NVIDIA HD Audio Driver 1.3.38.92 (HKLM\\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.38.92 - NVIDIA Corporation) WinRT Intellisense PPI - Other Languages (HKLM-x32\\{FF2B49B7-0254-3D6A-4BE0-EF4C59DBCC2B}) (Version: 10.1.19041.685 - Microsoft Corporation) Hidden 2021-10-24 17:59 - 2021-10-24 18:15 - 000000000 ____D C:\Exotic 2.6 Update HKU\S-1-5-21-326566074-3447909417-183555969-1001\Control Panel\Desktop\\Wallpaper -> c:\windows\web\wallpaper\theme1\img13.jpg Task: {16be7f3f-fa2f-44f1-b9e0-bb9be341d6ea} - no filepath Task: {a68a203b-7eaa-4914-a565-5ff9759ae2a4} - no filepath Task: {4bc5b754-7072-4f40-a1b7-dd43c20ebdf6} - no filepath "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{481404b2-cd19-4388-9998-80f99056dcfd}" => removed successfully Microsoft Defender Antivirus has detected malware or other potentially unwanted software. Task: {bb4b5836-08d4-46b2-996b-c55ac054f68a} - no filepath Task: {68912dca-04b7-43b9-b125-ab2888148ebb} - no filepath Task: {0ffde93b-8785-42a8-8c6c-2672d544280d} - no filepath 2021-10-02 23:04 - 2021-10-02 23:04 - 000004308 _____ C:\Windows\system32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} 2021-10-02 22:52 - 2021-10-23 10:08 - 000002421 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk Task: {0ed742eb-771d-447f-a4e4-64c6fd2882f4} - no filepath 2021-10-14 13:14 - 2021-10-14 13:14 - 000058304 _____ C:\Windows\system32\Drivers\49306c4f52694e454d556f325256464b5a33706c566b3161516c64354f544e6a4f457436.sys Stage:GATHER_RULES_FROM_LICENSES Entity Framework 6.2.0 Tools for Visual Studio 2022 (HKLM-x32\\{3A21F37E-9707-4E7F-94EB-2937A1C931FA}) (Version: 6.2.0.0 - Microsoft Corporation) Hidden Name: SettingsModifier:Win32/PossibleHostsFileHijack CMD: "%WINDIR%\SYSTEM32\lodctr.exe" /R Task: {257fa8a3-d406-4d7e-99a9-c9e255f9f6f0} - no filepath Engine Version: AM: 1.1.18600.4, NIS: 1.1.18600.4 2021-10-02 23:04 - 2021-09-14 14:39 - 000001951 _____ C:\Windows\NvContainerRecovery.bat 2021-10-02 23:02 - 2021-10-02 23:02 - 000000000 ____D C:\Program Files (x86)\AMD Error - The Alienware Client Management Service service failed to start due to the following error: Error - The application has failed to start because its side-by-side configuration is incorrect. start 2021-08-23 15:07 - 2021-08-23 15:07 - 000423936 _____ (TODO: ) [File not signed] C:\Program Files (x86)\GIGABYTE\RGBFusion\GvLedLib.dll ==================== Custom CLSID (Whitelisted): ============== 2021-10-02 22:56 - 2021-10-07 11:58 - 000125568 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys Ran by Pepega (24-10-2021 21:20:16) Policies: C:\Users\Pepega\NTUSER.pol: Restriction <==== ATTENTION CustomCLSID: HKU\S-1-5-21-326566074-3447909417-183555969-1001_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 -> C:\Users\Pepega\AppData\Local\Microsoft\OneDrive\21.170.0822.0002\amd64\FileSyncShell64.dll => No File "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{d4928d07-631c-4754-af4f-3f5f19729138}" => removed successfully Task: {ed48b1d9-cb70-4ae5-8deb-ce6ddd63422a} - no filepath 2021-10-13 22:14 - 2021-10-07 19:28 - 001172608 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll Task: {964fea64-405c-411f-8d7c-f9b886d45580} - no filepath FirewallRules: [{A73419CB-E557-4602-83F3-EED8A5A67B9A}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (Valve -> Valve Corporation) 0.0.0.0 watson.ppe.telemetry.microsoft.com "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{19e78c37-4706-4ee6-b14f-00a377e1761c}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{c4718da2-1857-4507-932c-28593e4e8294}" => removed successfully Task: {e21ec10f-b0f2-4d8c-ac9d-e74491370460} - no filepath 2021-10-03 15:03 - 2019-03-19 15:52 - 000000000 ____D C:\Windows\system32\Sysprep Task: {e0ba60f1-d26f-4185-8bb0-04b05678ff5a} - no filepath Category: Settings Modifier Description: The rules engine failed to evaluate the rules. Task: {86c0c79f-566b-48c2-a517-d270146f5782} - no filepath Task: {1539d558-2bfa-453d-a38e-aa8bbec05194} - no filepath HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp//go.microsoft.com/fwlink/?LinkId=54896 ========= End of CMD: ========= 2021-10-07 11:40 - 2021-10-07 11:40 - 000000000 ___HD C:\$WinREAgent Task: {134fdbcd-c972-40e5-a39b-91c169e4c9bf} - no filepath 2021-10-15 11:40 - 2021-10-15 11:40 - 000000000 ____D C:\ProgramData\BlueStacks_nxt 2021-10-02 23:04 - 2021-10-02 23:04 - 000004106 _____ C:\Windows\system32\Tasks\NvBatteryBoostCheckOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} 2021-10-02 23:25 - 2021-10-02 23:26 - 000000000 ____D C:\Windows\SysWOW64\1042 Resetting Path, OK! vs_clickoncebootstrappermsi (HKLM-x32\\{86B9577E-4C3E-4035-BAAF-CAFB08B73ADD}) (Version: 17.0.31709 - Microsoft Corporation) Hidden Error: (10/24/2021 06:01:46 PM) (Source: DCOM) (EventID: 10010) (User: Avalanche-14329) 2021-10-04 18:19 - 2019-03-19 15:52 - 000000000 ____D C:\Windows\ShellExperiences Error: (10/24/2021 07:36:20 PM) (Source: .NET Runtime) (EventID: 1026) (User: ) "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{e0ba60f1-d26f-4185-8bb0-04b05678ff5a}" => removed successfully 2021-10-13 22:15 - 2021-10-07 11:58 - 000038016 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhdap64.dll Microsoft Windows 10 Pro Version 1909 18363.418 (X64) (1970-01-01 06:34:12) This error could be caused if the system stopped responding, crashed, or lost power unexpectedly. 0.0.0.0 feedback.search.microsoft.com Exception code: 0xe0434352 2021-10-24 13:01 - 2021-10-24 17:56 - 000000410 __RSH C:\ProgramData\ntuser.pol Task: {8a370bc5-d53d-4130-9a86-55745d7884c5} - no filepath 2021-10-02 23:03 - 2021-10-02 23:04 - 000000000 ____D C:\Program Files (x86)\NVIDIA Corporation (NVIDIA Corporation -> NVIDIA) C:\Program Files\NVIDIA Corporation\FrameViewSDK\bin\PresentMon_x64.exe <2> "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8f7674a6-0b05-416d-8dc8-bba2f61cad8c}" => removed successfully Resetting Prefix Policy, OK! Task: {d9c6b67e-9dbb-4ba4-ad4b-5aecb6889d08} - no filepath Task: {fc60ad33-5948-48d9-9f11-c6ca25373a9c} - no filepath ==================== Hosts content: ========================= Faulting package full name: 2021-10-15 11:56 - 2021-10-15 12:04 - 000000000 ____D C:\Users\Pepega\AppData\Roaming\ChangZhi2 "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{43f54ace-856e-4b50-9808-1588b79b7c18}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{e6857042-80d9-4422-85b4-1c5dc0aae451}" => removed successfully Detection Type: Concrete Detection Origin: Local machine I assume this one is for the gpu mining as my gpu is also being used on 100%, but i am not able to see which app is using 100%, as the miner has a script where it immediately stops mining when process hacker or task manager is opened, the only way i was able to tell that the gpu was being used at 100% was because of an app that the gpu manufacturer has provided Startup: C:\Users\Pepega\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Thing.bat [2021-10-24] () [File not signed] Task: {C6B4432E-BB97-4CBA-9DFC-158E3B8F51BE} - System32\Tasks\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\default-browser-agent.exe [680888 2021-10-07] (Mozilla Corporation -> Mozilla Foundation) vcpp_crt.redist.clickonce (HKLM-x32\\{97772BFC-16F3-41B9-B13E-35B278085A1F}) (Version: 14.30.30528 - Microsoft Corporation) Hidden HKLM\SOFTWARE\Policies\Microsoft\Windows Defender => could not remove, key could be protected 2021-10-02 23:24 - 2021-10-04 18:19 - 000000000 ____D C:\Program Files\IIS 0.0.0.0 choice.microsoft.com Running from C:\Users\Pepega\Downloads "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{dfa6b7fe-8965-4d4f-9d9a-7abe5c5ee553}" => removed successfully Task: {11dec036-7e8b-4b5b-906d-51876287d3d1} - no filepath Description: Category: Settings Modifier CreateRestorePoint: vs_clickoncebootstrappermsires (HKLM-x32\\{4F48CC43-3C4F-4C5F-813A-8D5E5BF4E52A}) (Version: 17.0.31703 - Microsoft Corporation) Hidden Task: {9b1a2e00-1c51-45d5-b5e4-9257d58cc2fe} - no filepath 2021-10-24 14:31 - 2021-10-24 14:31 - 000000000 ____D C:\Program Files\Reference Assemblies 2021-10-03 18:24 - 2021-10-03 18:24 - 000000000 ____D C:\Program Files\Microsoft Update Health Tools go to : C:\Program Files (x86)\GIGABYTE\AORUS LCD Panel Setting\Updater and run FWUpgrade.exe, you will see the progress and after completion, Microsoft Defender Antivirus has detected malware or other potentially unwanted software. HKU\S-1-5-21-326566074-3447909417-183555969-1001\\Run: [Print driver host for applications] => C:\Program Files (x86)\Print driver host for applications\Print driver host for applications.exe [74752 2021-10-24] (Microsoft Corporation) [File not signed] "RESOLVED" LCD SCREEN Aorus 3080 Not working RESOLVED !! Resetting , OK! "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{410813e0-851c-472e-9a03-ef8f43a11e2b}" => removed successfully Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION 10,510. 2021-10-13 16:20 - 2021-10-13 16:20 - 000001422 _____ C:\Users\Pepega\Desktop\Roblox Player.lnk Description: CustomCLSID: HKU\S-1-5-21-326566074-3447909417-183555969-1001_Classes\CLSID\{e8c77137-e224-5791-b6e9-ff0305797a13}\InprocServer32 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Inc. -> Adobe Systems) Task: {b1fed2a8-3200-4219-af34-0fd05172af37} - no filepath Resetting , OK! Task: {4204c90d-5097-480b-ab90-0cff3c443b89} - no filepath Task: {6902881d-a9ea-4ce3-9977-eac42438e59f} - no filepath Task: {c4718da2-1857-4507-932c-28593e4e8294} - no filepath Category: Settings Modifier "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{f99694c5-bf64-4109-a138-067cb4c7d2e7}" => removed successfully <==== ATTENTION HKLM\\Run: [RtkAudUService] => C:\Windows\System32\DriverStore\FileRepository\realtekservice.inf_amd64_df67044ddd98b524\RtkAudUService64.exe [1273712 2021-07-29] (Realtek Semiconductor Corp. -> Realtek Semiconductor) Universal CRT Redistributable (HKLM-x32\\{A57CD0A6-4297-FD30-34A4-34758B6F5F69}) (Version: 10.1.19041.685 - Microsoft Corporation) Hidden Resetting Route, OK! "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{F7197523-B9AE-42F6-9BCD-3487235CDA82}" => removed successfully Total physical RAM: 32689.05 MB FF Extension: (Tampermonkey) - C:\Users\Pepega\AppData\Roaming\Mozilla\Firefox\Profiles\q42kwfcc.default-release\Extensions\firefox@tampermonkey.net.xpi [2021-10-24] Task: {68703689-47bd-47ee-9cf2-e91abb43a182} - no filepath 2021-10-02 23:19 - 2021-10-02 23:19 - 000000000 ____D C:\Program Files\Microsoft Visual Studio 2021-10-02 22:56 - 2021-10-24 14:29 - 000000000 ____D C:\Program Files\NVIDIA Corporation ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2021-06-11] (win.rar GmbH -> Alexander Roshal) 2021-10-02 22:51 - 2019-03-19 15:52 - 000000000 ____D C:\Windows\system32\FxsTmp at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object) "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{66f5635a-5bb6-4432-8d29-d7d2f625b98a}" => removed successfully Description: The WinRing0_1_2_0 service failed to start due to the following error: Task: {d4928d07-631c-4754-af4f-3f5f19729138} - no filepath The file which is running by the task will not be moved.) 2021-10-13 22:14 - 2021-10-07 19:28 - 002114672 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll 0.0.0.0 telemetry.appex.bing.net 2019-03-19 15:49 - 2021-10-24 15:25 - 000002820 _____ C:\Windows\system32\drivers\etc\hosts 2021-10-02 23:23 - 2021-10-18 13:15 - 000000000 ____D C:\Program Files (x86)\dotnet C:\Users\Pepega\AppData\Local\Update.exe => No running process found Task: {5ea271ce-e48a-4ade-9079-2a5bece10d83} - no filepath here are the virustotals for the 2 files:https://www.virustotal.com/gui/file/85aa1344d28fd7c6a911924040e5b3ae1278fb70444cd39d056bd270f147f61bhttps://www.virustotal.com/gui/file/85aa1344d28fd7c6a911924040e5b3ae1278fb70444cd39d056bd270f147f61b/behavior/Microsoft%20Sysinternals, FRST RESULTS: 2021-10-24 14:58 - 2019-03-19 15:37 - 000032768 _____ C:\Windows\system32\config\ELAM "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{00f722c3-08dc-4b10-b10e-91a3004714f3}" => removed successfully
Grape Plants For Sale Near San Francisco, Ca, Sa State Under 18 Football Team, Articles T