Malware Log Analysis

Start:: CreateRestorePoint: CloseProcesses: 2026-09-03 09:21 - 2025-11-10 15:51 - 000003408 _____ C:\WINDOWS\system32\Tasks\MAkF7mCn3tPqp662daybvERzwsKQYqnzM8 BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_202\bin\ssv.dll [2024-06-12] (Oracle America, Inc. -> Oracle Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_202\bin\jp2ssv.dll [2024-06-12] (Oracle America, Inc. -> Oracle Corporation) HKU\S-1-5-21-1066710034-326992338-341540203-1001\...\StartupApproved\Run: => "MicrosoftEdgeAutoLaunch_5B0BDDCB926BAA0926080A4C8AE6556B" HKU\S-1-5-21-1066710034-326992338-341540203-1001\...\Run: [MicrosoftEdgeAutoLaunch_5B0BDDCB926BAA0926080A4C8AE6556B] => "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start [5365576 2026-09-04] (Microsoft Corporation -> Microsoft Corporation) 2026-09-07 11:18 - 2026-09-07 11:18 - 000000000 ____D C:\Users\ivanc\AppData\Local\Yandex CustomCLSID: HKU\S-1-5-21-1066710034-326992338-341540203-1001_Classes\CLSID\{86CA1AA0-34AA-4E8B-A509-50C905BAE2A2}\InprocServer32 -> => No File ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => -> No File ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => -> No File ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => -> No File ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => -> No File ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => -> No File ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => -> No File ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => -> No File ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => -> No File ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => -> No File ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => -> No File ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => -> No File ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => -> No File ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => -> No File ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => -> No File AlternateDataStreams: C:\WINDOWS\tracing:? [34] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access.lnk:A1B76439FE [4298] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\draw.io.lnk:803345E73D [4298] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk:BE32D07BC5 [4298] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel.lnk:B96E9B8455 [4298] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FlashBrowser.lnk:113483B2A3 [4298] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mouse Properties (Touchpad Clickpad Trackpad TrackPoint Mouse Pointer Pointing Pad).lnk:5E3F4F2328 [4298] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++.lnk:159ADC9AA1 [4298] AlternateDataStreams: C:\Users\ivanc\Downloads\FRST64.exe:MBAM.Zone.Identifier [313] AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [10406] FirewallRules: [{DAB81594-97A4-4A4F-B84E-977B78433198}] => (Allow) C:\Program Files\Elgato\StreamDeck\node\node20.exe => No File FirewallRules: [UDP Query User{8EA4E90B-29E5-4588-B8DA-DF892AEA083F}C:\riot games\2xko\live\lion\binaries\win64\lion-win64-shipping.exe] => (Allow) C:\riot games\2xko\live\lion\binaries\win64\lion-win64-shipping.exe => No File FirewallRules: [TCP Query User{93EE27AF-2812-401F-9C50-479240850B41}C:\riot games\2xko\live\lion\binaries\win64\lion-win64-shipping.exe] => (Allow) C:\riot games\2xko\live\lion\binaries\win64\lion-win64-shipping.exe => No File FirewallRules: [UDP Query User{A2ABA577-F3F2-4A76-89FE-4F2BD05A4FBF}F:\games\steamgames\steamapps\common\overwatch\overwatch.exe] => (Allow) F:\games\steamgames\steamapps\common\overwatch\overwatch.exe => No File FirewallRules: [TCP Query User{FC5F985A-72FE-4F90-9BDF-A2E3D0830D9A}F:\games\steamgames\steamapps\common\overwatch\overwatch.exe] => (Allow) F:\games\steamgames\steamapps\common\overwatch\overwatch.exe => No File FirewallRules: [UDP Query User{C6061440-C9DE-4D19-8B4A-112381177781}C:\users\ivanc\appdata\local\vortxengine\app-2.5.17\signal-x64\signalrgb.exe] => (Allow) C:\users\ivanc\appdata\local\vortxengine\app-2.5.17\signal-x64\signalrgb.exe => No File FirewallRules: [TCP Query User{EEAEDC77-9FE6-4E80-897A-C82369953908}C:\users\ivanc\appdata\local\vortxengine\app-2.5.17\signal-x64\signalrgb.exe] => (Allow) C:\users\ivanc\appdata\local\vortxengine\app-2.5.17\signal-x64\signalrgb.exe => No File FirewallRules: [{E909854F-15F0-4953-8C04-458821ACE9CE}] => (Allow) E:\Games\steamgames\steamapps\common\Hollow Knight Silksong\Hollow Knight Silksong.exe => No File FirewallRules: [{119C66E4-9327-468E-B8CB-510BD8F64FD8}] => (Allow) E:\Games\steamgames\steamapps\common\Hollow Knight Silksong\Hollow Knight Silksong.exe => No File FirewallRules: [{F227E917-32CC-4C4F-B301-0EA8BADAD020}] => (Allow) E:\Games\steamgames\steamapps\common\Hollow Knight\hollow_knight.exe => No File FirewallRules: [{19F93C11-75F3-4A78-AEB4-82CEDDF2A0BF}] => (Allow) E:\Games\steamgames\steamapps\common\Hollow Knight\hollow_knight.exe => No File FirewallRules: [UDP Query User{50AD8BEC-CD4D-479C-BF30-A96245A906EF}E:\games\steamgames\steamapps\common\glacier events\bf6event.exe] => (Allow) E:\games\steamgames\steamapps\common\glacier events\bf6event.exe => No File FirewallRules: [TCP Query User{7CE1A41C-BEB4-438C-9142-1402794566A3}E:\games\steamgames\steamapps\common\glacier events\bf6event.exe] => (Allow) E:\games\steamgames\steamapps\common\glacier events\bf6event.exe => No File FirewallRules: [{D3128C68-6C0B-4D0E-A648-69F2BC5EB69A}] => (Allow) E:\Games\steamgames\steamapps\common\Glacier Events\EAAntiCheat.GameServiceLauncher.exe => No File FirewallRules: [{791457F2-1122-4E2D-9673-0C1250F3B94F}] => (Allow) E:\Games\steamgames\steamapps\common\Glacier Events\EAAntiCheat.GameServiceLauncher.exe => No File FirewallRules: [{52D16918-A096-4FC5-B845-489C8E5CE7A5}] => (Allow) C:\Users\ivanc\Desktop\CtrlUI\DirectXInput.exe => No File FirewallRules: [{82919904-1A12-4CED-A03F-801FADCF8CA4}] => (Allow) C:\Users\ivanc\Desktop\CtrlUI\CtrlUI.exe => No File FirewallRules: [UDP Query User{5464596F-5559-4478-BD7A-1CF6211D0518}C:\users\ivanc\appdata\local\vortxengine\app-2.5.6\signal-x64\signalrgb.exe] => (Allow) C:\users\ivanc\appdata\local\vortxengine\app-2.5.6\signal-x64\signalrgb.exe => No File FirewallRules: [TCP Query User{A6F8BC75-AEED-4E14-832C-03146272F956}C:\users\ivanc\appdata\local\vortxengine\app-2.5.6\signal-x64\signalrgb.exe] => (Allow) C:\users\ivanc\appdata\local\vortxengine\app-2.5.6\signal-x64\signalrgb.exe => No File FirewallRules: [UDP Query User{41DBD01C-3FB9-48E0-856F-760F17F7991D}E:\games\steamgames\steamapps\common\grand theft auto v enhanced\gta5_enhanced.exe] => (Block) E:\games\steamgames\steamapps\common\grand theft auto v enhanced\gta5_enhanced.exe => No File FirewallRules: [TCP Query User{7252DD19-5B6E-4397-9F76-D1D0DF94CAF7}E:\games\steamgames\steamapps\common\grand theft auto v enhanced\gta5_enhanced.exe] => (Block) E:\games\steamgames\steamapps\common\grand theft auto v enhanced\gta5_enhanced.exe => No File FirewallRules: [UDP Query User{898024DF-DEF8-4BE0-806A-828C01D18908}E:\games\steamgames\steamapps\common\grand theft auto v enhanced\gta5_enhanced.exe] => (Allow) E:\games\steamgames\steamapps\common\grand theft auto v enhanced\gta5_enhanced.exe => No File FirewallRules: [TCP Query User{EA3C1B12-9F40-4F7E-AE17-DDFEEE2C7105}E:\games\steamgames\steamapps\common\grand theft auto v enhanced\gta5_enhanced.exe] => (Allow) E:\games\steamgames\steamapps\common\grand theft auto v enhanced\gta5_enhanced.exe => No File FirewallRules: [{D82D5EE2-BA47-4151-B1C5-7BF2D07293AF}] => (Allow) E:\Games\steamgames\steamapps\common\Red Dead Redemption 2\PlayRDR2.exe => No File FirewallRules: [{624DE623-8C0B-4BC9-AF51-5F5814851581}] => (Allow) E:\Games\steamgames\steamapps\common\Red Dead Redemption 2\PlayRDR2.exe => No File FirewallRules: [{55992C24-7159-436B-88E0-66F0C2A0B9AA}] => (Allow) E:\Games\steamapps\common\Grand Theft Auto IV\GTAIV\PlayGTAIV.exe => No File FirewallRules: [{DC3859E0-B3BA-434E-993E-67C99CF3E420}] => (Allow) E:\Games\steamapps\common\Grand Theft Auto IV\GTAIV\PlayGTAIV.exe => No File FirewallRules: [UDP Query User{74599B8B-EA50-464D-82E6-AE59A5D16AAB}E:\games\steamapps\common\cyberpunk 2077\bin\x64\cyberpunk2077.exe] => (Allow) E:\games\steamapps\common\cyberpunk 2077\bin\x64\cyberpunk2077.exe => No File FirewallRules: [TCP Query User{3C426515-310E-4C3E-A86F-35EA317F9705}E:\games\steamapps\common\cyberpunk 2077\bin\x64\cyberpunk2077.exe] => (Allow) E:\games\steamapps\common\cyberpunk 2077\bin\x64\cyberpunk2077.exe => No File FirewallRules: [{708CE29A-D734-44CD-A709-2CFAECAA16AE}] => (Allow) E:\Games\steamapps\common\smbbm\smbbm.exe => No File FirewallRules: [{80668F24-6658-42CD-9B87-B89AD4F7E5E0}] => (Allow) E:\Games\steamapps\common\smbbm\smbbm.exe => No File FirewallRules: [{41A8286B-9AC8-4E3E-880A-A1FB4D195950}] => (Allow) E:\Games\steamgames\steamapps\common\Cyberpunk 2077\REDprelauncher.exe => No File FirewallRules: [{09B92D77-2215-42D8-ABD6-3212B641E553}] => (Allow) E:\Games\steamgames\steamapps\common\Cyberpunk 2077\REDprelauncher.exe => No File FirewallRules: [UDP Query User{F4C23D7E-F0D7-4477-8C60-CE9163FDC1FD}D:\games\beat saber (1.36.0.8486341502) (all dlc)\beat saber (1.36.0.8486341502) (all dlc)\beat saber.exe] => (Allow) D:\games\beat saber (1.36.0.8486341502) (all dlc)\beat saber (1.36.0.8486341502) (all dlc)\beat saber.exe => No File FirewallRules: [TCP Query User{0137924F-CC25-404A-AFEB-293F14D1821E}D:\games\beat saber (1.36.0.8486341502) (all dlc)\beat saber (1.36.0.8486341502) (all dlc)\beat saber.exe] => (Allow) D:\games\beat saber (1.36.0.8486341502) (all dlc)\beat saber (1.36.0.8486341502) (all dlc)\beat saber.exe => No File FirewallRules: [UDP Query User{FAACFE69-7E41-489C-A78D-ED869FF9455F}E:\games\steamgames\steamapps\common\watch_dogs\bin\watch_dogs.exe] => (Allow) E:\games\steamgames\steamapps\common\watch_dogs\bin\watch_dogs.exe => No File FirewallRules: [TCP Query User{BA258CDB-2913-4E13-84CC-6696C3FA0C11}E:\games\steamgames\steamapps\common\watch_dogs\bin\watch_dogs.exe] => (Allow) E:\games\steamgames\steamapps\common\watch_dogs\bin\watch_dogs.exe => No File FirewallRules: [UDP Query User{5C8C9613-3EEE-4349-B098-B564D730CB06}E:\games\steamgames\steamapps\common\watch_dogs2\bin\watchdogs2.exe] => (Allow) E:\games\steamgames\steamapps\common\watch_dogs2\bin\watchdogs2.exe => No File FirewallRules: [TCP Query User{3439CBD4-58B4-4092-B365-B038797C2843}E:\games\steamgames\steamapps\common\watch_dogs2\bin\watchdogs2.exe] => (Allow) E:\games\steamgames\steamapps\common\watch_dogs2\bin\watchdogs2.exe => No File FirewallRules: [{39D9BB8A-843C-46AF-95E8-05E2F34E9F23}] => (Allow) E:\Games\steamgames\steamapps\common\smbbm\smbbm.exe => No File FirewallRules: [{B8E0F7B9-DFA4-4196-A37C-547D493CF9E5}] => (Allow) E:\Games\steamgames\steamapps\common\smbbm\smbbm.exe => No File FirewallRules: [UDP Query User{E6AA5B48-5235-42FD-9F06-D21432742F49}C:\users\ivanc\appdata\local\medal\app-4.2712.0\medal.exe] => (Allow) C:\users\ivanc\appdata\local\medal\app-4.2712.0\medal.exe => No File FirewallRules: [TCP Query User{D3E0BF43-F873-4338-A9AC-E93DD3A64DB7}C:\users\ivanc\appdata\local\medal\app-4.2712.0\medal.exe] => (Allow) C:\users\ivanc\appdata\local\medal\app-4.2712.0\medal.exe => No File FirewallRules: [UDP Query User{31B22AE1-ED92-4CF9-89E3-2E2AF5FE85FC}D:\games\fortnite\engine\binaries\win64\epicwebhelper.exe] => (Block) D:\games\fortnite\engine\binaries\win64\epicwebhelper.exe => No File FirewallRules: [TCP Query User{DEABB224-1CE1-49DC-B0EB-1F90D2320834}D:\games\fortnite\engine\binaries\win64\epicwebhelper.exe] => (Block) D:\games\fortnite\engine\binaries\win64\epicwebhelper.exe => No File FirewallRules: [{9A0D4E36-AAB7-48B9-AD4E-690885EF8DF8}] => (Allow) E:\Games\steamgames\steamapps\common\Palworld\Palworld.exe => No File FirewallRules: [{B7E33DB7-DDCB-4E72-9204-65E401D26668}] => (Allow) E:\Games\steamgames\steamapps\common\Palworld\Palworld.exe => No File FirewallRules: [UDP Query User{CACB9448-4F70-40F1-999A-31772A207B14}E:\games\steamgames\steamapps\common\overwatch\overwatch.exe] => (Allow) E:\games\steamgames\steamapps\common\overwatch\overwatch.exe => No File FirewallRules: [TCP Query User{2B630AC1-9308-44AD-B9A4-A38D35F4A2C0}E:\games\steamgames\steamapps\common\overwatch\overwatch.exe] => (Allow) E:\games\steamgames\steamapps\common\overwatch\overwatch.exe => No File FirewallRules: [UDP Query User{D15A187C-5900-4FD3-B3CD-A15412B5BCEC}C:\program files (x86)\altserver\altserver.exe] => (Allow) C:\program files (x86)\altserver\altserver.exe => No File FirewallRules: [TCP Query User{826A5CC9-CB41-4F59-B164-5B5C7577C3D6}C:\program files (x86)\altserver\altserver.exe] => (Allow) C:\program files (x86)\altserver\altserver.exe => No File FirewallRules: [UDP Query User{DEC9E2D4-09F2-4C6F-B22F-912D27FA0FDD}E:\games\steamgames\steamapps\common\cyberpunk 2077\bin\x64\cyberpunk2077.exe] => (Allow) E:\games\steamgames\steamapps\common\cyberpunk 2077\bin\x64\cyberpunk2077.exe => No File FirewallRules: [TCP Query User{BA7D9AEC-1B76-458C-B296-49667900C85A}E:\games\steamgames\steamapps\common\cyberpunk 2077\bin\x64\cyberpunk2077.exe] => (Allow) E:\games\steamgames\steamapps\common\cyberpunk 2077\bin\x64\cyberpunk2077.exe => No File FirewallRules: [UDP Query User{354DB9AA-8990-4FA3-806F-5803681C6F6A}E:\games\steamgames\steamapps\common\marvelrivals\marvelgame\marvel\binaries\win64\marvel-win64-shipping.exe] => (Allow) E:\games\steamgames\steamapps\common\marvelrivals\marvelgame\marvel\binaries\win64\marvel-win64-shipping.exe => No File FirewallRules: [TCP Query User{591FCC84-0495-4FDD-9E91-11CD62F2986F}E:\games\steamgames\steamapps\common\marvelrivals\marvelgame\marvel\binaries\win64\marvel-win64-shipping.exe] => (Allow) E:\games\steamgames\steamapps\common\marvelrivals\marvelgame\marvel\binaries\win64\marvel-win64-shipping.exe => No File FirewallRules: [{D1B7CEA9-7B10-4B45-ABAC-F4EFA4D4CC37}] => (Allow) D:\Games\steamgames\steamapps\common\Supermarket Together\Supermarket Together.exe => No File FirewallRules: [{570ADFAE-0742-4A0A-B134-51B70E9EB5EA}] => (Allow) D:\Games\steamgames\steamapps\common\Supermarket Together\Supermarket Together.exe => No File FirewallRules: [UDP Query User{E48AFBDE-9E87-442A-822B-5BFD07C9CB42}C:\program files (x86)\vb\voicemeeter\voicemeeterpro.exe] => (Allow) C:\program files (x86)\vb\voicemeeter\voicemeeterpro.exe => No File FirewallRules: [TCP Query User{59C37B0E-CE85-4632-98A5-D18B48B34D7E}C:\program files (x86)\vb\voicemeeter\voicemeeterpro.exe] => (Allow) C:\program files (x86)\vb\voicemeeter\voicemeeterpro.exe => No File FirewallRules: [UDP Query User{86EC6345-A14C-4AE3-A77C-F64C3FE7904A}D:\games\riot games\riot client\riotclientelectron\riot client.exe] => (Allow) D:\games\riot games\riot client\riotclientelectron\riot client.exe => No File FirewallRules: [TCP Query User{627F4176-A686-477D-99B3-96785B1BC077}D:\games\riot games\riot client\riotclientelectron\riot client.exe] => (Allow) D:\games\riot games\riot client\riotclientelectron\riot client.exe => No File FirewallRules: [UDP Query User{EBCB849D-D0D7-4491-A641-3DC85F4131F4}C:\games\beat saber (1.36.0.8486341502) (all dlc)\beat saber (1.36.0.8486341502) (all dlc)\beat saber.exe] => (Block) C:\games\beat saber (1.36.0.8486341502) (all dlc)\beat saber (1.36.0.8486341502) (all dlc)\beat saber.exe => No File FirewallRules: [TCP Query User{8FAFF151-2EC7-47BC-8ED9-C152EFDC2358}C:\games\beat saber (1.36.0.8486341502) (all dlc)\beat saber (1.36.0.8486341502) (all dlc)\beat saber.exe] => (Block) C:\games\beat saber (1.36.0.8486341502) (all dlc)\beat saber (1.36.0.8486341502) (all dlc)\beat saber.exe => No File FirewallRules: [UDP Query User{C3F6000D-954B-4392-A59A-CF04E4613E77}C:\games\beat saber\beat saber.exe] => (Block) C:\games\beat saber\beat saber.exe => No File FirewallRules: [TCP Query User{91C03879-382A-46A4-B93B-B9B29D09BC4E}C:\games\beat saber\beat saber.exe] => (Block) C:\games\beat saber\beat saber.exe => No File FirewallRules: [UDP Query User{588EB863-897F-44DA-9489-D3D57F3D9276}C:\program files\epic games\ue_5.3\engine\binaries\win64\unrealeditor.exe] => (Allow) C:\program files\epic games\ue_5.3\engine\binaries\win64\unrealeditor.exe => No File FirewallRules: [TCP Query User{7E3D136C-D4C6-4B8A-994E-470DF70ECC5C}C:\program files\epic games\ue_5.3\engine\binaries\win64\unrealeditor.exe] => (Allow) C:\program files\epic games\ue_5.3\engine\binaries\win64\unrealeditor.exe => No File FirewallRules: [{525468D4-5DFC-4505-A8EF-68A359312B5B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Galaxy Life\x64\Galaxy Life.exe => No File FirewallRules: [{32C3CFF3-6D57-4454-A274-11F26313DEA2}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Galaxy Life\x64\Galaxy Life.exe => No File FirewallRules: [{4B321557-9D17-477D-8364-FDB259798893}] => (Allow) F:\Games\SteamLibrary\steamapps\common\Watch_Dogs\bin\watch_dogs.exe => No File FirewallRules: [{1A8B3538-E9EE-4A5C-ACBB-A763A513D2E6}] => (Allow) F:\Games\SteamLibrary\steamapps\common\Watch_Dogs\bin\watch_dogs.exe => No File FirewallRules: [{04A68290-AAE8-4816-89BE-174940CF80CA}] => (Allow) F:\Games\SteamLibrary\steamapps\common\Watch_Dogs2\EAC.exe => No File FirewallRules: [{3AE83AD7-3661-43CF-A9CD-4311A496CAAF}] => (Allow) F:\Games\SteamLibrary\steamapps\common\Watch_Dogs2\EAC.exe => No File FirewallRules: [{E6338EC1-6068-4EE7-885C-FE5C00F3A0F7}] => (Allow) F:\Games\SteamLibrary\steamapps\common\Watch_Dogs2\bin\WatchDogs2.exe => No File FirewallRules: [{3DE31546-4396-4179-89F6-5E7D4231191C}] => (Allow) F:\Games\SteamLibrary\steamapps\common\Watch_Dogs2\bin\WatchDogs2.exe => No File FirewallRules: [UDP Query User{45A468F0-23BD-4F53-8321-5EF47FD4D95E}F:\games\steamlibrary\steamapps\common\red dead redemption 2\rdr2.exe] => (Allow) F:\games\steamlibrary\steamapps\common\red dead redemption 2\rdr2.exe => No File FirewallRules: [TCP Query User{813A936A-7D3D-485D-8855-42B6688BFC7F}F:\games\steamlibrary\steamapps\common\red dead redemption 2\rdr2.exe] => (Allow) F:\games\steamlibrary\steamapps\common\red dead redemption 2\rdr2.exe => No File FirewallRules: [UDP Query User{43C2B069-2BFE-419B-9555-6E479CCC3D5B}D:\games\steamlibrary\steamapps\common\cyberpunk 2077\bin\x64\cyberpunk2077.exe] => (Allow) D:\games\steamlibrary\steamapps\common\cyberpunk 2077\bin\x64\cyberpunk2077.exe => No File FirewallRules: [TCP Query User{C3411266-58C1-4C2A-9ABC-33F66D9B3933}D:\games\steamlibrary\steamapps\common\cyberpunk 2077\bin\x64\cyberpunk2077.exe] => (Allow) D:\games\steamlibrary\steamapps\common\cyberpunk 2077\bin\x64\cyberpunk2077.exe => No File FirewallRules: [UDP Query User{5FB4DA7D-F7F0-4F90-AE9B-B4878C0842AC}C:\games\bs archives (1.30.0)\beat saber.exe] => (Allow) C:\games\bs archives (1.30.0)\beat saber.exe => No File FirewallRules: [TCP Query User{F16E9FD4-DE14-4AC5-8EBA-23FCA8715D44}C:\games\bs archives (1.30.0)\beat saber.exe] => (Allow) C:\games\bs archives (1.30.0)\beat saber.exe => No File FirewallRules: [{70BE610F-0AB4-4690-9FF9-C881D2154783}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Galaxy Life\x64\Galaxy Life.exe => No File FirewallRules: [{FF267436-EC55-4FC7-92B2-B924E828B994}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Galaxy Life\x64\Galaxy Life.exe => No File FirewallRules: [{DE617859-C4CD-49FE-B075-4A88BEDCCD34}] => (Block) C:\program files (x86)\steam\steamapps\common\galaxy life\cefsharp.browsersubprocess.exe => No File FirewallRules: [{10120E35-9D79-4D28-AAA3-9B0423FB02F8}] => (Block) C:\program files (x86)\steam\steamapps\common\galaxy life\cefsharp.browsersubprocess.exe => No File FirewallRules: [UDP Query User{77D0EFDD-DE6C-4E29-AB24-29D1A2A39F54}C:\program files (x86)\steam\steamapps\common\galaxy life\cefsharp.browsersubprocess.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\galaxy life\cefsharp.browsersubprocess.exe => No File FirewallRules: [TCP Query User{E4359F21-D128-42AF-89F6-906638A6B086}C:\program files (x86)\steam\steamapps\common\galaxy life\cefsharp.browsersubprocess.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\galaxy life\cefsharp.browsersubprocess.exe => No File FirewallRules: [{CB2B769B-8E3C-4461-9D63-D3CE03361CC8}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Galaxy Life\Galaxy Life.exe => No File FirewallRules: [{1127733C-F238-43CC-875B-A4A167587C43}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Galaxy Life\Galaxy Life.exe => No File FirewallRules: [{659B2533-0EAE-4318-ADC8-F1953AB6CDC0}] => (Block) C:\games\beat.saber.v1.27.0.incl.all.dlc\beat.saber.v1.27.0.incl.all.dlc\beat saber.exe => No File FirewallRules: [{B4009171-1BB6-43BC-BCE3-B8A476199B62}] => (Block) C:\games\beat.saber.v1.27.0.incl.all.dlc\beat.saber.v1.27.0.incl.all.dlc\beat saber.exe => No File FirewallRules: [UDP Query User{D581F0DC-7E64-4892-8CC8-AB96547D8EBA}C:\games\beat.saber.v1.27.0.incl.all.dlc\beat.saber.v1.27.0.incl.all.dlc\beat saber.exe] => (Allow) C:\games\beat.saber.v1.27.0.incl.all.dlc\beat.saber.v1.27.0.incl.all.dlc\beat saber.exe => No File FirewallRules: [TCP Query User{6F72FDBA-6FAD-440B-AAAA-D8267778A29E}C:\games\beat.saber.v1.27.0.incl.all.dlc\beat.saber.v1.27.0.incl.all.dlc\beat saber.exe] => (Allow) C:\games\beat.saber.v1.27.0.incl.all.dlc\beat.saber.v1.27.0.incl.all.dlc\beat saber.exe => No File FirewallRules: [{C5DF1534-06DB-4285-B6DD-0CD7354CD6B9}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\SteamVR\bin\win32\vrstartup.exe => No File FirewallRules: [{0F45B0B3-A8D9-4588-822A-32AA4EE2BF7B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\SteamVR\bin\win32\vrstartup.exe => No File FirewallRules: [{70F2F349-8146-4491-8BCF-F73CAC45A1AA}] => (Allow) C:\Program Files\Oculus\Support\oculus-client\OculusClient.exe => No File FirewallRules: [{2D5D6D92-C452-4985-A93D-0E51182737CB}] => (Allow) C:\Program Files\Oculus\Support\oculus-client\OculusClient.exe => No File FirewallRules: [{1DC933D0-F606-43B6-AD1C-E57F3FC1FC39}] => (Allow) C:\Program Files\Oculus\Support\oculus-worlds\Engine\Binaries\Win64\UnrealCEFSubProcess.exe => No File FirewallRules: [{6675E5AB-DF8D-476F-A747-A38E8595298B}] => (Allow) C:\Program Files\Oculus\Support\oculus-worlds\Engine\Binaries\Win64\UnrealCEFSubProcess.exe => No File FirewallRules: [{A3BB4A13-24EA-4C1E-B717-C41485DDBEE7}] => (Allow) C:\Program Files\Oculus\Support\oculus-worlds\Home2\Binaries\Win64\Home2-Win64-Shipping.exe => No File FirewallRules: [{D63F94C6-F6E9-465B-AB2D-31A19408270C}] => (Allow) C:\Program Files\Oculus\Support\oculus-worlds\Home2\Binaries\Win64\Home2-Win64-Shipping.exe => No File FirewallRules: [{3BD80DF2-3A89-4BE2-B21D-2EBB59FB1C6D}] => (Allow) C:\Program Files\Oculus\Support\oculus-worlds\Home2.exe => No File FirewallRules: [{509ECF0E-E323-417D-8A40-0FB456D7FCBA}] => (Allow) C:\Program Files\Oculus\Support\oculus-worlds\Home2.exe => No File FirewallRules: [{6B10329E-2865-42A4-9814-3CDD6E496204}] => (Block) C:\users\ivanc\onedrive\desktop\syncthing-windows-amd64-v1.23.0\syncthing.exe => No File FirewallRules: [{0042511E-4FD2-4A7D-93AC-4D7746F6DE97}] => (Block) C:\users\ivanc\onedrive\desktop\syncthing-windows-amd64-v1.23.0\syncthing.exe => No File FirewallRules: [UDP Query User{6BBDA016-3BDF-4CDB-A31B-77C5B2EC65A4}C:\users\ivanc\onedrive\desktop\syncthing-windows-amd64-v1.23.0\syncthing.exe] => (Allow) C:\users\ivanc\onedrive\desktop\syncthing-windows-amd64-v1.23.0\syncthing.exe => No File FirewallRules: [TCP Query User{41915EAC-84D0-4FA9-A778-9685360512B6}C:\users\ivanc\onedrive\desktop\syncthing-windows-amd64-v1.23.0\syncthing.exe] => (Allow) C:\users\ivanc\onedrive\desktop\syncthing-windows-amd64-v1.23.0\syncthing.exe => No File FirewallRules: [{D77D27D4-47D9-4C2B-B4DC-7D5ED3E70092}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File FirewallRules: [{4A28D871-E46B-41B9-83A0-2E6B32D23CCB}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File FirewallRules: [TCP Query User{59047639-438C-4BAD-89BE-79E26E23A5F4}F:\games\steamgames\steamapps\common\overwatch\overwatch.exe] => (Block) F:\games\steamgames\steamapps\common\overwatch\overwatch.exe => No File FirewallRules: [UDP Query User{BC0AD973-2093-4E68-ADA8-FC4019007015}F:\games\steamgames\steamapps\common\overwatch\overwatch.exe] => (Block) F:\games\steamgames\steamapps\common\overwatch\overwatch.exe => No File FirewallRules: [{7173F95A-38A2-4E28-A021-E632E991B89C}] => (Allow) F:\Games\steamgames\steamapps\common\Wuthering Waves\Wuthering Waves.exe => No File FirewallRules: [{984ABFC7-D41F-4817-A876-FF83A36E7C8A}] => (Allow) F:\Games\steamgames\steamapps\common\Wuthering Waves\Wuthering Waves.exe => No File FirewallRules: [{C62A665D-7A11-45C8-9164-6726FA7BA5D0}] => (Block) C:\program files\adobe\adobe creative cloud experience\js\node_modules\@ccx\adobe-cr\build\Release\Adobe Crash Processor.exe => No File FirewallRules: [{C0763F00-28EC-435E-B717-F321045FC976}] => (Block) C:\program files\adobe\adobe creative cloud experience\js\node_modules\@ccx\adobe-cr\build\Release\CRLogTransport.exe => No File FirewallRules: [{22DDE321-6C51-473D-BA7F-490FB93CCF21}] => (Block) C:\program files\adobe\adobe creative cloud experience\js\node_modules\@ccx\adobe-cr\build\Release\CRWindowsClientService.exe => No File FirewallRules: [TCP Query User{15A0C51D-57F1-4577-BC39-3235DEE7820B}C:\games\overwatch\_retail_\overwatch.exe] => (Allow) C:\games\overwatch\_retail_\overwatch.exe => No File FirewallRules: [UDP Query User{B777394F-2395-4F20-AE66-9A468013FA54}C:\games\overwatch\_retail_\overwatch.exe] => (Allow) C:\games\overwatch\_retail_\overwatch.exe => No File FirewallRules: [{C8B754B7-4756-4FB3-AB52-6C52D78BAD34}] => (Allow) F:\Games\steamgames\steamapps\common\Helldivers 2\bin\helldivers2.exe => No File FirewallRules: [{47CD426B-847C-4D5C-ABC8-E5B0ABCF27D4}] => (Allow) F:\Games\steamgames\steamapps\common\Helldivers 2\bin\helldivers2.exe => No File FirewallRules: [TCP Query User{66A198CA-7686-4AD2-9239-BBADE2C17DCD}F:\games\steamgames\steamapps\common\watch_dogs2\bin\watchdogs2.exe] => (Allow) F:\games\steamgames\steamapps\common\watch_dogs2\bin\watchdogs2.exe => No File FirewallRules: [UDP Query User{AD378B28-B726-45AE-9435-DD9620519B54}F:\games\steamgames\steamapps\common\watch_dogs2\bin\watchdogs2.exe] => (Allow) F:\games\steamgames\steamapps\common\watch_dogs2\bin\watchdogs2.exe => No File FirewallRules: [TCP Query User{6F13CABF-0CDF-4208-9F85-2AD321231F41}F:\games\steamgames\steamapps\common\grand theft auto v enhanced\gta5_enhanced.exe] => (Allow) F:\games\steamgames\steamapps\common\grand theft auto v enhanced\gta5_enhanced.exe => No File FirewallRules: [UDP Query User{C19A24C5-AC60-4920-82B2-8428832813D2}F:\games\steamgames\steamapps\common\grand theft auto v enhanced\gta5_enhanced.exe] => (Allow) F:\games\steamgames\steamapps\common\grand theft auto v enhanced\gta5_enhanced.exe => No File FirewallRules: [TCP Query User{B87E2164-97E9-490E-BD34-E76A85FD1A9B}C:\program files\windowsapps\hueessentials.hueessentials_4.5.3.0_x64__yfdreesr38bg8\hue essentials.exe] => (Allow) C:\program files\windowsapps\hueessentials.hueessentials_4.5.3.0_x64__yfdreesr38bg8\hue essentials.exe => No File FirewallRules: [UDP Query User{CEBC4C52-BA3B-401C-ACF9-6852FF7A7974}C:\program files\windowsapps\hueessentials.hueessentials_4.5.3.0_x64__yfdreesr38bg8\hue essentials.exe] => (Allow) C:\program files\windowsapps\hueessentials.hueessentials_4.5.3.0_x64__yfdreesr38bg8\hue essentials.exe => No File FirewallRules: [{A18F5C8F-EB43-48E0-B2CC-F97CC508BF6E}] => (Allow) E:\steamlibrary\steamapps\common\MSFS2024\FlightSimulator2024.exe => No File FirewallRules: [{E89FCC6E-0189-498F-8402-9CD3F0F0785B}] => (Allow) E:\steamlibrary\steamapps\common\MSFS2024\FlightSimulator2024.exe => No File FirewallRules: [TCP Query User{D7794B6B-1CA4-44CD-B789-923AA1DBF93E}E:\steamlibrary\steamapps\common\grand theft auto v\gta5.exe] => (Allow) E:\steamlibrary\steamapps\common\grand theft auto v\gta5.exe => No File FirewallRules: [UDP Query User{56173194-1287-417F-B3EA-413D0A6B1CBF}E:\steamlibrary\steamapps\common\grand theft auto v\gta5.exe] => (Allow) E:\steamlibrary\steamapps\common\grand theft auto v\gta5.exe => No File FirewallRules: [{A3F3D284-584B-4883-92EF-F1C0C9EC653B}] => (Allow) D:\Neverness To Everness\NTEGlobal\NTEGlobalGame.exe => No File FirewallRules: [{0C21CCB8-F533-471E-AB11-135F8390CA93}] => (Allow) D:\Neverness To Everness\NTEGlobal\NTEGlobalGame.exe => No File FirewallRules: [{E308CAEF-BBC1-41BA-9860-8B00BD54515E}] => (Allow) D:\Neverness To Everness\NTEGlobal\NTEGlobalUpdate.exe => No File FirewallRules: [{10C5E5F7-F1D9-4811-B341-7CC48786CA89}] => (Allow) D:\Neverness To Everness\NTEGlobal\NTEGlobalUpdate.exe => No File FirewallRules: [{ABCDA41B-677B-4E0F-91A4-3A918DA625D3}] => (Allow) D:\Neverness To Everness\NTEGlobal\NTEGlobalBrowser.exe => No File FirewallRules: [{A4A3D306-CAE6-49A9-9781-71FFA3969C24}] => (Allow) D:\Neverness To Everness\NTEGlobal\NTEGlobalBrowser.exe => No File FirewallRules: [{E50B9E46-CEAF-4D0F-A026-40AE9A30BFA7}] => (Allow) D:\Neverness To Everness\NTEGlobal\NTEGlobalWebBooster.exe => No File FirewallRules: [{57AE01B4-AFC8-4796-9E95-B37E123DDFB6}] => (Allow) D:\Neverness To Everness\NTEGlobal\NTEGlobalWebBooster.exe => No File FirewallRules: [{04D799C6-BE60-45FB-9FA0-FF8D3D424CEC}] => (Allow) D:\Neverness To Everness\Client\WindowsNoEditor\HT\Binaries\Win64\HTGame.exe => No File FirewallRules: [{E80C658A-97EE-41F2-BB7C-43A18CDC6077}] => (Allow) D:\Neverness To Everness\Client\WindowsNoEditor\HT\Binaries\Win64\HTGame.exe => No File FirewallRules: [{5C1D4F12-0817-4DE1-8DF4-5C74074A3F30}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Zenless Zone Zero\HYP.exe => No File FirewallRules: [{1CE4F4D3-A01D-4563-A483-ADCE733F2309}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Zenless Zone Zero\HYP.exe => No File FirewallRules: [{172523AE-8206-49C5-B035-878D7B5DD7D9}] => (Allow) D:\Games\SteamLibrary\steamapps\common\Neverness to Everness\NTEGlobal\NTEGlobalLauncher.exe => No File FirewallRules: [{7097A55B-5BFF-4B68-8A7C-D06DED0FAABB}] => (Allow) D:\Games\SteamLibrary\steamapps\common\Neverness to Everness\NTEGlobal\NTEGlobalLauncher.exe => No File FirewallRules: [{F3923C3D-1C79-4B69-B848-1D48A641C9F3}] => (Allow) D:\Games\SteamLibrary\steamapps\common\Neverness to Everness\NTEGlobal\NTEGlobalGame.exe => No File FirewallRules: [{BB5CC7C0-5547-4ADA-96F4-B7B5AF7D0B6E}] => (Allow) D:\Games\SteamLibrary\steamapps\common\Neverness to Everness\NTEGlobal\NTEGlobalGame.exe => No File FirewallRules: [{9DC2DF23-19D4-4D9C-B703-7D3D7E127C88}] => (Allow) D:\Games\SteamLibrary\steamapps\common\Neverness to Everness\NTEGlobal\NTEGlobalUpdate.exe => No File FirewallRules: [{F2C0843C-8483-4B4D-B377-D3162A953A8A}] => (Allow) D:\Games\SteamLibrary\steamapps\common\Neverness to Everness\NTEGlobal\NTEGlobalUpdate.exe => No File FirewallRules: [{388E0E1D-5266-4CD0-A63E-E9C5D78FBD8B}] => (Allow) D:\Games\SteamLibrary\steamapps\common\Neverness to Everness\NTEGlobal\NTEGlobalBrowser.exe => No File FirewallRules: [{0AB103BC-8FF7-4882-AC85-F68142CFA883}] => (Allow) D:\Games\SteamLibrary\steamapps\common\Neverness to Everness\NTEGlobal\NTEGlobalBrowser.exe => No File FirewallRules: [{92065FC6-5F16-4953-9346-494CB5060610}] => (Allow) D:\Games\SteamLibrary\steamapps\common\Neverness to Everness\NTEGlobal\NTEGlobalWebBooster.exe => No File FirewallRules: [{138DAA22-9A58-474A-A363-55CD9730FA0A}] => (Allow) D:\Games\SteamLibrary\steamapps\common\Neverness to Everness\NTEGlobal\NTEGlobalWebBooster.exe => No File FirewallRules: [{0D392EB0-1891-46C6-BF95-B225918D06B4}] => (Allow) D:\Games\SteamLibrary\steamapps\common\Neverness to Everness\Client\WindowsNoEditor\HT\Binaries\Win64\HTGame.exe => No File FirewallRules: [{9D054B4E-2684-4E56-9890-E55B78574E75}] => (Allow) D:\Games\SteamLibrary\steamapps\common\Neverness to Everness\Client\WindowsNoEditor\HT\Binaries\Win64\HTGame.exe => No File FirewallRules: [{7613A28D-C8DD-41A1-86FD-BCBEA4CDFB9B}] => (Allow) F:\Games\steamgames\steamapps\common\Neverness to Everness\NTEGlobal\NTEGlobalLauncher.exe => No File FirewallRules: [{9BB58E4F-0B5D-4AAA-A902-B4CB2875F3FB}] => (Allow) F:\Games\steamgames\steamapps\common\Neverness to Everness\NTEGlobal\NTEGlobalLauncher.exe => No File FirewallRules: [{1AE4D804-1EA7-40D2-9B36-4A6B1547B312}] => (Allow) F:\Games\steamgames\steamapps\common\Neverness to Everness\NTEGlobal\NTEGlobalGame.exe => No File FirewallRules: [{E67D5260-C605-4B15-AFD2-CE34143FFF50}] => (Allow) F:\Games\steamgames\steamapps\common\Neverness to Everness\NTEGlobal\NTEGlobalGame.exe => No File FirewallRules: [{EB011FA3-FEAA-4B9A-8E1F-744A8C3E2CCD}] => (Allow) F:\Games\steamgames\steamapps\common\Neverness to Everness\NTEGlobal\NTEGlobalUpdate.exe => No File FirewallRules: [{66FAF39F-BE18-4048-B361-3837CF73FD1B}] => (Allow) F:\Games\steamgames\steamapps\common\Neverness to Everness\NTEGlobal\NTEGlobalUpdate.exe => No File FirewallRules: [{969B005E-ADC2-440B-8541-497024DB65AF}] => (Allow) F:\Games\steamgames\steamapps\common\Neverness to Everness\NTEGlobal\NTEGlobalBrowser.exe => No File FirewallRules: [{E831E68E-8AC2-41A0-A76B-1FA9BD088AAE}] => (Allow) F:\Games\steamgames\steamapps\common\Neverness to Everness\NTEGlobal\NTEGlobalBrowser.exe => No File FirewallRules: [{F77F4466-D9A4-4827-B9F4-E56B27D4BF25}] => (Allow) F:\Games\steamgames\steamapps\common\Neverness to Everness\NTEGlobal\NTEGlobalWebBooster.exe => No File FirewallRules: [{6D917C7E-68A6-4C19-9581-AD59265657CD}] => (Allow) F:\Games\steamgames\steamapps\common\Neverness to Everness\NTEGlobal\NTEGlobalWebBooster.exe => No File FirewallRules: [{5F441D0C-5D72-4A7D-8C32-FCF9966534A2}] => (Allow) F:\Games\steamgames\steamapps\common\Neverness to Everness\Client\WindowsNoEditor\HT\Binaries\Win64\HTGame.exe => No File FirewallRules: [{70EF1DCE-2AA6-4427-91C9-258EE7401EEF}] => (Allow) F:\Games\steamgames\steamapps\common\Neverness to Everness\Client\WindowsNoEditor\HT\Binaries\Win64\HTGame.exe => No File HKLM\...\Run: [SteOptimizer] => C:\ProgramData\InProcSvr32\SteOptimizer.exe (No File) HKU\S-1-5-21-1066710034-326992338-341540203-1001\...\Run: [Teams] => "C:\Users\ivanc\AppData\Local\Microsoft\WindowsApps\MSTeams_8wekyb3d8bbwe\ms-teams.exe" msteams:system-initiated (No File) HKU\S-1-5-21-1066710034-326992338-341540203-1001\...\Run: [SteOptimizer] => C:\ProgramData\InProcSvr32\SteOptimizer.exe (No File) <==== ATTENTION ShortcutTarget: LG Monitor App Installer.lnk -> (No File) Task: {C3555B53-32F0-4A2B-9EE3-C306CBFD2344} - System32\Tasks\AMDRyzenMasterSDKTask => "C:\Program Files\AMD\CNext\CNext\cpumetricsserver.exe" (No File) Task: {A9E6F3C1-34D6-4E68-B915-6683551480F3} - System32\Tasks\ArnoldVink_DirectXInput => C:\Users\ivanc\Desktop\CtrlUI\DirectXInput-Launcher.exe (No File) Task: {386EFCBD-8146-47BA-8964-D5A6594695B2} - System32\Tasks\Microsoft\Windows\Clip\ClipESUConsumerProcessECUpdate => %SystemRoot%\system32\ClipESUConsumer.exe -persistEligibilityStatus (No File) Task: {6CA6996A-F3E2-4AAD-A3D7-8857DC932D64} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe (No File) Task: {7D739C2F-BAAB-4A2A-BFC9-6F463D441A63} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => %SystemRoot%\System32\MbaeParserTask.exe (No File) Task: {3098B440-DF14-4FF3-AE0E-09665A97FECC} - System32\Tasks\Microsoft\Windows\UNP\RunUpdateNotificationMgr => %windir%\System32\UNP\UpdateNotificationMgr.exe (No File) Task: {1BADC26C-1487-44C2-945D-C5BF867B3DB3} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_AC => %systemroot%\system32\MusNotification.exe /RunOnAC RebootDialog (No File) Task: {A57A3792-ECE3-43AA-A747-8E341025D157} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery => %systemroot%\system32\MusNotification.exe /RunOnBattery RebootDialog (No File) Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe (No File) U3 PGameProtectDriver; \??\F:\Games\steamgames\steamapps\common\Neverness to Everness\NTEGlobal\driver\PGameProtectDriver_X64.sys (No File) S2 WinRing0x64; System32\Drivers\WinRing0x64.sys (No File) 2026-09-07 11:15 - 2026-09-07 11:15 - 000000000 ____D C:\Users\Public\.ff_tmp 2025-01-03 01:16 - 2025-01-03 01:16 - 000000048 ____R () C:\Users\ivanc\AppData\Local\E1383F43476FFAF36E859734703C5A8F HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Restriction <==== ATTENTION HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Restriction <==== ATTENTION HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION GroupPolicy: Restriction ? <==== ATTENTION Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION R3 HWiNFO_156; \??\C:\Users\ivanc\AppData\Local\Temp\HWiNFO64A_156.SYS [64496 2026-09-08] (Martin Malik - REALiX -> ) <==== ATTENTION SearchScopes: HKU\S-1-5-21-1066710034-326992338-341540203-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = HKU\S-1-5-21-1066710034-326992338-341540203-1001\...\StartupApproved\StartupFolder: => "SteOptimizer.lnk" File: C:\Users\ivanc\.cache\node-systray\1.0.5\tray_windows_release.exe File: C:\Users\ivanc\Desktop\windows_64bit\server_win.exe File: C:\Program Files\LogiDownloadAssistant\bin\logi_download_assistant.exe File: C:\ProgramData\ivanc\Discord\Update.exe File: C:\WINDOWS\system32\scrnsave.scr File: C:\Program Files\FAHClient\HideConsole.exe Folder: C:\Program Files\Oculus 2026-09-07 11:16 - 2026-09-07 11:16 - 000000000 ____D C:\Users\ivanc\AppData\Local\TP-Link 2026-09-07 11:17 - 2026-09-07 11:17 - 000000000 ____D C:\ProgramData\docker_mgmt_v2_0_rtm 2026-09-07 11:18 - 2026-09-07 11:18 - 000000000 ____D C:\Users\ivanc\AppData\Local\Yandex 2026-09-07 11:18 - 2026-09-07 11:18 - 000000000 ____D C:\Users\ivanc\AppData\Roaming\docker_mgmt_v2_0_rtm 2026-09-07 11:15 - 2026-09-07 11:15 - 000000000 ____D C:\Users\Public\.ff_tmp 2026-09-07 11:18 - 2026-09-07 11:18 - 000640568 _____ (Microsoft Corporation) C:\Users\ivanc\MatriOrchestrator.exe Startup: C:\Users\ivanc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LG Monitor App Installer.lnk [2026-09-08] FF Notifications: Mozilla\Firefox\Profiles\n760fe3d.default-release -> hxxps://d3cmnn8hubcc73dfimeg.trovixnero.co.in; hxxps://k1jrlcw3xoggsd.trovixnero.co.in File: C:\WINDOWS\System32\IsoSessionServer.dll StartPowerShell: #Requires -Version 5.1 $ProductCodes = @( '{E10DE145-BB7B-4A95-9BA5-D0EF1F8687E6}' ) $DoComSweep = $false $DoRawSweep = $false $DoNameSweep = $false $ErrorActionPreference = 'SilentlyContinue' $ProgressPreference = 'SilentlyContinue' $script:SW = [Diagnostics.Stopwatch]::StartNew() function W { param([string]$s = '') Write-Output $s } function H { param([string]$t) W '' W ('-' * 100) W ('{0} [+{1:N1}s]' -f $t, $script:SW.Elapsed.TotalSeconds) W ('-' * 100) } function KV { param([string]$k, $v) if ($null -eq $v -or "$v" -eq '') { $v = '<none>' } W (' {0,-24} {1}' -f $k, $v) } function Pack { param([string]$g) $x = ($g -replace '[{}\-\s]', '').ToUpper() if ($x.Length -ne 32) { throw "bad guid: $g" } $o = -join $x[7..0] $o += -join $x[11..8] $o += -join $x[15..12] for ($i = 16; $i -lt 32; $i += 2) { $o += $x[$i + 1] + $x[$i] } $o } function Native { param([string]$p) $p -replace '^HKLM:\\', 'HKLM\' -replace '^HKCU:\\', 'HKCU\' ` -replace '^HKCR:\\', 'HKCR\' -replace '^HKU:\\', 'HKU\' } function DumpKey { param([string]$Path, [string]$Label = '') if (-not (Test-Path -LiteralPath $Path)) { return } W (Native $Path) if ($Label) { W " [$Label]" } $p = Get-ItemProperty -LiteralPath $Path $names = @($p.PSObject.Properties.Name | Where-Object { $_ -notlike 'PS*' } | Sort-Object) if ($names.Count -eq 0) { W ' <no values>' } foreach ($n in $names) { $v = $p.$n if ($v -is [byte[]]) { if ($v.Length -gt 64) { $v = (($v[0..63] | ForEach-Object { $_.ToString('x2') }) -join '') + "... ($($v.Length) bytes)" } else { $v = ($v | ForEach-Object { $_.ToString('x2') }) -join '' } } elseif ($v -is [array]) { $v = $v -join ' ; ' } KV $n $v } W '' } function MsiTable { param([string]$Path, [string]$Query) try { $i = New-Object -ComObject WindowsInstaller.Installer $db = $i.GetType().InvokeMember('OpenDatabase', 'InvokeMethod', $null, $i, @($Path, 0)) $v = $db.GetType().InvokeMember('OpenView', 'InvokeMethod', $null, $db, @($Query)) $v.GetType().InvokeMember('Execute', 'InvokeMethod', $null, $v, $null) while ($r = $v.GetType().InvokeMember('Fetch', 'InvokeMethod', $null, $v, $null)) { $n = $r.GetType().InvokeMember('FieldCount', 'GetProperty', $null, $r, $null) , @(for ($k = 1; $k -le $n; $k++) { $r.GetType().InvokeMember('StringData', 'GetProperty', $null, $r, $k) }) } $v.GetType().InvokeMember('Close', 'InvokeMethod', $null, $v, $null) [void][Runtime.InteropServices.Marshal]::ReleaseComObject($i) } catch { } } function RootToHive { param($r) switch ("$r") { '-1' { 'HKMU' } '0' { 'HKCR' } '1' { 'HKCU' } '2' { 'HKLM' } '3' { 'HKU' } default { "root$r" } } } function KeyPathPrefixToHive { param([string]$p) switch ($p) { '00' { 'HKCR' } '01' { 'HKCU' } '02' { 'HKLM' } '03' { 'HKU' } '20' { 'HKLM(64)' } '21' { 'HKCU(64)' } '22' { 'HKLM(64)' } '23' { 'HKU(64)' } default { "root$p" } } } $HKLM = [Microsoft.Win32.RegistryHive]::LocalMachine $HKCU = [Microsoft.Win32.RegistryHive]::CurrentUser $V64 = [Microsoft.Win32.RegistryView]::Registry64 $V32 = [Microsoft.Win32.RegistryView]::Registry32 function OpenBase { param($Hive, $View) [Microsoft.Win32.RegistryKey]::OpenBaseKey($Hive, $View) } $script:SysDirs = @( "$env:SystemRoot", "$env:SystemRoot\System32", "$env:SystemRoot\SysWOW64", "$env:SystemRoot\System32\drivers", "$env:SystemRoot\System32\wbem", "$env:SystemRoot\WinSxS", "$env:SystemRoot\assembly", "$env:ProgramData", "$env:ProgramData\Microsoft", "$env:ProgramFiles", "${env:ProgramFiles(x86)}", "$env:ProgramFiles\Common Files", "${env:ProgramFiles(x86)}\Common Files", "$env:ProgramFiles\Common Files\Microsoft Shared", "${env:ProgramFiles(x86)}\Common Files\Microsoft Shared", "$env:LOCALAPPDATA", "$env:LOCALAPPDATA\Programs", "$env:APPDATA", "$env:USERPROFILE", 'C:\' ) | Where-Object { $_ } | ForEach-Object { $_.TrimEnd('\').ToLower() } function Normalize-Path { param([string]$p) if ([string]::IsNullOrWhiteSpace($p)) { return $null } $s = $p.Trim() if ($s.StartsWith('"')) { $e = $s.IndexOf('"', 1) if ($e -gt 0) { $s = $s.Substring(1, $e - 1) } else { $s = $s.Trim('"') } } else { $m = [regex]::Match($s, '\s+[-/]') if ($m.Success) { $s = $s.Substring(0, $m.Index) } } $s = [Environment]::ExpandEnvironmentVariables($s) $s = ($s -replace '^\\\?\?\\', '' -replace '^@', '').Trim() if ($s -match '^[A-Za-z]:\\') { return $s.TrimEnd('\').ToLower() } if ($s -match '^[^\\/:*?"<>|]+\.(dll|exe|ocx|cpl|sys)$') { return $s.ToLower() } return $null } $script:OwnPaths = $null $script:OwnNames = $null $script:OwnDirs = @() function Test-Own { param([string]$c) $n = Normalize-Path $c if (-not $n) { return $false } if ($script:OwnPaths.Contains($n)) { return $true } foreach ($d in $script:OwnDirs) { if ($n.StartsWith($d + '\')) { return $true } } if ($n -notmatch '\\' -and $script:OwnNames.Contains($n)) { return $true } return $false } function Get-FileFacts { param([string]$Path) if (-not (Test-Path -LiteralPath $Path -PathType Leaf)) { return $null } $fi = Get-Item -LiteralPath $Path $vi = $fi.VersionInfo $sig = Get-AuthenticodeSignature -LiteralPath $Path [PSCustomObject]@{ Size = $fi.Length Created = $fi.CreationTime.ToString('yyyy-MM-dd HH:mm:ss') Modified = $fi.LastWriteTime.ToString('yyyy-MM-dd HH:mm:ss') Company = $vi.CompanyName Product = $vi.ProductName OrigName = $vi.OriginalFilename IntName = $vi.InternalName FileVer = $vi.FileVersion Desc = $vi.FileDescription SigStatus = "$($sig.Status)" Signer = $(if ($sig.SignerCertificate) { $sig.SignerCertificate.Subject }) SHA256 = (Get-FileHash -LiteralPath $Path -Algorithm SHA256).Hash } } W ('=' * 100) W ('MSI REGISTRATION FOOTPRINT {0}' -f (Get-Date -Format 'yyyy-MM-dd HH:mm:ss')) W ('HOST {0} USER {1}' -f $env:COMPUTERNAME, $env:USERNAME) W ('OS {0}' -f (Get-CimInstance Win32_OperatingSystem).Caption) W ('ELEVATED {0}' -f (New-Object Security.Principal.WindowsPrincipal( [Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole( [Security.Principal.WindowsBuiltInRole]::Administrator)) W ('SWEEPS com={0} raw={1} name={2}' -f $DoComSweep, $DoRawSweep, $DoNameSweep) W ('=' * 100) foreach ($pc in $ProductCodes) { $packed = Pack $pc $shortPc = ($pc -replace '[{}]', '') $script:OwnPaths = New-Object 'System.Collections.Generic.HashSet[string]' $script:OwnNames = New-Object 'System.Collections.Generic.HashSet[string]' $script:OwnDirs = @() $localPkg = $null $installLoc = $null $publisher = $null $displayName = $null $compFiles = New-Object System.Collections.ArrayList $compRegs = New-Object System.Collections.ArrayList $touchedKeys = New-Object System.Collections.ArrayList W '' W ('=' * 100) W "PRODUCTCODE $pc" W "PACKED $packed" W ('=' * 100) H '1. UNINSTALL / ARP' $found = $false foreach ($k in @( "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$pc", "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\$pc", "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$pc")) { if (-not (Test-Path -LiteralPath $k)) { continue } $found = $true [void]$touchedKeys.Add((Native $k)) DumpKey $k $p = Get-ItemProperty -LiteralPath $k if (-not $displayName) { $displayName = $p.DisplayName } if (-not $publisher) { $publisher = $p.Publisher } if (-not $installLoc) { $installLoc = $p.InstallLocation } if (-not $installLoc -and $p.DisplayIcon) { $ic = ($p.DisplayIcon -split ',')[0].Trim('"') if ($ic -match '\\') { $installLoc = Split-Path $ic -Parent } } } if (-not $found) { W '<none>' } H '2. INSTALLER BRANCH' $roots = @( "HKLM:\SOFTWARE\Classes\Installer\Products\$packed", "HKLM:\SOFTWARE\Classes\Installer\Features\$packed", "HKLM:\SOFTWARE\Classes\Installer\Patches\$packed" ) $bk = OpenBase $HKLM $V64 $ud = $bk.OpenSubKey('SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData') if ($ud) { foreach ($sid in $ud.GetSubKeyNames()) { $roots += "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\$sid\Products\$packed" } $ud.Close() } $bk.Close() $found = $false foreach ($r in ($roots | Sort-Object -Unique)) { if (-not (Test-Path -LiteralPath $r)) { continue } $found = $true [void]$touchedKeys.Add((Native $r)) foreach ($sub in @('', '\InstallProperties', '\SourceList', '\SourceList\Net', '\SourceList\Media', '\Usage', '\Features', '\Patches')) { DumpKey "$r$sub" $sub.TrimStart('\') } $ip = Get-ItemProperty -LiteralPath "$r\InstallProperties" if ($ip) { if (-not $localPkg) { $localPkg = $ip.LocalPackage } if (-not $installLoc) { $installLoc = $ip.InstallLocation } if (-not $publisher) { $publisher = $ip.Publisher } if (-not $displayName) { $displayName = $ip.DisplayName } } } if (-not $found) { W '<none>' } W '' W 'RESOLVED:' KV 'DisplayName' $displayName KV 'Publisher' $publisher KV 'InstallLocation' $installLoc KV 'LocalPackage' $localPkg H '3. UPGRADECODE MEMBERSHIP' $found = $false foreach ($cfg in @( @{ Path = 'SOFTWARE\Classes\Installer\UpgradeCodes'; Label = 'HKLM\SOFTWARE\Classes\Installer\UpgradeCodes' }, @{ Path = 'SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes'; Label = 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes' })) { $bk = OpenBase $HKLM $V64 $root = $bk.OpenSubKey($cfg.Path) if ($root) { foreach ($sub in $root.GetSubKeyNames()) { $k = $root.OpenSubKey($sub) if (-not $k) { continue } if ($k.GetValueNames() -contains $packed) { $found = $true W ('{0}\{1}' -f $cfg.Label, $sub) KV 'upgradecode (packed)' $sub KV 'member value' $k.GetValue($packed) W '' } $k.Close() } $root.Close() } $bk.Close() } if (-not $found) { W '<none>' } H '4. COMPONENT REGISTRATION' $found = $false $dirCand = New-Object System.Collections.ArrayList foreach ($cfg in @( @{ Path = 'SOFTWARE\Classes\Installer\Components'; Label = 'HKLM\SOFTWARE\Classes\Installer\Components' }, @{ Path = 'SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components'; Label = 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components' })) { $bk = OpenBase $HKLM $V64 $root = $bk.OpenSubKey($cfg.Path) if ($root) { foreach ($sub in $root.GetSubKeyNames()) { $k = $root.OpenSubKey($sub) if (-not $k) { continue } $vn = $k.GetValueNames() if ($vn -contains $packed) { $found = $true $val = "$($k.GetValue($packed))" W ('{0}\{1}' -f $cfg.Label, $sub) KV 'componentid' $sub KV 'keypath' $val $shared = @($vn | Where-Object { $_ -and $_ -ne $packed }) if ($shared.Count) { KV 'shared with' ($shared -join ', ') } W '' if ($val -match '^\d{2}:') { [void]$compRegs.Add($val) } elseif ($val -match '^[A-Za-z]:\\') { [void]$compFiles.Add($val) $n = Normalize-Path $val if ($n) { [void]$script:OwnPaths.Add($n) [void]$script:OwnNames.Add([IO.Path]::GetFileName($n)) [void]$dirCand.Add((Split-Path $n -Parent)) } } } $k.Close() } $root.Close() } $bk.Close() } if (-not $found) { W '<none>' } if ($installLoc -and (Test-Path -LiteralPath $installLoc)) { $il = $installLoc.TrimEnd('\').ToLower() if ($script:SysDirs -notcontains $il) { [void]$dirCand.Add($il) Get-ChildItem -LiteralPath $installLoc -Recurse -File | ForEach-Object { [void]$script:OwnPaths.Add($_.FullName.ToLower()) [void]$script:OwnNames.Add($_.Name.ToLower()) } } } $script:OwnDirs = @($dirCand | Where-Object { $_ } | Sort-Object -Unique | Where-Object { $script:SysDirs -notcontains $_ -and $_.Split('\').Count -ge 3 }) H '5. MSI DATABASE (cached package)' if ($localPkg -and (Test-Path -LiteralPath $localPkg)) { KV 'package' $localPkg $pf = Get-FileFacts $localPkg if ($pf) { KV 'size' $pf.Size KV 'created' $pf.Created KV 'modified' $pf.Modified KV 'sha256' $pf.SHA256 } W '' W '[Property]' MsiTable $localPkg 'SELECT Property, Value FROM Property' | ForEach-Object { W (' {0,-30} {1}' -f $_[0], $_[1]) } W '' W '[Registry] msi row -> live registry state' $rows = @(MsiTable $localPkg 'SELECT Root, Key, Name, Value, Component_ FROM Registry') if ($rows.Count -eq 0) { W ' <empty or unreadable>' } foreach ($row in $rows) { $hive = RootToHive $row[0] $key = $row[1] $name = $row[2] $cands = switch ($hive) { 'HKLM' { @("HKLM:\SOFTWARE\$key", "HKLM:\SOFTWARE\WOW6432Node\$key", "HKLM:\$key") } 'HKMU' { @("HKLM:\SOFTWARE\$key", "HKLM:\SOFTWARE\WOW6432Node\$key", "HKCU:\SOFTWARE\$key", "HKLM:\$key") } 'HKCU' { @("HKCU:\SOFTWARE\$key", "HKCU:\$key") } 'HKCR' { @("HKLM:\SOFTWARE\Classes\$key", "HKLM:\SOFTWARE\Classes\WOW6432Node\$key", "HKCU:\SOFTWARE\Classes\$key") } default { @("HKLM:\$key") } } $hitPath = $null $hitVal = $null foreach ($lp in $cands) { if (Test-Path -LiteralPath $lp) { $hitPath = Native $lp if ($name) { $lv = (Get-ItemProperty -LiteralPath $lp).$name if ($null -ne $lv) { $hitVal = "$lv" } } break } } W (' {0} {1}\{2}' -f $(if ($hitPath) { 'PRESENT' } else { 'ABSENT ' }), $hive, $key) if ($name) { KV ' value name' $name } KV ' msi value' $row[3] if ($hitPath) { KV ' live key' $hitPath if ($name) { KV ' live value' $hitVal } } KV ' component' $row[4] } W '' W '[Class]' $cls = @(MsiTable $localPkg 'SELECT CLSID, Context, Component_, ProgId_Default, Description FROM Class') if ($cls.Count -eq 0) { W ' <none>' } foreach ($c in $cls) { W (' {0} ctx={1} comp={2} progid={3} {4}' -f $c[0], $c[1], $c[2], $c[3], $c[4]) foreach ($lp in @("HKLM:\SOFTWARE\Classes\CLSID\$($c[0])", "HKLM:\SOFTWARE\Classes\WOW6432Node\CLSID\$($c[0])", "HKCU:\SOFTWARE\Classes\CLSID\$($c[0])")) { if (-not (Test-Path -LiteralPath $lp)) { continue } W (' LIVE {0}' -f (Native $lp)) foreach ($srv in @('InprocServer32', 'LocalServer32', 'InprocHandler32')) { if (Test-Path -LiteralPath "$lp\$srv") { W (' {0} = {1}' -f $srv, "$((Get-ItemProperty -LiteralPath "$lp\$srv").'(default)')") } } } } W '' W '[ProgId]' $pg = @(MsiTable $localPkg 'SELECT ProgId, Class_, Description FROM ProgId') if ($pg.Count -eq 0) { W ' <none>' } foreach ($g in $pg) { $st = if (Test-Path -LiteralPath "HKLM:\SOFTWARE\Classes\$($g[0])") { 'PRESENT' } else { 'ABSENT ' } W (' {0} {1,-40} class={2} {3}' -f $st, $g[0], $g[1], $g[2]) } W '' W '[TypeLib]' $tl = @(MsiTable $localPkg 'SELECT LibID, Version, Component_, Description FROM TypeLib') if ($tl.Count -eq 0) { W ' <none>' } foreach ($t in $tl) { $st = if (Test-Path -LiteralPath "HKLM:\SOFTWARE\Classes\TypeLib\$($t[0])") { 'PRESENT' } else { 'ABSENT ' } W (' {0} {1} ver={2} comp={3} {4}' -f $st, $t[0], $t[1], $t[2], $t[3]) } W '' W '[Extension]' $ex = @(MsiTable $localPkg 'SELECT Extension, Component_, ProgId_, MIME_ FROM Extension') if ($ex.Count -eq 0) { W ' <none>' } foreach ($e in $ex) { $st = if (Test-Path -LiteralPath "HKLM:\SOFTWARE\Classes\.$($e[0])") { 'PRESENT' } else { 'ABSENT ' } W (' {0} .{1} comp={2} progid={3} mime={4}' -f $st, $e[0], $e[1], $e[2], $e[3]) } W '' W '[AppId]' $ai = @(MsiTable $localPkg 'SELECT AppId, RemoteServerName, ServiceParameters, DllSurrogate FROM AppId') if ($ai.Count -eq 0) { W ' <none>' } foreach ($a in $ai) { $st = if (Test-Path -LiteralPath "HKLM:\SOFTWARE\Classes\AppID\$($a[0])") { 'PRESENT' } else { 'ABSENT ' } W (' {0} {1} surrogate={2}' -f $st, $a[0], $a[3]) } W '' W '[Directory]' MsiTable $localPkg 'SELECT Directory, Directory_Parent, DefaultDir FROM Directory' | ForEach-Object { W (' {0,-28} parent={1,-26} {2}' -f $_[0], $_[1], $_[2]) } W '' W '[Component]' MsiTable $localPkg 'SELECT Component, ComponentId, Directory_, Attributes, KeyPath FROM Component' | ForEach-Object { W (' {0,-30} {1,-40} dir={2,-22} attr={3,-6} key={4}' -f $_[0], $_[1], $_[2], $_[3], $_[4]) } W '' W '[File]' MsiTable $localPkg 'SELECT File, Component_, FileName, FileSize, Version FROM File' | ForEach-Object { W (' {0,-40} comp={1,-30} size={2,-10} ver={3}' -f ($_[2] -split '\|')[-1], $_[1], $_[3], $_[4]) } W '' W '[ServiceInstall]' $si = @(MsiTable $localPkg 'SELECT ServiceInstall, Name, DisplayName, ServiceType, StartType, LoadOrderGroup, Dependencies, StartName, Password, Arguments, Component_ FROM ServiceInstall') if ($si.Count -eq 0) { W ' <none>' } foreach ($s in $si) { W (' {0} name={1} disp={2} type={3} start={4} runas={5} args={6} comp={7}' -f $s[0], $s[1], $s[2], $s[3], $s[4], $s[7], $s[9], $s[10]) } W '' W '[CustomAction]' $ca = @(MsiTable $localPkg 'SELECT Action, Type, Source, Target FROM CustomAction') if ($ca.Count -eq 0) { W ' <none>' } foreach ($c in $ca) { W (' {0,-36} type={1,-8} src={2,-30} target={3}' -f $c[0], $c[1], $c[2], $c[3]) } W '' W '[Binary]' $bn = @(MsiTable $localPkg 'SELECT Name FROM Binary') if ($bn.Count -eq 0) { W ' <none>' } foreach ($b in $bn) { W (' {0}' -f $b[0]) } W '' W '[InstallExecuteSequence]' MsiTable $localPkg 'SELECT Action, Condition, Sequence FROM InstallExecuteSequence' | Sort-Object { [int]$_[2] } | ForEach-Object { W (' {0,-6} {1,-40} {2}' -f $_[2], $_[0], $_[1]) } W '' W '[Shortcut]' $sc = @(MsiTable $localPkg 'SELECT Shortcut, Directory_, Name, Target, Arguments FROM Shortcut') if ($sc.Count -eq 0) { W ' <none>' } foreach ($s in $sc) { W (' {0,-28} dir={1,-22} name={2,-28} target={3} {4}' -f $s[0], $s[1], ($s[2] -split '\|')[-1], $s[3], $s[4]) } } else { W '<cached msi unavailable>' KV 'LocalPackage' $localPkg } H '6. LIVE COM REGISTRATION' KV 'own files' $script:OwnPaths.Count KV 'own dirs' $(if ($script:OwnDirs.Count) { $script:OwnDirs -join ' | ' } else { '<none>' }) $ign = @($dirCand | Sort-Object -Unique | Where-Object { $script:SysDirs -contains $_ }) if ($ign.Count) { KV 'ignored sysdirs' ($ign -join ' | ') } W '' if (-not $DoComSweep) { W '<skipped: DoComSweep is false>' } elseif ($script:OwnPaths.Count -eq 0 -and $script:OwnDirs.Count -eq 0) { W '<no product binaries to match against>' } else { $hits = 0 foreach ($cfg in @( @{ Hive = $HKLM; View = $V64; Label = 'HKLM(64)' }, @{ Hive = $HKLM; View = $V32; Label = 'HKLM(32)' }, @{ Hive = $HKCU; View = $V64; Label = 'HKCU' })) { $bk = OpenBase $cfg.Hive $cfg.View $root = $bk.OpenSubKey('SOFTWARE\Classes\CLSID') if ($root) { foreach ($clsid in $root.GetSubKeyNames()) { $ck = $root.OpenSubKey($clsid) if (-not $ck) { continue } $subs = $ck.GetSubKeyNames() foreach ($srv in @('InprocServer32', 'LocalServer32', 'InprocHandler32')) { if ($subs -notcontains $srv) { continue } $sk = $ck.OpenSubKey($srv) if (-not $sk) { continue } $raw = "$($sk.GetValue(''))" if ($raw -and (Test-Own $raw)) { $hits++ W ('{0}\SOFTWARE\Classes\CLSID\{1}' -f $cfg.Label, $clsid) KV 'default' "$($ck.GetValue(''))" KV $srv $raw $tm = $sk.GetValue('ThreadingModel') if ($tm) { KV 'ThreadingModel' $tm } $ap = $ck.GetValue('AppID') if ($ap) { KV 'AppID' $ap } foreach ($e in @('ProgID', 'VersionIndependentProgID', 'TreatAs', 'Elevation')) { if ($subs -contains $e) { $ek = $ck.OpenSubKey($e) if ($ek) { KV $e "$($ek.GetValue(''))"; $ek.Close() } } } W '' } $sk.Close() } $ck.Close() } $root.Close() } $bk.Close() } foreach ($cfg in @( @{ Hive = $HKLM; View = $V64; Label = 'HKLM(64)' }, @{ Hive = $HKLM; View = $V32; Label = 'HKLM(32)' })) { $bk = OpenBase $cfg.Hive $cfg.View $root = $bk.OpenSubKey('SOFTWARE\Classes\TypeLib') if ($root) { foreach ($lib in $root.GetSubKeyNames()) { $lk = $root.OpenSubKey($lib) if (-not $lk) { continue } foreach ($ver in $lk.GetSubKeyNames()) { $vk = $lk.OpenSubKey($ver) if (-not $vk) { continue } foreach ($plat in ($vk.GetSubKeyNames() | Where-Object { $_ -match '^win(32|64)$' })) { $pk = $vk.OpenSubKey($plat) if (-not $pk) { continue } $d = "$($pk.GetValue(''))" if ($d -and (Test-Own $d)) { $hits++ W ('{0}\SOFTWARE\Classes\TypeLib\{1}\{2}\{3}' -f $cfg.Label, $lib, $ver, $plat) KV 'typelib' $d W '' } $pk.Close() } $vk.Close() } $lk.Close() } $root.Close() } $bk.Close() } if ($hits -eq 0) { W '<none>' } } H '7. APP PATHS / REGISTERED APPLICATIONS' if ($script:OwnPaths.Count -eq 0 -and $script:OwnDirs.Count -eq 0) { W '<no product binaries to match against>' } else { $hits = 0 foreach ($ap in @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths', 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths', 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths')) { if (-not (Test-Path -LiteralPath $ap)) { continue } Get-ChildItem -LiteralPath $ap | ForEach-Object { $props = Get-ItemProperty -LiteralPath $_.PSPath $d = "$($props.'(default)')" $path = "$($props.Path)" if ((Test-Own $d) -or (Test-Own $path) -or $script:OwnNames.Contains($_.PSChildName.ToLower())) { $script:hits++ W ('{0}\{1}' -f (Native $ap), $_.PSChildName) KV 'default' $d if ($path) { KV 'Path' $path } W '' } } } foreach ($ra in @('HKLM:\SOFTWARE\RegisteredApplications', 'HKCU:\SOFTWARE\RegisteredApplications')) { if (-not (Test-Path -LiteralPath $ra)) { continue } $p = Get-ItemProperty -LiteralPath $ra foreach ($pr in $p.PSObject.Properties) { if ($pr.Name -like 'PS*') { continue } $capKey = "HKLM:\SOFTWARE\$($pr.Value)" if (-not (Test-Path -LiteralPath $capKey)) { continue } $cap = Get-ItemProperty -LiteralPath $capKey if ($cap.ApplicationIcon -and (Test-Own (($cap.ApplicationIcon -split ',')[0]))) { $script:hits++ W ('{0} :: {1} = {2}' -f (Native $ra), $pr.Name, $pr.Value) } } } if ($script:hits -eq 0) { W '<none>' } } H '8. RAW REGISTRY SWEEP (productcode / packed guid)' if (-not $DoRawSweep) { W '<skipped: DoRawSweep is false>' } else { foreach ($term in @($pc, $shortPc, $packed)) { W "term: $term" $any = $false foreach ($hive in @('HKLM', 'HKCU', 'HKCR', 'HKU')) { $k = & reg.exe query $hive /f "$term" /s /k 2>$null | Where-Object { $_ -match '^HK' } $d = & reg.exe query $hive /f "$term" /s /d 2>$null | Where-Object { $_ -match '^HK' } if ($k) { $any = $true; $k | ForEach-Object { W " [key] $_" } } if ($d) { $any = $true; $d | ForEach-Object { W " [data] $_" } } } if (-not $any) { W ' <none>' } W '' } } H '9. RAW REGISTRY SWEEP (displayname / publisher / binaries)' if (-not $DoNameSweep) { W '<skipped: DoNameSweep is false>' } else { $terms = @() if ($displayName) { $terms += $displayName } if ($publisher) { $terms += $publisher } $script:OwnNames | ForEach-Object { $terms += $_ } $terms = @($terms | Where-Object { $_ -and $_.Length -ge 5 } | Sort-Object -Unique) if ($terms.Count -eq 0) { W '<no terms>' } foreach ($term in $terms) { W "term: $term" $any = $false foreach ($hive in @('HKLM', 'HKCU')) { $k = & reg.exe query $hive /f "$term" /s /k 2>$null | Where-Object { $_ -match '^HK' } $d = & reg.exe query $hive /f "$term" /s /d 2>$null | Where-Object { $_ -match '^HK' } if ($k) { $any = $true; $k | ForEach-Object { W " [key] $_" } } if ($d) { $any = $true; $d | ForEach-Object { W " [data] $_" } } } if (-not $any) { W ' <none>' } W '' } } H '10. FILES' $fl = @($compFiles | Sort-Object -Unique) if ($installLoc -and (Test-Path -LiteralPath $installLoc)) { Get-ChildItem -LiteralPath $installLoc -Recurse -File | ForEach-Object { $fl += $_.FullName } } $fl = @($fl | Sort-Object -Unique) if ($fl.Count -eq 0) { W '<none>' } foreach ($f in $fl) { if (-not (Test-Path -LiteralPath $f -PathType Leaf)) { W "MISSING $f"; continue } $ff = Get-FileFacts $f W $f KV 'size' $ff.Size KV 'created' $ff.Created KV 'modified' $ff.Modified KV 'company' $ff.Company KV 'product' $ff.Product KV 'description' $ff.Desc KV 'origname' $ff.OrigName KV 'internal' $ff.IntName KV 'fileversion' $ff.FileVer KV 'signature' $ff.SigStatus KV 'signer' $ff.Signer KV 'sha256' $ff.SHA256 W '' } H '11a. FLAT - REGISTRY KEYS PRESENT' if ($touchedKeys.Count -eq 0) { W '<none>' } ($touchedKeys | Sort-Object -Unique) | ForEach-Object { W $_ } H '11b. FLAT - REGISTRY KEYPATHS FROM COMPONENTS' if ($compRegs.Count -eq 0) { W '<none>' } foreach ($r in ($compRegs | Sort-Object -Unique)) { W ('{0}\{1}' -f (KeyPathPrefixToHive $r.Substring(0, 2)), $r.Substring(3)) } H '11c. FLAT - FILES' if ($fl.Count -eq 0) { W '<none>' } $fl | ForEach-Object { W $_ } H '11d. FLAT - DIRECTORIES' $dl = @() if ($installLoc) { $dl += $installLoc.TrimEnd('\') } $fl | ForEach-Object { $dl += (Split-Path $_ -Parent) } $dl = @($dl | Where-Object { $_ } | Sort-Object -Unique) if ($dl.Count -eq 0) { W '<none>' } foreach ($d in $dl) { $ex = Test-Path -LiteralPath $d -PathType Container $ct = '' if ($ex) { $ct = (Get-Item -LiteralPath $d).CreationTime.ToString('yyyy-MM-dd HH:mm:ss') } W ('{0,-8} {1,-20} {2}' -f $(if ($ex) { 'EXISTS' } else { 'MISSING' }), $ct, $d) } } W '' W ('=' * 100) W ('END total {0:N1}s' -f $script:SW.Elapsed.TotalSeconds) W ('=' * 100) EndPowerShell: Comment: Service / Driver Status (thanks to AdvancedSetup) Comment: 0 = Boot Comment: 1 = System Comment: 2 = Automatic Comment: 3 = Manual / Demand Comment: 4 = Disabled Comment: R = Running Comment: S = Stopped Comment: U = Unknown / unable to determine service state cleanly Comment: === rifteyy's default non-intrusive fixlist template === Comment: The following are done automatically with this fixlist: Comment: Hardens Windows Defender (for maximum efficiency DISABLE TAMPER PROTECTION) Comment: Checks and corrects the default Windows PATH environmental variable Comment: Checks for internet connection, valid DNS Comment: Checks for Windows RE status Comment: Checks and repairs WMI repository Comment: Checks Windows activation status Comment: Checks if TPM, Secure Boot are available and their status Comment: Restores original Windows services configuration Comment: Restores PowerShell execution policy Comment: Rebuilds performance counter library values Comment: Resynchronizes performance counter library values to WMI Comment: Enables file extensions Comment: Enables recovery environment Comment: Enables all firewall profiles Comment: Scans with HitmanPro from Sophos Comment: Scans and cleans with AdwCleaner from Malwarebytes Comment: Lists environment variables Comment: Lists Windows Defender properties, settings Comment: Lists drive info, identify possible damaged drives from Event Logs Comment: Lists Discord's "index.js" files that are often targeted by malware (to store and execute malicious code) Comment: Lists recent BSOD's Comment: Lists all installed applications, folder contents along with SHA256 for purposes of identifying installed app malware Comment: Lists 30 recent scheduled tasks Comment: Lists recent Run (Windows + R) executed commands, can identify ClickFix attacks Comment: Removes unwanted files (e.g. .exe, .com, .dll) from common folders (e.g. C:\ProgramData, AppData\Roaming) - these are not supposed to store any executable file types Comment: Removes generic filetypes associated with RenPyLoader from common folders Comment: Removes cache from Chrome, Firefox, Opera, Opera GX, Brave, Vivaldi, LibreWolf, Mullvad Browser, Zen and from Roblox, Fortnite, Discord, OBS Studio Comment: Removes policies Comment: Removes active BITS tasks Comment: Resets network Comment: Resets icon cache Comment: Removes proxy servers Comment: Removes temporary files Comment: Repairs system files Comment: List environment variables StartPowerShell: $key = Get-Item -Path "HKCU:\Environment" -ErrorAction SilentlyContinue if ($key) { $path = "HKCU\Environment" foreach ($name in $key.GetValueNames()) { $value = $key.GetValue($name, $null, [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames) "$path|$name=$value" } } $key = Get-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" -ErrorAction SilentlyContinue if ($key) { $path = "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" foreach ($name in $key.GetValueNames()) { $value = $key.GetValue($name, $null, [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames) "$path|$name=$value" } } Get-ChildItem Env: | Sort-Object Name | ForEach-Object { "SET|$($_.Name)=$($_.Value)" } Get-ChildItem Registry::HKEY_USERS | Where-Object { $_.PSChildName -match '^S-1-5-21-\d+-\d+-\d+-\d+$' } | ForEach-Object { $sid = $_.PSChildName $envPath = "Registry::HKEY_USERS\$sid\Environment" if (Test-Path $envPath) { $key = Get-Item -Path $envPath foreach ($name in $key.GetValueNames()) { $value = $key.GetValue($name, $null, [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames) "HKEY_USERS\$sid\Environment|$name=$value" } } } EndPowerShell: StartPowerShell: # Checks default Windows PATH entries and repairs missing ones. $ErrorActionPreference = 'Continue' function Expand-PlainPath { param([string]$Entry) return [Environment]::ExpandEnvironmentVariables($Entry).TrimEnd('\') } # Templates expanded once to plain paths (C:\Windows\..., C:\Users\...) $systemDefaults = @( (Expand-PlainPath '%SystemRoot%\system32') (Expand-PlainPath '%SystemRoot%') (Expand-PlainPath '%SystemRoot%\System32\Wbem') (Expand-PlainPath '%SystemRoot%\System32\WindowsPowerShell\v1.0') (Expand-PlainPath '%SystemRoot%\System32\OpenSSH') ) $userDefaults = @( (Expand-PlainPath '%USERPROFILE%\AppData\Local\Microsoft\WindowsApps') ) function Get-NormalizedPathEntries { param([string]$Raw) if ([string]::IsNullOrWhiteSpace($Raw)) { return @() } return @( $Raw -split ';' | Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | ForEach-Object { [Environment]::ExpandEnvironmentVariables($_.Trim().TrimEnd('\')).ToLowerInvariant() } ) } function Get-CombinedPathEntries { $machineRaw = [Environment]::GetEnvironmentVariable('Path', 'Machine') $userRaw = [Environment]::GetEnvironmentVariable('Path', 'User') return Get-NormalizedPathEntries -Raw ($machineRaw + ';' + $userRaw) } function Test-InPath { param( [string]$PlainPath, [string[]]$NormalizedEntries ) $key = $PlainPath.TrimEnd('\').ToLowerInvariant() return $NormalizedEntries -contains $key } function Add-ToPath { param( [string]$PlainPath, [ValidateSet('Machine', 'User')] [string]$Scope ) # always store plain path, never %VAR% form $toAdd = $PlainPath.TrimEnd('\') $current = [Environment]::GetEnvironmentVariable('Path', $Scope) if ([string]::IsNullOrWhiteSpace($current)) { [Environment]::SetEnvironmentVariable('Path', $toAdd, $Scope) return } $normalized = Get-NormalizedPathEntries -Raw $current $key = $toAdd.ToLowerInvariant() if ($normalized -contains $key) { return } $newPath = $current.TrimEnd(';') + ';' + $toAdd [Environment]::SetEnvironmentVariable('Path', $newPath, $Scope) } function Write-Result { param( [string]$Entry, [string]$Status ) $label = $Entry.PadRight(58) Write-Output ("{0} {1}" -f $label, $Status) } function Repair-AndVerify { param( [string]$PlainPath, [ValidateSet('Machine', 'User')] [string]$Scope ) if (-not (Test-Path -LiteralPath $PlainPath)) { Write-Result -Entry $PlainPath -Status 'ATTENTION !!! MISSING (no folder, cannot repair)' return 'failed' } if ($Scope -eq 'Machine') { $isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()). IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) if (-not $isAdmin) { Write-Result -Entry $PlainPath -Status 'ATTENTION !!! MISSING (need Admin to repair)' return 'failed' } } try { Add-ToPath -PlainPath $PlainPath -Scope $Scope } catch { Write-Result -Entry $PlainPath -Status "ATTENTION !!! MISSING (repair failed: $_)" return 'failed' } # re-query PATH from registry and verify plain path is present $after = Get-CombinedPathEntries if (Test-InPath -PlainPath $PlainPath -NormalizedEntries $after) { Write-Result -Entry $PlainPath -Status 'ATTENTION !!! MISSING -> repaired (verified)' return 'repaired' } Write-Result -Entry $PlainPath -Status 'ATTENTION !!! MISSING (repair ran, still missing after re-check)' return 'failed' } $combined = Get-CombinedPathEntries $hadMissing = $false $repairFailed = $false $repairedList = [System.Collections.Generic.List[string]]::new() Write-Output 'PATH CHECK' Write-Output ('-' * 72) foreach ($entry in $systemDefaults) { if (Test-InPath -PlainPath $entry -NormalizedEntries $combined) { Write-Result -Entry $entry -Status 'OK' continue } $hadMissing = $true $result = Repair-AndVerify -PlainPath $entry -Scope Machine if ($result -eq 'repaired') { [void]$repairedList.Add($entry) $combined = Get-CombinedPathEntries } else { $repairFailed = $true } } foreach ($entry in $userDefaults) { if (Test-InPath -PlainPath $entry -NormalizedEntries $combined) { Write-Result -Entry $entry -Status 'OK' continue } $hadMissing = $true $result = Repair-AndVerify -PlainPath $entry -Scope User if ($result -eq 'repaired') { [void]$repairedList.Add($entry) $combined = Get-CombinedPathEntries } else { $repairFailed = $true } } Write-Output ('-' * 72) if (-not $hadMissing) { Write-Output 'RESULT: all default PATH entries present' } elseif ($repairedList.Count -gt 0 -and -not $repairFailed) { Write-Output "RESULT: $($repairedList.Count) missing entry/entries repaired and verified - open a new terminal" } elseif ($repairedList.Count -gt 0 -and $repairFailed) { Write-Output "RESULT: $($repairedList.Count) verified, some still missing - open a new terminal / run as Admin" } else { Write-Output 'RESULT: missing entries not repaired (run as Admin for System PATH)' } if ($repairedList.Count -gt 0) { Write-Output '' Write-Output 'REPAIRED:' foreach ($item in $repairedList) { Write-Output " $item" } } if ($hadMissing -or $repairFailed) { exit 1 } exit 0 EndPowerShell: Comment: Verify Windows activation CMD: C:\Windows\System32\cscript.exe c:\windows\system32\slmgr.vbs /xpr & C:\Windows\System32\cscript.exe c:\windows\system32\slmgr.vbs /dlv Comment: Check TPM and Secure Boot status StartPowershell: [PSCustomObject]@{ "TPM Detected" = (Get-Tpm).TpmPresent; "TPM Enabled" = (Get-Tpm).TpmEnabled; "Secure Boot On" = (Confirm-SecureBootUEFI) } EndPowershell: StartPowerShell: # Check for internet connection $ErrorActionPreference = 'Continue' $dnsServers = @( '1.1.1.1' '8.8.8.8' ) $hosts = @( 'google.com' 'cloudflare.com' 'malwarebytes.com' ) function Write-Result { param( [string]$Label, [string]$Status ) Write-Output ("{0} {1}" -f $Label.PadRight(42), $Status) } function Test-DnsServer { param([string]$Server) $pingOk = $false try { $pingOk = Test-Connection -ComputerName $Server -Count 1 -Quiet -ErrorAction SilentlyContinue } catch { } $resolveOk = $false try { $result = Resolve-DnsName -Name 'google.com' -Server $Server -Type A -DnsOnly -ErrorAction Stop $ip = ($result | Where-Object { $_.IPAddress } | Select-Object -First 1).IPAddress if ($ip) { $resolveOk = $true } } catch { } # resolve is what matters; ping may be blocked if ($resolveOk) { return 'OK' } if ($pingOk) { return 'FAIL' } return 'FAIL' } function Test-HostReachable { param([string]$HostName) try { $dns = Resolve-DnsName -Name $HostName -Type A -ErrorAction Stop $resolvedIp = ($dns | Where-Object { $_.IPAddress } | Select-Object -First 1).IPAddress if (-not $resolvedIp) { return 'FAIL' } } catch { return 'FAIL' } try { $null = Invoke-WebRequest -Uri "https://$HostName" -UseBasicParsing -TimeoutSec 10 -MaximumRedirection 5 -ErrorAction Stop return 'OK' } catch { if ($_.Exception.Response) { return 'OK' } return 'FAIL' } } $failed = 0 Write-Output 'INTERNET CHECK' Write-Output ('-' * 72) Write-Output 'DNS SERVERS' foreach ($server in $dnsServers) { $status = Test-DnsServer -Server $server Write-Result -Label $server -Status $status if ($status -eq 'FAIL') { $failed++ } } Write-Output '' Write-Output 'HOSTS' foreach ($h in $hosts) { $status = Test-HostReachable -HostName $h Write-Result -Label $h -Status $status if ($status -eq 'FAIL') { $failed++ } } Write-Output ('-' * 72) if ($failed -eq 0) { Write-Output 'RESULT: all checks passed' exit 0 } Write-Output "RESULT: $failed check(s) failed" exit 1 EndPowerShell: StartPowershell: # Replace /scanonly with /clean if you also want to delete items -- however, this will activate a trial license on the system, I do not recommend it $hmpExe = "$env:TEMP\HitmanPro_x64.exe" $logFile = "$env:TEMP\HitmanPro_ScanLog.txt" Invoke-WebRequest -Uri "https://dl.surfright.nl/HitmanPro_x64.exe" -OutFile $hmpExe -UseBasicParsing $proc = Start-Process $hmpExe -ArgumentList "/ews","/scanonly","/noinstall","/log=`"$logFile`"","/logtype=txt" -Wait -PassThru if (!(Test-Path $logFile)) { Write-Host "Scan failed (exit $($proc.ExitCode))"; exit 1 } Get-Content $logFile -Encoding Unicode EndPowershell: StartPowerShell: # Downloads newest AdwCleaner version directly from Malwarebytes, performs an update, scans, cleans and writes the log in console # Does not clean preinstalled objects, only PUP/Adware # If you would like to delete preinstalled objects, add an argument /preinstalled to the /clean argument # If you would like to only scan with it, change the argument from /clean to /scan # NOTE: For the sake of users from Asia (primarily China), do not use the clean option. It will very likely remove a lot of their important software. New-Item -ItemType Directory -Force -Path "$env:SystemDrive\AdwCleaner" | Out-Null Invoke-WebRequest -Uri "https://adwcleaner.malwarebytes.com/adwcleaner?channel=release" -OutFile "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/eula" -Wait -WindowStyle Hidden $logFile = "$env:SystemDrive\AdwCleaner\AdwCleanerOutputFRST.txt" Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/noreboot /clean" -Wait -WindowStyle Hidden -RedirectStandardOutput $logFile Get-Content $logFile -Encoding Unicode Remove-Item -Path $logFile -Force -ErrorAction SilentlyContinue EndPowerShell: Comment: List drive info, identify possible damaged drives (thanks to AdvancedSetup from Malwarebytes for parts of these) StartPowerShell: param( [int]$MaxEvents = 5000 ) $GPTTypeMap = @{ 'EBD0A0A2-B9E5-4433-87C0-68B6B72699C7' = 'Microsoft Basic Data' 'E3C9E316-0B5C-4DB8-817D-F92DF00215AE' = 'Microsoft Reserved (MSR)' 'DE94BBA4-06D1-4D40-A16A-BFD50179D6AC' = 'Windows Recovery Environment (WinRE)' 'C12A7328-F81F-11D2-BA4B-00A0C93EC93B' = 'EFI System Partition' '21686148-6449-6E6F-744E-656564454649' = 'BIOS Boot Partition' 'A19D880F-05FC-4D3B-A006-743F0F84911E' = 'OEM Partition' '5808C8AA-7E8F-42E0-85D2-E1E90434CFB3' = 'Cluster Metadata Partition' '48465300-0000-11AA-AA11-00306543ECAC' = 'Apple HFS/HFS+' '7C3457EF-0000-11AA-AA11-00306543ECAC' = 'Apple APFS' '0FC63DAF-8483-4772-8E79-3D69D8477DE4' = 'Linux Filesystem' '0657FD6D-A4AB-43C4-84E5-0933C84B4F4F' = 'Linux Swap' 'E6D6D379-F507-44C2-A23C-238F2A3DF928' = 'Linux LVM' } $MBRTypeMap = @{ '01'='FAT12';'04'='FAT16 <32M';'05'='Extended';'06'='FAT16';'07'='IFS/NTFS/exFAT/HPFS';'0B'='FAT32 CHS';'0C'='FAT32 LBA';'0E'='FAT16 LBA' '0F'='Extended LBA';'82'='Linux Swap';'83'='Linux Native';'8E'='Linux LVM';'A5'='FreeBSD';'A6'='OpenBSD';'A8'='Mac OS X';'AB'='Mac OS X Boot' 'AF'='Mac OS X HFS';'EE'='EFI GPT Protective';'EF'='EFI System Partition' } function Get-PartitionTypeInfo { param($Partition) $guid = $null if ($Partition.GptType) { $guid = ($Partition.GptType -replace '[{}]', '').ToUpper() } if ([string]::IsNullOrWhiteSpace($guid) -or $guid -eq '00000000-0000-0000-0000-000000000000') { $guid = switch ($Partition.Type) { "System" { "C12A7328-F81F-11D2-BA4B-00A0C93EC93B" } "Reserved" { "E3C9E316-0B5C-4DB8-817D-F92DF00215AE" } "Basic" { "EBD0A0A2-B9E5-4433-87C0-68B6B72699C7" } "Recovery" { "DE94BBA4-06D1-4D40-A16A-BFD50179D6AC" } default { $null } } } if ($guid) { $name = $GPTTypeMap[$guid] if ($name) { return "$name (GPT GUID: $($guid.ToLower()))" } else { return "Unknown/Custom (GPT GUID: $($guid.ToLower()))" } } if ($Partition.MbrType) { $code = ($Partition.MbrType.ToString() -replace '^0x', '').PadLeft(2, '0').ToUpper() $name = $MBRTypeMap[$code] if ($name) { return "$name (MBR code: 0x$code)" } else { return "Unknown/Custom (MBR code: $($Partition.MbrType))" } } return $Partition.Type } function Get-DrMapping { param([int]$MaxEvents) $map = @{} try { $events = Get-WinEvent -FilterHashtable @{ LogName = 'System'; ProviderName = 'disk' } -MaxEvents $MaxEvents -ErrorAction Stop } catch { return $map } foreach ($e in $events) { if ($e.Message -match 'Harddisk(\d+)\\DR(\d+)') { $n = [int]$Matches[1] $dr = [int]$Matches[2] if (-not $map.ContainsKey($n)) { $map[$n] = $dr } } } return $map } $drMap = Get-DrMapping -MaxEvents $MaxEvents $physicalDisks = Get-PhysicalDisk | Select-Object DeviceId, FriendlyName, SerialNumber, MediaType, @{N='SizeGB';E={[math]::Round($_.Size / 1GB,2)}} foreach ($pd in $physicalDisks) { $devId = [int]$pd.DeviceId $drSuffix = if ($drMap.ContainsKey($devId)) { "\DR$($drMap[$devId])" } else { '\DR? (no event seen yet)' } Write-Host "" Write-Host "<=== \Device\Harddisk$devId$drSuffix ($($pd.FriendlyName)) ===>" Write-Host " DeviceId: $devId | Serial: $($pd.SerialNumber) | Media: $($pd.MediaType) | Size: $($pd.SizeGB) GB" try { $partitions = Get-Partition -DiskNumber $devId -ErrorAction Stop if (-not $partitions) { Write-Host " (no partitions found)" continue } foreach ($part in $partitions) { $driveLetter = if ($part.DriveLetter) { "$($part.DriveLetter):" } else { 'no letter' } $sizeGB = [math]::Round($part.Size / 1GB, 2) $typeInfo = Get-PartitionTypeInfo -Partition $part Write-Host " [PARTITION $($part.PartitionNumber)] Drive: $driveLetter - $sizeGB GB - $typeInfo" } } catch { Write-Host " [ERROR] cannot read partitions for disk $devId" } } if ($drMap.Count -eq 0) { Write-Host "" Write-Host "Note: no \Device\HarddiskN\DRx entries found in the last $MaxEvents System log events. Increase -MaxEvents, or the DR number will only appear once Windows actually logs a disk event for that drive (e.g. a bad block warning)." } EndPowerShell: Comment: Verify that Discord does not have any injected code to intercept personal data. If anything is prompted here, it needs to be checked that it isn't malicious code. Powershell: @("$env:APPDATA","$env:LOCALAPPDATA") | ForEach-Object { Get-ChildItem $_ -Recurse -Filter "index.js" -ErrorAction SilentlyContinue } | Where-Object { $_.FullName -match "discord_desktop_core" } | ForEach-Object { Write-Host "--- $($_.FullName) ---"; (Get-Content $_.FullName -Raw).Substring(0,[Math]::Min(2000,(Get-Content $_.FullName -Raw).Length)) } StartPowerShell: # Basic BSOD listings $ccKey = "HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl" $cfg = Get-ItemProperty $ccKey -ErrorAction SilentlyContinue $dumpTypeMap = @{0='None';1='Complete';2='Kernel';3='Minidump';7='Automatic'} Write-Output "--- Configuration ---" Write-Output ("Dump Type: {0} ({1})" -f $cfg.CrashDumpEnabled, $dumpTypeMap[$cfg.CrashDumpEnabled]) Write-Output ("Full Dump Path: {0}" -f $(if($cfg.DumpFile){[Environment]::ExpandEnvironmentVariables($cfg.DumpFile)}else{"$env:SystemRoot\MEMORY.DMP"})) Write-Output ("Minidump Folder: {0}" -f $(if($cfg.MinidumpDir){[Environment]::ExpandEnvironmentVariables($cfg.MinidumpDir)}else{"$env:SystemRoot\Minidump"})) Write-Output ("Auto Reboot: {0}" -f $(if($cfg.AutoReboot -eq 0){'Disabled'}else{'Enabled'})) Write-Output "--- Found Dump Files ---" $full = if($cfg.DumpFile){[Environment]::ExpandEnvironmentVariables($cfg.DumpFile)}else{"$env:SystemRoot\MEMORY.DMP"} if (Test-Path $full) { Get-Item $full | Select Name,Length,LastWriteTime | Format-Table -AutoSize } $mini = if($cfg.MinidumpDir){[Environment]::ExpandEnvironmentVariables($cfg.MinidumpDir)}else{"$env:SystemRoot\Minidump"} if (Test-Path $mini) { Get-ChildItem $mini -Filter *.dmp | Select Name,Length,LastWriteTime | Format-Table -AutoSize } Write-Output "--- BugCheck Reasoning (recent events) ---" $map = @{ '0x0000000A'='IRQL_NOT_LESS_OR_EQUAL - faulty/outdated driver accessed memory at high IRQL' '0x0000001E'='KMODE_EXCEPTION_NOT_HANDLED - unhandled kernel exception, often driver/hardware' '0x0000002E'='DATA_BUS_ERROR - typically bad RAM or hardware fault' '0x0000003B'='SYSTEM_SERVICE_EXCEPTION - exception in a system service, often driver-related' '0x00000050'='PAGE_FAULT_IN_NONPAGED_AREA - bad RAM or faulty driver/antivirus' '0x0000007A'='KERNEL_DATA_INPAGE_ERROR - disk-related problem' '0x0000007B'='INACCESSIBLE_BOOT_DEVICE - system could not find/access the boot device' '0x0000007E'='SYSTEM_THREAD_EXCEPTION_NOT_HANDLED - almost always a faulty driver' '0x0000007F'='UNEXPECTED_KERNEL_MODE_TRAP - hardware issue (CPU/RAM/overclocking)' '0x0000009F'='DRIVER_POWER_STATE_FAILURE - driver failed to respond to a power state change' '0x000000C2'='BAD_POOL_CALLER - driver mishandling memory (pool corruption)' '0x000000D1'='DRIVER_IRQL_NOT_LESS_OR_EQUAL - typically a network or GPU driver' '0x000000EF'='CRITICAL_PROCESS_DIED - a critical system process died, often malware/system corruption' '0x00000116'='VIDEO_TDR_FAILURE - GPU driver failed to respond in time (timeout)' '0x00000124'='WHEA_UNCORRECTABLE_ERROR - hardware fault (CPU/RAM/PSU/overclocking)' '0x00000133'='DPC_WATCHDOG_VIOLATION - faulty driver or storage subsystem issue' '0x00000139'='KERNEL_SECURITY_CHECK_FAILURE - corrupted kernel structure, possibly malware' } $events = Get-WinEvent -FilterHashtable @{LogName='System';Id=1001} -MaxEvents 100 -ErrorAction SilentlyContinue | Where-Object { $_.ProviderName -match 'WER-SystemErrorReporting' } | Select-Object -First 5 if (-not $events) { Write-Output "No BugCheck events found in the log." } foreach ($ev in $events) { $code = if ($ev.Message -match 'bugcheck was:\s*(0x[0-9A-Fa-f]+)') { $matches[1] } else { $null } Write-Output ("Time: {0}" -f $ev.TimeCreated) Write-Output ("Code: {0}" -f $(if($code){$code}else{'not recognized'})) if ($code -and $map.ContainsKey($code.ToUpper())) { Write-Output ("Meaning: {0}" -f $map[$code.ToUpper()]) } elseif ($code) { Write-Output "Meaning: unknown code, look up at learn.microsoft.com/windows-hardware/drivers/debugger/bug-check-code-reference2" } Write-Output "" } EndPowerShell: StartPowerShell: # This snippet lists all installed apps and their folder contents along with SHA256 hashes. Useful for troubleshooting malware abusing installed app entry. param( [switch]$Recurse, [int]$MaxFilesPerApp = [int]::MaxValue ) $uninstallPaths = @( 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*' ) $script:msiInstaller = $null function Get-MsiInstallLocation { param([string]$ProductCode) if (-not $script:msiInstaller) { try { $script:msiInstaller = New-Object -ComObject WindowsInstaller.Installer } catch { return $null } } try { $loc = $script:msiInstaller.ProductInfo($ProductCode, 'InstallLocation') if ([string]::IsNullOrWhiteSpace($loc)) { $loc = $script:msiInstaller.ProductInfo($ProductCode, 'InstallSource') } if ([string]::IsNullOrWhiteSpace($loc)) { return $null } return $loc } catch { return $null } } function Get-CleanPath { param([string]$RawValue) if ([string]::IsNullOrWhiteSpace($RawValue)) { return $null } $s = $RawValue.Trim() if ($s.StartsWith('"')) { $endQuote = $s.IndexOf('"', 1) if ($endQuote -gt 0) { return $s.Substring(1, $endQuote - 1) } } if ($s -match '^(.*?\.exe)\b') { return $Matches[1] } return $s } function Format-FileSize { param([long]$Bytes) if ($Bytes -ge 1GB) { return '{0:N2} GB' -f ($Bytes / 1GB) } if ($Bytes -ge 1MB) { return '{0:N2} MB' -f ($Bytes / 1MB) } if ($Bytes -ge 1KB) { return '{0:N2} KB' -f ($Bytes / 1KB) } return "$Bytes B" } $script:PeExtensions = @('.exe', '.dll', '.sys', '.ocx', '.cpl', '.scr', '.drv', '.efi', '.msi', '.msp', '.msu') function Test-IsPeFile { param([string]$Extension) return $script:PeExtensions -contains $Extension.ToLower() } function Get-SignatureInfo { param([string]$Path, [string]$Extension) if (-not (Test-IsPeFile -Extension $Extension)) { return [PSCustomObject]@{ Signer = 'N/A (not PE)'; Status = 'NotApplicable'; Valid = $false } } $result = [PSCustomObject]@{ Signer = 'Unsigned'; Status = 'NotSigned'; Valid = $false } try { $sig = Get-AuthenticodeSignature -LiteralPath $Path -ErrorAction Stop $result.Status = $sig.Status.ToString() $result.Valid = ($sig.Status -eq 'Valid') if ($sig.SignerCertificate) { if ($sig.SignerCertificate.Subject -match 'CN=([^,]+)') { $result.Signer = $Matches[1].Trim('"') } else { $result.Signer = $sig.SignerCertificate.Subject } if (-not $result.Valid) { $result.Signer += " [INVALID: $($result.Status)]" } } elseif ($sig.Status -eq 'NotSigned') { $result.Signer = 'Unsigned' } else { $result.Signer = "Unknown [$($result.Status)]" } } catch { $result.Signer = 'Verification error' $result.Status = 'Error' $result.Valid = $false } return $result } $rawApps = Get-ItemProperty -Path $uninstallPaths -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName -and $_.DisplayName.Trim() -ne '' } | Select-Object @{Name = 'Name'; Expression = { $_.DisplayName } }, @{Name = 'Version'; Expression = { $_.DisplayVersion } }, @{Name = 'Publisher'; Expression = { $_.Publisher } }, @{Name = 'InstallFolder'; Expression = { if ($_.InstallLocation -and $_.InstallLocation.Trim() -ne '') { $_.InstallLocation } elseif ($_.UninstallString -match 'MsiExec\.exe.*?(\{[0-9A-Fa-f\-]{36}\})') { $productCode = $Matches[1] $msiLoc = Get-MsiInstallLocation -ProductCode $productCode if ($msiLoc) { $msiLoc } else { "MSI: $productCode (location not found)" } } elseif ($_.UninstallString) { $_.UninstallString } else { 'N/A' } } } | Sort-Object Name -Unique foreach ($app in $rawApps) { $versionText = if ($app.Version) { $app.Version } else { '?' } $publisherText = if ($app.Publisher) { $app.Publisher } else { '?' } Write-Host "" Write-Host "<=== $($app.Name) [$versionText] ($publisherText) ===>" if ($app.InstallFolder -eq 'N/A' -or $app.InstallFolder -match '^MSI: .* \(location not found\)$') { Write-Host " Path: $($app.InstallFolder)" continue } $cleanPath = Get-CleanPath -RawValue $app.InstallFolder $exists = $false try { $exists = Test-Path -LiteralPath $cleanPath -ErrorAction Stop } catch [System.UnauthorizedAccessException] { Write-Host " Path: $cleanPath" Write-Host " [ACCESS DENIED]" continue } catch { Write-Host " Path: $cleanPath" Write-Host " [ERROR] cannot access" continue } if (-not $exists) { Write-Host " Path: $cleanPath" Write-Host " [NOT FOUND]" continue } $rootItem = Get-Item -LiteralPath $cleanPath -Force $created = $rootItem.CreationTime.ToString('dd/MM/yyyy HH:mm:ss') $modified = $rootItem.LastWriteTime.ToString('dd/MM/yyyy HH:mm:ss') if ($rootItem.PSIsContainer) { $subFolders = Get-ChildItem -LiteralPath $cleanPath -Directory -Force -ErrorAction SilentlyContinue $gciParams = @{ LiteralPath = $cleanPath; File = $true; Force = $true; ErrorAction = 'SilentlyContinue' } if ($Recurse) { $gciParams['Recurse'] = $true } $allFiles = Get-ChildItem @gciParams Write-Host " Path: $cleanPath | Created: $created | Modified: $modified | Files: $($allFiles.Count) | Folders: $($subFolders.Count)" foreach ($dir in $subFolders) { $dCreated = $dir.CreationTime.ToString('dd/MM/yyyy HH:mm:ss') $dModified = $dir.LastWriteTime.ToString('dd/MM/yyyy HH:mm:ss') $dFileCount = (Get-ChildItem -LiteralPath $dir.FullName -File -Force -ErrorAction SilentlyContinue).Count Write-Host (" [DIR] {0} - {1} - {2,10} - {3}" -f $dCreated, $dModified, "$dFileCount files", $dir.FullName) } } else { $allFiles = @($rootItem) Write-Host " Path: $cleanPath | Created: $created | Modified: $modified | Files: 1" } if ($allFiles.Count -eq 0) { continue } $shown = $allFiles | Select-Object -First $MaxFilesPerApp foreach ($f in $shown) { $hash = 'N/A' try { $hash = (Get-FileHash -LiteralPath $f.FullName -Algorithm SHA256 -ErrorAction Stop).Hash } catch { $hash = 'HASH-ERROR' } $size = Format-FileSize -Bytes $f.Length $fcreated = $f.CreationTime.ToString('dd/MM/yyyy HH:mm:ss') $fmod = $f.LastWriteTime.ToString('dd/MM/yyyy HH:mm:ss') $sigInfo = Get-SignatureInfo -Path $f.FullName -Extension $f.Extension Write-Host (" [{0}] {1} - {2} - {3,10} - Signer: {4} - {5}" -f $hash, $fcreated, $fmod, $size, $sigInfo.Signer, $f.FullName) } } EndPowerShell: Comment: List 30 recent scheduled tasks Powershell: Get-ScheduledTask | select -first 30 | Get-ScheduledTaskInfo Comment: List recent Run (Windows + R) executed commands, useful for identifying ClickFix attacks Powershell: (Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" -ErrorAction SilentlyContinue).PSObject.Properties | Where-Object { $_.Name -match "^[a-z]$" } | ForEach-Object { Write-Host "$($_.Name): $($_.Value)" } Comment: Remove unwanted files from common folders using native removal power of Farbar to include remove on reboot if needed. Please double check the user does not have any applications incorrectly installed in the directories listed below. C:\ProgramData\*.csproj C:\ProgramData\*.a3x C:\ProgramData\*.ahk C:\ProgramData\*.au3 C:\ProgramData\*.bat C:\ProgramData\*.cab C:\ProgramData\*.cmd C:\ProgramData\*.com C:\ProgramData\*.dll C:\ProgramData\*.exe C:\ProgramData\*.hta C:\ProgramData\*.jar C:\ProgramData\*.js C:\ProgramData\*.jse C:\ProgramData\*.lnk C:\ProgramData\*.pif C:\ProgramData\*.ps1 C:\ProgramData\*.py C:\ProgramData\*.pyc C:\ProgramData\*.pyd C:\ProgramData\*.scr C:\ProgramData\*.tmp C:\ProgramData\*.vbe C:\ProgramData\*.vbs C:\ProgramData\*.wsf C:\ProgramData\*.wsh C:\ProgramData\*.zip C:\ProgramData\*.rar C:\ProgramData\*.7z C:\Users\*\AppData\Roaming\*.csproj C:\Users\*\AppData\Roaming\*.au3 C:\Users\*\AppData\Roaming\*.bat C:\Users\*\AppData\Roaming\*.cab C:\Users\*\AppData\Roaming\*.cmd C:\Users\*\AppData\Roaming\*.com C:\Users\*\AppData\Roaming\*.dll C:\Users\*\AppData\Roaming\*.exe C:\Users\*\AppData\Roaming\*.hta C:\Users\*\AppData\Roaming\*.jar C:\Users\*\AppData\Roaming\*.js C:\Users\*\AppData\Roaming\*.jse C:\Users\*\AppData\Roaming\*.lnk C:\Users\*\AppData\Roaming\*.pif C:\Users\*\AppData\Roaming\*.ps1 C:\Users\*\AppData\Roaming\*.py C:\Users\*\AppData\Roaming\*.pyc C:\Users\*\AppData\Roaming\*.pyd C:\Users\*\AppData\Roaming\*.scr C:\Users\*\AppData\Roaming\*.tmp C:\Users\*\AppData\Roaming\*.vbe C:\Users\*\AppData\Roaming\*.vbs C:\Users\*\AppData\Roaming\*.wsf C:\Users\*\AppData\Roaming\*.wsh C:\Users\*\AppData\Roaming\*.zip C:\Users\*\AppData\Roaming\*.rar C:\Users\*\AppData\Roaming\*.7z C:\Users\CurrentUserName\AppData\Local\*.csproj C:\Users\CurrentUserName\AppData\Local\*.a3x C:\Users\CurrentUserName\AppData\Local\*.ahk C:\Users\CurrentUserName\AppData\Local\*.au3 C:\Users\CurrentUserName\AppData\Local\*.bat C:\Users\CurrentUserName\AppData\Local\*.cab C:\Users\CurrentUserName\AppData\Local\*.cmd C:\Users\CurrentUserName\AppData\Local\*.com C:\Users\CurrentUserName\AppData\Local\*.dll C:\Users\CurrentUserName\AppData\Local\*.exe C:\Users\CurrentUserName\AppData\Local\*.hta C:\Users\CurrentUserName\AppData\Local\*.jar C:\Users\CurrentUserName\AppData\Local\*.js C:\Users\CurrentUserName\AppData\Local\*.jse C:\Users\CurrentUserName\AppData\Local\*.lnk C:\Users\CurrentUserName\AppData\Local\*.pif C:\Users\CurrentUserName\AppData\Local\*.ps1 C:\Users\CurrentUserName\AppData\Local\*.py C:\Users\CurrentUserName\AppData\Local\*.pyc C:\Users\CurrentUserName\AppData\Local\*.pyd C:\Users\CurrentUserName\AppData\Local\*.scr C:\Users\CurrentUserName\AppData\Local\*.tmp C:\Users\CurrentUserName\AppData\Local\*.vbe C:\Users\CurrentUserName\AppData\Local\*.vbs C:\Users\CurrentUserName\AppData\Local\*.wsf C:\Users\CurrentUserName\AppData\Local\*.wsh C:\Users\CurrentUserName\AppData\Local\*.zip C:\Users\CurrentUserName\AppData\Local\*.rar C:\Users\CurrentUserName\AppData\Local\*.7z C:\Users\CurrentUserName\AppData\Roaming\*.csproj C:\Users\CurrentUserName\AppData\Roaming\*.a3x C:\Users\CurrentUserName\AppData\Roaming\*.ahk C:\Users\CurrentUserName\AppData\Roaming\*.au3 C:\Users\CurrentUserName\AppData\Roaming\*.bat C:\Users\CurrentUserName\AppData\Roaming\*.cab C:\Users\CurrentUserName\AppData\Roaming\*.cmd C:\Users\CurrentUserName\AppData\Roaming\*.com C:\Users\CurrentUserName\AppData\Roaming\*.dll C:\Users\CurrentUserName\AppData\Roaming\*.exe C:\Users\CurrentUserName\AppData\Roaming\*.hta C:\Users\CurrentUserName\AppData\Roaming\*.jar C:\Users\CurrentUserName\AppData\Roaming\*.js C:\Users\CurrentUserName\AppData\Roaming\*.jse C:\Users\CurrentUserName\AppData\Roaming\*.lnk C:\Users\CurrentUserName\AppData\Roaming\*.pif C:\Users\CurrentUserName\AppData\Roaming\*.ps1 C:\Users\CurrentUserName\AppData\Roaming\*.py C:\Users\CurrentUserName\AppData\Roaming\*.pyc C:\Users\CurrentUserName\AppData\Roaming\*.pyd C:\Users\CurrentUserName\AppData\Roaming\*.scr C:\Users\CurrentUserName\AppData\Roaming\*.tmp C:\Users\CurrentUserName\AppData\Roaming\*.vbe C:\Users\CurrentUserName\AppData\Roaming\*.vbs C:\Users\CurrentUserName\AppData\Roaming\*.wsf C:\Users\CurrentUserName\AppData\Roaming\*.wsh C:\Users\CurrentUserName\AppData\Roaming\*.zip C:\Users\CurrentUserName\AppData\Roaming\*.rar C:\Users\CurrentUserName\AppData\Roaming\*.7z Comment: RenPyLoader hollowed installed app generic removal C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.cmd C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.props C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.targets C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.tmp C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.csproj C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.user C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.cmd C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.cache C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.config C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.bat C:\Users\CurrentUserName\AppData\Local\NVIDIA\GeForce Experience Service\*.cfg C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.props C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.targets C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.tmp C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.csproj C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.user C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.cmd C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.cache C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.config C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.bat C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\Caches\*.cfg C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.props C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.targets C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.tmp C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.csproj C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.user C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.cmd C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.cache C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.config C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.bat C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\*.cfg C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.props C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.targets C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.tmp C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.csproj C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.user C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.cmd C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.cache C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.config C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.bat C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\*.cfg C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.props C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.targets C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.tmp C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.csproj C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.user C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.cmd C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.cache C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.config C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.bat C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\WebCache\*.cfg C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.props C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.targets C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.tmp C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.csproj C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.user C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.cmd C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.cache C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.config C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.bat C:\Users\CurrentUserName\AppData\Roaming\Microsoft\Crypto\*.cfg C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.props C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.targets C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.tmp C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.csproj C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.cmd C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.user C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.cache C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.config C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.bat C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\*.cfg Comment: Remove cache C:\Users\CurrentUserName\AppData\Local\Microsoft\Windows\INetCache\IE\ C:\Users\CurrentUserName\AppData\Local\Roblox\UniversalApp\WebView2\EBWebView\Default\Cache\Cache_Data\ C:\Users\CurrentUserName\AppData\Local\FortniteGame\Saved\webcache\ C:\Users\CurrentUserName\AppData\Local\FortniteGame\Saved\webcache_4147\ C:\Users\CurrentUserName\AppData\Local\FortniteGame\Saved\webcache_4430\ C:\Users\CurrentUserName\AppData\Roaming\discord\Cache\Cache_Data\ C:\Users\CurrentUserName\AppData\Roaming\obs-studio\plugin_config\obs-browser\Cache\Cache_Data\ StartPowerShell: $ProfilesDirectory = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList').ProfilesDirectory $DisplayNames = @{ "chrome" = "Chrome" "firefox" = "Firefox" "opera" = "Opera" "operagx" = "Opera GX" "brave" = "Brave" "msedge" = "Edge" "vivaldi" = "Vivaldi" "librewolf" = "LibreWolf" "mullvad" = "Mullvad Browser" "zen" = "Zen" } $ProcessNameMap = @{ "operagx" = "opera" "mullvad" = "mullvadbrowser" } $trueCacheNames = @("Cache", "Code Cache", "DawnCache", "GPUCache", "GrShaderCache", "ShaderCache", "Shared Dictionary\cache") function Get-CacheDirs { param([string]$BrowserName, [string]$ProfilesDirectory) switch ($BrowserName) { "chrome" { $dir = "$ProfilesDirectory\*\AppData\Local\Google\Chrome\User Data" Get-ChildItem $dir -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName } } "firefox" { $dir = "$ProfilesDirectory\*\AppData\Local\Mozilla\Firefox\Profiles" Get-ChildItem $dir -Directory -Recurse -Include "cache2" -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName + '\entries' } } "opera" { $dir1 = "$ProfilesDirectory\*\AppData\Local\Opera Software" $r1 = Get-ChildItem $dir1 -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName } $dir2 = "$ProfilesDirectory\*\AppData\Roaming\Opera Software" $r2 = Get-ChildItem $dir2 -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName } $r1 + $r2 } "operagx" { $dir1 = "$ProfilesDirectory\*\AppData\Local\Opera Software\Opera GX Stable" $r1 = Get-ChildItem $dir1 -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName } $dir2 = "$ProfilesDirectory\*\AppData\Roaming\Opera Software\Opera GX Stable" $r2 = Get-ChildItem $dir2 -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName } $r1 + $r2 } "brave" { $dir = "$ProfilesDirectory\*\AppData\Local\BraveSoftware\Brave-Browser\User Data" Get-ChildItem $dir -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName } } "msedge" { $dir = "$ProfilesDirectory\*\AppData\Local\Microsoft\Edge\User Data" Get-ChildItem $dir -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName } } "vivaldi" { $dir = "$ProfilesDirectory\*\AppData\Local\Vivaldi\User Data" Get-ChildItem $dir -Directory -Recurse -Include $trueCacheNames -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName } } "librewolf" { $dir = "$ProfilesDirectory\*\AppData\Local\LibreWolf\Profiles" Get-ChildItem $dir -Directory -Recurse -Include "cache2" -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName + '\entries' } } "mullvad" { $dir = "$ProfilesDirectory\*\AppData\Local\Mullvad\MullvadBrowser\Profiles" Get-ChildItem $dir -Directory -Recurse -Include "cache2" -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName + '\entries' } } "zen" { $dir = "$ProfilesDirectory\*\AppData\Local\zen\Profiles" Get-ChildItem $dir -Directory -Recurse -Include "cache2" -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName + '\entries' } } } } function Format-Size { param([long]$Bytes) if ($Bytes -ge 1GB) { return '{0:N2} GB' -f ($Bytes / 1GB) } if ($Bytes -ge 1MB) { return '{0:N2} MB' -f ($Bytes / 1MB) } if ($Bytes -ge 1KB) { return '{0:N2} KB' -f ($Bytes / 1KB) } return "$Bytes B" } $BrowserKeys = @('chrome', 'firefox', 'opera', 'operagx', 'brave', 'msedge', 'vivaldi', 'librewolf', 'mullvad', 'zen') foreach ($key in $BrowserKeys) { $procName = if ($ProcessNameMap.ContainsKey($key)) { $ProcessNameMap[$key] } else { $key } Get-Process -Name $procName -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue } Start-Sleep -Seconds 5 $grandBytes = 0L $grandFiles = 0 $anyFound = $false foreach ($key in $BrowserKeys) { $cacheDirs = Get-CacheDirs -BrowserName $key -ProfilesDirectory $ProfilesDirectory if (-not $cacheDirs -or $cacheDirs.Count -eq 0) { continue } $anyFound = $true $displayName = $DisplayNames[$key] $browserBytes = 0L $browserFiles = 0 foreach ($cacheDir in $cacheDirs) { if (-not (Test-Path $cacheDir)) { continue } $items = Get-ChildItem -Path $cacheDir -Force -Recurse -ErrorAction SilentlyContinue $files = $items | Where-Object { -not $_.PSIsContainer } $bytes = ($files | Measure-Object -Property Length -Sum).Sum if (-not $bytes) { $bytes = 0 } $browserFiles += $files.Count $browserBytes += $bytes Get-ChildItem -Path "$cacheDir\*" -Force -ErrorAction SilentlyContinue | Remove-Item -Force -Recurse -ErrorAction SilentlyContinue } $grandBytes += $browserBytes $grandFiles += $browserFiles Write-Host ("{0,-16} freed {1,10} ({2} files)" -f $displayName, (Format-Size $browserBytes), $browserFiles) } if (-not $anyFound) { Write-Host "No cache found for any installed browser." } Write-Host "" Write-Host ("Total freed: {0} ({1} files)" -f (Format-Size $grandBytes), $grandFiles) EndPowerShell: Comment: Windows Recovery Environment (Windows RE) status and enable CMD: C:\Windows\System32\reagentc.exe /info CMD: C:\Windows\System32\reagentc.exe /enable Comment: Disable hidden file extensions REG: reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f REG: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt" /v "CheckedValue" /t REG_DWORD /d 0 /f Comment: Verify WMI repository, repair & verify again CMD: C:\Windows\System32\wbem\winmgmt.exe /verifyrepository CMD: C:\Windows\System32\wbem\winmgmt.exe /salvagerepository CMD: C:\Windows\System32\wbem\winmgmt.exe /verifyrepository Comment: To rebuild the performance counter library values StartBatch: C:\Windows\System32\lodctr.exe" /R C:\Windows\SysWOW64\lodctr.exe" /R C:\Windows\System32\lodctr.exe /R C:\Windows\SysWOW64\lodctr.exe /R EndBatch: Comment: Resync performance counter library values to WMI as well CMD: C:\Windows\System32\wbem\winmgmt.exe /resyncperf Comment: Force policy removal C:\Windows\System32\GroupPolicyUsers C:\Windows\System32\GroupPolicy CMD: C:\Windows\System32\gpupdate.exe /force Comment: Restores and hardens selected Microsoft Defender Antivirus preferences. Comment: Tamper Protection must be temporarily disabled before applying these settings. Comment: Thanks to AdvancedSetup from Malwarebytes DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender|DisableAntiSpyware DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender|DisableAntiVirus StartPowerShell: # Enable real-time and behavioral protection Set-MpPreference -DisableRealtimeMonitoring $false Set-MpPreference -DisableBehaviorMonitoring $false # Enable potentially unwanted application blocking Set-MpPreference -PUAProtection Enabled # Enable cloud-delivered protection and automatic safe-sample submission Set-MpPreference -MAPSReporting Advanced Set-MpPreference -SubmitSamplesConsent SendSafeSamples # Use Microsoft's recommended high cloud-blocking level Set-MpPreference -CloudBlockLevel High # Allow additional time for cloud analysis of suspicious files Set-MpPreference -CloudExtendedTimeout 30 # Block connections to known malicious or untrusted network destinations Set-MpPreference -EnableNetworkProtection Enabled # Enable Block at First Sight Set-MpPreference -DisableBlockAtFirstSeen $false # Enable archive, removable-drive, network-file, download, and script scanning Set-MpPreference -DisableArchiveScanning $false Set-MpPreference -DisableRemovableDriveScanning $false Set-MpPreference -DisableScanningNetworkFiles $false Set-MpPreference -DisableIOAVProtection $false Set-MpPreference -DisableScriptScanning $false # Check for current security intelligence before starting a scan Set-MpPreference -CheckForSignaturesBeforeRunningScan $true # Enable supported DNS attack inspection and sinkholing when available if ((Get-Command Set-MpPreference).Parameters.ContainsKey('EnableDnsSinkhole')) { Set-MpPreference -EnableDnsSinkhole $true } # Sets signature update interval to 12 hours (default 24 hours) Set-MpPreference -SignatureUpdateInterval 12 # Update Microsoft Defender security intelligence Update-MpSignature EndPowerShell: Comment: List Windows Defender properties, settings StartPowerShell: function Write-Section { param([string]$Title) Write-Host "" Write-Host "<=== $Title ===>" } Write-Section "Protection Status" Get-MpComputerStatus | Select-Object AMServiceEnabled, AntispywareEnabled, AntivirusEnabled, BehaviorMonitorEnabled, IoavProtectionEnabled, RealTimeProtectionEnabled, IsTamperProtected, NetworkProtectionStatus | Format-List Write-Section "Signature / Engine Versions" Get-MpComputerStatus | Select-Object AMProductVersion, AMEngineVersion, AntivirusSignatureVersion, AntispywareSignatureVersion | Format-List Write-Section "Preferences / Configuration" Get-MpPreference | Select-Object PUAProtection, MAPSReporting, SubmitSamplesConsent, CheckForSignaturesBeforeRunningScan, CloudBlockLevel, EnableNetworkProtection, DisableScriptScanning, DisableArchiveScanning, DisableRemovableDriveScanning, DisableScanningNetworkFiles, DisableScanningMappedNetworkDrivesForFullScan, DisableBlockAtFirstSeen, DisableHeuristics, DisableAutoExclusions | Format-List Write-Section "Threat Detections" $threats = Get-MpThreatDetection if ($threats) { $threats | Format-Table -AutoSize } else { Write-Host " (no threat detections found)" } EndPowerShell: Comment: Enable recovery environment CMD: C:\Windows\System32\bcdedit.exe /set {default} recoveryenabled yes Comment: Restore original Windows services configuration StartPowerShell: Set-Service -Name "Netlogon" -StartupType Manual Set-Service -Name "BITS" -StartupType Manual Set-Service -Name "Dhcp" -StartupType Automatic Set-Service -Name "EventLog" -StartupType Automatic Set-Service -Name "EventSystem" -StartupType Automatic Set-Service -Name "nsi" -StartupType Automatic Set-Service -Name "RasMan" -StartupType Manual Set-Service -Name "SDRSVC" -StartupType Manual Set-Service -Name "SstpSvc" -StartupType Manual Set-Service -Name "TrustedInstaller" -StartupType Manual Set-Service -Name "VSS" -StartupType Manual Set-Service -Name "Winmgmt" -StartupType Automatic Set-Service -Name "wuauserv" -StartupType Manual EndPowerShell: Comment: BITS reset Startbatch: @echo off C:\Windows\System32\net.exe stop BITS C:\Windows\System32\ipconfig.exe /flushdns ren "%programdata%\Microsoft\Network\Downloader\qmgr*.*" qmgr*.*.old C:\Windows\System32\net.exe start BITS Endbatch: cmd: C:\Windows\System32\bitsadmin.exe /reset /allusers Comment: Reset the Windows Update download cache and update catalog database CMD: C:\Windows\System32\net.exe stop wuauserv /y CMD: C:\Windows\System32\net.exe stop cryptSvc /y CMD: C:\Windows\System32\net.exe stop bits /y CMD: C:\Windows\System32\net.exe stop msiserver /y Unlock: C:\Windows\SoftwareDistribution CMD: ren C:\Windows\SoftwareDistribution SoftwareDistribution.old Unlock: C:\Windows\System32\CatRoot2 CMD: ren C:\Windows\System32\CatRoot2 CatRoot2.old CMD: C:\Windows\System32\net.exe start wuauserv /y CMD: C:\Windows\System32\net.exe start cryptSvc /y CMD: C:\Windows\System32\net.exe start bits /y CMD: C:\Windows\System32\net.exe start msiserver /y Comment: Resets icon cache StartBatch: del /a /q "%localappdata%\IconCache.db" del /a /f /q "%localappdata%\Microsoft\Windows\Explorer\iconcache*" del /a /f /q "%localappdata%\Microsoft\Windows\Explorer\thumbcache*" EndBatch: Comment: Disable automatic restart after a crash, enable automatic updates StartRegedit: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl] "AutoReboot"=dword:00000000 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU] "NoAutoUpdate"=- EndRegedit: Comment: Reset PowerShell execution policy Powershell: Set-ExecutionPolicy Unrestricted -Scope CurrentUser -Force Comment: Fully reset the Windows network stack, WinHTTP proxy settings, DNS cache, and BITS transfer queue. Comment: Thanks to AdvancedSetup from Malwarebytes StartBatch: C:\Windows\System32\ipconfig.exe /flushdns C:\Windows\System32\ipconfig.exe /release C:\Windows\System32\netsh.exe winsock reset catalog C:\Windows\System32\netsh.exe int ip reset C:\Windows\System32\netsh.exe winhttp reset proxy C:\Windows\System32\netsh.exe winhttp reset autoproxy C:\Windows\System32\netsh.exe winhttp reset tracing EndBatch: Comment: Enable all firewall profiles CMD: C:\Windows\System32\netsh.exe advfirewall set allprofiles state on Comment: Additional temp file removal C:\Windows\System32\config\systemprofile\AppData\Local\*.tmp C:\WINDOWS\system32\*.tmp C:\WINDOWS\syswow64\*.tmp C:\Users\CurrentUserName\AppData\Local\Temp\* C:\Windows\Temp\* C:\Windows\SystemTemp\* C:\Windows\Prefetch\* Comment: System repair commands CMD: C:\Windows\System32\SFC.exe /scannow CMD: C:\Windows\System32\DISM.exe /Online /Cleanup-image /Restorehealth Comment: Remove set proxy servers RemoveProxy: Comment: Remove temporary files via FRST EmptyTemp: End::