content copied
content
Start::
CreateRestorePoint:
CloseProcesses:
File: C:\Users\usuario\AppData\Local\Programs\Transmission\transmission-qt.exe
File: C:\ProgramData\lock.dat;C:\ProgramData\rc.dat;C:\ProgramData\ts.dat
File: C:\Windows\system32\ac3acm.acm
File: C:\Program Files\ASUS\AacMB\Aac3572MbHal_x64.exe
File: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\CBSCreateVC.dll
File: C:\Program Files\Adobe\Acrobat DC\Acrobat\locale\es_es\Acrobat Elements\ContextMenuShim64.esp
File: C:\Program Files\AMD\AMD Privacy View\ewvcam\APV\x64\eyeware_vcam.dll
File: C:\Program Files\Razer\RazerAppEngine\app-4.0.821\dxcompiler.dll
Folder: C:\Users\usuario\AppData\Roaming\Prefs. de formato PNG de Adobe CS6
principle offer 1.1.10.99 (HKLM-x32\...\{bf613f05-7172-4cde-99d4-30773a09439a}) (Version: 1.1.10.99 - Eichmann, Spencer and Kuhn and Sons) Hidden
Salmon accommodation 2.5.5.78 (HKLM-x32\...\{b0c6b8a6-dea3-48df-9f9e-ab3d6cd2a2ae}) (Version: 2.5.5.78 - Marchetti-Giuliani Group SPA) Hidden
Ultimate Ad Eraser 1.0.0.0 (HKU\S-1-5-21-3630950357-4075521388-2021559087-1001\...\{54634965-28ef-4e45-a798-1c0c9c7cc679}) (Version: 1.0.0.0 - asevcuk865) Hidden
CHR HKLM-x32\...\Chrome\Extension: [aegnopegbbhjeeiganiajffnalhlkkjb]
CHR HKLM-x32\...\Chrome\Extension: [hkmfdialkjnljbcnincgpollobclebaf]
CHR HKU\S-1-5-21-3630950357-4075521388-2021559087-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [mjbepbhonbojpoaenhckjocchgfiaofo]
FF HKU\S-1-5-21-3630950357-4075521388-2021559087-1001\...\Firefox\Extensions: [[email protected]] - C:\Users\usuario\AppData\Roaming\ACEStream\extensions\awe\firefox\acewebextension_unlisted.xpi
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Edge: Restriction <==== ATTENTION
Task: {867B8A61-8A04-4D5F-834A-3999E598DA85} - System32\Tasks\AMDInstallUEP => C:\Program Files\AMD\InstallUEP\AMDInstallUEP.exe (No File)
Task: {245C4AC4-43F2-460C-A826-09D0600C69DC} - System32\Tasks\ASUS\P508PowerAgent_sdk => C:\Program Files (x86)\ASUS\ArmouryDevice\dll\ShareFromArmouryIII\Mouse\ROG STRIX CARRY\P508PowerAgent.exe (No File)
Task: {BCB54AE1-320F-4405-9E66-149085D58714} - System32\Tasks\Microsoft\Windows\Clip\ClipESUConsumerProcessECUpdate => %SystemRoot%\system32\ClipESUConsumer.exe -persistEligibilityStatus (No File)
Task: {E88D9B2C-DDEA-47B2-9582-085153004DB5} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe (No File)
Task: {CCDFC0B8-01A3-4E74-A820-4F13F51D269E} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => %SystemRoot%\System32\MbaeParserTask.exe (No File)
Task: {CAB76809-EDC0-40D2-A888-AD9BEDF4E88A} - System32\Tasks\Microsoft\Windows\UNP\RunUpdateNotificationMgr => %windir%\System32\UNP\UpdateNotificationMgr.exe (No File)
Task: {16B8E674-1DA5-4F13-B4F5-D2EDCC49EBD8} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_AC => %systemroot%\system32\MusNotification.exe /RunOnAC RebootDialog (No File)
Task: {24020FC7-0597-4BCF-B1B5-1622DD5ABAF5} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery => %systemroot%\system32\MusNotification.exe /RunOnBattery RebootDialog (No File)
Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe (No File)
S3 ace-game-0; \SystemRoot\System32\drivers\ace-game-0.sys (No File)
CustomCLSID: HKU\S-1-5-21-3630950357-4075521388-2021559087-1001_Classes\CLSID\{58624db6-e4cf-4ed6-a097-e489720c719b}\localserver32 -> "C:\Program Files\TechSmith\Camtasia 2023\CamtasiaStudio.exe" -ToastActivated => No File
CustomCLSID: HKU\S-1-5-21-3630950357-4075521388-2021559087-1001_Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32 -> => No File
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => -> No File
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => -> No File
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => -> No File
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => -> No File
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => -> No File
ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => -> No File
ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => -> No File
AlternateDataStreams: C:\WINDOWS\tracing:? [16]
FirewallRules: [{309BD452-D7D3-4C87-A97A-2E7855B6061A}] => (Allow) C:\ProgramData\ASUS\ARMOURY CRATE One Package\ACFL20260313204556\ACSetup\ACSetup.exe => No File
FirewallRules: [{A4019004-0281-4296-BBB4-C38C2DAA05D4}] => (Allow) C:\ProgramData\ASUS\ARMOURY CRATE One Package\ACFL20260313204556\ACSetup\ACSetup.exe => No File
FirewallRules: [UDP Query User{71E946E8-89BF-4421-B6D4-DA8F982B7652}C:\users\usuario\desktop\timberborn.build.18346774\timberborn.exe] => (Allow) C:\users\usuario\desktop\timberborn.build.18346774\timberborn.exe => No File
FirewallRules: [TCP Query User{B87B063B-A6E6-413D-950E-DA4FDFD407F7}C:\users\usuario\desktop\timberborn.build.18346774\timberborn.exe] => (Allow) C:\users\usuario\desktop\timberborn.build.18346774\timberborn.exe => No File
FirewallRules: [UDP Query User{722235C0-184C-4234-B867-C15315FC8E43}D:\steam\steamapps\common\astroneer\astro\binaries\win64\astro-win64-shipping.exe] => (Allow) D:\steam\steamapps\common\astroneer\astro\binaries\win64\astro-win64-shipping.exe => No File
FirewallRules: [TCP Query User{C7269F61-23EA-4839-98B5-BB80DE0207E7}D:\steam\steamapps\common\astroneer\astro\binaries\win64\astro-win64-shipping.exe] => (Allow) D:\steam\steamapps\common\astroneer\astro\binaries\win64\astro-win64-shipping.exe => No File
FirewallRules: [{23AC1C3D-111A-4CEB-917C-F2984B9C5033}] => (Allow) D:\Steam\steamapps\common\Planet S\editor\PlanS-Tools.exe => No File
FirewallRules: [{02975345-B866-4577-883C-7A2396CA21BC}] => (Allow) D:\Steam\steamapps\common\Planet S\editor\PlanS-Tools.exe => No File
FirewallRules: [{820D422C-026E-4C86-97FA-4D6F51F1B580}] => (Allow) D:\Steam\steamapps\common\Factorio\bin\x64\factorio.exe => No File
FirewallRules: [{EFE1C98F-1751-45C6-B30B-F20631AAC00E}] => (Allow) D:\Steam\steamapps\common\Factorio\bin\x64\factorio.exe => No File
FirewallRules: [UDP Query User{CEB72A43-FAB4-46B6-B370-6D9F87F1715E}C:\users\usuario\desktop\dyson.sphere.program.build.17922069\dspgame.exe] => (Allow) C:\users\usuario\desktop\dyson.sphere.program.build.17922069\dspgame.exe => No File
FirewallRules: [TCP Query User{9EE9344B-67DD-44E7-9035-B3ED1EB34022}C:\users\usuario\desktop\dyson.sphere.program.build.17922069\dspgame.exe] => (Allow) C:\users\usuario\desktop\dyson.sphere.program.build.17922069\dspgame.exe => No File
FirewallRules: [UDP Query User{85B91F13-F795-492A-B33A-7CE002EE2B64}C:\users\usuario\desktop\plan b terraform\plan b terraform.exe] => (Allow) C:\users\usuario\desktop\plan b terraform\plan b terraform.exe => No File
FirewallRules: [TCP Query User{D00114FD-AA6E-4F71-8F6C-9C1DFCB61539}C:\users\usuario\desktop\plan b terraform\plan b terraform.exe] => (Allow) C:\users\usuario\desktop\plan b terraform\plan b terraform.exe => No File
FirewallRules: [UDP Query User{0E560D3F-BEC1-4B39-A2DE-6BA842A405D5}D:\games\counter-strike 1.6\cstrike.exe] => (Allow) D:\games\counter-strike 1.6\cstrike.exe => No File
FirewallRules: [TCP Query User{81B331DC-7BB9-4BBE-8EEB-134B486F36F3}D:\games\counter-strike 1.6\cstrike.exe] => (Allow) D:\games\counter-strike 1.6\cstrike.exe => No File
FirewallRules: [{E91E3A4E-D732-40A4-A43A-9C0FEB216303}] => (Allow) D:\Steam\steamapps\common\SC Jogos\Barro GT\Barro GT.exe => No File
FirewallRules: [{FA7865D3-6B7A-4A96-A347-D72BBDD4C300}] => (Allow) D:\Steam\steamapps\common\SC Jogos\Barro GT\Barro GT.exe => No File
FirewallRules: [{727A07DD-E93E-4C0D-BC70-4693ED415C37}] => (Allow) D:\Steam\steamapps\common\SC Jogos\Launcher\SC Jogos Launcher.exe => No File
FirewallRules: [{1CC3AC7B-2182-422A-8078-9C6B93CCEC7D}] => (Allow) D:\Steam\steamapps\common\SC Jogos\Launcher\SC Jogos Launcher.exe => No File
FirewallRules: [{02B4C932-FC2B-4B43-A21A-7A368B32170D}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EALaunchHelper.exe => No File
FirewallRules: [{C9EF5C19-38E8-4E55-8152-1156CFF68CDD}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EALocalHostSvc.exe => No File
FirewallRules: [{0BEFEA52-A295-4C70-8A68-4F7703D054A3}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EALocalHostSvc.exe => No File
FirewallRules: [{22A91613-0FA8-459C-A6E2-2636934ED990}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EAGEP.exe => No File
FirewallRules: [{A867E4B9-FC7F-423A-8C91-DF3F4C02EA34}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EAGEP.exe => No File
FirewallRules: [{EEF43FF5-A7FF-4B9D-B92F-9BD36F659976}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EADesktop.exe => No File
FirewallRules: [{C8E3463A-D7CE-46DE-99BB-CE43A0B14C80}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EADesktop.exe => No File
FirewallRules: [{FA69DC53-2BC5-4AD1-B94C-98896B1E75F2}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EAConnect_microsoft.exe => No File
FirewallRules: [{0115FD29-AA0E-4EB5-A8DC-B573A77D72A1}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EAConnect_microsoft.exe => No File
FirewallRules: [{B06C8807-9813-4C4A-8B2E-25580CA4681E}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EABackgroundService.exe => No File
FirewallRules: [{C28D2839-2A40-4E60-B8B7-EA6E8B562F06}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EABackgroundService.exe => No File
FirewallRules: [{11CF0475-7D91-43AE-8485-79628E98173F}] => (Allow) D:\Steam\steamapps\common\Automation\UE427\AutomationGame\Binaries\Win64\AutomationGame-Win64-Shipping.exe => No File
FirewallRules: [{D5B5FE47-327D-45B8-9AAD-FF02E53B42FE}] => (Allow) D:\Steam\steamapps\common\Automation\UE427\AutomationGame\Binaries\Win64\AutomationGame-Win64-Shipping.exe => No File
FirewallRules: [UDP Query User{8F56342B-BF12-46A2-BF4E-8F42D686875E}D:\battlefield 4\bf4.exe] => (Allow) D:\battlefield 4\bf4.exe => No File
FirewallRules: [TCP Query User{27D07D24-4CED-4FC1-8F46-B4DDCA892783}D:\battlefield 4\bf4.exe] => (Allow) D:\battlefield 4\bf4.exe => No File
FirewallRules: [UDP Query User{FB428985-06E1-4B29-AF54-1B62FD537603}D:\rockstar games\gta v\grand theft auto v\gta5.exe] => (Allow) D:\rockstar games\gta v\grand theft auto v\gta5.exe => No File
FirewallRules: [TCP Query User{6FA1CC29-A4C8-4F79-901B-D852B313D54B}D:\rockstar games\gta v\grand theft auto v\gta5.exe] => (Allow) D:\rockstar games\gta v\grand theft auto v\gta5.exe => No File
FirewallRules: [UDP Query User{D6A85529-037B-496E-84BF-FCE089AF971C}C:\riot games\riot client\riotclientelectron\riot client.exe] => (Block) C:\riot games\riot client\riotclientelectron\riot client.exe => No File
FirewallRules: [TCP Query User{2B609D91-DF95-4F20-A646-650189E5EC9A}C:\riot games\riot client\riotclientelectron\riot client.exe] => (Block) C:\riot games\riot client\riotclientelectron\riot client.exe => No File
FirewallRules: [UDP Query User{B73BD91A-664C-4D1A-A21E-4E4F6E7990A9}D:\steam\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe] => (Allow) D:\steam\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe => No File
FirewallRules: [TCP Query User{8AD350D4-7F42-412D-9372-60F6E358BA5E}D:\steam\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe] => (Allow) D:\steam\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe => No File
FirewallRules: [UDP Query User{58DB1079-C0FA-4BB0-838C-0303915FA2AB}D:\rocketleague\binaries\win64\rocketleague.exe] => (Allow) D:\rocketleague\binaries\win64\rocketleague.exe => No File
FirewallRules: [TCP Query User{48359AA0-3B82-4848-9BDC-682C503386FB}D:\rocketleague\binaries\win64\rocketleague.exe] => (Allow) D:\rocketleague\binaries\win64\rocketleague.exe => No File
FirewallRules: [UDP Query User{4F0E3BC6-43E0-4595-8F4F-E465142A526B}D:\steam\steamapps\common\the finals\discovery\binaries\win64\discovery.exe] => (Allow) D:\steam\steamapps\common\the finals\discovery\binaries\win64\discovery.exe => No File
FirewallRules: [TCP Query User{BFC7AEEB-DCD2-45CF-A1D9-200EDA719283}D:\steam\steamapps\common\the finals\discovery\binaries\win64\discovery.exe] => (Allow) D:\steam\steamapps\common\the finals\discovery\binaries\win64\discovery.exe => No File
FirewallRules: [{12E01D06-BC2C-4582-93CE-9967F0A6A03B}] => (Allow) D:\Steam\steamapps\common\XCOM 2\2KLauncher\LauncherPatcher.exe => No File
FirewallRules: [{AD4578B7-9D79-4CD8-832C-C17FB0997CAF}] => (Allow) D:\Steam\steamapps\common\XCOM 2\2KLauncher\LauncherPatcher.exe => No File
FirewallRules: [UDP Query User{BC81C64B-AE7B-418D-A9A5-77F3E4AF07AA}D:\games\forza horizon 5\forzahorizon5.exe] => (Allow) D:\games\forza horizon 5\forzahorizon5.exe => No File
FirewallRules: [TCP Query User{98C4BD97-8298-49F1-A2BB-2900BF57AD80}D:\games\forza horizon 5\forzahorizon5.exe] => (Allow) D:\games\forza horizon 5\forzahorizon5.exe => No File
FirewallRules: [UDP Query User{99763263-5DB6-4CB0-83FE-8FFC68AB2F93}D:\games\forza horizon 4\forzahorizon4.exe] => (Allow) D:\games\forza horizon 4\forzahorizon4.exe => No File
FirewallRules: [TCP Query User{373D1645-3910-43FD-946F-CAC5E20F1AF0}D:\games\forza horizon 4\forzahorizon4.exe] => (Allow) D:\games\forza horizon 4\forzahorizon4.exe => No File
FirewallRules: [UDP Query User{EAC89BD9-9B3C-4F9C-8A51-10916FC2AE92}C:\users\usuario\desktop\variadas\descargas torrent\juegos\graveyard keeper v1.400-pivigames.blog\graveyard keeper.exe] => (Allow) C:\users\usuario\desktop\variadas\descargas torrent\juegos\graveyard keeper v1.400-pivigames.blog\graveyard keeper.exe => No File
FirewallRules: [TCP Query User{C05AA003-5091-4DF2-9F23-E2122965124B}C:\users\usuario\desktop\variadas\descargas torrent\juegos\graveyard keeper v1.400-pivigames.blog\graveyard keeper.exe] => (Allow) C:\users\usuario\desktop\variadas\descargas torrent\juegos\graveyard keeper v1.400-pivigames.blog\graveyard keeper.exe => No File
FirewallRules: [UDP Query User{4BED6FA0-55B2-4014-A4FE-1958DE3E04BF}C:\program files\epic games\payday2\payday2_win32_release.exe] => (Allow) C:\program files\epic games\payday2\payday2_win32_release.exe => No File
FirewallRules: [TCP Query User{2A926480-6407-49F9-A899-1DE0E26307B5}C:\program files\epic games\payday2\payday2_win32_release.exe] => (Allow) C:\program files\epic games\payday2\payday2_win32_release.exe => No File
FirewallRules: [UDP Query User{298600EA-7D7A-4F4A-8EB6-3D774AEE3925}C:\program files (x86)\diablo iv\diablo iv.exe] => (Allow) C:\program files (x86)\diablo iv\diablo iv.exe => No File
FirewallRules: [TCP Query User{1EEEDF96-8764-4F58-B2F9-CA0466CAD6FC}C:\program files (x86)\diablo iv\diablo iv.exe] => (Allow) C:\program files (x86)\diablo iv\diablo iv.exe => No File
FirewallRules: [UDP Query User{2D5B688F-152B-4150-BC3F-113CB1EA93D6}D:\games\torchlight iii\frontiers\binaries\win64\frontiers-win64-shipping.exe] => (Allow) D:\games\torchlight iii\frontiers\binaries\win64\frontiers-win64-shipping.exe => No File
FirewallRules: [TCP Query User{852A384B-87BE-4FD3-9536-055429EE9E2D}D:\games\torchlight iii\frontiers\binaries\win64\frontiers-win64-shipping.exe] => (Allow) D:\games\torchlight iii\frontiers\binaries\win64\frontiers-win64-shipping.exe => No File
FirewallRules: [UDP Query User{FC9FB441-09D1-4B48-B80E-20DEDA723321}C:\users\usuario\appdata\roaming\utorrent\updates\utorrent.exe] => (Allow) C:\users\usuario\appdata\roaming\utorrent\updates\utorrent.exe => No File
FirewallRules: [TCP Query User{C14CE545-F134-4449-9F16-39F2CB5F8E93}C:\users\usuario\appdata\roaming\utorrent\updates\utorrent.exe] => (Allow) C:\users\usuario\appdata\roaming\utorrent\updates\utorrent.exe => No File
FirewallRules: [UDP Query User{A518D13E-D043-486A-B145-925C1DC40B50}D:\tzared\tzared.exe] => (Allow) D:\tzared\tzared.exe => No File
FirewallRules: [TCP Query User{2C924F43-B1C5-4E4E-90F6-A448186813DE}D:\tzared\tzared.exe] => (Allow) D:\tzared\tzared.exe => No File
FirewallRules: [UDP Query User{A887A5EC-3B48-4AE8-B7AB-449D958A6786}C:\program files\ea games\battlefield 4\bf4.exe] => (Allow) C:\program files\ea games\battlefield 4\bf4.exe => No File
FirewallRules: [TCP Query User{0FF017E2-7E9D-44FD-8538-F680065BAC3E}C:\program files\ea games\battlefield 4\bf4.exe] => (Allow) C:\program files\ea games\battlefield 4\bf4.exe => No File
FirewallRules: [{B97FAD63-2C7A-4789-B889-664CB87CC52E}] => (Allow) C:\Program Files\EA Games\Battlefield 4\BFLauncher_x86.exe => No File
FirewallRules: [{6351F2E9-395A-4C25-8419-056F1C1BA222}] => (Allow) C:\Program Files\EA Games\Battlefield 4\BFLauncher_x86.exe => No File
FirewallRules: [{B4B4B8A8-C4F4-4E4F-8EBA-9E4181373C38}] => (Allow) C:\Program Files\EA Games\Battlefield 4\BFLauncher.exe => No File
FirewallRules: [{01BFF302-1D7A-4291-A720-A7602C37D329}] => (Allow) C:\Program Files\EA Games\Battlefield 4\BFLauncher.exe => No File
FirewallRules: [UDP Query User{4E8DB287-8184-49FA-9FFB-9F3B096AFDCA}D:\steam\steamapps\common\battlefield 1\bf1.exe] => (Allow) D:\steam\steamapps\common\battlefield 1\bf1.exe => No File
FirewallRules: [TCP Query User{3CE35B81-865A-4DCC-9D9A-F25F78BB7AA5}D:\steam\steamapps\common\battlefield 1\bf1.exe] => (Allow) D:\steam\steamapps\common\battlefield 1\bf1.exe => No File
FirewallRules: [UDP Query User{3AD65EED-4725-4D23-9605-AF7C1039519A}D:\steam\steamapps\common\warface\13_2000076\bin64release\game.exe] => (Allow) D:\steam\steamapps\common\warface\13_2000076\bin64release\game.exe => No File
FirewallRules: [TCP Query User{1E9A9CFF-EDF6-4AE4-95E1-F202690A46A6}D:\steam\steamapps\common\warface\13_2000076\bin64release\game.exe] => (Allow) D:\steam\steamapps\common\warface\13_2000076\bin64release\game.exe => No File
FirewallRules: [UDP Query User{077CD36D-55CA-44BC-91EB-BA40A77B9B29}D:\deathloop\deathloop.exe] => (Allow) D:\deathloop\deathloop.exe => No File
FirewallRules: [TCP Query User{91DD9CB9-7242-4226-ADF4-3139475B4E2A}D:\deathloop\deathloop.exe] => (Allow) D:\deathloop\deathloop.exe => No File
FirewallRules: [{64D271BA-F290-4BAD-92FE-8EBBD04D3787}] => (Allow) C:\Users\usuario\AppData\Roaming\uTorrent\uTorrent.exe => No File
FirewallRules: [{3F7D0C29-4F02-4C1E-A697-40C8BF0AA9B1}] => (Allow) C:\Users\usuario\AppData\Roaming\uTorrent\uTorrent.exe => No File
FirewallRules: [UDP Query User{F496BB14-5ADF-466B-834C-BCCB4EB6C7FC}C:\users\usuario\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\usuario\appdata\roaming\spotify\spotify.exe => No File
FirewallRules: [TCP Query User{B7583C1B-8F46-4488-BA6C-12DA896D84E0}C:\users\usuario\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\usuario\appdata\roaming\spotify\spotify.exe => No File
FirewallRules: [{C3FCA1E3-4E8F-4A38-8097-94493229F083}] => (Allow) D:\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File
FirewallRules: [{FDDDF4FA-186C-4F0D-830C-60C1A65C2972}] => (Allow) D:\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File
FirewallRules: [{E7C571D0-8642-40B6-889D-D2B1CF3E5DF3}] => (Allow) C:\ProgramData\ASUS\ARMOURY CRATE One Package\ACFL20260402142440\ACSetup\ACSetup.exe => No File
FirewallRules: [{DBB9C685-1831-4D02-B642-2A8F568CAAD7}] => (Allow) C:\ProgramData\ASUS\ARMOURY CRATE One Package\ACFL20260402142440\ACSetup\ACSetup.exe => No File
FirewallRules: [TCP Query User{C3CE346D-2BC5-471A-825F-792504CF5D26}C:\users\usuario\desktop\variadas\modulus.factory.automation-p2p\modulus.exe] => (Allow) C:\users\usuario\desktop\variadas\modulus.factory.automation-p2p\modulus.exe => No File
FirewallRules: [UDP Query User{25D31EBE-61F1-4B1D-89CB-56F28933C689}C:\users\usuario\desktop\variadas\modulus.factory.automation-p2p\modulus.exe] => (Allow) C:\users\usuario\desktop\variadas\modulus.factory.automation-p2p\modulus.exe => No File
FirewallRules: [{F8AF85AD-ACFD-4BF6-A3E8-6EBF2035B571}] => (Allow) C:\ProgramData\ASUS\ARMOURY CRATE One Package\ACFL20260513003103\ACSetup\ACSetup.exe => No File
FirewallRules: [{AB1EACA4-9780-42CE-8DC7-9937677382B3}] => (Allow) C:\ProgramData\ASUS\ARMOURY CRATE One Package\ACFL20260513003103\ACSetup\ACSetup.exe => No File
FirewallRules: [TCP Query User{F54BDC46-58DB-4F75-909D-B9A73E705644}C:\users\usuario\appdata\local\discord\app-1.0.9237\discord.exe] => (Block) C:\users\usuario\appdata\local\discord\app-1.0.9237\discord.exe => No File
FirewallRules: [UDP Query User{49316645-F01D-4DF6-B2AF-0EF600B92AC9}C:\users\usuario\appdata\local\discord\app-1.0.9237\discord.exe] => (Block) C:\users\usuario\appdata\local\discord\app-1.0.9237\discord.exe => No File
# This snippet lists all installed apps and their folder contents along with SHA256 hashes. Useful for troubleshooting malware abusing installed app entry.
StartPowerShell:
param(
[switch]$Recurse,
[int]$MaxFilesPerApp = [int]::MaxValue
)
$uninstallPaths = @(
'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
)
$script:msiInstaller = $null
function Get-MsiInstallLocation {
param([string]$ProductCode)
if (-not $script:msiInstaller) {
try { $script:msiInstaller = New-Object -ComObject WindowsInstaller.Installer } catch { return $null }
}
try {
$loc = $script:msiInstaller.ProductInfo($ProductCode, 'InstallLocation')
if ([string]::IsNullOrWhiteSpace($loc)) { $loc = $script:msiInstaller.ProductInfo($ProductCode, 'InstallSource') }
if ([string]::IsNullOrWhiteSpace($loc)) { return $null }
return $loc
} catch { return $null }
}
function Get-CleanPath {
param([string]$RawValue)
if ([string]::IsNullOrWhiteSpace($RawValue)) { return $null }
$s = $RawValue.Trim()
if ($s.StartsWith('"')) {
$endQuote = $s.IndexOf('"', 1)
if ($endQuote -gt 0) { return $s.Substring(1, $endQuote - 1) }
}
if ($s -match '^(.*?\.exe)\b') { return $Matches[1] }
return $s
}
function Format-FileSize {
param([long]$Bytes)
if ($Bytes -ge 1GB) { return '{0:N2} GB' -f ($Bytes / 1GB) }
if ($Bytes -ge 1MB) { return '{0:N2} MB' -f ($Bytes / 1MB) }
if ($Bytes -ge 1KB) { return '{0:N2} KB' -f ($Bytes / 1KB) }
return "$Bytes B"
}
$script:PeExtensions = @('.exe', '.dll', '.sys', '.ocx', '.cpl', '.scr', '.drv', '.efi', '.msi', '.msp', '.msu')
function Test-IsPeFile {
param([string]$Extension)
return $script:PeExtensions -contains $Extension.ToLower()
}
function Get-SignatureInfo {
param([string]$Path, [string]$Extension)
if (-not (Test-IsPeFile -Extension $Extension)) {
return [PSCustomObject]@{ Signer = 'N/A (not PE)'; Status = 'NotApplicable'; Valid = $false }
}
$result = [PSCustomObject]@{ Signer = 'Unsigned'; Status = 'NotSigned'; Valid = $false }
try {
$sig = Get-AuthenticodeSignature -LiteralPath $Path -ErrorAction Stop
$result.Status = $sig.Status.ToString()
$result.Valid = ($sig.Status -eq 'Valid')
if ($sig.SignerCertificate) {
if ($sig.SignerCertificate.Subject -match 'CN=([^,]+)') { $result.Signer = $Matches[1].Trim('"') }
else { $result.Signer = $sig.SignerCertificate.Subject }
if (-not $result.Valid) { $result.Signer += " [INVALID: $($result.Status)]" }
} elseif ($sig.Status -eq 'NotSigned') {
$result.Signer = 'Unsigned'
} else {
$result.Signer = "Unknown [$($result.Status)]"
}
} catch {
$result.Signer = 'Verification error'
$result.Status = 'Error'
$result.Valid = $false
}
return $result
}
$rawApps = Get-ItemProperty -Path $uninstallPaths -ErrorAction SilentlyContinue |
Where-Object { $_.DisplayName -and $_.DisplayName.Trim() -ne '' } |
Select-Object @{Name = 'Name'; Expression = { $_.DisplayName } },
@{Name = 'Version'; Expression = { $_.DisplayVersion } },
@{Name = 'Publisher'; Expression = { $_.Publisher } },
@{Name = 'InstallFolder'; Expression = {
if ($_.InstallLocation -and $_.InstallLocation.Trim() -ne '') { $_.InstallLocation }
elseif ($_.UninstallString -match 'MsiExec\.exe.*?(\{[0-9A-Fa-f\-]{36}\})') {
$productCode = $Matches[1]
$msiLoc = Get-MsiInstallLocation -ProductCode $productCode
if ($msiLoc) { $msiLoc } else { "MSI: $productCode (location not found)" }
}
elseif ($_.UninstallString) { $_.UninstallString }
else { 'N/A' }
} } |
Sort-Object Name -Unique
foreach ($app in $rawApps) {
$versionText = if ($app.Version) { $app.Version } else { '?' }
$publisherText = if ($app.Publisher) { $app.Publisher } else { '?' }
Write-Host ""
Write-Host "<=== $($app.Name) [$versionText] ($publisherText) ===>"
if ($app.InstallFolder -eq 'N/A' -or $app.InstallFolder -match '^MSI: .* \(location not found\)$') {
Write-Host " Path: $($app.InstallFolder)"
continue
}
$cleanPath = Get-CleanPath -RawValue $app.InstallFolder
$exists = $false
try {
$exists = Test-Path -LiteralPath $cleanPath -ErrorAction Stop
} catch [System.UnauthorizedAccessException] {
Write-Host " Path: $cleanPath"
Write-Host " [ACCESS DENIED]"
continue
} catch {
Write-Host " Path: $cleanPath"
Write-Host " [ERROR] cannot access"
continue
}
if (-not $exists) {
Write-Host " Path: $cleanPath"
Write-Host " [NOT FOUND]"
continue
}
$rootItem = Get-Item -LiteralPath $cleanPath -Force
$created = $rootItem.CreationTime.ToString('dd/MM/yyyy HH:mm:ss')
$modified = $rootItem.LastWriteTime.ToString('dd/MM/yyyy HH:mm:ss')
if ($rootItem.PSIsContainer) {
$subFolders = Get-ChildItem -LiteralPath $cleanPath -Directory -Force -ErrorAction SilentlyContinue
$gciParams = @{ LiteralPath = $cleanPath; File = $true; Force = $true; ErrorAction = 'SilentlyContinue' }
if ($Recurse) { $gciParams['Recurse'] = $true }
$allFiles = Get-ChildItem @gciParams
Write-Host " Path: $cleanPath | Created: $created | Modified: $modified | Files: $($allFiles.Count) | Folders: $($subFolders.Count)"
foreach ($dir in $subFolders) {
$dCreated = $dir.CreationTime.ToString('dd/MM/yyyy HH:mm:ss')
$dModified = $dir.LastWriteTime.ToString('dd/MM/yyyy HH:mm:ss')
$dFileCount = (Get-ChildItem -LiteralPath $dir.FullName -File -Force -ErrorAction SilentlyContinue).Count
Write-Host (" [DIR] {0} - {1} - {2,10} - {3}" -f $dCreated, $dModified, "$dFileCount files", $dir.FullName)
}
} else {
$allFiles = @($rootItem)
Write-Host " Path: $cleanPath | Created: $created | Modified: $modified | Files: 1"
}
if ($allFiles.Count -eq 0) { continue }
$shown = $allFiles | Select-Object -First $MaxFilesPerApp
foreach ($f in $shown) {
$hash = 'N/A'
try { $hash = (Get-FileHash -LiteralPath $f.FullName -Algorithm SHA256 -ErrorAction Stop).Hash } catch { $hash = 'HASH-ERROR' }
$size = Format-FileSize -Bytes $f.Length
$fcreated = $f.CreationTime.ToString('dd/MM/yyyy HH:mm:ss')
$fmod = $f.LastWriteTime.ToString('dd/MM/yyyy HH:mm:ss')
$sigInfo = Get-SignatureInfo -Path $f.FullName -Extension $f.Extension
Write-Host (" [{0}] {1} - {2} - {3,10} - Signer: {4} - {5}" -f $hash, $fcreated, $fmod, $size, $sigInfo.Signer, $f.FullName)
}
}
EndPowerShell:
Comment: To rebuild the performance counter library values
CMD: "%WINDIR%\SYSTEM32\lodctr.exe /R"
CMD: "%WINDIR%\SysWOW64\lodctr.exe /R"
CMD: "C:\Windows\SYSTEM32\lodctr.exe /R"
CMD: "C:\Windows\SysWOW64\lodctr.exe /R"
Comment: Resync performance counter library values to WMI as well
CMD: winmgmt.exe /resyncperf
Comment: AdwCleaner scan + clean
StartPowerShell:
New-Item -ItemType Directory -Force -Path "$env:SystemDrive\AdwCleaner" | Out-Null
Invoke-WebRequest -Uri "https://adwcleaner.malwarebytes.com/adwcleaner?channel=release" -OutFile "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe"
Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/eula" -Wait -WindowStyle Hidden
$logFile = "$env:SystemDrive\AdwCleaner\AdwCleanerOutputFRST.txt"
Start-Process -FilePath "$env:SystemDrive\AdwCleaner\AdwCleanerFRST.exe" -ArgumentList "/noreboot /clean" -Wait -WindowStyle Hidden -RedirectStandardOutput $logFile
Get-Content $logFile -Encoding Unicode
Remove-Item -Path $logFile -Force -ErrorAction SilentlyContinue
EndPowerShell:
Comment: HitmanPro scan
StartPowershell:
$hmpExe = "$env:TEMP\HitmanPro_x64.exe"
$logFile = "$env:TEMP\HitmanPro_ScanLog.txt"
Invoke-WebRequest -Uri "https://dl.surfright.nl/HitmanPro_x64.exe" -OutFile $hmpExe -UseBasicParsing
$proc = Start-Process $hmpExe -ArgumentList "/ews","/scanonly","/noinstall","/log=`"$logFile`"","/logtype=txt" -Wait -PassThru
if (!(Test-Path $logFile)) { Write-Host "Scan failed (exit $($proc.ExitCode))"; exit 1 }
Get-Content $logFile -Encoding Unicode
EndPowershell:
Comment: Verify that Discord does not have any injected code to intercept personal data. If anything is prompted here, it needs to be checked that it isn't malicious code.
Powershell: @("$env:APPDATA","$env:LOCALAPPDATA") | ForEach-Object { Get-ChildItem $_ -Recurse -Filter "index.js" -ErrorAction SilentlyContinue } | Where-Object { $_.FullName -match "discord_desktop_core" } | ForEach-Object { Write-Host "--- $($_.FullName) ---"; (Get-Content $_.FullName -Raw).Substring(0,[Math]::Min(2000,(Get-Content $_.FullName -Raw).Length)) }
Comment: Verify Windows activation
CMD: cscript c:\windows\system32\slmgr.vbs /xpr & cscript c:\windows\system32\slmgr.vbs /dlv
Comment: Check TPM and Secure Boot status
StartPowershell:
[PSCustomObject]@{ "TPM Detected" = (Get-Tpm).TpmPresent; "TPM Enabled" = (Get-Tpm).TpmEnabled; "Secure Boot On" = (Confirm-SecureBootUEFI) }
EndPowershell:
Comment: Force policy removal
C:\Windows\System32\GroupPolicyUsers
C:\Windows\System32\GroupPolicy
Comment: Network reset commands
CMD: netsh int ip reset
CMD: netsh int ipv6 reset
CMD: ipconfig /flushDNS
CMD: netsh winsock reset catalog
Comment: Remove unwanted files from common folders using native removal power of Farbar to include remove on reboot if needed. Please double check the user does not have any applications incorrectly installed in the directories listed below.
C:\ProgramData\*.csproj
C:\ProgramData\*.a3x
C:\ProgramData\*.ahk
C:\ProgramData\*.au3
C:\ProgramData\*.bat
C:\ProgramData\*.cab
C:\ProgramData\*.cmd
C:\ProgramData\*.com
C:\ProgramData\*.dll
C:\ProgramData\*.exe
C:\ProgramData\*.hta
C:\ProgramData\*.jar
C:\ProgramData\*.js
C:\ProgramData\*.jse
C:\ProgramData\*.lnk
C:\ProgramData\*.pif
C:\ProgramData\*.ps1
C:\ProgramData\*.py
C:\ProgramData\*.pyc
C:\ProgramData\*.pyd
C:\ProgramData\*.scr
C:\ProgramData\*.tmp
C:\ProgramData\*.vbe
C:\ProgramData\*.vbs
C:\ProgramData\*.wsf
C:\ProgramData\*.wsh
C:\ProgramData\*.zip
C:\ProgramData\*.rar
C:\ProgramData\*.7z
C:\Users\*\AppData\Roaming\*.csproj
C:\Users\*\AppData\Roaming\*.au3
C:\Users\*\AppData\Roaming\*.bat
C:\Users\*\AppData\Roaming\*.cab
C:\Users\*\AppData\Roaming\*.cmd
C:\Users\*\AppData\Roaming\*.com
C:\Users\*\AppData\Roaming\*.dll
C:\Users\*\AppData\Roaming\*.exe
C:\Users\*\AppData\Roaming\*.hta
C:\Users\*\AppData\Roaming\*.jar
C:\Users\*\AppData\Roaming\*.js
C:\Users\*\AppData\Roaming\*.jse
C:\Users\*\AppData\Roaming\*.lnk
C:\Users\*\AppData\Roaming\*.pif
C:\Users\*\AppData\Roaming\*.ps1
C:\Users\*\AppData\Roaming\*.py
C:\Users\*\AppData\Roaming\*.pyc
C:\Users\*\AppData\Roaming\*.pyd
C:\Users\*\AppData\Roaming\*.scr
C:\Users\*\AppData\Roaming\*.tmp
C:\Users\*\AppData\Roaming\*.vbe
C:\Users\*\AppData\Roaming\*.vbs
C:\Users\*\AppData\Roaming\*.wsf
C:\Users\*\AppData\Roaming\*.wsh
C:\Users\*\AppData\Roaming\*.zip
C:\Users\*\AppData\Roaming\*.rar
C:\Users\*\AppData\Roaming\*.7z
C:\Users\CurrentUserName\AppData\Local\*.csproj
C:\Users\CurrentUserName\AppData\Local\*.a3x
C:\Users\CurrentUserName\AppData\Local\*.ahk
C:\Users\CurrentUserName\AppData\Local\*.au3
C:\Users\CurrentUserName\AppData\Local\*.bat
C:\Users\CurrentUserName\AppData\Local\*.cab
C:\Users\CurrentUserName\AppData\Local\*.cmd
C:\Users\CurrentUserName\AppData\Local\*.com
C:\Users\CurrentUserName\AppData\Local\*.dll
C:\Users\CurrentUserName\AppData\Local\*.exe
C:\Users\CurrentUserName\AppData\Local\*.hta
C:\Users\CurrentUserName\AppData\Local\*.jar
C:\Users\CurrentUserName\AppData\Local\*.js
C:\Users\CurrentUserName\AppData\Local\*.jse
C:\Users\CurrentUserName\AppData\Local\*.lnk
C:\Users\CurrentUserName\AppData\Local\*.pif
C:\Users\CurrentUserName\AppData\Local\*.ps1
C:\Users\CurrentUserName\AppData\Local\*.py
C:\Users\CurrentUserName\AppData\Local\*.pyc
C:\Users\CurrentUserName\AppData\Local\*.pyd
C:\Users\CurrentUserName\AppData\Local\*.scr
C:\Users\CurrentUserName\AppData\Local\*.tmp
C:\Users\CurrentUserName\AppData\Local\*.vbe
C:\Users\CurrentUserName\AppData\Local\*.vbs
C:\Users\CurrentUserName\AppData\Local\*.wsf
C:\Users\CurrentUserName\AppData\Local\*.wsh
C:\Users\CurrentUserName\AppData\Local\*.zip
C:\Users\CurrentUserName\AppData\Local\*.rar
C:\Users\CurrentUserName\AppData\Local\*.7z
C:\Users\CurrentUserName\AppData\Roaming\*.csproj
C:\Users\CurrentUserName\AppData\Roaming\*.a3x
C:\Users\CurrentUserName\AppData\Roaming\*.ahk
C:\Users\CurrentUserName\AppData\Roaming\*.au3
C:\Users\CurrentUserName\AppData\Roaming\*.bat
C:\Users\CurrentUserName\AppData\Roaming\*.cab
C:\Users\CurrentUserName\AppData\Roaming\*.cmd
C:\Users\CurrentUserName\AppData\Roaming\*.com
C:\Users\CurrentUserName\AppData\Roaming\*.dll
C:\Users\CurrentUserName\AppData\Roaming\*.exe
C:\Users\CurrentUserName\AppData\Roaming\*.hta
C:\Users\CurrentUserName\AppData\Roaming\*.jar
C:\Users\CurrentUserName\AppData\Roaming\*.js
C:\Users\CurrentUserName\AppData\Roaming\*.jse
C:\Users\CurrentUserName\AppData\Roaming\*.lnk
C:\Users\CurrentUserName\AppData\Roaming\*.pif
C:\Users\CurrentUserName\AppData\Roaming\*.ps1
C:\Users\CurrentUserName\AppData\Roaming\*.py
C:\Users\CurrentUserName\AppData\Roaming\*.pyc
C:\Users\CurrentUserName\AppData\Roaming\*.pyd
C:\Users\CurrentUserName\AppData\Roaming\*.scr
C:\Users\CurrentUserName\AppData\Roaming\*.tmp
C:\Users\CurrentUserName\AppData\Roaming\*.vbe
C:\Users\CurrentUserName\AppData\Roaming\*.vbs
C:\Users\CurrentUserName\AppData\Roaming\*.wsf
C:\Users\CurrentUserName\AppData\Roaming\*.wsh
C:\Users\CurrentUserName\AppData\Roaming\*.zip
C:\Users\CurrentUserName\AppData\Roaming\*.rar
C:\Users\CurrentUserName\AppData\Roaming\*.7z
Comment: Additional temp file removal
C:\Windows\System32\config\systemprofile\AppData\Local\*.tmp
C:\WINDOWS\system32\*.tmp
C:\WINDOWS\syswow64\*.tmp
CMD: del %temp%\*.* /f /s /q
CMD: rd /s /q %temp%
C:\Windows\Temp\*
C:\Windows\SystemTemp\*
EmptyTemp:
End::
Warning
Executing a Fixlist on the wrong system may permanently damage it. Continue only if this link was meant for you.
To view the content, acknowledge this warning.