Preventivní vyčištění a kontrola logu

[extrem]

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:21:52, on 24.10.2022
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.19041.1566)


Boot mode: Normal

Running processes:
C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe
C:\Windows\SysWOW64\DllHost.exe
C:\Users\Roman\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: IEToEdge BHO - {1FD49718-1D00-4B19-AF5F-070AF6D5D54C} - C:\Program Files (x86)\Microsoft\Edge\Application\106.0.1370.52\BHO\ie_to_edge_bho.dll
O2 - BHO: Lync Click to Call BHO - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll
O2 - BHO: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll
O3 - Toolbar: Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll
O4 - HKLM\..\Run: [CanonQuickMenu] C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE /logon
O4 - HKLM\..\Run: [IJNetworkScannerSelectorEX] C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe /FORCE
O4 - HKLM\..\Run: [TeamsMachineInstaller] %ProgramFiles%\Teams Installer\Teams.exe --checkInstall --source=PROPLUS
O4 - HKLM\..\Run: [Adobe CCXProcess] C:\Program Files (x86)\Adobe\Adobe Creative Cloud Experience\CCXProcess.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent
O4 - HKCU\..\Run: [SandboxieControl] "C:\Program Files\Sandboxie\SbieCtrl.exe"
O4 - HKCU\..\Run: [LGHUB] "C:\Program Files\LGHUB\lghub.exe" --background
O4 - HKCU\..\Run: [MobalyticsHQ.DesktopApp] "C:\Users\Roman\AppData\Local\Programs\mobalytics-desktop\Mobalytics Desktop.exe"
O4 - HKCU\..\Run: [electron.app.Mobalytics Desktop] "C:\Users\Roman\AppData\Local\Programs\mobalytics-desktop\Mobalytics Desktop.exe"
O4 - HKCU\..\Run: [Web Companion] C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe --minimize
O4 - HKCU\..\Run: [MicrosoftEdgeAutoLaunch_66D161819F0EAC1A9819F518A968ED0B] "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
O4 - HKCU\..\Run: [GoogleChromeAutoLaunch_18A1594E0F7F3FF02E74E666D5F77580] "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --no-startup-window /prefetch:5
O4 - HKUS\S-1-5-19\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\Program Files\Microsoft Office\root\Office16\ONBttnIE.dll/105
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\ONBttnIE.dll
O9 - Extra button: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll
O9 - Extra 'Tools' menuitem: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: http://*.webcompanion.com
O18 - Protocol: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL
O18 - Protocol: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL
O18 - Protocol: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL
O18 - Protocol: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL
O18 - Protocol: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Protocol: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Filter hijack: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLMF.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD Crash Defender Service - Unknown owner - C:\Windows\System32\amdfendrsr.exe (file missing)
O23 - Service: AMD External Events Utility - AMD - C:\Windows\System32\DriverStore\FileRepository\u0384626.inf_amd64_709232910597852f\B384589\atiesrxx.exe
O23 - Service: AudioDeviceService - Unknown owner - C:\Windows\system32\AudioDeviceService.exe (file missing)
O23 - Service: BattlEye Service (BEService) - Unknown owner - C:\Program Files (x86)\Common Files\BattlEye\BEService.exe
O23 - Service: @%SystemRoot%\system32\CredentialEnrollmentManager.exe,-100 (CredentialEnrollmentManagerUserSvc) - Unknown owner - C:\Windows\system32\CredentialEnrollmentManager.exe (file missing)
O23 - Service: CredentialEnrollmentManagerUserSvc_96bbb - Unknown owner - C:\Windows\system32\CredentialEnrollmentManager.exe (file missing)
O23 - Service: @%SystemRoot%\system32\DiagSvcs\DiagnosticsHub.StandardCollector.ServiceRes.dll,-1000 (diagnosticshub.standardcollector.service) - Unknown owner - C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe (file missing)
O23 - Service: EasyAntiCheat - Epic Games, Inc - C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: Epic Online Services (EpicOnlineServices) - Epic Games, Inc. - C:\Program Files (x86)\Epic Games\Epic Online Services\service\EpicOnlineServicesHost.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Google Chrome Elevation Service (GoogleChromeElevationService) (GoogleChromeElevationService) - Google LLC - C:\Program Files (x86)\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
O23 - Service: Služba Aktualizace Google (gupdate) (gupdate) - Google LLC - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Aktualizace Google (gupdatem) (gupdatem) - Google LLC - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: LGHUB Updater Service (LGHUBUpdaterService) - Logitech, Inc. - C:\Program Files\LGHUB\lghub_updater.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\PerceptionSimulation\PerceptionSimulationService.exe,-101 (perceptionsimulation) - Unknown owner - C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: Realtek Audio Universal Service (RtkAudioUniversalService) - Realtek Semiconductor - C:\Windows\System32\DriverStore\FileRepository\realtekservice.inf_amd64_e879bbabfd265223\RtkAudUService64.exe
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\SecurityHealthAgent.dll,-1002 (SecurityHealthService) - Unknown owner - C:\Windows\system32\SecurityHealthService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SensorDataService.exe,-101 (SensorDataService) - Unknown owner - C:\Windows\System32\SensorDataService.exe (file missing)
O23 - Service: @%SystemRoot%\System32\SgrmBroker.exe,-100 (SgrmBroker) - Unknown owner - C:\Windows\system32\SgrmBroker.exe (file missing)
O23 - Service: @firewallapi.dll,-50323 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spectrum.exe,-101 (spectrum) - Unknown owner - C:\Windows\system32\spectrum.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\TieringEngineService.exe,-702 (TieringEngineService) - Unknown owner - C:\Windows\system32\TieringEngineService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: vgc - Riot Games, Inc. - C:\Program Files\Riot Vanguard\vgc.exe
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 11885 bytes

[Reklama]

[extrem]

# -------------------------------
# Malwarebytes AdwCleaner 8.3.2.0
# -------------------------------
# Build: 03-23-2022
# Database: 2022-10-10.1 (Cloud)
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Scan
# -------------------------------
# Start: 10-24-2022
# Duration: 00:00:07
# OS: Windows 10 Home
# Scanned: 32100
# Detected: 5


***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

PUP.Optional.WebCompanion C:\ProgramData\Application Data\Lavasoft\Web Companion

***** [ Files ] *****

No malicious files found.

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

No malicious tasks found.

***** [ Registry ] *****

PUP.Optional.Legacy HKCU\Software\Microsoft\Windows\CurrentVersion\Run|Web Companion
PUP.Optional.WebCompanion HKCU\Software\Lavasoft\Web Companion
PUP.Optional.WebCompanion HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\webcompanion.com
PUP.Optional.WebCompanion HKLM\Software\Wow6432Node\Lavasoft\Web Companion

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries found.

***** [ Chromium URLs ] *****

No malicious Chromium URLs found.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries found.

***** [ Firefox URLs ] *****

No malicious Firefox URLs found.

***** [ Hosts File Entries ] *****

No malicious hosts file entries found.

***** [ Preinstalled Software ] *****

No Preinstalled Software found.



########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S00].txt ##########

[extrem]

Malwarebytes
www.malwarebytes.com

-Podrobnosti logovacího souboru-
Datum skenování: 24.10.22
Čas skenování: 11:39
Logovací soubor: cf519f82-537f-11ed-bddd-a8a159116b5b.json

-Informace o softwaru-
Verze: 4.5.16.217
Verze komponentů: 1.0.1792
Aktualizovat verzi balíku komponent: 1.0.61475
Licence: Zkušební

-Systémová informace-
OS: Windows 10 (Build 19044.2130)
CPU: x64
Systém souborů: NTFS
Uživatel: DESKTOP-4R9VPOS\Roman

-Shrnutí skenování-
Typ skenování: Skenování hrozeb (Threat Scan)
Spuštění skenování: Ruční
Výsledek: Dokončeno
Skenované objekty: 318811
Zjištěné hrozby: 0
Hrozby umístěné do karantény: 0
Uplynulý čas: 3 min, 32 sek

-Možnosti skenování-
Paměť: Povoleno
Start: Povoleno
Systém souborů: Povoleno
Archivy: Povoleno
Rootkity: Zakázáno
Heuristika: Povoleno
Potenciálně nežádoucí program: Detekovat
Potenciálně nežádoucí modifikace: Detekovat

-Podrobnosti skenování-
Proces: 0
(Nebyly zjištěny žádné škodlivé položky)

Modul: 0
(Nebyly zjištěny žádné škodlivé položky)

Klíč registru: 0
(Nebyly zjištěny žádné škodlivé položky)

Hodnota v registru: 0
(Nebyly zjištěny žádné škodlivé položky)

Data registrů: 0
(Nebyly zjištěny žádné škodlivé položky)

Datové proudy: 0
(Nebyly zjištěny žádné škodlivé položky)

Adresář: 0
(Nebyly zjištěny žádné škodlivé položky)

Soubor: 0
(Nebyly zjištěny žádné škodlivé položky)

Fyzický sektor: 0
(Nebyly zjištěny žádné škodlivé položky)

WMI: 0
(Nebyly zjištěny žádné škodlivé položky)


(end)

[jaro3]

Odinstaluj:
Lavasoft\Web Companion

Spusť znovu AdwCleaner (u Windows Vista či Windows7, klikni na AdwCleaner pravým a vyber „Spustit jako správce“
klikni na „Skenování“ , po prohledání klikni na „ do karantény“

Program provede opravu, po automatickém restartu klikni na Zobrazit logovací soubor“ a pak poklepej na odpovídají log, (C:\AdwCleaner [C?].txt) , jeho obsah sem celý vlož.

Stáhni si Junkware Removal Tool by Thisisu
http://www.bleepingcomputer.com/downloa ... oval-tool/
https://downloads.malwarebytes.com/file/JRT-EOL
na svojí plochu.

Deaktivuj si svůj antivirový program. Pravým tl. myši klikni na JRT.exe a vyber „spustit jako správce“. Pro pokračování budeš vyzván ke stisknutí jakékoliv klávesy. Na nějakou klikni.
Začne skenování programu. Skenování může trvat dlouho , podle množství nákaz. Po ukončení skenu se objeví log (JRT.txt) , který se uloží na ploše.
Zkopíruj sem prosím celý jeho obsah.


Stáhni si RogueKiller by Adlice Software
http://www.adlice.com/download/roguekiller/
http://www.bleepingcomputer.com/download/roguekiller/
na svojí plochu.
- Zavři všechny ostatní programy a prohlížeče.
- - klikni na „Scan“. V novém okně nic neměň a klikni dole na „Start“ ve sloupci „Quick Scan“
- Program skenuje procesy PC. Po proskenování klikni na „Results “ , v dalším okně pak levým t. na „Export“ a vyber : „Text File“ , log nazvi třeb RK a ulož do dokumentů nebo na plochu. Otevři soubor a celý obsah logu sem zkopíruj.
Pokud je program blokován , zkus ho spustit několikrát. Pokud dále program nepůjde spustit a pracovat, přejmenuj ho na winlogon.exe.
-pokud bude mít log více než 60.000 znaků , rozděl ho a vlož do více příspěvků

[extrem]

Lavasoft se mi nedaří odinstalovat. Windows ani Revo uninstaller ho nevidí.
# -------------------------------
# Malwarebytes AdwCleaner 8.3.2.0
# -------------------------------
# Build: 03-23-2022
# Database: 2022-10-10.1 (Cloud)
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start: 10-24-2022
# Duration: 00:00:00
# OS: Windows 10 Home
# Cleaned: 4
# Failed: 0


***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

No malicious folders cleaned.

***** [ Files ] *****

No malicious files cleaned.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

Deleted HKCU\Software\Lavasoft\Web Companion
Deleted HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\webcompanion.com
Deleted HKCU\Software\Microsoft\Windows\CurrentVersion\Run|Web Companion
Deleted HKLM\Software\Wow6432Node\Lavasoft\Web Companion

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

No malicious Chromium URLs cleaned.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.

***** [ Hosts File Entries ] *****

No malicious hosts file entries cleaned.

***** [ Preinstalled Software ] *****

No Preinstalled Software cleaned.


*************************

[+] Delete Tracing Keys
[+] Reset Winsock

*************************

AdwCleaner[S00].txt - [1808 octets] - [24/10/2022 11:35:11]
AdwCleaner[S01].txt - [1810 octets] - [24/10/2022 16:21:50]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C01].txt ##########

[extrem]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.4 (07.09.2017)
Operating System: Windows 10 Home x64
Ran by Roman (Administrator) on 24.10.2022 at 16:24:27,16
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 0




Registry: 3

Successfully deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\GoogleChromeAutoLaunch_18A1594E0F7F3FF02E74E666D5F77580 (Registry Value)
Successfully deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} (Registry Key)
Successfully deleted: HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} (Registry Key)




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 24.10.2022 at 16:27:21,49
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[extrem]

Program : RogueKiller Anti-Malware
Version : 15.6.2.0
x64 : Yes
Program Date : Oct 10 2022
Location : C:\Program Files\RogueKiller\RogueKiller64.exe
Premium : No
Company : Adlice Software
Website : https://www.adlice.com/
Contact : https://adlice.com/contact/
Website : https://adlice.com/download/roguekiller/
Operating System : Windows 10 (10.0.19044) 64-bit
64-bit OS : Yes
Startup : 0
WindowsPE : No
User : Roman
User is Admin : Yes
Date : 2022/10/24 14:30:13
Type : Scan
Aborted : No
Scan Mode : Quick
Duration : 9
Found items : 0
Total scanned : 970
Signatures Version : 20221024_084649
Truesight Driver : Yes
Updates Count : 0
Arguments : -minimize

************************* Warnings *************************

************************* Processes *************************

************************* Modules *************************

************************* Services *************************

************************* Scheduled Tasks *************************

************************* Registry *************************

************************* WMI *************************

************************* Hosts File *************************
is_too_big : No
hosts_file_path : N/A


************************* Filesystem *************************

************************* Web Browsers *************************

************************* Antirootkit *************************

[jaro3]

No on tam možná jen Web Companion , nějaké složky mohou být i v Program data , program files ( Lavasoft).

Vypni antivir i firewall, RogueKiller, Malwarebytes Antimalware, windowsDefender
Stáhni zoek:
https://uloz.to/file/nFH1LwSrGioP/zoek1-rar

Zavři všechny ostatní programy , okna i prohlížeče.
Spusť Zoek.exe ( u win vista , win7, 8 klikni na něj pravým a vyber : „Spustit jako správce“
-pozor , náběh programu může trvat déle.
Do okna programu vlož skript níže:

Kód: Vybrat vše

autoclean;
resethosts;
emptyclsid;
IEdefaults;
FFdefaults;
CHRdefaults;
emptyIEcache;
emptyFFcache;
emptyCHRcache;
emptyalltemp;
emptyflash;
emptyjava;
emptyrecycle.bin;

klikni na Run Script
Program provede sken , opravu, sken i oprava může trvat i více minut ,je třeba posečkat do konce. Do okna neklikej!
Program nabídne restart , potvrď .
Po restartu se může nějaký čas ukázat pouze černá plocha , to je normální. Je třeba počkat až se vytvoří log. Ten si můžeš uložit třeba do dokumentů , jinak se sám ukládá do:
C:\zoek-results.log Zkopíruj sem celý obsah toho logu.
Pokud budou problémy , spusť zoek v nouz. režimu.


Stáhni si Zemana AntiMalware Free z tohoto odkazu:
https://www.zemana.com/Download/AntiMal ... .Setup.exe

(posuvník dolu na download)
a ulož si ho na plochu.
Poklepej na tento soubor na ploše a postupuj podle pokynů k instalaci programu.
Přijmi licenci k používání programu EULA , pokud se nabídne.
Pokud je k dispozici aktualizace programu , klepni na tlačítko „Update now“ ( aktualizovat nyní).
Zavři všechny otevřené soubory, složky a prohlížeče
Neměň žádné nastavení. Klikni na „Skenovat nyní“.
Po skenu lze vidět , zda jsou nějaké nákazy. Klikni na „Vykonat“ ( vymazat). Nákazy budou přemístěny do karantény.
Když je skenování dokončeno, klikni vlevo na „zprávy“ a pak na „otevři zprávu“ a zkopíruj sem celý obsah té zprávy.

Vlož nový log z HJT + informuj o problémech

[extrem]

Zoek.exe v5.0.0.2 Updated 03-May-2018(Online Version)
Tool run by Roman on 24.10.2022 at 19:30:34,46.
Microsoft Windows 10 Home 10.0.19044 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Roman\Desktop\zoek (1).exe [Scan all users] [Script inserted]

==== System Restore Info ======================

24.10.2022 19:32:44 Zoek.exe System Restore Point Created Successfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
127.0.0.1 localhost
::1 localhost

==== Empty Folders Check ======================

C:\PROGRA~2\Origin Games deleted successfully
C:\PROGRA~3\Application Data deleted successfully
C:\PROGRA~3\CanonIJPLM deleted successfully
C:\PROGRA~3\WarThunder deleted successfully
C:\Users\Roman\AppData\Roaming\Opera Software deleted successfully
C:\Users\Roman\AppData\Roaming\Wargaming.net deleted successfully
C:\Users\Roman\AppData\Local\DBG deleted successfully
C:\Users\Roman\AppData\Local\Opera Software deleted successfully

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== Deleting Files \ Folders ======================

C:\PROGRA~2\Origin Games not found
C:\Users\Roman\AppData\Roaming\discord deleted
C:\Users\Roman\AppData\Roaming\mobalytics-desktop deleted
C:\SteamMover.exe deleted
C:\PROGRA~3\Propagation deleted
C:\PROGRA~3\Package Cache deleted
C:\Users\Roman\AppData\Local\cache deleted
C:\Users\Roman\AppData\Local\CrashRpt deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be514a.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-11fc-8c8-9871b0.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-11fc-8c8-9871e0.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-11fc-8c8-9871f2.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-11fc-8c8-987213.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-11fc-8c8-987215.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-11fc-8c8-987227.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-11fc-8c8-987229.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-11fc-8c8-98724a.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-11fc-8c8-98726b.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-11fc-8c8-98728d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-11fc-8c8-98729e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-11fc-8c8-9872b0.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-11fc-8c8-9872d1.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-11fc-8c8-9872f2.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-11fc-8c8-987314.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-11fc-8c8-987345.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-11fc-8c8-987347.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-11fc-8c8-987349.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-11fc-8c8-98735a.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12ec-20e0-18334d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12ec-20e0-18334f.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12ec-20e0-183361.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12ec-20e0-183382.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12ec-20e0-183394.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12ec-20e0-183396.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12ec-20e0-183398.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12ec-20e0-1833aa.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12ec-20e0-1833ac.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12ec-20e0-1833ae.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12ec-20e0-1833bf.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12ec-20e0-1833c1.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12ec-20e0-1833c3.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12ec-20e0-1833d5.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12ec-20e0-1833d7.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12ec-20e0-1833d9.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12ec-20e0-1833ea.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12ec-20e0-1833ec.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12ec-20e0-1833fe.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12f8-18dc-224195.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12f8-18dc-224197.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12f8-18dc-2241b8.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12f8-18dc-2241da.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12f8-18dc-2241fb.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12f8-18dc-22421c.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12f8-18dc-22421e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12f8-18dc-22425f.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12f8-18dc-22428f.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12f8-18dc-2242a1.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12f8-18dc-2242b3.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12f8-18dc-2242e4.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12f8-18dc-224305.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12f8-18dc-224316.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12f8-18dc-224338.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12f8-18dc-224349.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12f8-18dc-22435b.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12f8-18dc-22436d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-12f8-18dc-22438e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1568-1ccc-34c7e4.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1568-1ccc-34c825.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1568-1ccc-34c836.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1568-1ccc-34c887.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1568-1ccc-34c8b7.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1568-1ccc-34c8f8.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1568-1ccc-34c938.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1568-1ccc-34c95a.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1568-1ccc-34c98b.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1568-1ccc-34c9fa.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1568-1ccc-34ca0c.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1568-1ccc-34ca1d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1568-1ccc-34ca4e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1568-1ccc-34ca6f.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1568-1ccc-34ca81.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1568-1ccc-34ca93.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1568-1ccc-34caa4.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1568-1ccc-34cad5.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1568-1ccc-34caf6.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19bc-618-435e06.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19bc-618-435e46.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19bc-618-435e96.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19bc-618-435eb8.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19bc-618-435ed9.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19bc-618-435f0a.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19bc-618-435f2b.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19bc-618-435f6c.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19bc-618-435f8d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19bc-618-435fcd.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19bc-618-435fef.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19bc-618-43601f.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19bc-618-436031.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19bc-618-436062.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19bc-618-436074.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19bc-618-4360c4.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19bc-618-436114.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19bc-618-436145.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19bc-618-436166.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19e4-490c-1fd3b2.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19e4-490c-1fd3c4.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19e4-490c-1fd3c6.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19e4-490c-1fd3e7.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19e4-490c-1fd3e9.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19e4-490c-1fd3eb.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19e4-490c-1fd3fc.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19e4-490c-1fd3fe.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19e4-490c-1fd400.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19e4-490c-1fd412.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19e4-490c-1fd414.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19e4-490c-1fd426.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19e4-490c-1fd428.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19e4-490c-1fd42a.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19e4-490c-1fd43b.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19e4-490c-1fd43d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19e4-490c-1fd44f.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19e4-490c-1fd451.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-19e4-490c-1fd453.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1b78-47a8-490eb0.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1b78-47a8-490f1f.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1b78-47a8-490f7f.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1b78-47a8-490f91.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1b78-47a8-490fb2.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1b78-47a8-490ff3.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1b78-47a8-491014.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1b78-47a8-491054.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1b78-47a8-491085.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1b78-47a8-4911c0.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1b78-47a8-491200.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1b78-47a8-491202.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1b78-47a8-491214.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1b78-47a8-491216.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1b78-47a8-491227.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1b78-47a8-491268.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1b78-47a8-491289.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1b78-47a8-4912aa.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1b78-47a8-4912bc.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1d1c-34fc-9fd4ec.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1d1c-34fc-9fd5b9.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1d1c-34fc-9fd609.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1d1c-34fc-9fd6e6.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1d1c-34fc-9fd746.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1d1c-34fc-9fd776.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1d1c-34fc-9fd824.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1d1c-34fc-9fd855.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1d1c-34fc-9fd8e4.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1d1c-34fc-9fd953.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1d1c-34fc-9fd984.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1d1c-34fc-9fd9d4.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1d1c-34fc-9fd9f5.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1d1c-34fc-9fda65.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1d1c-34fc-9fda86.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1d1c-34fc-9fdaa7.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1d1c-34fc-9fdb26.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1d1c-34fc-9fdb76.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1d1c-34fc-9fdc24.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1dd0-3328-95a83f.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1dd0-3328-95a860.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1dd0-3328-95a862.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1dd0-3328-95a874.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1dd0-3328-95a876.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1dd0-3328-95a887.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1dd0-3328-95a899.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1dd0-3328-95a8ab.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1dd0-3328-95a8bc.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1dd0-3328-95a8ce.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1dd0-3328-95a8e0.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1dd0-3328-95a901.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1dd0-3328-95a922.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1dd0-3328-95a943.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1dd0-3328-95a965.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1dd0-3328-95a976.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1dd0-3328-95a978.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1dd0-3328-95a98a.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1dd0-3328-95a98c.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1e18-844-3c1a0a0.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1e18-844-3c1a0b2.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1e18-844-3c1a0d3.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1e18-844-3c1a0f4.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1e18-844-3c1a106.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1e18-844-3c1a108.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1e18-844-3c1a129.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1e18-844-3c1a12b.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1e18-844-3c1a13d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1e18-844-3c1a14e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1e18-844-3c1a150.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1e18-844-3c1a162.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1e18-844-3c1a164.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1e18-844-3c1a176.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1e18-844-3c1a178.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1e18-844-3c1a189.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1e18-844-3c1a18b.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1e18-844-3c1a18d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1e18-844-3c1a1af.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1fb4-37d8-97fc1.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1fb4-37d8-97fc3.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1fb4-37d8-97fd4.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1fb4-37d8-97fd6.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1fb4-37d8-97fe8.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1fb4-37d8-97fea.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1fb4-37d8-97fec.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1fb4-37d8-97ffe.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1fb4-37d8-98000.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1fb4-37d8-98002.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1fb4-37d8-98013.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1fb4-37d8-98015.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1fb4-37d8-98017.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1fb4-37d8-98029.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1fb4-37d8-9802b.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1fb4-37d8-9802d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1fb4-37d8-9803e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1fb4-37d8-98040.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-1fb4-37d8-98042.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2018-1c58-18e43e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2018-1c58-18e450.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2018-1c58-18e462.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2018-1c58-18e56d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2018-1c58-18e58e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2018-1c58-18e5a0.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2018-1c58-18e5f0.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2018-1c58-18e611.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2018-1c58-18e613.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2018-1c58-18e635.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2018-1c58-18e666.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2018-1c58-18e668.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2018-1c58-18e698.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2018-1c58-18e6aa.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2018-1c58-18e70a.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2018-1c58-18e72b.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2018-1c58-18e73d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2018-1c58-18e76e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2018-1c58-18e7dd.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2090-13ac-3fb224.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2090-13ac-3fb226.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2090-13ac-3fb238.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2090-13ac-3fb24a.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2090-13ac-3fb26b.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2090-13ac-3fb28c.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2090-13ac-3fb29e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2090-13ac-3fb2a0.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2090-13ac-3fb2a2.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2090-13ac-3fb2b3.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2090-13ac-3fb2c5.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2090-13ac-3fb2c7.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2090-13ac-3fb2c9.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2090-13ac-3fb2cb.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2090-13ac-3fb2dd.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2090-13ac-3fb2df.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2090-13ac-3fb2f0.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2090-13ac-3fb2f2.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2090-13ac-3fb2f4.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-22c-1cf0-992698.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-22c-1cf0-9926b9.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-22c-1cf0-9926bb.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-22c-1cf0-9926bd.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-22c-1cf0-9926cf.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-22c-1cf0-9926d1.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-22c-1cf0-9926e3.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-22c-1cf0-9926e5.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-22c-1cf0-9926e7.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-22c-1cf0-9926f8.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-22c-1cf0-9926fa.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-22c-1cf0-9926fc.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-22c-1cf0-99270e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-22c-1cf0-992710.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-22c-1cf0-992721.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-22c-1cf0-992723.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-22c-1cf0-992725.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-22c-1cf0-992737.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-22c-1cf0-992739.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2428-e9c-32bd11.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2428-e9c-32bd22.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2428-e9c-32bd24.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2428-e9c-32bd36.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2428-e9c-32bd38.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2428-e9c-32bd59.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2428-e9c-32bd7a.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2428-e9c-32bd8c.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2428-e9c-32bd8e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2428-e9c-32bda0.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2428-e9c-32bdb1.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2428-e9c-32bdb3.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2428-e9c-32bdc5.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2428-e9c-32bdd6.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2428-e9c-32bdd8.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2428-e9c-32bdea.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2428-e9c-32bdec.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2428-e9c-32bdfe.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2428-e9c-32be1f.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2458-3298-1b5d9b.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2458-3298-1b5dad.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2458-3298-1b5daf.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2458-3298-1b5db1.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2458-3298-1b5dc2.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2458-3298-1b5dc4.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2458-3298-1b5dc6.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2458-3298-1b5df7.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2458-3298-1b5df9.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2458-3298-1b5e1a.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2458-3298-1b5e1c.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2458-3298-1b5e2e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2458-3298-1b5e40.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2458-3298-1b5e42.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2458-3298-1b5e53.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2458-3298-1b5e55.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2458-3298-1b5e67.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2458-3298-1b5e69.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2458-3298-1b5e7a.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2710-ed4-6d27f6.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2710-ed4-6d2807.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2710-ed4-6d2819.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2710-ed4-6d282b.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2710-ed4-6d282d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2710-ed4-6d283e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2710-ed4-6d2840.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2710-ed4-6d2852.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2710-ed4-6d2863.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2710-ed4-6d2885.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2710-ed4-6d28a6.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2710-ed4-6d28c7.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2710-ed4-6d28e8.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2710-ed4-6d290a.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2710-ed4-6d291b.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2710-ed4-6d293d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2710-ed4-6d294e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2710-ed4-6d2960.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2710-ed4-6d2981.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2764-2838-9b112.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2764-2838-9b123.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2764-2838-9b125.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2764-2838-9b137.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2764-2838-9b139.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2764-2838-9b14b.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2764-2838-9b14d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2764-2838-9b14f.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2764-2838-9b160.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2764-2838-9b162.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2764-2838-9b164.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2764-2838-9b176.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2764-2838-9b178.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2764-2838-9b189.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2764-2838-9b18b.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2764-2838-9b18d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2764-2838-9b19f.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2764-2838-9b1a1.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2764-2838-9b1a3.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-297c-3fec-a12ea0.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-297c-3fec-a12ec1.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-297c-3fec-a12f21.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-297c-3fec-a12f52.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-297c-3fec-a12f63.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-297c-3fec-a12fb3.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-297c-3fec-a13004.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-297c-3fec-a13015.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-297c-3fec-a13036.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-297c-3fec-a13038.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-297c-3fec-a1305a.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-297c-3fec-a1306b.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-297c-3fec-a1307d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-297c-3fec-a130dd.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-297c-3fec-a130fe.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-297c-3fec-a1311f.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-297c-3fec-a13131.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-297c-3fec-a13142.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-297c-3fec-a13183.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2ba8-114-1a4054.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2ba8-114-1a4085.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2ba8-114-1a40b5.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2ba8-114-1a40d7.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2ba8-114-1a40f8.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2ba8-114-1a4119.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2ba8-114-1a411b.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2ba8-114-1a412d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2ba8-114-1a413e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2ba8-114-1a4140.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2ba8-114-1a4152.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2ba8-114-1a4154.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2ba8-114-1a4175.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2ba8-114-1a4187.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2ba8-114-1a4199.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2ba8-114-1a41ba.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2ba8-114-1a41bc.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2ba8-114-1a422b.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2ba8-114-1a427b.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2cfc-3708-45010bd.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2cfc-3708-45010ee.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2cfc-3708-450112e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2cfc-3708-450114f.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2cfc-3708-4501180.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2cfc-3708-4501192.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2cfc-3708-45011b3.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2cfc-3708-45011e4.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2cfc-3708-4501205.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2cfc-3708-4501265.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2cfc-3708-4501342.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2cfc-3708-45013c1.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2cfc-3708-45013d2.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2cfc-3708-4501413.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2cfc-3708-4501463.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2cfc-3708-4501484.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2cfc-3708-4501496.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2cfc-3708-45014f6.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2cfc-3708-4501517.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2e70-714-217d1c.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2e70-714-217d3d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2e70-714-217d4f.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2e70-714-217d70.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2e70-714-217d92.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2e70-714-217db3.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2e70-714-217dc4.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2e70-714-217dd6.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2e70-714-217de8.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2e70-714-217dea.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2e70-714-217e0b.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2e70-714-217e2c.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2e70-714-217e4d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2e70-714-217e5f.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2e70-714-217e80.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2e70-714-217ea2.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2e70-714-217eb3.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2e70-714-217ed4.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-2e70-714-217ee6.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3170-37d4-9d0de.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3170-37d4-9d12e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3170-37d4-9d130.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3170-37d4-9d152.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3170-37d4-9d163.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3170-37d4-9d185.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3170-37d4-9d196.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3170-37d4-9d1c7.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3170-37d4-9d1d9.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3170-37d4-9d229.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3170-37d4-9d23a.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3170-37d4-9d26b.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3170-37d4-9d2ac.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3170-37d4-9d2bd.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3170-37d4-9d2df.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3170-37d4-9d310.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3170-37d4-9d350.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3170-37d4-9d371.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3170-37d4-9d393.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-31e0-3b44-6e70f0.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-31e0-3b44-6e7112.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-31e0-3b44-6e7143.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-31e0-3b44-6e7154.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-31e0-3b44-6e7185.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-31e0-3b44-6e71b6.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-31e0-3b44-6e71e7.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-31e0-3b44-6e71e9.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-31e0-3b44-6e721a.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-31e0-3b44-6e721c.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-31e0-3b44-6e725c.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-31e0-3b44-6e726e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-31e0-3b44-6e7270.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-31e0-3b44-6e72a1.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-31e0-3b44-6e72a3.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-31e0-3b44-6e72c4.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-31e0-3b44-6e72c6.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-31e0-3b44-6e72d8.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-31e0-3b44-6e72da.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3220-1c84-2ea516d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3220-1c84-2ea519d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3220-1c84-2ea51bf.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3220-1c84-2ea51f0.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3220-1c84-2ea5230.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3220-1c84-2ea5280.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3220-1c84-2ea5292.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3220-1c84-2ea52a3.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3220-1c84-2ea52e4.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3220-1c84-2ea52e6.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3220-1c84-2ea5307.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3220-1c84-2ea5328.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3220-1c84-2ea5359.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3220-1c84-2ea537b.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3220-1c84-2ea53fa.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3220-1c84-2ea53fc.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3220-1c84-2ea545b.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3220-1c84-2ea545d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3220-1c84-2ea547f.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3610-360c-6ab57f.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3610-360c-6ab590.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3610-360c-6ab592.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3610-360c-6ab594.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3610-360c-6ab5a6.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3610-360c-6ab5b8.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3610-360c-6ab5d9.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3610-360c-6ab5ea.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3610-360c-6ab5fc.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3610-360c-6ab60e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3610-360c-6ab610.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3610-360c-6ab621.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3610-360c-6ab643.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3610-360c-6ab654.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3610-360c-6ab666.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3610-360c-6ab677.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3610-360c-6ab699.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3610-360c-6ab6aa.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3610-360c-6ab6bc.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-36c4-3018-7a9873.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-36c4-3018-7a98e3.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-36c4-3018-7a98f4.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-36c4-3018-7a9906.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-36c4-3018-7a9918.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-36c4-3018-7a991a.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-36c4-3018-7a992b.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-36c4-3018-7a993d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-36c4-3018-7a995e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-36c4-3018-7a9970.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-36c4-3018-7a99cf.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-36c4-3018-7a99e1.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-36c4-3018-7a9a02.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-36c4-3018-7a9a14.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-36c4-3018-7a9a26.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-36c4-3018-7a9a28.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-36c4-3018-7a9a39.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-36c4-3018-7a9a5a.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-36c4-3018-7a9a6c.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be4f4c.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be4f4e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be4f60.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be4f71.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be4f73.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be4f85.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be4f87.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be4f89.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be4f9b.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be4f9d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be4fbe.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be4fc0.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be4fc2.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be4fd4.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be4fd6.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be4fe7.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be4fe9.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be4ffb.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be4ffd.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be500e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be5020.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be5022.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be5034.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be5036.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be5038.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be503a.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be504b.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be504d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be505f.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be5071.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be5082.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be50a3.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be50b5.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be50c7.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be50d8.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3c60-3b2c-be50ea.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3da0-2a30-164cbb.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3da0-2a30-164ccd.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3da0-2a30-164ccf.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3da0-2a30-164ce0.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3da0-2a30-164ce2.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3da0-2a30-164cf4.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3da0-2a30-164d05.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3da0-2a30-164d36.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3da0-2a30-164d67.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3da0-2a30-164d69.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3da0-2a30-164d8a.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3da0-2a30-164d8c.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3da0-2a30-164d8e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3da0-2a30-164da0.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3da0-2a30-164da2.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3da0-2a30-164db4.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3da0-2a30-164db6.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3da0-2a30-164dc7.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3da0-2a30-164dc9.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3efc-73c-4b665c.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3efc-73c-4b666d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3efc-73c-4b666f.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3efc-73c-4b6681.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3efc-73c-4b6683.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3efc-73c-4b6685.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3efc-73c-4b6697.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3efc-73c-4b6699.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3efc-73c-4b66aa.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3efc-73c-4b66ac.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3efc-73c-4b66be.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3efc-73c-4b66c0.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3efc-73c-4b66c2.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3efc-73c-4b66d3.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3efc-73c-4b66d5.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3efc-73c-4b66e7.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3efc-73c-4b66e9.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3efc-73c-4b66eb.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-3efc-73c-4b66fd.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4118-243c-2d72fa8.tmp deleted

[extrem]

C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4118-243c-2d72fba.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4118-243c-2d72fcc.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4118-243c-2d72fce.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4118-243c-2d72fd0.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4118-243c-2d72fe1.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4118-243c-2d72ff3.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4118-243c-2d73005.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4118-243c-2d73007.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4118-243c-2d73009.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4118-243c-2d7301a.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4118-243c-2d7301c.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4118-243c-2d7302e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4118-243c-2d7303f.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4118-243c-2d73061.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4118-243c-2d73082.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4118-243c-2d730a3.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4118-243c-2d730d4.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4118-243c-2d730d6.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4288-d8c-24c3bc.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4288-d8c-24c3ed.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4288-d8c-24c3fe.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4288-d8c-24c410.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4288-d8c-24c49e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4288-d8c-24c4df.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4288-d8c-24c4f1.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4288-d8c-24c59e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4288-d8c-24c5cf.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4288-d8c-24c5e1.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4288-d8c-24c70c.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4288-d8c-24c79a.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4288-d8c-24c7eb.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4288-d8c-24c7fc.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4288-d8c-24c81d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4288-d8c-24c83f.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4288-d8c-24c860.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4288-d8c-24c872.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4288-d8c-24c883.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4430-2a14-33069d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4430-2a14-3306ae.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4430-2a14-3306d0.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4430-2a14-3306d2.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4430-2a14-3306e3.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4430-2a14-3306f5.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4430-2a14-330706.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4430-2a14-330728.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4430-2a14-330749.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4430-2a14-33076a.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4430-2a14-33077c.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4430-2a14-33077e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4430-2a14-33078f.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4430-2a14-3307a1.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4430-2a14-3307c2.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4430-2a14-3307e4.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4430-2a14-330814.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4430-2a14-330836.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4430-2a14-330857.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7d74.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7d76.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7d78.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7d8a.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7d8c.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7d9d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7d9f.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7da1.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7db3.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7dc5.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7dc7.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7dc9.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7dea.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7dec.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7dfd.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7dff.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7e11.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7e13.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7e25.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7e27.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7e38.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7e3a.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7e4c.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7e5e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7e6f.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7e71.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7e83.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7e85.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7e96.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7e98.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7eaa.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7eac.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7ebe.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7ec0.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7ed1.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7ed3.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7f33.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7f35.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7f56.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7f78.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7f89.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7f9b.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7f9d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7f9f.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7fb0.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7fb2.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7fc4.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7fc6.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7fd8.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7fda.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7fdc.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7fed.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7fef.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba7ff1.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba8003.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba8005.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-47fc-cb0-ba8017.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4bb4-2690-847b27.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4bb4-2690-847b48.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4bb4-2690-847b5a.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4bb4-2690-847b7b.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4bb4-2690-847b9c.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4bb4-2690-847bbd.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4bb4-2690-847bcf.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4bb4-2690-847be1.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4bb4-2690-847bf2.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4bb4-2690-847c04.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4bb4-2690-847c15.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4bb4-2690-847c37.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4bb4-2690-847c48.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4bb4-2690-847c98.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4bb4-2690-847d46.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4bb4-2690-847d48.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4bb4-2690-847d6a.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4bb4-2690-847d8b.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-4bb4-2690-847d8d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-500-37c4-55c9b9.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-500-37c4-55c9da.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-500-37c4-55ca0b.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-500-37c4-55ca1c.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-500-37c4-55ca2e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-500-37c4-55ca9d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-500-37c4-55caaf.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-500-37c4-55cad0.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-500-37c4-55cae2.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-500-37c4-55caf3.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-500-37c4-55cb15.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-500-37c4-55cb65.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-500-37c4-55cb67.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-500-37c4-55cb88.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-500-37c4-55cb9a.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-500-37c4-55cbf9.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-500-37c4-55cc3a.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-500-37c4-55cc7a.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-500-37c4-55cc9c.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-748-3328-72a377.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-748-3328-72a388.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-748-3328-72a39a.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-748-3328-72a3bb.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-748-3328-72a3dc.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-748-3328-72a3de.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-748-3328-72a3f0.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-748-3328-72a402.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-748-3328-72a404.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-748-3328-72a415.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-748-3328-72a417.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-748-3328-72a419.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-748-3328-72a42b.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-748-3328-72a42d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-748-3328-72a43e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-748-3328-72a440.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-748-3328-72a462.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-748-3328-72a473.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-748-3328-72a475.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-820-1330-e2d9a9.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-820-1330-e2d9ab.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-820-1330-e2d9cc.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-820-1330-e2d9de.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-820-1330-e2d9e0.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-820-1330-e2d9f1.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-820-1330-e2da03.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-820-1330-e2da24.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-820-1330-e2da36.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-820-1330-e2da38.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-820-1330-e2da49.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-820-1330-e2da4b.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-820-1330-e2da4d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-820-1330-e2da6f.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-820-1330-e2da90.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-820-1330-e2dab1.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-820-1330-e2dac3.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-820-1330-e2dac5.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-820-1330-e2dad6.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-994-e78-5ebf0e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-994-e78-5ebf7e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-994-e78-5ebfed.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-994-e78-5ec01e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-994-e78-5ec04f.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-994-e78-5ec070.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-994-e78-5ec0a1.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-994-e78-5ec0b3.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-994-e78-5ec0e3.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-994-e78-5ec124.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-994-e78-5ec155.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-994-e78-5ec166.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-994-e78-5ec1a7.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-994-e78-5ec1e7.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-994-e78-5ec1f9.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-994-e78-5ec20b.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-994-e78-5ec24b.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-994-e78-5ec25d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-994-e78-5ec27e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-db8-10b0-9634f.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-db8-10b0-96351.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-db8-10b0-96353.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-db8-10b0-96365.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-db8-10b0-96367.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-db8-10b0-96369.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-db8-10b0-9637b.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-db8-10b0-9637d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-db8-10b0-9638e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-db8-10b0-96390.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-db8-10b0-96392.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-db8-10b0-96394.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-db8-10b0-963a6.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-db8-10b0-963b8.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-db8-10b0-963ba.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-db8-10b0-963bc.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-db8-10b0-963be.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-db8-10b0-963cf.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-db8-10b0-963e1.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-f48-33c0-156067.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-f48-33c0-156079.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-f48-33c0-15608a.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-f48-33c0-15608c.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-f48-33c0-15608e.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-f48-33c0-1560a0.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-f48-33c0-1560a2.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-f48-33c0-1560a4.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-f48-33c0-1560b5.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-f48-33c0-1560b7.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-f48-33c0-1560d9.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-f48-33c0-1560ea.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-f48-33c0-1560ec.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-f48-33c0-1560ee.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-f48-33c0-156100.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-f48-33c0-156102.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-f48-33c0-156114.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-f48-33c0-156116.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-f48-33c0-156118.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-ff4-1d94-27cc2fa.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-ff4-1d94-27cc33a.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-ff4-1d94-27cc35c.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-ff4-1d94-27cc36d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-ff4-1d94-27cc37f.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-ff4-1d94-27cc391.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-ff4-1d94-27cc3b2.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-ff4-1d94-27cc3e3.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-ff4-1d94-27cc404.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-ff4-1d94-27cc416.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-ff4-1d94-27cc427.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-ff4-1d94-27cc439.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-ff4-1d94-27cc44a.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-ff4-1d94-27cc46c.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-ff4-1d94-27cc47d.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-ff4-1d94-27cc48f.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-ff4-1d94-27cc4b0.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-ff4-1d94-27cc4c2.tmp deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\tw-ff4-1d94-27cc4d3.tmp deleted
C:\PROGRA~3\FinalDeleteFile.exe deleted
"C:\DumpStack.log.tmp" not deleted
"C:\Users\Roman\AppData\Roaming\LGHUB\lockfile" not deleted
"C:\Users\Roman\AppData\Roaming\LGHUB\Local Storage\leveldb\000003.log" not deleted
"C:\Users\Roman\AppData\Roaming\LGHUB\Local Storage\leveldb\LOCK" not deleted
"C:\Users\Roman\AppData\Roaming\LGHUB\Local Storage\leveldb\LOG" not deleted
"C:\Users\Roman\AppData\Roaming\LGHUB\Local Storage\leveldb\MANIFEST-000001" not deleted
"C:\Users\Roman\AppData\Roaming\LGHUB" not deleted
"C:\Users\Roman\AppData\Roaming\LGHUB\Local Storage" not deleted
"C:\Users\Roman\AppData\Roaming\LGHUB\Local Storage\leveldb" not deleted

==== Orphaned Tasks deleted from Registry ======================

uTorrent_1 deleted

==== Chromium Look ======================

Google Chrome Version: 106.0.5249.119

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
makcojoppodhcgmmchohadhpkicoafka - No path found[]

Comodo Drag&Drop Service - Roman\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\aneodkojaglhnkkdbbdnmmmgimlcaogo
Comodo Media Downloader - Roman\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\dihmnpngfonlhjmgkflpnibiaaliendo
BTTV - Roman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajopnjidmegmdimjlfnijceegpefgped
7TV - Roman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ammjkodgmmoknidbanneddgankgfejfh
SIH - Roman\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmeakgjggjdlcpncigglobpjbkabhmjl
Downloader for OnlyFans.com - Roman\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdbbabjcnanbkimdgcdfbnghhmchomnh

==== Chromium Fix ======================

C:\Users\Roman\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdbbabjcnanbkimdgcdfbnghhmchomnh deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com/"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com/"

==== All HKLM and HKCU SearchScopes ======================

HKLM\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKLM\Wow6432Node\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\Wow6432Node\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKCU\SearchScopes "DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"
HKCU\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66} - http://www.google.com/search?q={searchTerms}
HKCU\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

==== Reset Google Chrome ======================

C:\Users\Roman\AppData\Local\Comodo\Dragon\User Data\Default\Preferences was reset successfully
C:\Users\Roman\AppData\Local\Comodo\Dragon\User Data\Default\Secure Preferences was reset successfully
C:\Users\Roman\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\Roman\AppData\Local\Google\Chrome\User Data\Default\Preferences.bak was reset successfully
C:\Users\Roman\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences was reset successfully
C:\Users\Roman\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences.bak was reset successfully
C:\Users\Roman\AppData\Local\Microsoft\Edge\User Data\Default\Preferences was reset successfully
C:\Users\Roman\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences was reset successfully
C:\Users\Roman\AppData\Local\Comodo\Dragon\User Data\Default\Web Data was reset successfully
C:\Users\Roman\AppData\Local\Comodo\Dragon\User Data\Default\Web Data-journal was reset successfully
C:\Users\Roman\AppData\Local\Google\Chrome\User Data\Default\Web Data will be reset at reboot
C:\Users\Roman\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal will be reset at reboot
C:\Users\Roman\AppData\Local\Microsoft\Edge\User Data\Default\Web Data will be reset at reboot
C:\Users\Roman\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal was reset successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Roman\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Roman\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Edge Cache ======================

Edge Cache Emptied Successfully

==== Empty Chrome Cache ======================

C:\Users\Roman\AppData\Local\Comodo\Dragon\User Data\Default\Cache emptied successfully
C:\Users\Roman\AppData\Local\Google\Chrome\User Data\Default\Cache will be emptied at reboot
C:\Users\Roman\AppData\Local\Microsoft\Edge\User Data\Default\Cache will be emptied at reboot

==== Empty All Flash Cache ======================

No Flash Cache Found

==== Empty All Java Cache ======================

No Java Cache Found

==== C:\zoek_backup content ======================

C:\zoek_backup (files=9159 folders=1014 1193960907 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\Roman\AppData\Local\Temp will be emptied at reboot
C:\Windows\SysNative\config\systemprofile\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\Roman\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\DumpStack.log.tmp" not deleted
"C:\Users\Roman\AppData\Roaming\LGHUB\lockfile" not found
"C:\Users\Roman\AppData\Roaming\LGHUB\Local Storage\leveldb\000003.log" not found
"C:\Users\Roman\AppData\Roaming\LGHUB\Local Storage\leveldb\LOCK" not found
"C:\Users\Roman\AppData\Roaming\LGHUB\Local Storage\leveldb\LOG" not found
"C:\Users\Roman\AppData\Roaming\LGHUB\Local Storage\leveldb\MANIFEST-000001" not found
"C:\Users\Roman\AppData\Local\Google\Chrome\User Data\Default\Web Data" not found
"C:\Users\Roman\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal" not found
"C:\Users\Roman\AppData\Local\Microsoft\Edge\User Data\Default\Web Data" not found
"C:\Users\Roman\AppData\Roaming\LGHUB" not found
"C:\Users\Roman\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data" deleted
"C:\Users\Roman\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data" deleted

==== EOF on 24.10.2022 at 19:56:43,72 ======================

[extrem]

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:02:30, on 24.10.2022
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.19041.1566)


Boot mode: Normal

Running processes:
C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe
C:\Program Files (x86)\Zemana\AntiMalware\AntiMalware.exe
C:\Windows\SysWOW64\DllHost.exe
C:\Users\Roman\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Lync Click to Call BHO - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll
O2 - BHO: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll
O3 - Toolbar: Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll
O4 - HKLM\..\Run: [CanonQuickMenu] C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE /logon
O4 - HKLM\..\Run: [IJNetworkScannerSelectorEX] C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe /FORCE
O4 - HKLM\..\Run: [TeamsMachineInstaller] %ProgramFiles%\Teams Installer\Teams.exe --checkInstall --source=PROPLUS
O4 - HKLM\..\Run: [Adobe CCXProcess] C:\Program Files (x86)\Adobe\Adobe Creative Cloud Experience\CCXProcess.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent
O4 - HKCU\..\Run: [SandboxieControl] "C:\Program Files\Sandboxie\SbieCtrl.exe"
O4 - HKCU\..\Run: [LGHUB] "C:\Program Files\LGHUB\lghub.exe" --background
O4 - HKCU\..\Run: [MobalyticsHQ.DesktopApp] "C:\Users\Roman\AppData\Local\Programs\mobalytics-desktop\Mobalytics Desktop.exe"
O4 - HKCU\..\Run: [electron.app.Mobalytics Desktop] "C:\Users\Roman\AppData\Local\Programs\mobalytics-desktop\Mobalytics Desktop.exe"
O4 - HKCU\..\Run: [MicrosoftEdgeAutoLaunch_66D161819F0EAC1A9819F518A968ED0B] "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
O4 - HKCU\..\Run: [GoogleChromeAutoLaunch_18A1594E0F7F3FF02E74E666D5F77580] "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --no-startup-window /prefetch:5
O4 - HKUS\S-1-5-19\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\Program Files\Microsoft Office\root\Office16\ONBttnIE.dll/105
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\ONBttnIE.dll
O9 - Extra button: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll
O9 - Extra 'Tools' menuitem: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL
O18 - Protocol: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL
O18 - Protocol: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL
O18 - Protocol: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL
O18 - Protocol: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Protocol: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Filter hijack: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLMF.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD Crash Defender Service - Unknown owner - C:\Windows\System32\amdfendrsr.exe (file missing)
O23 - Service: AMD External Events Utility - AMD - C:\Windows\System32\DriverStore\FileRepository\u0384626.inf_amd64_709232910597852f\B384589\atiesrxx.exe
O23 - Service: AudioDeviceService - Unknown owner - C:\Windows\system32\AudioDeviceService.exe (file missing)
O23 - Service: BattlEye Service (BEService) - Unknown owner - C:\Program Files (x86)\Common Files\BattlEye\BEService.exe
O23 - Service: @%SystemRoot%\system32\CredentialEnrollmentManager.exe,-100 (CredentialEnrollmentManagerUserSvc) - Unknown owner - C:\Windows\system32\CredentialEnrollmentManager.exe (file missing)
O23 - Service: CredentialEnrollmentManagerUserSvc_74a8b - Unknown owner - C:\Windows\system32\CredentialEnrollmentManager.exe (file missing)
O23 - Service: @%SystemRoot%\system32\DiagSvcs\DiagnosticsHub.StandardCollector.ServiceRes.dll,-1000 (diagnosticshub.standardcollector.service) - Unknown owner - C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe (file missing)
O23 - Service: EasyAntiCheat - Epic Games, Inc - C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: Epic Online Services (EpicOnlineServices) - Epic Games, Inc. - C:\Program Files (x86)\Epic Games\Epic Online Services\service\EpicOnlineServicesHost.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Google Chrome Elevation Service (GoogleChromeElevationService) (GoogleChromeElevationService) - Google LLC - C:\Program Files (x86)\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
O23 - Service: Služba Aktualizace Google (gupdate) (gupdate) - Google LLC - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Aktualizace Google (gupdatem) (gupdatem) - Google LLC - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: LGHUB Updater Service (LGHUBUpdaterService) - Logitech, Inc. - C:\Program Files\LGHUB\lghub_updater.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\PerceptionSimulation\PerceptionSimulationService.exe,-101 (perceptionsimulation) - Unknown owner - C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: Realtek Audio Universal Service (RtkAudioUniversalService) - Realtek Semiconductor - C:\Windows\System32\DriverStore\FileRepository\realtekservice.inf_amd64_e879bbabfd265223\RtkAudUService64.exe
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\SecurityHealthAgent.dll,-1002 (SecurityHealthService) - Unknown owner - C:\Windows\system32\SecurityHealthService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SensorDataService.exe,-101 (SensorDataService) - Unknown owner - C:\Windows\System32\SensorDataService.exe (file missing)
O23 - Service: @%SystemRoot%\System32\SgrmBroker.exe,-100 (SgrmBroker) - Unknown owner - C:\Windows\system32\SgrmBroker.exe (file missing)
O23 - Service: @firewallapi.dll,-50323 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spectrum.exe,-101 (spectrum) - Unknown owner - C:\Windows\system32\spectrum.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\TieringEngineService.exe,-702 (TieringEngineService) - Unknown owner - C:\Windows\system32\TieringEngineService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: vgc - Riot Games, Inc. - C:\Program Files\Riot Vanguard\vgc.exe
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 11621 bytes

[jaro3]

A Zemana log?

Teams.exe on startup
I just installed microsoft office and I noticed a file called literally “Program” on startup and its command line says:
“C:\Program” Files\Teams Installer\Teams.exe - -checkInstall - -source=PROPLUS
(Notice the “ after Program)
There is no “teams installer” folder in Program Files, It is actually located in Program Files(x86). What is it? I disable it from running on startup, is it okay?
It sApparently it was related to teams, I uninstalled Teams Machine Wide and now that program is gone.... but two new programs have taken its place, One call Update and the other User, the first says it located in:
C:\ProgramData\Microsoft\Teams\Update.exe
And the other one in:
C:\Users\User\Appdata\Local\Microsoft\Teams\Update.exe
The thing is that neither of those locations actually exists. I did some research and I am not the only one with this problem but I couldn’t find a solution.eems to be referring to Microsoft Teams, you should be able to disable it from start up without issues
https://www.reddit.com/r/techsupport/co ... n_startup/

Právě jsem nainstaloval microsoft office a při spuštění jsem si všiml souboru nazvaného doslova „Program“ a jeho příkazový řádek říká:
Soubory „C:\Program“\Teams Installer\Teams.exe - -checkInstall - -source=PROPLUS
(Všimněte si „po programu)
V Program Files není žádná složka „teams installer“, ve skutečnosti se nachází v Program Files (x86). Co je to? Zakážu jeho spuštění při startu, je to v pořádku?
Zřejmě to souviselo s týmy, odinstaloval jsem Teams Machine Wide a tento program je teď pryč.... ale jeho místo zaujaly dva nové programy, jeden volá Update a druhý User, první říká, že se nachází v:
C:\ProgramData\Microsoft\Teams\Update.exe
A ten druhý v:
C:\Users\User\Appdata\Local\Microsoft\Teams\Update.exe
Jde o to, že ani jedno z těchto míst ve skutečnosti neexistuje. Provedl jsem nějaký průzkum a nejsem jediný, kdo má tento problém, ale nemohl jsem najít řešení. Zdá se, že odkazuje na Microsoft Teams, měli byste být schopni jej zakázat od spuštění bez problémů
https://www.reddit.com/r/techsupport/co ... n_startup/

Stáhni si zde DelFix
Další odkazy:
https://toolslib.net/downloads/viewdownload/2-delfix/
http://ccm.net/download/download-24087-delfix
https://www.bleepingcomputer.com/download/delfix/

ulož si soubor na plochu.
Poklepáním na ikonu spusť nástroj Delfix.exe
( Ve Windows Vista, Windows 7, 8 a10 musíš spustit soubor pravým tlačítkem myši -> Spustit jako správce .
V hlavním menu, zkontroluj tyto možnosti - Odstranění dezinfekce nástrojů (Remove desinfection tools) – Vyčistit body obnovy (Purge System Restore)
Poté klikněte na tlačítko Spustit (Run) a nech nástroj dělat svoji práci

Poté se zpráva se otevře (DelFix.txt). Vlož celý obsah zprávy sem.Jinak je zpráva zde:
v C: \ DelFix.txt

Pokud nejsou problémy , je to vše a můžeš dát vyřešeno , zelenou fajfku.