Fix result of Farbar Recovery Scan Tool (x64) Version: 20-09-2026 Ran by Mat Ong Bien (23-09-2026 23:08:34) Run:1 Running from C:\Users\Mat Ong Bien\Downloads\Sửa lỗi Loaded Profiles: Mat Ong Bien & WsiAccount Boot Mode: Normal ============================================== fixlist content: ***************** CloseProcesses: SystemRestore: On CreateRestorePoint: File: C:\Program Files\komorebi\bin\komorebi.exe; C:\Program Files\whkd\bin\whkd.exe File: C:\ProgramData\Common\Microsoft\Temp\AC5F54AB\CoreGuardMgr3586.exe HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION HKU\S-1-5-21-2041319105-246497727-3865677099-1001\...\Policies\Explorer: [EnableShellExecuteHooks] 1 HKU\S-1-5-21-2041319105-246497727-3865677099-1001\Environment\\UserInitMprLogonScript: -> C:\Users\Mat Ong Bien\AppData\Local\Microsoft\Temp\A059EE23\SoftAgent339820.exe (No File) GroupPolicy: Restriction ? <==== ATTENTION Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION HKLM\SOFTWARE\Policies\Microsoft\Edge: Restriction <==== ATTENTION Task: {D58E9DB9-BBE5-4813-BB88-74B49EFCCD6E} - System32\Tasks\AMDInstallUEP => C:\Program Files\AMD\InstallUEP\AMDInstallUEP.exe (No File) Task: {89EC1351-F039-436A-BEC8-9775D8882A7C} - System32\Tasks\Launch Adobe CCXProcess => "C:\Program Files\Adobe\Adobe Creative Cloud Experience\CCXProcess.exe" (No File) Task: {117D0C96-55AD-4711-BC35-53FDD75D9F3C} - System32\Tasks\LibreHardwareMonitor => C:\Users\Mat Ong Bien\Downloads\LibreHardwareMonitor\LibreHardwareMonitor.exe (No File) Task: {077BA067-7C15-40F0-B22E-C9DC2A54B4A2} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe (No File) Task: {D6B58EAD-8102-4912-BDDD-34713ACE6A7C} - System32\Tasks\Microsoft\Windows\PI\SecureBootEncodeUEFI => %WINDIR%\system32\SecureBootEncodeUEFI.exe (No File) Task: {C200712B-DD82-4A8C-84CF-8A167B40D28E} - System32\Tasks\Microsoft\Windows\Shell\UndockedFlightingUpdate => %windir%\system32\UndockedFlightingUpdateTask.exe (No File) Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe (No File) Task: {80501DCF-FA49-4895-84BB-2F273F9285A9} - System32\Tasks\Opera scheduled Autoupdate 1745690395 => C:\Users\Mat Ong Bien\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --scheduledtask --bypasslauncher $(Arg0) (No File) Task: {FB46E5B7-3998-4066-BF82-EF167E403D34} - System32\Tasks\Seelen\Seelen UI Service => C:\Users\Mat Ong Bien\AppData\Local\Microsoft\WindowsApps\slu-service.exe --startup (No File) Task: {143FB344-A04F-4E73-A39D-16C4525FB651} - System32\Tasks\WpsUpdateTask_Mat Ong Bien => C:\Users\Mat Ong Bien\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wpsupdate.exe -from=task -source=task (No File) S2 CheckUpdateSvc_a47d; C:\ProgramData\Common\Microsoft\Temp\AC5F54AB\CoreGuardMgr3586.exe [5263360 2026-09-23] () [File not signed] <==== ATTENTION S4 dabzyxccar; C:\WINDOWS\System32\WaaSMedicSvc.dll [94208 2026-08-21] (Microsoft Windows -> Microsoft Corporation) <==== ATTENTION S2 gmbzqolcou; C:\WINDOWS\system32\wuaueng.dll [179704 2026-08-29] (Microsoft Windows -> Microsoft Corporation) <==== ATTENTION U3 jebvhzuipr; C:\WINDOWS\system32\dosvc.dll [98304 2026-08-29] (Microsoft Windows -> Microsoft Corporation) <==== ATTENTION S4 pxbnuqubss; C:\WINDOWS\System32\qmgr.dll [1486848 2026-09-09] (Microsoft Windows -> Microsoft Corporation) <==== ATTENTION S4 upblbwvtpa; C:\WINDOWS\system32\usosvc.dll [106496 2026-08-29] (Microsoft Windows -> Microsoft Corporation) <==== ATTENTION CustomCLSID: HKU\S-1-5-21-2041319105-246497727-3865677099-1001_Classes\CLSID\{28A80003-18FD-411D-B0A3-3C81F618E22B}\InprocServer32 -> C:\Users\Mat Ong Bien\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\kwpsmenushellext64.dll => No File CustomCLSID: HKU\S-1-5-21-2041319105-246497727-3865677099-1001_Classes\CLSID\{2cd17d3d-8f37-6dad-c814-c56850a6de24}\localserver32 -> "C:\ProgramData\Lenovo\Udc\Hosts\24.9.1.3\x64\MessagingPlugin.exe" -ToastActivated => No File CustomCLSID: HKU\S-1-5-21-2041319105-246497727-3865677099-1001_Classes\CLSID\{2F81B25E-7507-4844-BFF2-77D2CC24CED4}\localserver32 -> "C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe" -ToastActivated => No File CustomCLSID: HKU\S-1-5-21-2041319105-246497727-3865677099-1001_Classes\CLSID\{67F4D210-BFC2-4ADD-9A2A-C9B9E1F42C4F}\InprocServer32 -> C:\Users\Mat Ong Bien\AppData\Local\Kingsoft\WPS Office\12.1.0.25180\office6\qingshellext64.dll => No File CustomCLSID: HKU\S-1-5-21-2041319105-246497727-3865677099-1001_Classes\CLSID\{89795E3E-F6B0-4D88-B1A0-BCC3DF1A682E}\InprocServer32 -> C:\Users\Mat Ong Bien\AppData\Roaming\Kingsoft\wps_intl\addons\pool\win-x64\kmsosidebar_3.1.0.482\kmsosidebar64.dll => No File CustomCLSID: HKU\S-1-5-21-2041319105-246497727-3865677099-1001_Classes\CLSID\{AA14F9C9-62B5-4637-8AC4-8F25BF29D5A7}\localserver32 -> => No File CustomCLSID: HKU\S-1-5-21-2041319105-246497727-3865677099-1001_Classes\CLSID\{F8686D90-7CB9-4D81-B596-69C3C408BA88}\InprocServer32 -> C:\Users\Mat Ong Bien\AppData\Roaming\Kingsoft\wps_intl\addons\pool\win-x64\kmsosidebar_3.1.0.482\kmsosidebar64.dll => No File ShellIconOverlayIdentifiers: [ LenovoAINowOverlayIcon] -> {4B48C68B-80D6-40FB-B4D1-63C19130EC75} => C:\Program Files\Lenovo\Lenovo AI Now\OverlayIcon.dll -> No File ContextMenuHandlers4_S-1-5-21-2041319105-246497727-3865677099-1001-x32: [qkdesktopshellext] -> {0D8B46EA-7D35-4921-B88C-7E2B1E2D80F0} => C:\Users\Mat Ong Bien\AppData\Local\Kingsoft\WPS Office\12.1.0.25180\office6\addons\kdesktopshellext\kdesktopshellext.dll -> No File HKU\S-1-5-21-2041319105-246497727-3865677099-1001\Software\Classes\regfile: <==== ATTENTION HKU\S-1-5-21-2041319105-246497727-3865677099-1001\Software\Classes\.reg: => <==== ATTENTION HKU\S-1-5-21-2041319105-246497727-3865677099-1001\Software\Classes\.bat: => <==== ATTENTION HKU\S-1-5-21-2041319105-246497727-3865677099-1001\Software\Classes\.cmd: => <==== ATTENTION FirewallRules: [{7E91F919-7708-4986-8B31-B447C7AB31D0}] => (Allow) C:\Program Files\WindowsApps\Claude_1.32885.1.0_x64__pzs8sxrjxfjjc\app\resources\cowork-svc.exe => No File FirewallRules: [{55A0EB39-0D57-4931-A980-5AAEE26D793E}] => (Allow) C:\Program Files\WindowsApps\Claude_1.32885.1.0_x64__pzs8sxrjxfjjc\app\resources\cowork-svc.exe => No File FirewallRules: [{259C7D1F-F6B6-49AB-B36B-4B98FFDE951F}] => (Allow) C:\Program Files\WindowsApps\Claude_1.32885.1.0_x64__pzs8sxrjxfjjc\app\Claude.exe => No File FirewallRules: [{5BBD7417-0ED0-4EB1-B693-FA49298CA140}] => (Allow) C:\Program Files\WindowsApps\Claude_1.32885.1.0_x64__pzs8sxrjxfjjc\app\Claude.exe => No File FirewallRules: [UDP Query User{7EC21F0B-DB9B-4750-B081-EB9F1D2174F5}C:\program files\windowsapps\mozilla.firefox_147.0.1.0_x64__n80bbvh6b1yt2\vfs\programfiles\firefox package root\firefox.exe] => (Allow) C:\program files\windowsapps\mozilla.firefox_147.0.1.0_x64__n80bbvh6b1yt2\vfs\programfiles\firefox package root\firefox.exe => No File FirewallRules: [TCP Query User{E39A0406-8224-45F2-8469-5FC4C2BDCE24}C:\program files\windowsapps\mozilla.firefox_147.0.1.0_x64__n80bbvh6b1yt2\vfs\programfiles\firefox package root\firefox.exe] => (Allow) C:\program files\windowsapps\mozilla.firefox_147.0.1.0_x64__n80bbvh6b1yt2\vfs\programfiles\firefox package root\firefox.exe => No File FirewallRules: [UDP Query User{F0166583-5488-4CAA-8765-8E42DA27C026}C:\program files\windowsapps\mozilla.firefox_147.0.0.0_x64__n80bbvh6b1yt2\vfs\programfiles\firefox package root\firefox.exe] => (Allow) C:\program files\windowsapps\mozilla.firefox_147.0.0.0_x64__n80bbvh6b1yt2\vfs\programfiles\firefox package root\firefox.exe => No File FirewallRules: [TCP Query User{8CB943C1-650B-45CC-9450-A85A2E2D8D1D}C:\program files\windowsapps\mozilla.firefox_147.0.0.0_x64__n80bbvh6b1yt2\vfs\programfiles\firefox package root\firefox.exe] => (Allow) C:\program files\windowsapps\mozilla.firefox_147.0.0.0_x64__n80bbvh6b1yt2\vfs\programfiles\firefox package root\firefox.exe => No File FirewallRules: [UDP Query User{6DCC059F-3371-4163-AC0E-30DB97CCF999}C:\program files\windowsapps\mozilla.firefox_146.0.1.0_x64__n80bbvh6b1yt2\vfs\programfiles\firefox package root\firefox.exe] => (Allow) C:\program files\windowsapps\mozilla.firefox_146.0.1.0_x64__n80bbvh6b1yt2\vfs\programfiles\firefox package root\firefox.exe => No File FirewallRules: [TCP Query User{D9362FC0-30AA-4096-BC2A-6DAFEFB2CBEC}C:\program files\windowsapps\mozilla.firefox_146.0.1.0_x64__n80bbvh6b1yt2\vfs\programfiles\firefox package root\firefox.exe] => (Allow) C:\program files\windowsapps\mozilla.firefox_146.0.1.0_x64__n80bbvh6b1yt2\vfs\programfiles\firefox package root\firefox.exe => No File FirewallRules: [UDP Query User{6E9120B8-CD27-48DB-A018-E8AEED44B044}C:\program files\windowsapps\openai.chatgpt-desktop_1.2025.328.0_x64__2p2nqsd0c76g0\app\chatgpt.exe] => (Allow) C:\program files\windowsapps\openai.chatgpt-desktop_1.2025.328.0_x64__2p2nqsd0c76g0\app\chatgpt.exe => No File FirewallRules: [TCP Query User{2EC6C480-9484-4EE8-8258-1389A7B4E33A}C:\program files\windowsapps\openai.chatgpt-desktop_1.2025.328.0_x64__2p2nqsd0c76g0\app\chatgpt.exe] => (Allow) C:\program files\windowsapps\openai.chatgpt-desktop_1.2025.328.0_x64__2p2nqsd0c76g0\app\chatgpt.exe => No File FirewallRules: [UDP Query User{C97E78FF-43B7-48C3-BB5D-8BBDDF2351A5}C:\program files\windowsapps\openai.chatgpt-desktop_1.2025.328.0_x64__2p2nqsd0c76g0\app\chatgpt.exe] => (Allow) C:\program files\windowsapps\openai.chatgpt-desktop_1.2025.328.0_x64__2p2nqsd0c76g0\app\chatgpt.exe => No File FirewallRules: [TCP Query User{B45FDD5B-AB31-461A-95C9-BD6D910F4139}C:\program files\windowsapps\openai.chatgpt-desktop_1.2025.328.0_x64__2p2nqsd0c76g0\app\chatgpt.exe] => (Allow) C:\program files\windowsapps\openai.chatgpt-desktop_1.2025.328.0_x64__2p2nqsd0c76g0\app\chatgpt.exe => No File FirewallRules: [UDP Query User{CF457639-6300-42A2-AFD8-2E1E1302E0C0}C:\program files\windowsapps\openai.chatgpt-desktop_1.2025.258.0_x64__2p2nqsd0c76g0\app\chatgpt.exe] => (Allow) C:\program files\windowsapps\openai.chatgpt-desktop_1.2025.258.0_x64__2p2nqsd0c76g0\app\chatgpt.exe => No File FirewallRules: [TCP Query User{8FC768A2-AB66-4A14-9FD2-715430F6AF7C}C:\program files\windowsapps\openai.chatgpt-desktop_1.2025.258.0_x64__2p2nqsd0c76g0\app\chatgpt.exe] => (Allow) C:\program files\windowsapps\openai.chatgpt-desktop_1.2025.258.0_x64__2p2nqsd0c76g0\app\chatgpt.exe => No File FirewallRules: [UDP Query User{3A3B3B02-F3A9-4340-A252-71AC44E0B9B4}C:\program files\windowsapps\spotifyab.spotifymusic_1.275.510.0_x64__zpdnekdrzrea0\spotify.exe] => (Allow) C:\program files\windowsapps\spotifyab.spotifymusic_1.275.510.0_x64__zpdnekdrzrea0\spotify.exe => No File FirewallRules: [TCP Query User{ED6DCF82-70A8-4574-A168-189A77E0F24C}C:\program files\windowsapps\spotifyab.spotifymusic_1.275.510.0_x64__zpdnekdrzrea0\spotify.exe] => (Allow) C:\program files\windowsapps\spotifyab.spotifymusic_1.275.510.0_x64__zpdnekdrzrea0\spotify.exe => No File FirewallRules: [UDP Query User{BE7F3668-E074-41D3-A18B-4504761331F0}C:\program files\windowsapps\openai.chatgpt-desktop_1.2025.258.0_x64__2p2nqsd0c76g0\app\chatgpt.exe] => (Allow) C:\program files\windowsapps\openai.chatgpt-desktop_1.2025.258.0_x64__2p2nqsd0c76g0\app\chatgpt.exe => No File FirewallRules: [TCP Query User{49794D76-A883-45F5-A609-416877C75313}C:\program files\windowsapps\openai.chatgpt-desktop_1.2025.258.0_x64__2p2nqsd0c76g0\app\chatgpt.exe] => (Allow) C:\program files\windowsapps\openai.chatgpt-desktop_1.2025.258.0_x64__2p2nqsd0c76g0\app\chatgpt.exe => No File FirewallRules: [{3EF7A0E0-8C23-40F4-937B-BEA0AE02AFDD}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File FirewallRules: [{4F1096AC-AEA4-4D9B-928E-EC2BF606A1A3}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File FirewallRules: [{7E05B49A-49FE-4497-945F-C2C8EFEFE3A0}] => (Allow) C:\Program Files (x86)\3uToolsV3\3uTools.exe => No File FirewallRules: [{E3245272-0970-4D4F-91C5-6C55FD68B1CD}] => (Allow) C:\Program Files (x86)\3uToolsV3\3uTools.exe => No File FirewallRules: [TCP Query User{A699490B-5D76-44C2-8B91-EF0382BD714A}C:\users\mat ong bien\appdata\roaming\utorrent web\utweb.exe] => (Allow) C:\users\mat ong bien\appdata\roaming\utorrent web\utweb.exe => No File FirewallRules: [UDP Query User{44FA2B0D-B911-458B-8021-019B5318A029}C:\users\mat ong bien\appdata\roaming\utorrent web\utweb.exe] => (Allow) C:\users\mat ong bien\appdata\roaming\utorrent web\utweb.exe => No File FirewallRules: [TCP Query User{AE343414-6BB9-47C3-9A50-56FB816E7B33}C:\program files\lenovo\lenovo.pfmservice\pfmservice.exe] => (Block) C:\program files\lenovo\lenovo.pfmservice\pfmservice.exe => No File FirewallRules: [UDP Query User{EA8BC20B-B977-4072-8623-E0C21B7D9E98}C:\program files\lenovo\lenovo.pfmservice\pfmservice.exe] => (Block) C:\program files\lenovo\lenovo.pfmservice\pfmservice.exe => No File FirewallRules: [TCP Query User{311A1D0E-3E23-45CD-B9F8-8987139F115B}J:\games\punishing gray raven game\pgr.exe] => (Allow) J:\games\punishing gray raven game\pgr.exe => No File FirewallRules: [UDP Query User{EBE624B3-CB33-4DDA-A9DA-1F397742C798}J:\games\punishing gray raven game\pgr.exe] => (Allow) J:\games\punishing gray raven game\pgr.exe => No File FirewallRules: [TCP Query User{5AFBABC4-4D39-4338-AB9F-BAE631F91083}J:\steamlibrary\steamapps\common\tree\tree\binaries\win64\tree-win64-shipping.exe] => (Block) J:\steamlibrary\steamapps\common\tree\tree\binaries\win64\tree-win64-shipping.exe => No File FirewallRules: [UDP Query User{A6DACB9C-F285-4893-8C6D-5F7D855708EC}J:\steamlibrary\steamapps\common\tree\tree\binaries\win64\tree-win64-shipping.exe] => (Block) J:\steamlibrary\steamapps\common\tree\tree\binaries\win64\tree-win64-shipping.exe => No File StartPowerShell: Invoke-webrequest https://raw.githubusercontent.com/winhelponline/Files/refs/heads/main/wu_services_all_windows_11_24h2.reg -OutFile C:\Downloaded\wu_services_all.reg dir C:\Downloaded & "C:\Program Files\Windows Defender\MpCmdRun.exe" -SignatureUpdate -MMPC Get-MpPreference | select Exclusion*, ThreatID*, Control* $Paths=(Get-MpPreference).ExclusionPath foreach ($Path in $Paths) { Remove-MpPreference -ExclusionPath $Path -Verbose} $Extensions=(Get-MpPreference).ExclusionExtension foreach ($Extension in $Extensions) { Remove-MpPreference -ExclusionExtension $Extension -Verbose} $Processes=(Get-MpPreference).ExclusionProcess foreach ($Process in $Processes) { Remove-MpPreference -ExclusionProcess $Process -Verbose} $ThreatIds = (Get-MpPreference).ThreatIDDefaultAction_Ids Foreach ($ThreatId in $ThreatIds) { Remove-MpPreference -ThreatIDDefaultAction_Ids $ThreatId -Verbose } Get-MpPreference Get-MpComputerStatus Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct netsh advfirewall show allprofiles state EndPowerShell: REG: reg import "C:\Downloaded\wu_services_all.reg" cmd: schtasks -create -f -sc onStart -ru "NT AUTHORITY\SYSTEM" -tn DWDH -tr "cmd /c cd /d 'C:\ProgramData\Microsoft\Windows Defender\Scans' & rd /s /q History\Service & rd /s /q History\CacheManager & del /f mpcache-*.bin* & del /f mpenginedb.db* & schtasks /delete /f /tn DWDH" >nul 2>nul RemoveDirectory: C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory EndPowerShell: C:\Downloaded\wu_services_all.reg C:\Windows\SoftwareDistribution\Download C:\Windows\SoftwareDistribution\DataStore EmptyTemp: ***************** Processes closed successfully. SystemRestore: On => completed Restore point was successfully created. ========================= File: C:\Program Files\komorebi\bin\komorebi.exe; C:\Program Files\whkd\bin\whkd.exe ======================== C:\Program Files\komorebi\bin\komorebi.exe File not signed MD5: FC4689BCCF3CD892A0729458C0AEAEE8 Creation and modification date: 2026-05-03 20:24 - 2026-05-03 20:24 Size: 014667264 Attributes: ----A Company Name: Internal Name: Original Name: Product: Description: File Version: Product Version: Copyright: Virusscan: https://virusscan.jotti.org/filescanjob/0m10x18jhz C:\Program Files\whkd\bin\whkd.exe File not signed MD5: 5CA18D451024F5BC89F95A807527F8FA Creation and modification date: 2025-09-09 15:35 - 2025-09-09 15:35 Size: 001615872 Attributes: ----A Company Name: Internal Name: Original Name: Product: Description: File Version: Product Version: Copyright: Virusscan: https://virusscan.jotti.org/filescanjob/np95p7c3ih ====== End of File: ====== ========================= File: C:\ProgramData\Common\Microsoft\Temp\AC5F54AB\CoreGuardMgr3586.exe ======================== C:\ProgramData\Common\Microsoft\Temp\AC5F54AB\CoreGuardMgr3586.exe File not signed MD5: 764B104A599A4AE0453981AF7139DF45 Creation and modification date: 2026-09-23 11:36 - 2026-09-23 17:18 Size: 005263360 Attributes: ----A Company Name: Internal Name: Original Name: Product: Description: File Version: Product Version: Copyright: Virusscan: https://virusscan.jotti.org/filescanjob/2zn8tsdma2 ====== End of File: ====== HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate => removed successfully "HKU\S-1-5-21-2041319105-246497727-3865677099-1001\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\EnableShellExecuteHooks" => removed successfully "HKU\S-1-5-21-2041319105-246497727-3865677099-1001\Environment\\UserInitMprLogonScript" => removed successfully "C:\WINDOWS\system32\GroupPolicy\Machine" Folder move: C:\WINDOWS\system32\GroupPolicy\Machine\comment.cmtx => moved successfully C:\WINDOWS\system32\GroupPolicy\Machine\Registry.pol => moved successfully C:\WINDOWS\system32\GroupPolicy\Machine => moved successfully C:\WINDOWS\system32\GroupPolicy\GPT.ini => moved successfully C:\ProgramData\NTUSER.pol => moved successfully HKLM\SOFTWARE\Policies\Mozilla => removed successfully HKLM\SOFTWARE\Policies\Microsoft\Edge => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{D58E9DB9-BBE5-4813-BB88-74B49EFCCD6E}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D58E9DB9-BBE5-4813-BB88-74B49EFCCD6E}" => removed successfully C:\WINDOWS\System32\Tasks\AMDInstallUEP => moved successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AMDInstallUEP" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{89EC1351-F039-436A-BEC8-9775D8882A7C}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{89EC1351-F039-436A-BEC8-9775D8882A7C}" => removed successfully C:\WINDOWS\System32\Tasks\Launch Adobe CCXProcess => moved successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Launch Adobe CCXProcess" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{117D0C96-55AD-4711-BC35-53FDD75D9F3C}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{117D0C96-55AD-4711-BC35-53FDD75D9F3C}" => removed successfully C:\WINDOWS\System32\Tasks\LibreHardwareMonitor => moved successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\LibreHardwareMonitor" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{077BA067-7C15-40F0-B22E-C9DC2A54B4A2}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{077BA067-7C15-40F0-B22E-C9DC2A54B4A2}" => removed successfully C:\WINDOWS\System32\Tasks\Microsoft\Windows\Location\Notifications => moved successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Location\Notifications" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{D6B58EAD-8102-4912-BDDD-34713ACE6A7C}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D6B58EAD-8102-4912-BDDD-34713ACE6A7C}" => removed successfully C:\WINDOWS\System32\Tasks\Microsoft\Windows\PI\SecureBootEncodeUEFI => moved successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\PI\SecureBootEncodeUEFI" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C200712B-DD82-4A8C-84CF-8A167B40D28E}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C200712B-DD82-4A8C-84CF-8A167B40D28E}" => removed successfully C:\WINDOWS\System32\Tasks\Microsoft\Windows\Shell\UndockedFlightingUpdate => moved successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Shell\UndockedFlightingUpdate" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F3E6E7ED-A196-4E44-8803-55FAB3AD4E29}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F3E6E7ED-A196-4E44-8803-55FAB3AD4E29}" => removed successfully C:\WINDOWS\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => moved successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{80501DCF-FA49-4895-84BB-2F273F9285A9}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{80501DCF-FA49-4895-84BB-2F273F9285A9}" => removed successfully C:\WINDOWS\System32\Tasks\Opera scheduled Autoupdate 1745690395 => moved successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Opera scheduled Autoupdate 1745690395" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{FB46E5B7-3998-4066-BF82-EF167E403D34}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FB46E5B7-3998-4066-BF82-EF167E403D34}" => removed successfully C:\WINDOWS\System32\Tasks\Seelen\Seelen UI Service => moved successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Seelen\Seelen UI Service" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{143FB344-A04F-4E73-A39D-16C4525FB651}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{143FB344-A04F-4E73-A39D-16C4525FB651}" => removed successfully C:\WINDOWS\System32\Tasks\WpsUpdateTask_Mat Ong Bien => moved successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WpsUpdateTask_Mat Ong Bien" => removed successfully HKLM\System\CurrentControlSet\Services\CheckUpdateSvc_a47d => removed successfully CheckUpdateSvc_a47d => service removed successfully HKLM\System\CurrentControlSet\Services\dabzyxccar => removed successfully dabzyxccar => service removed successfully HKLM\System\CurrentControlSet\Services\gmbzqolcou => removed successfully gmbzqolcou => service removed successfully HKLM\System\CurrentControlSet\Services\jebvhzuipr => removed successfully jebvhzuipr => service removed successfully HKLM\System\CurrentControlSet\Services\pxbnuqubss => removed successfully pxbnuqubss => service removed successfully HKLM\System\CurrentControlSet\Services\upblbwvtpa => removed successfully upblbwvtpa => service removed successfully HKU\S-1-5-21-2041319105-246497727-3865677099-1001_Classes\CLSID\{28A80003-18FD-411D-B0A3-3C81F618E22B} => removed successfully HKU\S-1-5-21-2041319105-246497727-3865677099-1001_Classes\CLSID\{2cd17d3d-8f37-6dad-c814-c56850a6de24} => removed successfully HKU\S-1-5-21-2041319105-246497727-3865677099-1001_Classes\CLSID\{2F81B25E-7507-4844-BFF2-77D2CC24CED4} => removed successfully HKU\S-1-5-21-2041319105-246497727-3865677099-1001_Classes\CLSID\{67F4D210-BFC2-4ADD-9A2A-C9B9E1F42C4F} => removed successfully HKU\S-1-5-21-2041319105-246497727-3865677099-1001_Classes\CLSID\{89795E3E-F6B0-4D88-B1A0-BCC3DF1A682E} => removed successfully HKU\S-1-5-21-2041319105-246497727-3865677099-1001_Classes\CLSID\{AA14F9C9-62B5-4637-8AC4-8F25BF29D5A7} => removed successfully HKU\S-1-5-21-2041319105-246497727-3865677099-1001_Classes\CLSID\{F8686D90-7CB9-4D81-B596-69C3C408BA88} => removed successfully HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ LenovoAINowOverlayIcon => removed successfully HKLM\Software\Classes\CLSID\{4B48C68B-80D6-40FB-B4D1-63C19130EC75} => removed successfully "HKU\S-1-5-21-2041319105-246497727-3865677099-1001-x32\Software\Classes\Directory\ShellEx\ContextMenuHandlers\qkdesktopshellext" => not found HKU\S-1-5-21-2041319105-246497727-3865677099-1001\Software\Classes\regfile => removed successfully HKU\S-1-5-21-2041319105-246497727-3865677099-1001\Software\Classes\.reg => removed successfully HKU\S-1-5-21-2041319105-246497727-3865677099-1001\Software\Classes\.bat => removed successfully HKU\S-1-5-21-2041319105-246497727-3865677099-1001\Software\Classes\.cmd => removed successfully "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{7E91F919-7708-4986-8B31-B447C7AB31D0}" => removed successfully "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{55A0EB39-0D57-4931-A980-5AAEE26D793E}" => removed successfully "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{259C7D1F-F6B6-49AB-B36B-4B98FFDE951F}" => removed successfully "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{5BBD7417-0ED0-4EB1-B693-FA49298CA140}" => removed successfully "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{7EC21F0B-DB9B-4750-B081-EB9F1D2174F5}C:\program files\windowsapps\mozilla.firefox_147.0.1.0_x64__n80bbvh6b1yt2\vfs\programfiles\firefox package root\firefox.exe" => removed successfully "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{E39A0406-8224-45F2-8469-5FC4C2BDCE24}C:\program files\windowsapps\mozilla.firefox_147.0.1.0_x64__n80bbvh6b1yt2\vfs\programfiles\firefox package root\firefox.exe" => removed successfully "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{F0166583-5488-4CAA-8765-8E42DA27C026}C:\program files\windowsapps\mozilla.firefox_147.0.0.0_x64__n80bbvh6b1yt2\vfs\programfiles\firefox package root\firefox.exe" => removed successfully "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{8CB943C1-650B-45CC-9450-A85A2E2D8D1D}C:\program files\windowsapps\mozilla.firefox_147.0.0.0_x64__n80bbvh6b1yt2\vfs\programfiles\firefox package root\firefox.exe" => removed successfully "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{6DCC059F-3371-4163-AC0E-30DB97CCF999}C:\program files\windowsapps\mozilla.firefox_146.0.1.0_x64__n80bbvh6b1yt2\vfs\programfiles\firefox package root\firefox.exe" => removed successfully "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{D9362FC0-30AA-4096-BC2A-6DAFEFB2CBEC}C:\program files\windowsapps\mozilla.firefox_146.0.1.0_x64__n80bbvh6b1yt2\vfs\programfiles\firefox package root\firefox.exe" => removed successfully "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{6E9120B8-CD27-48DB-A018-E8AEED44B044}C:\program files\windowsapps\openai.chatgpt-desktop_1.2025.328.0_x64__2p2nqsd0c76g0\app\chatgpt.exe" => removed successfully "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{2EC6C480-9484-4EE8-8258-1389A7B4E33A}C:\program files\windowsapps\openai.chatgpt-desktop_1.2025.328.0_x64__2p2nqsd0c76g0\app\chatgpt.exe" => removed successfully "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{C97E78FF-43B7-48C3-BB5D-8BBDDF2351A5}C:\program files\windowsapps\openai.chatgpt-desktop_1.2025.328.0_x64__2p2nqsd0c76g0\app\chatgpt.exe" => removed successfully "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{B45FDD5B-AB31-461A-95C9-BD6D910F4139}C:\program files\windowsapps\openai.chatgpt-desktop_1.2025.328.0_x64__2p2nqsd0c76g0\app\chatgpt.exe" => removed successfully "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{CF457639-6300-42A2-AFD8-2E1E1302E0C0}C:\program files\windowsapps\openai.chatgpt-desktop_1.2025.258.0_x64__2p2nqsd0c76g0\app\chatgpt.exe" => removed successfully "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{8FC768A2-AB66-4A14-9FD2-715430F6AF7C}C:\program files\windowsapps\openai.chatgpt-desktop_1.2025.258.0_x64__2p2nqsd0c76g0\app\chatgpt.exe" => removed successfully "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{3A3B3B02-F3A9-4340-A252-71AC44E0B9B4}C:\program files\windowsapps\spotifyab.spotifymusic_1.275.510.0_x64__zpdnekdrzrea0\spotify.exe" => removed successfully "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{ED6DCF82-70A8-4574-A168-189A77E0F24C}C:\program files\windowsapps\spotifyab.spotifymusic_1.275.510.0_x64__zpdnekdrzrea0\spotify.exe" => removed successfully "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{BE7F3668-E074-41D3-A18B-4504761331F0}C:\program files\windowsapps\openai.chatgpt-desktop_1.2025.258.0_x64__2p2nqsd0c76g0\app\chatgpt.exe" => removed successfully "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{49794D76-A883-45F5-A609-416877C75313}C:\program files\windowsapps\openai.chatgpt-desktop_1.2025.258.0_x64__2p2nqsd0c76g0\app\chatgpt.exe" => removed successfully "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{3EF7A0E0-8C23-40F4-937B-BEA0AE02AFDD}" => removed successfully "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{4F1096AC-AEA4-4D9B-928E-EC2BF606A1A3}" => removed successfully "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{7E05B49A-49FE-4497-945F-C2C8EFEFE3A0}" => removed successfully "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{E3245272-0970-4D4F-91C5-6C55FD68B1CD}" => removed successfully "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{A699490B-5D76-44C2-8B91-EF0382BD714A}C:\users\mat ong bien\appdata\roaming\utorrent web\utweb.exe" => removed successfully "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{44FA2B0D-B911-458B-8021-019B5318A029}C:\users\mat ong bien\appdata\roaming\utorrent web\utweb.exe" => removed successfully "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{AE343414-6BB9-47C3-9A50-56FB816E7B33}C:\program files\lenovo\lenovo.pfmservice\pfmservice.exe" => removed successfully "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{EA8BC20B-B977-4072-8623-E0C21B7D9E98}C:\program files\lenovo\lenovo.pfmservice\pfmservice.exe" => removed successfully "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{311A1D0E-3E23-45CD-B9F8-8987139F115B}J:\games\punishing gray raven game\pgr.exe" => removed successfully "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{EBE624B3-CB33-4DDA-A9DA-1F397742C798}J:\games\punishing gray raven game\pgr.exe" => removed successfully "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{5AFBABC4-4D39-4338-AB9F-BAE631F91083}J:\steamlibrary\steamapps\common\tree\tree\binaries\win64\tree-win64-shipping.exe" => removed successfully "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{A6DACB9C-F285-4893-8C6D-5F7D855708EC}J:\steamlibrary\steamapps\common\tree\tree\binaries\win64\tree-win64-shipping.exe" => removed successfully ========= Powershell: ========= Invoke-webrequest : Could not find a part of the path 'C:\Downloaded\wu_services_all.reg'. At C:\FRST\pw5592.ps1:1 char:1 + Invoke-webrequest https://raw.githubusercontent.com/winhelponline/Fil ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [Invoke-WebRequest], DirectoryNotFoundException + FullyQualifiedErrorId : System.IO.DirectoryNotFoundException,Microsoft.PowerShell.Commands.InvokeWebRequestComma nd dir : Cannot find path 'C:\Downloaded' because it does not exist. At C:\FRST\pw5592.ps1:2 char:1 + dir C:\Downloaded + ~~~~~~~~~~~~~~~~~ + CategoryInfo : ObjectNotFound: (C:\Downloaded:String) [Get-ChildItem], ItemNotFoundException + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.GetChildItemCommand Signature update started . . . Service Version: 4.18.26080.4 Engine Version: 1.1.26080.3 AntiSpyware Signature Version: 1.459.359.0 AntiVirus Signature Version: 1.459.359.0 Signature update finished. No updates needed ExclusionExtension : {.exe, .sys} ExclusionIpAddress : ExclusionPath : {C:\ProgramData, C:\Users\Mat Ong Bien\AppData\Local\09905ea99c339b, C:\Users\Mat Ong Bien\AppData\Local\09905ea99c339b\47792d8fd.exe, C:\WINDOWS\TEMP} ExclusionProcess : {0wgb0ktby.exe, 47792d8fd.exe, 8a68kn50nlkg.exe, 9r09gfi2u.exe...} ThreatIDDefaultAction_Actions : ThreatIDDefaultAction_Ids : ControlledFolderAccessAllowedApplications : {0wgb0ktby.exe, 47792d8fd.exe, 8a68kn50nlkg.exe, 9r09gfi2u.exe...} ControlledFolderAccessDefaultProtectedFolders : {C:\Users\Mat Ong Bien\OneDrive\Ta`i liˆ?u, C:\Users\Public\Documents, C:\Users\Mat Ong Bien\Pictures, C:\Users\Public\Pictures...} ControlledFolderAccessProtectedFolders : VERBOSE: Performing operation 'Update MSFT_MpPreference' on Target 'ProtectionManagement'. VERBOSE: Performing operation 'Update MSFT_MpPreference' on Target 'ProtectionManagement'. VERBOSE: Performing operation 'Update MSFT_MpPreference' on Target 'ProtectionManagement'. VERBOSE: Performing operation 'Update MSFT_MpPreference' on Target 'ProtectionManagement'. VERBOSE: Performing operation 'Update MSFT_MpPreference' on Target 'ProtectionManagement'. VERBOSE: Performing operation 'Update MSFT_MpPreference' on Target 'ProtectionManagement'. VERBOSE: Performing operation 'Update MSFT_MpPreference' on Target 'ProtectionManagement'. VERBOSE: Performing operation 'Update MSFT_MpPreference' on Target 'ProtectionManagement'. VERBOSE: Performing operation 'Update MSFT_MpPreference' on Target 'ProtectionManagement'. VERBOSE: Performing operation 'Update MSFT_MpPreference' on Target 'ProtectionManagement'. VERBOSE: Performing operation 'Update MSFT_MpPreference' on Target 'ProtectionManagement'. VERBOSE: Performing operation 'Update MSFT_MpPreference' on Target 'ProtectionManagement'. VERBOSE: Performing operation 'Update MSFT_MpPreference' on Target 'ProtectionManagement'. VERBOSE: Performing operation 'Update MSFT_MpPreference' on Target 'ProtectionManagement'. VERBOSE: Performing operation 'Update MSFT_MpPreference' on Target 'ProtectionManagement'. VERBOSE: Performing operation 'Update MSFT_MpPreference' on Target 'ProtectionManagement'. VERBOSE: Performing operation 'Update MSFT_MpPreference' on Target 'ProtectionManagement'. AiAgentNetworkInspection : 0 AiAgentProtection : 0 AllowDatagramProcessingOnWinServer : False AllowNetworkProtectionDownLevel : False AllowNetworkProtectionOnWinServer : False AllowSwitchToAsyncInspection : True ApplyDisableNetworkScanningToIOAV : False AttackSurfaceReductionOnlyExclusions : AttackSurfaceReductionRules_Actions : AttackSurfaceReductionRules_Ids : AttackSurfaceReductionRules_RuleSpecificExclusions : AttackSurfaceReductionRules_RuleSpecificExclusions_Id : BruteForceProtectionAggressiveness : 0 BruteForceProtectionConfiguredState : 0 BruteForceProtectionExclusions : BruteForceProtectionLocalNetworkBlocking : False BruteForceProtectionMaxBlockTime : 0 BruteForceProtectionSkipLearningPeriod : False CheckForSignaturesBeforeRunningScan : False CloudBlockLevel : 0 CloudExtendedTimeout : 0 ComputerID : 1B9969B7-830A-4C3A-8A86-AA9E6DE5F46B ControlledFolderAccessAllowedApplications : {0wgb0ktby.exe, 47792d8fd.exe, 8a68kn50nlkg.exe, 9r09gfi2u.exe...} ControlledFolderAccessDefaultProtectedFolders : {C:\Users\Mat Ong Bien\OneDrive\Ta`i liˆ?u, C:\Users\Public\Documents, C:\Users\Mat Ong Bien\Pictures, C:\Users\Public\Pictures...} ControlledFolderAccessProtectedFolders : DefinitionUpdatesChannel : 0 DeploymentChannel : 0 DisableArchiveScanning : False DisableAutoExclusions : False DisableBehaviorMonitoring : False DisableBlockAtFirstSeen : False DisableCacheMaintenance : False DisableCatchupFullScan : True DisableCatchupQuickScan : True DisableCoreServiceECSIntegration : False DisableCoreServiceTelemetry : False DisableCpuThrottleOnIdleScans : True DisableDatagramProcessing : False DisableDnsOverTcpParsing : False DisableDnsParsing : False DisableEmailScanning : True DisableFtpParsing : False DisableGradualRelease : False DisableHttpParsing : False DisableInboundConnectionFiltering : False DisableIOAVProtection : False DisableNetworkProtectionPerfTelemetry : False DisablePrivacyMode : False DisableQuicParsing : True DisableRdpParsing : False DisableRealtimeMonitoring : False DisableRemovableDriveScanning : True DisableRestorePoint : True DisableScanningMappedNetworkDrivesForFullScan : True DisableScanningNetworkFiles : False DisableScriptScanning : False DisableSmtpParsing : False DisableSshParsing : False DisableTamperProtection : False DisableTlsParsing : False EnableControlledFolderAccess : 1 EnableConvertWarnToBlock : False EnableDnsSinkhole : True EnableFileHashComputation : False EnableFullScanOnBatteryPower : False EnableLowCpuPriority : False EnableNetworkProtection : 0 EnableUdpReceiveOffload : False EnableUdpSegmentationOffload : False EngineUpdatesChannel : 0 ExclusionExtension : ExclusionIpAddress : ExclusionPath : ExclusionProcess : ForceUseProxyOnly : False HideExclusionsFromLocalUsers : True HighThreatDefaultAction : 0 IntelTDTEnabled : False LowThreatDefaultAction : 0 MAPSReporting : 2 MeteredConnectionUpdates : False ModerateThreatDefaultAction : 0 NetworkProtectionReputationMode : 0 OobeEnableRtpAndSigUpdate : False PerformanceModeStatus : 1 PlatformUpdatesChannel : 0 ProxyBypass : ProxyPacUrl : ProxyServer : PUAProtection : 1 QuarantinePurgeItemsAfterDelay : 90 QuickScanIncludeExclusions : 0 RandomizeScheduleTaskTimes : True RealTimeScanDirection : 0 RemediationScheduleDay : 0 RemediationScheduleTime : 02:00:00 RemoteEncryptionProtectionAggressiveness : 0 RemoteEncryptionProtectionConfiguredState : 0 RemoteEncryptionProtectionExclusions : RemoteEncryptionProtectionMaxBlockTime : 0 RemoveScanningThreadPoolCap : False ReportDynamicSignatureDroppedEvent : False ReportingAdditionalActionTimeOut : 10080 ReportingCriticalFailureTimeOut : 10080 ReportingNonCriticalTimeOut : 1440 ScanAvgCPULoadFactor : 50 ScanOnlyIfIdleEnabled : True ScanParameters : 1 ScanPurgeItemsAfterDelay : 15 ScanScheduleDay : 0 ScanScheduleOffset : 120 ScanScheduleQuickScanTime : 00:00:00 ScanScheduleTime : 02:00:00 SchedulerRandomizationTime : 4 ServiceHealthReportInterval : 60 SevereThreatDefaultAction : 0 SharedSignaturesPath : SharedSignaturesPathUpdateAtScheduledTimeOnly : False SignatureAuGracePeriod : 0 SignatureBlobFileSharesSources : SignatureBlobUpdateInterval : 60 SignatureDefinitionUpdateFileSharesSources : SignatureDisableUpdateOnStartupWithoutEngine : False SignatureFallbackOrder : MicrosoftUpdateServer|MMPC SignatureFirstAuGracePeriod : 120 SignatureScheduleDay : 8 SignatureScheduleTime : 01:45:00 SignatureUpdateCatchupInterval : 1 SignatureUpdateInterval : 0 SubmitSamplesConsent : 1 ThreatIDDefaultAction_Actions : ThreatIDDefaultAction_Ids : ThrottleForScheduledScanOnly : True TrustLabelProtectionStatus : 0 UILockdown : False UnknownThreatDefaultAction : 0 PSComputerName : AMEngineVersion : 1.1.26080.3 AMProductVersion : 4.18.26080.4 AMRunningMode : Normal AMServiceEnabled : True AMServiceVersion : 4.18.26080.4 AntispywareEnabled : True AntispywareSignatureAge : 0 AntispywareSignatureLastUpdated : 9/23/2026 6:08:42 PM AntispywareSignatureVersion : 1.459.360.0 AntivirusEnabled : True AntivirusSignatureAge : 0 AntivirusSignatureLastUpdated : 9/23/2026 6:08:42 PM AntivirusSignatureVersion : 1.459.360.0 BehaviorMonitorEnabled : True ComputerID : 1B9969B7-830A-4C3A-8A86-AA9E6DE5F46B ComputerState : 0 ControlledConfigurationState : 0 DefenderSignaturesOutOfDate : False DeviceControlDefaultEnforcement : DeviceControlPoliciesLastUpdated : 1/1/1601 7:00:00 AM DeviceControlState : Disabled FullScanAge : 0 FullScanEndTime : 9/23/2026 3:39:49 PM FullScanOverdue : False FullScanRequired : False FullScanSignatureVersion : 1.459.343.0 FullScanStartTime : 9/23/2026 3:13:21 PM InitializationProgress : ServiceStartedSuccessfully IoavProtectionEnabled : True IsTamperProtected : True IsVirtualMachine : False LastFullScanSource : 1 LastQuickScanSource : 1 NISEnabled : True NISEngineVersion : 1.1.26080.3 NISSignatureAge : 0 NISSignatureLastUpdated : 9/23/2026 6:08:42 PM NISSignatureVersion : 1.459.360.0 OnAccessProtectionEnabled : True ProductStatus : 524288 QuickScanAge : 0 QuickScanEndTime : 9/23/2026 12:22:51 PM QuickScanOverdue : False QuickScanSignatureVersion : 1.459.335.0 QuickScanStartTime : 9/23/2026 12:17:55 PM RealTimeProtectionEnabled : True RealTimeScanDirection : 0 RebootRequired : False SmartAppControlExpiration : SmartAppControlState : On TamperProtectionSource : Signatures TroubleShootingDailyMaxQuota : TroubleShootingDailyQuotaLeft : TroubleShootingEndTime : TroubleShootingExpirationLeft : TroubleShootingMode : TroubleShootingModeSource : TroubleShootingQuotaResetTime : TroubleShootingStartTime : PSComputerName : displayName : Windows Defender instanceGuid : {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} pathToSignedProductExe : windowsdefender:// pathToSignedReportingExe : %ProgramFiles%\Windows Defender\MsMpeng.exe productState : 397568 timestamp : Wed, 23 Sep 2026 13:26:14 GMT PSComputerName : Domain Profile Settings: ---------------------------------------------------------------------- State ON Private Profile Settings: ---------------------------------------------------------------------- State ON Public Profile Settings: ---------------------------------------------------------------------- State ON Ok. ========= End of Powershell: ========= ========= reg import "C:\Downloaded\wu_services_all.reg" ========= ERROR: Error opening the file. There may be a disk or file system error. ========= End of Reg: ========= ========= schtasks -create -f -sc onStart -ru "NT AUTHORITY\SYSTEM" -tn DWDH -tr "cmd /c cd /d 'C:\ProgramData\Microsoft\Windows Defender\Scans' & rd /s /q History\Service & rd /s /q History\CacheManager & del /f mpcache-*.bin* & del /f mpenginedb.db* & schtasks /delete /f /tn DWDH" >nul 2>nul ========= ========= End of CMD: ========= could not remove "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\01" => Scheduled to remove on reboot. could not remove "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\04" => Scheduled to remove on reboot. could not remove "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\07" => Scheduled to remove on reboot. could not remove "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\10" => Scheduled to remove on reboot. could not remove "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\11" => Scheduled to remove on reboot. could not remove "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\12" => Scheduled to remove on reboot. could not remove "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\13" => Scheduled to remove on reboot. could not remove "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\15" => Scheduled to remove on reboot. could not remove "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\21" => Scheduled to remove on reboot. could not remove "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\22" => Scheduled to remove on reboot. could not remove "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory" => Scheduled to remove on reboot. "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory" => could not remove could not remove "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory" => Scheduled to remove on reboot. EndPowerShell: => Error: No automatic fix found for this entry. "C:\Downloaded\wu_services_all.reg" => not found "C:\Windows\SoftwareDistribution\Download" => not found "C:\Windows\SoftwareDistribution\DataStore" => not found =========== EmptyTemp: ========== FlushDNS => completed BITS transfer queue => 2097152 B DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 525664507 B Java, Discord, Steam htmlcache, WinHttpAutoProxySvc/winhttp *.cache => 1232917887 B Windows/system/drivers => 166378270 B Edge => 2095285667 B Chrome => 1251237514 B Vivaldi => 3154949599 B Firefox => 2428859609 B Opera => 20569181 B Local\Temp, Local\*.tmp, LocalLow\Temp, Roaming\Temp, Roaming\*.tmp , Caches, history, cookies, recent: Default => 9221 B ProgramData => 993841 B Public => 0 B systemprofile => 881537 B systemprofile32 => 455987 B LocalService => 490941 B NetworkService => 49693 B Mat Ong Bien => 38546712 B WsiAccount => 7685 B RecycleBin => 62590229 B EmptyTemp: => 10.23 GB temporary data Removed. ================================ Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 23-09-2026 23:21:11) "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\01" => removed successfully "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\04" => removed successfully "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\07" => removed successfully "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\10" => removed successfully "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\11" => removed successfully "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\12" => removed successfully "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\13" => removed successfully "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\15" => removed successfully "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\21" => removed successfully "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\22" => removed successfully "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory" => removed successfully "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory" => removed successfully ==== End of Fixlog 23:21:11 ====