Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 14-10-2026
Ran by o0the (administrator) on -THB-DOZER (Micro-Star International Co., Ltd. Vector 16 HX AI A2XWHG) (16-10-2026 01:47:19)
Running from C:\Users\o0the\Downloads\FRST64English.exe
Loaded Profiles: o0the
Platform: Microsoft Windows 11 家庭版 中文版 Version 26H2 26300.9711 (X64) Language: 简体中文(中国大陆)
Default browser: Chrome
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(C:\Program Files (x86)\Kaspersky Lab\Kaspersky 21.27\avp.exe ->) (AO Kaspersky Lab -> AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky 21.27\avpui.exe
(C:\Program Files (x86)\MSI\MSI Center\MSI_Central_Service.exe ->) (MICRO-STAR INTERNATIONAL CO., LTD. -> Micro-Star Int'l Co., Ltd.) C:\Program Files (x86)\MSI\MSI Center\MSI.CentralServer.exe
(C:\Program Files (x86)\Steam\steam.exe ->) (Valve Corp. -> Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
(C:\Program Files\Google\Chrome\Application\chrome.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\cmd.exe
(C:\Program Files\Huorong\Sysdiag\bin\HipsDaemon.exe ->) (北京火绒网络科技有限公司 -> 北京火绒网络科技有限公司) C:\Program Files\Huorong\Sysdiag\bin\HipsTray.exe
(C:\Program Files\LGHUB\system_tray\lghub_system_tray.exe ->) (Logitech Inc -> Logitech, Inc.) C:\Program Files\LGHUB\lghub_agent.exe
(C:\Program Files\Logitech\X56\X56_Profiler.exe ->) (Logitech Inc -> Logitech, Inc.) C:\Program Files\Logitech\X56\LAClient\laclient.exe
(C:\Program Files\NVIDIA Corporation\FrameViewSDK\nvfvsdksvc_x64.exe ->) (NVIDIA Corporation -> ) C:\Program Files\NVIDIA Corporation\FrameViewSDK\bin\nvrla.exe
(C:\Program Files\NVIDIA Corporation\FrameViewSDK\nvfvsdksvc_x64.exe ->) (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\FrameViewSDK\FvContainer\FvContainer.exe
(C:\Program Files\NVIDIA Corporation\FrameViewSDK\nvfvsdksvc_x64.exe ->) (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\FrameViewSDK\FvContainer\FvContainer.System.exe
(C:\Program Files\NVIDIA Corporation\FrameViewSDK\nvfvsdksvc_x64.exe ->) (NVIDIA Corporation -> NVIDIA) C:\Program Files\NVIDIA Corporation\FrameViewSDK\bin\PresentMon_x64.exe
(C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe ->) (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA app\CEF\NVIDIA Overlay.exe
(C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe ->) (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA app\ShadowPlay\nvsphelper64.exe
(C:\Program Files\Process Lasso\srvstub.exe ->) (Bitsum Technologies (Bitsum LLC) -> Bitsum LLC) C:\Program Files\Process Lasso\ProcessGovernor.exe
(C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.304.258.0_x64__zpdnekdrzrea0\SpotifyLauncher.exe ->) (Spotify AB -> ) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.304.258.0_x64__zpdnekdrzrea0\crashpad_handler.exe
(C:\Users\o0the\AppData\Roaming\HuionTablet\HuionTablet.exe ->) (Shenzhen Huiwang Trend Technology Co., Ltd. -> ) C:\Users\o0the\AppData\Roaming\HuionTablet\TabletDriver.exe
(C:\Users\o0the\AppData\Roaming\HuionTablet\HuionTablet.exe ->) (Shenzhen Huiwang Trend Technology Co., Ltd. -> ) C:\Users\o0the\AppData\Roaming\HuionTablet\TabletServer.exe
(C:\Users\o0the\AppData\Roaming\utorrent\updates\3.6.0_47390\utorrentie.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft\EdgeWebView\Application\155.0.4283.45\msedgewebview2.exe
(C:\Users\o0the\AppData\Roaming\utorrent\uTorrent.exe ->) () [File not signed] C:\Users\o0the\AppData\Roaming\utorrent\crashpad_handler.exe
(C:\Users\o0the\AppData\Roaming\utorrent\uTorrent.exe ->) (BitTorrent Inc -> BitTorrent Inc.) C:\Users\o0the\AppData\Roaming\utorrent\helper\helper.exe
(C:\Users\o0the\AppData\Roaming\utorrent\uTorrent.exe ->) (RainCo HK Limited -> BitTorrent Inc.) C:\Users\o0the\AppData\Roaming\utorrent\updates\3.6.0_47390\utorrentie.exe <2>
(C:\Windows\SysWOW64\wallpaperservice32.exe ->) (Skutta Software GmbH -> Skutta Software GmbH) D:\SteamLibrary\steamapps\common\wallpaper_engine\wallpaper32.exe
(cmd.exe ->) (AO Kaspersky Lab -> AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky 21.27\plugins_nms.exe
(D:\QQ\QQ.exe ->) (Tencent Technology (Shenzhen) Company Limited -> ) D:\QQ\versions\9.9.26-44725\resources\app\win64\crashpad_handler.exe
(D:\SteamLibrary\steamapps\common\wallpaper_engine\wallpaper32.exe ->) (Skutta Software GmbH -> ) D:\SteamLibrary\steamapps\common\wallpaper_engine\bin\webwallpaper64.exe
(Discord Inc. -> Discord Inc.) C:\Users\o0the\AppData\Local\Discord\app-1.0.9262\Discord.exe <6>
(DriverStore\FileRepository\ipf_cpu.inf_amd64_4b6a23f61a3d7da1\ipf_uf.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\ipf_cpu.inf_amd64_4b6a23f61a3d7da1\ipf_helper.exe
(explorer.exe ->) (Beijing Duyou Science and Technology Co.,Ltd. -> Baidu.com, Inc.) D:\Other\BaiduNetdisk\YunDetectService.exe
(explorer.exe ->) (Google LLC -> Google LLC) C:\Program Files\Google\Chrome\Application\chrome.exe
(explorer.exe ->) (Logitech Inc -> Logitech, Inc.) C:\Program Files\LGHUB\system_tray\lghub_system_tray.exe
(explorer.exe ->) (Logitech) [File not signed] C:\Program Files\Logitech\X56\X56_Profiler.exe
(explorer.exe ->) (Microsoft Corporation -> ) C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2026.11090.22001.0_x64__8wekyb3d8bbwe\Photos.exe
(explorer.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
(explorer.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE
(explorer.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft OneDrive\OneDrive.exe
(explorer.exe ->) (RainCo HK Limited -> BitTorrent Limited) C:\Users\o0the\AppData\Roaming\utorrent\uTorrent.exe
(explorer.exe ->) (Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Windows\System32\DriverStore\FileRepository\realtekservice.inf_amd64_a112e46fc636d880\RtkAudUService64.exe
(explorer.exe ->) (Tencent Technology (Shenzhen) Company Limited -> Tencent) D:\QQ\QQ.exe
(explorer.exe ->) (Valve Corp. -> Valve Corporation) C:\Program Files (x86)\Steam\steam.exe
(Google LLC -> Google LLC) C:\Program Files\Google\Chrome\Application\chrome.exe <17>
(Kaspersky Labs GmbH -> AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky 21.27\avp.exe
(Microsoft Corporation -> ) C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2026.11090.22001.0_x64__8wekyb3d8bbwe\Photos.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe <7>
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft\EdgeWebView\Application\155.0.4283.45\msedgewebview2.exe <12>
(Microsoft Corporation -> Microsoft Corporation) C:\Windows\System32\GameInputSvc.exe
(Microsoft Corporation -> Windows (R) Win 7 DDK provider) C:\Program Files\Microsoft GameInput\x64\GameInputRedistService.exe
(MICRO-STAR INTERNATIONAL CO., LTD. -> Micro-Star INT'L CO., LTD.) C:\Program Files\WindowsApps\9426MICRO-STARINTERNATION.MSICenter_2.0.74.0_x64__kzh8wxbdkxb8p\DCv2\DCv2.exe
(NahimicService.exe ->) (SteelSeries France SASU -> Nahimic) C:\Windows\System32\NahimicAPO4Volume.exe
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe <3>
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA app\CEF\NVIDIA Overlay.exe <4>
(NVIDIA Corporation -> NVIDIA Corporation) C:\Windows\System32\DriverStore\FileRepository\nvmii.inf_amd64_7251a3c076e80d80\Display.NvContainer\NVDisplay.Container.exe
(services.exe ->) (Beijing Huorong Network Technology Co., Ltd. -> 北京火绒网络科技有限公司) C:\Program Files\Huorong\Sysdiag\bin\wsctrlsvc.exe
(services.exe ->) (Bitsum Technologies (Bitsum LLC) -> Bitsum LLC) C:\Program Files\Process Lasso\srvstub.exe
(services.exe ->) (British Cayman Islands Intelligo Technology Inc. Taiwan Branch -> Intelligo Technology Inc.) C:\Windows\System32\DriverStore\FileRepository\igoaudioservice.inf_amd64_fad4a7a67c651a34\IgoAudioService_x64.exe
(services.exe ->) (Huorong Security Lab. -> 北京火绒网络科技有限公司) C:\Program Files\Huorong\Sysdiag\bin\HipsDaemon.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Program Files\Thunderbolt Share\TBService.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\dtt_sw.inf_amd64_eff1f30039f77f6b\ipfsvc.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iastorvd.inf_amd64_da06297c4b8e9167\RstMwService.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igcc_dch.inf_amd64_f21846a062360d82\OneApp.IGCC.WinService.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\ipf_cpu.inf_amd64_4b6a23f61a3d7da1\ipf_uf.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\mewmiprov.inf_amd64_d51901c26227fb29\WMIRegistrationService.exe
(services.exe ->) (Intel Corporation -> Intel) C:\Windows\System32\DriverStore\FileRepository\intcoed.inf_amd64_3f27c0e4d2852503\AS\IAS\IntelAudioService.exe
(services.exe ->) (Kaspersky Labs GmbH -> AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky 21.27\avp.exe
(services.exe ->) (Logitech Inc -> Logitech) C:\Program Files\Logitech\DirectOutput\DirectOutputService.exe
(services.exe ->) (Logitech Inc -> Logitech, Inc.) C:\Program Files\LGHUB\lghub_updater.exe
(services.exe ->) (Logitech Inc -> Logitech, Inc.) C:\Windows\System32\DriverStore\FileRepository\logi_lamparray_usb.inf_amd64_0efdf0d8d6ee547b\logi_lamparray_service.AMD64.exe
(services.exe ->) (Microsoft Corporation -> ) C:\Program Files\WindowsApps\Microsoft.MicrosoftPCManager_3.3.15.0_x64__8wekyb3d8bbwe\PCManager\MSPCManagerService.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft OneDrive\26.178.0913.0007\FileSyncHelper.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Windows\System32\GameInputSvc.exe
(services.exe ->) (Microsoft Corporation -> MSOfficePLUSService) C:\Program Files\Microsoft OfficePLUS\3.16.0.46159\addin\MSOfficePLUSService.exe
(services.exe ->) (Microsoft Corporation -> Windows (R) Win 7 DDK provider) C:\Program Files\Microsoft GameInput\x64\GameInputRedistService.exe
(services.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\WUDFCompanionHost.exe <3>
(services.exe ->) (Micro-Star International CO., LTD. -> ) C:\Program Files (x86)\MSI\MSI NBFoundation Service\Sendevsvc.exe
(services.exe ->) (Micro-Star International CO., LTD. -> Micro-Star International Co., Ltd.) C:\Program Files (x86)\MSI\MSI NBFoundation Service\MSIAPService.exe
(services.exe ->) (Micro-Star International CO., LTD. -> Micro-Star International Co., Ltd.) C:\Windows\SysWOW64\MSIService.exe
(services.exe ->) (MICRO-STAR INTERNATIONAL CO., LTD. -> Micro-Star Int'l Co., Ltd.) C:\Program Files (x86)\MSI\MSI Center\MSI_Central_Service.exe
(services.exe ->) (MICRO-STAR INTERNATIONAL CO., LTD. -> Micro-Star INT'L CO., LTD.) C:\Program Files (x86)\MSI\MSI Center\Mystic Light\LightKeeperService.exe
(services.exe ->) (MICRO-STAR INTERNATIONAL CO., LTD. -> Micro-Star Int'l Co., Ltd.) C:\Program Files (x86)\MSI\MSI Center\Mystic Light\Mystic_Light_Service.exe
(services.exe ->) (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
(services.exe ->) (NVIDIA Corporation -> NVIDIA Corporation) C:\Windows\System32\DriverStore\FileRepository\nvmii.inf_amd64_7251a3c076e80d80\Display.NvContainer\NVDisplay.Container.exe
(services.exe ->) (NVIDIA Corporation -> NVIDIA) C:\Program Files\NVIDIA Corporation\FrameViewSDK\nvfvsdksvc_x64.exe
(services.exe ->) (Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Windows\System32\DriverStore\FileRepository\realtekservice.inf_amd64_a112e46fc636d880\RtkAudUService64.exe
(services.exe ->) (Skutta Software GmbH -> ) C:\Windows\SysWOW64\wallpaperservice32.exe
(services.exe ->) (SteelSeries France SASU -> Nahimic) C:\Windows\System32\NahimicService.exe
(services.exe ->) (Valve Corp. -> Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Shenzhen Huiwang Trend Technology Co., Ltd. -> Shenzhen Huion Trend Technology Co.,Ltd.) C:\Users\o0the\AppData\Roaming\HuionTablet\HuionTablet.exe
(sihost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.GamingApp_2609.1001.16.0_x64__8wekyb3d8bbwe\XboxPcTray.exe
(sihost.exe ->) (Spotify AB -> Spotify Ltd) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.304.258.0_x64__zpdnekdrzrea0\SpotifyLauncher.exe
(Skutta Software GmbH -> ) D:\SteamLibrary\steamapps\common\wallpaper_engine\bin\webwallpaper64.exe <4>
(Spotify AB -> Spotify Ltd) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.304.258.0_x64__zpdnekdrzrea0\Spotify.exe <8>
(SteelSeries France SASU -> A-Volute) C:\Users\o0the\AppData\Local\NhNotifSys\nahimic\nahimicNotifSys.exe
(svchost.exe ->) (21E1B422-257A-44A2-9C8F-379165856473 -> ) C:\Program Files\WindowsApps\A-Volute.Nahimic_1.10.15.0_x64__w2gh52qy24etm\Nahimic3.exe
(svchost.exe ->) (Bitsum Technologies (Bitsum LLC) -> Bitsum LLC) C:\Program Files\Process Lasso\bitsumsessionagent.exe
(svchost.exe ->) (Bitsum Technologies (Bitsum LLC) -> Bitsum LLC) C:\Program Files\Process Lasso\ProcessLasso.exe
(svchost.exe ->) (British Cayman Islands Intelligo Technology Inc. Taiwan Branch -> Intelligo Technology Inc.) C:\Windows\System32\DriverStore\FileRepository\igoaudioservice.inf_amd64_fad4a7a67c651a34\iGoSwServer.exe <2>
(svchost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe
(svchost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft OneDrive\26.178.0913.0007\FileCoAuth.exe
(svchost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.GamingApp_2609.1001.16.0_x64__8wekyb3d8bbwe\XboxPcApp.exe
(svchost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.GamingApp_2609.1001.16.0_x64__8wekyb3d8bbwe\XboxPcAppFT.exe
(svchost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.StartExperiencesApp_1.398.2.0_x64__8wekyb3d8bbwe\MicrosoftStartFeedProvider\MicrosoftStartFeedProvider.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\DataExchangeHost.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\InputMethod\CHS\ChsIME.exe <2>
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\NgcIso.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppActions.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(svchost.exe ->) (MICRO-STAR INTERNATIONAL CO., LTD. -> ) C:\Program Files (x86)\MSI\MSI Companion\Gamebar_Connect.exe
(svchost.exe ->) (MICRO-STAR INTERNATIONAL CO., LTD. -> ) C:\Program Files (x86)\MSI\MSI Companion\MSI_GamebarTool.exe
(svchost.exe ->) (MICRO-STAR INTERNATIONAL CO., LTD. -> Copyright ?2020 Micro-Star INT'L CO., LTD.) C:\Program Files (x86)\MSI\MSI Companion\MSI_TraceFPS.exe
(svchost.exe ->) (Micro-Star International CO., LTD. -> Micro-Star International Co., Ltd.) C:\Program Files (x86)\MSI\MSI NBFoundation Service\OmApSvcBroker.exe
(svchost.exe ->) (MICRO-STAR INTERNATIONAL CO., LTD. -> Micro-Star Int'l Co., Ltd.) C:\Program Files (x86)\MSI\MSI Center\MSI.TerminalServer.exe
(svchost.exe ->) (MICRO-STAR INTERNATIONAL CO., LTD. -> Micro-Star Int'l Co., Ltd.) C:\Program Files (x86)\MSI\MSI Center\Mystic Light\LEDKeeper2.exe
(svchost.exe ->) (MICRO-STAR INTERNATIONAL CO., LTD. -> Micro-Star Int'l Co., Ltd.) C:\Program Files (x86)\MSI\MSI Center\Sound Tune\pro\SoundTune.exe
(svchost.exe ->) (SteelSeries France SASU -> Nahimic) C:\Windows\System32\NahimicSvc64.exe
(svchost.exe ->) (SteelSeries France SASU -> Nahimic) C:\Windows\SysWOW64\NahimicSvc32.exe
(Tencent Technology (Shenzhen) Company Limited -> Tencent) D:\QQ\QQ.exe <8>
(Valve Corp. -> Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe <6>

==================== Registry (Whitelisted) ===================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtkAudUService] => C:\Windows\System32\DriverStore\FileRepository\realtekservice.inf_amd64_a112e46fc636d880\RtkAudUService64.exe [3499560 2026-07-22] (Realtek Semiconductor Corp. -> Realtek Semiconductor)
HKLM\...\Run: [X56] => C:\Program Files\Logitech\X56\X56_Profiler.exe [87552 2018-09-03] (Logitech) [File not signed]
HKLM\...\Run: [sysdiag] => C:\Program Files\Huorong\Sysdiag\bin\hipstray.exe [3245216 2026-10-09] (北京火绒网络科技有限公司 -> 北京火绒网络科技有限公司)
HKLM-x32\...\Run: [HuionTablet] => C:\Users\o0the\AppData\Roaming\HuionTablet\HuionTablet.exe [4441280 2026-06-20] (Shenzhen Huiwang Trend Technology Co., Ltd. -> Shenzhen Huion Trend Technology Co.,Ltd.)
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Restriction <==== ATTENTION
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Restriction <==== ATTENTION
HKU\S-1-5-21-2339272927-596407228-3174859544-1001\...\Run: [OneDrive] => C:\Program Files\Microsoft OneDrive\OneDrive.exe [4723048 2026-10-10] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-2339272927-596407228-3174859544-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [5823128 2026-10-13] (Valve Corp. -> Valve Corporation)
HKU\S-1-5-21-2339272927-596407228-3174859544-1001\...\Run: [LGHUB] => C:\Program Files\LGHUB\system_tray\lghub_system_tray.exe [28878488 2026-09-30] (Logitech Inc -> Logitech, Inc.)
HKU\S-1-5-21-2339272927-596407228-3174859544-1001\...\Run: [QQNT] => D:\QQ\QQ.exe [1637256 2025-08-20] (Tencent Technology (Shenzhen) Company Limited -> Tencent)
HKU\S-1-5-21-2339272927-596407228-3174859544-1001\...\Run: [Discord] => C:\Users\o0the\AppData\Local\Discord\Update.exe [1516408 2025-03-31] (Discord Inc. -> Discord Inc.)
HKU\S-1-5-21-2339272927-596407228-3174859544-1001\...\Run: [ut] => C:\Users\o0the\AppData\Roaming\utorrent\uTorrent.exe [9286816 2026-09-21] (RainCo HK Limited -> BitTorrent Limited)
HKU\S-1-5-21-2339272927-596407228-3174859544-1001\...\Run: [BaiduYunDetect] => D:\Other\BaiduNetdisk\YunDetectService.exe [3727112 2025-10-27] (Beijing Duyou Science and Technology Co.,Ltd. -> Baidu.com, Inc.)
HKU\S-1-5-21-2339272927-596407228-3174859544-1001\...\Run: [QuarkUpdaterTaskUser1.0.0.21] => C:\Users\o0the\AppData\Local\QuarkUpdater\QuarkUpdater\1.0.0.21\updater.exe [5950512 2025-12-17] (ALIBABA (CHINA) NETWORK TECHNOLOGY CO.,LTD. -> The Chromium Authors)
HKU\S-1-5-21-2339272927-596407228-3174859544-1001\...\Run: [GoogleChromeAutoLaunch_8F776242487C4D9F1F074AE5154FFD52] => "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window /prefetch:5 [4586648 2026-10-06] (Google LLC -> Google LLC)
HKU\S-1-5-21-2339272927-596407228-3174859544-1001\...\Run: [MicrosoftEdgeAutoLaunch_44712C18A2D54F8AEABA6C8B62ADE590] => "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start [5438280 2026-10-08] (Microsoft Corporation -> Microsoft Corporation)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{49210152-871f-4ffa-961d-a172abcbc09d}] -> C:\Program Files\Google\Chrome\Application\PlatformExperienceHelper\platform_experience_helper.exe [4924568 2026-08-11] (Google LLC -> Google LLC)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files\Google\Chrome\Application\155.0.8059.41\Installer\chrmstp.exe [8414872 2026-10-14] (Google LLC -> Google LLC)
Startup: C:\Users\o0the\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\发送至 OneNote.lnk [2026-09-21]
ShortcutTarget: 发送至 OneNote.lnk -> C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE (Microsoft Corporation -> Microsoft Corporation)

==================== Scheduled Tasks (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {4D607ED8-0991-4FB5-A206-E9A0FB5A09F7} - System32\Tasks\BackgroundTask => C:\Windows\System32\cmd.exe [339968 2026-10-14] (Microsoft Windows -> Microsoft Corporation) -> /c "C:\Users\o0the\AppData\Local\Microsoft\Windows\INetCache\SystemWebCors\sync_eae1.cmd" <==== ATTENTION
Task: {0902EB3E-4A1B-4809-8849-5F8CB73B8135} - System32\Tasks\GoogleSystem\GoogleUpdater\GoogleUpdaterTaskSystem157.0.8089.0{54B44D90-7964-4392-8B58-C0EEF2F658FA} => C:\Program Files (x86)\Google\GoogleUpdater\157.0.8089.0\updater.exe [9958552 2026-10-06] (Google LLC -> Google LLC)
Task: {0D8255DB-CC62-4EDB-9D94-F4CBE2956659} - System32\Tasks\GoogleUserPEH\RunPlatformExperienceHelper_Daily => C:\Program Files\Google\Chrome\Application\PlatformExperienceHelper\platform_experience_helper.exe [4924568 2026-08-11] (Google LLC -> Google LLC)
Task: {F38515B8-E1D5-4E69-ACD3-E116C27B897C} - System32\Tasks\GoogleUserPEH\RunPlatformExperienceHelper_Metrics => C:\Program Files\Google\Chrome\Application\PlatformExperienceHelper\platform_experience_helper.exe [4924568 2026-08-11] (Google LLC -> Google LLC)
Task: {28978CBA-161B-4171-8385-E50EEFD01877} - System32\Tasks\GoogleUserPEH\RunPlatformExperienceHelperOnUnlock => C:\Program Files\Google\Chrome\Application\PlatformExperienceHelper\platform_experience_helper.exe [4924568 2026-08-11] (Google LLC -> Google LLC)
Task: {897CDE16-944B-4C13-B06C-CB3BC74B0468} - System32\Tasks\iGoAudioTask => C:\Windows\System32\DriverStore\FileRepository\igoaudioservice.inf_amd64_fad4a7a67c651a34\iGoSwServer.exe [1087688 2025-04-01] (British Cayman Islands Intelligo Technology Inc. Taiwan Branch -> Intelligo Technology Inc.)
Task: {6BFE09AE-0D7E-492D-B3FA-EBF5165E2966} - System32\Tasks\iGoAudioTaskSession => C:\Windows\System32\DriverStore\FileRepository\igoaudioservice.inf_amd64_fad4a7a67c651a34\iGoSwServer.exe [1087688 2025-04-01] (British Cayman Islands Intelligo Technology Inc. Taiwan Branch -> Intelligo Technology Inc.)
Task: {AD673EAA-2B1A-475F-9AB5-95A47E382D81} - System32\Tasks\Kaspersky_Upgrade_Launcher_{278ADC42-419D-4547-A6CA-5B74BE0AD901} => C:\Program Files\Common Files\AV\Kaspersky\upgrade.exe [780304 2026-10-15] (AO Kaspersky Lab -> AO Kaspersky Lab)
Task: {F37ABAD7-F475-4E9D-8DAF-7B333AE05E26} - System32\Tasks\Microsoft\Office\Office Actions Server => C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ActionsServer\ActionsServer.exe [16430976 2026-10-10] (Microsoft Corporation -> Microsoft Corporation)
Task: {D412B130-9D74-4058-AFA3-825A9703DE19} - System32\Tasks\Microsoft\Office\Office Automatic Updates 2.0 => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [29735240 2026-10-02] (Microsoft Corporation -> Microsoft Corporation)
Task: {8FEB1242-7EB3-4FDB-84F9-77F270EB267C} - System32\Tasks\Microsoft\Office\Office Background Push Maintenance => C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx64\Microsoft Shared\OFFICE16\opushutil.exe [15108960 2026-10-10] (Microsoft Corporation -> Microsoft Corporation)
Task: {956CFC71-7867-452B-A297-EA4595BFD9E7} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [29735240 2026-10-02] (Microsoft Corporation -> Microsoft Corporation)
Task: {3D83D4FD-0091-4327-B45D-3DEDF760734F} - System32\Tasks\Microsoft\Office\Office Feature Updates => C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [427376 2026-10-10] (Microsoft Corporation -> Microsoft Corporation)
Task: {DCB67815-2B8D-46B3-84E2-A631780C733D} - System32\Tasks\Microsoft\Office\Office Feature Updates Logon => C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [427376 2026-10-10] (Microsoft Corporation -> Microsoft Corporation)
Task: {85960346-9099-4D60-BA03-BED65DFC9C58} - System32\Tasks\Microsoft\Office\Office Performance Monitor => C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\operfmon.exe [1325424 2026-10-02] (Microsoft Corporation -> Microsoft Corporation)
Task: {24B14A91-157F-4564-AA6E-BE8034C5A8C3} - System32\Tasks\Microsoft\Office\Office Startup Maintenance => C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ActionsServer\ActionsServer.exe [16430976 2026-10-10] (Microsoft Corporation -> Microsoft Corporation)
Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe  (No File)
Task: {39F08B5F-021D-4413-94F9-5F32EA0D15D9} - System32\Tasks\MSI Task Host - LEDKeeper2_Host => C:\Program Files (x86)\MSI\MSI Center\Mystic Light\LEDKeeper2.exe [3399320 2025-07-31] (MICRO-STAR INTERNATIONAL CO., LTD. -> Micro-Star Int'l Co., Ltd.)
Task: {5A121378-4098-4482-B1C1-89F028364EAB} - System32\Tasks\MSI_GamebarConnect => C:\Program Files (x86)\MSI\MSI Companion\Gamebar_Connect.exe [118368 2025-08-18] (MICRO-STAR INTERNATIONAL CO., LTD. -> )
Task: {8517BE20-6E3A-45BB-A80C-7ABF5712BFA5} - System32\Tasks\MSI_GamebarTool => C:\Program Files (x86)\MSI\MSI Companion\MSI_GamebarTool.exe [241736 2025-08-18] (MICRO-STAR INTERNATIONAL CO., LTD. -> )
Task: {9365378E-5ED1-4BDD-90D9-22150EA2D4B8} - System32\Tasks\MSI_TraceFPS => C:\Program Files (x86)\MSI\MSI Companion\MSI_TraceFPS.exe [355936 2025-08-18] (MICRO-STAR INTERNATIONAL CO., LTD. -> Copyright ?2020 Micro-Star INT'L CO., LTD.)
Task: {D370227B-380F-43F8-9825-61660EE523AD} - System32\Tasks\NahimicTask32 => C:\Windows\System32\..\SysWOW64\NahimicSvc32.exe [1118264 2025-06-30] (SteelSeries France SASU -> Nahimic)
Task: {E25164B7-1F66-4526-8E98-C15320FCF771} - System32\Tasks\NahimicTask64 => C:\Windows\System32\.\NahimicSvc64.exe [1438232 2025-06-30] (SteelSeries France SASU -> Nahimic)
Task: {1DD99186-359E-4A39-928A-3E33DAD852AF} - System32\Tasks\NVIDIA App SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NVIDIA App\CEF\NVIDIA App.exe [3656304 2026-08-31] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {9647DAEB-B627-4F6C-B7E8-6E082B05F8D1} - System32\Tasks\OmApSvcBroker => C:\Program Files (x86)\MSI\MSI NBFoundation Service\OmApSvcBroker.exe [1361456 2026-09-03] (Micro-Star International CO., LTD. -> Micro-Star International Co., Ltd.)
Task: {BFACE26B-F983-4939-A5A5-087A50888F64} - System32\Tasks\OneDC_Updater => C:\Program Files (x86)\MSI\MSI_Center_Updater\OneDC_Updater.exe [855600 2026-09-04] (Micro-Star International CO., LTD. -> Micro-Star International Co., Ltd.)
Task: {DC1AEB8C-68F7-4FC3-90AE-EF9028C3B502} - System32\Tasks\OneDrive Per-Machine Standalone Update Task => C:\Program Files\Microsoft OneDrive\OneDriveStandaloneUpdater.exe [4414312 2026-10-10] (Microsoft Corporation -> Microsoft Corporation)
Task: {4224F3BA-9256-4AAA-BCC8-06866421200C} - System32\Tasks\OneDrive Reporting Task-S-1-5-21-2339272927-596407228-3174859544-1001 => C:\Program Files\Microsoft OneDrive\OneDriveStandaloneUpdater.exe [4414312 2026-10-10] (Microsoft Corporation -> Microsoft Corporation)
Task: {48424559-042B-4D14-9E38-CB027D1B1622} - System32\Tasks\OneDrive Startup Task-S-1-5-21-2339272927-596407228-3174859544-1001 => C:\Program Files\Microsoft OneDrive\26.178.0913.0007\OneDriveLauncher.exe [874856 2026-10-10] (Microsoft Corporation -> Microsoft Corporation)
Task: {9FAE7500-D4B3-45BA-9E8A-87A45A273F1F} - System32\Tasks\Process Lasso Management Console (GUI) => C:\Program Files\Process Lasso\processlasso.exe [2429424 2026-03-03] (Bitsum Technologies (Bitsum LLC) -> Bitsum LLC)
Task: {8C7BF8B4-49AA-4F3B-B92E-2BEEEAB89503} - System32\Tasks\QuarkUpdaterUser\QuarkUpdater\QuarkUpdaterTaskUser1.0.0.21{53D9DCB4-FBB2-4C75-8403-3490EA99B5ED} => C:\Users\o0the\AppData\Local\QuarkUpdater\QuarkUpdater\1.0.0.21\updater.exe [5950512 2025-12-17] (ALIBABA (CHINA) NETWORK TECHNOLOGY CO.,LTD. -> The Chromium Authors)
Task: {DC6E9EE2-D127-42B9-AED9-DE9FC314E581} - System32\Tasks\Session agent for Process Lasso => C:\Program Files\Process Lasso\bitsumsessionagent.exe [184824 2026-03-03] (Bitsum Technologies (Bitsum LLC) -> Bitsum LLC)
Task: {EC013495-1B66-4F85-BA8E-BF4AECDB423C} - System32\Tasks\SoftLanding\S-1-5-21-2339272927-596407228-3174859544-1001\SoftLandingRefreshForExpirationTask-{856db29e-b9f5-48eb-97a1-9dd73e0205c5} => {F576B2F9-7850-4226-ADB0-E5993FED4F02}

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\CreateExplorerShellUnelevatedTask.job => C:\Windows\explorer.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyServer: [S-1-5-21-2339272927-596407228-3174859544-1001] => 127.0.0.1:7890
Tcpip\Parameters: [DhcpNameServer] 192.168.11.1
Tcpip\..\Interfaces\{de03df23-67da-477e-a678-2bd9927d032d}: [NameServer] 8.8.8.8,8.8.4.4
Tcpip\..\Interfaces\{de03df23-67da-477e-a678-2bd9927d032d}: [DhcpNameServer] 10.116.122.56
Tcpip\..\Interfaces\{fbb24d47-ad89-41bf-8660-a20f60e6fbd3}: [NameServer] 8.8.8.8,8.8.4.4
Tcpip\..\Interfaces\{fbb24d47-ad89-41bf-8660-a20f60e6fbd3}: [DhcpNameServer] 192.168.11.1
Tcpip\..\Interfaces\{fbb24d47-ad89-41bf-8660-a20f60e6fbd3}\37C697: [DhcpNameServer] 192.168.3.1
Tcpip\..\Interfaces\{fbb24d47-ad89-41bf-8660-a20f60e6fbd3}\8456E627970267F6E60235B616C6963656: [NameServer] 8.8.8.8,8.8.4.4
Tcpip\..\Interfaces\{fbb24d47-ad89-41bf-8660-a20f60e6fbd3}\8456E627970267F6E60235B616C6963656: [DhcpNameServer] 10.227.108.121
Tcpip\..\Interfaces\{fbb24d47-ad89-41bf-8660-a20f60e6fbd3}\9438E60393866995A206DC033C038C03: [NameServer] 8.8.8.8,8.8.4.4
Tcpip\..\Interfaces\{fbb24d47-ad89-41bf-8660-a20f60e6fbd3}\9438E60393866995A206DC033C038C03: [DhcpNameServer] 10.250.105.140
Tcpip\..\Interfaces\{fbb24d47-ad89-41bf-8660-a20f60e6fbd3}\B4F6D65696A696D274D2B4531343: [NameServer] 8.8.8.8,8.8.4.4
Tcpip\..\Interfaces\{fbb24d47-ad89-41bf-8660-a20f60e6fbd3}\B4F6D65696A696D274D2B4531343: [DhcpNameServer] 192.168.11.1

FireFox:
========
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL [2026-08-26] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @baidu.com/YunWebDetectPlugin -> D:\Other\BaiduNetdisk\npYunWebDetect.dll [2025-10-27] (Beijing Duyou Science and Technology Co.,Ltd. -> Baidu.com, Inc.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\NPSPWRAP.DLL [2026-08-26] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @qq.com/QQPhotoDrawEx -> C:\Program Files (x86)\Tencent\Qzone\npQQPhotoDrawEx.dll [2013-08-13] (Tencent Technology(Shenzhen) Company Limited -> )
FF Plugin-x32: @qq.com/QzoneMusic -> C:\Program Files (x86)\Tencent\QzoneMusic\npQzoneMusic.dll [2016-02-26] (Tencent Technology(Shenzhen) Company Limited -> Tencent)
FF Plugin-x32: @tencent.com/npQQMailWebKit,version=1.0.0.1 -> C:\Program Files (x86)\QQMailPlugin\npQQMailWebKit.dll [2013-04-25] (Tencent Technology(Shenzhen) Company Limited -> Tencent)
FF Plugin-x32: @tencent.com/nptxftnWebKit,version=1.0.0.1 -> C:\Program Files (x86)\QQMailPlugin\nptxftnWebKit.dll [2013-04-08] (Tencent Technology (Shenzhen) Company Limited) [File not signed]

Edge: 
=======
Edge DefaultProfile: Default
Edge Profile: C:\Users\o0the\AppData\Local\Microsoft\Edge\User Data\Default [2026-10-15]
Edge HomePage: Default -> hxxp://www.baidu.com/
Edge StartupUrls: Default -> "hxxps://go.microsoft.com/fwlink/?LinkId=625115"
Edge Extension: (利用者クライアントソフト Edge/Chrome) - C:\Users\o0the\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ddhaancdmkmeigppopkakhpbboccibla [2025-08-19]
Edge Extension: (マイナポータル) - C:\Users\o0the\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\fjjibalalngebiaophebgkkohaaggphf [2026-09-11]
Edge Extension: (Google 文档的离线功能) - C:\Users\o0the\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2026-09-20]
Edge Extension: (Adblock Plus - 免费的广告拦截器) - C:\Users\o0the\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\gmgoamodcdcjnbaobigkjelfplakmdhh [2026-10-12]
Edge Extension: (篡改猴) - C:\Users\o0the\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\iikmkjmpaadaobahmlepeloendndfphd [2026-10-10]
Edge Extension: (集装箱) - C:\Users\o0the\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\iooablphhiejolggkfjnojinnmccdapb [2025-08-18]
Edge Extension: (Edge relevant text changes) - C:\Users\o0the\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha [2025-08-18]
Edge Extension: (Pixiv工具箱) - C:\Users\o0the\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\kjbdcfnalffdkdbomnmcgjpjhkngijkc [2025-08-18]
Edge Extension: (穿梭Transocks回国加速器 - 海外华人回国追剧听歌看球赛) - C:\Users\o0the\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\mhnblpolhhnnomgmaaejnfflepnefoek [2026-05-21]
Edge Extension: (Microsoft Rewards) - C:\Users\o0the\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\nlbmdekgjkajiobkcbpolefohlelfhfe [2025-08-18]
Edge Extension: (Ruffle - Flash Emulator) - C:\Users\o0the\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\pipjjbgofgieknlpefmcckdmgaaegban [2026-10-08]

Chrome: 
=======
CHR DefaultProfile: Profile 1
CHR Profile: C:\Users\o0the\AppData\Local\Google\Chrome\User Data\Profile 1 [2026-10-15]
CHR Extension: (カスペルスキー プラグイン) - C:\Users\o0the\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ahkjpbeeocnddjkakilopmfdlnjdpcdm [2026-10-15]
CHR Extension: (Pixiv Toolkit Next) - C:\Users\o0the\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ajlcnbbeidbackfknkgknjefhmbngdnj [2026-10-08]
CHR Extension: (Adblock Plus - free ad blocker) - C:\Users\o0the\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2026-10-13]
CHR Extension: (Tampermonkey) - C:\Users\o0the\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\dhdgffkkebhmkfjojejmpbldmpobfkfo [2026-10-08]
CHR Extension: (Microsoft Bing Search with Rewards) - C:\Users\o0the\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\fbgcedjacmlbgleddnoacbnijgmiolem [2026-10-08]
CHR Extension: (Google オフライン ドキュメント) - C:\Users\o0the\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2026-10-15]
CHR Extension: (Chrome ウェブストア決済) - C:\Users\o0the\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2026-10-08]

==================== Services (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVP21.27; C:\Program Files (x86)\Kaspersky Lab\Kaspersky 21.27\avp.exe [135104 2026-09-30] (Kaspersky Labs GmbH -> AO Kaspersky Lab)
S3 BaiduNetdiskUtility; D:\Other\BaiduNetdisk\YunUtilityService.exe [112904 0] (Access Denied)  [File not signed?]
S3 battlenet_helpersvc; C:\ProgramData\Battle.net_components\battlenet_helpersvc\AgentHelper.exe [3642064 2026-06-27] (Blizzard Entertainment, Inc. -> Blizzard Entertainment)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [30856424 2026-09-12] (BattlEye Innovations e.K. -> )
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [12732808 2026-10-02] (Microsoft Corporation -> Microsoft Corporation)
R2 dptftcs; C:\Windows\System32\DriverStore\FileRepository\dtt_sw.inf_amd64_eff1f30039f77f6b\ipfsvc.exe [572504 2025-04-01] (Intel Corporation -> Intel Corporation)
S3 EasyAntiCheat_EOS; C:\Program Files (x86)\EasyAntiCheat_EOS\EasyAntiCheat_EOS.exe [1039800 2026-09-29] (Epic Games Inc. -> Epic Games, Inc.)
R3 FileSyncHelper; C:\Program Files\Microsoft OneDrive\26.178.0913.0007\FileSyncHelper.exe [3806096 2026-10-10] (Microsoft Corporation -> Microsoft Corporation)
R2 GameInputRedistService; C:\Program Files\Microsoft GameInput\x64\GameInputRedistService.exe [435328 2026-08-31] (Microsoft Corporation -> Windows (R) Win 7 DDK provider)
R2 HipsDaemon; C:\Program Files\Huorong\Sysdiag\bin\HipsDaemon.exe [2041592 2026-10-09] (Huorong Security Lab. -> 北京火绒网络科技有限公司)
R3 HRWSCCtrl; C:\Program Files\Huorong\Sysdiag\bin\wsctrlsvc.exe [306376 2026-10-09] (Beijing Huorong Network Technology Co., Ltd. -> 北京火绒网络科技有限公司)
R2 IgoAudioService; C:\Windows\System32\DriverStore\FileRepository\igoaudioservice.inf_amd64_fad4a7a67c651a34\IgoAudioService_x64.exe [39192 2025-04-01] (British Cayman Islands Intelligo Technology Inc. Taiwan Branch -> Intelligo Technology Inc.)
R2 IntelAudioService; C:\Windows\System32\DriverStore\FileRepository\intcoed.inf_amd64_3f27c0e4d2852503\AS\IAS\IntelAudioService.exe [363440 2025-04-01] (Intel Corporation -> Intel)
S2 IntelDisplayUMService; C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_aa232d5fe3bbb115\IntelDisplayUMService.exe [392624 2025-04-01] (Intel Corporation -> Intel Corporation)
R2 ipfsvc; C:\Windows\System32\DriverStore\FileRepository\ipf_cpu.inf_amd64_4b6a23f61a3d7da1\ipf_uf.exe [3105856 2025-04-01] (Intel Corporation -> Intel Corporation)
S3 IsoSessionCore; C:\Windows\System32\IsoSessionCoreServer.dll [184320 2026-10-14] (Microsoft Windows -> Microsoft Corporation)
S3 klvssbridge64_21.27; C:\Program Files (x86)\Kaspersky Lab\Kaspersky 21.27\x64\vssbridge64.exe [299024 2026-09-30] (AO Kaspersky Lab -> AO Kaspersky Lab)
R2 LGHUBUpdaterService; C:\Program Files\LGHUB\lghub_updater.exe [25021592 2026-09-30] (Logitech Inc -> Logitech, Inc.)
R2 LightKeeperService; C:\Program Files (x86)\MSI\MSI Center\Mystic Light\LightKeeperService.exe [92768 2023-05-10] (MICRO-STAR INTERNATIONAL CO., LTD. -> Micro-Star INT'L CO., LTD.)
R2 logi_lamparray_service; C:\Windows\System32\DriverStore\FileRepository\logi_lamparray_usb.inf_amd64_0efdf0d8d6ee547b\logi_lamparray_service.AMD64.exe [11815816 2026-08-27] (Logitech Inc -> Logitech, Inc.)
S3 MDCoreSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpDefenderCoreService.exe [2307776 2026-09-18] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 Micro Star SCM; C:\Windows\SysWOW64\MSIService.exe [170544 2026-06-26] (Micro-Star International CO., LTD. -> Micro-Star International Co., Ltd.)
R2 MSI Foundation Service; C:\Program Files (x86)\MSI\MSI NBFoundation Service\MSIAPService.exe [142440 2026-09-09] (Micro-Star International CO., LTD. -> Micro-Star International Co., Ltd.)
R2 MSI Sendevsvc; C:\Program Files (x86)\MSI\MSI NBFoundation Service\Sendevsvc.exe [313392 2026-07-28] (Micro-Star International CO., LTD. -> )
R2 MSI_Center_Service; C:\Program Files (x86)\MSI\MSI Center\MSI_Central_Service.exe [183368 2026-09-10] (MICRO-STAR INTERNATIONAL CO., LTD. -> Micro-Star Int'l Co., Ltd.)
R2 Mystic_Light_Service; C:\Program Files (x86)\MSI\MSI Center\Mystic Light\Mystic_Light_Service.exe [41064 2024-04-23] (MICRO-STAR INTERNATIONAL CO., LTD. -> Micro-Star Int'l Co., Ltd.)
R2 NahimicService; C:\Windows\System32\NahimicService.exe [1910808 2025-06-30] (SteelSeries France SASU -> Nahimic)
S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [13809968 2025-08-27] (INCA Internet Co.,Ltd. -> INCA Internet Co., Ltd.)
R2 NVDisplay.ContainerLocalSystem; C:\Windows\System32\DriverStore\FileRepository\nvmii.inf_amd64_7251a3c076e80d80\Display.NvContainer\NVDisplay.Container.exe [1702632 2026-09-06] (NVIDIA Corporation -> NVIDIA Corporation)
R2 OfficePLUS Service; C:\Program Files\Microsoft OfficePLUS\3.16.0.46159\addin\MSOfficePLUSService.exe [80456 2026-04-14] (Microsoft Corporation -> MSOfficePLUSService)
S3 OneDrive Updater Service; C:\Program Files\Microsoft OneDrive\26.178.0913.0007\OneDriveUpdaterService.exe [4110184 2026-10-10] (Microsoft Corporation -> Microsoft Corporation)
R2 PCManager Service Store; C:\Program Files\WindowsApps\Microsoft.MicrosoftPCManager_3.3.15.0_x64__8wekyb3d8bbwe\PCManager\MSPCManagerService.exe [153648 2024-06-04] (Microsoft Corporation -> )
R2 ProcessGovernor; C:\Program Files\Process Lasso\processgovernor.exe [1349112 2026-03-03] (Bitsum Technologies (Bitsum LLC) -> Bitsum LLC)
S3 Rockstar Service; D:\Rockstar Games\Launcher\RockstarService.exe [1683576 2026-07-20] (Rockstar Games, Inc. -> Rockstar Games)
R2 SaiDOutput; C:\Program Files\Logitech\DirectOutput\DirectOutputService.exe [231560 2018-09-03] (Logitech Inc -> Logitech)
R2 TBService; C:\Program Files\Thunderbolt Share\TBService.exe [3018608 2025-02-14] (Intel Corporation -> Intel Corporation)
R2 Wallpaper Engine Service; D:\SteamLibrary\steamapps\common\wallpaper_engine\wallpaper32.exe [4303856 2026-07-06] (Skutta Software GmbH -> Skutta Software GmbH)
S3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\NisSrv.exe [5311776 2026-09-18] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MsMpEng.exe [291360 2026-09-18] (Microsoft Windows Publisher -> Microsoft Corporation)

===================== Drivers (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 BTHMODEM; C:\Windows\System32\drivers\bthmodem.sys [114688 2025-09-10] (Microsoft Corporation) [File not signed]
S3 Ccx01000; C:\Windows\System32\drivers\Ccx01000.sys [692224 2026-10-14] (Microsoft Windows -> Microsoft Corporation)
R0 cm_km; C:\Windows\System32\DRIVERS\cm_km.sys [228448 2026-09-30] (Microsoft Windows Hardware Compatibility Publisher -> Kaspersky)
R0 fse; C:\Windows\System32\drivers\fse.sys [240968 2026-10-14] (Microsoft Windows -> Microsoft Corporation)
R3 FvKMDSvc; \??\C:\Windows\system32\VRFCAT-Plugins\FrameViewKM_x64.sys [29248 2026-07-28] (NVIDIA Corporation -> )
R3 hidgamepad; C:\Windows\System32\DriverStore\FileRepository\hidgamepad.inf_amd64_66e5eb14670e10ae\hidgamepad.sys [73728 2026-10-14] (Microsoft Windows -> Microsoft Corporation)
R0 hrdevmon; C:\Windows\System32\DRIVERS\hrdevmon.sys [58032 2026-10-09] (Microsoft Windows Hardware Compatibility Publisher -> Beijing Huorong Network Technology Co., Ltd.)
R1 hrndis6; C:\Windows\system32\DRIVERS\hrndis6.sys [49840 2026-10-09] (Microsoft Windows Hardware Compatibility Publisher -> Beijing Huorong Network Technology Co., Ltd.)
R2 hrwfpdrv; C:\Windows\System32\DRIVERS\hrwfpdrv.sys [191664 2026-10-09] (Microsoft Windows Hardware Compatibility Publisher -> Beijing Huorong Network Technology Co., Ltd.)
R3 iaLPSS2_GPIO2_MTL_S; C:\Windows\System32\DriverStore\FileRepository\ialpss2_gpio2_mtl_s.inf_amd64_28f3fe1c15edc39c\iaLPSS2_GPIO2_MTL_S.sys [176616 2025-04-01] (Intel Corporation -> Intel Corporation)
R3 iaLPSS2_I2C_MTL_S; C:\Windows\System32\DriverStore\FileRepository\ialpss2_i2c_mtl_s.inf_amd64_6ba0327da07376ff\iaLPSS2_I2C_MTL_S.sys [214616 2025-04-01] (Intel Corporation -> Intel Corporation)
S3 iaLPSS2_I3C_MTL_S; C:\Windows\System32\DriverStore\FileRepository\ialpss2_i3c_mtl_s.inf_amd64_49ff4429f9bd5f14\iaLPSS2_I3C_MTL_S.sys [153176 2025-04-01] (Intel Corporation -> Intel Corporation)
S3 iaLPSS2_SPI_MTL_S; C:\Windows\System32\DriverStore\FileRepository\ialpss2_spi_mtl_s.inf_amd64_24bd9dbaf62db8a4\iaLPSS2_SPI_MTL_S.sys [164328 2025-04-01] (Intel Corporation -> Intel Corporation)
S3 iaLPSS2_UART2_MTL_S; C:\Windows\System32\DriverStore\FileRepository\ialpss2_uart2_mtl_s.inf_amd64_c23e5bbfc3d41c87\iaLPSS2_UART2_MTL_S.sys [322136 2025-04-01] (Intel Corporation -> Intel Corporation)
R0 iaStorVD; C:\Windows\System32\drivers\iaStorVD.sys [1623136 2024-12-09] (Intel Corporation -> Intel Corporation)
R3 IntcBtLE; C:\Windows\System32\DriverStore\FileRepository\intcbtle.inf_amd64_bb884529e7a7ec47\IntcBtLE.sys [170440 2025-04-01] (Intel Corporation -> Intel(R) Corporation)
R0 IntcPMT; C:\Windows\System32\DriverStore\FileRepository\intcpmt.inf_amd64_7a61591fddff4def\intcpmt.sys [66808 2025-04-01] (Intel Corporation -> Intel Corporation)
S3 IntcSdwBus; C:\Windows\System32\DriverStore\FileRepository\intcsdwbus.inf_amd64_4c54c2efd8e56be7\IntcSdwBus.sys [647624 2025-04-01] (Intel Corporation -> Intel(R) Corporation)
R3 IntcUSB; C:\Windows\System32\DriverStore\FileRepository\intcusb.inf_amd64_9243944f4484f5e9\IntcUSB.sys [947144 2025-04-01] (Intel Corporation -> Intel(R) Corporation)
R3 IntelGNA; C:\Windows\System32\DriverStore\FileRepository\gna.inf_amd64_8e2f374849f1eba9\gna.sys [90304 2025-04-01] (Intel Corporation -> Intel Corporation)
R3 ipf_acpi; C:\Windows\System32\DriverStore\FileRepository\ipf_acpi.inf_amd64_dbcf6ccfb499ed06\ipf_acpi.sys [90176 2025-04-01] (Intel Corporation -> Intel Corporation)
R3 ipf_cpu; C:\Windows\System32\DriverStore\FileRepository\ipf_cpu.inf_amd64_4b6a23f61a3d7da1\ipf_cpu.sys [89664 2025-04-01] (Intel Corporation -> Intel Corporation)
R3 ipf_lf; C:\Windows\System32\DriverStore\FileRepository\ipf_cpu.inf_amd64_4b6a23f61a3d7da1\ipf_lf.sys [504896 2025-04-01] (Intel Corporation -> Intel Corporation)
R3 ipf_smbus; C:\Windows\System32\DriverStore\FileRepository\ipf_smbus.inf_amd64_c859bf41768f468f\ipf_smbus.sys [73304 2025-04-01] (Intel Corporation -> Intel Corporation)
R1 klbackupdisk.K4W-21-27; C:\Windows\system32\DRIVERS\K4W-21-27\klbackupdisk.sys [93368 2026-09-30] (Microsoft Windows Hardware Compatibility Publisher -> Kaspersky)
R1 klbackupflt.K4W-21-27; C:\Windows\System32\DRIVERS\K4W-21-27\klbackupflt.sys [245432 2026-09-30] (Microsoft Windows Hardware Compatibility Publisher -> Kaspersky)
R1 kldisk.K4W-21-27; C:\Windows\system32\DRIVERS\K4W-21-27\kldisk.sys [109752 2026-09-30] (Microsoft Windows Hardware Compatibility Publisher -> Kaspersky)
S0 klelam; C:\Windows\System32\DRIVERS\klelam.sys [48776 2026-09-30] (Microsoft Windows Early Launch Anti-malware Publisher -> AO Kaspersky Lab)
R1 klflt.K4W-21-27; C:\Windows\system32\DRIVERS\K4W-21-27\klflt.sys [734912 2026-09-30] (Microsoft Windows Hardware Compatibility Publisher -> Kaspersky)
R1 klgse.K4W-21-27; C:\Windows\System32\DRIVERS\K4W-21-27\klgse.sys [920112 2026-10-15] (Microsoft Windows Hardware Compatibility Publisher -> Kaspersky)
R1 klhk.K4W-21-27; C:\Windows\system32\DRIVERS\K4W-21-27\klhk.sys [3520584 2026-10-15] (Microsoft Windows Hardware Compatibility Publisher -> Kaspersky)
R3 klids.K4W-21-27; \??\C:\ProgramData\Kaspersky Lab\AVP21.27\Bases\klids.sys [242808 2026-10-15] (Microsoft Windows Hardware Compatibility Publisher -> )
S3 klids_dg.K4W-21-27; \??\C:\ProgramData\Kaspersky Lab\AVP21.27\Bases\klids.sys [242808 2026-10-15] (Microsoft Windows Hardware Compatibility Publisher -> )
R1 KLIF.K4W-21-27; C:\Windows\System32\DRIVERS\K4W-21-27\klif.sys [1552056 2026-09-30] (Microsoft Windows Hardware Compatibility Publisher -> Kaspersky)
R1 klim6; C:\Windows\system32\DRIVERS\klim6.sys [91832 2026-09-30] (Microsoft Windows Hardware Compatibility Publisher -> Kaspersky)
R1 klkbdflt.K4W-21-27; C:\Windows\system32\DRIVERS\K4W-21-27\klkbdflt.sys [101568 2026-09-30] (Microsoft Windows Hardware Compatibility Publisher -> Kaspersky)
R3 klmouflt.K4W-21-27; C:\Windows\system32\DRIVERS\K4W-21-27\klmouflt.sys [96448 2026-09-30] (Microsoft Windows Hardware Compatibility Publisher -> Kaspersky)
R1 klpnpflt.K4W-21-27; C:\Windows\system32\DRIVERS\K4W-21-27\klpnpflt.sys [97464 2026-09-30] (Microsoft Windows Hardware Compatibility Publisher -> Kaspersky)
R0 klupd_K4W-21-27_arkmon; C:\Windows\System32\Drivers\klupd_K4W-21-27_arkmon.sys [449360 2026-10-15] (Microsoft Windows Hardware Compatibility Publisher -> Kaspersky)
R3 klupd_K4W-21-27_klark; C:\Windows\System32\Drivers\klupd_K4W-21-27_klark.sys [371360 2026-10-15] (Microsoft Windows Hardware Compatibility Publisher -> Kaspersky)
R0 klupd_K4W-21-27_klbg; C:\Windows\System32\Drivers\klupd_K4W-21-27_klbg.sys [156504 2026-10-15] (Microsoft Windows Hardware Compatibility Publisher -> Kaspersky)
R3 klupd_K4W-21-27_mark; C:\Windows\System32\Drivers\klupd_K4W-21-27_mark.sys [309416 2026-10-15] (Microsoft Windows Hardware Compatibility Publisher -> Kaspersky)
R1 klwtp.K4W-21-27; C:\Windows\system32\DRIVERS\K4W-21-27\klwtp.sys [574648 2026-09-30] (Microsoft Windows Hardware Compatibility Publisher -> Kaspersky)
R1 kneps.K4W-21-27; C:\Windows\system32\DRIVERS\K4W-21-27\kneps.sys [500416 2026-09-30] (Microsoft Windows Hardware Compatibility Publisher -> Kaspersky)
S3 KslD; C:\Windows\System32\drivers\wd\KslD.sys [83008 2026-09-03] (Microsoft Windows -> Microsoft Corporation)
S2 l1vhlwf; C:\Windows\System32\drivers\l1vhlwf.sys [155000 2026-10-14] (Microsoft Windows -> Microsoft Corporation)
R3 logi_joy_bus_enum; C:\Windows\System32\drivers\logi_joy_bus_enum.x64.sys [45448 2026-04-16] (Logitech Inc -> Logitech)
R3 logi_joy_vir_hid; C:\Windows\System32\drivers\logi_joy_vir_hid.x64.sys [32648 2026-04-16] (Logitech Inc -> Logitech)
R3 logi_joy_xlcore; C:\Windows\System32\drivers\logi_joy_xlcore.x64.sys [74632 2026-04-16] (Logitech Inc -> Logitech)
R3 logi_lamparray; C:\Windows\System32\DriverStore\FileRepository\logi_lamparray_usb.inf_amd64_0efdf0d8d6ee547b\logi_lamparray.AMD64.sys [89480 2026-08-27] (Logitech Inc -> Logitech, Inc.)
R3 LSaiMini; C:\Windows\System32\drivers\LSaiMini.sys [30840 2018-09-04] (WDKTestCert SYSTEM,131245371151827277 -> Logitech)
R3 LSaiNtBus; C:\Windows\system32\drivers\LSaiBus.sys [70456 2018-09-04] (WDKTestCert SYSTEM,131245371151827277 -> Logitech)
S3 LT6911Au; C:\Windows\System32\DriverStore\FileRepository\lt6911au.inf_amd64_eb32461cad3c21f7\LT6911Au.sys [68528 2025-04-01] (Intel Corporation -> Intel(R) Corporation)
S3 MpKslf4a91237; \??\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Default\MpKslDrv.sys [263560 2024-06-04] (Microsoft Windows -> )
R1 MSIO; \??\C:\Windows\system32\drivers\MsIo64.sys [19672 2023-12-10] (Microsoft Windows Hardware Compatibility Publisher -> )
R3 NahimicBTLink; C:\Windows\System32\drivers\NahimicBTLink.sys [95856 2024-05-13] (A-Volute SAS -> Windows (R) Win 7 DDK provider)
R3 Nahimic_Mirroring; C:\Windows\System32\drivers\Nahimic_Mirroring.sys [95896 2024-05-15] (A-Volute SAS -> Windows (R) Win 7 DDK provider)
R3 npu; C:\Windows\System32\DriverStore\FileRepository\npu.inf_amd64_b5234cb0f8a3327c\npu_kmd.sys [594152 2025-04-01] (Intel Corporation -> Intel(R) Corporation)
R3 npusbio; C:\Windows\System32\Drivers\npusbio_x64.sys [38400 2019-03-07] (NaturalPoint, Inc -> )
R3 nvpcf; C:\Windows\System32\drivers\nvpcf.sys [313064 2026-09-05] (NVIDIA Corporation -> NVIDIA Corporation)
R3 rt25cx21; C:\Windows\System32\DriverStore\FileRepository\rt25cx21x64.inf_amd64_7ac7d413a2dbc3d4\rt25cx21x64.sys [921128 2025-12-15] (Realtek Semiconductor Corp. -> Realtek)
S3 rtcx21; C:\Windows\System32\DriverStore\FileRepository\rtcx21x64.inf_amd64_feec7a9662e785f0\rtcx21x64.sys [539648 2024-03-28] (Microsoft Windows -> Realtek)
R3 SaiG2221; C:\Windows\System32\drivers\SaiG2221.sys [227128 2018-09-04] (WDKTestCert SYSTEM,131245371151827277 -> Logitech)
R3 SaiGa221; C:\Windows\System32\drivers\SaiGa221.sys [227128 2018-09-04] (WDKTestCert SYSTEM,131245371151827277 -> Logitech)
R3 SaiK2221; C:\Windows\system32\DRIVERS\SaiK2221.sys [227128 2018-09-04] (WDKTestCert SYSTEM,131245371151827277 -> Logitech)
R3 SaiKa221; C:\Windows\system32\DRIVERS\SaiKa221.sys [227128 2018-09-04] (WDKTestCert SYSTEM,131245371151827277 -> Logitech)
S3 SaiMini; C:\Windows\System32\drivers\SaiMini.sys [24184 2016-05-23] (Mad Catz Europe Ltd -> Saitek)
S3 SaiNtBus; C:\Windows\system32\drivers\SaiBus.sys [59768 2016-05-23] (Mad Catz Europe Ltd -> Saitek)
R3 SaiU2221; C:\Windows\system32\DRIVERS\SaiU2221.sys [33512 2018-09-04] (WDKTestCert SYSTEM,131245371151827277 -> Logitech)
R3 SaiUa221; C:\Windows\system32\DRIVERS\SaiUa221.sys [33512 2018-09-04] (WDKTestCert SYSTEM,131245371151827277 -> Logitech)
R1 sysdiag; C:\Windows\System32\DRIVERS\sysdiag.sys [560304 2026-10-09] (Microsoft Windows Hardware Compatibility Publisher -> Beijing Huorong Network Technology Co., Ltd.)
R3 tap0901; C:\Windows\System32\drivers\tap0901.sys [27136 2025-10-25] (OpenVPN Technologies, Inc. -> The OpenVPN Project)
S3 uunetfilter; \??\C:\Windows\System32\drivers\uunetfilter.sys [107784 2026-01-16] (NetEase (Hangzhou) Network Co., Ltd -> )
S3 uuwfp; \??\C:\Windows\System32\drivers\uuwfp.sys [65600 2024-07-10] (NetEase (Hangzhou) Network Co., Ltd -> )
R3 VCamSDK; C:\Windows\system32\DRIVERS\VCamSDK.sys [1092456 2026-07-12] (Shanghai Yitu Information Technology Co., Ltd. -> e2eSoft)
S3 vmbusproxy; C:\Windows\system32\drivers\vmbusproxy.sys [98304 2025-08-18] (Microsoft Windows -> Microsoft Corporation)
R3 vmulti; C:\Windows\System32\drivers\vmulti.sys [20496 2026-06-20] (Microsoft Windows Hardware Compatibility Publisher -> Windows (R) Win 7 DDK provider)
S4 WdAiNisDrv; C:\Windows\System32\drivers\wd\WdAiNisDrv.sys [51264 2026-09-18] (Microsoft Windows -> Microsoft Corporation)
S3 WdBoot; C:\Windows\system32\drivers\wd\WdBoot.sys [21632 2026-09-18] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\wd\WdFilter.sys [664592 2026-09-18] (Microsoft Windows -> Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\drivers\wd\WdNisDrv.sys [137240 2026-09-18] (Microsoft Windows -> Microsoft Corporation)

==================== SvcHost (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One month (created) (Whitelisted) =========

(If an entry is included in the fixlist, the file/folder will be moved.)

2026-9-28 1:25 - 2026-9-28 1:25 - 000000000 ____D C:\ProgramData\Documents\Logitech
2026-10-16 01:18 - 2026-10-16 01:18 - 000395468 _____ C:\Windows\system32\prfh0804.dat
2026-10-16 01:18 - 2026-10-16 01:18 - 000132074 _____ C:\Windows\system32\prfc0804.dat
2026-10-16 01:05 - 2026-10-16 01:13 - 000694650 _____ C:\Windows\ntbtlog.txt
2026-10-16 01:05 - 2026-10-16 01:05 - 000000214 _____ C:\Windows\Tasks\CreateExplorerShellUnelevatedTask.job
2026-10-16 00:33 - 2026-10-16 00:34 - 000000238 _____ C:\Users\o0the\Downloads\Search.txt
2026-10-16 00:27 - 2026-10-16 01:46 - 000093356 _____ C:\Users\o0the\Downloads\Addition.txt
2026-10-16 00:24 - 2026-10-16 01:47 - 000055417 _____ C:\Users\o0the\Downloads\FRST.txt
2026-10-16 00:24 - 2026-10-16 01:47 - 000000000 ____D C:\FRST
2026-10-16 00:23 - 2026-10-16 00:24 - 002456064 _____ (Farbar) C:\Users\o0the\Downloads\FRST64English.exe
2026-10-16 00:22 - 2026-10-16 00:23 - 002139648 _____ (Farbar) C:\Users\o0the\Downloads\FRST.exe
2026-10-16 00:16 - 2026-10-16 00:16 - 003183752 _____ C:\Users\o0the\Downloads\Autoruns.zip
2026-10-15 22:01 - 2026-10-15 22:01 - 000003214 _____ C:\Windows\system32\Tasks\Kaspersky_Upgrade_Launcher_{278ADC42-419D-4547-A6CA-5B74BE0AD901}
2026-10-15 22:01 - 2026-10-15 22:01 - 000002422 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\カスペルスキー.lnk
2026-10-15 22:01 - 2026-10-15 22:01 - 000002263 _____ C:\Users\Public\Desktop\カスペルスキー.lnk
2026-10-15 22:00 - 2026-10-15 22:01 - 000000000 ____D C:\Windows\system32\Drivers\K4W-21-27
2026-10-15 22:00 - 2026-10-15 22:00 - 000000000 ____D C:\Program Files (x86)\Kaspersky Lab
2026-10-15 21:59 - 2026-10-15 21:59 - 000000000 ____D C:\ProgramData\Kaspersky Lab Setup Files
2026-10-15 21:57 - 2026-10-15 21:58 - 007079176 _____ (カスペルスキー) C:\Users\o0the\Downloads\kaspersky4win202121.27.6.532ja_46673.exe
2026-10-15 21:37 - 2026-10-16 01:14 - 000000000 ____D C:\Windows\CbsTemp
2026-10-14 22:13 - 2026-10-14 22:15 - 000000000 ___HD C:\$WinREAgent
2026-10-14 22:01 - 2026-10-14 22:01 - 000004985 _____ C:\Windows\system32\DeviceFeatureDDF.json
2026-10-14 22:00 - 2026-10-14 22:00 - 000091797 _____ C:\Windows\SysWOW64\ctac.json
2026-10-14 22:00 - 2026-10-14 22:00 - 000091797 _____ C:\Windows\system32\ctac.json
2026-10-14 22:00 - 2026-10-14 22:00 - 000039736 _____ C:\Windows\SysWOW64\IntegratedServicesRegionPolicySet.json
2026-10-14 22:00 - 2026-10-14 22:00 - 000039736 _____ C:\Windows\system32\IntegratedServicesRegionPolicySet.json
2026-10-10 22:56 - 2026-10-10 22:56 - 000000000 ____D C:\Users\o0the\AppData\LocalLow\PaconeSoft
2026-10-09 22:36 - 2026-10-09 22:36 - 000001071 _____ C:\Users\Public\Desktop\火绒安全软件.lnk
2026-10-09 22:36 - 2026-10-09 22:36 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\火绒安全实验室
2026-10-09 22:35 - 2026-10-09 22:35 - 000213664 _____ (Beijing Huorong Network Technology Co., Ltd.) C:\Windows\system32\dtrampo.dll
2026-10-09 22:35 - 2026-10-09 22:35 - 000000000 ____D C:\ProgramData\Huorong
2026-10-09 22:24 - 2026-10-15 22:01 - 000000000 ____D C:\Program Files\Common Files\AV
2026-10-09 22:24 - 2026-10-15 22:00 - 000000000 ____D C:\ProgramData\Kaspersky Lab
2026-10-09 13:57 - 2026-10-09 13:57 - 000000000 ____D C:\Windows\Microsoft Antimalware
2026-10-08 23:20 - 2026-10-08 23:20 - 000000000 ____D C:\Users\o0the\AppData\Local\ElevatedDiagnostics
2026-10-08 20:14 - 2026-10-08 21:03 - 000000000 ___HD C:\$SysReset
2026-10-08 19:17 - 2026-10-09 22:36 - 000000000 ____D C:\Program Files\Huorong
2026-10-08 02:26 - 2026-10-08 02:26 - 000000000 ____D C:\Users\o0the\AppData\Local\WindowsOobeAppHost
2026-10-08 02:06 - 2026-10-08 02:06 - 000003322 _____ C:\Windows\system32\Tasks\BackgroundTask
2026-10-08 02:05 - 2026-10-08 02:05 - 000000000 ____D C:\Users\o0the\AppData\Local\Wacom
2026-10-08 02:05 - 2026-10-08 02:05 - 000000000 ____D C:\Users\o0the\AppData\Local\Synaptics
2026-10-08 02:02 - 2026-10-08 02:02 - 000000000 ____D C:\Users\o0the\AppData\Roaming\RenPy
2026-10-02 23:53 - 2026-10-02 23:53 - 000000000 ____D C:\Program Files\Common Files\DESIGNER
2026-10-01 19:29 - 2026-10-01 19:29 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logi
2026-10-01 19:29 - 2026-10-01 19:29 - 000000000 ____D C:\Program Files\LGHUB
2026-09-30 19:59 - 2026-09-30 19:59 - 000003646 _____ C:\Windows\system32\Tasks\OneDC_Updater
2026-09-30 19:59 - 2026-09-30 19:59 - 000002974 _____ C:\Windows\system32\Tasks\OmApSvcBroker
2026-09-29 18:11 - 2026-09-29 18:11 - 000000000 ____D C:\Users\o0the\AppData\Local\BANDAI NAMCO Entertainment
2026-09-29 01:09 - 2026-09-29 01:09 - 001472519 _____ C:\Users\o0the\Downloads\0020078010089.pdf
2026-09-28 01:32 - 2026-09-28 01:32 - 000000000 ____D C:\Users\o0the\AppData\Local\SmartTechnology
2026-09-28 01:25 - 2026-10-15 21:39 - 000000000 ____D C:\Users\Public\Logi
2026-09-28 01:25 - 2026-09-28 01:25 - 000003027 _____ C:\Users\o0the\Desktop\X56 H.O.T.A.S..lnk
2026-09-28 01:25 - 2026-09-28 01:25 - 000000000 ____D C:\Users\Public\Documents\Logitech
2026-09-28 01:25 - 2018-09-04 16:21 - 000864264 _____ C:\Windows\system32\SaiC2221.Dll
2026-09-28 01:25 - 2018-09-04 16:21 - 000862848 _____ C:\Windows\system32\SaiCa221.Dll
2026-09-28 01:25 - 2018-09-04 16:21 - 000600704 _____ C:\Windows\system32\Saitek.CLR.X56Pages.dll
2026-09-28 01:25 - 2018-09-04 16:21 - 000318584 _____ C:\Windows\system32\Sd.WpfControls.dll
2026-09-28 01:25 - 2018-09-04 16:21 - 000227128 _____ (Logitech) C:\Windows\system32\Drivers\SaiK2221.sys
2026-09-28 01:25 - 2018-09-04 16:21 - 000188056 _____ C:\Windows\system32\Saitek.CLR.DataSource.dll
2026-09-28 01:25 - 2018-09-04 16:21 - 000071808 _____ () C:\Windows\system32\Saitek.WPF.UserControls.dll
2026-09-28 01:25 - 2018-09-04 16:21 - 000048768 _____ () C:\Windows\system32\Saitek.WPF.X56Pages.dll
2026-09-28 01:25 - 2018-09-04 16:21 - 000027656 _____ C:\Windows\system32\SaiC2221_07.dll
2026-09-28 01:25 - 2018-09-04 16:21 - 000026752 _____ C:\Windows\system32\SaiCa221_0C.dll
2026-09-28 01:25 - 2018-09-04 16:21 - 000026744 _____ C:\Windows\system32\SaiC2221_0C.dll
2026-09-28 01:25 - 2018-09-04 16:21 - 000026632 _____ C:\Windows\system32\SaiC2221_09.dll
2026-09-28 01:25 - 2018-09-04 16:21 - 000026632 _____ C:\Windows\system32\SaiC2221_05.dll
2026-09-28 01:25 - 2018-09-04 16:21 - 000026240 _____ C:\Windows\system32\SaiCa221_10.dll
2026-09-28 01:25 - 2018-09-04 16:21 - 000026240 _____ C:\Windows\system32\SaiCa221_0A.dll
2026-09-28 01:25 - 2018-09-04 16:21 - 000026240 _____ C:\Windows\system32\SaiCa221_07.dll
2026-09-28 01:25 - 2018-09-04 16:21 - 000026232 _____ C:\Windows\system32\SaiC2221_10.dll
2026-09-28 01:25 - 2018-09-04 16:21 - 000026232 _____ C:\Windows\system32\SaiC2221_0A.dll
2026-09-28 01:25 - 2018-09-04 16:21 - 000026120 _____ C:\Windows\system32\SaiC2221_0402.dll
2026-09-28 01:25 - 2018-09-04 16:21 - 000025728 _____ C:\Windows\system32\SaiCa221_19.dll
2026-09-28 01:25 - 2018-09-04 16:21 - 000025728 _____ C:\Windows\system32\SaiC2221_19.dll
2026-09-28 01:25 - 2018-09-04 16:21 - 000025216 _____ C:\Windows\system32\SaiCa221_09.dll
2026-09-28 01:25 - 2018-09-04 16:21 - 000025216 _____ C:\Windows\system32\SaiCa221_05.dll
2026-09-28 01:25 - 2018-09-04 16:21 - 000024704 _____ C:\Windows\system32\SaiCa221_0402.dll
2026-09-28 01:25 - 2018-09-04 16:21 - 000023680 _____ C:\Windows\system32\SaiCa221_11.dll
2026-09-28 01:25 - 2018-09-04 16:21 - 000023680 _____ C:\Windows\system32\SaiC2221_11.dll
2026-09-28 01:25 - 2018-09-04 16:21 - 000023192 _____ C:\Windows\system32\SaiCa221_12.dll
2026-09-28 01:25 - 2018-09-04 16:21 - 000023168 _____ C:\Windows\system32\SaiC2221_12.dll
2026-09-28 01:24 - 2026-09-28 01:24 - 032692760 _____ (Igor Pavlov) C:\Users\o0the\Downloads\X56_HOTAS_x64_8_0_213_0.exe
2026-09-28 01:22 - 2026-09-28 01:22 - 000000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_SaiUa221_01009.Wdf
2026-09-28 01:16 - 2026-09-28 01:16 - 000000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_SaiU2221_01009.Wdf
2026-09-28 01:15 - 2018-09-04 16:21 - 000227128 _____ (Logitech) C:\Windows\system32\Drivers\SaiKa221.sys
2026-09-28 01:15 - 2018-09-04 16:21 - 000227128 _____ (Logitech) C:\Windows\system32\Drivers\SaiGa221.sys
2026-09-28 01:15 - 2018-09-04 16:21 - 000227128 _____ (Logitech) C:\Windows\system32\Drivers\SaiG2221.sys
2026-09-28 01:15 - 2018-09-04 16:21 - 000033512 _____ (Logitech) C:\Windows\system32\Drivers\SaiUa221.sys
2026-09-28 01:15 - 2018-09-04 16:21 - 000033512 _____ (Logitech) C:\Windows\system32\Drivers\SaiU2221.sys
2026-09-28 00:58 - 2026-09-28 00:58 - 027805288 _____ (Igor Pavlov) C:\Users\o0the\Downloads\X56_HOTAS_x64_8_0_132_0.exe
2026-09-28 00:58 - 2018-09-04 16:21 - 000070456 _____ (Logitech) C:\Windows\system32\Drivers\LSaiBus.sys
2026-09-28 00:58 - 2018-09-04 16:21 - 000030840 _____ (Logitech) C:\Windows\system32\Drivers\LSaiMini.sys
2026-09-28 00:26 - 2026-09-28 00:26 - 000000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_SaiKa221_01009.Wdf
2026-09-28 00:25 - 2026-09-28 00:25 - 000000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_SaiK2221_01009.Wdf
2026-09-28 00:22 - 2026-09-28 00:22 - 006952600 _____ (Mad catz ) C:\Users\o0the\Downloads\X56_Rhino_7_0_56_6_x64_Drivers.exe
2026-09-28 00:15 - 2026-09-28 00:15 - 000388998 _____ C:\Users\o0the\Downloads\Profiles Pack.zip
2026-09-27 18:02 - 2026-09-27 18:02 - 000000812 _____ C:\Users\o0the\AppData\Local\recently-used.xbel
2026-09-26 01:36 - 2026-09-26 01:36 - 000693646 _____ C:\Users\o0the\Downloads\La-7_Fin_Simple_Checklist.zip
2026-09-26 01:30 - 2026-09-26 01:30 - 004597897 _____ C:\Users\o0the\Downloads\Mosquito_Checklists.zip
2026-09-23 22:26 - 2026-09-23 22:26 - 000000000 ____D C:\Program Files\Microsoft GameInput
2026-09-22 00:55 - 2026-09-22 00:55 - 043565048 _____ (网易(杭州)网络有限公司) C:\Users\o0the\Downloads\UU-6.19.0.exe
2026-09-22 00:55 - 2026-09-22 00:55 - 000001814 _____ C:\Users\Public\Desktop\UU加速器.lnk
2026-09-22 00:55 - 2026-09-22 00:55 - 000001132 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UU加速器.lnk
2026-09-21 22:05 - 2026-09-21 22:05 - 000000000 ____D C:\Users\o0the\Documents\OneNote Notebooks
2026-09-21 03:17 - 2026-09-21 03:17 - 067991251 _____ C:\Users\o0the\Downloads\Ace_Combat_-_15_Escadre_de_Chasse_fRuleru.zip
2026-09-21 03:16 - 2026-09-21 03:16 - 097389037 _____ C:\Users\o0the\Downloads\Ustio_Air_Force_Mirage_F1_pack.zip
2026-09-19 17:39 - 2026-09-19 17:39 - 004423938 _____ C:\Users\o0the\Downloads\F-86F_Checklists.zip
2026-09-19 17:34 - 2026-09-19 17:34 - 068277983 _____ C:\Users\o0the\Downloads\Skins_F-86F_Blue_Impulse.zip
2026-09-19 17:26 - 2026-09-19 17:26 - 017245252 _____ C:\Users\o0the\Downloads\ROCAF.7z

==================== One month (modified) ==================

(If an entry is included in the fixlist, the file/folder will be moved.)

2026-10-16 01:47 - 2025-08-25 20:23 - 000000000 ____D C:\Users\o0the\AppData\Roaming\utorrent
2026-10-16 01:46 - 2025-08-19 01:26 - 000000000 ____D C:\Program Files (x86)\Steam
2026-10-16 01:34 - 2025-04-01 18:57 - 000000000 ____D C:\ProgramData\Common
2026-10-16 01:30 - 2026-08-26 16:12 - 000522736 _____ (Microsoft Corporation) C:\Windows\system32\gamingservicesproxy_13.dll
2026-10-16 01:30 - 2025-08-19 01:04 - 004602352 _____ (Microsoft Corporation) C:\Windows\system32\xgameruntime.dll
2026-10-16 01:30 - 2025-08-19 01:04 - 001194480 _____ (Microsoft Corporation) C:\Windows\system32\gameplatformservices.dll
2026-10-16 01:30 - 2025-08-19 01:04 - 000317936 _____ (Microsoft Corporation) C:\Windows\system32\gamelaunchhelper.dll
2026-10-16 01:30 - 2025-08-19 01:04 - 000272880 _____ (Microsoft Corporation) C:\Windows\system32\gameconfighelper.dll
2026-10-16 01:30 - 2025-08-19 01:04 - 000166384 _____ (Microsoft Corporation) C:\Windows\system32\gamingtcuihelpers.dll
2026-10-16 01:30 - 2025-08-19 01:04 - 000158192 _____ (Microsoft Corporation) C:\Windows\system32\xgamehelper.exe
2026-10-16 01:30 - 2025-08-19 01:04 - 000084464 _____ (Microsoft Corporation) C:\Windows\system32\xgamecontrol.exe
2026-10-16 01:30 - 2024-04-01 16:26 - 000000000 ___HD C:\Program Files\WindowsApps
2026-10-16 01:30 - 2024-04-01 16:26 - 000000000 ____D C:\Windows\SystemTemp
2026-10-16 01:30 - 2024-04-01 16:26 - 000000000 ____D C:\Windows\AppReadiness
2026-10-16 01:28 - 2024-04-01 16:26 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2026-10-16 01:21 - 2024-04-01 16:26 - 000000000 ____D C:\Windows\system32\WinBioDatabase
2026-10-16 01:18 - 2024-06-04 22:05 - 001362192 _____ C:\Windows\system32\PerfStringBackup.INI
2026-10-16 01:18 - 2024-04-01 16:24 - 000000000 ____D C:\Windows\INF
2026-10-16 01:17 - 2025-08-19 00:53 - 000000000 ____D C:\Users\o0the\AppData\Local\D3DSCache
2026-10-16 01:15 - 2025-09-03 01:57 - 000000000 ____D C:\Users\o0the\AppData\Local\BitTorrentHelper
2026-10-16 01:15 - 2025-08-25 16:10 - 000000000 ____D C:\Users\o0the\AppData\Roaming\discord
2026-10-16 01:15 - 2025-08-25 16:10 - 000000000 ____D C:\Users\o0the\AppData\Local\Discord
2026-10-16 01:15 - 2025-08-20 14:18 - 000000000 ____D C:\Users\o0the\AppData\Roaming\QQ
2026-10-16 01:15 - 2025-08-19 00:56 - 000000000 ___RD C:\Users\o0the\OneDrive
2026-10-16 01:14 - 2025-08-19 01:46 - 000018853 _____ C:\Users\o0the\AppData\LocalLow\f07a4c8b083768217a24ad0c73b6a72039384b691c0633740db2cc2681f23788
2026-10-16 01:14 - 2025-08-19 00:30 - 000022922 _____ C:\Windows\system32\5E37410B-D6F1-471D-AE27-563CEAC0D6B2
2026-10-16 01:14 - 2025-04-01 18:09 - 000003108 _____ C:\Windows\system32\Tasks\NahimicTask32
2026-10-16 01:14 - 2025-04-01 18:09 - 000003088 _____ C:\Windows\system32\Tasks\NahimicTask64
2026-10-16 01:14 - 2025-04-01 17:28 - 000000000 ____D C:\MSI
2026-10-16 01:14 - 2025-04-01 17:11 - 000000000 ____D C:\ProgramData\NVIDIA
2026-10-16 01:14 - 2025-04-01 17:08 - 000003308 _____ C:\Windows\system32\Tasks\iGoAudioTask
2026-10-16 01:14 - 2025-04-01 16:55 - 000001623 _____ C:\Windows\system32\config\VSMIDK
2026-10-16 01:14 - 2024-06-04 21:59 - 000012288 ___SH C:\DumpStack.log.tmp
2026-10-16 01:14 - 2024-06-04 21:59 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2026-10-16 01:14 - 2024-04-01 16:26 - 000000000 ____D C:\Windows\ServiceState
2026-10-16 01:13 - 2024-04-01 16:21 - 001048576 _____ C:\Windows\system32\config\BBI
2026-10-16 01:01 - 2026-08-03 14:45 - 000001316 _____ C:\Users\o0the\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Discord.lnk
2026-10-16 01:01 - 2025-08-25 16:10 - 000002255 _____ C:\Users\o0the\Desktop\Discord.lnk
2026-10-15 22:34 - 2025-08-19 01:06 - 000000000 ____D C:\Users\o0the\AppData\Roaming\Microsoft\MMC
2026-10-15 22:01 - 2026-08-31 22:17 - 000027739 _____ C:\Windows\system32\InstallMonitorLog.csv
2026-10-15 22:01 - 2025-08-19 00:53 - 000000000 ____D C:\Users\o0the\AppData\Local\Packages
2026-10-15 22:01 - 2024-06-04 22:01 - 000000000 ____D C:\ProgramData\Packages
2026-10-15 22:01 - 2024-04-01 16:21 - 000032768 _____ C:\Windows\system32\config\ELAM
2026-10-15 22:00 - 2024-04-01 16:26 - 000000000 ___HD C:\Windows\ELAMBKUP
2026-10-15 21:55 - 2024-04-01 16:26 - 000000000 ____D C:\ProgramData\USOPrivate
2026-10-15 21:40 - 2025-08-19 01:05 - 000055743 _____ C:\Users\o0the\AppData\LocalLow\cd888e09bda849ec599bb9d630523133eed8373d344d6d8365147ba8fcf0e05a
2026-10-15 02:26 - 2024-06-04 21:59 - 000662120 _____ C:\Windows\system32\FNTCACHE.DAT
2026-10-15 02:24 - 2024-04-01 16:26 - 000000000 ____D C:\Windows\UUS
2026-10-15 02:24 - 2024-04-01 16:26 - 000000000 ____D C:\Windows\SysWOW64\WinMetadata
2026-10-15 02:24 - 2024-04-01 16:26 - 000000000 ____D C:\Windows\SysWOW64\setup
2026-10-15 02:24 - 2024-04-01 16:26 - 000000000 ____D C:\Windows\SysWOW64\oobe
2026-10-15 02:24 - 2024-04-01 16:26 - 000000000 ____D C:\Windows\SysWOW64\migwiz
2026-10-15 02:24 - 2024-04-01 16:26 - 000000000 ____D C:\Windows\SysWOW64\InstallShield
2026-10-15 02:24 - 2024-04-01 16:26 - 000000000 ____D C:\Windows\SysWOW64\Dism
2026-10-15 02:24 - 2024-04-01 16:26 - 000000000 ____D C:\Windows\SysWOW64\AdvancedInstallers
2026-10-15 02:23 - 2025-12-21 17:33 - 000000000 ____D C:\Windows\system32\NarratorMCAT
2026-10-15 02:23 - 2025-08-19 00:45 - 000000000 ____D C:\Windows\system32\ruxim
2026-10-15 02:23 - 2024-04-02 01:31 - 000000000 ____D C:\Windows\system32\OpenSSH
2026-10-15 02:23 - 2024-04-02 01:31 - 000000000 ____D C:\Windows\system32\Microsoft-Edge-WebView
2026-10-15 02:23 - 2024-04-01 16:26 - 000000000 ___RD C:\Windows\ImmersiveControlPanel
2026-10-15 02:23 - 2024-04-01 16:26 - 000000000 ____D C:\Windows\SystemResources
2026-10-15 02:23 - 2024-04-01 16:26 - 000000000 ____D C:\Windows\system32\WinMetadata
2026-10-15 02:23 - 2024-04-01 16:26 - 000000000 ____D C:\Windows\system32\WinBioPlugIns
2026-10-15 02:23 - 2024-04-01 16:26 - 000000000 ____D C:\Windows\system32\Sysprep
2026-10-15 02:23 - 2024-04-01 16:26 - 000000000 ____D C:\Windows\system32\ShellExperiences
2026-10-15 02:23 - 2024-04-01 16:26 - 000000000 ____D C:\Windows\system32\setup
2026-10-15 02:23 - 2024-04-01 16:26 - 000000000 ____D C:\Windows\system32\SecureBootUpdates
2026-10-15 02:23 - 2024-04-01 16:26 - 000000000 ____D C:\Windows\system32\oobe
2026-10-15 02:23 - 2024-04-01 16:26 - 000000000 ____D C:\Windows\system32\migwiz
2026-10-15 02:23 - 2024-04-01 16:26 - 000000000 ____D C:\Windows\system32\HealthAttestationClient
2026-10-15 02:23 - 2024-04-01 16:26 - 000000000 ____D C:\Windows\system32\Dism
2026-10-15 02:23 - 2024-04-01 16:26 - 000000000 ____D C:\Windows\system32\DDFs
2026-10-15 02:23 - 2024-04-01 16:26 - 000000000 ____D C:\Windows\system32\appraiser
2026-10-15 02:23 - 2024-04-01 16:26 - 000000000 ____D C:\Windows\system32\AdvancedInstallers
2026-10-15 02:23 - 2024-04-01 16:26 - 000000000 ____D C:\Windows\ShellExperiences
2026-10-15 02:23 - 2024-04-01 16:26 - 000000000 ____D C:\Windows\ShellComponents
2026-10-15 02:23 - 2024-04-01 16:26 - 000000000 ____D C:\Windows\Provisioning
2026-10-15 02:23 - 2024-04-01 16:26 - 000000000 ____D C:\Windows\BrowserCore
2026-10-15 02:23 - 2024-04-01 16:26 - 000000000 ____D C:\Windows\bcastdvr
2026-10-15 02:23 - 2024-04-01 16:26 - 000000000 ____D C:\Program Files\Common Files\System
2026-10-15 02:23 - 2024-04-01 16:21 - 000000000 ____D C:\Windows\servicing
2026-10-15 00:13 - 2026-04-20 21:11 - 000000000 ____D C:\Users\o0the\AppData\Roaming\EasyAntiCheat
2026-10-14 22:00 - 2024-06-04 22:03 - 003387392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PrintConfig.dll
2026-10-14 21:54 - 2025-08-19 02:22 - 000000000 ____D C:\Windows\system32\MRT
2026-10-14 21:51 - 2025-08-19 02:22 - 230303336 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2026-10-14 21:43 - 2024-06-04 21:59 - 000003262 _____ C:\Windows\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA{A045AFFC-B9C3-42F0-88FE-1848D7A16B15}
2026-10-14 21:43 - 2024-06-04 21:59 - 000003190 _____ C:\Windows\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore{FB9CC6D0-7914-4983-A789-A3F6A3A0C641}
2026-10-14 21:37 - 2025-08-19 01:24 - 000002226 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2026-10-14 21:37 - 2025-08-19 01:24 - 000002185 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2026-10-11 22:51 - 2025-08-27 17:25 - 000000000 ____D C:\Program Files\Microsoft OneDrive
2026-10-10 21:03 - 2024-06-04 21:59 - 000002429 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
2026-10-10 20:38 - 2024-06-04 22:06 - 000000000 ____D C:\Program Files\Microsoft Office
2026-10-10 20:32 - 2025-08-25 00:40 - 000003194 _____ C:\Windows\system32\Tasks\OneDrive Per-Machine Standalone Update Task
2026-10-10 20:32 - 2025-08-25 00:40 - 000001936 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2026-10-10 20:32 - 2025-08-23 22:34 - 000003546 _____ C:\Windows\system32\Tasks\OneDrive Startup Task-S-1-5-21-2339272927-596407228-3174859544-1001
2026-10-10 20:32 - 2025-08-19 00:56 - 000003592 _____ C:\Windows\system32\Tasks\OneDrive Reporting Task-S-1-5-21-2339272927-596407228-3174859544-1001
2026-10-09 23:01 - 2025-08-19 01:27 - 000000000 ____D C:\Users\o0the\AppData\Local\Steam
2026-10-09 22:54 - 2024-06-04 21:57 - 000000000 ___DC C:\Windows\Panther
2026-10-08 23:20 - 2024-04-01 16:26 - 000000000 ____D C:\Windows\system32\NDF
2026-10-08 19:30 - 2024-06-04 21:59 - 000000000 ____D C:\Windows\system32\SleepStudy
2026-10-08 02:36 - 2025-08-19 00:51 - 000000000 ____D C:\Users\o0the
2026-10-08 02:26 - 2026-07-21 20:13 - 000000000 ____D C:\Users\o0the\AppData\Local\CloudDriveDesktopWidget
2026-10-08 02:25 - 2024-04-01 16:26 - 000000000 ____D C:\Windows\LiveKernelReports
2026-10-08 02:06 - 2025-08-19 00:53 - 000000000 ___SD C:\Users\o0the\AppData\Roaming\Microsoft\Crypto
2026-10-08 02:04 - 2026-02-24 04:06 - 000000000 ____D C:\Users\o0the\AppData\Local\Programs\Quark
2026-10-08 02:01 - 2025-08-19 02:27 - 000000000 ____D C:\Users\o0the\AppData\Local\CrashDumps
2026-10-04 20:59 - 2025-08-19 01:53 - 000000000 ____D C:\Users\o0the\AppData\Local\NVIDIA Corporation
2026-10-03 04:06 - 2025-08-19 00:58 - 001127032 _____ C:\Users\o0the\AppData\LocalLow\bf806f8da65a2279dc3a13591b42437d3620060fd010ea6735ee0444a5ecfb39
2026-10-03 03:17 - 2026-02-24 04:07 - 000001364 _____ C:\Users\o0the\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\夸克.lnk
2026-10-03 03:17 - 2025-08-19 13:04 - 000000000 ____D C:\Users\o0the\AppData\Local\Programs\Common
2026-10-03 00:00 - 2026-08-26 16:12 - 000522736 _____ (Microsoft Corporation) C:\Windows\system32\gamingservicesproxy_13.dll.0
2026-10-03 00:00 - 2025-08-19 01:04 - 001194480 _____ (Microsoft Corporation) C:\Windows\system32\gameplatformservices.dll.0
2026-10-02 03:08 - 2025-08-19 14:57 - 000000000 ____D C:\Users\o0the\AppData\Roaming\lghub
2026-10-02 03:08 - 2025-08-19 14:57 - 000000000 ____D C:\Users\o0the\AppData\Roaming\G HUB
2026-10-01 19:29 - 2025-08-19 14:57 - 000000000 ____D C:\Users\o0the\AppData\Local\LGHUB
2026-09-30 19:59 - 2025-04-01 17:27 - 000000000 ____D C:\Program Files (x86)\MSI
2026-09-29 18:11 - 2026-04-20 21:11 - 000000000 ____D C:\Program Files (x86)\EasyAntiCheat_EOS
2026-09-29 18:11 - 2025-11-02 03:39 - 000000000 ____D C:\Users\o0the\AppData\Local\UnrealEngine
2026-09-28 01:25 - 2025-08-19 14:57 - 000000000 ____D C:\Program Files\Logitech
2026-09-27 20:35 - 2025-08-30 02:10 - 000776079 _____ C:\Users\o0the\AppData\LocalLow\d81b5504d1f9ff0d1df17a0995623f1069cf8b3eb09f934589300ec05d503743
2026-09-25 01:07 - 2026-07-12 00:22 - 000000000 ____D C:\Users\o0the\AppData\Roaming\obs-studio
2026-09-23 22:10 - 2025-08-19 14:48 - 000000000 ____D C:\ProgramData\LGHUB
2026-09-18 17:29 - 2024-06-04 21:59 - 000000000 ____D C:\Windows\system32\Drivers\wd

==================== Files in the root of some directories ========

2025-08-19 01:23 - 2025-08-19 01:23 - 000000260 ____H () C:\Users\o0the\AppData\Roaming\B917F429.bat
2026-06-05 00:29 - 2026-06-05 00:30 - 108049150 _____ () C:\Users\o0the\AppData\Roaming\GameRanger.zip
2025-10-25 18:36 - 2025-10-25 18:37 - 000007334 _____ () C:\Users\o0the\AppData\Roaming\heybox_acc.log
2026-09-10 18:34 - 2026-09-13 03:12 - 000006046 _____ () C:\Users\o0the\AppData\Roaming\plugin_scan_state_VST2_x32.scan
2026-09-10 18:34 - 2026-09-13 03:12 - 000006046 _____ () C:\Users\o0the\AppData\Roaming\plugin_scan_state_VST2_x64.scan
2026-09-10 18:34 - 2026-09-13 03:12 - 000000191 _____ () C:\Users\o0the\AppData\Roaming\plugin_scan_state_VST3_x32.scan
2026-09-10 18:34 - 2026-09-13 03:12 - 000000501 _____ () C:\Users\o0the\AppData\Roaming\plugin_scan_state_VST3_x64.scan
2026-09-27 18:02 - 2026-09-27 18:02 - 000000812 _____ () C:\Users\o0the\AppData\Local\recently-used.xbel
2025-12-22 16:59 - 2025-12-22 16:59 - 000007602 _____ () C:\Users\o0the\AppData\Local\Resmon.ResmonCfg

==================== SigCheck ============================

(There is no automatic fix for files that do not pass verification.)

==================== End of FRST.txt ========================