ClickOnce Bootstrapper Package for Microsoft .NET Framework (HKLM-x32\\{5A260D5A-95D3-4956-8E0A-E182CC4144ED}) (Version: 4.8.04162 - Microsoft Corporation) Hidden Task: {5594E525-77BA-4ACC-96A7-90740DA56E19} - System32\Tasks\NahimicSvc32Run => C:\Windows\SysWOW64\NahimicSvc32.exe [823304 2020-12-10] (A-Volute SAS -> Nahimic) "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{78bdf1d8-0a82-4ea3-8ac6-e6a6e95fd874}" => removed successfully 2021-10-13 22:14 - 2021-10-07 19:27 - 008722576 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll go to : C:\Program Files (x86)\GIGABYTE\AORUS LCD Panel Setting\Updater and run FWUpgrade.exe, you will see the progress and after completion, it will ask you to shutdown, click yes and the turn on the pc again. my os is win10 x64, 2004. goodluck. I have the 3090 and I do not see that folder. 2021-10-02 23:02 - 2021-10-02 23:02 - 000000000 ____D C:\Users\Pepega\AppData\Roaming\AMD start Task: {7758a3fe-bd22-4403-acda-05ae12b2505a} - no filepath NVIDIA HD Audio Driver 1.3.38.92 (HKLM\\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.38.92 - NVIDIA Corporation) Tcpip\..\Interfaces\{710b131b-0ffc-4c94-8d3e-1b075637d571}: [DhcpNameServer] 1.1.1.1 1.0.0.1 Task: {51f29cff-5f75-43a6-8c78-2970cd2f96ac} - no filepath 2021-10-15 11:58 - 2021-10-15 11:58 - 000000000 ____D C:\Users\Pepega\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LDPlayer4 CustomCLSID: HKU\S-1-5-21-326566074-3447909417-183555969-1001_Classes\CLSID\{917E8742-AA3B-7318-FA12-10485FB322A2}\localserver32 -> "C:\Users\Pepega\AppData\Local\Microsoft\OneDrive\21.170.0822.0002\Microsoft.SharePoint.exe" => No File 2021-10-15 11:58 - 2021-10-15 11:58 - 000000803 _____ C:\Users\Pepega\Desktop\LDPlayer4.lnk Task: {95d6d4ae-89c2-47b7-947d-0a2c92579474} - no filepath "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{252c0390-ef87-47eb-805e-da800dd5671d}" => removed successfully ContextMenuHandlers1: [AccExt] -> {2A118EB5-5797-4F5E-8B3D-F4ECBA3C98E4} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2021-09-15] (Adobe Inc. -> ) Engine Version: AM: 1.1.18600.4, NIS: 1.1.18600.4 The Client License Service (ClipSVC) service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. Microsoft Windows 10 Pro Version 1909 18363.418 (X64) (1970-01-01 06:34:12) 0.0.0.0 reports.wes.df.telemetry.microsoft.com 2021-10-02 23:22 - 2021-10-02 23:36 - 000000000 ____D C:\Program Files (x86)\Microsoft SDKs CMD: netsh int ip reset Please copy the entire contents of the code box below to the a new file. 2021-10-02 23:22 - 2021-10-02 23:26 - 000000000 ____D C:\Program Files (x86)\Windows Kits (Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Windows\System32\DriverStore\FileRepository\realtekservice.inf_amd64_df67044ddd98b524\RtkAudUService64.exe <2> Microsoft Defender Antivirus has detected malware or other potentially unwanted software. Task: {60deadb4-207d-4623-826b-8aef456e994f} - no filepath if you guys know how to remove these types of files please reply, thanks. 2021-10-03 16:47 - 2019-03-19 15:49 - 000028672 _____ C:\Windows\system32\config\BCD-Template 2021-10-15 11:40 - 2021-10-15 11:40 - 000000000 ____D C:\ProgramData\BlueStacks_nxt 2021-10-03 15:47 - 2021-10-18 20:25 - 000270480 _____ C:\Windows\system32\FNTCACHE.DAT Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION 2021-10-22 11:43 - 2021-10-22 18:56 - 000000000 ____D C:\ProgramData\Riot Games FF Extension: (NoScript) - C:\Users\Pepega\AppData\Roaming\Mozilla\Firefox\Profiles\q42kwfcc.default-release\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2021-10-05] Task: {8457ad0b-1c75-431d-a5ae-ee1aed76a239} - no filepath FF Extension: (Kurgzsekseta) - C:\Users\Pepega\AppData\Roaming\Mozilla\Firefox\Profiles\q42kwfcc.default-release\Extensions\{e8f3b919-d290-4270-b66f-29f3fdbb1986}.xpi [2021-10-05] (If an entry is included in the fixlist, the task (.job) file will be moved. 2021-10-13 22:14 - 2021-10-07 19:29 - 000656512 _____ (NVIDIA Corporation) C:\Windows\system32\nvml.dll HKU\S-1-5-21-326566074-3447909417-183555969-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp//go.microsoft.com/fwlink/?LinkId=54896 2021-10-24 17:43 - 2021-10-24 20:56 - 000002087 _____ C:\Users\Pepega\Desktop\help.txt Exception Info: System.Runtime.InteropServices.ExternalException 2021-10-02 23:01 - 2021-10-02 23:01 - 000000000 ____D C:\Users\Pepega\AppData\Local\setup "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{57f92185-4f7e-4549-bf72-8ded737637ee}" => removed successfully Task: {68912dca-04b7-43b9-b125-ab2888148ebb} - no filepath 2021-10-03 18:05 - 2021-10-03 18:05 - 000000000 ____D C:\Users\Pepega\AppData\Local\Apple Computer Please post the Fixlog.txt and let me know what problem persists. Date: 2021-10-24 15:35:27.734 vs_clickoncebootstrappermsires (HKLM-x32\\{4F48CC43-3C4F-4C5F-813A-8D5E5BF4E52A}) (Version: 17.0.31703 - Microsoft Corporation) Hidden ========= End of CMD: ========= Task: {4596b534-45a4-4c4e-93a8-e4c01a69090e} - no filepath ================ Task: {65f6d357-0576-4835-8e37-d12ac62b76e0} - no filepath " The NVIDIA LocalSystem Container service terminated with the following Loaded Profiles: Pepega Task: {e21ec10f-b0f2-4d8c-ac9d-e74491370460} - no filepath This error could be caused if the system stopped responding, crashed, or lost power unexpectedly. Security intelligence Version: AV: 1.351.958.0, AS: 1.351.958.0, NIS: 1.351.958.0 Task: {51f29cff-5f75-43a6-8c78-2970cd2f96ac} - no filepath ==================== Processes (Whitelisted) ================= 2021-10-02 22:51 - 2021-10-10 13:03 - 000003480 _____ C:\Windows\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA Task: {e21ec10f-b0f2-4d8c-ac9d-e74491370460} - no filepath GIGABYTE / AORUS WARRANTY - TERMS AND Task: {60deadb4-207d-4623-826b-8aef456e994f} - no filepath 2021-10-04 10:02 - 2021-10-04 10:02 - 000000000 ____D C:\Users\Pepega\AppData\Local\OO Software 2021-10-11 09:07 - 2021-10-11 09:07 - 000058304 _____ C:\Windows\system32\Drivers\49306c4f52694d336548644956544e70536b4a70616d56784e5546484d57517956577430.sys (If an entry is included in the fixlist, the process will be closed. Startup: C:\Users\Pepega\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Thing.bat [2021-10-24] () [File not signed] 2021-10-02 23:25 - 2021-10-04 18:19 - 000000000 ____D C:\Windows\system32\1029 MonitorService.exe located in :Program Files (x86)\GIGABYTE\AORUS LCD Panel Setting This controls the LCD panel on the 3080 Aurorus series cards on startup. 2021-10-24 14:31 - 2021-10-24 14:31 - 000000000 ____D C:\Program Files\MSBuild Resetting Echo Sequence Request, OK! Edge Profile: C:\Users\Pepega\AppData\Local\Microsoft\Edge\User Data\Default [2021-10-24] Task: {b8ce6039-5202-4c0c-b706-9d55226ab086} - no filepath Error: (10/24/2021 07:29:03 PM) (Source: Software Protection Platform Service) (EventID: 8228) (User: ) Report Id: c4164c23-2f25-4c91-a107-f917df162ea7 2021-10-02 23:26 - 2021-10-04 18:19 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Python 3.9 2021-10-02 23:04 - 2021-09-14 14:39 - 001293680 _____ (NVIDIA Corporation) C:\Windows\system32\NvRtmpStreamer64.dll The following corrective action will be taken in 6000 milliseconds: Startup: C:\Users\Pepega\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Thing.bat [2021-10-24] () [File not signed] ==================== SigCheck ============================ 2021-10-24 14:31 - 2021-10-24 14:31 - 000000000 ____D C:\Program Files\Reference Assemblies 2021-10-02 23:04 - 2021-09-14 14:39 - 002186608 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll Error: Unable to rebuild performance counter setting from system backup store, error code is 2 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) FirewallRules: [{30A1031D-2A0F-4ED7-BB78-4C35329A0857}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation) Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40664 (HKLM-x32\\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}) (Version: 12.0.40664.0 - Microsoft Corporation) Task: {68703689-47bd-47ee-9cf2-e91abb43a182} - no filepath "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5ea271ce-e48a-4ade-9079-2a5bece10d83}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{f31abc37-3a79-4244-9a4b-03a808823654}" => removed successfully Task: {1e6a4e2b-eca4-4162-8baf-5e2cbc56f0a8} - no filepath AMD Chipset Software (HKLM-x32\\AMD_Chipset_IODrivers) (Version: 2.15.07.2229 - Advanced Micro Devices, Inc.) Disk: 1 (Protective MBR) (Size: 1863 GB) (Disk ID: 00000000) 2021-10-02 23:24 - 2021-10-02 23:24 - 000000000 ____D C:\Users\Pepega\.dotnet vs_filehandler_x86 (HKLM-x32\\{84E8F6CC-49D4-45C4-8AD6-18F123873643}) (Version: 17.0.31709 - Microsoft Corporation) Hidden 2021-10-15 11:57 - 2021-10-15 11:59 - 000000000 ____D C:\Users\Pepega\AppData\Roaming\XuanZhi 2021-10-13 22:14 - 2021-10-07 19:29 - 000635008 _____ C:\Windows\SysWOW64\nvofapi.dll icecap_collectionresources (HKLM-x32\\{D71337CA-4452-43D2-9583-45670FF77185}) (Version: 17.0.31709 - Microsoft Corporation) Hidden Task: {b44de6b6-1303-474b-bd1f-0c3e771de5d9} - no filepath 2021-10-13 22:14 - 2021-10-07 19:32 - 001450200 _____ C:\Windows\SysWOW64\vulkaninfo-1-999-0-0-0.exe Task: {9b1a2e00-1c51-45d5-b5e4-9257d58cc2fe} - no filepath "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8c4fdb45-99dd-42f3-8984-07e5f8dff7f4}" => removed successfully I assume this app is the cpu miner, it has a script that utilizes .net framework to mine, the exe that it uses to mine is RegAsm.exe, and mines at only 50% cpu, i was only able to see that it was using 50% cpu in process explorer. \\?\Volume{66a9e99a-1cf4-4f5a-a085-9db2177d6629}\ (Recovery) (Fixed) (Total:0.52 GB) (Free:0.5 GB) NTFS (If an entry is included in the fixlist, it will be removed from the registry. Universal CRT Tools x64 (HKLM\\{CD06199B-41C1-AE6D-7567-984CC68792C3}) (Version: 10.1.19041.685 - Microsoft Corporation) Hidden 0.0.0.0 vortex.data.microsoft.com The NVIDIA LocalSystem Container service terminated unexpectedly. Entity Framework 6.2.0 Tools for Visual Studio 2022 (HKLM-x32\\{3A21F37E-9707-4E7F-94EB-2937A1C931FA}) (Version: 6.2.0.0 - Microsoft Corporation) Hidden The system cannot find the file specified. Name: SettingsModifier:Win32/PossibleHostsFileHijack 2021-10-02 23:25 - 2021-10-04 18:19 - 000000000 ____D C:\Windows\SysWOW64\1055 CMD: "C:\Windows\SysWOW64\lodctr.exe" /R Task: {4fb942bf-3d44-41ff-bc65-52cd12996f26} - no filepath Microsoft Windows Desktop Runtime - 5.0.11 (x86) (HKLM-x32\\{7ce2617d-0a0a-4f61-8e5a-96f7bfca6fdd}) (Version: 5.0.11.30524 - Microsoft Corporation) 2021-10-02 23:01 - 2021-10-24 12:21 - 000000000 ____D C:\ProgramData\Package Cache Exception Info: System.Runtime.InteropServices.ExternalException 2021-10-03 18:24 - 2021-10-03 19:31 - 000000000 ____D C:\Program Files\ruxim service 2021-10-02 23:43 - 2021-10-02 23:43 - 000000000 ____D C:\ProgramData\Battle.net 2021-10-02 23:49 - 2021-10-02 23:49 - 000000219 _____ C:\Users\Pepega\Desktop\Counter-Strike Global Offensive.url vs_SQLClickOnceBootstrappermsi (HKLM-x32\\{F16C13E8-83A4-47C8-8687-B9E1DDDFA80C}) (Version: 17.0.31703 - Microsoft Corporation) Hidden S3 SIVDriver; C:\Windows\system32\Drivers\SIVX64.sys [205552 2021-02-13] (RH Software Ltd -> Ray Hinchliffe) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service" 2021-10-02 22:59 - 2021-10-02 22:59 - 000000000 ____D C:\Program Files\WinRAR 2021-10-24 20:41 - 2021-10-24 20:41 - 000000000 ____D C:\ProgramData\Norton Task: {0ed742eb-771d-447f-a4e4-64c6fd2882f4} - no filepath Task: {1a105416-49db-4c94-a1d7-5a3597878e9a} - no filepath 2021-10-02 23:25 - 2021-10-02 23:26 - 000000000 ____D C:\Windows\system32\1042 Resetting Compartment, OK! FirewallRules: [Microsoft-Windows-Unified-Telemetry-Client] => (Block) C:\Windows\system32\svchost.exe (Microsoft Windows Publisher -> Microsoft Corporation) 3>restart. 2021-10-13 22:14 - 2021-10-07 19:32 - 001111256 _____ C:\Windows\system32\vulkan-1.dll Task: {e2e2a07e-8ce9-45bf-94db-a91755d15155} - no filepath 2021-10-04 09:37 - 2021-10-04 09:37 - 000000000 ____D C:\Users\Pepega\AppData\Roaming\Macromedia HKLM\SOFTWARE\Policies\Microsoft\Edge: Restriction <==== ATTENTION 2021-10-02 23:44 - 2021-10-20 12:04 - 000000000 ____D C:\Users\Pepega\AppData\Roaming\Battle.net GIGABYTE - RGB FUSION 2021-10-20 14:48 - 2021-10-20 14:50 - 000000000 ____D C:\Program Files (x86)\GIGABYTE (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe Resetting Multicast Address, OK! 2021-10-13 22:14 - 2021-10-07 19:29 - 000800384 _____ C:\Windows\system32\nvofapi64.dll i have tried manually removing these files in safe mode but again, it was only a temporary solution, as they are downloaded again (presumably using some sort of script), even though i have firewall enable (Currently there is no automatic fix for this section.) 2021-10-12 19:23 - 2021-10-12 19:23 - 000000000 ____D C:\Program Files\Epic Games 2021-10-24 14:03 - 2021-10-24 14:03 - 000058304 _____ C:\Windows\system32\Drivers\49306c4f52694d3361565a36626b5a525132647563586434536a6c474d586f3054584670.sys 2021-10-13 16:20 - 2021-10-13 16:20 - 000001245 _____ C:\Users\Pepega\Desktop\Roblox Studio.lnk Task: {f99694c5-bf64-4109-a138-067cb4c7d2e7} - no filepath Task: {69239D2A-9392-46A2-9683-DE2CB69D23FE} - System32\Tasks\AMDAutoUpdate => C:\Program Files\AMD\AutoUpdate\AMDAutoUpdate.exe [667832 2021-07-16] (Advanced Micro Devices INC. -> ) Process Name: C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe