rayan2000 New member Joined Feb 6, 2021 Posts 2 Feb 6, 2021 #1 Window 10 running, 2019 i was browsing for an pirated application and i found a zip file which i unzipped and saw a app named multimeter.exe(i double clicked on it) which then disappeared . after some time window gave a message "would you like to allow this application to make changes to your device " i selected no .It disappeared as it was supposed to be , but it kept giving me these messages everytime i turned on my laptop. And my window defender security also gave me messages on repeat. I installed many antivirus programs and run a scan but no changes . It is still full of virus. Next day a chinese app started own its own written in chinese i closed it . But it kept turning on everytime i turned on the pc . i checked the Task manager to check if there was anything malicious but there wasn't. I also found out that there were many files with extension as (tmp). and my temp folder was also filled with some files that i wasnt able delete (C:\Users\acer\AppData\Local\Temp) . can someone please help me with this i also have a Farbar Recovery Scan Tool that i ran and got the results . Please help my laptop has become much slower . Attachments Addition.txt 55.1 KB · Views: 10 FRST.txt 53.5 KB · Views: 12
Window 10 running, 2019 i was browsing for an pirated application and i found a zip file which i unzipped and saw a app named multimeter.exe(i double clicked on it) which then disappeared . after some time window gave a message "would you like to allow this application to make changes to your device " i selected no .It disappeared as it was supposed to be , but it kept giving me these messages everytime i turned on my laptop. And my window defender security also gave me messages on repeat. I installed many antivirus programs and run a scan but no changes . It is still full of virus. Next day a chinese app started own its own written in chinese i closed it . But it kept turning on everytime i turned on the pc . i checked the Task manager to check if there was anything malicious but there wasn't. I also found out that there were many files with extension as (tmp). and my temp folder was also filled with some files that i wasnt able delete (C:\Users\acer\AppData\Local\Temp) . can someone please help me with this i also have a Farbar Recovery Scan Tool that i ran and got the results . Please help my laptop has become much slower .
icotonev Security Analyst Staff member Joined Jan 18, 2020 Posts 146 Location Bulgaria Feb 6, 2021 #3 Hi ,rayan2000.! Please give me some time to go over your logs and I will get back to you as soon as possible... !!!
Hi ,rayan2000.! Please give me some time to go over your logs and I will get back to you as soon as possible... !!!
icotonev Security Analyst Staff member Joined Jan 18, 2020 Posts 146 Location Bulgaria Feb 6, 2021 #4 Farbar Recovery Scan Tool - Fix Highlight the contents of the below code box and press Ctrl + C on your keyboard Code: Start:: CreateRestorePoint: CloseProcesses: (Microsoft Corporation -> Microsoft Corporation) C:\Users\acer\AppData\Roaming\HwxzwCObnu\RegAsm.exe HKU\S-1-5-21-3345053375-1707548004-3847637765-1001\...\Run: [Chromium Update] => C:\Users\acer\AppData\Local\Chromium\Update\1.3.99.0\ChromiumUpdateCore.exe <==== ATTENTION HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION Task: {0ECA1F2E-3162-4E76-A4AF-0C7727B1FD9F} - System32\Tasks\ChromiumUpdateTaskUserS-1-5-21-3345053375-1707548004-3847637765-1001Core => C:\Users\acer\AppData\Local\Chromium\Update\ChromiumUpdate.exe <==== ATTENTION Task: {A5DD70CC-C2AC-416C-B43C-B37E03850BB5} - System32\Tasks\ChromiumUpdateTaskUserS-1-5-21-3345053375-1707548004-3847637765-1001UA => C:\Users\acer\AppData\Local\Chromium\Update\ChromiumUpdate.exe <==== ATTENTION S2 HitmanProScheduler; "C:\Program Files\HitmanPro\hmpsched.exe" [X] 2021-02-06 12:21 - 2021-02-06 12:21 - 000000000 ____D C:\Users\acer\AppData\Roaming\Avast Software 2021-02-06 12:20 - 2021-02-06 12:21 - 000468888 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswc867cd256224c893.tmp 2021-02-06 12:20 - 2021-02-06 12:21 - 000324904 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswbea60b4afae2b7df.tmp 2021-02-06 12:20 - 2021-02-06 12:21 - 000214808 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswcafa7caaceaea1f0.tmp 2021-02-06 12:20 - 2021-02-06 12:20 - 000851256 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswacf82ca0435b5ddc.tmp 2021-02-06 12:20 - 2021-02-06 12:20 - 000522480 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswb8834f4206b5ab9c.tmp 2021-02-06 12:20 - 2021-02-06 12:20 - 000340576 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe 2021-02-06 12:20 - 2021-02-06 12:20 - 000332880 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw2fe2ebce436625b2.tmp 2021-02-06 12:20 - 2021-02-06 12:20 - 000247888 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw8288fb2cb154ebd4.tmp 2021-02-06 12:20 - 2021-02-06 12:20 - 000208672 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw5d6c0848e0076488.tmp 2021-02-06 12:20 - 2021-02-06 12:20 - 000176384 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswe3d4313124dcb869.tmp 2021-02-06 12:20 - 2021-02-06 12:20 - 000108928 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw6fa2ccf5f6dd7d0b.tmp 2021-02-06 12:20 - 2021-02-06 12:20 - 000097360 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw1c11669f3f021b38.tmp 2021-02-06 12:20 - 2021-02-06 12:20 - 000084496 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw2d548227bbe747ab.tmp 2021-02-06 12:20 - 2021-02-06 12:20 - 000042424 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswb304b8d89e04a9f2.tmp 2021-02-06 12:20 - 2021-02-06 12:20 - 000036792 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswf5e09975ce45bd37.tmp 2021-02-06 12:20 - 2021-02-06 12:20 - 000016832 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw49cb41de281d6348.tmp 2021-02-06 12:20 - 2021-02-06 12:20 - 000000000 ____D C:\Program Files\Common Files\Avast Software 2021-02-06 12:20 - 2021-02-06 12:20 - 000000000 ____D C:\Program Files\Avast Software 2021-02-06 12:19 - 2021-02-06 13:35 - 000000000 ____D C:\ProgramData\Avast Software 2021-02-05 21:12 - 2021-02-05 23:31 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro 2021-02-05 21:12 - 2021-02-05 22:26 - 000057728 _____ C:\WINDOWS\system32\Drivers\hitmanpro37.sys 2021-02-05 11:08 - 2021-02-06 13:33 - 000000000 ____D C:\Users\acer\AppData\Roaming\HwxzwCObnu CustomCLSID: HKU\S-1-5-21-3345053375-1707548004-3847637765-1001_Classes\CLSID\{D8E0CDAD-2FAE-40EB-8433-7F5A79714FB8}\InprocServer32 -> C:\Users\acer\AppData\Local\Chromium\Update\1.3.99.0\psuser_64.dll => No File CustomCLSID: HKU\S-1-5-21-3345053375-1707548004-3847637765-1001_Classes\CLSID\{E064AEC2-5150-4DF6-B2A3-1A6721C2076B}\InprocServer32 -> C:\Users\acer\AppData\Local\Chromium\Update\1.3.99.0\psuser_64.dll => No File CustomCLSID: HKU\S-1-5-21-3345053375-1707548004-3847637765-1001_Classes\CLSID\{E9E7529D-7F09-410B-AF2A-CC154473B19C}\InprocServer32 -> C:\Users\acer\AppData\Local\Google\Update\1.3.35.452\psuser_64.dll => No File ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File ShellIconOverlayIdentifiers: [00avg] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll -> No File ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll -> No File AlternateDataStreams: C:\WINDOWS\tracing:? [16] AlternateDataStreams: C:\Users\acer\Local Settings:05-02-2021 [8631] AlternateDataStreams: C:\Users\acer\Local Settings:06-02-2021 [199297] AlternateDataStreams: C:\Users\acer\AppData\Local:05-02-2021 [8631] AlternateDataStreams: C:\Users\acer\AppData\Local:06-02-2021 [199297] AlternateDataStreams: C:\Users\acer\AppData\Local\Application Data:05-02-2021 [8631] AlternateDataStreams: C:\Users\acer\AppData\Local\Application Data:06-02-2021 [199297 FirewallRules: [TCP Query User{AC226EFF-9C04-4F7C-A064-4F72FB9C6723}C:\windows.old\users\acer\appdata\roaming\utorrent\utorrent.exe] => (Allow) C:\windows.old\users\acer\appdata\roaming\utorrent\utorrent.exe => No File FirewallRules: [UDP Query User{ADA20F26-1319-448C-B91B-6D6C710D87E1}C:\windows.old\users\acer\appdata\roaming\utorrent\utorrent.exe] => (Allow) C:\windows.old\users\acer\appdata\roaming\utorrent\utorrent.exe => No File FirewallRules: [TCP Query User{620D7B0F-FA3C-45B6-A9E7-9068B46DF38F}E:\grand theft auto v\gta5.exe] => (Allow) E:\grand theft auto v\gta5.exe => No File FirewallRules: [UDP Query User{0476330A-C7D0-4FFB-A97E-34C50FCD1D7F}E:\grand theft auto v\gta5.exe] => (Allow) E:\grand theft auto v\gta5.exe => No File FirewallRules: [TCP Query User{803067A3-0622-4D99-A4FF-A6868BFAB9D1}D:\games\prototype 2\prototype2.exe] => (Allow) D:\games\prototype 2\prototype2.exe => No File FirewallRules: [UDP Query User{7E7DA199-7341-4E59-BD4D-096CE863A9B9}D:\games\prototype 2\prototype2.exe] => (Allow) D:\games\prototype 2\prototype2.exe => No File FirewallRules: [{598B3BC5-4CBF-4631-8948-FD7A63DA66CB}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe => No File FirewallRules: [{2A8697BB-4F1B-4304-B409-BD638D485784}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe => No File FirewallRules: [TCP Query User{EDE72457-383E-4D54-AD04-2533CD1FA498}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.175\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.175\opera.exe => No File FirewallRules: [UDP Query User{0869433C-2D3D-4A03-9575-50498C8732B5}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.175\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.175\opera.exe => No File FirewallRules: [TCP Query User{F72C8137-90DE-4CBC-975E-D7F24C6C9B5E}D:\grand theft auto v\gta5.exe] => (Allow) D:\grand theft auto v\gta5.exe => No File FirewallRules: [UDP Query User{F80B8DD0-0802-404C-95C6-AAA58F026940}D:\grand theft auto v\gta5.exe] => (Allow) D:\grand theft auto v\gta5.exe => No File FirewallRules: [TCP Query User{08D09850-EBA7-4A7D-A920-E895ADFAC7B5}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.205\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.205\opera.exe => No File FirewallRules: [UDP Query User{0DF59DC5-14AE-4448-B977-D4682E80AB67}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.205\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.205\opera.exe => No File FirewallRules: [TCP Query User{7150D04D-24CD-43C6-9DC0-2C2308258BF3}C:\windows.old\users\acer\appdata\roaming\utorrent\utorrent.exe] => (Allow) C:\windows.old\users\acer\appdata\roaming\utorrent\utorrent.exe => No File FirewallRules: [UDP Query User{18826AB9-612C-4660-94A1-6EB0F6DD1FEE}C:\windows.old\users\acer\appdata\roaming\utorrent\utorrent.exe] => (Allow) C:\windows.old\users\acer\appdata\roaming\utorrent\utorrent.exe => No File FirewallRules: [TCP Query User{C6D35541-F77A-4617-9379-ECD56246D3AA}D:\games\prototype 2\prototype2.exe] => (Allow) D:\games\prototype 2\prototype2.exe => No File FirewallRules: [UDP Query User{04E47FC4-289B-4DC7-B752-3531C1085D1D}D:\games\prototype 2\prototype2.exe] => (Allow) D:\games\prototype 2\prototype2.exe => No File FirewallRules: [TCP Query User{EDC72347-3AA4-4BA1-98DC-99AFFCE9216F}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.205\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.205\opera.exe => No File FirewallRules: [UDP Query User{9B0FF6CC-F8DD-472F-BC02-A6C26E68B64C}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.205\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.205\opera.exe => No File FirewallRules: [TCP Query User{DC74E897-04D9-47E2-A134-F8522ACB7007}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.234\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.234\opera.exe => No File FirewallRules: [UDP Query User{1850A0DC-DFBC-416F-BDDD-466259105F02}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.234\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.234\opera.exe => No File FirewallRules: [{415F2C5E-AEE5-46B2-A68E-C21826AAE4C5}] => (Allow) D:\Games\Steam.exe => No File FirewallRules: [{A1641D3E-677E-41B2-AA22-AE37DE6D76DF}] => (Allow) D:\Games\Steam.exe => No File FirewallRules: [{92F6A1C3-8D65-494D-9BCD-5F5DBF6C96AA}] => (Allow) D:\Games\bin\cef\cef.win7\steamwebhelper.exe => No File FirewallRules: [{21F65E71-C573-4955-8C6B-B92FBF68D725}] => (Allow) D:\Games\bin\cef\cef.win7\steamwebhelper.exe => No File FirewallRules: [{73793D5D-088E-42F7-90A1-B6382C251327}] => (Allow) D:\Games\steamapps\common\Black Squad\binaries\win64\BlackSquadGame.exe => No File FirewallRules: [{46E4AEE1-E99E-4F7B-B67F-D6A649299111}] => (Allow) D:\Games\steamapps\common\Black Squad\binaries\win64\BlackSquadGame.exe => No File FirewallRules: [TCP Query User{0BBDC29A-2AD4-4E3A-A66C-C56746BE45EC}D:\epic games\gmaes\unrealtournament\engine\binaries\win64\ue4-win64-shipping.exe] => (Allow) D:\epic games\gmaes\unrealtournament\engine\binaries\win64\ue4-win64-shipping.exe => No File FirewallRules: [UDP Query User{6812B089-B3B6-41E4-A959-AE24863F4C63}D:\epic games\gmaes\unrealtournament\engine\binaries\win64\ue4-win64-shipping.exe] => (Allow) D:\epic games\gmaes\unrealtournament\engine\binaries\win64\ue4-win64-shipping.exe => No File FirewallRules: [TCP Query User{15A3F9DB-44DC-4E61-868A-639935A0CEE2}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.287\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.287\opera.exe => No File FirewallRules: [UDP Query User{D56A6168-FEF8-4BFD-8EC2-6030CB71A13A}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.287\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.287\opera.exe => No File FirewallRules: [TCP Query User{CE5B5E12-D8AD-479F-A0FE-3C38044E7C66}D:\epic games\gmaes\roguecompany\roguecompany\binaries\win64\roguecompany.exe] => (Allow) D:\epic games\gmaes\roguecompany\roguecompany\binaries\win64\roguecompany.exe => No File FirewallRules: [UDP Query User{38E05DA8-DDAC-440C-93E5-A6BC5797CFBF}D:\epic games\gmaes\roguecompany\roguecompany\binaries\win64\roguecompany.exe] => (Allow) D:\epic games\gmaes\roguecompany\roguecompany\binaries\win64\roguecompany.exe => No File FirewallRules: [TCP Query User{4EDFE3DB-3680-46BC-8A0D-927BDA48CE12}D:\call of duty mw\call of duty modern warfare\modernwarfare.exe] => (Allow) D:\call of duty mw\call of duty modern warfare\modernwarfare.exe => No File FirewallRules: [UDP Query User{E74BD461-6E30-471D-8B09-4E7D572E78D3}D:\call of duty mw\call of duty modern warfare\modernwarfare.exe] => (Allow) D:\call of duty mw\call of duty modern warfare\modernwarfare.exe => No File FirewallRules: [{3149748B-FD86-4719-B962-51CC336ADB3E}] => (Allow) D:\Games\steamapps\common\Fallout76\Fallout76.exe => No File FirewallRules: [{D9B546E0-C1FD-4969-BA5A-BDCB89D708D8}] => (Allow) D:\Games\steamapps\common\Fallout76\Fallout76.exe => No File FirewallRules: [TCP Query User{227BCAB0-EE1F-417D-A158-FD2D878D4F47}D:\epic\rocketleague\binaries\win64\rocketleague.exe] => (Allow) D:\epic\rocketleague\binaries\win64\rocketleague.exe => No File FirewallRules: [UDP Query User{C125EC71-E522-43DF-AD81-274DC7CEEAD3}D:\epic\rocketleague\binaries\win64\rocketleague.exe] => (Allow) D:\epic\rocketleague\binaries\win64\rocketleague.exe => No File FirewallRules: [TCP Query User{644F511C-38AD-4BF7-ADCC-6098C5C61923}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.302\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.302\opera.exe => No File FirewallRules: [UDP Query User{13606449-BE69-4F69-A53B-704236F158C7}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.302\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.302\opera.exe => No File FirewallRules: [TCP Query User{497E4576-738A-4E1D-B360-47C2FF187B88}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.302\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.302\opera.exe => No File FirewallRules: [UDP Query User{37AC1477-1858-4A29-9657-B087A9490B14}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.302\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.302\opera.exe => No File FirewallRules: [TCP Query User{C430D6C2-AF08-44D9-A0B9-D36BFE4E749A}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.310\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.310\opera.exe => No File FirewallRules: [UDP Query User{3266141C-86FE-47B8-8F84-76FC4F490015}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.310\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.310\opera.exe => No File FirewallRules: [{EC1C0BDA-4469-43E1-A4E9-289A42F2CCA1}] => (Allow) D:\epic\steam\steam.exe => No File FirewallRules: [{E361C40A-F4DF-4847-8971-74CC78D2E4A9}] => (Allow) D:\epic\steam\steam.exe => No File FirewallRules: [{0069D078-E195-4A0F-BC9B-797F9AA6E27A}] => (Allow) D:\epic\steam\bin\cef\cef.win7\steamwebhelper.exe => No File FirewallRules: [{D7C59057-3EF2-4256-A507-BE9180C4BD8C}] => (Allow) D:\epic\steam\bin\cef\cef.win7\steamwebhelper.exe => No File FirewallRules: [TCP Query User{3A784161-E1E4-4E48-BFC0-B9A8DA5B1C8B}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.323\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.323\opera.exe => No File FirewallRules: [UDP Query User{EBCAA14F-97DE-4B04-AA71-33117DB95B26}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.323\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.323\opera.exe => No File FirewallRules: [TCP Query User{4514B13B-D552-4D4A-8238-342519117E43}D:\epic\roguecompany\roguecompany\binaries\win64\roguecompany.exe] => (Allow) D:\epic\roguecompany\roguecompany\binaries\win64\roguecompany.exe => No File FirewallRules: [UDP Query User{4CCCFE20-AE45-4F15-80B2-A676D2A4FBAB}D:\epic\roguecompany\roguecompany\binaries\win64\roguecompany.exe] => (Allow) D:\epic\roguecompany\roguecompany\binaries\win64\roguecompany.exe => No File FirewallRules: [TCP Query User{D338B63E-8BA5-406E-959E-43E402C9FB5A}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.323\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.323\opera.exe => No File FirewallRules: [UDP Query User{5EF76A88-BDE8-4D2C-8C77-C8078DD042C6}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.323\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.323\opera.exe => No File FirewallRules: [TCP Query User{BDD56E41-65DA-4CE0-B7DB-7D7A7FB013AA}C:\windows.old\users\acer\appdata\roaming\utorrent\updates\3.5.5_45828.exe] => (Allow) C:\windows.old\users\acer\appdata\roaming\utorrent\updates\3.5.5_45828.exe => No File FirewallRules: [UDP Query User{508CE07A-7AD0-4EB7-A910-A11C8263A01A}C:\windows.old\users\acer\appdata\roaming\utorrent\updates\3.5.5_45828.exe] => (Allow) C:\windows.old\users\acer\appdata\roaming\utorrent\updates\3.5.5_45828.exe => No File FirewallRules: [TCP Query User{077D2CFA-446A-49D7-93C0-D081DEA0CCFE}D:\games\crossout\launcher.exe] => (Allow) D:\games\crossout\launcher.exe => No File FirewallRules: [UDP Query User{A58415D4-260C-418C-99AC-29DB87FF9766}D:\games\crossout\launcher.exe] => (Allow) D:\games\crossout\launcher.exe => No File FirewallRules: [{6150A2FD-BA41-466A-9DCE-33CB58758E39}] => (Allow) C:\Program Files (x86)\AnyDesk\AnyDesk.exe => No File FirewallRules: [{4815147A-AE2A-41C2-AF2E-30974DA861A7}] => (Allow) C:\Program Files (x86)\AnyDesk\AnyDesk.exe => No File FirewallRules: [{284DDD70-29DC-4ADC-ACB8-B3E6B853D819}] => (Allow) C:\Program Files (x86)\AnyDesk\AnyDesk.exe => No File FirewallRules: [{8E7C00C3-1F67-41C2-801A-99CB161BCA77}] => (Allow) C:\Program Files (x86)\AnyDesk\AnyDesk.exe => No File FirewallRules: [{4FBB81D4-9273-45EC-A29B-EC9E76B30A5A}] => (Allow) C:\Program Files (x86)\AnyDesk\AnyDesk.exe => No File FirewallRules: [{18921F63-7CDE-4DAA-9DBA-09EC60D83C44}] => (Allow) C:\Program Files (x86)\AnyDesk\AnyDesk.exe => No File FirewallRules: [TCP Query User{5A5CFA36-E6C2-470F-8FB3-87390BAD4932}D:\epic\spellbreak\g3\binaries\win64\spellbreak.exe] => (Allow) D:\epic\spellbreak\g3\binaries\win64\spellbreak.exe => No File FirewallRules: [UDP Query User{906C425A-90A9-4CA8-9AFB-BA0535C85314}D:\epic\spellbreak\g3\binaries\win64\spellbreak.exe] => (Allow) D:\epic\spellbreak\g3\binaries\win64\spellbreak.exe => No File FirewallRules: [TCP Query User{E93A4471-ED97-4D26-8AB8-40197905C4F0}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.441\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.441\opera.exe => No File FirewallRules: [UDP Query User{EA280370-CADC-4922-BBCE-CB8686D43460}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.441\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.441\opera.exe => No File FirewallRules: [TCP Query User{4B907162-AB70-4CEE-B055-7DAEEE6439CD}D:\games\ubisoft game launcher\games\hyper scape\hyperscape.exe] => (Allow) D:\games\ubisoft game launcher\games\hyper scape\hyperscape.exe => No File FirewallRules: [UDP Query User{BE5D617F-F915-46C2-B642-2105B9452429}D:\games\ubisoft game launcher\games\hyper scape\hyperscape.exe] => (Allow) D:\games\ubisoft game launcher\games\hyper scape\hyperscape.exe => No File FirewallRules: [{DB015787-0F8C-4DE3-97FA-0834EE306FB6}] => (Allow) D:\steam\Steam.exe => No File FirewallRules: [{D4B1A240-4B64-41DC-8A25-37A9EAB484E0}] => (Allow) D:\steam\Steam.exe => No File FirewallRules: [{A007C0F5-2C70-4E1A-B3FE-B34B87A3DC36}] => (Allow) D:\steam\bin\cef\cef.win7\steamwebhelper.exe => No File FirewallRules: [{FB08D27A-DD41-4A3F-8872-946BF1CF00D8}] => (Allow) D:\steam\bin\cef\cef.win7\steamwebhelper.exe => No File FirewallRules: [TCP Query User{DB65ADAF-67BE-4624-BFB0-E0CB96E5CCDE}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.449\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.449\opera.exe => No File FirewallRules: [UDP Query User{BAC354E5-711F-4CC9-822B-5ED7F8A92725}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.449\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.449\opera.exe => No File FirewallRules: [{4259C875-6C8A-422D-9AB0-A56D7E03C21C}] => (Allow) D:\steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File FirewallRules: [{A98B9205-0FBB-4865-8AFE-50E5AE1E9131}] => (Allow) D:\steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File FirewallRules: [TCP Query User{6C05BD8C-C3B3-4500-8014-A14A0F3A5E9A}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.456\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.456\opera.exe => No File FirewallRules: [UDP Query User{4598C22D-4F3F-4E1F-BD9A-41140A894D98}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.456\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.456\opera.exe => No File FirewallRules: [{FA74E7FF-FECF-4872-9C7C-B8D13F71BF83}] => (Allow) D:\Games\Grand Theft Auto V\GTA5.exe => No File FirewallRules: [{C49216C1-E31F-4C25-9834-7AFA827267D3}] => (Allow) D:\Games\Grand Theft Auto V\GTA5.exe => No File FirewallRules: [TCP Query User{1AF01F38-F9EF-4628-A73F-4BD8AD017085}D:\games\cyberpunk 2077\bin\x64\cyberpunk2077.exe] => (Allow) D:\games\cyberpunk 2077\bin\x64\cyberpunk2077.exe => No File FirewallRules: [UDP Query User{55E51065-B04F-415E-BC79-5FAFA5A8FC08}D:\games\cyberpunk 2077\bin\x64\cyberpunk2077.exe] => (Allow) D:\games\cyberpunk 2077\bin\x64\cyberpunk2077.exe => No File FirewallRules: [TCP Query User{5E295B62-F9D9-4878-A00F-2828A6BC52B3}C:\program files\jetbrains\intellij idea community edition 2020.3\bin\idea64.exe] => (Allow) C:\program files\jetbrains\intellij idea community edition 2020.3\bin\idea64.exe => No File FirewallRules: [UDP Query User{7D6C7457-17B6-4239-B18C-AEE44738FA21}C:\program files\jetbrains\intellij idea community edition 2020.3\bin\idea64.exe] => (Allow) C:\program files\jetbrains\intellij idea community edition 2020.3\bin\idea64.exe => No File FirewallRules: [TCP Query User{1664C9A9-99D7-4CA8-B610-3494010B1991}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.456\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.456\opera.exe => No File FirewallRules: [UDP Query User{0A1C9BAD-2499-46B7-B3BB-89DBF9FEB5A1}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.456\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.456\opera.exe => No File FirewallRules: [TCP Query User{8829BBA8-2BC7-4B02-AE43-7A9EA6EE2415}C:\users\acer\appdata\local\programs\opera gx\72.0.3815.454\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\72.0.3815.454\opera.exe => No File FirewallRules: [UDP Query User{F8BDB726-0AE5-4B78-BF98-E88AC967579C}C:\users\acer\appdata\local\programs\opera gx\72.0.3815.454\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\72.0.3815.454\opera.exe => No File FirewallRules: [TCP Query User{054DA44A-D37C-46BA-93DB-23E65020F078}C:\users\acer\appdata\local\programs\opera gx\72.0.3815.454\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\72.0.3815.454\opera.exe => No File FirewallRules: [UDP Query User{7BDF4DC1-EAF4-469D-ADD0-C70D687C13C3}C:\users\acer\appdata\local\programs\opera gx\72.0.3815.454\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\72.0.3815.454\opera.exe => No File FirewallRules: [TCP Query User{D0E52C5F-38AF-422D-A5C3-38A257190C9F}D:\steam\steamapps\common\spellbreak\g3\binaries\win64\spellbreak.exe] => (Allow) D:\steam\steamapps\common\spellbreak\g3\binaries\win64\spellbreak.exe => No File FirewallRules: [UDP Query User{88FA4F61-7966-4DBB-8BF0-95E3FF14C5E3}D:\steam\steamapps\common\spellbreak\g3\binaries\win64\spellbreak.exe] => (Allow) D:\steam\steamapps\common\spellbreak\g3\binaries\win64\spellbreak.exe => No File FirewallRules: [TCP Query User{9D2A4839-88F3-4DA0-841D-97D0D4FBC0C4}C:\users\acer\appdata\local\programs\opera gx\72.0.3815.459\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\72.0.3815.459\opera.exe => No File FirewallRules: [UDP Query User{EF91B707-7D5F-41DA-B3DE-DA883F5C7800}C:\users\acer\appdata\local\programs\opera gx\72.0.3815.459\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\72.0.3815.459\opera.exe => No File FirewallRules: [TCP Query User{EB07BF1D-717A-4251-B954-61336C750562}C:\users\acer\appdata\local\programs\opera gx\72.0.3815.459\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\72.0.3815.459\opera.exe => No File FirewallRules: [UDP Query User{D2B057EF-697A-44D9-B41C-047A8EEEA93B}C:\users\acer\appdata\local\programs\opera gx\72.0.3815.459\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\72.0.3815.459\opera.exe => No File FirewallRules: [{0E05C3FD-8852-45A0-9DF7-D46583F81188}] => (Allow) D:\Games\Grand Theft Auto V\GTA5.exe => No File FirewallRules: [{913C6EAD-B033-45FC-BA65-1D73136F8185}] => (Allow) D:\Games\Grand Theft Auto V\GTA5.exe => No File FirewallRules: [TCP Query User{1980EF71-38C3-4DA0-9DCC-D867582D146B}C:\users\acer\appdata\local\programs\opera gx\72.0.3815.473\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\72.0.3815.473\opera.exe => No File FirewallRules: [UDP Query User{D831441B-3E62-499C-BF3F-847859B15B3D}C:\users\acer\appdata\local\programs\opera gx\72.0.3815.473\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\72.0.3815.473\opera.exe => No File FirewallRules: [{F667DFCB-765D-4CDC-ABD7-36E2CB7A4E07}] => (Allow) C:\Program Files\BlueStacks\HD-Player.exe => No File FirewallRules: [TCP Query User{595CD2E2-B2AB-4BE9-B24A-7FE1BEE0BBCD}C:\users\acer\appdata\local\programs\opera gx\72.0.3815.487\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\72.0.3815.487\opera.exe => No File FirewallRules: [UDP Query User{CC7FF1DC-9FAB-4909-BFF0-8EB4502DE2D6}C:\users\acer\appdata\local\programs\opera gx\72.0.3815.487\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\72.0.3815.487\opera.exe => No File C:\Program Files\Common Files\Avast Software C:\Program Files\Avast Software C:\ProgramData\Avast Software C:\Users\acer\AppData\Roaming\Avast Software C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro C:\Program Files\HitmanPro VirusTotal: C:\WINDOWS\System32\Wscript.exe VirusTotal: C:\Program Files\Intel\SUR\QUEENCREEK\x64\task.vbs Hosts: EmptyTemp: End:: NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system Double-click FRST.exe/FRST64.exe to run it. Press the Fix button just once and wait. Note: No need to paste the script into FRST. Restart the computer if prompted. When the fix is complete FRST will generate a log in the same location it was run from (Fixlog.txt) Please copy and paste its contents into your reply. n your next reply, please include: Fixlog.txt
Farbar Recovery Scan Tool - Fix Highlight the contents of the below code box and press Ctrl + C on your keyboard Code: Start:: CreateRestorePoint: CloseProcesses: (Microsoft Corporation -> Microsoft Corporation) C:\Users\acer\AppData\Roaming\HwxzwCObnu\RegAsm.exe HKU\S-1-5-21-3345053375-1707548004-3847637765-1001\...\Run: [Chromium Update] => C:\Users\acer\AppData\Local\Chromium\Update\1.3.99.0\ChromiumUpdateCore.exe <==== ATTENTION HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION Task: {0ECA1F2E-3162-4E76-A4AF-0C7727B1FD9F} - System32\Tasks\ChromiumUpdateTaskUserS-1-5-21-3345053375-1707548004-3847637765-1001Core => C:\Users\acer\AppData\Local\Chromium\Update\ChromiumUpdate.exe <==== ATTENTION Task: {A5DD70CC-C2AC-416C-B43C-B37E03850BB5} - System32\Tasks\ChromiumUpdateTaskUserS-1-5-21-3345053375-1707548004-3847637765-1001UA => C:\Users\acer\AppData\Local\Chromium\Update\ChromiumUpdate.exe <==== ATTENTION S2 HitmanProScheduler; "C:\Program Files\HitmanPro\hmpsched.exe" [X] 2021-02-06 12:21 - 2021-02-06 12:21 - 000000000 ____D C:\Users\acer\AppData\Roaming\Avast Software 2021-02-06 12:20 - 2021-02-06 12:21 - 000468888 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswc867cd256224c893.tmp 2021-02-06 12:20 - 2021-02-06 12:21 - 000324904 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswbea60b4afae2b7df.tmp 2021-02-06 12:20 - 2021-02-06 12:21 - 000214808 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswcafa7caaceaea1f0.tmp 2021-02-06 12:20 - 2021-02-06 12:20 - 000851256 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswacf82ca0435b5ddc.tmp 2021-02-06 12:20 - 2021-02-06 12:20 - 000522480 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswb8834f4206b5ab9c.tmp 2021-02-06 12:20 - 2021-02-06 12:20 - 000340576 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe 2021-02-06 12:20 - 2021-02-06 12:20 - 000332880 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw2fe2ebce436625b2.tmp 2021-02-06 12:20 - 2021-02-06 12:20 - 000247888 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw8288fb2cb154ebd4.tmp 2021-02-06 12:20 - 2021-02-06 12:20 - 000208672 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw5d6c0848e0076488.tmp 2021-02-06 12:20 - 2021-02-06 12:20 - 000176384 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswe3d4313124dcb869.tmp 2021-02-06 12:20 - 2021-02-06 12:20 - 000108928 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw6fa2ccf5f6dd7d0b.tmp 2021-02-06 12:20 - 2021-02-06 12:20 - 000097360 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw1c11669f3f021b38.tmp 2021-02-06 12:20 - 2021-02-06 12:20 - 000084496 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw2d548227bbe747ab.tmp 2021-02-06 12:20 - 2021-02-06 12:20 - 000042424 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswb304b8d89e04a9f2.tmp 2021-02-06 12:20 - 2021-02-06 12:20 - 000036792 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswf5e09975ce45bd37.tmp 2021-02-06 12:20 - 2021-02-06 12:20 - 000016832 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw49cb41de281d6348.tmp 2021-02-06 12:20 - 2021-02-06 12:20 - 000000000 ____D C:\Program Files\Common Files\Avast Software 2021-02-06 12:20 - 2021-02-06 12:20 - 000000000 ____D C:\Program Files\Avast Software 2021-02-06 12:19 - 2021-02-06 13:35 - 000000000 ____D C:\ProgramData\Avast Software 2021-02-05 21:12 - 2021-02-05 23:31 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro 2021-02-05 21:12 - 2021-02-05 22:26 - 000057728 _____ C:\WINDOWS\system32\Drivers\hitmanpro37.sys 2021-02-05 11:08 - 2021-02-06 13:33 - 000000000 ____D C:\Users\acer\AppData\Roaming\HwxzwCObnu CustomCLSID: HKU\S-1-5-21-3345053375-1707548004-3847637765-1001_Classes\CLSID\{D8E0CDAD-2FAE-40EB-8433-7F5A79714FB8}\InprocServer32 -> C:\Users\acer\AppData\Local\Chromium\Update\1.3.99.0\psuser_64.dll => No File CustomCLSID: HKU\S-1-5-21-3345053375-1707548004-3847637765-1001_Classes\CLSID\{E064AEC2-5150-4DF6-B2A3-1A6721C2076B}\InprocServer32 -> C:\Users\acer\AppData\Local\Chromium\Update\1.3.99.0\psuser_64.dll => No File CustomCLSID: HKU\S-1-5-21-3345053375-1707548004-3847637765-1001_Classes\CLSID\{E9E7529D-7F09-410B-AF2A-CC154473B19C}\InprocServer32 -> C:\Users\acer\AppData\Local\Google\Update\1.3.35.452\psuser_64.dll => No File ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File ShellIconOverlayIdentifiers: [00avg] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll -> No File ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll -> No File AlternateDataStreams: C:\WINDOWS\tracing:? [16] AlternateDataStreams: C:\Users\acer\Local Settings:05-02-2021 [8631] AlternateDataStreams: C:\Users\acer\Local Settings:06-02-2021 [199297] AlternateDataStreams: C:\Users\acer\AppData\Local:05-02-2021 [8631] AlternateDataStreams: C:\Users\acer\AppData\Local:06-02-2021 [199297] AlternateDataStreams: C:\Users\acer\AppData\Local\Application Data:05-02-2021 [8631] AlternateDataStreams: C:\Users\acer\AppData\Local\Application Data:06-02-2021 [199297 FirewallRules: [TCP Query User{AC226EFF-9C04-4F7C-A064-4F72FB9C6723}C:\windows.old\users\acer\appdata\roaming\utorrent\utorrent.exe] => (Allow) C:\windows.old\users\acer\appdata\roaming\utorrent\utorrent.exe => No File FirewallRules: [UDP Query User{ADA20F26-1319-448C-B91B-6D6C710D87E1}C:\windows.old\users\acer\appdata\roaming\utorrent\utorrent.exe] => (Allow) C:\windows.old\users\acer\appdata\roaming\utorrent\utorrent.exe => No File FirewallRules: [TCP Query User{620D7B0F-FA3C-45B6-A9E7-9068B46DF38F}E:\grand theft auto v\gta5.exe] => (Allow) E:\grand theft auto v\gta5.exe => No File FirewallRules: [UDP Query User{0476330A-C7D0-4FFB-A97E-34C50FCD1D7F}E:\grand theft auto v\gta5.exe] => (Allow) E:\grand theft auto v\gta5.exe => No File FirewallRules: [TCP Query User{803067A3-0622-4D99-A4FF-A6868BFAB9D1}D:\games\prototype 2\prototype2.exe] => (Allow) D:\games\prototype 2\prototype2.exe => No File FirewallRules: [UDP Query User{7E7DA199-7341-4E59-BD4D-096CE863A9B9}D:\games\prototype 2\prototype2.exe] => (Allow) D:\games\prototype 2\prototype2.exe => No File FirewallRules: [{598B3BC5-4CBF-4631-8948-FD7A63DA66CB}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe => No File FirewallRules: [{2A8697BB-4F1B-4304-B409-BD638D485784}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe => No File FirewallRules: [TCP Query User{EDE72457-383E-4D54-AD04-2533CD1FA498}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.175\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.175\opera.exe => No File FirewallRules: [UDP Query User{0869433C-2D3D-4A03-9575-50498C8732B5}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.175\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.175\opera.exe => No File FirewallRules: [TCP Query User{F72C8137-90DE-4CBC-975E-D7F24C6C9B5E}D:\grand theft auto v\gta5.exe] => (Allow) D:\grand theft auto v\gta5.exe => No File FirewallRules: [UDP Query User{F80B8DD0-0802-404C-95C6-AAA58F026940}D:\grand theft auto v\gta5.exe] => (Allow) D:\grand theft auto v\gta5.exe => No File FirewallRules: [TCP Query User{08D09850-EBA7-4A7D-A920-E895ADFAC7B5}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.205\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.205\opera.exe => No File FirewallRules: [UDP Query User{0DF59DC5-14AE-4448-B977-D4682E80AB67}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.205\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.205\opera.exe => No File FirewallRules: [TCP Query User{7150D04D-24CD-43C6-9DC0-2C2308258BF3}C:\windows.old\users\acer\appdata\roaming\utorrent\utorrent.exe] => (Allow) C:\windows.old\users\acer\appdata\roaming\utorrent\utorrent.exe => No File FirewallRules: [UDP Query User{18826AB9-612C-4660-94A1-6EB0F6DD1FEE}C:\windows.old\users\acer\appdata\roaming\utorrent\utorrent.exe] => (Allow) C:\windows.old\users\acer\appdata\roaming\utorrent\utorrent.exe => No File FirewallRules: [TCP Query User{C6D35541-F77A-4617-9379-ECD56246D3AA}D:\games\prototype 2\prototype2.exe] => (Allow) D:\games\prototype 2\prototype2.exe => No File FirewallRules: [UDP Query User{04E47FC4-289B-4DC7-B752-3531C1085D1D}D:\games\prototype 2\prototype2.exe] => (Allow) D:\games\prototype 2\prototype2.exe => No File FirewallRules: [TCP Query User{EDC72347-3AA4-4BA1-98DC-99AFFCE9216F}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.205\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.205\opera.exe => No File FirewallRules: [UDP Query User{9B0FF6CC-F8DD-472F-BC02-A6C26E68B64C}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.205\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.205\opera.exe => No File FirewallRules: [TCP Query User{DC74E897-04D9-47E2-A134-F8522ACB7007}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.234\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.234\opera.exe => No File FirewallRules: [UDP Query User{1850A0DC-DFBC-416F-BDDD-466259105F02}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.234\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.234\opera.exe => No File FirewallRules: [{415F2C5E-AEE5-46B2-A68E-C21826AAE4C5}] => (Allow) D:\Games\Steam.exe => No File FirewallRules: [{A1641D3E-677E-41B2-AA22-AE37DE6D76DF}] => (Allow) D:\Games\Steam.exe => No File FirewallRules: [{92F6A1C3-8D65-494D-9BCD-5F5DBF6C96AA}] => (Allow) D:\Games\bin\cef\cef.win7\steamwebhelper.exe => No File FirewallRules: [{21F65E71-C573-4955-8C6B-B92FBF68D725}] => (Allow) D:\Games\bin\cef\cef.win7\steamwebhelper.exe => No File FirewallRules: [{73793D5D-088E-42F7-90A1-B6382C251327}] => (Allow) D:\Games\steamapps\common\Black Squad\binaries\win64\BlackSquadGame.exe => No File FirewallRules: [{46E4AEE1-E99E-4F7B-B67F-D6A649299111}] => (Allow) D:\Games\steamapps\common\Black Squad\binaries\win64\BlackSquadGame.exe => No File FirewallRules: [TCP Query User{0BBDC29A-2AD4-4E3A-A66C-C56746BE45EC}D:\epic games\gmaes\unrealtournament\engine\binaries\win64\ue4-win64-shipping.exe] => (Allow) D:\epic games\gmaes\unrealtournament\engine\binaries\win64\ue4-win64-shipping.exe => No File FirewallRules: [UDP Query User{6812B089-B3B6-41E4-A959-AE24863F4C63}D:\epic games\gmaes\unrealtournament\engine\binaries\win64\ue4-win64-shipping.exe] => (Allow) D:\epic games\gmaes\unrealtournament\engine\binaries\win64\ue4-win64-shipping.exe => No File FirewallRules: [TCP Query User{15A3F9DB-44DC-4E61-868A-639935A0CEE2}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.287\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.287\opera.exe => No File FirewallRules: [UDP Query User{D56A6168-FEF8-4BFD-8EC2-6030CB71A13A}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.287\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.287\opera.exe => No File FirewallRules: [TCP Query User{CE5B5E12-D8AD-479F-A0FE-3C38044E7C66}D:\epic games\gmaes\roguecompany\roguecompany\binaries\win64\roguecompany.exe] => (Allow) D:\epic games\gmaes\roguecompany\roguecompany\binaries\win64\roguecompany.exe => No File FirewallRules: [UDP Query User{38E05DA8-DDAC-440C-93E5-A6BC5797CFBF}D:\epic games\gmaes\roguecompany\roguecompany\binaries\win64\roguecompany.exe] => (Allow) D:\epic games\gmaes\roguecompany\roguecompany\binaries\win64\roguecompany.exe => No File FirewallRules: [TCP Query User{4EDFE3DB-3680-46BC-8A0D-927BDA48CE12}D:\call of duty mw\call of duty modern warfare\modernwarfare.exe] => (Allow) D:\call of duty mw\call of duty modern warfare\modernwarfare.exe => No File FirewallRules: [UDP Query User{E74BD461-6E30-471D-8B09-4E7D572E78D3}D:\call of duty mw\call of duty modern warfare\modernwarfare.exe] => (Allow) D:\call of duty mw\call of duty modern warfare\modernwarfare.exe => No File FirewallRules: [{3149748B-FD86-4719-B962-51CC336ADB3E}] => (Allow) D:\Games\steamapps\common\Fallout76\Fallout76.exe => No File FirewallRules: [{D9B546E0-C1FD-4969-BA5A-BDCB89D708D8}] => (Allow) D:\Games\steamapps\common\Fallout76\Fallout76.exe => No File FirewallRules: [TCP Query User{227BCAB0-EE1F-417D-A158-FD2D878D4F47}D:\epic\rocketleague\binaries\win64\rocketleague.exe] => (Allow) D:\epic\rocketleague\binaries\win64\rocketleague.exe => No File FirewallRules: [UDP Query User{C125EC71-E522-43DF-AD81-274DC7CEEAD3}D:\epic\rocketleague\binaries\win64\rocketleague.exe] => (Allow) D:\epic\rocketleague\binaries\win64\rocketleague.exe => No File FirewallRules: [TCP Query User{644F511C-38AD-4BF7-ADCC-6098C5C61923}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.302\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.302\opera.exe => No File FirewallRules: [UDP Query User{13606449-BE69-4F69-A53B-704236F158C7}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.302\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.302\opera.exe => No File FirewallRules: [TCP Query User{497E4576-738A-4E1D-B360-47C2FF187B88}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.302\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.302\opera.exe => No File FirewallRules: [UDP Query User{37AC1477-1858-4A29-9657-B087A9490B14}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.302\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.302\opera.exe => No File FirewallRules: [TCP Query User{C430D6C2-AF08-44D9-A0B9-D36BFE4E749A}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.310\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.310\opera.exe => No File FirewallRules: [UDP Query User{3266141C-86FE-47B8-8F84-76FC4F490015}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.310\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.310\opera.exe => No File FirewallRules: [{EC1C0BDA-4469-43E1-A4E9-289A42F2CCA1}] => (Allow) D:\epic\steam\steam.exe => No File FirewallRules: [{E361C40A-F4DF-4847-8971-74CC78D2E4A9}] => (Allow) D:\epic\steam\steam.exe => No File FirewallRules: [{0069D078-E195-4A0F-BC9B-797F9AA6E27A}] => (Allow) D:\epic\steam\bin\cef\cef.win7\steamwebhelper.exe => No File FirewallRules: [{D7C59057-3EF2-4256-A507-BE9180C4BD8C}] => (Allow) D:\epic\steam\bin\cef\cef.win7\steamwebhelper.exe => No File FirewallRules: [TCP Query User{3A784161-E1E4-4E48-BFC0-B9A8DA5B1C8B}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.323\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.323\opera.exe => No File FirewallRules: [UDP Query User{EBCAA14F-97DE-4B04-AA71-33117DB95B26}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.323\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.323\opera.exe => No File FirewallRules: [TCP Query User{4514B13B-D552-4D4A-8238-342519117E43}D:\epic\roguecompany\roguecompany\binaries\win64\roguecompany.exe] => (Allow) D:\epic\roguecompany\roguecompany\binaries\win64\roguecompany.exe => No File FirewallRules: [UDP Query User{4CCCFE20-AE45-4F15-80B2-A676D2A4FBAB}D:\epic\roguecompany\roguecompany\binaries\win64\roguecompany.exe] => (Allow) D:\epic\roguecompany\roguecompany\binaries\win64\roguecompany.exe => No File FirewallRules: [TCP Query User{D338B63E-8BA5-406E-959E-43E402C9FB5A}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.323\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.323\opera.exe => No File FirewallRules: [UDP Query User{5EF76A88-BDE8-4D2C-8C77-C8078DD042C6}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.323\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.323\opera.exe => No File FirewallRules: [TCP Query User{BDD56E41-65DA-4CE0-B7DB-7D7A7FB013AA}C:\windows.old\users\acer\appdata\roaming\utorrent\updates\3.5.5_45828.exe] => (Allow) C:\windows.old\users\acer\appdata\roaming\utorrent\updates\3.5.5_45828.exe => No File FirewallRules: [UDP Query User{508CE07A-7AD0-4EB7-A910-A11C8263A01A}C:\windows.old\users\acer\appdata\roaming\utorrent\updates\3.5.5_45828.exe] => (Allow) C:\windows.old\users\acer\appdata\roaming\utorrent\updates\3.5.5_45828.exe => No File FirewallRules: [TCP Query User{077D2CFA-446A-49D7-93C0-D081DEA0CCFE}D:\games\crossout\launcher.exe] => (Allow) D:\games\crossout\launcher.exe => No File FirewallRules: [UDP Query User{A58415D4-260C-418C-99AC-29DB87FF9766}D:\games\crossout\launcher.exe] => (Allow) D:\games\crossout\launcher.exe => No File FirewallRules: [{6150A2FD-BA41-466A-9DCE-33CB58758E39}] => (Allow) C:\Program Files (x86)\AnyDesk\AnyDesk.exe => No File FirewallRules: [{4815147A-AE2A-41C2-AF2E-30974DA861A7}] => (Allow) C:\Program Files (x86)\AnyDesk\AnyDesk.exe => No File FirewallRules: [{284DDD70-29DC-4ADC-ACB8-B3E6B853D819}] => (Allow) C:\Program Files (x86)\AnyDesk\AnyDesk.exe => No File FirewallRules: [{8E7C00C3-1F67-41C2-801A-99CB161BCA77}] => (Allow) C:\Program Files (x86)\AnyDesk\AnyDesk.exe => No File FirewallRules: [{4FBB81D4-9273-45EC-A29B-EC9E76B30A5A}] => (Allow) C:\Program Files (x86)\AnyDesk\AnyDesk.exe => No File FirewallRules: [{18921F63-7CDE-4DAA-9DBA-09EC60D83C44}] => (Allow) C:\Program Files (x86)\AnyDesk\AnyDesk.exe => No File FirewallRules: [TCP Query User{5A5CFA36-E6C2-470F-8FB3-87390BAD4932}D:\epic\spellbreak\g3\binaries\win64\spellbreak.exe] => (Allow) D:\epic\spellbreak\g3\binaries\win64\spellbreak.exe => No File FirewallRules: [UDP Query User{906C425A-90A9-4CA8-9AFB-BA0535C85314}D:\epic\spellbreak\g3\binaries\win64\spellbreak.exe] => (Allow) D:\epic\spellbreak\g3\binaries\win64\spellbreak.exe => No File FirewallRules: [TCP Query User{E93A4471-ED97-4D26-8AB8-40197905C4F0}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.441\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.441\opera.exe => No File FirewallRules: [UDP Query User{EA280370-CADC-4922-BBCE-CB8686D43460}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.441\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.441\opera.exe => No File FirewallRules: [TCP Query User{4B907162-AB70-4CEE-B055-7DAEEE6439CD}D:\games\ubisoft game launcher\games\hyper scape\hyperscape.exe] => (Allow) D:\games\ubisoft game launcher\games\hyper scape\hyperscape.exe => No File FirewallRules: [UDP Query User{BE5D617F-F915-46C2-B642-2105B9452429}D:\games\ubisoft game launcher\games\hyper scape\hyperscape.exe] => (Allow) D:\games\ubisoft game launcher\games\hyper scape\hyperscape.exe => No File FirewallRules: [{DB015787-0F8C-4DE3-97FA-0834EE306FB6}] => (Allow) D:\steam\Steam.exe => No File FirewallRules: [{D4B1A240-4B64-41DC-8A25-37A9EAB484E0}] => (Allow) D:\steam\Steam.exe => No File FirewallRules: [{A007C0F5-2C70-4E1A-B3FE-B34B87A3DC36}] => (Allow) D:\steam\bin\cef\cef.win7\steamwebhelper.exe => No File FirewallRules: [{FB08D27A-DD41-4A3F-8872-946BF1CF00D8}] => (Allow) D:\steam\bin\cef\cef.win7\steamwebhelper.exe => No File FirewallRules: [TCP Query User{DB65ADAF-67BE-4624-BFB0-E0CB96E5CCDE}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.449\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.449\opera.exe => No File FirewallRules: [UDP Query User{BAC354E5-711F-4CC9-822B-5ED7F8A92725}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.449\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.449\opera.exe => No File FirewallRules: [{4259C875-6C8A-422D-9AB0-A56D7E03C21C}] => (Allow) D:\steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File FirewallRules: [{A98B9205-0FBB-4865-8AFE-50E5AE1E9131}] => (Allow) D:\steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File FirewallRules: [TCP Query User{6C05BD8C-C3B3-4500-8014-A14A0F3A5E9A}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.456\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.456\opera.exe => No File FirewallRules: [UDP Query User{4598C22D-4F3F-4E1F-BD9A-41140A894D98}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.456\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.456\opera.exe => No File FirewallRules: [{FA74E7FF-FECF-4872-9C7C-B8D13F71BF83}] => (Allow) D:\Games\Grand Theft Auto V\GTA5.exe => No File FirewallRules: [{C49216C1-E31F-4C25-9834-7AFA827267D3}] => (Allow) D:\Games\Grand Theft Auto V\GTA5.exe => No File FirewallRules: [TCP Query User{1AF01F38-F9EF-4628-A73F-4BD8AD017085}D:\games\cyberpunk 2077\bin\x64\cyberpunk2077.exe] => (Allow) D:\games\cyberpunk 2077\bin\x64\cyberpunk2077.exe => No File FirewallRules: [UDP Query User{55E51065-B04F-415E-BC79-5FAFA5A8FC08}D:\games\cyberpunk 2077\bin\x64\cyberpunk2077.exe] => (Allow) D:\games\cyberpunk 2077\bin\x64\cyberpunk2077.exe => No File FirewallRules: [TCP Query User{5E295B62-F9D9-4878-A00F-2828A6BC52B3}C:\program files\jetbrains\intellij idea community edition 2020.3\bin\idea64.exe] => (Allow) C:\program files\jetbrains\intellij idea community edition 2020.3\bin\idea64.exe => No File FirewallRules: [UDP Query User{7D6C7457-17B6-4239-B18C-AEE44738FA21}C:\program files\jetbrains\intellij idea community edition 2020.3\bin\idea64.exe] => (Allow) C:\program files\jetbrains\intellij idea community edition 2020.3\bin\idea64.exe => No File FirewallRules: [TCP Query User{1664C9A9-99D7-4CA8-B610-3494010B1991}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.456\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.456\opera.exe => No File FirewallRules: [UDP Query User{0A1C9BAD-2499-46B7-B3BB-89DBF9FEB5A1}C:\users\acer\appdata\local\programs\opera gx\71.0.3770.456\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\71.0.3770.456\opera.exe => No File FirewallRules: [TCP Query User{8829BBA8-2BC7-4B02-AE43-7A9EA6EE2415}C:\users\acer\appdata\local\programs\opera gx\72.0.3815.454\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\72.0.3815.454\opera.exe => No File FirewallRules: [UDP Query User{F8BDB726-0AE5-4B78-BF98-E88AC967579C}C:\users\acer\appdata\local\programs\opera gx\72.0.3815.454\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\72.0.3815.454\opera.exe => No File FirewallRules: [TCP Query User{054DA44A-D37C-46BA-93DB-23E65020F078}C:\users\acer\appdata\local\programs\opera gx\72.0.3815.454\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\72.0.3815.454\opera.exe => No File FirewallRules: [UDP Query User{7BDF4DC1-EAF4-469D-ADD0-C70D687C13C3}C:\users\acer\appdata\local\programs\opera gx\72.0.3815.454\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\72.0.3815.454\opera.exe => No File FirewallRules: [TCP Query User{D0E52C5F-38AF-422D-A5C3-38A257190C9F}D:\steam\steamapps\common\spellbreak\g3\binaries\win64\spellbreak.exe] => (Allow) D:\steam\steamapps\common\spellbreak\g3\binaries\win64\spellbreak.exe => No File FirewallRules: [UDP Query User{88FA4F61-7966-4DBB-8BF0-95E3FF14C5E3}D:\steam\steamapps\common\spellbreak\g3\binaries\win64\spellbreak.exe] => (Allow) D:\steam\steamapps\common\spellbreak\g3\binaries\win64\spellbreak.exe => No File FirewallRules: [TCP Query User{9D2A4839-88F3-4DA0-841D-97D0D4FBC0C4}C:\users\acer\appdata\local\programs\opera gx\72.0.3815.459\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\72.0.3815.459\opera.exe => No File FirewallRules: [UDP Query User{EF91B707-7D5F-41DA-B3DE-DA883F5C7800}C:\users\acer\appdata\local\programs\opera gx\72.0.3815.459\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\72.0.3815.459\opera.exe => No File FirewallRules: [TCP Query User{EB07BF1D-717A-4251-B954-61336C750562}C:\users\acer\appdata\local\programs\opera gx\72.0.3815.459\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\72.0.3815.459\opera.exe => No File FirewallRules: [UDP Query User{D2B057EF-697A-44D9-B41C-047A8EEEA93B}C:\users\acer\appdata\local\programs\opera gx\72.0.3815.459\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\72.0.3815.459\opera.exe => No File FirewallRules: [{0E05C3FD-8852-45A0-9DF7-D46583F81188}] => (Allow) D:\Games\Grand Theft Auto V\GTA5.exe => No File FirewallRules: [{913C6EAD-B033-45FC-BA65-1D73136F8185}] => (Allow) D:\Games\Grand Theft Auto V\GTA5.exe => No File FirewallRules: [TCP Query User{1980EF71-38C3-4DA0-9DCC-D867582D146B}C:\users\acer\appdata\local\programs\opera gx\72.0.3815.473\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\72.0.3815.473\opera.exe => No File FirewallRules: [UDP Query User{D831441B-3E62-499C-BF3F-847859B15B3D}C:\users\acer\appdata\local\programs\opera gx\72.0.3815.473\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\72.0.3815.473\opera.exe => No File FirewallRules: [{F667DFCB-765D-4CDC-ABD7-36E2CB7A4E07}] => (Allow) C:\Program Files\BlueStacks\HD-Player.exe => No File FirewallRules: [TCP Query User{595CD2E2-B2AB-4BE9-B24A-7FE1BEE0BBCD}C:\users\acer\appdata\local\programs\opera gx\72.0.3815.487\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\72.0.3815.487\opera.exe => No File FirewallRules: [UDP Query User{CC7FF1DC-9FAB-4909-BFF0-8EB4502DE2D6}C:\users\acer\appdata\local\programs\opera gx\72.0.3815.487\opera.exe] => (Allow) C:\users\acer\appdata\local\programs\opera gx\72.0.3815.487\opera.exe => No File C:\Program Files\Common Files\Avast Software C:\Program Files\Avast Software C:\ProgramData\Avast Software C:\Users\acer\AppData\Roaming\Avast Software C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro C:\Program Files\HitmanPro VirusTotal: C:\WINDOWS\System32\Wscript.exe VirusTotal: C:\Program Files\Intel\SUR\QUEENCREEK\x64\task.vbs Hosts: EmptyTemp: End:: NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system Double-click FRST.exe/FRST64.exe to run it. Press the Fix button just once and wait. Note: No need to paste the script into FRST. Restart the computer if prompted. When the fix is complete FRST will generate a log in the same location it was run from (Fixlog.txt) Please copy and paste its contents into your reply. n your next reply, please include: Fixlog.txt
icotonev Security Analyst Staff member Joined Jan 18, 2020 Posts 146 Location Bulgaria Feb 7, 2021 #5 Hello, rayan2000..! Are you still with me..?
x BlueRobot Administrator Staff member Joined May 7, 2013 Posts 10,185 Location %systemroot% Feb 12, 2021 #6 Thread has been closed due to no response from the user. @rayan2000 if you would like the thread to be reopened, then please message one of the staff members.
Thread has been closed due to no response from the user. @rayan2000 if you would like the thread to be reopened, then please message one of the staff members.
