# Virus dusApp aparecio de repente entre mis aplicaciones **URL:** https://forospyware.com/t/virus-dusapp-aparecio-de-repente-entre-mis-aplicaciones/36460 **Category:** Eliminar Malwares **Created:** [12 Octubre, 2026 16:45 UTC](https://forospyware.com/t/virus-dusapp-aparecio-de-repente-entre-mis-aplicaciones/36460 "2026-10-12T16:45:59Z") **Posts on this page:** 6 **Page:** 1
### Author: ![Nashe\_Xd](https://forospyware.com/user_avatar/forospyware.com/nashe_xd/32/45162_2.png) [@Nashe\_Xd](https://forospyware.com/u/Nashe_Xd) #### Post date: [12 Octubre, 2026 16:46 UTC](https://forospyware.com/t/virus-dusapp-aparecio-de-repente-entre-mis-aplicaciones/36460/1 "2026-10-12T16:46:00Z")
Buenas, hoy estaba revisando mis aplicaciones y note una llamada dusApp, no recuerdo haberla instalado nunca y por lo que vi en este foro es una especie de spyware, segui los consejos de otra publicacion y ya tengo addition.txt y frst.txt, me serviria mucho si me pudieran ayudar ---
### Author: ![Nashe\_Xd](https://forospyware.com/user_avatar/forospyware.com/nashe_xd/32/45162_2.png) [@Nashe\_Xd](https://forospyware.com/u/Nashe_Xd) #### Post date: [12 Octubre, 2026 16:46 UTC](https://forospyware.com/t/virus-dusapp-aparecio-de-repente-entre-mis-aplicaciones/36460/2 "2026-10-12T16:46:32Z")
Resultado del análisis realizado por Farbar Recovery Scan Tool (FRST) (x64) Versión: 26-09-2026 Ejecutado por Admin (administrador) sobre LAPTOP-QVS0U5OQ (HP HP Laptop 14-dq1xxx) (12-10-2026 10:32:16) Ejecutado desde C:\Users\Admin\Downloads\farbar-recovery-scan-tool-26-09-2026.exe Perfiles cargados: Admin Plataforma: Microsoft Windows 11 Home Single Language Versión 25H2 26200.9550 (X64) Idioma: Español (México) Navegador predeterminado: Edge Modo de Inicio: Normal ==================== Procesos (Lista blanca) ================= (Si una entrada es incluida en el fixlist, el proceso será cerrado. El archivo no será movido.) (C:\Program Files (x86)\Glarysoft\Malware Hunter\MalwareHunter.exe -\>) (Glarysoft Ltd → Glarysoft Ltd) C:\Program Files (x86)\Glarysoft\Malware Hunter\x64\x64ProcessAssistSvc.exe (C:\Program Files (x86)\Glarysoft\Malware Hunter\mhtray.exe -\>) (Glarysoft Ltd → Glarysoft Ltd) C:\Program Files (x86)\Glarysoft\Malware Hunter\MalwareHunter.exe (C:\Program Files\McAfee\WebAdvisor\servicehost.exe -\>) (McAfee, LLC → McAfee, LLC) C:\Program Files\McAfee\WebAdvisor\uihost.exe (C:\Program Files\WindowsApps\AD2F1837.HPSystemEventUtility\_3.2.24.0\_x64\_\_v10z8vjag6ke6\SystemEventUtility\HPSystemEventUtilityBackground.exe -\>) (HP Inc. → HP Inc.) C:\Program Files\WindowsApps\AD2F1837.HPSystemEventUtility\_3.2.24.0\_x64\_\_v10z8vjag6ke6\SystemEventUtility\HPSystemEventUtilityHost.exe (C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub\_19.2610.35011.0\_x64\_\_8wekyb3d8bbwe\M365Copilot.exe -\>) (Microsoft Corporation → Microsoft Corporation) C:\Program Files (x86)\Microsoft\EdgeWebView\Application\154.0.4258.62\msedgewebview2.exe (C:\Program Files\WindowsApps\MSTeams\_26260.1701.5139.3736\_x64\_\_8wekyb3d8bbwe\ms-teams.exe -\>) (Microsoft Corporation → Microsoft Corporation) C:\Program Files (x86)\Microsoft\EdgeWebView\Application\154.0.4258.62\msedgewebview2.exe (C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MsMpEng.exe -\>) (Microsoft Windows → Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\DefenderSessionHelper.exe (C:\Users\Admin\AppData\Local\MEGAsync\MEGAsync.exe -\>) (Mega Limited → ) C:\Users\Admin\AppData\Local\MEGAsync\mega-desktop-app-gfxworker.exe (DriverStore\FileRepository\cui\_dch.inf\_amd64\_7208949846a9b9dc\igfxCUIServiceN.exe -\>) (Intel Corporation → Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\cui\_dch.inf\_amd64\_7208949846a9b9dc\igfxEMN.exe (explorer.exe -\>) (Mega Limited → Mega Limited) C:\Users\Admin\AppData\Local\MEGAsync\MEGAsync.exe (explorer.exe -\>) (Microsoft Corporation → ) C:\Program Files\WindowsApps\Microsoft.ScreenSketch\_11.2607.23.0\_x64\_\_8wekyb3d8bbwe\SnippingTool\SnippingTool.exe (explorer.exe -\>) (Realtek Semiconductor Corp. → Realtek Semiconductor) C:\Windows\System32\RtkAudUService64.exe (HP Inc. → HP Inc.) C:\Program Files\HP\HP Media Network\HPMediaNetwork.exe (HP Inc. → HP Inc.) C:\Program Files\WindowsApps\AD2F1837.HPSystemEventUtility\_3.2.24.0\_x64\_\_v10z8vjag6ke6\SystemEventUtility\HPSystemEventUtilityBackground.exe (Microsoft Corporation → Microsoft Corporation) C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe \<7\> (Microsoft Corporation → Microsoft Corporation) C:\Program Files (x86)\Microsoft\EdgeWebView\Application\154.0.4258.62\msedgewebview2.exe \<16\> (Microsoft Corporation → Microsoft Corporation) C:\Program Files\Microsoft OneDrive\26.178.0913.0007\OneDrive.Sync.Service.exe (Microsoft Corporation → Microsoft Corporation) C:\Program Files\Microsoft OneDrive\OneDrive.exe (Microsoft Corporation → Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub\_19.2610.35011.0\_x64\_\_8wekyb3d8bbwe\M365Copilot.exe (Microsoft Corporation → Microsoft Corporation) C:\Windows\System32\GameInputSvc.exe (Microsoft Corporation → Windows (R) Win 7 DDK provider) C:\Program Files\Microsoft GameInput\x64\GameInputRedistService.exe (Microsoft Windows → Microsoft) C:\Windows\UUS\amd64\MoNotificationUx.exe (services.exe -\>) (ELAN Microelectronics Corporation → ) C:\Windows\System32\ELAN\_MOC\_IAP\_Service.exe (services.exe -\>) (HP Inc. → HP Inc.) C:\Program Files\HPCommRecovery\HPCommRecovery.exe (services.exe -\>) (HP Inc. → HP Inc.) C:\Program Files\HPPrintScanDoctor\HPPrintScanDoctorService.exe (services.exe -\>) (HP Inc. → HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf\_amd64\_ef460d1f2a35fc16\x64\TouchpointAnalyticsClientService.exe (services.exe -\>) (HP Inc. → HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpcustomcapcomp.inf\_amd64\_166246cb8bd387ff\x64\AppHelperCap.exe (services.exe -\>) (HP Inc. → HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpcustomcapcomp.inf\_amd64\_166246cb8bd387ff\x64\DiagsCap.exe (services.exe -\>) (HP Inc. → HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpcustomcapcomp.inf\_amd64\_166246cb8bd387ff\x64\NetworkCap.exe (services.exe -\>) (HP Inc. → HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpcustomcapcomp.inf\_amd64\_166246cb8bd387ff\x64\SysInfoCap.exe (services.exe -\>) (Intel Corporation → Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\cui\_dch.inf\_amd64\_7208949846a9b9dc\igfxCUIServiceN.exe (services.exe -\>) (Intel Corporation → Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\dptf\_cpu.inf\_amd64\_21306a77b30fd6e0\esif\_uf.exe (services.exe -\>) (Intel Corporation → Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iastorac.inf\_amd64\_ba273d0ffb93e225\RstMwService.exe (services.exe -\>) (Intel Corporation → Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igcc\_dch.inf\_amd64\_9cf4db1a1fd1b22d\OneApp.IGCC.WinService.exe (services.exe -\>) (Intel Corporation → Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iigd\_dch.inf\_amd64\_6b9450da178a9e04\IntelCpHDCPSvc.exe (services.exe -\>) (Intel(R) Embedded Subsystems and IP Blocks Group → Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\dal.inf\_amd64\_31a8dbbf39dcdc3b\jhi\_service.exe (services.exe -\>) (McAfee, LLC → McAfee, LLC) C:\Program Files\McAfee\WebAdvisor\servicehost.exe (services.exe -\>) (Microsoft Corporation → Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe (services.exe -\>) (Microsoft Corporation → Microsoft Corporation) C:\Program Files\Microsoft OneDrive\26.178.0913.0007\FileSyncHelper.exe (services.exe -\>) (Microsoft Corporation → Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (services.exe -\>) (Microsoft Corporation → Microsoft Corporation) C:\Windows\System32\GameInputSvc.exe (services.exe -\>) (Microsoft Corporation → Windows (R) Win 7 DDK provider) C:\Program Files\Microsoft GameInput\x64\GameInputRedistService.exe (services.exe -\>) (Microsoft Windows Hardware Compatibility Publisher → Realtek Semiconductor Corp.) C:\Windows\RtkBtManServ.exe (services.exe -\>) (Microsoft Windows Publisher → Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpDefenderCoreService.exe (services.exe -\>) (Microsoft Windows Publisher → Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MsMpEng.exe (services.exe -\>) (Realtek Semiconductor Corp. → Realtek Semiconductor) C:\Windows\System32\RtkAudUService64.exe (services.exe -\>) (Sound Research Corporation → Sound Research, Corp.) C:\Windows\System32\SECOMN64.exe (services.exe -\>) (Synaptics Incorporated → Synaptics Incorporated) C:\Windows\System32\SynTPEnhService.exe (services.exe -\>) (WildTangent, Inc. → ) C:\Program Files (x86)\WildTangent Games\Integration\WildTangentHelperService.exe (svchost.exe -\>) (Glarysoft Ltd → Glarysoft Ltd) C:\Program Files (x86)\Glarysoft\Malware Hunter\Cloudscan\MHCloudSvc.exe (svchost.exe -\>) (Glarysoft Ltd → Glarysoft Ltd) C:\Program Files (x86)\Glarysoft\Malware Hunter\mhtray.exe (svchost.exe -\>) (HP Inc. → HP Inc.) C:\Program Files (x86)\HP\HPAudioSwitch\HPAudioSwitch.exe (svchost.exe -\>) (HP Inc. → HP Inc.) C:\Program Files\WindowsApps\ad2f1837.hpjumpstarts\_1.10.1627.0\_x64\_\_v10z8vjag6ke6\HP.JumpStarts.exe (svchost.exe -\>) (Microsoft Corporation → Microsoft Corporation) C:\Program Files\Microsoft OneDrive\26.178.0913.0007\FileCoAuth.exe (svchost.exe -\>) (Microsoft Corporation → Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.GamingApp\_2609.1001.16.0\_x64\_\_8wekyb3d8bbwe\XboxPcAppFT.exe (svchost.exe -\>) (Microsoft Corporation → Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.StartExperiencesApp\_1.380.2.0\_x64\_\_8wekyb3d8bbwe\MicrosoftStartFeedProvider\MicrosoftStartFeedProvider.exe (svchost.exe -\>) (Microsoft Windows → Microsoft Corporation) C:\Windows\System32\dllhost.exe (svchost.exe -\>) (Microsoft Windows → Microsoft Corporation) C:\Windows\System32\smartscreen.exe (svchost.exe -\>) (Microsoft Windows → Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp\_cw5n1h2txyewy\CHXSmartScreen.exe (svchost.exe -\>) (Microsoft Windows → Microsoft Corporation) C:\Windows\UUS\amd64\MoUsoCoreWorker.exe (SynTPEnhService.exe -\>) (Synaptics Incorporated → Synaptics Incorporated) C:\Windows\System32\SynTPEnh.exe ==================== Registro (Lista blanca) =================== (Si una entrada es incluida en el fixlist, el elemento del registro será restaurado a su valor predeterminado o será eliminado. El archivo no será movido.) HKLM…\Run: [RtkAudUService] =\> C:\WINDOWS\System32\RtkAudUService64.exe [1138976 2020-08-13] (Realtek Semiconductor Corp. → Realtek Semiconductor) HKLM…\RunOnce: [Delete Cached Update Binary] =\> C:\WINDOWS\system32\cmd.exe /q /c del /q “C:\Program Files\Microsoft OneDrive\Update\OneDriveSetup.exe” [147194768 2026-10-10] (Microsoft Corporation → Microsoft Corporation) HKLM…\RunOnce: [Delete Cached Standalone Update Binary] =\> C:\WINDOWS\system32\cmd.exe /q /c del /q “C:\Program Files\Microsoft OneDrive\StandaloneUpdater\OneDriveSetup.exe” (Ningún archivo) HKLM…\RunOnce: [msedge\_cleanup\_{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}] =\> C:\Program Files (x86)\Microsoft\Edge\Application\155.0.4283.45\Installer\setup.exe [6591816 2026-10-10] (Microsoft Corporation → Microsoft Corporation) HKU\S-1-5-21-799460012-3513789069-1987005638-1001…\Run: [HPSEU\_Host\_Launcher] =\> C:\Program Files\HP\HP System Event Utility\Host Launcher\HpseuHostLauncher.exe [545864 2025-11-17] (HP Inc. → HP Inc.) HKU\S-1-5-21-799460012-3513789069-1987005638-1001…\Run: [OneDrive] =\> C:\Program Files\Microsoft OneDrive\OneDrive.exe [4723048 2026-10-10] (Microsoft Corporation → Microsoft Corporation) HKU\S-1-5-21-799460012-3513789069-1987005638-1001…\Run: [Steam] =\> C:\Program Files (x86)\Steam\steam.exe [5774488 2026-07-23] (Valve Corp. → Valve Corporation) HKU\S-1-5-21-799460012-3513789069-1987005638-1001…\Run: [MicrosoftEdgeAutoLaunch\_5EFC0ECB77A7585FE9DCDD0B2E946A2B] =\> “C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe” --win-session-start [5438280 2026-10-08] (Microsoft Corporation → Microsoft Corporation) HKU\S-1-5-21-799460012-3513789069-1987005638-1001…\Run: [RobloxPlayerBeta] =\> C:\Users\Admin\AppData\Local\Roblox\Versions\version-cec3ad5889b447cf\RobloxPlayerBeta.exe [141782992 2026-10-07] (Roblox Corporation → Roblox Corporation) HKU\S-1-5-21-799460012-3513789069-1987005638-1001…\MountPoints2: {8832b84b-7b52-11f0-a55a-ec4fe98e3783} - “D:\autorun.exe” HKLM…\Print\Monitors\Nitro PDF Port 14 Monitor: C:\WINDOWS\system32\NxPrinterMonitor14.dll [341448 2023-07-19] (Nitro Software, Inc. → Nitro Software, Inc.) HKLM\Software\Microsoft\Active Setup\Installed Components: [{49210152-871f-4ffa-961d-a172abcbc09d}] → C:\Program Files\Google\Chrome\Application\PlatformExperienceHelper\platform\_experience\_helper.exe [4924568 2026-08-11] (Google LLC → Google LLC) HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] → C:\Program Files\Google\Chrome\Application\155.0.8059.39\Installer\chrmstp.exe [8414872 2026-10-07] (Google LLC → Google LLC) HKLM\Software…\Authentication\Credential Providers: [{C885AA15-1764-4293-B82A-0586ADD46B35}] → Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MEGAsync.lnk [2024-10-14] ShortcutTarget: MEGAsync.lnk → C:\Users\Admin\AppData\Local\MEGAsync\MEGAsync.exe (Mega Limited → Mega Limited) ==================== Tareas programadas (Lista blanca) ================= (Si una entrada es incluida en el fixlist, será eliminada del registro. El archivo no se moverá a menos que sea añadido al listado por separado.) Task: {5E09C9B0-49BB-4717-9877-75046F9E9CE0} - \Opera GX scheduled Autoupdate 1710833736 → Ningún archivo \<==== ATENCIÓN Task: {CE4D8E90-E7CA-4161-986F-A9ECA8470189} - \Opera GX scheduled Autoupdate 1755870323 → Ningún archivo \<==== ATENCIÓN Task: {172D30CC-8EAC-4D3F-82F6-236D63A98CF0} - System32\Tasks\GoogleSystem\GoogleUpdater\GoogleUpdaterTaskSystem132.0.6806.0{58D8C81F-2C75-4EF9-A6F5-603B20B93DA0} =\> “C:\Program Files (x86)\Google\GoogleUpdater\132.0.6806.0\updater.exe” --wake --system (Ningún archivo) Task: {43E58499-67A6-42D2-AD2F-67069B08FE72} - System32\Tasks\GoogleSystem\GoogleUpdater\GoogleUpdaterTaskSystem156.0.8067.0{150B38F1-B1C4-4B55-90D9-6FD872A84CB6} =\> C:\Program Files (x86)\Google\GoogleUpdater\156.0.8067.0\updater.exe [9992344 2026-09-21] (Google LLC → Google LLC) Task: {683CAB8D-7F64-4D1E-B6EA-9FFB7017BF28} - System32\Tasks\GoogleUserPEH\RunPlatformExperienceHelper\_Daily =\> C:\Program Files\Google\Chrome\Application\PlatformExperienceHelper\platform\_experience\_helper.exe [4924568 2026-08-11] (Google LLC → Google LLC) Task: {CE440E1C-9BD7-41E5-AE72-7283487411A1} - System32\Tasks\GoogleUserPEH\RunPlatformExperienceHelper\_Metrics =\> C:\Program Files\Google\Chrome\Application\PlatformExperienceHelper\platform\_experience\_helper.exe [4924568 2026-08-11] (Google LLC → Google LLC) Task: {C5DEDB33-2A5D-4CBD-AAE9-3115CCF15C6B} - System32\Tasks\GUMalwareHunter =\> C:\Program Files (x86)\Glarysoft\Malware Hunter\mhtray.exe [801176 2024-04-21] (Glarysoft Ltd → Glarysoft Ltd) Task: {1DD81BB1-8C6B-47FC-9041-01EF1F232EF9} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Update Notice =\> C:\Program Files (x86)\HP\HP Support Framework\Resources\BingPopup\BingPopup.exe [1026632 2026-08-13] (HP Inc. → HP Inc.) → C:\Program Files (x86)\HP\HP Support Framework\/show Task: {9FCE597C-90F1-4E08-9877-FCEB227865C4} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report =\> C:\Program Files (x86)\HP\HP Support Framework\Resources\HPSFReport.exe [480264 2026-08-13] (HP Inc. → HP Inc.) Task: {0D93B9A6-E640-45CB-8B8B-CB80D536262D} - System32\Tasks\HP\Consent Manager Launcher =\> C:\WINDOWS\system32\sc.exe [102400 2025-07-01] (Microsoft Windows → Microsoft Corporation) → start hptouchpointanalyticsservice Task: {631897A9-E49C-4FF2-9787-8FD335B67E78} - System32\Tasks\HPAudioSwitch =\> C:\Program Files (x86)\HP\HPAudioSwitch\HPAudioSwitch.exe [1644472 2019-06-21] (HP Inc. → HP Inc.) Task: {CFA20DD4-63B6-40EB-AC6B-2AA1C5425480} - System32\Tasks\McAfeeTsk\OOBEUpgrader =\> C:\Program Files\McAfee\MSC\OOBE\_Upgrader.exe /Run (Ningún archivo) Task: {DF922311-4C01-4CC4-A672-8E69C2469CE8} - System32\Tasks\MEGA\MEGAsync Update Task S-1-5-21-799460012-3513789069-1987005638-1001 =\> C:\Users\Admin\AppData\Local\MEGAsync\MEGAupdater.exe [2091024 2026-09-21] (Mega Limited → ) Task: {C0B9CCF9-725B-4717-835E-328339147E79} - System32\Tasks\Microsoft\Office\Office Automatic Updates 2.0 =\> C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [22865832 2022-03-30] (Microsoft Corporation → Microsoft Corporation) Task: {15199D9B-2F7E-4A01-B550-C8658C537CAA} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor =\> C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [22865832 2022-03-30] (Microsoft Corporation → Microsoft Corporation) Task: {75887F00-992B-4B1D-BBA7-B8F641623D0C} - System32\Tasks\Microsoft\Office\Office Feature Updates =\> C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [138680 2024-02-15] (Microsoft Corporation → Microsoft Corporation) Task: {F1B07844-3B26-4B70-A20D-1A39C92DF0D0} - System32\Tasks\Microsoft\Office\Office Feature Updates Logon =\> C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [138680 2024-02-15] (Microsoft Corporation → Microsoft Corporation) Task: {D17BCEC3-FC8E-4691-8DCF-AA13B441E164} - System32\Tasks\Microsoft\Office\Office Performance Monitor =\> C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\operfmon.exe [61336 2024-02-15] (Microsoft Corporation → Microsoft Corporation) Task: {4AC7D5CE-9478-43C7-8A75-2FB9F9092643} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 =\> C:\Program Files\Microsoft Office\root\Office16\msoia.exe [8338896 2024-02-15] (Microsoft Corporation → Microsoft Corporation) Task: {C272422D-600A-4D1B-8F68-F67FCF6EFFDE} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 =\> C:\Program Files\Microsoft Office\root\Office16\msoia.exe [8338896 2024-02-15] (Microsoft Corporation → Microsoft Corporation) Task: {077BA067-7C15-40F0-B22E-C9DC2A54B4A2} - System32\Tasks\Microsoft\Windows\Location\Notifications =\> %windir%\System32\LocationNotificationWindows.exe (Ningún archivo) Task: {CCDFC0B8-01A3-4E74-A820-4F13F51D269E} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser =\> %SystemRoot%\System32\MbaeParserTask.exe (Ningún archivo) Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO\_UxBroker =\> %systemroot%\system32\MusNotification.exe (Ningún archivo) Task: {B66CB323-5A49-4997-BC28-E8CB5A30D05A} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance =\> C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe [1902880 2026-09-17] (Microsoft Windows Publisher → Microsoft Corporation) Task: {DDCEB4CF-8A10-4545-92EC-EC6D62C97074} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup =\> C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe [1902880 2026-09-17] (Microsoft Windows Publisher → Microsoft Corporation) Task: {C246C7D0-715B-426F-9DAE-3C09ED7CF9C5} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan =\> C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe [1902880 2026-09-17] (Microsoft Windows Publisher → Microsoft Corporation) Task: {7356587E-2AB5-4ADA-9686-E19E2E3974CA} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification =\> C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe [1902880 2026-09-17] (Microsoft Windows Publisher → Microsoft Corporation) Task: {6D5C21E8-FDBC-4A66-A4B8-2C834EA20211} - System32\Tasks\OneDrive Per-Machine Standalone Update Task =\> C:\Program Files\Microsoft OneDrive\OneDriveStandaloneUpdater.exe [4414312 2026-10-10] (Microsoft Corporation → Microsoft Corporation) Task: {B69B9B12-B361-421F-A478-8F45B30BD402} - System32\Tasks\OneDrive Reporting Task-S-1-5-21-799460012-3513789069-1987005638-1001 =\> C:\Program Files\Microsoft OneDrive\OneDriveStandaloneUpdater.exe [4414312 2026-10-10] (Microsoft Corporation → Microsoft Corporation) Task: {101B3026-1FA8-4A86-BCF8-8D68A0E1C58F} - System32\Tasks\OneDrive Startup Task-S-1-5-21-799460012-3513789069-1987005638-1001 =\> C:\Program Files\Microsoft OneDrive\26.178.0913.0007\OneDriveLauncher.exe [874856 2026-10-10] (Microsoft Corporation → Microsoft Corporation) Task: {7578241F-E618-428B-BDD8-6420E0A14258} - System32\Tasks\SoftLanding\S-1-5-21-799460012-3513789069-1987005638-1001\SoftLandingRefreshForExpirationTask-{8afb401d-0dc9-4c2f-b2a1-7937e91af649} =\> {F576B2F9-7850-4226-ADB0-E5993FED4F02} (Si una entrada es incluida en el fixlist, el archivo de tarea (.job) será movido. El archivo que está siendo ejecutado por la tarea no será movido.) ==================== Internet (Lista blanca) ==================== (Si un elemento es incluido en el fixlist, y éste pertenece al registro, será eliminado o restaurado a su valor predeterminado.) Hosts: Hay más de una entrada en Hosts. Consulte la sección Hosts de Addition.txt Tcpip\Parameters: [DhcpNameServer] 190.92.0.6 35.224.97.72 Tcpip..\Interfaces{371eb9da-8aac-4693-b3f4-4384ce65c15d}: [DhcpNameServer] 190.92.0.6 35.224.97.72 Tcpip..\Interfaces{371eb9da-8aac-4693-b3f4-4384ce65c15d}\6416D6E214C66716275637: [DhcpNameServer] 192.168.0.1 # FireFox: FF Plugin: @microsoft.com/SharePoint,version=14.0 → C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL [2024-02-15] (Microsoft Corporation → Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 → C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\NPSPWRAP.DLL [2024-02-15] (Microsoft Corporation → Microsoft Corporation) # Edge: Edge DefaultProfile: Default Edge Profile: C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default [2026-10-12] Edge Extension: (Documentos de Google sin conexión) - C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2026-09-26] Edge Extension: (Edge relevant text changes) - C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha [2024-02-14] # Chrome: CHR DefaultProfile: Profile 1 CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default [2026-09-14] CHR Extension: (Documentos de Google sin conexión) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2026-04-17] CHR Extension: (Sistema de pagos de Chrome Web Store) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2024-02-14] CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile [2026-10-12] CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 1 [2026-10-12] CHR Notifications: Profile 1 → hxxps://meet.google.com CHR Extension: (Dark Reader) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\eimadpbcbfnmbkopoojfekhnkhdbieeh [2026-10-10] CHR Extension: (McAfee® WebAdvisor) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2026-10-10] CHR Extension: (Documentos de Google sin conexión) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2026-09-16] CHR Extension: (VPN gratis para Chrome - VPN Proxy VeePN) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\majdfhpaihoncoakbjgbdhglocklcgno [2026-10-10] CHR Extension: (Sistema de pagos de Chrome Web Store) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2024-02-17] CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 3 [2026-02-12] CHR Extension: (McAfee® WebAdvisor) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 3\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2026-01-18] CHR Extension: (Documentos de Google sin conexión) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 3\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2026-01-18] CHR Extension: (Sistema de pagos de Chrome Web Store) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 3\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2026-01-18] CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 4 [2026-02-07] CHR Extension: (McAfee® WebAdvisor) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2026-01-18] CHR Extension: (Documentos de Google sin conexión) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2026-01-18] CHR Extension: (Sistema de pagos de Chrome Web Store) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2026-01-18] CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 5 [2026-07-21] CHR Notifications: Profile 5 → hxxps://mail.google.com CHR StartupUrls: Profile 5 → “hxxps://www.google.com/” CHR Extension: (McAfee® WebAdvisor) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 5\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2026-07-21] CHR Extension: (Documentos de Google sin conexión) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 5\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2026-07-06] CHR Extension: (Sistema de pagos de Chrome Web Store) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 5\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2026-01-21] CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile [2026-10-10] CHR HKLM…\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] CHR HKLM-x32…\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] ==================== Servicios (Lista blanca) =================== (Si una entrada es incluida en el fixlist, será eliminada del registro. El archivo no se moverá a menos que sea añadido al listado por separado.) R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [11666384 2022-03-29] (Microsoft Corporation → Microsoft Corporation) R3 FileSyncHelper; C:\Program Files\Microsoft OneDrive\26.178.0913.0007\FileSyncHelper.exe [3806096 2026-10-10] (Microsoft Corporation → Microsoft Corporation) R2 GameInputRedistService; C:\Program Files\Microsoft GameInput\x64\GameInputRedistService.exe [435328 2026-09-01] (Microsoft Corporation → Windows (R) Win 7 DDK provider) R2 HP Comm Recover; C:\Program Files\HPCommRecovery\HPCommRecovery.exe [905080 2019-12-19] (HP Inc. → HP Inc.) R2 HPAppHelperCap; C:\WINDOWS\System32\DriverStore\FileRepository\hpcustomcapcomp.inf\_amd64\_166246cb8bd387ff\x64\AppHelperCap.exe [932032 2026-07-08] (HP Inc. → HP Inc.) R2 HPDiagsCap; C:\WINDOWS\System32\DriverStore\FileRepository\hpcustomcapcomp.inf\_amd64\_166246cb8bd387ff\x64\DiagsCap.exe [929984 2026-07-08] (HP Inc. → HP Inc.) R2 HPNetworkCap; C:\WINDOWS\System32\DriverStore\FileRepository\hpcustomcapcomp.inf\_amd64\_166246cb8bd387ff\x64\NetworkCap.exe [925888 2026-07-08] (HP Inc. → HP Inc.) R2 HPPrintScanDoctorService; C:\Program Files\HPPrintScanDoctor\HPPrintScanDoctorService.exe [243720 2026-09-17] (HP Inc. → HP Inc.) R2 HPSysInfoCap; C:\WINDOWS\System32\DriverStore\FileRepository\hpcustomcapcomp.inf\_amd64\_166246cb8bd387ff\x64\SysInfoCap.exe [1029832 2026-07-08] (HP Inc. → HP Inc.) R2 HpTouchpointAnalyticsService; C:\WINDOWS\System32\DriverStore\FileRepository\hpanalyticscomp.inf\_amd64\_ef460d1f2a35fc16\x64\TouchpointAnalyticsClientService.exe [639784 2025-10-02] (HP Inc. → HP Inc.) S3 IsoSessionCore; C:\WINDOWS\System32\IsoSessionCoreServer.dll [184320 2026-09-25] (Microsoft Windows → Microsoft Corporation) R2 McAfee WebAdvisor; C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe [907688 2026-10-08] (McAfee, LLC → McAfee, LLC) R2 MDCoreSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpDefenderCoreService.exe [2307776 2026-09-17] (Microsoft Windows Publisher → Microsoft Corporation) S3 OneDrive Updater Service; C:\Program Files\Microsoft OneDrive\26.178.0913.0007\OneDriveUpdaterService.exe [4110184 2026-10-10] (Microsoft Corporation → Microsoft Corporation) S3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\NisSrv.exe [5311776 2026-09-17] (Microsoft Windows Publisher → Microsoft Corporation) R2 WildTangentHelper; C:\Program Files (x86)\WildTangent Games\Integration\WildTangentHelperService.exe [1685312 2023-02-09] (WildTangent, Inc. → ) R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MsMpEng.exe [291360 2026-09-17] (Microsoft Windows Publisher → Microsoft Corporation) ===================== Controladores (Lista blanca) =================== (Si una entrada es incluida en el fixlist, será eliminada del registro. El archivo no se moverá a menos que sea añadido al listado por separado.) S3 AmUStor; C:\WINDOWS\system32\drivers\AmUStorU.sys [143904 2020-05-12] (Alcorlink Corp. → ) S3 BTHMODEM; C:\WINDOWS\System32\drivers\bthmodem.sys [110592 2025-02-21] (Microsoft Corporation) [Archivo no firmado] S3 Ccx01000; C:\WINDOWS\System32\drivers\Ccx01000.sys [692224 2026-09-25] (Microsoft Windows → Microsoft Corporation) S3 dg\_ssudbus; C:\WINDOWS\System32\drivers\ssudbus2.sys [167440 2022-09-30] (Samsung Electronics CO., LTD. → Samsung Electronics Co., Ltd.) S3 dtsoftbus01; C:\WINDOWS\System32\drivers\dtsoftbus01.sys [283200 2023-08-29] (DT Soft Ltd → DT Soft Ltd) R0 fse; C:\WINDOWS\System32\drivers\fse.sys [241016 2026-09-25] (Microsoft Windows → Microsoft Corporation) S3 GUMHFilters; ??\C:\Program Files (x86)\Glarysoft\Malware Hunter\Native\winxp\_x64\GUMHFilter.sys [35384 2023-06-30] (Microsoft Windows Hardware Compatibility Publisher → ) S3 Hamachi; C:\WINDOWS\System32\drivers\Hamdrv.sys [45680 2022-05-18] (Microsoft Windows Hardware Compatibility Publisher → LogMeIn Inc.) R3 HPCustomCapDriver; C:\WINDOWS\System32\DriverStore\FileRepository\hpcustomcapdriver.inf\_amd64\_1421dec2010cc057\x64\hpcustomcapdriver.sys [18984 2024-05-07] (Microsoft Windows Hardware Compatibility Publisher → HP Inc.) R3 iaLPSS2\_I2C\_ICL; C:\WINDOWS\System32\DriverStore\FileRepository\ialpss2\_i2c\_icl.inf\_amd64\_c8c0638291b9b209\iaLPSS2\_I2C\_ICL.sys [200456 2020-04-28] (Intel Corporation → Intel Corporation) R3 KslD; C:\WINDOWS\System32\drivers\wd\KslD.sys [83008 2026-09-02] (Microsoft Windows → Microsoft Corporation) S2 l1vhlwf; C:\WINDOWS\System32\drivers\l1vhlwf.sys [155000 2026-09-25] (Microsoft Windows → Microsoft Corporation) S2 SecDrv; C:\WINDOWS\SysWOW64\drivers\SECDRV.SYS [11376 2025-10-05] () [Archivo no firmado] S3 ssudqcfilter; C:\WINDOWS\System32\drivers\ssudqcfilter.sys [76832 2022-09-30] (Samsung Electronics CO., LTD. → QUALCOMM Incorporated) S3 ss\_conn\_usb\_driver2; C:\WINDOWS\System32\Drivers\ss\_conn\_usb\_driver2.sys [50720 2022-09-30] (Samsung Electronics CO., LTD. → Samsung Electronics Co., Ltd.) S3 vmbusproxy; C:\WINDOWS\system32\drivers\vmbusproxy.sys [98304 2025-06-22] (Microsoft Windows → Microsoft Corporation) S4 WdAiNisDrv; C:\WINDOWS\System32\drivers\wd\WdAiNisDrv.sys [51264 2026-09-17] (Microsoft Windows → Microsoft Corporation) S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [21632 2026-09-17] (Microsoft Windows Early Launch Anti-malware Publisher → Microsoft Corporation) R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [664592 2026-09-17] (Microsoft Windows → Microsoft Corporation) S3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [137240 2026-09-17] (Microsoft Windows → Microsoft Corporation) R3 WirelessButtonDriver64; C:\WINDOWS\System32\drivers\WirelessButtonDriver64.sys [40208 2026-06-18] (HP Inc. → HP) U3 aspnet\_state; no ImagePath ==================== SvcHost (Lista blanca) =================== (Si una entrada es incluida en el fixlist, será eliminada del registro. El archivo no se moverá a menos que sea añadido al listado por separado.) ==================== Un mes (creado) (Lista blanca) ========= (Si una entrada es incluida en el fixlist, el archivo/carpeta será eliminado/a.) 2026-10-12 10:28 - 2026-10-12 10:30 - 000061567 \ __**\_ C:\Users\Admin\Downloads\Addition.txt 2026-10-12 10:25 - 2026-10-12 10:33 - 000031794 \_** _\_ C:\Users\Admin\Downloads\FRST.txt 2026-10-12 10:25 - 2026-10-12 10:32 - 000000000 \__ **D C:\FRST 2026-10-12 10:19 - 2026-10-12 10:19 - 002455552 \_** _\_ (Farbar) C:\Users\Admin\Downloads\farbar-recovery-scan-tool-26-09-2026.exe 2026-10-11 14:46 - 2026-10-11 23:00 - 000000000 \ __**D C:\WINDOWS\CbsTemp 2026-10-09 20:41 - 2026-10-09 20:41 - 000825088 \_** _\_ C:\WINDOWS\system32\perfh00A.dat 2026-10-09 20:41 - 2026-10-09 20:41 - 000181554 \__ **\_ C:\WINDOWS\system32\perfc00A.dat 2026-10-09 17:11 - 2026-10-09 17:11 - 000000000 \_D C:\Users\Admin\AppData\Roaming\Narrator 2026-09-24 21:36 - 2026-09-24 21:36 - 000004985 \_\_ C:\WINDOWS\system32\DeviceFeatureDDF.json 2026-09-24 21:33 - 2026-09-24 21:33 - 000039736 \_** _\_ C:\WINDOWS\SysWOW64\IntegratedServicesRegionPolicySet.json 2026-09-24 21:33 - 2026-09-24 21:33 - 000039736 \ __**\_ C:\WINDOWS\system32\IntegratedServicesRegionPolicySet.json 2026-09-24 21:32 - 2026-09-24 21:32 - 000091797 \_** _\_ C:\WINDOWS\SysWOW64\ctac.json 2026-09-24 21:32 - 2026-09-24 21:32 - 000091797 \__ **\_ C:\WINDOWS\system32\ctac.json 2026-09-24 20:51 - 2026-09-24 20:51 - 000078818 \_** _\_ C:\Users\Admin\Downloads\trabajo-agricola-revolucion-agricola-moderna.webp 2026-09-24 02:03 - 2026-09-24 02:03 - 000001071 \__ **\_ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OBS Studio.lnk 2026-09-24 02:03 - 2026-09-24 02:03 - 000001059 \_** _\_ C:\Users\Public\Desktop\OBS Studio.lnk 2026-09-24 02:03 - 2026-09-24 02:03 - 000000000 \_\_\_\_D C:\ProgramData\obs-studio-hook 2026-09-24 02:01 - 2026-09-24 02:03 - 000000000 \_\_\_\_D C:\Program Files\obs-studio 2026-09-22 22:31 - 2026-09-22 22:31 - 000000000 \_\_\_\_D C:\Program Files\Microsoft GameInput 2026-09-13 13:29 - 2026-09-13 13:29 - 000000000 \_\_\_\_D C:\Users\Admin\AppData\Local\cache ==================== Un mes (modificado) ================== (Si una entrada es incluida en el fixlist, el archivo/carpeta será eliminado/a.) 2026-10-12 10:20 - 2024-04-01 01:26 - 000000000 \__**D C:\ProgramData\regid.1991-06.com.microsoft 2026-10-12 10:13 - 2024-04-01 01:26 - 000000000 \_HD C:\Program Files\WindowsApps 2026-10-12 10:13 - 2024-04-01 01:26 - 000000000 \_D C:\WINDOWS\AppReadiness 2026-10-12 10:13 - 2024-02-14 15:26 - 000000000 \_D C:\Users\Admin\AppData\Local\Packages 2026-10-12 10:13 - 2020-10-29 09:21 - 000000000 \_D C:\ProgramData\Packages 2026-10-12 10:05 - 2024-04-26 15:47 - 000000000 \_D C:\Users\Admin\AppData\Local\Bluestacks 2026-10-12 08:38 - 2024-04-01 01:26 - 000000000 \_D C:\WINDOWS\SystemTemp 2026-10-11 19:45 - 2025-02-21 01:12 - 000003636 \_\_ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA 2026-10-11 19:45 - 2025-02-21 01:12 - 000003564 \_\_ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore 2026-10-11 19:43 - 2025-02-21 01:06 - 000000000 \_D C:\WINDOWS\system32\SleepStudy 2026-10-10 14:46 - 2024-02-14 15:42 - 000000000 \_D C:\Users\Admin\AppData\Local\D3DSCache 2026-10-10 09:56 - 2024-02-14 15:12 - 000002447 \_\_ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk 2026-10-10 09:56 - 2024-02-14 15:12 - 000002285 \_\_ C:\Users\Public\Desktop\Microsoft Edge.lnk 2026-10-10 09:53 - 2025-02-21 01:12 - 000003194 \_\_ C:\WINDOWS\system32\Tasks\OneDrive Per-Machine Standalone Update Task 2026-10-10 09:53 - 2024-02-14 16:09 - 000000000 \_D C:\Program Files\Microsoft OneDrive 2026-10-10 09:53 - 2024-02-14 15:28 - 000000000 \_RD C:\Users\Admin\OneDrive 2026-10-10 09:52 - 2025-02-21 01:12 - 000003592 \_\_ C:\WINDOWS\system32\Tasks\OneDrive Reporting Task-S-1-5-21-799460012-3513789069-1987005638-1001 2026-10-10 09:52 - 2025-02-21 01:12 - 000003546 \_\_ C:\WINDOWS\system32\Tasks\OneDrive Startup Task-S-1-5-21-799460012-3513789069-1987005638-1001 2026-10-10 09:52 - 2024-02-14 15:59 - 000002030 \_\_ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk 2026-10-09 20:41 - 2025-02-21 01:07 - 001900270 \_\_ C:\WINDOWS\system32\PerfStringBackup.INI 2026-10-09 20:41 - 2024-04-01 01:24 - 000000000 \_D C:\WINDOWS\INF 2026-10-09 20:33 - 2025-02-21 01:12 - 000000006 \_H C:\WINDOWS\Tasks\SA.DAT 2026-10-09 20:33 - 2025-02-21 01:10 - 000014746 \_\_ C:\WINDOWS\system32\5E37410B-D6F1-471D-AE27-563CEAC0D6B2 2026-10-09 20:33 - 2025-02-21 01:08 - 000000000 \_D C:\Users\Admin 2026-10-09 20:33 - 2024-04-01 01:26 - 000000000 \_D C:\WINDOWS\ServiceState 2026-10-09 20:33 - 2024-02-14 15:26 - 000000000 \_SHD C:\Users\Admin\IntelGraphicsProfiles 2026-10-09 20:33 - 2024-02-14 15:12 - 000012288 \_SH C:\DumpStack.log.tmp 2026-10-09 20:33 - 2024-02-14 15:12 - 000000000 \_D C:\Intel 2026-10-07 21:36 - 2024-06-10 20:03 - 000000000 \_D C:\Users\Admin\AppData\Local\CrashDumps 2026-10-07 18:54 - 2024-02-14 15:28 - 000000000 \_D C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder 2026-10-07 16:22 - 2025-05-19 00:27 - 000001414 \_\_ C:\Users\Admin\Desktop\Roblox Player.lnk 2026-10-07 12:01 - 2024-04-26 20:05 - 000000000 \_D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Roblox 2026-10-07 05:29 - 2024-02-14 15:43 - 000002252 \_\_ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk 2026-10-07 05:29 - 2024-02-14 15:43 - 000002211 \_\_ C:\Users\Public\Desktop\Google Chrome.lnk 2026-10-06 18:43 - 2024-04-26 20:05 - 000001242 \_\_ C:\Users\Admin\Desktop\Roblox Studio.lnk 2026-10-02 11:28 - 2024-02-17 11:37 - 004602352 \_\_ (Microsoft Corporation) C:\WINDOWS\system32\xgameruntime.dll 2026-10-02 11:28 - 2024-02-17 11:37 - 000166384 \_\_ (Microsoft Corporation) C:\WINDOWS\system32\gamingtcuihelpers.dll 2026-10-02 11:28 - 2024-02-17 11:37 - 000158192 \_\_ (Microsoft Corporation) C:\WINDOWS\system32\xgamehelper.exe 2026-10-02 11:28 - 2024-02-17 11:37 - 000084464 \_\_ (Microsoft Corporation) C:\WINDOWS\system32\xgamecontrol.exe 2026-10-02 11:27 - 2026-08-13 17:11 - 000522736 \_**\_ (Microsoft Corporation) C:\WINDOWS\system32\gamingservicesproxy\_13.dll.0 2026-10-02 11:27 - 2026-08-13 17:11 - 000522736 \__**\_ (Microsoft Corporation) C:\WINDOWS\system32\gamingservicesproxy\_13.dll 2026-10-02 11:27 - 2024-02-17 11:37 - 001194480 \_**_\_ (Microsoft Corporation) C:\WINDOWS\system32\gameplatformservices.dll 2026-10-02 11:27 - 2024-02-17 11:37 - 000317936 \__**\_ (Microsoft Corporation) C:\WINDOWS\system32\gamelaunchhelper.dll 2026-10-02 11:27 - 2024-02-17 11:37 - 000272880 \_**_\_ (Microsoft Corporation) C:\WINDOWS\system32\gameconfighelper.dll 2026-09-29 16:15 - 2024-04-01 01:26 - 000000000 \_ **D C:\ProgramData\USOPrivate 2026-09-29 15:57 - 2025-02-21 01:06 - 000001607 \_** \_ C:\WINDOWS\system32\config\VSMIDK 2026-09-29 15:57 - 2024-04-01 01:21 - 001048576 \__ **\_ C:\WINDOWS\system32\config\BBI 2026-09-29 15:53 - 2025-02-21 01:06 - 000492064 \_** \_\_ C:\WINDOWS\system32\FNTCACHE.DAT 2026-09-29 15:51 - 2025-12-15 00:13 - 000000000 \_\_\_\_D C:\WINDOWS\system32\NarratorMCAT 2026-09-29 15:51 - 2025-07-16 23:51 - 000000000 \_\_\_\_D C:\WINDOWS\system32\ruxim 2026-09-29 15:51 - 2024-04-01 14:26 - 000000000 \_\_\_\_D C:\WINDOWS\system32\OpenSSH 2026-09-29 15:51 - 2024-04-01 01:26 - 000000000 \_\_\_RD C:\WINDOWS\ImmersiveControlPanel 2026-09-29 15:51 - 2024-04-01 01:26 - 000000000 \_\_\_\_D C:\WINDOWS\UUS 2026-09-29 15:51 - 2024-04-01 01:26 - 000000000 \_\_\_\_D C:\WINDOWS\SysWOW64\WinMetadata 2026-09-29 15:51 - 2024-04-01 01:26 - 000000000 \_\_\_\_D C:\WINDOWS\SysWOW64\setup 2026-09-29 15:51 - 2024-04-01 01:26 - 000000000 \_\_\_\_D C:\WINDOWS\SysWOW64\oobe 2026-09-29 15:51 - 2024-04-01 01:26 - 000000000 \_\_\_\_D C:\WINDOWS\SysWOW64\migwiz 2026-09-29 15:51 - 2024-04-01 01:26 - 000000000 \_\_\_\_D C:\WINDOWS\SysWOW64\InstallShield 2026-09-29 15:51 - 2024-04-01 01:26 - 000000000 \_\_\_\_D C:\WINDOWS\SysWOW64\es-MX 2026-09-29 15:51 - 2024-04-01 01:26 - 000000000 \_\_\_\_D C:\WINDOWS\SysWOW64\Dism 2026-09-29 15:51 - 2024-04-01 01:26 - 000000000 \_\_\_\_D C:\WINDOWS\SysWOW64\AdvancedInstallers 2026-09-29 15:51 - 2024-04-01 01:26 - 000000000 \_\_\_\_D C:\WINDOWS\SystemResources 2026-09-29 15:51 - 2024-04-01 01:26 - 000000000 \_\_\_\_D C:\WINDOWS\system32\WinMetadata 2026-09-29 15:51 - 2024-04-01 01:26 - 000000000 \_\_\_\_D C:\WINDOWS\system32\WinBioPlugIns 2026-09-29 15:51 - 2024-04-01 01:26 - 000000000 \_\_\_\_D C:\WINDOWS\system32\Sysprep 2026-09-29 15:51 - 2024-04-01 01:26 - 000000000 \_\_\_\_D C:\WINDOWS\system32\ShellExperiences 2026-09-29 15:51 - 2024-04-01 01:26 - 000000000 \_\_\_\_D C:\WINDOWS\system32\setup 2026-09-29 15:51 - 2024-04-01 01:26 - 000000000 \_\_\_\_D C:\WINDOWS\system32\SecureBootUpdates 2026-09-29 15:51 - 2024-04-01 01:26 - 000000000 \_\_\_\_D C:\WINDOWS\system32\PerceptionSimulation 2026-09-29 15:51 - 2024-04-01 01:26 - 000000000 \_\_\_\_D C:\WINDOWS\system32\oobe 2026-09-29 15:51 - 2024-04-01 01:26 - 000000000 \_\_\_\_D C:\WINDOWS\system32\migwiz 2026-09-29 15:51 - 2024-04-01 01:26 - 000000000 \_\_\_\_D C:\WINDOWS\system32\HealthAttestationClient 2026-09-29 15:51 - 2024-04-01 01:26 - 000000000 \_\_\_\_D C:\WINDOWS\system32\es-MX 2026-09-29 15:51 - 2024-04-01 01:26 - 000000000 \_\_\_\_D C:\WINDOWS\system32\Dism 2026-09-29 15:51 - 2024-04-01 01:26 - 000000000 \_\_\_\_D C:\WINDOWS\system32\appraiser 2026-09-29 15:51 - 2024-04-01 01:26 - 000000000 \_\_\_\_D C:\WINDOWS\system32\AdvancedInstallers 2026-09-29 15:51 - 2024-04-01 01:26 - 000000000 \_\_\_\_D C:\WINDOWS\ShellExperiences 2026-09-29 15:51 - 2024-04-01 01:26 - 000000000 \_\_\_\_D C:\WINDOWS\ShellComponents 2026-09-29 15:51 - 2024-04-01 01:26 - 000000000 \_\_\_\_D C:\WINDOWS\Provisioning 2026-09-29 15:51 - 2024-04-01 01:26 - 000000000 \_\_\_\_D C:\WINDOWS\BrowserCore 2026-09-29 15:51 - 2024-04-01 01:26 - 000000000 \_\_\_\_D C:\WINDOWS\bcastdvr 2026-09-29 15:51 - 2024-04-01 01:26 - 000000000 \_\_\_\_D C:\Program Files\Common Files\System 2026-09-29 15:51 - 2024-04-01 01:21 - 000000000 \_\_\_\_D C:\WINDOWS\servicing 2026-09-26 21:36 - 2024-05-04 17:52 - 000000000 \_\_\_\_D C:\Users\Admin\AppData\Roaming\RenPy 2026-09-24 21:37 - 2024-02-14 16:18 - 000000000 \__**D C:\Users\Admin\AppData\Roaming\Microsoft\Word 2026-09-24 21:30 - 2025-02-21 01:08 - 003387392 \_** _\_ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll 2026-09-24 20:49 - 2024-02-14 16:18 - 000000000 \__ **D C:\Users\Admin\AppData\Roaming\Microsoft\Office 2026-09-24 16:11 - 2025-10-02 05:31 - 000000016 \_** _\_ C:\Users\Admin\AppData\Roaming\obs-virtualcam.txt 2026-09-24 16:10 - 2025-10-02 05:30 - 000000000 \_\_\_\_D C:\Users\Admin\AppData\Roaming\obs-studio 2026-09-24 02:40 - 2025-10-13 03:22 - 000000000 \_\_\_\_D C:\Users\Admin\AppData\Local\CapCut 2026-09-24 02:04 - 2025-10-02 05:30 - 000000000 \_\_\_\_D C:\ProgramData\obs-studio 2026-09-21 15:14 - 2024-06-09 21:17 - 000000000 \_\_\_\_D C:\Users\Admin\AppData\Local\MEGAsync 2026-09-17 16:27 - 2020-05-06 02:58 - 000000000 \_\_\_\_D C:\WINDOWS\system32\Drivers\wd 2026-09-16 21:34 - 2025-02-21 01:12 - 000000000 \_\_\_\_D C:\WINDOWS\system32\Tasks\HP 2026-09-16 21:34 - 2025-01-30 23:37 - 000000000 \_\_\_\_D C:\Program Files\HPPrintScanDoctor 2026-09-14 17:20 - 2025-02-21 01:12 - 000000000 \_\_\_\_D C:\WINDOWS\system32\Tasks\Hewlett-Packard 2026-09-14 17:13 - 2024-04-01 14:26 - 000000000 \_\_\_\_D C:\WINDOWS\system32\Microsoft-Edge-WebView 2026-09-14 02:42 - 2026-04-19 03:40 - 000000000 \_\_\_\_D C:\Users\Admin\Documents\Descargas MEGA ==================== Archivos en la raíz de algunos directorios ======== 2025-10-02 05:31 - 2026-09-24 16:11 - 000000016 \__**\_ () C:\Users\Admin\AppData\Roaming\obs-virtualcam.txt 2024-11-03 23:21 - 2025-10-07 18:59 - 000006046 \_**_\_ () C:\Users\Admin\AppData\Roaming\plugin\_scan\_state\_VST2\_x32.scan 2024-11-03 23:21 - 2025-10-07 18:59 - 000006046 \__**\_ () C:\Users\Admin\AppData\Roaming\plugin\_scan\_state\_VST2\_x64.scan 2024-11-03 23:21 - 2025-10-07 18:59 - 000000059 \_**_\_ () C:\Users\Admin\AppData\Roaming\plugin\_scan\_state\_VST3\_x32.scan 2024-11-03 23:21 - 2025-10-07 18:59 - 000000059 \_\_\_\_\_ () C:\Users\Admin\AppData\Roaming\plugin\_scan\_state\_VST3\_x64.scan ==================== SigCheck ============================ (No existe una corrección automática para los archivos que no pasan la verificación.) ==================== Final de FRST.txt ======================== ---
### Author: ![Nashe\_Xd](https://forospyware.com/user_avatar/forospyware.com/nashe_xd/32/45162_2.png) [@Nashe\_Xd](https://forospyware.com/u/Nashe_Xd) #### Post date: [12 Octubre, 2026 16:52 UTC](https://forospyware.com/t/virus-dusapp-aparecio-de-repente-entre-mis-aplicaciones/36460/3 "2026-10-12T16:52:39Z")
# Resultados del Análisis Adicional de Farbar Recovery Scan Tool (x64) Versión: 26-09-2026 Ejecutado por Admin (12-10-2026 10:34:53) Ejecutado desde C:\Users\Admin\Downloads Microsoft Windows 11 Home Single Language Versión 25H2 26200.9550 (X64) (2025-02-21 07:13:08) Modo de Inicio: Normal ==================== Cuentas: ============================= (Si una entrada es incluida en el fixlist, será eliminada.) Admin (S-1-5-21-799460012-3513789069-1987005638-1001 - Administrators - Enabled) =\> C:\Users\Admin Administrador (S-1-5-21-799460012-3513789069-1987005638-500 - Administrators - Disabled) DefaultAccount (S-1-5-21-799460012-3513789069-1987005638-503 - Limited - Disabled) Invitado (S-1-5-21-799460012-3513789069-1987005638-501 - Limited - Disabled) WDAGUtilityAccount (S-1-5-21-799460012-3513789069-1987005638-504 - Limited - Disabled) ==================== Centro de Seguridad ======================== (Si una entrada es incluida en el fixlist, será eliminada.) AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Programas instalados ====================== (Solo los programas de adware con indicador “Oculto”, pueden ser añadidos al fixlist para hacerlos visibles. Los programas adware deben ser desinstalados manualmente.) Copilot (HKLM-x32…\Microsoft Copilot) (Version: 155.0.4283.45 - Microsoft Corporation) DusApp (HKLM-x32…{FEEA5B7D-FDCD-443F-91CB-FAB12B82D6AE}) (Version: 4.2.7 - duspub) Epic Games Launcher Prerequisites (x64) (HKLM…{E81CA011-E9A8-42B8-A4C0-11F66BE56D6C}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden Google Chrome (HKLM-x32…\Google Chrome) (Version: 155.0.8059.39 - Google LLC) HP Audio Switch (HKLM-x32…{3A5141D4-47DB-4302-9B1C-272BE585BC8A}) (Version: 1.0.179.0 - HP Inc.) HP Connection Optimizer (HKLM-x32…{6468C4A5-E47E-405F-B675-A70A70983EA6}) (Version: 2.0.16.0 - HP Inc.) HP Documentation (HKLM…\HP\_Documentation) (Version: 1.0.0.1 - HP Inc.) iLovePDF (HKLM-x32…\iLovePDF) (Version: 2.1.14.0 - iLovePDF.S.L) Java™ SE Development Kit 17.0.11 (64-bit) (HKLM…{0FAEA8F8-E75C-579F-981F-093F0430FE97}) (Version: 17.0.11.0 - Oracle Corporation) Juegos WildTangent (HKLM-x32…\WildTangent wildgames Master Uninstall) (Version: 1.1.1.47 - WildTangent) Launcher Prerequisites (x64) (HKLM-x32…{60e762c3-a30e-4a24-ac32-35fc9aa84805}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden Malware Hunter 1.183.0.804 (HKLM-x32…\Malware Hunter) (Version: 1.183.0.804 - Glarysoft Ltd) MEGAsync (HKLM-x32…\MEGAsync) (Version: - Mega Limited) Microsoft Edge (HKLM-x32…\Microsoft Edge) (Version: 155.0.4283.45 - Microsoft Corporation) Microsoft GameInput (HKLM…{C7B6BB76-07B4-48D4-B257-4511AB9E002A}) (Version: 3.5.270.0 - Microsoft Corporation) Microsoft Office LTSC Standard 2021 - en-us (HKLM…\Standard2021Volume - en-us) (Version: 16.0.15028.20160 - Microsoft Corporation) Microsoft Office LTSC Standard 2021 - es-mx (HKLM…\Standard2021Volume - es-mx) (Version: 16.0.15028.20160 - Microsoft Corporation) Microsoft OneDrive (HKLM…\OneDriveSetup.exe) (Version: 26.178.0913.0007 - Microsoft Corporation) Microsoft Project Profesional 2021 - es-mx (HKLM…\ProjectPro2021Volume - es-mx) (Version: 16.0.15028.20160 - Microsoft Corporation) Microsoft Project Professional 2021 - en-us (HKLM…\ProjectPro2021Volume - en-us) (Version: 16.0.15028.20160 - Microsoft Corporation) Microsoft Teams Meeting Add-in for Microsoft Office (HKLM…{A7AB73A3-CB10-4AA5-9D38-6AEFFBDE4C91}) (Version: 1.25.14602 - Microsoft) Microsoft Update Health Tools (HKLM…{C6FD611E-7EFE-488C-A0E0-974C09EF6473}) (Version: 5.72.0.0 - Microsoft Corporation) Microsoft Visio LTSC Professional 2021 - en-us (HKLM…\VisioPro2021Volume - en-us) (Version: 16.0.15028.20160 - Microsoft Corporation) Microsoft Visio LTSC Professional 2021 - es-mx (HKLM…\VisioPro2021Volume - es-mx) (Version: 16.0.15028.20160 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32…{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM…{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM…{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32…{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM…{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32…{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32…{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32…{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.61030 (HKLM…{37B8F9C7-03FB-3253-8781-2517C99D7C00}) (Version: 11.0.61030 - Microsoft Corporation) Hidden Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.61030 (HKLM…{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}) (Version: 11.0.61030 - Microsoft Corporation) Hidden Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 (HKLM-x32…{B175520C-86A2-35A7-8619-86DC379688B9}) (Version: 11.0.61030 - Microsoft Corporation) Hidden Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 (HKLM-x32…{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}) (Version: 11.0.61030 - Microsoft Corporation) Hidden Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32…{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40664 (HKLM-x32…{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}) (Version: 12.0.40664.0 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32…{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.40664 (HKLM-x32…{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}) (Version: 12.0.40664.0 - Microsoft Corporation) Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.40664 (HKLM…{010792BA-551A-3AC0-A7EF-0FAB4156C382}) (Version: 12.0.40664 - Microsoft Corporation) Hidden Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.40664 (HKLM…{53CF6934-A98D-3D84-9146-FC4EDF3D5641}) (Version: 12.0.40664 - Microsoft Corporation) Hidden Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.40664 (HKLM-x32…{D401961D-3A20-3AC7-943B-6139D5BD490A}) (Version: 12.0.40664 - Microsoft Corporation) Hidden Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.40664 (HKLM-x32…{8122DAB1-ED4D-3676-BB0A-CA368196543E}) (Version: 12.0.40664 - Microsoft Corporation) Hidden Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.42.34438 (HKLM-x32…{b49c10dd-4d54-45f8-ad13-fa25704456a4}) (Version: 14.42.34438.0 - Microsoft Corporation) Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.42.34438 (HKLM-x32…{ba10fda9-f731-441f-a999-000bbb7ceec2}) (Version: 14.42.34438.0 - Microsoft Corporation) Microsoft Visual C++ 2022 X64 Additional Runtime - 14.42.34438 (HKLM…{E528AD94-12D7-42C4-91A3-908BE28E9BD2}) (Version: 14.42.34438 - Microsoft Corporation) Hidden Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.42.34438 (HKLM…{2E15F519-4FDA-4834-B4EE-7EFCE7D8D4EE}) (Version: 14.42.34438 - Microsoft Corporation) Hidden Microsoft Visual C++ 2022 X86 Additional Runtime - 14.42.34438 (HKLM-x32…{A5592FEF-F948-4BA6-A066-8BBFC2DC7EE1}) (Version: 14.42.34438 - Microsoft Corporation) Hidden Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.42.34438 (HKLM-x32…{5D0C4511-3CA1-4FF8-A4BA-C0E1957ABEEA}) (Version: 14.42.34438 - Microsoft Corporation) Hidden Microsoft Visual Studio Code (User) (HKU\S-1-5-21-799460012-3513789069-1987005638-1001…{771FD6B0-FA20-440A-A002-3B3BAC16DC50}\_is1) (Version: 1.118.1 - Microsoft Corporation) Microsoft Windows Application Compatibility Fix Database (HKLM…{22221111-1111-1111-1111-111111111111}.sdb) (Version: - ) Microsoft XNA Framework Redistributable 4.0 (HKLM-x32…{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - Microsoft Corporation) Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM-x32…{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation) MSXML 4.0 SP2 Parser and SDK (HKLM-x32…{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation) Nitro PDF Pro (HKLM…{F29D2688-3A1F-40F0-8537-C61CED00E65B}) (Version: 14.9.0.8 - Nitro) OBS Studio (HKLM-x32…\OBS Studio) (Version: 32.2.2 - OBS Project) Office 16 Click-to-Run Extensibility Component (HKLM…{90160000-008C-0000-1000-0000000FF1CE}) (Version: 16.0.15028.20050 - Microsoft Corporation) Hidden Office 16 Click-to-Run Licensing Component (HKLM…{90160000-007E-0000-1000-0000000FF1CE}) (Version: 16.0.15028.20160 - Microsoft Corporation) Hidden Opera GX Stable 107.0.5045.75 (HKU\S-1-5-21-799460012-3513789069-1987005638-1001…\Opera GX 107.0.5045.75) (Version: 107.0.5045.75 - Opera Software) Opera GX Stable 120.0.5543.204 (HKU\S-1-5-21-799460012-3513789069-1987005638-1001…\Opera GX 120.0.5543.204) (Version: 120.0.5543.204 - Opera Software) Paradox Launcher v2 (HKLM…{BCBAAF27-1C19-48A5-8DEF-258E46D93FE0}) (Version: 2.4.0 - Paradox Interactive) Roblox Player for Admin (HKU\S-1-5-21-799460012-3513789069-1987005638-1001…\roblox-player) (Version: - Roblox Corporation) Steam (HKLM-x32…\Steam) (Version: 2.10.91.91 - Valve Corporation) WebAdvisor de McAfee (HKLM-x32…{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}) (Version: 4.1.2.126 - McAfee, LLC) WebView2 Runtime de Microsoft Edge (HKLM-x32…\Microsoft EdgeWebView) (Version: 154.0.4258.62 - Microsoft Corporation) Hidden WildTangent Helper (HKLM-x32…{A39303AB-4898-4F12-BAA0-0B8630F86DB4}) (Version: 5.0.0.331 - WildTangent) Hidden WildTangent ShortcutProvider (HKLM-x32…{80831F60-19D7-43B3-A60C-5CAF8C478DF6}) (Version: 7.0.0.402 - WildTangent) Hidden WinRAR 6.24 (64-bit) (HKLM…\WinRAR archiver) (Version: 6.24.0 - win.rar GmbH) Zoom (HKU\S-1-5-21-799460012-3513789069-1987005638-1001…\ZoomUMX) (Version: 5.17.11 (34827) - Zoom Video Communications, Inc.) # Packages: ¡Solitario! → C:\Program Files\WindowsApps\26720RandomSaladGamesLLC.SimpleSolitaire\_7.5.40.0\_x64\_\_kx24dqmazqk8j [2026-02-24] (Random Salad Games LLC) 5A894077.McAfeeSecurity → C:\Program Files\WindowsApps\5A894077.McAfeeSecurity\_2.1.68.0\_x64\_\_wafk5atnkzcwy [2024-02-14] (McAfee LLC.) AppUp.IntelGraphicsExperience → C:\Program Files\WindowsApps\AppUp.IntelGraphicsExperience\_1.100.5688.0\_x64\_\_8j3eq9eme6ctt [2024-11-18] (INTEL CORP) [Startup Task] Dropbox - promoción → C:\Program Files\WindowsApps\C27EB4BA.DropboxOEM\_23.4.38.0\_x64\_\_xbfy0k16fey96 [2026-07-28] (Dropbox Inc.) HP Audio Center → C:\Program Files\WindowsApps\AD2F1837.HPAudioCenter\_1.7.197.0\_x64\_\_v10z8vjag6ke6 [2025-01-31] (HP Inc.) HP Inc. Energy Star → C:\Program Files\WindowsApps\AD2F1837.HPInc.EnergyStar\_2.0.11.0\_x64\_\_v10z8vjag6ke6 [2026-02-23] (HP Inc.) HP JumpStarts → C:\Program Files\WindowsApps\AD2F1837.HPJumpStarts\_1.10.1627.0\_x64\_\_v10z8vjag6ke6 [2024-02-14] (HP Inc.) HP PC Hardware Diagnostics Windows → C:\Program Files\WindowsApps\AD2F1837.HPPCHardwareDiagnosticsWindows\_3.3.2.0\_x64\_\_v10z8vjag6ke6 [2026-10-02] (HP Inc.) [Startup Task] HP PC Privacy Settings → C:\Program Files\WindowsApps\AD2F1837.HPPrivacySettings\_1.6.4.0\_x64\_\_v10z8vjag6ke6 [2026-09-30] (HP Inc.) HP Smart → C:\Program Files\WindowsApps\AD2F1837.HPPrinterControl\_166.2.1118.0\_x64\_\_v10z8vjag6ke6 [2026-09-17] (HP Inc.) HP Support Assistant → C:\Program Files\WindowsApps\AD2F1837.HPSupportAssistant\_9.55.10.0\_x64\_\_v10z8vjag6ke6 [2026-09-06] (HP Inc.) HP System Event Utility → C:\Program Files\WindowsApps\AD2F1837.HPSystemEventUtility\_3.2.24.0\_x64\_\_v10z8vjag6ke6 [2026-07-03] (HP Inc.) Ink.Handwriting.es-MX.1.0 → C:\Program Files\WindowsApps\Microsoft.Ink.Handwriting.es-MX.1.0\_0.1248.2215.0\_x64\_\_8wekyb3d8bbwe [2026-06-12] (Microsoft Corporation) Ink.Handwriting.es-MX.1.0 → C:\Program Files\WindowsApps\Microsoft.Ink.Handwriting.es-MX.1.0\_0.1248.2215.0\_x86\_\_8wekyb3d8bbwe [2026-06-12] (Microsoft Corporation) Ink.Handwriting.Main.es-MX.1.0 → C:\Program Files\WindowsApps\Microsoft.Ink.Handwriting.Main.es-MX.1.0\_0.1248.2215.0\_x64\_\_8wekyb3d8bbwe [2026-06-17] (Microsoft Corporation) Intel® Optane™ Memory and Storage Management → C:\Program Files\WindowsApps\AppUp.IntelOptaneMemoryandStorageManagement\_18.1.1042.0\_x64\_\_8j3eq9eme6ctt [2025-05-10] (INTEL CORP) LinkedIn → C:\Program Files\WindowsApps\7EE7776C.LinkedInforWindows\_3.0.43.0\_x64\_\_w1wdnht996qgy [2026-01-16] (LinkedIn) [Startup Task] MEGAsync → C:\Users\Admin\AppData\Local\MEGAsync [2026-09-21] (MEGAsync) Microsoft Defender → C:\Program Files\WindowsApps\Microsoft.6365217CE6EB4\_102.2608.18002.0\_x64\_\_8wekyb3d8bbwe [2026-09-27] (Microsoft Corporation) [Startup Task] Microsoft Family → C:\Program Files\WindowsApps\MicrosoftCorporationII.MicrosoftFamily\_0.2.40.0\_x64\_\_8wekyb3d8bbwe [2025-03-01] (Microsoft Corp.) Microsoft.HEVCVideoExtensionFirstParty → C:\Program Files\WindowsApps\Microsoft.HEVCVideoExtensionFirstParty\_2.4.111.0\_x64\_\_8wekyb3d8bbwe [2026-08-16] (Microsoft Corporation) Minecraft for Windows → C:\Program Files\WindowsApps\Microsoft.MinecraftUWP\_1.26.5203.0\_x64\_\_8wekyb3d8bbwe [2026-09-26] (Microsoft Studios) Minecraft Launcher → C:\Program Files\WindowsApps\Microsoft.4297127D64EC6\_2.6.2.0\_x64\_\_8wekyb3d8bbwe [2026-05-17] (Microsoft Studios) Narrator Extension - Excel → C:\Program Files\WindowsApps\MicrosoftWindows.NarratorScript.Excel\_1.0.14.0\_neutral\_\_cw5n1h2txyewy [2026-10-09] (Microsoft Windows) Narrator Extension - Outlook Web App → C:\Program Files\WindowsApps\MicrosoftWindows.NarratorExtension-OutlookWebApp\_1.0.2.0\_neutral\_\_cw5n1h2txyewy [2026-10-09] (Microsoft Windows) Narrator Extension - PowerPoint → C:\Program Files\WindowsApps\MicrosoftWindows.NarratorExtension-ppt\_1.0.4.0\_neutral\_\_cw5n1h2txyewy [2026-10-09] (Microsoft Windows) Narrator Extension - Word → C:\Program Files\WindowsApps\MicrosoftWindows.NarratorExtension-Word\_2.0.3.0\_neutral\_\_cw5n1h2txyewy [2026-10-09] (Microsoft Windows) NarratorExtension - Outlook → C:\Program Files\WindowsApps\MicrosoftWindows.NarratorScript.Outlook\_2.0.4.0\_neutral\_\_cw5n1h2txyewy [2026-10-09] (Microsoft Windows) Netflix → C:\Program Files\WindowsApps\4DF9E0F8.Netflix\_7.0.8.0\_neutral\_\_mcm4njqhnhss8 [2024-10-27] (Netflix, Inc.) Visual Studio Code → C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\034f571df5\appx [2026-05-01] () WildTangent Games → C:\Program Files\WindowsApps\WildTangentGames.63435CFB65F55\_2.0.84.0\_x64\_\_qt5r5pa5dyg8m [2025-01-31] (WildTangent Games) WinAppRuntime.Singleton → C:\Program Files\WindowsApps\MicrosoftCorporationII.WinAppRuntime.Singleton\_8002.5.1.0\_x64\_\_8wekyb3d8bbwe [2026-09-27] (Microsoft Corp.) WinRAR → C:\Program Files\WinRAR [2024-02-15] (win.rar GmbH) ==================== Personalizado CLSID (Lista blanca): ============== (Si una entrada es incluida en el fixlist, será eliminada del registro. El archivo no se moverá a menos que sea añadido al listado por separado.) CustomCLSID: HKU\S-1-5-21-799460012-3513789069-1987005638-1001\_Classes\CLSID{7d043d4e-4259-f459-3630-7b434fd7752c}\localserver32 → C:\Program Files\HP\HP Media Network\HPMediaNetwork.exe (HP Inc. → HP Inc.) CustomCLSID: HKU\S-1-5-21-799460012-3513789069-1987005638-1001\_Classes\CLSID{7E75AF8B-F561-4381-8947-90743620CFC6}\localserver32 → “c:\program files\musehub\current\musehub.exe” ----AppNotificationActivated: =\> Ningún archivo CustomCLSID: HKU\S-1-5-21-799460012-3513789069-1987005638-1001\_Classes\CLSID{DFF20505-B08F-455B-AD70-4FBD055088E0}\localserver32 → C:\Program Files\Google\Chrome\Application\PlatformExperienceHelper\platform\_experience\_helper.exe (Google LLC → Google LLC) CustomCLSID: HKU\S-1-5-21-799460012-3513789069-1987005638-1001\_Classes\CLSID{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32 → C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.25.14602\x64\Microsoft.Teams.MeetingAddin.DLL (Microsoft Corporation → Microsoft Corporation) ShellIconOverlayIdentifiers: [MEGA (Pending)] → {056D528D-CE28-4194-9BA3-BA2E9197FF8C} =\> C:\Users\Admin\AppData\Local\MEGAsync\ShellExtX64.dll [2026-09-21] (Mega Limited → ) ShellIconOverlayIdentifiers: [MEGA (Synced)] → {05B38830-F4E9-4329-978B-1DD28605D202} =\> C:\Users\Admin\AppData\Local\MEGAsync\ShellExtX64.dll [2026-09-21] (Mega Limited → ) ShellIconOverlayIdentifiers: [MEGA (Syncing)] → {0596C850-7BDD-4C9D-AFDF-873BE6890637} =\> C:\Users\Admin\AppData\Local\MEGAsync\ShellExtX64.dll [2026-09-21] (Mega Limited → ) ContextMenuHandlers1: [FileSyncEx] → {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} =\> C:\Program Files\Microsoft OneDrive\26.178.0913.0007\FileSyncShell64.dll [2026-10-10] (Microsoft Corporation → Microsoft Corporation) ContextMenuHandlers1: [Glarysoft MalwareHunter] → {EA847F47-97F1-4D78-AB99-C63CA1C327F0} =\> C:\Program Files (x86)\Glarysoft\Malware Hunter\x64\MHContextHandlerx64.dll [2023-03-03] (Glarysoft Ltd → Glarysoft Ltd) ContextMenuHandlers1: [MEGA (Context menu)] → {0229E5E7-09E9-45CF-9228-0228EC7D5F17} =\> C:\Users\Admin\AppData\Local\MEGAsync\ShellExtX64.dll [2026-09-21] (Mega Limited → ) ContextMenuHandlers1: [Nitro.Pro.ShellExtension.Shim] → {211B6F25-950C-49CD-AB86-A448EF85686A} =\> C:\Program Files\Common Files\Nitro\Nitro.Pro.ShellExtension.Shim.dll [2023-07-19] (Nitro Software, Inc. → Nitro Software, Inc.) ContextMenuHandlers2: [Glarysoft MalwareHunter] → {EA847F47-97F1-4D78-AB99-C63CA1C327F0} =\> C:\Program Files (x86)\Glarysoft\Malware Hunter\x64\MHContextHandlerx64.dll [2023-03-03] (Glarysoft Ltd → Glarysoft Ltd) ContextMenuHandlers2: [MEGA (Context menu)] → {0229E5E7-09E9-45CF-9228-0228EC7D5F17} =\> C:\Users\Admin\AppData\Local\MEGAsync\ShellExtX64.dll [2026-09-21] (Mega Limited → ) ContextMenuHandlers3: [MEGA (Context menu)] → {0229E5E7-09E9-45CF-9228-0228EC7D5F17} =\> C:\Users\Admin\AppData\Local\MEGAsync\ShellExtX64.dll [2026-09-21] (Mega Limited → ) ContextMenuHandlers4: [FileSyncEx] → {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} =\> C:\Program Files\Microsoft OneDrive\26.178.0913.0007\FileSyncShell64.dll [2026-10-10] (Microsoft Corporation → Microsoft Corporation) ContextMenuHandlers4: [MEGA (Context menu)] → {0229E5E7-09E9-45CF-9228-0228EC7D5F17} =\> C:\Users\Admin\AppData\Local\MEGAsync\ShellExtX64.dll [2026-09-21] (Mega Limited → ) ContextMenuHandlers5: [FileSyncEx] → {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} =\> C:\Program Files\Microsoft OneDrive\26.178.0913.0007\FileSyncShell64.dll [2026-10-10] (Microsoft Corporation → Microsoft Corporation) ContextMenuHandlers6: [Glarysoft MalwareHunter] → {EA847F47-97F1-4D78-AB99-C63CA1C327F0} =\> C:\Program Files (x86)\Glarysoft\Malware Hunter\x64\MHContextHandlerx64.dll [2023-03-03] (Glarysoft Ltd → Glarysoft Ltd) ==================== Codecs (Lista blanca) ==================== ==================== Accesos directos & WMI ======================== (Las entradas pueden ser listadas para ser restauradas o eliminadas.) ShortcutWithArgument: C:\Users\Admin\Desktop\Persona 1 - Chrome.lnk → C:\Program Files\Google\Chrome\Application\chrome.exe (Google LLC) → --profile-directory=“Default” ShortcutWithArgument: C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\ff13ca23fee04978\Kevin - Chrome.lnk → C:\Program Files\Google\Chrome\Application\chrome.exe (Google LLC) → --profile-directory=“Profile 5” ShortcutWithArgument: C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\69639df789022856\Samir - Chrome.lnk → C:\Program Files\Google\Chrome\Application\chrome.exe (Google LLC) → --profile-directory=“Profile 1” ==================== Módulos cargados (Lista blanca) ============= 2026-09-05 15:09 - 2026-09-05 15:09 - 000138240 \__**\_ () [Archivo no firmado] C:\WINDOWS\assembly\NativeImages\_v4.0.30319\_32\Interop.IWs06dcaa36#\1361606853cda8f21519f51b887f79cc\Interop.IWshRuntimeLibrary.ni.dll 2026-10-01 20:27 - 2026-10-01 20:27 - 000869376 \_**_\_ (.NET Foundation) [Archivo no firmado] C:\WINDOWS\assembly\NativeImages\_v4.0.30319\_64\Microsoft.T417b639d#\475955786dcb468fd6d107f8ca6929fc\Microsoft.Toolkit.Uwp.Notifications.ni.dll 2026-09-14 17:32 - 2026-09-14 17:32 - 000134656 \__**\_ (hardcodet.net) [Archivo no firmado] C:\WINDOWS\assembly\NativeImages\_v4.0.30319\_32\Hardcodet.W6cab32f3#\1ca4323890ac4f0aab42de10a3c30b05\Hardcodet.Wpf.TaskbarNotification.ni.dll 2026-09-05 15:03 - 2026-09-05 15:03 - 000088576 \_**_\_ (HP Inc.) [Archivo no firmado] C:\WINDOWS\assembly\NativeImages\_v4.0.30319\_64\HP.SEU.Localization\0b1008fd4111db78bc27ecb28d861a82\HP.SEU.Localization.ni.dll 2026-09-05 15:03 - 2026-09-05 15:03 - 000440320 \__**\_ (HP Inc.) [Archivo no firmado] C:\WINDOWS\assembly\NativeImages\_v4.0.30319\_64\LauncherSDK\5783a87788c2ba1e5686230d97543c0f\LauncherSDK.ni.dll 2026-09-05 15:03 - 2026-09-05 15:03 - 000038400 \_**_\_ (HP Inc.) [Archivo no firmado] C:\WINDOWS\assembly\NativeImages\_v4.0.30319\_64\Logging\e50966a179729e711da844035e53777f\Logging.ni.dll 2026-09-14 17:34 - 2026-09-14 17:34 - 000153600 \__**\_ (HP Inc.) [Archivo no firmado] C:\WINDOWS\assembly\NativeImages\_v4.0.30319\_64\RpcClient\dbbd610f8a61ddaf1e43145b5af46eca\RpcClient.ni.dll 2026-09-14 17:34 - 2026-09-14 17:34 - 000125440 \_**_\_ (HP Inc.) [Archivo no firmado] C:\WINDOWS\assembly\NativeImages\_v4.0.30319\_64\WMISDK\8578fd2322ced119022973f06c8571cd\WMISDK.ni.dll 2026-09-14 17:32 - 2026-09-14 17:32 - 001700864 \__**\_ (Mark Heath & Contributors) [Archivo no firmado] C:\WINDOWS\assembly\NativeImages\_v4.0.30319\_32\NAudio\a9e8c2fc39f1ac7d2dd085c1ee5154f8\NAudio.ni.dll 2026-09-14 17:32 - 2026-09-14 17:32 - 003062272 \_**_\_ (Newtonsoft) [Archivo no firmado] C:\WINDOWS\assembly\NativeImages\_v4.0.30319\_32\Newtonsoft.Json\39d765760e07fec56a098058bf196660\Newtonsoft.Json.ni.dll 2026-09-14 17:33 - 2026-09-14 17:33 - 003884544 \__**\_ (Newtonsoft) [Archivo no firmado] C:\WINDOWS\assembly\NativeImages\_v4.0.30319\_64\Newtonsoft.Json\e7031ee81a19ccb1f96401fa814a55d6\Newtonsoft.Json.ni.dll 2026-09-14 17:32 - 2026-09-14 17:32 - 000793088 \_**_\_ (The Apache Software Foundation) [Archivo no firmado] C:\WINDOWS\assembly\NativeImages\_v4.0.30319\_32\log4net\0c33e701fe3f757f90531e7636cb066a\log4net.ni.dll ==================== Alternate Data Streams (Lista blanca) ======== ==================== Modo Seguro (Lista blanca) ================== ==================== Asociación (Lista blanca) ================= ==================== Internet Explorer (Lista blanca) ============= BHO: NitroPDF.IE.Sharepoint → {3BFAE61D-4A6D-4467-9E5E-FE5293D10F9F} → C:\Program Files\Nitro\PDF Pro\14\npnitroie.dll [2023-07-19] (Nitro Software, Inc. → Nitro Software, Inc.) BHO: HP Network Check Helper → {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} → C:\Program Files (x86)\HP\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2026-08-13] (HP Inc. → HP Inc.) BHO-x32: Skype for Business Browser Helper → {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} → C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll [2024-02-15] (Microsoft Corporation → Microsoft Corporation) BHO-x32: NitroPDF.IE.Sharepoint → {3BFAE61D-4A6D-4467-9E5E-FE5293D10F9F} → C:\Program Files (x86)\Nitro\PDF Pro\14\npnitroie.dll [2023-07-19] (Nitro Software, Inc. → Nitro Software, Inc.) BHO-x32: HP Network Check Helper → {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} → C:\Program Files (x86)\HP\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2026-08-13] (HP Inc. → HP Inc.) Handler: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2024-02-15] (Microsoft Corporation → Microsoft Corporation) Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2024-02-15] (Microsoft Corporation → Microsoft Corporation) Handler: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2024-02-15] (Microsoft Corporation → Microsoft Corporation) Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2024-02-15] (Microsoft Corporation → Microsoft Corporation) Handler: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2024-02-15] (Microsoft Corporation → Microsoft Corporation) Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2024-02-15] (Microsoft Corporation → Microsoft Corporation) Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2024-02-15] (Microsoft Corporation → Microsoft Corporation) Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2024-02-15] (Microsoft Corporation → Microsoft Corporation) ==================== Hosts contenido: ========================= (Si es necesario, la directiva Hosts: puede ser incluida en el fixlist para restablecer Hosts.) 2019-12-07 03:14 - 2025-08-13 04:44 - 000000330 \_\_\_\_\_ C:\WINDOWS\system32\drivers\etc\hosts 127.0.0.1 localhost 46.101.172.11 pes6gate-ec.winning-eleven.net # PESGate Sixserver 46.101.172.11 we9stun.winning-eleven.net # Stunserver ==================== Network =========================== (Actualmente no existe una corrección automática para esta sección.) DNS Servers: El medio no está conectado a internet. Firewall de Windows está habilitado. # Network Binding: Wi-Fi: Realtek RTL8723DE 802.11b/g/n PCIe Adapter → rtwlane.sys vms\_vsf: Filtro de extensión del conmutador virtual de Hyper-V ms\_l1vhlwf: Nested Network Virtualization vms\_vsp: Protocolo de extensión del conmutador virtual de Hyper-V ==================== Otras Áreas =========================== (Actualmente no existe una corrección automática para esta sección.) HKLM\System\CurrentControlSet\Control\Session Manager\Environment\Path → C:\Program Files\Common Files\Oracle\Java\javapath;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0;%SYSTEMROOT%\System32\OpenSSH; HKU\S-1-5-21-799460012-3513789069-1987005638-1001\Control Panel\Desktop\Wallpaper → C:\WINDOWS\web\wallpaper\Windows\img19.jpg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System =\> (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) HKLM\SOFTWARE\Microsoft\Windows Defender\Features =\> (TamperProtection: 4) (TamperProtectionSource: 2) HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection =\> (DpaDisabled: 0) HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|E:\OInstall.exe HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Users\Admin\AppData\Local\Temp\files HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|D:\Apps\KMSAt-v179-SFT\KMSAuto++ v1.7.9\KMSAuto++ x64.exe HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|D:\Apps\KMSAt-v179-SFT\KMSAuto++ v1.7.9\KMSAuto\_Files HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\WINDOWS\System32\SECOPatcher.dll HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Users\Admin\AppData\Local\Temp\dControl.exe ==================== MSCONFIG/TASK MANAGER elementos deshabilitados == (Si una entrada es incluida en el fixlist, será eliminada.) HKU\S-1-5-21-799460012-3513789069-1987005638-1001…\StartupApproved\Run: =\> “Opera GX Browser Assistant” HKU\S-1-5-21-799460012-3513789069-1987005638-1001…\StartupApproved\Run: =\> “EpicGamesLauncher” HKU\S-1-5-21-799460012-3513789069-1987005638-1001…\StartupApproved\Run: =\> “Steam” ==================== Reglas de firewall (Lista blanca) ================ (Si una entrada es incluida en el fixlist, será eliminada del registro. El archivo no se moverá a menos que sea añadido al listado por separado.) FirewallRules: [UDP Query User{D89D35D8-EB59-47EC-978C-651B5C4E1718}C:\users\admin\desktop\citra-windows-msvc-20240927-608383e\citra-qt.exe] =\> (Allow) C:\users\admin\desktop\citra-windows-msvc-20240927-608383e\citra-qt.exe =\> Ningún archivo FirewallRules: [TCP Query User{91C7B06A-B756-405F-B2E9-A0C658EEF701}C:\users\admin\desktop\citra-windows-msvc-20240927-608383e\citra-qt.exe] =\> (Allow) C:\users\admin\desktop\citra-windows-msvc-20240927-608383e\citra-qt.exe =\> Ningún archivo FirewallRules: [{EE40F6EF-E2F8-4545-82F0-5B69B16CB9A6}] =\> (Allow) C:\Program Files\WindowsApps\MicrosoftTeams\_25007.203.3359.7325\_x64\_\_8wekyb3d8bbwe\msteams.exe (Microsoft Corporation → Microsoft Corporation) FirewallRules: [{E56F2230-50B3-4376-A15B-ABE9DC02E79A}] =\> (Allow) C:\Program Files\WindowsApps\MicrosoftTeams\_25007.203.3359.7325\_x64\_\_8wekyb3d8bbwe\msteams.exe (Microsoft Corporation → Microsoft Corporation) FirewallRules: [{8DBD7F61-73ED-4FC1-A300-8664A03637BB}] =\> (Allow) C:\Program Files (x86)\Steam\steamapps\common\POSTAL2Complete\ShareThePain\System\Postal2MP.exe () [Archivo no firmado] FirewallRules: [{96513244-5119-46F4-B4AA-8207A811D42C}] =\> (Allow) C:\Program Files (x86)\Steam\steamapps\common\POSTAL2Complete\ShareThePain\System\Postal2MP.exe () [Archivo no firmado] FirewallRules: [{2F9C4C37-E6BD-4108-BDC3-44B8820D2176}] =\> (Allow) C:\Program Files (x86)\Steam\steamapps\common\POSTAL2Complete\System\Postal2.exe () [Archivo no firmado] FirewallRules: [{BFF9C4E5-CCEB-4104-AFF7-E55E10BA806D}] =\> (Allow) C:\Program Files (x86)\Steam\steamapps\common\POSTAL2Complete\System\Postal2.exe () [Archivo no firmado] FirewallRules: [{A673CE2F-665B-430C-A8C4-995071BEF06B}] =\> (Allow) C:\Program Files (x86)\Steam\steamapps\common\Left 4 Dead 2\left4dead2.exe () [Archivo no firmado] FirewallRules: [{63BAA3A9-0339-4F4F-B8F5-61F5CAA64FD1}] =\> (Allow) C:\Program Files (x86)\Steam\steamapps\common\Left 4 Dead 2\left4dead2.exe () [Archivo no firmado] FirewallRules: [UDP Query User{084A4331-FE30-40D1-9E11-7AF67525203F}C:\users\admin\desktop\stardew.valley.v1.6.3a ultima version\stardewmoddingapi.exe] =\> (Block) C:\users\admin\desktop\stardew.valley.v1.6.3a ultima version\stardewmoddingapi.exe =\> Ningún archivo FirewallRules: [TCP Query User{78C0460A-66F7-4A63-B2E7-F07CA5589C0D}C:\users\admin\desktop\stardew.valley.v1.6.3a ultima version\stardewmoddingapi.exe] =\> (Block) C:\users\admin\desktop\stardew.valley.v1.6.3a ultima version\stardewmoddingapi.exe =\> Ningún archivo FirewallRules: [UDP Query User{60E53B2E-73F2-4993-996B-EEF14AE22435}C:\users\admin\desktop\stardew.valley.v1.6.3a ultima version\stardew valley.exe] =\> (Block) C:\users\admin\desktop\stardew.valley.v1.6.3a ultima version\stardew valley.exe =\> Ningún archivo FirewallRules: [TCP Query User{C1C0EE4B-43F2-4992-906B-C2A3A4DD1C1C}C:\users\admin\desktop\stardew.valley.v1.6.3a ultima version\stardew valley.exe] =\> (Block) C:\users\admin\desktop\stardew.valley.v1.6.3a ultima version\stardew valley.exe =\> Ningún archivo FirewallRules: [UDP Query User{A496F28A-E633-403A-AA12-DCB36FD78EAC}C:\users\admin\appdata\local\packages\microsoft.4297127d64ec6\_8wekyb3d8bbwe\localcache\local\runtime\java-runtime-delta\windows-x64\java-runtime-delta\bin\javaw.exe] =\> (Block) C:\users\admin\appdata\local\packages\microsoft.4297127d64ec6\_8wekyb3d8bbwe\localcache\local\runtime\java-runtime-delta\windows-x64\java-runtime-delta\bin\javaw.exe FirewallRules: [TCP Query User{0A96893F-97CF-4743-A6F2-E48E56A95536}C:\users\admin\appdata\local\packages\microsoft.4297127d64ec6\_8wekyb3d8bbwe\localcache\local\runtime\java-runtime-delta\windows-x64\java-runtime-delta\bin\javaw.exe] =\> (Block) C:\users\admin\appdata\local\packages\microsoft.4297127d64ec6\_8wekyb3d8bbwe\localcache\local\runtime\java-runtime-delta\windows-x64\java-runtime-delta\bin\javaw.exe FirewallRules: [UDP Query User{E9766A30-3633-414B-AB1B-7568C2ECAD9A}C:\users\admin\appdata\local\packages\microsoft.4297127d64ec6\_8wekyb3d8bbwe\localcache\local\runtime\java-runtime-gamma\windows-x64\java-runtime-gamma\bin\javaw.exe] =\> (Allow) C:\users\admin\appdata\local\packages\microsoft.4297127d64ec6\_8wekyb3d8bbwe\localcache\local\runtime\java-runtime-gamma\windows-x64\java-runtime-gamma\bin\javaw.exe FirewallRules: [TCP Query User{A3212DEB-9978-4AB5-8A8F-7E1E107CB653}C:\users\admin\appdata\local\packages\microsoft.4297127d64ec6\_8wekyb3d8bbwe\localcache\local\runtime\java-runtime-gamma\windows-x64\java-runtime-gamma\bin\javaw.exe] =\> (Allow) C:\users\admin\appdata\local\packages\microsoft.4297127d64ec6\_8wekyb3d8bbwe\localcache\local\runtime\java-runtime-gamma\windows-x64\java-runtime-gamma\bin\javaw.exe FirewallRules: [{8A37CED0-DC40-4354-A3EE-7F16AA34A0E3}] =\> (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe =\> Ningún archivo FirewallRules: [{22474685-FA2B-462C-ADB6-244491ADA938}] =\> (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe =\> Ningún archivo FirewallRules: [{6076A1E7-44DA-453D-BFC2-172E6DC1A6D0}] =\> (Allow) C:\Program Files (x86)\Steam\Steam.exe (Valve Corp. → Valve Corporation) FirewallRules: [{6FD51CA8-0F28-4432-8709-30251EA9C0B1}] =\> (Allow) C:\Program Files (x86)\Steam\Steam.exe (Valve Corp. → Valve Corporation) FirewallRules: [UDP Query User{1BF2BB2A-5982-401F-868C-E701CFF21B0B}C:\users\admin\appdata\local\programs\opera gx\opera.exe] =\> (Block) C:\users\admin\appdata\local\programs\opera gx\opera.exe =\> Ningún archivo FirewallRules: [TCP Query User{E743623F-4736-401B-B522-7E9053C03AF6}C:\users\admin\appdata\local\programs\opera gx\opera.exe] =\> (Block) C:\users\admin\appdata\local\programs\opera gx\opera.exe =\> Ningún archivo FirewallRules: [{CEA2C98E-128B-4BE3-BA5E-A880DB60F837}] =\> (Allow) C:\Program Files\Microsoft Office\root\Office16\outlook.exe (Microsoft Corporation → Microsoft Corporation) FirewallRules: [{086983F7-D544-4E39-BB79-BFFD27D46C32}] =\> (Allow) C:\Program Files\Microsoft Office\root\Office16\UcMapi.exe =\> Ningún archivo FirewallRules: [{F8694745-E013-461E-8427-15E63C7874D9}] =\> (Allow) C:\Program Files\Microsoft Office\root\Office16\Lync.exe =\> Ningún archivo FirewallRules: [{00BCA30C-D536-402C-98B8-46F871D30EC0}] =\> (Allow) C:\Users\Admin\AppData\Roaming\Zoom\bin\airhost.exe (Zoom Video Communications, Inc. → Zoom Video Communications, Inc.) FirewallRules: [{7F4F4B0F-3AC5-42CF-A9DB-25657E847227}] =\> (Allow) C:\Users\Admin\AppData\Roaming\Zoom\bin\airhost.exe (Zoom Video Communications, Inc. → Zoom Video Communications, Inc.) FirewallRules: [{294A71D5-30F4-478A-BEEB-A09AD3B17E32}] =\> (Allow) C:\Users\Admin\AppData\Roaming\Zoom\bin\Zoom.exe (Zoom Video Communications, Inc. → Zoom Video Communications, Inc.) FirewallRules: [TCP Query User{F715B9C5-C65A-4582-88BB-EAE44159A3C0}C:\users\admin\desktop\pes 6 locazos\program files\konami\pro evolution soccer 6\pes6.exe] =\> (Allow) C:\users\admin\desktop\pes 6 locazos\program files\konami\pro evolution soccer 6\pes6.exe =\> Ningún archivo FirewallRules: [UDP Query User{82306A5B-77E7-482C-9A2D-913FD10149FB}C:\users\admin\desktop\pes 6 locazos\program files\konami\pro evolution soccer 6\pes6.exe] =\> (Allow) C:\users\admin\desktop\pes 6 locazos\program files\konami\pro evolution soccer 6\pes6.exe =\> Ningún archivo FirewallRules: [TCP Query User{8E6035AC-969F-46D5-9150-F0FBC8A47B3E}C:\program files (x86)\konami\pro evolution soccer 2013\pes2013.exe] =\> (Allow) C:\program files (x86)\konami\pro evolution soccer 2013\pes2013.exe =\> Ningún archivo FirewallRules: [UDP Query User{62CEF482-F140-46BE-9D96-A6FB15588ECB}C:\program files (x86)\konami\pro evolution soccer 2013\pes2013.exe] =\> (Allow) C:\program files (x86)\konami\pro evolution soccer 2013\pes2013.exe =\> Ningún archivo FirewallRules: [{29630B9F-0C21-49E7-A418-54B16EC96BCB}] =\> (Allow) C:\Program Files (x86)\KONAMI\Pro Evolution Soccer 2013\Pro Evolution Soccer 2013.exe (Konami Digital Entertainment Co., Ltd.) [Archivo no firmado] FirewallRules: [{7B35AD6C-BD67-4CBA-A982-8E7CFC4615AC}] =\> (Allow) C:\Program Files (x86)\KONAMI\Pro Evolution Soccer 2013\Pro Evolution Soccer 2013.exe (Konami Digital Entertainment Co., Ltd.) [Archivo no firmado] FirewallRules: [TCP Query User{5252BE76-1811-4F81-A6D4-2BF1F5D779F9}C:\program files (x86)\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe] =\> (Allow) C:\program files (x86)\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe =\> Ningún archivo FirewallRules: [UDP Query User{CF08BC38-0801-4671-85F7-E5FACD5772E5}C:\program files (x86)\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe] =\> (Allow) C:\program files (x86)\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe =\> Ningún archivo FirewallRules: [{2C15321C-5B67-4BC4-9EFD-8F7329F385B2}] =\> (Allow) C:\Program Files (x86)\Steam\steamapps\common\hotline\_miami\HotlineMiami.exe (Devolver) [Archivo no firmado] FirewallRules: [{301205A0-0F72-4E14-80C2-9621C16E2910}] =\> (Allow) C:\Program Files (x86)\Steam\steamapps\common\hotline\_miami\HotlineMiami.exe (Devolver) [Archivo no firmado] FirewallRules: [{07ADF8B9-9A26-473F-82A8-0EBB482F33A9}] =\> (Allow) C:\Program Files (x86)\Steam\steamapps\common\Hitman Blood Money\HitmanBloodMoney.exe () [Archivo no firmado] FirewallRules: [{BD90F659-B033-4647-93E9-8CB43911F5FC}] =\> (Allow) C:\Program Files (x86)\Steam\steamapps\common\Hitman Blood Money\HitmanBloodMoney.exe () [Archivo no firmado] FirewallRules: [{483EF486-7438-40C8-AAB0-130DE8F18E14}] =\> (Allow) C:\Program Files (x86)\Steam\steamapps\common\Hitman Blood Money\configure.exe () [Archivo no firmado] FirewallRules: [{B4F3FB06-388C-4536-BCAA-3F20103939E5}] =\> (Allow) C:\Program Files (x86)\Steam\steamapps\common\Hitman Blood Money\configure.exe () [Archivo no firmado] FirewallRules: [TCP Query User{D0BE2ED0-171F-4B7D-84FA-D80E2C9FEE1A}C:\users\admin\appdata\local\packages\microsoft.4297127d64ec6\_8wekyb3d8bbwe\localcache\local\runtime\jre-legacy\windows-x64\jre-legacy\bin\javaw.exe] =\> (Allow) C:\users\admin\appdata\local\packages\microsoft.4297127d64ec6\_8wekyb3d8bbwe\localcache\local\runtime\jre-legacy\windows-x64\jre-legacy\bin\javaw.exe FirewallRules: [UDP Query User{7050EC80-6F90-4378-B2D9-FA813C9FB8E5}C:\users\admin\appdata\local\packages\microsoft.4297127d64ec6\_8wekyb3d8bbwe\localcache\local\runtime\jre-legacy\windows-x64\jre-legacy\bin\javaw.exe] =\> (Allow) C:\users\admin\appdata\local\packages\microsoft.4297127d64ec6\_8wekyb3d8bbwe\localcache\local\runtime\jre-legacy\windows-x64\jre-legacy\bin\javaw.exe FirewallRules: [TCP Query User{F64AC537-D7F6-4AF2-862C-4E26227FCF8A}C:\users\admin\desktop\dispatch\_b20672856\_elenemigos\dispatch\binaries\win64\dispatch-win64-shipping.exe] =\> (Block) C:\users\admin\desktop\dispatch\_b20672856\_elenemigos\dispatch\binaries\win64\dispatch-win64-shipping.exe =\> Ningún archivo FirewallRules: [UDP Query User{BA7E8A66-672B-4E63-969E-F59CAB5C184C}C:\users\admin\desktop\dispatch\_b20672856\_elenemigos\dispatch\binaries\win64\dispatch-win64-shipping.exe] =\> (Block) C:\users\admin\desktop\dispatch\_b20672856\_elenemigos\dispatch\binaries\win64\dispatch-win64-shipping.exe =\> Ningún archivo FirewallRules: [TCP Query User{933FDDE4-1AFA-4560-B449-F09EEB019832}C:\users\admin\desktop\dispatch\_b20774381\_elenemigos\dispatch\binaries\win64\dispatch-win64-shipping.exe] =\> (Block) C:\users\admin\desktop\dispatch\_b20774381\_elenemigos\dispatch\binaries\win64\dispatch-win64-shipping.exe =\> Ningún archivo FirewallRules: [UDP Query User{08784866-853D-437B-AF53-45ECF474B1CD}C:\users\admin\desktop\dispatch\_b20774381\_elenemigos\dispatch\binaries\win64\dispatch-win64-shipping.exe] =\> (Block) C:\users\admin\desktop\dispatch\_b20774381\_elenemigos\dispatch\binaries\win64\dispatch-win64-shipping.exe =\> Ningún archivo FirewallRules: [{39E9DA05-AE52-4FC6-B0BC-5F3BE67C12E6}] =\> (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe (Valve Corp. → Valve Corporation) FirewallRules: [{9A8D34A8-0506-4C42-9D55-E9364D1371A5}] =\> (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe (Valve Corp. → Valve Corporation) FirewallRules: [TCP Query User{90765828-F305-4C6C-AA09-62985B574DC3}C:\users\admin\desktop\citra-windows-msvc-20240303-0ff3440\citra-qt.exe] =\> (Allow) C:\users\admin\desktop\citra-windows-msvc-20240303-0ff3440\citra-qt.exe =\> Ningún archivo FirewallRules: [UDP Query User{60D95BC6-7A50-4987-B645-46E47E510876}C:\users\admin\desktop\citra-windows-msvc-20240303-0ff3440\citra-qt.exe] =\> (Allow) C:\users\admin\desktop\citra-windows-msvc-20240303-0ff3440\citra-qt.exe =\> Ningún archivo FirewallRules: [{6873F788-826E-42FA-A06F-7D206412ABC9}] =\> (Allow) C:\Program Files (x86)\Steam\steamapps\common\Terraria\Terraria.exe (Re-Logic) [Archivo no firmado] FirewallRules: [{6B3AF583-F16E-4F10-9D5A-79EBC823D7AE}] =\> (Allow) C:\Program Files (x86)\Steam\steamapps\common\Terraria\Terraria.exe (Re-Logic) [Archivo no firmado] FirewallRules: [TCP Query User{3D8A5B0C-C5AE-4E94-83F0-DAC3B271D20E}C:\program files (x86)\steam\steamapps\common\terraria\terrariaserver.exe] =\> (Allow) C:\program files (x86)\steam\steamapps\common\terraria\terrariaserver.exe (Re-Logic) [Archivo no firmado] FirewallRules: [UDP Query User{073B4228-9A80-4369-B90F-7DEFC705D631}C:\program files (x86)\steam\steamapps\common\terraria\terrariaserver.exe] =\> (Allow) C:\program files (x86)\steam\steamapps\common\terraria\terrariaserver.exe (Re-Logic) [Archivo no firmado] FirewallRules: [TCP Query User{F1C13B8C-7CA5-4C72-9A6E-D86837D3D7D2}C:\users\admin\appdata\local\programs\microsoft vs code\code.exe] =\> (Allow) C:\users\admin\appdata\local\programs\microsoft vs code\code.exe (Microsoft Corporation → Microsoft Corporation) FirewallRules: [UDP Query User{C7C09811-A6F9-412A-9279-8AEFA9FA63E6}C:\users\admin\appdata\local\programs\microsoft vs code\code.exe] =\> (Allow) C:\users\admin\appdata\local\programs\microsoft vs code\code.exe (Microsoft Corporation → Microsoft Corporation) FirewallRules: [{3129BA70-2158-4BD5-A76D-C6669D52A6B5}] =\> (Allow) C:\Program Files (x86)\Steam\steamapps\common\Hearts of Iron IV\dowser.exe (Paradox Interactive AB (publ) → ) FirewallRules: [{41F4DF5B-3316-4D73-85A9-D09EE715F012}] =\> (Allow) C:\Program Files (x86)\Steam\steamapps\common\Hearts of Iron IV\dowser.exe (Paradox Interactive AB (publ) → ) FirewallRules: [{5706624A-B9BE-40BC-BD3D-29A042659F27}] =\> (Allow) C:\Program Files (x86)\Steam\steamapps\common\Hearts of Iron IV\hoi4.exe (Paradox Interactive AB (publ) → Paradox Interactive) FirewallRules: [{368ACE83-4943-4997-87A3-218C7CD0D0A0}] =\> (Allow) C:\Program Files (x86)\Steam\steamapps\common\Hearts of Iron IV\hoi4.exe (Paradox Interactive AB (publ) → Paradox Interactive) FirewallRules: [EdgeWebView2-MDNS-In-UDP] =\> (Allow) C:\WINDOWS\system32\Microsoft-Edge-WebView\msedgewebview2.exe (Microsoft Corporation → Microsoft Corporation) FirewallRules: [{8CAEA194-0D6B-423E-B992-87D6E73966F7}] =\> (Allow) C:\Program Files (x86)\BlueStacks X\BlueStacksWeb.exe =\> Ningún archivo FirewallRules: [{6E4E263F-84B8-4C8F-AF32-36FF1D8C45E0}] =\> (Allow) C:\Program Files (x86)\BlueStacks X\Cloud Game.exe =\> Ningún archivo FirewallRules: [{B3281F00-835B-402D-BBBD-7F8DC93F4E12}] =\> (Allow) C:\Program Files\BlueStacks\_nxt\HD-Player.exe =\> Ningún archivo FirewallRules: [{88D35DB3-BDB3-4A5D-B34C-549E3EE6AC8D}] =\> (Allow) C:\Program Files\BlueStacks\_nxt\BlueStacksAppplayerWeb.exe =\> Ningún archivo FirewallRules: [{A8FB1847-0F00-47BA-BB86-6AE2604052FA}] =\> (Allow) C:\Program Files\BlueStacks\_nxt\BlueStacksAIRun.exe =\> Ningún archivo FirewallRules: [{5133A1EC-5259-4D8D-84FA-78AEF71C4470}] =\> (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe (Google LLC → Google LLC) FirewallRules: [{65688274-5DCE-4BBE-88E1-F3115CA12E47}] =\> (Allow) C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub\_19.2610.35011.0\_x64\_\_8wekyb3d8bbwe\M365Copilot.exe (Microsoft Corporation → Microsoft Corporation) FirewallRules: [{049DD805-2F41-43BF-AE4F-BA55AA4B3085}] =\> (Allow) C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub\_19.2610.35011.0\_x64\_\_8wekyb3d8bbwe\M365Copilot.exe (Microsoft Corporation → Microsoft Corporation) FirewallRules: [{012DC19A-0CC0-4B86-B0A9-009DB3238294}] =\> (Allow) C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub\_19.2610.35011.0\_x64\_\_8wekyb3d8bbwe\M365Copilot.exe (Microsoft Corporation → Microsoft Corporation) FirewallRules: [{3679FD69-F277-4AF1-88E7-1DD5463C5B1E}] =\> (Allow) C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub\_19.2610.35011.0\_x64\_\_8wekyb3d8bbwe\M365Copilot.exe (Microsoft Corporation → Microsoft Corporation) FirewallRules: [{9AB0D24B-7DDD-4B16-A7FB-0061409D28AA}] =\> (Allow) C:\Program Files (x86)\Microsoft\Copilot\Application\mscopilot.exe (Microsoft Corporation → Microsoft Corporation) ==================== Puntos de Restauración ========================= 10-10-2026 16:02:28 Eliminación del paquete de idioma ==================== Dispositivos defectuosos en el Administrador de dispositivos ============ ==================== Errores del registro de eventos: ======================== # Errores de aplicación: Error: (10/12/2026 08:36:50 AM) (Source: Application Hang) (EventID: 1002) (User: NT AUTHORITY) Description: El programa CrossDeviceService.exe versión 1.26072.116.0 dejó de interactuar con Windows y se cerró. Para ver si hay más información disponible sobre este problema, comprueba el historial de problemas en el panel de control de Seguridad y mantenimiento. Error: (10/07/2026 05:29:13 AM) (Source: Application Hang) (EventID: 1002) (User: NT AUTHORITY) Description: El programa mscopilot\_proxy.exe versión 154.0.4258.53 dejó de interactuar con Windows y se cerró. Para ver si hay más información disponible sobre este problema, comprueba el historial de problemas en el panel de control de Seguridad y mantenimiento. Error: (09/28/2026 11:55:15 AM) (Source: VSS) (EventID: 8193) (User: ) Description: Error del Servicio de instantáneas de volumen: error inesperado al llamar a la rutina QueryFullProcessImageNameW. HR = 0x80070006, Controlador no válido.. Operación: Ejecutando operación asincrónica Contexto: Estado actual: DoSnapshotSet ================= ---
### Author: ![Nashe\_Xd](https://forospyware.com/user_avatar/forospyware.com/nashe_xd/32/45162_2.png) [@Nashe\_Xd](https://forospyware.com/u/Nashe_Xd) #### Post date: [12 Octubre, 2026 16:53 UTC](https://forospyware.com/t/virus-dusapp-aparecio-de-repente-entre-mis-aplicaciones/36460/4 "2026-10-12T16:53:38Z")
# Errores del sistema: Error: (10/12/2026 08:38:47 AM) (Source: Microsoft-Windows-TPM-WMI) (EventID: 1796) (User: NT AUTHORITY) Description: La actualización de arranque seguro no ha podido actualizar SBAT debido al error -1878589247. Para obtener más información, consulta [Eventos de actualización de variables DB y DBX de arranque seguro | Microsoft Support](https://go.microsoft.com/fwlink/?linkid=2169931) Error: (10/11/2026 09:20:04 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY) Description: Error de instalación: error de Windows al instalar la siguiente actualización, error (0x80073d02 = No se pudo instalar el paquete porque los recursos que modifica están actualmente en uso.): 9NTXGKQ8P7N0-MicrosoftWindows.CrossDevice. Error: (10/11/2026 08:38:45 PM) (Source: Microsoft-Windows-TPM-WMI) (EventID: 1796) (User: NT AUTHORITY) Description: La actualización de arranque seguro no ha podido actualizar SBAT debido al error -1878589247. Para obtener más información, consulta [Eventos de actualización de variables DB y DBX de arranque seguro | Microsoft Support](https://go.microsoft.com/fwlink/?linkid=2169931) Error: (10/11/2026 07:43:44 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY) Description: Error de instalación: error de Windows al instalar la siguiente actualización, error (0x80073d02 = No se pudo instalar el paquete porque los recursos que modifica están actualmente en uso.): 9NTXGKQ8P7N0-MicrosoftWindows.CrossDevice. Error: (10/11/2026 02:44:51 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY) Description: Error de instalación: error de Windows al instalar la siguiente actualización, error (0x80073d02 = No se pudo instalar el paquete porque los recursos que modifica están actualmente en uso.): 9NTXGKQ8P7N0-MicrosoftWindows.CrossDevice. Error: (10/11/2026 10:17:17 AM) (Source: MTConfig) (EventID: 1) (User: ) Description: Error al intentar configurar el modo de entrada de un dispositivo multitoque. Error: (10/11/2026 10:17:17 AM) (Source: MTConfig) (EventID: 1) (User: ) Description: Error al intentar configurar el modo de entrada de un dispositivo multitoque. ---
### Author: ![Nashe\_Xd](https://forospyware.com/user_avatar/forospyware.com/nashe_xd/32/45162_2.png) [@Nashe\_Xd](https://forospyware.com/u/Nashe_Xd) #### Post date: [12 Octubre, 2026 16:54 UTC](https://forospyware.com/t/virus-dusapp-aparecio-de-repente-entre-mis-aplicaciones/36460/5 "2026-10-12T16:54:38Z")
Error: (10/11/2026 09:20:11 AM) (Source: Microsoft-Windows-TPM-WMI) (EventID: 1796) (User: NT AUTHORITY) Description: La actualización de arranque seguro no ha podido actualizar SBAT debido al error -1878589247. Para obtener más información, consulta [Eventos de actualización de variables DB y DBX de arranque seguro | Microsoft Support](https://go.microsoft.com/fwlink/?linkid=2169931) # Windows Defender: TimeCreated : 11/10/2026 23:01:24 Message : Antivirus de Microsoft Defender śсαŋ нąş ьėзŋ šŧόрρêδ ъёƒóřё ¢ömφℓèŧįоη.%η %ŧŜсǻň ĮĎ:%ь{F8A706F6-5293-45BE-B75F-F5EACDC8065F}%ň %ŧŜĉªп Τγρέ:%ьAntimalware%ή %тŞ¢αⁿ Рâяämėţэŗŝ:%вExamen rápido%п %ťÛśēѓ:%ьNT AUTHORITY\SYSTEM%п %тŠţθφ Γéдŝòη:%вŞснěðųļеď şĉâň ẃáś šķîφρ℮ď ъε¢áųš℮ ťнè ℓªšţ şùćčёşŝƒцļ şċàп ẅąš ẅίŧћїл ŧћё ŀäśť 7 δάŷś TimeCreated : 11/10/2026 14:44:12 Message : Antivirus de Microsoft Defender śсαŋ нąş ьėзŋ šŧόрρêδ ъёƒóřё ¢ömφℓèŧįоη.%η %ŧŜсǻň ĮĎ:%ь{005A171C-5667-440B-B9A4-AE77F2D05949}%ň %ŧŜĉªп Τγρέ:%ьAntimalware%ή %тŞ¢αⁿ Рâяämėţэŗŝ:%вExamen rápido%п %ťÛśēѓ:%ьNT AUTHORITY\SYSTEM%п %тŠţθφ Γéдŝòη:%вŞснěðųļеď şĉâň ẃáś šķîφρ℮ď ъε¢áųš℮ ťнè ℓªšţ şùćčёşŝƒцļ şċàп ẅąš ẅίŧћїл ŧћё ŀäśť 7 δάŷś TimeCreated : 8/10/2026 22:26:41 Message : Antivirus de Microsoft Defender śсαŋ нąş ьėзŋ šŧόрρêδ ъёƒóřё ¢ömφℓèŧįоη.%η %ŧŜсǻň ĮĎ:%ь{859C1CA9-AFDD-4453-AC5E-64C399A7596C}%ň %ŧŜĉªп Τγρέ:%ьAntimalware%ή %тŞ¢αⁿ Рâяämėţэŗŝ:%вExamen rápido%п %ťÛśēѓ:%ьNT AUTHORITY\SYSTEM%п %тŠţθφ Γéдŝòη:%вŞснěðųļеď şĉâň ẃáś šķîφρ℮ď ъε¢áųš℮ ťнè ℓªšţ şùćčёşŝƒцļ şċàп ẅąš ẅίŧћїл ŧћё ŀäśť 7 δάŷś TimeCreated : 8/10/2026 13:39:11 Message : Antivirus de Microsoft Defender śсαŋ нąş ьėзŋ šŧόрρêδ ъёƒóřё ¢ömφℓèŧįоη.%η %ŧŜсǻň ĮĎ:%ь{84D8B178-92E5-4E0A-9B08-7197D36BDA6A}%ň %ŧŜĉªп Τγρέ:%ьAntimalware%ή %тŞ¢αⁿ Рâяämėţэŗŝ:%вExamen rápido%п %ťÛśēѓ:%ьNT AUTHORITY\SYSTEM%п %тŠţθφ Γéдŝòη:%вŞснěðųļеď şĉâň ẃáś šķîφρ℮ď ъε¢áųš℮ ťнè ℓªšţ şùćčёşŝƒцļ şċàп ẅąš ẅίŧћїл ŧћё ŀäśť 7 δάŷś TimeCreated : 7/10/2026 11:24:49 Message : Antivirus de Microsoft Defender śсαŋ нąş ьėзŋ šŧόрρêδ ъёƒóřё ¢ömφℓèŧįоη.%η %ŧŜсǻň ĮĎ:%ь{88575A35-ED56-455C-87BB-F91F1220ECA7}%ň %ŧŜĉªп Τγρέ:%ьAntimalware%ή %тŞ¢αⁿ Рâяämėţэŗŝ:%вExamen rápido%п %ťÛśēѓ:%ьNT AUTHORITY\SYSTEM%п %тŠţθφ Γéдŝòη:%вŞснěðųļеď şĉâň ẃáś šķîφρ℮ď ъε¢áųš℮ ťнè ℓªšţ şùćčёşŝƒцļ şċàп ẅąš ẅίŧћїл ŧћё ŀäśť 7 δάŷś TimeCreated : 6/10/2026 07:11:35 Message : Antivirus de Microsoft Defender śсαŋ нąş ьėзŋ šŧόрρêδ ъёƒóřё ¢ömφℓèŧįоη.%η %ŧŜсǻň ĮĎ:%ь{3782AF5B-97B3-40E5-A1C3-3A3332CB488A}%ň %ŧŜĉªп Τγρέ:%ьAntimalware%ή %тŞ¢αⁿ Рâяämėţэŗŝ:%вExamen rápido%п %ťÛśēѓ:%ьNT AUTHORITY\SYSTEM%п %тŠţθφ Γéдŝòη:%вŞснěðųļеď şĉâň ẃáś šķîφρ℮ď ъε¢áųš℮ ťнè ℓªšţ şùćčёşŝƒцļ şċàп ẅąš ẅίŧћїл ŧћё ŀäśť 7 δάŷś TimeCreated : 4/10/2026 03:26:15 Message : Antivirus de Microsoft Defender śсαŋ нąş ьėзŋ šŧόрρêδ ъёƒóřё ¢ömφℓèŧįоη.%η %ŧŜсǻň ĮĎ:%ь{7DE11351-598C-437F-9DC8-9C696A7BF0B6}%ň %ŧŜĉªп Τγρέ:%ьAntimalware%ή %тŞ¢αⁿ Рâяämėţэŗŝ:%вExamen rápido%п %ťÛśēѓ:%ьNT AUTHORITY\SYSTEM%п %тŠţθφ Γéдŝòη:%вЃР€ çθŋπэςŧíòⁿ ґüлδоωⁿ TimeCreated : 3/10/2026 10:54:32 Message : Antivirus de Microsoft Defender śсαŋ нąş ьėзŋ šŧόрρêδ ъёƒóřё ¢ömφℓèŧįоη.%η %ŧŜсǻň ĮĎ:%ь{B2A3422E-9D52-4A08-B63C-77DBBD43DEB1}%ň %ŧŜĉªп Τγρέ:%ьAntimalware%ή %тŞ¢αⁿ Рâяämėţэŗŝ:%вExamen rápido%п %ťÛśēѓ:%ьNT AUTHORITY\SYSTEM%п %тŠţθφ Γéдŝòη:%вЃР€ çθŋπэςŧíòⁿ ґüлδоωⁿ # CodeIntegrity: Date: 2026-10-09 20:33:44 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\DefenderSessionHelper.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2026-10-09 20:24:51 Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume3\Program Files\Google\Chrome\Application\154.0.8037.58\libLiteRtWebGpuAccelerator.dll that did not meet the Microsoft signing level requirements. ==================== Información de la memoria =========================== BIOS: AMI F.30 07/04/2023 Placa base: HP 86C8 Procesador: Intel(R) Core™ i5-1035G1 CPU @ 1.00GHz Porcentaje de memoria en uso: 63% RAM física total: 7875.77 MB RAM física disponible: 2840.89 MB Virtual total: 15865.82 MB Virtual disponible: 8177.48 MB ==================== Unidades ================================ Disk 0 - Drive c: (Windows) (Fixed) (Total:237.31 GB) (Free:71.35 GB) (Model: Intel Optane+238GBSSD) NTFS Disk 0 - \?\Volume{33263afe-45fb-41c1-bb07-c379b9a8422d}\ () (Fixed) (Total:911 MB) (Free:72.85 MB) NTFS Disk 0 - \?\Volume{63321dd4-dd50-487a-b42c-36e2caa0c985}\ (SYSTEM) (Fixed) (Total:256 MB) (Free:166.4 MB) FAT32 ==================== MBR & Tabla de particiones ==================== ============================================================ Disk: 0 (Size: 238.47 GB) (Disk ID: 96A33449) # Partitions: Partition Style : GPT Partition Count : 4 Disk ID : {227165D5-092F-4BEA-8FCC-1DFEE49EA75D} Usable Offset : 0.02 MB Usable Length : 238.47 GB Max Partitions : 128 ## Partition 1 Type : EFI System Partition Size : 260 MB Offset : 1 MB Type GUID : {C12A7328-F81F-11D2-BA4B-00A0C93EC93B} Partition GUID : {63321DD4-DD50-487A-B42C-36E2CAA0C985} GPT Name : EFI system partition Attributes : 0x8000000000000000 Attribute Flags : No Default Drive Letter Hidden : Yes Platform Required: No ## Partition 2 Type : Microsoft Reserved (MSR) Size : 16 MB Offset : 261 MB Type GUID : {E3C9E316-0B5C-4DB8-817D-F92DF00215AE} Partition GUID : {E165D88C-676E-4D25-8B6C-A3279B01FEEC} GPT Name : Microsoft reserved partition Attributes : 0x8000000000000000 Attribute Flags : No Default Drive Letter Hidden : Yes Platform Required: No ## Partition 3 Type : Basic Data Partition Size : 237.31 GB Offset : 277 MB Type GUID : {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7} Partition GUID : {C3ABD8B5-BCCB-4CCC-8181-22E68E83AB19} GPT Name : Basic data partition Attributes : 0x0000000000000000 Attribute Flags : None Hidden : No Platform Required: No ## Partition 4 Type : Windows Recovery Size : 911 MB Offset : 243278 MB Type GUID : {DE94BBA4-06D1-4D40-A16A-BFD50179D6AC} Partition GUID : {33263AFE-45FB-41C1-BB07-C379B9A8422D} Attributes : 0x8000000000000001 Attribute Flags : Platform Required, No Default Drive Letter Hidden : Yes Platform Required: Yes ============================================================ ==================== Final Addition.txt ====== ---
### Author: ![JCTecn1cal](https://forospyware.com/user_avatar/forospyware.com/jctecn1cal/32/3784_2.png) [@JCTecn1cal](https://forospyware.com/u/JCTecn1cal) #### Post date: [12 Octubre, 2026 19:52 UTC](https://forospyware.com/t/virus-dusapp-aparecio-de-repente-entre-mis-aplicaciones/36460/6 "2026-10-12T19:52:43Z")
Hola @Nashe_Xd > [@](#): > > **[¡Te damos la Bienvenida a los foros de InfoSpyware!](https://forospyware.com/t/%C2%A1bienvenidos-primeros-pasos-en-el-foro-de-infospyware/8)** > > - Como nuevo usuario [**Te pedimos que leas nuestras reglas**](https://forospyware.com/guidelines) > - Aquí tienes nuestra **[FAQ: Preguntas frecuentes, cómo utilizar el foro](https://forospyware.com/t/faq-preguntas-frecuentes-c%C3%B3mo-utilizar-el-foro/153)** para cualquier duda que tengas acerca del funcionamiento de este lugar. > > El sistema de nuestro foro se basa en méritos **Necesitas participar en el foro para conseguirlos y de esta manera podrás adjuntar archivos o subir imágenes** Por ejemplo ![capturada7](https://forospyware.com/uploads/default/original/3X/7/8/78e69942237e714051cd8917e4d965fef9b63d7f.jpeg) Tengo que aclarar algo a todos los usuarios en general: > [@](#): > > Si ustedes sospechan la presencia de malwares en sus equipos **el primer paso sería realizar todos los pasos incluyendo los opcionales de nuestra Guía básica de detección y eliminación** me refiero a esta [Guía de detección y eliminación de Malwares 2026](https://forospyware.com/t/gu%C3%ADa-de-detecci%C3%B3n-y-eliminaci%C3%B3n-de-malwares-2026/23/1) > > En caso de que sus problemas no se solucionen **el segundo paso sería abrir un tema trayendo los reportes de todas las herramientas que hayan usado lo cual incluye a los análisis que hayan realizado con sus propias suites de seguridad** para que reciban atención mas personalizada al respecto. > > FRST es una herramienta de eliminación manual de malware **que requiere supervisión constante de expertos que están facultados para interpretar sus reportes y crear scripts personalizados para eliminar el malware que afecta a un equipo en particular** Cuando se usa FRST **el tema queda a cargo de un experto y no cualquier usuario puede intervenir en el** Desafortunadamente nuestros expertos parecen estar muy ocupados con sus propias vidas y no tienen mucho tiempo para el foro, > > En resumen: **Procuren no usar FRST desde el principio (al menos que se trate del Malware Doble Tilde)** o de lo contrario **se van a tener que esperar a que un experto aparezca, lea su reportes y entonces les empiece a mandar instrucciones** lo que hace que el tema se quede “estancado” o lo pasemos por alto y se quede sin respuesta por mucho tiempo. > > **Si deciden usar FRST y publicar sus reportes les pedimos amablemente que tengan mucha paciencia** > > Muchas gracias por su atenciön