# [SOLVED] taskeng.exe keeps popping up



## Jozanne

The taskeng.exe screen keeps popping up and it's quite annoying. How do i resolve this problem? The solutions on the forum did not help in resolving my issue... do it have any other way or could you reiterate? I don't think anything was "tampered" with


----------



## Tomshawk

*Re: taskeng.exe keeps popping up*

Keeps popping up saying what?

Whats the error?
I see you are running windows 7 from your profile is it updated to all the latest Windows updates

what solution in the forum are you suggesting fixed the problem

More information please?


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

i can't see what it's saying it disappearing quickly. most of the times it's just a blank screen at least from what i have seen..


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

and only "optional updates" available


----------



## Tomshawk

*Re: taskeng.exe keeps popping up*

Lets start with, Open the event viewer and let us know if there is anything with Red Exclamation Marks (Errors)
Open Event Viewer

Again, what solution were you referring to that you said did not fix the problem?


----------



## jenae

*Re: taskeng.exe keeps popping up*

Hi, it would help if we see your startup. Go to start search and type cmd right click on the returned cmd.exe and select "run as administrator" at the prompt copy paste:-



Code:


wmic startup get Caption, Location, Command /format:list > 0 & notepad 0

 press enter. Please post the notepad outcome here.


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

Caption=Sidebar
Command=%ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
Location=HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


Caption=Sidebar
Command=%ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
Location=HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


Caption=Dropbox
Command=Dropbox.lnk
Location=Startup


Caption=Event Reminder
Command=Event Reminder.lnk
Location=Startup


Caption=Google Update
Command="C:\Users\B\AppData\Local\Google\Update\GoogleUpdate.exe" /c
Location=HKU\S-1-5-21-3419578036-40878485-3947204858-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


Caption=DAEMON Tools Lite
Command="C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
Location=HKU\S-1-5-21-3419578036-40878485-3947204858-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


Caption=RocketDock
Command="C:\Program Files\RocketDock\RocketDock.exe"
Location=HKU\S-1-5-21-3419578036-40878485-3947204858-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


Caption=uTorrent
Command="C:\Program Files\uTorrent\uTorrent.exe" /MINIMIZED
Location=HKU\S-1-5-21-3419578036-40878485-3947204858-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


Caption=msnmsgr
Command="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
Location=HKU\S-1-5-21-3419578036-40878485-3947204858-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


Caption=MyWebSearch Email Plugin
Command=C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
Location=HKU\S-1-5-21-3419578036-40878485-3947204858-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


Caption=Skype
Command="C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
Location=HKU\S-1-5-21-3419578036-40878485-3947204858-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


Caption=Pando Media Booster
Command=C:\Program Files\Pando Networks\Media Booster\PMB.exe
Location=HKU\S-1-5-21-3419578036-40878485-3947204858-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


Caption=Sidebar
Command=%ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
Location=HKU\S-1-5-21-3419578036-40878485-3947204858-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


Caption=HDAudDeck
Command=C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe -r
Location=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


Caption=Adobe ARM
Command="C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
Location=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


Caption=BCSSync
Command="C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
Location=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


Caption=
Command=
Location=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


Caption=RoxWatchTray
Command="C:\Program Files\Common Files\Roxio Shared\13.0\SharedCOM\RoxWatchTray13.exe"
Location=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


Caption=CPMonitor
Command="C:\Program Files\Roxio 2011\5.0\CPMonitor.exe"
Location=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


Caption=Desktop Disc Tool
Command="C:\Program Files\Roxio 2011\Roxio Burn\RoxioBurnLauncher.exe"
Location=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


Caption=lxdnmon.exe
Command="C:\Program Files\Lexmark 2600 Series\lxdnmon.exe"
Location=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


Caption=EzPrint
Command="C:\Program Files\Lexmark 2600 Series\ezprint.exe"
Location=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


Caption=NeroCheck
Command=C:\Windows\system32\NeroCheck.exe
Location=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


Caption=DATAMNGR
Command=C:\PROGRA~1\WIA6EB~1\Datamngr\DATAMN~1.EXE
Location=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


Caption=MSC
Command="c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
Location=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


Caption=My Web Search Bar Search Scope Monitor
Command="C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=2 /w /h
Location=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


Caption=MyWebSearch Email Plugin
Command=C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
Location=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


Caption=APSDaemon
Command="C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
Location=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


Caption=QuickTime Task
Command="C:\Program Files\QuickTime\QTTask.exe" -atboottime
Location=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


Caption=TkBellExe
Command="C:\Program Files\Real\RealPlayer\update\realsched.exe" -osboot
Location=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


Caption=iTunesHelper
Command="C:\Program Files\iTunes\iTunesHelper.exe"
Location=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


Caption=SunJavaUpdateSched
Command="C:\Program Files\Common Files\Java\Java Update\jusched.exe"
Location=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

when i go into event viewer, i don't see anything in red but in "Summary of Adminstrative events" 10 Errors in the last 24hrs and 66 in the last 7 days.. that's what it says


----------



## Tomshawk

*Re: taskeng.exe keeps popping up*

While waiting for Jenae, Start by Uninstall mywebsearch and utorrent

Both of those programs cause alot of problems


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

question: what problems do they actually cause? because i have had utorrent for example for years... my mother, however, got mywebsearch with the games she downloaded... could you enlighten me please


----------



## Tomshawk

*Re: taskeng.exe keeps popping up*

mywebsearch causes popups, annoying Malware and it slows down your internet browser.

utorrent is a good way to get infected with viruses for one thing, also alot of people use it to get illegal software, not that you are but... since we cant know what you are using it for. We cant really assist you until you uninstall it


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

ok what i'm seeing in red in the "event viewer" in errors section are a lot of:

service control manager
WMI
search
restart manager
print service
microsoft antimalware
kernel-event tracing
esent
dvd maker
distributedCOM
disk
dhcp-Client
CAP12
application error


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

ok.. well they are both already uninstalled


----------



## jenae

*Re: taskeng.exe keeps popping up*

Hi, you have a lot of startup programs that are not needed you can use Msconfig to uncheck most of what you have , not the MSE av though. You have an empty entry:-

Caption=
Command=
Location=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

This is most likely the problem , HOWEVER you really do need to post at our security forum, up to you they will discover if u torrent is still on your computer. Normally I do not respond to people who show this.
Security centre:-

http://www.techsupportforum.com/for...-posting-for-malware-removal-help-305963.html


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

i just got HOLD of the error..


----------



## Jozanne

*Re: taskeng.exe keeps popping up*



Tomshawk said:


> mywebsearch causes popups, annoying Malware and it slows down your internet browser.
> 
> utorrent is a good way to get infected with viruses for one thing, also alot of people use it to get illegal software, not that you are but... since we cant know what you are using it for. We cant really assist you until you uninstall it


hi. i just got of the error it says: c:\word.bat is not recognized as an internal or external command operable program or batch file


----------



## joeten

*Re: taskeng.exe keeps popping up*

Take the advice and get your system checked by security jenae gave you a link to the steps you need to follow, then make a new thread in the virus,trojan and malware area and post all the info you gathered there and mention anything you could not do.


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

what is mse?


----------



## joeten

*Re: taskeng.exe keeps popping up*

Microsoft Security Essentials anti virus


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

hi. i am currently in the forum of the malware trojan section.. however, it appears that my computer is clean from all malware and viruses as indicated by "amateur" one of your colleagues. i got a screen shot of what is appearing..


----------



## shawnpb

*Re: taskeng.exe keeps popping up*



Jozanne said:


> hi. i am currently in the forum of the malware trojan section.. however, it appears that my computer is clean from all malware and viruses as indicated by "amateur" one of your colleagues. i got a screen shot of what is appearing..



When does this Command Prompt Error appear? Does it appear during startup of Windows, or does it appear randomly?

Did you take the advice about going to Msconfig/Startup Tab and un-checking except essential Microsoft items?

Perhaps that word.bat is in there if so uncheck it then reboot.

Also go to Computer open the C: drive in the search bar type in Word.bat if any is found take a screen shot of it.


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

How do I go about doing that exactly? Also the pop up appears randomly


----------



## shawnpb

*Re: taskeng.exe keeps popping up*



JackBauer_24 said:


> When does this Command Prompt Error appear? Does it appear during startup of Windows, or does it appear randomly?
> 
> Did you take the advice about going to Msconfig/Startup Tab and un-checking except essential Microsoft items?
> 
> Perhaps that word.bat is in there if so uncheck it then reboot.
> 
> Also go to Computer open the C: drive in the search bar type in Word.bat if any is found take a screen shot of it.



Click on the Msconfig link I provided.


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

Ok I will check it out later in the morning,


----------



## jenae

*Re: taskeng.exe keeps popping up*

Hi, back in post #6 you were shown how to open a cmd prompt as admin, please do so again, at the prompt copy paste:-





Code:


dir /s /a /x "c:\Windows\Tasks*.*" > 0 & notepad 0

 press enter, please copy paste the notepad outcome here, be patient this will take awhile to run.


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

when i input it just as u did, (with the spaces) it says:

volume in drive C has no label
Volume Serial Number is D4F4-F601


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

i also did the msconfig thing and there were no different results


----------



## shawnpb

*Re: taskeng.exe keeps popping up*



Jozanne said:


> when i input it just as u did, (with the spaces) it says:
> 
> volume in drive C has no label
> Volume Serial Number is D4F4-F601



You did not post all of the outcome of the notepad file. There should of opened a notepad file when the operation was completed. Copy and paste all the contents inside the notepad here.

Should look something like this....



Code:


Volume in drive C has no label.
 Volume Serial Number is 8CB0-8AEF

 Directory of c:\Windows

06/07/2013  09:12 PM    <DIR>                       Tasks
               0 File(s)              0 bytes

 Directory of c:\Windows\assembly\GAC_MSIL

07/13/2009  11:20 PM    <DIR>          TASKSC~1     TaskScheduler
07/14/2009  01:37 AM    <DIR>          TASKSC~1.RES TaskScheduler.Resources
               0 File(s)              0 bytes

 Directory of c:\Windows\assembly\GAC_MSIL\TaskScheduler\6.1.0.0__31bf3856ad364e35

11/20/2010  04:36 AM           167,936              TaskScheduler.dll
               1 File(s)        167,936 bytes

 Directory of c:\Windows\assembly\GAC_MSIL\TaskScheduler.Resources\6.1.0.0_en_31bf3856ad364e35

07/13/2009  10:12 PM             7,168              TaskScheduler.resources.dll
               1 File(s)          7,168 bytes

 Directory of c:\Windows\assembly\NativeImages_v2.0.50727_32

06/10/2013  11:03 AM    <DIR>          TASKSC~1     TaskScheduler
               0 File(s)              0 bytes

 Directory of c:\Windows\assembly\NativeImages_v2.0.50727_32\TaskScheduler\2048cb6f31cef240893e6e390b0c70a9

06/10/2013  11:03 AM           245,248 TASKSC~1.DLL TaskScheduler.ni.dll
               1 File(s)        245,248 bytes

 Directory of c:\Windows\assembly\NativeImages_v2.0.50727_64

06/10/2013  11:01 AM    <DIR>          TASKSC~1     TaskScheduler
               0 File(s)              0 bytes

 Directory of c:\Windows\assembly\NativeImages_v2.0.50727_64\TaskScheduler\0fdceeed3e5cf3a193b8c49ad80f8931

06/10/2013  11:01 AM           304,128 TASKSC~1.DLL TaskScheduler.ni.dll
               1 File(s)        304,128 bytes

 Directory of c:\Windows\Help\mui\0409

06/10/2009  05:54 PM            64,597              taskscheduler.CHM
               1 File(s)         64,597 bytes

 Directory of c:\Windows\PolicyDefinitions

06/10/2009  04:58 PM             5,520              TaskScheduler.admx
               1 File(s)          5,520 bytes

 Directory of c:\Windows\PolicyDefinitions\en-US

07/13/2009  10:24 PM             7,038              TaskScheduler.adml
               1 File(s)          7,038 bytes

 Directory of c:\Windows\System32

06/08/2013  02:32 PM    <DIR>                       Tasks
11/20/2010  05:27 AM         1,197,056              taskschd.dll
06/10/2009  04:58 PM           145,059              taskschd.msc
07/13/2009  09:41 PM            55,296              TaskSchdPS.dll
               3 File(s)      1,397,411 bytes

 Directory of c:\Windows\System32\en-US

07/13/2009  10:25 PM             2,560              taskschd.dll.mui
07/13/2009  10:26 PM           145,059              taskschd.msc
               2 File(s)        147,619 bytes

 Directory of c:\Windows\SysWOW64

07/13/2009  11:20 PM    <DIR>                       Tasks
11/20/2010  04:21 AM           505,856              taskschd.dll
06/10/2009  05:38 PM           145,059              taskschd.msc
07/13/2009  09:16 PM            36,864              TaskSchdPS.dll
               3 File(s)        687,779 bytes

 Directory of c:\Windows\SysWOW64\en-US

07/13/2009  10:02 PM             2,560              taskschd.dll.mui
07/13/2009  10:04 PM           145,059              taskschd.msc
               2 File(s)        147,619 bytes

 Directory of  c:\Windows\winsxs\amd64_microsoft-windows-dxp-deviceexperience_31bf3856ad364e35_6.1.7601.17514_none_a54b31331066c8e2

06/10/2009  05:00 PM            13,427              tasks.xml
               1 File(s)         13,427 bytes

 Directory of c:\Windows\winsxs\amd64_microsoft-windows-printing-fdprint_31bf3856ad364e35_6.1.7600.16385_none_b425025e9ef3d84c

06/10/2009  05:02 PM            11,364              tasks.xml
               1 File(s)         11,364 bytes

 Directory of  c:\Windows\winsxs\amd64_microsoft-windows-t..cheduler-apis-proxy_31bf3856ad364e35_6.1.7600.16385_none_31a8e7113546f43e

07/13/2009  09:41 PM            55,296 TASKSC~1.DLL TaskSchdPS.dll
               1 File(s)         55,296 bytes

 Directory of  c:\Windows\winsxs\amd64_microsoft-windows-t..duler-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_3a346b361b962de3

07/13/2009  10:24 PM             7,038 TASKSC~1.ADM TaskScheduler.adml
               1 File(s)          7,038 bytes

 Directory of  c:\Windows\winsxs\amd64_microsoft-windows-t..er-client.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1bf121eae88b9918

07/13/2009  10:25 PM             2,560 TASKSC~1.MUI taskschd.dll.mui
               1 File(s)          2,560 bytes

 Directory of c:\Windows\winsxs\amd64_microsoft-windows-taskscheduler-adm_31bf3856ad364e35_6.1.7600.16385_none_074719bfd9d616de

06/10/2009  04:58 PM             5,520 TASKSC~1.ADM TaskScheduler.admx
               1 File(s)          5,520 bytes

 Directory of  c:\Windows\winsxs\amd64_microsoft-windows-taskscheduler-client_31bf3856ad364e35_6.1.7601.17514_none_a2204d83b4ef6bd1

11/20/2010  05:27 AM         1,197,056              taskschd.dll
               1 File(s)      1,197,056 bytes

 Directory of  c:\Windows\winsxs\amd64_server-help-chm.tas..eduler_lh.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c5e1a6b84df8c850

06/10/2009  05:54 PM            64,597 TASKSC~1.CHM taskscheduler.CHM
               1 File(s)         64,597 bytes

 Directory of c:\Windows\winsxs\amd64_taskschedulersettings.resources_31bf3856ad364e35_6.1.7600.16385_en-us_4f61fcad4768c9b8

07/13/2009  10:26 PM           145,059              taskschd.msc
               1 File(s)        145,059 bytes

 Directory of c:\Windows\winsxs\amd64_taskschedulersettings_31bf3856ad364e35_6.1.7600.16385_none_a6dff5711e0deb2d

06/10/2009  04:58 PM           145,059              taskschd.msc
               1 File(s)        145,059 bytes

 Directory of c:\Windows\winsxs\msil_taskscheduler.resources_31bf3856ad364e35_6.1.7600.16385_en-us_21df7e00fbf2db0a

07/13/2009  10:12 PM             7,168 TASKSC~1.DLL TaskScheduler.resources.dll
               1 File(s)          7,168 bytes

 Directory of c:\Windows\winsxs\msil_taskscheduler_31bf3856ad364e35_6.1.7601.17514_none_170487c39d98ec89

11/20/2010  04:36 AM           167,936 TASKSC~1.DLL TaskScheduler.dll
               1 File(s)        167,936 bytes

 Directory of c:\Windows\winsxs\wow64_taskschedulersettings_31bf3856ad364e35_6.1.7600.16385_none_b1349fc3526ead28

06/10/2009  05:38 PM           145,059              taskschd.msc
               1 File(s)        145,059 bytes

 Directory of  c:\Windows\winsxs\x86_microsoft-windows-t..cheduler-apis-proxy_31bf3856ad364e35_6.1.7600.16385_none_d58a4b8d7ce98308

07/13/2009  09:16 PM            36,864 TASKSC~1.DLL TaskSchdPS.dll
               1 File(s)         36,864 bytes

 Directory of  c:\Windows\winsxs\x86_microsoft-windows-t..er-client.resources_31bf3856ad364e35_6.1.7600.16385_en-us_bfd28667302e27e2

07/13/2009  10:02 PM             2,560 TASKSC~1.MUI taskschd.dll.mui
               1 File(s)          2,560 bytes

 Directory of c:\Windows\winsxs\x86_microsoft-windows-taskscheduler-client_31bf3856ad364e35_6.1.7601.17514_none_4601b1fffc91fa9b

11/20/2010  04:21 AM           505,856              taskschd.dll
               1 File(s)        505,856 bytes

 Directory of c:\Windows\winsxs\x86_taskschedulersettings.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f34361298f0b5882

07/13/2009  10:04 PM           145,059              taskschd.msc
               1 File(s)        145,059 bytes

     Total Files Listed:
              34 File(s)      5,839,541 bytes
               7 Dir(s)  214,327,996,416 bytes free


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

ok let me do it over, because nothing came up


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

blank notepad came up


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

ok so after several tries.. it did not come up in notepad but i just copied it and paste it from the cmd...




Directory of c:\Windows\Help\mui\0412

06/08/2009 10:39 AM 70,858 taskscheduler.CHM
1 File(s) 70,858 bytes

Directory of c:\Windows\Help\mui\0413

06/08/2009 10:41 AM 68,542 taskscheduler.CHM
1 File(s) 68,542 bytes

Directory of c:\Windows\Help\mui\0414

06/10/2009 08:54 PM 67,045 taskscheduler.CHM
1 File(s) 67,045 bytes

Directory of c:\Windows\Help\mui\0415

06/15/2009 07:03 PM 72,706 taskscheduler.CHM
1 File(s) 72,706 bytes

Directory of c:\Windows\Help\mui\0416

06/08/2009 10:40 AM 70,279 taskscheduler.CHM
1 File(s) 70,279 bytes

Directory of c:\Windows\Help\mui\0419

06/15/2009 07:04 PM 70,078 taskscheduler.CHM
1 File(s) 70,078 bytes

Directory of c:\Windows\Help\mui\041F

06/08/2009 10:43 AM 69,200 taskscheduler.CHM
1 File(s) 69,200 bytes

Directory of c:\Windows\Help\mui\0804

06/08/2009 10:39 AM 68,653 taskscheduler.CHM
1 File(s) 68,653 bytes

Directory of c:\Windows\Help\mui\0816

06/12/2009 09:16 PM 69,587 taskscheduler.CHM
1 File(s) 69,587 bytes

Directory of c:\Windows\Help\mui\0C0A

06/08/2009 10:40 AM 70,074 taskscheduler.CHM
1 File(s) 70,074 bytes

Directory of c:\Windows\PolicyDefinitions

06/10/2009 05:38 PM 5,520 TaskScheduler.admx
1 File(s) 5,520 bytes

Directory of c:\Windows\PolicyDefinitions\ar-SA

07/13/2009 06:43 PM 10,525 TaskScheduler.adml
1 File(s) 10,525 bytes

Directory of c:\Windows\PolicyDefinitions\cs-CZ

07/13/2009 06:45 PM 7,899 TaskScheduler.adml
1 File(s) 7,899 bytes

Directory of c:\Windows\PolicyDefinitions\da-DK

07/13/2009 06:37 PM 7,473 TaskScheduler.adml
1 File(s) 7,473 bytes

Directory of c:\Windows\PolicyDefinitions\de-DE

07/13/2009 06:47 PM 8,552 TaskScheduler.adml
1 File(s) 8,552 bytes

Directory of c:\Windows\PolicyDefinitions\el-GR

07/13/2009 06:36 PM 15,700 TaskScheduler.adml
1 File(s) 15,700 bytes

Directory of c:\Windows\PolicyDefinitions\en-US

11/20/2010 08:38 PM 7,038 TaskScheduler.adml
1 File(s) 7,038 bytes

Directory of c:\Windows\PolicyDefinitions\es-ES

07/13/2009 06:39 PM 8,195 TaskScheduler.adml
1 File(s) 8,195 bytes

Directory of c:\Windows\PolicyDefinitions\fi-FI

07/13/2009 06:35 PM 7,763 TaskScheduler.adml
1 File(s) 7,763 bytes

Directory of c:\Windows\PolicyDefinitions\fr-FR

07/13/2009 06:46 PM 9,096 TaskScheduler.adml
1 File(s) 9,096 bytes

Directory of c:\Windows\PolicyDefinitions\he-IL

07/13/2009 06:35 PM 10,046 TaskScheduler.adml
1 File(s) 10,046 bytes

Directory of c:\Windows\PolicyDefinitions\hu-HU

07/13/2009 06:40 PM 9,287 TaskScheduler.adml
1 File(s) 9,287 bytes

Directory of c:\Windows\PolicyDefinitions\it-IT

07/13/2009 06:39 PM 8,365 TaskScheduler.adml
1 File(s) 8,365 bytes

Directory of c:\Windows\PolicyDefinitions\ja-JP

07/13/2009 08:34 PM 9,831 TaskScheduler.adml
1 File(s) 9,831 bytes

Directory of c:\Windows\PolicyDefinitions\ko-KR

07/13/2009 07:59 PM 8,049 TaskScheduler.adml
1 File(s) 8,049 bytes

Directory of c:\Windows\PolicyDefinitions\nb-NO

07/13/2009 06:36 PM 7,590 TaskScheduler.adml
1 File(s) 7,590 bytes

Directory of c:\Windows\PolicyDefinitions\nl-NL

07/13/2009 06:41 PM 8,364 TaskScheduler.adml
1 File(s) 8,364 bytes

Directory of c:\Windows\PolicyDefinitions\pl-PL

07/13/2009 06:41 PM 8,419 TaskScheduler.adml
1 File(s) 8,419 bytes

Directory of c:\Windows\PolicyDefinitions\pt-BR

07/13/2009 06:50 PM 8,258 TaskScheduler.adml
1 File(s) 8,258 bytes

Directory of c:\Windows\PolicyDefinitions\pt-PT

07/13/2009 06:47 PM 8,485 TaskScheduler.adml
1 File(s) 8,485 bytes

Directory of c:\Windows\PolicyDefinitions\ru-RU

07/13/2009 06:46 PM 13,700 TaskScheduler.adml
1 File(s) 13,700 bytes

Directory of c:\Windows\PolicyDefinitions\tr-TR

07/13/2009 06:49 PM 8,214 TaskScheduler.adml
1 File(s) 8,214 bytes

Directory of c:\Windows\PolicyDefinitions\zh-CN

07/13/2009 07:59 PM 6,430 TaskScheduler.adml
1 File(s) 6,430 bytes

Directory of c:\Windows\PolicyDefinitions\zh-TW

07/13/2009 07:52 PM 7,013 TaskScheduler.adml
1 File(s) 7,013 bytes

Directory of c:\Windows\System32

06/05/2013 04:28 PM <DIR> Tasks
11/20/2010 05:29 PM 505,856 taskschd.dll
06/10/2009 05:38 PM 145,059 taskschd.msc
07/13/2009 09:16 PM 36,864 TaskSchdPS.dll
3 File(s) 687,779 bytes

Directory of c:\Windows\System32\ar-SA

07/13/2009 06:33 PM 145,109 taskschd.msc
1 File(s) 145,109 bytes

Directory of c:\Windows\System32\cs-CZ

07/13/2009 06:37 PM 145,091 taskschd.msc
1 File(s) 145,091 bytes

Directory of c:\Windows\System32\da-DK

07/13/2009 06:34 PM 145,059 taskschd.msc
1 File(s) 145,059 bytes

Directory of c:\Windows\System32\de-DE

07/13/2009 06:40 PM 2,560 taskschd.dll.mui
07/13/2009 06:37 PM 145,061 taskschd.msc
2 File(s) 147,621 bytes

Directory of c:\Windows\System32\el-GR

07/13/2009 06:33 PM 145,149 taskschd.msc
1 File(s) 145,149 bytes

Directory of c:\Windows\System32\en-US

11/20/2010 08:38 PM 2,560 taskschd.dll.mui
11/20/2010 08:38 PM 145,059 taskschd.msc
2 File(s) 147,619 bytes

Directory of c:\Windows\System32\es-ES

07/13/2009 06:39 PM 2,560 taskschd.dll.mui
07/13/2009 06:37 PM 145,078 taskschd.msc
2 File(s) 147,638 bytes

Directory of c:\Windows\System32\fi-FI

07/13/2009 06:41 PM 145,071 taskschd.msc
1 File(s) 145,071 bytes

Directory of c:\Windows\System32\fr-FR

07/13/2009 06:47 PM 2,560 taskschd.dll.mui
07/13/2009 06:37 PM 145,084 taskschd.msc
2 File(s) 147,644 bytes

Directory of c:\Windows\System32\he-IL

07/13/2009 06:33 PM 145,095 taskschd.msc
1 File(s) 145,095 bytes

Directory of c:\Windows\System32\hu-HU

07/13/2009 06:45 PM 145,069 taskschd.msc
1 File(s) 145,069 bytes

Directory of c:\Windows\System32\it-IT

07/13/2009 06:39 PM 2,560 taskschd.dll.mui
07/13/2009 06:37 PM 145,086 taskschd.msc
2 File(s) 147,646 bytes

Directory of c:\Windows\System32\ja-JP

07/13/2009 08:34 PM 2,560 taskschd.dll.mui
07/13/2009 08:16 PM 145,112 taskschd.msc
2 File(s) 147,672 bytes

Directory of c:\Windows\System32\ko-KR

07/13/2009 07:51 PM 145,072 taskschd.msc
1 File(s) 145,072 bytes

Directory of c:\Windows\System32\nb-NO

07/13/2009 06:34 PM 145,065 taskschd.msc
1 File(s) 145,065 bytes

Directory of c:\Windows\System32\nl-NL

07/13/2009 06:50 PM 2,560 taskschd.dll.mui
07/13/2009 06:47 PM 145,054 taskschd.msc
2 File(s) 147,614 bytes

Directory of c:\Windows\System32\pl-PL

07/13/2009 06:39 PM 145,079 taskschd.msc
1 File(s) 145,079 bytes

Directory of c:\Windows\System32\pt-BR

07/13/2009 06:47 PM 145,074 taskschd.msc
1 File(s) 145,074 bytes

Directory of c:\Windows\System32\pt-PT

07/13/2009 06:45 PM 145,077 taskschd.msc
1 File(s) 145,077 bytes

Directory of c:\Windows\System32\ru-RU

07/13/2009 06:44 PM 145,141 taskschd.msc
1 File(s) 145,141 bytes

Directory of c:\Windows\System32\tr-TR

07/13/2009 06:39 PM 145,085 taskschd.msc
1 File(s) 145,085 bytes

Directory of c:\Windows\System32\zh-CN

07/13/2009 07:50 PM 145,072 taskschd.msc
1 File(s) 145,072 bytes

Directory of c:\Windows\System32\zh-TW

07/13/2009 07:51 PM 145,070 taskschd.msc
1 File(s) 145,070 bytes


----------



## shawnpb

*Re: taskeng.exe keeps popping up*

Wait for Janae to come back to analise your current post.


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

the notepad one just popped up..


Volume in drive C has no label.
Volume Serial Number is D4F4-F601

Directory of c:\Windows

05/18/2013 03:21 PM <DIR> Tasks
0 File(s) 0 bytes

Directory of c:\Windows\assembly\GAC_MSIL

07/13/2009 10:37 PM <DIR> TASKSC~1 TaskScheduler
10/11/2012 02:52 PM <DIR> TASKSC~1.RES TaskScheduler.Resources
0 File(s) 0 bytes

Directory of c:\Windows\assembly\GAC_MSIL\TaskScheduler\6.1.0.0__31bf3856ad364e35

11/20/2010 05:29 PM 167,936 TaskScheduler.dll
1 File(s) 167,936 bytes

Directory of c:\Windows\assembly\GAC_MSIL\TaskScheduler.Resources\6.1.0.0_ar_31bf3856ad364e35

11/20/2010 04:55 AM 7,680 TaskScheduler.resources.dll
1 File(s) 7,680 bytes

Directory of c:\Windows\assembly\GAC_MSIL\TaskScheduler.Resources\6.1.0.0_cs_31bf3856ad364e35

07/13/2009 06:49 PM 7,168 TaskScheduler.resources.dll
1 File(s) 7,168 bytes

Directory of c:\Windows\assembly\GAC_MSIL\TaskScheduler.Resources\6.1.0.0_da_31bf3856ad364e35

07/13/2009 06:48 PM 7,680 TaskScheduler.resources.dll
1 File(s)  7,680 bytes

Directory of c:\Windows\assembly\GAC_MSIL\TaskScheduler.Resources\6.1.0.0_de_31bf3856ad364e35

07/13/2009 06:51 PM 7,168 TaskScheduler.resources.dll
1 File(s) 7,168 bytes

Directory of c:\Windows\assembly\GAC_MSIL\TaskScheduler.Resources\6.1.0.0_el_31bf3856ad364e35

07/13/2009 06:47 PM 9,216 TaskScheduler.resources.dll
1 File(s) 9,216 bytes

Directory of c:\Windows\assembly\GAC_MSIL\TaskScheduler.Resources\6.1.0.0_en_31bf3856ad364e35

11/20/2010 08:38 PM 7,168 TaskScheduler.resources.dll
1 File(s) 7,168 bytes

Directory of c:\Windows\assembly\GAC_MSIL\TaskScheduler.Resources\6.1.0.0_es_31bf3856ad364e35

11/20/2010 04:17 AM 7,680 TaskScheduler.resources.dll
1 File(s) 7,680 bytes

Directory of c:\Windows\assembly\GAC_MSIL\TaskScheduler.Resources\6.1.0.0_fi_31bf3856ad364e35

11/20/2010 04:54 AM 7,680 TaskScheduler.resources.dll
1 File(s) 7,680 bytes

Directory of c:\Windows\assembly\GAC_MSIL\TaskScheduler.Resources\6.1.0.0_fr_31bf3856ad364e35

07/13/2009 06:51 PM 7,680 TaskScheduler.resources.dll
1 File(s) 7,680 bytes

Directory of c:\Windows\assembly\GAC_MSIL\TaskScheduler.Resources\6.1.0.0_he_31bf3856ad364e35

11/20/2010 04:54 AM 7,680 TaskScheduler.resources.dll
1 File(s) 7,680 bytes

Directory of c:\Windows\assembly\GAC_MSIL\TaskScheduler.Resources\6.1.0.0_hu_31bf3856ad364e35

07/13/2009 06:50 PM 7,168 TaskScheduler.resources.dll
1 File(s) 7,168 bytes

Directory of c:\Windows\assembly\GAC_MSIL\TaskScheduler.Resources\6.1.0.0_it_31bf3856ad364e35

11/20/2010 04:59 AM 7,680 TaskScheduler.resources.dll
1 File(s) 7,680 bytes

Directory of c:\Windows\assembly\GAC_MSIL\TaskScheduler.Resources\6.1.0.0_ja_31bf3856ad364e35

11/20/2010 04:14 AM 7,680 TaskScheduler.resources.dll
1 File(s) 7,680 bytes

Directory of c:\Windows\assembly\GAC_MSIL\TaskScheduler.Resources\6.1.0.0_ko_31bf3856ad364e35

11/20/2010 05:47 AM 7,168 TaskScheduler.resources.dll
1 File(s) 7,168 bytes

Directory of c:\Windows\assembly\GAC_MSIL\TaskScheduler.Resources\6.1.0.0_nl_31bf3856ad364e35

07/13/2009 06:53 PM 7,168 TaskScheduler.resources.dll
1 File(s) 7,168 bytes

Directory of c:\Windows\assembly\GAC_MSIL\TaskScheduler.Resources\6.1.0.0_no_31bf3856ad364e35

07/13/2009 06:49 PM 7,168 TaskScheduler.resources.dll
1 File(s) 7,168 bytes

Directory of c:\Windows\assembly\GAC_MSIL\TaskScheduler.Resources\6.1.0.0_pl_31bf3856ad364e35

11/20/2010 05:00 AM 7,680 TaskScheduler.resources.dll
1 File(s) 7,680 bytes

Directory of c:\Windows\assembly\GAC_MSIL\TaskScheduler.Resources\6.1.0.0_pt-BR_31bf3856ad364e35

11/20/2010 05:02 AM 7,680 TaskScheduler.resources.dll
1 File(s) 7,680 bytes

Directory of c:\Windows\assembly\GAC_MSIL\TaskScheduler.Resources\6.1.0.0_pt_31bf3856ad364e35

07/13/2009 06:50 PM 7,680 TaskScheduler.resources.dll
1 File(s) 7,680 bytes

Directory of c:\Windows\assembly\GAC_MSIL\TaskScheduler.Resources\6.1.0.0_ru_31bf3856ad364e35

07/13/2009 06:52 PM 8,192 TaskScheduler.resources.dll
1 File(s) 8,192 bytes

Directory of c:\Windows\assembly\GAC_MSIL\TaskScheduler.Resources\6.1.0.0_tr_31bf3856ad364e35

07/13/2009 06:53 PM 7,168 TaskScheduler.resources.dll
1 File(s) 7,168 bytes

Directory of c:\Windows\assembly\GAC_MSIL\TaskScheduler.Resources\6.1.0.0_zh-CHS_31bf3856ad364e35

07/13/2009 08:03 PM 7,168 TaskScheduler.resources.dll
1 File(s) 7,168 bytes

Directory of c:\Windows\assembly\GAC_MSIL\TaskScheduler.Resources\6.1.0.0_zh-CHT_31bf3856ad364e35

07/13/2009 08:04 PM 7,168 TaskScheduler.resources.dll
1 File(s) 7,168 bytes

Directory of c:\Windows\assembly\NativeImages_v2.0.50727_32

02/17/2013 09:42 AM <DIR> TASKSC~1 TaskScheduler
0 File(s) 0 bytes

Directory of c:\Windows\assembly\NativeImages_v2.0.50727_32\TaskScheduler\2048cb6f31cef240893e6e390b0c70a9

02/17/2013 09:42 AM 245,248 TASKSC~1.DLL TaskScheduler.ni.dll
1 File(s) 245,248 bytes

Directory of c:\Windows\Help\mui\0401

06/08/2009 10:38 AM 69,191 taskscheduler.CHM
1 File(s) 69,191 bytes

Directory of c:\Windows\Help\mui\0404

06/19/2009 07:03 PM 68,692 taskscheduler.CHM
1 File(s) 68,692 bytes

Directory of c:\Windows\Help\mui\0405

06/08/2009 10:40 AM 72,172 taskscheduler.CHM
1 File(s) 72,172 bytes

Directory of c:\Windows\Help\mui\0406

06/08/2009 10:39 AM 67,512 taskscheduler.CHM
1 File(s) 67,512 bytes

Directory of c:\Windows\Help\mui\0407

06/15/2009 07:03 PM 70,576 taskscheduler.CHM
1 File(s) 70,576 bytes

Directory of c:\Windows\Help\mui\0408

06/08/2009 10:48 AM 74,052 taskscheduler.CHM
1 File(s) 74,052 bytes

Directory of c:\Windows\Help\mui\0409

11/20/2010 08:38 PM 64,597 taskscheduler.CHM
1 File(s) 64,597 bytes

Directory of c:\Windows\Help\mui\040B

06/15/2009 07:04 PM 68,966 taskscheduler.CHM
1 File(s) 68,966 bytes

Directory of c:\Windows\Help\mui\040C

06/08/2009 10:39 AM 71,794 taskscheduler.CHM
1 File(s) 71,794 bytes

Directory of c:\Windows\Help\mui\040D

06/19/2009 07:02 PM 67,278 taskscheduler.CHM
1 File(s) 67,278 bytes

Directory of c:\Windows\Help\mui\040E

06/12/2009 09:17 PM 73,337 taskscheduler.CHM
1 File(s) 73,337 bytes

Directory of c:\Windows\Help\mui\0410

06/15/2009 07:04 PM 69,392 taskscheduler.CHM
1 File(s) 69,392 bytes

Directory of c:\Windows\Help\mui\0411

06/15/2009 07:04 PM 82,581 taskscheduler.CHM
1 File(s) 82,581 bytes

Directory of c:\Windows\Help\mui\0412

06/08/2009 10:39 AM 70,858 taskscheduler.CHM
1 File(s) 70,858 bytes

Directory of c:\Windows\Help\mui\0413

06/08/2009 10:41 AM 68,542 taskscheduler.CHM
1 File(s) 68,542 bytes

Directory of c:\Windows\Help\mui\0414

06/10/2009 08:54 PM 67,045 taskscheduler.CHM
1 File(s) 67,045 bytes

Directory of c:\Windows\Help\mui\0415

06/15/2009 07:03 PM 72,706 taskscheduler.CHM
1 File(s) 72,706 bytes

Directory of c:\Windows\Help\mui\0416

06/08/2009 10:40 AM 70,279 taskscheduler.CHM
1 File(s) 70,279 bytes

Directory of c:\Windows\Help\mui\0419

06/15/2009 07:04 PM 70,078 taskscheduler.CHM
1 File(s) 70,078 bytes

Directory of c:\Windows\Help\mui\041F

06/08/2009 10:43 AM 69,200 taskscheduler.CHM
1 File(s) 69,200 bytes

Directory of c:\Windows\Help\mui\0804

06/08/2009 10:39 AM 68,653 taskscheduler.CHM
1 File(s) 68,653 bytes

Directory of c:\Windows\Help\mui\0816

06/12/2009 09:16 PM 69,587 taskscheduler.CHM
1 File(s) 69,587 bytes

Directory of c:\Windows\Help\mui\0C0A

06/08/2009 10:40 AM 70,074 taskscheduler.CHM
1 File(s) 70,074 bytes

Directory of c:\Windows\PolicyDefinitions

06/10/2009 05:38 PM 5,520 TaskScheduler.admx
1 File(s) 5,520 bytes

Directory of c:\Windows\PolicyDefinitions\ar-SA

07/13/2009 06:43 PM 10,525 TaskScheduler.adml
1 File(s) 10,525 bytes

Directory of c:\Windows\PolicyDefinitions\cs-CZ

07/13/2009 06:45 PM 7,899 TaskScheduler.adml
1 File(s) 7,899 bytes

Directory of c:\Windows\PolicyDefinitions\da-DK

07/13/2009 06:37 PM 7,473 TaskScheduler.adml
1 File(s) 7,473 bytes

Directory of c:\Windows\PolicyDefinitions\de-DE

07/13/2009 06:47 PM 8,552 TaskScheduler.adml
1 File(s) 8,552 bytes

Directory of c:\Windows\PolicyDefinitions\el-GR

07/13/2009 06:36 PM 15,700 TaskScheduler.adml
1 File(s) 15,700 bytes

Directory of c:\Windows\PolicyDefinitions\en-US

11/20/2010 08:38 PM 7,038 TaskScheduler.adml
1 File(s) 7,038 bytes

Directory of c:\Windows\PolicyDefinitions\es-ES

07/13/2009 06:39 PM 8,195 TaskScheduler.adml
1 File(s) 8,195 bytes

Directory of c:\Windows\PolicyDefinitions\fi-FI

07/13/2009 06:35 PM 7,763 TaskScheduler.adml
1 File(s) 7,763 bytes

Directory of c:\Windows\PolicyDefinitions\fr-FR

07/13/2009 06:46 PM 9,096 TaskScheduler.adml
1 File(s) 9,096 bytes

Directory of c:\Windows\PolicyDefinitions\he-IL

07/13/2009 06:35 PM 10,046 TaskScheduler.adml
1 File(s) 10,046 bytes

Directory of c:\Windows\PolicyDefinitions\hu-HU

07/13/2009 06:40 PM 9,287 TaskScheduler.adml
1 File(s) 9,287 bytes

Directory of c:\Windows\PolicyDefinitions\it-IT

07/13/2009 06:39 PM 8,365 TaskScheduler.adml
1 File(s) 8,365 bytes

Directory of c:\Windows\PolicyDefinitions\ja-JP

07/13/2009 08:34 PM 9,831 TaskScheduler.adml
1 File(s) 9,831 bytes

Directory of c:\Windows\PolicyDefinitions\ko-KR

07/13/2009 07:59 PM 8,049 TaskScheduler.adml
1 File(s) 8,049 bytes

Directory of c:\Windows\PolicyDefinitions\nb-NO

07/13/2009 06:36 PM 7,590 TaskScheduler.adml
1 File(s) 7,590 bytes

Directory of c:\Windows\PolicyDefinitions\nl-NL

07/13/2009 06:41 PM 8,364 TaskScheduler.adml
1 File(s) 8,364 bytes

Directory of c:\Windows\PolicyDefinitions\pl-PL

07/13/2009 06:41 PM 8,419 TaskScheduler.adml
1 File(s) 8,419 bytes

Directory of c:\Windows\PolicyDefinitions\pt-BR

07/13/2009 06:50 PM 8,258 TaskScheduler.adml
1 File(s) 8,258 bytes

Directory of c:\Windows\PolicyDefinitions\pt-PT

07/13/2009 06:47 PM 8,485 TaskScheduler.adml
1 File(s) 8,485 bytes

Directory of c:\Windows\PolicyDefinitions\ru-RU

07/13/2009 06:46 PM 13,700 TaskScheduler.adml
1 File(s) 13,700 bytes

Directory of c:\Windows\PolicyDefinitions\tr-TR

07/13/2009 06:49 PM 8,214 TaskScheduler.adml
1 File(s) 8,214 bytes

Directory of c:\Windows\PolicyDefinitions\zh-CN

07/13/2009 07:59 PM 6,430 TaskScheduler.adml
1 File(s) 6,430 bytes

Directory of c:\Windows\PolicyDefinitions\zh-TW

07/13/2009 07:52 PM 7,013 TaskScheduler.adml
1 File(s) 7,013 bytes

Directory of c:\Windows\System32

06/05/2013 04:28 PM <DIR> Tasks
11/20/2010 05:29 PM 505,856 taskschd.dll
06/10/2009 05:38 PM 145,059 taskschd.msc
07/13/2009 09:16 PM 36,864 TaskSchdPS.dll
3 File(s) 687,779 bytes

Directory of c:\Windows\System32\ar-SA

07/13/2009 06:33 PM 145,109 taskschd.msc
1 File(s) 145,109 bytes

Directory of c:\Windows\System32\cs-CZ

07/13/2009 06:37 PM 145,091 taskschd.msc
1 File(s) 145,091 bytes

Directory of c:\Windows\System32\da-DK

07/13/2009 06:34 PM 145,059 taskschd.msc
1 File(s) 145,059 bytes

Directory of c:\Windows\System32\de-DE

07/13/2009 06:40 PM 2,560 taskschd.dll.mui
07/13/2009 06:37 PM 145,061 taskschd.msc
2 File(s) 147,621 bytes


----------



## jenae

*Re: taskeng.exe keeps popping up*

Hi, when you run a cmd and you see a flashing underscore cursor, this means the system is still working. I did say this takes awhile, when finished the normal prompt will reappear. What you posted was a bit of a mess (should have looked like jack's sample) anyway I went through it and can find no sign of the errant entry.

So lets run a vbs file which shows all startup items. Run the attached .zip file and double click on the returned .vbs file (run on local computer, be patient and wait till it finishes) You can read it in notepad. Press ctrl + f a find box will open in notepad, you can try .bat or word.bat. Post a copy here for us to have a look through.

View attachment silent.zip


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

i think this is it??

ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\B\AppData\Roaming
asl.log=Destination=file
BURN_AUTOPLAY=C:\Program Files\Roxio 2011\Roxio Burn\
CLASSPATH=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=B-PC
ComSpec=C:\Windows\system32\cmd.exe
EMC_AUTOPLAY=C:\Program Files\Common Files\Roxio Shared\
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\B
LOCALAPPDATA=C:\Users\B\AppData\Local
LOGONSERVER=\\B-PC
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\Windows\system32;C:\Windows;C:\Windows\system32\wbem;C:\Program Files\Common Files\Microsoft Shared\Windows Live;C:\Program Files\NVIDIA Corporation\PhysX\Common;C:\Windows\System32\WindowsPowerShell\v1.0;C:\Program Files\Windows Live\Shared;C:\Program Files\Common Files\Roxio Shared\DLLShared;C:\Program Files\Common Files\Roxio Shared\13.0\DLLShared;C:\Program Files\QuickTime\QTSystem
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 16 Model 6 Stepping 3, AuthenticAMD
PROCESSOR_LEVEL=16
PROCESSOR_REVISION=0603
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files
PROMPT=$P$G
PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\
PUBLIC=C:\Users\Public
QTJAVA=C:\Program Files\Java\jre6\lib\ext\QTJava.zip
RCAUTOPLAY=C:\Program Files\Roxio 2011\Roxio Central\
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\B\AppData\Local\Temp
TMP=C:\Users\B\AppData\Local\Temp
USERDOMAIN=B-PC
USERNAME=B
USERPROFILE=C:\Users\B
windir=C:\Windows
windows_tracing_flags=3
windows_tracing_logfile=C:\BVTBin\Tests\installpackage\csilogfile.log


----------



## Jozanne

*Re: taskeng.exe keeps popping up*



Jozanne said:


> i think this is it??
> 
> ALLUSERSPROFILE=C:\ProgramData
> APPDATA=C:\Users\B\AppData\Roaming
> asl.log=Destination=file
> BURN_AUTOPLAY=C:\Program Files\Roxio 2011\Roxio Burn\
> CLASSPATH=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
> CommonProgramFiles=C:\Program Files\Common Files
> COMPUTERNAME=B-PC
> ComSpec=C:\Windows\system32\cmd.exe
> EMC_AUTOPLAY=C:\Program Files\Common Files\Roxio Shared\
> FP_NO_HOST_CHECK=NO
> HOMEDRIVE=C:
> HOMEPATH=\Users\B
> LOCALAPPDATA=C:\Users\B\AppData\Local
> LOGONSERVER=\\B-PC
> NUMBER_OF_PROCESSORS=1
> OS=Windows_NT
> Path=C:\Windows\system32;C:\Windows;C:\Windows\system32\wbem;C:\Program Files\Common Files\Microsoft Shared\Windows Live;C:\Program Files\NVIDIA Corporation\PhysX\Common;C:\Windows\System32\WindowsPowerShell\v1.0;C:\Program Files\Windows Live\Shared;C:\Program Files\Common Files\Roxio Shared\DLLShared;C:\Program Files\Common Files\Roxio Shared\13.0\DLLShared;C:\Program Files\QuickTime\QTSystem
> PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
> PROCESSOR_ARCHITECTURE=x86
> PROCESSOR_IDENTIFIER=x86 Family 16 Model 6 Stepping 3, AuthenticAMD
> PROCESSOR_LEVEL=16
> PROCESSOR_REVISION=0603
> ProgramData=C:\ProgramData
> ProgramFiles=C:\Program Files
> PROMPT=$P$G
> PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\
> PUBLIC=C:\Users\Public
> QTJAVA=C:\Program Files\Java\jre6\lib\ext\QTJava.zip
> RCAUTOPLAY=C:\Program Files\Roxio 2011\Roxio Central\
> SESSIONNAME=Console
> SystemDrive=C:
> SystemRoot=C:\Windows
> TEMP=C:\Users\B\AppData\Local\Temp
> TMP=C:\Users\B\AppData\Local\Temp
> USERDOMAIN=B-PC
> USERNAME=B
> USERPROFILE=C:\Users\B
> windir=C:\Windows
> windows_tracing_flags=3
> windows_tracing_logfile=C:\BVTBin\Tests\installpackage\csilogfile.log




PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

any luck?


----------



## jenae

*Re: taskeng.exe keeps popping up*

Hi, no what you sent us was your environment variables usually attained by running the set cmd.

Go back to my post #34 and run the attached .zip file it will return a Silent Runners.vbs file, right click on this and select open (if uac pops up agree to run it, if your AV pops up agree to run it, it is clean) ignore the box that pops up it will run automatically, will take awhile (so be patient), when finished it will tell you where the report is located, if you have followed instructions it will be right in front of you in the open unzipped folder. It will be around 50-60kb double click, it will open in notepad, copy paste the report here please.


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

this is the 5th time of doing this. i am not seeing this file that they said it would have been in. i did a search, no luck. i have followed to the best of my knowledge. I am still searching for this file


----------



## jenae

*Re: taskeng.exe keeps popping up*

Hi, it opened in the same folder it unzipped to, this folder would still have been opened when you ran the script, right there in front of you. Look in the unzipped folder.


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

there is nothing there except the same file i downloaded.. "silent runners" but imma look again


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

finally.. i had to put it on the desktop and run it from there...


"Silent Runners.vbs", revision 64, Silent Runners - Adware? Disinfect, don't reformat!
Operating System: Microsoft Windows 7 Ultimate Service Pack 1 (32-bit)
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
RocketDock = "C:\Program Files\RocketDock\RocketDock.exe" [null data]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
QuickTime Task = "C:\Program Files\QuickTime\QTTask.exe" -atboottime [Apple Inc.]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

{3049C3E9-B461-4BC5-8870-4C09146192CA}\(Default) = (no title provided)
-> {HKLM…CLSID} = RealNetworks Download and Record Plugin for Internet Explorer
\InProcServer32\(Default) = C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [RealDownloader]

{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\(Default) = (no title provided)
-> {HKLM…CLSID} = Groove GFS Browser Helper
\InProcServer32\(Default) = C:\PROGRA~1\MICROS~4\Office14\GROOVEEX.DLL [MS]

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM…CLSID} = Java(tm) Plug-In SSV Helper
\InProcServer32\(Default) = C:\Program Files\Java\jre7\bin\ssv.dll [Oracle Corporation]

{9030D464-4C02-4ABF-8ECC-5164760863C6}\(Default) = (no title provided)
-> {HKLM…CLSID} = Windows Live ID Sign-in Helper
\InProcServer32\(Default) = C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [MS]

{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}\(Default) = SkypeIEPluginBHO
-> {HKLM…CLSID} = Skype Browser Helper
\InProcServer32\(Default) = C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [Skype Technologies S.A.]

{B4F3A835-0E21-4959-BA22-42B3008E02FF}\(Default) = URLRedirectionBHO
-> {HKLM…CLSID} = Office Document Cache Handler
\InProcServer32\(Default) = C:\PROGRA~1\MICROS~4\Office14\URLREDIR.DLL [MS]

{CB0D163C-E9F4-4236-9496-0597E24B23A5}\(Default) = (no title provided)
-> {HKLM…CLSID} = GamesBarBHO Class
\InProcServer32\(Default) = C:\Program Files\GamesBar\2.0.1.82\oberontb.dll [Oberon Media Ltd.]

{DBC80044-A445-435b-BC74-9C25C1C588A9}\(Default) = (no title provided)
-> {HKLM…CLSID} = Java(tm) Plug-In 2 SSV Helper
\InProcServer32\(Default) = C:\Program Files\Java\jre7\bin\jp2ssv.dll [Oracle Corporation]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\

DropboxExt1\(Default) = {FB314ED9-A251-47B7-93E1-CDD82E34AF8B}
-> {HKCU…CLSID} = DropboxExt
\InProcServer32\(Default) = C:\Users\B\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll [Dropbox, Inc.]

DropboxExt2\(Default) = {FB314EDA-A251-47B7-93E1-CDD82E34AF8B}
-> {HKCU…CLSID} = DropboxExt
\InProcServer32\(Default) = C:\Users\B\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll [Dropbox, Inc.]

DropboxExt3\(Default) = {FB314EDB-A251-47B7-93E1-CDD82E34AF8B}
-> {HKCU…CLSID} = DropboxExt
\InProcServer32\(Default) = C:\Users\B\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll [Dropbox, Inc.]

DropboxExt4\(Default) = {FB314EDC-A251-47B7-93E1-CDD82E34AF8B}
-> {HKCU…CLSID} = DropboxExt
\InProcServer32\(Default) = C:\Users\B\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll [Dropbox, Inc.]

Groove Explorer Icon Overlay 1 (GFS Unread Stub)\(Default) = {99FD978C-D287-4F50-827F-B2C658EDA8E7}
-> {HKLM…CLSID} = Groove Explorer Icon Overlay 1 (GFS Unread Stub)
\InProcServer32\(Default) = C:\PROGRA~1\MICROS~4\Office14\GROOVEEX.DLL [MS]

Groove Explorer Icon Overlay 2 (GFS Stub)\(Default) = {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}
-> {HKLM…CLSID} = Groove Explorer Icon Overlay 2 (GFS Stub)
\InProcServer32\(Default) = C:\PROGRA~1\MICROS~4\Office14\GROOVEEX.DLL [MS]

Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)\(Default) = {920E6DB1-9907-4370-B3A0-BAFC03D81399}
-> {HKLM…CLSID} = Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)
\InProcServer32\(Default) = C:\PROGRA~1\MICROS~4\Office14\GROOVEEX.DLL [MS]

Groove Explorer Icon Overlay 3 (GFS Folder)\(Default) = {16F3DD56-1AF5-4347-846D-7C10C4192619}
-> {HKLM…CLSID} = Groove Explorer Icon Overlay 3 (GFS Folder)
\InProcServer32\(Default) = C:\PROGRA~1\MICROS~4\Office14\GROOVEEX.DLL [MS]

Groove Explorer Icon Overlay 4 (GFS Unread Mark)\(Default) = {2916C86E-86A6-43FE-8112-43ABE6BF8DCC}
-> {HKLM…CLSID} = Groove Explorer Icon Overlay 4 (GFS Unread Mark)
\InProcServer32\(Default) = C:\PROGRA~1\MICROS~4\Office14\GROOVEEX.DLL [MS]

HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\

{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} = DropboxExt
-> {HKCU…CLSID} = DropboxExt
\InProcServer32\(Default) = C:\Users\B\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll [Dropbox, Inc.]

{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} = DropboxExt
-> {HKCU…CLSID} = DropboxExt
\InProcServer32\(Default) = C:\Users\B\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll [Dropbox, Inc.]

{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} = DropboxExt
-> {HKCU…CLSID} = DropboxExt
\InProcServer32\(Default) = C:\Users\B\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll [Dropbox, Inc.]

{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} = DropboxExt
-> {HKCU…CLSID} = DropboxExt
\InProcServer32\(Default) = C:\Users\B\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll [Dropbox, Inc.]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\

{A70C977A-BF00-412C-90B7-034C51DA2439} = NvCpl DesktopContext Class
-> {HKLM…CLSID} = DesktopContext Class
\InProcServer32\(Default) = C:\Program Files\NVIDIA Corporation\Display\nvui.dll [NVIDIA Corporation]

{3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} = NVIDIA Play On My TV Context Menu Extension
-> {HKLM…CLSID} = NVIDIA CPL Context Menu Extension
\InProcServer32\(Default) = C:\Windows\system32\nvshext.dll [NVIDIA Corporation]

{23170F69-40C1-278A-1000-000100020000} = 7-Zip Shell Extension
-> {HKLM…CLSID} = 7-Zip Shell Extension
\InProcServer32\(Default) = C:\Program Files\7-Zip\7-zip.dll [Igor Pavlov]

{42042206-2D85-11D3-8CFF-005004838597} = Microsoft Office HTML Icon Handler
-> {HKLM…CLSID} = (no title provided)
\InProcServer32\(Default) = C:\Program Files\Microsoft Office\Office14\msohevi.dll [MS]

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} = Microsoft Office Metadata Handler
-> {HKLM…CLSID} = Microsoft Office Metadata Handler
\InProcServer32\(Default) = C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll [MS]

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} = Microsoft Office Thumbnail Handler
-> {HKLM…CLSID} = Microsoft Office Thumbnail Handler
\InProcServer32\(Default) = C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll [MS]

{3D60EDA7-9AB4-4DA8-864C-D9B5F2E7281D} = Groove Namespace Extension
-> {HKLM…CLSID} = Workspaces
\InProcServer32\(Default) = C:\PROGRA~1\MICROS~4\Office14\GROOVEEX.DLL [MS]

{0875DCB6-C686-4243-9432-ADCCF0B9F2D7} = Microsoft OneNote Namespace Extension for Windows Desktop Search
-> {HKLM…CLSID} = Microsoft OneNote Namespace Extension for Windows Desktop Search
\InProcServer32\(Default) = C:\Program Files\Microsoft Office\Office14\ONFILTER.DLL [MS]

{506F4668-F13E-4AA1-BB04-B43203AB3CC0} = {506F4668-F13E-4AA1-BB04-B43203AB3CC0}
-> {HKLM…CLSID} = ImageExtractorShellExt Class
\InProcServer32\(Default) = C:\Program Files\Microsoft Office\Office14\VISSHE.DLL [MS]

{D66DC78C-4F61-447F-942B-3FB6980118CF} = {D66DC78C-4F61-447F-942B-3FB6980118CF}
-> {HKLM…CLSID} = CInfoTipShellExt Class
\InProcServer32\(Default) = C:\Program Files\Microsoft Office\Office14\VISSHE.DLL [MS]

{72853161-30C5-4D22-B7F9-0BBC1D38A37E} = Groove GFS Browser Helper
-> {HKLM…CLSID} = Groove GFS Browser Helper
\InProcServer32\(Default) = C:\PROGRA~1\MICROS~4\Office14\GROOVEEX.DLL [MS]

{6C467336-8281-4E60-8204-430CED96822D} = Groove GFS Context Menu Handler
-> {HKLM…CLSID} = Groove GFS Context Menu Handler
\InProcServer32\(Default) = C:\PROGRA~1\MICROS~4\Office14\GROOVEEX.DLL [MS]

{2A541AE1-5BF6-4665-A8A3-CFA9672E4291} = Groove GFS Explorer Bar
-> {HKLM…CLSID} = Groove Folder Synchronization
\InProcServer32\(Default) = C:\PROGRA~1\MICROS~4\Office14\GROOVEEX.DLL [MS]

{16F3DD56-1AF5-4347-846D-7C10C4192619} = Groove Explorer Icon Overlay 3 (GFS Folder)
-> {HKLM…CLSID} = Groove Explorer Icon Overlay 3 (GFS Folder)
\InProcServer32\(Default) = C:\PROGRA~1\MICROS~4\Office14\GROOVEEX.DLL [MS]

{B5A7F190-DDA6-4420-B3BA-52453494E6CD} = Groove GFS Stub Execution Hook
-> {HKLM…CLSID} = Groove GFS Stub Execution Hook
\InProcServer32\(Default) = C:\PROGRA~1\MICROS~4\Office14\GROOVEEX.DLL [MS]

{A449600E-1DC6-4232-B948-9BD794D62056} = Groove GFS Stub Icon Handler
-> {HKLM…CLSID} = Groove GFS Stub Icon Handler
\InProcServer32\(Default) = C:\PROGRA~1\MICROS~4\Office14\GROOVEEX.DLL [MS]

{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} = Groove Explorer Icon Overlay 2 (GFS Stub)
-> {HKLM…CLSID} = Groove Explorer Icon Overlay 2 (GFS Stub)
\InProcServer32\(Default) = C:\PROGRA~1\MICROS~4\Office14\GROOVEEX.DLL [MS]

{920E6DB1-9907-4370-B3A0-BAFC03D81399} = Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)
-> {HKLM…CLSID} = Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)
\InProcServer32\(Default) = C:\PROGRA~1\MICROS~4\Office14\GROOVEEX.DLL [MS]

{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} = Groove Explorer Icon Overlay 4 (GFS Unread Mark)
-> {HKLM…CLSID} = Groove Explorer Icon Overlay 4 (GFS Unread Mark)
\InProcServer32\(Default) = C:\PROGRA~1\MICROS~4\Office14\GROOVEEX.DLL [MS]

{99FD978C-D287-4F50-827F-B2C658EDA8E7} = Groove Explorer Icon Overlay 1 (GFS Unread Stub)
-> {HKLM…CLSID} = Groove Explorer Icon Overlay 1 (GFS Unread Stub)
\InProcServer32\(Default) = C:\PROGRA~1\MICROS~4\Office14\GROOVEEX.DLL [MS]

{387E725D-DC16-4D76-B310-2C93ED4752A0} = Groove XML Icon Handler
-> {HKLM…CLSID} = Groove XML Icon Handler
\InProcServer32\(Default) = C:\PROGRA~1\MICROS~4\Office14\GROOVEEX.DLL [MS]

{00020D75-0000-0000-C000-000000000046} = Microsoft Outlook Desktop Icon Handler
-> {HKLM…CLSID} = Microsoft Outlook
\InProcServer32\(Default) = C:\PROGRA~1\MICROS~4\Office14\MLSHEXT.DLL [MS]

{0006F045-0000-0000-C000-000000000046} = Microsoft Outlook Custom Icon Handler
-> {HKLM…CLSID} = Outlook File Icon Extension
\InProcServer32\(Default) = C:\Program Files\Microsoft Office\Office14\OLKFSTUB.DLL [MS]

{2C5515DC-2A7E-4BFD-B813-CACC2B685EB7} = Revo Uninstaller Pro Extension
-> {HKLM…CLSID} = RUShellExt Class
\InProcServer32\(Default) = C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll [VS Revo Group]

{4380C993-0C43-4E02-9A7A-0D40B6EA7590} = DefragglerShellExtension
-> {HKLM…CLSID} = DefragglerShellExtension Class
\InProcServer32\(Default) = C:\Program Files\Defraggler\DefragglerShell.dll [Piriform Ltd]

{09A47860-11B0-4DA5-AFA5-26D86198A780} = EPP
-> {HKLM…CLSID} = (no title provided)
\InProcServer32\(Default) = c:\PROGRA~1\MICROS~2\shellext.dll [MS]

{5F327514-6C5E-4d60-8F16-D07FA08A78ED} = Auto Update Property Sheet Extension
-> {HKLM…CLSID} = Auto Update Property Sheet Extension
\InProcServer32\(Default) = C:\Windows\system32\wuaucpl.cpl [file not found]

{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} = Shell Extensions for RealOne Player
-> {HKLM…CLSID} = RealOne Player Context Menu Class
\InProcServer32\(Default) = c:\program files\real\realplayer\rpshell.dll [RealNetworks, Inc.]

{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} = iTunes
-> {HKLM…CLSID} = iTunes
\InProcServer32\(Default) = C:\Program Files\iTunes\iTunesMiniPlayer.dll [Apple Inc.]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\

<<!>> {B5A7F190-DDA6-4420-B3BA-52453494E6CD} = Groove GFS Stub Execution Hook
-> {HKLM…CLSID} = Groove GFS Stub Execution Hook
\InProcServer32\(Default) = C:\PROGRA~1\MICROS~4\Office14\GROOVEEX.DLL [MS]

HKLM\SYSTEM\CurrentControlSet\Control\Lsa\
<<!>> (livessp [MS]) Security Packages = kerberos|msv1_0|schannel|wdigest|tspkg|pku2u|livessp

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\

{F8A0B131-5F68-486c-8040-7E8FC3C85BB6}\(Default) = WLIDCredentialProvider
-> {HKLM…CLSID} = WLIDCredentialProvider
\InProcServer32\(Default) = C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDCREDPROV.DLL [MS]

HKLM\SOFTWARE\Classes\PROTOCOLS\Filter\

<<!>> text/xml\CLSID = {807573E5-5146-11D5-A672-00B0D022E945}
-> {HKLM…CLSID} = Microsoft Office InfoPath XML Mime Filter
\InProcServer32\(Default) = C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL [MS]

HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\

<<!>> ms-help\CLSID = {314111c7-a502-11d2-bbca-00c04f8ec294}
-> {HKLM…CLSID} = HxProtocol Class
\InProcServer32\(Default) = C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll [MS]

<<!>> skype-ie-addon-data\CLSID = {91774881-D725-4E58-B298-07617B9B86A8}
-> {HKLM…CLSID} = Skype IE add-on Pluggable Protocol
\InProcServer32\(Default) = C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [Skype Technologies S.A.]

<<!>> skype4com\CLSID = {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D}
-> {HKLM…CLSID} = IEProtocolHandler Class
\InProcServer32\(Default) = C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL [Skype Technologies]

<<!>> wlmailhtml\CLSID = {03C514A3-1EFB-4856-9F99-10D7BE1653C0}
-> {HKLM…CLSID} = Windows Live Mail HTML Asynchronous Pluggable Protocol Handler
\InProcServer32\(Default) = C:\Program Files\Windows Live\Mail\mailcomm.dll [MS]

HKCU\Software\Classes\*\shellex\ContextMenuHandlers\

DropboxExt\(Default) = {FB314ED9-A251-47B7-93E1-CDD82E34AF8B}
-> {HKCU…CLSID} = DropboxExt
\InProcServer32\(Default) = C:\Users\B\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll [Dropbox, Inc.]

HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\

7-Zip\(Default) = {23170F69-40C1-278A-1000-000100020000}
-> {HKLM…CLSID} = 7-Zip Shell Extension
\InProcServer32\(Default) = C:\Program Files\7-Zip\7-zip.dll [Igor Pavlov]

DefragglerShellExtension\(Default) = {4380C993-0C43-4E02-9A7A-0D40B6EA7590}
-> {HKLM…CLSID} = DefragglerShellExtension Class
\InProcServer32\(Default) = C:\Program Files\Defraggler\DefragglerShell.dll [Piriform Ltd]

EPP\(Default) = {09A47860-11B0-4DA5-AFA5-26D86198A780}
-> {HKLM…CLSID} = (no title provided)
\InProcServer32\(Default) = c:\PROGRA~1\MICROS~2\shellext.dll [MS]

RXDCExtSvr13\(Default) = {D0ED6350-B793-4834-9237-177584E4755D}
-> {HKLM…CLSID} = RXDCExtShlExt Class
\InProcServer32\(Default) = C:\Program Files\Roxio 2011\Virtual Drive\DC_ShellExt.dll [Sonic Solutions]

XXX Groove GFS Context Menu Handler XXX\(Default) = {6C467336-8281-4E60-8204-430CED96822D}
-> {HKLM…CLSID} = Groove GFS Context Menu Handler
\InProcServer32\(Default) = C:\PROGRA~1\MICROS~4\Office14\GROOVEEX.DLL [MS]

HKLM\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\

MBAMShlExt\(Default) = {57CE581A-0CB6-4266-9CA0-19364C90A0B3}
-> {HKLM…CLSID} = MBAMShlExt Class
\InProcServer32\(Default) = C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll [Malwarebytes Corporation]

XXX Groove GFS Context Menu Handler XXX\(Default) = {6C467336-8281-4E60-8204-430CED96822D}
-> {HKLM…CLSID} = Groove GFS Context Menu Handler
\InProcServer32\(Default) = C:\PROGRA~1\MICROS~4\Office14\GROOVEEX.DLL [MS]

HKCU\Software\Classes\Directory\shellex\ContextMenuHandlers\

DropboxExt\(Default) = {FB314ED9-A251-47B7-93E1-CDD82E34AF8B}
-> {HKCU…CLSID} = DropboxExt
\InProcServer32\(Default) = C:\Users\B\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll [Dropbox, Inc.]

HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\

7-Zip\(Default) = {23170F69-40C1-278A-1000-000100020000}
-> {HKLM…CLSID} = 7-Zip Shell Extension
\InProcServer32\(Default) = C:\Program Files\7-Zip\7-zip.dll [Igor Pavlov]

EPP\(Default) = {09A47860-11B0-4DA5-AFA5-26D86198A780}
-> {HKLM…CLSID} = (no title provided)
\InProcServer32\(Default) = c:\PROGRA~1\MICROS~2\shellext.dll [MS]

XXX Groove GFS Context Menu Handler XXX\(Default) = {6C467336-8281-4E60-8204-430CED96822D}
-> {HKLM…CLSID} = Groove GFS Context Menu Handler
\InProcServer32\(Default) = C:\PROGRA~1\MICROS~4\Office14\GROOVEEX.DLL [MS]

HKLM\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\

7-Zip\(Default) = {23170F69-40C1-278A-1000-000100020000}
-> {HKLM…CLSID} = 7-Zip Shell Extension
\InProcServer32\(Default) = C:\Program Files\7-Zip\7-zip.dll [Igor Pavlov]

HKCU\Software\Classes\Directory\Background\shellex\ContextMenuHandlers\

DropboxExt\(Default) = {FB314ED9-A251-47B7-93E1-CDD82E34AF8B}
-> {HKCU…CLSID} = DropboxExt
\InProcServer32\(Default) = C:\Users\B\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll [Dropbox, Inc.]

HKLM\SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\

NvCplDesktopContext\(Default) = {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9}
-> {HKLM…CLSID} = NVIDIA CPL Context Menu Extension
\InProcServer32\(Default) = C:\Windows\system32\nvshext.dll [NVIDIA Corporation]

XXX Groove GFS Context Menu Handler XXX\(Default) = {6C467336-8281-4E60-8204-430CED96822D}
-> {HKLM…CLSID} = Groove GFS Context Menu Handler
\InProcServer32\(Default) = C:\PROGRA~1\MICROS~4\Office14\GROOVEEX.DLL [MS]

HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\

{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = PDF Column Info
-> {HKLM…CLSID} = PDF Shell Extension
\InProcServer32\(Default) = C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll [Adobe Systems, Inc.]

HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\

DefragglerShellExtension\(Default) = {4380C993-0C43-4E02-9A7A-0D40B6EA7590}
-> {HKLM…CLSID} = DefragglerShellExtension Class
\InProcServer32\(Default) = C:\Program Files\Defraggler\DefragglerShell.dll [Piriform Ltd]

MBAMShlExt\(Default) = {57CE581A-0CB6-4266-9CA0-19364C90A0B3}
-> {HKLM…CLSID} = MBAMShlExt Class
\InProcServer32\(Default) = C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll [Malwarebytes Corporation]

RUShellExt\(Default) = {2C5515DC-2A7E-4BFD-B813-CACC2B685EB7}
-> {HKLM…CLSID} = RUShellExt Class
\InProcServer32\(Default) = C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll [VS Revo Group]

RXDCExtSvr13\(Default) = {D0ED6350-B793-4834-9237-177584E4755D}
-> {HKLM…CLSID} = RXDCExtShlExt Class
\InProcServer32\(Default) = C:\Program Files\Roxio 2011\Virtual Drive\DC_ShellExt.dll [Sonic Solutions]

XXX Groove GFS Context Menu Handler XXX\(Default) = {6C467336-8281-4E60-8204-430CED96822D}
-> {HKLM…CLSID} = Groove GFS Context Menu Handler
\InProcServer32\(Default) = C:\PROGRA~1\MICROS~4\Office14\GROOVEEX.DLL [MS]

HKLM\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\

{E5BA42A9-BF3F-40B3-978A-CCD306F381A7}\(Default) = (no title provided)
-> {HKLM…CLSID} = Compressed (LZH) Folder Right Drag Handler
\InProcServer32\(Default) = C:\Windows\system32\lzhfldr2.dll [MS]


Default executables:
--------------------

<<!>> HKLM\SOFTWARE\Classes\.com\(Default) = ComFile


Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------

Note: detected settings may not have any effect.

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\

NoDrives = (REG_DWORD) dword:0x00000000
{unrecognized setting}

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\

NoDrives = (REG_DWORD) dword:0x00000000
{unrecognized setting}

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\

DisableRegistryTools = (REG_DWORD) dword:0x00000000
{unrecognized setting}


Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
Wallpaper = C:\Users\B\AppData\LocalLow\FUNWEB~1\SCREEN~1\Images\f3wallpp.bmp

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
Wallpaper = C:\Users\B\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg


Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
SCRNSAVE.EXE = C:\PROGRA~1\Games\GARDEN~1\GARDEN~1.SCR [file not found]


Windows Portable Device AutoPlay Handlers
-----------------------------------------

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\

BasicBurnAdd\
Provider = Roxio Burn - Secure
InvokeProgID = BasicBurn.PLAYADD
InvokeVerb = Add
HKLM\SOFTWARE\Classes\BasicBurn.PLAYADD\shell\Add\Command\(Default) = "C:\Program Files\Roxio 2011\Roxio Burn\Roxio Burn.exe" /BURN %L [null data]

BasicBurnCopy\
Provider = Roxio Burn - Secure
InvokeProgID = BasicBurn.PLAYCOPY
InvokeVerb = Copy
HKLM\SOFTWARE\Classes\BasicBurn.PLAYCOPY\shell\Copy\Command\(Default) = "C:\Program Files\Roxio 2011\Roxio Burn\Roxio Burn.exe" /Copy %L [null data]

CinePlayerDVD\
Provider = Roxio CinePlayer
InvokeProgID = CinePlayer.PLAYDVD
InvokeVerb = Play
HKLM\SOFTWARE\Classes\CinePlayer.PLAYDVD\shell\Play\Command\(Default) = C:\Program Files\Roxio 2011\5.0\CinePlayer.exe %l [Sonic Solutions]

CinePlayerDVD1\
Provider = Roxio CinePlayer
InvokeProgID = CinePlayer.PLAYDVD
InvokeVerb = Play
HKLM\SOFTWARE\Classes\CinePlayer.PLAYDVD\shell\Play\Command\(Default) = C:\Program Files\Roxio 2011\5.0\CinePlayer.exe %l [Sonic Solutions]

EpShowApp\
Provider = Lexmark Fast Pics
InvokeProgID = EzPrint
InvokeVerb = Play
HKLM\SOFTWARE\Classes\EzPrint\shell\Play\DropTarget\CLSID = {225F2F50-F37D-4eb3-B3A6-F675C9B52C83}
-> {HKLM…CLSID} = (no title provided)
\LocalServer32\(Default) = "C:\Program Files\Lexmark 2600 Series\ezprint.exe" [Lexmark International Inc.]

iTunesBurnCDOnArrival\
Provider = iTunes
InvokeProgID = iTunes.BurnCD
InvokeVerb = burn
HKLM\SOFTWARE\Classes\iTunes.BurnCD\shell\burn\command\(Default) = "C:\Program Files\iTunes\iTunes.exe" /AutoPlayBurn "%L" [Apple Inc.]

iTunesImportSongsOnArrival\
Provider = iTunes
InvokeProgID = iTunes.ImportSongsOnCD
InvokeVerb = import
HKLM\SOFTWARE\Classes\iTunes.ImportSongsOnCD\shell\import\command\(Default) = "C:\Program Files\iTunes\iTunes.exe" /AutoPlayImportSongs "%L" [Apple Inc.]

iTunesPlaySongsOnArrival\
Provider = iTunes
InvokeProgID = iTunes.PlaySongsOnCD
InvokeVerb = play
HKLM\SOFTWARE\Classes\iTunes.PlaySongsOnCD\shell\play\command\(Default) = "C:\Program Files\iTunes\iTunes.exe" /playCD "%L" [Apple Inc.]

iTunesShowSongsOnArrival\
Provider = iTunes
InvokeProgID = iTunes.ShowSongsOnCD
InvokeVerb = showsongs
HKLM\SOFTWARE\Classes\iTunes.ShowSongsOnCD\shell\showsongs\command\(Default) = "C:\Program Files\iTunes\iTunes.exe" /AutoPlayShowSongs "%L" [Apple Inc.]

MediaCapture11Photos\
Provider = Media Import
InvokeProgID = RoxioMediaCapture13
InvokeVerb = Photo
HKLM\SOFTWARE\Classes\RoxioMediaCapture13\shell\Photo\command\(Default) = C:\Program Files\Roxio 2011\Media Import\MediaCapture13.exe -photo %L [Sonic Solutions]

MediaCapture11VideoCamera\
Provider = Media Import
ProgID = Shell.HWEventHandlerShellExecute
InitCmdLine = C:\Program Files\Roxio 2011\Media Import\MediaCapture13.exe
HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}
-> {HKLM…CLSID} = Shell Execute Hardware Event Handler
\LocalServer32\(Default) = C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7} [MS]

MediaCapture11Videos\
Provider = Media Import
InvokeProgID = RoxioMediaCapture13
InvokeVerb = Video
HKLM\SOFTWARE\Classes\RoxioMediaCapture13\shell\Video\command\(Default) = C:\Program Files\Roxio 2011\Media Import\MediaCapture13.exe -video %L [Sonic Solutions]

RoxioCreator12PlayCDAudioOnArrival\
Provider = Roxio Creator Classic
InvokeProgID = Creator12
InvokeVerb = open
HKLM\SOFTWARE\Classes\Creator12\shell\open\Command\(Default) = C:\Program Files\Roxio 2011\Creator Classic\Creator13.exe [Sonic Solutions]

RoxioSCAudioCDTask60\
Provider = Roxio Home Audio
InvokeProgID = Roxio.RoxioCentral60
InvokeVerb = AudioCDTask
HKLM\SOFTWARE\Classes\Roxio.RoxioCentral60\shell\AudioCDTask\Command\(Default) = C:\Program Files\Roxio 2011\Roxio Central\RoxioCentralFx.exe /Launch 10253C4C-229D-4c87-8D1D-169EFDFED869 [null data]

RoxioSCCopyCD60\
Provider = Roxio Home Copy
InvokeProgID = Roxio.RoxioCentral60
InvokeVerb = ExactCopyJob
HKLM\SOFTWARE\Classes\Roxio.RoxioCentral60\shell\ExactCopyJob\Command\(Default) = C:\Program Files\Roxio 2011\Roxio Central\RoxioCentralFx.exe /Launch 20C35DAF-3B5B-4c2d-9DCD-5C866838F5CC [null data]

RoxioSCCopyDisc60\
Provider = Roxio Home Copy
InvokeProgID = Roxio.RoxioCentral60
InvokeVerb = ExactCopyJob
HKLM\SOFTWARE\Classes\Roxio.RoxioCentral60\shell\ExactCopyJob\Command\(Default) = C:\Program Files\Roxio 2011\Roxio Central\RoxioCentralFx.exe /Launch 20C35DAF-3B5B-4c2d-9DCD-5C866838F5CC [null data]

RoxioSCDataProject60\
Provider = Roxio Home Data
InvokeProgID = Roxio.RoxioCentral60
InvokeVerb = DataGuide
HKLM\SOFTWARE\Classes\Roxio.RoxioCentral60\shell\DataGuide\Command\(Default) = C:\Program Files\Roxio 2011\Roxio Central\RoxioCentralFx.exe /Launch 1FA905E4-5763-4ba8-999A-5E104D3CDE8C [null data]

RoxioSCDataTask60\
Provider = Roxio Home Data
InvokeProgID = Roxio.RoxioCentral60
InvokeVerb = DataTask
HKLM\SOFTWARE\Classes\Roxio.RoxioCentral60\shell\DataTask\Command\(Default) = C:\Program Files\Roxio 2011\Roxio Central\RoxioCentralFx.exe /Launch 9CA0EEEE-5BC5-41e9-8242-BEE21643FFF0 [null data]

RPCDBurningOnArrival\
Provider = RealPlayer
InvokeProgID = RealPlayer.CDBurn.6
InvokeVerb = open
HKCU\Software\Classes\RealPlayer.CDBurn.6\shell\open\command\(Default) = "c:\program files\real\realplayer\\RealPlay.exe" /burn "%1" [RealNetworks, Inc.]

RPDeviceOnArrival\
Provider = RealPlayer
ProgID = RealPlayer.HWEventHandler
HKLM\SOFTWARE\Classes\RealPlayer.HWEventHandler\CLSID\(Default) = {67E76F1D-BDE2-4052-913C-2752366192D2}
-> {HKLM…CLSID} = RealNetworks Scheduler
\LocalServer32\(Default) = "c:\program files\real\realplayer\Update\realsched.exe" -autoplay [RealNetworks, Inc.]

RPDVDBurningOnArrival\
Provider = RealPlayer
InvokeProgID = RealPlayer.DVDBurn.6
InvokeVerb = open
HKCU\Software\Classes\RealPlayer.DVDBurn.6\shell\open\command\(Default) = "c:\program files\real\realplayer\\RealPlay.exe" /burndvd "%1" [RealNetworks, Inc.]

RPPlayCDAudioOnArrival\
Provider = RealPlayer
InvokeProgID = RealPlayer.AudioCD.6
InvokeVerb = play
HKCU\Software\Classes\RealPlayer.AudioCD.6\shell\play\command\(Default) = "c:\program files\real\realplayer\\RealPlay.exe" /play %1 [RealNetworks, Inc.]

RPPlayDVDMovieOnArrival\
Provider = RealPlayer
InvokeProgID = RealPlayer.DVD.6
InvokeVerb = play
HKCU\Software\Classes\RealPlayer.DVD.6\shell\play\command\(Default) = "c:\program files\real\realplayer\\RealPlay.exe" /dvd %1 [RealNetworks, Inc.]

RPPlayMediaOnArrival\
Provider = RealPlayer
InvokeProgID = RealPlayer.AutoPlay.6
InvokeVerb = open
HKCU\Software\Classes\RealPlayer.AutoPlay.6\shell\open\command\(Default) = "c:\program files\real\realplayer\\RealPlay.exe" /autoplay "%1" [RealNetworks, Inc.]

VLCPlayCDAudioOnArrival\
Provider = VideoLAN VLC media player
InvokeProgID = VLC.CDAudio
InvokeVerb = Open
HKLM\SOFTWARE\Classes\VLC.CDAudio\shell\Open\command\(Default) = "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file cdda:///%1 [VideoLAN]

VLCPlayDVDAudioOnArrival\
Provider = VideoLAN VLC media player
InvokeProgID = VLC.OPENFolder
InvokeVerb = Open
HKLM\SOFTWARE\Classes\VLC.OPENFolder\shell\Open\command\(Default) = "C:\Program Files\VideoLAN\VLC\vlc.exe" %1 [VideoLAN]

VLCPlayDVDMovieOnArrival\
Provider = VideoLAN VLC media player
InvokeProgID = VLC.DVDMovie
InvokeVerb = Open
HKLM\SOFTWARE\Classes\VLC.DVDMovie\shell\Open\command\(Default) = "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file dvd:///%1 [VideoLAN]

VLCPlayMusicFilesOnArrival\
Provider = VideoLAN VLC media player
InvokeProgID = VLC.OPENFolder
InvokeVerb = Open
HKLM\SOFTWARE\Classes\VLC.OPENFolder\shell\Open\command\(Default) = "C:\Program Files\VideoLAN\VLC\vlc.exe" %1 [VideoLAN]

VLCPlaySVCDMovieOnArrival\
Provider = VideoLAN VLC media player
InvokeProgID = VLC.SVCDMovie
InvokeVerb = Open
HKLM\SOFTWARE\Classes\VLC.SVCDMovie\shell\Open\command\(Default) = "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file vcd:///%1 [VideoLAN]

VLCPlayVCDMovieOnArrival\
Provider = VideoLAN VLC media player
InvokeProgID = VLC.VCDMovie
InvokeVerb = Open
HKLM\SOFTWARE\Classes\VLC.VCDMovie\shell\Open\command\(Default) = "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file vcd:///%1 [VideoLAN]

VLCPlayVideoFilesOnArrival\
Provider = VideoLAN VLC media player
InvokeProgID = VLC.OPENFolder
InvokeVerb = Open
HKLM\SOFTWARE\Classes\VLC.OPENFolder\shell\Open\command\(Default) = "C:\Program Files\VideoLAN\VLC\vlc.exe" %1 [VideoLAN]

WIA_{840C67E0-232A-4506-9536-04058E8FB387}\
Provider = Microsoft Publisher
CLSID = {A55803CC-4D53-404c-8557-FD63DBA95D24}
InitCmdLine = /WiaCmd;C:\Program Files\Microsoft Office\Office14\MSPUB.EXE /IMG_WIA;
-> {HKLM…CLSID} = WPDShextAutoplay
\LocalServer32\(Default) = C:\Windows\system32\WPDShextAutoplay.exe [MS]

WIA_{A8AA952A-D023-4489-9E33-B3C29F09E1B0}\
Provider = Microsoft Word
CLSID = {A55803CC-4D53-404c-8557-FD63DBA95D24}
InitCmdLine = /WiaCmd;C:\Program Files\Microsoft Office\Office14\WINWORD.EXE /IMG_WIA;
-> {HKLM…CLSID} = WPDShextAutoplay
\LocalServer32\(Default) = C:\Windows\system32\WPDShextAutoplay.exe [MS]

WIA_{FD21649E-295A-4EF6-8B08-321A51DAD5C9}\
Provider = Microsoft Publisher
CLSID = {A55803CC-4D53-404c-8557-FD63DBA95D24}
InitCmdLine = /WiaCmd;C:\Program Files\Microsoft Office\Office14\MSPUB.EXE /IMG_STI /StiDevice:%1 /StiEvent:%2;
-> {HKLM…CLSID} = WPDShextAutoplay
\LocalServer32\(Default) = C:\Windows\system32\WPDShextAutoplay.exe [MS]


Non-disabled Scheduled Tasks:
-----------------------------

C:\Users\B\AppData\Local\Microsoft\Windows Sidebar\Settings.ini

C:\Windows\System32\Tasks
Adobe Flash Player Updater -> launches: C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [Adobe Systems Incorporated]
GoogleUpdateTaskUserS-1-5-21-3419578036-40878485-3947204858-1000Core -> launches: C:\Users\B\AppData\Local\Google\Update\GoogleUpdate.exe /c [Google Inc.]
GoogleUpdateTaskUserS-1-5-21-3419578036-40878485-3947204858-1000UA -> launches: C:\Users\B\AppData\Local\Google\Update\GoogleUpdate.exe /ua /installsource scheduler [Google Inc.]
Installation App Launcher -> launches: "C:\Program Files\Lexmark 2600 Series\ezprint.exe" [Lexmark International Inc.]
RealDownloaderDownloaderScheduledTaskS-1-5-21-3419578036-40878485-3947204858-1000 -> launches: C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe /bgrecordaliveevent [RealNetworks, Inc.]
RealDownloaderRealUpgradeLogonTaskS-1-5-21-3419578036-40878485-3947204858-1000 -> launches: C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe /logoncheck [RealNetworks, Inc.]
RealDownloaderRealUpgradeScheduledTaskS-1-5-21-3419578036-40878485-3947204858-1000 -> launches: C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe /scheduledcheck [RealNetworks, Inc.]
RealPlayerRealUpgradeLogonTaskS-1-5-21-3419578036-40878485-3947204858-1000 -> launches: C:\Program Files\Real\RealUpgrade\RealUpgrade.exe /logoncheck [RealNetworks, Inc.]
RealPlayerRealUpgradeScheduledTaskS-1-5-21-3419578036-40878485-3947204858-1000 -> launches: C:\Program Files\Real\RealUpgrade\RealUpgrade.exe /scheduledcheck [RealNetworks, Inc.]
RealUpgradeLogonTaskS-1-5-21-3419578036-40878485-3947204858-1000 -> launches: C:\Program Files\Real\RealUpgrade\RealUpgrade.exe /logoncheck [RealNetworks, Inc.]
RealUpgradeScheduledTaskS-1-5-21-3419578036-40878485-3947204858-1000 -> launches: C:\Program Files\Real\RealUpgrade\RealUpgrade.exe /scheduledcheck [RealNetworks, Inc.]
Word Script -> launches: c:\word.bat [file not found]
{072CA5B2-5F03-4BCF-A02A-A0F39845F82E} -> launches: C:\Riot Games\League of Legends\lol.launcher.exe [null data]
{3D55F34C-0976-4C05-9756-277FE8258D6E} -> launches: C:\Riot Games\League of Legends\lol.launcher.exe [null data]
{6AB75A7F-54FD-426C-BF30-37BADDC7BDFA} -> launches: C:\roomMaster\rw5main.exe [file not found]
{AAACF832-D3D0-4487-82A4-841335DA972E} -> launches: C:\Windows\system32\pcalua.exe -a c:\pmw\msrun.exe [MS]

C:\Windows\System32\Tasks\Apple
AppleSoftwareUpdate -> launches: C:\Program Files\Apple Software Update\SoftwareUpdate.exe -task [Apple Inc.]

C:\Windows\System32\Tasks\Games
UpdateCheck_S-1-5-21-3419578036-40878485-3947204858-1000 -> (HIDDEN!) launches: {CA22F5B1-E06F-4A2B-94FC-21E87FE53781}
-> {HKLM…CLSID} = GameUpdateTask Class
\InProcServer32\(Default) = C:\Windows\System32\gameux.dll [MS]

C:\Windows\System32\Tasks\Microsoft\Microsoft Antimalware
Microsoft Antimalware Scheduled Scan -> launches: c:\Program Files\Microsoft Security Client\MpCmdRun.exe Scan -ScheduleJob -RestrictPrivileges [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Active Directory Rights Management Services Client
AD RMS Rights Policy Template Management (Manual) -> launches: {BF5CB148-7C77-4d8a-A53E-D81C70CF743C}
-> {HKLM…CLSID} = AD RMS Rights Policy Template Management (Manual) Task Handler
\InProcServer32\(Default) = C:\Windows\system32\msdrm.dll [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Application Experience
AitAgent -> launches: aitagent [MS]
ProgramDataUpdater -> launches: %windir%\system32\rundll32.exe aepdu.dll,AePduRunUpdate [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Autochk
Proxy -> launches: %windir%\system32\rundll32.exe /d acproxy.dll,PerformAutochkOperations [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Bluetooth
UninstallDeviceTask -> launches: BthUdTask.exe $(Arg0) [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\CertificateServicesClient
SystemTask -> launches: {58fb76b9-ac85-4e55-ac04-427593b1d060}
-> {HKLM…CLSID} = Certificate Services Client Task Handler
\InProcServer32\(Default) = C:\Windows\system32\dimsjob.dll [MS]
UserTask -> launches: {58fb76b9-ac85-4e55-ac04-427593b1d060}
-> {HKLM…CLSID} = Certificate Services Client Task Handler
\InProcServer32\(Default) = C:\Windows\system32\dimsjob.dll [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program
Consolidator -> launches: %SystemRoot%\System32\wsqmcons.exe [MS]
KernelCeipTask -> (HIDDEN!) launches: {e7ed314f-2816-4c26-aeb5-54a34d02404c}
-> {HKLM…CLSID} = KernelCeipCustomHandler
\InProcServer32\(Default) = C:\Windows\System32\kernelceip.dll [MS]
UsbCeip -> (HIDDEN!) launches: {c27f6b1d-fe0b-45e4-9257-38799fa69bc8}
-> {HKLM…CLSID} = UsbCeip
\InProcServer32\(Default) = C:\Windows\System32\usbceip.dll [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Defrag
ScheduledDefrag -> launches: %windir%\system32\defrag.exe -c [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Diagnosis
Scheduled -> (HIDDEN!) launches: {c1f85ef8-bcc2-4606-bb39-70c523715eb3}
-> {HKLM…CLSID} = ScheduledDiagnosticCustomHandler
\InProcServer32\(Default) = C:\Windows\System32\sdiagschd.dll [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Location
Notifications -> launches: %windir%\System32\LocationNotifications.exe [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Maintenance
WinSAT -> launches: {A9A33436-678B-4C9C-A211-7CC38785E79D}
-> {HKLM…CLSID} = WinSAT Task Manger Task
\InProcServer32\(Default) = C:\Windows\system32\WinSATAPI.dll [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Media Center
ActivateWindowsSearch -> launches: %SystemRoot%\ehome\ehPrivJob.exe /DoActivateWindowsSearch [MS]
ConfigureInternetTimeService -> launches: %SystemRoot%\ehome\ehPrivJob.exe /DoConfigureInternetTimeService [MS]
DispatchRecoveryTasks -> launches: %SystemRoot%\ehome\ehPrivJob.exe /DoRecoveryTasks $(Arg0) [MS]
ehDRMInit -> launches: %SystemRoot%\ehome\ehPrivJob.exe /DRMInit [MS]
InstallPlayReady -> launches: %SystemRoot%\ehome\ehPrivJob.exe /InstallPlayReady $(Arg0) [MS]
mcupdate -> launches: %SystemRoot%\ehome\mcupdate $(Arg0) [MS]
MediaCenterRecoveryTask -> launches: %SystemRoot%\ehome\mcupdate.exe -MediaCenterRecoveryTask [MS]
ObjectStoreRecoveryTask -> launches: %SystemRoot%\ehome\mcupdate.exe -ObjectStoreRecoveryTask [MS]
OCURActivate -> launches: %SystemRoot%\ehome\ehPrivJob.exe /OCURActivate [MS]
OCURDiscovery -> launches: %SystemRoot%\ehome\ehPrivJob.exe /OCURDiscovery $(Arg0) [MS]
PBDADiscovery -> launches: %SystemRoot%\ehome\ehPrivJob.exe /PBDADiscovery [MS]
PBDADiscoveryW1 -> launches: %SystemRoot%\ehome\ehPrivJob.exe /wait:7 /PBDADiscovery [MS]
PBDADiscoveryW2 -> launches: %SystemRoot%\ehome\ehPrivJob.exe /wait:90 /PBDADiscovery [MS]
PvrRecoveryTask -> launches: %SystemRoot%\ehome\mcupdate.exe -PvrRecoveryTask [MS]
PvrScheduleTask -> launches: %SystemRoot%\ehome\mcupdate.exe -PvrSchedule [MS]
RegisterSearch -> launches: %SystemRoot%\ehome\ehPrivJob.exe /DoRegisterSearch $(Arg0) [MS]
ReindexSearchRoot -> launches: %SystemRoot%\ehome\ehPrivJob.exe /DoReindexSearchRoot [MS]
SqlLiteRecoveryTask -> launches: %SystemRoot%\ehome\mcupdate.exe -SqlLiteRecoveryTask [MS]
StartRecording -> launches: %SystemRoot%\ehome\ehrec /StartRecording [MS]
UpdateRecordPath -> launches: %SystemRoot%\ehome\ehPrivJob.exe /DoUpdateRecordPath $(Arg0) [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\MemoryDiagnostic
CorruptionDetector -> (HIDDEN!) launches: {190BA3F6-0205-4f46-B589-95C6822899D2}
-> {HKLM…CLSID} = MemoryDiagnosticCustomHandler
\InProcServer32\(Default) = C:\Windows\System32\memdiag.dll [MS]
DecompressionFailureDetector -> (HIDDEN!) launches: {190BA3F6-0205-4f46-B589-95C6822899D2}
-> {HKLM…CLSID} = MemoryDiagnosticCustomHandler
\InProcServer32\(Default) = C:\Windows\System32\memdiag.dll [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\MobilePC
HotStart -> launches: {06DA0625-9701-43da-BFD7-FBEEA2180A1E}
-> {HKLM…CLSID} = HotStart User Agent
\InProcServer32\(Default) = C:\Windows\System32\HotStartUserAgent.dll [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\MUI
LPRemove -> launches: %windir%\system32\lpremove.exe [MS]
Mcbuilder -> launches: C:\Windows\System32\mcbuilder.exe [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Multimedia
SystemSoundsService -> launches: {2DEA658F-54C1-4227-AF9B-260AB5FC3543}
-> {HKLM…CLSID} = Microsoft PlaySoundService Class
\InProcServer32\(Default) = C:\Windows\System32\PlaySndSrv.dll [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\NetTrace
GatherNetworkInfo -> launches: %windir%\system32\gatherNetworkInfo.vbs [null data]

C:\Windows\System32\Tasks\Microsoft\Windows\Power Efficiency Diagnostics
AnalyzeSystem -> launches: %SystemRoot%\System32\powercfg.exe -energy -auto [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\RAC
RacTask -> (HIDDEN!) launches: {42060D27-CA53-41f5-96E4-B1E8169308A6}
-> {HKLM…CLSID} = ReliabilityAnalysisCustomHandler
\InProcServer32\(Default) = C:\Windows\system32\RacEngn.dll [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Ras
MobilityManager -> launches: {c463a0fc-794f-4fdf-9201-01938ceacafa}
-> {HKLM…CLSID} = RasMobilityManager
\InProcServer32\(Default) = C:\Windows\system32\rasmbmgr.dll [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Registry
RegIdleBackup -> (HIDDEN!) launches: {ca767aa8-9157-4604-b64b-40747123d5f2}
-> {HKLM…CLSID} = RegistryIdleBackupHandler
\InProcServer32\(Default) = C:\Windows\System32\regidle.dll [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\RemoteAssistance
RemoteAssistanceTask -> (HIDDEN!) launches: %windir%\system32\RAServer.exe /offerraupdate [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\SideShow
GadgetManager -> launches: {FF87090D-4A9A-4f47-879B-29A80C355D61}
-> {HKLM…CLSID} = GadgetsManager Class
\InProcServer32\(Default) = C:\Windows\System32\AuxiliaryDisplayServices.dll [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\SystemRestore
SR -> launches: %windir%\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Task Manager
Interactive -> (HIDDEN!) launches: {855fec53-d2e4-4999-9e87-3414e9cf0ff4}
-> {HKLM…CLSID} = RunTask
\InProcServer32\(Default) = C:\Windows\system32\wdc.dll [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Tcpip
IpAddressConflict1 -> launches: %windir%\system32\rundll32.exe ndfapi.dll,NdfRunDllDuplicateIPOffendingSystem [MS]
IpAddressConflict2 -> launches: %windir%\system32\rundll32.exe ndfapi.dll,NdfRunDllDuplicateIPDefendingSystem [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework
MsCtfMonitor -> (HIDDEN!) launches: {01575cfe-9a55-4003-a5e1-f38d1ebdcbe1}
-> {HKLM…CLSID} = MsCtfMonitor task handler
\InProcServer32\(Default) = C:\Windows\system32\MsCtfMonitor.dll [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Time Synchronization
SynchronizeTime -> launches: %windir%\system32\sc.exe start w32time task_started [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\UPnP
UPnPHostConfig -> launches: sc.exe config upnphost start= auto [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\WDI
ResolutionHost -> (HIDDEN!) launches: {900be39d-6be8-461a-bc4d-b0fa71f5ecb1}
-> {HKLM…CLSID} = DiagnosticInfrastructureCustomHandler
\InProcServer32\(Default) = C:\Windows\System32\wdi.dll [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Windows Activation Technologies
ValidationTask -> (HIDDEN!) launches: %SystemRoot%\system32\Wat\WatAdminSvc.exe /run [MS]
ValidationTaskDeadline -> (HIDDEN!) launches: %SystemRoot%\system32\schtasks.exe /run /I /TN "\Microsoft\Windows\Windows Activation Technologies\ValidationTask" [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Windows Error Reporting
QueueReporting -> launches: %windir%\system32\wermgr.exe -queuereporting [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Windows Filtering Platform
BfeOnServiceStartTypeChange -> (HIDDEN!) launches: %windir%\system32\rundll32.exe bfe.dll,BfeOnServiceStartTypeChange [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Windows Media Sharing
UpdateLibrary -> launches: "%ProgramFiles%\Windows Media Player\wmpnscfg.exe" [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\WindowsBackup
AutomaticBackup -> launches: %systemroot%\system32\rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup [MS]
Windows Backup Monitor -> launches: %systemroot%\system32\sdclt.exe /CHECKSKIPPED [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Wininet
CacheTask -> launches: {0358b920-0ac7-461f-98f4-58e32cd89148}
-> {HKLM…CLSID} = Wininet Cache task object
\InProcServer32\(Default) = C:\Windows\system32\wininet.dll [MS]

C:\Windows\System32\Tasks\Microsoft\Windows Live\SOXE
Extractor Definitions Update Task -> launches: {3519154C-227E-47F3-9CC9-12C3F05817F1}
-> {HKLM…CLSID} = Windows Live Social Object Extractor Engine Definition Updater
\InProcServer32\(Default) = C:\Program Files\Windows Live\SOXE\wlsoxe.dll [MS]

C:\Windows\System32\Tasks\WPD
SqmUpload_S-1-5-21-3419578036-40878485-3947204858-1000 -> (HIDDEN!) launches: %windir%\system32\rundll32.exe portabledeviceapi.dll,#1 [MS]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = %SystemRoot%\system32\NLAapi.dll [MS]
000000000002\LibraryPath = %SystemRoot%\system32\napinsp.dll [MS]
000000000003\LibraryPath = %SystemRoot%\system32\pnrpnsp.dll [MS]
000000000004\LibraryPath = %SystemRoot%\system32\pnrpnsp.dll [MS]
000000000005\LibraryPath = %SystemRoot%\System32\mswsock.dll [MS]
000000000006\LibraryPath = %SystemRoot%\System32\winrnr.dll [MS]
000000000007\LibraryPath = C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [MS]
000000000008\LibraryPath = C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [MS]
000000000009\LibraryPath = C:\Program Files\Bonjour\mdnsNSP.dll [Apple Inc.]

Transport Service Providers

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 20


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\
{6F282B65-56BF-4BD1-A8B2-A4449A05863D} = GamesBar
-> {HKLM…CLSID} = GamesBar
\InProcServer32\(Default) = C:\Program Files\GamesBar\2.0.1.82\oberontb.dll [Oberon Media Ltd.]

Explorer Bars

HKLM\SOFTWARE\Classes\CLSID\{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}\(Default) = Groove Folder Synchronization
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = C:\PROGRA~1\MICROS~4\Office14\GROOVEEX.DLL [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\
{2670000A-7350-4F3C-8081-5663EE0C6C49}\
ButtonText = Send to OneNote
MenuText = Se&nd to OneNote
CLSIDExtension = {48E73304-E1D6-4330-914C-F5F514E3486C}
-> {HKLM…CLSID} = Send to OneNote from Internet Explorer button
\InProcServer32\(Default) = C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll [MS]

{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\
ButtonText = OneNote Lin&ked Notes
MenuText = OneNote Lin&ked Notes
CLSIDExtension = {FFFDC614-B694-4AE6-AB38-5D6374584B52}
-> {HKLM…CLSID} = Linked Notes button
\InProcServer32\(Default) = C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll [MS]

{898EA8C8-E7FF-479B-8935-AEC46303B9E5}\
ButtonText = Skype Click to Call
CLSIDExtension = {898EA8C8-E7FF-479B-8935-AEC46303B9E5}
-> {HKLM…CLSID} = Skype Browser Helper
\InProcServer32\(Default) = C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [Skype Technologies S.A.]


Miscellaneous IE Hijack Points
------------------------------

HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs\
<<H>> Tabs = C:\Program Files\MyPlayCity Toolbar\fasttabs.html [file not found]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Microsoft Antimalware Service, MsMpSvc, "c:\Program Files\Microsoft Security Client\MsMpEng.exe" [MS]
Windows Live ID Sign-in Assistant, wlidsvc, "C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE" [MS]


Safe Mode Drivers & Services (subkey name, subkey default value):
-----------------------------------------------------------------

HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\

<<!>> MsMpSvc, Service

HKLM\System\CurrentControlSet\Control\SafeBoot\Network\

<<!>> MsMpSvc, Service


Print Monitors:
---------------

HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\
2600 Series Port\Driver = lxdnlmpm.DLL [ ]


---------- (launch time: 2013-06-18 08:20:21)
<<!>>: Suspicious data at a malware launch point.
<<H>>: Suspicious data at a browser hijack point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points, use the -supp parameter or answer "No" at the
first message box and "Yes" at the second message box.
---------- (total run time: 47 seconds, including 18 seconds for message boxes)


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

here we go


----------



## shawnpb

*Re: taskeng.exe keeps popping up*

Follow this Show hidden files to unhide hidden files. Use unlocker to delete the word.bat which should be in C:\word.bat Also go to control panel/Administrative Tools/Task Scheduler see if there is any schedule tasks associated with word.bat


----------



## jenae

*Re: taskeng.exe keeps popping up*

Hi, yes follow Jack's suggestions, However, before you do, open a cmd as admin (as shown) and at the prompt type:-



Code:


net stop schedule

 (press enter) this will stop the task scheduler service, which while open has a handle on the file and will not let you delete it. Once you have done this follow Jack's suggestion. When finished restart computer, the task schedule will be restarted.


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

i did what janea said and this is what came up.. i did it both with spaces and without spaces


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

do i skip the cmd and go to what jack said? what to do?


----------



## jenae

*Re: taskeng.exe keeps popping up*

Hi, well that shows a permissions problem, probably best if we leave it for the moment, since it will not effect the normal running of the computer. Lets see if we can snip this fellow in the registry. Tasks are located in the following key, so we can see them open a cmd as admin (as shown) and highlight everything in the code box right click in the highlighted text and select copy. Open the cmd prompt and at the flashing cursor right click and select paste, press enter.Post the notepad outcome here, it will be quite long.




Code:


reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks" /s > 0 & notepad 0


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{01ADFD4A-9436-4A67-A729-F3583B606B5B}
Path REG_SZ \OfficeSoftwareProtectionPlatform\SvcRestartTask
Hash REG_BINARY C1641B3BE7D44C4AF34DB1EAFB52998F9A8F67C285A5CF685D0A7DB91A773FB0
Triggers REG_BINARY 150000000000000001134A01E8134A010000F232FACFC30100134A01E8134A01FFFFFFFFFFFFFFFF482182024848484872C5A855484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000514000000484848480000000048484848380000004848484858020000100E000000000000FFFFFFFF070000003C0000000300000000000000000000000000000000000000690000000000000000000000DDDD00000000000001134A01E8134A010000F232FACFC30100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF01000000010000000000000000017B02010000000000000027000000
DynamicInfo REG_BINARY 03000000E0286D7BA473CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{05EE699F-AB25-42D8-8781-558C5D1D2FAD}
Path REG_SZ \Microsoft\Windows\Tcpip\IpAddressConflict1
Triggers REG_BINARY 150000000000000000D1FF7228F6BE07000000000000000000D1FF7228F6BE07FFFFFFFFFFFFFFFF38A1400348484848E99D6008484848480048484848484848004848484848484804000000484848481000000048484848010200000000000520000000210200000000000048484848380000004848484858020000100E000080F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000CCCC00000000000000D1FF7228F6BE07000000000000000000D1FF7228F6BE07FFFFFFFFFFFFFFFF00000000FFFFFFFF0000000000000000000000000000000001000000B49ED2CB95C16F02FA9045EB8D000000000000003C00510075006500720079004C006900730074003E003C00510075006500720079002000490064003D00220030002200200050006100740068003D002200530079007300740065006D0022003E003C00530065006C00650063007400200050006100740068003D002200530079007300740065006D0022003E002A005B00530079007300740065006D005B00500072006F00760069006400650072005B0040004E0061006D0065003D0027005400630070006900700027005D00200061006E00640020004500760065006E007400490044003D0034003100390038005D005D003C002F00530065006C006500630074003E003C002F00510075006500720079003E003C002F00510075006500720079004C006900730074003E00000048484848000000000000000000000000000000000000000000000000
DynamicInfo REG_BINARY 03000000F00D9C123F04CA0100000000000000000000000000000000
Hash REG_BINARY CEF4FD5DA04459B60C163CD71D538078A601EF7EE05832CECD2DD79D5213AF22

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{071D41B6-8806-4EB0-B661-6CB67BE6E86E}
Path REG_SZ \Microsoft\Windows\Diagnosis\Scheduled
Triggers REG_BINARY 15000000000000000152DA092052DA090068B69402D0C3010052DA092052DA09FFFFFFFFFFFFFFFF7289C00348484848AB8C36E4484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005040000004848484800000000484848483800000048484848580200008070000080F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000DDDD0000000000000152DA092052DA090068B69402D0C30100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF0200000001000100000000000001F9090100000000000000D0D21800
DynamicInfo REG_BINARY 030000007193A5123F04CA0100000000000000000000000000000000
Hash REG_BINARY 82EBD60108500FCD357BF28CCE5952EFB6FF943B38E8250A3AF34507C6162FAE

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0B74D9AB-77B3-4635-9DC5-EB252FF05F54}
Path REG_SZ \Microsoft\Windows\Media Center\OCURDiscovery
Hash REG_BINARY 1FC092677FA581A6F0D9017D0F02E74681A0DA6B0AF0EEF0E204E92D1605757A
Triggers REG_BINARY 150000000000000000E72A01386F9672FFFFFFFFFFFFFFFF00E72A01386F9672000000000000000000214202484848485C36CF06484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848480000000048484848
DynamicInfo REG_BINARY 03000000602F4F0CDE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0D9B5D92-3A22-486D-A887-3AA21597CF27}
Path REG_SZ \Microsoft\Windows\Time Synchronization\SynchronizeTime
Triggers REG_BINARY 150000000000000001A1D80718A1D80700E8E6379DEFC40100A1D80718A1D807FFFFFFFFFFFFFFFFE021420348484848DFDC7836484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005130000004848484800000000484848480000000048484848DDDD00000000000001A1D80718A1D80700E8E6379DEFC40100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF02000000010001000000000000017802010000000000000024D51800
DynamicInfo REG_BINARY 030000003156AA123F04CA0100000000000000000000000000000000
Hash REG_BINARY 17D3BD884BE1EAD4B4B32CC46D0707E468688A3FCDE1835573BF3A392D0BF65A

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0E12083C-0335-49DB-9542-BA1EC6D83ECC}
Path REG_SZ \Microsoft\Windows\Tcpip\IpAddressConflict2
Triggers REG_BINARY 15000000000000000160C1074860C10780294E129638C60100D1FF7228F6BE07FFFFFFFFFFFFFFFF38A1400348484848A201FC43484848480048484848484848004848484848484804000000484848481000000048484848010200000000000520000000210200000000000048484848380000004848484858020000100E000080F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000CCCC0000000000000160C1074860C10780294E129638C60100D1FF7228F6BE07FFFFFFFFFFFFFFFF00000000FFFFFFFF0000000000000000000000000000000001000000B49ED2CB95C16F02FA9045EB8D000000000000003C00510075006500720079004C006900730074003E003C00510075006500720079002000490064003D00220030002200200050006100740068003D002200530079007300740065006D0022003E003C00530065006C00650063007400200050006100740068003D002200530079007300740065006D0022003E002A005B00530079007300740065006D005B00500072006F00760069006400650072005B0040004E0061006D0065003D0027005400630070006900700027005D00200061006E00640020004500760065006E007400490044003D0034003100390039005D005D003C002F00530065006C006500630074003E003C002F00510075006500720079003E003C002F00510075006500720079004C006900730074003E00000048484848000000000000000000000000000000000000000000000000
DynamicInfo REG_BINARY 0300000092B7AC123F04CA0100000000000000000000000000000000
Hash REG_BINARY 4D3C72EE9B731BFCFC7022531B2870DEF28FF13FF8E0F089003E02AA0F40C05D

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1216802A-CE1D-45BC-8574-087E81239DFC}
Path REG_SZ \Microsoft\Windows\Media Center\ConfigureInternetTimeService
Hash REG_BINARY 1A61FB3046F2F771F436B66EDEC9EEC6E1E9E3F219AA4224495928E6BC347BEE
Triggers REG_BINARY 150000000000000000E72A01386F9672FFFFFFFFFFFFFFFF00E72A01386F967200000000000000000021420248484848334EC699484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848480000000048484848
DynamicInfo REG_BINARY 030000002097710DDE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{18E6D428-D26C-4169-BEDF-3B5BDDC952F6}
Path REG_SZ \Microsoft\Windows\Application Experience\ProgramDataUpdater
Triggers REG_BINARY 15000000000000000160C1074860C10700343C5C4209C8010060C1074860C107FFFFFFFFFFFFFFFF7E2142024848484837E5BF7A484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848483800000048484848B40000007043010080F40300FFFFFFFF04000000000000000000000000000000000000000000000000000000750070000000000000000000DDDD0000000000000160C1074860C10700343C5C4209C80100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF0100000001000000000000000001EA07010000000000000024D51800
DynamicInfo REG_BINARY 03000000A51A58133F04CA0100000000000000000000000000000000
Hash REG_BINARY DC338F10A3CFC796A188C9F3527F69731F42DAFFD45DC3437174145A408A4A05

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1EC9510D-A439-4950-9399-B6399EDF9EA7}
Path REG_SZ \Microsoft\Windows\Autochk\Proxy
Triggers REG_BINARY 150000000000000000D1FF72B8397802000000000000000000D1FF72B8397802FFFFFFFFFFFFFFFF4221420248484848B1B1AB59484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005130000004848484800000000484848483800000048484848580200008033E10180F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000FFFF00000000000000D1FF72B8397802000000000000000000D1FF72B8397802FFFFFFFFFFFFFFFF08070000FFFFFFFF00000000000000000000000000000000014D454D4000000068D7180060B62B00
DynamicInfo REG_BINARY 030000004A4E65123F04CA0100000000000000000000000000000000
Hash REG_BINARY 02E603F0F0B98221F070DD81A88B3DB67CE5DA315BC568423732F9EED15F3F79

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2375F586-1009-41FB-B54E-30D8AF2B781D}
Path REG_SZ \Microsoft\Windows\Windows Media Sharing\UpdateLibrary
Triggers REG_BINARY 150000000000000000D1FF72C0FD700A000000000000000000D1FF72C0FD700AFFFFFFFFFFFFFFFF4085400248484848EC26CB6D484848480048484848484848004848484848484805000000484848480C0000004848484801010000000000050B0000004848484800000000484848480000000048484848CCCC00000000000000D1FF72C0FD700A000000000000000000D1FF72C0FD700AFFFFFFFFFFFFFFFF00000000FFFFFFFF0000000000000000000000000000000001000000B49ED2CB95C16F02FA9045EB1E010000000000003C00510075006500720079004C006900730074003E000A00200020002000200020002000200020002000200020002000200020003C00510075006500720079000A00200020002000200020002000200020002000200020002000200020002000200020002000490064003D002200300022000A0020002000200020002000200020002000200020002000200020002000200020002000200050006100740068003D002200530079007300740065006D0022000A002000200020002000200020002000200020002000200020002000200020002000200020003E000A0020002000200020002000200020002000200020002000200020002000200020003C00530065006C00650063007400200050006100740068003D002200530079007300740065006D0022003E002A005B00530079007300740065006D005B00500072006F00760069006400650072005B0040004E0061006D0065003D0027004D006900630072006F0073006F00660074002D00570069006E0064006F00770073002D0057004D0050004E00530053002D00530065007200760069006300650027005D00200061006E006400200028004500760065006E007400490044003D003100340032003100300029005D005D003C002F00530065006C006500630074003E000A00200020002000200020002000200020002000200020002000200020003C002F00510075006500720079003E000A002000200020002000200020002000200020002000200020003C002F00510075006500720079004C006900730074003E0000004848000000000000000000000000000000000000000000000000
DynamicInfo REG_BINARY 0300000066DD5C133F04CA0100000000000000000000000000000000
Hash REG_BINARY 72A5683A40FAA291AA33CC4DD71A02E9E691D7C5A7BA213B817C759F7D4E24BE

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{249EA428-8F2A-4411-B8CB-B741B6D76773}
Path REG_SZ \RealPlayerRealUpgradeLogonTaskS-1-5-21-3419578036-40878485-3947204858-1000
Hash REG_BINARY 0BBA2F4A6D860F4609DFB8F40C2E433E8C574C9198F44847882511604CC11590
Triggers REG_BINARY 150000000000000001962D01E8962D0100924ABA0962CE010000000000000000FFFFFFFFFFFFFFFF38214100484848480C7DE2F3484848480048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848380000004848484858020000100E000080F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000AAAA00000000000001962D01E8962D0100924ABA0962CE010000000000000000FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000E6430101006900630065004100700069002E000048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848
DynamicInfo REG_BINARY 03000000E0673A432B62CE0190FD53CEF46CCE010000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{24FA84A0-E087-48EC-BC51-2B9C4C815D78}
Path REG_SZ \Microsoft\Windows\PerfTrack\BackgroundConfigSurveyor
Triggers REG_BINARY 150000000000000000D1FF725075D009000000000000000000D1FF725075D009FFFFFFFFFFFFFFFF102182024848484803D61589484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005130000004848484800000000484848480000000048484848EEEE00000000000000D1FF725075D009000000000000000000D1FF725075D009FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000D2180001000000660074004C4D454D48000000DDDD00000000000001397902C83979020078BA3F01C2C80100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF0100000001000000000000000001D0090100000000000000D0D21800
DynamicInfo REG_BINARY 0300000027A061133F04CA0100000000000000000000000000000000
Hash REG_BINARY 8A4BC3FB22E943EDE5A98456CCAF3453D4DDD613D1A3265017967ABC8C779E7D

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{25F9B764-EFEB-487C-99C6-262AC820C63F}
Path REG_SZ \{AAACF832-D3D0-4487-82A4-841335DA972E}
Hash REG_BINARY 0EB2DD9087E75DD723B2D862E18B4AC42FAFD6C9E507008494BC1875B38EB4ED
Triggers REG_BINARY 1500000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF2821410048484848A022610D484848480048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848380000004848484858020000100E000080F40300FFFFFFFF070000000000000000000000000000000000000000000000000000007500700000000000000000008888000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000E6240201006900630065003A00000000000000
DynamicInfo REG_BINARY 03000000F02823554C20CE01F02823554C20CE010000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2BD05BA6-988D-4BD3-A9CD-9A39F80AF524}
Path REG_SZ \Microsoft\Windows\MemoryDiagnostic\CorruptionDetector
Triggers REG_BINARY 150000000000000000D1FF7228F6BE07000000000000000000D1FF7228F6BE07FFFFFFFFFFFFFFFF00A0C00248484848F1D7B9294848484800484848484848480048484848484848040000004848484810000000484848480102000000000005200000002102000000000000484848480000000048484848CCCC00000000000000D1FF7228F6BE07000000000000000000D1FF7228F6BE07FFFFFFFFFFFFFFFF00000000FFFFFFFF0000000000000000000000000000000001000000B49ED2CB95C16F02FA9045EB99000000000000003C00510075006500720079004C006900730074003E003C00510075006500720079002000490064003D00220030002200200050006100740068003D002200530079007300740065006D0022003E003C00530065006C00650063007400200050006100740068003D002200530079007300740065006D0022003E002A005B00530079007300740065006D005B00500072006F00760069006400650072005B0040004E0061006D0065003D0027004100700070006C00690063006100740069006F006E00200050006F0070007500700027005D00200061006E00640020004500760065006E007400490044003D0031003800300031005D005D003C002F00530065006C006500630074003E003C002F00510075006500720079003E003C002F00510075006500720079004C006900730074003E00000048484848000000000000000000000000000000000000000000000000
DynamicInfo REG_BINARY 03000000870164133F04CA0100000000000000000000000000000000
Hash REG_BINARY 39D0B04F356DF6650E076076255CE26CE27591428740C759241D2B1AEE37F612

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2C59ECAF-3A27-4640-9F4B-519B05BDD70F}
Path REG_SZ \Microsoft\Windows\MUI\LPRemove
Triggers REG_BINARY 150000000000000000D1FF72409CEA07000000000000000000D1FF72409CEA07FFFFFFFFFFFFFFFF12214203484848489B41D2D8484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000512000000484848480000000048484848380000004848484858020000FFFFFFFF907E0000FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000FFFF00000000000000D1FF72409CEA07000000000000000000D1FF72409CEA07FFFFFFFFFFFFFFFFDC050000FFFFFFFF00000000000000000000000000000000014D454D4000000068D71800E0B12B00
DynamicInfo REG_BINARY 030000000A116A123F04CA0100000000000000000000000000000000
Hash REG_BINARY 47D45B031C1994B39C49EF36D6FE80FBEC111F7D6EF3E282476EF5D77E097DAB

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2D2A2DCD-315C-4E4F-B6F0-7B0663588175}
Path REG_SZ \Adobe Flash Player Updater
Hash REG_BINARY 45E8C6A6C31C1A9CDFFFBBCC07262CD366FD1C39B0FAA0F07FDC80684BB67637
Triggers REG_BINARY 150000000000000001CF210128CF21010034720BD053BF0100CF210128CF2101FFFFFFFFFFFFFFFF282162004848484887B10CF5484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000512000000484848480000000048484848380000004848484858020000100E000080F40300FFFFFFFF09000000000000000000000000000000000000000000000000000000640061000000000000000000DDDD00000000000001CF210128CF21010034720BD053BF010000000000000000000000000000000000000000000000000000000000000000100E000080510100FFFFFFFF0100000001000000000000000001D301010000000000000027000000
DynamicInfo REG_BINARY 0300000020687DACB037CD01D06803C53E6DCE010000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{341ECAFB-0959-49CD-B367-5707F008D7AB}
Path REG_SZ \Word Script
Hash REG_BINARY DF82DEA0D62ECA9ECB822D296727B53450F6AE6B5FBD9C40F53DEEB226D8E9EC
Triggers REG_BINARY 150000000000000001FF590118FF590100C816A54548CE0100FF590118FF5901FFFFFFFFFFFFFFFF3821410048484848DC1BB54A484848480048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848380000004848484858020000100E000080F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000DDDD00000000000001FF590118FF590100C816A54548CE0100000000000000000000000000000000000000000000000000000000000000007800000000000000FFFFFFFF00000000000000000000000000015D02010000000000000019000000
DynamicInfo REG_BINARY 0300000068B8237C6348CE0170216CCC436DCE010100000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{35B2987A-C113-4674-89B3-778E5CF49FFB}
Path REG_SZ \Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan
Hash REG_BINARY 1C0566019D113BE97D30BB4941560119DD85B3CD2EBB5D712AE4D8AAAC713D5F
Triggers REG_BINARY 150000000000000001F9AC00C0F9AC0080C0A59FFB53BF0101F9AC00C0F9AC000000647763712F02522142034848484846C83507484848480048484848484848004848484848484805000000484848480C0000004848484801010000000000051200000048484848000000004848484838000000484848483C0000004038000080F40300FFFFFFFF070000000000000000000000000000000000000000000000000000003C0050000000000000000000DDDD00000000000001F9AC00C0F9AC0080C0A59FFB53BF0101F9AC00C0F9AC000000647763712F02000000000000000000000000000000000000000000000000FFFFFFFF0200000001000100000000000001A200010000000000000027000000
DynamicInfo REG_BINARY 0300000030F8596DF16CCE0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{367F930A-A3DB-4112-B1F1-50E92A171C88}
Path REG_SZ \Microsoft\Windows\Shell\WindowsParentalControls
Triggers REG_BINARY 150000000000000000D1FF72882AF909000000000000000000D1FF72882AF909FFFFFFFFFFFFFFFF4085800248484848E149B4C1484848480048484848484848004848484848484805000000484848480C0000004848484801010000000000050B000000484848480000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF070000003C0000000500000000000000000000000000000000000000750070000000000000000000AAAA00000000000000D1FF72882AF909000000000000000000D1FF72882AF909FFFFFFFFFFFFFFFF01000000FFFFFFFF0000000000000000000000000000000000000000660074004C4D454D480000000148484848484848
DynamicInfo REG_BINARY 03000000ACBA7A123F04CA0100000000000000000000000000000000
Hash REG_BINARY 886511E7DEE4F447B2F704A04046BB942BD9BDA76152A12BB0AE3D9B56C6AAF5

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{371A6AFB-1D6E-4119-904E-9037692EF8C4}
Path REG_SZ \Microsoft\Windows\Offline Files\Logon Synchronization
Hash REG_BINARY 6576A98588179A08B31C3D3999726FCF3761698BAAA53EC77A03A35E4108207A
Triggers REG_BINARY 150000000000000000E8150225D49972000000000000000000E8150225D49972FFFFFFFFFFFFFFFFF0A1000248484848532B4026484848480048484848484848004848484848484805000000484848480C0000004848484801010000000000050B000000484848480000000048484848380000004848484800000000FFFFFFFF80510100FFFFFFFF07000000000000000000000000000000000000000000000000000000380024000000000000000000AAAA00000000000000E8150225D49972000000000000000000E8150225D49972FFFFFFFFFFFFFFFFF0000000FFFFFFFF00000000000000000000000000E8150201FFFFFF0000000000000000000000000148484848484848
DynamicInfo REG_BINARY 03000000E099B308DE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3A636302-40F9-4F22-ACFE-2E7578BA308A}
Path REG_SZ \Microsoft\Windows\Media Center\ehDRMInit
Hash REG_BINARY 9B2BFF8825669B3C372748418CC0EB39C719BDAEBCD676CC7B39E1022601A0BF
Triggers REG_BINARY 150000000000000000E72A01386F9672FFFFFFFFFFFFFFFF00E72A01386F967200000000000000000021420248484848E8DDC73B484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005130000004848484800000000484848480000000048484848
DynamicInfo REG_BINARY 03000000406EF30CDE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3E0498FD-B3D2-4D48-B316-0C9F5F4734D2}
Path REG_SZ \Microsoft\Windows\Media Center\InstallPlayReady
Hash REG_BINARY FA87213DE12B497A787F46A1863343D4C9578E30570573918454DF0528610310
Triggers REG_BINARY 150000000000000000E72A01386F9672FFFFFFFFFFFFFFFF00E72A01386F9672000000000000000000054202484848484A08CFB1484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848480000000048484848
DynamicInfo REG_BINARY 0300000000C0EF0DDE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4040E761-8758-4007-B2FE-142B24BF4B16}
Path REG_SZ \Microsoft\Windows\Ras\MobilityManager
Triggers REG_BINARY 150000000000000000D1FF72B8397802000000000000000000D1FF72B8397802FFFFFFFFFFFFFFFF40054202484848484716FF88484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005130000004848484800000000484848480000000048484848CCCC00000000000000D1FF72B8397802000000000000000000D1FF72B8397802FFFFFFFFFFFFFFFF00000000FFFFFFFF0000000000000000000000000000000001000000B49ED2CB95C16F02FA9045EB2A010000000000003C00510075006500720079004C006900730074003E000A00200020002000200020002000200020002000200020002000200020003C00510075006500720079000A00200020002000200020002000200020002000200020002000200020002000200020002000490064003D002200300022000A0020002000200020002000200020002000200020002000200020002000200020002000200050006100740068003D0022004100700070006C00690063006100740069006F006E0022000A002000200020002000200020002000200020002000200020002000200020002000200020003E000A0020002000200020002000200020002000200020002000200020002000200020003C00530065006C00650063007400200050006100740068003D0022004100700070006C00690063006100740069006F006E0022003E002A005B00530079007300740065006D005B00500072006F00760069006400650072005B0040004E0061006D0065003D00270052006100730043006C00690065006E00740027005D00200061006E006400200028004C006500760065006C003D00340020006F00720020004C006500760065006C003D0030002900200061006E006400200028004500760065006E007400490044003D003200300032003800310029005D005D003C002F00530065006C006500630074003E000A00200020002000200020002000200020002000200020002000200020003C002F00510075006500720079003E000A002000200020002000200020002000200020002000200020003C002F00510075006500720079004C006900730074003E0000004848000000000000000000000000000000000000000000000000
DynamicInfo REG_BINARY 0300000047C468133F04CA0100000000000000000000000000000000
Hash REG_BINARY 472F2F6E40D88458D92B946C81BA9225D63C0BD045FBAB63CAEF1904BC35BA73

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{42579F0F-BC71-4569-BC0E-E8EC59233D7F}
Path REG_SZ \Microsoft\Windows\Media Center\ReindexSearchRoot
Hash REG_BINARY 59500DAC2B3DF24DD8EBD096B081796CE15A4D699DE7F05B53C249612F21A974
Triggers REG_BINARY 150000000000000000E72A01386F9672FFFFFFFFFFFFFFFF00E72A01386F967200000000000000000021420248484848E17CF563484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848480000000048484848
DynamicInfo REG_BINARY 03000000A07F260EDE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{48C156B3-F8B9-4765-8A0B-D63A27DFEA0C}
Path REG_SZ \Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector
Hash REG_BINARY 9615D02C18C2E20A2C5D63731D4143F49CD173A5C6E09584EA1A72DC9A6CFF48
Triggers REG_BINARY 150000000000000001156A0100156A010068B69402D0C30100156A0100156A01FFFFFFFFFFFFFFFF52218202484848488ACEFD74484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848480000000048484848DDDD00000000000001156A0100156A010068B69402D0C30100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF02000000020001000000000000016D00010000000000000027000000
DynamicInfo REG_BINARY 0300000080C7A809DE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4A9F54C4-19EE-4D7A-8F08-AB4A477357B5}
Path REG_SZ \{6AB75A7F-54FD-426C-BF30-37BADDC7BDFA}
Hash REG_BINARY A14D124CF21E69750F6EA34874E714B5B41D715044C4FA3025C0DF972280BAAC
Triggers REG_BINARY 1500000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF2821410048484848FBA29099484848480048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848380000004848484858020000100E000080F40300FFFFFFFF070000000000000000000000000000000000000000000000000000007500700000000000000000008888000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000E9B20001006900630065003A00000065000000
DynamicInfo REG_BINARY 03000000D0370D1F774DCE01A0330F1F774DCE010000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4BC3B3F1-E218-43D1-BC20-EE70EDC8BFAC}
Path REG_SZ \Games\UpdateCheck_S-1-5-21-3419578036-40878485-3947204858-1000
Hash REG_BINARY 130FAAFE37A4EF88AA10AAC15DFD85298AC968F67E6E4672259BBC9F606EDF06
Triggers REG_BINARY 1500000000000000000000000000000000000000000000000095D200B895D200FFFFFFFFFFFFFFFF9A21C10248484848033EABDA484848480048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848380000004848484858020000100E000080F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000DDDD0000000000000195D200B895D2000090FF031A4CC80100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF0100000001000000000000000001170201000000201C000027000000AAAA000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF84030000FFFFFFFF00000000000000000000000000E71702010064006C006C002C002D00350030000048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848
DynamicInfo REG_BINARY 0300000020D20170ED6ACE0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4E037E1D-BD9B-4FF6-ACE7-773BF57242C3}
Path REG_SZ \Installation App Launcher
Hash REG_BINARY 56962F77E29A5189BFC1B4D98F3C399C9E41A7648536A23480ABEFD132762358
Triggers REG_BINARY 1500000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF7821410048484848068EF77A484848480048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848380000004848484858020000100E000080F40300FFFFFFFF070000000000000000000000000000000000000000000000000000007400720000000000000000008888000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000E8090101006F00660074002E0063006F006D00
DynamicInfo REG_BINARY 0300000070912B367EFACC0170912B367EFACC010400014000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{50FB5A03-0E1E-48DE-B8A1-BEE9D7D2CD0F}
Path REG_SZ \Microsoft\Windows\User Profile Service\HiveUploadTask
Triggers REG_BINARY 15000000000000000160C1074860C10700406A6006E9C7010060C1074860C107FFFFFFFFFFFFFFFFC2210202484848480C2AD3B9484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000512000000484848480000000048484848380000004848484858020000201C000080F40300FFFFFFFF07000000780000000300000000000000000000000000000000000000750070000000000000000000DDDD0000000000000160C1074860C10700406A6006E9C7010000000000000000000000000000000000000000000000000000000000000000C0A8000000000000FFFFFFFF0000000000000000000000000001BE0701000000100E000024D51800
DynamicInfo REG_BINARY 03000000A8256B133F04CA0100000000000000000000000000000000
Hash REG_BINARY 22735240F634AF52EB496CAC7F58E85D9ED7AF876AD31D5AE4C1F57C234E5728

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{52578FD9-EA43-4338-8D9D-58F15AB940B4}
Path REG_SZ \RealDownloaderRealUpgradeLogonTaskS-1-5-21-3419578036-40878485-3947204858-1000
Hash REG_BINARY 4F33ED67A79152437F013DF6519BFE93BAE13E7DE46C4C9279F9414C91E54775
Triggers REG_BINARY 150000000000000001383701203837018025CCBA4261CE010000000000000000FFFFFFFFFFFFFFFF382141004848484887398E48484848480048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848380000004848484858020000100E000080F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000740069000000000000000000AAAA00000000000001383701203837018025CCBA4261CE010000000000000000FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000E4E301010064006C006C002C002D00350030000048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848
DynamicInfo REG_BINARY 0300000050B12F436461CE01F07F8FCEF46CCE010000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{54E5294C-56F7-4976-AE61-DF4AB6981DFD}
Path REG_SZ \Microsoft\Windows\Media Center\PvrScheduleTask
Hash REG_BINARY 695AC268A441273AAAC43B4C25E863C354D8400FF37237317343CD29A22A2CEF
Triggers REG_BINARY 150000000000000000E72A01386F9672FFFFFFFFFFFFFFFF00E72A01386F9672000000000000000000054202484848483A1B96C3484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005140000004848484800000000484848480000000048484848
DynamicInfo REG_BINARY 03000000A01EB012DE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{56DDB4E5-92C2-40AD-9F91-2E78FA599066}
Path REG_SZ \Microsoft\Windows\Windows Activation Technologies\ValidationTask
Hash REG_BINARY 8D553B340F9D131C6C4BAA654C045EFDCB9ADF9F97CF3EE9997DC985F570EF65
Triggers REG_BINARY 1500000000000000008F5500D08F5500806D4DE6946FCE01008F5500D08F5500FFFFFFFFFFFFFFFFC221C20248484848F2C3147B484848480048484848484848004848484848484805000000484848480C0000004848484801010000000000051300000048484848000000004848484838000000484848482C010000F0200D0000000000FFFFFFFF07000000000000000000000000000000000000000000000000000000200020000000000000000000DDDD000000000000008F5500D08F5500806D4DE6946FCE0100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF010000005A0000000000000000013002010000000000000027000000
DynamicInfo REG_BINARY 03000000A06218AFD172CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5B184694-64C3-4633-94C5-945B3FA561D6}
Path REG_SZ \Microsoft\Windows\WindowsBackup\ConfigNotification
Triggers REG_BINARY 150000000000000001202C01E0202C0100906BDA198ECB0100202C01E0202C01FFFFFFFFFFFFFFFF4821020248484848FF32C16A484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000513000000484848480000000048484848380000004848484800000000FFFFFFFF80F40300FFFFFFFF070000000000000000000000000000000000000000000000000000006F0066000000000000000000DDDD00000000000001202C01E0202C0100906BDA198ECB0100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF01000000010000000000000000011602010000000000000027000000
DynamicInfo REG_BINARY 030000007835F5133F04CA0100000000000000000000000000000000
Hash REG_BINARY 9EE2B2B420322289B37A740278BCAAF92D9DFA6021E9780435F161C4A88809BA

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5C2C622F-70E9-4194-A7DA-033E827365AD}
Path REG_SZ \Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStartTypeChange
Triggers REG_BINARY 150000000000000000D1FF72B8397802000000000000000000D1FF72B8397802FFFFFFFFFFFFFFFF0010C20248484848170F4F6E484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000512000000484848480000000048484848380000004848484800000000FFFFFFFF80F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000CCCC00000000000000D1FF72B8397802000000000000000000D1FF72B8397802FFFFFFFFFFFFFFFF00000000FFFFFFFF0000000000000000000000000000000001000000B49ED2CB95C16F02FA9045EBD3000000000000003C00510075006500720079004C006900730074003E003C00510075006500720079002000490064003D00220030002200200050006100740068003D002200530079007300740065006D0022003E003C00530065006C00650063007400200050006100740068003D002200530079007300740065006D0022003E002A002F00530079007300740065006D002F00500072006F00760069006400650072005B0040004E0061006D0065003D0027005300650072007600690063006500200043006F006E00740072006F006C0020004D0061006E00610067006500720027005D00200061006E00640020002A002F00530079007300740065006D002F004500760065006E007400490044003D00270037003000340030002700200061006E00640020002A002F004500760065006E00740044006100740061002F0044006100740061005B0040004E0061006D0065003D00270070006100720061006D00340027005D003D00270042004600450027003C002F00530065006C006500630074003E003C002F00510075006500720079003E003C002F00510075006500720079004C006900730074003E000000000000000000000000000000000000000000000000000000
DynamicInfo REG_BINARY 03000000D896F7133F04CA0100000000000000000000000000000000
Hash REG_BINARY CD3589987E9B5E1E6B4EEC849A5ADBBEECEA05CB35BB86B07AC66C4029EB0D6D

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5DC72057-73B3-4079-9EAC-90EE4D3B1410}
Path REG_SZ \Microsoft\Windows\Media Center\SqlLiteRecoveryTask
Hash REG_BINARY 0582C3DC8E70BC6FAEEB500EB43EEBB03B2D607B40B61B59C0BC46292F5BE42A
Triggers REG_BINARY 150000000000000000E72A01386F9672FFFFFFFFFFFFFFFF00E72A01386F967200000000000000000005420248484848BB353C89484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005140000004848484800000000484848480000000048484848
DynamicInfo REG_BINARY 0300000040916112DE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5FD7670E-E3FE-4385-9A3E-C0B2D551615C}
Path REG_SZ \Microsoft\Windows\Media Center\ObjectStoreRecoveryTask
Hash REG_BINARY 0D7CE53B5DEDF3BB738E23E6AFCFF4829C8AF0A3B1179EFB42DD3DAFED865833
Triggers REG_BINARY 150000000000000000E72A01386F9672FFFFFFFFFFFFFFFF00E72A01386F967200000000000000000005420248484848073581F7484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005140000004848484800000000484848480000000048484848
DynamicInfo REG_BINARY 03000000E00E2612DE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{60158C7A-6808-42CD-95EE-AFD9A57925DB}
Path REG_SZ \Microsoft\Windows\AppID\PolicyConverter
Triggers REG_BINARY 15000000000000000084FF7201000000FFFFFFFFFFFFFFFF0084FF7201000000000000000000000040110202484848483498017A484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005130000004848484800000000484848480000000048484848
DynamicInfo REG_BINARY 030000003A030D143F04CA0100000000000000000000000000000000
Hash REG_BINARY C645BB8F8D8C5DE3EA7A893D785BD95FC06FA4D7810745FE4E78E392009FFFB8

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6375CC1C-D975-48D2-9CD5-63DB19B10D4A}
Path REG_SZ \Microsoft\Windows\WDI\ResolutionHost
Triggers REG_BINARY 15000000000000000084FF7201000000FFFFFFFFFFFFFFFF0084FF720100000000000000000000000085C003484848489D84F470484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000504000000484848480000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF0A000000000000000000000000000000000000000000000000000000750070000000000000000000
DynamicInfo REG_BINARY 030000003A030D143F04CA0100000000000000000000000000000000
Hash REG_BINARY 7678F283CD528277951D5955D00319DC3E404F5D6AD8E0806B80DC781E7181CA

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{67537D1B-8825-466D-8624-C6BDE55117E2}
Path REG_SZ \Microsoft\Windows\MUI\Mcbuilder
Hash REG_BINARY 9C92087F24BF14895851784B5C6694143D0351907D9A27B38AE8DB65813978BC
Triggers REG_BINARY 1500000000000000000000000000000000000000000000000163F800E863F80000C024BA1856E10148214200484848487EF0381F484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000512000000484848480000000048484848380000004848484858020000100E000080F40300FFFFFFFF070000005802000005000000000000000000000000000000000000007500700000000000000000008888000000000000000000000000000000000000000000000163F800E863F80000C024BA1856E10100000000FFFFFFFF00000000000000000000000000E4BC0101006900630065003A00000065000000
DynamicInfo REG_BINARY 03000000709488CEE1A7CD01709488CEE1A7CD011F13048000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6AEF0C98-2CB4-4B67-8C70-4C977C7355CC}
Path REG_SZ \Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask
Triggers REG_BINARY 15000000000000000113D0079013D0070000F232FACFC3010013D0079013D007FFFFFFFFFFFFFFFF4021820248484848217B8E98484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000514000000484848480000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF070000003C0000000300000000000000000000000000000000000000750070000000000000000000DDDD0000000000000113D0079013D0070000F232FACFC30100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF01000000010000000000000000017802010000000000000024D51800
DynamicInfo REG_BINARY 03000000FBC511143F04CA0100000000000000000000000000000000
Hash REG_BINARY FD59AA8FA7E6D6C681945135C99BCEAC82F3DB23B037253C8DAD1617F5C5E425

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6B7AC694-8D6D-481B-9DD8-2A3A741ADA6D}
Path REG_SZ \Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem
Triggers REG_BINARY 15000000000000000160C1074860C1070030118B3B4CC8010060C1074860C107FFFFFFFFFFFFFFFF4221420248484848D8D9932B484848480048484848484848004848484848484805000000484848480C0000004848484801010000000000051200000048484848000000004848484838000000484848482C010000201C00002C010000FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000DDDD0000000000000160C1074860C1070030118B3B4CC80100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF010000000E000000000000000001EA07010000008070000024D51800
DynamicInfo REG_BINARY 030000003C0E20143F04CA0100000000000000000000000000000000
Hash REG_BINARY 9423B265CBAB426F81672F084E7D9866F685D983B62224712FF0DBC4FFEFE374

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7032A47F-EEA3-458F-88E0-5AE0AA911271}
Path REG_SZ \RealDownloaderDownloaderScheduledTaskS-1-5-21-3419578036-40878485-3947204858-1000
Hash REG_BINARY 77801E573760E051412558FA3438335C53D8116400F308315EDFA6719AF34602
Triggers REG_BINARY 15000000000000000101C202F001C202800529299743CE010001C202F001C202FFFFFFFFFFFFFFFF382141004848484813070780484848480048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848380000004848484858020000100E000080F40300FFFFFFFF070000000000000000000000000000000000000000000000000000002E0045000000000000000000DDDD0000000000000101C202F001C202800529299743CE0100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF010000000A0000000000000000019001010000000000000027000000
DynamicInfo REG_BINARY 03000000E0E2BFB0B843CE01D0C4E8F8026BCE010000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{731E9C62-95B5-4C8C-AB64-4CC591C9FF5B}
Path REG_SZ \Microsoft\Windows\RemoteAssistance\RemoteAssistanceTask
Triggers REG_BINARY 150000000000000000D1FF72882AF909000000000000000000D1FF72882AF909FFFFFFFFFFFFFFFF2811C2034848484866D894B3484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000512000000484848480000000048484848380000004848484858020000100E000080F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000CCCC00000000000000D1FF72882AF909000000000000000000D1FF72882AF909FFFFFFFFFFFFFFFF0F000000FFFFFFFF0000000000000000000000000000000001000000B49ED2CB95C16F02FA9045EBA5000000000000003C00510075006500720079004C006900730074003E003C00510075006500720079002000490064003D00220030002200200050006100740068003D002200530079007300740065006D0022003E003C00530065006C00650063007400200050006100740068003D002200530079007300740065006D0022003E002A005B00530079007300740065006D005B00500072006F00760069006400650072005B0040004E0061006D0065003D0027004D006900630072006F0073006F00660074002D00570069006E0064006F00770073002D00470072006F007500700050006F006C0069006300790027005D00200061006E00640020004500760065006E007400490044003D0031003500300032005D005D003C002F00530065006C006500630074003E003C002F00510075006500720079003E003C002F00510075006500720079004C006900730074003E00000048484848000000000000000000000000000000000000000000000000888800000000000000D1FF72882AF909000000000000000000D1FF72882AF909FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000000000014D454D4000000014D518009831BC07
DynamicInfo REG_BINARY 03000000806141143F04CA0100000000000000000000000000000000
Hash REG_BINARY 40F4A1B4CBF346720B7A186AAE912FCEA1FBE0DD82F48F51FCB9AD1A76BF2525

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{73259F86-29D6-42FF-B1E7-634F6E40D4F8}
Path REG_SZ \Microsoft\Windows\CertificateServicesClient\UserTask-Roam
Triggers REG_BINARY 1500000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF908500024848484824A4C7D0484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000504000000484848480000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF070000003C00000005000000000000000000000000000000000000007500700000000000000000007777000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000E95F000101000000000003000000005C005300070000001835370101484848484848487777000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000E95F000100080009001E00000000000000000008000000010000000148484848484848
DynamicInfo REG_BINARY 03000000A18548143F04CA0100000000000000000000000000000000
Hash REG_BINARY F2CE6AB8C22DCF1780141867455A46FA6D08F08C5B5D482002372E5FDE059B43

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7373E2BE-7F47-4F61-85C5-9F495F60F337}
Path REG_SZ \GoogleUpdateTaskUserS-1-5-21-3419578036-40878485-3947204858-1000Core
Hash REG_BINARY 5493AF49F607F7E53BBE955232853AF472B53D0044C2F07476B04EEE71B5B107
Triggers REG_BINARY 1500000000000000014543013845430100D82673E84DCE010045430138454301FFFFFFFFFFFFFFFF0021610148484848E426C9FF484848480048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848380000004848484858020000100E000000000000FFFFFFFF05000000000000000000000000000000000000000000000000000000750070000000000000000000DDDD000000000000014543013845430100D82673E84DCE0100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF0100000001000000000000000001B001010000000000000027000000
DynamicInfo REG_BINARY 03000000B028B0EF1373CC01B02E449CC168CE010000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{77CAF46C-AF8A-4BA3-B9F4-277A6FD47342}
Path REG_SZ \Microsoft\Windows\Media Center\PBDADiscovery
Hash REG_BINARY FD760AB16D2846C5BFB23557934499A525D5FCEC624AD083FD21DDE1326FAE9D
Triggers REG_BINARY 150000000000000000E72A01386F9672FFFFFFFFFFFFFFFF00E72A01386F9672000000000000000000214202484848484AC29224484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848480000000048484848
DynamicInfo REG_BINARY 030000006050880CDE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{785021A7-191F-4571-A974-8E7144DE9A5A}
Path REG_SZ \Microsoft\Windows\SideShow\SystemDataProviders
Hash REG_BINARY 8DFB2AAA49E262BC3CA3901D44152079D55567AAA637743E01E34DF36A5FB4C7
Triggers REG_BINARY 1500000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF002102024848484888275990484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000513000000484848480000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF070000000000000000000000000000000000000000000000000000006B0044000000000000000000AAAA000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF1E000000FFFFFFFF00000000000000000000000000E6A70001FFFFFF0200000002000100000000000148484848484848
DynamicInfo REG_BINARY 0300000080407A0ADE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{786A15E9-49DF-4638-B9C8-81EFEC13828B}
Path REG_SZ \Microsoft\Windows\WindowsBackup\AutomaticBackup
Hash REG_BINARY CF737A26FE36A26297E01F79C7B88CE133036D7B0B2EE5FBBFC86D6FA07945BC
Triggers REG_BINARY 1500000000000000012D3A01982D3A0100F80FFEEFFECC01002D3A01982D3A01FFFFFFFFFFFFFFFF4005420148484848CC2B58B8484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000512000000484848480000000048484848380000004848484858020000100E000080F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000DDDD000000000000012D3A01982D3A0100F80FFEEFFECC0100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF02000000010001000000000000013802010000000000000027000000
DynamicInfo REG_BINARY 030000001C88C6C78DDFCC0100D8633AE56ACE010000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{797CEE52-0431-47F4-BFE9-583EA4BE4811}
Path REG_SZ \Microsoft\Windows\MobilePC\HotStart
Hash REG_BINARY 0651BF3B9923F80BE8B50E253E843A95B0CFB7EB97A3EE4E7C955B543DD190E9
Triggers REG_BINARY 150000000000000000E42A0125D49972000000000000000000E42A0125D49972FFFFFFFFFFFFFFFF40854002484848487E9B658C484848480048484848484848004848484848484805000000484848480C0000004848484801010000000000050B000000484848480000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF0700000000000000000000000000000000000000000000000000000075006E000000000000000000AAAA00000000000000E42A0125D49972000000000000000000E42A0125D49972FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000E42A0101006800440052004D0049006E0069000148484848484848
DynamicInfo REG_BINARY 0300000040CE540FDE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7D3C7871-A917-4EF0-82E8-5F0A96423051}
Path REG_SZ \Microsoft\Windows\Bluetooth\UninstallDeviceTask
Triggers REG_BINARY 15000000000000000084FF7201000000FFFFFFFFFFFFFFFF0084FF7201000000000000000000000010054202484848480D99DFD7484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848480000000048484848
DynamicInfo REG_BINARY 0300000001E74A143F04CA0100000000000000000000000000000000
Hash REG_BINARY 90A6903C079DE796E0B72C7C3B740EA1AD655883DF0AC5468E3EB70311B7E7F7

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7EA27148-16CB-425B-A81A-6022AFA3709E}
Path REG_SZ \Microsoft\Windows\SideShow\GadgetManager
Hash REG_BINARY 2B16A83D35908A64E898F2743328C16CBC44DE6C67AF392D6B0F19AE00829A72
Triggers REG_BINARY 150000000000000000E42A0125D49972000000000000000000E42A0125D49972FFFFFFFFFFFFFFFF009140024848484863DEF7F2484848480048484848484848004848484848484804000000484848481000000048484848010200000000000520000000210200000000000048484848380000004848484800000000FFFFFFFF80F40300FFFFFFFF070000000000000000000000000000000000000000000000000000005C0053000000000000000000AAAA00000000000000E42A0125D49972000000000000000000E42A0125D49972FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000E42A010000650072006900650073003E0066000148484848484848
DynamicInfo REG_BINARY 03000000407C500BDE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{805601B5-161B-4F6E-9A0D-49C1907198B6}
Path REG_SZ \Microsoft\Windows\Media Center\UpdateRecordPath
Hash REG_BINARY EB28225E5ADAD1323F85643ABEC315B0F6F9F15D232F4DA9D56085F77D31388C
Triggers REG_BINARY 150000000000000000E72A01386F9672FFFFFFFFFFFFFFFF00E72A01386F9672000000000000000000214202484848482E977B9B484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848480000000048484848
DynamicInfo REG_BINARY 0300000080CC270DDE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8905ECD8-016F-4DC2-90E6-A5F1FA6A841A}
Path REG_SZ \Microsoft\Windows\Active Directory Rights Management Services Client\AD RMS Rights Policy Template Management (Automated)
Triggers REG_BINARY 150000000000000000D1FF7228F6BE0700000000000000000060C1074860C107FFFFFFFFFFFFFFFFC8850002484848484F482AB2484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000100000000484848480000000048484848380000004848484858020000100E0000100E0000FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000DDDD0000000000000160C1074860C10700781825AB03C70100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF0100000001000000000000000001BE0701000000100E000024D51800AAAA00000000000000D1FF7228F6BE07000000000000000000D1FF7228F6BE07FFFFFFFFFFFFFFFF100E0000FFFFFFFF00000000000000000000000000000000010000001984C2CB4C4D454D480000000148484848484848
DynamicInfo REG_BINARY 030000000C1C7D123F04CA0100000000000000000000000000000000
Hash REG_BINARY 5FEA8C5D590E391F05DC6BF182EE76FA80BE1EC03C9F02439F1A619A1D371CBB

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8DE64D1B-40FE-4836-BDB4-5F69F69E999A}
Path REG_SZ \Microsoft\Windows\Media Center\RecordingRestart
Hash REG_BINARY F5FE5470249EA95DE2CB01D9FA910FB31957ED0FB0F9E03208A37081A057AA08
Triggers REG_BINARY 150000000000000000E42A0125D49972000000000000000000E42A0125D49972FFFFFFFFFFFFFFFF60050202484848483E01CFAF484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000514000000484848480000000048484848380000004848484800000000FFFFFFFF80F40300FFFFFFFF06000000000000000000000000000000000000000000000000000000380024000000000000000000FFFF00000000000000E42A0125D49972000000000000000000E42A0125D49972FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000E42A0101006100720074000000690074000000
DynamicInfo REG_BINARY 03000000E0A3B10FDE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{920124A8-6DED-46FB-92DF-4C3288A17E24}
Path REG_SZ \Microsoft\Windows\WindowsBackup\Windows Backup Monitor
Hash REG_BINARY 9F4E5740CF2651CC44B37A21368259C0CE9C1C4140F9A174794CBB650867751B
Triggers REG_BINARY 150000000000000000000000000000000000000000000000002D3A01982D3A01FFFFFFFFFFFFFFFF40A14003484848484D5A71524848484800484848484848480048484848484848040000004848484810000000484848480102000000000005200000002102000000000000484848480000000048484848DDDD000000000000012D3A01982D3A0100901E77C886C50100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF01000000010000000000000000013802010000000000000027000000AAAA000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF2C010000FFFFFFFF00000000000000000000000000E43802010065002C002D00320031003900340001484848484848487777000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF2C010000FFFFFFFF00000000000000000000000000E438020100120001010000000000050B00000008000000000000050148484848484848
DynamicInfo REG_BINARY 03000000DC136CC78DDFCC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9334C323-F100-4656-9BA0-E4AA69C0F9C2}
Path REG_SZ \Microsoft\Windows\SystemRestore\SR
Triggers REG_BINARY 150000000000000000D1FF72C0FD700A0000000000000000005ADA09B05ADA09FFFFFFFFFFFFFFFF5221420248484848EDD0741F484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848483800000048484848580200007043010080F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000DDDD000000000000015ADA09B05ADA090080E1017470C50100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF010000000100000000000000000176020100000000000000D0D21800FFFF00000000000000D1FF72C0FD700A000000000000000000D1FF72C0FD700AFFFFFFFFFFFFFFFF08070000FFFFFFFF00000000000000000000000000000000014D454D4000000014D51800E84B5E0A
DynamicInfo REG_BINARY 03000000CBD36E123F04CA0100000000000000000000000000000000
Hash REG_BINARY A2281A82814B04BF0AE2441991C482C4859EA3BFF19E695D72CDF0B8E25A481C

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9B75C702-EA13-406A-BADB-6C588EE4375B}
Path REG_SZ \Microsoft\Windows\CertificateServicesClient\SystemTask
Triggers REG_BINARY 150000000000000000D1FF7228F6BE07000000000000000000D1FF7228F6BE07FFFFFFFFFFFFFFFFC0054202484848484E9F42CE484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000512000000484848480000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF070000003C0000000500000000000000000000000000000000000000750070000000000000000000CCCC00000000000000D1FF7228F6BE07000000000000000000D1FF7228F6BE07FFFFFFFFFFFFFFFF00000000FFFFFFFF0000000000000000000000000000000001000000B49ED2CB95C16F02FA9045EB1B010000000000003C00510075006500720079004C006900730074003E000A0020002000200020002000200020002000200020002000200020002000200020003C00510075006500720079002000490064003D00220030002200200050006100740068003D002200530079007300740065006D0022003E000A00200020002000200020002000200020002000200020002000200020002000200020002000200020003C00530065006C00650063007400200050006100740068003D002200530079007300740065006D0022003E000A002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002A005B00530079007300740065006D005B00500072006F00760069006400650072005B0040004E0061006D0065003D0027004D006900630072006F0073006F00660074002D00570069006E0064006F00770073002D00470072006F007500700050006F006C0069006300790027005D00200061006E00640020004500760065006E007400490044003D0031003500300032005D005D000A00200020002000200020002000200020002000200020002000200020002000200020002000200020003C002F00530065006C006500630074003E000A0020002000200020002000200020002000200020002000200020002000200020003C002F00510075006500720079003E000A0020002000200020002000200020002000200020002000200020002000200020003C002F00510075006500720079004C006900730074003E000000000000000000000000000000000000000000000000000000888800000000000000D1FF7228F6BE07000000000000000000D1FF7228F6BE07FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000000000010074006F0072000000000000000000FFFF00000000000000D1FF7228F6BE07000000000000000000D1FF7228F6BE07FFFFFFFFFFFFFFFF0A000000FFFFFFFF807000000000000000000000000000000100000000006E006700650029000000
DynamicInfo REG_BINARY 030000008B9673123F04CA0100000000000000000000000000000000
Hash REG_BINARY 5F1741F0E3673AEE6B7D983CDB718C34640A8C20B8D2F627B7AA491C12F16358

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9B849445-CF41-4195-AF4C-745EEE7F9D05}
Path REG_SZ \Microsoft\Windows\Media Center\MediaCenterRecoveryTask
Hash REG_BINARY EB514214B7FD8BCDF44B13E01117537348E099E5CC33A15A470C6C60FE50467D
Triggers REG_BINARY 150000000000000000E72A01386F9672FFFFFFFFFFFFFFFF00E72A01386F96720000000000000000000542024848484868DEB374484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848480000000048484848
DynamicInfo REG_BINARY 0300000020D00513DE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9EFACBE6-A797-4905-A0C6-014CD3000DBB}
Path REG_SZ \Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask
Triggers REG_BINARY 15000000000000000160C1074860C107002C7103E30BC9010060C1074860C107FFFFFFFFFFFFFFFF5221C20248484848D3FA1AB0484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005130000004848484800000000484848483800000048484848B400000010EF000080F40300FFFFFFFF070000008C0A00000100000000000000000000000000000000000000750070000000800000000000DDDD0000000000000160C1074860C107002C7103E30BC90100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF0200000001001000000000000001BE07010000000000000024D51800
DynamicInfo REG_BINARY 03000000220B52143F04CA0100000000000000000000000000000000
Hash REG_BINARY AEB03F1BC169236F2C3BF019F9D9ED3C213D1E4A568F8C67F1FC3F2EC08649A6

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9F54B95F-5096-4803-AE61-E9B3AC5B616D}
Path REG_SZ \Microsoft\Windows\MemoryDiagnostic\DecompressionFailureDetector
Triggers REG_BINARY 150000000000000000D1FF7228F6BE07000000000000000000D1FF7228F6BE07FFFFFFFFFFFFFFFF00A0C00248484848AA4E8B9D4848484800484848484848480048484848484848040000004848484810000000484848480102000000000005200000002102000000000000484848480000000048484848CCCC00000000000000D1FF7228F6BE07000000000000000000D1FF7228F6BE07FFFFFFFFFFFFFFFF00000000FFFFFFFF0000000000000000000000000000000001000000B49ED2CB95C16F02FA9045EBF4000000000000003C00510075006500720079004C006900730074003E003C00510075006500720079002000490064003D00220030002200200050006100740068003D0022004D006900630072006F0073006F00660074002D00570069006E0064006F00770073002D004B00650072006E0065006C002D00530074006F00720065004D00670072002F004F007000650072006100740069006F006E0061006C0022003E003C00530065006C00650063007400200050006100740068003D0022004D006900630072006F0073006F00660074002D00570069006E0064006F00770073002D004B00650072006E0065006C002D00530074006F00720065004D00670072002F004F007000650072006100740069006F006E0061006C0022003E002A005B00530079007300740065006D005B00500072006F00760069006400650072005B0040004E0061006D0065003D0027004D006900630072006F0073006F00660074002D00570069006E0064006F00770073002D004B00650072006E0065006C002D00530074006F00720065004D006700720027005D00200061006E00640020004500760065006E007400490044003D0036005D005D003C002F00530065006C006500630074003E003C002F00510075006500720079003E003C002F00510075006500720079004C006900730074003E000000484848484848000000000000000000000000000000000000000000000000
DynamicInfo REG_BINARY 03000000E3CD56143F04CA0100000000000000000000000000000000
Hash REG_BINARY CBB12F1ED12986181801A365A6F75001D31D2BB3CF7441BA8541894267D4CC42

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A1CFA52F-06F2-418D-ADDB-CD6456D66F43}
Path REG_SZ \Microsoft\Windows\RAC\RacTask
Triggers REG_BINARY 150000000000000000D1FF72882AF909000000000000000000D1FF72882AF909FFFFFFFFFFFFFFFF4021C20248484848E9C5E87D484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000513000000484848480000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000CCCC00000000000000D1FF72882AF909000000000000000000D1FF72882AF909FFFFFFFFFFFFFFFF00000000FFFFFFFF0000000000000000000000000000000001000000B49ED2CB95C16F02FA9045EBA8000000000000003C00510075006500720079004C006900730074003E003C00510075006500720079002000490064003D00220030002200200050006100740068003D0022004100700070006C00690063006100740069006F006E0022003E003C00530065006C00650063007400200050006100740068003D0022004100700070006C00690063006100740069006F006E0022003E002A005B00530079007300740065006D005B00500072006F00760069006400650072005B0040004E0061006D0065003D0027004D006900630072006F0073006F00660074002D00570069006E0064006F00770073002D00430045004900500027005D00200061006E00640020004500760065006E007400490044003D0031003000300037005D005D003C002F00530065006C006500630074003E003C002F00510075006500720079003E003C002F00510075006500720079004C006900730074003E000000484848484848000000000000000000000000000000000000000000000000DDDD0000000000000052DA092052DA090040A429C292C8010000000000000000000000000000000000000000000000000000000000000000100E000000000000FFFFFFFF000000000000000000000000000176020100000084030000D0D21800
DynamicInfo REG_BINARY 03000000272178143F04CA0100000000000000000000000000000000
Hash REG_BINARY E59879E1FF87CB7D11142664C919E0ADF61F5A9687D697C3F1C204FA4C56E303

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A2CFB6F3-B3AE-4971-8E29-C415BE22D2E5}
Path REG_SZ \Microsoft\Windows\Maintenance\WinSAT
Triggers REG_BINARY 150000000000000001E7500108E7500100283BA2114CC80100E7500108E75001FFFFFFFFFFFFFFFF3AA1400348484848D47E7A60484848480048484848484848004848484848484804000000484848481000000048484848010200000000000520000000200200000000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF070000000000000000000000000000000000000000000000000000008C1300000000000000000000DDDD00000000000001E7500108E7500100283BA2114CC80100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF02000000010001000000000000014501010000000000000027000000
DynamicInfo REG_BINARY 0300000047457F143F04CA0100000000000000000000000000000000
Hash REG_BINARY 9B40054FDFC971DD00551EA1F0551CC9B99C1E3823CA4BAC180DF0AA81AD3EB1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A316E645-1C56-45A6-BD6A-7DCA79778090}
Path REG_SZ \Microsoft\Windows\Customer Experience Improvement Program\UsbCeip
Triggers REG_BINARY 15000000000000000160C1074860C107009C9EE073A6C8010060C1074860C107FFFFFFFFFFFFFFFF7021C2024848484863251B5D484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000513000000484848480000000048484848380000004848484800000000FFFFFFFF80F40300FFFFFFFF070000008C0A00000100000000000000000000000000000000000000750070000000000000000000DDDD0000000000000160C1074860C107009C9EE073A6C80100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF0100000003000000000000000001EA07010000000000000024D51800
DynamicInfo REG_BINARY 03000000686986143F04CA0100000000000000000000000000000000
Hash REG_BINARY AE1862BA409924248DC1736D23E327B7154018FC40A4DA695BC777D1135A5244

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A6394592-54CE-4E93-8D64-1A068F462632}
Path REG_SZ \Microsoft\Windows\Customer Experience Improvement Program\Consolidator
Triggers REG_BINARY 1500000000000000014DDA09D84DDA0900C05B5DC3D0C301004DDA09D84DDA09FFFFFFFFFFFFFFFF4021420248484848F3FE730B484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848480000000048484848DDDD000000000000014DDA09D84DDA0900C05B5DC3D0C3010000000000000000000000000000000000000000000000000000000000000000300B010000000000FFFFFFFF0000000000000000000000000001F9090100000000000000D0D21800
DDDC519


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

DynamicInfo REG_BINARY 03000000292C8B143F04CA0100000000000000000000000000000000
Hash REG_BINARY 555CD377BA0A0532A5630EBE96AE9DB1843E642B2A15BA07C40C8B67BE00E87F

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A69D6C6D-0E2F-448A-9BEA-9F24B4F35C0D}
Path REG_SZ \{3D55F34C-0976-4C05-9756-277FE8258D6E}
Hash REG_BINARY AFF667112D35F5EB2E54C59816CD275CA86F48AD887E6B204267ABDB731537A0
Triggers REG_BINARY 1500000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF28214100484848482AE51207484848480048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848380000004848484858020000100E000080F40300FFFFFFFF070000000000000000000000000000000000000000000000000000007500700000000000000000008888000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000E6BE0101006B00200076006500720073006900
DynamicInfo REG_BINARY 030000000062EAE66131CE0110FAECE66131CE010000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AA903F78-7508-4DDC-8993-E148D2C21489}
Path REG_SZ \Microsoft\Windows\Media Center\mcupdate
Hash REG_BINARY D23B7887DFD927FA2B59E80B7E060FA80CAAA1E83153B4053EF49F210FFA35C6
Triggers REG_BINARY 150000000000000000E72A01386F9672FFFFFFFFFFFFFFFF00E72A01386F967200000000000000006005420248484848A548697F484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000514000000484848480000000048484848380000004848484800000000FFFFFFFF80F40300FFFFFFFF06000000000000000000000000000000000000000000000000000000380024000000000000000000
DynamicInfo REG_BINARY 03000000A084A511DE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AB771A9F-FB0F-4FA1-8B5F-48186615901E}
Path REG_SZ \Microsoft\Windows\WindowsColorSystem\Calibration Loader
Triggers REG_BINARY 1500000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF0091000248484848A34B56BE484848480048484848484848004848484848484804000000484848481000000048484848010200000000000520000000210200000000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000AAAA000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000E95F0001000000660074004C4D454D4800000001484848484848487777000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000E95F0001007300740065006D00330032005C00010000006E0074000148484848484848
DynamicInfo REG_BINARY 030000004E648B123F04CA0100000000000000000000000000000000
Hash REG_BINARY 1C5E72CB821B89108191AC5B7FD3157B5CCE0474EDD44C9D1CEC819787F288AB

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AC93A5CA-2DFF-4FB7-9B95-FB62B744B4F9}
Path REG_SZ \Microsoft\Windows\Offline Files\Background Synchronization
Hash REG_BINARY AD7A12177D6040123220F9C762C3CEAC067CB60199D9BA539F02CC27DDAB61DA
Triggers REG_BINARY 150000000000000001E73B0298E73B0200C07640094CC80100E73B0298E73B02FFFFFFFFFFFFFFFFC8A1000248484848F33EE4E3484848480048484848484848004848484848484805000000484848480C0000004848484801010000000000050B000000484848480000000048484848380000004848484800000000FFFFFFFF80510100FFFFFFFF07000000000000000000000000000000000000000000000000000000500037000000000000000000DDDD00000000000001E73B0298E73B0200C07640094CC80100000000000000000000000000000000000000000000000000000000000000006054000000000000FFFFFFFF00000000000000000000000000012A0201000000100E000019000000
DynamicInfo REG_BINARY 0300000060DD4A08DE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{ACA66235-9BFB-440E-9BF9-CDF4DD587C2D}
Path REG_SZ \RealUpgradeScheduledTaskS-1-5-21-3419578036-40878485-3947204858-1000
Hash REG_BINARY 93FF61B2DF148E1484EA7E7C459FB7646E6D19CFE110ACF407238153F69F0061
Triggers REG_BINARY 1500000000000000011B5501881B55018062C70A4E32CE01001B5501881B5501FFFFFFFFFFFFFFFF38214100484848485D6F524D484848480048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848380000004848484858020000100E000080F40300FFFFFFFF070000000000000000000000000000000000000000000000000000002E0045000000000000000000DDDD000000000000011B5501881B55018062C70A4E32CE0100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF0100000007000000000000000001BA04010000000000000027000000
DynamicInfo REG_BINARY 03000000A0FB78926F32CE01B07AC32A7169CE010000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AE77AC7B-43C9-445B-85CA-5265F02A6F85}
Path REG_SZ \GoogleUpdateTaskUserS-1-5-21-3419578036-40878485-3947204858-1000UA
Hash REG_BINARY C5A8C043FCF78CF974D16B6F3C427B52AFD47B406753B088BF6073F50B5B69B9
Triggers REG_BINARY 1500000000000000014543013845430100D82673E84DCE010045430138454301FFFFFFFFFFFFFFFF0021610148484848EA6C5EAD484848480048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848380000004848484858020000100E000000000000FFFFFFFF05000000000000000000000000000000000000000000000000000000750070000000000000000000DDDD000000000000014543013845430100D82673E84DCE010000000000000000000000000000000000000000000000000000000000000000100E000080510100FFFFFFFF01000000010000000000000000014402010000000000000027000000
DynamicInfo REG_BINARY 03000000E0F20AF01373CC0130985FEE3D6DCE010000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B13CBDFD-B8EE-432D-8AA8-A3C932D48251}
Path REG_SZ \WPD\SqmUpload_S-1-5-21-3419578036-40878485-3947204858-1000
Hash REG_BINARY F685FF2A8708765E062F6123F225D2B1308D249A33F194CC57F398A2A7BC713D
Triggers REG_BINARY 150000000000000001169A0028169A0000A0ABD56D4CC80101169A0028169A000080D8FCAD84D001D221C10248484848C0F98A99484848480048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C004200000048483800000048484848580200007043010084030000FFFFFFFF070000000000000000000000000000000000000000000000000000003C0050000000000000000000DDDD00000000000001169A0028169A0000A0ABD56D4CC80101169A0028169A000080D8FCAD84D001000000000000000000000000000000000000000000000000FFFFFFFF0100000001000000000000000001590201000000100E000027000000
DynamicInfo REG_BINARY 030000006052314CD973CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B5603D2E-7C83-4D83-96B7-73784F770E59}
Path REG_SZ \RealUpgradeLogonTaskS-1-5-21-3419578036-40878485-3947204858-1000
Hash REG_BINARY 539004E2F5032DCB08CAA2AF69364F300C86D787860FE5AF56145D3A54B57740
Triggers REG_BINARY 1500000000000000011B5501881B550100F95F0B4E32CE010000000000000000FFFFFFFFFFFFFFFF38214100484848481E72745F484848480048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848380000004848484858020000100E000080F40300FFFFFFFF070000000000000000000000000000000000000000000000000000002E0045000000000000000000AAAA000000000000011B5501881B550100F95F0B4E32CE010000000000000000FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000E8BA0401006900630065004100700069002E000048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848
DynamicInfo REG_BINARY 0300000060DFB6926F32CE01F07F8FCEF46CCE010000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B64A7A08-90B1-4383-8787-DEF924D6F6B2}
Path REG_SZ \Microsoft\Windows\Media Center\DispatchRecoveryTasks
Hash REG_BINARY 780DBABA615FA679F8133BE59B1A9F73B11E21DD466C8D144DF62612262EB80D
Triggers REG_BINARY 150000000000000000EA1F01386F1673FFFFFFFFFFFFFFFF00EA1F01386F167300000000000000000805420248484848FC88CFDD484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000512000000484848480000000048484848380000004848484800000000FFFFFFFF80F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000FFFFFFFF0000000000000000
DynamicInfo REG_BINARY 030000004076BC0EDE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B9A6DE44-D4C9-4D49-B5B0-820535CB3474}
Path REG_SZ \Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver
Hash REG_BINARY AC67DF7A4B9D1C8713C2D62FD8685113FB7749DE03811F77BBC4B4B06B74C2DA
Triggers REG_BINARY 150000000000000000E42A0125D49972000000000000000000E42A0125D49972FFFFFFFFFFFFFFFF00858003484848481FCACD844848484800484848484848480048484848484848040000004848484810000000484848480102000000000005200000002102000000000000484848480000000048484848AAAA00000000000000E42A0125D49972000000000000000000E42A0125D49972FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000E42A0101FFFFFF0200000002000100000000000148484848484848
DynamicInfo REG_BINARY 03000000E05F0A0ADE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B9BEE219-C29E-4310-819C-147A5A0E045E}
Path REG_SZ \Microsoft\Windows\Defrag\ScheduledDefrag
Triggers REG_BINARY 15000000000000000115E200B015E20000E8E6379DEFC4010015E200B015E200FFFFFFFFFFFFFFFF7E21420348484848A54D405E484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848483800000048484848B4000000803A090080F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000DDDD0000000000000115E200B015E20000E8E6379DEFC40100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF02000000010008000000000000018D0301000000201C000027000000
DynamicInfo REG_BINARY 03000000898D8D143F04CA0100000000000000000000000000000000
Hash REG_BINARY 70467C89670B100089D923FD427DBE7E91C2E93EFDA227539CF2601E2BCE1BF8

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BBA67AD0-4BA0-4B44-827B-FF419B70C057}
Path REG_SZ \Microsoft\Windows\Multimedia\SystemSoundsService
Triggers REG_BINARY 150000000000000000D1FF72882AF909000000000000000000D1FF72882AF909FFFFFFFFFFFFFFFF00854002484848489D3512E9484848480048484848484848004848484848484804000000484848481000000048484848010200000000000520000000210200000000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000AAAA00000000000000D1FF72882AF909000000000000000000D1FF72882AF909FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000D2180001000000660074004C4D454D480000000148484848484848
DynamicInfo REG_BINARY 03000000AEC58D123F04CA0100000000000000000000000000000000
Hash REG_BINARY FD7B51B9FB6DDD39374C586690F9E934EE65EB22FD61531B5408B20591031CE2

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BBEF5F6B-6562-4B59-80BB-E2FAF4EF8A24}
Path REG_SZ \Microsoft\Windows\SideShow\AutoWake
Hash REG_BINARY F1F3647B90EF320699C2A4CC877553D0AF5FBC91CCA73EC5D21D2C69ABA97BE7
Triggers REG_BINARY 150000000000000000E42A0125D49972000000000000000000E42A0125D49972FFFFFFFFFFFFFFFF00210202484848481CE1E052484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000513000000484848480000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF070000000000000000000000000000000000000000000000000000006B0044000000000000000000AAAA00000000000000E42A0125D49972000000000000000000E42A0125D49972FFFFFFFFFFFFFFFF3C000000FFFFFFFF00000000000000000000000000E42A0101FFFFFF0200000002000100000000000148484848484848
DynamicInfo REG_BINARY 0300000000E7BC0ADE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BFB012CF-548D-47D9-B5A2-9A60E815E667}
Path REG_SZ \Microsoft\Windows\SideShow\SessionAgent
Hash REG_BINARY DBC065695455F16521C1F2CCB4FBA71757C53FC6D38C9B87FE41BF26F286E159
Triggers REG_BINARY 1500000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF00850002484848483D09F37D484848480048484848484848004848484848484804000000484848481000000048484848010200000000000520000000210200000000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF07000000000000000000000000000000000000000000000000000000380024000000000000000000AAAA000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF0F000000FFFFFFFF00000000000000000000000000E9750001FFFFFF0200000002000100000000000148484848484848
DynamicInfo REG_BINARY 0300000060740B0BDE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C170367D-B924-4681-B98A-B114AC8E79E2}
Path REG_SZ \RealPlayerRealUpgradeScheduledTaskS-1-5-21-3419578036-40878485-3947204858-1000
Hash REG_BINARY 770ED17B0CD799D8BB30321D75C99E53D8B88FCF762ED46C2EB2088A7F72F566
Triggers REG_BINARY 150000000000000001962D01E8962D010038E8B70962CE0100962D01E8962D01FFFFFFFFFFFFFFFF382141004848484821215D86484848480048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848380000004848484858020000100E000080F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000DDDD00000000000001962D01E8962D010038E8B70962CE0100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF01000000070000000000000000014301010000000000000027000000
DynamicInfo REG_BINARY 0300000040A28D412B62CE01C038C2902B6DCE010000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C4D4E8D5-0D6D-42DD-83DA-68372255EAF7}
Path REG_SZ \Microsoft\Windows\Windows Activation Technologies\ValidationTaskDeadline
Hash REG_BINARY 3EAA52B7638B9C4D7880188441C081DFDE963236F4C5B27B5F59E9480EE7614B
Triggers REG_BINARY 1500000000000000008F5500D08F550080ED6E8E7077CE01008F5500D08F5500FFFFFFFFFFFFFFFFC821C20248484848103B0105484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000513000000484848480000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF070000000000000000000000000000000000000000000000000000002E0045000000000000000000DDDD000000000000008F5500D08F550080ED6E8E7077CE0100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF010000005A000000000000000001AA00010000000000000027000000
DynamicInfo REG_BINARY 03000000C0A758AFD172CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C6859845-4A2B-4EA4-BC5F-BCA3177BFF4A}
Path REG_SZ \Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Hash REG_BINARY 7C90BE8C4E068C3354BE8729C025D9F6D559F10FD57CCCD0065B51D0BCADC08E
Triggers REG_BINARY 15000000000000000000000000000000000000000000000000219100E0219100FFFFFFFFFFFFFFFFF8A14000484848480E0907C6484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000504000000484848480000000048484848380000004848484858020000100E0000100E0000FFFFFFFF07000000100E00000100000000000000000000000000000000000000200020000000000000000000DDDD00000000000001219100E021910000638F4726C9CA0100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF0100000007000000000000000001240101000000803A090027000000AAAA000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF84030000FFFFFFFF00000000000000000000000000E824010100650068006F006D0065005C0065000148484848484848
DynamicInfo REG_BINARY 03000000C0C3A5C8A373CC019017C5E6F66CCE010000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C6EB10A8-9963-4D96-B5A4-83000DC797DE}
Path REG_SZ \Apple\AppleSoftwareUpdate
Hash REG_BINARY 4EC97C6CBB0566A159C5D69FB8400A9C039BDA2BB3626BAB086A8FA7B5D3BF74
Triggers REG_BINARY 15000000000000000123650198236501006E2B2EDE99CD010023650198236501FFFFFFFFFFFFFFFF78A1400048484848CB9D1CB6484848480048484848484848004848484848484804000000484848481000000048484848010200000000000520000000210200000000000048484848380000004848484858020000100E000080F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000200020000000000000000000DDDD0000000000000123650198236501006E2B2EDE99CD0100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF02000000010004000000000000018301010000000000000027000000
DynamicInfo REG_BINARY 03000000A0C6B7685699CD0120E4051C986CCE010000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C90440A0-6D8F-423F-8F42-83EEF05CE708}
Path REG_SZ \Microsoft\Windows\AppID\VerifiedPublisherCertStoreCheck
Triggers REG_BINARY 150000000000000000D1FF72409CEA07000000000000000000D1FF72409CEA07FFFFFFFFFFFFFFFF7E11020248484848218D22DB484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005130000004848484800000000484848483800000048484848B40000007043010080F40300FFFFFFFF0A000000000000000000000000000000000000000000000000000000750070000000000000000000FFFF00000000000000D1FF72409CEA07000000000000000000D1FF72409CEA07FFFFFFFFFFFFFFFF08070000FFFFFFFF80510100000000000000000000000000014D454D4000000068D71800E0B12B00
DynamicInfo REG_BINARY 030000008B9673123F04CA0100000000000000000000000000000000
Hash REG_BINARY A8559F6CCCA2DF09F1225F5DCFF67D8C6FF124FC5F85DCDF7F191DC7CF13EADE

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D21B403E-ACF9-4AE0-AF23-F2868758D742}
Path REG_SZ \Microsoft\Windows\Media Center\StartRecording
Hash REG_BINARY 6F3251475E855FE31A519893A624488246E71775F85E8A3FF3D3B155D2685F76
Triggers REG_BINARY 150000000000000000EA1F01386F1673FFFFFFFFFFFFFFFF00EA1F01386F167300000000000000004807420248484848FB7B73CB484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000514000000484848480000000048484848380000004848484858020000100E000080F40300FFFFFFFF0700000000000000000000000000000000000000000000000000000075006E000000000000000000
DynamicInfo REG_BINARY 03000000107C998C3E82CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D21F6024-191F-4454-BBBC-09A650DA2549}
Path REG_SZ \Microsoft\Windows\Application Experience\AitAgent
Triggers REG_BINARY 15000000000000000160C1074860C1070004C51F5309C8010060C1074860C107FFFFFFFFFFFFFFFF7E214202484848482774D537484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848483800000048484848B40000006035010080F40300FFFFFFFF09000000000000000000000000000000000000000000000000000000750070000000000000000000DDDD0000000000000160C1074860C1070004C51F5309C80100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF0100000001000000000000000001EA07010000000000000024D51800
DynamicInfo REG_BINARY 03000000A1065F153F04CA0100000000000000000000000000000000
Hash REG_BINARY 9A13FF7FB54C9212AAC3663AEE2889A6AFB0BA6898ABC3F9A811E6216987B833

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D622195C-D680-4FEA-9C56-59660C7C9E94}
Path REG_SZ \Microsoft\Windows\UPnP\UPnPHostConfig
Triggers REG_BINARY 15000000000000000084FF7201000000FFFFFFFFFFFFFFFF0084FF72010000000000000000000000102142024848484811E47727484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848480000000048484848
DynamicInfo REG_BINARY 03000000016861153F04CA0100000000000000000000000000000000
Hash REG_BINARY 6A0C38920812DABEF61FED2083D14E9E085CDBD0F5459B3159F0F4504CC8B4B0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D8BB5B7F-D0CA-4F67-A3D7-73E1D05F63DA}
Path REG_SZ \Microsoft\Windows\Registry\RegIdleBackup
Triggers REG_BINARY 15000000000000000160C1074860C10700C07640094CC8010060C1074860C107FFFFFFFFFFFFFFFF4E20C20248484848C7925C29484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848483800000048484848B40000007043010000000000FFFFFFFF05000000000000000000000000000000000000000000000000000000750070000000000000000000DDDD0000000000000160C1074860C10700C07640094CC80100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF010000000A000000000000000001EA0701000000100E000024D51800
DynamicInfo REG_BINARY 03000000C22A66153F04CA0100000000000000000000000000000000
Hash REG_BINARY AE0DB2F31A30B208E0C50EF64C29948A828612AC605CA8F6B3E42F51EA6C09E1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DE8699D2-8A05-42F7-8A85-5162AF47D26A}
Path REG_SZ \Microsoft\Windows\Windows Error Reporting\QueueReporting
Triggers REG_BINARY 150000000000000000D1FF72B8397802000000000000000000D1FF72B8397802FFFFFFFFFFFFFFFF40854002484848488A154A60484848480048484848484848004848484848484804000000484848481000000048484848010200000000000520000000210200000000000048484848380000004848484800000000FFFFFFFF80F40300FFFFFFFF05000000000000000000000000000000000000000000000000000000750070000000000000000000AAAA00000000000000D1FF72B8397802000000000000000000D1FF72B8397802FFFFFFFFFFFFFFFF0C030000FFFFFFFF0000000000000000000000000000000001000000000000004C4D454D480000000148484848484848
DynamicInfo REG_BINARY 030000000E2790123F04CA0100000000000000000000000000000000
Hash REG_BINARY 6EB7D50A0F0E813EF39052146B2AB58692ED68D82E0E8E733043ECC9334D16D1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DE8BAE53-2809-4F75-85EF-427D364B9B2C}
Path REG_SZ \Microsoft\Windows\CertificateServicesClient\UserTask
Triggers REG_BINARY 150000000000000000D1FF7228F6BE07000000000000000000D1FF7228F6BE07FFFFFFFFFFFFFFFFC085400248484848965281FA484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000504000000484848480000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF070000003C0000000500000000000000000000000000000000000000750070000000000000000000CCCC00000000000000D1FF7228F6BE07000000000000000000D1FF7228F6BE07FFFFFFFFFFFFFFFF00000000FFFFFFFF0000000000000000000000000000000001000000B49ED2CB95C16F02FA9045EBA5000000000000003C00510075006500720079004C006900730074003E003C00510075006500720079002000490064003D00220030002200200050006100740068003D002200530079007300740065006D0022003E003C00530065006C00650063007400200050006100740068003D002200530079007300740065006D0022003E002A005B00530079007300740065006D005B00500072006F00760069006400650072005B0040004E0061006D0065003D0027004D006900630072006F0073006F00660074002D00570069006E0064006F00770073002D00470072006F007500700050006F006C0069006300790027005D00200061006E00640020004500760065006E007400490044003D0031003500300033005D005D003C002F00530065006C006500630074003E003C002F00510075006500720079003E003C002F00510075006500720079004C006900730074003E00000048484848000000000000000000000000000000000000000000000000888800000000000000D1FF7228F6BE07000000000000000000D1FF7228F6BE07FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000000000014D454D4000000068D71800E0B42B00AAAA00000000000000D1FF7228F6BE07000000000000000000D1FF7228F6BE07FFFFFFFFFFFFFFFF00000000FFFFFFFF80700000000000000000000000000000010000001984C2CB4C4D454D480000000148484848484848
DynamicInfo REG_BINARY 030000000E2790123F04CA0100000000000000000000000000000000
Hash REG_BINARY DB89FE61B38CF541D584C34612B856A825EF9A287779F0CCBFAA95A0183E8781

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DF3EA79F-FB5B-48FA-B81E-53A2B8278A52}
Path REG_SZ \Microsoft\Windows\Media Center\PBDADiscoveryW1
Hash REG_BINARY ED6C3AF77BC32514D0E4A46115FB377242E60FDE46F8FF3785AF624B20462691
Triggers REG_BINARY 150000000000000000E72A01386F9672FFFFFFFFFFFFFFFF00E72A01386F96720000000000000000400542024848484820231FCE484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000512000000484848480000000048484848380000004848484800000000FFFFFFFF100E0000FFFFFFFF07000000000000000000000000000000000000000000000000000000760069000000000000000000
DynamicInfo REG_BINARY 03000000E0741B11DE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E4B0EF8F-3174-48ED-9CCD-72F89DA2862E}
Path REG_SZ \RealDownloaderRealUpgradeScheduledTaskS-1-5-21-3419578036-40878485-3947204858-1000
Hash REG_BINARY 0D7C821FC823FE77CE26670E9CEE7E2C76334D7846D87A37C946FE3A112E43A4
Triggers REG_BINARY 1500000000000000013837012038370180F89AB94261CE010038370120383701FFFFFFFFFFFFFFFF38214100484848481415DB1E484848480048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848380000004848484858020000100E000080F40300FFFFFFFF070000000000000000000000000000000000000000000000000000002E0045000000000000000000DDDD000000000000013837012038370180F89AB94261CE0100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF0100000007000000000000000001E301010000000000000027000000
DynamicInfo REG_BINARY 0300000010F04F426461CE01F0EF9069E466CE010000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E6F3A527-8B0B-43FA-94EB-584032761924}
Path REG_SZ \Microsoft\Windows\Active Directory Rights Management Services Client\AD RMS Rights Policy Template Management (Manual)
Triggers REG_BINARY 150000000000000000D1FF7228F6BE07000000000000000000D1FF7228F6BE07FFFFFFFFFFFFFFFFF885400248484848CE52BAAA484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000100000000484848480000000048484848380000004848484858020000100E0000100E0000FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000AAAA00000000000000D1FF7228F6BE07000000000000000000D1FF7228F6BE07FFFFFFFFFFFFFFFF100E0000FFFFFFFF00000000000000000000000000000000000000001984C2CB4C4D454D480000000148484848484848
DynamicInfo REG_BINARY 030000006F8892123F04CA0100000000000000000000000000000000
Hash REG_BINARY 62050C0D7C474998414FA2C47E4D346ECE628D7D974F377EE3B8AE2E60982EE3

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E79B2998-8F63-451A-A56D-26EDC0A5098A}
Path REG_SZ \Microsoft\Windows\Shell\WindowsParentalControlsMigration
Triggers REG_BINARY 1500000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF400582034848484879F2196C484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000512000000484848480000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF070000003C0000000100000000000000000000000000000000000000750070000000000000000000AAAA000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF01000000FFFFFFFF00000000000000000000000000E6560001000000660074004C4D454D480000000148484848484848
DynamicInfo REG_BINARY 030000002F4B97123F04CA0100000000000000000000000000000000
Hash REG_BINARY 6D5D71FCD9AF69DE33A5E47E6DE894CAD15A010944B2EF58C072C7F61EDB87E8

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E8164C0D-216C-4B6B-9EB8-31BF958B8014}
Path REG_SZ \Microsoft\Windows\NetTrace\GatherNetworkInfo
Triggers REG_BINARY 15000000000000000084FF7201000000FFFFFFFFFFFFFFFF0084FF720100000000000000000000000085400348484848A31C713A484848480048484848484848004848484848484804000000484848481000000048484848010200000000000520000000210200000000000048484848380000004848484800000000FFFFFFFF80F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000
DynamicInfo REG_BINARY 030000001AE132163F04CA0100000000000000000000000000000000
Hash REG_BINARY 9E154171408F80E0D5CEB4D8F775758B345B3FD705AD0B3058B1732870BE807F

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E8312B17-3798-4531-9106-372FC3C021E1}
Path REG_SZ \Microsoft\Windows\Media Center\PBDADiscoveryW2
Hash REG_BINARY D2B529269E9CD0C8E777506B13CBC3B9EC133ADCFA2160D03B795663C6D14D51
Triggers REG_BINARY 150000000000000000E72A01386F9672FFFFFFFFFFFFFFFF00E72A01386F967200000000000000004005420248484848215727BB484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000512000000484848480000000048484848380000004848484800000000FFFFFFFF100E0000FFFFFFFF07000000000000000000000000000000000000000000000000000000760069000000000000000000
DynamicInfo REG_BINARY 03000000A0585911DE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{EC50B587-5B8E-4156-9BE9-897AB610E46A}
Path REG_SZ \Microsoft\Windows\Media Center\PvrRecoveryTask
Hash REG_BINARY F18E7E603225B086AE1605B0EDDA4E41A11A6940F8C50583C566546D4753DBF9
Triggers REG_BINARY 150000000000000000E72A01386F9672FFFFFFFFFFFFFFFF00E72A01386F96720000000000000000000542024848484831C9DCAA484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005140000004848484800000000484848480000000048484848
DynamicInfo REG_BINARY 030000000007E111DE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{ED527CB1-07E8-4D12-B7D2-A7202C34E3D7}
Path REG_SZ \Microsoft\Windows\Media Center\OCURActivate
Hash REG_BINARY 21F0C71001FDAD4060D134F2914F036D1DAA814D9CF6206B8BBEA1D09AC5125B
Triggers REG_BINARY 150000000000000000E72A01386F9672FFFFFFFFFFFFFFFF00E72A01386F967200000000000000000021420248484848C7422EAF484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848480000000048484848
DynamicInfo REG_BINARY 030000000010BF0CDE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F04A1936-8F65-47EF-8CA6-9CA4D357FCC5}
Path REG_SZ \Microsoft\Windows\Media Center\PeriodicScanRetry
Hash REG_BINARY 8E6911CA59C45F2EE0BF63453DCD580B285E92CE1BFE4589F956D67C57F75EA3
Triggers REG_BINARY 1500000000000000015496721C000000006ECFFE35D4C60101E32A01D8E72A01006ECFFE35D4C6013021020248484848890E4413484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000514000000484848480000000048484848380000004848484800000000FFFFFFFF80F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000380024000000000000000000DDDD000000000000015496721C000000006ECFFE35D4C60100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF00000000000000000000000000000000010000000000000000000000
DynamicInfo REG_BINARY 03000000C038B90BDE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F1369A11-E983-4458-B390-712EFA1CBA44}
Path REG_SZ \Microsoft\Windows\TextServicesFramework\MsCtfMonitor
Triggers REG_BINARY 150000000000000000D1FF72409CEA07000000000000000000D1FF72409CEA07FFFFFFFFFFFFFFFF0085C00248484848E774F314484848480048484848484848004848484848484804000000484848481000000048484848010200000000000520000000210200000000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000AAAA00000000000000D1FF72409CEA07000000000000000000D1FF72409CEA07FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000000000010000001984C2CB4C4D454D480000000148484848484848
DynamicInfo REG_BINARY 0300000090AC99123F04CA0100000000000000000000000000000000
Hash REG_BINARY F7CCB39021E7E245CADCD75E426102522087DD3AC91AF7D4387D8D70ED6DDAB4

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F4B7FFA5-CFCE-4EDA-9BE5-13913DEB4B68}
Path REG_SZ \Microsoft\Windows\Wininet\CacheTask
Hash REG_BINARY B40015C2E03A4473C93284B4A79D0D10020C191C69D34B60D89B92D8942A01FC
Triggers REG_BINARY 1500000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF008540024848484814F966A5484848480048484848484848004848484848484804000000484848481000000048484848010200000000000520000000210200000000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000AAAA000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000E69E01010000000000000000000000000000000148484848484848
DynamicInfo REG_BINARY 0300000040B378B5ED2FCE0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F59FBF07-EE85-492D-91C3-DC21ADB54111}
Path REG_SZ \{072CA5B2-5F03-4BCF-A02A-A0F39845F82E}
Hash REG_BINARY AFF667112D35F5EB2E54C59816CD275CA86F48AD887E6B204267ABDB731537A0
Triggers REG_BINARY 1500000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF28214100484848482AE51207484848480048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848380000004848484858020000100E000080F40300FFFFFFFF070000000000000000000000000000000000000000000000000000007500700000000000000000008888000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000E9300201000000630065000200000240DF0000
DynamicInfo REG_BINARY 03000000804208B46131CE0150200FB46131CE010000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F68AC12F-8CBC-438E-A6EE-8D7951ABB1D9}
Path REG_SZ \Microsoft\Windows\Media Center\RegisterSearch
Hash REG_BINARY 3C0B66D64686766827850B149B5AFB544220673B5B4D47CB5556EF2C868E2381
Triggers REG_BINARY 150000000000000000E72A01386F9672FFFFFFFFFFFFFFFF00E72A01386F967200000000000000000021420248484848A9A3FB23484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848480000000048484848
DynamicInfo REG_BINARY 03000000C056A80DDE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F68FF8CA-B7A1-43C3-A45B-01A9281D19F0}
Path REG_SZ \Microsoft\Windows\Media Center\ActivateWindowsSearch
Hash REG_BINARY 440979398F3AB418F90B93DC0DD97070F5EF2337860AB42775202EF71D70B9E9
Triggers REG_BINARY 150000000000000000E72A01386F9672FFFFFFFFFFFFFFFF00E72A01386F9672000000000000000000214202484848489039649F484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848480000000048484848
DynamicInfo REG_BINARY 0300000080927E0EDE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F93C7104-998A-4A38-B935-775A3138B3C3}
Path REG_SZ \Microsoft\Windows\Location\Notifications
Triggers REG_BINARY 150000000000000000D1FF72C0FD700A000000000000000000D1FF72C0FD700AFFFFFFFFFFFFFFFF0085400248484848DFDD7976484848480048484848484848004848484848484805000000484848480C0000004848484801010000000000050B000000484848480000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000CCCC00000000000000D1FF72C0FD700A000000000000000000D1FF72C0FD700AFFFFFFFFFFFFFFFF00000000FFFFFFFF0000000000000000000000000000000001000000B49ED2CB95C16F02FA9045EBA4000000000000003C00510075006500720079004C006900730074003E003C00510075006500720079002000490064003D00220030002200200050006100740068003D0022004100700070006C00690063006100740069006F006E0022003E003C00530065006C00650063007400200050006100740068003D0022004100700070006C00690063006100740069006F006E0022003E002A005B00530079007300740065006D005B00500072006F00760069006400650072005B0040004E0061006D0065003D0027004C006F0063006100740069006F006E004E006F00740069006600690063006100740069006F006E00730027005D00200061006E00640020004500760065006E007400490044003D0031005D005D003C002F00530065006C006500630074003E003C002F00510075006500720079003E003C002F00510075006500720079004C006900730074003E000000484848484848000000000000000000000000000000000000000000000000
DynamicInfo REG_BINARY 030000005B2941163F04CA0100000000000000000000000000000000
Hash REG_BINARY E2EEC5DC638B16A8DCF4E83A3514F28DC7FFB5CA04854176D252D9095C29B343

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FFB8486A-9861-4B82-BE38-C7F8FB1B6605}
Path REG_SZ \Microsoft\Windows\Task Manager\Interactive
Triggers REG_BINARY 15000000000000000084FF7201000000FFFFFFFFFFFFFFFF0084FF720100000000000000000000000085C0024848484819D7D458484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000504000000484848480000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF05000000000000000000000000000000000000000000000000000000750070000000000000000000
DynamicInfo REG_BINARY 030000001CEC45163F04CA0100000000000000000000000000000000
Hash REG_BINARY 89DE49D146B9DA8A3F686F98CC965767AFCD9716B08A2FC65105DC7B0


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

i just did what u said. i'm back. what's next?


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

do i move on to what jack said?


----------



## jenae

*Re: taskeng.exe keeps popping up*

Hi, my post#51, you did add it to registry, you did copy it exactly as it appeared?

If the file is still popping up that reg mod should have removed it, could you open a cmd as admin again and run the cmd 



Code:


reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks" /s > 0 & notepad 0

 press enter, post the notepad outcome here.


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

yes i did what u said..


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{01ADFD4A-9436-4A67-A729-F3583B606B5B}
Path REG_SZ \OfficeSoftwareProtectionPlatform\SvcRestartTask
Hash REG_BINARY C1641B3BE7D44C4AF34DB1EAFB52998F9A8F67C285A5CF685D0A7DB91A773FB0
Triggers REG_BINARY 150000000000000001134A01E8134A010000F232FACFC30100134A01E8134A01FFFFFFFFFFFFFFFF482182024848484872C5A855484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000514000000484848480000000048484848380000004848484858020000100E000000000000FFFFFFFF070000003C0000000300000000000000000000000000000000000000690000000000000000000000DDDD00000000000001134A01E8134A010000F232FACFC30100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF01000000010000000000000000017B02010000000000000027000000
DynamicInfo REG_BINARY 03000000E0286D7BA473CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{05EE699F-AB25-42D8-8781-558C5D1D2FAD}
Path REG_SZ \Microsoft\Windows\Tcpip\IpAddressConflict1
Triggers REG_BINARY 150000000000000000D1FF7228F6BE07000000000000000000D1FF7228F6BE07FFFFFFFFFFFFFFFF38A1400348484848E99D6008484848480048484848484848004848484848484804000000484848481000000048484848010200000000000520000000210200000000000048484848380000004848484858020000100E000080F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000CCCC00000000000000D1FF7228F6BE07000000000000000000D1FF7228F6BE07FFFFFFFFFFFFFFFF00000000FFFFFFFF0000000000000000000000000000000001000000B49ED2CB95C16F02FA9045EB8D000000000000003C00510075006500720079004C006900730074003E003C00510075006500720079002000490064003D00220030002200200050006100740068003D002200530079007300740065006D0022003E003C00530065006C00650063007400200050006100740068003D002200530079007300740065006D0022003E002A005B00530079007300740065006D005B00500072006F00760069006400650072005B0040004E0061006D0065003D0027005400630070006900700027005D00200061006E00640020004500760065006E007400490044003D0034003100390038005D005D003C002F00530065006C006500630074003E003C002F00510075006500720079003E003C002F00510075006500720079004C006900730074003E00000048484848000000000000000000000000000000000000000000000000
DynamicInfo REG_BINARY 03000000F00D9C123F04CA0100000000000000000000000000000000
Hash REG_BINARY CEF4FD5DA04459B60C163CD71D538078A601EF7EE05832CECD2DD79D5213AF22

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{071D41B6-8806-4EB0-B661-6CB67BE6E86E}
Path REG_SZ \Microsoft\Windows\Diagnosis\Scheduled
Triggers REG_BINARY 15000000000000000152DA092052DA090068B69402D0C3010052DA092052DA09FFFFFFFFFFFFFFFF7289C00348484848AB8C36E4484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005040000004848484800000000484848483800000048484848580200008070000080F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000DDDD0000000000000152DA092052DA090068B69402D0C30100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF0200000001000100000000000001F9090100000000000000D0D21800
DynamicInfo REG_BINARY 030000007193A5123F04CA0100000000000000000000000000000000
Hash REG_BINARY 82EBD60108500FCD357BF28CCE5952EFB6FF943B38E8250A3AF34507C6162FAE

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0B74D9AB-77B3-4635-9DC5-EB252FF05F54}
Path REG_SZ \Microsoft\Windows\Media Center\OCURDiscovery
Hash REG_BINARY 1FC092677FA581A6F0D9017D0F02E74681A0DA6B0AF0EEF0E204E92D1605757A
Triggers REG_BINARY 150000000000000000E72A01386F9672FFFFFFFFFFFFFFFF00E72A01386F9672000000000000000000214202484848485C36CF06484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848480000000048484848
DynamicInfo REG_BINARY 03000000602F4F0CDE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0D9B5D92-3A22-486D-A887-3AA21597CF27}
Path REG_SZ \Microsoft\Windows\Time Synchronization\SynchronizeTime
Triggers REG_BINARY 150000000000000001A1D80718A1D80700E8E6379DEFC40100A1D80718A1D807FFFFFFFFFFFFFFFFE021420348484848DFDC7836484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005130000004848484800000000484848480000000048484848DDDD00000000000001A1D80718A1D80700E8E6379DEFC40100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF02000000010001000000000000017802010000000000000024D51800
DynamicInfo REG_BINARY 030000003156AA123F04CA0100000000000000000000000000000000
Hash REG_BINARY 17D3BD884BE1EAD4B4B32CC46D0707E468688A3FCDE1835573BF3A392D0BF65A

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0E12083C-0335-49DB-9542-BA1EC6D83ECC}
Path REG_SZ \Microsoft\Windows\Tcpip\IpAddressConflict2
Triggers REG_BINARY 15000000000000000160C1074860C10780294E129638C60100D1FF7228F6BE07FFFFFFFFFFFFFFFF38A1400348484848A201FC43484848480048484848484848004848484848484804000000484848481000000048484848010200000000000520000000210200000000000048484848380000004848484858020000100E000080F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000CCCC0000000000000160C1074860C10780294E129638C60100D1FF7228F6BE07FFFFFFFFFFFFFFFF00000000FFFFFFFF0000000000000000000000000000000001000000B49ED2CB95C16F02FA9045EB8D000000000000003C00510075006500720079004C006900730074003E003C00510075006500720079002000490064003D00220030002200200050006100740068003D002200530079007300740065006D0022003E003C00530065006C00650063007400200050006100740068003D002200530079007300740065006D0022003E002A005B00530079007300740065006D005B00500072006F00760069006400650072005B0040004E0061006D0065003D0027005400630070006900700027005D00200061006E00640020004500760065006E007400490044003D0034003100390039005D005D003C002F00530065006C006500630074003E003C002F00510075006500720079003E003C002F00510075006500720079004C006900730074003E00000048484848000000000000000000000000000000000000000000000000
DynamicInfo REG_BINARY 0300000092B7AC123F04CA0100000000000000000000000000000000
Hash REG_BINARY 4D3C72EE9B731BFCFC7022531B2870DEF28FF13FF8E0F089003E02AA0F40C05D

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1216802A-CE1D-45BC-8574-087E81239DFC}
Path REG_SZ \Microsoft\Windows\Media Center\ConfigureInternetTimeService
Hash REG_BINARY 1A61FB3046F2F771F436B66EDEC9EEC6E1E9E3F219AA4224495928E6BC347BEE
Triggers REG_BINARY 150000000000000000E72A01386F9672FFFFFFFFFFFFFFFF00E72A01386F967200000000000000000021420248484848334EC699484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848480000000048484848
DynamicInfo REG_BINARY 030000002097710DDE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{18E6D428-D26C-4169-BEDF-3B5BDDC952F6}
Path REG_SZ \Microsoft\Windows\Application Experience\ProgramDataUpdater
Triggers REG_BINARY 15000000000000000160C1074860C10700343C5C4209C8010060C1074860C107FFFFFFFFFFFFFFFF7E2142024848484837E5BF7A484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848483800000048484848B40000007043010080F40300FFFFFFFF04000000000000000000000000000000000000000000000000000000750070000000000000000000DDDD0000000000000160C1074860C10700343C5C4209C80100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF0100000001000000000000000001EA07010000000000000024D51800
DynamicInfo REG_BINARY 03000000A51A58133F04CA0100000000000000000000000000000000
Hash REG_BINARY DC338F10A3CFC796A188C9F3527F69731F42DAFFD45DC3437174145A408A4A05

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1EC9510D-A439-4950-9399-B6399EDF9EA7}
Path REG_SZ \Microsoft\Windows\Autochk\Proxy
Triggers REG_BINARY 150000000000000000D1FF72B8397802000000000000000000D1FF72B8397802FFFFFFFFFFFFFFFF4221420248484848B1B1AB59484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005130000004848484800000000484848483800000048484848580200008033E10180F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000FFFF00000000000000D1FF72B8397802000000000000000000D1FF72B8397802FFFFFFFFFFFFFFFF08070000FFFFFFFF00000000000000000000000000000000014D454D4000000068D7180060B62B00
DynamicInfo REG_BINARY 030000004A4E65123F04CA0100000000000000000000000000000000
Hash REG_BINARY 02E603F0F0B98221F070DD81A88B3DB67CE5DA315BC568423732F9EED15F3F79

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2375F586-1009-41FB-B54E-30D8AF2B781D}
Path REG_SZ \Microsoft\Windows\Windows Media Sharing\UpdateLibrary
Triggers REG_BINARY 150000000000000000D1FF72C0FD700A000000000000000000D1FF72C0FD700AFFFFFFFFFFFFFFFF4085400248484848EC26CB6D484848480048484848484848004848484848484805000000484848480C0000004848484801010000000000050B0000004848484800000000484848480000000048484848CCCC00000000000000D1FF72C0FD700A000000000000000000D1FF72C0FD700AFFFFFFFFFFFFFFFF00000000FFFFFFFF0000000000000000000000000000000001000000B49ED2CB95C16F02FA9045EB1E010000000000003C00510075006500720079004C006900730074003E000A00200020002000200020002000200020002000200020002000200020003C00510075006500720079000A00200020002000200020002000200020002000200020002000200020002000200020002000490064003D002200300022000A0020002000200020002000200020002000200020002000200020002000200020002000200050006100740068003D002200530079007300740065006D0022000A002000200020002000200020002000200020002000200020002000200020002000200020003E000A0020002000200020002000200020002000200020002000200020002000200020003C00530065006C00650063007400200050006100740068003D002200530079007300740065006D0022003E002A005B00530079007300740065006D005B00500072006F00760069006400650072005B0040004E0061006D0065003D0027004D006900630072006F0073006F00660074002D00570069006E0064006F00770073002D0057004D0050004E00530053002D00530065007200760069006300650027005D00200061006E006400200028004500760065006E007400490044003D003100340032003100300029005D005D003C002F00530065006C006500630074003E000A00200020002000200020002000200020002000200020002000200020003C002F00510075006500720079003E000A002000200020002000200020002000200020002000200020003C002F00510075006500720079004C006900730074003E0000004848000000000000000000000000000000000000000000000000
DynamicInfo REG_BINARY 0300000066DD5C133F04CA0100000000000000000000000000000000
Hash REG_BINARY 72A5683A40FAA291AA33CC4DD71A02E9E691D7C5A7BA213B817C759F7D4E24BE

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{249EA428-8F2A-4411-B8CB-B741B6D76773}
Path REG_SZ \RealPlayerRealUpgradeLogonTaskS-1-5-21-3419578036-40878485-3947204858-1000
Hash REG_BINARY 0BBA2F4A6D860F4609DFB8F40C2E433E8C574C9198F44847882511604CC11590
Triggers REG_BINARY 150000000000000001962D01E8962D0100924ABA0962CE010000000000000000FFFFFFFFFFFFFFFF38214100484848480C7DE2F3484848480048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848380000004848484858020000100E000080F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000AAAA00000000000001962D01E8962D0100924ABA0962CE010000000000000000FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000E6430101006900630065004100700069002E000048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848
DynamicInfo REG_BINARY 03000000E0673A432B62CE015072EB44A16ECE010000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{24FA84A0-E087-48EC-BC51-2B9C4C815D78}
Path REG_SZ \Microsoft\Windows\PerfTrack\BackgroundConfigSurveyor
Triggers REG_BINARY 150000000000000000D1FF725075D009000000000000000000D1FF725075D009FFFFFFFFFFFFFFFF102182024848484803D61589484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005130000004848484800000000484848480000000048484848EEEE00000000000000D1FF725075D009000000000000000000D1FF725075D009FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000D2180001000000660074004C4D454D48000000DDDD00000000000001397902C83979020078BA3F01C2C80100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF0100000001000000000000000001D0090100000000000000D0D21800
DynamicInfo REG_BINARY 0300000027A061133F04CA0100000000000000000000000000000000
Hash REG_BINARY 8A4BC3FB22E943EDE5A98456CCAF3453D4DDD613D1A3265017967ABC8C779E7D

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{25F9B764-EFEB-487C-99C6-262AC820C63F}
Path REG_SZ \{AAACF832-D3D0-4487-82A4-841335DA972E}
Hash REG_BINARY 0EB2DD9087E75DD723B2D862E18B4AC42FAFD6C9E507008494BC1875B38EB4ED
Triggers REG_BINARY 1500000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF2821410048484848A022610D484848480048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848380000004848484858020000100E000080F40300FFFFFFFF070000000000000000000000000000000000000000000000000000007500700000000000000000008888000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000E6240201006900630065003A00000000000000
DynamicInfo REG_BINARY 03000000F02823554C20CE01F02823554C20CE010000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2BD05BA6-988D-4BD3-A9CD-9A39F80AF524}
Path REG_SZ \Microsoft\Windows\MemoryDiagnostic\CorruptionDetector
Triggers REG_BINARY 150000000000000000D1FF7228F6BE07000000000000000000D1FF7228F6BE07FFFFFFFFFFFFFFFF00A0C00248484848F1D7B9294848484800484848484848480048484848484848040000004848484810000000484848480102000000000005200000002102000000000000484848480000000048484848CCCC00000000000000D1FF7228F6BE07000000000000000000D1FF7228F6BE07FFFFFFFFFFFFFFFF00000000FFFFFFFF0000000000000000000000000000000001000000B49ED2CB95C16F02FA9045EB99000000000000003C00510075006500720079004C006900730074003E003C00510075006500720079002000490064003D00220030002200200050006100740068003D002200530079007300740065006D0022003E003C00530065006C00650063007400200050006100740068003D002200530079007300740065006D0022003E002A005B00530079007300740065006D005B00500072006F00760069006400650072005B0040004E0061006D0065003D0027004100700070006C00690063006100740069006F006E00200050006F0070007500700027005D00200061006E00640020004500760065006E007400490044003D0031003800300031005D005D003C002F00530065006C006500630074003E003C002F00510075006500720079003E003C002F00510075006500720079004C006900730074003E00000048484848000000000000000000000000000000000000000000000000
DynamicInfo REG_BINARY 03000000870164133F04CA0100000000000000000000000000000000
Hash REG_BINARY 39D0B04F356DF6650E076076255CE26CE27591428740C759241D2B1AEE37F612

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2C59ECAF-3A27-4640-9F4B-519B05BDD70F}
Path REG_SZ \Microsoft\Windows\MUI\LPRemove
Triggers REG_BINARY 150000000000000000D1FF72409CEA07000000000000000000D1FF72409CEA07FFFFFFFFFFFFFFFF12214203484848489B41D2D8484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000512000000484848480000000048484848380000004848484858020000FFFFFFFF907E0000FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000FFFF00000000000000D1FF72409CEA07000000000000000000D1FF72409CEA07FFFFFFFFFFFFFFFFDC050000FFFFFFFF00000000000000000000000000000000014D454D4000000068D71800E0B12B00
DynamicInfo REG_BINARY 030000000A116A123F04CA0100000000000000000000000000000000
Hash REG_BINARY 47D45B031C1994B39C49EF36D6FE80FBEC111F7D6EF3E282476EF5D77E097DAB

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2D2A2DCD-315C-4E4F-B6F0-7B0663588175}
Path  REG_SZ \Adobe Flash Player Updater
Hash REG_BINARY 45E8C6A6C31C1A9CDFFFBBCC07262CD366FD1C39B0FAA0F07FDC80684BB67637
Triggers REG_BINARY 150000000000000001CF210128CF21010034720BD053BF0100CF210128CF2101FFFFFFFFFFFFFFFF282162004848484887B10CF5484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000512000000484848480000000048484848380000004848484858020000100E000080F40300FFFFFFFF09000000000000000000000000000000000000000000000000000000640061000000000000000000DDDD00000000000001CF210128CF21010034720BD053BF010000000000000000000000000000000000000000000000000000000000000000100E000080510100FFFFFFFF0100000001000000000000000001D301010000000000000027000000
DynamicInfo REG_BINARY 0300000020687DACB037CD0190019A76296ECE010000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{341ECAFB-0959-49CD-B367-5707F008D7AB}
Path REG_SZ \Word Script
Hash REG_BINARY DF82DEA0D62ECA9ECB822D296727B53450F6AE6B5FBD9C40F53DEEB226D8E9EC
Triggers REG_BINARY 150000000000000001FF590118FF590100C816A54548CE0100FF590118FF5901FFFFFFFFFFFFFFFF3821410048484848DC1BB54A484848480048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848380000004848484858020000100E000080F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000DDDD00000000000001FF590118FF590100C816A54548CE0100000000000000000000000000000000000000000000000000000000000000007800000000000000FFFFFFFF00000000000000000000000000015D02010000000000000019000000
DynamicInfo REG_BINARY 0300000068B8237C6348CE0130800E00A36ECE010100000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{367F930A-A3DB-4112-B1F1-50E92A171C88}
Path REG_SZ \Microsoft\Windows\Shell\WindowsParentalControls
Triggers REG_BINARY 150000000000000000D1FF72882AF909000000000000000000D1FF72882AF909FFFFFFFFFFFFFFFF4085800248484848E149B4C1484848480048484848484848004848484848484805000000484848480C0000004848484801010000000000050B000000484848480000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF070000003C0000000500000000000000000000000000000000000000750070000000000000000000AAAA00000000000000D1FF72882AF909000000000000000000D1FF72882AF909FFFFFFFFFFFFFFFF01000000FFFFFFFF0000000000000000000000000000000000000000660074004C4D454D480000000148484848484848
DynamicInfo REG_BINARY 03000000ACBA7A123F04CA0100000000000000000000000000000000
Hash REG_BINARY 886511E7DEE4F447B2F704A04046BB942BD9BDA76152A12BB0AE3D9B56C6AAF5

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{371A6AFB-1D6E-4119-904E-9037692EF8C4}
Path REG_SZ \Microsoft\Windows\Offline Files\Logon Synchronization
Hash REG_BINARY 6576A98588179A08B31C3D3999726FCF3761698BAAA53EC77A03A35E4108207A
Triggers REG_BINARY 150000000000000000E8150225D49972000000000000000000E8150225D49972FFFFFFFFFFFFFFFFF0A1000248484848532B4026484848480048484848484848004848484848484805000000484848480C0000004848484801010000000000050B000000484848480000000048484848380000004848484800000000FFFFFFFF80510100FFFFFFFF07000000000000000000000000000000000000000000000000000000380024000000000000000000AAAA00000000000000E8150225D49972000000000000000000E8150225D49972FFFFFFFFFFFFFFFFF0000000FFFFFFFF00000000000000000000000000E8150201FFFFFF0000000000000000000000000148484848484848
DynamicInfo REG_BINARY 03000000E099B308DE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3A636302-40F9-4F22-ACFE-2E7578BA308A}
Path REG_SZ \Microsoft\Windows\Media Center\ehDRMInit
Hash REG_BINARY 9B2BFF8825669B3C372748418CC0EB39C719BDAEBCD676CC7B39E1022601A0BF
Triggers REG_BINARY 150000000000000000E72A01386F9672FFFFFFFFFFFFFFFF00E72A01386F967200000000000000000021420248484848E8DDC73B484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005130000004848484800000000484848480000000048484848
DynamicInfo REG_BINARY 03000000406EF30CDE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3E0498FD-B3D2-4D48-B316-0C9F5F4734D2}
Path REG_SZ \Microsoft\Windows\Media Center\InstallPlayReady
Hash REG_BINARY FA87213DE12B497A787F46A1863343D4C9578E30570573918454DF0528610310
Triggers REG_BINARY 150000000000000000E72A01386F9672FFFFFFFFFFFFFFFF00E72A01386F9672000000000000000000054202484848484A08CFB1484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848480000000048484848
DynamicInfo REG_BINARY 0300000000C0EF0DDE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4040E761-8758-4007-B2FE-142B24BF4B16}
Path REG_SZ \Microsoft\Windows\Ras\MobilityManager
Triggers REG_BINARY 150000000000000000D1FF72B8397802000000000000000000D1FF72B8397802FFFFFFFFFFFFFFFF40054202484848484716FF88484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005130000004848484800000000484848480000000048484848CCCC00000000000000D1FF72B8397802000000000000000000D1FF72B8397802FFFFFFFFFFFFFFFF00000000FFFFFFFF0000000000000000000000000000000001000000B49ED2CB95C16F02FA9045EB2A010000000000003C00510075006500720079004C006900730074003E000A00200020002000200020002000200020002000200020002000200020003C00510075006500720079000A00200020002000200020002000200020002000200020002000200020002000200020002000490064003D002200300022000A0020002000200020002000200020002000200020002000200020002000200020002000200050006100740068003D0022004100700070006C00690063006100740069006F006E0022000A002000200020002000200020002000200020002000200020002000200020002000200020003E000A0020002000200020002000200020002000200020002000200020002000200020003C00530065006C00650063007400200050006100740068003D0022004100700070006C00690063006100740069006F006E0022003E002A005B00530079007300740065006D005B00500072006F00760069006400650072005B0040004E0061006D0065003D00270052006100730043006C00690065006E00740027005D00200061006E006400200028004C006500760065006C003D00340020006F00720020004C006500760065006C003D0030002900200061006E006400200028004500760065006E007400490044003D003200300032003800310029005D005D003C002F00530065006C006500630074003E000A00200020002000200020002000200020002000200020002000200020003C002F00510075006500720079003E000A002000200020002000200020002000200020002000200020003C002F00510075006500720079004C006900730074003E0000004848000000000000000000000000000000000000000000000000
DynamicInfo REG_BINARY 0300000047C468133F04CA0100000000000000000000000000000000
Hash REG_BINARY 472F2F6E40D88458D92B946C81BA9225D63C0BD045FBAB63CAEF1904BC35BA73

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{42579F0F-BC71-4569-BC0E-E8EC59233D7F}
Path REG_SZ \Microsoft\Windows\Media Center\ReindexSearchRoot
Hash REG_BINARY 59500DAC2B3DF24DD8EBD096B081796CE15A4D699DE7F05B53C249612F21A974
Triggers REG_BINARY 150000000000000000E72A01386F9672FFFFFFFFFFFFFFFF00E72A01386F967200000000000000000021420248484848E17CF563484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848480000000048484848
DynamicInfo REG_BINARY 03000000A07F260EDE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{48C156B3-F8B9-4765-8A0B-D63A27DFEA0C}
Path REG_SZ \Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector
Hash REG_BINARY 9615D02C18C2E20A2C5D63731D4143F49CD173A5C6E09584EA1A72DC9A6CFF48
Triggers REG_BINARY 150000000000000001156A0100156A010068B69402D0C30100156A0100156A01FFFFFFFFFFFFFFFF52218202484848488ACEFD74484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848480000000048484848DDDD00000000000001156A0100156A010068B69402D0C30100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF02000000020001000000000000016D00010000000000000027000000
DynamicInfo REG_BINARY 0300000080C7A809DE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4A9F54C4-19EE-4D7A-8F08-AB4A477357B5}
Path REG_SZ \{6AB75A7F-54FD-426C-BF30-37BADDC7BDFA}
Hash REG_BINARY A14D124CF21E69750F6EA34874E714B5B41D715044C4FA3025C0DF972280BAAC
Triggers REG_BINARY 1500000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF2821410048484848FBA29099484848480048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848380000004848484858020000100E000080F40300FFFFFFFF070000000000000000000000000000000000000000000000000000007500700000000000000000008888000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000E9B20001006900630065003A00000065000000
DynamicInfo REG_BINARY 03000000D0370D1F774DCE01A0330F1F774DCE010000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4BC3B3F1-E218-43D1-BC20-EE70EDC8BFAC}
Path REG_SZ \Games\UpdateCheck_S-1-5-21-3419578036-40878485-3947204858-1000
Hash REG_BINARY 130FAAFE37A4EF88AA10AAC15DFD85298AC968F67E6E4672259BBC9F606EDF06
Triggers REG_BINARY 1500000000000000000000000000000000000000000000000095D200B895D200FFFFFFFFFFFFFFFF9A21C10248484848033EABDA484848480048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848380000004848484858020000100E000080F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000DDDD0000000000000195D200B895D2000090FF031A4CC80100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF0100000001000000000000000001170201000000201C000027000000AAAA000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF84030000FFFFFFFF00000000000000000000000000E71702010064006C006C002C002D00350030000048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848
DynamicInfo REG_BINARY 0300000020D20170ED6ACE0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4E037E1D-BD9B-4FF6-ACE7-773BF57242C3}
Path REG_SZ \Installation App Launcher
Hash REG_BINARY 56962F77E29A5189BFC1B4D98F3C399C9E41A7648536A23480ABEFD132762358
Triggers REG_BINARY 1500000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF7821410048484848068EF77A484848480048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848380000004848484858020000100E000080F40300FFFFFFFF070000000000000000000000000000000000000000000000000000007400720000000000000000008888000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000E8090101006F00660074002E0063006F006D00
DynamicInfo REG_BINARY 0300000070912B367EFACC0170912B367EFACC010400014000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{50FB5A03-0E1E-48DE-B8A1-BEE9D7D2CD0F}
Path REG_SZ \Microsoft\Windows\User Profile Service\HiveUploadTask
Triggers REG_BINARY 15000000000000000160C1074860C10700406A6006E9C7010060C1074860C107FFFFFFFFFFFFFFFFC2210202484848480C2AD3B9484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000512000000484848480000000048484848380000004848484858020000201C000080F40300FFFFFFFF07000000780000000300000000000000000000000000000000000000750070000000000000000000DDDD0000000000000160C1074860C10700406A6006E9C7010000000000000000000000000000000000000000000000000000000000000000C0A8000000000000FFFFFFFF0000000000000000000000000001BE0701000000100E000024D51800
DynamicInfo REG_BINARY 03000000A8256B133F04CA0100000000000000000000000000000000
Hash REG_BINARY 22735240F634AF52EB496CAC7F58E85D9ED7AF876AD31D5AE4C1F57C234E5728

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{52578FD9-EA43-4338-8D9D-58F15AB940B4}
Path REG_SZ \RealDownloaderRealUpgradeLogonTaskS-1-5-21-3419578036-40878485-3947204858-1000
Hash REG_BINARY 4F33ED67A79152437F013DF6519BFE93BAE13E7DE46C4C9279F9414C91E54775
Triggers REG_BINARY 150000000000000001383701203837018025CCBA4261CE010000000000000000FFFFFFFFFFFFFFFF382141004848484887398E48484848480048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848380000004848484858020000100E000080F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000740069000000000000000000AAAA00000000000001383701203837018025CCBA4261CE010000000000000000FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000E4E301010064006C006C002C002D00350030000048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848
DynamicInfo REG_BINARY 0300000050B12F436461CE01B0F42645A16ECE010000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{54E5294C-56F7-4976-AE61-DF4AB6981DFD}
Path REG_SZ \Microsoft\Windows\Media Center\PvrScheduleTask
Hash REG_BINARY 695AC268A441273AAAC43B4C25E863C354D8400FF37237317343CD29A22A2CEF
Triggers REG_BINARY 150000000000000000E72A01386F9672FFFFFFFFFFFFFFFF00E72A01386F9672000000000000000000054202484848483A1B96C3484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005140000004848484800000000484848480000000048484848
DynamicInfo REG_BINARY 03000000A01EB012DE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{56DDB4E5-92C2-40AD-9F91-2E78FA599066}
Path REG_SZ \Microsoft\Windows\Windows Activation Technologies\ValidationTask
Hash REG_BINARY 8D553B340F9D131C6C4BAA654C045EFDCB9ADF9F97CF3EE9997DC985F570EF65
Triggers REG_BINARY 1500000000000000008F5500D08F5500806D4DE6946FCE01008F5500D08F5500FFFFFFFFFFFFFFFFC221C20248484848F2C3147B484848480048484848484848004848484848484805000000484848480C0000004848484801010000000000051300000048484848000000004848484838000000484848482C010000F0200D0000000000FFFFFFFF07000000000000000000000000000000000000000000000000000000200020000000000000000000DDDD000000000000008F5500D08F5500806D4DE6946FCE0100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF010000005A0000000000000000013002010000000000000027000000
DynamicInfo REG_BINARY 03000000A06218AFD172CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5B184694-64C3-4633-94C5-945B3FA561D6}
Path REG_SZ \Microsoft\Windows\WindowsBackup\ConfigNotification
Triggers REG_BINARY 150000000000000001202C01E0202C0100906BDA198ECB0100202C01E0202C01FFFFFFFFFFFFFFFF4821020248484848FF32C16A484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000513000000484848480000000048484848380000004848484800000000FFFFFFFF80F40300FFFFFFFF070000000000000000000000000000000000000000000000000000006F0066000000000000000000DDDD00000000000001202C01E0202C0100906BDA198ECB0100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF01000000010000000000000000011602010000000000000027000000
DynamicInfo REG_BINARY 030000007835F5133F04CA0100000000000000000000000000000000
Hash REG_BINARY 9EE2B2B420322289B37A740278BCAAF92D9DFA6021E9780435F161C4A88809BA

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5C2C622F-70E9-4194-A7DA-033E827365AD}
Path REG_SZ \Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStartTypeChange
Triggers REG_BINARY 150000000000000000D1FF72B8397802000000000000000000D1FF72B8397802FFFFFFFFFFFFFFFF0010C20248484848170F4F6E484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000512000000484848480000000048484848380000004848484800000000FFFFFFFF80F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000CCCC00000000000000D1FF72B8397802000000000000000000D1FF72B8397802FFFFFFFFFFFFFFFF00000000FFFFFFFF0000000000000000000000000000000001000000B49ED2CB95C16F02FA9045EBD3000000000000003C00510075006500720079004C006900730074003E003C00510075006500720079002000490064003D00220030002200200050006100740068003D002200530079007300740065006D0022003E003C00530065006C00650063007400200050006100740068003D002200530079007300740065006D0022003E002A002F00530079007300740065006D002F00500072006F00760069006400650072005B0040004E0061006D0065003D0027005300650072007600690063006500200043006F006E00740072006F006C0020004D0061006E00610067006500720027005D00200061006E00640020002A002F00530079007300740065006D002F004500760065006E007400490044003D00270037003000340030002700200061006E00640020002A002F004500760065006E00740044006100740061002F0044006100740061005B0040004E0061006D0065003D00270070006100720061006D00340027005D003D00270042004600450027003C002F00530065006C006500630074003E003C002F00510075006500720079003E003C002F00510075006500720079004C006900730074003E000000000000000000000000000000000000000000000000000000
DynamicInfo REG_BINARY 03000000D896F7133F04CA0100000000000000000000000000000000
Hash REG_BINARY CD3589987E9B5E1E6B4EEC849A5ADBBEECEA05CB35BB86B07AC66C4029EB0D6D

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5DC72057-73B3-4079-9EAC-90EE4D3B1410}
Path REG_SZ \Microsoft\Windows\Media Center\SqlLiteRecoveryTask
Hash REG_BINARY 0582C3DC8E70BC6FAEEB500EB43EEBB03B2D607B40B61B59C0BC46292F5BE42A
Triggers REG_BINARY 150000000000000000E72A01386F9672FFFFFFFFFFFFFFFF00E72A01386F967200000000000000000005420248484848BB353C89484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005140000004848484800000000484848480000000048484848
DynamicInfo REG_BINARY 0300000040916112DE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5FD7670E-E3FE-4385-9A3E-C0B2D551615C}
Path REG_SZ \Microsoft\Windows\Media Center\ObjectStoreRecoveryTask
Hash REG_BINARY 0D7CE53B5DEDF3BB738E23E6AFCFF4829C8AF0A3B1179EFB42DD3DAFED865833
Triggers REG_BINARY 150000000000000000E72A01386F9672FFFFFFFFFFFFFFFF00E72A01386F967200000000000000000005420248484848073581F7484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005140000004848484800000000484848480000000048484848
DynamicInfo REG_BINARY 03000000E00E2612DE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{60158C7A-6808-42CD-95EE-AFD9A57925DB}
Path REG_SZ \Microsoft\Windows\AppID\PolicyConverter
Triggers REG_BINARY 15000000000000000084FF7201000000FFFFFFFFFFFFFFFF0084FF7201000000000000000000000040110202484848483498017A484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005130000004848484800000000484848480000000048484848
DynamicInfo REG_BINARY 030000003A030D143F04CA0100000000000000000000000000000000
Hash REG_BINARY C645BB8F8D8C5DE3EA7A893D785BD95FC06FA4D7810745FE4E78E392009FFFB8

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6375CC1C-D975-48D2-9CD5-63DB19B10D4A}
Path REG_SZ \Microsoft\Windows\WDI\ResolutionHost
Triggers REG_BINARY 15000000000000000084FF7201000000FFFFFFFFFFFFFFFF0084FF720100000000000000000000000085C003484848489D84F470484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000504000000484848480000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF0A000000000000000000000000000000000000000000000000000000750070000000000000000000
DynamicInfo REG_BINARY 030000003A030D143F04CA0100000000000000000000000000000000
Hash REG_BINARY 7678F283CD528277951D5955D00319DC3E404F5D6AD8E0806B80DC781E7181CA

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{67537D1B-8825-466D-8624-C6BDE55117E2}
Path REG_SZ \Microsoft\Windows\MUI\Mcbuilder
Hash REG_BINARY 9C92087F24BF14895851784B5C6694143D0351907D9A27B38AE8DB65813978BC
Triggers REG_BINARY 1500000000000000000000000000000000000000000000000163F800E863F80000C024BA1856E10148214200484848487EF0381F484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000512000000484848480000000048484848380000004848484858020000100E000080F40300FFFFFFFF070000005802000005000000000000000000000000000000000000007500700000000000000000008888000000000000000000000000000000000000000000000163F800E863F80000C024BA1856E10100000000FFFFFFFF00000000000000000000000000E4BC0101006900630065003A00000065000000
DynamicInfo REG_BINARY 03000000709488CEE1A7CD01709488CEE1A7CD011F13048000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6AEF0C98-2CB4-4B67-8C70-4C977C7355CC}
Path REG_SZ \Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask
Triggers REG_BINARY 15000000000000000113D0079013D0070000F232FACFC3010013D0079013D007FFFFFFFFFFFFFFFF4021820248484848217B8E98484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000514000000484848480000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF070000003C0000000300000000000000000000000000000000000000750070000000000000000000DDDD0000000000000113D0079013D0070000F232FACFC30100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF01000000010000000000000000017802010000000000000024D51800
DynamicInfo REG_BINARY 03000000FBC511143F04CA0100000000000000000000000000000000
Hash REG_BINARY FD59AA8FA7E6D6C681945135C99BCEAC82F3DB23B037253C8DAD1617F5C5E425

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6B7AC694-8D6D-481B-9DD8-2A3A741ADA6D}
Path REG_SZ \Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem
Triggers REG_BINARY 15000000000000000160C1074860C1070030118B3B4CC8010060C1074860C107FFFFFFFFFFFFFFFF4221420248484848D8D9932B484848480048484848484848004848484848484805000000484848480C0000004848484801010000000000051200000048484848000000004848484838000000484848482C010000201C00002C010000FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000DDDD0000000000000160C1074860C1070030118B3B4CC80100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF010000000E000000000000000001EA07010000008070000024D51800
DynamicInfo REG_BINARY 030000003C0E20143F04CA0100000000000000000000000000000000
Hash REG_BINARY 9423B265CBAB426F81672F084E7D9866F685D983B62224712FF0DBC4FFEFE374

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7032A47F-EEA3-458F-88E0-5AE0AA911271}
Path REG_SZ \RealDownloaderDownloaderScheduledTaskS-1-5-21-3419578036-40878485-3947204858-1000
Hash REG_BINARY 77801E573760E051412558FA3438335C53D8116400F308315EDFA6719AF34602
Triggers REG_BINARY 15000000000000000101C202F001C202800529299743CE010001C202F001C202FFFFFFFFFFFFFFFF382141004848484813070780484848480048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848380000004848484858020000100E000080F40300FFFFFFFF070000000000000000000000000000000000000000000000000000002E0045000000000000000000DDDD0000000000000101C202F001C202800529299743CE0100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF010000000A0000000000000000019001010000000000000027000000
DynamicInfo REG_BINARY 03000000E0E2BFB0B843CE01D0C4E8F8026BCE010000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{731E9C62-95B5-4C8C-AB64-4CC591C9FF5B}
Path REG_SZ \Microsoft\Windows\RemoteAssistance\RemoteAssistanceTask
Triggers REG_BINARY 150000000000000000D1FF72882AF909000000000000000000D1FF72882AF909FFFFFFFFFFFFFFFF2811C2034848484866D894B3484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000512000000484848480000000048484848380000004848484858020000100E000080F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000CCCC00000000000000D1FF72882AF909000000000000000000D1FF72882AF909FFFFFFFFFFFFFFFF0F000000FFFFFFFF0000000000000000000000000000000001000000B49ED2CB95C16F02FA9045EBA5000000000000003C00510075006500720079004C006900730074003E003C00510075006500720079002000490064003D00220030002200200050006100740068003D002200530079007300740065006D0022003E003C00530065006C00650063007400200050006100740068003D002200530079007300740065006D0022003E002A005B00530079007300740065006D005B00500072006F00760069006400650072005B0040004E0061006D0065003D0027004D006900630072006F0073006F00660074002D00570069006E0064006F00770073002D00470072006F007500700050006F006C0069006300790027005D00200061006E00640020004500760065006E007400490044003D0031003500300032005D005D003C002F00530065006C006500630074003E003C002F00510075006500720079003E003C002F00510075006500720079004C006900730074003E00000048484848000000000000000000000000000000000000000000000000888800000000000000D1FF72882AF909000000000000000000D1FF72882AF909FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000000000014D454D4000000014D518009831BC07
DynamicInfo REG_BINARY 03000000806141143F04CA0100000000000000000000000000000000
Hash REG_BINARY 40F4A1B4CBF346720B7A186AAE912FCEA1FBE0DD82F48F51FCB9AD1A76BF2525

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{73259F86-29D6-42FF-B1E7-634F6E40D4F8}
Path REG_SZ \Microsoft\Windows\CertificateServicesClient\UserTask-Roam
Triggers REG_BINARY 1500000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF908500024848484824A4C7D0484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000504000000484848480000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF070000003C00000005000000000000000000000000000000000000007500700000000000000000007777000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000E95F000101000000000003000000005C005300070000001835370101484848484848487777000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000E95F000100080009001E00000000000000000008000000010000000148484848484848
DynamicInfo REG_BINARY 03000000A18548143F04CA0100000000000000000000000000000000
Hash REG_BINARY F2CE6AB8C22DCF1780141867455A46FA6D08F08C5B5D482002372E5FDE059B43

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7373E2BE-7F47-4F61-85C5-9F495F60F337}
Path REG_SZ \GoogleUpdateTaskUserS-1-5-21-3419578036-40878485-3947204858-1000Core
Hash REG_BINARY 5493AF49F607F7E53BBE955232853AF472B53D0044C2F07476B04EEE71B5B107
Triggers REG_BINARY 1500000000000000014543013845430100D82673E84DCE010045430138454301FFFFFFFFFFFFFFFF0021610148484848E426C9FF484848480048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848380000004848484858020000100E000000000000FFFFFFFF05000000000000000000000000000000000000000000000000000000750070000000000000000000DDDD000000000000014543013845430100D82673E84DCE0100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF0100000001000000000000000001B001010000000000000027000000
DynamicInfo REG_BINARY 03000000B028B0EF1373CC01B02E449CC168CE010000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{77CAF46C-AF8A-4BA3-B9F4-277A6FD47342}
Path REG_SZ \Microsoft\Windows\Media Center\PBDADiscovery
Hash REG_BINARY FD760AB16D2846C5BFB23557934499A525D5FCEC624AD083FD21DDE1326FAE9D
Triggers REG_BINARY 150000000000000000E72A01386F9672FFFFFFFFFFFFFFFF00E72A01386F9672000000000000000000214202484848484AC29224484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848480000000048484848
DynamicInfo REG_BINARY 030000006050880CDE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{785021A7-191F-4571-A974-8E7144DE9A5A}
Path REG_SZ \Microsoft\Windows\SideShow\SystemDataProviders
Hash REG_BINARY 8DFB2AAA49E262BC3CA3901D44152079D55567AAA637743E01E34DF36A5FB4C7
Triggers REG_BINARY 1500000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF002102024848484888275990484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000513000000484848480000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF070000000000000000000000000000000000000000000000000000006B0044000000000000000000AAAA000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF1E000000FFFFFFFF00000000000000000000000000E6A70001FFFFFF0200000002000100000000000148484848484848
DynamicInfo REG_BINARY 0300000080407A0ADE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{786A15E9-49DF-4638-B9C8-81EFEC13828B}
Path REG_SZ \Microsoft\Windows\WindowsBackup\AutomaticBackup
Hash REG_BINARY CF737A26FE36A26297E01F79C7B88CE133036D7B0B2EE5FBBFC86D6FA07945BC
Triggers REG_BINARY 1500000000000000012D3A01982D3A0100F80FFEEFFECC01002D3A01982D3A01FFFFFFFFFFFFFFFF4005420148484848CC2B58B8484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000512000000484848480000000048484848380000004848484858020000100E000080F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000DDDD000000000000012D3A01982D3A0100F80FFEEFFECC0100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF02000000010001000000000000013802010000000000000027000000
DynamicInfo REG_BINARY 030000001C88C6C78DDFCC0100D8633AE56ACE010000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{797CEE52-0431-47F4-BFE9-583EA4BE4811}
Path REG_SZ \Microsoft\Windows\MobilePC\HotStart
Hash REG_BINARY 0651BF3B9923F80BE8B50E253E843A95B0CFB7EB97A3EE4E7C955B543DD190E9
Triggers REG_BINARY 150000000000000000E42A0125D49972000000000000000000E42A0125D49972FFFFFFFFFFFFFFFF40854002484848487E9B658C484848480048484848484848004848484848484805000000484848480C0000004848484801010000000000050B000000484848480000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF0700000000000000000000000000000000000000000000000000000075006E000000000000000000AAAA00000000000000E42A0125D49972000000000000000000E42A0125D49972FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000E42A0101006800440052004D0049006E0069000148484848484848
DynamicInfo REG_BINARY 0300000040CE540FDE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7D3C7871-A917-4EF0-82E8-5F0A96423051}
Path REG_SZ \Microsoft\Windows\Bluetooth\UninstallDeviceTask
Triggers REG_BINARY 15000000000000000084FF7201000000FFFFFFFFFFFFFFFF0084FF7201000000000000000000000010054202484848480D99DFD7484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848480000000048484848
DynamicInfo REG_BINARY 0300000001E74A143F04CA0100000000000000000000000000000000
Hash REG_BINARY 90A6903C079DE796E0B72C7C3B740EA1AD655883DF0AC5468E3EB70311B7E7F7

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7EA27148-16CB-425B-A81A-6022AFA3709E}
Path REG_SZ \Microsoft\Windows\SideShow\GadgetManager
Hash REG_BINARY 2B16A83D35908A64E898F2743328C16CBC44DE6C67AF392D6B0F19AE00829A72
Triggers REG_BINARY 150000000000000000E42A0125D49972000000000000000000E42A0125D49972FFFFFFFFFFFFFFFF009140024848484863DEF7F2484848480048484848484848004848484848484804000000484848481000000048484848010200000000000520000000210200000000000048484848380000004848484800000000FFFFFFFF80F40300FFFFFFFF070000000000000000000000000000000000000000000000000000005C0053000000000000000000AAAA00000000000000E42A0125D49972000000000000000000E42A0125D49972FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000E42A010000650072006900650073003E0066000148484848484848
DynamicInfo REG_BINARY 03000000407C500BDE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{805601B5-161B-4F6E-9A0D-49C1907198B6}
Path REG_SZ \Microsoft\Windows\Media Center\UpdateRecordPath
Hash REG_BINARY EB28225E5ADAD1323F85643ABEC315B0F6F9F15D232F4DA9D56085F77D31388C
Triggers REG_BINARY 150000000000000000E72A01386F9672FFFFFFFFFFFFFFFF00E72A01386F9672000000000000000000214202484848482E977B9B484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848480000000048484848
DynamicInfo REG_BINARY 0300000080CC270DDE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8905ECD8-016F-4DC2-90E6-A5F1FA6A841A}
Path REG_SZ \Microsoft\Windows\Active Directory Rights Management Services Client\AD RMS Rights Policy Template Management (Automated)
Triggers REG_BINARY 150000000000000000D1FF7228F6BE0700000000000000000060C1074860C107FFFFFFFFFFFFFFFFC8850002484848484F482AB2484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000100000000484848480000000048484848380000004848484858020000100E0000100E0000FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000DDDD0000000000000160C1074860C10700781825AB03C70100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF0100000001000000000000000001BE0701000000100E000024D51800AAAA00000000000000D1FF7228F6BE07000000000000000000D1FF7228F6BE07FFFFFFFFFFFFFFFF100E0000FFFFFFFF00000000000000000000000000000000010000001984C2CB4C4D454D480000000148484848484848
DynamicInfo REG_BINARY 030000000C1C7D123F04CA0100000000000000000000000000000000
Hash REG_BINARY 5FEA8C5D590E391F05DC6BF182EE76FA80BE1EC03C9F02439F1A619A1D371CBB

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8DE64D1B-40FE-4836-BDB4-5F69F69E999A}
Path REG_SZ \Microsoft\Windows\Media Center\RecordingRestart
Hash REG_BINARY F5FE5470249EA95DE2CB01D9FA910FB31957ED0FB0F9E03208A37081A057AA08
Triggers REG_BINARY 150000000000000000E42A0125D49972000000000000000000E42A0125D49972FFFFFFFFFFFFFFFF60050202484848483E01CFAF484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000514000000484848480000000048484848380000004848484800000000FFFFFFFF80F40300FFFFFFFF06000000000000000000000000000000000000000000000000000000380024000000000000000000FFFF00000000000000E42A0125D49972000000000000000000E42A0125D49972FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000E42A0101006100720074000000690074000000
DynamicInfo REG_BINARY 03000000E0A3B10FDE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{920124A8-6DED-46FB-92DF-4C3288A17E24}
Path REG_SZ \Microsoft\Windows\WindowsBackup\Windows Backup Monitor
Hash REG_BINARY 9F4E5740CF2651CC44B37A21368259C0CE9C1C4140F9A174794CBB650867751B
Triggers REG_BINARY 150000000000000000000000000000000000000000000000002D3A01982D3A01FFFFFFFFFFFFFFFF40A14003484848484D5A71524848484800484848484848480048484848484848040000004848484810000000484848480102000000000005200000002102000000000000484848480000000048484848DDDD000000000000012D3A01982D3A0100901E77C886C50100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF01000000010000000000000000013802010000000000000027000000AAAA000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF2C010000FFFFFFFF00000000000000000000000000E43802010065002C002D00320031003900340001484848484848487777000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF2C010000FFFFFFFF00000000000000000000000000E438020100120001010000000000050B00000008000000000000050148484848484848
DynamicInfo REG_BINARY 03000000DC136CC78DDFCC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9334C323-F100-4656-9BA0-E4AA69C0F9C2}
Path REG_SZ \Microsoft\Windows\SystemRestore\SR
Triggers REG_BINARY 150000000000000000D1FF72C0FD700A0000000000000000005ADA09B05ADA09FFFFFFFFFFFFFFFF5221420248484848EDD0741F484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848483800000048484848580200007043010080F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000DDDD000000000000015ADA09B05ADA090080E1017470C50100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF010000000100000000000000000176020100000000000000D0D21800FFFF00000000000000D1FF72C0FD700A000000000000000000D1FF72C0FD700AFFFFFFFFFFFFFFFF08070000FFFFFFFF00000000000000000000000000000000014D454D4000000014D51800E84B5E0A
DynamicInfo REG_BINARY 03000000CBD36E123F04CA0100000000000000000000000000000000
Hash REG_BINARY A2281A82814B04BF0AE2441991C482C4859EA3BFF19E695D72CDF0B8E25A481C

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9B75C702-EA13-406A-BADB-6C588EE4375B}
Path REG_SZ \Microsoft\Windows\CertificateServicesClient\SystemTask
Triggers REG_BINARY 150000000000000000D1FF7228F6BE07000000000000000000D1FF7228F6BE07FFFFFFFFFFFFFFFFC0054202484848484E9F42CE484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000512000000484848480000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF070000003C0000000500000000000000000000000000000000000000750070000000000000000000CCCC00000000000000D1FF7228F6BE07000000000000000000D1FF7228F6BE07FFFFFFFFFFFFFFFF00000000FFFFFFFF0000000000000000000000000000000001000000B49ED2CB95C16F02FA9045EB1B010000000000003C00510075006500720079004C006900730074003E000A0020002000200020002000200020002000200020002000200020002000200020003C00510075006500720079002000490064003D00220030002200200050006100740068003D002200530079007300740065006D0022003E000A00200020002000200020002000200020002000200020002000200020002000200020002000200020003C00530065006C00650063007400200050006100740068003D002200530079007300740065006D0022003E000A002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002A005B00530079007300740065006D005B00500072006F00760069006400650072005B0040004E0061006D0065003D0027004D006900630072006F0073006F00660074002D00570069006E0064006F00770073002D00470072006F007500700050006F006C0069006300790027005D00200061006E00640020004500760065006E007400490044003D0031003500300032005D005D000A00200020002000200020002000200020002000200020002000200020002000200020002000200020003C002F00530065006C006500630074003E000A0020002000200020002000200020002000200020002000200020002000200020003C002F00510075006500720079003E000A0020002000200020002000200020002000200020002000200020002000200020003C002F00510075006500720079004C006900730074003E000000000000000000000000000000000000000000000000000000888800000000000000D1FF7228F6BE07000000000000000000D1FF7228F6BE07FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000000000010074006F0072000000000000000000FFFF00000000000000D1FF7228F6BE07000000000000000000D1FF7228F6BE07FFFFFFFFFFFFFFFF0A000000FFFFFFFF807000000000000000000000000000000100000000006E006700650029000000
DynamicInfo REG_BINARY 030000008B9673123F04CA0100000000000000000000000000000000
Hash REG_BINARY 5F1741F0E3673AEE6B7D983CDB718C34640A8C20B8D2F627B7AA491C12F16358

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9B849445-CF41-4195-AF4C-745EEE7F9D05}
Path REG_SZ \Microsoft\Windows\Media Center\MediaCenterRecoveryTask
Hash REG_BINARY EB514214B7FD8BCDF44B13E01117537348E099E5CC33A15A470C6C60FE50467D


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

Triggers REG_BINARY 150000000000000000E72A01386F9672FFFFFFFFFFFFFFFF00E72A01386F96720000000000000000000542024848484868DEB374484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848480000000048484848
DynamicInfo REG_BINARY 0300000020D00513DE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9EFACBE6-A797-4905-A0C6-014CD3000DBB}
Path REG_SZ \Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask
Triggers REG_BINARY 15000000000000000160C1074860C107002C7103E30BC9010060C1074860C107FFFFFFFFFFFFFFFF5221C20248484848D3FA1AB0484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005130000004848484800000000484848483800000048484848B400000010EF000080F40300FFFFFFFF070000008C0A00000100000000000000000000000000000000000000750070000000800000000000DDDD0000000000000160C1074860C107002C7103E30BC90100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF0200000001001000000000000001BE07010000000000000024D51800
DynamicInfo REG_BINARY 03000000220B52143F04CA0100000000000000000000000000000000
Hash REG_BINARY AEB03F1BC169236F2C3BF019F9D9ED3C213D1E4A568F8C67F1FC3F2EC08649A6

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9F54B95F-5096-4803-AE61-E9B3AC5B616D}
Path REG_SZ \Microsoft\Windows\MemoryDiagnostic\DecompressionFailureDetector
Triggers REG_BINARY 150000000000000000D1FF7228F6BE07000000000000000000D1FF7228F6BE07FFFFFFFFFFFFFFFF00A0C00248484848AA4E8B9D4848484800484848484848480048484848484848040000004848484810000000484848480102000000000005200000002102000000000000484848480000000048484848CCCC00000000000000D1FF7228F6BE07000000000000000000D1FF7228F6BE07FFFFFFFFFFFFFFFF00000000FFFFFFFF0000000000000000000000000000000001000000B49ED2CB95C16F02FA9045EBF4000000000000003C00510075006500720079004C006900730074003E003C00510075006500720079002000490064003D00220030002200200050006100740068003D0022004D006900630072006F0073006F00660074002D00570069006E0064006F00770073002D004B00650072006E0065006C002D00530074006F00720065004D00670072002F004F007000650072006100740069006F006E0061006C0022003E003C00530065006C00650063007400200050006100740068003D0022004D006900630072006F0073006F00660074002D00570069006E0064006F00770073002D004B00650072006E0065006C002D00530074006F00720065004D00670072002F004F007000650072006100740069006F006E0061006C0022003E002A005B00530079007300740065006D005B00500072006F00760069006400650072005B0040004E0061006D0065003D0027004D006900630072006F0073006F00660074002D00570069006E0064006F00770073002D004B00650072006E0065006C002D00530074006F00720065004D006700720027005D00200061006E00640020004500760065006E007400490044003D0036005D005D003C002F00530065006C006500630074003E003C002F00510075006500720079003E003C002F00510075006500720079004C006900730074003E000000484848484848000000000000000000000000000000000000000000000000
DynamicInfo REG_BINARY 03000000E3CD56143F04CA0100000000000000000000000000000000
Hash REG_BINARY CBB12F1ED12986181801A365A6F75001D31D2BB3CF7441BA8541894267D4CC42

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A1CFA52F-06F2-418D-ADDB-CD6456D66F43}
Path REG_SZ \Microsoft\Windows\RAC\RacTask
Triggers REG_BINARY 150000000000000000D1FF72882AF909000000000000000000D1FF72882AF909FFFFFFFFFFFFFFFF4021C20248484848E9C5E87D484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000513000000484848480000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000CCCC00000000000000D1FF72882AF909000000000000000000D1FF72882AF909FFFFFFFFFFFFFFFF00000000FFFFFFFF0000000000000000000000000000000001000000B49ED2CB95C16F02FA9045EBA8000000000000003C00510075006500720079004C006900730074003E003C00510075006500720079002000490064003D00220030002200200050006100740068003D0022004100700070006C00690063006100740069006F006E0022003E003C00530065006C00650063007400200050006100740068003D0022004100700070006C00690063006100740069006F006E0022003E002A005B00530079007300740065006D005B00500072006F00760069006400650072005B0040004E0061006D0065003D0027004D006900630072006F0073006F00660074002D00570069006E0064006F00770073002D00430045004900500027005D00200061006E00640020004500760065006E007400490044003D0031003000300037005D005D003C002F00530065006C006500630074003E003C002F00510075006500720079003E003C002F00510075006500720079004C006900730074003E000000484848484848000000000000000000000000000000000000000000000000DDDD0000000000000052DA092052DA090040A429C292C8010000000000000000000000000000000000000000000000000000000000000000100E000000000000FFFFFFFF000000000000000000000000000176020100000084030000D0D21800
DynamicInfo REG_BINARY 03000000272178143F04CA0100000000000000000000000000000000
Hash REG_BINARY E59879E1FF87CB7D11142664C919E0ADF61F5A9687D697C3F1C204FA4C56E303

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A2CFB6F3-B3AE-4971-8E29-C415BE22D2E5}
Path REG_SZ \Microsoft\Windows\Maintenance\WinSAT
Triggers REG_BINARY 150000000000000001E7500108E7500100283BA2114CC80100E7500108E75001FFFFFFFFFFFFFFFF3AA1400348484848D47E7A60484848480048484848484848004848484848484804000000484848481000000048484848010200000000000520000000200200000000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF070000000000000000000000000000000000000000000000000000008C1300000000000000000000DDDD00000000000001E7500108E7500100283BA2114CC80100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF02000000010001000000000000014501010000000000000027000000
DynamicInfo REG_BINARY 0300000047457F143F04CA0100000000000000000000000000000000
Hash REG_BINARY 9B40054FDFC971DD00551EA1F0551CC9B99C1E3823CA4BAC180DF0AA81AD3EB1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A316E645-1C56-45A6-BD6A-7DCA79778090}
Path REG_SZ \Microsoft\Windows\Customer Experience Improvement Program\UsbCeip
Triggers REG_BINARY 15000000000000000160C1074860C107009C9EE073A6C8010060C1074860C107FFFFFFFFFFFFFFFF7021C2024848484863251B5D484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000513000000484848480000000048484848380000004848484800000000FFFFFFFF80F40300FFFFFFFF070000008C0A00000100000000000000000000000000000000000000750070000000000000000000DDDD0000000000000160C1074860C107009C9EE073A6C80100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF0100000003000000000000000001EA07010000000000000024D51800
DynamicInfo REG_BINARY 03000000686986143F04CA0100000000000000000000000000000000
Hash REG_BINARY AE1862BA409924248DC1736D23E327B7154018FC40A4DA695BC777D1135A5244

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A39C2AF5-05B5-4620-9152-BCC4C022744D}
Path REG_SZ \Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan
Hash REG_BINARY 7E1BDEBBA8396E103DA84D2BB72004234BCECC7BF23EF09529F305F63B3D3AC4
Triggers REG_BINARY 150000000000000001FC3B01C0FC3B0180BC9151FD53BF0101FC3B01C0FC3B010000647763712F025221420348484848FCAE6793484848480048484848484848004848484848484805000000484848480C0000004848484801010000000000051200000048484848000000004848484838000000484848483C0000004038000080F40300FFFFFFFF070000000000000000000000000000000000000000000000000000003C0050000000000000000000DDDD00000000000001FC3B01C0FC3B0180BC9151FD53BF0101FC3B01C0FC3B010000647763712F02000000000000000000000000000000000000000000000000FFFFFFFF0200000001000100000000000001C405010000000000000027000000
DynamicInfo REG_BINARY 0300000050A8CA42A26ECE0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A6394592-54CE-4E93-8D64-1A068F462632}
Path REG_SZ \Microsoft\Windows\Customer Experience Improvement Program\Consolidator
Triggers REG_BINARY 1500000000000000014DDA09D84DDA0900C05B5DC3D0C301004DDA09D84DDA09FFFFFFFFFFFFFFFF4021420248484848F3FE730B484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848480000000048484848DDDD000000000000014DDA09D84DDA0900C05B5DC3D0C3010000000000000000000000000000000000000000000000000000000000000000300B010000000000FFFFFFFF0000000000000000000000000001F9090100000000000000D0D21800
DynamicInfo REG_BINARY 03000000292C8B143F04CA0100000000000000000000000000000000
Hash REG_BINARY 555CD377BA0A0532A5630EBE96AE9DB1843E642B2A15BA07C40C8B67BE00E87F

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A69D6C6D-0E2F-448A-9BEA-9F24B4F35C0D}
Path REG_SZ \{3D55F34C-0976-4C05-9756-277FE8258D6E}
Hash REG_BINARY AFF667112D35F5EB2E54C59816CD275CA86F48AD887E6B204267ABDB731537A0
Triggers REG_BINARY 1500000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF28214100484848482AE51207484848480048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848380000004848484858020000100E000080F40300FFFFFFFF070000000000000000000000000000000000000000000000000000007500700000000000000000008888000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000E6BE0101006B00200076006500720073006900
DynamicInfo REG_BINARY 030000000062EAE66131CE0110FAECE66131CE010000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AA903F78-7508-4DDC-8993-E148D2C21489}
Path REG_SZ \Microsoft\Windows\Media Center\mcupdate
Hash REG_BINARY D23B7887DFD927FA2B59E80B7E060FA80CAAA1E83153B4053EF49F210FFA35C6
Triggers REG_BINARY 150000000000000000E72A01386F9672FFFFFFFFFFFFFFFF00E72A01386F967200000000000000006005420248484848A548697F484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000514000000484848480000000048484848380000004848484800000000FFFFFFFF80F40300FFFFFFFF06000000000000000000000000000000000000000000000000000000380024000000000000000000
DynamicInfo REG_BINARY 03000000A084A511DE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AB771A9F-FB0F-4FA1-8B5F-48186615901E}
 Path REG_SZ \Microsoft\Windows\WindowsColorSystem\Calibration Loader
Triggers REG_BINARY 1500000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF0091000248484848A34B56BE484848480048484848484848004848484848484804000000484848481000000048484848010200000000000520000000210200000000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000AAAA000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000E95F0001000000660074004C4D454D4800000001484848484848487777000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000E95F0001007300740065006D00330032005C00010000006E0074000148484848484848
DynamicInfo REG_BINARY 030000004E648B123F04CA0100000000000000000000000000000000
Hash REG_BINARY 1C5E72CB821B89108191AC5B7FD3157B5CCE0474EDD44C9D1CEC819787F288AB

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AC93A5CA-2DFF-4FB7-9B95-FB62B744B4F9}
Path REG_SZ \Microsoft\Windows\Offline Files\Background Synchronization
Hash REG_BINARY AD7A12177D6040123220F9C762C3CEAC067CB60199D9BA539F02CC27DDAB61DA
Triggers REG_BINARY 150000000000000001E73B0298E73B0200C07640094CC80100E73B0298E73B02FFFFFFFFFFFFFFFFC8A1000248484848F33EE4E3484848480048484848484848004848484848484805000000484848480C0000004848484801010000000000050B000000484848480000000048484848380000004848484800000000FFFFFFFF80510100FFFFFFFF07000000000000000000000000000000000000000000000000000000500037000000000000000000DDDD00000000000001E73B0298E73B0200C07640094CC80100000000000000000000000000000000000000000000000000000000000000006054000000000000FFFFFFFF00000000000000000000000000012A0201000000100E000019000000
DynamicInfo REG_BINARY 0300000060DD4A08DE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{ACA66235-9BFB-440E-9BF9-CDF4DD587C2D}
Path REG_SZ \RealUpgradeScheduledTaskS-1-5-21-3419578036-40878485-3947204858-1000
Hash REG_BINARY 93FF61B2DF148E1484EA7E7C459FB7646E6D19CFE110ACF407238153F69F0061
Triggers REG_BINARY 1500000000000000011B5501881B55018062C70A4E32CE01001B5501881B5501FFFFFFFFFFFFFFFF38214100484848485D6F524D484848480048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848380000004848484858020000100E000080F40300FFFFFFFF070000000000000000000000000000000000000000000000000000002E0045000000000000000000DDDD000000000000011B5501881B55018062C70A4E32CE0100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF0100000007000000000000000001BA04010000000000000027000000
DynamicInfo REG_BINARY 03000000A0FB78926F32CE01B07AC32A7169CE010000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AE77AC7B-43C9-445B-85CA-5265F02A6F85}
Path REG_SZ \GoogleUpdateTaskUserS-1-5-21-3419578036-40878485-3947204858-1000UA
Hash REG_BINARY C5A8C043FCF78CF974D16B6F3C427B52AFD47B406753B088BF6073F50B5B69B9
Triggers REG_BINARY 1500000000000000014543013845430100D82673E84DCE010045430138454301FFFFFFFFFFFFFFFF0021610148484848EA6C5EAD484848480048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848380000004848484858020000100E000000000000FFFFFFFF05000000000000000000000000000000000000000000000000000000750070000000000000000000DDDD000000000000014543013845430100D82673E84DCE010000000000000000000000000000000000000000000000000000000000000000100E000080510100FFFFFFFF01000000010000000000000000014402010000000000000027000000
DynamicInfo REG_BINARY 03000000E0F20AF01373CC01F0C6DD9F286ECE010000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B13CBDFD-B8EE-432D-8AA8-A3C932D48251}
Path REG_SZ \WPD\SqmUpload_S-1-5-21-3419578036-40878485-3947204858-1000
Hash REG_BINARY F685FF2A8708765E062F6123F225D2B1308D249A33F194CC57F398A2A7BC713D
Triggers REG_BINARY 150000000000000001169A0028169A0000A0ABD56D4CC80101169A0028169A000080D8FCAD84D001D221C10248484848C0F98A99484848480048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C004200000048483800000048484848580200007043010084030000FFFFFFFF070000000000000000000000000000000000000000000000000000003C0050000000000000000000DDDD00000000000001169A0028169A0000A0ABD56D4CC80101169A0028169A000080D8FCAD84D001000000000000000000000000000000000000000000000000FFFFFFFF0100000001000000000000000001590201000000100E000027000000
DynamicInfo REG_BINARY 030000006052314CD973CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B5603D2E-7C83-4D83-96B7-73784F770E59}
Path REG_SZ \RealUpgradeLogonTaskS-1-5-21-3419578036-40878485-3947204858-1000
Hash REG_BINARY 539004E2F5032DCB08CAA2AF69364F300C86D787860FE5AF56145D3A54B57740
Triggers REG_BINARY 1500000000000000011B5501881B550100F95F0B4E32CE010000000000000000FFFFFFFFFFFFFFFF38214100484848481E72745F484848480048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848380000004848484858020000100E000080F40300FFFFFFFF070000000000000000000000000000000000000000000000000000002E0045000000000000000000AAAA000000000000011B5501881B550100F95F0B4E32CE010000000000000000FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000E8BA0401006900630065004100700069002E000048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848
DynamicInfo REG_BINARY 0300000060DFB6926F32CE01B0F42645A16ECE010000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B64A7A08-90B1-4383-8787-DEF924D6F6B2}
Path REG_SZ \Microsoft\Windows\Media Center\DispatchRecoveryTasks
Hash REG_BINARY 780DBABA615FA679F8133BE59B1A9F73B11E21DD466C8D144DF62612262EB80D
Triggers REG_BINARY 150000000000000000EA1F01386F1673FFFFFFFFFFFFFFFF00EA1F01386F167300000000000000000805420248484848FC88CFDD484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000512000000484848480000000048484848380000004848484800000000FFFFFFFF80F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000FFFFFFFF0000000000000000
DynamicInfo REG_BINARY 030000004076BC0EDE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B9A6DE44-D4C9-4D49-B5B0-820535CB3474}
Path REG_SZ \Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver
Hash REG_BINARY AC67DF7A4B9D1C8713C2D62FD8685113FB7749DE03811F77BBC4B4B06B74C2DA
Triggers REG_BINARY 150000000000000000E42A0125D49972000000000000000000E42A0125D49972FFFFFFFFFFFFFFFF00858003484848481FCACD844848484800484848484848480048484848484848040000004848484810000000484848480102000000000005200000002102000000000000484848480000000048484848AAAA00000000000000E42A0125D49972000000000000000000E42A0125D49972FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000E42A0101FFFFFF0200000002000100000000000148484848484848
DynamicInfo REG_BINARY 03000000E05F0A0ADE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B9BEE219-C29E-4310-819C-147A5A0E045E}
Path REG_SZ \Microsoft\Windows\Defrag\ScheduledDefrag
Triggers REG_BINARY 15000000000000000115E200B015E20000E8E6379DEFC4010015E200B015E200FFFFFFFFFFFFFFFF7E21420348484848A54D405E484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848483800000048484848B4000000803A090080F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000DDDD0000000000000115E200B015E20000E8E6379DEFC40100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF02000000010008000000000000018D0301000000201C000027000000
DynamicInfo REG_BINARY 03000000898D8D143F04CA0100000000000000000000000000000000
Hash REG_BINARY 70467C89670B100089D923FD427DBE7E91C2E93EFDA227539CF2601E2BCE1BF8

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BBA67AD0-4BA0-4B44-827B-FF419B70C057}
Path REG_SZ \Microsoft\Windows\Multimedia\SystemSoundsService
Triggers REG_BINARY 150000000000000000D1FF72882AF909000000000000000000D1FF72882AF909FFFFFFFFFFFFFFFF00854002484848489D3512E9484848480048484848484848004848484848484804000000484848481000000048484848010200000000000520000000210200000000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000AAAA00000000000000D1FF72882AF909000000000000000000D1FF72882AF909FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000D2180001000000660074004C4D454D480000000148484848484848
DynamicInfo REG_BINARY 03000000AEC58D123F04CA0100000000000000000000000000000000
Hash REG_BINARY FD7B51B9FB6DDD39374C586690F9E934EE65EB22FD61531B5408B20591031CE2

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BBEF5F6B-6562-4B59-80BB-E2FAF4EF8A24}
Path REG_SZ \Microsoft\Windows\SideShow\AutoWake
Hash REG_BINARY F1F3647B90EF320699C2A4CC877553D0AF5FBC91CCA73EC5D21D2C69ABA97BE7
Triggers REG_BINARY 150000000000000000E42A0125D49972000000000000000000E42A0125D49972FFFFFFFFFFFFFFFF00210202484848481CE1E052484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000513000000484848480000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF070000000000000000000000000000000000000000000000000000006B0044000000000000000000AAAA00000000000000E42A0125D49972000000000000000000E42A0125D49972FFFFFFFFFFFFFFFF3C000000FFFFFFFF00000000000000000000000000E42A0101FFFFFF0200000002000100000000000148484848484848
DynamicInfo REG_BINARY 0300000000E7BC0ADE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BFB012CF-548D-47D9-B5A2-9A60E815E667}
Path REG_SZ \Microsoft\Windows\SideShow\SessionAgent
Hash REG_BINARY DBC065695455F16521C1F2CCB4FBA71757C53FC6D38C9B87FE41BF26F286E159
Triggers REG_BINARY 1500000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF00850002484848483D09F37D484848480048484848484848004848484848484804000000484848481000000048484848010200000000000520000000210200000000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF07000000000000000000000000000000000000000000000000000000380024000000000000000000AAAA000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF0F000000FFFFFFFF00000000000000000000000000E9750001FFFFFF0200000002000100000000000148484848484848
DynamicInfo REG_BINARY 0300000060740B0BDE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C170367D-B924-4681-B98A-B114AC8E79E2}
Path REG_SZ \RealPlayerRealUpgradeScheduledTaskS-1-5-21-3419578036-40878485-3947204858-1000
Hash REG_BINARY 770ED17B0CD799D8BB30321D75C99E53D8B88FCF762ED46C2EB2088A7F72F566
Triggers REG_BINARY 150000000000000001962D01E8962D010038E8B70962CE0100962D01E8962D01FFFFFFFFFFFFFFFF382141004848484821215D86484848480048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848380000004848484858020000100E000080F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000DDDD00000000000001962D01E8962D010038E8B70962CE0100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF01000000070000000000000000014301010000000000000027000000
DynamicInfo REG_BINARY 0300000040A28D412B62CE01C038C2902B6DCE010000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C4D4E8D5-0D6D-42DD-83DA-68372255EAF7}
Path REG_SZ \Microsoft\Windows\Windows Activation Technologies\ValidationTaskDeadline
Hash REG_BINARY 3EAA52B7638B9C4D7880188441C081DFDE963236F4C5B27B5F59E9480EE7614B
Triggers REG_BINARY 1500000000000000008F5500D08F550080ED6E8E7077CE01008F5500D08F5500FFFFFFFFFFFFFFFFC821C20248484848103B0105484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000513000000484848480000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF070000000000000000000000000000000000000000000000000000002E0045000000000000000000DDDD000000000000008F5500D08F550080ED6E8E7077CE0100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF010000005A000000000000000001AA00010000000000000027000000
DynamicInfo REG_BINARY 03000000C0A758AFD172CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C6859845-4A2B-4EA4-BC5F-BCA3177BFF4A}
Path REG_SZ \Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Hash REG_BINARY 7C90BE8C4E068C3354BE8729C025D9F6D559F10FD57CCCD0065B51D0BCADC08E
Triggers REG_BINARY 15000000000000000000000000000000000000000000000000219100E0219100FFFFFFFFFFFFFFFFF8A14000484848480E0907C6484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000504000000484848480000000048484848380000004848484858020000100E0000100E0000FFFFFFFF07000000100E00000100000000000000000000000000000000000000200020000000000000000000DDDD00000000000001219100E021910000638F4726C9CA0100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF0100000007000000000000000001240101000000803A090027000000AAAA000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF84030000FFFFFFFF00000000000000000000000000E824010100650068006F006D0065005C0065000148484848484848
DynamicInfo REG_BINARY 03000000C0C3A5C8A373CC01600A7BA9826ECE010000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C6EB10A8-9963-4D96-B5A4-83000DC797DE}
Path REG_SZ \Apple\AppleSoftwareUpdate
Hash REG_BINARY 4EC97C6CBB0566A159C5D69FB8400A9C039BDA2BB3626BAB086A8FA7B5D3BF74
Triggers REG_BINARY 15000000000000000123650198236501006E2B2EDE99CD010023650198236501FFFFFFFFFFFFFFFF78A1400048484848CB9D1CB6484848480048484848484848004848484848484804000000484848481000000048484848010200000000000520000000210200000000000048484848380000004848484858020000100E000080F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000200020000000000000000000DDDD0000000000000123650198236501006E2B2EDE99CD0100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF02000000010004000000000000018301010000000000000027000000
DynamicInfo REG_BINARY 03000000A0C6B7685699CD0120E4051C986CCE010000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C90440A0-6D8F-423F-8F42-83EEF05CE708}
Path REG_SZ \Microsoft\Windows\AppID\VerifiedPublisherCertStoreCheck
Triggers REG_BINARY 150000000000000000D1FF72409CEA07000000000000000000D1FF72409CEA07FFFFFFFFFFFFFFFF7E11020248484848218D22DB484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005130000004848484800000000484848483800000048484848B40000007043010080F40300FFFFFFFF0A000000000000000000000000000000000000000000000000000000750070000000000000000000FFFF00000000000000D1FF72409CEA07000000000000000000D1FF72409CEA07FFFFFFFFFFFFFFFF08070000FFFFFFFF80510100000000000000000000000000014D454D4000000068D71800E0B12B00
DynamicInfo REG_BINARY 030000008B9673123F04CA0100000000000000000000000000000000
Hash REG_BINARY A8559F6CCCA2DF09F1225F5DCFF67D8C6FF124FC5F85DCDF7F191DC7CF13EADE

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D21B403E-ACF9-4AE0-AF23-F2868758D742}
Path REG_SZ \Microsoft\Windows\Media Center\StartRecording
Hash REG_BINARY 6F3251475E855FE31A519893A624488246E71775F85E8A3FF3D3B155D2685F76
Triggers REG_BINARY 150000000000000000EA1F01386F1673FFFFFFFFFFFFFFFF00EA1F01386F167300000000000000004807420248484848FB7B73CB484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000514000000484848480000000048484848380000004848484858020000100E000080F40300FFFFFFFF0700000000000000000000000000000000000000000000000000000075006E000000000000000000
DynamicInfo REG_BINARY 03000000107C998C3E82CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D21F6024-191F-4454-BBBC-09A650DA2549}
Path REG_SZ \Microsoft\Windows\Application Experience\AitAgent
Triggers REG_BINARY 15000000000000000160C1074860C1070004C51F5309C8010060C1074860C107FFFFFFFFFFFFFFFF7E214202484848482774D537484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848483800000048484848B40000006035010080F40300FFFFFFFF09000000000000000000000000000000000000000000000000000000750070000000000000000000DDDD0000000000000160C1074860C1070004C51F5309C80100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF0100000001000000000000000001EA07010000000000000024D51800
DynamicInfo REG_BINARY 03000000A1065F153F04CA0100000000000000000000000000000000
Hash REG_BINARY 9A13FF7FB54C9212AAC3663AEE2889A6AFB0BA6898ABC3F9A811E6216987B833

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D622195C-D680-4FEA-9C56-59660C7C9E94}
Path REG_SZ \Microsoft\Windows\UPnP\UPnPHostConfig
Triggers REG_BINARY 15000000000000000084FF7201000000FFFFFFFFFFFFFFFF0084FF72010000000000000000000000102142024848484811E47727484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848480000000048484848
DynamicInfo REG_BINARY 03000000016861153F04CA0100000000000000000000000000000000
Hash REG_BINARY 6A0C38920812DABEF61FED2083D14E9E085CDBD0F5459B3159F0F4504CC8B4B0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D8BB5B7F-D0CA-4F67-A3D7-73E1D05F63DA}
Path REG_SZ \Microsoft\Windows\Registry\RegIdleBackup
Triggers REG_BINARY 15000000000000000160C1074860C10700C07640094CC8010060C1074860C107FFFFFFFFFFFFFFFF4E20C20248484848C7925C29484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848483800000048484848B40000007043010000000000FFFFFFFF05000000000000000000000000000000000000000000000000000000750070000000000000000000DDDD0000000000000160C1074860C10700C07640094CC80100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF010000000A000000000000000001EA0701000000100E000024D51800
DynamicInfo REG_BINARY 03000000C22A66153F04CA0100000000000000000000000000000000
Hash REG_BINARY AE0DB2F31A30B208E0C50EF64C29948A828612AC605CA8F6B3E42F51EA6C09E1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DE8699D2-8A05-42F7-8A85-5162AF47D26A}
Path REG_SZ \Microsoft\Windows\Windows Error Reporting\QueueReporting
Triggers REG_BINARY 150000000000000000D1FF72B8397802000000000000000000D1FF72B8397802FFFFFFFFFFFFFFFF40854002484848488A154A60484848480048484848484848004848484848484804000000484848481000000048484848010200000000000520000000210200000000000048484848380000004848484800000000FFFFFFFF80F40300FFFFFFFF05000000000000000000000000000000000000000000000000000000750070000000000000000000AAAA00000000000000D1FF72B8397802000000000000000000D1FF72B8397802FFFFFFFFFFFFFFFF0C030000FFFFFFFF0000000000000000000000000000000001000000000000004C4D454D480000000148484848484848
DynamicInfo REG_BINARY 030000000E2790123F04CA0100000000000000000000000000000000
Hash REG_BINARY 6EB7D50A0F0E813EF39052146B2AB58692ED68D82E0E8E733043ECC9334D16D1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DE8BAE53-2809-4F75-85EF-427D364B9B2C}
Path REG_SZ \Microsoft\Windows\CertificateServicesClient\UserTask
Triggers REG_BINARY 150000000000000000D1FF7228F6BE07000000000000000000D1FF7228F6BE07FFFFFFFFFFFFFFFFC085400248484848965281FA484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000504000000484848480000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF070000003C0000000500000000000000000000000000000000000000750070000000000000000000CCCC00000000000000D1FF7228F6BE07000000000000000000D1FF7228F6BE07FFFFFFFFFFFFFFFF00000000FFFFFFFF0000000000000000000000000000000001000000B49ED2CB95C16F02FA9045EBA5000000000000003C00510075006500720079004C006900730074003E003C00510075006500720079002000490064003D00220030002200200050006100740068003D002200530079007300740065006D0022003E003C00530065006C00650063007400200050006100740068003D002200530079007300740065006D0022003E002A005B00530079007300740065006D005B00500072006F00760069006400650072005B0040004E0061006D0065003D0027004D006900630072006F0073006F00660074002D00570069006E0064006F00770073002D00470072006F007500700050006F006C0069006300790027005D00200061006E00640020004500760065006E007400490044003D0031003500300033005D005D003C002F00530065006C006500630074003E003C002F00510075006500720079003E003C002F00510075006500720079004C006900730074003E00000048484848000000000000000000000000000000000000000000000000888800000000000000D1FF7228F6BE07000000000000000000D1FF7228F6BE07FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000000000014D454D4000000068D71800E0B42B00AAAA00000000000000D1FF7228F6BE07000000000000000000D1FF7228F6BE07FFFFFFFFFFFFFFFF00000000FFFFFFFF80700000000000000000000000000000010000001984C2CB4C4D454D480000000148484848484848
DynamicInfo REG_BINARY 030000000E2790123F04CA0100000000000000000000000000000000
Hash REG_BINARY DB89FE61B38CF541D584C34612B856A825EF9A287779F0CCBFAA95A0183E8781

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DF3EA79F-FB5B-48FA-B81E-53A2B8278A52}
Path REG_SZ \Microsoft\Windows\Media Center\PBDADiscoveryW1
Hash REG_BINARY ED6C3AF77BC32514D0E4A46115FB377242E60FDE46F8FF3785AF624B20462691
Triggers REG_BINARY 150000000000000000E72A01386F9672FFFFFFFFFFFFFFFF00E72A01386F96720000000000000000400542024848484820231FCE484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000512000000484848480000000048484848380000004848484800000000FFFFFFFF100E0000FFFFFFFF07000000000000000000000000000000000000000000000000000000760069000000000000000000
DynamicInfo REG_BINARY 03000000E0741B11DE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E4B0EF8F-3174-48ED-9CCD-72F89DA2862E}
Path REG_SZ \RealDownloaderRealUpgradeScheduledTaskS-1-5-21-3419578036-40878485-3947204858-1000
Hash REG_BINARY 0D7C821FC823FE77CE26670E9CEE7E2C76334D7846D87A37C946FE3A112E43A4
Triggers REG_BINARY 1500000000000000013837012038370180F89AB94261CE010038370120383701FFFFFFFFFFFFFFFF38214100484848481415DB1E484848480048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848380000004848484858020000100E000080F40300FFFFFFFF070000000000000000000000000000000000000000000000000000002E0045000000000000000000DDDD000000000000013837012038370180F89AB94261CE0100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF0100000007000000000000000001E301010000000000000027000000
DynamicInfo REG_BINARY 0300000010F04F426461CE01F0EF9069E466CE010000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E6F3A527-8B0B-43FA-94EB-584032761924}
Path REG_SZ \Microsoft\Windows\Active Directory Rights Management Services Client\AD RMS Rights Policy Template Management (Manual)
Triggers REG_BINARY 150000000000000000D1FF7228F6BE07000000000000000000D1FF7228F6BE07FFFFFFFFFFFFFFFFF885400248484848CE52BAAA484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000100000000484848480000000048484848380000004848484858020000100E0000100E0000FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000AAAA00000000000000D1FF7228F6BE07000000000000000000D1FF7228F6BE07FFFFFFFFFFFFFFFF100E0000FFFFFFFF00000000000000000000000000000000000000001984C2CB4C4D454D480000000148484848484848
DynamicInfo REG_BINARY 030000006F8892123F04CA0100000000000000000000000000000000
Hash REG_BINARY 62050C0D7C474998414FA2C47E4D346ECE628D7D974F377EE3B8AE2E60982EE3

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E79B2998-8F63-451A-A56D-26EDC0A5098A}
Path REG_SZ \Microsoft\Windows\Shell\WindowsParentalControlsMigration
Triggers REG_BINARY 1500000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF400582034848484879F2196C484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000512000000484848480000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF070000003C0000000100000000000000000000000000000000000000750070000000000000000000AAAA000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF01000000FFFFFFFF00000000000000000000000000E6560001000000660074004C4D454D480000000148484848484848
DynamicInfo REG_BINARY 030000002F4B97123F04CA0100000000000000000000000000000000
Hash REG_BINARY 6D5D71FCD9AF69DE33A5E47E6DE894CAD15A010944B2EF58C072C7F61EDB87E8

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E8164C0D-216C-4B6B-9EB8-31BF958B8014}
Path REG_SZ \Microsoft\Windows\NetTrace\GatherNetworkInfo
Triggers REG_BINARY 15000000000000000084FF7201000000FFFFFFFFFFFFFFFF0084FF720100000000000000000000000085400348484848A31C713A484848480048484848484848004848484848484804000000484848481000000048484848010200000000000520000000210200000000000048484848380000004848484800000000FFFFFFFF80F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000
DynamicInfo REG_BINARY 030000001AE132163F04CA0100000000000000000000000000000000
Hash REG_BINARY 9E154171408F80E0D5CEB4D8F775758B345B3FD705AD0B3058B1732870BE807F

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E8312B17-3798-4531-9106-372FC3C021E1}
Path REG_SZ \Microsoft\Windows\Media Center\PBDADiscoveryW2
Hash REG_BINARY D2B529269E9CD0C8E777506B13CBC3B9EC133ADCFA2160D03B795663C6D14D51
Triggers REG_BINARY 150000000000000000E72A01386F9672FFFFFFFFFFFFFFFF00E72A01386F967200000000000000004005420248484848215727BB484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000512000000484848480000000048484848380000004848484800000000FFFFFFFF100E0000FFFFFFFF07000000000000000000000000000000000000000000000000000000760069000000000000000000
DynamicInfo REG_BINARY 03000000A0585911DE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{EC50B587-5B8E-4156-9BE9-897AB610E46A}
Path REG_SZ \Microsoft\Windows\Media Center\PvrRecoveryTask
Hash REG_BINARY F18E7E603225B086AE1605B0EDDA4E41A11A6940F8C50583C566546D4753DBF9
Triggers REG_BINARY 150000000000000000E72A01386F9672FFFFFFFFFFFFFFFF00E72A01386F96720000000000000000000542024848484831C9DCAA484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005140000004848484800000000484848480000000048484848
DynamicInfo REG_BINARY 030000000007E111DE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{ED527CB1-07E8-4D12-B7D2-A7202C34E3D7}
Path REG_SZ \Microsoft\Windows\Media Center\OCURActivate
Hash REG_BINARY 21F0C71001FDAD4060D134F2914F036D1DAA814D9CF6206B8BBEA1D09AC5125B
Triggers REG_BINARY 150000000000000000E72A01386F9672FFFFFFFFFFFFFFFF00E72A01386F967200000000000000000021420248484848C7422EAF484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848480000000048484848
DynamicInfo REG_BINARY 030000000010BF0CDE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F04A1936-8F65-47EF-8CA6-9CA4D357FCC5}
Path REG_SZ \Microsoft\Windows\Media Center\PeriodicScanRetry
Hash REG_BINARY 8E6911CA59C45F2EE0BF63453DCD580B285E92CE1BFE4589F956D67C57F75EA3
Triggers REG_BINARY 1500000000000000015496721C000000006ECFFE35D4C60101E32A01D8E72A01006ECFFE35D4C6013021020248484848890E4413484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000514000000484848480000000048484848380000004848484800000000FFFFFFFF80F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000380024000000000000000000DDDD000000000000015496721C000000006ECFFE35D4C60100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF00000000000000000000000000000000010000000000000000000000
DynamicInfo REG_BINARY 03000000C038B90BDE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F1369A11-E983-4458-B390-712EFA1CBA44}
Path REG_SZ \Microsoft\Windows\TextServicesFramework\MsCtfMonitor
Triggers REG_BINARY 150000000000000000D1FF72409CEA07000000000000000000D1FF72409CEA07FFFFFFFFFFFFFFFF0085C00248484848E774F314484848480048484848484848004848484848484804000000484848481000000048484848010200000000000520000000210200000000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000AAAA00000000000000D1FF72409CEA07000000000000000000D1FF72409CEA07FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000000000010000001984C2CB4C4D454D480000000148484848484848
DynamicInfo REG_BINARY 0300000090AC99123F04CA0100000000000000000000000000000000
Hash REG_BINARY F7CCB39021E7E245CADCD75E426102522087DD3AC91AF7D4387D8D70ED6DDAB4

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F4B7FFA5-CFCE-4EDA-9BE5-13913DEB4B68}
Path REG_SZ \Microsoft\Windows\Wininet\CacheTask
Hash REG_BINARY B40015C2E03A4473C93284B4A79D0D10020C191C69D34B60D89B92D8942A01FC
Triggers REG_BINARY 1500000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF008540024848484814F966A5484848480048484848484848004848484848484804000000484848481000000048484848010200000000000520000000210200000000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000AAAA000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000E69E01010000000000000000000000000000000148484848484848
DynamicInfo REG_BINARY 0300000040B378B5ED2FCE0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F59FBF07-EE85-492D-91C3-DC21ADB54111}
Path REG_SZ \{072CA5B2-5F03-4BCF-A02A-A0F39845F82E}
Hash REG_BINARY AFF667112D35F5EB2E54C59816CD275CA86F48AD887E6B204267ABDB731537A0
Triggers REG_BINARY 1500000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF28214100484848482AE51207484848480048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000B49ED2CB95C16F02FA9045EBE8030000484848480E0000004848484842002D00500043005C00420000004848380000004848484858020000100E000080F40300FFFFFFFF070000000000000000000000000000000000000000000000000000007500700000000000000000008888000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF00000000FFFFFFFF00000000000000000000000000E9300201000000630065000200000240DF0000
DynamicInfo REG_BINARY 03000000804208B46131CE0150200FB46131CE010000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F68AC12F-8CBC-438E-A6EE-8D7951ABB1D9}
Path REG_SZ \Microsoft\Windows\Media Center\RegisterSearch
Hash REG_BINARY 3C0B66D64686766827850B149B5AFB544220673B5B4D47CB5556EF2C868E2381
Triggers REG_BINARY 150000000000000000E72A01386F9672FFFFFFFFFFFFFFFF00E72A01386F967200000000000000000021420248484848A9A3FB23484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848480000000048484848
DynamicInfo REG_BINARY 03000000C056A80DDE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F68FF8CA-B7A1-43C3-A45B-01A9281D19F0}
Path REG_SZ \Microsoft\Windows\Media Center\ActivateWindowsSearch
Hash REG_BINARY 440979398F3AB418F90B93DC0DD97070F5EF2337860AB42775202EF71D70B9E9
Triggers REG_BINARY 150000000000000000E72A01386F9672FFFFFFFFFFFFFFFF00E72A01386F9672000000000000000000214202484848489039649F484848480048484848484848004848484848484805000000484848480C000000484848480101000000000005120000004848484800000000484848480000000048484848
DynamicInfo REG_BINARY 0300000080927E0EDE72CC0100000000000000000000000000000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F93C7104-998A-4A38-B935-775A3138B3C3}
Path REG_SZ \Microsoft\Windows\Location\Notifications
Triggers REG_BINARY 150000000000000000D1FF72C0FD700A000000000000000000D1FF72C0FD700AFFFFFFFFFFFFFFFF0085400248484848DFDD7976484848480048484848484848004848484848484805000000484848480C0000004848484801010000000000050B000000484848480000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF07000000000000000000000000000000000000000000000000000000750070000000000000000000CCCC00000000000000D1FF72C0FD700A000000000000000000D1FF72C0FD700AFFFFFFFFFFFFFFFF00000000FFFFFFFF0000000000000000000000000000000001000000B49ED2CB95C16F02FA9045EBA4000000000000003C00510075006500720079004C006900730074003E003C00510075006500720079002000490064003D00220030002200200050006100740068003D0022004100700070006C00690063006100740069006F006E0022003E003C00530065006C00650063007400200050006100740068003D0022004100700070006C00690063006100740069006F006E0022003E002A005B00530079007300740065006D005B00500072006F00760069006400650072005B0040004E0061006D0065003D0027004C006F0063006100740069006F006E004E006F00740069006600690063006100740069006F006E00730027005D00200061006E00640020004500760065006E007400490044003D0031005D005D003C002F00530065006C006500630074003E003C002F00510075006500720079003E003C002F00510075006500720079004C006900730074003E000000484848484848000000000000000000000000000000000000000000000000
DynamicInfo REG_BINARY 030000005B2941163F04CA0100000000000000000000000000000000
Hash REG_BINARY E2EEC5DC638B16A8DCF4E83A3514F28DC7FFB5CA04854176D252D9095C29B343

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FFB8486A-9861-4B82-BE38-C7F8FB1B6605}
Path REG_SZ \Microsoft\Windows\Task Manager\Interactive
Triggers REG_BINARY 15000000000000000084FF7201000000FFFFFFFFFFFFFFFF0084FF720100000000000000000000000085C0024848484819D7D458484848480048484848484848004848484848484805000000484848480C00000048484848010100000000000504000000484848480000000048484848380000004848484800000000FFFFFFFF00000000FFFFFFFF05000000000000000000000000000000000000000000000000000000750070000000000000000000
DynamicInfo REG_BINARY 030000001CEC45163F04CA0100000000000000000000000000000000
Hash REG_BINARY 89DE49D146B9DA8A3F686F98CC965767AFCD9716B08A2FC65105DC7B0DDDC519


----------



## jenae

*Re: taskeng.exe keeps popping up*

Hi, it's still there and I am not surprised, there is an error in my reg mod cmd. Terribly sorry. (will do no harm) As before copy paste all below in the code box into notepad. In notepad select "File" from the main menu then "save as" in the box type:- word.reg and save to desktop, locate the saved file and double click it agree to add to registry, should receive a message that this has happened, then restart computer:-




Code:


Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{341ECAFB-0959-49CD-B367-5707F008D7AB}]


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

this is what came up


----------



## spunk.funk

*Re: taskeng.exe keeps popping up*



> copy paste all below in the code box into *notepad.* In notepad select "*File*" from the main menu then "save as" in the box type:- *word.reg* and * save to desktop*, locate the saved file and* double click it* agree to add to registry,


Jenae would like you to copy the text in the code box and paste it in *Notepad *not the command prompt. 
Be aware that the right margin is way far to the right to get _all _of the code


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

oops. my apologies.. hold on


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

this is what came up


----------



## jenae

*Re: taskeng.exe keeps popping up*

Hi jozanne, just relax this is really quite simple, lets do this over again, this is the code box:-




Code:


Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{341ECAFB-0959-49CD-B367-5707F008D7AB}]

Now we need to copy everything in the code box to notepad, so highlight all the text in the box and right click on it select "copy" now open notepad and in a blank spot right click and select "paste" notepad will look like this:-

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{341ECAFB-0959-49CD-B367-5707F008D7AB}]

Next in notepad go to the main menu and select "File" under file select "Save As" call it word.reg, and save it to desktop, locate the saved file and double click it, you will be asked if you wish to add this to the registry agree, a message will tell you the key has been added, restart computer.

The reason you get the message in your last post is because you did not include ALL in the code box ie:- Windows Registry Editor Version 5.00.


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

done.. it have not popped up since i have restarted.. at least just yet... is that it? or there is more?


----------



## jenae

*Re: taskeng.exe keeps popping up*

Hi, no you have finally done it, and no doubt learnt about your computer into the bargain.


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

thank you very much... can i delete everything that i had to save and download now?


----------



## jenae

*Re: taskeng.exe keeps popping up*

Hi, Yes if you wish or leave them for a few days they will do no harm.


----------



## Jozanne

*Re: taskeng.exe keeps popping up*

ok thnx much again


----------



## Jozanne

what causes that problem?


----------



## Superion

I'm assuming a corrupt registry since it seems you were missing such key. Having that blank entry was a clue. Blank MSCONFIG entries occur when a registry value exists but contains no data. This can occur when a application install or uninstall fails, or if a pieces of malware has modified the registry. From further reading I have come to the conclusion that there is no specific Diagnostic tool that can repair missing registry values as that would be impossible. "A Registry database contains information that is specific to an individual computers hardware, drivers, and installed applications. A registry key serves as a container for registry values, like a folder is a container for files. While the individual registry keys may be quite similar to those in other computers the values that inhabit them are very different." I wouldn't suggest reading up how to find the solution since this issue could be only your computer's issue.

In this case you didn't have the system restore option since you didn't seem to have any prior to the issue. Usually updating windows will automatically create a restore point. There are some that claim how to replace or change registry keys as I would {{{{{NOT}}}}} suggest you try. Fortunately, It seems Jenae has found a way, but after reading I'm not too sure what exactly is going on here. I know vbs is used for scripting. That file pinpoints how programs start up. Other then that she has me lost. 

I hope this was at best a little informative and answered any questions you may have.


----------



## joeten

Superion just an FYI jenae is a male his name is his cat, Also he is a very experienced and highly regarded forensic analyst for want of a better description, and usually has a good idea which values to use. I have seldom seen him stumped or getting it wrong.


----------



## Superion

Thanks Joeten sorry for the mix up. i do appreciate any corrections. I enjoy reading and reasearching everything jenae is a part of.


----------



## joeten

LOL I don't think he will hold it against you.


----------



## BIGBEARJEDI

Awesome fix, Jenae!!:grin:

<<<BIGBEARJEDI>>>


----------



## TechDemic

i had this taskeng.exe boxpoppingup with another box in front of saying it could find c:/client etc. file.
I cleaned this computer with malwarebytes, mse, and adware.
and avast.
It is clean, but now the only thing that will randomnly pop up everyonce in a while i the taskeng.exe box, it is empty just and uderscrore in it. i believe i am missing something like this person. Can someone help me?
I did what was instructed of this user in this forum but it didnt fix my problem.


----------



## Superion

I'm not an admin or anything but I would recommend for you to make another thread as your problem can exist in a different form.


----------

