Windows 10: A strange login. Or an attack?

I do not no what happened but today I started my pc, and suddenly the name of my network had been changed. Or the name of my modem. After rebooting my modem to default settings I logged in witn my Microsoft account. Wich should me the only way to start windows. But after I checked the events that occurred on my pc I saw a strange event. I am not a IT specialist and not even a amature but this is what I found. Please explain what I should do. And excuse the poor grammar. I,m dutch and English I sn't my language.




- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" />
<EventID>1530</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2018-10-15T16:02:33.107134300Z" />
<EventRecordID>3610</EventRecordID>
<Correlation />
<Execution ProcessID="1296" ThreadID="4848" />
<Channel>Application</Channel>
<Computer>Doggytop</Computer>
<Security UserID="S-1-5-18" />
</System>
- <EventData Name="EVENT_HIVE_LEAK">
<Data Name="Detail">42 user registry handles leaked from \Registry\User\S-1-5-21-3599373940-2952038636-1933688023-1001: Process 1044 (\Device\HarddiskVolume4\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001 Process 908 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\System\GameConfigStore\Parents Process 3608 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Microsoft\CommsAPHost\Test Process 908 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\System\GameConfigStore Process 2380 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Policies\Microsoft\Windows\CloudContent Process 10552 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Microsoft\Windows\CurrentVersion\PushNotifications Process 8440 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall Process 3608 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Microsoft\Windows\CurrentVersion\Explorer Process 10552 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Microsoft\Windows\CurrentVersion\Explorer Process 10552 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\Cache\DefaultAccount\$quietmoment1$windows.data.notifications.quietmoment\Current Process 11688 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process 10552 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process 2380 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Microsoft\Windows\CurrentVersion\Privacy Process 10552 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\Cache\DefaultAccount\$microsoft.quiethoursprofile.alarmsonly$windows.data.notifications.quiethoursprofile\Current Process 10552 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\Cache\DefaultAccount\$microsoft.quiethoursprofile.alarmsonly$windows.data.notifications.quiethoursprofile\Current Process 10552 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\Cache\DefaultAccount\$$windows.data.notifications.quiethourssettings\Current Process 10552 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore Process 10552 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore Process 10552 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore Process 10552 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore Process 10552 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore Process 10552 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore Process 10552 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore Process 10552 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Microsoft\Internet Explorer\Main\FeatureControl Process 11688 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Microsoft\Internet Explorer\Main\FeatureControl Process 10552 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\Cache\DefaultAccount\$quietmoment0$windows.data.notifications.quietmoment\Current Process 2380 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Policies\Microsoft\Windows\DataCollection Process 11688 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Process 10552 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Process 3608 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Microsoft\Internet Explorer\Main Process 11688 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Microsoft\Internet Explorer\Main Process 10552 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001





\Software\Microsoft\Internet Explorer\Main Process 3608 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Microsoft\ActiveSync\Partners Process 10552 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\Cache\DefaultAccount\$quietmoment2$windows.data.notifications.quietmoment\Current Process 3608 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Microsoft\Unified Store\HighWaterMarks\C:_Users_TV-CH_AppData_Local_Comms_UnistoreDB_store.vol Process 10552 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\Cache\DefaultAccount\$quietmoment3$windows.data.notifications.quietmoment\Current Process 8252 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Microsoft\Windows NT\CurrentVersion\Fonts Process 908 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\System\GameConfigStore\Children Process 3608 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Microsoft\Internet Explorer\Security Process 11688 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Microsoft\Internet Explorer\Security Process 10552 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Microsoft\Internet Explorer\Security Process 10552 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3599373940-2952038636-1933688023-1001\Software\Microsoft\Windows\CurrentVersion\PushNotifications\wpnidm</Data>
</EventData>
</Event>

:)

 

Can't login to new computer w/Windows 10

Hi,

Thank you for your reply.

• 
  Are you able to login to Microsoft Account on Web?
  
• 
  Have you installed any language pack?
  

I suggest you to follow the steps below and check if it helps.

Step 1: I suggest you to select the appropriate language in login screen at the bottom right corner and check if it helps.

Steps 2: Use On-screen keyboard in the login screen to login and check if it helps.

Hope this helps. If the issue remains unresolved, please get back to us and we would be happy to help.

 

About Ransomware attack

Here is Microsoft's Customer Guidance on the Ransomware Attack:

• In March, we released a security update which addresses the vulnerability that these attacks are exploiting. Those who have Windows Update enabled are protected against attacks on this vulnerability. For those organizations who have not yet applied the
  security update, we suggest you immediately deploy Microsoft Security Bulletin MS17-010.

• For customers using Windows Defender, we released an update earlier today which detects this threat as Ransom:Win32/WannaCrypt.
  As an additional “defense-in-depth” measure, keep up-to-date anti-malware software installed on your machines. Customers running anti-malware software from any number of security companies can confirm with their provider, that they are protected.

• This attack type may evolve over time, so any additional defense-in-depth strategies will provide additional protections. (For example, to further protect against SMBv1 attacks, customers
  should consider blocking legacy protocols on their networks).

For the full article,
Click HERE

 

Router DoS Attack Logs

wow OP, that is a huge list and range of IPs

you should nslookup each one to see whats up with those.

my router logged 2 "dos attacks" like a few days. it was amazon, my ISP and some other place i forgot. strange, but they stopped already