Windows 10: RestartByRestartManager?

Can someone please explain what this is? Some process created this file in C:\ .

:)

 

Sudden slow boot time on Windows Loading screen with SSD


Malwarebyteswww.malwarebytes.com-Log Details-Scan Date: 2/22/18Scan Time: 1:10 PMLog File: f0b33c60-17ea-11e8-867d-4ccc6af66280.jsonAdministrator: Yes-Software Information-Version: 3.3.1.2183Components Version: 1.0.262Update Package Version: 1.0.4052License: Free-System Information-OS: Windows 10 (Build 16299.248)CPU: x64File System: NTFSUser: CUERVOTR\thiag-Scan Summary-Scan Type: Threat ScanResult: CompletedObjects Scanned: 291045Threats Detected: 0(No malicious items detected)Threats Quarantined: 0(No malicious items detected)Time Elapsed: 1 min, 5 sec-Scan Options-Memory: EnabledStartup: EnabledFilesystem: EnabledArchives: EnabledRootkits: DisabledHeuristics: EnabledPUP: DetectPUM: Detect-Scan Details-Process: 0(No malicious items detected)Module: 0(No malicious items detected)Registry Key: 0(No malicious items detected)Registry Value: 0(No malicious items detected)Registry Data: 0(No malicious items detected)Data Stream: 0(No malicious items detected)Folder: 0(No malicious items detected)File: 0(No malicious items detected)Physical Sector: 0(No malicious items detected)(end)

RogueKiller V12.12.5.0 (x64) [Feb 19 2018] (Free) por Adlice Softwaremail : http://www.adlice.com/contact/Feedback : https://forum.adlice.comSite : Blog Articles - Adlice Software : http://www.adlice.comSistema Operacional : Windows 10 (10.0.16299) 64 bits versionIniciou : Modo normalUsuário : thiag [Administrador]Started from : C:\Users\thiag\Desktop\RogueKiller_portable64.exeModo : Escanear -- Data : 02/22/2018 13:17:31 (Duration : 00:22:47)¤¤¤ Processos : 0 ¤¤¤¤¤¤ Registro : 8 ¤¤¤[PUP] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce | Application Restart #1 : C:\MSI\LiveUpdate\DL_FILE\Killer_Network_Drivers_9.0.0.46\Liveinst.exe /killer /RestartByRestartManager:31896E33-0DFA-40cb-81FD-99B51239595C [x] -> Encontrado[PUP] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce | Application Restart #1 : C:\MSI\LiveUpdate\DL_FILE\Killer_Network_Drivers_9.0.0.46\Liveinst.exe /killer /RestartByRestartManager:31896E33-0DFA-40cb-81FD-99B51239595C [x] -> Encontrado[PUP] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce | Application Restart #1 : C:\MSI\LiveUpdate\DL_FILE\Killer_Network_Drivers_9.0.0.46\Liveinst.exe /killer /RestartByRestartManager:31896E33-0DFA-40cb-81FD-99B51239595C [x] -> Encontrado[PUP] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce | Application Restart #1 : C:\MSI\LiveUpdate\DL_FILE\Killer_Network_Drivers_9.0.0.46\Liveinst.exe /killer /RestartByRestartManager:31896E33-0DFA-40cb-81FD-99B51239595C [x] -> Encontrado[PUP.HackTool|VT.Detected] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRule s | {8C345444-FB41-4743-A6AF-10A52819B886} : v2.27|Action=Allow|Active=TRUE|Dir=In|Protocol=6|LPort=1688|App=C:\Windows\AutoKMS\AutoKMS.exe|Name= AutoKMS| [-] -> Encontrado[PUP.HackTool|VT.Detected] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRule s | {7FF9E76D-8050-446B-8950-EF0CB72F3C92} : v2.27|Action=Allow|Active=TRUE|Dir=Out|Protocol=6|LPort=1688|App=C:\Windows\AutoKMS\AutoKMS.exe|Name =AutoKMS| [-] -> Encontrado[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Encontrado[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Encontrado¤¤¤ Tarefas : 1 ¤¤¤[PUP.HackTool|VT.Detected] \AutoKMS -- C:\Windows\AutoKMS\AutoKMS.exe -> Encontrado¤¤¤ Arquivos : 1 ¤¤¤[PUP.HackTool][Pasta] C:\Windows\AutoKMS -> Encontrado¤¤¤ WMI : 0 ¤¤¤¤¤¤ Arquivos de hosts : 0 ¤¤¤¤¤¤ Antirootkit : 0 (Driver: Carregado) ¤¤¤¤¤¤ Navegadores : 1 ¤¤¤[PUM.HomePage][Firefox:Config] 3nj6d6gf.default : user_pref("browser.startup.homepage", "moz-extension://1eda7cd8-1a10-4edf-bedd-3ea40f28870f/dashboard.html"); -> Encontrado¤¤¤ Verificação da MBR : ¤¤¤+++++ PhysicalDrive0: ST1000DM003-1CH162 +++++--- User ---[MBR] 43ac937f0b4b35fd28411e4b5f8a69b4[BSP] 5fbd3c6c8aae6c097682c79b7e13cedf : Empty|VT.Unknown MBR CodePartition table:0 - Basic data partition | Offset (sectors): 2048 | Size: 953868 MBUser = LL1 ... OKUser = LL2 ... OK+++++ PhysicalDrive1: SAMSUNG HD161HJ +++++--- User ---[MBR] 22cdc553b96df7978b88ea21813d51d1[BSP] 98c374aedf641a29bbb6aa5f5a998b95 : Empty|VT.Unknown MBR CodePartition table:0 - Basic data partition | Offset (sectors): 2048 | Size: 152626 MBUser = LL1 ... OKUser = LL2 ... OK+++++ PhysicalDrive2: WDC WDS256G1X0C-00ENX0 +++++--- User ---[MBR] 29159466cdce39be30625db92b53eb17[BSP] df4f83c1f72e36823a12b0dfc7617313 : Empty MBR CodePartition table:0 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 2048 | Size: 499 MB1 - [MAN-MOUNT] EFI system partition | Offset (sectors): 1024000 | Size: 100 MB2 - [MAN-MOUNT] Microsoft reserved partition | Offset (sectors): 1228800 | Size: 16 MB3 - Basic data partition | Offset (sectors): 1261568 | Size: 243582 MBUser = LL1 ... OKError reading LL2 MBR! ([1] Incorrect function. )