[heyage13]

Good day, 

 

My pc was up and running and in use when all of a sudden my monitors started to flicker with various colors then the screens went blank. 

 

Upon restart, there are red and white lines on my monitor and Windows will not boot (pictures attached). 

 

Really hoping someone can assist with this. 

 

Thank you, 

 

Adriano

 

 

Attached Thumbnails

• 
• 
• 
• 

[Advertisements]

Hi,  heyage13

 

Does it happens when you enter the BIOS setup Utility?

[JSntgRvr]

Hi,  heyage13

 

Does it happens when you enter the BIOS setup Utility?

[heyage13]

Yes - both in the BIOS and upon not entering the BIOS, every time at startup..

 

I did a clean re-install of Windows 10, computer was running smoothly until about 20 min of watching iptv on VLC player...screen started flickering strange colours, hard drive froze, and blank screens...

[JSntgRvr]

You may have a hardware issue, not related to Windows. Is the graphic PCI Card integrated in the motherboard, or is it a PCI card that can be removed and refreshed its contacts with the MoBo?
 
Please download Farbar Recovery Scan Tool and save it to your desktop.
 
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• Right click FRST(64) and select Run as administrator.
• Make sure that under Optional Scans, there is a checkmark on Addition.txt.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
• The tool will also produce another log (Addition.txt ). Please attach this to your reply.

[heyage13]

Good day, 
 
Thank you for getting back - the graphics card is a separate from the motherboard.
 
Logs : 
 
 

 

Spoiler

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 14-02-2021
Ran by heyag (administrator) on DESKTOP-7F869C5 (16-02-2021 13:53:13)
Running from C:\Users\heyag\Downloads
Loaded Profiles: heyag
Platform: Windows 10 Pro Version 20H2 19042.804 (X64) Language: English (United States)
Default browser: Chrome
Boot Mode: Normal


==================== Processes (Whitelisted) =================


(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)


(Apple Inc. -> Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.36.72\GoogleCrashHandler.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.36.72\GoogleCrashHandler64.exe
(Google LLC -> Google LLC) C:\Program Files\Google\Chrome\Application\chrome.exe <17>
(Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Users\heyag\AppData\Local\Microsoft\OneDrive\OneDrive.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowsstore_12011.1001.1.0_x64__8wekyb3d8bbwe\WinStore.App.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Microsoft Windows Hardware Compatibility Publisher -> AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Windows Hardware Compatibility Publisher -> AMD) C:\Windows\System32\atiesrxx.exe


==================== Registry (Whitelisted) ===================


(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)


HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files\Google\Chrome\Application\88.0.4324.150\Installer\chrmstp.exe [2021-02-14] (Google LLC -> Google LLC)


==================== Scheduled Tasks (Whitelisted) ============


(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


Task: {490F33B2-CB25-4F0D-90D6-FEB70B6E3B49} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [154440 2021-02-14] (Google LLC -> Google LLC)
Task: {98CA0982-67D2-49C9-802D-6A2F75D7B374} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [154440 2021-02-14] (Google LLC -> Google LLC)


(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)




==================== Internet (Whitelisted) ====================


(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)


Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{be08d431-2ef0-4cd8-b973-7fa5cf674f1e}: [DhcpNameServer] 192.168.0.1


Edge: 
=======
Edge Profile: C:\Users\heyag\AppData\Local\Microsoft\Edge\User Data\Default [2021-02-15]


FireFox:
========
FF Plugin-x32: @videolan.org/vlc,version=3.0.12 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2021-01-04] (VideoLAN -> VideoLAN)


Chrome: 
=======
CHR Profile: C:\Users\heyag\AppData\Local\Google\Chrome\User Data\Default [2021-02-16]
CHR Notifications: Default -> hxxps://my.questrade.com; hxxps://www.dailymail.co.uk; hxxps://www.facebook.com; hxxps://www.youtube.com
CHR HomePage: Default -> hxxp://google.com/
CHR StartupUrls: Default -> "hxxp://google.com/"
CHR Extension: (Slides) - C:\Users\heyag\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2021-02-14]
CHR Extension: (Docs) - C:\Users\heyag\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2021-02-14]
CHR Extension: (Google Drive) - C:\Users\heyag\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2021-02-14]
CHR Extension: (YouTube) - C:\Users\heyag\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2021-02-14]
CHR Extension: (uBlock Origin) - C:\Users\heyag\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjpalhdlnbpafiamejdnhcphjbkeiagm [2021-02-14]
CHR Extension: (Sheets) - C:\Users\heyag\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2021-02-14]
CHR Extension: (Google Docs Offline) - C:\Users\heyag\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2021-02-14]
CHR Extension: (Chrome Web Store Payments) - C:\Users\heyag\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2021-02-14]
CHR Extension: (Real-Debrid extension) - C:\Users\heyag\AppData\Local\Google\Chrome\User Data\Default\Extensions\oefkkgfcahbeccgckjgbnfclcmnjgidg [2021-02-14]
CHR Extension: (Pop Art Studio Online) - C:\Users\heyag\AppData\Local\Google\Chrome\User Data\Default\Extensions\oompiimecpnflklhlnmdpddcjdmiibkf [2021-02-14]
CHR Extension: (Psykopaint) - C:\Users\heyag\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgjchkcfmigkkhedgjedmffdepgmpfil [2021-02-14]
CHR Extension: (Weather Underground) - C:\Users\heyag\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjejbgheonogbpfkkjigbmahaljipoej [2021-02-14]
CHR Extension: (World Clocks 2) - C:\Users\heyag\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjgoijhajhaahklokegbfnohialajpej [2021-02-14]
CHR Extension: (Gmail) - C:\Users\heyag\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2021-02-14]
CHR Extension: (Chrome Media Router) - C:\Users\heyag\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2021-02-14]


==================== Services (Whitelisted) ===================


(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [96056 2020-05-20] (Apple Inc. -> Apple Inc.)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [7456464 2021-02-14] (Malwarebytes Inc -> Malwarebytes)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [5198064 2021-01-27] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [3004048 2019-12-07] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103384 2019-12-07] (Microsoft Windows Publisher -> Microsoft Corporation)


===================== Drivers (Whitelisted) ===================


(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


S0 amdkmafd; C:\WINDOWS\System32\drivers\amdkmafd.sys [40720 2015-07-28] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.)
S3 AppleKmdfFilter; C:\WINDOWS\System32\drivers\AppleKmdfFilter.sys [20032 2020-10-09] (WDKTestCert build,132303256403278908 -> Apple Inc.)
S3 AppleLowerFilter; C:\WINDOWS\System32\drivers\AppleLowerFilter.sys [35976 2020-10-09] (WDKTestCert build,132303256403278908 -> Apple Inc.)
R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [153312 2021-02-14] (Malwarebytes Corporation -> Malwarebytes)
R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [220616 2021-02-14] (Malwarebytes Inc -> Malwarebytes)
S0 MbamElam; C:\WINDOWS\System32\DRIVERS\MbamElam.sys [19912 2021-02-14] (Microsoft Windows Early Launch Anti-malware Publisher -> Malwarebytes)
R3 MBAMFarflt; C:\WINDOWS\System32\DRIVERS\farflt.sys [198248 2021-02-15] (Malwarebytes Inc -> Malwarebytes)
R3 MBAMProtection; C:\WINDOWS\system32\DRIVERS\mbam.sys [77496 2021-02-15] (Malwarebytes Inc -> Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [248992 2021-02-14] (Malwarebytes Inc -> Malwarebytes)
R3 MBAMWebProtection; C:\WINDOWS\system32\DRIVERS\mwac.sys [142416 2021-02-15] (Malwarebytes Inc -> Malwarebytes)
R3 MTsensor; C:\WINDOWS\System32\drivers\ASACPI.sys [17280 2020-02-14] (ASUSTeK Computer Inc. -> )
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [46688 2019-12-07] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [350136 2019-12-07] (Microsoft Windows -> Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [54200 2019-12-07] (Microsoft Windows -> Microsoft Corporation)
R3 WirelessKeyboardFilter; C:\WINDOWS\System32\drivers\WirelessKeyboardFilter.sys [49336 2018-03-11] (Microsoft Corporation -> Microsoft Corporation)


==================== NetSvcs (Whitelisted) ===================


(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)




==================== One month (created) (Whitelisted) =========


(If an entry is included in the fixlist, the file/folder will be moved.)


2021-02-16 13:53 - 2021-02-16 13:53 - 000009403 _____ C:\Users\heyag\Downloads\FRST.txt
2021-02-16 13:52 - 2021-02-16 13:53 - 000000000 ____D C:\FRST
2021-02-16 13:52 - 2021-02-16 13:52 - 002297856 _____ (Farbar) C:\Users\heyag\Downloads\FRST64.exe
2021-02-16 13:52 - 2021-02-16 13:52 - 002297856 _____ (Farbar) C:\Users\heyag\Downloads\FRST64 (1).exe
2021-02-16 11:48 - 2021-02-16 11:52 - 000000000 ____D C:\Users\heyag\AppData\Local\mslug3
2021-02-16 11:38 - 2021-02-16 11:38 - 000000000 ____D C:\Users\heyag\AppData\Roaming\Code Mystics
2021-02-16 11:38 - 2021-02-16 11:38 - 000000000 ____D C:\ProgramData\Package Cache
2021-02-16 11:33 - 2021-02-16 11:48 - 000000000 ____D C:\Users\heyag\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon Games
2021-02-16 11:32 - 2021-02-16 11:32 - 000001298 _____ C:\Users\heyag\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon Games.lnk
2021-02-16 11:32 - 2021-02-16 11:32 - 000001290 _____ C:\Users\heyag\Desktop\Amazon Games.lnk
2021-02-16 11:32 - 2021-02-16 11:32 - 000000000 ____D C:\Users\heyag\AppData\Local\CEF
2021-02-16 11:31 - 2021-02-16 11:31 - 001869392 _____ (Amazon) C:\Users\heyag\Downloads\AmazonGamesSetup.exe
2021-02-16 11:31 - 2021-02-16 11:31 - 000000000 ____D C:\Users\heyag\AppData\Local\Amazon Games
2021-02-16 10:46 - 2021-02-16 10:46 - 000000000 ____D C:\Users\heyag\AppData\Local\PeerDistRepub
2021-02-15 10:51 - 2021-02-15 14:06 - 000000000 ____D C:\Users\heyag\AppData\Roaming\vlc
2021-02-15 08:59 - 2021-02-15 08:59 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2021-02-15 08:59 - 2021-02-15 08:59 - 000000000 ____D C:\Program Files (x86)\VideoLAN
2021-02-15 08:52 - 2021-02-15 08:52 - 041436128 _____ C:\Users\heyag\Downloads\vlc-3.0.12-win32.exe
2021-02-15 08:24 - 2021-02-15 08:24 - 000198248 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
2021-02-15 08:24 - 2021-02-15 08:24 - 000142416 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2021-02-15 08:24 - 2021-02-15 08:24 - 000077496 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2021-02-14 19:45 - 2021-02-14 19:45 - 000000000 _SHDL C:\Users\Default User
2021-02-14 19:45 - 2021-02-14 19:45 - 000000000 _SHDL C:\Users\All Users
2021-02-14 19:45 - 2021-02-14 19:45 - 000000000 _SHDL C:\Documents and Settings
2021-02-14 19:42 - 2021-02-16 13:48 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2021-02-14 19:42 - 2021-02-16 08:49 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2021-02-14 19:42 - 2021-02-14 19:42 - 000258688 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2021-02-14 19:42 - 2021-02-14 19:42 - 000000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2021-02-14 19:42 - 2021-02-14 19:42 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd
2021-02-14 19:42 - 2021-02-14 19:42 - 000000000 ____D C:\WINDOWS\ServiceProfiles
2021-02-14 19:42 - 2021-02-14 19:42 - 000000000 ____D C:\Program Files\Common Files\ATI Technologies
2021-02-14 19:42 - 2021-02-14 19:42 - 000000000 ____D C:\Program Files\AMD
2021-02-14 19:42 - 2021-02-14 19:42 - 000000000 _____ C:\WINDOWS\ativpsrm.bin
2021-02-14 19:41 - 2021-02-16 08:49 - 000008192 ___SH C:\DumpStack.log.tmp
2021-02-14 19:39 - 2021-02-14 19:45 - 000000000 ____D C:\WINDOWS\Panther
2021-02-14 19:39 - 2021-02-14 19:45 - 000000000 ____D C:\Windows.old
2021-02-14 19:38 - 2021-02-14 19:38 - 000008192 _____ C:\WINDOWS\system32\config\userdiff
2021-02-14 19:38 - 2021-02-14 19:38 - 000000000 ____D C:\WINDOWS\Setup
2021-02-14 19:37 - 2021-02-14 19:37 - 000000000 ____D C:\WINDOWS\SysWOW64\winrm
2021-02-14 19:37 - 2021-02-14 19:37 - 000000000 ____D C:\WINDOWS\SysWOW64\WCN
2021-02-14 19:37 - 2021-02-14 19:37 - 000000000 ____D C:\WINDOWS\SysWOW64\sysprep
2021-02-14 19:37 - 2021-02-14 19:37 - 000000000 ____D C:\WINDOWS\SysWOW64\slmgr
2021-02-14 19:37 - 2021-02-14 19:37 - 000000000 ____D C:\WINDOWS\SysWOW64\Printing_Admin_Scripts
2021-02-14 19:37 - 2021-02-14 19:37 - 000000000 ____D C:\WINDOWS\SysWOW64\0409
2021-02-14 19:37 - 2021-02-14 19:37 - 000000000 ____D C:\WINDOWS\system32\winrm
2021-02-14 19:37 - 2021-02-14 19:37 - 000000000 ____D C:\WINDOWS\system32\WCN
2021-02-14 19:37 - 2021-02-14 19:37 - 000000000 ____D C:\WINDOWS\system32\slmgr
2021-02-14 19:37 - 2021-02-14 19:37 - 000000000 ____D C:\WINDOWS\system32\Printing_Admin_Scripts
2021-02-14 19:37 - 2021-02-14 19:37 - 000000000 ____D C:\WINDOWS\system32\0409
2021-02-14 19:37 - 2021-02-14 19:37 - 000000000 ____D C:\WINDOWS\DigitalLocker
2021-02-14 19:37 - 2020-10-02 19:33 - 000835472 _____ (Adobe) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2021-02-14 19:37 - 2020-10-02 19:33 - 000179608 _____ (Adobe) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2021-02-14 19:35 - 2021-02-16 13:48 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2021-02-14 19:35 - 2021-02-15 10:05 - 000000000 ___HD C:\Program Files\WindowsApps
2021-02-14 19:35 - 2021-02-15 10:05 - 000000000 ____D C:\WINDOWS\AppReadiness
2021-02-14 19:35 - 2021-02-15 08:59 - 000000000 ___RD C:\Program Files (x86)
2021-02-14 19:35 - 2021-02-15 08:27 - 000000000 ____D C:\WINDOWS\appcompat
2021-02-14 19:35 - 2021-02-14 23:50 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2021-02-14 19:35 - 2021-02-14 19:45 - 000000000 ____D C:\WINDOWS\CSC
2021-02-14 19:35 - 2021-02-14 19:41 - 000000000 ____D C:\WINDOWS\system32\config\TxR
2021-02-14 19:35 - 2021-02-14 19:39 - 000028672 _____ C:\WINDOWS\system32\config\BCD-Template
2021-02-14 19:35 - 2021-02-14 19:39 - 000000000 ____D C:\WINDOWS\Containers
2021-02-14 19:35 - 2021-02-14 19:37 - 000000000 ___SD C:\WINDOWS\SysWOW64\F12
2021-02-14 19:35 - 2021-02-14 19:37 - 000000000 ___SD C:\WINDOWS\SysWOW64\DiagSvcs
2021-02-14 19:35 - 2021-02-14 19:37 - 000000000 ___SD C:\WINDOWS\system32\F12
2021-02-14 19:35 - 2021-02-14 19:37 - 000000000 ___SD C:\WINDOWS\system32\dsc
2021-02-14 19:35 - 2021-02-14 19:37 - 000000000 ___SD C:\WINDOWS\system32\DiagSvcs
2021-02-14 19:35 - 2021-02-14 19:37 - 000000000 ____D C:\WINDOWS\SysWOW64\setup
2021-02-14 19:35 - 2021-02-14 19:37 - 000000000 ____D C:\WINDOWS\SysWOW64\oobe
2021-02-14 19:35 - 2021-02-14 19:37 - 000000000 ____D C:\WINDOWS\SysWOW64\MUI
2021-02-14 19:35 - 2021-02-14 19:37 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2021-02-14 19:35 - 2021-02-14 19:37 - 000000000 ____D C:\WINDOWS\SysWOW64\Com
2021-02-14 19:35 - 2021-02-14 19:37 - 000000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2021-02-14 19:35 - 2021-02-14 19:37 - 000000000 ____D C:\WINDOWS\system32\SystemResetPlatform
2021-02-14 19:35 - 2021-02-14 19:37 - 000000000 ____D C:\WINDOWS\system32\Sysprep
2021-02-14 19:35 - 2021-02-14 19:37 - 000000000 ____D C:\WINDOWS\system32\setup
2021-02-14 19:35 - 2021-02-14 19:37 - 000000000 ____D C:\WINDOWS\system32\PerceptionSimulation
2021-02-14 19:35 - 2021-02-14 19:37 - 000000000 ____D C:\WINDOWS\system32\oobe
2021-02-14 19:35 - 2021-02-14 19:37 - 000000000 ____D C:\WINDOWS\system32\MUI
2021-02-14 19:35 - 2021-02-14 19:37 - 000000000 ____D C:\WINDOWS\system32\migwiz
2021-02-14 19:35 - 2021-02-14 19:37 - 000000000 ____D C:\WINDOWS\system32\Dism
2021-02-14 19:35 - 2021-02-14 19:37 - 000000000 ____D C:\WINDOWS\system32\Com
2021-02-14 19:35 - 2021-02-14 19:37 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
2021-02-14 19:35 - 2021-02-14 19:37 - 000000000 ____D C:\WINDOWS\IME
2021-02-14 19:35 - 2021-02-14 19:37 - 000000000 ____D C:\WINDOWS\Help
2021-02-14 19:35 - 2021-02-14 19:37 - 000000000 ____D C:\Program Files\Windows Photo Viewer
2021-02-14 19:35 - 2021-02-14 19:37 - 000000000 ____D C:\Program Files\Windows NT
2021-02-14 19:35 - 2021-02-14 19:37 - 000000000 ____D C:\Program Files\Windows Defender Advanced Threat Protection
2021-02-14 19:35 - 2021-02-14 19:37 - 000000000 ____D C:\Program Files\Windows Defender
2021-02-14 19:35 - 2021-02-14 19:37 - 000000000 ____D C:\Program Files\Common Files\System
2021-02-14 19:35 - 2021-02-14 19:37 - 000000000 ____D C:\Program Files\Common Files\microsoft shared
2021-02-14 19:35 - 2021-02-14 19:37 - 000000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2021-02-14 19:35 - 2021-02-14 19:37 - 000000000 ____D C:\Program Files (x86)\Windows NT
2021-02-14 19:35 - 2021-02-14 19:37 - 000000000 ____D C:\Program Files (x86)\Windows Defender
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 __SHD C:\WINDOWS\BitLockerDiscoveryVolumeContents
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 __SHD C:\Program Files\Windows Sidebar
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 __SHD C:\Program Files (x86)\Windows Sidebar
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 __RSD C:\WINDOWS\Media
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ___SD C:\WINDOWS\SysWOW64\Nui
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ___SD C:\WINDOWS\SysWOW64\Configuration
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ___SD C:\WINDOWS\system32\UNP
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ___SD C:\WINDOWS\system32\Nui
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ___SD C:\WINDOWS\system32\Configuration
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ___SD C:\WINDOWS\system32\AppV
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ___SD C:\WINDOWS\Downloaded Program Files
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ___RD C:\WINDOWS\Offline Web Pages
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ___HD C:\WINDOWS\LanguageOverlayCache
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\Web
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\WaaS
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\Vss
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\tracing
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\TAPI
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\SysWOW64\WinMetadata
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\SysWOW64\SMI
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ras
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\SysWOW64\PerceptionSimulation
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\SysWOW64\NDF
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\SysWOW64\Msdtc
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\SysWOW64\migwiz
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\SysWOW64\Keywords
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\SysWOW64\Ipmi
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\SysWOW64\InputMethod
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\SysWOW64\inetsrv
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\SysWOW64\IME
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\SysWOW64\icsxml
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\SysWOW64\GroupPolicyUsers
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\SysWOW64\GroupPolicy
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\SysWOW64\downlevel
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\SysWOW64\Bthprops
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\SysWOW64\AppLocker
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\SysWOW64\AdvancedInstallers
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\SystemResources
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\SystemApps
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\WinMetadata
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\winevt
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\ti-et
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\ta-lk
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\ta-in
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\si-lk
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\ShellExperiences
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\Sgrm
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\SecureBootUpdates
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\ras
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\ProximityToast
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\PointOfService
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\osa-Osge-001
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\NDF
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\my-mm
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\MsDtc
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\Macromed
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\Keywords
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\Ipmi
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\InputMethod
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\inetsrv
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\IME
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\icsxml
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\ias
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\Hydrogen
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\GroupPolicyUsers
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\GroupPolicy
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\ff-Adlm-SN
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\DriverState
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\Drivers\DriverData
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\downlevel
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\DDFs
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\ContainerSettingsProviders
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\config\systemprofile
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\config\RegBack
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\config\Journal
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\Bthprops
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\appraiser
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\AppLocker
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\am-et
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\AdvancedInstallers
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\System
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\SKB
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\ShellExperiences
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\ShellComponents
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\security
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\schemas
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\SchCache
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\Resources
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\rescache
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\RemotePackages
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\Registration
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\Provisioning
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\PLA
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\Performance
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\ModemLogs
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\L2Schemas
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\InputMethod
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\IdentityCRL
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\Globalization
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\GameBarPresenceWriter
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\DiagTrack
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\Cursors
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\Branding
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\bcastdvr
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\ProgramData\WindowsHolographicDevices
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\ProgramData\USOShared
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\Program Files\Windows Security
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\Program Files\Windows Portable Devices
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\Program Files\Windows Multimedia Platform
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\Program Files\ModifiableWindowsApps
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\Program Files\Common Files\Services
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\Program Files (x86)\Windows Portable Devices
2021-02-14 19:35 - 2021-02-14 19:35 - 000000000 ____D C:\Program Files (x86)\Windows Multimedia Platform
2021-02-14 19:35 - 2021-02-14 19:33 - 000215943 _____ C:\WINDOWS\SysWOW64\dssec.dat
2021-02-14 19:35 - 2021-02-14 19:33 - 000215943 _____ C:\WINDOWS\system32\dssec.dat
2021-02-14 19:35 - 2021-02-14 19:33 - 000020908 _____ C:\WINDOWS\system32\OEMDefaultAssociations.xml
2021-02-14 19:35 - 2021-02-14 19:33 - 000017635 _____ C:\WINDOWS\system32\Drivers\etc\services
2021-02-14 19:35 - 2021-02-14 19:33 - 000003683 _____ C:\WINDOWS\system32\Drivers\etc\lmhosts.sam
2021-02-14 19:35 - 2021-02-14 19:33 - 000003103 _____ C:\WINDOWS\SysWOW64\mmc.exe.config
2021-02-14 19:35 - 2021-02-14 19:33 - 000003103 _____ C:\WINDOWS\system32\mmc.exe.config
2021-02-14 19:35 - 2021-02-14 19:33 - 000001358 _____ C:\WINDOWS\system32\Drivers\etc\protocol
2021-02-14 19:35 - 2021-02-14 19:33 - 000000858 _____ C:\WINDOWS\system32\DefaultQuestions.json
2021-02-14 19:35 - 2021-02-14 19:33 - 000000741 _____ C:\WINDOWS\SysWOW64\NOISE.DAT
2021-02-14 19:35 - 2021-02-14 19:33 - 000000741 _____ C:\WINDOWS\system32\NOISE.DAT
2021-02-14 19:35 - 2021-02-14 19:33 - 000000407 _____ C:\WINDOWS\system32\Drivers\etc\networks
2021-02-14 19:35 - 2021-02-14 19:33 - 000000219 _____ C:\WINDOWS\system.ini
2021-02-14 19:35 - 2021-02-14 19:33 - 000000092 _____ C:\WINDOWS\win.ini
2021-02-14 19:35 - 2021-02-14 17:06 - 000000000 ____D C:\WINDOWS\ServiceState
2021-02-14 19:35 - 2021-02-14 17:05 - 000000000 ___RD C:\WINDOWS\PrintDialog
2021-02-14 19:35 - 2021-02-14 17:01 - 000000000 ___HD C:\WINDOWS\ELAMBKUP
2021-02-14 19:35 - 2021-02-14 16:49 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2021-02-14 19:35 - 2021-02-14 16:47 - 000000000 ____D C:\WINDOWS\system32\WinBioDatabase
2021-02-14 19:35 - 2021-02-14 16:46 - 000000000 ____D C:\WINDOWS\system32\spool
2021-02-14 19:35 - 2021-02-14 16:46 - 000000000 ____D C:\ProgramData\USOPrivate
2021-02-14 19:34 - 2021-02-16 13:52 - 000000000 ____D C:\WINDOWS\INF
2021-02-14 19:30 - 2021-02-14 17:34 - 000000000 ____D C:\WINDOWS\CbsTemp
2021-02-14 19:29 - 2021-02-15 00:13 - 069730304 _____ C:\WINDOWS\system32\config\SOFTWARE
2021-02-14 19:29 - 2021-02-15 00:13 - 013893632 _____ C:\WINDOWS\system32\config\SYSTEM
2021-02-14 19:29 - 2021-02-15 00:13 - 000524288 _____ C:\WINDOWS\system32\config\DEFAULT
2021-02-14 19:29 - 2021-02-15 00:13 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2021-02-14 19:29 - 2021-02-15 00:13 - 000131072 _____ C:\WINDOWS\system32\config\SAM
2021-02-14 19:29 - 2021-02-15 00:13 - 000032768 _____ C:\WINDOWS\system32\config\SECURITY
2021-02-14 19:29 - 2021-02-14 19:40 - 000000000 ___HD C:\$SysReset
2021-02-14 19:29 - 2021-02-14 19:35 - 000000000 ____D C:\WINDOWS\system32\SMI
2021-02-14 19:29 - 2021-02-14 17:34 - 000000000 ____D C:\WINDOWS\servicing
2021-02-14 19:29 - 2021-02-14 17:01 - 000032768 _____ C:\WINDOWS\system32\config\ELAM
2021-02-14 17:29 - 2021-02-14 17:29 - 000000000 ____D C:\Program Files\Microsoft Update Health Tools
2021-02-14 17:08 - 2021-02-14 17:08 - 000000000 ____D C:\Users\heyag\AppData\Roaming\SystemAcCrux
2021-02-14 17:08 - 2021-02-14 17:08 - 000000000 ____D C:\ProgramData\Apple
2021-02-14 17:08 - 2021-02-14 17:08 - 000000000 ____D C:\Program Files\Common Files\Apple
2021-02-14 17:07 - 2021-02-14 17:07 - 000001360 _____ C:\ProgramData\Desktop\EaseUS MobiMover.lnk
2021-02-14 17:07 - 2021-02-14 17:07 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EaseUS MobiMover
2021-02-14 17:07 - 2021-02-14 17:07 - 000000000 ____D C:\ProgramData\EMM
2021-02-14 17:07 - 2021-02-14 17:07 - 000000000 ____D C:\Program Files (x86)\EaseUS
2021-02-14 17:06 - 2021-02-14 17:07 - 199191568 _____ (EaseUS ) C:\Users\heyag\Downloads\mover_free_easeus.exe
2021-02-14 17:06 - 2021-02-14 17:07 - 000000000 ____D C:\WINDOWS\system32\MRT
2021-02-14 17:06 - 2021-02-14 17:06 - 000000000 ____D C:\Users\heyag\AppData\Roaming\MobiMover
2021-02-14 17:05 - 2021-02-14 17:05 - 000000000 ___HD C:\$WinREAgent
2021-02-14 17:05 - 2021-02-14 17:05 - 000000000 ____D C:\WINDOWS\OCR
2021-02-14 17:03 - 2021-02-14 17:03 - 001520016 _____ C:\Users\heyag\Downloads\mover_free_Installer_20210214.262.exe
2021-02-14 17:02 - 2021-02-14 17:02 - 000248992 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys
2021-02-14 17:02 - 2021-02-14 17:02 - 000220616 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamChameleon.sys
2021-02-14 17:02 - 2021-02-14 17:02 - 000002033 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes.lnk
2021-02-14 17:02 - 2021-02-14 17:02 - 000002021 _____ C:\ProgramData\Desktop\Malwarebytes.lnk
2021-02-14 17:02 - 2021-02-14 17:02 - 000000000 ____D C:\Users\heyag\AppData\Local\mbam
2021-02-14 17:01 - 2021-02-14 17:01 - 000153312 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbae64.sys
2021-02-14 17:01 - 2021-02-14 17:01 - 000019912 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamElam.sys
2021-02-14 17:01 - 2021-02-14 17:01 - 000000000 ____D C:\ProgramData\Malwarebytes
2021-02-14 17:01 - 2021-02-14 17:01 - 000000000 ____D C:\Program Files\Malwarebytes
2021-02-14 17:00 - 2021-02-15 08:24 - 000002247 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2021-02-14 17:00 - 2021-02-14 17:00 - 002086424 _____ (Malwarebytes) C:\Users\heyag\Downloads\MBSetup.exe
2021-02-14 17:00 - 2021-02-14 17:00 - 000000000 ____D C:\Program Files\Google
2021-02-14 16:58 - 2021-02-15 08:31 - 000000000 ____D C:\Users\heyag\AppData\Local\Google
2021-02-14 16:58 - 2021-02-14 16:58 - 001304160 _____ (Google LLC) C:\Users\heyag\Downloads\ChromeSetup.exe
2021-02-14 16:58 - 2021-02-14 16:58 - 000003418 _____ C:\WINDOWS\system32\Tasks\GoogleUpdateTaskMachineUA
2021-02-14 16:58 - 2021-02-14 16:58 - 000003294 _____ C:\WINDOWS\system32\Tasks\GoogleUpdateTaskMachineCore
2021-02-14 16:58 - 2021-02-14 16:58 - 000000000 ____D C:\Users\heyag\AppData\Local\Comms
2021-02-14 16:58 - 2021-02-14 16:58 - 000000000 ____D C:\Program Files (x86)\Google
2021-02-14 16:54 - 2021-02-15 08:24 - 000002438 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
2021-02-14 16:53 - 2021-02-14 16:53 - 000003480 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
2021-02-14 16:53 - 2021-02-14 16:53 - 000003356 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore
2021-02-14 16:53 - 2009-11-21 19:12 - 896671374 _____ C:\Users\heyag\Desktop\STE-000.wav
2021-02-14 16:52 - 2021-02-14 17:07 - 000000000 ____D C:\Users\heyag\AppData\Local\PlaceholderTileLogoFolder
2021-02-14 16:51 - 2021-02-16 08:49 - 000000000 ___RD C:\Users\heyag\OneDrive
2021-02-14 16:51 - 2021-02-14 16:51 - 000003378 _____ C:\WINDOWS\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-2448682662-421193360-4221479448-1001
2021-02-14 16:51 - 2021-02-14 16:51 - 000000000 ___HD C:\Users\heyag\MicrosoftEdgeBackups
2021-02-14 16:51 - 2021-02-14 16:51 - 000000000 ___HD C:\OneDriveTemp
2021-02-14 16:51 - 2021-02-14 16:51 - 000000000 ____D C:\ProgramData\Microsoft OneDrive
2021-02-14 16:50 - 2021-02-16 08:54 - 000795738 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2021-02-14 16:50 - 2021-02-14 16:52 - 000000000 ____D C:\Users\heyag\AppData\Local\MicrosoftEdge
2021-02-14 16:49 - 2021-02-15 08:24 - 000000000 ____D C:\Users\heyag\AppData\Local\ConnectedDevicesPlatform
2021-02-14 16:49 - 2021-02-14 17:07 - 000000000 ____D C:\Users\heyag\AppData\Local\Packages
2021-02-14 16:49 - 2021-02-14 17:07 - 000000000 ____D C:\ProgramData\Packages
2021-02-14 16:49 - 2021-02-14 17:06 - 000000000 ____D C:\Users\heyag\AppData\Local\PackageStaging
2021-02-14 16:49 - 2021-02-14 16:49 - 000000000 ___RD C:\Users\heyag\3D Objects
2021-02-14 16:49 - 2021-02-14 16:49 - 000000000 ____D C:\Users\heyag\AppData\Local\VirtualStore
2021-02-14 16:49 - 2021-02-14 16:49 - 000000000 ____D C:\Users\heyag\AppData\Local\Publishers
2021-02-14 16:47 - 2021-02-15 14:20 - 000000000 ____D C:\Users\heyag
2021-02-14 16:47 - 2021-02-14 16:51 - 000002363 _____ C:\Users\heyag\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2021-02-14 16:47 - 2021-02-14 16:47 - 000000020 ___SH C:\Users\heyag\ntuser.ini
2021-02-10 08:37 - 2021-02-10 08:37 - 002755584 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2021-02-10 08:37 - 2021-02-10 08:37 - 002755584 ____N (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2021-02-10 08:37 - 2021-02-10 08:37 - 001314112 ____N (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2021-02-10 08:37 - 2021-02-10 08:37 - 000010892 ____N C:\WINDOWS\system32\DrtmAuthTxt.wim
2021-02-10 08:36 - 2021-02-10 08:36 - 000231232 _____ C:\WINDOWS\system32\containerdevicemanagement.dll
2021-01-27 13:56 - 2021-01-27 13:56 - 003860832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rtmpltfm.dll
2021-01-27 13:56 - 2021-01-27 13:56 - 001333760 _____ C:\WINDOWS\SysWOW64\TextInputMethodFormatter.dll
2021-01-27 13:56 - 2021-01-27 13:56 - 001162240 _____ C:\WINDOWS\system32\MBR2GPT.EXE
2021-01-27 13:56 - 2021-01-27 13:56 - 000980320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rtmpal.dll
2021-01-27 13:56 - 2021-01-27 13:56 - 000915296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rtmcodecs.dll
2021-01-27 13:56 - 2021-01-27 13:56 - 000732000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ortcengine.dll
2021-01-27 13:56 - 2021-01-27 13:56 - 000729600 _____ (Microsoft Corporation) C:\WINDOWS\system32\hhctrl.ocx
2021-01-27 13:56 - 2021-01-27 13:56 - 000611952 _____ C:\WINDOWS\SysWOW64\TextShaping.dll
2021-01-27 13:56 - 2021-01-27 13:56 - 000595968 _____ (Microsoft Corporation) C:\WINDOWS\system32\appwiz.cpl
2021-01-27 13:56 - 2021-01-27 13:56 - 000581120 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhotoScreensaver.scr
2021-01-27 13:56 - 2021-01-27 13:56 - 000575488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hhctrl.ocx
2021-01-27 13:56 - 2021-01-27 13:56 - 000499200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhotoScreensaver.scr
2021-01-27 13:56 - 2021-01-27 13:56 - 000469504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\appwiz.cpl
2021-01-27 13:56 - 2021-01-27 13:56 - 000467968 _____ C:\WINDOWS\system32\AssignedAccessCsp.dll
2021-01-27 13:56 - 2021-01-27 13:56 - 000455680 _____ C:\WINDOWS\SysWOW64\WindowManagementAPI.dll
2021-01-27 13:56 - 2021-01-27 13:56 - 000446976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mmsys.cpl
2021-01-27 13:56 - 2021-01-27 13:56 - 000422912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winspool.drv
2021-01-27 13:56 - 2021-01-27 13:56 - 000330752 _____ C:\WINDOWS\SysWOW64\ssdm.dll
2021-01-27 13:56 - 2021-01-27 13:56 - 000304128 _____ (Microsoft Corporation) C:\WINDOWS\system32\ksproxy.ax
2021-01-27 13:56 - 2021-01-27 13:56 - 000266240 _____ C:\WINDOWS\SysWOW64\Windows.Internal.UI.Shell.WindowTabManager.dll
2021-01-27 13:56 - 2021-01-27 13:56 - 000266240 _____ (Microsoft Corporation) C:\WINDOWS\system32\mpg2splt.ax
2021-01-27 13:56 - 2021-01-27 13:56 - 000240640 _____ C:\WINDOWS\SysWOW64\CoreMas.dll
2021-01-27 13:56 - 2021-01-27 13:56 - 000235520 _____ C:\WINDOWS\SysWOW64\HeatCore.dll
2021-01-27 13:56 - 2021-01-27 13:56 - 000234496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ksproxy.ax
2021-01-27 13:56 - 2021-01-27 13:56 - 000221184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bthprops.cpl
2021-01-27 13:56 - 2021-01-27 13:56 - 000204800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mpg2splt.ax
2021-01-27 13:56 - 2021-01-27 13:56 - 000182272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\timedate.cpl
2021-01-27 13:56 - 2021-01-27 13:56 - 000178688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\intl.cpl
2021-01-27 13:56 - 2021-01-27 13:56 - 000170496 _____ (Microsoft Corporation) C:\WINDOWS\system32\VBICodec.ax
2021-01-27 13:56 - 2021-01-27 13:56 - 000157184 _____ C:\WINDOWS\system32\uwfcsp.dll
2021-01-27 13:56 - 2021-01-27 13:56 - 000138056 _____ C:\WINDOWS\system32\HvsiManagementApi.dll
2021-01-27 13:56 - 2021-01-27 13:56 - 000135168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VBICodec.ax
2021-01-27 13:56 - 2021-01-27 13:56 - 000112128 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\activeds.tlb
2021-01-27 13:56 - 2021-01-27 13:56 - 000111616 _____ C:\WINDOWS\system32\RDVGHelper.exe
2021-01-27 13:56 - 2021-01-27 13:56 - 000101704 _____ C:\WINDOWS\SysWOW64\HvsiManagementApi.dll
2021-01-27 13:56 - 2021-01-27 13:56 - 000100864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncpa.cpl
2021-01-27 13:56 - 2021-01-27 13:56 - 000095744 _____ C:\WINDOWS\system32\VirtualMonitorManager.dll
2021-01-27 13:56 - 2021-01-27 13:56 - 000087552 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdc.ocx
2021-01-27 13:56 - 2021-01-27 13:56 - 000084992 _____ (Microsoft Corporation) C:\WINDOWS\system32\wscui.cpl
2021-01-27 13:56 - 2021-01-27 13:56 - 000072704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdc.ocx
2021-01-27 13:56 - 2021-01-27 13:56 - 000067584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wscui.cpl
2021-01-27 13:56 - 2021-01-27 13:56 - 000067072 _____ C:\WINDOWS\system32\BWContextHandler.dll
2021-01-27 13:56 - 2021-01-27 13:56 - 000055376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rtmmvrortc.dll
2021-01-27 13:56 - 2021-01-27 13:56 - 000053760 _____ C:\WINDOWS\SysWOW64\BWContextHandler.dll
2021-01-27 13:56 - 2021-01-27 13:56 - 000047472 _____ C:\WINDOWS\SysWOW64\umpdc.dll
2021-01-27 13:56 - 2021-01-27 13:56 - 000045880 _____ C:\WINDOWS\system32\HvSocket.dll
2021-01-27 13:56 - 2021-01-27 13:56 - 000039936 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2021-01-27 13:56 - 2021-01-27 13:56 - 000023552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msacm32.drv
2021-01-27 13:56 - 2021-01-27 13:56 - 000010752 _____ C:\WINDOWS\SysWOW64\agentactivationruntimestarter.exe
2021-01-27 13:55 - 2021-01-27 13:55 - 004898144 _____ (Microsoft Corporation) C:\WINDOWS\system32\rtmpltfm.dll
2021-01-27 13:55 - 2021-01-27 13:55 - 004227116 ____N C:\WINDOWS\system32\DefaultHrtfs.bin
2021-01-27 13:55 - 2021-01-27 13:55 - 002260992 _____ C:\WINDOWS\system32\TextInputMethodFormatter.dll
2021-01-27 13:55 - 2021-01-27 13:55 - 002260480 _____ (The ICU Project) C:\WINDOWS\system32\icu.dll
2021-01-27 13:55 - 2021-01-27 13:55 - 002254336 _____ C:\WINDOWS\system32\dwmscene.dll
2021-01-27 13:55 - 2021-01-27 13:55 - 001822272 ____N (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2021-01-27 13:55 - 2021-01-27 13:55 - 001393496 ____N (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2021-01-27 13:55 - 2021-01-27 13:55 - 001354080 _____ (Microsoft Corporation) C:\WINDOWS\system32\rtmpal.dll
2021-01-27 13:55 - 2021-01-27 13:55 - 001091936 _____ (Microsoft Corporation) C:\WINDOWS\system32\rtmcodecs.dll
2021-01-27 13:55 - 2021-01-27 13:55 - 001032544 _____ (Microsoft Corporation) C:\WINDOWS\system32\ortcengine.dll
2021-01-27 13:55 - 2021-01-27 13:55 - 000707544 _____ C:\WINDOWS\system32\TextShaping.dll
2021-01-27 13:55 - 2021-01-27 13:55 - 000643072 _____ C:\WINDOWS\system32\WindowManagementAPI.dll
2021-01-27 13:55 - 2021-01-27 13:55 - 000562688 _____ (Microsoft Corporation) C:\WINDOWS\system32\winspool.drv
2021-01-27 13:55 - 2021-01-27 13:55 - 000544768 _____ (Microsoft Corporation) C:\WINDOWS\system32\mmsys.cpl
2021-01-27 13:55 - 2021-01-27 13:55 - 000455168 _____ C:\WINDOWS\system32\ssdm.dll
2021-01-27 13:55 - 2021-01-27 13:55 - 000363520 _____ C:\WINDOWS\system32\Windows.Internal.UI.Shell.WindowTabManager.dll
2021-01-27 13:55 - 2021-01-27 13:55 - 000306688 _____ C:\WINDOWS\system32\HeatCore.dll
2021-01-27 13:55 - 2021-01-27 13:55 - 000287232 _____ C:\WINDOWS\system32\CoreMas.dll
2021-01-27 13:55 - 2021-01-27 13:55 - 000266752 _____ (Microsoft Corporation) C:\WINDOWS\system32\bthprops.cpl
2021-01-27 13:55 - 2021-01-27 13:55 - 000243200 _____ (Microsoft Corporation) C:\WINDOWS\system32\timedate.cpl
2021-01-27 13:55 - 2021-01-27 13:55 - 000238592 _____ (Microsoft Corporation) C:\WINDOWS\system32\intl.cpl
2021-01-27 13:55 - 2021-01-27 13:55 - 000197632 _____ C:\WINDOWS\system32\IHDS.dll
2021-01-27 13:55 - 2021-01-27 13:55 - 000190976 _____ C:\WINDOWS\system32\BthpanContextHandler.dll
2021-01-27 13:55 - 2021-01-27 13:55 - 000165888 _____ C:\WINDOWS\system32\DataStoreCacheDumpTool.exe
2021-01-27 13:55 - 2021-01-27 13:55 - 000152064 _____ C:\WINDOWS\system32\EoAExperiences.exe
2021-01-27 13:55 - 2021-01-27 13:55 - 000112128 ____N (Microsoft Corporation) C:\WINDOWS\system32\activeds.tlb
2021-01-27 13:55 - 2021-01-27 13:55 - 000102912 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncpa.cpl
2021-01-27 13:55 - 2021-01-27 13:55 - 000089088 _____ C:\WINDOWS\system32\windows.applicationmodel.conversationalagent.proxystub.dll
2021-01-27 13:55 - 2021-01-27 13:55 - 000074240 _____ C:\WINDOWS\system32\rdsxvmaudio.dll
2021-01-27 13:55 - 2021-01-27 13:55 - 000073216 _____ C:\WINDOWS\system32\windows.applicationmodel.conversationalagent.internal.proxystub.dll
2021-01-27 13:55 - 2021-01-27 13:55 - 000064552 _____ C:\WINDOWS\system32\umpdc.dll
2021-01-27 13:55 - 2021-01-27 13:55 - 000060928 _____ C:\WINDOWS\system32\runexehelper.exe
2021-01-27 13:55 - 2021-01-27 13:55 - 000056672 _____ (Microsoft Corporation) C:\WINDOWS\system32\rtmmvrortc.dll
2021-01-27 13:55 - 2021-01-27 13:55 - 000048640 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2021-01-27 13:55 - 2021-01-27 13:55 - 000030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\msacm32.drv
2021-01-27 13:55 - 2021-01-27 13:55 - 000029696 _____ (The ICU Project) C:\WINDOWS\system32\icuuc.dll
2021-01-27 13:55 - 2021-01-27 13:55 - 000025088 _____ (The ICU Project) C:\WINDOWS\system32\icuin.dll
2021-01-27 13:55 - 2021-01-27 13:55 - 000013312 _____ C:\WINDOWS\system32\agentactivationruntimestarter.exe
2021-01-27 13:55 - 2021-01-27 13:55 - 000001370 ____N C:\WINDOWS\system32\ThirdPartyNoticesBySHS.txt


==================== One month (modified) ==================


(If an entry is included in the fixlist, the file/folder will be moved.)




==================== SigCheck ============================


(There is no automatic fix for files that do not pass verification.)


==================== End of FRST.txt ========================






Additional scan result of Farbar Recovery Scan Tool (x64) Version: 14-02-2021
Ran by heyag (16-02-2021 13:55:36)
Running from C:\Users\heyag\Downloads
Windows 10 Pro Version 20H2 19042.804 (X64) (2021-02-15 00:45:42)
Boot Mode: Normal
==========================================================




==================== Accounts: =============================


Administrator (S-1-5-21-2448682662-421193360-4221479448-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-2448682662-421193360-4221479448-503 - Limited - Disabled)
Guest (S-1-5-21-2448682662-421193360-4221479448-501 - Limited - Disabled)
heyag (S-1-5-21-2448682662-421193360-4221479448-1001 - Administrator - Enabled) => C:\Users\heyag
WDAGUtilityAccount (S-1-5-21-2448682662-421193360-4221479448-504 - Limited - Disabled)


==================== Security Center ========================


(If an entry is included in the fixlist, it will be removed.)


AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}


==================== Installed Programs ======================


(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)


Amazon Games (HKU\S-1-5-21-2448682662-421193360-4221479448-1001\...\{4DD10B06-78A4-4E6F-AA39-25E9C38FA568}) (Version: 1.7.172.1 - Amazon.com Services, Inc.)
Apple Application Support (32-bit) (HKLM-x32\...\{11C4575B-4B32-44D2-A097-D59A00BA60DE}) (Version: 8.5 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{D39B163A-9E12-442C-95E9-33FA5746AB21}) (Version: 8.5 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{C788AE25-3D4E-4D18-811B-3219F778487E}) (Version: 13.5.1.2 - Apple Inc.)
Baseball Stars 2 (HKU\S-1-5-21-2448682662-421193360-4221479448-1001\...\AmazonGames/Baseball Stars 2) (Version:  - SNK)
EaseUS MobiMover 5.3.6 (HKLM-x32\...\EaseUS MobiMover_is1) (Version:  - EaseUS)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 88.0.4324.150 - Google LLC)
Malwarebytes version 4.3.0.98 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 4.3.0.98 - Malwarebytes)
Metal Slug 2 (HKU\S-1-5-21-2448682662-421193360-4221479448-1001\...\AmazonGames/Metal Slug 2) (Version:  - SNK)
METAL SLUG 3 (HKU\S-1-5-21-2448682662-421193360-4221479448-1001\...\AmazonGames/METAL SLUG 3) (Version:  - SNK)
Microsoft Edge (HKLM-x32\...\Microsoft Edge) (Version: 88.0.705.68 - Microsoft Corporation)
Microsoft Edge Update (HKLM-x32\...\Microsoft Edge Update) (Version: 1.3.141.59 - )
Microsoft OneDrive (HKU\S-1-5-21-2448682662-421193360-4221479448-1001\...\OneDriveSetup.exe) (Version: 21.002.0104.0005 - Microsoft Corporation)
Microsoft Update Health Tools (HKLM\...\{143E35D3-F0A4-4E90-96C9-B1B72F11343A}) (Version: 2.70.0.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Stealth [bleep] Deluxe (HKU\S-1-5-21-2448682662-421193360-4221479448-1001\...\AmazonGames/Stealth [bleep] Deluxe) (Version:  - Curve Digital)
The King of Fighters '97 Global Match (HKU\S-1-5-21-2448682662-421193360-4221479448-1001\...\AmazonGames/The King of Fighters '97 Global) (Version:  - SNK)
VLC media player (HKLM-x32\...\VLC media player) (Version: 3.0.12 - VideoLAN)


Packages:
=========
Microsoft Solitaire Collection -> C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.9.1252.0_x64__8wekyb3d8bbwe [2021-02-14] (Microsoft Studios) [MS Ad]
Spotify Music -> C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.152.687.0_x86__zpdnekdrzrea0 [2021-02-14] (Spotify AB) [Startup Task]


==================== Custom CLSID (Whitelisted): ==============


(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2021-02-14] (Malwarebytes Corporation -> Malwarebytes)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2021-02-14] (Malwarebytes Corporation -> Malwarebytes)


==================== Codecs (Whitelisted) ====================


==================== Shortcuts & WMI ========================


==================== Loaded Modules (Whitelisted) =============


==================== Alternate Data Streams (Whitelisted) ========


==================== Safe Mode (Whitelisted) ==================


(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"


==================== Association (Whitelisted) =================


==================== Internet Explorer (Whitelisted) ==========


HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = 


==================== Hosts content: =========================


(If needed Hosts: directive could be included in the fixlist to reset Hosts.)


2021-02-14 19:35 - 2021-02-14 19:33 - 000000824 _____ C:\WINDOWS\system32\drivers\etc\hosts


==================== Other Areas ===========================


(Currently there is no automatic fix for this section.)


HKU\S-1-5-21-2448682662-421193360-4221479448-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\heyag\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\dual-monitor-wallpaper-21.jpg
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: )
Windows Firewall is enabled.


==================== MSCONFIG/TASK MANAGER disabled items ==


==================== FirewallRules (Whitelisted) ================


(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


FirewallRules: [{7D674753-6358-4F5C-AC47-6EE78E6DBEB9}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.68.96.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)
FirewallRules: [{A0B96643-FBBF-45F4-8FEF-681441367E50}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.68.96.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)
FirewallRules: [{FB94909C-D57F-48C1-9FDC-D57520890A14}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.68.96.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)
FirewallRules: [{88D2585E-392F-4ACE-8491-0176140F336D}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.68.96.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)
FirewallRules: [{43DC3C92-2F46-4FDE-8422-1CCBFA529712}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe (Google LLC -> Google LLC)
FirewallRules: [{E0210CF5-6F0B-4013-A308-5E16AB1BC2A0}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.152.687.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{BC3EF21A-8683-4DF4-A3B6-7A8142918A16}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.152.687.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{73A8679B-226A-424E-BAE9-9F37676357E7}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.152.687.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{7B759E5F-163B-4F03-B27E-57D42010C8CF}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.152.687.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{A671393E-9342-41BE-BAA1-DAC8EDB319E3}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.152.687.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{38ABF0B2-92A0-40AD-97C3-4D5BFAC6DFA2}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.152.687.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{B859C269-C137-4E25-9AE0-04FBFD842DCB}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.152.687.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{72EC89EF-813E-4615-91DF-DF568B277722}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.152.687.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{4F6BCA10-66C4-4372-8FF1-D481029FFEA8}] => (Allow) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc. -> Apple Inc.)


==================== Restore Points =========================


ATTENTION: System Restore is disabled (Total:110.83 GB) (Free:81.52 GB) (74%)


==================== Faulty Device Manager Devices ============




==================== Event log errors: ========================


Application errors:
==================
Error: (02/16/2021 08:49:31 AM) (Source: ATIeRecord) (EventID: 16396) (User: )
Description: ATI EEU PnP start/stop failed


Error: (02/15/2021 02:20:44 PM) (Source: ATIeRecord) (EventID: 16396) (User: )
Description: ATI EEU PnP start/stop failed


Error: (02/15/2021 08:24:16 AM) (Source: ATIeRecord) (EventID: 16396) (User: )
Description: ATI EEU PnP start/stop failed


Error: (02/15/2021 12:13:25 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mousocoreworker.exe, version: 10.0.19041.789, time stamp: 0x1c668876
Faulting module name: ucrtbase.dll, version: 10.0.19041.789, time stamp: 0x2bd748bf
Exception code: 0xc0000409
Fault offset: 0x000000000007286e
Faulting process id: 0x14ac
Faulting application start time: 0x01d70359451836ae
Faulting application path: C:\Windows\System32\mousocoreworker.exe
Faulting module path: C:\WINDOWS\System32\ucrtbase.dll
Report Id: f639f657-5b76-4987-a133-4aa04fa1111d
Faulting package full name: 
Faulting package-relative application ID:


Error: (02/15/2021 12:11:35 AM) (Source: ATIeRecord) (EventID: 16396) (User: )
Description: ATI EEU PnP start/stop failed


Error: (02/14/2021 04:49:45 PM) (Source: ATIeRecord) (EventID: 16396) (User: )
Description: ATI EEU PnP start/stop failed


Error: (02/14/2021 04:49:44 PM) (Source: ATIeRecord) (EventID: 16396) (User: )
Description: ATI EEU PnP start/stop failed


Error: (02/14/2021 04:47:39 PM) (Source: SecurityCenter) (EventID: 16) (User: )
Description: Error while updating Windows Defender status to SECURITY_PRODUCT_STATE_ON.




System errors:
=============
Error: (02/16/2021 08:49:25 AM) (Source: volmgr) (EventID: 46) (User: )
Description: Crash dump initialization failed!


Error: (02/16/2021 08:49:31 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 3:40:43 PM on ‎2021-‎02-‎15 was unexpected.


Error: (02/15/2021 02:20:36 PM) (Source: volmgr) (EventID: 46) (User: )
Description: Crash dump initialization failed!


Error: (02/15/2021 02:20:43 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 1:42:43 PM on ‎2021-‎02-‎15 was unexpected.


Error: (02/15/2021 12:49:49 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-7F869C5)
Description: The server microsoft.windowscommunicationsapps_16005.13426.20566.0_x64__8wekyb3d8bbwe!microsoft.windowslive.calendar.AppXwkn9j84yh1kvnt49k5r8h6y1ecsv09hs.mca did not register with DCOM within the required timeout.


Error: (02/14/2021 05:03:35 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x8024200b: Update for Microsoft Defender Antivirus antimalware platform - KB4052623 (Version 4.18.2101.9).


Error: (02/14/2021 07:44:15 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: The Printer Extensions and Notifications service is marked as an interactive service.  However, the system is configured to not allow interactive services.  This service may not function properly.


Error: (02/14/2021 07:44:12 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Network List Service service terminated with the following error: 
The device is not ready.


Windows Defender:
=================


CodeIntegrity:
===============
Date: 2021-02-14 19:44:31
Description: 
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe because the set of per-page image hashes could not be found on the system.


Date: 2021-02-14 19:44:31
Description: 
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe because the set of per-page image hashes could not be found on the system.




==================== Memory info =========================== 


BIOS: American Megatrends Inc. 0903 09/20/2011
Motherboard: ASUSTeK Computer INC. Rampage III Formula
Processor: Intel® Core™ i7 CPU X 980 @ 3.33GHz
Percentage of memory in use: 18%
Total physical RAM: 24567.11 MB
Available physical RAM: 20144.41 MB
Total Virtual: 28535.11 MB
Available Virtual: 23823.66 MB


==================== Drives ================================


Drive c: () (Fixed) (Total:110.83 GB) (Free:81.52 GB) NTFS
Drive d: () (Fixed) (Total:931.51 GB) (Free:667.52 GB) NTFS
Drive e: (Seagate Backup Plus Drive) (Fixed) (Total:7451.91 GB) (Free:4237.58 GB) NTFS


\\?\Volume{683f1f60-0000-0000-0000-100000000000}\ (System Reserved) (Fixed) (Total:0.49 GB) (Free:0.46 GB) NTFS
\\?\Volume{683f1f60-0000-0000-0000-50d41b000000}\ () (Fixed) (Total:0.47 GB) (Free:0.05 GB) NTFS


==================== MBR & Partition Table ====================


==========================================================
Disk: 0 (MBR Code: Windows 7/8/10) (Size: 111.8 GB) (Disk ID: 683F1F60)
Partition 1: (Active) - (Size=500 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=110.8 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=482 MB) - (Type=27)


==========================================================
Disk: 1 (MBR Code: Windows 7/8/10) (Size: 931.5 GB) (Disk ID: 5508A1AC)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)


==========================================================
Disk: 2 (Size: 7452 GB) (Disk ID: 9FC4602D)


Partition: GPT.


==================== End of Addition.txt =======================

[JSntgRvr]

Go to Device Manager. Scroll down to Display Adapter. Expand to the adapter and right click on it. Uninstall the Adapter. Restart the computer and allow Windows to search and install the adapter. Le me know if that helps.

 

 

How To Publish a Snapshot using

Guide Overview

 

The purpose of this guide is to teach you how to post your computer's specifications to the forum with minimal effort on your part. This is often helpful when troubleshooting problems, and the person helping you needs to see the details of your computer's hardware.

 

Tools NeededSpeccy

• Speccy - First, you will need a Windows program called Speccy. From Piriform's website, Speccy is a "fast, lightweight, advanced system information tool for your PC." This is a very useful utility that every PC user should have in their arsenal.

 

Instructions

• Go to Piriform's website, and click the big button.

• Next, click Download from Piriform.com (the FileHippo link requires an extra click). Or if you want to use a portable version of Speccy (which doesn't require installation), click the builds page link and download the portable version.

• You might be asked where you want to save the file. The best place to put it is the Desktop, as it will be easy to find later.

• After the file finishes downloading, you are ready to run Speccy. If you downloaded the installer, simply open it and follow the prompts until installation is complete.

• If you downloaded the portable version, you will need to unzip it before use. Right-click the ZIP file and click Extract all > Next. Open up the extracted folder and double-click on Speccy.

• Once inside Speccy, it will look similar to this (with your computer's specifications, of course):

• Now, in the menu bar at the top left, click File > Publish Snapshot

• You will see the following prompt:

• Click Yes > then Copy to Clipboard

• Now, once you are back in the forum topic you are posting in, scroll down to the bottom of the page to the "Reply to this topic" section. Right-click in the empty space of the Reply box and click Paste. Then, click the Post button below the Reply box.

 

[heyage13]

Good day, 

 

I uninstalled the display adapter driver(s) as there were two showing (AMD Radeon HD 6900 Series & AMD Radeon HD 6900)

 

I restarted my computer, Windows self re-installed the 2 drivers. 

 

 

 

 

SPECCY LOG:

 

http://speccy.pirifo...qdwP7gUfGIJFzJb

[JSntgRvr]

Do you have two display adapters?

[heyage13]

As far as I know, I only have one video card - it does however have two chips in it, so maybe this is why it's showing two drivers?

[JSntgRvr]

Monitor 1
 

• Name: PHL 328B6Q on AMD Radeon HD 6990
• Current Resolution: 1920x1080 pixels
• Work Resolution: 1920x1040 pixels
• State: Enabled
• Multiple displays: Extended, Primary, Enabled
• Monitor Width: 1920
• Monitor Height: 1080
• Monitor BPP:32 bits per pixel
• Monitor Frequency: 60 Hz
• Device: \\.\DISPLAY25\Monitor0

 
Monitor 2
 

• Name: PHL 241B8Q on AMD Radeon HD 6990
• Current Resolution: 1920x1080 pixels
• Work Resolution: 1920x1040 pixels
• State: Enabled
• Multiple displays: Extended, Secondary, Enabled
• Monitor Width: 1920
• Monitor Height: 1080
• Monitor BPP: 32 bits per pixel
• Monitor Frequency: 60 Hz
• Device: \\.\DISPLAY26\Monitor0

 

ATI AMD Radeon HD 6990

• Manufacturer: ATI
• Model: AMD Radeon HD 6990
• GPU: Antilles
• Device ID: 1002-671D
• Subvendor: ATI (1002)
• Current Performance Level: Level 0
• Current GPU Clock: 450 MHz
• Current Memory Clock: 1250 MHz
• Current Shader Clock: 1250 MHz
• Voltage: 1.000 V
• Die Size: 778 mm²
• Release Date: Feb 8, 2011
• DirectX Support: 11.0
• DirectX Shader Model: 5.0
• OpenGL Support: 4.1
• GPU Clock: 880.0 MHz
• Temperature: 63 °C
• Core Voltage: 1.000 V
• Crossfire: Disabled
• Driver version: 15.200.1055.0
• BIOS Version: 113-C2060100-102
• ROPs: 32
• Memory Type: GDDR5
• Memory: 2048 MB
• Bus Width: 64x4 (256 bit)
• Pixel Fillrate: 28.2 GPixels/s
• Bandwidth: 160.0 GB/s
• Max Power Draw: 375 Watts
• Count of performance levels : 3
• Level 1 - "Perf Level 0"
• GPU Clock: 250 MHz
• Shader Clock: 150 MHz
• Level 2 - "Perf Level 1"
• GPU Clock: 500 MHz
• Shader Clock: 1250 MHz
• Level 3 - "Perf Level 2"
• GPU Clock: 880 MHz
• Shader Clock: 1250 MHz

 


ATI AMD Radeon HD 6900 Series
 

• Manufacturer: ATI
• Model:AMD Radeon HD 6900 Series
• GPU:Antilles
• Device ID:1002-671D
• Subvendor:ATI (1002)
• Current Performance Level:Level 0
• Current GPU Clock: 450 MHz
• Current Memory Clock: 
• 1250 MHz
• Current Shader Clock: 
• 1250 MHz
• Voltage: 
• 1.000 V
• Die Size: 778 mm²
• Release Date: Feb 8, 2011
• DirectX Support: 11.0
• DirectX Shader Model: 5.0
• OpenGL Support: 4.1
• GPU Clock: 880.0 MHz
• Temperature: 50 °C
• Core Voltage: 0.900 V
• Crossfire: Disabled
• Driver version: 15.301.1901.0
• BIOS Version: 113-C2060100-103
• ROPs: 32
• Memory Type: GDDR5
• Memory: 2048 MB
• Bus Width: 64x4 (256 bit)
• Pixel Fillrate: 28.2 GPixels/s
• Bandwidth: 160.0 GB/s
• Max Power Draw: 375 Watts
• Count of performance levels : 3
• Level 1 - "Perf Level 0"
• GPU Clock: 250 MHz
• Shader Clock: 150 MHz
• Level 2 - "Perf Level 1"
• GPU Clock: 500 MHz
• Shader Clock: 1250 MHz
• Level 3 - "Perf Level 2"
• GPU Clock: 880 MHz
• Shader Clock: 1250 MHz

You seems to have two adapters(6900 and 6990) and two monitors. Did you uninstalled both adapters and allowed Windows to re-detect those adapters and install the drivers thereby? You can download latest drivers from ATI.

[JSntgRvr]

There is no malware in your computer. Moving this topic to hardware.

[heyage13]

Yes, I have two monitors. Yes, I uninstalled both drivers and allowed Windows to reinstall them . 

[heyage13]

I notice this issue may be caused when running iptv via VLC player....attempted to try this again and screens displayed a mix of colors before pc crashing.

[JSntgRvr]

 

You seems to have two adapters(6900 and 6990) and two monitors. Did you uninstalled both adapters and allowed Windows to re-detect those adapters and install the drivers thereby? You can download latest drivers from ATI.

 

Try to upgrade the drivers throughout the link above.

[heyage13]

Unfortunately there is no driver in the link provided for my video card...