[scottb]

Hi,

 

I cannot be as informed or descriptive as i would like to be with this. Its a neighbours laptop that he did not realise his security had ran out and he was using the internet and got infected.

i cannot even tell you what it was that infected it. His daughter downloaded avast one and ran it and cleaned the laptop, but i cannot see anywhere within the program that has stored logs of scans. He has no idea what the infection was either.

He has windows 10 installed on it.

I've downloaded malwarebytes and ran it and its not detected any infections on the laptop, but it is running slow and sluggish.

was hoping someone would be able to help?

Here are the logs from Farbar recovery tool.

 

thanks in advance

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 27-12-2021

Ran by User (administrator) on DESKTOP-O6KGU14 (TOSHIBA SATELLITE C850-19Z) (02-01-2022 19:13:33)

Running from C:\Users\User\Desktop

Loaded Profiles: User

Platform: Microsoft Windows 10 Home Version 1909 18363.1316 (X64) Language: English (United Kingdom)

Default browser: Chrome

Boot Mode: Normal

 

==================== Processes (Whitelisted) =================

 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

 

(Avast Software s.r.o. -> AVAST Software) C:\Program Files\Avast Software\Avast\afwServ.exe

(Avast Software s.r.o. -> AVAST Software) C:\Program Files\Avast Software\Avast\aswEngSrv.exe

(Avast Software s.r.o. -> AVAST Software) C:\Program Files\Avast Software\Avast\aswidsagent.exe

(Avast Software s.r.o. -> AVAST Software) C:\Program Files\Avast Software\Avast\aswToolsSvc.exe

(Avast Software s.r.o. -> AVAST Software) C:\Program Files\Avast Software\Avast\AvastSvc.exe

(Avast Software s.r.o. -> AVAST Software) C:\Program Files\Avast Software\Avast\AvastUI.exe <5>

(Avast Software s.r.o. -> AVAST Software) C:\Program Files\Avast Software\Avast\wsc_proxy.exe

(Avast Software s.r.o. -> AVAST Software) C:\Program Files\Avast Software\Cleanup\TuneupSvc.exe

(Avast Software s.r.o. -> AVAST Software) C:\Program Files\Avast Software\Driver Updater\DriverUpdSvc.exe

(Dynabook Inc. -> Dynabook Inc.) C:\Windows\System32\DriverStore\FileRepository\tossrvctl.inf_amd64_b172549968baa801\DSDFunctionKeyCtlService.exe <2>

(Dynabook Inc. -> Dynabook Inc.) C:\Windows\System32\DriverStore\FileRepository\tossrvctl.inf_amd64_b172549968baa801\dynabookSystemService.exe

(Dynabook Inc. -> Dynabook Inc.) C:\Windows\System32\DriverStore\FileRepository\tossrvctl.inf_amd64_b172549968baa801\RMService.exe

(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleCrashHandler.exe

(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleCrashHandler64.exe

(Intel® pGFX -> Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel® pGFX -> Intel Corporation) C:\Windows\System32\igfxpers.exe

(Intel® pGFX -> Intel Corporation) C:\Windows\System32\igfxtray.exe

(Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe

(Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe

(Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe <12>

(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\DataExchangeHost.exe

(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe

(Realtek Semiconductor Corp -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Synaptics Incorporated -> Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Synaptics Incorporated -> Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe

(Synaptics Incorporated -> Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

 

==================== Registry (Whitelisted) ===================

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

 

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13196432 2012-09-27] (Realtek Semiconductor Corp -> Realtek Semiconductor)

HKLM\...\Run: [HotKeysCmds] => "C:\WINDOWS\system32\hkcmd.exe" (No File)

HKLM\...\Run: [AvastUI.exe] => C:\Program Files\Avast Software\Avast\AvLaunch.exe [157464 2021-12-30] (Avast Software s.r.o. -> AVAST Software)

HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files\Google\Chrome\Application\96.0.4664.110\Installer\chrmstp.exe [2022-01-02] (Google LLC -> Google LLC)

HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION

 

==================== Scheduled Tasks (Whitelisted) ============

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

Task: {0CADD81D-864D-47D0-88A0-33B136629796} - System32\Tasks\Avast Software\Overseer => C:\Program Files\Common Files\Avast Software\Overseer\overseer.exe [1778456 2021-12-30] (Avast Software s.r.o. -> Avast Software)

Task: {1A04323E-B76D-461E-B55E-F36E2222B5D3} - System32\Tasks\Avast Software\Avast Driver Updater BugReport => C:\Program Files\Avast Software\Driver Updater\AvBugReport.exe [4760344 2021-12-30] (Avast Software s.r.o. -> AVAST Software) -> --send "dumps|report" --silent --product 148 --programpath "C:\Program Files\Avast Software\Driver Updater\Setup\.." --configpath "C:\Program Files\Avast Software\Driver Updater\Setup" --path "C:\ProgramData\Avast Software\Driver Updater\log" --path "C:\ProgramData\Avast Software\Icarus\Logs" --guid 0129b057-ac57-41bd-b712-746e07d0b0f3

Task: {2751492F-8FEE-4F9C-8361-8545CBA1007B} - System32\Tasks\Avast Software\Avast SecureLine VPN Bug Report => C:\Program Files\Avast Software\SecureLine VPN\AvBugReport.exe [4760344 2021-12-30] (Avast Software s.r.o. -> AVAST Software) -> --send "dumps|report" --silent --product 11 --programpath "C:\Program Files\Avast Software\SecureLine VPN" --configpath "C:\ProgramData\Avast Software\SecureLine VPN" --path "C:\ProgramData\Avast Software\SecureLine VPN\log" --path "C:\ProgramData\Avast Software\Icarus\Logs" --logpath "C:\ProgramData\Avast Software\SecureLine VPN\log" --guid 5277942d-7d55-4ef0-9d8f-94f2647bd49a

Task: {5D397201-C6FC-490B-B90B-B3B2C5E0F37A} - System32\Tasks\Avast Software\Avast Cleanup Update => C:\Program Files\Common Files\Avast Software\Icarus\avast-tu\icarus.exe [6475544 2021-12-16] (Avast Software s.r.o. -> Avast Software)

Task: {5D55C69F-E7D8-4ED2-AA5A-8B955C37BECA} - System32\Tasks\Avast Software\Avast Cleanup BugReport => C:\Program Files\Avast Software\Cleanup\AvBugReport.exe [4760344 2021-12-30] (Avast Software s.r.o. -> AVAST Software) -> --send "dumps|report" --silent --product 62 --programpath "C:\Program Files\Avast Software\Cleanup\Setup\.." --configpath "C:\Program Files\Avast Software\Cleanup\Setup" --path "C:\ProgramData\Avast Software\Cleanup\log" --path "C:\ProgramData\Avast Software\Icarus\Logs" --guid f1f4bff7-b123-4b69-8dfb-3cfcb72b8e1f

Task: {6F12A808-4B69-4AD6-A5AD-FB29D285EE89} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [156232 2022-01-02] (Google LLC -> Google LLC)

Task: {71DAE3B1-778D-47F9-807F-3AC3DD071B92} - System32\Tasks\Avast Software\Avast SecureLine VPN Update => C:\Program Files\Common Files\Avast Software\Icarus\avast-vpn\icarus.exe [6475544 2021-12-14] (Avast Software s.r.o. -> Avast Software)

Task: {90EAC3D2-5E30-441F-B5E3-EB1357452DE3} - System32\Tasks\HardDiskSentinel\Hard Disk Sentinel_User => F:\HD Health Utilitys\Hard Disk Sentinel\HDSentinel.exe /AUTORUN (No File)

Task: {BDACEBA9-8DB3-4321-9BBF-915950A0AECE} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION

Task: {D0409B63-4E4F-40D1-8576-F36F635FC0A9} - System32\Tasks\Avast Emergency Update => C:\Program Files\Avast Software\Avast\AvEmUpdate.exe [4969240 2021-12-30] (Avast Software s.r.o. -> AVAST Software)

Task: {F1D04A6C-F25F-4677-9B3E-A06F0DB09DDB} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [156232 2022-01-02] (Google LLC -> Google LLC)

Task: {F4654CB7-2AF5-4972-BBE6-7B2D69C30E34} - System32\Tasks\Avast SecureLine VPN Update => C:\Program Files\Avast Software\SecureLine VPN\VpnUpdate.exe [1226520 2021-12-30] (Avast Software s.r.o. -> AVAST Software)

Task: {FE096A8C-9B5E-4816-A046-0D4434AC9494} - System32\Tasks\Avast Software\Avast Driver Updater Update => C:\Program Files\Common Files\Avast Software\Icarus\avast-du\icarus.exe [6475544 2021-12-16] (Avast Software s.r.o. -> Avast Software)

 

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

 

 

==================== Internet (Whitelisted) ====================

 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

 

Tcpip\Parameters: [DhcpNameServer] 192.168.1.254

Tcpip\..\Interfaces\{ddb43ea3-e84b-451a-831e-a3a051c5bdd9}: [DhcpNameServer] 192.168.1.254

 

Edge: 

=======

Edge Profile: C:\Users\User\AppData\Local\Microsoft\Edge\User Data\Default [2022-01-02]

Edge DownloadDir: Default -> C:\Users\User\Desktop

 

Chrome: 

=======

CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default [2022-01-02]

CHR Session Restore: Default -> is enabled.

CHR Extension: (Chrome Web Store Payments) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2021-02-18]

 

==================== Services (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

R3 aswbIDSAgent; C:\Program Files\Avast Software\Avast\aswidsagent.exe [8480848 2021-12-30] (Avast Software s.r.o. -> AVAST Software)

R2 avast! Antivirus; C:\Program Files\Avast Software\Avast\AvastSvc.exe [452888 2021-12-30] (Avast Software s.r.o. -> AVAST Software)

R2 avast! Firewall; C:\Program Files\Avast Software\Avast\afwServ.exe [1720088 2021-12-30] (Avast Software s.r.o. -> AVAST Software)

R2 avast! Tools; C:\Program Files\Avast Software\Avast\aswToolsSvc.exe [452888 2021-12-30] (Avast Software s.r.o. -> AVAST Software)

R2 AvastWscReporter; C:\Program Files\Avast Software\Avast\wsc_proxy.exe [56912 2021-12-30] (Avast Software s.r.o. -> AVAST Software)

R2 CleanupPSvc; C:\Program Files\Avast Software\Cleanup\TuneupSvc.exe [13745432 2021-12-30] (Avast Software s.r.o. -> AVAST Software)

R2 DriverUpdSvc; C:\Program Files\Avast Software\Driver Updater\DriverUpdSvc.exe [7204632 2021-12-30] (Avast Software s.r.o. -> AVAST Software)

R2 DSDFunctionKeyCtlService; C:\WINDOWS\System32\DriverStore\FileRepository\tossrvctl.inf_amd64_b172549968baa801\DSDFunctionKeyCtlService.exe [615760 2020-06-15] (Dynabook Inc. -> Dynabook Inc.)

R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [7901368 2022-01-02] (Malwarebytes Inc -> Malwarebytes)

S2 SecureLine; C:\Program Files\Avast Software\SecureLine VPN\VpnSvc.exe [9210136 2021-12-30] (Avast Software s.r.o. -> AVAST Software)

R2 TSDSettingService; C:\WINDOWS\System32\DriverStore\FileRepository\tossrvctl.inf_amd64_b172549968baa801\dynabookSystemService.exe [44976440 2020-06-15] (Dynabook Inc. -> Dynabook Inc.)

S2 TSDTabletControlService; C:\WINDOWS\System32\DriverStore\FileRepository\tossrvctl.inf_amd64_b172549968baa801\TOSTABSYSSVC.exe [254272 2020-06-15] (Dynabook Inc. -> Dynabook Inc.)

R2 TSDWirelessLEDCtlService; C:\WINDOWS\System32\DriverStore\FileRepository\tossrvctl.inf_amd64_b172549968baa801\RMService.exe [446232 2020-06-15] (Dynabook Inc. -> Dynabook Inc.)

S3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2111.5-0\NisSrv.exe [2876152 2021-12-22] (Microsoft Windows Publisher -> Microsoft Corporation)

S3 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2111.5-0\MsMpEng.exe [128360 2021-12-22] (Microsoft Windows Publisher -> Microsoft Corporation)

S2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [X]

 

===================== Drivers (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

R0 aswArDisk; C:\WINDOWS\System32\drivers\aswArDisk.sys [36784 2021-12-30] (Avast Software s.r.o. -> AVAST Software)

R1 aswArPot; C:\WINDOWS\System32\drivers\aswArPot.sys [223176 2021-12-30] (Avast Software s.r.o. -> AVAST Software)

R1 aswbidsdriver; C:\WINDOWS\System32\drivers\aswbidsdriver.sys [369216 2021-12-30] (Avast Software s.r.o. -> AVAST Software)

R0 aswbidsh; C:\WINDOWS\System32\drivers\aswbidsh.sys [252992 2021-12-30] (Avast Software s.r.o. -> AVAST Software)

R0 aswbuniv; C:\WINDOWS\System32\drivers\aswbuniv.sys [100416 2021-12-30] (Avast Software s.r.o. -> AVAST Software)

R0 aswElam; C:\WINDOWS\System32\drivers\aswElam.sys [21936 2021-12-30] (Microsoft Windows Early Launch Anti-malware Publisher -> AVAST Software)

R1 aswKbd; C:\WINDOWS\System32\drivers\aswKbd.sys [42416 2021-12-30] (Avast Software s.r.o. -> AVAST Software)

R1 aswMonFlt; C:\WINDOWS\System32\drivers\aswMonFlt.sys [186280 2021-12-30] (Avast Software s.r.o. -> AVAST Software)

R1 aswNetHub; C:\WINDOWS\System32\drivers\aswNetHub.sys [540056 2021-12-30] (Avast Software s.r.o. -> AVAST Software)

R1 aswRdr; C:\WINDOWS\System32\drivers\aswRdr2.sys [108912 2021-12-30] (Avast Software s.r.o. -> AVAST Software)

R0 aswRvrt; C:\WINDOWS\System32\drivers\aswRvrt.sys [83976 2021-12-30] (Avast Software s.r.o. -> AVAST Software)

R1 aswSnx; C:\WINDOWS\System32\drivers\aswSnx.sys [853800 2021-12-30] (Avast Software s.r.o. -> AVAST Software)

R1 aswSP; C:\WINDOWS\System32\drivers\aswSP.sys [545176 2021-12-30] (Avast Software s.r.o. -> AVAST Software)

R2 aswStm; C:\WINDOWS\System32\drivers\aswStm.sys [215432 2021-12-30] (Avast Software s.r.o. -> AVAST Software)

R0 aswVmm; C:\WINDOWS\System32\drivers\aswVmm.sys [318760 2021-12-30] (Avast Software s.r.o. -> AVAST Software)

S3 aswVpnRdr; C:\WINDOWS\System32\drivers\aswVpnRdr.sys [56960 2021-12-30] (Avast Software s.r.o. -> Avast Software)

S3 BthA2dp; C:\WINDOWS\System32\drivers\BthA2dp.sys [231936 2020-08-31] (Microsoft Corporation) [File not signed]

R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [160176 2022-01-02] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)

R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [210352 2022-01-02] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)

S0 MbamElam; C:\WINDOWS\System32\DRIVERS\MbamElam.sys [19912 2022-01-02] (Microsoft Windows Early Launch Anti-malware Publisher -> Malwarebytes)

R3 MBAMFarflt; C:\WINDOWS\System32\DRIVERS\farflt.sys [193448 2022-01-02] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)

R3 MBAMProtection; C:\WINDOWS\system32\DRIVERS\mbam.sys [69040 2022-01-02] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)

R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [248992 2022-01-02] (Malwarebytes Inc -> Malwarebytes)

R3 MBAMWebProtection; C:\WINDOWS\system32\DRIVERS\mwac.sys [149424 2022-01-02] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)

S3 MpKsl08cf7275; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{663DAE71-0EB5-439E-824B-24A63222A2ED}\MpKslDrv.sys [48360 2021-12-30] (Microsoft Windows -> Microsoft Corporation)

S3 MpKslb1b99ffe; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{663DAE71-0EB5-439E-824B-24A63222A2ED}\MpKslDrv.sys [48360 2021-12-30] (Microsoft Windows -> Microsoft Corporation)

R3 rtwlane_13; C:\WINDOWS\System32\drivers\rtwlane_13.sys [3717120 2019-03-19] (Microsoft Windows -> Realtek Semiconductor Corporation)

R3 Thotkey; C:\WINDOWS\System32\drivers\Thotkey.sys [47816 2019-04-30] (Dynabook Inc. -> Dynabook Inc.)

R1 TosSrvCtlDrv; C:\WINDOWS\System32\DriverStore\FileRepository\tossrvctl.inf_amd64_b172549968baa801\TosSrvCtlDrv.sys [25824 2020-06-15] (Dynabook Inc. -> Dynabook Inc.)

S0 TVALZ; C:\WINDOWS\System32\drivers\TVALZ_O.SYS [46088 2019-04-30] (Dynabook Inc. -> Dynabook Inc.)

R0 TVALZ_O; C:\WINDOWS\System32\drivers\TVALZ_O.SYS [46088 2019-04-30] (Dynabook Inc. -> Dynabook Inc.)

S3 WdBoot; C:\WINDOWS\system32\drivers\wd\WdBoot.sys [48536 2021-12-22] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)

S3 WdFilter; C:\WINDOWS\system32\drivers\wd\WdFilter.sys [435432 2021-12-22] (Microsoft Windows -> Microsoft Corporation)

S3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [86248 2021-12-22] (Microsoft Windows -> Microsoft Corporation)

 

==================== NetSvcs (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

 

==================== One month (created) (Whitelisted) =========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2022-01-02 19:13 - 2022-01-02 19:18 - 000016448 _____ C:\Users\User\Desktop\FRST.txt

2022-01-02 19:13 - 2022-01-02 19:13 - 000000000 ____D C:\Users\User\Desktop\FRST-OlderVersion

2022-01-02 19:10 - 2022-01-02 19:16 - 000000000 ____D C:\FRST

2022-01-02 19:03 - 2022-01-02 19:13 - 002311168 _____ (Farbar) C:\Users\User\Desktop\FRST64.exe

2022-01-02 12:32 - 2022-01-02 12:32 - 000002334 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

2022-01-02 12:32 - 2022-01-02 12:32 - 000002293 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2022-01-02 12:29 - 2022-01-02 12:29 - 000003420 _____ C:\WINDOWS\system32\Tasks\GoogleUpdateTaskMachineUA

2022-01-02 12:29 - 2022-01-02 12:29 - 000003296 _____ C:\WINDOWS\system32\Tasks\GoogleUpdateTaskMachineCore

2022-01-02 11:42 - 2022-01-02 11:42 - 000069040 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys

2022-01-02 11:42 - 2022-01-02 11:42 - 000002044 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes.lnk

2022-01-02 11:42 - 2022-01-02 11:42 - 000002032 _____ C:\Users\Public\Desktop\Malwarebytes.lnk

2022-01-02 11:41 - 2022-01-02 11:41 - 000248992 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys

2022-01-02 11:41 - 2022-01-02 11:41 - 000210352 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamChameleon.sys

2022-01-02 11:41 - 2022-01-02 11:41 - 000193448 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys

2022-01-02 11:41 - 2022-01-02 11:41 - 000149424 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys

2022-01-02 11:41 - 2022-01-02 11:40 - 000160176 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbae64.sys

2022-01-02 11:41 - 2022-01-02 11:39 - 000019912 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamElam.sys

2022-01-02 11:39 - 2022-01-02 11:39 - 000000000 ____D C:\ProgramData\Malwarebytes

2022-01-02 11:15 - 2022-01-02 11:41 - 000000000 ____D C:\Users\User\AppData\LocalLow\IGDump

2022-01-02 11:04 - 2022-01-02 11:04 - 000000000 ____D C:\Users\User\AppData\Local\mbam

2022-01-02 10:55 - 2022-01-02 11:39 - 000000000 ____D C:\Program Files\Malwarebytes

2022-01-02 10:54 - 2022-01-02 10:54 - 002101944 _____ (Malwarebytes) C:\Users\User\Downloads\MBSetup-10789.10789-consumer.exe

2022-01-02 10:19 - 2022-01-02 10:19 - 000000000 ____D C:\Users\User\AppData\Local\D3DSCache

2022-01-02 10:17 - 2022-01-02 10:17 - 000000000 ____D C:\Users\User\AppData\Local\Avast Software

2021-12-30 15:40 - 2021-12-30 15:40 - 000000000 ____D C:\Users\User\AppData\Roaming\Avast Software

2021-12-30 15:40 - 2021-12-30 15:40 - 000000000 ____D C:\Users\User\AppData\Local\CEF

2021-12-30 15:36 - 2021-12-30 15:36 - 000002165 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast One.lnk

2021-12-30 15:36 - 2021-12-30 15:36 - 000002153 _____ C:\Users\Public\Desktop\Avast One.lnk

2021-12-30 15:28 - 2022-01-02 10:05 - 000004302 _____ C:\WINDOWS\system32\Tasks\Avast SecureLine VPN Update

2021-12-30 15:28 - 2021-12-30 15:28 - 000056960 _____ (Avast Software) C:\WINDOWS\system32\Drivers\aswVpnRdr.sys

2021-12-30 15:26 - 2021-12-30 15:26 - 000036120 _____ (Avast Software) C:\WINDOWS\system32\icarus_rvrt.exe

2021-12-30 15:26 - 2021-12-30 15:26 - 000000000 ____D C:\WINDOWS\system32\gf2engine

2021-12-30 15:25 - 2022-01-02 10:05 - 000004264 _____ C:\WINDOWS\system32\Tasks\Avast Emergency Update

2021-12-30 15:25 - 2021-12-30 15:28 - 000000000 ____D C:\WINDOWS\system32\Tasks\Avast Software

2021-12-30 15:25 - 2021-12-30 15:25 - 000061304 _____ () C:\WINDOWS\system32\Drivers\lpsport.sys

2021-12-30 15:24 - 2021-12-30 15:26 - 000000000 ____D C:\Program Files\Common Files\Avast Software

2021-12-30 15:24 - 2021-12-30 15:24 - 000545176 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys

2021-12-30 15:24 - 2021-12-30 15:24 - 000318760 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswVmm.sys

2021-12-30 15:24 - 2021-12-30 15:24 - 000252992 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswbidsh.sys

2021-12-30 15:24 - 2021-12-30 15:24 - 000215432 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswStm.sys

2021-12-30 15:24 - 2021-12-30 15:24 - 000186280 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys

2021-12-30 15:24 - 2021-12-30 15:24 - 000100416 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswbuniv.sys

2021-12-30 15:24 - 2021-12-30 15:24 - 000083976 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRvrt.sys

2021-12-30 15:24 - 2021-12-30 15:24 - 000021936 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswElam.sys

2021-12-30 15:24 - 2021-12-30 15:23 - 000853800 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSnx.sys

2021-12-30 15:24 - 2021-12-30 15:23 - 000540056 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswNetHub.sys

2021-12-30 15:24 - 2021-12-30 15:23 - 000369216 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswbidsdriver.sys

2021-12-30 15:24 - 2021-12-30 15:23 - 000340248 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe

2021-12-30 15:24 - 2021-12-30 15:23 - 000223176 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswArPot.sys

2021-12-30 15:24 - 2021-12-30 15:23 - 000108912 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys

2021-12-30 15:24 - 2021-12-30 15:23 - 000042416 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswKbd.sys

2021-12-30 15:24 - 2021-12-30 15:23 - 000036784 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswArDisk.sys

2021-12-30 15:21 - 2021-12-30 15:28 - 000000000 ____D C:\Program Files\Avast Software

2021-12-30 15:20 - 2022-01-02 11:19 - 000000000 ____D C:\ProgramData\Avast Software

2021-12-30 15:19 - 2021-12-30 15:19 - 000234280 _____ (AVAST Software) C:\Users\User\Downloads\avast_one_essential_setup_online.exe

2021-12-30 10:29 - 2021-12-30 10:29 - 000000000 ___HD C:\$WinREAgent

2021-12-28 15:01 - 2021-12-28 15:01 - 000000000 ____D C:\Users\User\Documents\TotalAV

2021-12-28 14:53 - 2021-12-28 14:53 - 000000000 ____D C:\ProgramData\SecuritySuite

2021-12-28 14:52 - 2021-12-28 14:52 - 000000000 ____D C:\Users\User\AppData\Local\GUI

2021-12-28 14:49 - 2021-12-28 14:52 - 000000000 ____D C:\ProgramData\TotalAV

2021-12-28 14:39 - 2021-12-28 14:41 - 057545744 _____ C:\Users\User\Downloads\TotalAV_Setup (1).exe

2021-12-28 14:36 - 2021-12-28 14:41 - 057545744 _____ C:\Users\User\Downloads\TotalAV_Setup.exe

2021-12-16 09:28 - 2021-12-22 11:30 - 000003592 _____ C:\WINDOWS\system32\Tasks\OneDrive Reporting Task-S-1-5-21-3902916569-2937469160-4147389536-1001

 

==================== One month (modified) ==================

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2022-01-02 19:07 - 2019-03-19 04:52 - 000000000 ____D C:\WINDOWS\AppReadiness

2022-01-02 18:57 - 2016-04-28 13:02 - 000000000 ____D C:\Program Files (x86)\Google

2022-01-02 18:55 - 2019-03-19 04:52 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft

2022-01-02 18:28 - 2019-03-19 04:52 - 000000000 ___HD C:\Program Files\WindowsApps

2022-01-02 18:25 - 2019-12-05 16:10 - 000000000 ____D C:\ProgramData\Packages

2022-01-02 17:38 - 2020-08-31 10:12 - 000000000 ____D C:\WINDOWS\system32\SleepStudy

2022-01-02 11:51 - 2019-03-19 04:50 - 000000000 ____D C:\WINDOWS\INF

2022-01-02 11:41 - 2019-03-19 04:52 - 000000000 ___HD C:\WINDOWS\ELAMBKUP

2022-01-02 11:18 - 2020-08-31 15:01 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT

2022-01-02 11:17 - 2019-03-19 04:37 - 000786432 _____ C:\WINDOWS\system32\config\BBI

2022-01-02 10:33 - 2016-04-28 13:01 - 001341272 _____ (Google LLC) C:\Users\User\Downloads\ChromeSetup.exe

2021-12-30 16:18 - 2016-04-28 13:18 - 000000000 ____D C:\Users\User\AppData\Roaming\Kodi

2021-12-30 15:09 - 2018-03-18 22:00 - 000000000 ____D C:\Users\User\AppData\Local\Packages

2021-12-30 13:27 - 2019-12-07 15:29 - 000000000 ___HD C:\$WINDOWS.~BT

2021-12-30 13:21 - 2020-04-29 13:56 - 000000000 ___DC C:\WINDOWS\Panther

2021-12-30 10:07 - 2020-08-31 10:27 - 000795992 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2021-12-22 20:18 - 2020-08-31 14:59 - 000013338 _____ C:\WINDOWS\diagwrn.xml

2021-12-22 20:18 - 2020-08-31 14:59 - 000013338 _____ C:\WINDOWS\diagerr.xml

2021-12-22 20:18 - 2019-03-19 04:37 - 000032768 _____ C:\WINDOWS\system32\config\ELAM

2021-12-22 11:30 - 2021-08-26 19:12 - 000002391 _____ C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk

2021-12-22 11:30 - 2020-08-31 15:01 - 000003378 _____ C:\WINDOWS\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-3902916569-2937469160-4147389536-1001

2021-12-22 11:29 - 2020-09-01 00:36 - 000002449 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk

2021-12-22 11:23 - 2018-02-18 17:43 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd

2021-12-15 17:51 - 2019-03-19 04:52 - 000000000 ____D C:\WINDOWS\LiveKernelReports

2021-12-15 16:57 - 2020-09-01 00:35 - 000003480 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA

2021-12-15 16:57 - 2020-09-01 00:35 - 000003356 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore

 

==================== SigCheck ============================

 

(There is no automatic fix for files that do not pass verification.)

 

==================== End of FRST.txt ========================

 

 

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-12-2021

Ran by User (02-01-2022 19:20:46)

Running from C:\Users\User\Desktop

Microsoft Windows 10 Home Version 1909 18363.1316 (X64) (2020-08-31 15:02:49)

Boot Mode: Normal

==========================================================

 

 

==================== Accounts: =============================

 

 

(If an entry is included in the fixlist, it will be removed.)

 

Administrator (S-1-5-21-3902916569-2937469160-4147389536-500 - Administrator - Disabled)

DefaultAccount (S-1-5-21-3902916569-2937469160-4147389536-503 - Limited - Disabled)

Guest (S-1-5-21-3902916569-2937469160-4147389536-501 - Limited - Disabled)

User (S-1-5-21-3902916569-2937469160-4147389536-1001 - Administrator - Enabled) => C:\Users\User

WDAGUtilityAccount (S-1-5-21-3902916569-2937469160-4147389536-504 - Limited - Disabled)

 

==================== Security Center ========================

 

(If an entry is included in the fixlist, it will be removed.)

 

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AV: Avast Antivirus (Enabled - Up to date) {EB19B86E-3998-C706-90EF-92B41EB091AF}

AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FW: Avast Antivirus (Enabled) {D322394B-73F7-C65E-BBB0-3B81E063D6D4}

 

==================== Installed Programs ======================

 

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 

Avast One (HKLM\...\Avast Antivirus) (Version: 21.11.2500 - Avast Software)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 96.0.4664.110 - Google LLC)

Kodi (HKU\S-1-5-21-3902916569-2937469160-4147389536-1001\...\Kodi) (Version:  - XBMC-Foundation)

Malwarebytes version 4.5.0.152 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 4.5.0.152 - Malwarebytes)

Microsoft Edge (HKLM-x32\...\Microsoft Edge) (Version: 96.0.1054.62 - Microsoft Corporation)

Microsoft OneDrive (HKU\S-1-5-21-3902916569-2937469160-4147389536-1001\...\OneDriveSetup.exe) (Version: 21.230.1107.0004 - Microsoft Corporation)

Microsoft Update Health Tools (HKLM\...\{D06A5649-3BDB-4F2C-9C38-AB25CD5102E2}) (Version: 2.81.0.0 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6738 - Realtek Semiconductor Corp.)

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 19.4.3.38 - Synaptics Incorporated)

Update for Windows 10 for x64-based Systems (KB4023057) (HKLM\...\{32DC821E-4A7D-4878-BEE8-337FA153D7F2}) (Version: 2.63.0.0 - Microsoft Corporation) Hidden

Update for Windows 10 for x64-based Systems (KB4480730) (HKLM\...\{3BAE4496-6F6C-4330-A8AA-B93D3D346FA5}) (Version: 2.53.0.0 - Microsoft Corporation)

UpdateAssistant (HKLM\...\{F339C545-24DC-4870-AA32-6EB6B0500B95}) (Version: 1.24.0.0 - Microsoft Corporation) Hidden

Windows 10 Update Assistant (HKLM-x32\...\{D5C69738-B486-402E-85AC-2456D98A64E4}) (Version: 1.4.9200.22532 - Microsoft Corporation)

Windows Setup Remediations (x64) (KB4023057) (HKLM\...\{5534e02f-0f5d-40dd-ba92-bea38d22384d}.sdb) (Version:  - )

 

Packages:

=========

Candy Crush Soda Saga -> C:\Program Files\WindowsApps\king.com.CandyCrushSodaSaga_1.208.400.0_x86__kgqvnymyfvs32 [2021-12-16] (king.com)

DVD Player+ -> C:\Program Files\WindowsApps\61878MobilityinLifeapplic.DVDPlayer_13.1.3.0_x64__zfxkqydss3nar [2021-10-09] (Mobility in Life applications) [Startup Task]

Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x64__8wekyb3d8bbwe [2019-12-05] (Microsoft Corporation) [MS Ad]

Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x86__8wekyb3d8bbwe [2019-01-26] (Microsoft Corporation) [MS Ad]

Microsoft Solitaire Collection -> C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.11.12160.0_x64__8wekyb3d8bbwe [2021-12-22] (Microsoft Studios) [MS Ad]

Twitter -> C:\Program Files\WindowsApps\9E2F88E3.TWITTER_7.0.0.0_x86__wgeqdkkx372wm [2021-10-09] (Twitter Inc.)

 

==================== Custom CLSID (Whitelisted): ==============

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Avast Software\Avast\ashShell.dll [2021-12-30] (Avast Software s.r.o. -> AVAST Software)

ShellIconOverlayIdentifiers-x32: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Avast Software\Avast\ashShell.dll [2021-12-30] (Avast Software s.r.o. -> AVAST Software)

ContextMenuHandlers1: [avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Avast Software\Avast\ashShell.dll [2021-12-30] (Avast Software s.r.o. -> AVAST Software)

ContextMenuHandlers3: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Avast Software\Avast\ashShell.dll [2021-12-30] (Avast Software s.r.o. -> AVAST Software)

ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2022-01-02] (Malwarebytes Corporation -> Malwarebytes)

ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => C:\WINDOWS\system32\igfxpph.dll [2017-03-09] (Microsoft Windows Hardware Compatibility Publisher -> Intel Corporation)

ContextMenuHandlers6: [avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Avast Software\Avast\ashShell.dll [2021-12-30] (Avast Software s.r.o. -> AVAST Software)

ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2022-01-02] (Malwarebytes Corporation -> Malwarebytes)

 

==================== Codecs (Whitelisted) ====================

 

==================== Shortcuts & WMI ========================

 

==================== Loaded Modules (Whitelisted) =============

 

==================== Alternate Data Streams (Whitelisted) ========

 

==================== Safe Mode (Whitelisted) ==================

 

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aswSP.sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\aswSP.sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

 

==================== Association (Whitelisted) =================

 

==================== Internet Explorer (Whitelisted) ==========

 

 

==================== Hosts content: =========================

 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

 

2015-10-30 07:24 - 2021-12-30 15:02 - 000000824 _____ C:\WINDOWS\system32\drivers\etc\hosts

 

==================== Other Areas ===========================

 

(Currently there is no automatic fix for this section.)

 

HKU\S-1-5-21-3902916569-2937469160-4147389536-1001\Control Panel\Desktop\\Wallpaper -> C:\WINDOWS\web\wallpaper\Windows\img0.jpg

DNS Servers: 192.168.1.254

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)

Windows Firewall is enabled.

 

==================== MSCONFIG/TASK MANAGER disabled items ==

 

(If an entry is included in the fixlist, it will be removed.)

 

HKU\S-1-5-21-3902916569-2937469160-4147389536-1001\...\StartupApproved\Run: => "OneDrive"

 

==================== FirewallRules (Whitelisted) ================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

FirewallRules: [TCP Query User{0F606019-CD10-4C6B-B6CA-A18602415AA7}C:\program files (x86)\kodi\kodi.exe] => (Allow) C:\program files (x86)\kodi\kodi.exe (XBMC-Foundation) [File not signed]

FirewallRules: [UDP Query User{AC537F46-6C35-420E-8165-723F077A93D7}C:\program files (x86)\kodi\kodi.exe] => (Allow) C:\program files (x86)\kodi\kodi.exe (XBMC-Foundation) [File not signed]

FirewallRules: [{B5CFABBD-2126-492F-B5DB-5A8213D18260}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.79.95.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)

FirewallRules: [{CBA9DCDE-3A6E-4DD8-838C-A05004A48ECC}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.79.95.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)

FirewallRules: [{1DF728A2-801B-430D-861B-9D3CD6C7C542}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.79.95.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)

FirewallRules: [{0596A1C7-1F42-42D1-81EA-08C9F7CF10AE}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.79.95.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)

FirewallRules: [{2CCC3504-0DDF-4E45-A4E0-087AF0D35F46}] => (Block) C:\Program Files\Avast Software\Avast\AvastUI.exe (Avast Software s.r.o. -> AVAST Software)

FirewallRules: [{4837B69E-8D9B-40FC-945E-3FEDA020F0BC}] => (Block) C:\Program Files\Avast Software\Avast\AvastUI.exe (Avast Software s.r.o. -> AVAST Software)

FirewallRules: [{1E30D51E-0615-4E12-ABB8-DBD6D159460C}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe (Google LLC -> Google LLC)

 

==================== Restore Points =========================

 

30-12-2021 14:04:38 Scheduled Checkpoint

 

==================== Faulty Device Manager Devices ============

 

 

==================== Event log errors: ========================

 

Application errors:

==================

Error: (01/02/2022 07:17:49 PM) (Source: ESENT) (EventID: 455) (User: )

Description: svchost (7916,R,98) TILEREPOSITORYS-1-5-18: Error -1023 (0xfffffc01) occurred while opening logfile C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database\EDB.log.

 

Error: (01/02/2022 07:07:33 PM) (Source: ESENT) (EventID: 455) (User: )

Description: svchost (7916,R,98) TILEREPOSITORYS-1-5-18: Error -1023 (0xfffffc01) occurred while opening logfile C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database\EDB.log.

 

Error: (01/02/2022 07:03:47 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: The program SystemSettings.exe version 10.0.18362.1171 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

 

Process ID: 2630

 

Start Time: 01d8000b4a640776

 

Termination Time: 4294967295

 

Application Path: C:\Windows\ImmersiveControlPanel\SystemSettings.exe

 

Report Id: 7e886b12-08f3-455a-adc2-5c86a87037aa

 

Faulting package full name: windows.immersivecontrolpanel_10.0.2.1000_neutral_neutral_cw5n1h2txyewy

 

Faulting package-relative application ID: microsoft.windows.immersivecontrolpanel

 

Hang type: Quiesce

 

Error: (01/02/2022 04:15:36 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: The program Microsoft.Photos.exe version 2021.21090.10008.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

 

Process ID: e38

 

Start Time: 01d7ffdfaefbcef9

 

Termination Time: 4294967295

 

Application Path: C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2021.21090.10008.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe

 

Report Id: 26df42d7-3266-4c9e-b3d7-ecf89ab02149

 

Faulting package full name: Microsoft.Windows.Photos_2021.21090.10008.0_x64__8wekyb3d8bbwe

 

Faulting package-relative application ID: App

 

Hang type: Quiesce

 

Error: (01/02/2022 03:38:10 PM) (Source: ESENT) (EventID: 455) (User: )

Description: svchost (1456,R,98) TILEREPOSITORYS-1-5-18: Error -1023 (0xfffffc01) occurred while opening logfile C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database\EDB.log.

 

Error: (01/02/2022 03:27:30 PM) (Source: ESENT) (EventID: 455) (User: )

Description: svchost (1776,R,98) TILEREPOSITORYS-1-5-18: Error -1023 (0xfffffc01) occurred while opening logfile C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database\EDB.log.

 

Error: (01/02/2022 03:17:31 PM) (Source: ESENT) (EventID: 455) (User: )

Description: svchost (5820,R,98) TILEREPOSITORYS-1-5-18: Error -1023 (0xfffffc01) occurred while opening logfile C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database\EDB.log.

 

Error: (01/02/2022 03:07:31 PM) (Source: ESENT) (EventID: 455) (User: )

Description: svchost (9428,R,98) TILEREPOSITORYS-1-5-18: Error -1023 (0xfffffc01) occurred while opening logfile C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database\EDB.log.

 

 

System errors:

=============

Error: (01/02/2022 06:47:42 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-O6KGU14)

Description: The server king.com.CandyCrushSodaSaga_1.208.400.0_x86__kgqvnymyfvs32!App did not register with DCOM within the required timeout.

 

Error: (01/02/2022 02:49:07 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-O6KGU14)

Description: The server Microsoft.SkypeApp_15.79.95.0_x86__kzf8qxf38zg5c!App.AppXtwmqn4em5r5dpafgj4t4yyxgjfe0hr50.mca did not register with DCOM within the required timeout.

 

Error: (01/02/2022 12:22:16 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-O6KGU14)

Description: The server {ABC01078-F197-4B0B-ADBC-CFE684B39C82} did not register with DCOM within the required timeout.

 

Error: (01/02/2022 11:24:52 AM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-O6KGU14)

Description: The server Microsoft.SkypeApp_15.79.95.0_x86__kzf8qxf38zg5c!App.AppXtwmqn4em5r5dpafgj4t4yyxgjfe0hr50.mca did not register with DCOM within the required timeout.

 

Error: (01/02/2022 11:23:51 AM) (Source: Service Control Manager) (EventID: 7022) (User: )

Description: The Delivery Optimization service did not respond on starting.

 

Error: (01/02/2022 11:22:17 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The Malwarebytes Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 86400000 milliseconds: Restart the service.

 

Error: (01/02/2022 11:19:49 AM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-O6KGU14)

Description: The server Microsoft.SkypeApp_15.79.95.0_x86__kzf8qxf38zg5c!App.AppXtwmqn4em5r5dpafgj4t4yyxgjfe0hr50.mca did not register with DCOM within the required timeout.

 

Error: (01/02/2022 11:19:46 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The SecureLine service failed to start due to the following error: 

The service did not respond to the start or control request in a timely fashion.

 

 

Windows Defender:

================

Date: 2021-01-24 12:05:03.743

Description: 

Windows Defender Antivirus scan has been stopped before completion.

Scan Type: Antimalware

Scan Parameters: Quick Scan

Event[0]:

 

Date: 2021-12-30 10:26:31.345

Description: 

Microsoft Defender Antivirus has encountered an error trying to update security intelligence.

New security intelligence Version: 

Previous security intelligence Version: 1.355.882.0

Update Source: Microsoft Malware Protection Center

Security intelligence Type: AntiVirus

Update Type: Full

Current Engine Version: 

Previous Engine Version: 1.1.18800.4

Error code: 0x80070102

Error description: The wait operation timed out. 

 

Date: 2021-12-28 15:47:03.564

Description: 

Microsoft Defender Antivirus has encountered an error trying to update security intelligence.

New security intelligence Version: 

Previous security intelligence Version: 1.355.882.0

Update Source: Microsoft Malware Protection Center

Security intelligence Type: AntiVirus

Update Type: Full

Current Engine Version: 

Previous Engine Version: 1.1.18800.4

Error code: 0x80070020

Error description: The process cannot access the file because it is being used by another process. 

 

Date: 2021-12-28 15:47:03.556

Description: 

Microsoft Defender Antivirus has encountered an error trying to update security intelligence.

New security intelligence Version: 

Previous security intelligence Version: 1.355.882.0

Update Source: Microsoft Malware Protection Center

Security intelligence Type: AntiSpyware

Update Type: Full

Current Engine Version: 

Previous Engine Version: 1.1.18800.4

Error code: 0x80070020

Error description: The process cannot access the file because it is being used by another process. 

 

Date: 2021-12-28 15:47:03.548

Description: 

Microsoft Defender Antivirus has encountered an error trying to update security intelligence.

New security intelligence Version: 

Previous security intelligence Version: 1.355.882.0

Update Source: Microsoft Malware Protection Center

Security intelligence Type: AntiVirus

Update Type: Full

Current Engine Version: 

Previous Engine Version: 1.1.18800.4

Error code: 0x80070020

Error description: The process cannot access the file because it is being used by another process. 

 

Date: 2021-12-28 15:41:08.804

Description: 

Microsoft Defender Antivirus has encountered an error trying to update security intelligence.

New security intelligence Version: 

Previous security intelligence Version: 1.355.882.0

Update Source: Microsoft Update Server

Security intelligence Type: AntiVirus

Update Type: Full

Current Engine Version: 

Previous Engine Version: 1.1.18800.4

Error code: 0x80240022

Error description: The program can't check for definition updates. 

 

==================== Memory info =========================== 

 

BIOS: Insyde Corp. 6.00 08/31/2012

Motherboard: Intel PLCSF8

Processor: Intel® Celeron® CPU B830 @ 1.80GHz

Percentage of memory in use: 87%

Total physical RAM: 1931.7 MB

Available physical RAM: 236.77 MB

Total Virtual: 4747.7 MB

Available Virtual: 1347.3 MB

 

==================== Drives ================================

 

Drive c: (TI30992200A) (Fixed) (Total:449.05 GB) (Free:401.36 GB) NTFS

 

\\?\Volume{c0dd0d82-2e24-42e0-8b79-6b71a3bce69d}\ (System) (Fixed) (Total:0.68 GB) (Free:0.36 GB) NTFS

\\?\Volume{af8b09ce-eebe-494e-86ba-6fcab0e774ab}\ () (Fixed) (Total:0.92 GB) (Free:0.4 GB) NTFS

\\?\Volume{a379aa5e-0794-483d-ac07-9ca701b9551d}\ (Recovery) (Fixed) (Total:14.73 GB) (Free:5.88 GB) NTFS

\\?\Volume{ecc65991-673f-4371-a0e7-17f3f31de389}\ () (Fixed) (Total:0.25 GB) (Free:0.2 GB) FAT32

 

==================== MBR & Partition Table ====================

 

==========================================================

Disk: 0 (Size: 465.8 GB) (Disk ID: 3218F92C)

 

Partition: GPT.

 

==================== End of Addition.txt =======================

 

[Advertisements]

Hi, scottb.
 
There is no sign of an active infection in the logs.
 
BUT, there are some important things to say regarding this computer:
 
1. Outdated operating system
 
It is important always to keep current with the latest security fixes from Microsoft. This can patch many of the security holes through which attackers can infect a computer. This computer is still running in version 1909, which stopped receiving security updates since last May. The latest one is version 21H2. 
 
 
2. Old computer, lack of RAM
 
Even if you upgrade the computer, there are things that will keep it running slow.
 
These lines are from the logs, indicating a lack of sufficient resources to run programs in an old computer. You have only 2GB installed RAM, and 87% of it is in use. Windows 10 can't run properly in a computer with 2GB RAM only.
 
BIOS: Insyde Corp. 6.00 08/31/2012
Motherboard: Intel PLCSF8
Processor: Intel® Celeron® CPU B830 @ 1.80GHz
Percentage of memory in use: 87%
Total physical RAM: 1931.7 MB
Available physical RAM: 236.77 MB
Total Virtual: 4747.7 MB
Available Virtual: 1347.3 MB
Perhaps uninstalling Avast and stay with the built-in Windows 10 antivirus, Windows Defender, will help a bit, but in any case 2GB RAM is extremely low memory for Windows 10.
 
To uninstall Avast: https://support.avas...tivirus-Utility
 
To check how much RAM can you add, now or in the future:

Here you can run a free RAM wizard to determine which RAM is compatible with your motherboard. You download and run a small program, which will scan your computer and then recommend compatible RAM. You don't have to buy from them, but you can find out how much RAM the computer can accept.
 
 
What I recommend:
 
Check if there is a possibility to add RAM, if yes add RAM, uninstall Avast and upgrade the computer to the latest version.
 
 
Let me know if you have any questions. 

[DR M]

Hi, scottb.
 
There is no sign of an active infection in the logs.
 
BUT, there are some important things to say regarding this computer:
 
1. Outdated operating system
 
It is important always to keep current with the latest security fixes from Microsoft. This can patch many of the security holes through which attackers can infect a computer. This computer is still running in version 1909, which stopped receiving security updates since last May. The latest one is version 21H2. 
 
 
2. Old computer, lack of RAM
 
Even if you upgrade the computer, there are things that will keep it running slow.
 
These lines are from the logs, indicating a lack of sufficient resources to run programs in an old computer. You have only 2GB installed RAM, and 87% of it is in use. Windows 10 can't run properly in a computer with 2GB RAM only.
 
BIOS: Insyde Corp. 6.00 08/31/2012
Motherboard: Intel PLCSF8
Processor: Intel® Celeron® CPU B830 @ 1.80GHz
Percentage of memory in use: 87%
Total physical RAM: 1931.7 MB
Available physical RAM: 236.77 MB
Total Virtual: 4747.7 MB
Available Virtual: 1347.3 MB
Perhaps uninstalling Avast and stay with the built-in Windows 10 antivirus, Windows Defender, will help a bit, but in any case 2GB RAM is extremely low memory for Windows 10.
 
To uninstall Avast: https://support.avas...tivirus-Utility
 
To check how much RAM can you add, now or in the future:

Here you can run a free RAM wizard to determine which RAM is compatible with your motherboard. You download and run a small program, which will scan your computer and then recommend compatible RAM. You don't have to buy from them, but you can find out how much RAM the computer can accept.
 
 
What I recommend:
 
Check if there is a possibility to add RAM, if yes add RAM, uninstall Avast and upgrade the computer to the latest version.
 
 
Let me know if you have any questions. 

[scottb]

Hi Dr M,

 

Thankyou for your help and advise on this issue, I'll talk to the owner of the laptop and see what he says about upgrading the memory.

Can you just confirm that the 2 links are the same memory, were in the UK and crucial is American link.

 

https://www.crucial....f160b/ct4337018

 

https://www.amazon.c...,aps,430&sr=8-3

 

thanks again.

[DR M]

Scott,

 

It seems that they both refer to the same thing.

[scottb]

DR M, 

 

thank you again for your help.

 

scott

[DR M]

You are very welcome.

[DR M]

It appears that this issue is resolved, and therefore this topic has been marked as such.

 

scottb, If you need this topic reopened, please contact a staff member, or send me a personal message (hoover with the mouse on my profile name and choose Send message).