Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Virus Infection

Started by ForrestGump , Oct 05 2022 11:38 PM

Virus

Please log in to reply

#1
ForrestGump

Posted 05 October 2022 - 11:38 PM

Member

Member
91 posts

Hello,

Just joined & need assistance to resolve my Infected Laptop,

I have ran Malwarebytes with Rootkits selected & AI scan not selected & no Detections reported,

I used the Reset this PC function & there was no improvement for the issues of freezing, Further issues & observations are as follows,

Symptoms occuring are,

Edge & Google with only 1 tab open use 50-75% of CPU & MEM

When using Disk Cleanup if I move the cursor when Disk Cleanup states cleaning, it closes right away & it also gets stuck on removing Defender files that are not required any longer

I downloaded then Deleted Miray RAM DISK & Qiling DISK Master RAM

I notice Miray Software AG & Chongqing Xia Soft Tech are listed in Internet Options, Content, Certificates, Trusted Publishers with both having expired Certificates?

I noticed the Windows Security icon on the taskbar had a yellow exclamation indicator, when I opened it, I saw that App & Browser control was disabled and I was prompted to enable the feature.

When I enabled it & looked at the Exploit Protection settings, I noticed though that under program settings, all the system settings were set at default, & there are several programs with system overrides,

extExport.exe, ie4uinit.exe, ieinstal.exe, ielowutil.exe, ieUnatt.exe, iexplore.exe, msfeedssync.exe, mshta.exe, All had, Force randomization for images(mandatory ASLR) set to Override system settings (on)

mscorsvw.exe, ngen.exe, ngentask.exe, printdialog.exe, runtimebroker.exe, systemsettingshost.exe, All Had, Disable extension points Override system settings (on)

presentationhost.exe, Had, Data Execution Prevention, Force Randomization for Images(mandatory ASLR), Randomize memory allocations(Bottom up ASLR), Validate exception chains(SEHOP), Validate heap

integrity, All set to Override system settings (on)

presentationhost.exe, indicated 6 system overrides, yet only the 5 listed above actually were, When I had reviewed this list to see what was missed, there is 1 entry unlike the others,

Control Flow Guard(CFG), Is checked on for override system settings but is dark grey not blue.

End of issues & observations

Please review the issues & observations & FRST scan results & advise further

Thank you so much!!

BTW I will never download Freeware again for as long as I live

I have scanned with FRST & posted below are the results

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 04-10-2022

Ran by doher (administrator) on HAL900 (Hewlett-Packard HP G61 Notebook PC) (05-10-2022 18:34:32)

Running from C:\Users\doher\OneDrive\Desktop

Loaded Profiles: doher

Platform: Microsoft Windows 10 Pro Version 21H2 19044.2075 (X64) Language: English (United States)

Default browser: Edge

Boot Mode: Normal

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(atiesrxx.exe ->) (Microsoft Windows Hardware Compatibility Publisher -> AMD) C:\Windows\System32\atieclxx.exe

(C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe ->) (Synaptics Incorporated -> Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(services.exe ->) (Microsoft Windows Hardware Compatibility Publisher -> AMD) C:\Windows\System32\atiesrxx.exe

(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2207.7-0\MsMpEng.exe

(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2207.7-0\NisSrv.exe

(services.exe ->) (Synaptics Incorporated -> Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe

(svchost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Users\doher\AppData\Local\Microsoft\OneDrive\22.191.0911.0001\FileCoAuth.exe

(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe

(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe

(Synaptics Incorporated -> Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

==================== Registry (Whitelisted) ===================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3954352 2016-03-31] (Synaptics Incorporated -> Synaptics Incorporated)

HKU\S-1-5-21-1890784580-1000596592-3856219040-1001\...\Run: [Opera Browser Assistant] => C:\Users\doher\AppData\Local\Programs\Opera\assistant\browser_assistant.exe [4137936 2022-09-14] (Opera Norway AS -> Opera Software)

HKU\S-1-5-21-1890784580-1000596592-3856219040-1001\...\RunOnce: [Delete Cached Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\doher\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" (No File)

HKU\S-1-5-21-1890784580-1000596592-3856219040-1001\...\RunOnce: [Delete Cached Standalone Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\doher\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" (No File)

HKU\S-1-5-21-1890784580-1000596592-3856219040-1001\...\RunOnce: [Uninstall 21.220.1024.0005\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\doher\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\amd64" (No File)

HKU\S-1-5-21-1890784580-1000596592-3856219040-1001\...\RunOnce: [Uninstall 21.220.1024.0005] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\doher\AppData\Local\Microsoft\OneDrive\21.220.1024.0005" (No File)

HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files\Google\Chrome\Application\106.0.5249.91\Installer\chrmstp.exe [2022-10-05] (Google LLC -> Google LLC)

HKLM\Software\...\Authentication\Credential Providers: [{f64945df-4fa9-4068-a2fb-61af319edd33}] -> C:\WINDOWS\system32\rdpcredentialprovider.dll [2022-10-04] (Microsoft Windows -> Microsoft Corporation)

==================== Scheduled Tasks (Whitelisted) ============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {52850E0C-86A4-46EE-87CD-569DAF5E6A90} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2207.7-0\MpCmdRun.exe [1335960 2022-10-04] (Microsoft Windows Publisher -> Microsoft Corporation)

Task: {627F11A7-DB57-4CAD-9C39-DEBDA5A97B8D} - System32\Tasks\GoogleUpdateTaskMachineCore{CCAD91CA-4D95-45E8-9397-E4D83671A68C} => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [171480 2022-10-05] (Google LLC -> Google LLC)

Task: {777BF150-2027-491E-B78D-5A7D5BE35734} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2207.7-0\MpCmdRun.exe [1335960 2022-10-04] (Microsoft Windows Publisher -> Microsoft Corporation)

Task: {7E10D5FB-81BF-4247-BAC4-BD5C9686A77A} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2207.7-0\MpCmdRun.exe [1335960 2022-10-04] (Microsoft Windows Publisher -> Microsoft Corporation)

Task: {9047BE8A-DED6-4B7E-8B16-19C21B9DAF3E} - System32\Tasks\GoogleUpdateTaskMachineUA{F4EFA46F-C692-4809-820D-BE5C8CFC2442} => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [171480 2022-10-05] (Google LLC -> Google LLC)

Task: {E84127CA-6F66-4417-BD10-09B319547B94} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2207.7-0\MpCmdRun.exe [1335960 2022-10-04] (Microsoft Windows Publisher -> Microsoft Corporation)

Task: {F85A7457-4A52-4327-A0F8-93C321BD5539} - System32\Tasks\Opera scheduled Autoupdate 1664946301 => C:\Users\doher\AppData\Local\Programs\Opera\launcher.exe [2534856 2022-09-21] (Opera Norway AS -> Opera Software)

Task: {F8FDA3AB-DDC7-4BE8-AD0C-8AD0846B6A1D} - System32\Tasks\Opera scheduled assistant Autoupdate 1664946315 => C:\Users\doher\AppData\Local\Programs\Opera\launcher.exe [2534856 2022-09-21] (Opera Norway AS -> Opera Software) -> --scheduledautoupdate --component-name=assistant --component-path="C:\Users\doher\AppData\Local\Programs\Opera\assistant" $(Arg0)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

Tcpip\..\Interfaces\{8ae5b79e-3f17-43ac-9ee0-392aa1379c3a}: [DhcpNameServer] 192.168.2.1

Tcpip\..\Interfaces\{e03cb7c5-df15-4fd3-aee5-d164ca37553e}: [DhcpNameServer] 192.168.2.1

Edge:

=======

Edge DefaultProfile: Default

Edge Profile: C:\Users\doher\AppData\Local\Microsoft\Edge\User Data\Default [2022-10-05]

Edge Notifications: Default -> hxxps://www.youtube.com

Edge DefaultSearchURL: Default -> hxxps://duckduckgo.com/?q={searchTerms}

Edge DefaultSearchKeyword: Default -> duckduckgo.com

Edge DefaultSuggestURL: Default -> hxxps://duckduckgo.com/ac/?q={searchTerms}&type=list

Edge Extension: (DuckDuckGo) - C:\Users\doher\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\caoacbimdbbljakfhgikoodekdnlcgpk [2022-10-04]

Edge Extension: (uBlock Origin) - C:\Users\doher\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\cjpalhdlnbpafiamejdnhcphjbkeiagm [2022-10-04]

Edge Extension: (Enhancer for YouTube™) - C:\Users\doher\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\dlgfaleeejmphhnemjgiaekdbonkagkd [2022-10-04]

Edge Extension: (Malwarebytes Browser Guard) - C:\Users\doher\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ihcjicgdanjaechkgeegckofjjedodee [2022-10-04]

Edge Extension: (MSN New Tab) - C:\Users\doher\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\lklfbkdigihjaaeamncibechhgalldgl [2022-10-04]

Edge Extension: (Privacy Badger) - C:\Users\doher\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\pkehgijcmpdhfbdbbnkijodmdjhbjlgp [2022-10-04]

Chrome:

=======

CHR Profile: C:\Users\doher\AppData\Local\Google\Chrome\User Data\Default [2022-10-05]

CHR Extension: (Google Docs Offline) - C:\Users\doher\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2022-10-05]

CHR Extension: (AdBlock — best ad blocker) - C:\Users\doher\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2022-10-05]

CHR Extension: (Chrome Web Store Payments) - C:\Users\doher\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2022-10-05]

CHR Extension: (Speedtest by Ookla) - C:\Users\doher\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgjjikdiikihdfpoppgaidccahalehjh [2022-10-05]

CHR Extension: (Enhancer for YouTube™) - C:\Users\doher\AppData\Local\Google\Chrome\User Data\Default\Extensions\ponfpcnoihfmfllpaingbgckeeldkhle [2022-10-05]

Opera:

=======

OPR Profile: C:\Users\doher\AppData\Roaming\Opera Software\Opera Stable [2022-10-05]

OPR DefaultSuggestURL: Opera Stable -> hxxps://www.google.com/complete/search?client=opera&q={searchTerms}&ie={inputEncoding}&oe={outputEncoding}

OPR Extension: (Rich Hints Agent) - C:\Users\doher\AppData\Roaming\Opera Software\Opera Stable\Extensions\enegjkbbakeegngfapepobipndnebkdk [2022-10-05]

OPR Extension: (Opera Crypto Wallet) - C:\Users\doher\AppData\Roaming\Opera Software\Opera Stable\Extensions\gojhcdgcpbpfigcaejpfhfegekdgiblk [2022-10-05]

OPR Extension: (Amazon Assistant Promotion) - C:\Users\doher\AppData\Roaming\Opera Software\Opera Stable\Extensions\kbmoiomgmchbpihhdpabemajcbjpcijk [2022-10-05]

==================== Services (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [224192 2022-10-04] (Microsoft Windows Publisher -> Microsoft Corporation)

R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2207.7-0\NisSrv.exe [3125112 2022-10-04] (Microsoft Windows Publisher -> Microsoft Corporation)

R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2207.7-0\MsMpEng.exe [133560 2022-10-04] (Microsoft Windows Publisher -> Microsoft Corporation)

===================== Drivers (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 MirayRAMDrive; C:\WINDOWS\System32\drivers\mrdo.sys [65488 2022-02-10] (Miray Software AG -> Miray)

S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [49576 2022-10-04] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)

R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [453904 2022-10-04] (Microsoft Windows -> Microsoft Corporation)

R3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [94480 2022-10-04] (Microsoft Windows -> Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One month (created) (Whitelisted) =========

(If an entry is included in the fixlist, the file/folder will be moved.)

2022-10-05 17:31 - 2022-10-05 18:35 - 000000000 ____D C:\FRST

2022-10-05 14:53 - 2022-10-05 14:53 - 000000000 ____D C:\WINDOWS\Panther

2022-10-05 04:26 - 2022-10-05 04:27 - 000000000 ____D C:\Users\doher\AppData\Local\PlaceholderTileLogoFolder

2022-10-05 01:05 - 2022-10-05 01:05 - 000004406 _____ C:\WINDOWS\system32\Tasks\Opera scheduled assistant Autoupdate 1664946315

2022-10-05 01:05 - 2022-10-05 01:05 - 000004152 _____ C:\WINDOWS\system32\Tasks\Opera scheduled Autoupdate 1664946301

2022-10-05 01:05 - 2022-10-05 01:05 - 000001405 _____ C:\Users\doher\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Opera Browser.lnk

2022-10-05 01:05 - 2022-10-05 01:05 - 000000000 ____D C:\Users\doher\AppData\Local\Opera Software

2022-10-05 01:03 - 2022-10-05 01:03 - 000000000 ____D C:\Users\doher\AppData\Roaming\Opera Software

2022-10-05 00:52 - 2022-10-05 00:52 - 000002325 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

2022-10-05 00:52 - 2022-10-05 00:52 - 000002284 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2022-10-05 00:52 - 2022-10-05 00:52 - 000000000 ____D C:\Program Files\Google

2022-10-05 00:51 - 2022-10-05 17:56 - 000000000 ____D C:\Program Files (x86)\Google

2022-10-05 00:51 - 2022-10-05 01:04 - 000000000 ____D C:\Users\doher\AppData\Local\Google

2022-10-05 00:51 - 2022-10-05 00:51 - 000003496 _____ C:\WINDOWS\system32\Tasks\GoogleUpdateTaskMachineUA{F4EFA46F-C692-4809-820D-BE5C8CFC2442}

2022-10-05 00:51 - 2022-10-05 00:51 - 000003372 _____ C:\WINDOWS\system32\Tasks\GoogleUpdateTaskMachineCore{CCAD91CA-4D95-45E8-9397-E4D83671A68C}

2022-10-04 23:50 - 2022-10-04 23:50 - 000000000 ____D C:\Users\doher\AppData\Local\PeerDistRepub

2022-10-04 22:40 - 2022-10-04 22:40 - 000378531 _____ C:\Users\doher\Downloads\Start_Menu_troubleshooter.zip

2022-10-04 21:12 - 2022-10-04 21:12 - 000000000 ____D C:\Users\doher\AppData\Local\Apps\2.0

2022-10-04 20:54 - 2022-10-04 20:54 - 000000000 ____D C:\Users\doher\AppData\Local\Comms

2022-10-04 20:12 - 2022-10-04 20:12 - 000000000 ____D C:\Users\doher\AppData\Local\OneDrive

2022-10-04 19:21 - 2022-10-04 19:21 - 000000000 ____D C:\Users\doher\OneDrive\Documents\Zoom

2022-10-04 19:21 - 2022-05-02 17:20 - 461187826 _____ C:\Users\doher\OneDrive\Documents\reg back up may 02 2022 518 pm.reg

2022-10-04 19:21 - 2022-04-26 21:22 - 000000000 _____ C:\Users\doher\OneDrive\Documents\Default.rdp

2022-10-04 19:21 - 2022-03-30 20:05 - 000725625 _____ C:\Users\doher\OneDrive\Documents\dism log mar 30 2022.txt

2022-10-04 19:20 - 2022-10-04 19:20 - 000000000 ____D C:\Users\doher\OneDrive\Documents\PCMark 7

2022-10-04 19:20 - 2022-10-04 19:20 - 000000000 ____D C:\Users\doher\OneDrive\Documents\PassMark

2022-10-04 18:47 - 2022-10-04 18:50 - 000000000 ____D C:\WINDOWS\system32\MRT

2022-10-04 18:44 - 2022-10-04 18:44 - 000000000 ____D C:\Program Files\Microsoft Update Health Tools

2022-10-04 18:43 - 2022-10-04 18:43 - 000001148 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Health Check.lnk

2022-10-04 18:43 - 2022-10-04 18:43 - 000000000 ____D C:\Program Files\PCHealthCheck

2022-10-04 18:23 - 2022-10-05 18:24 - 000003592 _____ C:\WINDOWS\system32\Tasks\OneDrive Reporting Task-S-1-5-21-1890784580-1000596592-3856219040-1001

2022-10-04 18:23 - 2022-10-05 18:24 - 000003362 _____ C:\WINDOWS\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-1890784580-1000596592-3856219040-1001

2022-10-04 18:23 - 2022-10-04 18:23 - 000000000 ____D C:\ProgramData\Microsoft OneDrive

2022-10-04 18:22 - 2022-10-05 13:53 - 000000000 ____D C:\Users\doher\AppData\Local\D3DSCache

2022-10-04 18:20 - 2022-10-05 04:27 - 000000000 ____D C:\Users\doher\AppData\Local\Packages

2022-10-04 18:20 - 2022-10-04 20:54 - 000000000 ____D C:\ProgramData\Packages

2022-10-04 18:20 - 2022-10-04 19:19 - 000000000 ____D C:\Users\doher\AppData\Local\ConnectedDevicesPlatform

2022-10-04 18:20 - 2022-10-04 18:20 - 000000020 ___SH C:\Users\doher\ntuser.ini

2022-10-04 18:20 - 2022-10-04 18:20 - 000000000 ____D C:\Users\doher\AppData\Roaming\Adobe

2022-10-04 18:20 - 2022-10-04 18:20 - 000000000 ____D C:\Users\doher\AppData\Local\VirtualStore

2022-10-04 18:20 - 2022-10-04 18:20 - 000000000 ____D C:\Users\doher\AppData\Local\Publishers

2022-10-04 17:32 - 2022-10-04 17:33 - 000000000 ____D C:\WINDOWS\ServiceProfiles

2022-10-04 17:28 - 2022-10-04 17:28 - 000000000 ____D C:\WINDOWS\SystemTemp

2022-10-04 17:28 - 2022-10-04 17:28 - 000000000 ____D C:\ProgramData\ssh

2022-10-04 17:20 - 2022-10-04 17:20 - 001687040 _____ C:\WINDOWS\system32\libcrypto.dll

2022-10-04 17:20 - 2022-10-04 17:20 - 000581120 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhotoScreensaver.scr

2022-10-04 17:20 - 2022-10-04 17:20 - 000499200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhotoScreensaver.scr

2022-10-04 17:20 - 2022-10-04 17:20 - 000479744 _____ C:\WINDOWS\system32\AssignedAccessCsp.dll

2022-10-04 17:20 - 2022-10-04 17:20 - 000188928 _____ C:\WINDOWS\system32\uwfcfgmgmt.dll

2022-10-04 17:20 - 2022-10-04 17:20 - 000170496 _____ C:\WINDOWS\system32\DeviceUpdateCenterCsp.dll

2022-10-04 17:20 - 2022-10-04 17:20 - 000158208 _____ C:\WINDOWS\system32\uwfcsp.dll

2022-10-04 17:20 - 2022-10-04 17:20 - 000138056 _____ C:\WINDOWS\system32\HvsiManagementApi.dll

2022-10-04 17:20 - 2022-10-04 17:20 - 000101704 _____ C:\WINDOWS\SysWOW64\HvsiManagementApi.dll

2022-10-04 17:20 - 2022-10-04 17:20 - 000095744 _____ C:\WINDOWS\system32\VirtualMonitorManager.dll

2022-10-04 17:20 - 2022-10-04 17:20 - 000040960 _____ C:\WINDOWS\system32\uwfservicingapi.dll

2022-10-04 17:19 - 2022-10-04 17:19 - 003860832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rtmpltfm.dll

2022-10-04 17:19 - 2022-10-04 17:19 - 002371072 _____ C:\WINDOWS\system32\rdpnano.dll

2022-10-04 17:19 - 2022-10-04 17:19 - 000980320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rtmpal.dll

2022-10-04 17:19 - 2022-10-04 17:19 - 000915296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rtmcodecs.dll

2022-10-04 17:19 - 2022-10-04 17:19 - 000732000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ortcengine.dll

2022-10-04 17:19 - 2022-10-04 17:19 - 000693248 _____ C:\WINDOWS\system32\FsNVSDeviceSource.dll

2022-10-04 17:19 - 2022-10-04 17:19 - 000530944 _____ (curl, hxxps://curl.se/) C:\WINDOWS\system32\curl.exe

2022-10-04 17:19 - 2022-10-04 17:19 - 000470528 _____ (curl, hxxps://curl.se/) C:\WINDOWS\SysWOW64\curl.exe

2022-10-04 17:19 - 2022-10-04 17:19 - 000270848 _____ C:\WINDOWS\system32\EsclScan.dll

2022-10-04 17:19 - 2022-10-04 17:19 - 000152064 _____ C:\WINDOWS\system32\EsclProtocol.dll

2022-10-04 17:19 - 2022-10-04 17:19 - 000104448 _____ C:\WINDOWS\system32\nettraceex.dll

2022-10-04 17:19 - 2022-10-04 17:19 - 000067072 _____ C:\WINDOWS\system32\BWContextHandler.dll

2022-10-04 17:19 - 2022-10-04 17:19 - 000055376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rtmmvrortc.dll

2022-10-04 17:19 - 2022-10-04 17:19 - 000053760 _____ C:\WINDOWS\SysWOW64\BWContextHandler.dll

2022-10-04 17:19 - 2022-10-04 17:19 - 000045880 _____ C:\WINDOWS\system32\HvSocket.dll

2022-10-04 17:19 - 2022-10-04 17:19 - 000033280 _____ (Microsoft Corporation) C:\WINDOWS\system32\mode.com

2022-10-04 17:19 - 2022-10-04 17:19 - 000026624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mode.com

2022-10-04 17:19 - 2022-10-04 17:19 - 000020992 _____ (Microsoft Corporation) C:\WINDOWS\system32\tree.com

2022-10-04 17:19 - 2022-10-04 17:19 - 000018944 _____ C:\WINDOWS\SysWOW64\WsdProviderUtil.dll

2022-10-04 17:19 - 2022-10-04 17:19 - 000017920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tree.com

2022-10-04 17:19 - 2022-10-04 17:19 - 000014848 _____ (Microsoft Corporation) C:\WINDOWS\system32\chcp.com

2022-10-04 17:19 - 2022-10-04 17:19 - 000012800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\chcp.com

2022-10-04 17:19 - 2022-10-04 17:19 - 000012251 _____ C:\WINDOWS\system32\DrtmAuthTxt.wim

2022-10-04 17:18 - 2022-10-04 17:18 - 002111488 _____ (Digimarc) C:\WINDOWS\SysWOW64\DMRCDecoder.dll

2022-10-04 17:18 - 2022-10-04 17:18 - 001864192 _____ (The ICU Project) C:\WINDOWS\SysWOW64\icu.dll

2022-10-04 17:18 - 2022-10-04 17:18 - 001333760 _____ C:\WINDOWS\SysWOW64\TextInputMethodFormatter.dll

2022-10-04 17:18 - 2022-10-04 17:18 - 001164288 _____ C:\WINDOWS\system32\MBR2GPT.EXE

2022-10-04 17:18 - 2022-10-04 17:18 - 000611960 _____ C:\WINDOWS\SysWOW64\TextShaping.dll

2022-10-04 17:18 - 2022-10-04 17:18 - 000468440 _____ C:\WINDOWS\SysWOW64\WindowManagementAPI.dll

2022-10-04 17:18 - 2022-10-04 17:18 - 000363520 _____ C:\WINDOWS\system32\Windows.Internal.UI.Shell.WindowTabManager.dll

2022-10-04 17:18 - 2022-10-04 17:18 - 000330752 _____ C:\WINDOWS\SysWOW64\ssdm.dll

2022-10-04 17:18 - 2022-10-04 17:18 - 000266240 _____ C:\WINDOWS\SysWOW64\Windows.Internal.UI.Shell.WindowTabManager.dll

2022-10-04 17:18 - 2022-10-04 17:18 - 000240640 _____ C:\WINDOWS\SysWOW64\CoreMas.dll

2022-10-04 17:18 - 2022-10-04 17:18 - 000235520 _____ C:\WINDOWS\SysWOW64\HeatCore.dll

2022-10-04 17:18 - 2022-10-04 17:18 - 000223744 _____ C:\WINDOWS\SysWOW64\TpmTool.exe

2022-10-04 17:18 - 2022-10-04 17:18 - 000047472 _____ C:\WINDOWS\SysWOW64\umpdc.dll

2022-10-04 17:18 - 2022-10-04 17:18 - 000039936 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll

2022-10-04 17:18 - 2022-10-04 17:18 - 000010752 _____ C:\WINDOWS\SysWOW64\agentactivationruntimestarter.exe

2022-10-04 17:17 - 2022-10-04 17:17 - 004898144 _____ (Microsoft Corporation) C:\WINDOWS\system32\rtmpltfm.dll

2022-10-04 17:17 - 2022-10-04 17:17 - 002254336 _____ C:\WINDOWS\system32\dwmscene.dll

2022-10-04 17:17 - 2022-10-04 17:17 - 001354080 _____ (Microsoft Corporation) C:\WINDOWS\system32\rtmpal.dll

2022-10-04 17:17 - 2022-10-04 17:17 - 001091936 _____ (Microsoft Corporation) C:\WINDOWS\system32\rtmcodecs.dll

2022-10-04 17:17 - 2022-10-04 17:17 - 001032544 _____ (Microsoft Corporation) C:\WINDOWS\system32\ortcengine.dll

2022-10-04 17:17 - 2022-10-04 17:17 - 000190976 _____ C:\WINDOWS\system32\BthpanContextHandler.dll

2022-10-04 17:17 - 2022-10-04 17:17 - 000152064 _____ C:\WINDOWS\system32\EoAExperiences.exe

2022-10-04 17:17 - 2022-10-04 17:17 - 000061952 _____ C:\WINDOWS\system32\printticketvalidation.dll

2022-10-04 17:17 - 2022-10-04 17:17 - 000060928 _____ C:\WINDOWS\system32\runexehelper.exe

2022-10-04 17:17 - 2022-10-04 17:17 - 000057344 _____ C:\WINDOWS\system32\APMonUI.dll

2022-10-04 17:17 - 2022-10-04 17:17 - 000056672 _____ (Microsoft Corporation) C:\WINDOWS\system32\rtmmvrortc.dll

2022-10-04 17:17 - 2022-10-04 17:17 - 000048640 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll

2022-10-04 17:16 - 2022-10-04 17:16 - 004227116 _____ C:\WINDOWS\system32\DefaultHrtfs.bin

2022-10-04 17:16 - 2022-10-04 17:16 - 002295296 _____ (Digimarc) C:\WINDOWS\system32\DMRCDecoder.dll

2022-10-04 17:16 - 2022-10-04 17:16 - 002260480 _____ C:\WINDOWS\system32\TextInputMethodFormatter.dll

2022-10-04 17:16 - 2022-10-04 17:16 - 002260480 _____ (The ICU Project) C:\WINDOWS\system32\icu.dll

2022-10-04 17:16 - 2022-10-04 17:16 - 000706536 _____ C:\WINDOWS\system32\TextShaping.dll

2022-10-04 17:16 - 2022-10-04 17:16 - 000657464 _____ C:\WINDOWS\system32\WindowManagementAPI.dll

2022-10-04 17:16 - 2022-10-04 17:16 - 000640512 _____ C:\WINDOWS\system32\SettingSyncDownloadHelper.dll

2022-10-04 17:16 - 2022-10-04 17:16 - 000413696 _____ C:\WINDOWS\system32\AzureCheck.dll

2022-10-04 17:16 - 2022-10-04 17:16 - 000306688 _____ C:\WINDOWS\system32\HeatCore.dll

2022-10-04 17:16 - 2022-10-04 17:16 - 000287232 _____ C:\WINDOWS\system32\CoreMas.dll

2022-10-04 17:16 - 2022-10-04 17:16 - 000272896 _____ C:\WINDOWS\system32\TpmTool.exe

2022-10-04 17:16 - 2022-10-04 17:16 - 000232288 _____ C:\WINDOWS\system32\containerdevicemanagement.dll

2022-10-04 17:16 - 2022-10-04 17:16 - 000162304 _____ C:\WINDOWS\system32\DataStoreCacheDumpTool.exe

2022-10-04 17:16 - 2022-10-04 17:16 - 000098816 _____ C:\WINDOWS\system32\Drivers\cimfs.sys

2022-10-04 17:16 - 2022-10-04 17:16 - 000074240 _____ C:\WINDOWS\system32\rdsxvmaudio.dll

2022-10-04 17:16 - 2022-10-04 17:16 - 000064552 _____ C:\WINDOWS\system32\umpdc.dll

2022-10-04 17:16 - 2022-10-04 17:16 - 000029696 _____ (The ICU Project) C:\WINDOWS\system32\icuuc.dll

2022-10-04 17:16 - 2022-10-04 17:16 - 000025088 _____ (The ICU Project) C:\WINDOWS\system32\icuin.dll

2022-10-04 17:16 - 2022-10-04 17:16 - 000024576 _____ C:\WINDOWS\system32\WsdProviderUtil.dll

2022-10-04 17:16 - 2022-10-04 17:16 - 000001370 _____ C:\WINDOWS\system32\ThirdPartyNoticesBySHS.txt

2022-10-04 17:15 - 2022-10-04 17:15 - 000455168 _____ C:\WINDOWS\system32\ssdm.dll

2022-10-04 17:15 - 2022-10-04 17:15 - 000288768 _____ C:\WINDOWS\system32\Windows.Management.InprocObjects.dll

2022-10-04 17:15 - 2022-10-04 17:15 - 000197632 _____ C:\WINDOWS\system32\IHDS.dll

2022-10-04 17:15 - 2022-10-04 17:15 - 000089088 _____ C:\WINDOWS\system32\windows.applicationmodel.conversationalagent.proxystub.dll

2022-10-04 17:15 - 2022-10-04 17:15 - 000073216 _____ C:\WINDOWS\system32\windows.applicationmodel.conversationalagent.internal.proxystub.dll

2022-10-04 17:15 - 2022-10-04 17:15 - 000013312 _____ C:\WINDOWS\system32\agentactivationruntimestarter.exe

2022-10-04 17:03 - 2022-10-04 17:03 - 000000000 ____D C:\Program Files\Reference Assemblies

2022-10-04 17:03 - 2022-10-04 17:03 - 000000000 ____D C:\Program Files\MSBuild

2022-10-04 17:03 - 2022-10-04 17:03 - 000000000 ____D C:\Program Files (x86)\Reference Assemblies

2022-10-04 17:03 - 2022-10-04 17:03 - 000000000 ____D C:\Program Files (x86)\MSBuild

2022-10-04 17:01 - 2022-10-04 17:01 - 000000000 ____D C:\Program Files\Synaptics

2022-10-04 16:59 - 2022-10-04 16:59 - 000008192 _____ C:\WINDOWS\system32\config\userdiff

2022-10-04 13:53 - 2022-10-05 14:57 - 000840598 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2022-10-04 13:48 - 2022-10-05 14:53 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT

2022-10-04 13:48 - 2022-10-04 18:45 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd

2022-10-04 13:48 - 2022-10-04 13:48 - 000003612 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA{5D5FA87D-8AD4-4FE3-8C9D-AAC9FBF2FC5C}

2022-10-04 13:48 - 2022-10-04 13:48 - 000003488 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore{1CC0C225-8D66-4F90-BB26-44AF4225D386}

2022-10-04 13:43 - 2022-10-05 18:24 - 000002385 _____ C:\Users\doher\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk

2022-10-04 13:43 - 2022-10-04 18:20 - 000000000 ____D C:\Users\doher

2022-10-04 13:40 - 2022-10-04 13:40 - 000000000 ____H C:\WINDOWS\system32\Drivers\Msft_Kernel_SynTP_01011.Wdf

2022-10-04 13:39 - 2022-10-04 13:49 - 000002278 _____ C:\Users\Public\Desktop\Microsoft Edge.lnk

2022-10-04 13:39 - 2022-10-04 13:39 - 000000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf

2022-10-04 13:39 - 2022-10-04 13:39 - 000000000 _____ C:\WINDOWS\ativpsrm.bin

2022-10-04 13:38 - 2022-10-05 16:03 - 000000000 ____D C:\WINDOWS\system32\SleepStudy

2022-10-04 13:38 - 2022-10-04 13:38 - 000257824 _____ C:\WINDOWS\system32\FNTCACHE.DAT

2022-10-04 12:41 - 2022-10-04 13:46 - 000000000 ___HD C:\$SysReset

2022-10-03 04:54 - 2022-10-03 04:55 - 000000000 ____D C:\Users\doher\AppData\LocalLow\IObit

2022-09-25 23:54 - 2022-09-25 23:56 - 000000000 ___HD C:\$WinREAgent

2022-09-25 21:04 - 2022-10-04 19:20 - 000000000 ____D C:\Users\doher\OneDrive\Documents\New folder

2022-09-22 20:48 - 2022-09-22 20:48 - 000004600 _____ C:\Users\doher\OneDrive\Documents\Attossdbenchres.bmk

2022-09-22 20:23 - 2022-09-22 20:23 - 000000000 ____D C:\ATTO

2022-09-22 20:22 - 2022-09-22 20:22 - 003993048 _____ (ATTO Technology, Inc.) C:\Users\doher\Downloads\win_app_benchmark_4000f2.exe

2022-09-22 02:50 - 2022-09-22 02:50 - 000000000 ____D C:\Users\doher\.wdc

2022-09-22 02:32 - 2022-09-22 02:32 - 003637651 _____ C:\Users\doher\Downloads\c01868653.pdf

2022-09-21 00:02 - 2022-09-21 00:02 - 000001024 ____H C:\SYSTAG.BIN

2022-09-20 23:05 - 2022-09-22 23:31 - 000001024 ____H C:\AMTAG.BIN

2022-09-20 03:49 - 2022-09-20 03:49 - 000000000 _____ C:\cbslog.txt

2022-09-20 00:33 - 2022-09-20 00:33 - 002786040 _____ (Opera Software) C:\Users\doher\Downloads\OperaSetup.exe

2022-09-19 22:44 - 2022-10-03 20:10 - 000000000 ____D C:\AMD

2022-09-19 22:02 - 2022-09-26 03:09 - 000000000 ____D C:\Users\doher\OneDrive\Documents\AIDA64 Reports

2022-09-19 10:44 - 2022-09-19 21:53 - 000000000 ____D C:\Users\doher\Downloads\aida64business675_portable

2022-09-19 10:44 - 2022-09-19 10:44 - 049661152 _____ C:\Users\doher\Downloads\aida64business675_portable.zip

2022-09-19 08:49 - 2022-09-19 08:49 - 001427176 _____ (Google LLC) C:\Users\doher\Downloads\ChromeSetup.exe

2022-09-19 03:15 - 2022-09-19 03:31 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPatrol

2022-09-18 17:49 - 2022-10-03 08:37 - 000000000 ___HD C:\OneDriveTemp

2022-09-18 17:49 - 2022-09-18 17:49 - 000000000 ____D C:\Users\doher\OneDrive\Documents\Windows Imaging and Configuration Designer (WICD)

2022-09-18 17:49 - 2022-09-18 17:49 - 000000000 ____D C:\Users\doher\OneDrive\Documents\Windows Assessment Console

2022-09-18 17:49 - 2022-09-18 17:49 - 000000000 ____D C:\Users\doher\OneDrive\Documents\Sigcheck

2022-09-18 17:49 - 2022-09-18 17:49 - 000000000 ____D C:\Users\doher\OneDrive\Documents\Assessment Results

2022-09-18 17:49 - 2022-09-13 23:49 - 000000000 _____ C:\Users\doher\OneDrive\Documents\disk results.txt

2022-09-18 17:49 - 2022-03-21 11:23 - 000000552 _____ C:\Users\doher\OneDrive\Documents\cc_20220321_112309.reg

2022-09-18 17:49 - 2022-03-21 11:21 - 000039364 _____ C:\Users\doher\OneDrive\Documents\cc_20220321_112000.reg

2022-09-18 17:48 - 2022-10-05 18:24 - 000000000 ___RD C:\Users\doher\OneDrive

2022-09-18 17:44 - 2022-10-04 18:21 - 000000000 __RHD C:\Users\Public\AccountPictures

2022-09-18 17:44 - 2022-10-04 18:20 - 000000000 ___RD C:\Users\doher\3D Objects

2022-09-18 07:41 - 2022-09-18 07:41 - 000000000 _SHDL C:\Documents and Settings

2022-09-18 07:40 - 2022-09-18 07:40 - 000000000 ____D C:\WINDOWS\CSC

2022-09-18 07:31 - 2022-10-04 13:49 - 000002440 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk

2022-09-18 07:26 - 2022-10-05 14:52 - 000008192 ___SH C:\DumpStack.log.tmp

2022-09-16 17:10 - 2016-03-31 02:24 - 000772104 _____ (Synaptics Incorporated) C:\WINDOWS\system32\SynCOM.dll

2022-09-16 17:10 - 2016-03-31 02:24 - 000622784 _____ (Synaptics Incorporated) C:\WINDOWS\system32\Drivers\SynTP.sys

2022-09-16 17:10 - 2016-03-31 02:24 - 000430256 _____ (Synaptics Incorporated) C:\WINDOWS\SysWOW64\SynCom.dll

2022-09-16 17:10 - 2016-03-31 02:24 - 000274968 _____ (Synaptics Incorporated) C:\WINDOWS\system32\SynTPAPI.dll

2022-09-16 17:10 - 2016-03-31 02:24 - 000267440 _____ (Synaptics Incorporated) C:\WINDOWS\system32\SynTPCo31-1.dll

2022-09-16 17:10 - 2016-03-31 02:24 - 000052904 _____ (Synaptics Incorporated) C:\WINDOWS\system32\Drivers\Smb_driver_Intel_Aux.sys

2022-09-16 17:10 - 2016-03-31 02:24 - 000052400 _____ (Synaptics Incorporated) C:\WINDOWS\system32\Drivers\Smb_driver_AMDASF_Aux.sys

==================== One month (modified) ==================

(If an entry is included in the fixlist, the file/folder will be moved.)

2022-10-05 15:09 - 2019-12-07 05:14 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft

2022-10-05 15:03 - 2019-12-07 05:03 - 000000000 ____D C:\WINDOWS\CbsTemp

2022-10-05 14:57 - 2019-12-07 05:13 - 000000000 ____D C:\WINDOWS\INF

2022-10-05 14:52 - 2019-12-07 05:03 - 000065536 _____ C:\WINDOWS\system32\config\BBI

2022-10-05 04:38 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\appcompat

2022-10-05 04:32 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\AppReadiness

2022-10-05 04:26 - 2019-12-07 05:14 - 000000000 ___HD C:\Program Files\WindowsApps

2022-10-05 00:36 - 2019-12-07 05:14 - 000000000 ___RD C:\WINDOWS\PrintDialog

2022-10-05 00:36 - 2019-12-07 05:14 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel

2022-10-04 18:44 - 2019-12-07 05:14 - 000000000 ____D C:\Program Files\Windows Defender

2022-10-04 18:43 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\system32\SecureBootUpdates

2022-10-04 17:35 - 2019-12-07 05:14 - 000028672 _____ C:\WINDOWS\system32\config\BCD-Template

2022-10-04 17:35 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\system32\WinBioDatabase

2022-10-04 17:28 - 2019-12-07 05:54 - 000000000 ___SD C:\WINDOWS\system32\AppV

2022-10-04 17:28 - 2019-12-07 05:54 - 000000000 ____D C:\Program Files\Windows Photo Viewer

2022-10-04 17:28 - 2019-12-07 05:54 - 000000000 ____D C:\Program Files\Windows Defender Advanced Threat Protection

2022-10-04 17:28 - 2019-12-07 05:54 - 000000000 ____D C:\Program Files (x86)\Windows Photo Viewer

2022-10-04 17:28 - 2019-12-07 05:51 - 000000000 ____D C:\WINDOWS\system32\OpenSSH

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ___SD C:\WINDOWS\SysWOW64\F12

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ___SD C:\WINDOWS\SysWOW64\DiagSvcs

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ___SD C:\WINDOWS\system32\UNP

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ___SD C:\WINDOWS\system32\F12

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ___SD C:\WINDOWS\system32\DiagSvcs

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\SysWOW64\WinMetadata

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\SysWOW64\setup

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\SysWOW64\PerceptionSimulation

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\SysWOW64\oobe

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\SysWOW64\migwiz

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\SysWOW64\lv-LV

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\SysWOW64\lt-LT

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\SysWOW64\Keywords

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\SysWOW64\et-EE

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\SysWOW64\es-MX

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\SysWOW64\Com

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\SysWOW64\AdvancedInstallers

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\SystemResources

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\system32\WinMetadata

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\system32\WinBioPlugIns

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\system32\SystemResetPlatform

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\system32\Sysprep

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\system32\ShellExperiences

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\system32\setup

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\system32\PerceptionSimulation

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\system32\migwiz

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\system32\lv-LV

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\system32\lt-LT

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\system32\Keywords

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\system32\et-EE

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\system32\es-MX

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\system32\Dism

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\system32\DDFs

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\system32\Com

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\system32\appraiser

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\system32\AdvancedInstallers

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\ShellExperiences

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\ShellComponents

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\Provisioning

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\PolicyDefinitions

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\IME

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\DiagTrack

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\bcastdvr

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\Program Files\Common Files\System

2022-10-04 17:28 - 2019-12-07 05:14 - 000000000 ____D C:\Program Files (x86)\Windows Defender

2022-10-04 17:28 - 2019-12-07 05:03 - 000000000 ____D C:\WINDOWS\servicing

2022-10-04 17:26 - 2019-12-07 05:54 - 000023552 _____ (Microsoft Corporation) C:\WINDOWS\system32\OEMDefaultAssociations.dll

2022-10-04 17:26 - 2019-12-07 05:54 - 000020908 _____ C:\WINDOWS\system32\OEMDefaultAssociations.xml

2022-10-04 17:26 - 2019-12-07 05:15 - 000208384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msclmd.dll

2022-10-04 17:26 - 2019-12-07 05:14 - 000232448 _____ (Microsoft Corporation) C:\WINDOWS\system32\msclmd.dll

2022-10-04 17:03 - 2019-12-07 05:52 - 000000000 ____D C:\WINDOWS\OCR

2022-10-04 13:56 - 2019-12-07 05:14 - 000000000 ____D C:\ProgramData\USOPrivate

2022-10-04 13:55 - 2019-12-07 05:51 - 000000000 ____D C:\WINDOWS\system32\FxsTmp

2022-10-04 13:55 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\system32\spool

2022-10-04 13:55 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\system32\oobe

2022-10-04 13:48 - 2019-12-07 05:03 - 000032768 _____ C:\WINDOWS\system32\config\ELAM

2022-10-04 13:39 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\ServiceState

2022-09-12 21:56 - 2021-04-25 23:13 - 000000000 __RHD C:\MSOCache

==================== SigCheck ============================

(There is no automatic fix for files that do not pass verification.)

==================== End of FRST.txt ========================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-10-2022

Ran by doher (05-10-2022 18:40:33)

Running from C:\Users\doher\OneDrive\Desktop

Microsoft Windows 10 Pro Version 21H2 19044.2075 (X64) (2022-10-04 17:55:27)

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

(If an entry is included in the fixlist, it will be removed.)

Administrator (S-1-5-21-1890784580-1000596592-3856219040-500 - Administrator - Disabled)

DefaultAccount (S-1-5-21-1890784580-1000596592-3856219040-503 - Limited - Disabled)

doher (S-1-5-21-1890784580-1000596592-3856219040-1001 - Administrator - Enabled) => C:\Users\doher

Guest (S-1-5-21-1890784580-1000596592-3856219040-501 - Limited - Disabled)

WDAGUtilityAccount (S-1-5-21-1890784580-1000596592-3856219040-504 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 106.0.5249.91 - Google LLC)

Microsoft Edge (HKLM-x32\...\Microsoft Edge) (Version: 106.0.1370.34 - Microsoft Corporation)

Microsoft OneDrive (HKU\S-1-5-21-1890784580-1000596592-3856219040-1001\...\OneDriveSetup.exe) (Version: 22.191.0911.0001 - Microsoft Corporation)

Microsoft Update Health Tools (HKLM\...\{7B1FCD52-8F6B-4F12-A143-361EA39F5E7C}) (Version: 3.67.0.0 - Microsoft Corporation)

Opera Stable 91.0.4516.20 (HKU\S-1-5-21-1890784580-1000596592-3856219040-1001\...\Opera 91.0.4516.20) (Version: 91.0.4516.20 - Opera Software)

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 19.0.12.98 - Synaptics Incorporated)

Windows PC Health Check (HKLM\...\{6798C408-2636-448C-8AC6-F4E341102D27}) (Version: 3.6.2204.08001 - Microsoft Corporation)

Packages:

=========

Microsoft Solitaire Collection -> C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.14.9130.0_x64__8wekyb3d8bbwe [2022-10-05] (Microsoft Studios) [MS Ad]

Speedtest by Ookla -> C:\Program Files\WindowsApps\Ookla.SpeedtestbyOokla_1.15.163.0_x64__43tkc6nmykmb6 [2022-10-05] (Ookla)

==================== Custom CLSID (Whitelisted): ==============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== Codecs (Whitelisted) ====================

==================== Shortcuts & WMI ========================

==================== Loaded Modules (Whitelisted) =============

==================== Alternate Data Streams (Whitelisted) ========

==================== Safe Mode (Whitelisted) ==================

==================== Association (Whitelisted) =================

==================== Internet Explorer (Whitelisted) ==========

==================== Hosts content: =========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2019-12-07 05:14 - 2019-12-07 05:12 - 000000824 _____ C:\WINDOWS\system32\drivers\etc\hosts

==================== Other Areas ===========================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1890784580-1000596592-3856219040-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\doher\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper

DNS Servers: 192.168.2.1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: )

Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(If an entry is included in the fixlist, it will be removed.)

HKU\S-1-5-21-1890784580-1000596592-3856219040-1001\...\StartupApproved\Run: => "OneDrive"

HKU\S-1-5-21-1890784580-1000596592-3856219040-1001\...\StartupApproved\Run: => "Opera Browser Assistant"

==================== FirewallRules (Whitelisted) ================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{E9CB6A2D-F399-44C7-886B-8194EAA5FDC1}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.88.3401.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)

FirewallRules: [{D234F914-1F7A-437E-A5D1-DE6C92E8278B}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.88.3401.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)

FirewallRules: [{1ED7D18D-C951-42F4-B1F3-FE8D986EBAA1}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.88.3401.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)

FirewallRules: [{2572A349-E0A7-45D4-B7E2-B870501CF275}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.88.3401.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)

FirewallRules: [{C7CF151E-4CE4-4F16-AA68-E3545A18CD5F}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe (Google LLC -> Google LLC)

==================== Restore Points =========================

04-10-2022 18:43:14 Windows Modules Installer

04-10-2022 21:52:44 RESET PC RESTORE POINT

==================== Faulty Device Manager Devices ============

==================== Event log errors: ========================

Application errors:

==================

Error: (10/05/2022 12:32:15 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: SystemSettings.exe, version: 10.0.19041.2075, time stamp: 0x4aa1ce82

Faulting module name: SystemSettings.DataModel.dll, version: 10.0.19041.746, time stamp: 0xcea263fa

Exception code: 0xc00000fd

Fault offset: 0x00000000000079df

Faulting process id: 0xdf0

Faulting application start time: 0x01d8d8737130c6b1

Faulting application path: C:\Windows\ImmersiveControlPanel\SystemSettings.exe

Faulting module path: C:\Windows\System32\SystemSettings.DataModel.dll

Report Id: abbf1953-3e39-49a8-8350-09e24fbdc1c6

Faulting package full name: windows.immersivecontrolpanel_10.0.2.1000_neutral_neutral_cw5n1h2txyewy

Faulting package-relative application ID: microsoft.windows.immersivecontrolpanel

Error: (10/05/2022 12:31:54 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: SystemSettings.exe, version: 10.0.19041.2075, time stamp: 0x4aa1ce82

Faulting module name: ucrtbase.dll, version: 10.0.19041.789, time stamp: 0x2bd748bf

Exception code: 0xc000041d

Fault offset: 0x000000000000ddda

Faulting process id: 0xa10

Faulting application start time: 0x01d8d87354fb1109

Faulting application path: C:\Windows\ImmersiveControlPanel\SystemSettings.exe

Faulting module path: C:\WINDOWS\System32\ucrtbase.dll

Report Id: 94a4598c-5207-4f6f-8b7d-a454ca34773f

Faulting package full name: windows.immersivecontrolpanel_10.0.2.1000_neutral_neutral_cw5n1h2txyewy

Faulting package-relative application ID: microsoft.windows.immersivecontrolpanel

Error: (10/05/2022 12:28:37 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: SystemSettings.exe, version: 10.0.19041.2075, time stamp: 0x4aa1ce82

Faulting module name: ucrtbase.dll, version: 10.0.19041.789, time stamp: 0x2bd748bf

Exception code: 0xc000041d

Fault offset: 0x000000000000e109

Faulting process id: 0x7ac

Faulting application start time: 0x01d8d872e95e290d

Faulting application path: C:\Windows\ImmersiveControlPanel\SystemSettings.exe

Faulting module path: C:\WINDOWS\System32\ucrtbase.dll

Report Id: 257ea25f-e797-4775-b33b-cbcb40ecc4d7

Faulting package full name: windows.immersivecontrolpanel_10.0.2.1000_neutral_neutral_cw5n1h2txyewy

Faulting package-relative application ID: microsoft.windows.immersivecontrolpanel

Error: (10/05/2022 12:25:26 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: SystemSettings.exe, version: 10.0.19041.2075, time stamp: 0x4aa1ce82

Faulting module name: ucrtbase.dll, version: 10.0.19041.789, time stamp: 0x2bd748bf

Exception code: 0xc00000fd

Fault offset: 0x000000000000ddda

Faulting process id: 0x132c

Faulting application start time: 0x01d8d8727d2d8b05

Faulting application path: C:\Windows\ImmersiveControlPanel\SystemSettings.exe

Faulting module path: C:\WINDOWS\System32\ucrtbase.dll

Report Id: 0d364c7b-1ae7-4df9-9fc8-c7f4b28c863f

Faulting package full name: windows.immersivecontrolpanel_10.0.2.1000_neutral_neutral_cw5n1h2txyewy

Faulting package-relative application ID: microsoft.windows.immersivecontrolpanel

Error: (10/05/2022 12:21:38 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: SystemSettings.exe, version: 10.0.19041.2075, time stamp: 0x4aa1ce82

Faulting module name: ucrtbase.dll, version: 10.0.19041.789, time stamp: 0x2bd748bf

Exception code: 0xc000041d

Fault offset: 0x0000000000015c3d

Faulting process id: 0x1f54

Faulting application start time: 0x01d8d871ef50b72d

Faulting application path: C:\Windows\ImmersiveControlPanel\SystemSettings.exe

Faulting module path: C:\WINDOWS\System32\ucrtbase.dll

Report Id: ed15d6cc-0dfd-49fc-9657-16ff61faf793

Faulting package full name: windows.immersivecontrolpanel_10.0.2.1000_neutral_neutral_cw5n1h2txyewy

Faulting package-relative application ID: microsoft.windows.immersivecontrolpanel

Error: (10/05/2022 12:20:41 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: SystemSettings.exe, version: 10.0.19041.2075, time stamp: 0x4aa1ce82

Faulting module name: ucrtbase.dll, version: 10.0.19041.789, time stamp: 0x2bd748bf

Exception code: 0xc000041d

Fault offset: 0x000000000000e109

Faulting process id: 0x1188

Faulting application start time: 0x01d8d8716914899f

Faulting application path: C:\Windows\ImmersiveControlPanel\SystemSettings.exe

Faulting module path: C:\WINDOWS\System32\ucrtbase.dll

Report Id: 4c6c954b-d361-4def-8810-0314a3efebc9

Faulting package full name: windows.immersivecontrolpanel_10.0.2.1000_neutral_neutral_cw5n1h2txyewy

Faulting package-relative application ID: microsoft.windows.immersivecontrolpanel

Error: (10/05/2022 12:17:15 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: SystemSettings.exe, version: 10.0.19041.2075, time stamp: 0x4aa1ce82

Faulting module name: SystemSettings.DataModel.dll, version: 10.0.19041.746, time stamp: 0xcea263fa

Exception code: 0xc000041d

Fault offset: 0x000000000000dec8

Faulting process id: 0x2a0

Faulting application start time: 0x01d8d853d55c8c3d

Faulting application path: C:\Windows\ImmersiveControlPanel\SystemSettings.exe

Faulting module path: C:\Windows\System32\SystemSettings.DataModel.dll

Report Id: f2903c2d-6928-48e4-9737-edbdfcac88d7

Faulting package full name: windows.immersivecontrolpanel_10.0.2.1000_neutral_neutral_cw5n1h2txyewy

Faulting package-relative application ID: microsoft.windows.immersivecontrolpanel

Error: (10/04/2022 09:32:10 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: The program SearchApp.exe version 10.0.19041.2075 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

Process ID: c84

Start Time: 01d8d85a3dfdfa79

Termination Time: 4294967295

Application Path: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

Report Id: 1092ad83-34bb-4aa6-a30b-91dce0479bcf

Faulting package full name: Microsoft.Windows.Search_1.14.7.19041_neutral_neutral_cw5n1h2txyewy

Faulting package-relative application ID: ShellFeedsUI

Hang type: Quiesce

System errors:

=============

Error: (10/05/2022 02:52:09 PM) (Source: DCOM) (EventID: 10010) (User: HAL900)

Description: The server {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} did not register with DCOM within the required timeout.

Error: (10/05/2022 02:52:09 PM) (Source: DCOM) (EventID: 10010) (User: HAL900)

Description: The server {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} did not register with DCOM within the required timeout.

Error: (10/05/2022 02:52:09 PM) (Source: DCOM) (EventID: 10010) (User: HAL900)

Description: The server {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} did not register with DCOM within the required timeout.

Error: (10/05/2022 02:52:08 PM) (Source: DCOM) (EventID: 10010) (User: HAL900)

Description: The server {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} did not register with DCOM within the required timeout.

Error: (10/05/2022 01:09:55 PM) (Source: DCOM) (EventID: 10010) (User: HAL900)

Description: The server {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} did not register with DCOM within the required timeout.

Error: (10/05/2022 01:09:55 PM) (Source: DCOM) (EventID: 10010) (User: HAL900)

Description: The server {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} did not register with DCOM within the required timeout.

Error: (10/04/2022 07:49:40 PM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )

Description: 4

Error: (10/04/2022 02:15:10 PM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )

Description: 4

==================== Memory info ===========================

BIOS: Hewlett-Packard F.15 05/17/2010

Motherboard: Hewlett-Packard 363F

Processor: AMD Athlon™ II Dual-Core M300

Percentage of memory in use: 49%

Total physical RAM: 7932.2 MB

Available physical RAM: 4027.02 MB

Total Virtual: 9852.2 MB

Available Virtual: 6024.08 MB

==================== Drives ================================

Drive c: (C ) (Fixed) (Total:323.26 GB) (Free:275.14 GB) (Model: WD Blue SA510 2.5 500GB) NTFS ==>[system with boot components (obtained from drive)]

Drive e: () (Removable) (Total:59.45 GB) (Free:54.98 GB) exFAT

Drive f: (RECOVERY) (Fixed) (Total:21.1 GB) (Free:9.61 GB) (Model: WD Blue SA510 2.5 500GB) NTFS ==>[system with boot components (obtained from drive)]

Drive g: (HP_TOOLS) (Fixed) (Total:0.1 GB) (Free:0.06 GB) (Model: WD Blue SA510 2.5 500GB) FAT32

Drive h: (ESD-USB (D:)) (Removable) (Total:28.65 GB) (Free:17.08 GB) NTFS

\\?\Volume{7dda13fc-0000-0000-0000-100000000000}\ (SYSTEM) (Fixed) (Total:0.19 GB) (Free:0.16 GB) NTFS

==================== MBR & Partition Table ====================

==========================================================

Disk: 0 (MBR Code: Windows 7/8/10) (Size: 465.8 GB) (Disk ID: 7DDA13FC)

Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=323.3 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=21.1 GB) - (Type=07 NTFS)

Partition 4: (Not Active) - (Size=108 MB) - (Type=0C)

==========================================================

Disk: 1 (Size: 59.5 GB) (Disk ID: 9403A996)

Partition 1: (Not Active) - (Size=59.5 GB) - (Type=07 NTFS)

==========================================================

Disk: 2 (MBR Code: Windows 7/8/10) (Size: 28.7 GB) (Disk ID: 9A17DA42)

Partition 1: (Not Active) - (Size=28.7 GB) - (Type=07 NTFS)

==================== End of Addition.txt =======================

Sorry but unable to work with this laptop as it is not responding

Please help me if you are able

Edited by ForrestGump, 06 October 2022 - 08:54 PM.

#2
RKinner

Posted 12 October 2022 - 06:48 AM

Malware Expert

Expert
24,624 posts

Not sure what you meant with your last statement. Can you still run FRST? If so try this:

Download the attached fixlist.txt to the same location as FRST

fixlist.txt 4.13KB 280 downloads

Run FRST and press Fix. This will check your system files and hopefully repair any that are broken. Usually takes about 25 minutes to complete but may time out after one hour if the PC is super slow. Will reboot when done.

A fix log will be generated please post that

Reboot if the fix doesn't reboot it for you

Run FRST again but this time make sure Addition.txt is checked and hit Scan. Post both logs.

#3
ForrestGump

Posted 13 October 2022 - 02:40 AM

Member

Topic Starter
Member
91 posts

.

Edited by ForrestGump, 13 October 2022 - 02:42 AM.

#4
ForrestGump

Posted 13 October 2022 - 02:45 AM

Member

Topic Starter
Member
91 posts

Not sure what you meant with your last statement. Can you still run FRST? If so try this:

Download the attached fixlist.txt to the same location as FRST

fixlist.txt

Run FRST and press Fix. This will check your system files and hopefully repair any that are broken. Usually takes about 25 minutes to complete but may time out after one hour if the PC is super slow. Will reboot when done.

A fix log will be generated please post that

Reboot if the fix doesn't reboot it for you

Run FRST again but this time make sure Addition.txt is checked and hit Scan. Post both logs.

.

Not sure what you meant with your last statement. Can you still run FRST? If so try this:

Download the attached fixlist.txt to the same location as FRST

fixlist.txt

Run FRST and press Fix. This will check your system files and hopefully repair any that are broken. Usually takes about 25 minutes to complete but may time out after one hour if the PC is super slow. Will reboot when done.

A fix log will be generated please post that

Reboot if the fix doesn't reboot it for you

Run FRST again but this time make sure Addition.txt is checked and hit Scan. Post both logs.

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 04-10-2022

Ran by doher (administrator) on HAL900 (Hewlett-Packard HP G61 Notebook PC) (13-10-2022 02:56:28)

Running from C:\Users\doher\OneDrive\Desktop

Loaded Profiles: doher

Platform: Microsoft Windows 10 Pro Version 21H2 19044.2130 (X64) Language: English (United States) -> English (United Kingdom)

Default browser: Edge

Boot Mode: Normal

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(atiesrxx.exe ->) (Microsoft Windows Hardware Compatibility Publisher -> AMD) C:\Windows\System32\atieclxx.exe

(C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe ->) (Synaptics Incorporated -> Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

(services.exe ->) (Microsoft Windows -> ) C:\Windows\System32\OpenSSH\ssh-agent.exe

(services.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Program Files\Microsoft Update Health Tools\uhssvc.exe

(services.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

(services.exe ->) (Microsoft Windows Hardware Compatibility Publisher -> AMD) C:\Windows\System32\atiesrxx.exe

(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2207.7-0\MsMpEng.exe

(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2207.7-0\NisSrv.exe

(services.exe ->) (Synaptics Incorporated -> Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe

(services.exe ->) (Wondershare Technology Group Co.,Ltd -> Wondershare) C:\ProgramData\Wondershare\Service\InstallAssistService.exe