Hi
My son's computer all of a sudden became much slower, his Geforce Nvidia Experience stopped functioning and it appeared that his GPU crashed while trying to stream Star Wars Battlefront 2 on Twitch. From there I noticed his download speeds were terrible, even though he is not on wifi and downloading with cable attached to the router. I tested with my laptop and there was nothing wrong with the download speeds. Yesterday he received another error (I can't remember what is was but was something to do with stacks) and pointed that there may be a virus. I scanned using ESET and it found nothing. Are you able to scan my logs for me please to let me know if you think there may be a virus or malware (or something else wrong with his PC).
Thank you
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-09-2021
Ran by user (03-09-2021 08:33:41)
Running from C:\Users\user\Desktop
Windows 10 Pro Version 21H1 19043.1165 (X64) (2020-09-16 16:05:10)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
(If an entry is included in the fixlist, it will be removed.)
Administrator (S-1-5-21-772020480-3986485932-2889396054-500 - Administrator - Enabled) => C:\Users\Administrator
DefaultAccount (S-1-5-21-772020480-3986485932-2889396054-503 - Limited - Disabled)
defaultuser0 (S-1-5-21-772020480-3986485932-2889396054-1000 - Limited - Disabled) => C:\Users\defaultuser0
Guest (S-1-5-21-772020480-3986485932-2889396054-501 - Limited - Disabled)
user (S-1-5-21-772020480-3986485932-2889396054-1001 - Administrator - Enabled) => C:\Users\user
WDAGUtilityAccount (S-1-5-21-772020480-3986485932-2889396054-504 - Limited - Disabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: ESET Security (Enabled - Up to date) {89B55CC4-3881-78B2-11E2-479AE0371896}
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: ESET Security (Enabled - Up to date) {885D845F-AF19-0124-FECE-FFF49D00F440}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: ESET Firewall (Enabled) {B066057A-E576-007C-D591-56C163D3B33B}
FW: ESET Firewall (Enabled) {B18EDDE1-72EE-79EA-3ABD-EEAF1EE45FED}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Reader XI (11.0.04) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.04 - Adobe Systems Incorporated)
BlueStacks App Player (HKLM\...\BlueStacks) (Version: 4.220.0.1109 - BlueStack Systems, Inc.)
Command & Conquer™ Red Alert 2 and Yuri’s Revenge (HKLM-x32\...\{F5275D1C-D133-486D-8F07-D6C571F0A8EC}) (Version: 1.0.0.0 - Electronic Arts, Inc.)
ESET Security (HKLM\...\{0C3F76CB-98AA-49B1-9B72-CD040E3E17E8}) (Version: 14.2.24.0 - ESET, spol. s r.o.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 93.0.4577.63 - Google LLC)
Intel Driver && Support Assistant (HKLM-x32\...\{C38DE4F8-DF58-4B5D-9D4C-1F68773A2AE2}) (Version: 21.3.21.5 - Intel) Hidden
Intel® Computing Improvement Program (HKLM\...\{A9133872-C9FE-45CC-8F01-D1947B0F09EA}) (Version: 2.4.04755 - Intel Corporation)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 26.20.100.7212 - Intel Corporation)
Intel® Driver & Support Assistant (HKLM-x32\...\{9360c8cc-b617-469a-bb35-829c13e21d97}) (Version: 21.3.21.5 - Intel)
Java 8 Update 301 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180301F0}) (Version: 8.0.3010.9 - Oracle Corporation)
Java 8 Update 301 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180301F0}) (Version: 8.0.3010.9 - Oracle Corporation)
Jurassic World Evolution (HKLM-x32\...\Jurassic World Evolution_is1) (Version: - )
K-Lite Codec Pack 9.7.5 (Full) (HKLM-x32\...\KLiteCodecPack_is1) (Version: 9.7.5 - )
LEGO Jurassic World (HKLM-x32\...\TEVHT0p1cmFzc2ljV29ybGQ=_is1) (Version: 1 - )
Microsoft 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 16.0.14228.20250 - Microsoft Corporation)
Microsoft Edge (HKLM-x32\...\Microsoft Edge) (Version: 92.0.902.84 - Microsoft Corporation)
Microsoft Edge WebView2 Runtime (HKLM-x32\...\Microsoft EdgeWebView) (Version: 92.0.902.84 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-772020480-3986485932-2889396054-1001\...\OneDriveSetup.exe) (Version: 21.150.0725.0001 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-772020480-3986485932-2889396054-500\...\OneDriveSetup.exe) (Version: 21.150.0725.0001 - Microsoft Corporation)
Microsoft Update Health Tools (HKLM\...\{852D8FE5-BC66-4061-B1C4-CADF51E5B27D}) (Version: 2.82.0.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{CA8A885F-E95B-3FC6-BB91-F4D9377C7686}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015-2019 Redistributable (x64) - 14.28.29334 (HKLM-x32\...\{a9cfe9c7-e54f-46cd-9c5c-542ff8e3e8c4}) (Version: 14.28.29334.0 - Microsoft Corporation)
Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.28.29334 (HKLM-x32\...\{b2d0f752-adc5-496e-8f70-8669de01f746}) (Version: 14.28.29334.0 - Microsoft Corporation)
Minecraft Launcher (HKLM-x32\...\{733C3ACB-432D-4880-B0E1-660000D7974D}) (Version: 1.0.0.0 - Mojang)
NVIDIA FrameView SDK 1.1.4923.29968894 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_FrameViewSdk) (Version: 1.1.4923.29968894 - NVIDIA Corporation)
NVIDIA GeForce Experience 3.23.0.74 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 3.23.0.74 - NVIDIA Corporation)
NVIDIA Graphics Driver 471.96 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 471.96 - NVIDIA Corporation)
NVIDIA HD Audio Driver 1.3.38.60 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.38.60 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.19.0218 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.19.0218 - NVIDIA Corporation)
Office 16 Click-to-Run Extensibility Component (HKLM\...\{90160000-008C-0000-1000-0000000FF1CE}) (Version: 16.0.14228.20250 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (HKLM\...\{90160000-007E-0000-1000-0000000FF1CE}) (Version: 16.0.14228.20250 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (HKLM\...\{90160000-008C-0409-1000-0000000FF1CE}) (Version: 16.0.14026.20246 - Microsoft Corporation) Hidden
OpenOffice 4.1.7 (HKLM-x32\...\{A09D951F-4BA3-4383-97B3-D1B91835E779}) (Version: 4.17.9800 - Apache Software Foundation)
Origin (HKLM-x32\...\Origin) (Version: 10.5.102.48654 - Electronic Arts, Inc.)
Paradox Launcher v2 (HKLM\...\{A92DB5D9-A24D-4678-9F91-B4FA6D895718}) (Version: 2.0.4.0 - Paradox Interactive)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7841 - Realtek Semiconductor Corp.)
Realtek USB Wireless LAN Driver (HKLM-x32\...\InstallShield_{DBCC4C27-F949-482b-B786-7B3B67587CD2}) (Version: Drv_3.00.0032 - REALTEK Semiconductor Corp.)
Rise of Nations Extended Edition (HKLM-x32\...\Rise of Nations Extended Edition_R.G. Mechanics_is1) (Version: - R.G. Mechanics, Panky)
School of Dragons (HKLM-x32\...\School of Dragons 3.11.0.CL237231_RELEASE) (Version: 3.11.0.CL237231_RELEASE - JumpStart Games)
STAR WARS™ Battlefront™ II (HKLM-x32\...\{8a882ce0-0c0b-4eb2-850c-28ebadab4f50}) (Version: 1.1.8.16162 - Electronic Arts)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Tenda Wireless Utility (HKLM-x32\...\{198CC6BB-29D8-43DB-AF60-CEEF9DDF9F18}) (Version: 1.0.0.8 - Tenda)
The Sims 4 Seasons (HKLM\...\The Sims 4 Seasons_is1) (Version: 1.46.18.1020 - )
Twitch Studio (HKU\S-1-5-21-772020480-3986485932-2889396054-1001\...\{DEE70742-F4E9-44CA-B2B9-EE95DCF372B0}) (Version: 8.0.0 - Twitch Interactive, Inc.)
Update for Windows 10 for x64-based Systems (KB4023057) (HKLM\...\{32DC821E-4A7D-4878-BEE8-337FA153D7F2}) (Version: 2.63.0.0 - Microsoft Corporation) Hidden
Update for Windows 10 for x64-based Systems (KB4480730) (HKLM\...\{3BAE4496-6F6C-4330-A8AA-B93D3D346FA5}) (Version: 2.53.0.0 - Microsoft Corporation)
UpdateAssistant (HKLM\...\{F49D6A65-1AB6-4728-9FDA-DB5BAB631CF6}) (Version: 1.23.0.0 - Microsoft Corporation) Hidden
VLC media player (HKLM-x32\...\VLC media player) (Version: 3.0.4 - VideoLAN)
WestwoodOnline (HKLM-x32\...\{BBCD6D56-8A26-4DDE-9482-DBC9C7B7341D}) (Version: 1.0.0.0 - WestwoodOnline)
WinRAR 6.02 (64-bit) (HKLM\...\WinRAR archiver) (Version: 6.02.0 - win.rar GmbH)
Packages:
=========
24c696e8-faaf-4e4a-a2de-c99354943b6e -> C:\Program Files\WindowsApps\FishingPlanetLLC.FishingPlanet_1.6.8.0_x64__y2zv6n0w7wm9j [2021-08-20] (Fishing Planet LLC)
Amazing Run -> C:\Program Files\WindowsApps\28627PremiumFreeEpisodeGa.StarWarRun_10.9.0.0_x64__haf3134me8dd2 [2020-04-21] (Premium Free Episode Games PC Ltd.) [MS Ad]
ASTRONEER -> C:\Program Files\WindowsApps\SystemEraSoftworks.29415440E1269_1.20.274.0_x64__ftk5pbg2rayv2 [2021-08-20] (System Era Softworks)
Autodesk SketchBook -> C:\Program Files\WindowsApps\89006A2E.AutodeskSketchBook_5.1.0.0_x64__tf1gferkr813w [2019-11-08] (Autodesk Inc.)
Bubble Witch 3 Saga -> C:\Program Files\WindowsApps\king.com.BubbleWitch3Saga_7.7.46.0_x86__kgqvnymyfvs32 [2021-08-19] (king.com)
Candy Crush Soda Saga -> C:\Program Files\WindowsApps\king.com.CandyCrushSodaSaga_1.200.300.0_x86__kgqvnymyfvs32 [2021-08-20] (king.com)
Canon Inkjet Print Utility -> C:\Program Files\WindowsApps\34791E63.CanonInkjetPrintUtility_3.1.0.0_neutral__6e5tt8cgb93ep [2021-04-29] (Canon Inc.)
Despicable Me: Minion Rush -> C:\Program Files\WindowsApps\GAMELOFTSA.DespicableMeMinionRush_4.1.4.1_x86__0pp20fcewvvtj [2019-12-14] (GAMELOFT SA)
Dig Out! -> C:\Program Files\WindowsApps\XIMADINC.DigOut_1.8.3.0_x64__np8fj6akx2czy [2019-12-14] (ZiMAD) [MS Ad]
Dragon City -> C:\Program Files\WindowsApps\SocialPoint.DragonCityMobile_12.3.3.0_x86__jahftqv9k5jer [2021-08-20] (Socialpoint)
Great Hunt - North America -> C:\Program Files\WindowsApps\SimulatorsLiveLLC.GreatHunt-NorthAmerica_1.1.5.0_x64__4m7mw7nsxfatr [2020-10-20] (Simulators Live, LLC)
Ice Age Adventures -> C:\Program Files\WindowsApps\A278AB0D.IceAgeAdventures_1.8.2.13_x86__h6adky7gbf63m [2020-05-10] (Gameloft.)
Idle Farming -> C:\Program Files\WindowsApps\40091MagicWorldMinionsGam.IdleFarming_12.1.0.0_x64__gn4pwfy1ssrwp [2020-04-21] (Magic World Minions Games) [MS Ad]
Idle Miner Empire -> C:\Program Files\WindowsApps\15609SniperStrikeFPSShoot.IdleMinerEmpire_10.5.0.0_x64__9cjb9ckgksp78 [2020-04-21] (Sniper Strike FPS Shooting) [MS Ad]
Intel® Graphics Command Center -> C:\Program Files\WindowsApps\AppUp.IntelGraphicsExperience_1.100.3370.0_x64__8j3eq9eme6ctt [2021-09-02] (INTEL CORP) [Startup Task]
Jurassic Safari Hunt -> C:\Program Files\WindowsApps\SimulatorsLiveLLC.JurassicSafariHunt_1.1.4.0_x64__4m7mw7nsxfatr [2021-04-29] (Simulators Live, LLC)
March of Empires: War of Lords -> C:\Program Files\WindowsApps\A278AB0D.MarchofEmpires_5.8.7.0_x86__h6adky7gbf63m [2021-08-19] (Gameloft SE)
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x64__8wekyb3d8bbwe [2019-10-10] (Microsoft Corporation) [MS Ad]
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x86__8wekyb3d8bbwe [2019-10-10] (Microsoft Corporation) [MS Ad]
Microsoft Solitaire Collection -> C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.10.7290.0_x64__8wekyb3d8bbwe [2021-09-02] (Microsoft Studios) [MS Ad]
Minecraft for Windows 10 -> C:\Program Files\WindowsApps\Microsoft.MinecraftUWP_1.17.1101.0_x64__8wekyb3d8bbwe [2021-08-19] (Microsoft Studios)
NVIDIA Control Panel -> C:\Program Files\WindowsApps\NVIDIACorp.NVIDIAControlPanel_8.1.961.0_x64__56jybvy8sckqj [2021-09-02] (NVIDIA Corp.)
Photos Media Engine Add-on -> C:\Program Files\WindowsApps\Microsoft.Photos.MediaEngineDLC_1.0.0.0_x64__8wekyb3d8bbwe [2020-05-18] (Microsoft Corporation)
Spotify Music -> C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.166.578.0_x86__zpdnekdrzrea0 [2021-08-20] (Spotify AB) [Startup Task]
The Tribez & Castlez -> C:\Program Files\WindowsApps\0EB8BD08.TheTribezCastlez_2.5.46.0_x86__erk4rrwmt7jyt [2019-12-14] (GAME INSIGHT GLOBAL LIMITED)
Township -> C:\Program Files\WindowsApps\PLRWORLDWIDESALES.TOWNSHIP_2021.840.1.0_x64__1feq88045d2v2 [2021-08-19] (Playrix)
World of Tanks Blitz -> C:\Program Files\WindowsApps\7458BE2C.WorldofTanksBlitz_8.2.313.0_x64__x4tje2y229k00 [2021-08-20] (Wargaming Group Limited)
Worms Battle - Wormageddon -> C:\Program Files\WindowsApps\Games4TeensLLC.WormsBattle-Wormageddon_1.1.4.0_x64__geznks25p0ap0 [2020-07-17] (Games 4 Teen, LLC)
==================== Custom CLSID (Whitelisted): ==============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-772020480-3986485932-2889396054-1001_Classes\CLSID\{233525e0-5434-46ef-b464-fd7e45e2e145}\localserver32 -> C:\Program Files (x86)\Intel\Driver and Support Assistant\DSATray.exe (IDSA Production signing key 2021 -> Intel)
ContextMenuHandlers1: [ESET Security Shell] -> {B089FE88-FB52-11D3-BDF1-0050DA34150D} => C:\Program Files\ESET\ESET Security\shellExt.dll [2021-08-18] (ESET, spol. s r.o. -> ESET)
ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2021-06-11] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2021-06-11] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers2: [ESET Security Shell] -> {B089FE88-FB52-11D3-BDF1-0050DA34150D} => C:\Program Files\ESET\ESET Security\shellExt.dll [2021-08-18] (ESET, spol. s r.o. -> ESET)
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\WINDOWS\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_b8346c359fcd6093\nvshext.dll [2021-08-28] (Nvidia Corporation -> NVIDIA Corporation)
ContextMenuHandlers6: [ESET Security Shell] -> {B089FE88-FB52-11D3-BDF1-0050DA34150D} => C:\Program Files\ESET\ESET Security\shellExt.dll [2021-08-18] (ESET, spol. s r.o. -> ESET)
ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2021-06-11] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2021-06-11] (win.rar GmbH -> Alexander Roshal)
==================== Codecs (Whitelisted) ====================
==================== Shortcuts & WMI ========================
==================== Loaded Modules (Whitelisted) =============
==================== Alternate Data Streams (Whitelisted) ========
==================== Safe Mode (Whitelisted) ==================
==================== Association (Whitelisted) =================
==================== Internet Explorer (Whitelisted) ==========
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_301\bin\ssv.dll [2021-09-02] (Oracle America, Inc. -> Oracle Corporation)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_301\bin\jp2ssv.dll [2021-09-02] (Oracle America, Inc. -> Oracle Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll [2021-06-09] (Microsoft Corporation -> Microsoft Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_301\bin\ssv.dll [2021-09-02] (Oracle America, Inc. -> Oracle Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_301\bin\jp2ssv.dll [2021-09-02] (Oracle America, Inc. -> Oracle Corporation)
Handler: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2021-08-20] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2021-08-20] (Microsoft Corporation -> Microsoft Corporation)
Handler: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2021-08-20] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2021-08-20] (Microsoft Corporation -> Microsoft Corporation)
Handler: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2021-08-20] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2021-08-20] (Microsoft Corporation -> Microsoft Corporation)
Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2021-08-20] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2021-08-20] (Microsoft Corporation -> Microsoft Corporation)
==================== Hosts content: =========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2016-07-16 13:47 - 2016-07-16 13:45 - 000000824 _____ C:\WINDOWS\system32\drivers\etc\hosts
2020-08-20 18:22 - 2020-08-20 18:22 - 000000439 _____ C:\WINDOWS\system32\drivers\etc\hosts.ics
==================== Other Areas ===========================
(Currently there is no automatic fix for this section.)
HKLM\System\CurrentControlSet\Control\Session Manager\Environment\\Path -> C:\ProgramData\Oracle\Java\javapath;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\WINDOWS\System32\OpenSSH\;C:\Program Files\NVIDIA Corporation\NVIDIA NvDLISR
HKU\S-1-5-21-772020480-3986485932-2889396054-1000\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Windows\img0.jpg
HKU\S-1-5-21-772020480-3986485932-2889396054-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
HKU\S-1-5-21-772020480-3986485932-2889396054-500\Control Panel\Desktop\\Wallpaper -> C:\WINDOWS\web\wallpaper\Windows\img0.jpg
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
(If an entry is included in the fixlist, it will be removed.)
MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: DSAService => 2
MSCONFIG\Services: DSAUpdateService => 3
MSCONFIG\Services: ESRV_SVC_QUEENCREEK => 3
MSCONFIG\Services: FvSvc => 3
MSCONFIG\Services: GoogleChromeElevationService => 3
MSCONFIG\Services: gupdate => 2
MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: igfxCUIService2.0.0.0 => 2
MSCONFIG\Services: Intel® SUR QC SAM => 3
MSCONFIG\Services: NvContainerLocalSystem => 2
MSCONFIG\Services: NVDisplay.ContainerLocalSystem => 2
MSCONFIG\Services: Origin Client Service => 3
MSCONFIG\Services: Origin Web Helper Service => 2
MSCONFIG\Services: Steam Client Service => 3
MSCONFIG\Services: SystemUsageReportSvc_QUEENCREEK => 2
MSCONFIG\Services: USER_ESRV_SVC_QUEENCREEK => 3
HKLM\...\StartupApproved\Run: => "SecurityHealth"
HKLM\...\StartupApproved\Run: => "RTHDVCPL"
HKLM\...\StartupApproved\Run32: => "Adobe ARM"
HKLM\...\StartupApproved\Run32: => "Intel Driver & Support Assistant"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKU\S-1-5-21-772020480-3986485932-2889396054-1001\...\StartupApproved\Run: => "OneDrive"
HKU\S-1-5-21-772020480-3986485932-2889396054-1001\...\StartupApproved\Run: => "Steam"
HKU\S-1-5-21-772020480-3986485932-2889396054-1001\...\StartupApproved\Run: => "EADM"
==================== FirewallRules (Whitelisted) ================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{D8C862AB-97D3-430D-BE09-716466594C8D}] => (Allow) C:\Program Files\BlueStacks\HD-Player.exe (BlueStack Systems, Inc. -> BlueStack Systems, Inc.)
FirewallRules: [{EE4DE0C2-7E77-4C26-AF6F-AAF789CFEC60}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\School of Dragons How to Train Your Dragon\DOMain.exe () [File not signed]
FirewallRules: [{1E7429CB-0E69-44F5-BCF9-4C4C77CB98B4}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\School of Dragons How to Train Your Dragon\DOMain.exe () [File not signed]
FirewallRules: [{FD84B4BE-3D45-4D24-9638-D8F29DC8C610}] => (Allow) C:\Program Files (x86)\Origin Games\STAR WARS Battlefront II\starwarsbattlefrontii.exe (Electronic Arts, Inc. -> Electronic Arts Inc.)
FirewallRules: [{B5E589D6-B7C3-49BD-A77D-A3538E9B8980}] => (Allow) C:\Program Files (x86)\Origin Games\STAR WARS Battlefront II\starwarsbattlefrontii.exe (Electronic Arts, Inc. -> Electronic Arts Inc.)
FirewallRules: [{EA59FD28-789C-4175-8443-A5B88B5FFEF6}] => (Allow) C:\Program Files (x86)\Origin Games\STAR WARS Battlefront II\starwarsbattlefrontii_trial.exe (Electronic Arts, Inc. -> Electronic Arts Inc.)
FirewallRules: [{6AE79637-0D81-49E7-A352-8B8B1A7FDB77}] => (Allow) C:\Program Files (x86)\Origin Games\STAR WARS Battlefront II\starwarsbattlefrontii_trial.exe (Electronic Arts, Inc. -> Electronic Arts Inc.)
FirewallRules: [{B095CD8B-E69B-4FAC-8A41-D0596378CEB1}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (Valve -> Valve Corporation)
FirewallRules: [{CD1A5BAE-134B-4396-B274-16FC91767945}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (Valve -> Valve Corporation)
FirewallRules: [{32A2F801-B803-4F02-80A3-0CA96F9CA0C8}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Jurassic World Evolution\JWE.exe (Frontier Developments) [File not signed]
FirewallRules: [{D370D3B8-DB75-4041-9222-8FFC0367B2C6}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Jurassic World Evolution\JWE.exe (Frontier Developments) [File not signed]
FirewallRules: [{4D8886FC-5007-4299-8BC8-83350F449FE5}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe => No File
FirewallRules: [{EFDE8D68-C972-4B25-A6BB-3BD447439128}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe => No File
FirewallRules: [{F7D4D5A1-D0C1-4B89-A15E-CF4825FECE4E}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe (Valve -> Valve Corporation)
FirewallRules: [{D0BDB5E6-389A-4821-B71E-F96375217C31}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe (Valve -> Valve Corporation)
FirewallRules: [UDP Query User{C08F5384-EC30-4220-A5CA-DD348FCF1F50}C:\games\the sims 4 seasons\game\bin\ts4_x64.exe] => (Block) C:\games\the sims 4 seasons\game\bin\ts4_x64.exe (Electronic Arts Inc.) [File not signed]
FirewallRules: [TCP Query User{B7398DFE-5DDD-4916-8BBA-A26C1E836D89}C:\games\the sims 4 seasons\game\bin\ts4_x64.exe] => (Block) C:\games\the sims 4 seasons\game\bin\ts4_x64.exe (Electronic Arts Inc.) [File not signed]
FirewallRules: [{529FCEE7-A74B-4B59-9B39-68713AAAC04F}] => (Allow) C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe (Intel® Software Development Products -> )
FirewallRules: [{953138D4-1F44-40AC-AA06-63D29C902D9E}] => (Allow) C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe (Intel® Software Development Products -> )
FirewallRules: [{892AF7BB-EBF1-4397-A160-DDEAC2A7ED03}] => (Block) C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe (Intel® Software Development Products -> )
FirewallRules: [{9C0B98B3-8414-4B08-963F-CC10F2D39C1A}] => (Block) C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe (Intel® Software Development Products -> )
FirewallRules: [{2B1698EE-63E1-42AF-8336-EBF39024CB25}] => (Allow) C:\Program Files (x86)\Origin Games\Command and Conquer Red Alert II\RA2Launcher.exe (Kalloc Studios, Inc. -> Kalloc Studios) [File not signed]
FirewallRules: [{234B3848-AF6D-43D9-BC48-5CA74DEA1C40}] => (Allow) C:\Program Files (x86)\Origin Games\Command and Conquer Red Alert II\RA2Launcher.exe (Kalloc Studios, Inc. -> Kalloc Studios) [File not signed]
FirewallRules: [{1E5B736B-32A5-4466-A7EE-89532A6E598E}] => (Allow) C:\Program Files (x86)\Origin Games\STAR WARS Battlefront II\starwarsbattlefrontii_trial.exe (Electronic Arts, Inc. -> Electronic Arts Inc.)
FirewallRules: [{F54ACAAF-A6AA-41D0-8A23-648A63ACE440}] => (Allow) C:\Program Files (x86)\Origin Games\STAR WARS Battlefront II\starwarsbattlefrontii_trial.exe (Electronic Arts, Inc. -> Electronic Arts Inc.)
FirewallRules: [{29F8E06F-0053-42CB-92BE-28CEED70C300}] => (Allow) C:\Program Files (x86)\Origin Games\STAR WARS Battlefront II\starwarsbattlefrontii.exe (Electronic Arts, Inc. -> Electronic Arts Inc.)
FirewallRules: [{F4C66C7E-690A-46E7-8936-F2CDEFD756BF}] => (Allow) C:\Program Files (x86)\Origin Games\STAR WARS Battlefront II\starwarsbattlefrontii.exe (Electronic Arts, Inc. -> Electronic Arts Inc.)
FirewallRules: [{267DE33F-43AB-4115-828C-874403899E89}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Among Us\Among Us.exe () [File not signed]
FirewallRules: [{F61A7BF8-330E-4D02-998F-EDC2E067EF4A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Among Us\Among Us.exe () [File not signed]
FirewallRules: [{79DB100F-C07C-43D0-BA08-4387F670EDE5}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Team Fortress 2\hl2.exe (Valve -> )
FirewallRules: [{FF249E55-AE3D-4E65-A87D-F3C57A128AFD}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Team Fortress 2\hl2.exe (Valve -> )
FirewallRules: [{2A52AA3B-C7D2-4D5D-8826-CA1825BA9FA8}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Subnautica\Subnautica.exe () [File not signed]
FirewallRules: [{7A0EB0A0-71FF-4E99-95D6-81B1D331C4CB}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Subnautica\Subnautica.exe () [File not signed]
FirewallRules: [{A1B7496F-252D-4D4C-8169-0A08E174EF58}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Kerbal Space Program\KSP_x64.exe (Take-Two Interactive Software, Inc. -> )
FirewallRules: [{9464A6EC-29E0-43C2-A36A-EB67B85A2A2F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Kerbal Space Program\KSP_x64.exe (Take-Two Interactive Software, Inc. -> )
FirewallRules: [{398B18D5-0B66-40C5-94E6-B2E8C5265F23}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Evil Genius 2\launcher\eg2.exe (Rebellion) [File not signed]
FirewallRules: [{EFF677CF-3208-4598-BF75-A858213FAF63}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Evil Genius 2\launcher\eg2.exe (Rebellion) [File not signed]
FirewallRules: [{6D2F09A9-AEAE-440B-8438-ABA5F9F04DCA}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Don't Starve Together\bin\dontstarve_steam.exe () [File not signed]
FirewallRules: [{F4571F4D-DA89-4483-A7D9-9CEBE489A756}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Don't Starve Together\bin\dontstarve_steam.exe () [File not signed]
FirewallRules: [{3F2AE0E9-1FB2-40D4-8562-D0CCC0FD570A}] => (Allow) LPort=1542
FirewallRules: [{2C13DDF4-266E-43B3-BF42-443C06E28AC5}] => (Allow) LPort=1542
FirewallRules: [{E1912F43-71E4-4C46-95DC-7F59DE21DD46}] => (Allow) LPort=53
FirewallRules: [{12B9A238-021B-4DFF-9CD1-9AED1E7656F8}] => (Allow) C:\Program Files (x86)\Tenda\TeWlanCuRt\RTLDHCP.exe (Realtek Semiconductor Corp -> Realtek)
FirewallRules: [{102A19E1-65BD-4F74-8431-728BC401A81F}] => (Allow) C:\Program Files (x86)\Tenda\TeWlanCuRt\RTLDHCP.exe (Realtek Semiconductor Corp -> Realtek)
FirewallRules: [{4CD1F01F-6FB4-4548-B202-218683042B12}] => (Allow) C:\Program Files (x86)\Tenda\TeWlanCuRt\RTLDHCP.exe (Realtek Semiconductor Corp -> Realtek)
FirewallRules: [{783DA4E8-3067-42B6-B820-48798A5D3537}] => (Allow) LPort=53
FirewallRules: [{5EDA22C7-3388-4F29-BB32-DCB4F5E8B181}] => (Allow) C:\Program Files (x86)\Tenda\TeWlanCuRt\RTLDHCP.exe (Realtek Semiconductor Corp -> Realtek)
FirewallRules: [{791CBE4A-FD25-4822-B3B3-A54DF25A0CAF}] => (Allow) C:\Program Files (x86)\Tenda\TeWlanCuRt\RTLDHCP.exe (Realtek Semiconductor Corp -> Realtek)
FirewallRules: [{BA79A362-D898-490C-A683-821A14E25CD2}] => (Allow) C:\Program Files (x86)\Tenda\TeWlanCuRt\RTLDHCP.exe (Realtek Semiconductor Corp -> Realtek)
FirewallRules: [{A0E41E26-58A4-4F48-B4BD-FB7323B7DBD3}] => (Allow) C:\Program Files (x86)\Tenda\TeWlanCuRt\RTLDHCP.exe (Realtek Semiconductor Corp -> Realtek)
FirewallRules: [{6D43CCB3-DFDD-495F-A46C-ABDB2921DC75}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.166.578.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{A035D0EC-DCA5-410B-AB56-7F97C7420448}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.166.578.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{30988F8C-2AFC-424C-BF3F-E80A1B50A4DB}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.166.578.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{D6761168-3F34-49C6-84B0-D6E5EFE3A63F}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.166.578.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{05D84348-A1E3-434A-A1F6-F4389EC03A46}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.166.578.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{89A6DA91-03CB-4CCE-9FD5-BB31B6B3F4E3}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.166.578.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{4281613C-969B-4CE4-B2DE-E8E6921D4C74}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.166.578.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{FFA6C8F3-C5A4-4EC2-9EFA-29ABE0DD0AA5}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.166.578.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{30DC3901-FB07-4A98-86AC-DE33805E2A78}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\outlook.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{027E259B-55DD-45F4-ABFD-F08C1222E410}] => (Allow) C:\Program Files (x86)\Microsoft\EdgeWebView\Application\92.0.902.84\msedgewebview2.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{F7AA55DF-3291-47E1-A11F-EC8700BE354D}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe (NVIDIA Corporation -> NVIDIA Corporation)
FirewallRules: [{76A15121-C475-4408-970B-C5F86310B7AE}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe (NVIDIA Corporation -> NVIDIA Corporation)
FirewallRules: [{E945FF61-BC08-46B8-9B12-2C9AC87B02FF}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe (NVIDIA Corporation -> NVIDIA Corporation)
FirewallRules: [{6D0869F8-1096-42F0-8ADB-E9A25E2DEF54}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe (NVIDIA Corporation -> NVIDIA Corporation)
FirewallRules: [{7285DC62-9F05-406D-8C60-0251F9321E90}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe (NVIDIA Corporation -> NVIDIA Corporation)
FirewallRules: [{6166A3A7-3775-4C83-B392-ADF8F72B442C}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe (NVIDIA Corporation -> NVIDIA Corporation)
FirewallRules: [{8D3CBBBC-3BD7-4E81-8E18-6007B1042D4D}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google LLC)
==================== Restore Points =========================
02-09-2021 17:45:46 Installed Minecraft Launcher
==================== Faulty Device Manager Devices ============
==================== Event log errors: ========================
Application errors:
==================
Error: (09/03/2021 02:41:58 AM) (Source: Microsoft-Windows-Defrag) (EventID: 264) (User: )
Description: The storage optimiser couldn't complete re-trim on (C:) because: The operation requested is not supported by the hardware backing the volume. (0x8900002A)
Error: (09/02/2021 08:55:37 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: wmiprvse.exe, version: 10.0.19041.546, time stamp: 0x5da7ab91
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0x80131623
Fault offset: 0x00007ff9ebea200f
Faulting process ID: 0x2e2c
Faulting application start time: 0x01d7a02c1c5e0f7f
Faulting application path: C:\WINDOWS\system32\wbem\wmiprvse.exe
Faulting module path: unknown
Report ID: a96a34d3-172d-4207-bcd2-f7e61610da38
Faulting package full name:
Faulting package-relative application ID:
Error: (09/02/2021 08:55:36 PM) (Source: .NET Runtime) (EventID: 1025) (User: )
Description: Application: wmiprvse.exe
Framework Version: v4.0.30319
Description: The application requested process termination through System.Environment.FailFast(string message).
Message: Unexpected exception thrown from the provider:
System.IO.FileLoadException:
File name: 'Microsoft.AppV.AppvClientComConsumer, Version=10.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35'
at Microsoft.AppV.AppvPublishingServerWMI.AppvPublishingServer.EnumeratePublishingServers()
Stack:
at System.Environment.FailFast(System.String)
at WmiNative.WbemProvider.WmiNative.IWbemServices.CreateInstanceEnumAsync(System.String, Int32, WmiNative.IWbemContext, WmiNative.IWbemObjectSink)
Error: (09/02/2021 08:55:34 PM) (Source: Microsoft Security Client) (EventID: 3002) (User: )
Description: Event-ID 3002
Error: (09/02/2021 08:55:34 PM) (Source: Microsoft Security Client) (EventID: 2002) (User: )
Description: Event-ID 2002
Error: (09/02/2021 08:55:34 PM) (Source: Microsoft Security Client) (EventID: 2003) (User: )
Description: Event-ID 2003
Error: (09/02/2021 04:29:46 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: ekrn.exe, version: 10.21.37.0, time stamp: 0x610cf7d8
Faulting module name: ntdll.dll, version: 10.0.19041.1110, time stamp: 0xe7a22463
Exception code: 0xc0000374
Fault offset: 0x00000000000ff259
Faulting process ID: 0x620
Faulting application start time: 0x01d79ff5417210bb
Faulting application path: C:\Program Files\ESET\ESET Security\ekrn.exe
Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll
Report ID: ede122c4-8167-449e-9c01-0134d6167fcb
Faulting package full name:
Faulting package-relative application ID:
Error: (09/02/2021 04:15:31 PM) (Source: ESENT) (EventID: 522) (User: )
Description: StartMenuExperienceHost (4484,P,98) TILEREPOSITORYS-1-5-21-772020480-3986485932-2889396054-500: An attempt to open the device with name "\\.\C:" containing "C:\" failed with system error 5 (0x00000005): "Access is denied. ". The operation will fail with error -1032 (0xfffffbf8).
System errors:
=============
Error: (09/03/2021 07:27:40 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Realtek DHCP Service service terminated unexpectedly. It has done this 1 time(s).
Error: (09/03/2021 07:27:40 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Origin Web Helper Service service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.
Error: (09/03/2021 07:27:40 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (45000 milliseconds) while waiting for the Origin Web Helper Service service to connect.
Error: (09/03/2021 07:23:51 AM) (Source: DCOM) (EventID: 10005) (User: RICHARDPC)
Description: DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "Unavailable" in order to run the server:
{DD522ACC-F821-461A-A407-50B198B896DC}
Error: (09/03/2021 07:23:35 AM) (Source: DCOM) (EventID: 10005) (User: RICHARDPC)
Description: DCOM got error "1084" attempting to start the service camsvc with arguments "Unavailable" in order to run the server:
Windows.Internal.CapabilityAccess.CapabilityAccess
Error: (09/03/2021 07:23:20 AM) (Source: DCOM) (EventID: 10005) (User: RICHARDPC)
Description: DCOM got error "1084" attempting to start the service TokenBroker with arguments "Unavailable" in order to run the server:
Windows.Internal.Security.Authentication.Web.TokenBrokerInternal
Error: (09/03/2021 07:23:19 AM) (Source: DCOM) (EventID: 10005) (User: RICHARDPC)
Description: DCOM got error "1084" attempting to start the service TokenBroker with arguments "Unavailable" in order to run the server:
Windows.Internal.Security.Authentication.Web.TokenBrokerInternal
Error: (09/03/2021 07:23:19 AM) (Source: DCOM) (EventID: 10005) (User: RICHARDPC)
Description: DCOM got error "1084" attempting to start the service TokenBroker with arguments "Unavailable" in order to run the server:
Windows.Internal.Security.Authentication.Web.TokenBrokerInternal
CodeIntegrity:
===============
Date: 2021-09-03 07:29:48
Description:
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\ESET\ESET Security\eamsi.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2021-09-02 16:29:46
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\aepic.dll because the set of per-page image hashes could not be found on the system.
==================== Memory info ===========================
BIOS: American Megatrends Inc. 3805 05/16/2018
Motherboard: ASUSTeK COMPUTER INC. B150M-K
Processor: Intel® Core™ i5-6500 CPU @ 3.20GHz
Percentage of memory in use: 44%
Total physical RAM: 8119.32 MB
Available physical RAM: 4468.47 MB
Total Virtual: 10029.32 MB
Available Virtual: 4959.58 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:930.14 GB) (Free:565.21 GB) NTFS
Drive e: (R WILLIAMS) (Removable) (Total:29.86 GB) (Free:29.84 GB) FAT32
\\?\Volume{fb8676c7-c800-4b33-8bb2-72493272ac68}\ (Recovery) (Fixed) (Total:0.44 GB) (Free:0.42 GB) NTFS
\\?\Volume{95fa06f5-6380-4c24-9fc0-c8e32f8afa8f}\ () (Fixed) (Total:0.82 GB) (Free:0.38 GB) NTFS
\\?\Volume{d1fb4a23-be45-438b-8457-6895c90e7bb7}\ () (Fixed) (Total:0.09 GB) (Free:0.07 GB) FAT32
==================== MBR & Partition Table ====================
==========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: F188F6A9)
Partition: GPT.
==========================================================
Disk: 1 (Size: 29.9 GB) (Disk ID: 149EDC4E)
Partition 1: (Active) - (Size=29.9 GB) - (Type=0C)
==================== End of Addition.txt =======================
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 01-09-2021
Ran by user (administrator) on RICHARDPC (03-09-2021 08:31:24)
Running from C:\Users\user\Desktop
Loaded Profiles: user
Platform: Windows 10 Pro Version 21H1 19043.1165 (X64) Language: English (United Kingdom)
Default browser: Chrome
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(ESET, spol. s r.o. -> ESET) C:\Program Files\ESET\ESET Security\eguiProxy.exe
(ESET, spol. s r.o. -> ESET) C:\Program Files\ESET\ESET Security\ekrn.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe <11>
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.36.102\GoogleCrashHandler.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.36.102\GoogleCrashHandler64.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsStore_12107.1001.15.0_x64__8wekyb3d8bbwe\WinStore.App.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe <2>
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\oobe\UserOOBEBroker.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(NVIDIA Corporation -> Node.js) C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe <3>
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe <3>
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\ShadowPlay\nvsphelper64.exe
(Nvidia Corporation -> NVIDIA Corporation) C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_b8346c359fcd6093\Display.NvContainer\NVDisplay.Container.exe <2>
(Realtek Semiconductor Corp -> ) C:\Windows\runSW.exe
(Realtek Semiconductor Corp -> Realtek) C:\Program Files (x86)\Tenda\TeWlanCuRt\RtlService.exe
(Realtek Semiconductor Corp. -> Realtek) C:\Windows\SwUSB.exe
==================== Registry (Whitelisted) ===================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8838400 2016-06-07] (Realtek Semiconductor Corp -> Realtek Semiconductor)
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Security\ecmds.exe [165928 2021-08-18] (ESET, spol. s r.o. -> ESET)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems, Incorporated -> Adobe Systems Incorporated)
HKLM-x32\...\Run: [Intel Driver & Support Assistant] => C:\Program Files (x86)\Intel\Driver and Support Assistant\DSATray.exe [288672 2021-05-21] (IDSA Production signing key 2021 -> Intel)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [706344 2021-06-09] (Oracle America, Inc. -> Oracle Corporation)
HKLM\...\Policies\Explorer: [HideSCAHealth] 1
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-772020480-3986485932-2889396054-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [4110568 2021-07-21] (Valve -> Valve Corporation)
HKU\S-1-5-21-772020480-3986485932-2889396054-1001\...\RunOnce: [Application Restart #0] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe --flag-switches-begin --flag-switches-end --enable-audio-service-sandbox --origin-trial-disabled-features=MeasureMemory --restore-last-sess (the data entry has 289 more characters).
HKLM\...\Windows x64\Print Processors\Canon MX490 series Print Processor: C:\Windows\System32\spool\prtprocs\x64\CNMPDCK.DLL [30208 2014-09-10] (Microsoft Windows Hardware Compatibility Publisher -> CANON INC.)
HKLM\...\Print\Monitors\Canon BJ FAX Language Monitor MX490 series: C:\WINDOWS\system32\CNCALCK.DLL [303104 2014-09-22] (Microsoft Windows Hardware Compatibility Publisher -> CANON INC.)
HKLM\...\Print\Monitors\Canon BJ Language Monitor MX490 series: C:\WINDOWS\system32\CNMLMCK.DLL [406528 2014-09-10] (Microsoft Windows Hardware Compatibility Publisher -> CANON INC.)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\93.0.4577.63\Installer\chrmstp.exe [2021-09-03] (Google LLC -> Google LLC)
==================== Scheduled Tasks (Whitelisted) ============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {17679853-FFAE-4CB7-9FB9-7057CD00345E} - System32\Tasks\BlueStacksHelper => C:\ProgramData\BlueStacks\Client\Helper\BlueStacksHelper.exe [754472 2021-04-05] (BlueStack Systems, Inc. -> BlueStack Systems, Inc.)
Task: {1F00CA0F-C6D3-4298-8B68-DD28A9A89616} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153168 2019-10-11] (Google Inc -> Google Inc.)
Task: {20056910-2F85-4756-8DAD-43843B90DEA3} - System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe [645488 2021-06-09] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {24069A13-E761-45F1-BDA0-DEFF9DFE0CE4} - System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [903024 2021-05-04] (NVIDIA Corporation -> NVIDIA Corporation) -> -d "C:\Program Files\NVIDIA Corporation\NvDriverUpdateCheck" -l 3 -f C:\ProgramData\NVIDIA\NvContainerDriverUpdateCheck.log
Task: {253FF3C5-8AD0-4B05-ADA9-4381904BFDC1} - System32\Tasks\IntelSURQC-Upgrade-86621605-2a0b-4128-8ffc-15514c247132-Logon => C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe [18744 2019-04-15] (Intel® Software Development Products -> Intel Corporation)
Task: {2C4EEDCE-AC42-4DE0-A6DA-7FDA293DB62D} - System32\Tasks\Microsoft\Office\Office Feature Updates Logon => C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [139112 2021-08-20] (Microsoft Corporation -> Microsoft Corporation)
Task: {2C735C54-649E-4FAD-A6C1-BA2B3BFB5FF4} - System32\Tasks\NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA GeForce Experience.exe [3339120 2021-06-15] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {2F8D454A-A6FB-48C2-ADA7-ADD60A578B0F} - System32\Tasks\NvTmRep_CrashReport1_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvBackend\NvTmRep.exe [1261424 2021-06-09] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {434948BE-9C26-4EF1-9F1A-6133DEEB2722} - System32\Tasks\NvTmRep_CrashReport3_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvBackend\NvTmRep.exe [1261424 2021-06-09] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {54DE27A5-62B9-47DF-8659-E1F53EDF503B} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel® Update Manager\bin\iumsvc.exe
Task: {5FB4A3DD-D0D1-483C-B5A1-28F45A3498DD} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153168 2019-10-11] (Google Inc -> Google Inc.)
Task: {64A6BC9D-62D9-461D-B071-2204040903C1} - System32\Tasks\NvTmRep_CrashReport4_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvBackend\NvTmRep.exe [1261424 2021-06-09] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {69D8926D-AC2F-4795-B348-A96428E49508} - System32\Tasks\Microsoft\Office\Office Automatic Updates 2.0 => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [23253888 2021-08-06] (Microsoft Corporation -> Microsoft Corporation)
Task: {6E0DCC2B-CE7D-41EA-89A0-3FC2D7A7FEF7} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [23253888 2021-08-06] (Microsoft Corporation -> Microsoft Corporation)
Task: {8EC0056E-0F91-43F5-A7C1-CE0132D3523F} - System32\Tasks\EOSv3 Scheduler onTime => C:\Users\user\Downloads\esetonlinescanner.exe
Task: {8F73A28B-3BFE-4790-BF60-B5EBF11931E3} - System32\Tasks\EOSv3 Scheduler onLogOn => C:\Users\user\Downloads\esetonlinescanner.exe
Task: {96E57684-E55C-466E-804E-EF8862AA5A94} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [905072 2021-06-09] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {D38B6F36-35FC-43C1-AA2C-01165CE753D2} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [905072 2021-06-09] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {D7FB0DF1-2DF3-4D11-83BB-B143185567DF} - System32\Tasks\IntelSURQC-Upgrade-86621605-2a0b-4128-8ffc-15514c247132 => C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe [18744 2019-04-15] (Intel® Software Development Products -> Intel Corporation)
Task: {E20B00FE-46C1-4B18-9EE5-85D0F40B0C7F} - System32\Tasks\USER_ESRV_SVC_QUEENCREEK => "C:\WINDOWS\System32\Wscript.exe" //B //NoLogo "C:\Program Files\Intel\SUR\QUEENCREEK\x64\task.vbs"
Task: {E45EF849-27A4-4385-A149-535005E03E72} - System32\Tasks\NvTmRep_CrashReport2_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvBackend\NvTmRep.exe [1261424 2021-06-09] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {EF192315-0B4D-46FF-8CBD-F83B8E17EA67} - System32\Tasks\NvBatteryBoostCheckOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [903024 2021-05-04] (NVIDIA Corporation -> NVIDIA Corporation) -> -d "C:\Program Files\NVIDIA Corporation\NvBackend\NvBatteryBoostCheck" -l 3 -f C:\ProgramData\NVIDIA\NvContainerBatteryBoostCheck.log
Task: {FDEF1943-3844-430E-8C01-E5D9F3C51AEF} - System32\Tasks\Microsoft\Office\Office Feature Updates => C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [139112 2021-08-20] (Microsoft Corporation -> Microsoft Corporation)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{35193124-d662-4c0b-8f44-f616bc87ac85}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{43f2741b-236a-4bb5-bc9d-6adbfd55f8d1}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{646e0a3d-9cee-4e81-9ac9-33257f6fc438}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{85dea709-296b-4636-ac1a-bdf918fe0c1b}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{bd16c92e-5f78-4c2d-9946-9d31ef9c1321}: [DhcpNameServer] 192.168.1.1
Edge:
=======
Edge Extension: (No Name) -> AutoFormFill_5ED10D46BD7E47DEB1F3685D2C0FCE08 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\AutoFormFill [not found]
Edge Extension: (No Name) -> BookReader_B171F20233094AC88D05A8EF7B9763E8 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\BookViewer [not found]
Edge Extension: (No Name) -> LearningTools_7706F933-971C-41D1-9899-8A026EB5D824 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\LearningTools [not found]
Edge Extension: (No Name) -> PinJSAPI_EC01B57063BE468FAB6DB7EBFC3BF368 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\PinJSAPI [not found]
Edge DefaultProfile: Default
Edge Profile: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default [2021-09-03]
FireFox:
========
FF Plugin: @java.com/DTPlugin,version=11.301.2 -> C:\Program Files\Java\jre1.8.0_301\bin\dtplugin\npDeployJava1.dll [2021-09-02] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.301.2 -> C:\Program Files\Java\jre1.8.0_301\bin\plugin2\npjp2.dll [2021-09-02] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL [2021-06-09] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.301.2 -> C:\Program Files (x86)\Java\jre1.8.0_301\bin\dtplugin\npDeployJava1.dll [2021-09-02] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.301.2 -> C:\Program Files (x86)\Java\jre1.8.0_301\bin\plugin2\npjp2.dll [2021-09-02] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\NPSPWRAP.DLL [2021-06-09] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=3.0.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2018-08-09] (VideoLAN -> VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2013-09-05] (Adobe Systems, Incorporated -> Adobe Systems Inc.)
Chrome:
=======
CHR DefaultProfile: Profile 1
CHR Profile: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default [2021-09-03]
CHR Extension: (Docs) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2019-10-11]
CHR Extension: (Google Drive) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2020-10-28]
CHR Extension: (YouTube) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2019-10-11]
CHR Extension: (Google Docs Offline) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2021-07-07]
CHR Extension: (Chrome Web Store Payments) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2021-02-01]
CHR Extension: (Gmail) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2020-10-28]
CHR Profile: C:\Users\user\AppData\Local\Google\Chrome\User Data\Guest Profile [2021-09-03]
CHR Profile: C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 1 [2021-09-03]
CHR Extension: (Slides) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2021-09-02]
CHR Extension: (Docs) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2021-09-02]
CHR Extension: (Google Drive) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2021-09-02]
CHR Extension: (YouTube) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2021-09-02]
CHR Extension: (Sheets) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2021-09-02]
CHR Extension: (Google Docs Offline) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2021-09-02]
CHR Extension: (Chrome Web Store Payments) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2021-09-02]
CHR Extension: (Gmail) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2021-09-02]
CHR Profile: C:\Users\user\AppData\Local\Google\Chrome\User Data\System Profile [2021-09-03]
==================== Services (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S4 AdobeARMservice; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65640 2013-09-05] (Adobe Systems, Incorporated -> Adobe Systems Incorporated)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [9142128 2021-08-05] (Microsoft Corporation -> Microsoft Corporation)
R2 ekrn; C:\Program Files\ESET\ESET Security\ekrn.exe [3079464 2021-08-18] (ESET, spol. s r.o. -> ESET)
R3 ekrnEpfw; C:\Program Files\ESET\ESET Security\ekrn.exe [3079464 2021-08-18] (ESET, spol. s r.o. -> ESET)
S4 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2556048 2021-08-31] (Electronic Arts, Inc. -> Electronic Arts)
S2 Origin Web Helper Service; C:\Program Files (x86)\Origin\OriginWebHelperService.exe [3474584 2021-08-31] (Electronic Arts, Inc. -> Electronic Arts)
R2 RealtekWlanU; C:\Program Files (x86)\Tenda\TeWlanCuRt\RtlService.exe [48856 2016-08-23] (Realtek Semiconductor Corp -> Realtek)
S2 RTLDHCPService; C:\Program Files (x86)\Tenda\TeWlanCuRt\RTLDHCP.exe [262360 2016-08-23] (Realtek Semiconductor Corp -> Realtek)
R2 RunSwUSB; C:\Windows\runSW.exe [44760 2017-01-06] (Realtek Semiconductor Corp -> )
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [5394872 2021-08-19] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 TwitchService; C:\Program Files\Common Files\Twitch\TwitchService.exe [317144 2021-08-30] (Twitch Interactive, Inc. -> )
S3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1911.3-0\NisSrv.exe [3206472 2020-01-13] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1911.3-0\MsMpEng.exe [103376 2020-01-13] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 NVDisplay.ContainerLocalSystem; C:\WINDOWS\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_b8346c359fcd6093\Display.NvContainer\NVDisplay.Container.exe -s NVDisplay.ContainerLocalSystem -f %ProgramData%\NVIDIA\NVDisplay.ContainerLocalSystem.log -l 3 -d C:\WINDOWS\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_b8346c359fcd6093\Display.NvContainer\plugins\LocalSystem -r -p 30000 -cfg NVDisplay.ContainerLocalSystem\LocalSystem
===================== Drivers (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [14464 2014-02-25] (ASUSTeK Computer Inc. -> )
R2 BlueStacksDrv; C:\Program Files\BlueStacks\BstkDrv_bgp.sys [315976 2020-07-26] (Bluestack Systems, Inc -> Bluestack System Inc.)
R1 eamonm; C:\WINDOWS\System32\DRIVERS\eamonm.sys [169424 2021-08-18] (ESET, spol. s r.o. -> ESET)
R0 edevmon; C:\WINDOWS\System32\DRIVERS\edevmon.sys [123472 2021-08-18] (ESET, spol. s r.o. -> ESET)
S0 eelam; C:\WINDOWS\System32\DRIVERS\eelam.sys [15824 2021-03-15] (Microsoft Windows Early Launch Anti-malware Publisher -> ESET)
R1 ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [194776 2021-08-18] (ESET, spol. s r.o. -> ESET)
R2 ekbdflt; C:\WINDOWS\system32\DRIVERS\ekbdflt.sys [43904 2021-08-18] (ESET, spol. s r.o. -> ESET)
R1 epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [70232 2021-08-18] (ESET, spol. s r.o. -> ESET)
R1 epfwwfp; C:\WINDOWS\system32\DRIVERS\epfwwfp.sys [107456 2021-08-18] (ESET, spol. s r.o. -> ESET)
S3 RtlWlanu; C:\WINDOWS\System32\drivers\rtwlanu.sys [5733920 2016-12-13] (Realtek Semiconductor Corp. -> Realtek Semiconductor Corporation)
S3 WdBoot; C:\WINDOWS\system32\drivers\wd\WdBoot.sys [45664 2020-01-13] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\wd\WdFilter.sys [355760 2020-01-13] (Microsoft Windows -> Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [54192 2020-01-13] (Microsoft Windows -> Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One month (created) (Whitelisted) =========
(If an entry is included in the fixlist, the file/folder will be moved.)
2021-09-03 08:31 - 2021-09-03 08:32 - 000020894 _____ C:\Users\user\Desktop\FRST.txt
2021-09-03 08:31 - 2021-09-03 08:21 - 002302464 _____ (Farbar) C:\Users\user\Desktop\FRST64 (1).exe
2021-09-02 20:52 - 2021-09-03 07:13 - 000000000 ____D C:\ESD
2021-09-02 20:51 - 2021-09-02 20:51 - 000000000 ___HD C:\$Windows.~WS
2021-09-02 20:51 - 2021-09-02 20:51 - 000000000 ____D C:\$WINDOWS.~BT
2021-09-02 18:21 - 2021-09-02 18:21 - 000000000 ____D C:\Users\Administrator\AppData\Local\PeerDistRepub
2021-09-02 17:47 - 2021-09-02 18:25 - 000000000 ____D C:\Program Files (x86)\Minecraft Launcher
2021-09-02 17:47 - 2021-09-02 17:47 - 000001103 _____ C:\Users\Public\Desktop\Minecraft Launcher.lnk
2021-09-02 17:47 - 2021-09-02 17:47 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Minecraft Launcher
2021-09-02 17:44 - 2021-09-02 17:44 - 002666496 _____ C:\Users\user\Downloads\MinecraftInstaller.msi
2021-09-02 17:00 - 2021-09-02 17:00 - 000000000 ____D C:\WINDOWS\LastGood.Tmp
2021-09-02 16:54 - 2021-08-28 14:25 - 001858664 _____ C:\WINDOWS\system32\vulkaninfo-1-999-0-0-0.exe
2021-09-02 16:54 - 2021-08-28 14:25 - 001858664 _____ C:\WINDOWS\system32\vulkaninfo.exe
2021-09-02 16:54 - 2021-08-28 14:25 - 001474704 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.dll
2021-09-02 16:54 - 2021-08-28 14:25 - 001438848 _____ C:\WINDOWS\SysWOW64\vulkaninfo-1-999-0-0-0.exe
2021-09-02 16:54 - 2021-08-28 14:25 - 001438848 _____ C:\WINDOWS\SysWOW64\vulkaninfo.exe
2021-09-02 16:54 - 2021-08-28 14:25 - 001212536 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.dll
2021-09-02 16:54 - 2021-08-28 14:25 - 001097856 _____ C:\WINDOWS\system32\vulkan-1-999-0-0-0.dll
2021-09-02 16:54 - 2021-08-28 14:25 - 001097856 _____ C:\WINDOWS\system32\vulkan-1.dll
2021-09-02 16:54 - 2021-08-28 14:25 - 000951936 _____ C:\WINDOWS\SysWOW64\vulkan-1-999-0-0-0.dll
2021-09-02 16:54 - 2021-08-28 14:25 - 000951936 _____ C:\WINDOWS\SysWOW64\vulkan-1.dll
2021-09-02 16:54 - 2021-08-28 14:22 - 001520760 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFR64.dll
2021-09-02 16:54 - 2021-08-28 14:22 - 001171064 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFR.dll
2021-09-02 16:54 - 2021-08-28 14:22 - 000716920 _____ C:\WINDOWS\system32\nvofapi64.dll
2021-09-02 16:54 - 2021-08-28 14:22 - 000676480 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFROpenGL.dll
2021-09-02 16:54 - 2021-08-28 14:22 - 000645240 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvml.dll
2021-09-02 16:54 - 2021-08-28 14:22 - 000577168 _____ C:\WINDOWS\SysWOW64\nvofapi.dll
2021-09-02 16:54 - 2021-08-28 14:22 - 000564344 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFROpenGL.dll
2021-09-02 16:54 - 2021-08-28 14:21 - 002112128 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvFBC64.dll
2021-09-02 16:54 - 2021-08-28 14:21 - 001595536 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvFBC.dll
2021-09-02 16:54 - 2021-08-28 14:21 - 000919184 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvEncodeAPI64.dll
2021-09-02 16:54 - 2021-08-28 14:21 - 000750224 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvEncodeAPI.dll
2021-09-02 16:54 - 2021-08-28 14:21 - 000706192 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvidia-smi.exe
2021-09-02 16:54 - 2021-08-28 14:20 - 005681280 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcpl.dll
2021-09-02 16:54 - 2021-08-27 18:54 - 000083133 _____ C:\WINDOWS\system32\nvinfo.pb
2021-09-02 16:53 - 2021-08-28 14:20 - 008854144 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuvid.dll
2021-09-02 16:53 - 2021-08-28 14:20 - 007920760 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuvid.dll
2021-09-02 16:53 - 2021-08-28 14:20 - 004987512 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuda.dll
2021-09-02 16:53 - 2021-08-28 14:20 - 002925688 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuda.dll
2021-09-02 16:53 - 2021-08-28 14:20 - 000447104 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdebugdump.exe
2021-09-02 16:53 - 2021-08-28 14:19 - 000849016 _____ (NVIDIA Corporation) C:\WINDOWS\system32\MCU.exe
2021-09-02 16:53 - 2021-08-28 14:18 - 006216336 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvapi.dll
2021-09-02 16:37 - 2021-09-02 16:37 - 000003976 _____ C:\WINDOWS\system32\Tasks\NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2021-09-02 16:37 - 2021-09-02 16:37 - 000003940 _____ C:\WINDOWS\system32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2021-09-02 16:37 - 2021-09-02 16:37 - 000001443 _____ C:\Users\Public\Desktop\GeForce Experience.lnk
2021-09-02 16:37 - 2021-09-02 16:37 - 000000000 ____D C:\Users\Administrator\AppData\Local\CEF
2021-09-02 16:37 - 2021-09-02 16:37 - 000000000 ____D C:\Users\Administrator\ansel
2021-09-02 16:37 - 2021-09-02 16:37 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2021-09-02 16:37 - 2021-06-09 16:17 - 002838384 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvspcap64.dll
2021-09-02 16:37 - 2021-06-09 16:17 - 002186608 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvspcap.dll
2021-09-02 16:37 - 2021-06-09 16:17 - 001293680 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvRtmpStreamer64.dll
2021-09-02 16:36 - 2021-09-02 16:36 - 000004308 _____ C:\WINDOWS\system32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2021-09-02 16:36 - 2021-09-02 16:36 - 000004106 _____ C:\WINDOWS\system32\Tasks\NvBatteryBoostCheckOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2021-09-02 16:36 - 2021-09-02 16:36 - 000003858 _____ C:\WINDOWS\system32\Tasks\NvTmRep_CrashReport4_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2021-09-02 16:36 - 2021-09-02 16:36 - 000003858 _____ C:\WINDOWS\system32\Tasks\NvTmRep_CrashReport3_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2021-09-02 16:36 - 2021-09-02 16:36 - 000003858 _____ C:\WINDOWS\system32\Tasks\NvTmRep_CrashReport2_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2021-09-02 16:36 - 2021-09-02 16:36 - 000003858 _____ C:\WINDOWS\system32\Tasks\NvTmRep_CrashReport1_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2021-09-02 16:36 - 2021-06-04 14:22 - 000168304 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvaudcap64v.dll
2021-09-02 16:36 - 2021-06-04 14:22 - 000144240 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvaudcap32v.dll
2021-09-02 16:36 - 2021-05-04 09:49 - 000001951 _____ C:\WINDOWS\NvContainerRecovery.bat
2021-09-02 16:34 - 2021-09-02 16:34 - 000000197 _____ C:\Users\Administrator\Desktop\Nvidia test.txt
2021-09-02 16:34 - 2021-09-02 16:34 - 000000000 ____D C:\Users\Administrator\AppData\Local\Comms
2021-09-02 16:34 - 2021-06-02 16:03 - 000067464 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvvhci.sys
2021-09-02 16:34 - 2021-06-02 15:17 - 000069856 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvvad64v.sys
2021-09-02 16:28 - 2021-09-02 16:31 - 129403048 _____ (NVIDIA Corporation New) C:\Users\Administrator\Downloads\GeForce_Experience_v3.23.0.74.exe
2021-09-02 16:23 - 2021-09-02 16:23 - 000000000 ____D C:\Users\Administrator\AppData\Local\PlaceholderTileLogoFolder
2021-09-02 16:19 - 2021-09-02 16:23 - 000003380 _____ C:\WINDOWS\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-772020480-3986485932-2889396054-500
2021-09-02 16:19 - 2021-09-02 16:19 - 000000000 ___RD C:\Users\Administrator\OneDrive
2021-09-02 16:18 - 2021-09-02 16:18 - 000057449 _____ C:\WINDOWS\system32\NOTICE_mod
2021-09-02 16:18 - 2021-09-02 16:18 - 000000000 ____D C:\Users\Administrator\AppData\Local\ESET
2021-09-02 16:16 - 2021-09-02 16:48 - 000000000 ____D C:\Users\Administrator\AppData\Local\NVIDIA Corporation
2021-09-02 16:15 - 2021-09-02 16:35 - 000000000 ____D C:\Users\Administrator\AppData\Local\Publishers
2021-09-02 16:14 - 2021-09-02 17:01 - 000000000 ____D C:\Users\Administrator\AppData\Local\NVIDIA
2021-09-02 16:14 - 2021-09-02 16:37 - 000000000 ____D C:\Users\Administrator
2021-09-02 16:14 - 2021-09-02 16:35 - 000000000 ____D C:\Users\Administrator\AppData\Local\Packages
2021-09-02 16:14 - 2021-09-02 16:27 - 000002332 _____ C:\Users\Administrator\Desktop\Google Chrome.lnk
2021-09-02 16:14 - 2021-09-02 16:23 - 000002387 _____ C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2021-09-02 16:14 - 2021-09-02 16:21 - 000000000 ____D C:\Users\Administrator\AppData\Local\D3DSCache
2021-09-02 16:14 - 2021-09-02 16:20 - 000002348 _____ C:\Users\Administrator\Desktop\Microsoft Edge.lnk
2021-09-02 16:14 - 2021-09-02 16:14 - 000000020 ___SH C:\Users\Administrator\ntuser.ini
2021-09-02 16:14 - 2021-09-02 16:14 - 000000000 ___RD C:\Users\Administrator\3D Objects
2021-09-02 16:14 - 2021-09-02 16:14 - 000000000 ____D C:\Users\Administrator\AppData\Roaming\Adobe
2021-09-02 16:14 - 2021-09-02 16:14 - 000000000 ____D C:\Users\Administrator\AppData\Local\Google
2021-09-02 16:14 - 2021-09-02 16:14 - 000000000 ____D C:\Users\Administrator\AppData\Local\ConnectedDevicesPlatform
2021-09-02 15:59 - 2021-09-02 15:58 - 000191832 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-64.dll
2021-08-31 20:09 - 2021-08-31 20:48 - 000000000 ____D C:\Users\user\AppData\Roaming\Origin
2021-08-31 20:09 - 2021-08-31 20:41 - 000000000 ____D C:\Users\user\AppData\Local\Origin
2021-08-30 17:14 - 2021-08-31 16:45 - 000000000 ____D C:\Users\user\AppData\Roaming\Twitch Studio
2021-08-30 17:14 - 2021-08-31 16:07 - 000000000 ____D C:\Program Files\Common Files\Twitch
2021-08-30 17:14 - 2021-08-30 17:14 - 000001127 _____ C:\Users\user\Desktop\Twitch Studio.lnk
2021-08-30 17:14 - 2021-08-30 17:14 - 000001113 _____ C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Twitch Studio.lnk
2021-08-30 17:14 - 2021-08-30 17:14 - 000000000 ____D C:\Users\user\AppData\Roaming\twitch-desktop-electron-platform
2021-08-30 17:13 - 2021-08-30 17:13 - 001242192 _____ (Twitch Interactive, Inc.) C:\Users\user\Downloads\TwitchStudioSetup-network_[usher-722579840][referrer-studio_page].exe
2021-08-20 14:58 - 2021-08-20 14:58 - 000000000 ___HD C:\$WinREAgent
2021-08-19 15:34 - 2021-08-19 15:34 - 000007680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MsraLegacy.tlb
2021-08-19 15:34 - 2021-08-19 15:34 - 000007680 _____ (Microsoft Corporation) C:\WINDOWS\system32\MsraLegacy.tlb
2021-08-19 15:34 - 2021-08-19 15:34 - 000006656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rendezvousSession.tlb
2021-08-19 15:34 - 2021-08-19 15:34 - 000006656 _____ (Microsoft Corporation) C:\WINDOWS\system32\rendezvousSession.tlb
2021-08-19 15:33 - 2021-08-19 15:33 - 001687040 _____ C:\WINDOWS\system32\libcrypto.dll
2021-08-19 15:33 - 2021-08-19 15:33 - 000157184 _____ C:\WINDOWS\system32\uwfcsp.dll
2021-08-19 15:33 - 2021-08-19 15:33 - 000153600 _____ C:\WINDOWS\system32\uwfcfgmgmt.dll
2021-08-19 15:32 - 2021-08-19 15:32 - 002755584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2021-08-19 15:32 - 2021-08-19 15:32 - 002755584 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2021-08-19 15:32 - 2021-08-19 15:32 - 002371072 _____ C:\WINDOWS\system32\rdpnano.dll
2021-08-19 15:32 - 2021-08-19 15:32 - 001314128 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2021-08-19 15:32 - 2021-08-19 15:32 - 000700928 _____ C:\WINDOWS\system32\FsNVSDeviceSource.dll
2021-08-19 15:32 - 2021-08-19 15:32 - 000570880 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2021-08-19 15:32 - 2021-08-19 15:32 - 000452608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2021-08-19 15:32 - 2021-08-19 15:32 - 000084992 _____ (Microsoft Corporation) C:\WINDOWS\system32\wscui.cpl
2021-08-19 15:32 - 2021-08-19 15:32 - 000067584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wscui.cpl
2021-08-19 15:32 - 2021-08-19 15:32 - 000011347 _____ C:\WINDOWS\system32\DrtmAuthTxt.wim
2021-08-19 15:31 - 2021-08-19 15:31 - 001864192 _____ (The ICU Project) C:\WINDOWS\SysWOW64\icu.dll
2021-08-19 15:31 - 2021-08-19 15:31 - 001333760 _____ C:\WINDOWS\SysWOW64\TextInputMethodFormatter.dll
2021-08-19 15:31 - 2021-08-19 15:31 - 001163776 _____ C:\WINDOWS\system32\MBR2GPT.EXE
2021-08-19 15:31 - 2021-08-19 15:31 - 000468440 _____ C:\WINDOWS\SysWOW64\WindowManagementAPI.dll
2021-08-19 15:31 - 2021-08-19 15:31 - 000423936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winspool.drv
2021-08-19 15:31 - 2021-08-19 15:31 - 000223744 _____ C:\WINDOWS\SysWOW64\TpmTool.exe
2021-08-19 15:30 - 2021-08-19 15:30 - 001823280 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2021-08-19 15:30 - 2021-08-19 15:30 - 001393480 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2021-08-19 15:30 - 2021-08-19 15:30 - 000060928 _____ C:\WINDOWS\system32\runexehelper.exe
2021-08-19 15:29 - 2021-08-19 15:29 - 002260992 _____ C:\WINDOWS\system32\TextInputMethodFormatter.dll
2021-08-19 15:29 - 2021-08-19 15:29 - 002260480 _____ (The ICU Project) C:\WINDOWS\system32\icu.dll
2021-08-19 15:29 - 2021-08-19 15:29 - 000657464 _____ C:\WINDOWS\system32\WindowManagementAPI.dll
2021-08-19 15:29 - 2021-08-19 15:29 - 000097792 _____ C:\WINDOWS\system32\Drivers\cimfs.sys
2021-08-19 15:28 - 2021-08-19 15:28 - 000563712 _____ (Microsoft Corporation) C:\WINDOWS\system32\winspool.drv
2021-08-19 15:28 - 2021-08-19 15:28 - 000288768 _____ C:\WINDOWS\system32\Windows.Management.InprocObjects.dll
2021-08-19 15:28 - 2021-08-19 15:28 - 000287232 _____ C:\WINDOWS\system32\CoreMas.dll
2021-08-19 15:28 - 2021-08-19 15:28 - 000272384 _____ C:\WINDOWS\system32\TpmTool.exe
2021-08-19 15:28 - 2021-08-19 15:28 - 000165888 _____ C:\WINDOWS\system32\DataStoreCacheDumpTool.exe
2021-08-19 15:28 - 2021-08-19 15:28 - 000013312 _____ C:\WINDOWS\system32\agentactivationruntimestarter.exe
2021-08-19 15:09 - 2021-08-19 15:09 - 000002056 _____ C:\Users\Public\Desktop\Tenda Wireless Utility.lnk
2021-08-19 15:09 - 2021-08-19 15:09 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tenda
2021-08-19 15:08 - 2021-08-19 15:08 - 000000000 ____D C:\Program Files (x86)\Tenda
2021-08-19 15:08 - 2016-12-13 17:26 - 005733920 _____ (Realtek Semiconductor Corporation ) C:\WINDOWS\system32\Drivers\rtwlanu.sys
2021-08-19 15:08 - 2016-08-23 09:55 - 000451072 _____ C:\WINDOWS\SysWOW64\ISSRemoveSP.exe
2021-08-19 15:08 - 2016-08-23 09:55 - 000380928 _____ (Realtek) C:\WINDOWS\RtlUI2.exe
2021-08-19 15:08 - 2016-08-23 09:55 - 000100000 _____ C:\WINDOWS\SysWOW64\EAPPkt9x.VXD
2021-08-19 15:08 - 2016-08-23 09:55 - 000012981 _____ C:\WINDOWS\SysWOW64\REALPKT.VXD
2021-08-19 15:08 - 2016-08-23 09:55 - 000000901 _____ C:\WINDOWS\RtlUI2.exe.manifest
2021-08-19 15:07 - 2021-08-19 15:07 - 000000000 ____D C:\Users\user\AppData\Roaming\WinRAR
2021-08-19 15:06 - 2021-08-19 15:06 - 003348968 _____ (Alexander Roshal) C:\Users\user\Downloads\winrar-x64-602.exe
2021-08-19 15:06 - 2021-08-19 15:06 - 000000000 ____D C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2021-08-19 15:06 - 2021-08-19 15:06 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2021-08-19 15:06 - 2021-08-19 15:06 - 000000000 ____D C:\Program Files\WinRAR
2021-08-19 14:49 - 2021-08-19 14:54 - 070702137 _____ C:\Users\user\Downloads\Setup_U12_V0.12.1.8.rar
2021-08-19 13:31 - 2021-08-19 15:08 - 000000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2021-08-19 13:31 - 2021-08-19 13:31 - 000000000 ____D C:\Program Files (x86)\Realtek
2021-08-19 13:31 - 2019-07-18 21:15 - 001139416 _____ (Realtek Semiconductor Corp. ) C:\WINDOWS\system32\Rtlihvs.dll
2021-08-19 13:31 - 2017-01-06 11:04 - 000500736 _____ (Realtek) C:\WINDOWS\SwUSB.exe
2021-08-19 13:31 - 2017-01-06 11:04 - 000044760 _____ () C:\WINDOWS\runSW.exe
2021-08-19 13:27 - 2021-08-19 13:29 - 032558217 _____ C:\Users\user\Downloads\00015960-RTLWlanU_WindowsDriver_1030.38.0712.2019_Drv_3.00.0032.L.zip
2021-08-06 13:24 - 2021-08-06 13:36 - 002760820 _____ C:\WINDOWS\Minidump\080621-50031-01.dmp
==================== One month (modified) ==================
(If an entry is included in the fixlist, the file/folder will be moved.)
2021-09-03 08:32 - 2020-04-19 15:58 - 000000000 ____D C:\FRST
2021-09-03 08:24 - 2019-10-11 08:59 - 000000000 ____D C:\Program Files (x86)\Google
2021-09-03 08:02 - 2020-09-16 17:41 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2021-09-03 07:36 - 2019-12-07 11:14 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2021-09-03 07:33 - 2020-09-16 17:46 - 000795738 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2021-09-03 07:33 - 2019-12-07 11:13 - 000000000 ____D C:\WINDOWS\INF
2021-09-03 07:28 - 2019-10-10 00:23 - 000000000 ____D C:\ProgramData\NVIDIA
2021-09-03 07:26 - 2020-09-16 18:04 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2021-09-03 07:26 - 2020-09-16 17:41 - 000008192 ___SH C:\DumpStack.log.tmp
2021-09-03 07:25 - 2020-04-15 13:08 - 000776904 _____ C:\WINDOWS\ntbtlog.txt
2021-09-03 07:25 - 2019-12-07 11:03 - 000786432 _____ C:\WINDOWS\system32\config\BBI
2021-09-03 07:23 - 2020-04-19 14:32 - 000000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job
2021-09-03 07:22 - 2020-04-25 12:52 - 000000000 ____D C:\Program Files (x86)\Java
2021-09-03 07:13 - 2020-09-15 18:02 - 000000000 ___DC C:\WINDOWS\Panther
2021-09-03 07:12 - 2019-10-11 16:57 - 000000000 ____D C:\Users\user\AppData\Local\D3DSCache
2021-09-03 07:05 - 2020-05-04 16:17 - 000000000 ____D C:\Program Files (x86)\Steam
2021-09-03 01:24 - 2019-10-11 08:59 - 000002301 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2021-09-02 20:43 - 2020-04-25 12:59 - 000000000 ____D C:\Users\user\AppData\Roaming\.minecraft
2021-09-02 18:22 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\AppReadiness
2021-09-02 17:13 - 2019-10-11 15:54 - 000000000 ____D C:\Users\user\AppData\Local\NVIDIA Corporation
2021-09-02 17:11 - 2019-10-11 15:54 - 000000000 ____D C:\Users\user\AppData\Local\NVIDIA
2021-09-02 16:55 - 2019-10-10 00:23 - 000000000 ____D C:\ProgramData\NVIDIA Corporation
2021-09-02 16:37 - 2019-10-10 00:22 - 000000000 ____D C:\Program Files\NVIDIA Corporation
2021-09-02 16:37 - 2019-10-10 00:22 - 000000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2021-09-02 16:36 - 2020-09-16 18:04 - 000003894 _____ C:\WINDOWS\system32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2021-09-02 16:36 - 2020-09-16 18:04 - 000003654 _____ C:\WINDOWS\system32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2021-09-02 16:31 - 2019-12-07 11:14 - 000000000 ___RD C:\WINDOWS\PrintDialog
2021-09-02 16:14 - 2019-12-07 11:14 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2021-09-02 16:14 - 2019-10-09 14:58 - 000000000 __RHD C:\Users\Public\AccountPictures
2021-09-02 15:59 - 2020-04-25 12:58 - 000000000 ____D C:\Program Files\Java
2021-09-02 15:59 - 2020-04-25 12:52 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2021-09-02 15:58 - 2020-04-25 12:59 - 000191832 _____ (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge-64.dll
2021-09-02 15:57 - 2020-04-25 12:52 - 000164696 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2021-08-31 20:48 - 2019-10-11 16:36 - 000000000 ____D C:\ProgramData\Origin
2021-08-31 20:42 - 2019-10-11 16:59 - 000000000 ____D C:\Program Files (x86)\Origin Games
2021-08-31 20:14 - 2019-10-14 14:48 - 000000000 ____D C:\Users\user\AppData\Local\CrashDumps
2021-08-31 20:12 - 2019-10-11 16:55 - 000000000 ____D C:\Program Files (x86)\Origin
2021-08-31 16:46 - 2020-05-04 16:25 - 000000000 ____D C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2021-08-30 18:44 - 2020-09-16 18:04 - 000003364 _____ C:\WINDOWS\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-772020480-3986485932-2889396054-1001
2021-08-30 18:44 - 2020-09-16 05:07 - 000002376 _____ C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2021-08-30 17:08 - 2020-04-25 13:11 - 000002438 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
2021-08-30 17:08 - 2019-12-07 11:14 - 000000000 ___HD C:\Program Files\WindowsApps
2021-08-28 14:18 - 2019-10-31 13:56 - 007280848 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvapi64.dll
2021-08-21 10:44 - 2020-05-12 14:45 - 000000000 ____D C:\Users\user\Documents\Sound recordings
2021-08-20 16:16 - 2019-12-07 11:03 - 000000000 ____D C:\WINDOWS\CbsTemp
2021-08-20 13:58 - 2020-05-11 15:06 - 000000000 ____D C:\Program Files\Microsoft Office
2021-08-20 13:58 - 2019-12-07 11:14 - 000000000 ____D C:\Program Files\Common Files\microsoft shared
2021-08-19 19:57 - 2019-10-09 14:58 - 000000000 ____D C:\Users\user\AppData\Local\Packages
2021-08-19 15:46 - 2020-09-16 17:41 - 000464704 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2021-08-19 15:43 - 2019-12-07 16:46 - 000000000 ____D C:\WINDOWS\system32\OpenSSH
2021-08-19 15:43 - 2019-12-07 16:45 - 000000000 ____D C:\WINDOWS\system32\Drivers\en-GB
2021-08-19 15:43 - 2019-12-07 11:14 - 000000000 ___SD C:\WINDOWS\system32\UNP
2021-08-19 15:43 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\SysWOW64\WinMetadata
2021-08-19 15:43 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\SysWOW64\setup
2021-08-19 15:43 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\SysWOW64\oobe
2021-08-19 15:43 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\SysWOW64\lv-LV
2021-08-19 15:43 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\SysWOW64\lt-LT
2021-08-19 15:43 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\SysWOW64\et-EE
2021-08-19 15:43 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\SysWOW64\es-MX
2021-08-19 15:43 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2021-08-19 15:43 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\SystemResources
2021-08-19 15:43 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\system32\WinMetadata
2021-08-19 15:43 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2021-08-19 15:43 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\system32\SystemResetPlatform
2021-08-19 15:43 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\system32\setup
2021-08-19 15:43 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\system32\oobe
2021-08-19 15:43 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\system32\migwiz
2021-08-19 15:43 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\system32\lv-LV
2021-08-19 15:43 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\system32\lt-LT
2021-08-19 15:43 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\system32\et-EE
2021-08-19 15:43 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\system32\es-MX
2021-08-19 15:43 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\system32\Dism
2021-08-19 15:42 - 2019-12-07 16:49 - 000000000 ____D C:\Program Files\Windows Defender Advanced Threat Protection
2021-08-19 15:42 - 2019-12-07 16:45 - 000000000 ____D C:\WINDOWS\en-GB
2021-08-19 15:42 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\ShellComponents
2021-08-19 15:42 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\Provisioning
2021-08-19 15:42 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
2021-08-19 15:42 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\DiagTrack
2021-08-19 15:42 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\bcastdvr
2021-08-19 15:42 - 2019-12-07 11:14 - 000000000 ____D C:\Program Files\Common Files\System
2021-08-19 15:42 - 2019-12-07 11:03 - 000000000 ____D C:\WINDOWS\servicing
2021-08-19 15:41 - 2020-11-27 17:21 - 000000000 ____D C:\Program Files\Microsoft Update Health Tools
2021-08-19 15:40 - 2019-12-07 16:49 - 000023552 _____ (Microsoft Corporation) C:\WINDOWS\system32\OEMDefaultAssociations.dll
2021-08-19 15:00 - 2019-10-10 15:06 - 000000000 ____D C:\Users\user\AppData\Local\PlaceholderTileLogoFolder
2021-08-19 15:00 - 2019-10-10 12:37 - 000000000 ____D C:\ProgramData\Packages
2021-08-18 16:38 - 2021-01-23 22:22 - 000003386 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore1d6ec0f202725f8
2021-08-18 16:38 - 2020-09-16 18:04 - 000003480 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
2021-08-18 16:24 - 2020-09-16 17:37 - 000123472 _____ (ESET) C:\WINDOWS\system32\Drivers\edevmon.sys
2021-08-18 16:24 - 2020-04-02 13:43 - 000194776 _____ (ESET) C:\WINDOWS\system32\Drivers\ehdrv.sys
2021-08-18 16:24 - 2020-04-02 13:43 - 000169424 _____ (ESET) C:\WINDOWS\system32\Drivers\eamonm.sys
2021-08-18 16:24 - 2020-04-02 13:43 - 000107456 _____ (ESET) C:\WINDOWS\system32\Drivers\epfwwfp.sys
2021-08-18 16:24 - 2020-04-02 13:43 - 000070232 _____ (ESET) C:\WINDOWS\system32\Drivers\epfw.sys
2021-08-18 16:24 - 2020-04-02 13:43 - 000043904 _____ (ESET) C:\WINDOWS\system32\Drivers\ekbdflt.sys
2021-08-14 17:22 - 2019-10-09 21:28 - 000000000 ____D C:\WINDOWS\system32\MRT
2021-08-14 17:20 - 2019-10-09 21:27 - 133215968 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2021-08-14 17:16 - 2019-10-09 14:59 - 000000000 ___RD C:\Users\user\OneDrive
2021-08-06 13:36 - 2021-02-16 20:48 - 000000000 ____D C:\WINDOWS\Minidump
2021-08-06 13:24 - 2021-02-16 20:48 - 1208873243 _____ C:\WINDOWS\MEMORY.DMP
2021-08-05 16:19 - 2020-09-16 18:04 - 000003420 _____ C:\WINDOWS\system32\Tasks\GoogleUpdateTaskMachineUA
2021-08-05 16:19 - 2020-09-16 18:04 - 000003296 _____ C:\WINDOWS\system32\Tasks\GoogleUpdateTaskMachineCore
==================== Files in the root of some directories ========
2019-10-11 16:56 - 2019-10-11 16:56 - 000000017 _____ () C:\Users\user\AppData\Local\resmon.resmoncfg
==================== SigCheck ============================
(There is no automatic fix for files that do not pass verification.)
==================== End of FRST.txt ========================
Sign In
Create Account
