[Dohnovan]

I'm just wondering if theres any malware, spyware or maybe a virus on my computer. I've scanned my pc with malwarebytes and it found nothing. I tried to scan my pc with eset online one time scanner but the program would not work it would open then close.

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 18-04-2022 01

Ran by Dohnovan (administrator) on DESKTOP-LBHF8BQ (Micro-Star International Co., Ltd MS-7A38) (18-04-2022 13:37:08)

Running from C:\Users\Dohnovan\Desktop

Loaded Profiles: Dohnovan

Platform: Microsoft Windows 10 Home Version 21H1 19043.1645 (X64) Language: English (United States)

Default browser: Chrome

Boot Mode: Normal

 

==================== Processes (Whitelisted) =================

 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

 

(Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\AMDRSServ.exe

(Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\RadeonSoftware.exe

(A-Volute -> ) C:\Program Files\SteelSeries\SS Audio\Foundation\SSAudioSvc32.exe

(A-Volute -> ) C:\Program Files\SteelSeries\SS Audio\Foundation\x64\SSAudioSvc64.exe

(C:\Program Files (x86)\Razer\Razer Services\Razer Central\Razer Central.exe ->) (Razer USA Ltd. -> The CefSharp Authors) C:\Program Files (x86)\Razer\Razer Services\Razer Central\CefSharp.BrowserSubprocess.exe <2>

(C:\Program Files (x86)\Razer\Razer Services\Razer Central\RazerCentralService.exe ->) (Razer USA Ltd. -> Razer Inc.) C:\Program Files (x86)\Razer\Razer Services\Razer Central\Razer Central.exe

(C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe ->) (Razer USA Ltd. -> ) C:\Program Files (x86)\Razer\Synapse3\UserProcess\Razer Synapse Service Process.exe

(C:\Program Files\AMD\CNext\CNext\AMDRSServ.exe ->) (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\amdow.exe

(C:\Program Files\AMD\CNext\CNext\AMDRSServ.exe ->) (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\AMDRSSrcExt.exe

(C:\Program Files\AMD\CNext\CNext\RadeonSoftware.exe ->) (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\cncmd.exe

(C:\Program Files\AMD\CNext\CNext\RadeonSoftware.exe ->) (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\QtWebEngineProcess.exe

(C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

(C:\Program Files\SteelSeries\GG\SteelSeriesGG.exe ->) (SteelSeries ApS -> SteelSeries ApS) C:\Program Files\SteelSeries\GG\SteelSeriesEngine.exe

(C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2203.5-0\MsMpEng.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2203.5-0\MpCopyAccelerator.exe

(Discord Inc. -> Discord Inc.) C:\Users\Dohnovan\AppData\Local\Discord\app-1.0.9004\Discord.exe <6>

(DriverStore\FileRepository\u0375709.inf_amd64_b5db6b3799486cf8\B375758\atiesrxx.exe ->) (Advanced Micro Devices Inc. -> AMD) C:\Windows\System32\DriverStore\FileRepository\u0375709.inf_amd64_b5db6b3799486cf8\B375758\atieclxx.exe

(explorer.exe ->) (Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe <20>

(explorer.exe ->) (SteelSeries ApS -> SteelSeries ApS) C:\Program Files\SteelSeries\GG\SteelSeriesGG.exe

(explorer.exe ->) (Support.com Inc -> SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE

(Razer USA Ltd. -> Razer Inc.) C:\Program Files (x86)\Razer\Synapse3\WPFUI\Framework\Razer Synapse 3 Host\Razer Synapse 3.exe

(services.exe ->) (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.) C:\Windows\System32\amdfendrsr.exe

(services.exe ->) (Advanced Micro Devices Inc. -> AMD) C:\Program Files\AMD\Performance Profile Client\AUEPDU.exe

(services.exe ->) (Advanced Micro Devices Inc. -> AMD) C:\Windows\System32\DriverStore\FileRepository\u0375709.inf_amd64_b5db6b3799486cf8\B375758\atiesrxx.exe

(services.exe ->) (Intel Corporation -> Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

(services.exe ->) (Intel Corporation -> Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe

(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe

(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2203.5-0\MsMpEng.exe

(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2203.5-0\NisSrv.exe

(services.exe ->) (Razer USA Ltd. -> Razer Inc) C:\Program Files (x86)\Razer\Razer Services\GMS\GameManagerService.exe

(services.exe ->) (Razer USA Ltd. -> Razer Inc.) C:\Program Files (x86)\Razer Chroma SDK\bin\RzSDKServer.exe

(services.exe ->) (Razer USA Ltd. -> Razer Inc.) C:\Program Files (x86)\Razer Chroma SDK\bin\RzSDKService.exe

(services.exe ->) (Razer USA Ltd. -> Razer Inc.) C:\Program Files (x86)\Razer\Razer Services\Razer Central\RazerCentralService.exe

(services.exe ->) (Razer USA Ltd. -> Razer Inc.) C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe

(services.exe ->) (SUPERAntiSpyware.com -> SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe

(services.exe ->) (SurfRight B.V. -> SurfRight B.V.) C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe <2>

(svchost.exe ->) (Adlice -> ) C:\Program Files\UCheck\UCheck64.exe

(svchost.exe ->) (Advanced Micro Devices Inc. -> AMD) C:\Program Files\AMD\Performance Profile Client\AUEPMaster.exe

(svchost.exe ->) (Advanced Micro Devices, Inc.) [File not signed] C:\Program Files\AMD\CNext\CNext\CPUMetricsServer.exe

(svchost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe

(svchost.exe ->) (Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2103.8.0_x64__8wekyb3d8bbwe\Calculator.exe

(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe

(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe <2>

(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MoUsoCoreWorker.exe

(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe

(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\wlanext.exe

 

==================== Registry (Whitelisted) ===================

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

 

HKLM\...\Run: [SteelSeriesGG] => C:\Program Files\SteelSeries\GG\SteelSeriesGG.exe [12691848 2022-04-06] (SteelSeries ApS -> SteelSeries ApS)

HKLM-x32\...\Run: [Discord] => C:\ProgramData\SquirrelMachineInstalls\Discord.exe [70858912 2021-07-15] (Discord Inc. -> Discord Inc.)

HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [4279208 2022-03-14] (Valve Corp. -> Valve Corporation)

HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\Run: [Synapse3] => C:\Program Files (x86)\Razer\Synapse3\WPFUI\Framework\Razer Synapse 3 Host\Razer Synapse 3.exe [3527240 2022-03-28] (Razer USA Ltd. -> Razer Inc.)

HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\Run: [Discord] => C:\Users\Dohnovan\AppData\Local\Discord\Update.exe [1512104 2021-05-24] (Discord Inc. -> GitHub)

HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [11223920 2021-07-06] (Support.com Inc -> SUPERAntiSpyware)

HKU\S-1-5-18\...\Run: [Synapse3] => C:\Program Files (x86)\Razer\Synapse3\WPFUI\Framework\Razer Synapse 3 Host\Razer Synapse 3.exe [3527240 2022-03-28] (Razer USA Ltd. -> Razer Inc.)

HKLM\Software\Microsoft\Active Setup\Installed Components: [OpenVPN_UserSetup] -> reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v OPENVPN-GUI /f

HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\100.0.4896.127\Installer\chrmstp.exe [2022-04-14] (Google LLC -> Google LLC)

HKLM\Software\Microsoft\Active Setup\Installed Components: [{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}] -> C:\Program Files\BraveSoftware\Brave-Browser\Application\100.1.37.116\Installer\chrmstp.exe [2022-04-15] (Brave Software, Inc. -> Brave Software, Inc.)

Startup: C:\Users\Dohnovan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spywareblaster.exe [2020-08-13] (BrightFort LLC -> )

GroupPolicy: Restriction ? <==== ATTENTION

HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION

HKLM\SOFTWARE\Policies\Microsoft\Edge: Restriction <==== ATTENTION

 

==================== Scheduled Tasks (Whitelisted) ============

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

Task: {08E5B611-4DA5-4724-BF5F-CEB73F9E0C7D} - System32\Tasks\SSAudioSvc64Run => C:\Program Files\Steelseries\SS Audio\Foundation\x64\SSAudioSvc64.exe [797088 2020-01-08] (A-Volute -> )

Task: {1D5281C1-A55E-4E9D-B7A3-2DB5C71C101D} - System32\Tasks\AMDLinkUpdate => C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe [1709048 2022-01-18] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)

Task: {24647903-7512-4ED6-84FA-CFF6B406287C} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2203.5-0\MpCmdRun.exe [993000 2022-04-07] (Microsoft Windows Publisher -> Microsoft Corporation)

Task: {2AFE60A3-3C00-4AF5-BFF5-8D96C9C8F860} - System32\Tasks\BraveSoftwareUpdateTaskMachineCore => C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe [155848 2020-09-19] (Brave Software, Inc. -> BraveSoftware Inc.)

Task: {2EB29D3E-78F2-4DC6-A4EE-8497FB17A281} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2203.5-0\MpCmdRun.exe [993000 2022-04-07] (Microsoft Windows Publisher -> Microsoft Corporation)

Task: {43727CF0-7152-44CE-B26F-0CB5B3497A6E} - System32\Tasks\Microsoft\Office\Office Performance Monitor => C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\operfmon.exe [61336 2022-04-05] (Microsoft Corporation -> Microsoft Corporation)

Task: {568E4EEF-5E99-4C66-B8E9-DA74BFF2DCA1} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153168 2018-01-14] (Google Inc -> Google Inc.)

Task: {5E706780-CE86-4A81-B224-D9DA2ABCA7EE} - System32\Tasks\Microsoft\Office\Office Automatic Updates 2.0 => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [22866856 2022-04-15] (Microsoft Corporation -> Microsoft Corporation)

Task: {72272DFC-049E-46D5-8C98-9563407B5D9D} - System32\Tasks\SSAudioSvc32Run => C:\Program Files\Steelseries\SS Audio\Foundation\SSAudioSvc32.exe [1299872 2020-01-08] (A-Volute -> )

Task: {7236DF21-1E55-4491-849E-6CF16FC17ABE} - System32\Tasks\Microsoft\Office\Office Feature Updates Logon => C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [138672 2022-04-15] (Microsoft Corporation -> Microsoft Corporation)

Task: {7D484749-46DF-40A9-AF50-007BE595726C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153168 2018-01-14] (Google Inc -> Google Inc.)

Task: {87B04948-F2EF-4300-AD2C-47DF5EC9915B} - System32\Tasks\ModifyLinkUpdate => C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe [1709048 2022-01-18] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)

Task: {9253C3DF-0C61-44DE-9EDB-B71638043C46} - System32\Tasks\CreateExplorerShellUnelevatedTask => C:\WINDOWS\Explorer.exe /NoUACCheck

Task: {9687B87A-B606-44FF-88E2-8020E46EA239} - System32\Tasks\AMDRyzenMasterSDKTask => C:\Program Files\AMD\CNext\CNext\cpumetricsserver.exe [358912 2022-01-18] (Advanced Micro Devices, Inc.) [File not signed]

Task: {9E104028-00F8-4343-A741-D04D706466C9} - System32\Tasks\Microsoft\Office\Office Feature Updates => C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [138672 2022-04-15] (Microsoft Corporation -> Microsoft Corporation)

Task: {A361A1B9-ECF6-4DAB-AE81-0CBB3CE76364} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2203.5-0\MpCmdRun.exe [993000 2022-04-07] (Microsoft Windows Publisher -> Microsoft Corporation)

Task: {AB26E664-0506-4CB4-A8F8-3A72DFF32411} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [22866856 2022-04-15] (Microsoft Corporation -> Microsoft Corporation)

Task: {B4A4857B-6463-4CEC-8C30-7D001E0F1070} - System32\Tasks\StartCN => C:\Program Files\AMD\CNext\CNext\cncmd.exe [55288 2022-01-18] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)

Task: {BC2173B5-C39F-40B2-99E4-F41B28F26961} - System32\Tasks\BraveSoftwareUpdateTaskMachineUA => C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe [155848 2020-09-19] (Brave Software, Inc. -> BraveSoftware Inc.)

Task: {BDA358F7-FD10-4FAB-A724-6CE5B18B18B1} - System32\Tasks\UCheck => C:\Program Files\UCheck\UCheck64.exe [29145424 2021-06-15] (Adlice -> )

Task: {C99E02F3-7020-4F2B-BC4E-0BF167D241C7} - System32\Tasks\StartAUEP => C:\Program Files\AMD\Performance Profile Client\AUEPMaster.exe [652792 2022-01-18] (Advanced Micro Devices Inc. -> AMD)

Task: {E56EFD6A-B11A-4B88-BA1D-D1F92E6D1F9B} - System32\Tasks\StartDVR => C:\Program Files\AMD\CNext\CNext\RSServCmd.exe [260600 2022-01-18] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)

Task: {EF4E4E8C-6B95-4C86-BBB9-529976E0A20A} - System32\Tasks\StartCNBM => C:\Program Files\AMD\CNext\CNext\cncmd.exe [55288 2022-01-18] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)

Task: {F5A18132-7CDE-447B-BEEB-C6B1E0BD1FB8} - System32\Tasks\AMDInstallLauncher => C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe [1709048 2022-01-18] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)

Task: {F7577032-6D72-4CEA-8E8B-86518785C2A5} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2203.5-0\MpCmdRun.exe [993000 2022-04-07] (Microsoft Windows Publisher -> Microsoft Corporation)

 

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

 

 

==================== Internet (Whitelisted) ====================

 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

 

Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76

Tcpip\..\Interfaces\{1a8f5a04-83c8-490b-b4bc-64e8c2c6fd6d}: [DhcpNameServer] 192.168.42.129

Tcpip\..\Interfaces\{1cd6b0cf-5059-4ef2-9609-a8d02c0c81b4}: [DhcpNameServer] 75.75.75.75 75.75.76.76

Tcpip\..\Interfaces\{3c01823b-a919-4197-a2ce-b7ef6cd5d03a}: [DhcpNameServer] 192.168.43.1

Tcpip\..\Interfaces\{57a5de9c-d2e2-48be-96b9-44b1389dcc84}: [DhcpNameServer] 75.75.75.75 75.75.76.76

Tcpip\..\Interfaces\{8f09853e-c450-47d3-b7bc-5aedbe848278}: [DhcpNameServer] 192.168.43.1

Tcpip\..\Interfaces\{dad6bf82-733a-495c-84a7-154afa6ad446}: [DhcpNameServer] 192.168.42.129

Tcpip\..\Interfaces\{e0510115-42dc-46d8-842a-cc54eeda8aa9}: [DhcpNameServer] 10.0.1.1

 

Edge: 

=======

Edge Extension: (Adblock Plus) -> 10_EyeoGmbHAdblockPlus_d55gg7py3s0m0 => C:\Program Files\WindowsApps\EyeoGmbH.AdblockPlus_0.9.19.0_neutral__d55gg7py3s0m0 [2021-10-07]

Edge Extension: (AdGuard AdBlocker) -> EdgeExtension_AdguardAdguardAdBlocker_m055xr0c82818 => C:\Program Files\WindowsApps\Adguard.AdguardAdBlocker_3.3.8.0_neutral__m055xr0c82818 [2020-01-11]

Edge DefaultProfile: Default

Edge Profile: C:\Users\Dohnovan\AppData\Local\Microsoft\Edge\User Data\Default [2022-04-10]

Edge Extension: (Adblock Plus - free ad blocker) - C:\Users\Dohnovan\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\gmgoamodcdcjnbaobigkjelfplakmdhh [2022-01-24]

Edge Extension: (AdGuard AdBlocker) - C:\Users\Dohnovan\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\pdffkfellgipmhklpdmokmckkkfcopbh [2022-01-24]

 

FireFox:

========

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL [2022-04-05] (Microsoft Corporation -> Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\NPSPWRAP.DLL [2022-03-03] (Microsoft Corporation -> Microsoft Corporation)

 

Chrome: 

=======

CHR DefaultProfile: Default

CHR Profile: C:\Users\Dohnovan\AppData\Local\Google\Chrome\User Data\Default [2022-04-18]

CHR Notifications: Default -> hxxps://www.youtube.com

CHR HomePage: Default -> hxxps://www.google.com/

CHR Extension: (Slides) - C:\Users\Dohnovan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2018-01-14]

CHR Extension: (Just Black) - C:\Users\Dohnovan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aghfnjkcakhmadgdomlmlhhaocbkloab [2021-12-20]

CHR Extension: (Docs) - C:\Users\Dohnovan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2018-01-14]

CHR Extension: (Google Drive) - C:\Users\Dohnovan\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2020-10-22]

CHR Extension: (YouTube) - C:\Users\Dohnovan\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2018-01-14]

CHR Extension: (Adblock Plus - free ad blocker) - C:\Users\Dohnovan\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2022-01-13]

CHR Extension: (Sheets) - C:\Users\Dohnovan\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2018-01-14]

CHR Extension: (Google Docs Offline) - C:\Users\Dohnovan\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2022-04-13]

CHR Extension: (MetaMask) - C:\Users\Dohnovan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nkbihfbeogaeaoehlefnkodbefgpgknn [2022-04-07]

CHR Extension: (Chrome Web Store Payments) - C:\Users\Dohnovan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2021-01-29]

CHR Extension: (Gmail) - C:\Users\Dohnovan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2020-10-22]

CHR Profile: C:\Users\Dohnovan\AppData\Local\Google\Chrome\User Data\System Profile [2021-10-05]

 

Brave: 

=======

BRA Profile: C:\Users\Dohnovan\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default [2022-04-17]

BRA Extension: (Brave Local Data Files Updater) - C:\Users\Dohnovan\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal [2022-04-17]

BRA Extension: (Brave NTP background images) - C:\Users\Dohnovan\AppData\Local\BraveSoftware\Brave-Browser\User Data\aoojcmojmmcbpfgoecoadbdpnagfchel [2022-04-11]

BRA Extension: (Wallet Data Files Updater) - C:\Users\Dohnovan\AppData\Local\BraveSoftware\Brave-Browser\User Data\BraveWallet [2022-04-17]

BRA Extension: (Brave Ad Block Updater (Default)) - C:\Users\Dohnovan\AppData\Local\BraveSoftware\Brave-Browser\User Data\cffkpbalmllkdoenhmdmpbkajipdjfam [2022-04-17]

BRA Extension: (Brave NTP sponsored images) - C:\Users\Dohnovan\AppData\Local\BraveSoftware\Brave-Browser\User Data\gccbbckogglekeggclmmekihdgdpdgoe [2022-04-17]

BRA Extension: (Brave SpeedReader Updater) - C:\Users\Dohnovan\AppData\Local\BraveSoftware\Brave-Browser\User Data\jicbkmdloagakknpihibphagfckhjdih [2022-04-07]

BRA Extension: (Brave HTTPS Everywhere Updater) - C:\Users\Dohnovan\AppData\Local\BraveSoftware\Brave-Browser\User Data\oofiananboodjbbmdelgdommihjbkfag [2022-04-17]

 

==================== Services (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [173472 2021-01-09] (SUPERAntiSpyware.com -> SUPERAntiSpyware.com)

R2 AUEPLauncher; C:\Program Files\AMD\CIM\..\Performance Profile Client\AUEPDU.exe [504824 2022-01-18] (Advanced Micro Devices Inc. -> AMD)

S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [8906088 2021-08-22] (BattlEye Innovations e.K. -> )

S2 brave; C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe [155848 2020-09-19] (Brave Software, Inc. -> BraveSoftware Inc.)

S3 bravem; C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe [155848 2020-09-19] (Brave Software, Inc. -> BraveSoftware Inc.)

R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [11666384 2022-04-05] (Microsoft Corporation -> Microsoft Corporation)

S3 EasyAntiCheat; C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe [802432 2020-08-10] (EasyAntiCheat Oy -> EasyAntiCheat Ltd)

R2 hmpalertsvc; C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe [5159632 2021-11-30] (SurfRight B.V. -> SurfRight B.V.)

S3 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [7901368 2021-11-22] (Malwarebytes Inc -> Malwarebytes)

R2 Razer Chroma SDK Server; C:\Program Files (x86)\Razer Chroma SDK\bin\RzSDKServer.exe [449664 2018-08-28] (Razer USA Ltd. -> Razer Inc.)

R2 Razer Chroma SDK Service; C:\Program Files (x86)\Razer Chroma SDK\bin\RzSDKService.exe [942720 2018-09-12] (Razer USA Ltd. -> Razer Inc.)

R2 Razer Game Manager Service; C:\Program Files (x86)\Razer\Razer Services\GMS\GameManagerService.exe [254224 2021-11-15] (Razer USA Ltd. -> Razer Inc)

R2 Razer Synapse Service; C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe [298056 2022-03-28] (Razer USA Ltd. -> Razer Inc.)

R2 RzActionSvc; C:\Program Files (x86)\Razer\Razer Services\Razer Central\RazerCentralService.exe [533824 2022-02-18] (Razer USA Ltd. -> Razer Inc.)

S3 SteelSeriesUpdateService; C:\Program Files\SteelSeries\GG\SteelSeriesUpdateService.exe [32648 2022-04-06] (SteelSeries ApS -> )

R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2203.5-0\NisSrv.exe [3116848 2022-04-07] (Microsoft Windows Publisher -> Microsoft Corporation)

R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2203.5-0\MsMpEng.exe [133544 2022-04-07] (Microsoft Windows Publisher -> Microsoft Corporation)

 

===================== Drivers (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

R3 amdfendrmgr; C:\WINDOWS\System32\drivers\amdfendrmgr.sys [33216 2021-12-02] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)

S3 amdkmafd; C:\WINDOWS\System32\drivers\amdkmafd.sys [49448 2016-08-18] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.)

S2 AMDRyzenMasterDriverV19; C:\WINDOWS\system32\AMDRyzenMasterDriver.sys [43336 2022-01-16] (Advanced Micro Devices INC. -> Advanced Micro Devices)

R3 AMDSAFD; C:\WINDOWS\System32\DriverStore\FileRepository\amdsafd.inf_amd64_edd3335a4253bf6d\amdsafd.sys [109520 2021-11-04] (Advanced Micro Devices Inc. -> Advanced Micro Devices)

R3 amdwddmg; C:\WINDOWS\System32\DriverStore\FileRepository\u0375709.inf_amd64_b5db6b3799486cf8\B375758\amdkmdag.sys [82940976 2022-01-17] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)

R3 AMDXE; C:\WINDOWS\System32\drivers\amdxe.sys [65168 2021-08-17] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)

S3 BthA2dp; C:\WINDOWS\System32\drivers\BthA2dp.sys [279040 2019-12-07] (Microsoft Corporation) [File not signed]

S3 BthHFEnum; C:\WINDOWS\System32\drivers\bthhfenum.sys [144896 2019-12-07] (Microsoft Corporation) [File not signed]

R1 hmpalert; C:\WINDOWS\system32\drivers\hmpalert.sys [412664 2021-11-30] (Microsoft Windows Hardware Compatibility Publisher -> SurfRight B.V.)

S0 MbamElam; C:\WINDOWS\System32\DRIVERS\MbamElam.sys [19912 2021-02-21] (Microsoft Windows Early Launch Anti-malware Publisher -> Malwarebytes)

S3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [248992 2021-05-31] (Malwarebytes Inc -> Malwarebytes)

R1 ndextlag; C:\WINDOWS\system32\DRIVERS\ndextlag.sys [48640 2018-04-11] (Mainline Net Holdings Limited -> SKOWSAND SERVICOS DE PROVEDORES E INTERNET LTDA - ME)

S3 ocznvme; C:\WINDOWS\System32\drivers\ocznvme.sys [99592 2016-06-10] (Toshiba America Electronic Components, Inc. -> TOSHIBA CORPORATION)

S3 ocztrimfilter; C:\WINDOWS\System32\drivers\ocztrimfilter.sys [29064 2016-06-10] (Toshiba America Electronic Components, Inc. -> TOSHIBA CORPORATION)

R3 RzCommon; C:\WINDOWS\System32\drivers\RzCommon.sys [54632 2021-03-30] (Razer USA Ltd. -> Razer Inc)

R3 RzDev_0067; C:\WINDOWS\System32\drivers\RzDev_0067.sys [54152 2020-08-24] (Razer USA Ltd. -> Razer Inc)

R3 RzDev_024e; C:\WINDOWS\System32\drivers\RzDev_024e.sys [54168 2020-08-24] (Razer USA Ltd. -> Razer Inc)

R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2021-01-09] (Support.com, Inc. -> SUPERAdBlocker.com and SUPERAntiSpyware.com)

R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2021-01-09] (Support.com, Inc. -> SUPERAdBlocker.com and SUPERAntiSpyware.com)

S3 secnvme; C:\WINDOWS\System32\drivers\secnvme.sys [135688 2016-12-09] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd)

R3 ssdevfactory; C:\WINDOWS\System32\drivers\ssdevfactory.sys [48848 2020-09-25] (SteelSeries ApS -> SteelSeries ApS)

R3 SteelSeries_Sonar_VAD; C:\WINDOWS\System32\DriverStore\FileRepository\steelseries-sonar-vad.inf_amd64_6f6e907eca1efa31\SteelSeries-Sonar-VAD.sys [89568 2022-03-23] (SteelSeries ApS -> Windows ® Win 7 DDK provider)

R3 tap0901; C:\WINDOWS\System32\drivers\tap0901.sys [47920 2020-02-20] (Microsoft Windows Hardware Compatibility Publisher -> The OpenVPN Project)

S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [49600 2022-04-07] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)

R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [443664 2022-04-07] (Microsoft Windows -> Microsoft Corporation)

R3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [90384 2022-04-07] (Microsoft Windows -> Microsoft Corporation)

S3 xhunter1; C:\WINDOWS\xhunter1.sys [47096 2018-02-18] (Wellbia.com Co., Ltd. -> Wellbia.com Co., Ltd.)

S3 cpuz149; \??\C:\Users\Dohnovan\AppData\Local\Temp\cpuz149\cpuz149_x64.sys [X] <==== ATTENTION

 

==================== NetSvcs (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

 

==================== One month (created) (Whitelisted) =========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2022-04-18 13:37 - 2022-04-18 13:39 - 000027262 _____ C:\Users\Dohnovan\Desktop\FRST.txt

2022-04-18 13:36 - 2022-04-18 13:36 - 000000000 ____D C:\Users\Dohnovan\Desktop\FRST-OlderVersion

2022-04-18 13:35 - 2022-04-18 13:38 - 000000000 ____D C:\FRST

2022-04-18 13:34 - 2022-04-18 13:36 - 002366464 _____ (Farbar) C:\Users\Dohnovan\Desktop\FRST64.exe

2022-04-14 11:19 - 2022-04-14 11:19 - 000105072 _____ C:\Users\Dohnovan\Downloads\DDixon2022w4.pdf

2022-04-12 17:32 - 2022-04-12 17:32 - 000039936 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll

2022-04-12 17:32 - 2022-04-12 17:32 - 000011803 _____ C:\WINDOWS\system32\DrtmAuthTxt.wim

2022-04-12 17:31 - 2022-04-12 17:31 - 000048640 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll

2022-04-12 17:30 - 2022-04-12 17:30 - 000162816 _____ C:\WINDOWS\system32\DataStoreCacheDumpTool.exe

2022-04-12 16:59 - 2022-04-12 16:59 - 000000000 ___HD C:\$WinREAgent

2022-04-10 07:24 - 2022-04-10 07:24 - 015274968 _____ (ESET) C:\Users\Dohnovan\Downloads\esetonlinescanner (1).exe

2022-04-08 18:33 - 2022-04-08 18:33 - 000012261 _____ C:\Users\Dohnovan\Downloads\_ActionBarSaver-r20100719.zip

2022-04-05 14:07 - 2022-04-18 09:48 - 000003084 _____ C:\WINDOWS\system32\Tasks\AMDLinkUpdate

2022-03-30 11:56 - 2022-03-30 11:56 - 000000000 ____D C:\Program Files\Google

2022-03-29 09:44 - 2022-03-29 09:44 - 000000025 _____ C:\Users\Dohnovan\Desktop\snapchat code.txt

2022-03-24 18:44 - 2022-03-24 18:44 - 000000009 _____ C:\Users\Dohnovan\Desktop\facebook pass.txt

2022-03-21 14:32 - 2022-03-21 14:32 - 000000011 _____ C:\Users\Dohnovan\Desktop\Richards discord info.txt

2022-03-20 18:03 - 2022-03-20 20:39 - 000000452 _____ C:\Users\Dohnovan\Desktop\how I'm treated at work.txt

 

==================== One month (modified) ==================

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2022-04-18 13:32 - 2018-01-14 11:41 - 000000000 ____D C:\Program Files (x86)\Google

2022-04-18 13:31 - 2020-12-09 20:01 - 000000000 ____D C:\Users\Dohnovan\AppData\Roaming\discord

2022-04-18 13:30 - 2021-07-15 19:23 - 000000000 ____D C:\Users\Dohnovan\AppData\Local\Discord

2022-04-18 13:19 - 2019-12-07 03:14 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft

2022-04-18 13:14 - 2022-01-07 20:15 - 000033170 _____ C:\Users\Dohnovan\Desktop\Math Notes.txt

2022-04-18 10:39 - 2021-10-07 12:43 - 000000000 ____D C:\WINDOWS\system32\SleepStudy

2022-04-18 09:48 - 2022-01-21 17:08 - 000003124 _____ C:\WINDOWS\system32\Tasks\AMDInstallLauncher

2022-04-17 05:20 - 2020-06-13 10:56 - 000002445 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk

2022-04-17 05:20 - 2020-06-13 10:56 - 000002283 _____ C:\Users\Public\Desktop\Microsoft Edge.lnk

2022-04-17 05:20 - 2019-12-07 03:14 - 000000000 ___HD C:\Program Files\WindowsApps

2022-04-17 05:20 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\AppReadiness

2022-04-15 17:17 - 2021-01-04 11:37 - 000000000 ____D C:\Users\Dohnovan\AppData\Local\AMD_Common

2022-04-15 09:04 - 2017-04-07 15:15 - 000000000 ____D C:\Program Files\Microsoft Office

2022-04-15 05:11 - 2020-09-19 15:59 - 000002371 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brave.lnk

2022-04-15 05:11 - 2020-09-19 15:59 - 000002330 _____ C:\Users\Public\Desktop\Brave.lnk

2022-04-14 19:33 - 2018-01-14 11:42 - 000002308 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

2022-04-14 19:33 - 2018-01-14 11:42 - 000002267 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2022-04-13 08:46 - 2019-12-07 03:13 - 000000000 ____D C:\WINDOWS\INF

2022-04-13 08:42 - 2021-10-07 13:06 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT

2022-04-13 08:42 - 2020-06-18 15:39 - 000008192 ___SH C:\DumpStack.log.tmp

2022-04-13 08:42 - 2019-06-19 15:54 - 000000000 ____D C:\ProgramData\HitmanPro.Alert

2022-04-12 20:41 - 2019-12-07 03:03 - 000524288 _____ C:\WINDOWS\system32\config\BBI

2022-04-12 20:41 - 2017-04-11 10:49 - 000065536 _____ C:\WINDOWS\system32\spu_storage.bin

2022-04-12 20:40 - 2021-10-07 12:59 - 000840598 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2022-04-12 20:35 - 2021-10-07 12:43 - 000436016 _____ C:\WINDOWS\system32\FNTCACHE.DAT

2022-04-12 20:32 - 2019-12-07 03:14 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel

2022-04-12 20:32 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism

2022-04-12 20:32 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\SystemResources

2022-04-12 20:32 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\system32\oobe

2022-04-12 20:32 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\system32\Dism

2022-04-12 20:32 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\ShellExperiences

2022-04-12 20:32 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\Provisioning

2022-04-12 20:32 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\PolicyDefinitions

2022-04-12 20:32 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\bcastdvr

2022-04-12 17:41 - 2019-12-07 03:03 - 000000000 ____D C:\WINDOWS\CbsTemp

2022-04-12 16:30 - 2017-12-09 11:41 - 000000000 ____D C:\WINDOWS\system32\MRT

2022-04-12 16:23 - 2017-12-09 11:40 - 143823848 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

2022-04-10 20:36 - 2021-03-23 18:05 - 000000000 ____D C:\ProgramData\TEMP

2022-04-10 07:52 - 2022-01-22 23:56 - 000001388 _____ C:\Users\Dohnovan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ESET Online Scanner.lnk

2022-04-10 06:48 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\LiveKernelReports

2022-04-08 21:52 - 2017-12-08 22:06 - 000000000 ____D C:\Program Files (x86)\Steam

2022-04-08 18:57 - 2020-06-03 11:41 - 000000000 ____D C:\Users\Dohnovan\Desktop\World of Warcraft 3.3.5a

2022-04-08 08:15 - 2017-12-09 12:50 - 000000000 ____D C:\ProgramData\SteelSeries

2022-04-07 22:59 - 2021-09-14 23:23 - 000000075 _____ C:\Users\Dohnovan\Desktop\settings.sav

2022-04-07 21:35 - 2018-05-21 16:36 - 000000000 ____D C:\Users\Dohnovan\AppData\Local\D3DSCache

2022-04-07 16:33 - 2019-06-22 23:06 - 000000000 ____D C:\Users\Dohnovan\Documents\The Witcher 3

2022-04-07 16:26 - 2017-12-13 05:05 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd

2022-04-06 17:06 - 2021-12-12 23:08 - 000003588 _____ C:\WINDOWS\system32\Tasks\OneDrive Reporting Task-S-1-5-21-2108490749-413910539-1021375685-1003

2022-04-06 17:06 - 2021-10-07 13:06 - 000003384 _____ C:\WINDOWS\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-2108490749-413910539-1021375685-1003

2022-04-06 17:06 - 2021-10-07 12:14 - 000002395 _____ C:\Users\Dohnovan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk

2022-04-06 11:15 - 2018-03-13 16:34 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Razer

2022-04-06 11:14 - 2021-10-09 20:23 - 000003386 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore1d7bbac9216e929

2022-04-06 11:14 - 2021-10-07 13:06 - 000003510 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA1d6b1325f7ebb04

2022-04-05 19:26 - 2021-10-07 12:14 - 000000000 ____D C:\Users\Dohnovan

2022-04-05 00:55 - 2020-11-20 01:36 - 000000000 ____D C:\Program Files\Microsoft Update Health Tools

2022-03-28 11:03 - 2019-06-22 23:43 - 000000000 ____D C:\Users\Dohnovan\Desktop\Scriptmerger

2022-03-23 21:13 - 2020-11-20 01:36 - 000601432 _____ (Microsoft Corporation) C:\WINDOWS\system32\sedplugins.dll

2022-03-23 21:12 - 2020-11-20 01:36 - 000483664 _____ (Microsoft Corporation) C:\WINDOWS\system32\QualityUpdateAssistant.dll

 

==================== Files in the root of some directories ========

 

2021-03-01 20:52 - 2021-03-08 23:19 - 000007598 _____ () C:\Users\Dohnovan\AppData\Local\Resmon.ResmonCfg

 

==================== SigCheck ============================

 

(There is no automatic fix for files that do not pass verification.)

 

==================== End of FRST.txt ========================

 

 

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-04-2022 01

Ran by Dohnovan (18-04-2022 13:41:34)

Running from C:\Users\Dohnovan\Desktop

Microsoft Windows 10 Home Version 21H1 19043.1645 (X64) (2021-10-07 19:07:44)

Boot Mode: Normal

==========================================================

 

 

==================== Accounts: =============================

 

 

(If an entry is included in the fixlist, it will be removed.)

 

Administrator (S-1-5-21-2108490749-413910539-1021375685-500 - Administrator - Disabled)

DefaultAccount (S-1-5-21-2108490749-413910539-1021375685-503 - Limited - Disabled)

defaultuser0 (S-1-5-21-2108490749-413910539-1021375685-1002 - Limited - Disabled)

Dohnovan (S-1-5-21-2108490749-413910539-1021375685-1003 - Administrator - Enabled) => C:\Users\Dohnovan

Guest (S-1-5-21-2108490749-413910539-1021375685-501 - Limited - Disabled)

WDAGUtilityAccount (S-1-5-21-2108490749-413910539-1021375685-504 - Limited - Disabled)

 

==================== Security Center ========================

 

(If an entry is included in the fixlist, it will be removed.)

 

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AV: Malwarebytes (Disabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 

==================== Installed Programs ======================

 

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 

Advanced Combat Tracker (remove only) (HKLM-x32\...\Advanced Combat Tracker) (Version:  - )

AMD Software (HKLM\...\AMD Catalyst Install Manager) (Version: 22.1.2 - Advanced Micro Devices, Inc.)

APOInstallerMSISetup (HKLM\...\{5C4734F8-9AF3-4324-A36E-DC147853B2F5}) (Version: 1.2.1101 - Steelseries) Hidden

Asmedia USB Host Controller Driver (HKLM-x32\...\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.16.36.1 - Asmedia Technology)

AudioDeviceFXPluginSampleUIMSISetup (HKLM\...\{C9BA81B6-4A0F-454A-B331-81A45A57573E}) (Version: 1.2.1101 - Steelseries) Hidden

Belarc Advisor 9.0 (HKLM-x32\...\Belarc Advisor) (Version: 9.0.0.0 - Belarc Inc.)

Black Desert (HKLM-x32\...\BlackDesert_NA_is1) (Version: 1.0 - PearlAbyss Corp.)

Branding64 (HKLM\...\{15E10477-5999-498F-A988-E22FAA096B5E}) (Version: 1.00.0008 - Advanced Micro Devices, Inc.) Hidden

Brave (HKLM-x32\...\BraveSoftware Brave-Browser) (Version: 100.1.37.116 - Brave Software Inc)

Discord (HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\Discord) (Version: 1.0.9002 - Discord Inc.)

ExitLag version 4.183 (HKLM-x32\...\{B3117F72-F22D-4DA7-B554-B3F4EDBB408F}_is1) (Version: 4.183 - ExitLag)

FINAL FANTASY XIV ONLINE (HKLM-x32\...\{2B41E132-07DF-4925-A3D3-F2D1765CCDFE}) (Version: 1.0.0000 - SQUARE ENIX CO., LTD.)

Genshin Impact (HKLM\...\Genshin Impact) (Version: 2.14.1.0 - miHoYo Co.,Ltd)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 100.0.4896.127 - Google LLC)

Google Update Helper (HKLM-x32\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.99.0 - Google Inc.) Hidden

Harver System Checker 2.0.6 (HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\57ba83c7-44cc-50c5-93e2-68092ebb1ce7) (Version: 2.0.6 - Harver)

HitmanPro.Alert 3 (HKLM\...\HitmanPro.Alert) (Version: 3.8.19.923 - SurfRight B.V.)

Intel® Wireless Bluetooth® (HKLM-x32\...\{0E13241D-76B0-4A4C-9665-3969F55C08D5}) (Version: 19.40.1702.1091 - Intel Corporation)

Intel® PROSet/Wireless Software (HKLM-x32\...\{263d87d0-9772-40be-ab36-eabbdbff49f7}) (Version: 21.20.1 - Intel Corporation)

Malwarebytes version 4.4.11.149 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 4.4.11.149 - Malwarebytes)

Microsoft 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 16.0.15028.20204 - Microsoft Corporation)

Microsoft Edge (HKLM-x32\...\Microsoft Edge) (Version: 100.0.1185.44 - Microsoft Corporation)

Microsoft Edge WebView2 Runtime (HKLM-x32\...\Microsoft EdgeWebView) (Version: 100.0.1185.44 - Microsoft Corporation)

Microsoft OneDrive (HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\OneDriveSetup.exe) (Version: 22.055.0313.0001 - Microsoft Corporation)

Microsoft Update Health Tools (HKLM\...\{7B1FCD52-8F6B-4F12-A143-361EA39F5E7C}) (Version: 3.67.0.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)

Microsoft Visual C++ 2015-2019 Redistributable (x64) - 14.29.30133 (HKLM-x32\...\{295d1583-fdb9-414b-a4c8-da539362a26b}) (Version: 14.29.30133.0 - Microsoft Corporation)

Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.29.30133 (HKLM-x32\...\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}) (Version: 14.29.30133.0 - Microsoft Corporation)

Nexon Launcher (HKLM-x32\...\Nexon Nexon Launcher) (Version: 2.1.0 - Nexon)

NVIDIA PhysX (HKLM-x32\...\{B455E95A-B804-439F-B533-336B1635AE97}) (Version: 9.14.0702 - NVIDIA Corporation)

Office 16 Click-to-Run Extensibility Component (HKLM\...\{90160000-008C-0000-1000-0000000FF1CE}) (Version: 16.0.15028.20050 - Microsoft Corporation) Hidden

Office 16 Click-to-Run Licensing Component (HKLM\...\{90160000-007E-0000-1000-0000000FF1CE}) (Version: 16.0.15028.20160 - Microsoft Corporation) Hidden

Office 16 Click-to-Run Localization Component (HKLM\...\{90160000-008C-0409-1000-0000000FF1CE}) (Version: 16.0.14131.20278 - Microsoft Corporation) Hidden

ProductDaemonSetup (HKLM\...\{C31282E4-C1A3-433C-A803-D9ED4A99DC8F}) (Version: 1.2.1101 - Steelseries) Hidden

Razer Chroma SDK (HKLM-x32\...\Razer Chroma SDK) (Version: 2.21.1 - Razer Inc.)

Razer Synapse (HKLM-x32\...\Razer Synapse) (Version: 3.7.0331.032911 - Razer Inc.)

Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.10.714.2016 - Realtek)

Revo Uninstaller 2.2.8 (HKLM\...\{A28DBDA2-3CC7-4ADC-8BFE-66D7743C6C97}_is1) (Version: 2.2.8 - VS Revo Group, Ltd.)

Rockstar Games Social Club (HKLM-x32\...\Rockstar Games Social Club) (Version: 1.2.4.1 - Rockstar Games)

RyzenMasterSDK (HKLM\...\{170E2572-C6EB-43BA-A6B4-B768B57C5D65}) (Version: 1.2.3.5 - Advanced Micro Devices, Inc.) Hidden

Speccy (HKLM\...\Speccy) (Version: 1.32 - Piriform)

SpywareBlaster 6.0 (HKLM-x32\...\SpywareBlaster_is1) (Version: 6.0.0 - BrightFort LLC)

SSAudio (HKLM-x32\...\{1c112a1f-1120-415d-85ab-7a3de5b0a9c2}) (Version: 1.2.1101 - Steelseries)

SSAudioDaemonMSISetup (HKLM\...\{CDEA766D-38C5-448B-8316-02D01C842E1E}) (Version: 1.2.1101 - Steelseries) Hidden

Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)

SteelSeries GG 17.1.0 (HKLM\...\SteelSeries GG) (Version: 17.1.0 - SteelSeries ApS)

SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 10.0.1220 - SUPERAntiSpyware.com)

The Witcher 3 Mod Manager (HKLM\...\{B8F09437-C8B5-4DFD-B655-C93E8C05A8DE}) (Version: 0.6.4 - stefan3372)

UCheck version 4.0.6.0 (HKLM\...\C4E7EE54-826F-41C4-BE3C-375CC70DC1D8_is1) (Version: 4.0.6.0 - Adlice Software)

ULauncher (HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\ULauncher) (Version: 0.33.52 - uwow.biz)

Update for Windows 10 for x64-based Systems (KB4023057) (HKLM\...\{F14FB68A-9188-4036-AD0D-D054BC9C9291}) (Version: 2.59.0.0 - Microsoft Corporation)

Vulkan Run Time Libraries 1.0.39.1 (HKLM\...\VulkanRT1.0.39.1) (Version: 1.0.39.1 - LunarG, Inc.)

Vulkan Run Time Libraries 1.0.61.0 (HKLM\...\VulkanRT1.0.61.0) (Version: 1.0.61.0 - LunarG, Inc.) Hidden

Vulkan Run Time Libraries 1.0.65.0 (HKLM\...\VulkanRT1.0.65.0) (Version: 1.0.65.0 - LunarG, Inc.) Hidden

Vulkan Run Time Libraries 1.0.65.0 (HKLM\...\VulkanRT1.0.65.0-3) (Version: 1.0.65.0 - LunarG, Inc.) Hidden

Windows PC Health Check (HKLM\...\{B1E7D0FD-7CFE-4E0C-A5DA-0F676499DB91}) (Version: 3.2.2110.14001 - Microsoft Corporation)

WinRAR 6.02 (64-bit) (HKLM\...\WinRAR archiver) (Version: 6.02.0 - win.rar GmbH)

Zoom (HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\ZoomUMX) (Version: 5.8.4 (1736) - Zoom Video Communications, Inc.)

 

Packages:

=========

9 zip -> C:\Program Files\WindowsApps\184MagikHub.9zip_3.3.75.0_x64__hvr7qkvwfhvx6 [2020-07-19] (Magik Hub) [MS Ad]

Adblock Plus -> C:\Program Files\WindowsApps\EyeoGmbH.AdblockPlus_0.9.19.0_neutral__d55gg7py3s0m0 [2021-10-07] (eyeo GmbH)

AdGuard AdBlocker -> C:\Program Files\WindowsApps\Adguard.AdguardAdBlocker_3.3.8.0_neutral__m055xr0c82818 [2020-01-11] (Performix)

Autodesk SketchBook -> C:\Program Files\WindowsApps\89006A2E.AutodeskSketchBook_5.1.0.0_x64__tf1gferkr813w [2019-11-06] (Autodesk Inc.)

Bubble Witch 3 Saga -> C:\Program Files\WindowsApps\king.com.BubbleWitch3Saga_7.17.65.0_x86__kgqvnymyfvs32 [2022-03-30] (king.com)

Candy Crush Soda Saga -> C:\Program Files\WindowsApps\king.com.CandyCrushSodaSaga_1.215.400.0_x64__kgqvnymyfvs32 [2022-04-08] (king.com)

Disney Magic Kingdoms -> C:\Program Files\WindowsApps\A278AB0D.DisneyMagicKingdoms_6.7.12.0_x86__h6adky7gbf63m [2022-03-09] (Gameloft SE)

Hidden City: Hidden Object Adventure -> C:\Program Files\WindowsApps\828B5831.HiddenCityMysteryofShadows_1.47.4702.0_x86__ytsefhwckbdv6 [2022-04-14] (G5 Entertainment AB)

HP Smart -> C:\Program Files\WindowsApps\AD2F1837.HPPrinterControl_135.1.385.0_x64__v10z8vjag6ke6 [2022-03-22] (HP Inc.)

March of Empires: War of Lords -> C:\Program Files\WindowsApps\A278AB0D.MarchofEmpires_6.3.1.0_x86__h6adky7gbf63m [2022-04-14] (Gameloft SE)

Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x64__8wekyb3d8bbwe [2021-10-07] (Microsoft Corporation) [MS Ad]

Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x86__8wekyb3d8bbwe [2021-10-07] (Microsoft Corporation) [MS Ad]

Microsoft Solitaire Collection -> C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.12.3171.0_x64__8wekyb3d8bbwe [2022-03-24] (Microsoft Studios) [MS Ad]

Minecraft for Windows 10 -> C:\Program Files\WindowsApps\Microsoft.MinecraftUWP_1.18.1201.0_x64__8wekyb3d8bbwe [2022-02-16] (Microsoft Studios)

Photos Media Engine Add-on -> C:\Program Files\WindowsApps\Microsoft.Photos.MediaEngineDLC_1.0.0.0_x64__8wekyb3d8bbwe [2020-04-05] (Microsoft Corporation)

Plex -> C:\Program Files\WindowsApps\CAF9E577.Plex_3.2.20.0_x64__aam28m9va5cke [2017-12-09] (Plex)

Xbox One SmartGlass -> C:\Program Files\WindowsApps\Microsoft.XboxOneSmartGlass_2.2.1702.2004_x64__8wekyb3d8bbwe [2017-12-27] (Microsoft Corporation)

 

==================== Custom CLSID (Whitelisted): ==============

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

ShellIconOverlayIdentifiers: [HitmanPro.Alert Shell Extension] -> {6FAC02B7-77D6-418B-AC11-962C65CDE8DD} => C:\WINDOWS\system32\hmpshell.dll [2021-11-30] (SurfRight B.V. -> SurfRight B.V.)

ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2021-06-11] (win.rar GmbH -> Alexander Roshal)

ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2021-06-11] (win.rar GmbH -> Alexander Roshal)

ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2021-02-21] (Malwarebytes Corporation -> Malwarebytes)

ContextMenuHandlers5: [ACE] -> {5E2121EE-0300-11D4-8D3B-444553540000} => C:\WINDOWS\System32\atiacm64.dll [2022-01-17] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)

ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2021-02-21] (Malwarebytes Corporation -> Malwarebytes)

ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2021-06-11] (win.rar GmbH -> Alexander Roshal)

ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2021-06-11] (win.rar GmbH -> Alexander Roshal)

 

==================== Codecs (Whitelisted) ====================

 

==================== Shortcuts & WMI ========================

 

==================== Loaded Modules (Whitelisted) =============

 

2021-04-21 03:30 - 2021-04-21 03:30 - 000017920 _____ () [File not signed] C:\Program Files\AMD\CNext\CNext\libEGL.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 003567616 _____ () [File not signed] C:\Program Files\AMD\CNext\CNext\libGLESv2.dll

2021-11-12 22:17 - 2021-11-12 22:17 - 000912896 _____ () [File not signed] C:\Program Files\AMD\Performance Profile Client\aws-cpp-sdk-core.dll

2021-11-12 22:17 - 2021-11-12 22:17 - 003109888 _____ () [File not signed] C:\Program Files\AMD\Performance Profile Client\aws-cpp-sdk-s3.dll

2022-01-18 00:17 - 2022-01-18 00:17 - 000562688 _____ (Advanced Micro Devices) [File not signed] C:\Program Files\AMD\CNext\CNext\Device.dll

2022-01-18 00:17 - 2022-01-18 00:17 - 000058880 _____ (Advanced Micro Devices) [File not signed] C:\Program Files\AMD\CNext\CNext\Platform.dll

2022-01-18 01:45 - 2022-01-18 01:45 - 001717248 _____ (Advanced Micro Devices, Inc.) [File not signed] C:\Program Files\AMD\WVR\OpenVR\bin\win64\driver_amdwvr.dll

2021-12-06 11:11 - 2021-12-06 11:11 - 002146304 _____ (Holtek Semiconductor Inc.) [File not signed] C:\Program Files\SteelSeries\GG\HIDDLL.dll

2021-12-06 11:11 - 2021-12-06 11:11 - 002284032 _____ (Holtek) [File not signed] C:\Program Files\SteelSeries\GG\ISPDLL.dll

2017-09-05 00:15 - 2017-09-05 00:15 - 004396032 _____ (Microsoft Corporation) [File not signed] C:\Program Files\AMD\CNext\CNext\D3DCompiler_47.dll

2020-04-19 10:41 - 2020-04-19 10:41 - 000000000 ____L (Microsoft Corporation) [simlink -> C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppvIsvSubsystems64.dll] C:\Program Files\Microsoft Office\Root\Office16\AppVIsvSubsystems64.dll

2020-04-19 10:41 - 2020-04-19 10:41 - 000000000 ____L (Microsoft Corporation) [simlink -> C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2R64.dll] C:\Program Files\Microsoft Office\Root\Office16\c2r64.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000057856 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\plugins\audio\qtaudio_windows.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000031744 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\plugins\imageformats\qgif.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000039424 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\plugins\imageformats\qicns.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000031232 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\plugins\imageformats\qico.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000415232 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\plugins\imageformats\qjpeg.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000025088 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\plugins\imageformats\qsvg.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000025088 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\plugins\imageformats\qtga.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000023552 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\plugins\imageformats\qwbmp.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000532992 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\plugins\imageformats\qwebp.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 001455104 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\plugins\platforms\qwindows.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 001227776 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\plugins\sqldrivers\qsqlite.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000135680 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\plugins\styles\qwindowsvistastyle.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 006270976 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5Core.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 006947328 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5Gui.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000740352 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5Multimedia.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000123392 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5MultimediaQuick.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 001110528 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5Network.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000326656 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5Positioning.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 003798528 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5Qml.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000440832 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5QmlModels.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000054784 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5QmlWorkerScript.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 004255744 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5Quick.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000171520 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5QuickControls2.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 001128448 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5QuickTemplates2.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000206336 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5Sql.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000334336 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5Svg.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000133120 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5WebChannel.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000396800 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5WebEngine.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 102854656 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5WebEngineCore.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 005611008 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5Widgets.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000463360 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5WinExtras.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000210432 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5Xml.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 002877440 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5XmlPatterns.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000056832 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\QtGraphicalEffects\private\qtgraphicaleffectsprivate.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000059392 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\QtGraphicalEffects\qtgraphicaleffectsplugin.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000267776 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\QtMultimedia\declarative_multimedia.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000017408 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\QtQml\qmlplugin.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000017920 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\QtQuick.2\qtquick2plugin.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000290816 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\QtQuick\Controls.2\qtquickcontrols2plugin.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000336896 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\QtQuick\Controls\qtquickcontrolsplugin.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000134144 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\QtQuick\Dialogs\dialogplugin.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000106496 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\QtQuick\Layouts\qquicklayoutsplugin.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000325120 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\QtQuick\Templates.2\qtquicktemplates2plugin.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000045568 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\QtQuick\Window.2\windowplugin.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000093184 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\QtWebEngine\qtwebengineplugin.dll

 

==================== Alternate Data Streams (Whitelisted) ========

 

(If an entry is included in the fixlist, only the ADS will be removed.)

 

AlternateDataStreams: C:\ProgramData\TEMP:5C321E34 [274]

 

==================== Safe Mode (Whitelisted) ==================

 

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

 

==================== Association (Whitelisted) =================

 

==================== Internet Explorer (Whitelisted) ==========

 

HKU\S-1-5-21-2108490749-413910539-1021375685-1003\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://oem17win10.msn.com/?pc=NMTE

BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll [2022-03-03] (Microsoft Corporation -> Microsoft Corporation)

Handler-x32: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files (x86)\Belarc\BelarcAdvisor\System\BAVoilaX.dll [2019-01-25] (Belarc, Inc. -> Belarc, Inc.)

Handler: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2022-04-05] (Microsoft Corporation -> Microsoft Corporation)

Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2022-04-05] (Microsoft Corporation -> Microsoft Corporation)

Handler: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2022-04-05] (Microsoft Corporation -> Microsoft Corporation)

Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2022-04-05] (Microsoft Corporation -> Microsoft Corporation)

Handler: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2022-04-05] (Microsoft Corporation -> Microsoft Corporation)

Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2022-04-05] (Microsoft Corporation -> Microsoft Corporation)

Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2022-04-05] (Microsoft Corporation -> Microsoft Corporation)

Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2022-04-05] (Microsoft Corporation -> Microsoft Corporation)

 

(If an entry is included in the fixlist, it will be removed from the registry.)

 

IE restricted site: HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\008i.com -> 008i.com

IE restricted site: HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\008k.com -> 008k.com

IE restricted site: HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\00hq.com -> 00hq.com

IE restricted site: HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\0190-dialers.com -> 0190-dialers.com

IE restricted site: HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\01i.info -> 01i.info

IE restricted site: HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com

IE restricted site: HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\0411dd.com -> 0411dd.com

IE restricted site: HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\0511zfhl.com -> 0511zfhl.com

IE restricted site: HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\05p.com -> 05p.com

IE restricted site: HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\0632qyw.com -> 0632qyw.com

IE restricted site: HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com

IE restricted site: HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com

IE restricted site: HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com

IE restricted site: HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\0calories.net -> 0calories.net

IE restricted site: HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\0cj.net -> 0cj.net

IE restricted site: HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\0scan.com -> 0scan.com

IE restricted site: HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\1-britney-spears-nude.com -> 1-britney-spears-nude.com

IE restricted site: HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\1-domains-registrations.com -> 1-domains-registrations.com

IE restricted site: HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\1-se.com -> 1-se.com

IE restricted site: HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\1001movie.com -> 1001movie.com

 

There are 6091 more sites.

 

 

==================== Hosts content: =========================

 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

 

2017-03-18 15:03 - 2020-12-29 17:04 - 000000824 _____ C:\WINDOWS\system32\drivers\etc\hosts

 

==================== Other Areas ===========================

 

(Currently there is no automatic fix for this section.)

 

HKLM\System\CurrentControlSet\Control\Session Manager\Environment\\Path -> C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Program Files (x86)\Razer Chroma SDK\bin;C:\Program Files\Razer Chroma SDK\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\WiFi\bin\;C:\Program Files\Common Files\Intel\WirelessCommon\;C:\Users\Dohnovan\AppData\Local\Microsoft\WindowsApps;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps;%SYSTEMROOT%\System32\OpenSSH\

HKU\S-1-5-21-2108490749-413910539-1021375685-1003\Control Panel\Desktop\\Wallpaper -> c:\windows\web\wallpaper\windows\img0.jpg

DNS Servers: 75.75.75.75 - 75.75.76.76

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: )

Windows Firewall is enabled.

 

Network Binding:

=============

Bluetooth Network Connection: ExitLag Game Booster -> nt_ndextlag (enabled) 

Wi-Fi: ExitLag Game Booster -> nt_ndextlag (enabled) 

Local Area Connection: ExitLag Game Booster -> nt_ndextlag (enabled) 

Ethernet 2: ExitLag Game Booster -> nt_ndextlag (enabled) 

 

==================== MSCONFIG/TASK MANAGER disabled items ==

 

(If an entry is included in the fixlist, it will be removed.)

 

HKLM\...\StartupApproved\Run32: => "Discord"

HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\StartupApproved\Run: => "OneDrive"

HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\StartupApproved\Run: => "Steam"

HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\StartupApproved\Run: => "OPENVPN-GUI"

 

==================== FirewallRules (Whitelisted) ================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

FirewallRules: [{3351BAF1-BD8E-4881-9C12-D3FEA0E049E7}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\StateOfDecay2\StateOfDecay2\Binaries\Win64\StateOfDecay2-Win64-Shipping.exe (Undead Labs, LLC) [File not signed]

FirewallRules: [{25CCACBF-D00F-4DE0-8FDF-ED1A812FAADF}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\StateOfDecay2\StateOfDecay2\Binaries\Win64\StateOfDecay2-Win64-Shipping.exe (Undead Labs, LLC) [File not signed]

FirewallRules: [{63CB26E2-BC63-42BC-A5D0-0E12FF443786}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Unturned\Unturned.exe (Smartly Dressed Games Ltd. -> ) [File not signed]

FirewallRules: [{2646AFA2-162E-42A1-80E5-8FCE3C4E271C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Unturned\Unturned.exe (Smartly Dressed Games Ltd. -> ) [File not signed]

FirewallRules: [{DBF7A4A0-370F-475C-AD48-E9EB329F39A2}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Unturned\Unturned_BE.exe (BattlEye Innovations e.K. -> BattlEye Innovations)

FirewallRules: [{093A4023-8BA4-40A8-937A-7E3E26A36939}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Unturned\Unturned_BE.exe (BattlEye Innovations e.K. -> BattlEye Innovations)

FirewallRules: [{DB8FEBBB-6628-47F5-803B-46B0F78DE4C4}] => (Allow) C:\Users\Dohnovan\AppData\Roaming\Zoom\bin\Zoom.exe (Zoom Video Communications, Inc. -> Zoom Video Communications, Inc.)

FirewallRules: [{E5143819-BFC2-4C59-9BAD-1344103E4AD5}] => (Allow) C:\Program Files (x86)\SquareEnix\FINAL FANTASY XIV - A Realm Reborn\Advanced Combat Tracker\Advanced Combat Tracker.exe (EQAditu) [File not signed]

FirewallRules: [{5E6DF25B-EE60-4F06-B08B-00004B89EB93}] => (Allow) C:\Program Files (x86)\SquareEnix\FINAL FANTASY XIV - A Realm Reborn\boot\ffxivlauncher.exe (SQUARE ENIX CO., LTD. -> SQUARE ENIX CO., LTD.)

FirewallRules: [{91B94865-65B7-45CA-AF9E-44B3023CB9CC}] => (Allow) C:\Program Files (x86)\SquareEnix\FINAL FANTASY XIV - A Realm Reborn\boot\ffxivlauncher.exe (SQUARE ENIX CO., LTD. -> SQUARE ENIX CO., LTD.)

FirewallRules: [{E2421D3E-73BD-4E25-9656-92F5F49738FB}] => (Allow) C:\Program Files (x86)\SquareEnix\FINAL FANTASY XIV - A Realm Reborn\boot\ffxivboot.exe (SQUARE ENIX CO., LTD. -> SQUARE ENIX CO., LTD.)

FirewallRules: [{1BE0A6A0-5613-4700-829E-225605C5D1E7}] => (Allow) C:\Program Files (x86)\SquareEnix\FINAL FANTASY XIV - A Realm Reborn\boot\ffxivboot.exe (SQUARE ENIX CO., LTD. -> SQUARE ENIX CO., LTD.)

FirewallRules: [{D83A3869-F28B-4A4C-B367-B9F8F6B62C4D}] => (Allow) c:\program files (x86)\exitlag\exitlag.exe (SKOWSAND SERVICOS DE PROVEDORES E INTERNET LTDA -> )

FirewallRules: [{54ABB1D1-2DBD-4DA9-BE0E-58C743F320FF}] => (Allow) c:\program files (x86)\exitlag\exitlag.exe (SKOWSAND SERVICOS DE PROVEDORES E INTERNET LTDA -> )

FirewallRules: [{0E3D7240-E0CA-4AD9-AB7E-83B299E16D7C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Borderlands 3\OakGame\Binaries\Win64\Borderlands3.exe (Gearbox Software, L.L.C. -> Gearbox Software)

FirewallRules: [{0E651DF0-62D3-41D5-B039-3C42CE903B96}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Borderlands 3\OakGame\Binaries\Win64\Borderlands3.exe (Gearbox Software, L.L.C. -> Gearbox Software)

FirewallRules: [{1F8ED8C6-7BC4-4A9D-A0C4-CB325EFD5D6B}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe (Intel Corporation-Wireless Connectivity Solutions -> )

FirewallRules: [{50E286A9-EC43-4A42-82B3-B541B6893C62}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Witcher 3\bin\x64\witcher3.exe (CD Projekt Red) [File not signed]

FirewallRules: [{732F52FA-463B-4228-8163-A5EC1E0B8C73}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Witcher 3\bin\x64\witcher3.exe (CD Projekt Red) [File not signed]

FirewallRules: [UDP Query User{31B319D4-01B2-48FE-81A7-51110CE771B7}C:\program files (x86)\steam\steamapps\common\paladins\binaries\win64\paladins.exe] => (Block) C:\program files (x86)\steam\steamapps\common\paladins\binaries\win64\paladins.exe (Hirez Studios, Inc.) [File not signed]

FirewallRules: [TCP Query User{4F7CACBF-BBB5-428E-B6EE-D1163044D084}C:\program files (x86)\steam\steamapps\common\paladins\binaries\win64\paladins.exe] => (Block) C:\program files (x86)\steam\steamapps\common\paladins\binaries\win64\paladins.exe (Hirez Studios, Inc.) [File not signed]

FirewallRules: [UDP Query User{355EBCE9-2330-4B92-8E46-C7C76C402DA4}C:\program files (x86)\steam\steamapps\common\paladins\binaries\win64\paladins.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\paladins\binaries\win64\paladins.exe (Hirez Studios, Inc.) [File not signed]

FirewallRules: [TCP Query User{2C813A9F-F998-4D44-8B34-6963CF481A47}C:\program files (x86)\steam\steamapps\common\paladins\binaries\win64\paladins.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\paladins\binaries\win64\paladins.exe (Hirez Studios, Inc.) [File not signed]

FirewallRules: [{AE0EC883-ECC1-4257-9241-1C9586835901}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Paladins\Binaries\Win64\PaladinsEAC.exe (EasyAntiCheat Oy -> EasyAntiCheat Ltd)

FirewallRules: [{F2E459D0-8C52-44F9-B805-AFDA263B500D}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Paladins\Binaries\Win64\PaladinsEAC.exe (EasyAntiCheat Oy -> EasyAntiCheat Ltd)

FirewallRules: [{D37551E3-AE21-495A-90C1-0CE6907D3259}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Dishonored2\Dishonored2.exe (Arkane Studios) [File not signed]

FirewallRules: [{8D6BD339-6DB0-4B01-B064-950E1CB534FD}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Dishonored2\Dishonored2.exe (Arkane Studios) [File not signed]

FirewallRules: [{A8E5B1A0-6D7D-4D9C-96E1-B72039726CC2}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (Valve Corp. -> Valve Corporation)

FirewallRules: [{21FC1428-1EFB-47FF-BF78-DB5B1945382E}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (Valve Corp. -> Valve Corporation)

FirewallRules: [{D98FA1A5-1463-4F80-B944-62DCFE82B0DA}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe (Valve Corp. -> Valve Corporation)

FirewallRules: [{A73A6A68-3D6E-4ACB-BB1C-69891D2BC2E1}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe (Valve Corp. -> Valve Corporation)

FirewallRules: [TCP Query User{3A8F03ED-1DF4-4EFC-AB24-470F3D8E2A04}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe (Google LLC -> Google LLC)

FirewallRules: [UDP Query User{0C6F481E-F930-4C76-AE5C-202166C80AE3}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe (Google LLC -> Google LLC)

FirewallRules: [{F01FBF58-567C-4C2D-9E09-69501E7126D0}] => (Block) C:\program files (x86)\google\chrome\application\chrome.exe (Google LLC -> Google LLC)

FirewallRules: [{E246DB11-0299-4E9E-BAF1-F9600C9E1E87}] => (Block) C:\program files (x86)\google\chrome\application\chrome.exe (Google LLC -> Google LLC)

FirewallRules: [{C3DAE883-E9F4-413F-86F6-8D3F4B8E79BD}] => (Allow) C:\Users\Dohnovan\AppData\Roaming\Zoom\bin\Zoom.exe (Zoom Video Communications, Inc. -> Zoom Video Communications, Inc.)

FirewallRules: [{81624FDD-E49A-4806-9F8B-DBF11A998E47}] => (Allow) C:\Users\Dohnovan\AppData\Roaming\Zoom\bin\airhost.exe => No File

FirewallRules: [{3A0D9672-3930-48CF-BA8A-2CB34B5E520A}] => (Allow) C:\Users\Dohnovan\AppData\Roaming\Zoom\bin\airhost.exe => No File

FirewallRules: [TCP Query User{427E764D-7D50-4DBB-AC61-F5BF16E6D63A}C:\users\dohnovan\desktop\genshin impact\genshin impact game\genshinimpact.exe] => (Allow) C:\users\dohnovan\desktop\genshin impact\genshin impact game\genshinimpact.exe (miHoYo Co.,Ltd. -> )

FirewallRules: [UDP Query User{D6D9EA3B-D5BC-430D-9190-8944076D6D6C}C:\users\dohnovan\desktop\genshin impact\genshin impact game\genshinimpact.exe] => (Allow) C:\users\dohnovan\desktop\genshin impact\genshin impact game\genshinimpact.exe (miHoYo Co.,Ltd. -> )

FirewallRules: [{9A00E6EC-5378-4B5F-A60E-821FCF79D9BA}] => (Block) C:\users\dohnovan\desktop\genshin impact\genshin impact game\genshinimpact.exe (miHoYo Co.,Ltd. -> )

FirewallRules: [{BD98832D-0364-4199-8298-C05E288941C7}] => (Block) C:\users\dohnovan\desktop\genshin impact\genshin impact game\genshinimpact.exe (miHoYo Co.,Ltd. -> )

FirewallRules: [{8E02FA4D-86A3-4245-BCC4-040BA4750900}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\outlook.exe (Microsoft Corporation -> Microsoft Corporation)

FirewallRules: [{26C6520C-1EDF-4657-9DAD-6039133816D0}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Tools\Launcher.exe (Digital Extremes Ltd. -> Digital Extremes)

FirewallRules: [{2827F5D3-4F6E-4EFF-9AE0-E5865AD47630}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Warframe.x64.exe (Digital Extremes Ltd. -> Digital Extremes)

FirewallRules: [{7A4F04D6-31F5-4E1E-ACBC-CE380D7D7355}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Warframe.x64.exe (Digital Extremes Ltd. -> Digital Extremes)

FirewallRules: [{6FDEEC98-0DAA-4F6E-94E9-C31F604A9162}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Tools\RemoteCrashSender.exe (Digital Extremes Ltd. -> )

FirewallRules: [{57A5D862-A95D-4D81-A8E7-D13E4A7DA43C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Tools\Launcher.exe (Digital Extremes Ltd. -> Digital Extremes)

FirewallRules: [{043C2C11-F499-4DE4-AD71-7790ABCE0657}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Warframe.x64.exe (Digital Extremes Ltd. -> Digital Extremes)

FirewallRules: [{C726A832-531C-4D1C-8270-6425383DFD61}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Warframe.x64.exe (Digital Extremes Ltd. -> Digital Extremes)

FirewallRules: [{D69240F3-FBDA-4737-9C5D-ADAC14833D1E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Tools\RemoteCrashSender.exe (Digital Extremes Ltd. -> )

FirewallRules: [{2DA2D552-B60C-48F0-9B9C-02E9D23762B0}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.82.404.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)

FirewallRules: [{511BCC85-2F53-4476-9433-ED52E427F473}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.82.404.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)

FirewallRules: [{4EB258DF-AB3D-45CC-A06D-F351D521D4EB}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.82.404.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)

FirewallRules: [{26752D40-C03A-48FC-9039-40C58F1D6285}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.82.404.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)

FirewallRules: [{2E8C830A-13CC-4438-B0E3-DF5A32DF1D5F}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google LLC)

FirewallRules: [{9A999737-C017-421D-9D02-88BC5CF2640A}] => (Allow) C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe (Brave Software, Inc. -> Brave Software, Inc.)

FirewallRules: [{30E37C1A-7A5C-4537-B737-CA6CD88E5486}] => (Allow) C:\Program Files (x86)\Microsoft\EdgeWebView\Application\100.0.1185.44\msedgewebview2.exe (Microsoft Corporation -> Microsoft Corporation)

 

==================== Restore Points =========================

 

25-03-2022 18:04:21 Scheduled Checkpoint

03-04-2022 17:57:44 Scheduled Checkpoint

12-04-2022 16:06:33 Scheduled Checkpoint

 

==================== Faulty Device Manager Devices ============

 

 

==================== Event log errors: ========================

 

Application errors:

==================

Error: (04/18/2022 01:36:18 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: The program FRST64.exe version 19.5.2021.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

 

Process ID: 6a8

 

Start Time: 01d8535b6f735f4a

 

Termination Time: 4294967295

 

Application Path: C:\Users\Dohnovan\Desktop\FRST64.exe

 

Report Id: 420cc456-17d2-44f1-adb6-00f223d15a59

 

Faulting package full name: 

 

Faulting package-relative application ID: 

 

Hang type: Top level window is idle

 

Error: (04/17/2022 10:32:10 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: Razer Synapse Service.exe, version: 1.0.0.0, time stamp: 0x624275cc

Faulting module name: ntdll.dll, version: 10.0.19041.1566, time stamp: 0xbde09443

Exception code: 0xc0000374

Fault offset: 0x000e6d03

Faulting process id: 0x152c

Faulting application start time: 0x01d84f44e38ebe02

Faulting application path: C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe

Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll

Report Id: 3dd3973b-1943-40b7-a4c1-d697b82b0ee1

Faulting package full name: 

Faulting package-relative application ID:

 

Error: (04/16/2022 10:54:47 AM) (Source: Microsoft-Windows-Defrag) (EventID: 264) (User: )

Description: The storage optimizer couldn't complete retrim on Windows (C:) because: The operation requested is not supported by the hardware backing the volume. (0x8900002A)

 

Error: (04/15/2022 09:04:32 AM) (Source: Microsoft-Windows-RestartManager) (EventID: 10006) (User: DESKTOP-LBHF8BQ)

Description: Application or service 'Microsoft Office SDX Helper' could not be shut down.

 

Error: (04/09/2022 08:03:20 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: Razer Synapse Service.exe, version: 1.0.0.0, time stamp: 0x624275cc

Faulting module name: ntdll.dll, version: 10.0.19041.1566, time stamp: 0xbde09443

Exception code: 0xc0000374

Fault offset: 0x000e6d03

Faulting process id: 0x39c4

Faulting application start time: 0x01d849d9e42cab0c

Faulting application path: C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe

Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll

Report Id: 27fbf82f-850e-4e76-8f7d-1f6c35d9f3e9

Faulting package full name: 

Faulting package-relative application ID:

 

Error: (04/09/2022 12:16:26 PM) (Source: Microsoft-Windows-Defrag) (EventID: 264) (User: )

Description: The storage optimizer couldn't complete retrim on Windows (C:) because: The operation requested is not supported by the hardware backing the volume. (0x8900002A)

 

Error: (04/08/2022 06:34:34 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: The program Wow.exe version 3.3.5.12340 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

 

Process ID: 52e0

 

Start Time: 01d84b911d3b6cd1

 

Termination Time: 12

 

Application Path: C:\Users\Dohnovan\Desktop\World of Warcraft 3.3.5a\Wow.exe

 

Report Id: ee1fd8c7-89fc-4266-902b-6e5d1fa32d76

 

Faulting package full name: 

 

Faulting package-relative application ID: 

 

Hang type: Unknown

 

Error: (04/08/2022 08:17:16 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: svchost.exe_Audiosrv, version: 10.0.19041.1566, time stamp: 0x1f37eb46

Faulting module name: ntdll.dll, version: 10.0.19041.1566, time stamp: 0x1be73aa8

Exception code: 0xc0000005

Fault offset: 0x000000000002faad

Faulting process id: 0xa90

Faulting application start time: 0x01d84927295a91e0

Faulting application path: C:\WINDOWS\System32\svchost.exe

Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll

Report Id: 8e88e073-62aa-4180-b25d-7b75135242d8

Faulting package full name: 

Faulting package-relative application ID:

 

 

System errors:

=============

Error: (04/18/2022 09:27:53 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The Razer Synapse Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 0 milliseconds: Run the configured recovery program.

 

Error: (04/18/2022 09:27:48 AM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Razer Synapse Service service.

 

Error: (04/18/2022 09:27:18 AM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Razer Synapse Service service.

 

Error: (04/18/2022 09:26:48 AM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Razer Synapse Service service.

 

Error: (04/13/2022 08:42:57 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The AMDRyzenMasterDriverV19 service failed to start due to the following error: 

Cannot create a file when that file already exists.

 

Error: (04/12/2022 08:41:11 PM) (Source: Service Control Manager) (EventID: 7043) (User: )

Description: The Update Orchestrator Service service did not shut down properly after receiving a preshutdown control.

 

Error: (04/12/2022 08:35:06 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The AMDRyzenMasterDriver service failed to start due to the following error: 

Cannot create a file when that file already exists.

 

Error: (04/10/2022 12:08:50 AM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-LBHF8BQ)

Description: The server {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474} did not register with DCOM within the required timeout.

 

 

Windows Defender:

================

Date: 2022-04-17 16:43:27

Description: 

Microsoft Defender Antivirus scan has been stopped before completion.

Scan Type: Antimalware

Scan Parameters: Quick Scan

 

Date: 2022-04-16 16:43:40

Description: 

Microsoft Defender Antivirus scan has been stopped before completion.

Scan Type: Antimalware

Scan Parameters: Quick Scan

 

Date: 2022-04-15 16:43:57

Description: 

Microsoft Defender Antivirus scan has been stopped before completion.

Scan Type: Antimalware

Scan Parameters: Quick Scan

 

Date: 2022-04-14 16:43:34

Description: 

Microsoft Defender Antivirus scan has been stopped before completion.

Scan Type: Antimalware

Scan Parameters: Quick Scan

 

Date: 2022-04-13 16:43:27

Description: 

Microsoft Defender Antivirus scan has been stopped before completion.

Scan Type: Antimalware

Scan Parameters: Quick Scan



CodeIntegrity:

===============

Date: 2022-04-13 08:54:25

Description: 

Code Integrity determined that a process (\Device\HarddiskVolume4\ProgramData\Microsoft\Windows Defender\Platform\4.18.2203.5-0\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

 

Date: 2022-04-06 11:22:44

Description: 

Code Integrity determined that a process (\Device\HarddiskVolume4\ProgramData\Microsoft\Windows Defender\Platform\4.18.2202.4-0\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

 

 

==================== Memory info =========================== 

 

BIOS: American Megatrends Inc. 1.51 05/02/2017

Motherboard: Micro-Star International Co., Ltd B350M BAZOOKA (MS-7A38)

Processor: AMD Ryzen 5 1400 Quad-Core Processor 

Percentage of memory in use: 71%

Total physical RAM: 8144.69 MB

Available physical RAM: 2295.83 MB

Total Virtual: 15784.48 MB

Available Virtual: 4647.49 MB

 

==================== Drives ================================

 

Drive c: (Windows) (Fixed) (Total:930.35 GB) (Free:124.58 GB) NTFS

 

\\?\Volume{34b487b2-1f24-455b-888b-88fe24145180}\ () (Fixed) (Total:0.49 GB) (Free:0.47 GB) NTFS

\\?\Volume{9545ae2b-ceb4-43bc-a9a6-ddd687564b0d}\ () (Fixed) (Total:0.56 GB) (Free:0.08 GB) NTFS

\\?\Volume{7c6e70a3-6b38-47db-a32a-880393128539}\ (SYSTEM) (Fixed) (Total:0.09 GB) (Free:0.07 GB) FAT32

 

==================== MBR & Partition Table ====================

 

==========================================================

Disk: 0 (Size: 931.5 GB) (Disk ID: 1BA58450)

 

Partition: GPT.

 

==================== End of Addition.txt =======================

 

[Advertisements]

I accidently went to a website that I thought was this one today, it was called www.geekstogo.org. I'm not sure if that website is associated with you but it made me anxious since I've never seen that website pop up when I'm searching for this website.

[Dohnovan]

I accidently went to a website that I thought was this one today, it was called www.geekstogo.org. I'm not sure if that website is associated with you but it made me anxious since I've never seen that website pop up when I'm searching for this website.

[DR M]

Hi, Dohnovan.
 
Thanks for your patience, and thank you for letting us know about that site. Since they charge people for the assistance they provide, I see it as a "name steal", to get benefit from it. 
 
Anyway, your logs are clean. 
 
The following comments/instructions will make some maintenance. I included a system's check in the Step 3.
 
 
1. Adblockers
 
You have 2 similar programs for the same purpose enabled in Edge. Sometimes they cause conflicts when working together. Uninstall/Disable one of them.
 
Adblock Plus 
AdGuard AdBlocker 
 
 
2. Security programs
 
SuperAntispyware, Hitman Pro, Malwarebytes...
 
I would uninstall Hitman Pro and/or SuperAntispyware.
 
 
3. FRST fix

Please do the following to run a FRST fix.

NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system

• Please select the entire contents of the code box below, from the "Start::" line to "End::", including both lines. Right-click and select "Copy ". No need to paste anything to anywhere.

Start::
CreateRestorePoint:
CloseProcesses:
HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Edge: Restriction <==== ATTENTION
S3 cpuz149; \??\C:\Users\Dohnovan\AppData\Local\Temp\cpuz149\cpuz149_x64.sys [X] <==== ATTENTION
AlternateDataStreams: C:\ProgramData\TEMP:5C321E34 [274]
FirewallRules: [{81624FDD-E49A-4806-9F8B-DBF11A998E47}] => (Allow) C:\Users\Dohnovan\AppData\Roaming\Zoom\bin\airhost.exe => No File
FirewallRules: [{3A0D9672-3930-48CF-BA8A-2CB34B5E520A}] => (Allow) C:\Users\Dohnovan\AppData\Roaming\Zoom\bin\airhost.exe => No File
DeleteKey: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains
DeleteKey: HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains
CMD: DISM /Online /Cleanup-Image /RestoreHealth
CMD: SFC /scannow
End::

• Please right-click on FRST64 on your Desktop, to run it as administrator. When the tool opens, click "yes" to the disclaimer.
• Press the Fix button once and wait.
• FRST will process fixlist.txt
• When finished, it will produce a log fixlog.txt on your Desktop.
• Please post the log in your next reply.

 

In your next reply:

1. Let me know what you unisntalled
2. Post the fixlog.txt
3. Feedback: what makes you think the computer has malware? Also, let me know if you are dealing with specific issues, other than the Eset online issue. 

[DR M]

Do you still need assistance?

[Dohnovan]

Sorry, I've been busy recently and I didn't check the forums until today.

[Dohnovan]

I uninstalled hitmanpro, I never use edge and I don't know why the adblock I have on google chrome got installed on edge. I did the fix like you said and I accidently opened chrome not thinking to check if it was finished, it was still working on the fix. I don't think I've noticed any sort of symptoms on my pc that could imply theres any virus, spyware or malware, I'm just wondering if there could be anything on my pc. Thank you for the help. I feel like my pcs faster now for some reason.

 

 

Fix result of Farbar Recovery Scan Tool (x64) Version: 22-04-2022

Ran by Dohnovan (22-04-2022 10:24:37) Run:1

Running from C:\Users\Dohnovan\Desktop

Loaded Profiles: Dohnovan

Boot Mode: Normal

==============================================

 

fixlist content:

*****************

CreateRestorePoint:

CloseProcesses:

HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION

HKLM\SOFTWARE\Policies\Microsoft\Edge: Restriction <==== ATTENTION

S3 cpuz149; \??\C:\Users\Dohnovan\AppData\Local\Temp\cpuz149\cpuz149_x64.sys [X] <==== ATTENTION

AlternateDataStreams: C:\ProgramData\TEMP:5C321E34 [274]

FirewallRules: [{81624FDD-E49A-4806-9F8B-DBF11A998E47}] => (Allow) C:\Users\Dohnovan\AppData\Roaming\Zoom\bin\airhost.exe => No File

FirewallRules: [{3A0D9672-3930-48CF-BA8A-2CB34B5E520A}] => (Allow) C:\Users\Dohnovan\AppData\Roaming\Zoom\bin\airhost.exe => No File

DeleteKey: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains

DeleteKey: HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains

CMD: DISM /Online /Cleanup-Image /RestoreHealth

CMD: SFC /scannow

 

*****************

 

Restore point was successfully created.

Processes closed successfully.

HKLM\SOFTWARE\Policies\Google => removed successfully

HKLM\SOFTWARE\Policies\Microsoft\Edge => removed successfully

HKLM\System\CurrentControlSet\Services\cpuz149 => removed successfully

cpuz149 => service removed successfully

C:\ProgramData\TEMP => ":5C321E34" ADS removed successfully

"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{81624FDD-E49A-4806-9F8B-DBF11A998E47}" => removed successfully

"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{3A0D9672-3930-48CF-BA8A-2CB34B5E520A}" => removed successfully

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains => removed successfully

HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains => removed successfully

 

========= DISM /Online /Cleanup-Image /RestoreHealth =========

 

 

Deployment Image Servicing and Management tool

Version: 10.0.19041.844

 

Image Version: 10.0.19043.1645

 

 

[==                         3.8%                           ] 

 

[==                         3.8%                           ] 

 

[==                         3.9%                           ] 

 

[==                         4.1%                           ] 

 

[==                         4.2%                           ] 

 

[==                         4.3%                           ] 

 

[==                         4.5%                           ] 

 

[==                         4.6%                           ] 

 

[==                         4.8%                           ] 

 

[==                         5.1%                           ] 

 

[===                        5.2%                           ] 

 

[===                        5.3%                           ] 

 

[===                        5.4%                           ] 

 

[===                        5.6%                           ] 

 

[===                        5.7%                           ] 

 

[===                        6.0%                           ] 

 

[===                        6.2%                           ] 

 

[===                        6.4%                           ] 

 

[===                        6.8%                           ] 

 

[===                        6.8%                           ] 

 

[====                       6.9%                           ] 

 

[====                       7.2%                           ] 

 

[====                       7.4%                           ] 

 

[====                       7.7%                           ] 

 

[====                       7.8%                           ] 

 

[====                       7.9%                           ] 

 

[====                       8.1%                           ] 

 

[====                       8.2%                           ] 

 

[====                       8.5%                           ] 

 

[====                       8.6%                           ] 

 

[=====                      8.8%                           ] 

 

[=====                      8.9%                           ] 

 

[=====                      9.2%                           ] 

 

[=====                      9.5%                           ] 

 

[=====                      9.7%                           ] 

 

[=====                      10.0%                          ] 

 

[=====                      10.3%                          ] 

 

[======                     10.6%                          ] 

 

[======                     10.9%                          ] 

 

[======                     10.9%                          ] 

 

[======                     11.0%                          ] 

 

[======                     11.2%                          ] 

 

[======                     11.3%                          ] 

 

[======                     11.5%                          ] 

 

[======                     11.8%                          ] 

 

[=======                    12.1%                          ] 

 

[=======                    12.2%                          ] 

 

[=======                    12.5%                          ] 

 

[=======                    12.6%                          ] 

 

[=======                    12.7%                          ] 

 

[=======                    12.9%                          ] 

 

[=======                    13.2%                          ] 

 

[=======                    13.5%                          ] 

 

[=======                    13.7%                          ] 

 

[========                   14.0%                          ] 

 

[========                   14.0%                          ] 

 

[========                   14.3%                          ] 

 

[========                   14.6%                          ] 

 

[========                   14.9%                          ] 

 

[=========                  15.9%                          ] 

 

[=========                  16.9%                          ] 

 

[==========                 17.4%                          ] 

 

[==========                 17.9%                          ] 

 

[==========                 18.3%                          ] 

 

[==========                 18.5%                          ] 

 

[==========                 18.8%                          ] 

 

[===========                19.0%                          ] 

 

[===========                19.2%                          ] 

 

[===========                19.6%                          ] 

 

[===========                20.0%                          ] 

 

[===========                20.4%                          ] 

 

[============               20.9%                          ] 

 

[============               21.4%                          ] 

 

[============               22.0%                          ] 

 

[============               22.3%                          ] 

 

[=============              22.9%                          ] 

 

[=============              23.2%                          ] 

 

[=============              23.3%                          ] 

 

[=============              23.5%                          ] 

 

[=============              23.8%                          ] 

 

[==============             24.2%                          ] 

 

[==============             24.3%                          ] 

 

[==============             24.4%                          ] 

 

[==============             24.5%                          ] 

 

[==============             24.8%                          ] 

 

[==============             25.1%                          ] 

 

[==============             25.3%                          ] 

 

[==============             25.4%                          ] 

 

[==============             25.7%                          ] 

 

[==============             25.8%                          ] 

 

[===============            26.0%                          ] 

 

[===============            26.0%                          ] 

 

[===============            26.0%                          ] 

 

[===============            26.0%                          ] 

 

[===============            26.1%                          ] 

 

[===============            26.1%                          ] 

 

[===============            26.6%                          ] 

 

[===============            26.6%                          ] 

 

[===============            27.0%                          ] 

 

[===============            27.2%                          ] 

 

[===============            27.5%                          ] 

 

[================           27.8%                          ] 

 

[================           27.9%                          ] 

 

[================           28.3%                          ] 

 

[================           28.6%                          ] 

 

[================           28.8%                          ] 

 

[================           28.9%                          ] 

 

[================           29.3%                          ] 

 

[=================          29.5%                          ] 

 

[=================          29.7%                          ] 

 

[=================          29.7%                          ] 

 

[=================          30.0%                          ] 

 

[=================          30.2%                          ] 

 

[=================          30.6%                          ] 

 

[=================          30.9%                          ] 

 

[==================         31.1%                          ] 

 

[==================         31.5%                          ] 

 

[==================         31.8%                          ] 

 

[==================         31.9%                          ] 

 

[==================         32.1%                          ] 

 

[==================         32.2%                          ] 

 

[==================         32.5%                          ] 

 

[==================         32.6%                          ] 

 

[==================         32.7%                          ] 

 

[===================        33.1%                          ] 

 

[===================        33.1%                          ] 

 

[===================        33.2%                          ] 

 

[===================        33.4%                          ] 

 

[===================        33.7%                          ] 

 

[===================        33.9%                          ] 

 

[===================        34.0%                          ] 

 

[===================        34.0%                          ] 

 

[===================        34.1%                          ] 

 

[===================        34.2%                          ] 

 

[===================        34.4%                          ] 

 

[====================       34.5%                          ] 

 

[====================       34.6%                          ] 

 

[====================       34.9%                          ] 

 

[====================       35.1%                          ] 

 

[====================       35.3%                          ] 

 

[====================       35.7%                          ] 

 

[====================       35.8%                          ] 

 

[====================       35.8%                          ] 

 

[====================       35.8%                          ] 

 

[====================       35.9%                          ] 

 

[====================       36.0%                          ] 

 

[=====================      36.3%                          ] 

 

[=====================      36.7%                          ] 

 

[=====================      36.9%                          ] 

 

[=====================      37.1%                          ] 

 

[=====================      37.1%                          ] 

 

[=====================      37.1%                          ] 

 

[=====================      37.2%                          ] 

 

[=====================      37.2%                          ] 

 

[=====================      37.3%                          ] 

 

[=====================      37.4%                          ] 

 

[=====================      37.4%                          ] 

 

[=====================      37.4%                          ] 

 

[=====================      37.4%                          ] 

 

[=====================      37.5%                          ] 

 

[=====================      37.6%                          ] 

 

[=====================      37.6%                          ] 

 

[=====================      37.7%                          ] 

 

[=====================      37.7%                          ] 

 

[=====================      37.7%                          ] 

 

[=====================      37.8%                          ] 

 

[=====================      37.8%                          ] 

 

[=====================      37.9%                          ] 

 

[======================     38.0%                          ] 

 

[======================     38.0%                          ] 

 

[======================     38.0%                          ] 

 

[======================     38.1%                          ] 

 

[======================     38.1%                          ] 

 

[======================     38.2%                          ] 

 

[======================     38.2%                          ] 

 

[======================     38.3%                          ] 

 

[======================     38.3%                          ] 

 

[======================     38.3%                          ] 

 

[======================     38.4%                          ] 

 

[======================     38.5%                          ] 

 

[======================     38.5%                          ] 

 

[======================     38.5%                          ] 

 

[======================     38.6%                          ] 

 

[======================     38.6%                          ] 

 

[======================     38.6%                          ] 

 

[======================     38.6%                          ] 

 

[======================     38.7%                          ] 

 

[======================     38.8%                          ] 

 

[======================     38.8%                          ] 

 

[======================     38.9%                          ] 

 

[======================     38.9%                          ] 

 

[======================     39.0%                          ] 

 

[======================     39.0%                          ] 

 

[======================     39.1%                          ] 

 

[======================     39.2%                          ] 

 

[======================     39.2%                          ] 

 

[======================     39.2%                          ] 

 

[======================     39.3%                          ] 

 

[======================     39.4%                          ] 

 

[======================     39.5%                          ] 

 

[======================     39.5%                          ] 

 

[======================     39.6%                          ] 

 

[=======================    39.7%                          ] 

 

[=======================    39.7%                          ] 

 

[=======================    39.7%                          ] 

 

[=======================    39.8%                          ] 

 

[=======================    39.8%                          ] 

 

[=======================    39.9%                          ] 

 

[=======================    40.0%                          ] 

 

[=======================    40.1%                          ] 

 

[=======================    40.2%                          ] 

 

[=======================    40.3%                          ] 

 

[=======================    40.4%                          ] 

 

[=======================    40.5%                          ] 

 

[=======================    40.5%                          ] 

 

[=======================    40.7%                          ] 

 

[=======================    40.8%                          ] 

 

[=======================    40.9%                          ] 

 

[=======================    41.0%                          ] 

 

[=======================    41.2%                          ] 

 

[=======================    41.3%                          ] 

 

[========================   41.4%                          ] 

 

[========================   41.7%                          ] 

 

[========================   41.7%                          ] 

 

[========================   41.9%                          ] 

 

[========================   42.1%                          ] 

 

[========================   42.2%                          ] 

 

[========================   42.2%                          ] 

 

[========================   42.4%                          ] 

 

[========================   42.6%                          ] 

 

[========================   42.9%                          ] 

 

[========================   42.9%                          ] 

 

[========================   42.9%                          ] 

 

[=========================  43.2%                          ] 

 

[=========================  43.3%                          ] 

 

[=========================  43.5%                          ] 

 

[=========================  43.7%                          ] 

 

[=========================  43.8%                          ] 

 

[=========================  43.8%                          ] 

 

[=========================  43.8%                          ] 

 

[=========================  43.9%                          ] 

 

[=========================  44.0%                          ] 

 

[=========================  44.1%                          ] 

 

[=========================  44.2%                          ] 

 

[=========================  44.3%                          ] 

 

[=========================  44.4%                          ] 

 

[=========================  44.5%                          ] 

 

[=========================  44.5%                          ] 

 

[=========================  44.7%                          ] 

 

[=========================  44.8%                          ] 

 

[========================== 44.8%                          ] 

 

[========================== 44.9%                          ] 

 

[========================== 45.0%                          ] 

 

[========================== 45.0%                          ] 

 

[========================== 45.1%                          ] 

 

[========================== 45.2%                          ] 

 

[========================== 45.3%                          ] 

 

[========================== 45.5%                          ] 

 

[========================== 45.6%                          ] 

 

[========================== 45.7%                          ] 

 

[========================== 45.7%                          ] 

 

[========================== 45.9%                          ] 

 

[========================== 46.0%                          ] 

 

[========================== 46.3%                          ] 

 

[========================== 46.5%                          ] 

 

[========================== 46.5%                          ] 

 

[===========================46.7%                          ] 

 

[===========================46.9%                          ] 

 

[===========================47.0%                          ] 

 

[===========================47.1%                          ] 

 

[===========================47.3%                          ] 

 

[===========================47.5%                          ] 

 

[===========================47.7%                          ] 

 

[===========================48.0%                          ] 

 

[===========================48.2%                          ] 

 

[===========================48.3%                          ] 

 

[===========================48.4%                          ] 

 

[===========================48.8%                          ] 

 

[===========================49.1%                          ] 

 

[===========================49.4%                          ] 

 

[===========================49.7%                          ] 

 

[===========================50.0%                          ] 

 

[===========================50.3%                          ] 

 

[===========================50.6%                          ] 

 

[===========================50.8%                          ] 

 

[===========================51.2%                          ] 

 

[===========================51.5%                          ] 

 

[===========================51.8%                          ] 

 

[===========================52.2%                          ] 

 

[===========================52.3%                          ] 

 

[===========================52.6%                          ] 

 

[===========================52.8%                          ] 

 

[===========================53.1%                          ] 

 

[===========================53.2%                          ] 

 

[===========================53.2%                          ] 

 

[===========================53.2%                          ] 

 

[===========================53.3%                          ] 

 

[===========================53.3%                          ] 

 

[===========================53.3%                          ] 

 

[===========================53.4%                          ] 

 

[===========================53.4%                          ] 

 

[===========================53.5%                          ] 

 

[===========================53.5%                          ] 

 

[===========================53.6%                          ] 

 

[===========================53.6%                          ] 

 

[===========================53.6%                          ] 

 

[===========================53.7%                          ] 

 

[===========================53.7%                          ] 

 

[===========================53.7%                          ] 

 

[===========================53.7%                          ] 

 

[===========================53.7%                          ] 

 

[===========================53.7%                          ] 

 

[===========================53.8%                          ] 

 

[===========================53.8%                          ] 

 

[===========================53.9%                          ] 

 

[===========================53.9%                          ] 

 

[===========================53.9%                          ] 

 

[===========================54.0%                          ] 

 

[===========================54.0%                          ] 

 

[===========================54.0%                          ] 

 

[===========================54.0%                          ] 

 

[===========================54.1%                          ] 

 

[===========================54.1%                          ] 

 

[===========================54.2%                          ] 

 

[===========================54.2%                          ] 

 

[===========================54.3%                          ] 

 

[===========================54.3%                          ] 

 

[===========================54.3%                          ] 

 

[===========================54.4%                          ] 

 

[===========================54.4%                          ] 

 

[===========================54.5%                          ] 

 

[===========================54.5%                          ] 

 

[===========================54.5%                          ] 

 

[===========================54.6%                          ] 

 

[===========================54.6%                          ] 

 

[===========================54.6%                          ] 

 

[===========================54.7%                          ] 

 

[===========================54.7%                          ] 

 

[===========================54.8%                          ] 

 

[===========================54.8%                          ] 

 

[===========================54.9%                          ] 

 

[===========================54.9%                          ] 

 

[===========================54.9%                          ] 

 

[===========================54.9%                          ] 

 

[===========================54.9%                          ] 

 

[===========================54.9%                          ] 

 

[===========================55.0%                          ] 

 

[===========================55.0%                          ] 

 

[===========================55.0%                          ] 

 

[===========================55.1%                          ] 

 

[===========================55.1%                          ] 

 

[===========================55.1%                          ] 

 

[===========================55.2%                          ] 

 

[===========================55.2%                          ] 

 

[===========================55.2%                          ] 

 

[===========================55.2%                          ] 

 

[===========================55.3%                          ] 

 

[===========================55.3%                          ] 

 

[===========================55.3%                          ] 

 

[===========================55.4%                          ] 

 

[===========================55.4%                          ] 

 

[===========================55.4%                          ] 

 

[===========================55.5%                          ] 

 

[===========================55.5%                          ] 

 

[===========================55.5%                          ] 

 

[===========================55.6%                          ] 

 

[===========================55.6%                          ] 

 

[===========================55.7%                          ] 

 

[===========================55.8%                          ] 

 

[===========================55.8%                          ] 

 

[===========================55.8%                          ] 

 

[===========================55.8%                          ] 

 

[===========================55.9%                          ] 

 

[===========================55.9%                          ] 

 

[===========================55.9%                          ] 

 

[===========================56.0%                          ] 

 

[===========================56.0%                          ] 

 

[===========================56.1%                          ] 

 

[===========================56.1%                          ] 

 

[===========================56.2%                          ] 

 

[===========================56.2%                          ] 

 

[===========================56.3%                          ] 

 

[===========================56.3%                          ] 

 

[===========================56.3%                          ] 

 

[===========================56.4%                          ] 

 

[===========================56.7%                          ] 

 

[===========================56.9%=                         ] 

 

[===========================57.0%=                         ] 

 

[===========================57.0%=                         ] 

 

[===========================57.1%=                         ] 

 

[===========================57.1%=                         ] 

 

[===========================57.1%=                         ] 

 

[===========================57.2%=                         ] 

 

[===========================57.4%=                         ] 

 

[===========================57.9%=                         ] 

 

[===========================57.9%=                         ] 

 

[===========================58.4%=                         ] 

 

[===========================58.9%==                        ] 

 

[===========================59.4%==                        ] 

 

[===========================59.5%==                        ] 

 

[===========================59.5%==                        ] 

 

[===========================59.6%==                        ] 

 

[===========================60.1%==                        ] 

 

[===========================62.3%====                      ] 

 

[===========================84.9%=================         ] 

 

[==========================100.0%==========================] 

The restore operation completed successfully.

The operation completed successfully.

 

========= End of CMD: =========

 

 

========= SFC /scannow =========

 

 

 

Beginning system scan.  This process will take some time.

 

 

 

Beginning verification phase of system scan.

 

 

Verification 0% complete.

Verification 1% complete.

Verification 1% complete.

Verification 2% complete.

Verification 3% complete.

Verification 3% complete.

Verification 4% complete.

Verification 5% complete.

Verification 5% complete.

Verification 6% complete.

Verification 7% complete.

Verification 7% complete.

Verification 8% complete.

Verification 8% complete.

Verification 9% complete.

Verification 10% complete.

Verification 10% complete.

Verification 11% complete.

Verification 12% complete.

Verification 12% complete.

Verification 13% complete.

Verification 14% complete.

Verification 14% complete.

Verification 15% complete.

Verification 16% complete.

Verification 16% complete.

Verification 17% complete.

Verification 17% complete.

Verification 18% complete.

Verification 19% complete.

Verification 19% complete.

Verification 20% complete.

Verification 21% complete.

Verification 21% complete.

Verification 22% complete.

Verification 23% complete.

Verification 23% complete.

Verification 24% complete.

Verification 24% complete.

Verification 25% complete.

Verification 26% complete.

Verification 26% complete.

Verification 27% complete.

Verification 28% complete.

Verification 28% complete.

Verification 29% complete.

Verification 30% complete.

Verification 30% complete.

Verification 31% complete.

Verification 32% complete.

Verification 32% complete.

Verification 33% complete.

Verification 33% complete.

Verification 34% complete.

Verification 35% complete.

Verification 35% complete.

Verification 36% complete.

Verification 37% complete.

Verification 37% complete.

Verification 38% complete.

Verification 39% complete.

Verification 39% complete.

Verification 40% complete.

Verification 40% complete.

Verification 41% complete.

Verification 42% complete.

Verification 42% complete.

Verification 43% complete.

Verification 44% complete.

Verification 44% complete.

Verification 45% complete.

Verification 46% complete.

Verification 46% complete.

Verification 47% complete.

Verification 48% complete.

Verification 48% complete.

Verification 49% complete.

Verification 49% complete.

Verification 50% complete.

Verification 51% complete.

Verification 51% complete.

Verification 52% complete.

Verification 53% complete.

Verification 53% complete.

Verification 54% complete.

Verification 55% complete.

Verification 55% complete.

Verification 56% complete.

Verification 56% complete.

Verification 57% complete.

Verification 58% complete.

Verification 58% complete.

Verification 59% complete.

Verification 60% complete.

Verification 60% complete.

Verification 61% complete.

Verification 62% complete.

Verification 62% complete.

Verification 63% complete.

Verification 64% complete.

Verification 64% complete.

Verification 65% complete.

Verification 65% complete.

Verification 66% complete.

Verification 67% complete.

Verification 67% complete.

Verification 68% complete.

Verification 69% complete.

Verification 69% complete.

Verification 70% complete.

Verification 71% complete.

Verification 71% complete.

Verification 72% complete.

Verification 72% complete.

Verification 73% complete.

Verification 74% complete.

Verification 74% complete.

Verification 75% complete.

Verification 76% complete.

Verification 76% complete.

Verification 77% complete.

Verification 78% complete.

Verification 78% complete.

Verification 79% complete.

Verification 80% complete.

Verification 80% complete.

Verification 81% complete.

Verification 81% complete.

Verification 82% complete.

Verification 83% complete.

Verification 83% complete.

Verification 84% complete.

Verification 85% complete.

Verification 85% complete.

Verification 86% complete.

Verification 87% complete.

Verification 87% complete.

Verification 88% complete.

Verification 88% complete.

Verification 89% complete.

Verification 90% complete.

Verification 90% complete.

Verification 91% complete.

Verification 92% complete.

Verification 92% complete.

Verification 93% complete.

Verification 94% complete.

Verification 94% complete.

Verification 95% complete.

Verification 96% complete.

Verification 96% complete.

Verification 97% complete.

Verification 97% complete.

Verification 98% complete.

Verification 99% complete.

Verification 99% complete.

Verification 100% complete.

 

 

Windows Resource Protection found corrupt files and successfully repaired them.

 

For online repairs, details are included in the CBS log file located at

 

windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. For offline

 

repairs, details are included in the log file provided by the /OFFLOGFILE flag.

 

 

========= End of CMD: =========

 

 

 

The system needed a reboot.

 

==== End of Fixlog 11:02:48 ====

Edited by Dohnovan, 22 April 2022 - 11:38 AM.

[DR M]

Hi, Dohnovan.
 
From the fixlog:
 
Windows Resource Protection found corrupt files and successfully repaired them.
 
Try To run Eset Online now, following my instructions below. Let me know how it will go:

Download ESET Online Scanner and save it to your desktop.

• Right-click on esetonlinescanner_enu.exe and select Run as Administrator.
• When the tool opens, click Get Started.
• Read and accept the license agreement.
• At the Welcome to ESET Online Scanner window, click Get Started.
• Select whether you would like to send anonymous data to ESET.
• Note: if you see the "Welcome Back to ESET Online Scanner" screen, click Computer Scan > Full Scan.
• Click on the Full Scan option.
• Select Enable ESET to detect and remove potentially unwanted applications, then click Start scan.
• ESET will now begin scanning your computer. This may take some time.
• When the scan is finished and if threats have been detected, select Save scan log. Save it to your desktop as eset.txt. Click on Continue.
• ESET Online Scanner may ask if you'd like to turn on the Periodic Scan feature. Click on Continue.
• On the next screen, you can leave feedback about the program if you wish. Check the box for Delete application data on closing. If you left feedback, click Submit and continue. If not, Close without feedback.
• Open the scan log on your desktop (eset.txt) and copy and paste its contents into your next reply.

[Dohnovan]

I tried opening the eset online scanner following your directions after installing it and it opens a window but before the window even fully loads it closes the program.

[DR M]

Eset Online doesn't install itself. You just save the exe file on the Desktop and then double click on it to do the Scan. 
 
What I can think about this issue, is that a security program in the computer prevents Eset Online to start. 
 
Let me check fresh FRST logs now, please.

• Double-click on the FRST icon to run it, as you did before. When the tool opens click Yes to disclaimer.
• Press Scan button and wait for a while.
• The scanner will produced two logs on your Desktop: FRST.txt and Addition.txt.
• Please attach the content of these two logs in your next reply.

[Dohnovan]

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 22-04-2022

Ran by Dohnovan (administrator) on DESKTOP-LBHF8BQ (Micro-Star International Co., Ltd MS-7A38) (23-04-2022 09:44:24)

Running from C:\Users\Dohnovan\Desktop

Loaded Profiles: Dohnovan

Platform: Microsoft Windows 10 Home Version 21H1 19043.1645 (X64) Language: English (United States)

Default browser: Chrome

Boot Mode: Normal

 

==================== Processes (Whitelisted) =================

 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

 

(Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\AMDRSServ.exe

(Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\RadeonSoftware.exe

(A-Volute -> ) C:\Program Files\SteelSeries\SS Audio\Foundation\SSAudioSvc32.exe

(A-Volute -> ) C:\Program Files\SteelSeries\SS Audio\Foundation\x64\SSAudioSvc64.exe

(C:\Program Files (x86)\Razer\Razer Services\Razer Central\Razer Central.exe ->) (Razer USA Ltd. -> The CefSharp Authors) C:\Program Files (x86)\Razer\Razer Services\Razer Central\CefSharp.BrowserSubprocess.exe <2>

(C:\Program Files (x86)\Razer\Razer Services\Razer Central\RazerCentralService.exe ->) (Razer USA Ltd. -> Razer Inc.) C:\Program Files (x86)\Razer\Razer Services\Razer Central\Razer Central.exe

(C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe ->) (Razer USA Ltd. -> ) C:\Program Files (x86)\Razer\Synapse3\UserProcess\Razer Synapse Service Process.exe

(C:\Program Files\AMD\CNext\CNext\AMDRSServ.exe ->) (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\amdow.exe

(C:\Program Files\AMD\CNext\CNext\AMDRSServ.exe ->) (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\AMDRSSrcExt.exe

(C:\Program Files\AMD\CNext\CNext\RadeonSoftware.exe ->) (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\cncmd.exe

(C:\Program Files\AMD\CNext\CNext\RadeonSoftware.exe ->) (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\QtWebEngineProcess.exe

(C:\Program Files\SteelSeries\GG\SteelSeriesGG.exe ->) (SteelSeries ApS -> SteelSeries ApS) C:\Program Files\SteelSeries\GG\SteelSeriesEngine.exe

(C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2203.5-0\MsMpEng.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2203.5-0\MpCopyAccelerator.exe

(Discord Inc. -> Discord Inc.) C:\Users\Dohnovan\AppData\Local\Discord\app-1.0.9004\Discord.exe <6>

(DriverStore\FileRepository͵709.inf_amd64_b5db6b3799486cf8\B375758\atiesrxx.exe ->) (Advanced Micro Devices Inc. -> AMD) C:\Windows\System32\DriverStore\FileRepository͵709.inf_amd64_b5db6b3799486cf8\B375758\atieclxx.exe

(explorer.exe ->) (Brave Software, Inc. -> Brave Software, Inc.) C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe <16>

(explorer.exe ->) (Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe <18>

(explorer.exe ->) (Razer USA Ltd. -> Razer Inc.) C:\Program Files (x86)\Razer\Synapse3\WPFUI\Framework\Razer Synapse 3 Host\Razer Synapse 3.exe

(explorer.exe ->) (SteelSeries ApS -> SteelSeries ApS) C:\Program Files\SteelSeries\GG\SteelSeriesGG.exe

(explorer.exe ->) (Support.com Inc -> SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE

(services.exe ->) (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.) C:\Windows\System32\amdfendrsr.exe

(services.exe ->) (Advanced Micro Devices Inc. -> AMD) C:\Program Files\AMD\Performance Profile Client\AUEPDU.exe

(services.exe ->) (Advanced Micro Devices Inc. -> AMD) C:\Windows\System32\DriverStore\FileRepository͵709.inf_amd64_b5db6b3799486cf8\B375758\atiesrxx.exe

(services.exe ->) (Intel Corporation -> Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

(services.exe ->) (Intel Corporation -> Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe

(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe

(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2203.5-0\MsMpEng.exe

(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2203.5-0\NisSrv.exe

(services.exe ->) (Razer USA Ltd. -> Razer Inc) C:\Program Files (x86)\Razer\Razer Services\GMS\GameManagerService.exe

(services.exe ->) (Razer USA Ltd. -> Razer Inc.) C:\Program Files (x86)\Razer Chroma SDK\bin\RzSDKServer.exe

(services.exe ->) (Razer USA Ltd. -> Razer Inc.) C:\Program Files (x86)\Razer Chroma SDK\bin\RzSDKService.exe

(services.exe ->) (Razer USA Ltd. -> Razer Inc.) C:\Program Files (x86)\Razer\Razer Services\Razer Central\RazerCentralService.exe

(services.exe ->) (Razer USA Ltd. -> Razer Inc.) C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe

(services.exe ->) (SUPERAntiSpyware.com -> SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe

(svchost.exe ->) (Adlice -> ) C:\Program Files\UCheck\UCheck64.exe

(svchost.exe ->) (Advanced Micro Devices Inc. -> AMD) C:\Program Files\AMD\Performance Profile Client\AUEPMaster.exe

(svchost.exe ->) (Advanced Micro Devices, Inc.) [File not signed] C:\Program Files\AMD\CNext\CNext\CPUMetricsServer.exe

(svchost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe

(svchost.exe ->) (Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2103.8.0_x64__8wekyb3d8bbwe\Calculator.exe

(svchost.exe ->) (Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_5.722.3302.0_x64__8wekyb3d8bbwe\GameBar.exe

(svchost.exe ->) (Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_5.722.3302.0_x64__8wekyb3d8bbwe\GameBarFTServer.exe

(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe <2>

(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\wlanext.exe

 

==================== Registry (Whitelisted) ===================

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

 

HKLM\...\Run: [SteelSeriesGG] => C:\Program Files\SteelSeries\GG\SteelSeriesGG.exe [12691848 2022-04-06] (SteelSeries ApS -> SteelSeries ApS)

HKLM-x32\...\Run: [Discord] => C:\ProgramData\SquirrelMachineInstalls\Discord.exe [70858912 2021-07-15] (Discord Inc. -> Discord Inc.)

HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [4279208 2022-03-14] (Valve Corp. -> Valve Corporation)

HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\Run: [Synapse3] => C:\Program Files (x86)\Razer\Synapse3\WPFUI\Framework\Razer Synapse 3 Host\Razer Synapse 3.exe [3527240 2022-03-28] (Razer USA Ltd. -> Razer Inc.)

HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\Run: [Discord] => C:\Users\Dohnovan\AppData\Local\Discord\Update.exe [1512104 2021-05-24] (Discord Inc. -> GitHub)

HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [11223920 2021-07-06] (Support.com Inc -> SUPERAntiSpyware)

HKU\S-1-5-18\...\Run: [Synapse3] => C:\Program Files (x86)\Razer\Synapse3\WPFUI\Framework\Razer Synapse 3 Host\Razer Synapse 3.exe [3527240 2022-03-28] (Razer USA Ltd. -> Razer Inc.)

HKLM\Software\Microsoft\Active Setup\Installed Components: [OpenVPN_UserSetup] -> reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v OPENVPN-GUI /f

HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\100.0.4896.127\Installer\chrmstp.exe [2022-04-14] (Google LLC -> Google LLC)

HKLM\Software\Microsoft\Active Setup\Installed Components: [{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}] -> C:\Program Files\BraveSoftware\Brave-Browser\Application\100.1.37.116\Installer\chrmstp.exe [2022-04-15] (Brave Software, Inc. -> Brave Software, Inc.)

Startup: C:\Users\Dohnovan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spywareblaster.exe [2020-08-13] (BrightFort LLC -> )

GroupPolicy: Restriction ? <==== ATTENTION

 

==================== Scheduled Tasks (Whitelisted) ============

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

Task: {08E5B611-4DA5-4724-BF5F-CEB73F9E0C7D} - System32\Tasks\SSAudioSvc64Run => C:\Program Files\Steelseries\SS Audio\Foundation\x64\SSAudioSvc64.exe [797088 2020-01-08] (A-Volute -> )

Task: {24647903-7512-4ED6-84FA-CFF6B406287C} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2203.5-0\MpCmdRun.exe [993000 2022-04-07] (Microsoft Windows Publisher -> Microsoft Corporation)

Task: {2AFE60A3-3C00-4AF5-BFF5-8D96C9C8F860} - System32\Tasks\BraveSoftwareUpdateTaskMachineCore => C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe [155848 2020-09-19] (Brave Software, Inc. -> BraveSoftware Inc.)

Task: {2EB29D3E-78F2-4DC6-A4EE-8497FB17A281} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2203.5-0\MpCmdRun.exe [993000 2022-04-07] (Microsoft Windows Publisher -> Microsoft Corporation)

Task: {38738C68-4172-40D9-902F-F5E7DF74001E} - System32\Tasks\AMDInstallLauncher => C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe [1709048 2022-01-18] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)

Task: {43727CF0-7152-44CE-B26F-0CB5B3497A6E} - System32\Tasks\Microsoft\Office\Office Performance Monitor => C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\operfmon.exe [61336 2022-04-05] (Microsoft Corporation -> Microsoft Corporation)

Task: {568E4EEF-5E99-4C66-B8E9-DA74BFF2DCA1} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153168 2018-01-14] (Google Inc -> Google Inc.)

Task: {5E706780-CE86-4A81-B224-D9DA2ABCA7EE} - System32\Tasks\Microsoft\Office\Office Automatic Updates 2.0 => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [22866856 2022-04-15] (Microsoft Corporation -> Microsoft Corporation)

Task: {72272DFC-049E-46D5-8C98-9563407B5D9D} - System32\Tasks\SSAudioSvc32Run => C:\Program Files\Steelseries\SS Audio\Foundation\SSAudioSvc32.exe [1299872 2020-01-08] (A-Volute -> )

Task: {7236DF21-1E55-4491-849E-6CF16FC17ABE} - System32\Tasks\Microsoft\Office\Office Feature Updates Logon => C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [138672 2022-04-15] (Microsoft Corporation -> Microsoft Corporation)

Task: {7D484749-46DF-40A9-AF50-007BE595726C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153168 2018-01-14] (Google Inc -> Google Inc.)

Task: {87B04948-F2EF-4300-AD2C-47DF5EC9915B} - System32\Tasks\ModifyLinkUpdate => C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe [1709048 2022-01-18] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)

Task: {9253C3DF-0C61-44DE-9EDB-B71638043C46} - System32\Tasks\CreateExplorerShellUnelevatedTask => C:\WINDOWS\Explorer.exe /NoUACCheck

Task: {9687B87A-B606-44FF-88E2-8020E46EA239} - System32\Tasks\AMDRyzenMasterSDKTask => C:\Program Files\AMD\CNext\CNext\cpumetricsserver.exe [358912 2022-01-18] (Advanced Micro Devices, Inc.) [File not signed]

Task: {9E104028-00F8-4343-A741-D04D706466C9} - System32\Tasks\Microsoft\Office\Office Feature Updates => C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [138672 2022-04-15] (Microsoft Corporation -> Microsoft Corporation)

Task: {A361A1B9-ECF6-4DAB-AE81-0CBB3CE76364} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2203.5-0\MpCmdRun.exe [993000 2022-04-07] (Microsoft Windows Publisher -> Microsoft Corporation)

Task: {AB26E664-0506-4CB4-A8F8-3A72DFF32411} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [22866856 2022-04-15] (Microsoft Corporation -> Microsoft Corporation)

Task: {AEF244E8-E768-4B41-AE20-1C4BFA0179DB} - System32\Tasks\AMDLinkUpdate => C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe [1709048 2022-01-18] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)

Task: {B4A4857B-6463-4CEC-8C30-7D001E0F1070} - System32\Tasks\StartCN => C:\Program Files\AMD\CNext\CNext\cncmd.exe [55288 2022-01-18] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)

Task: {BC2173B5-C39F-40B2-99E4-F41B28F26961} - System32\Tasks\BraveSoftwareUpdateTaskMachineUA => C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe [155848 2020-09-19] (Brave Software, Inc. -> BraveSoftware Inc.)

Task: {BDA358F7-FD10-4FAB-A724-6CE5B18B18B1} - System32\Tasks\UCheck => C:\Program Files\UCheck\UCheck64.exe [29145424 2021-06-15] (Adlice -> )

Task: {C99E02F3-7020-4F2B-BC4E-0BF167D241C7} - System32\Tasks\StartAUEP => C:\Program Files\AMD\Performance Profile Client\AUEPMaster.exe [652792 2022-01-18] (Advanced Micro Devices Inc. -> AMD)

Task: {E56EFD6A-B11A-4B88-BA1D-D1F92E6D1F9B} - System32\Tasks\StartDVR => C:\Program Files\AMD\CNext\CNext\RSServCmd.exe [260600 2022-01-18] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)

Task: {EF4E4E8C-6B95-4C86-BBB9-529976E0A20A} - System32\Tasks\StartCNBM => C:\Program Files\AMD\CNext\CNext\cncmd.exe [55288 2022-01-18] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)

Task: {F7577032-6D72-4CEA-8E8B-86518785C2A5} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2203.5-0\MpCmdRun.exe [993000 2022-04-07] (Microsoft Windows Publisher -> Microsoft Corporation)

 

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

 

 

==================== Internet (Whitelisted) ====================

 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

 

Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76

Tcpip\..\Interfaces\{1a8f5a04-83c8-490b-b4bc-64e8c2c6fd6d}: [DhcpNameServer] 192.168.42.129

Tcpip\..\Interfaces\{1cd6b0cf-5059-4ef2-9609-a8d02c0c81b4}: [DhcpNameServer] 75.75.75.75 75.75.76.76

Tcpip\..\Interfaces\{3c01823b-a919-4197-a2ce-b7ef6cd5d03a}: [DhcpNameServer] 192.168.43.1

Tcpip\..\Interfaces\{57a5de9c-d2e2-48be-96b9-44b1389dcc84}: [DhcpNameServer] 75.75.75.75 75.75.76.76

Tcpip\..\Interfaces\{8f09853e-c450-47d3-b7bc-5aedbe848278}: [DhcpNameServer] 192.168.43.1

Tcpip\..\Interfaces\{dad6bf82-733a-495c-84a7-154afa6ad446}: [DhcpNameServer] 192.168.42.129

Tcpip\..\Interfaces\{e0510115-42dc-46d8-842a-cc54eeda8aa9}: [DhcpNameServer] 10.0.1.1

 

Edge: 

=======

Edge Extension: (Adblock Plus) -> 10_EyeoGmbHAdblockPlus_d55gg7py3s0m0 => C:\Program Files\WindowsApps\EyeoGmbH.AdblockPlus_0.9.19.0_neutral__d55gg7py3s0m0 [2021-10-07]

Edge Extension: (AdGuard AdBlocker) -> EdgeExtension_AdguardAdguardAdBlocker_m055xr0c82818 => C:\Program Files\WindowsApps\Adguard.AdguardAdBlocker_3.3.8.0_neutral__m055xr0c82818 [2020-01-11]

Edge DefaultProfile: Default

Edge Profile: C:\Users\Dohnovan\AppData\Local\Microsoft\Edge\User Data\Default [2022-04-10]

Edge Extension: (Adblock Plus - free ad blocker) - C:\Users\Dohnovan\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\gmgoamodcdcjnbaobigkjelfplakmdhh [2022-01-24]

Edge Extension: (AdGuard AdBlocker) - C:\Users\Dohnovan\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\pdffkfellgipmhklpdmokmckkkfcopbh [2022-01-24]

 

FireFox:

========

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL [2022-04-05] (Microsoft Corporation -> Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\NPSPWRAP.DLL [2022-03-03] (Microsoft Corporation -> Microsoft Corporation)

 

Chrome: 

=======

CHR DefaultProfile: Default

CHR Profile: C:\Users\Dohnovan\AppData\Local\Google\Chrome\User Data\Default [2022-04-23]

CHR Notifications: Default -> hxxps://www.youtube.com

CHR HomePage: Default -> hxxps://www.google.com/

CHR Extension: (Just Black) - C:\Users\Dohnovan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aghfnjkcakhmadgdomlmlhhaocbkloab [2021-12-20]

CHR Extension: (Adblock Plus - free ad blocker) - C:\Users\Dohnovan\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2022-01-13]

CHR Extension: (Google Docs Offline) - C:\Users\Dohnovan\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2022-04-13]

CHR Extension: (MetaMask) - C:\Users\Dohnovan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nkbihfbeogaeaoehlefnkodbefgpgknn [2022-04-20]

CHR Extension: (Chrome Web Store Payments) - C:\Users\Dohnovan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2021-01-29]

CHR Profile: C:\Users\Dohnovan\AppData\Local\Google\Chrome\User Data\System Profile [2021-10-05]

 

Brave: 

=======

BRA Profile: C:\Users\Dohnovan\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default [2022-04-23]

BRA Extension: (Brave Local Data Files Updater) - C:\Users\Dohnovan\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal [2022-04-22]

BRA Extension: (Brave NTP background images) - C:\Users\Dohnovan\AppData\Local\BraveSoftware\Brave-Browser\User Data\aoojcmojmmcbpfgoecoadbdpnagfchel [2022-04-11]

BRA Extension: (Wallet Data Files Updater) - C:\Users\Dohnovan\AppData\Local\BraveSoftware\Brave-Browser\User Data\BraveWallet [2022-04-17]

BRA Extension: (Brave Ad Block Updater (Default)) - C:\Users\Dohnovan\AppData\Local\BraveSoftware\Brave-Browser\User Data\cffkpbalmllkdoenhmdmpbkajipdjfam [2022-04-22]

BRA Extension: (Brave NTP sponsored images) - C:\Users\Dohnovan\AppData\Local\BraveSoftware\Brave-Browser\User Data\gccbbckogglekeggclmmekihdgdpdgoe [2022-04-22]

BRA Extension: (Brave SpeedReader Updater) - C:\Users\Dohnovan\AppData\Local\BraveSoftware\Brave-Browser\User Data\jicbkmdloagakknpihibphagfckhjdih [2022-04-07]

BRA Extension: (Brave HTTPS Everywhere Updater) - C:\Users\Dohnovan\AppData\Local\BraveSoftware\Brave-Browser\User Data\oofiananboodjbbmdelgdommihjbkfag [2022-04-22]

 

==================== Services (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [173472 2021-01-09] (SUPERAntiSpyware.com -> SUPERAntiSpyware.com)

R2 AUEPLauncher; C:\Program Files\AMD\CIM\..\Performance Profile Client\AUEPDU.exe [504824 2022-01-18] (Advanced Micro Devices Inc. -> AMD)

S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [8906088 2021-08-22] (BattlEye Innovations e.K. -> )

S2 brave; C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe [155848 2020-09-19] (Brave Software, Inc. -> BraveSoftware Inc.)

S3 bravem; C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe [155848 2020-09-19] (Brave Software, Inc. -> BraveSoftware Inc.)

R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [11666384 2022-04-05] (Microsoft Corporation -> Microsoft Corporation)

S3 EasyAntiCheat; C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe [802432 2020-08-10] (EasyAntiCheat Oy -> EasyAntiCheat Ltd)

S3 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [7901368 2021-11-22] (Malwarebytes Inc -> Malwarebytes)

R2 Razer Chroma SDK Server; C:\Program Files (x86)\Razer Chroma SDK\bin\RzSDKServer.exe [449664 2018-08-28] (Razer USA Ltd. -> Razer Inc.)

R2 Razer Chroma SDK Service; C:\Program Files (x86)\Razer Chroma SDK\bin\RzSDKService.exe [942720 2018-09-12] (Razer USA Ltd. -> Razer Inc.)

R2 Razer Game Manager Service; C:\Program Files (x86)\Razer\Razer Services\GMS\GameManagerService.exe [254224 2021-11-15] (Razer USA Ltd. -> Razer Inc)

R2 Razer Synapse Service; C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe [298056 2022-03-28] (Razer USA Ltd. -> Razer Inc.)

R2 RzActionSvc; C:\Program Files (x86)\Razer\Razer Services\Razer Central\RazerCentralService.exe [533824 2022-02-18] (Razer USA Ltd. -> Razer Inc.)

S3 SteelSeriesUpdateService; C:\Program Files\SteelSeries\GG\SteelSeriesUpdateService.exe [32648 2022-04-06] (SteelSeries ApS -> )

R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2203.5-0\NisSrv.exe [3116848 2022-04-07] (Microsoft Windows Publisher -> Microsoft Corporation)

R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2203.5-0\MsMpEng.exe [133544 2022-04-07] (Microsoft Windows Publisher -> Microsoft Corporation)

 

===================== Drivers (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

R3 amdfendrmgr; C:\WINDOWS\System32\drivers\amdfendrmgr.sys [33216 2021-12-02] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)

S3 amdkmafd; C:\WINDOWS\System32\drivers\amdkmafd.sys [49448 2016-08-18] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.)

R2 AMDRyzenMasterDriverV19; C:\WINDOWS\system32\AMDRyzenMasterDriver.sys [43336 2022-01-16] (Advanced Micro Devices INC. -> Advanced Micro Devices)

R3 AMDSAFD; C:\WINDOWS\System32\DriverStore\FileRepository\amdsafd.inf_amd64_edd3335a4253bf6d\amdsafd.sys [109520 2021-11-04] (Advanced Micro Devices Inc. -> Advanced Micro Devices)

R3 amdwddmg; C:\WINDOWS\System32\DriverStore\FileRepository͵709.inf_amd64_b5db6b3799486cf8\B375758\amdkmdag.sys [82940976 2022-01-17] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)

R3 AMDXE; C:\WINDOWS\System32\drivers\amdxe.sys [65168 2021-08-17] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)

S0 MbamElam; C:\WINDOWS\System32\DRIVERS\MbamElam.sys [19912 2021-02-21] (Microsoft Windows Early Launch Anti-malware Publisher -> Malwarebytes)

S3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [248992 2021-05-31] (Malwarebytes Inc -> Malwarebytes)

R3 MpKsl8821430b; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{5C00BB2D-FDB0-42E5-BCE9-26E86690ABD5}\MpKslDrv.sys [139536 2022-04-22] (Microsoft Windows -> Microsoft Corporation)

R1 ndextlag; C:\WINDOWS\system32\DRIVERS\ndextlag.sys [48640 2018-04-11] (Mainline Net Holdings Limited -> SKOWSAND SERVICOS DE PROVEDORES E INTERNET LTDA - ME)

S3 ocznvme; C:\WINDOWS\System32\drivers\ocznvme.sys [99592 2016-06-10] (Toshiba America Electronic Components, Inc. -> TOSHIBA CORPORATION)

S3 ocztrimfilter; C:\WINDOWS\System32\drivers\ocztrimfilter.sys [29064 2016-06-10] (Toshiba America Electronic Components, Inc. -> TOSHIBA CORPORATION)

R3 RzCommon; C:\WINDOWS\System32\drivers\RzCommon.sys [54632 2021-03-30] (Razer USA Ltd. -> Razer Inc)

R3 RzDev_0067; C:\WINDOWS\System32\drivers\RzDev_0067.sys [54152 2020-08-24] (Razer USA Ltd. -> Razer Inc)

R3 RzDev_024e; C:\WINDOWS\System32\drivers\RzDev_024e.sys [54168 2020-08-24] (Razer USA Ltd. -> Razer Inc)

R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2021-01-09] (Support.com, Inc. -> SUPERAdBlocker.com and SUPERAntiSpyware.com)

R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2021-01-09] (Support.com, Inc. -> SUPERAdBlocker.com and SUPERAntiSpyware.com)

S3 secnvme; C:\WINDOWS\System32\drivers\secnvme.sys [135688 2016-12-09] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd)

R3 ssdevfactory; C:\WINDOWS\System32\drivers\ssdevfactory.sys [48848 2020-09-25] (SteelSeries ApS -> SteelSeries ApS)

R3 SteelSeries_Sonar_VAD; C:\WINDOWS\System32\DriverStore\FileRepository\steelseries-sonar-vad.inf_amd64_6f6e907eca1efa31\SteelSeries-Sonar-VAD.sys [89568 2022-03-23] (SteelSeries ApS -> Windows ® Win 7 DDK provider)

R3 tap0901; C:\WINDOWS\System32\drivers\tap0901.sys [47920 2020-02-20] (Microsoft Windows Hardware Compatibility Publisher -> The OpenVPN Project)

S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [49600 2022-04-07] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)

R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [443664 2022-04-07] (Microsoft Windows -> Microsoft Corporation)

R3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [90384 2022-04-07] (Microsoft Windows -> Microsoft Corporation)

S3 xhunter1; C:\WINDOWS\xhunter1.sys [47096 2018-02-18] (Wellbia.com Co., Ltd. -> Wellbia.com Co., Ltd.)

 

==================== NetSvcs (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

 

==================== One month (created) (Whitelisted) =========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2022-04-23 09:44 - 2022-04-23 09:46 - 000025647 _____ C:\Users\Dohnovan\Desktop\FRST.txt

2022-04-22 20:52 - 2022-04-22 20:53 - 015274968 _____ (ESET) C:\Users\Dohnovan\Desktop\esetonlinescanner (2).exe

2022-04-21 20:27 - 2022-04-21 20:27 - 000000000 ____D C:\Program Files\PCHealthCheck

2022-04-18 13:36 - 2022-04-22 10:23 - 000000000 ____D C:\Users\Dohnovan\Desktop\FRST-OlderVersion

2022-04-18 13:35 - 2022-04-23 09:45 - 000000000 ____D C:\FRST

2022-04-18 13:34 - 2022-04-22 10:23 - 002366976 _____ (Farbar) C:\Users\Dohnovan\Desktop\FRST64.exe

2022-04-14 11:19 - 2022-04-14 11:19 - 000105072 _____ C:\Users\Dohnovan\Downloads\DDixon2022w4.pdf

2022-04-12 17:32 - 2022-04-12 17:32 - 000039936 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll

2022-04-12 17:32 - 2022-04-12 17:32 - 000011803 _____ C:\WINDOWS\system32\DrtmAuthTxt.wim

2022-04-12 17:31 - 2022-04-12 17:31 - 000048640 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll

2022-04-12 17:30 - 2022-04-12 17:30 - 000162816 _____ C:\WINDOWS\system32\DataStoreCacheDumpTool.exe

2022-04-12 16:59 - 2022-04-12 16:59 - 000000000 ___HD C:\$WinREAgent

2022-04-10 07:24 - 2022-04-10 07:24 - 015274968 _____ (ESET) C:\Users\Dohnovan\Downloads\esetonlinescanner (1).exe

2022-04-08 18:33 - 2022-04-08 18:33 - 000012261 _____ C:\Users\Dohnovan\Downloads\_ActionBarSaver-r20100719.zip

2022-04-05 14:07 - 2022-04-22 11:21 - 000003084 _____ C:\WINDOWS\system32\Tasks\AMDLinkUpdate

2022-03-30 11:56 - 2022-03-30 11:56 - 000000000 ____D C:\Program Files\Google

2022-03-29 09:44 - 2022-03-29 09:44 - 000000025 _____ C:\Users\Dohnovan\Desktop\snapchat code.txt

2022-03-24 18:44 - 2022-03-24 18:44 - 000000009 _____ C:\Users\Dohnovan\Desktop\facebook pass.txt

 

==================== One month (modified) ==================

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2022-04-23 09:42 - 2019-12-07 03:14 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft

2022-04-23 09:39 - 2020-12-09 20:01 - 000000000 ____D C:\Users\Dohnovan\AppData\Roaming\discord

2022-04-23 09:38 - 2018-01-14 11:41 - 000000000 ____D C:\Program Files (x86)\Google

2022-04-23 09:23 - 2021-07-15 19:23 - 000000000 ____D C:\Users\Dohnovan\AppData\Local\Discord

2022-04-23 09:05 - 2021-10-07 12:43 - 000000000 ____D C:\WINDOWS\system32\SleepStudy

2022-04-23 05:21 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\AppReadiness

2022-04-23 05:20 - 2020-06-13 10:56 - 000002445 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk

2022-04-23 05:20 - 2020-06-13 10:56 - 000002283 _____ C:\Users\Public\Desktop\Microsoft Edge.lnk

2022-04-23 05:20 - 2019-12-07 03:14 - 000000000 ___HD C:\Program Files\WindowsApps

2022-04-22 20:54 - 2022-01-22 23:56 - 000001388 _____ C:\Users\Dohnovan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ESET Online Scanner.lnk

2022-04-22 11:21 - 2022-01-21 17:08 - 000003124 _____ C:\WINDOWS\system32\Tasks\AMDInstallLauncher

2022-04-22 11:12 - 2021-10-07 13:06 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT

2022-04-22 11:12 - 2020-06-18 15:39 - 000008192 ___SH C:\DumpStack.log.tmp

2022-04-22 11:11 - 2019-12-07 03:03 - 000524288 _____ C:\WINDOWS\system32\config\BBI

2022-04-22 11:11 - 2017-04-11 10:49 - 000065536 _____ C:\WINDOWS\system32\spu_storage.bin

2022-04-22 10:54 - 2019-12-07 03:03 - 000000000 ____D C:\WINDOWS\CbsTemp

2022-04-22 10:20 - 2019-06-19 15:54 - 000000000 ____D C:\ProgramData\HitmanPro.Alert

2022-04-21 21:01 - 2022-01-07 20:15 - 000036073 _____ C:\Users\Dohnovan\Desktop\Math Notes.txt

2022-04-21 20:27 - 2021-11-10 20:49 - 000001153 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Health Check.lnk

2022-04-20 17:31 - 2021-12-12 23:08 - 000003588 _____ C:\WINDOWS\system32\Tasks\OneDrive Reporting Task-S-1-5-21-2108490749-413910539-1021375685-1003

2022-04-20 17:31 - 2021-10-07 13:06 - 000003384 _____ C:\WINDOWS\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-2108490749-413910539-1021375685-1003

2022-04-20 17:31 - 2021-10-07 12:14 - 000002395 _____ C:\Users\Dohnovan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk

2022-04-19 21:33 - 2021-10-07 13:05 - 000003420 _____ C:\WINDOWS\system32\Tasks\GoogleUpdateTaskMachineUA

2022-04-19 21:33 - 2021-10-07 13:05 - 000003296 _____ C:\WINDOWS\system32\Tasks\GoogleUpdateTaskMachineCore

2022-04-19 16:42 - 2020-06-03 11:41 - 000000000 ____D C:\Users\Dohnovan\Desktop\World of Warcraft 3.3.5a

2022-04-15 17:17 - 2021-01-04 11:37 - 000000000 ____D C:\Users\Dohnovan\AppData\Local\AMD_Common

2022-04-15 09:04 - 2017-04-07 15:15 - 000000000 ____D C:\Program Files\Microsoft Office

2022-04-15 05:11 - 2020-09-19 15:59 - 000002371 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brave.lnk

2022-04-15 05:11 - 2020-09-19 15:59 - 000002330 _____ C:\Users\Public\Desktop\Brave.lnk

2022-04-14 19:33 - 2018-01-14 11:42 - 000002308 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

2022-04-14 19:33 - 2018-01-14 11:42 - 000002267 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2022-04-13 08:46 - 2019-12-07 03:13 - 000000000 ____D C:\WINDOWS\INF

2022-04-12 20:40 - 2021-10-07 12:59 - 000840598 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2022-04-12 20:35 - 2021-10-07 12:43 - 000436016 _____ C:\WINDOWS\system32\FNTCACHE.DAT

2022-04-12 20:32 - 2019-12-07 03:14 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel

2022-04-12 20:32 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism

2022-04-12 20:32 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\SystemResources

2022-04-12 20:32 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\system32\oobe

2022-04-12 20:32 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\system32\Dism

2022-04-12 20:32 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\ShellExperiences

2022-04-12 20:32 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\Provisioning

2022-04-12 20:32 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\PolicyDefinitions

2022-04-12 20:32 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\bcastdvr

2022-04-12 16:30 - 2017-12-09 11:41 - 000000000 ____D C:\WINDOWS\system32\MRT

2022-04-12 16:23 - 2017-12-09 11:40 - 143823848 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

2022-04-10 20:36 - 2021-03-23 18:05 - 000000000 ____D C:\ProgramData\TEMP

2022-04-10 06:48 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\LiveKernelReports

2022-04-08 21:52 - 2017-12-08 22:06 - 000000000 ____D C:\Program Files (x86)\Steam

2022-04-08 08:15 - 2017-12-09 12:50 - 000000000 ____D C:\ProgramData\SteelSeries

2022-04-07 22:59 - 2021-09-14 23:23 - 000000075 _____ C:\Users\Dohnovan\Desktop\settings.sav

2022-04-07 21:35 - 2018-05-21 16:36 - 000000000 ____D C:\Users\Dohnovan\AppData\Local\D3DSCache

2022-04-07 16:33 - 2019-06-22 23:06 - 000000000 ____D C:\Users\Dohnovan\Documents\The Witcher 3

2022-04-07 16:26 - 2017-12-13 05:05 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd

2022-04-06 11:15 - 2018-03-13 16:34 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Razer

2022-04-06 11:14 - 2021-10-09 20:23 - 000003386 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore1d7bbac9216e929

2022-04-06 11:14 - 2021-10-07 13:06 - 000003510 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA1d6b1325f7ebb04

2022-04-05 19:26 - 2021-10-07 12:14 - 000000000 ____D C:\Users\Dohnovan

2022-04-05 00:55 - 2020-11-20 01:36 - 000000000 ____D C:\Program Files\Microsoft Update Health Tools

2022-03-28 11:03 - 2019-06-22 23:43 - 000000000 ____D C:\Users\Dohnovan\Desktop\Scriptmerger

 

==================== Files in the root of some directories ========

 

2021-03-01 20:52 - 2021-03-08 23:19 - 000007598 _____ () C:\Users\Dohnovan\AppData\Local\Resmon.ResmonCfg

 

==================== SigCheck ============================

 

(There is no automatic fix for files that do not pass verification.)

 

==================== End of FRST.txt ========================

 

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-04-2022

Ran by Dohnovan (23-04-2022 09:48:17)

Running from C:\Users\Dohnovan\Desktop

Microsoft Windows 10 Home Version 21H1 19043.1645 (X64) (2021-10-07 19:07:44)

Boot Mode: Normal

==========================================================

 

 

==================== Accounts: =============================

 

 

(If an entry is included in the fixlist, it will be removed.)

 

Administrator (S-1-5-21-2108490749-413910539-1021375685-500 - Administrator - Disabled)

DefaultAccount (S-1-5-21-2108490749-413910539-1021375685-503 - Limited - Disabled)

defaultuser0 (S-1-5-21-2108490749-413910539-1021375685-1002 - Limited - Disabled)

Dohnovan (S-1-5-21-2108490749-413910539-1021375685-1003 - Administrator - Enabled) => C:\Users\Dohnovan

Guest (S-1-5-21-2108490749-413910539-1021375685-501 - Limited - Disabled)

WDAGUtilityAccount (S-1-5-21-2108490749-413910539-1021375685-504 - Limited - Disabled)

 

==================== Security Center ========================

 

(If an entry is included in the fixlist, it will be removed.)

 

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AV: Malwarebytes (Disabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 

==================== Installed Programs ======================

 

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 

Advanced Combat Tracker (remove only) (HKLM-x32\...\Advanced Combat Tracker) (Version:  - )

AMD Software (HKLM\...\AMD Catalyst Install Manager) (Version: 22.1.2 - Advanced Micro Devices, Inc.)

APOInstallerMSISetup (HKLM\...\{5C4734F8-9AF3-4324-A36E-DC147853B2F5}) (Version: 1.2.1101 - Steelseries) Hidden

Asmedia USB Host Controller Driver (HKLM-x32\...\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.16.36.1 - Asmedia Technology)

AudioDeviceFXPluginSampleUIMSISetup (HKLM\...\{C9BA81B6-4A0F-454A-B331-81A45A57573E}) (Version: 1.2.1101 - Steelseries) Hidden

Belarc Advisor 9.0 (HKLM-x32\...\Belarc Advisor) (Version: 9.0.0.0 - Belarc Inc.)

Black Desert (HKLM-x32\...\BlackDesert_NA_is1) (Version: 1.0 - PearlAbyss Corp.)

Branding64 (HKLM\...\{15E10477-5999-498F-A988-E22FAA096B5E}) (Version: 1.00.0008 - Advanced Micro Devices, Inc.) Hidden

Brave (HKLM-x32\...\BraveSoftware Brave-Browser) (Version: 100.1.37.116 - Brave Software Inc)

Discord (HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\Discord) (Version: 1.0.9002 - Discord Inc.)

ExitLag version 4.183 (HKLM-x32\...\{B3117F72-F22D-4DA7-B554-B3F4EDBB408F}_is1) (Version: 4.183 - ExitLag)

FINAL FANTASY XIV ONLINE (HKLM-x32\...\{2B41E132-07DF-4925-A3D3-F2D1765CCDFE}) (Version: 1.0.0000 - SQUARE ENIX CO., LTD.)

Genshin Impact (HKLM\...\Genshin Impact) (Version: 2.14.1.0 - miHoYo Co.,Ltd)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 100.0.4896.127 - Google LLC)

Google Update Helper (HKLM-x32\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.99.0 - Google Inc.) Hidden

Harver System Checker 2.0.6 (HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\57ba83c7-44cc-50c5-93e2-68092ebb1ce7) (Version: 2.0.6 - Harver)

Intel® Wireless Bluetooth® (HKLM-x32\...\{0E13241D-76B0-4A4C-9665-3969F55C08D5}) (Version: 19.40.1702.1091 - Intel Corporation)

Intel® PROSet/Wireless Software (HKLM-x32\...\{263d87d0-9772-40be-ab36-eabbdbff49f7}) (Version: 21.20.1 - Intel Corporation)

Malwarebytes version 4.4.11.149 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 4.4.11.149 - Malwarebytes)

Microsoft 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 16.0.15028.20204 - Microsoft Corporation)

Microsoft Edge (HKLM-x32\...\Microsoft Edge) (Version: 100.0.1185.50 - Microsoft Corporation)

Microsoft Edge WebView2 Runtime (HKLM-x32\...\Microsoft EdgeWebView) (Version: 100.0.1185.44 - Microsoft Corporation)

Microsoft OneDrive (HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\OneDriveSetup.exe) (Version: 22.065.0412.0004 - Microsoft Corporation)

Microsoft Update Health Tools (HKLM\...\{7B1FCD52-8F6B-4F12-A143-361EA39F5E7C}) (Version: 3.67.0.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)

Microsoft Visual C++ 2015-2019 Redistributable (x64) - 14.29.30133 (HKLM-x32\...\{295d1583-fdb9-414b-a4c8-da539362a26b}) (Version: 14.29.30133.0 - Microsoft Corporation)

Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.29.30133 (HKLM-x32\...\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}) (Version: 14.29.30133.0 - Microsoft Corporation)

Nexon Launcher (HKLM-x32\...\Nexon Nexon Launcher) (Version: 2.1.0 - Nexon)

NVIDIA PhysX (HKLM-x32\...\{B455E95A-B804-439F-B533-336B1635AE97}) (Version: 9.14.0702 - NVIDIA Corporation)

Office 16 Click-to-Run Extensibility Component (HKLM\...\{90160000-008C-0000-1000-0000000FF1CE}) (Version: 16.0.15028.20050 - Microsoft Corporation) Hidden

Office 16 Click-to-Run Licensing Component (HKLM\...\{90160000-007E-0000-1000-0000000FF1CE}) (Version: 16.0.15028.20160 - Microsoft Corporation) Hidden

Office 16 Click-to-Run Localization Component (HKLM\...\{90160000-008C-0409-1000-0000000FF1CE}) (Version: 16.0.14131.20278 - Microsoft Corporation) Hidden

ProductDaemonSetup (HKLM\...\{C31282E4-C1A3-433C-A803-D9ED4A99DC8F}) (Version: 1.2.1101 - Steelseries) Hidden

Razer Chroma SDK (HKLM-x32\...\Razer Chroma SDK) (Version: 2.21.1 - Razer Inc.)

Razer Synapse (HKLM-x32\...\Razer Synapse) (Version: 3.7.0331.032911 - Razer Inc.)

Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.10.714.2016 - Realtek)

Revo Uninstaller 2.2.8 (HKLM\...\{A28DBDA2-3CC7-4ADC-8BFE-66D7743C6C97}_is1) (Version: 2.2.8 - VS Revo Group, Ltd.)

Rockstar Games Social Club (HKLM-x32\...\Rockstar Games Social Club) (Version: 1.2.4.1 - Rockstar Games)

RyzenMasterSDK (HKLM\...\{170E2572-C6EB-43BA-A6B4-B768B57C5D65}) (Version: 1.2.3.5 - Advanced Micro Devices, Inc.) Hidden

Speccy (HKLM\...\Speccy) (Version: 1.32 - Piriform)

SpywareBlaster 6.0 (HKLM-x32\...\SpywareBlaster_is1) (Version: 6.0.0 - BrightFort LLC)

SSAudio (HKLM-x32\...\{1c112a1f-1120-415d-85ab-7a3de5b0a9c2}) (Version: 1.2.1101 - Steelseries)

SSAudioDaemonMSISetup (HKLM\...\{CDEA766D-38C5-448B-8316-02D01C842E1E}) (Version: 1.2.1101 - Steelseries) Hidden

Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)

SteelSeries GG 17.1.0 (HKLM\...\SteelSeries GG) (Version: 17.1.0 - SteelSeries ApS)

SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 10.0.1220 - SUPERAntiSpyware.com)

The Witcher 3 Mod Manager (HKLM\...\{B8F09437-C8B5-4DFD-B655-C93E8C05A8DE}) (Version: 0.6.4 - stefan3372)

UCheck version 4.0.6.0 (HKLM\...\C4E7EE54-826F-41C4-BE3C-375CC70DC1D8_is1) (Version: 4.0.6.0 - Adlice Software)

ULauncher (HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\ULauncher) (Version: 0.33.52 - uwow.biz)

Update for Windows 10 for x64-based Systems (KB4023057) (HKLM\...\{F14FB68A-9188-4036-AD0D-D054BC9C9291}) (Version: 2.59.0.0 - Microsoft Corporation)

Vulkan Run Time Libraries 1.0.39.1 (HKLM\...\VulkanRT1.0.39.1) (Version: 1.0.39.1 - LunarG, Inc.)

Vulkan Run Time Libraries 1.0.61.0 (HKLM\...\VulkanRT1.0.61.0) (Version: 1.0.61.0 - LunarG, Inc.) Hidden

Vulkan Run Time Libraries 1.0.65.0 (HKLM\...\VulkanRT1.0.65.0) (Version: 1.0.65.0 - LunarG, Inc.) Hidden

Vulkan Run Time Libraries 1.0.65.0 (HKLM\...\VulkanRT1.0.65.0-3) (Version: 1.0.65.0 - LunarG, Inc.) Hidden

Windows PC Health Check (HKLM\...\{6798C408-2636-448C-8AC6-F4E341102D27}) (Version: 3.6.2204.08001 - Microsoft Corporation)

WinRAR 6.02 (64-bit) (HKLM\...\WinRAR archiver) (Version: 6.02.0 - win.rar GmbH)

Zoom (HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\ZoomUMX) (Version: 5.8.4 (1736) - Zoom Video Communications, Inc.)

 

Packages:

=========

9 zip -> C:\Program Files\WindowsApps\184MagikHub.9zip_3.3.75.0_x64__hvr7qkvwfhvx6 [2020-07-19] (Magik Hub) [MS Ad]

Adblock Plus -> C:\Program Files\WindowsApps\EyeoGmbH.AdblockPlus_0.9.19.0_neutral__d55gg7py3s0m0 [2021-10-07] (eyeo GmbH)

AdGuard AdBlocker -> C:\Program Files\WindowsApps\Adguard.AdguardAdBlocker_3.3.8.0_neutral__m055xr0c82818 [2020-01-11] (Performix)

Autodesk SketchBook -> C:\Program Files\WindowsApps\89006A2E.AutodeskSketchBook_5.1.0.0_x64__tf1gferkr813w [2019-11-06] (Autodesk Inc.)

Bubble Witch 3 Saga -> C:\Program Files\WindowsApps\king.com.BubbleWitch3Saga_7.17.65.0_x86__kgqvnymyfvs32 [2022-03-30] (king.com)

Candy Crush Soda Saga -> C:\Program Files\WindowsApps\king.com.CandyCrushSodaSaga_1.215.400.0_x64__kgqvnymyfvs32 [2022-04-08] (king.com)

Disney Magic Kingdoms -> C:\Program Files\WindowsApps\A278AB0D.DisneyMagicKingdoms_6.7.12.0_x86__h6adky7gbf63m [2022-03-09] (Gameloft SE)

Hidden City: Hidden Object Adventure -> C:\Program Files\WindowsApps\828B5831.HiddenCityMysteryofShadows_1.47.4702.0_x86__ytsefhwckbdv6 [2022-04-14] (G5 Entertainment AB)

HP Smart -> C:\Program Files\WindowsApps\AD2F1837.HPPrinterControl_135.1.385.0_x64__v10z8vjag6ke6 [2022-03-22] (HP Inc.)

March of Empires: War of Lords -> C:\Program Files\WindowsApps\A278AB0D.MarchofEmpires_6.3.1.0_x86__h6adky7gbf63m [2022-04-14] (Gameloft SE)

Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x64__8wekyb3d8bbwe [2021-10-07] (Microsoft Corporation) [MS Ad]

Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x86__8wekyb3d8bbwe [2021-10-07] (Microsoft Corporation) [MS Ad]

Microsoft Solitaire Collection -> C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.12.3171.0_x64__8wekyb3d8bbwe [2022-03-24] (Microsoft Studios) [MS Ad]

Minecraft for Windows 10 -> C:\Program Files\WindowsApps\Microsoft.MinecraftUWP_1.18.3004.0_x64__8wekyb3d8bbwe [2022-04-19] (Microsoft Studios)

Photos Media Engine Add-on -> C:\Program Files\WindowsApps\Microsoft.Photos.MediaEngineDLC_1.0.0.0_x64__8wekyb3d8bbwe [2020-04-05] (Microsoft Corporation)

Plex -> C:\Program Files\WindowsApps\CAF9E577.Plex_3.2.20.0_x64__aam28m9va5cke [2017-12-09] (Plex)

Xbox One SmartGlass -> C:\Program Files\WindowsApps\Microsoft.XboxOneSmartGlass_2.2.1702.2004_x64__8wekyb3d8bbwe [2017-12-27] (Microsoft Corporation)

 

==================== Custom CLSID (Whitelisted): ==============

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2021-06-11] (win.rar GmbH -> Alexander Roshal)

ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2021-06-11] (win.rar GmbH -> Alexander Roshal)

ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2021-02-21] (Malwarebytes Corporation -> Malwarebytes)

ContextMenuHandlers5: [ACE] -> {5E2121EE-0300-11D4-8D3B-444553540000} => C:\WINDOWS\System32\atiacm64.dll [2022-01-17] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)

ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2021-02-21] (Malwarebytes Corporation -> Malwarebytes)

ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2021-06-11] (win.rar GmbH -> Alexander Roshal)

ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2021-06-11] (win.rar GmbH -> Alexander Roshal)

 

==================== Codecs (Whitelisted) ====================

 

==================== Shortcuts & WMI ========================

 

==================== Loaded Modules (Whitelisted) =============

 

2021-04-21 03:30 - 2021-04-21 03:30 - 000017920 _____ () [File not signed] C:\Program Files\AMD\CNext\CNext\libEGL.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 003567616 _____ () [File not signed] C:\Program Files\AMD\CNext\CNext\libGLESv2.dll

2021-11-12 22:17 - 2021-11-12 22:17 - 000912896 _____ () [File not signed] C:\Program Files\AMD\Performance Profile Client\aws-cpp-sdk-core.dll

2021-11-12 22:17 - 2021-11-12 22:17 - 003109888 _____ () [File not signed] C:\Program Files\AMD\Performance Profile Client\aws-cpp-sdk-s3.dll

2022-01-18 00:17 - 2022-01-18 00:17 - 000562688 _____ (Advanced Micro Devices) [File not signed] C:\Program Files\AMD\CNext\CNext\Device.dll

2022-01-18 00:17 - 2022-01-18 00:17 - 000058880 _____ (Advanced Micro Devices) [File not signed] C:\Program Files\AMD\CNext\CNext\Platform.dll

2022-01-18 01:45 - 2022-01-18 01:45 - 001717248 _____ (Advanced Micro Devices, Inc.) [File not signed] C:\Program Files\AMD\WVR\OpenVR\bin\win64\driver_amdwvr.dll

2021-12-06 11:11 - 2021-12-06 11:11 - 002146304 _____ (Holtek Semiconductor Inc.) [File not signed] C:\Program Files\SteelSeries\GG\HIDDLL.dll

2021-12-06 11:11 - 2021-12-06 11:11 - 002284032 _____ (Holtek) [File not signed] C:\Program Files\SteelSeries\GG\ISPDLL.dll

2017-09-05 00:15 - 2017-09-05 00:15 - 004396032 _____ (Microsoft Corporation) [File not signed] C:\Program Files\AMD\CNext\CNext\D3DCompiler_47.dll

2020-04-19 10:41 - 2020-04-19 10:41 - 000000000 ____L (Microsoft Corporation) [simlink -> C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppvIsvSubsystems64.dll] C:\Program Files\Microsoft Office\Root\Office16\AppVIsvSubsystems64.dll

2020-04-19 10:41 - 2020-04-19 10:41 - 000000000 ____L (Microsoft Corporation) [simlink -> C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2R64.dll] C:\Program Files\Microsoft Office\Root\Office16\c2r64.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000057856 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\plugins\audio\qtaudio_windows.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000031744 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\plugins\imageformats\qgif.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000039424 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\plugins\imageformats\qicns.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000031232 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\plugins\imageformats\qico.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000415232 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\plugins\imageformats\qjpeg.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000025088 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\plugins\imageformats\qsvg.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000025088 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\plugins\imageformats\qtga.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000023552 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\plugins\imageformats\qwbmp.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000532992 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\plugins\imageformats\qwebp.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 001455104 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\plugins\platforms\qwindows.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 001227776 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\plugins\sqldrivers\qsqlite.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000135680 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\plugins\styles\qwindowsvistastyle.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 006270976 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5Core.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 006947328 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5Gui.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000740352 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5Multimedia.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000123392 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5MultimediaQuick.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 001110528 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5Network.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000326656 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5Positioning.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 003798528 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5Qml.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000440832 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5QmlModels.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000054784 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5QmlWorkerScript.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 004255744 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5Quick.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000171520 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5QuickControls2.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 001128448 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5QuickTemplates2.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000206336 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5Sql.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000334336 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5Svg.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000133120 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5WebChannel.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000396800 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5WebEngine.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 102854656 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5WebEngineCore.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 005611008 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5Widgets.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000463360 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5WinExtras.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000210432 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5Xml.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 002877440 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5XmlPatterns.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000056832 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\QtGraphicalEffects\private\qtgraphicaleffectsprivate.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000059392 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\QtGraphicalEffects\qtgraphicaleffectsplugin.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000267776 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\QtMultimedia\declarative_multimedia.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000017408 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\QtQml\qmlplugin.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000017920 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\QtQuick.2\qtquick2plugin.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000290816 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\QtQuick\Controls.2\qtquickcontrols2plugin.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000336896 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\QtQuick\Controls\qtquickcontrolsplugin.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000134144 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\QtQuick\Dialogs\dialogplugin.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000106496 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\QtQuick\Layouts\qquicklayoutsplugin.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000325120 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\QtQuick\Templates.2\qtquicktemplates2plugin.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000045568 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\QtQuick\Window.2\windowplugin.dll

2021-04-21 03:30 - 2021-04-21 03:30 - 000093184 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\QtWebEngine\qtwebengineplugin.dll

 

==================== Alternate Data Streams (Whitelisted) ========

 

==================== Safe Mode (Whitelisted) ==================

 

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

 

==================== Association (Whitelisted) =================

 

==================== Internet Explorer (Whitelisted) ==========

 

HKU\S-1-5-21-2108490749-413910539-1021375685-1003\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://oem17win10.msn.com/?pc=NMTE

BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll [2022-03-03] (Microsoft Corporation -> Microsoft Corporation)

Handler-x32: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files (x86)\Belarc\BelarcAdvisor\System\BAVoilaX.dll [2019-01-25] (Belarc, Inc. -> Belarc, Inc.)

Handler: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2022-04-05] (Microsoft Corporation -> Microsoft Corporation)

Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2022-04-05] (Microsoft Corporation -> Microsoft Corporation)

Handler: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2022-04-05] (Microsoft Corporation -> Microsoft Corporation)

Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2022-04-05] (Microsoft Corporation -> Microsoft Corporation)

Handler: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2022-04-05] (Microsoft Corporation -> Microsoft Corporation)

Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2022-04-05] (Microsoft Corporation -> Microsoft Corporation)

Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2022-04-05] (Microsoft Corporation -> Microsoft Corporation)

Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2022-04-05] (Microsoft Corporation -> Microsoft Corporation)

 

==================== Hosts content: =========================

 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

 

2017-03-18 15:03 - 2020-12-29 17:04 - 000000824 _____ C:\WINDOWS\system32\drivers\etc\hosts

 

==================== Other Areas ===========================

 

(Currently there is no automatic fix for this section.)

 

HKLM\System\CurrentControlSet\Control\Session Manager\Environment\\Path -> C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Program Files (x86)\Razer Chroma SDK\bin;C:\Program Files\Razer Chroma SDK\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\WiFi\bin\;C:\Program Files\Common Files\Intel\WirelessCommon\;C:\Users\Dohnovan\AppData\Local\Microsoft\WindowsApps;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps;%SYSTEMROOT%\System32\OpenSSH\

HKU\S-1-5-21-2108490749-413910539-1021375685-1003\Control Panel\Desktop\\Wallpaper -> c:\windows\web\wallpaper\windows\img0.jpg

DNS Servers: 75.75.75.75 - 75.75.76.76

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: )

Windows Firewall is enabled.

 

Network Binding:

=============

Bluetooth Network Connection: ExitLag Game Booster -> nt_ndextlag (enabled) 

Wi-Fi: ExitLag Game Booster -> nt_ndextlag (enabled) 

Local Area Connection: ExitLag Game Booster -> nt_ndextlag (enabled) 

Ethernet 2: ExitLag Game Booster -> nt_ndextlag (enabled) 

 

==================== MSCONFIG/TASK MANAGER disabled items ==

 

(If an entry is included in the fixlist, it will be removed.)

 

HKLM\...\StartupApproved\Run32: => "Discord"

HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\StartupApproved\Run: => "OneDrive"

HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\StartupApproved\Run: => "Steam"

HKU\S-1-5-21-2108490749-413910539-1021375685-1003\...\StartupApproved\Run: => "OPENVPN-GUI"

 

==================== FirewallRules (Whitelisted) ================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

FirewallRules: [{3351BAF1-BD8E-4881-9C12-D3FEA0E049E7}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\StateOfDecay2\StateOfDecay2\Binaries\Win64\StateOfDecay2-Win64-Shipping.exe (Undead Labs, LLC) [File not signed]

FirewallRules: [{25CCACBF-D00F-4DE0-8FDF-ED1A812FAADF}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\StateOfDecay2\StateOfDecay2\Binaries\Win64\StateOfDecay2-Win64-Shipping.exe (Undead Labs, LLC) [File not signed]

FirewallRules: [{63CB26E2-BC63-42BC-A5D0-0E12FF443786}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Unturned\Unturned.exe (Smartly Dressed Games Ltd. -> ) [File not signed]

FirewallRules: [{2646AFA2-162E-42A1-80E5-8FCE3C4E271C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Unturned\Unturned.exe (Smartly Dressed Games Ltd. -> ) [File not signed]

FirewallRules: [{DBF7A4A0-370F-475C-AD48-E9EB329F39A2}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Unturned\Unturned_BE.exe (BattlEye Innovations e.K. -> BattlEye Innovations)

FirewallRules: [{093A4023-8BA4-40A8-937A-7E3E26A36939}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Unturned\Unturned_BE.exe (BattlEye Innovations e.K. -> BattlEye Innovations)

FirewallRules: [{DB8FEBBB-6628-47F5-803B-46B0F78DE4C4}] => (Allow) C:\Users\Dohnovan\AppData\Roaming\Zoom\bin\Zoom.exe (Zoom Video Communications, Inc. -> Zoom Video Communications, Inc.)

FirewallRules: [{E5143819-BFC2-4C59-9BAD-1344103E4AD5}] => (Allow) C:\Program Files (x86)\SquareEnix\FINAL FANTASY XIV - A Realm Reborn\Advanced Combat Tracker\Advanced Combat Tracker.exe (EQAditu) [File not signed]

FirewallRules: [{5E6DF25B-EE60-4F06-B08B-00004B89EB93}] => (Allow) C:\Program Files (x86)\SquareEnix\FINAL FANTASY XIV - A Realm Reborn\boot\ffxivlauncher.exe (SQUARE ENIX CO., LTD. -> SQUARE ENIX CO., LTD.)

FirewallRules: [{91B94865-65B7-45CA-AF9E-44B3023CB9CC}] => (Allow) C:\Program Files (x86)\SquareEnix\FINAL FANTASY XIV - A Realm Reborn\boot\ffxivlauncher.exe (SQUARE ENIX CO., LTD. -> SQUARE ENIX CO., LTD.)

FirewallRules: [{E2421D3E-73BD-4E25-9656-92F5F49738FB}] => (Allow) C:\Program Files (x86)\SquareEnix\FINAL FANTASY XIV - A Realm Reborn\boot\ffxivboot.exe (SQUARE ENIX CO., LTD. -> SQUARE ENIX CO., LTD.)

FirewallRules: [{1BE0A6A0-5613-4700-829E-225605C5D1E7}] => (Allow) C:\Program Files (x86)\SquareEnix\FINAL FANTASY XIV - A Realm Reborn\boot\ffxivboot.exe (SQUARE ENIX CO., LTD. -> SQUARE ENIX CO., LTD.)

FirewallRules: [{D83A3869-F28B-4A4C-B367-B9F8F6B62C4D}] => (Allow) c:\program files (x86)\exitlag\exitlag.exe (SKOWSAND SERVICOS DE PROVEDORES E INTERNET LTDA -> )

FirewallRules: [{54ABB1D1-2DBD-4DA9-BE0E-58C743F320FF}] => (Allow) c:\program files (x86)\exitlag\exitlag.exe (SKOWSAND SERVICOS DE PROVEDORES E INTERNET LTDA -> )

FirewallRules: [{0E3D7240-E0CA-4AD9-AB7E-83B299E16D7C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Borderlands 3\OakGame\Binaries\Win64\Borderlands3.exe (Gearbox Software, L.L.C. -> Gearbox Software)

FirewallRules: [{0E651DF0-62D3-41D5-B039-3C42CE903B96}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Borderlands 3\OakGame\Binaries\Win64\Borderlands3.exe (Gearbox Software, L.L.C. -> Gearbox Software)

FirewallRules: [{1F8ED8C6-7BC4-4A9D-A0C4-CB325EFD5D6B}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe (Intel Corporation-Wireless Connectivity Solutions -> )

FirewallRules: [{50E286A9-EC43-4A42-82B3-B541B6893C62}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Witcher 3\bin\x64\witcher3.exe (CD Projekt Red) [File not signed]

FirewallRules: [{732F52FA-463B-4228-8163-A5EC1E0B8C73}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Witcher 3\bin\x64\witcher3.exe (CD Projekt Red) [File not signed]

FirewallRules: [UDP Query User{31B319D4-01B2-48FE-81A7-51110CE771B7}C:\program files (x86)\steam\steamapps\common\paladins\binaries\win64\paladins.exe] => (Block) C:\program files (x86)\steam\steamapps\common\paladins\binaries\win64\paladins.exe (Hirez Studios, Inc.) [File not signed]

FirewallRules: [TCP Query User{4F7CACBF-BBB5-428E-B6EE-D1163044D084}C:\program files (x86)\steam\steamapps\common\paladins\binaries\win64\paladins.exe] => (Block) C:\program files (x86)\steam\steamapps\common\paladins\binaries\win64\paladins.exe (Hirez Studios, Inc.) [File not signed]

FirewallRules: [UDP Query User{355EBCE9-2330-4B92-8E46-C7C76C402DA4}C:\program files (x86)\steam\steamapps\common\paladins\binaries\win64\paladins.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\paladins\binaries\win64\paladins.exe (Hirez Studios, Inc.) [File not signed]

FirewallRules: [TCP Query User{2C813A9F-F998-4D44-8B34-6963CF481A47}C:\program files (x86)\steam\steamapps\common\paladins\binaries\win64\paladins.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\paladins\binaries\win64\paladins.exe (Hirez Studios, Inc.) [File not signed]

FirewallRules: [{AE0EC883-ECC1-4257-9241-1C9586835901}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Paladins\Binaries\Win64\PaladinsEAC.exe (EasyAntiCheat Oy -> EasyAntiCheat Ltd)

FirewallRules: [{F2E459D0-8C52-44F9-B805-AFDA263B500D}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Paladins\Binaries\Win64\PaladinsEAC.exe (EasyAntiCheat Oy -> EasyAntiCheat Ltd)

FirewallRules: [{D37551E3-AE21-495A-90C1-0CE6907D3259}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Dishonored2\Dishonored2.exe (Arkane Studios) [File not signed]

FirewallRules: [{8D6BD339-6DB0-4B01-B064-950E1CB534FD}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Dishonored2\Dishonored2.exe (Arkane Studios) [File not signed]

FirewallRules: [{A8E5B1A0-6D7D-4D9C-96E1-B72039726CC2}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (Valve Corp. -> Valve Corporation)

FirewallRules: [{21FC1428-1EFB-47FF-BF78-DB5B1945382E}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (Valve Corp. -> Valve Corporation)

FirewallRules: [{D98FA1A5-1463-4F80-B944-62DCFE82B0DA}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe (Valve Corp. -> Valve Corporation)

FirewallRules: [{A73A6A68-3D6E-4ACB-BB1C-69891D2BC2E1}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe (Valve Corp. -> Valve Corporation)

FirewallRules: [TCP Query User{3A8F03ED-1DF4-4EFC-AB24-470F3D8E2A04}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe (Google LLC -> Google LLC)

FirewallRules: [UDP Query User{0C6F481E-F930-4C76-AE5C-202166C80AE3}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe (Google LLC -> Google LLC)

FirewallRules: [{F01FBF58-567C-4C2D-9E09-69501E7126D0}] => (Block) C:\program files (x86)\google\chrome\application\chrome.exe (Google LLC -> Google LLC)

FirewallRules: [{E246DB11-0299-4E9E-BAF1-F9600C9E1E87}] => (Block) C:\program files (x86)\google\chrome\application\chrome.exe (Google LLC -> Google LLC)

FirewallRules: [{C3DAE883-E9F4-413F-86F6-8D3F4B8E79BD}] => (Allow) C:\Users\Dohnovan\AppData\Roaming\Zoom\bin\Zoom.exe (Zoom Video Communications, Inc. -> Zoom Video Communications, Inc.)

FirewallRules: [TCP Query User{427E764D-7D50-4DBB-AC61-F5BF16E6D63A}C:\users\dohnovan\desktop\genshin impact\genshin impact game\genshinimpact.exe] => (Allow) C:\users\dohnovan\desktop\genshin impact\genshin impact game\genshinimpact.exe (miHoYo Co.,Ltd. -> )

FirewallRules: [UDP Query User{D6D9EA3B-D5BC-430D-9190-8944076D6D6C}C:\users\dohnovan\desktop\genshin impact\genshin impact game\genshinimpact.exe] => (Allow) C:\users\dohnovan\desktop\genshin impact\genshin impact game\genshinimpact.exe (miHoYo Co.,Ltd. -> )

FirewallRules: [{9A00E6EC-5378-4B5F-A60E-821FCF79D9BA}] => (Block) C:\users\dohnovan\desktop\genshin impact\genshin impact game\genshinimpact.exe (miHoYo Co.,Ltd. -> )

FirewallRules: [{BD98832D-0364-4199-8298-C05E288941C7}] => (Block) C:\users\dohnovan\desktop\genshin impact\genshin impact game\genshinimpact.exe (miHoYo Co.,Ltd. -> )

FirewallRules: [{8E02FA4D-86A3-4245-BCC4-040BA4750900}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\outlook.exe (Microsoft Corporation -> Microsoft Corporation)

FirewallRules: [{26C6520C-1EDF-4657-9DAD-6039133816D0}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Tools\Launcher.exe (Digital Extremes Ltd. -> Digital Extremes)

FirewallRules: [{2827F5D3-4F6E-4EFF-9AE0-E5865AD47630}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Warframe.x64.exe (Digital Extremes Ltd. -> Digital Extremes)

FirewallRules: [{7A4F04D6-31F5-4E1E-ACBC-CE380D7D7355}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Warframe.x64.exe (Digital Extremes Ltd. -> Digital Extremes)

FirewallRules: [{6FDEEC98-0DAA-4F6E-94E9-C31F604A9162}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Tools\RemoteCrashSender.exe (Digital Extremes Ltd. -> )

FirewallRules: [{57A5D862-A95D-4D81-A8E7-D13E4A7DA43C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Tools\Launcher.exe (Digital Extremes Ltd. -> Digital Extremes)

FirewallRules: [{043C2C11-F499-4DE4-AD71-7790ABCE0657}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Warframe.x64.exe (Digital Extremes Ltd. -> Digital Extremes)

FirewallRules: [{C726A832-531C-4D1C-8270-6425383DFD61}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Warframe.x64.exe (Digital Extremes Ltd. -> Digital Extremes)

FirewallRules: [{D69240F3-FBDA-4737-9C5D-ADAC14833D1E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Tools\RemoteCrashSender.exe (Digital Extremes Ltd. -> )

FirewallRules: [{2DA2D552-B60C-48F0-9B9C-02E9D23762B0}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.82.404.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)

FirewallRules: [{511BCC85-2F53-4476-9433-ED52E427F473}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.82.404.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)

FirewallRules: [{4EB258DF-AB3D-45CC-A06D-F351D521D4EB}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.82.404.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)

FirewallRules: [{26752D40-C03A-48FC-9039-40C58F1D6285}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.82.404.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)

FirewallRules: [{2E8C830A-13CC-4438-B0E3-DF5A32DF1D5F}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google LLC)

FirewallRules: [{9A999737-C017-421D-9D02-88BC5CF2640A}] => (Allow) C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe (Brave Software, Inc. -> Brave Software, Inc.)

FirewallRules: [{30E37C1A-7A5C-4537-B737-CA6CD88E5486}] => (Allow) C:\Program Files (x86)\Microsoft\EdgeWebView\Application\100.0.1185.44\msedgewebview2.exe (Microsoft Corporation -> Microsoft Corporation)

 

==================== Restore Points =========================

 

03-04-2022 17:57:44 Scheduled Checkpoint

12-04-2022 16:06:33 Scheduled Checkpoint

21-04-2022 16:30:19 Scheduled Checkpoint

 

==================== Faulty Device Manager Devices ============

 

 

==================== Event log errors: ========================

 

Application errors:

==================

Error: (04/22/2022 09:26:32 PM) (Source: Microsoft-Windows-Defrag) (EventID: 264) (User: )

Description: The storage optimizer couldn't complete retrim on Windows (C:) because: The operation requested is not supported by the hardware backing the volume. (0x8900002A)

 

Error: (04/22/2022 10:26:26 AM) (Source: VSS) (EventID: 8193) (User: )

Description: Volume Shadow Copy Service error: Unexpected error calling routine QueryFullProcessImageNameW.  hr = 0x8007001f, A device attached to the system is not functioning.

.

 

 

Operation:

   Executing Asynchronous Operation

 

Context:

   Current State: DoSnapshotSet

 

Error: (04/22/2022 10:24:38 AM) (Source: VSS) (EventID: 8194) (User: )

Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005, Access is denied.

.

This is often caused by incorrect security settings in either the writer or requestor process.

 

 

Operation:

   Gathering Writer Data

 

Context:

   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}

   Writer Name: System Writer

   Writer Instance ID: {d3e3528d-0bc9-427a-89d7-86340cdcb0c8}

 

Error: (04/21/2022 07:00:47 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: The program Wow.exe version 3.3.5.12340 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

 

Process ID: 6164

 

Start Time: 01d855d611661336

 

Termination Time: 31

 

Application Path: C:\Users\Dohnovan\Desktop\World of Warcraft 3.3.5a\Wow.exe

 

Report Id: 4cd25088-700b-43f8-8ac7-610c9c94a812

 

Faulting package full name: 

 

Faulting package-relative application ID: 

 

Hang type: Unknown

 

Error: (04/21/2022 05:18:10 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: The program Wow.exe version 3.3.5.12340 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

 

Process ID: 8a4

 

Start Time: 01d855cc10de745d

 

Termination Time: 10

 

Application Path: C:\Users\Dohnovan\Desktop\World of Warcraft 3.3.5a\Wow.exe

 

Report Id: 4eddffd9-4af1-45a2-9e66-506a2d9404c0

 

Faulting package full name: 

 

Faulting package-relative application ID: 

 

Hang type: Unknown

 

Error: (04/19/2022 08:29:13 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: The program Wow.exe version 3.3.5.12340 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

 

Process ID: 504

 

Start Time: 01d854480b210539

 

Termination Time: 13

 

Application Path: C:\Users\Dohnovan\Desktop\World of Warcraft 3.3.5a\Wow.exe

 

Report Id: 91d5e3d2-e5bc-409b-89e5-68b6dda65d4d

 

Faulting package full name: 

 

Faulting package-relative application ID: 

 

Hang type: Unknown

 

Error: (04/18/2022 01:36:18 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: The program FRST64.exe version 19.5.2021.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

 

Process ID: 6a8

 

Start Time: 01d8535b6f735f4a

 

Termination Time: 4294967295

 

Application Path: C:\Users\Dohnovan\Desktop\FRST64.exe

 

Report Id: 420cc456-17d2-44f1-adb6-00f223d15a59

 

Faulting package full name: 

 

Faulting package-relative application ID: 

 

Hang type: Top level window is idle

 

Error: (04/17/2022 10:32:10 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: Razer Synapse Service.exe, version: 1.0.0.0, time stamp: 0x624275cc

Faulting module name: ntdll.dll, version: 10.0.19041.1566, time stamp: 0xbde09443

Exception code: 0xc0000374

Fault offset: 0x000e6d03

Faulting process id: 0x152c

Faulting application start time: 0x01d84f44e38ebe02

Faulting application path: C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe

Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll

Report Id: 3dd3973b-1943-40b7-a4c1-d697b82b0ee1

Faulting package full name: 

Faulting package-relative application ID:

 

 

System errors:

=============

Error: (04/22/2022 11:12:57 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The AMDRyzenMasterDriver service failed to start due to the following error: 

Cannot create a file when that file already exists.

 

Error: (04/22/2022 11:11:05 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)

Description: WLAN Extensibility Module has stopped unexpectedly.

 

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll

 

Error: (04/22/2022 11:11:05 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)

Description: WLAN Extensibility Module has stopped unexpectedly.

 

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll

 

Error: (04/22/2022 11:10:59 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)

Description: WLAN Extensibility Module has stopped unexpectedly.

 

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll

 

Error: (04/22/2022 11:10:57 AM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-LBHF8BQ)

Description: The server {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} did not register with DCOM within the required timeout.

 

Error: (04/22/2022 10:26:07 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The Razer Synapse Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 0 milliseconds: Run the configured recovery program.

 

Error: (04/22/2022 10:25:53 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The Microsoft Office Click-to-Run Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 0 milliseconds: Restart the service.

 

Error: (04/22/2022 10:25:53 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The Windows Search service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 30000 milliseconds: Restart the service.

 

 

Windows Defender:

================

Date: 2022-04-22 17:04:17

Description: 

Microsoft Defender Antivirus scan has been stopped before completion.

Scan Type: Antimalware

Scan Parameters: Quick Scan

 

Date: 2022-04-21 19:05:50

Description: 

Microsoft Defender Antivirus scan has been stopped before completion.

Scan Type: Antimalware

Scan Parameters: Quick Scan

 

Date: 2022-04-20 16:44:07

Description: 

Microsoft Defender Antivirus scan has been stopped before completion.

Scan Type: Antimalware

Scan Parameters: Quick Scan

 

Date: 2022-04-20 10:01:24

Description: 

Microsoft Defender Antivirus scan has been stopped before completion.

Scan Type: Antimalware

Scan Parameters: Quick Scan

 

Date: 2022-04-18 16:43:44

Description: 

Microsoft Defender Antivirus scan has been stopped before completion.

Scan Type: Antimalware

Scan Parameters: Quick Scan



CodeIntegrity:

===============

Date: 2022-04-22 17:03:52

Description: 

Code Integrity determined that a process (\Device\HarddiskVolume4\ProgramData\Microsoft\Windows Defender\Platform\4.18.2203.5-0\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

 

Date: 2022-04-06 11:22:44

Description: 

Code Integrity determined that a process (\Device\HarddiskVolume4\ProgramData\Microsoft\Windows Defender\Platform\4.18.2202.4-0\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

 

 

==================== Memory info =========================== 

 

BIOS: American Megatrends Inc. 1.51 05/02/2017

Motherboard: Micro-Star International Co., Ltd B350M BAZOOKA (MS-7A38)

Processor: AMD Ryzen 5 1400 Quad-Core Processor 

Percentage of memory in use: 73%

Total physical RAM: 8144.69 MB

Available physical RAM: 2130.39 MB

Total Virtual: 14032.69 MB

Available Virtual: 2155.32 MB

 

==================== Drives ================================

 

Drive c: (Windows) (Fixed) (Total:930.35 GB) (Free:123.26 GB) NTFS

 

\\?\Volume{34b487b2-1f24-455b-888b-88fe24145180}\ () (Fixed) (Total:0.49 GB) (Free:0.47 GB) NTFS

\\?\Volume{9545ae2b-ceb4-43bc-a9a6-ddd687564b0d}\ () (Fixed) (Total:0.56 GB) (Free:0.08 GB) NTFS

\\?\Volume{7c6e70a3-6b38-47db-a32a-880393128539}\ (SYSTEM) (Fixed) (Total:0.09 GB) (Free:0.07 GB) FAT32

 

==================== MBR & Partition Table ====================

 

==========================================================

Disk: 0 (Size: 931.5 GB) (Disk ID: 1BA58450)

 

Partition: GPT.

 

==================== End of Addition.txt =======================

[DR M]

Hi, Dohnovan.
 
You have still both the Adblockers in Edge. I know you said that you are not using Edge, but since we started to make some tidiness, please remove one of those. 
 
You have SuperAntiSpyware, SpywareBlaster, Ucheck and previously you had Hitman Pro installed. I gather that one of these programs blocks Eset. Although I don't see it as a problem, I would disable all these programs and then check if Eset opens or not. Do not try to do that yet. Leave it at the end of the procedure. 
 
Let's now proceed to the following steps. First, I would like you to check if Windows Defender runs properly. Then I'm asking you to perform two scans with Malwarebytes and AdwCleaner. 
 
 

1. Check from Settings

• Go to Settings (Windows icon on the keyboard + i)
• Select Update & Security
• From the left pane, Windows Security
• Open Windows Security
• Take a screenshot of what you see

 

2. Check services with FSS

• Please download Farbar Service Scanner and save it on your Desktop. IMPORTANT.
• Right click on the tool icon and run it as administrator.
• Make sure all the options are checked.
• Click on the Scan button.
• It will create a log (FSS.txt) on your Desktop.
• Copy and paste the log's content to your next reply.

 

3. Run AdwCleaner (scan only)

Download AdwCleaner and save it to your desktop.

• Double click AdwCleaner.exe to run it.
• Click Scan Now.
  • When the scan has finished, a Scan Results window will open.
  • Click Cancel (at this point do not attempt to Quarantine anything that is found)
• Now click the Log Files tab.
  • Double click on the latest scan log (Scan logs have a [S0*] suffix, where * is replaced by a number. The latest scan will have the largest number)
  • A Notepad file will open containing the results of the scan.
  • Please post the contents of the file in your next reply.

 

4. Run Malwarebytes (scan only)

• Start with uninstalling the old version you have installed: Malwarebytes version 4.4.11.149
• Download Malwarebytes and save it to your Desktop.
• Once downloaded, close all programs and Windows on your computer.
• Double-click on the icon on your desktop named MBSetup.exe. This will start the installation of MBAM onto your computer.
• Follow the instructions to install the program.
• When finished, double click the program's icon created on your Desktop.
• Click the little gear on the top right (Settings) and when it opens, click the Security tab and make sure about the following:
  

  Under the title Scan Options, all the options are checked.
  Under the title Windows Security Center (Premium only) the option is NOT checked.
  Under the title Potentially unwanted items all options are set to Always.

• Click on the little gear to return to the main menu and select Scan. The program will start scanning your computer. This may take about 10 minutes, but in some cases it may be take longer.
• When finished, you will see the Threat Scan Summary window open.
• If threats are not found, click View Report and proceed to the two last steps below.
  
  If threats are found, make sure that all threats are not selected, close the program and proceed to the next steps below.
  • Open Malwarebytes again, click on the Scanner, and then on the Reports tab.
  • Find the report with the most recent date and double click on it.
  • Click on Export and then Copy to Clipboard.
  • Paste its content here, in your next reply.

 

In your next reply please post:

1. The screenshot from Windows Security
2. The FSS.txt
3. The AdwCleaner[S0*].txt
4. The Malwarebytes report

[Dohnovan]

Malwarebytes didn't detect anything.

 

Farbar Service Scanner Version: 03-11-2021

Ran by Dohnovan (administrator) on 25-04-2022 at 12:28:39

Running from "C:\Users\Dohnovan\Desktop"

Microsoft Windows 10 Home  (X64)

Boot Mode: Normal

****************************************************************

 

Internet Services:

============

 

Connection Status:

==============

Localhost is accessible.

LAN connected.

Google IP is accessible.

Google.com is accessible.

Yahoo.com is accessible.

 

 

Windows Firewall:

=============

 

Firewall Disabled Policy: 

==================

 

 

System Restore:

============

 

System Restore Policy: 

========================

 

 

Windows Security:

============

 

 

Windows Update:

============

 

Windows Autoupdate Disabled Policy: 

============================

 

 

Windows Defender:

==============

 

Other Services:

==============

 

 

File Check:

========

C:\Windows\System32\nsisvc.dll => File is digitally signed

C:\Windows\System32\Drivers\nsiproxy.sys => File is digitally signed

C:\Windows\System32\Drivers\afd.sys => File is digitally signed

C:\Windows\System32\Drivers\tdx.sys => File is digitally signed

C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed

C:\Windows\System32\dnsrslvr.dll => File is digitally signed

C:\Windows\System32\dnsapi.dll => File is digitally signed

C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed

C:\Windows\System32\mpssvc.dll => File is digitally signed

C:\Windows\System32\bfe.dll => File is digitally signed

C:\Windows\System32\Drivers\mpsdrv.sys => File is digitally signed

C:\Windows\System32\SDRSVC.dll => File is digitally signed

C:\Windows\System32\vssvc.exe => File is digitally signed

C:\Windows\System32\SecurityHealthService.exe => File is digitally signed

C:\Windows\System32\wscsvc.dll => File is digitally signed

C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed

C:\Windows\System32\wuaueng.dll => File is digitally signed

C:\Windows\System32\qmgr.dll => File is digitally signed

C:\Windows\System32\es.dll => File is digitally signed

C:\Windows\System32\cryptsvc.dll => File is digitally signed

C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed

C:\Windows\System32\ipnathlp.dll => File is digitally signed

C:\Windows\System32\iphlpsvc.dll => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

 

 

**** End of log ****

 

# -------------------------------

# Malwarebytes AdwCleaner 8.3.2.0

# -------------------------------

# Build:    03-23-2022

# Database: 2022-03-15.3 (Cloud)

# Support:  https://www.malwarebytes.com/support

#

# -------------------------------

# Mode: Scan

# -------------------------------

# Start:    04-25-2022

# Duration: 00:00:45

# OS:       Windows 10 Home

# Scanned:  32048

# Detected: 1

 

 

***** [ Services ] *****

 

No malicious services found.

 

***** [ Folders ] *****

 

No malicious folders found.

 

***** [ Files ] *****

 

PUP.Optional.Legacy             C:\END

 

***** [ DLL ] *****

 

No malicious DLLs found.

 

***** [ WMI ] *****

 

No malicious WMI found.

 

***** [ Shortcuts ] *****

 

No malicious shortcuts found.

 

***** [ Tasks ] *****

 

No malicious tasks found.

 

***** [ Registry ] *****

 

No malicious registry entries found.

 

***** [ Chromium (and derivatives) ] *****

 

No malicious Chromium entries found.

 

***** [ Chromium URLs ] *****

 

No malicious Chromium URLs found.

 

***** [ Firefox (and derivatives) ] *****

 

No malicious Firefox entries found.

 

***** [ Firefox URLs ] *****

 

No malicious Firefox URLs found.

 

***** [ Hosts File Entries ] *****

 

No malicious hosts file entries found.

 

***** [ Preinstalled Software ] *****

 

No Preinstalled Software found.

 

 

 

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S00].txt ##########

 

 

 

 

[Dohnovan]

[DR M]

Thanks, Dohnovan.

 

Run AdwCleaner once more, and when an item detected, send it to Quarantine. 

 

C:\END

 

 

After that, let me see the latest AdwCleaner[C0*].txt log. 

 

Have you tried to disable the programs I mentioned above, to check if/which one blocks Eset? As I said, not a big deal, but it would be good to know. 

[Dohnovan]

I exited out of every program you said could be effecting eset and even disabled windows defender and it still didn't work.

 

 

# -------------------------------

# Malwarebytes AdwCleaner 8.3.2.0

# -------------------------------

# Build:    03-23-2022

# Database: 2022-04-27.2 (Cloud)

# Support:  https://www.malwarebytes.com/support

#

# -------------------------------

# Mode: Clean

# -------------------------------

# Start:    04-27-2022

# Duration: 00:00:05

# OS:       Windows 10 Home

# Cleaned:  1

# Failed:   0

 

 

***** [ Services ] *****

 

No malicious services cleaned.

 

***** [ Folders ] *****

 

No malicious folders cleaned.

 

***** [ Files ] *****

 

Deleted       C:\END

 

***** [ DLL ] *****

 

No malicious DLLs cleaned.

 

***** [ WMI ] *****

 

No malicious WMI cleaned.

 

***** [ Shortcuts ] *****

 

No malicious shortcuts cleaned.

 

***** [ Tasks ] *****

 

No malicious tasks cleaned.

 

***** [ Registry ] *****

 

No malicious registry entries cleaned.

 

***** [ Chromium (and derivatives) ] *****

 

No malicious Chromium entries cleaned.

 

***** [ Chromium URLs ] *****

 

No malicious Chromium URLs cleaned.

 

***** [ Firefox (and derivatives) ] *****

 

No malicious Firefox entries cleaned.

 

***** [ Firefox URLs ] *****

 

No malicious Firefox URLs cleaned.

 

***** [ Hosts File Entries ] *****

 

No malicious hosts file entries cleaned.

 

***** [ Preinstalled Software ] *****

 

No Preinstalled Software cleaned.

 

 

*************************

 

[+] Delete Tracing Keys

[+] Reset Winsock

 

*************************

 

AdwCleaner[S00].txt - [1419 octets] - [25/04/2022 12:38:13]

AdwCleaner[S01].txt - [1480 octets] - [27/04/2022 21:42:22]

 

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C01].txt ##########