Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Pc Restarts on Shutdown

Started by ClearGreen , Jan 05 2025 09:50 AM

Please log in to reply

#1
ClearGreen

Posted 05 January 2025 - 09:50 AM

Member

Member
14 posts

Just recently my Pc has begun restarting after I try to shut it down. At first it only happened occasionally, but now it happens every time I try to shut it down and I have to switch off the power to the Pc.

The only thing I can think that started occurring at about the same time is a blue screen coming up after I've clicked Shut Down saying that there is still an app running. When this has happened in the dim and distant past I've always had time to click on Wait or Shut down. This time the screen disappears so quickly I can't even see what the name of the app is.

That's about it. Below are the contents of the .txt files as requested.

Kind regards

Paul

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 04-01-2025

Ran by Paul (administrator) on PC (Micro-Star International Co., Ltd. MS-7B89) (05-01-2025 15:36:18)

Running from C:\Users\Paul\Desktop\FRST64.exe

Loaded Profiles: Paul

Platform: Microsoft Windows 10 Pro Version 22H2 19045.5247 (X64) Language: English (United Kingdom)

Default browser: Chrome

Boot Mode: Normal

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(C:\Program Files\Bitdefender Agent\ProductAgentService.exe ->) (Bitdefender SRL -> Bitdefender) C:\Program Files\Bitdefender Agent\27.0.1.290\DiscoverySrv.exe

(C:\Program Files\Bitdefender\Bitdefender Security App\bdservicehost.exe ->) (Bitdefender SRL -> Bitdefender) C:\Program Files\Bitdefender\Bitdefender Security App\bdagent.exe

(C:\Program Files\Bitdefender\Bitdefender Security\bdservicehost.exe ->) (Bitdefender SRL -> Bitdefender) C:\Program Files\Bitdefender\Bitdefender Security\bdntwrk.exe

(C:\Program Files\Bitdefender\Bitdefender Security\bdservicehost.exe ->) (Bitdefender SRL -> Bitdefender) C:\Program Files\Bitdefender\Bitdefender Security\bduserhost.exe <2>

(C:\Program Files\Bitdefender\Bitdefender Security\bdservicehost.exe ->) (S.C. BITDEFENDER S.R.L. -> Bitdefender) C:\Program Files\Bitdefender\Bitdefender Security\wsccommunicator.exe

(explorer.exe ->) (Google LLC -> Google LLC) C:\Program Files\Google\Chrome\Application\chrome.exe <43>

(services.exe ->) (Bitdefender SRL -> Bitdefender) C:\Program Files\Bitdefender Agent\ProductAgentService.exe

(services.exe ->) (Bitdefender SRL -> Bitdefender) C:\Program Files\Bitdefender Agent\redline\bdredline.exe

(services.exe ->) (Bitdefender SRL -> Bitdefender) C:\Program Files\Bitdefender\Bitdefender Security App\bdservicehost.exe

(services.exe ->) (Bitdefender SRL -> Bitdefender) C:\Program Files\Bitdefender\Bitdefender Security App\safepay\bdservicehost.exe

(services.exe ->) (Bitdefender SRL -> Bitdefender) C:\Program Files\Bitdefender\Bitdefender Security\bdservicehost.exe <3>

(services.exe ->) (Bitdefender SRL -> Bitdefender) C:\Program Files\Bitdefender\Bitdefender Security\updatesrv.exe

(services.exe ->) (Bitdefender SRL -> Bitdefender) C:\Program Files\Common Files\Bitdefender\SetupInformation\Bitdefender RedLine\bdredline.exe

(services.exe ->) (Gen Digital Inc. -> Piriform Software Ltd) C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe

(services.exe ->) (Intel Corporation-Wireless Connectivity Solutions -> Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

(services.exe ->) (Intel Corporation-Wireless Connectivity Solutions -> Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe

(services.exe ->) (Intel Corporation-Wireless Connectivity Solutions -> Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe

(services.exe ->) (NVIDIA Corporation -> NVIDIA Corporation) C:\Windows\System32\DriverStore\FileRepository\nvrfi.inf_amd64_075e0a1c13484a5c\Display.NvContainer\NVDisplay.Container.exe <2>

(services.exe ->) (Pango LLC -> Pango Inc.) C:\Program Files (x86)\Hotspot Shield\12.9.6\bin\cmw_srv.exe

(services.exe ->) (SEIKO EPSON CORPORATION -> Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe

(services.exe ->) (Zoom Video Communications, Inc. -> Zoom Video Communications, Inc.) C:\Program Files\Common Files\Zoom\Support\CptService.exe

(svchost.exe ->) (24803D75-212C-471A-BC57-9EF86AB91435 -> ) C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2450.6.0_x64__cv1g1gvanyjgm\WhatsApp.exe

(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe

==================== Registry (Whitelisted) ===================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Bdagent] => C:\Program Files\Bitdefender\Bitdefender Security App\bdagent.exe [1088776 2024-12-13] (Bitdefender SRL -> Bitdefender)

HKLM\...\Run: [BdagentApp] => C:\Program Files\Bitdefender\Bitdefender Security App\bdagent.exe [1088776 2024-12-13] (Bitdefender SRL -> Bitdefender)

HKLM\...\Run: [EPPCCMON] => C:\Program Files (x86)\EPSON Software\Epson Printer Connection Checker\EPPCCMON.EXE [455968 2023-05-26] (SEIKO EPSON CORPORATION -> Seiko Epson Corporation)

HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [2756368 2023-08-09] (SEIKO EPSON CORPORATION -> Seiko Epson Corporation)

HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Restriction <==== ATTENTION

HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Restriction <==== ATTENTION

HKU\S-1-5-19\...\Run: [GoogleDriveFS] => C:\Program Files\Google\Drive File Stream\101.0.3.0\GoogleDriveFS.exe [61998176 2024-12-16] (Google LLC -> Google, Inc.)

HKU\S-1-5-20\...\Run: [GoogleDriveFS] => C:\Program Files\Google\Drive File Stream\101.0.3.0\GoogleDriveFS.exe [61998176 2024-12-16] (Google LLC -> Google, Inc.)

HKU\S-1-5-21-1357561984-4161033644-3417195034-1001\...\Run: [CCleaner Smart Cleaning] => C:\Program Files\CCleaner\CCleaner64.exe [45381424 2024-12-04] (Gen Digital Inc. -> Piriform Software Ltd)

HKU\S-1-5-21-1357561984-4161033644-3417195034-1001\...\Run: [CiscoMeetingDaemon] => C:\Users\Paul\AppData\Local\WebEx\WebexHost.exe [7272032 2024-04-01] (Cisco WebEx LLC -> Cisco Webex LLC)

HKU\S-1-5-21-1357561984-4161033644-3417195034-1001\...\Run: [MicrosoftEdgeAutoLaunch_A4C619A52FD641FDF622FAB8D686879D] => "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start [3911240 2024-12-19] (Microsoft Corporation -> Microsoft Corporation)

HKU\S-1-5-21-1357561984-4161033644-3417195034-1001\...\Run: [GoogleDriveFS] => C:\Program Files\Google\Drive File Stream\101.0.3.0\GoogleDriveFS.exe [61998176 2024-12-16] (Google LLC -> Google, Inc.)

HKU\S-1-5-21-1357561984-4161033644-3417195034-1001\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E1YATIBJE.EXE [484712 2021-11-02] (SEIKO EPSON CORPORATION -> Seiko Epson Corporation)

HKU\S-1-5-21-1357561984-4161033644-3417195034-1001\...\Run: [EPSDNMON] => C:\Program Files (x86)\Epson Software\Download Navigator\EPSDNMON.EXE [350032 2022-07-22] (SEIKO EPSON CORPORATION -> Seiko Epson Corporation)

HKU\S-1-5-18\...\Run: [GoogleDriveFS] => C:\Program Files\Google\Drive File Stream\101.0.3.0\GoogleDriveFS.exe [61998176 2024-12-16] (Google LLC -> Google, Inc.)

HKLM\...\Print\Monitors\EPSON XP-2200 Series 64MonitorBE: C:\Windows\system32\E1YLMBBJE.DLL [237568 2021-09-21] (Microsoft Windows Hardware Compatibility Publisher -> Seiko Epson Corporation)

HKLM\...\Print\Monitors\EPSON XP-243 245 247 Series 64MonitorBE: C:\Windows\system32\E_YLMBRFE.DLL [182784 2015-12-09] (SEIKO EPSON CORPORATION) [File not signed]

HKLM\...\Print\Monitors\EpsonNet Print Port: C:\Windows\system32\enppmon.dll [500736 2016-09-14] (SEIKO EPSON CORPORATION) [File not signed]

HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files\Google\Chrome\Application\131.0.6778.205\Installer\chrmstp.exe [2024-12-20] (Google LLC -> Google LLC)

Startup: C:\Users\Paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\How do you practice your scaless.txt [2024-12-15] () [File not signed]

Startup: C:\Users\Paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Shopping List - Shortcut.lnk [2024-04-10]

ShortcutTarget: Shopping List - Shortcut.lnk -> C:\Users\Paul\Documents\Shopping List.txt () [File not signed]

Startup: C:\Users\Paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trading Record - Shortcut.lnk [2023-04-16]

ShortcutTarget: Trading Record - Shortcut.lnk -> C:\Users\Paul\Desktop\Trading Record.ods () [File not signed]

Startup: C:\Users\Paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Weekend Jobs - Shortcut.lnk [2024-09-21]

ShortcutTarget: Weekend Jobs - Shortcut.lnk -> C:\Users\Paul\Desktop\Weekend Jobs.txt () [File not signed]

Startup: C:\Users\Paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zFocus.png [2022-05-20] () [File not signed]

==================== Scheduled Tasks (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {3A49606B-D2AC-479C-8706-96E2E5C4F03F} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1574856 2024-09-25] (Adobe Inc. -> Adobe Inc.)

Task: {800ED48C-2C77-4777-B04B-57D9E13B4109} - System32\Tasks\Bitdefender Agent WatchDog_65D6944A0EF74FDAB96E31112AD39864 => C:\Program Files\Bitdefender Agent\27.0.1.290\WatchDog.exe [1156904 2024-11-20] (Bitdefender SRL -> Bitdefender) -> C:\Program Files\Bitdefender Agent\27.0.1.290\repair

Task: {1469E9A9-E61F-4EC5-833A-3E4DC3936BD0} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [829408 2024-12-04] (Gen Digital Inc. -> Gen Digital Inc.)

Task: {7658B18C-400C-4600-8EC3-631200BA9845} - System32\Tasks\CCleanerCrashReporting => C:\Program Files\CCleaner\CCleanerBugReport.exe [5983536 2024-12-04] (Gen Digital Inc. -> Gen Digital Inc.) -> --product 90 --send dumps|report --path "C:\Program Files\CCleaner\LOG" --programpath "C:\Program Files\CCleaner" --guid "b35de6a0-b0ac-4c31-8661-ee573150ae11" --version "6.31.11415" --silent

Task: {A2981FED-A1F2-4DB3-A42C-EE7435478D86} - System32\Tasks\CCleanerSkipUAC - Paul => C:\Program Files\CCleaner\CCleaner.exe [39151920 2024-12-04] (Gen Digital Inc. -> Piriform Software Ltd)

Task: {A77E6A33-039F-4BC4-894B-DF2CD7515ED5} - System32\Tasks\EPSON XP-2200 Series Update {0D9DFF8A-49C0-411E-86B1-088BC1D0D91E} => C:\Windows\System32\spool\drivers\x64\3\E1YTSBJE.EXE [680440 2017-06-07] (SEIKO EPSON CORPORATION -> Seiko Epson Corporation)

Task: {01B5839F-434E-4284-B97C-D221E10F9F04} - System32\Tasks\GoogleSystem\GoogleUpdater\GoogleUpdaterTaskSystem132.0.6833.0{44EFD25D-BA25-443B-90E7-6E424404615B} => C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\updater.exe [5591136 2024-11-11] (Google LLC -> Google LLC)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\CCleanerCrashReporting.job => C:\Program Files\CCleaner\CCleanerBugReport.exe

Task: C:\Windows\Tasks\EPSON XP-2200 Series Update {0D9DFF8A-49C0-411E-86B1-088BC1D0D91E}.job => C:\Windows\system32\spool\DRIVERS\x64\3\E1YTSBJE.EXE:/EXE:{0D9DFF8A-49C0-411E-86B1-088BC1D0D91E} /F:UpdateWORKGROUP\DESKTOP-VR0LFER$ĊSearches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Winsock: Catalog5 01 C:\Windows\SysWOW64\napinsp.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog5 02 C:\Windows\SysWOW64\pnrpnsp.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog5 03 C:\Windows\SysWOW64\pnrpnsp.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog5 04 C:\Windows\SysWOW64\wshbth.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog5 05 C:\Windows\SysWOW64\NLAapi.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog5 06 C:\Windows\SysWOW64\mswsock.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog5 07 C:\Windows\SysWOW64\winrnr.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog9 01 C:\Windows\SysWOW64\mswsock.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog9 02 C:\Windows\SysWOW64\mswsock.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog9 03 C:\Windows\SysWOW64\mswsock.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog9 04 C:\Windows\SysWOW64\mswsock.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog9 05 C:\Windows\SysWOW64\mswsock.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog9 06 C:\Windows\SysWOW64\mswsock.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog9 07 C:\Windows\SysWOW64\mswsock.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog9 08 C:\Windows\SysWOW64\mswsock.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog9 09 C:\Windows\SysWOW64\mswsock.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog9 10 C:\Windows\SysWOW64\mswsock.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog9 11 C:\Windows\SysWOW64\mswsock.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog9 12 C:\Windows\SysWOW64\mswsock.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog9 13 C:\Windows\SysWOW64\mswsock.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog9 14 C:\Windows\SysWOW64\mswsock.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog5-x64 01 C:\Windows\system32\napinsp.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog5-x64 02 C:\Windows\system32\pnrpnsp.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog5-x64 03 C:\Windows\system32\pnrpnsp.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog5-x64 04 C:\Windows\system32\wshbth.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog5-x64 05 C:\Windows\system32\NLAapi.dll [0 2024-03-13] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog5-x64 06 C:\Windows\System32\mswsock.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog5-x64 07 C:\Windows\System32\winrnr.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog9-x64 01 C:\Windows\system32\mswsock.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog9-x64 02 C:\Windows\system32\mswsock.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog9-x64 03 C:\Windows\system32\mswsock.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog9-x64 04 C:\Windows\system32\mswsock.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog9-x64 05 C:\Windows\system32\mswsock.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog9-x64 06 C:\Windows\system32\mswsock.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog9-x64 07 C:\Windows\system32\mswsock.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog9-x64 08 C:\Windows\system32\mswsock.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog9-x64 09 C:\Windows\system32\mswsock.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog9-x64 10 C:\Windows\system32\mswsock.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog9-x64 11 C:\Windows\system32\mswsock.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog9-x64 12 C:\Windows\system32\mswsock.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog9-x64 13 C:\Windows\system32\mswsock.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Winsock: Catalog9-x64 14 C:\Windows\system32\mswsock.dll [0 2023-11-15] (Microsoft Corporation) <==== ATTENTION [zero byte File/Folder]

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

Tcpip\..\Interfaces\{18365fca-403b-4752-a8c2-0dc032073b75}: [NameServer] 8.8.8.8

Tcpip\..\Interfaces\{3a60f4d1-e2a9-4d23-ad7c-a43fab8f0ee6}: [DhcpNameServer] 192.168.1.1

Tcpip\..\Interfaces\{b7a94f67-f047-4b0a-bafd-77eca18e84b3}: [DhcpNameServer] 192.168.1.1

Tcpip\..\Interfaces\{b7a94f67-f047-4b0a-bafd-77eca18e84b3}: [DhcpDomain] lan

Tcpip\..\Interfaces\{b7a94f67-f047-4b0a-bafd-77eca18e84b3}\14E64627F69646140523540314: [DhcpNameServer] 192.168.43.1

Tcpip\..\Interfaces\{b7a94f67-f047-4b0a-bafd-77eca18e84b3}\821405139202338302D4F6F6270225F61646: [DhcpNameServer] 192.168.1.1

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION

Edge:

=======

Edge DefaultProfile: Default

Edge Profile: C:\Users\Paul\AppData\Local\Microsoft\Edge\User Data\Default [2025-01-04]

Edge Extension: (Bitdefender Anti-tracker) - C:\Users\Paul\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\dbconhplchnbippmjabbcedokimacfjl [2024-07-28]

Edge Extension: (Google Docs Offline) - C:\Users\Paul\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2024-12-17]

Edge Extension: (Edge relevant text changes) - C:\Users\Paul\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha [2024-01-27]

Edge HKLM-x32\...\Edge\Extension: [dbconhplchnbippmjabbcedokimacfjl]

FireFox:

========

FF Plugin: Adobe Acrobat -> C:\Program Files\Adobe\Acrobat DC\Acrobat\Air\nppdf32.dll [2024-12-05] (Adobe Systems Inc.) <==== ATTENTION [zero byte File/Folder]

FF Plugin-x32: @videolan.org/vlc,version=3.0.16 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2024-06-08] (VideoLAN) <==== ATTENTION [zero byte File/Folder]

FF Plugin-x32: @videolan.org/vlc,version=3.0.18 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2024-06-08] (VideoLAN) <==== ATTENTION [zero byte File/Folder]

FF Plugin-x32: @videolan.org/vlc,version=3.0.19 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2024-06-08] (VideoLAN) <==== ATTENTION [zero byte File/Folder]

FF Plugin-x32: @videolan.org/vlc,version=3.0.20 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2024-06-08] (VideoLAN) <==== ATTENTION [zero byte File/Folder]

FF Plugin-x32: @videolan.org/vlc,version=3.0.21 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2024-06-08] (VideoLAN) <==== ATTENTION [zero byte File/Folder]

Chrome:

=======

CHR DefaultProfile: Default

CHR Profile: C:\Users\Paul\AppData\Local\Google\Chrome\User Data\Default [2025-01-05]

CHR DownloadDir: C:\Users\Paul\Desktop

CHR Notifications: Default -> hxxps://community.mymensa.mensa.org.uk

CHR HomePage: Default -> hxxp://www.virginmedia.com/

CHR StartupUrls: Default -> "hxxps://www.metoffice.gov.uk/weather/forecast/u10g8x4vg#?date=2024-07-20","hxxps://calendar.google.com/calendar/u/0/r","hxxps://mail.google.com/mail/u/0/#inbox","hxxps://www.forexfactory.com/calendar"

CHR Extension: (Adblock Plus - free ad blocker) - C:\Users\Paul\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2024-12-18]

CHR Extension: (Adobe Acrobat: PDF edit, convert, sign tools) - C:\Users\Paul\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2024-12-10]

CHR Extension: (Dashlane — Password Manager) - C:\Users\Paul\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdjamakpfbbddfjaooikfcpapjohcfmg [2024-12-24]

CHR Extension: (Google Docs Offline) - C:\Users\Paul\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2024-12-18]

CHR Extension: (Cisco Webex Extension) - C:\Users\Paul\AppData\Local\Google\Chrome\User Data\Default\Extensions\jlhmfgmfgeifomenelglieieghnjghma [2022-07-22]

CHR Extension: (Bitdefender Anti-tracker) - C:\Users\Paul\AppData\Local\Google\Chrome\User Data\Default\Extensions\khndhdhbebhaddchcgnalcjlaekbbeof [2024-07-19]

CHR Extension: (Application launcher for Drive (by Google)) - C:\Users\Paul\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2023-08-21]

CHR Extension: (Chrome Web Store Payments) - C:\Users\Paul\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2021-11-11]

CHR Extension: (Send from Gmail (by Google)) - C:\Users\Paul\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgphcomnlaojlmmcjmiddhdapjpbgeoc [2024-06-04]

CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho]

CHR HKU\S-1-5-21-1357561984-4161033644-3417195034-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]

CHR HKU\S-1-5-21-1357561984-4161033644-3417195034-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh]

CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]

CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho]

CHR HKLM-x32\...\Chrome\Extension: [khndhdhbebhaddchcgnalcjlaekbbeof]

==================== Services (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S4 AdobeARMservice; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [172992 2024-09-25] (Adobe Inc. -> Adobe Inc.)

R2 BDAppSrv; C:\Program Files\Bitdefender\Bitdefender Security App\bdservicehost.exe [851640 2024-12-13] (Bitdefender SRL -> Bitdefender)

R2 BDAuxSrv; C:\Program Files\Bitdefender\Bitdefender Security\bdservicehost.exe [852152 2024-12-13] (Bitdefender SRL -> Bitdefender)

R2 BDProtSrv; C:\Program Files\Bitdefender\Bitdefender Security\bdservicehost.exe [852152 2024-12-13] (Bitdefender SRL -> Bitdefender)

R2 bdredline; C:\Program Files\Common Files\Bitdefender\SetupInformation\Bitdefender RedLine\bdredline.exe [2946088 2023-08-31] (Bitdefender SRL -> Bitdefender)

R2 bdredline_agent; C:\Program Files\Bitdefender Agent\redline\bdredline.exe [2577184 2023-07-20] (Bitdefender SRL -> Bitdefender)

R2 BDSafepaySrv; C:\Program Files\Bitdefender\Bitdefender Security App\Safepay\bdservicehost.exe [852152 2024-12-13] (Bitdefender SRL -> Bitdefender)

R2 CCleanerPerformanceOptimizerService; C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe [1087792 2024-12-04] (Gen Digital Inc. -> Piriform Software Ltd)

R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [206304 2022-07-13] (SEIKO EPSON CORPORATION -> Seiko Epson Corporation)

R2 hshld_12.9.6; C:\Program Files (x86)\Hotspot Shield\12.9.6\bin\cmw_srv.exe [259592 2024-12-12] (Pango LLC -> Pango Inc.)

S4 MyEpson Portal Service; C:\Program Files (x86)\EPSON\MyEpson Portal\mepService.exe [714712 2017-06-28] (SEIKO EPSON CORPORATION -> Seiko Epson Corporation)

R2 NVDisplay.ContainerLocalSystem; C:\Windows\System32\DriverStore\FileRepository\nvrfi.inf_amd64_075e0a1c13484a5c\Display.NvContainer\NVDisplay.Container.exe [1275000 2024-09-28] (NVIDIA Corporation -> NVIDIA Corporation)

R2 ProductAgentService; C:\Program Files\Bitdefender Agent\ProductAgentService.exe [714200 2024-11-20] (Bitdefender SRL -> Bitdefender)

S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [559368 2024-11-17] (Microsoft Windows Publisher -> Microsoft Corporation)

R2 UPDATESRV; C:\Program Files\Bitdefender\Bitdefender Security\updatesrv.exe [291224 2024-12-13] (Bitdefender SRL -> Bitdefender)

R2 VSSERV; C:\Program Files\Bitdefender\Bitdefender Security\bdservicehost.exe [852152 2024-12-13] (Bitdefender SRL -> Bitdefender)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [3004048 2019-12-07] (Microsoft Windows Publisher -> Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103384 2019-12-07] (Microsoft Windows Publisher -> Microsoft Corporation)

S3 McAfee WebAdvisor; "C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe" [X]

R2 ZoomCptService; "C:\Program Files\Common Files\Zoom\Support\CptService.exe" -user_path "C:\Users\Paul\AppData\Roaming\Zoom"

===================== Drivers (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 atc; C:\Windows\System32\DRIVERS\atc.sys [7505856 2024-09-19] (Microsoft Windows Hardware Compatibility Publisher -> Bitdefender S.R.L. Bucharest, ROMANIA)

R2 BdDci4; C:\Windows\system32\DRIVERS\bddci4.sys [969664 2024-11-20] (Microsoft Windows Hardware Compatibility Publisher -> Bitdefender)

S0 bdelam; C:\Windows\System32\drivers\bdelam.sys [24568 2023-11-15] (Microsoft Windows Early Launch Anti-malware Publisher -> Bitdefender)

S3 bdprivmon; C:\Windows\System32\DRIVERS\bdprivmon.sys [49200 2023-08-21] (Microsoft Windows Hardware Compatibility Publisher -> Bitdefender SRL)

S3 bduefiscan; C:\Windows\system32\DRIVERS\bduefiscan.sys [42432 2024-09-06] (Microsoft Windows Hardware Compatibility Publisher -> Bitdefender)

S3 dg_ssudbus; C:\Windows\system32\DRIVERS\ssudbus2.sys [167440 2022-09-30] (Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.)

R1 Gemma; C:\Windows\System32\DRIVERS\gemma.sys [1490896 2024-09-06] (Microsoft Windows Hardware Compatibility Publisher -> BitDefender S.R.L. Bucharest, ROMANIA)

R2 googledrivefs31626; C:\Program Files\Google\Drive File Stream\Drivers\31626\googledrivefs31626.sys [384096 2024-07-24] (Microsoft Windows Hardware Compatibility Publisher -> Google, Inc.)

R3 hsstap; C:\Windows\System32\drivers\hsstap.sys [39424 2020-09-29] (Microsoft Windows Hardware Compatibility Publisher -> Pango)

S3 Ignisv2; C:\Windows\system32\DRIVERS\ignisv2.sys [849968 2024-05-30] (Microsoft Windows Hardware Compatibility Publisher -> Bitdefender)

R1 pango_netfilter2; C:\Windows\System32\drivers\pango_netfilter2.sys [89088 2024-12-12] (Microsoft Windows Hardware Compatibility Publisher -> Pango Inc)

S3 ssudmdm; C:\Windows\system32\DRIVERS\ssudmdm.sys [174112 2022-09-30] (Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.)

S3 ss_conn_usb_driver2; C:\Windows\System32\Drivers\ss_conn_usb_driver2.sys [50720 2022-09-30] (Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.)

R2 trufos; C:\Windows\System32\DRIVERS\trufos.sys [629184 2023-11-15] (Microsoft Windows Hardware Compatibility Publisher -> Bitdefender)

S3 usbscan; C:\Windows\system32\DRIVERS\usbscan.sys [49664 2022-07-13] (Microsoft Corporation) [File not signed]

R0 vlflt; C:\Windows\System32\DRIVERS\vlflt.sys [1403456 2024-11-20] (Microsoft Windows Hardware Compatibility Publisher -> Bitdefender)

S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [46688 2019-12-07] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)

S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [350136 2019-12-07] (Microsoft Windows -> Microsoft Corporation)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [54200 2019-12-07] (Microsoft Windows -> Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One month (created) (Whitelisted) =========

(If an entry is included in the fixlist, the file/folder will be moved.)

2025-01-05 15:36 - 2025-01-05 15:36 - 000028079 _____ C:\Users\Paul\Desktop\FRST.txt

2025-01-05 15:35 - 2025-01-05 15:36 - 000000000 ____D C:\FRST

2025-01-05 15:34 - 2025-01-05 15:34 - 002403840 _____ (Farbar) C:\Users\Paul\Desktop\FRST64.exe

2025-01-05 12:35 - 2025-01-05 12:40 - 000000000 ____D C:\Users\Paul\Desktop\Tregembo

2025-01-04 14:57 - 2025-01-04 16:48 - 000014895 _____ C:\Users\Paul\Desktop\Carb Cycling.ods

2025-01-04 14:54 - 2025-01-04 16:48 - 000000037 _____ C:\Users\Paul\Desktop\Jobs.txt

2025-01-04 14:50 - 2025-01-04 14:50 - 000000671 _____ C:\Users\Paul\Desktop\TGIF.txt

2024-12-28 14:33 - 2024-12-28 14:33 - 000000108 _____ C:\Users\Paul\Desktop\How to fold a Pop-up Sauna.txt

2024-12-21 09:55 - 2024-12-21 09:55 - 000000851 _____ C:\Users\Paul\Desktop\Turkey drumsticks.txt

2024-12-21 08:28 - 2024-12-21 08:28 - 000390631 _____ C:\Users\Paul\Desktop\21 December 2024.pdf

2024-12-20 05:23 - 2024-12-20 05:23 - 000001242 _____ C:\Users\Public\Desktop\Hotspot Shield.lnk

2024-12-20 05:22 - 2024-12-20 05:23 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hotspot Shield

2024-12-20 05:22 - 2024-12-20 05:22 - 000000000 ____D C:\Program Files (x86)\Hotspot Shield

2024-12-19 07:24 - 2024-12-19 07:24 - 000000000 _____ C:\Users\Paul\Desktop\Windows key + V.txt

2024-12-18 06:32 - 2024-12-18 06:32 - 000198010 _____ C:\Users\Paul\Desktop\UWBill122024.pdf

2024-12-17 18:47 - 2024-12-17 18:47 - 000001693 _____ C:\Users\Paul\Desktop\Carrot, Parsnip, and Potato Latkes.txt

2024-12-17 18:45 - 2024-12-17 18:45 - 000001988 _____ C:\Users\Paul\Desktop\Peanut Butter Shortbread.txt

2024-12-16 07:11 - 2024-12-16 07:11 - 000016454 _____ C:\Users\Paul\Desktop\calendar.pdf

2024-12-16 07:01 - 2024-12-16 07:01 - 000016454 _____ C:\Users\Paul\Desktop\Rubbish Collections.pdf

2024-12-11 07:14 - 2024-12-11 07:14 - 000022205 _____ C:\Windows\SysWOW64\IntegratedServicesRegionPolicySet.json

2024-12-11 07:13 - 2024-12-11 07:13 - 000022205 _____ C:\Windows\system32\IntegratedServicesRegionPolicySet.json

2024-12-11 06:21 - 2024-12-11 06:21 - 000000000 ___HD C:\$WinREAgent

2024-12-09 06:37 - 2024-12-09 06:37 - 002493878 _____ C:\Users\Paul\Desktop\7 Things We Wish Someone Had Told Us Before We Started Trading.mhtml

2024-12-09 06:32 - 2024-12-09 06:32 - 001485512 _____ C:\Users\Paul\Desktop\FX Market Reactions to Events_ “Millisecond Data Helps Traders Capture 90% of Movements”.mhtml

==================== One month (modified) ==================

(If an entry is included in the fixlist, the file/folder will be moved.)

2025-01-05 14:55 - 2021-11-11 20:33 - 000795742 _____ C:\Windows\system32\PerfStringBackup.INI

2025-01-05 14:55 - 2019-12-07 09:13 - 000000000 ____D C:\Windows\INF

2025-01-05 14:49 - 2019-12-07 09:14 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft

2025-01-05 14:48 - 2021-11-11 20:32 - 000000000 ____D C:\ProgramData\NVIDIA

2025-01-05 14:48 - 2021-11-11 20:25 - 000008192 ___SH C:\DumpStack.log.tmp

2025-01-05 14:48 - 2021-11-11 20:25 - 000000006 ____H C:\Windows\Tasks\SA.DAT

2025-01-05 14:48 - 2021-11-11 20:25 - 000000000 ____D C:\Windows\system32\SleepStudy

2025-01-05 13:55 - 2019-12-07 09:03 - 000131072 _____ C:\Windows\system32\config\ELAM

2025-01-05 13:49 - 2024-11-15 14:58 - 000311337 _____ C:\Users\Paul\Desktop\Trading Record.ods

2025-01-05 08:28 - 2019-12-07 09:14 - 000000000 ___HD C:\Program Files\WindowsApps

2025-01-05 08:28 - 2019-12-07 09:14 - 000000000 ____D C:\Windows\AppReadiness

2025-01-05 08:08 - 2024-09-15 09:27 - 000000326 _____ C:\Users\Paul\Desktop\Weekend Jobs.txt

2025-01-04 16:57 - 2021-11-11 20:33 - 000000000 ____D C:\Users\Paul

2025-01-04 09:24 - 2021-12-10 15:21 - 000003542 _____ C:\Windows\system32\Tasks\Adobe Acrobat Update Task

2025-01-03 07:10 - 2021-11-12 17:54 - 000000000 ____D C:\Users\Paul\.oanda

2025-01-03 05:25 - 2021-11-12 17:19 - 000004210 _____ C:\Windows\system32\Tasks\CCleaner Update

2024-12-29 07:24 - 2024-11-29 07:59 - 000000000 ____D C:\Users\Paul\Desktop\TMS Pay

2024-12-29 06:40 - 2023-01-17 19:12 - 000000000 ____D C:\Users\Paul\Desktop\TMS

2024-12-28 14:11 - 2021-11-12 17:26 - 000000000 ____D C:\Users\Paul\AppData\Roaming\vlc

2024-12-24 18:42 - 2023-02-08 05:08 - 000000000 ____D C:\Users\Paul\Desktop\Moos Folder

2024-12-21 10:31 - 2022-09-30 07:42 - 000000666 _____ C:\Windows\Tasks\CCleanerCrashReporting.job

2024-12-21 10:30 - 2021-12-15 15:05 - 000000000 ____D C:\Windows\SystemTemp

2024-12-21 10:30 - 2021-11-12 17:19 - 000000000 ____D C:\Program Files\CCleaner

2024-12-21 06:00 - 2021-11-11 20:25 - 000002438 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk

2024-12-20 18:55 - 2021-11-11 20:25 - 000003536 _____ C:\Windows\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA

2024-12-20 18:55 - 2021-11-11 20:25 - 000003412 _____ C:\Windows\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore

2024-12-20 06:42 - 2021-11-19 10:48 - 000017220 _____ C:\Users\Paul\Desktop\Payments Out.ods

2024-12-20 05:23 - 2024-09-14 05:52 - 000000000 ____D C:\ProgramData\Hotspot Shield

2024-12-20 05:22 - 2021-11-18 17:44 - 000000000 ____D C:\ProgramData\Package Cache

2024-12-20 05:22 - 2021-11-11 21:15 - 000002207 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

2024-12-17 19:42 - 2023-02-26 15:11 - 000000000 ____D C:\Program Files\FTMO MetaTrader 5

2024-12-17 06:39 - 2021-11-11 20:34 - 000000000 ____D C:\Users\Paul\AppData\Local\Packages

2024-12-17 06:37 - 2021-12-12 18:24 - 000003592 _____ C:\Windows\system32\Tasks\OneDrive Reporting Task-S-1-5-21-1357561984-4161033644-3417195034-1001

2024-12-17 06:37 - 2021-11-11 20:35 - 000003352 _____ C:\Windows\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-1357561984-4161033644-3417195034-1001

2024-12-17 06:37 - 2021-11-11 20:33 - 000002380 _____ C:\Users\Paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk

2024-12-16 19:03 - 2024-10-02 12:27 - 000000000 ____D C:\Users\Paul\AppData\Local\CrashDumps

2024-12-16 19:03 - 2023-02-04 12:12 - 000002133 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive.lnk

2024-12-16 19:03 - 2022-09-30 07:42 - 000003382 _____ C:\Windows\system32\Tasks\CCleanerCrashReporting

2024-12-15 14:23 - 2024-04-10 04:51 - 000000364 _____ C:\Users\Paul\Documents\Shopping List.txt

2024-12-13 06:38 - 2022-10-13 20:59 - 000002033 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat.lnk

2024-12-11 19:48 - 2021-11-11 20:25 - 000296680 _____ C:\Windows\system32\FNTCACHE.DAT

2024-12-11 19:47 - 2019-12-07 09:03 - 000524288 _____ C:\Windows\system32\config\BBI

2024-12-11 19:46 - 2024-07-10 09:28 - 000000000 ____D C:\Windows\system32\compatrel

2024-12-11 19:46 - 2019-12-07 09:14 - 000000000 ___RD C:\Windows\PrintDialog

2024-12-11 19:46 - 2019-12-07 09:14 - 000000000 ___RD C:\Windows\ImmersiveControlPanel

2024-12-11 19:46 - 2019-12-07 09:14 - 000000000 ____D C:\Windows\SysWOW64\setup

2024-12-11 19:46 - 2019-12-07 09:14 - 000000000 ____D C:\Windows\SystemResources

2024-12-11 19:46 - 2019-12-07 09:14 - 000000000 ____D C:\Windows\system32\ShellExperiences

2024-12-11 19:46 - 2019-12-07 09:14 - 000000000 ____D C:\Windows\system32\setup

2024-12-11 19:46 - 2019-12-07 09:14 - 000000000 ____D C:\Windows\system32\PerceptionSimulation

2024-12-11 19:46 - 2019-12-07 09:14 - 000000000 ____D C:\Windows\system32\oobe

2024-12-11 19:46 - 2019-12-07 09:14 - 000000000 ____D C:\Windows\system32\appraiser

2024-12-11 19:46 - 2019-12-07 09:14 - 000000000 ____D C:\Windows\ShellExperiences

2024-12-11 19:46 - 2019-12-07 09:14 - 000000000 ____D C:\Windows\ShellComponents

2024-12-11 19:46 - 2019-12-07 09:14 - 000000000 ____D C:\Windows\bcastdvr

2024-12-11 18:57 - 2019-12-07 09:03 - 000000000 ____D C:\Windows\CbsTemp

2024-12-11 07:13 - 2021-11-11 20:29 - 003016192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PrintConfig.dll

==================== SigCheck ============================

(There is no automatic fix for files that do not pass verification.)

==================== End of FRST.txt ========================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-01-2025

Ran by Paul (05-01-2025 15:37:27)

Running from C:\Users\Paul\Desktop

Microsoft Windows 10 Pro Version 22H2 19045.5247 (X64) (2021-11-11 20:27:08)

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

(If an entry is included in the fixlist, it will be removed.)

Administrator (S-1-5-21-1357561984-4161033644-3417195034-500 - Administrator - Disabled)

DefaultAccount (S-1-5-21-1357561984-4161033644-3417195034-503 - Limited - Disabled)

Guest (S-1-5-21-1357561984-4161033644-3417195034-501 - Limited - Disabled)

Paul (S-1-5-21-1357561984-4161033644-3417195034-1001 - Administrator - Enabled) => C:\Users\Paul

WDAGUtilityAccount (S-1-5-21-1357561984-4161033644-3417195034-504 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Bitdefender Antivirus (Enabled - Up to date) {0F59B032-EA77-E3A8-2382-74A4346E5522}

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Acrobat (64-bit) (HKLM\...\{AC76BA86-1033-1033-7760-BC15014EA700}) (Version: 24.005.20320 - Adobe)

Adobe Refresh Manager (HKLM-x32\...\{AC76BA86-0804-1033-1959-018244601102}) (Version: 1.8.0 - Adobe Systems Incorporated) Hidden

Amazon Kindle (HKU\S-1-5-21-1357561984-4161033644-3417195034-1001\...\Amazon Kindle) (Version: 1.39.1.65323 - Amazon)

Bitdefender Agent (HKLM\...\Bitdefender Agent) (Version: 27.0.1.290 - Bitdefender)

Bitdefender Antivirus Plus (HKLM\...\Bitdefender) (Version: 26.0.32.109 - Bitdefender)

CCleaner (HKLM\...\CCleaner) (Version: 6.31 - Piriform)

Cisco Webex Meetings (HKU\S-1-5-21-1357561984-4161033644-3417195034-1001\...\ActiveTouchMeetingClient) (Version: 42.8.4 - Cisco Webex LLC)

Epson Event Manager (HKLM-x32\...\{067039C9-A41C-42F5-9571-B06E0700AAA4}) (Version: 3.11.77 - Seiko Epson Corporation)

Epson Manuals (HKLM-x32\...\{84CECC1B-21EF-41B1-9A91-3E724E5D99D3}) (Version: 2.0.4.0 - Seiko Epson Corporation)

Epson Photo+ (HKLM-x32\...\{1E900386-22F3-43A8-8121-81C5A5512A0C}) (Version: 3.7.3.0 - Seiko Epson Corporation)

Epson Printer Connection Checker (HKLM-x32\...\{DE32F90E-1A29-4D74-BCF1-E7DDB25D713A}) (Version: 3.4.0.0 - Seiko Epson Corporation)

Epson Scan 2 (HKLM-x32\...\Epson Scan 2) (Version: - Seiko Epson Corporation)

EPSON Scan PDF EXtensions (HKLM-x32\...\{F9956472-6E16-4F83-BF9A-F887EF4A45B7}) (Version: 1.03.02 - SEIKO EPSON Corp.)

Epson ScanSmart (HKLM-x32\...\{1A1B60BB-F156-4F6D-AD79-8A096B67E9AB}) (Version: 3.7.10 - Seiko Epson Corporation)

Epson Software Updater (HKLM-x32\...\{711E8536-AB71-4455-A6C4-357FDBBEBF91}) (Version: 4.6.7 - Seiko Epson Corporation)

EPSON XP-2200 Series Printer Uninstall (HKLM\...\EPSON XP-2200 Series) (Version: - Seiko Epson Corporation)

EpsonNet Print (HKLM\...\{96ED1D58-440C-4345-8FEE-C4781366C67F}) (Version: 3.1.4.0 - SEIKO EPSON Corporation)

FTMO MetaTrader 4 (HKLM-x32\...\FTMO MetaTrader 4) (Version: 4.00 - MetaQuotes Ltd.)

FTMO MetaTrader 5 (HKLM\...\FTMO MetaTrader 5) (Version: 5.00 - MetaQuotes Ltd.)

FXCM MetaTrader4 (HKLM-x32\...\FXCM MetaTrader4) (Version: 4.00 - MetaQuotes Ltd.)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 131.0.6778.205 - Google LLC)

Google Drive (HKLM\...\{6BBAE539-2232-434A-A4E5-9A33560C6283}) (Version: 101.0.3.0 - Google LLC)

Hotspot Shield 12.9.6 (HKLM-x32\...\{AF599C42-A2E5-4251-B7EE-492511B712F8}) (Version: 12.9.6.12245 - Pango Inc.) Hidden

Hotspot Shield 12.9.6 (HKLM-x32\...\HotspotShield) (Version: 12.9.6 - Pango Inc.) Hidden

HotspotShield TAP-Windows 9.24.4 (HKLM\...\HotspotShield TAP-Windows) (Version: 9.24.4 - Pango Inc.) Hidden

Intel® PROSet/Wireless Software (HKLM-x32\...\{185db067-38cd-4521-a43e-c39b96ee1389}) (Version: 19.50.1 - Intel Corporation)

Intel® PROSet/Wireless WiFi Software (HKLM\...\{8C497266-8C62-4A79-AA01-763DA804E8C7}) (Version: 19.50.0.0945 - Intel Corporation) Hidden

Microsoft Edge (HKLM-x32\...\Microsoft Edge) (Version: 131.0.2903.112 - Microsoft Corporation)

Microsoft Edge WebView2 Runtime (HKLM-x32\...\Microsoft EdgeWebView) (Version: 131.0.2903.112 - Microsoft Corporation) Hidden

Microsoft OneDrive (HKU\S-1-5-21-1357561984-4161033644-3417195034-1001\...\OneDriveSetup.exe) (Version: 24.226.1110.0004 - Microsoft Corporation)

Microsoft Update Health Tools (HKLM\...\{1FC1A6C2-576E-489A-9B4A-92D21F542136}) (Version: 3.74.0.0 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.40.33810 (HKLM-x32\...\{47109d57-d746-4f8b-9618-ed6a17cc922b}) (Version: 14.40.33810.0 - Microsoft Corporation)

Microsoft Visual C++ 2022 X86 Additional Runtime - 14.40.33810 (HKLM-x32\...\{5EA6C998-D5AC-4ED9-89C3-9F25B17CCD3D}) (Version: 14.40.33810 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.40.33810 (HKLM-x32\...\{0C3457A0-3DCE-4A33-BEF0-9B528C557771}) (Version: 14.40.33810 - Microsoft Corporation) Hidden

MyEpson Portal (HKLM-x32\...\{3361D415-BA35-4143-B301-661991BA6219}) (Version: 1.1.3.6 - SEIKO EPSON CORPORATION) Hidden

MyEpson Portal (HKLM-x32\...\MyEpson Portal) (Version: - Seiko Epson Corporation)

NVIDIA Graphics Driver 536.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 536.23 - NVIDIA Corporation)

OANDA Desktop (HKLM-x32\...\{BE91B0FB-1165-4248-BB64-A75205450D1F}) (Version: 5.0.2 - OANDA)

OpenOffice 4.1.15 (HKLM-x32\...\{82A24788-8CDB-49B9-AA92-6C357E2F8D40}) (Version: 4.115.9813 - Apache Software Foundation)

Recuva (HKLM\...\Recuva) (Version: 1.53 - Piriform)

Speccy (HKLM\...\Speccy) (Version: 1.32 - Piriform)

TechSmith Capture (HKU\S-1-5-21-1357561984-4161033644-3417195034-1001\...\RelayRecorder) (Version: 2.1.4 - TechSmith Corporation)

Update for x64-based Windows Systems (KB5001716) (HKLM\...\{DA80A019-4C3B-4DAA-ACA1-6937D7CAAF9E}) (Version: 8.94.0.0 - Microsoft Corporation)

VLC media player (HKLM-x32\...\VLC media player) (Version: 3.0.21 - VideoLAN)

Windows PC Health Check (HKLM\...\{6798C408-2636-448C-8AC6-F4E341102D27}) (Version: 3.6.2204.08001 - Microsoft Corporation)

Zoom Workplace (64-bit) (HKLM\...\{78A47191-A0AD-4F93-8DF9-F2E5DCDEB418}) (Version: 6.2.47507 - Zoom)

Packages:

=========

Adobe Acrobat Reader -> C:\Program Files\Adobe\Acrobat DC [2024-12-13] ()

iTunes -> C:\Program Files\WindowsApps\AppleInc.iTunes_12134.4.3008.0_x64__nzyj5cx40ttqa [2024-10-25] (Apple Inc.) [Startup Task]

Netflix -> C:\Program Files\WindowsApps\4DF9E0F8.Netflix_7.0.8.0_neutral__mcm4njqhnhss8 [2024-07-23] (Netflix, Inc.)

NVIDIA Control Panel -> C:\Program Files\WindowsApps\NVIDIACorp.NVIDIAControlPanel_8.1.967.0_x64__56jybvy8sckqj [2024-12-27] (NVIDIA Corp.)

Photos Media Engine Add-on -> C:\Program Files\WindowsApps\Microsoft.Photos.MediaEngineDLC_1.0.0.0_x64__8wekyb3d8bbwe [2022-05-31] (Microsoft Corporation)

Prime Video for Windows -> C:\Program Files\WindowsApps\AmazonVideo.PrimeVideo_1.0.171.0_x64__pwbj9vvecjh7j [2025-01-03] (Amazon Development Centre (London) Ltd)

TradingView -> C:\Program Files\WindowsApps\TradingView.Desktop_2.9.4.6649_x64__n534cwy3pjxzj [2024-12-12] (TradingView, Inc.) [Startup Task]

WhatsApp -> C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2450.6.0_x64__cv1g1gvanyjgm [2024-12-20] (WhatsApp Inc.) [Startup Task]

==================== Custom CLSID (Whitelisted): ==============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1357561984-4161033644-3417195034-1001_Classes\CLSID\{32E26FD9-F435-4A20-A561-35D4B987CFDC}\InprocServer32 -> C:\Users\Paul\AppData\Local\WebEx\WebEx64\Meetings\atucfobj.dll (Cisco WebEx LLC -> Cisco WebEx LLC)

CustomCLSID: HKU\S-1-5-21-1357561984-4161033644-3417195034-1001_Classes\CLSID\{38142727-3008-9161-1521-349515000000}\localserver32 -> C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe (Adobe Inc. -> Adobe)

ShellIconOverlayIdentifiers: [ GoogleDriveCloudOverlayIconHandler] -> {A8E52322-8734-481D-A7E2-27B309EF8D56} => C:\Program Files\Google\Drive File Stream\101.0.3.0\drivefsext.dll [2024-12-16] (Google LLC -> Google, Inc.)

ShellIconOverlayIdentifiers: [ GoogleDriveMirrorBlacklistedOverlayIconHandler] -> {51EF1569-67EE-4AD6-9646-E726C3FFC8A2} => C:\Program Files\Google\Drive File Stream\101.0.3.0\drivefsext.dll [2024-12-16] (Google LLC -> Google, Inc.)

ShellIconOverlayIdentifiers: [ GoogleDrivePinnedOverlayIconHandler] -> {CFE8B367-77A7-41D7-9C90-75D16D7DC6B6} => C:\Program Files\Google\Drive File Stream\101.0.3.0\drivefsext.dll [2024-12-16] (Google LLC -> Google, Inc.)

ShellIconOverlayIdentifiers: [ GoogleDriveProgressOverlayIconHandler] -> {C973DA94-CBDF-4E77-81D1-E5B794FBD146} => C:\Program Files\Google\Drive File Stream\101.0.3.0\drivefsext.dll [2024-12-16] (Google LLC -> Google, Inc.)

ShellIconOverlayIdentifiers-x32: [ GoogleDriveCloudOverlayIconHandler] -> {A8E52322-8734-481D-A7E2-27B309EF8D56} => C:\Program Files\Google\Drive File Stream\101.0.3.0\drivefsext.dll [2024-12-16] (Google LLC -> Google, Inc.)

ShellIconOverlayIdentifiers-x32: [ GoogleDriveMirrorBlacklistedOverlayIconHandler] -> {51EF1569-67EE-4AD6-9646-E726C3FFC8A2} => C:\Program Files\Google\Drive File Stream\101.0.3.0\drivefsext.dll [2024-12-16] (Google LLC -> Google, Inc.)

ShellIconOverlayIdentifiers-x32: [ GoogleDrivePinnedOverlayIconHandler] -> {CFE8B367-77A7-41D7-9C90-75D16D7DC6B6} => C:\Program Files\Google\Drive File Stream\101.0.3.0\drivefsext.dll [2024-12-16] (Google LLC -> Google, Inc.)

ShellIconOverlayIdentifiers-x32: [ GoogleDriveProgressOverlayIconHandler] -> {C973DA94-CBDF-4E77-81D1-E5B794FBD146} => C:\Program Files\Google\Drive File Stream\101.0.3.0\drivefsext.dll [2024-12-16] (Google LLC -> Google, Inc.)

ContextMenuHandlers1: [DriveFS 28 or later] -> {EE15C2BD-CECB-49F8-A113-CA1BFC528F5B} => C:\Program Files\Google\Drive File Stream\101.0.3.0\drivefsext.dll [2024-12-16] (Google LLC -> Google, Inc.)

ContextMenuHandlers4: [DriveFS 28 or later] -> {EE15C2BD-CECB-49F8-A113-CA1BFC528F5B} => C:\Program Files\Google\Drive File Stream\101.0.3.0\drivefsext.dll [2024-12-16] (Google LLC -> Google, Inc.)

ContextMenuHandlers4: [RecuvaShellExt] -> {435E5DF5-2510-463C-B223-BDA47006D002} => C:\Program Files\Recuva\RecuvaShell64.dll [2022-11-22] (Piriform Software Ltd -> Piriform Software Ltd)

ContextMenuHandlers5: [DriveFS 28 or later] -> {EE15C2BD-CECB-49F8-A113-CA1BFC528F5B} => C:\Program Files\Google\Drive File Stream\101.0.3.0\drivefsext.dll [2024-12-16] (Google LLC -> Google, Inc.)

ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\Windows\System32\DriverStore\FileRepository\nvrfi.inf_amd64_075e0a1c13484a5c\nvshext.dll [2024-09-28] (NVIDIA Corporation -> NVIDIA Corporation)

ContextMenuHandlers6: [RecuvaShellExt] -> {435E5DF5-2510-463C-B223-BDA47006D002} => C:\Program Files\Recuva\RecuvaShell64.dll [2022-11-22] (Piriform Software Ltd -> Piriform Software Ltd)

==================== Codecs (Whitelisted) ====================

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)

Shortcut: C:\Users\Paul\My Drive\Desktop\Google Drive.lnk -> C:\Program Files\Google\Drive File Stream\launch.bat ()

==================== Loaded Modules (Whitelisted) =============

2021-11-19 19:11 - 2015-12-09 04:08 - 000182784 _____ (SEIKO EPSON CORPORATION) [File not signed] C:\Windows\System32\E_YLMBRFE.DLL

2016-09-14 13:31 - 2016-09-14 13:31 - 000500736 ____S (SEIKO EPSON CORPORATION) [File not signed] C:\Windows\System32\enppmon.dll

==================== Alternate Data Streams (Whitelisted) ========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\Paul\Desktop\FRST64.exe:BDU [0]

==================== Safe Mode (Whitelisted) ==================

==================== Association (Whitelisted) =================

==================== Internet Explorer (Whitelisted) =============

BHO: Bitdefender Anti-tracker -> {159ff5d5-55f1-4d2f-b706-767a55f77abb} -> C:\Program Files\Bitdefender\Bitdefender Security App\bdtrackerstbie.dll [2024-12-13] (Bitdefender SRL -> Bitdefender)

BHO: McAfee WebAdvisor -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> C:\Program Files\McAfee\WebAdvisor\x64\IEPlugin.dll => No File

BHO-x32: Bitdefender Anti-tracker -> {159ff5d5-55f1-4d2f-b706-767a55f77abb} -> C:\Program Files\Bitdefender\Bitdefender Security App\antispam32\bdtrackerstbie.dll [2024-12-13] (Bitdefender SRL -> Bitdefender)

BHO-x32: McAfee WebAdvisor -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> C:\Program Files\McAfee\WebAdvisor\win32\IEPlugin.dll => No File

==================== Hosts content: =========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2019-12-07 09:14 - 2019-12-07 09:12 - 000000824 _____ C:\Windows\system32\drivers\etc\hosts

==================== Other Areas ===========================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1357561984-4161033644-3417195034-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Paul\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper

DNS Servers: 192.168.1.1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

Windows Firewall is enabled.

Network Binding:

=============

Bluetooth Network Connection: Bluetooth Device (Personal Area Network) -> bthpan.sys

WiFi: Intel® Dual Band Wireless-AC 7265 -> Netwtw04.sys

Ethernet 2: Realtek PCIe GbE Family Controller #2 -> rt640x64.sys

HotspotShield Network Adapter: HotspotShield TAP-Windows Adapter V9 -> hsstap.sys

==================== MSCONFIG/TASK MANAGER disabled items ==

(If an entry is included in the fixlist, it will be removed.)

HKLM\...\StartupApproved\Run: => "EPPCCMON"

HKLM\...\StartupApproved\Run32: => "EEventManager"

HKU\S-1-5-21-1357561984-4161033644-3417195034-1001\...\StartupApproved\Run: => "MicrosoftEdgeAutoLaunch_A4C619A52FD641FDF622FAB8D686879D"

HKU\S-1-5-21-1357561984-4161033644-3417195034-1001\...\StartupApproved\Run: => "OneDrive"

HKU\S-1-5-21-1357561984-4161033644-3417195034-1001\...\StartupApproved\Run: => "CCleaner Smart Cleaning"

HKU\S-1-5-21-1357561984-4161033644-3417195034-1001\...\StartupApproved\Run: => "EPLTarget\P0000000000000000"

HKU\S-1-5-21-1357561984-4161033644-3417195034-1001\...\StartupApproved\Run: => "CiscoMeetingDaemon"

HKU\S-1-5-21-1357561984-4161033644-3417195034-1001\...\StartupApproved\Run: => "GoogleDriveFS"

HKU\S-1-5-21-1357561984-4161033644-3417195034-1001\...\StartupApproved\Run: => "utweb"

HKU\S-1-5-21-1357561984-4161033644-3417195034-1001\...\StartupApproved\Run: => "EPSDNMON"

==================== FirewallRules (Whitelisted) ================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{9FC518C8-E636-4E9A-B451-23361BB45443}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe (Intel Corporation-Wireless Connectivity Solutions -> )

FirewallRules: [{AD439D60-7660-4378-838C-F997DAACF74E}] => (Allow) C:\Program Files\Bitdefender\Bitdefender Security\bdntwrk.exe (Bitdefender SRL -> Bitdefender)

FirewallRules: [{8BFB03A1-CF34-49CA-BD11-FCC78F769B2D}] => (Allow) C:\Users\Paul\AppData\Roaming\Zoom\bin\Zoom.exe => No File

FirewallRules: [{5B45D9EF-AC52-42EF-8A6F-6A67A2B7B886}] => (Allow) C:\Users\Paul\AppData\Local\Temp\EpInsNav\DL\3013\Network\EpsonNetSetup\Data\ENEasyApp.exe => No File

FirewallRules: [{0EF0A148-B0E0-46C7-A8A7-4C7B994F6D23}] => (Allow) C:\Users\Paul\AppData\Local\Temp\EpInsNav\DL\3013\Network\EpsonNetSetup\Data\ENEasyApp.exe => No File

FirewallRules: [{9126DA9E-467D-4824-AA62-72627051AF52}] => (Allow) C:\Users\Paul\AppData\Local\Temp\EpInsNav\DL\3013\Network\EpsonNetSetup\Data\ENEasyApp.exe => No File

FirewallRules: [{EFA319F7-5FDC-45BC-8FBC-5A01AD87F572}] => (Allow) C:\Users\Paul\AppData\Local\Temp\EpInsNav\DL\3013\Network\EpsonNetSetup\Data\ENEasyApp.exe => No File

FirewallRules: [{357E694A-3CBC-4F7A-A7D8-CD54FEAD7EC1}] => (Allow) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION -> Seiko Epson Corporation)

FirewallRules: [{6A7D9EA9-DB71-4A9E-988F-69D0C9EE6E30}] => (Allow) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION -> Seiko Epson Corporation)

FirewallRules: [{96E19EED-738F-4A11-9F0D-43EC5328452C}] => (Allow) C:\Program Files\Zoom\bin\Zoom.exe (Zoom Video Communications, Inc. -> Zoom Video Communications, Inc.)

FirewallRules: [{5CF4FD41-C92E-4A80-A627-8E812AC2332D}] => (Allow) C:\Program Files\Zoom\bin\airhost.exe (Zoom Video Communications, Inc. -> Zoom Video Communications, Inc.)

FirewallRules: [{BD4939EE-0B58-4ED9-B7E0-8C3A193CE12D}] => (Allow) C:\Program Files\Zoom\bin\airhost.exe (Zoom Video Communications, Inc. -> Zoom Video Communications, Inc.)

FirewallRules: [{8F3172D0-188D-4490-9714-93664B93608C}] => (Allow) C:\Program Files\WindowsApps\AppleInc.iTunes_12134.4.3008.0_x64__nzyj5cx40ttqa\iTunes.exe (5BD5593D-A41B-4F89-884E-B4F3E0FBAA75 -> Apple Inc.)

FirewallRules: [{FA636920-DA7D-48E5-A433-7BA7F7818D47}] => (Allow) C:\Program Files\WindowsApps\AppleInc.iTunes_12134.4.3008.0_x64__nzyj5cx40ttqa\iTunes.exe (5BD5593D-A41B-4F89-884E-B4F3E0FBAA75 -> Apple Inc.)

FirewallRules: [{448A28A9-0545-46E8-B5F7-91B4E0BDD644}] => (Allow) C:\Program Files\WindowsApps\AppleInc.iTunes_12134.4.3008.0_x64__nzyj5cx40ttqa\iTunes.exe (5BD5593D-A41B-4F89-884E-B4F3E0FBAA75 -> Apple Inc.)

FirewallRules: [{8B6247D9-726C-4141-A726-840CB9B7423B}] => (Allow) C:\Program Files\WindowsApps\AppleInc.iTunes_12134.4.3008.0_x64__nzyj5cx40ttqa\iTunes.exe (5BD5593D-A41B-4F89-884E-B4F3E0FBAA75 -> Apple Inc.)

FirewallRules: [{52A40D29-B39E-4E53-8BF4-565B97B84950}] => (Allow) C:\Program Files\WindowsApps\AppleInc.iTunes_12134.4.3008.0_x64__nzyj5cx40ttqa\AMDS64\AppleMobileDeviceProcess.exe (5BD5593D-A41B-4F89-884E-B4F3E0FBAA75 -> Apple Inc.)

FirewallRules: [{DC61B80B-CDDE-4724-8555-6A053FFA363B}] => (Allow) C:\Program Files\WindowsApps\AppleInc.iTunes_12134.4.3008.0_x64__nzyj5cx40ttqa\AMDS64\AppleMobileDeviceProcess.exe (5BD5593D-A41B-4F89-884E-B4F3E0FBAA75 -> Apple Inc.)

FirewallRules: [{E00ED792-E39F-4489-9220-74C187E30D89}] => (Allow) C:\Program Files\WindowsApps\AppleInc.iTunes_12134.4.3008.0_x64__nzyj5cx40ttqa\AMDS64\AppleMobileDeviceProcess.exe (5BD5593D-A41B-4F89-884E-B4F3E0FBAA75 -> Apple Inc.)

FirewallRules: [{6A467FFD-1898-4482-B666-5AABA2DB05B5}] => (Allow) C:\Program Files\WindowsApps\AppleInc.iTunes_12134.4.3008.0_x64__nzyj5cx40ttqa\AMDS64\AppleMobileDeviceProcess.exe (5BD5593D-A41B-4F89-884E-B4F3E0FBAA75 -> Apple Inc.)

FirewallRules: [{C2D73D66-1042-4618-8EC3-6D4850C4C33D}] => (Allow) C:\Program Files\FTMO MetaTrader 5\metatester64.exe (MetaQuotes Ltd -> MetaQuotes Ltd.)

FirewallRules: [{A80BBA97-DA58-47E9-842F-1E046129D27F}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe (Google LLC -> Google LLC)

FirewallRules: [{962C267A-05B5-48EE-B1BB-2633412CF18B}] => (Allow) C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.112\msedgewebview2.exe (Microsoft Corporation -> Microsoft Corporation)

FirewallRules: [{0AADEE35-7335-41C6-BC2D-F74A2B1EA599}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.134.3202.0_x64__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)

FirewallRules: [{12DD8E3E-6D76-4648-9775-3445AC1C255C}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.134.3202.0_x64__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)

FirewallRules: [{52E70027-CFEA-46FE-9A89-A9A05C5BEA36}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.134.3202.0_x64__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)

FirewallRules: [{32508CEB-D9FF-4597-A1D7-5FABB89A31B8}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.134.3202.0_x64__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)

==================== Restore Points =========================

18-12-2024 19:43:02 Scheduled Checkpoint

27-12-2024 06:05:09 Scheduled Checkpoint

05-01-2025 09:00:22 Scheduled Checkpoint

==================== Faulty Device Manager Devices ============

==================== Event log errors: ========================

Application errors:

==================

Error: (01/03/2025 06:20:36 AM) (Source: Microsoft-Windows-Perflib) (EventID: 1023) (User: NT AUTHORITY)

Description: Windows cannot load the extensible counter DLL "C:\Windows\system32\sysmain.dll" (Win32 error code 126).

Error: (12/31/2024 05:52:08 AM) (Source: Microsoft-Windows-Perflib) (EventID: 1023) (User: NT AUTHORITY)

Description: Windows cannot load the extensible counter DLL "C:\Windows\system32\sysmain.dll" (Win32 error code 126).

Error: (12/30/2024 05:50:43 AM) (Source: Microsoft-Windows-Perflib) (EventID: 1023) (User: NT AUTHORITY)

Description: Windows cannot load the extensible counter DLL "C:\Windows\system32\sysmain.dll" (Win32 error code 126).

Error: (12/28/2024 02:12:17 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: The program wmplayer.exe version 12.0.19041.3636 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

Process ID: 16e8

Start Time: 01db5930efee2a9f

Termination Time: 15

Application Path: C:\Program Files (x86)\Windows Media Player\wmplayer.exe

Report Id: ae34c2c3-71b7-420d-b4ec-fdaa0e3e5272

Faulting package full name:

Faulting package-relative application ID:

Hang type: Unknown

Error: (12/28/2024 01:58:56 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: The program explorer.exe version 10.0.19041.5247 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

Process ID: 1dd0

Start Time: 01db592f235501f8

Termination Time: 337

Application Path: C:\Windows\explorer.exe

Report Id: c96b33e1-3176-4e7c-9b64-1c07935b1e23

Faulting package full name:

Faulting package-relative application ID:

Hang type: Cross-thread

Error: (12/20/2024 05:23:00 AM) (Source: Microsoft-Windows-AppModel-State) (EventID: 12) (User: PC)

Description: Microsoft.Windows.Photos_8wekyb3d8bbwe-2147023878

Error: (12/19/2024 06:29:49 AM) (Source: Microsoft-Windows-Perflib) (EventID: 1023) (User: NT AUTHORITY)

Description: Windows cannot load the extensible counter DLL "C:\Windows\system32\sysmain.dll" (Win32 error code 126).

Error: (12/18/2024 07:24:57 PM) (Source: Microsoft-Windows-Perflib) (EventID: 1023) (User: NT AUTHORITY)

Description: Windows cannot load the extensible counter DLL "C:\Windows\system32\sysmain.dll" (Win32 error code 126).

System errors:

=============

Error: (01/05/2025 02:50:33 PM) (Source: Microsoft-Windows-TPM-WMI) (EventID: 1796) (User: NT AUTHORITY)

Description: The Secure Boot update failed to update a Secure Boot variable with error (-2147020471 = Secure Boot is not enabled on this machine.). For more information, please see https://go.microsoft...?linkid=2169931

Error: (01/05/2025 02:48:31 PM) (Source: EventLog) (EventID: 6008) (User: )

Description: The previous system shutdown at 14:02:13 on ‎05/‎01/‎2025 was unexpected.

Error: (01/05/2025 02:02:13 PM) (Source: EventLog) (EventID: 6008) (User: )

Description: The previous system shutdown at 14:00:25 on ‎05/‎01/‎2025 was unexpected.

Error: (01/05/2025 02:02:06 PM) (Source: Microsoft-Windows-Kernel-Boot) (EventID: 29) (User: NT AUTHORITY)

Description: 3221225595A fatal error occurred processing the restoration data.

Error: (01/05/2025 02:00:25 PM) (Source: EventLog) (EventID: 6008) (User: )

Description: The previous system shutdown at 13:57:43 on ‎05/‎01/‎2025 was unexpected.

Error: (01/05/2025 01:57:43 PM) (Source: EventLog) (EventID: 6008) (User: )

Description: The previous system shutdown at 13:56:13 on ‎05/‎01/‎2025 was unexpected.

Error: (01/05/2025 01:57:33 PM) (Source: Microsoft-Windows-Kernel-Boot) (EventID: 29) (User: NT AUTHORITY)

Description: 3221225595A fatal error occurred processing the restoration data.

Error: (01/05/2025 01:56:03 PM) (Source: Microsoft-Windows-Kernel-Boot) (EventID: 29) (User: NT AUTHORITY)

Description: 3221225595A fatal error occurred processing the restoration data.

Windows Defender:

================Event[0]:

Date: 2023-01-17 14:53:33

Description:

Microsoft Defender Antivirus has encountered an error trying to update security intelligence.

New security intelligence Version:

Previous security intelligence Version: 1.303.25.0

Update Source: Microsoft Malware Protection Center

Security intelligence Type: AntiVirus

Update Type: Full

Current Engine Version:

Previous Engine Version: 1.1.16400.2

Error code: 0x80072ee7

Error description: The server name or address could not be resolved

Date: 2023-01-17 14:53:33

Description:

Microsoft Defender Antivirus has encountered an error trying to update security intelligence.

New security intelligence Version:

Previous security intelligence Version: 1.303.25.0

Update Source: Microsoft Malware Protection Center

Security intelligence Type: AntiSpyware

Update Type: Full

Current Engine Version:

Previous Engine Version: 1.1.16400.2

Error code: 0x80072ee7

Error description: The server name or address could not be resolved

Date: 2023-01-17 14:53:33

Description:

Microsoft Defender Antivirus has encountered an error trying to update security intelligence.

New security intelligence Version:

Previous security intelligence Version: 1.303.25.0

Update Source: Microsoft Malware Protection Center

Security intelligence Type: AntiVirus

Update Type: Full

Current Engine Version:

Previous Engine Version: 1.1.16400.2

Error code: 0x80072ee7

Error description: The server name or address could not be resolved

Date: 2023-01-17 14:53:33

Description:

Microsoft Defender Antivirus has encountered an error trying to update security intelligence.

New security intelligence Version:

Previous security intelligence Version: 1.303.25.0

Update Source: Microsoft Malware Protection Center

Security intelligence Type: AntiVirus

Update Type: Full

Current Engine Version:

Previous Engine Version: 1.1.16400.2

Error code: 0x80072ee7

Error description: The server name or address could not be resolved

Date: 2023-01-17 14:53:33

Description:

Microsoft Defender Antivirus has encountered an error trying to update security intelligence.

New security intelligence Version:

Previous security intelligence Version: 1.303.25.0

Update Source: Microsoft Malware Protection Center

Security intelligence Type: AntiSpyware

Update Type: Full

Current Engine Version:

Previous Engine Version: 1.1.16400.2

Error code: 0x80072ee7

Error description: The server name or address could not be resolved

CodeIntegrity:

===============

Date: 2025-01-05 14:50:44

Description:

Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bitdefender\Bitdefender Security\bdamsi\dlls_267085317237112912\antimalware_provider64.dll that did not meet the Windows signing level requirements.

==================== Memory info ===========================

BIOS: American Megatrends Inc. 2.B0 11/30/2020

Motherboard: Micro-Star International Co., Ltd. B450M MORTAR MAX (MS-7B89)

Processor: AMD Ryzen 5 1600 Six-Core Processor

Percentage of memory in use: 74%

Total physical RAM: 8117.74 MB

Available physical RAM: 2098.79 MB

Total Virtual: 11317.74 MB

Available Virtual: 2955.77 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:223.46 GB) (Free:66.22 GB) (Model: WDC WDS240G2G0B-00EPW0) NTFS

\\?\Volume{5883be86-da96-4d54-9bc9-5fe116bd42c7}\ () (Fixed) (Total:0.09 GB) (Free:0.07 GB) FAT32

==================== MBR & Partition Table ====================

==========================================================

Disk: 0 (Size: 223.6 GB) (Disk ID: 5E539B50)

Partition: GPT.

==================== End of Addition.txt =======================

#2
RKinner

Posted 05 January 2025 - 02:48 PM

Malware Expert

Expert
24,713 posts

It looks like your PC might be crashing on shutdown since the event viewer reports

The previous system shutdown at 13:56:13 on ‎05/‎01/‎2025 was unexpected.

You can turn off Automatic Restart which might give you more details:

Settings, System, About then over on the right side click on Advanced System Settings.

This will bring up a new window, Under Startup and Recovery, click on Settings and it should bring up another

new window.

Under System Failure:

check Write an event to the system log

UNCHECK: Automatically Restart

Under Write Debugging Information

it should say:

Small Memory Dump (256KB)

You have a couple of other problems - don't know if they are related but let's address them:

:Description: 3221225595A fatal error occurred processing the restoration data.

This is probably a hibernate error. Try turning off hibernate:

Open am Admin Command Prompt ( Search for cmd but don't hit enter. It should find Command Prompt. Right click on it and Run As Admin.)

Type:

powercfg.exe  /hibernate off

Hit Enter. (Note to save typing and prevent errors it's best to copy the command (highlight the command then Ctrl + c) then move to the Command Prompt and right click)

Now type:

dir  /a  \hiberfil.sys

Enter.

It should normally show

File Not Found

If it finds a file then delete it with:

del  /h  \hiberfil.sys

I would leave it off for a while. To turn it back on you open an Admin Command Prompt again and type:

powercfg.exe /hibernate on

Finally and rather strange is the large number of zero byte files in your Winsock: Catalog5.

Not sure how you are able to get on line without them. :

In the Admin Command Prompt type:

DISM  /Online  /Cleanup-Image  /RestoreHealth

Hit Enter. Usually takes about 15 minutes but can be longer. Be patient.

When that finishes, type:

SFC  /scannow

Enter. Should take about 10 minutes. When it finishes it will tell you if it found any bad files and was able to fix them. If it says it couldn't fix them let me know.

Now let's clear all of the events and reboot.

Type:

FOR /F "usebackq delims==" %i IN (`wevtutil el`) DO wevtutil cl "%i"

Enter.

Now close all windows and reboot.

Do you get a blue screen? What does it say?

Once it restarts, rerun FRST as before and post both logs.

#3
ClearGreen

Posted 06 January 2025 - 01:22 AM

Member

Topic Starter
Member
14 posts

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 04-01-2025

Ran by Paul (administrator) on PC (Micro-Star International Co., Ltd. MS-7B89) (06-01-2025 07:15:02)

Running from C:\Users\Paul\Desktop\FRST64.exe

Loaded Profiles: Paul

Platform: Microsoft Windows 10 Pro Version 22H2 19045.5247 (X64) Language: English (United Kingdom)

Default browser: Chrome

Boot Mode: Normal

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(C:\Program Files\Bitdefender Agent\ProductAgentService.exe ->) (Bitdefender SRL -> Bitdefender) C:\Program Files\Bitdefender Agent\27.0.1.290\DiscoverySrv.exe

(C:\Program Files\Bitdefender\Bitdefender Security App\bdservicehost.exe ->) (Bitdefender SRL -> Bitdefender) C:\Program Files\Bitdefender\Bitdefender Security App\bdagent.exe

(C:\Program Files\Bitdefender\Bitdefender Security\bdservicehost.exe ->) (Bitdefender SRL -> Bitdefender) C:\Program Files\Bitdefender\Bitdefender Security\bdntwrk.exe

(C:\Program Files\Bitdefender\Bitdefender Security\bdservicehost.exe ->) (Bitdefender SRL -> Bitdefender) C:\Program Files\Bitdefender\Bitdefender Security\bduserhost.exe <2>

(C:\Program Files\Bitdefender\Bitdefender Security\bdservicehost.exe ->) (S.C. BITDEFENDER S.R.L. -> Bitdefender) C:\Program Files\Bitdefender\Bitdefender Security\wsccommunicator.exe

(explorer.exe ->) (Google LLC -> Google LLC) C:\Program Files\Google\Chrome\Application\chrome.exe <2>

(Google LLC -> Google LLC) C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\updater.exe <6>

(Microsoft Corporation -> ) C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2024.11120.5010.0_x64__8wekyb3d8bbwe\Photos.exe

(Microsoft Windows -> Microsoft Corporation) C:\Windows\splwow64.exe