Jump to content

anindya

Members
  • Posts

    7
  • Joined

  • Last visited

Reputation

0 Neutral
  1. I installed road redemption and it was in Downloads folder. C:\Users\Thor\Downloads
  2. Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10.11.2018 Ran by Thor (11-11-2018 11:34:20) Running from C:\Users\Thor\Downloads Windows 10 Home Single Language Version 1803 17134.345 (X64) (2018-08-15 18:27:05) Boot Mode: Normal ========================================================== ==================== Accounts: ============================= Administrator (S-1-5-21-2452082275-3313010305-2762231402-500 - Administrator - Disabled) DefaultAccount (S-1-5-21-2452082275-3313010305-2762231402-503 - Limited - Disabled) Guest (S-1-5-21-2452082275-3313010305-2762231402-501 - Limited - Disabled) Thor (S-1-5-21-2452082275-3313010305-2762231402-1001 - Administrator - Enabled) => C:\Users\Thor WDAGUtilityAccount (S-1-5-21-2452082275-3313010305-2762231402-504 - Limited - Disabled) ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B} AV: McAfee VirusScan (Enabled - Up to date) {8BCDACFA-D264-3528-5EF8-E94FD0BC1FBC} AS: Malwarebytes (Enabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: McAfee VirusScan (Enabled - Up to date) {30AC4D1E-F45E-3AA6-6448-D23DAB3B5501} FW: McAfee Firewall (Enabled) {B3F62DDF-980B-3470-75A7-407A2E6F58C7} ==================== Installed Programs ====================== (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) «Road Redemption» (1.01) (HKLM-x32\...\«Road Redemption»_is1) (Version: 1.01 - Pixel Dash Studios, EQ) µTorrent (HKU\S-1-5-21-2452082275-3313010305-2762231402-1001\...\uTorrent) (Version: 3.5.4.44809 - BitTorrent Inc.) ASUS Device Activation (HKLM-x32\...\{9C4B0706-9F9A-47BF-B417-0A111FC52B04}) (Version: 1.0.4.0 - ASUSTeK COMPUTER INC.) ASUS GiftBox Service (HKLM-x32\...\{4701E5AB-AF91-4D40-8F18-358CC80E4E5B}) (Version: 3.2.3.0 - ASUSTeK COMPUTER INC.) ASUS Hello (HKLM-x32\...\{D8CE1923-92A9-4036-817E-9E0D8AA2169B}) (Version: 1.1.4.0 - ASUSTeK COMPUTER INC.) ASUS Live Update (HKLM-x32\...\{FA540E67-095C-4A1B-97BA-4D547DEC9AF4}) (Version: 3.5.2 - ASUSTeK COMPUTER INC.) ATK Package (ASUS Keyboard Hotkeys) (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version: 1.0.0060 - ASUSTeK COMPUTER INC.) AudioWizard (HKLM-x32\...\{57E770A2-2BAF-4CAA-BAA3-BD896E2254D3}) (Version: 1.0.8.5 - ICEpower a/s) Citrix Receiver 4.9 LTSR (HKLM-x32\...\CitrixOnlinePluginPackWeb) (Version: 14.9.2000.21 - Citrix Systems, Inc.) FIFA18 version 1.0 (HKLM\...\FIFA18_is1) (Version: 1.0 - STEAMPUNKS) <==== ATTENTION Google Chrome (HKLM-x32\...\Google Chrome) (Version: 70.0.3538.77 - Google Inc.) Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.17 - Google Inc.) Hidden Intel(R) Chipset Device Software (HKLM-x32\...\{55d73ea7-6354-42db-8831-02d048ae57f8}) (Version: 10.1.17541.8066 - Intel(R) Corporation) Hidden Intel(R) Dynamic Platform and Thermal Framework (HKLM-x32\...\{654EE65D-FAA4-4EA6-8C07-DC94E6A304D4}) (Version: 8.3.10208.5644 - Intel Corporation) Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 11.7.0.1068 - Intel Corporation) Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 23.20.16.4974 - Intel Corporation) Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 16.0.4.1093 - Intel Corporation) Intel(R) Serial IO (HKLM\...\{9FD91C5C-44AE-4D9D-85BE-AE52816B0294}) (Version: 30.100.1725.1 - Intel Corporation) Intel(R) Trusted Connect Service Client x86 (HKLM-x32\...\{C9552825-7BF2-4344-BA91-D3CD46F4C441}) (Version: 1.49.166.0 - Intel Corporation) Hidden Intel(R) Trusted Connect Services Client (HKLM-x32\...\{df682aff-4294-4ad1-aaa7-276931d5781f}) (Version: 1.49.166.0 - Intel Corporation) Hidden Intel® PROSet/Wireless Software (HKLM-x32\...\{d5c53162-d8b4-4547-8a40-917a25c0172e}) (Version: 20.60.0 - Intel Corporation) Logitech Unifying Software 2.50 (HKLM\...\Logitech Unifying) (Version: 2.50.25 - Logitech) Malwarebytes version 3.6.1.2711 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.6.1.2711 - Malwarebytes) McAfee LiveSafe (HKLM-x32\...\MSC) (Version: 16.0 R14 - McAfee, Inc.) McAfee WebAdvisor (HKLM-x32\...\{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}) (Version: 4.0.8.19377 - McAfee, Inc.) Microsoft OneDrive (HKU\S-1-5-21-2452082275-3313010305-2762231402-1001\...\OneDriveSetup.exe) (Version: 18.172.0826.0010 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation) Microsoft Visual Studio Code (User) (HKU\S-1-5-21-2452082275-3313010305-2762231402-1001\...\{771FD6B0-FA20-440A-A002-3B3BAC16DC50}_is1) (Version: 1.27.2 - Microsoft Corporation) NVIDIA GeForce Experience 3.12.0.84 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 3.12.0.84 - NVIDIA Corporation) NVIDIA Graphics Driver 389.12 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 389.12 - NVIDIA Corporation) NVIDIA PhysX System Software 9.17.0524 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.17.0524 - NVIDIA Corporation) Online Plug-in (HKLM-x32\...\{D9BD3EBD-36EB-4F89-B7A3-2451AD374496}) (Version: 14.9.2000.21 - Citrix Systems, Inc.) Hidden Popcorn-Time (HKU\S-1-5-21-2452082275-3313010305-2762231402-1001\...\Popcorn-Time) (Version: 0.3.10 - Popcorn Time) Python 3.7.0 (32-bit) (HKU\S-1-5-21-2452082275-3313010305-2762231402-1001\...\{ece37911-ffeb-4f29-95d6-abcf555d7364}) (Version: 3.7.150.0 - Python Software Foundation) Python 3.7.0 (Anaconda3 5.3.0 64-bit) (HKU\S-1-5-21-2452082275-3313010305-2762231402-1001\...\Python 3.7.0 (Anaconda3 5.3.0 64-bit)) (Version: 5.3.0 - Anaconda, Inc.) Python 3.7.0 Core Interpreter (32-bit) (HKLM-x32\...\{13BB06D9-FD38-47E5-946E-C2606C554030}) (Version: 3.7.150.0 - Python Software Foundation) Hidden Python 3.7.0 Development Libraries (32-bit) (HKLM-x32\...\{B424BE74-3C96-4974-8754-9D6442286112}) (Version: 3.7.150.0 - Python Software Foundation) Hidden Python 3.7.0 Documentation (32-bit) (HKLM-x32\...\{ABEE159E-FE5B-4E58-BDD7-1DED2F10AAEB}) (Version: 3.7.150.0 - Python Software Foundation) Hidden Python 3.7.0 Executables (32-bit) (HKLM-x32\...\{4642A126-F999-4407-801B-C1C89BDA58C5}) (Version: 3.7.150.0 - Python Software Foundation) Hidden Python 3.7.0 pip Bootstrap (32-bit) (HKLM-x32\...\{69CFC76B-3434-4919-8885-BA7960725137}) (Version: 3.7.150.0 - Python Software Foundation) Hidden Python 3.7.0 Standard Library (32-bit) (HKLM-x32\...\{09160A5D-8B99-4A89-9E9D-8A6D8E9C7EC1}) (Version: 3.7.150.0 - Python Software Foundation) Hidden Python 3.7.0 Tcl/Tk Support (32-bit) (HKLM-x32\...\{8A09EA6B-C86C-4ECA-8742-C4C1BCA96845}) (Version: 3.7.150.0 - Python Software Foundation) Hidden Python 3.7.0 Test Suite (32-bit) (HKLM-x32\...\{717DB3B4-C457-447B-A8A6-6921A4D917EF}) (Version: 3.7.150.0 - Python Software Foundation) Hidden Python 3.7.0 Utility Scripts (32-bit) (HKLM-x32\...\{FC756D1E-1252-406E-8414-E11FAF97F3C7}) (Version: 3.7.150.0 - Python Software Foundation) Hidden Python 3.7.1rc1 (64-bit) (HKU\S-1-5-21-2452082275-3313010305-2762231402-1001\...\{81649048-4dad-4376-a160-cf35dc9ebdb6}) (Version: 3.7.1121.0 - Python Software Foundation) Python 3.7.1rc1 Add to Path (64-bit) (HKLM\...\{15E5D203-C806-4A41-AE47-304B17A61B99}) (Version: 3.7.1121.0 - Python Software Foundation) Hidden Python 3.7.1rc1 Core Interpreter (64-bit) (HKLM\...\{16B55EA2-53B8-4431-85C9-D8A1066CD703}) (Version: 3.7.1121.0 - Python Software Foundation) Hidden Python 3.7.1rc1 Development Libraries (64-bit) (HKLM\...\{EA3F1CFF-FFDB-411D-8892-CE8785C03536}) (Version: 3.7.1121.0 - Python Software Foundation) Hidden Python 3.7.1rc1 Documentation (64-bit) (HKLM\...\{E480639A-23BA-4EC1-9BFB-29A9927F4384}) (Version: 3.7.1121.0 - Python Software Foundation) Hidden Python 3.7.1rc1 Executables (64-bit) (HKLM\...\{6D6E1822-0071-4C72-B2B5-A489A4BACF98}) (Version: 3.7.1121.0 - Python Software Foundation) Hidden Python 3.7.1rc1 pip Bootstrap (64-bit) (HKLM\...\{738800A2-D31E-4117-8B5C-AAFC464BF96C}) (Version: 3.7.1121.0 - Python Software Foundation) Hidden Python 3.7.1rc1 Standard Library (64-bit) (HKLM\...\{4C7A44F1-4444-4D5A-AFB2-2C1739A29544}) (Version: 3.7.1121.0 - Python Software Foundation) Hidden Python 3.7.1rc1 Tcl/Tk Support (64-bit) (HKLM\...\{410E210A-440C-44F1-8B21-F9B463F14395}) (Version: 3.7.1121.0 - Python Software Foundation) Hidden Python 3.7.1rc1 Test Suite (64-bit) (HKLM\...\{0E079D36-B148-4217-929C-320DBAF1A37B}) (Version: 3.7.1121.0 - Python Software Foundation) Hidden Python 3.7.1rc1 Utility Scripts (64-bit) (HKLM\...\{BCEA126E-FBB4-42E4-9F42-847AE2C4FB84}) (Version: 3.7.1121.0 - Python Software Foundation) Hidden Python Launcher (HKLM-x32\...\{BBC22881-C285-4A60-971A-F2A275E57706}) (Version: 3.7.6477.0 - Python Software Foundation) Self-service Plug-in (HKLM-x32\...\{2A7454B7-827C-45C8-8946-77230183FAAD}) (Version: 4.9.2000.16 - Citrix Systems, Inc.) Hidden Tencent Gaming Buddy (HKLM-x32\...\MobileGamePC) (Version: 1.0.0.1 - Tencent Technology Company) Vulkan Run Time Libraries 1.0.61.0 (HKLM\...\VulkanRT1.0.61.0) (Version: 1.0.61.0 - LunarG, Inc.) Hidden Vulkan Run Time Libraries 1.0.65.1 (HKLM\...\VulkanRT1.0.65.1) (Version: 1.0.65.1 - LunarG, Inc.) Hidden WinFlash (HKLM-x32\...\{8F21291E-0444-4B1D-B9F9-4370A73E346D}) (Version: 3.2.9.0 - ASUSTeK COMPUTER INC.) WinRAR 5.61 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.61.0 - win.rar GmbH) ==================== Custom CLSID (Whitelisted): ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ContextMenuHandlers1: [McCtxMenuFrmWrk] -> {CCA9EFD3-29ED-430A-BA6D-E6BBFF0A60C2} => c:\Program Files\mcafee\msc\McCtxMenuFrmWrk.dll [2018-10-05] (McAfee, Inc.) ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2018-09-30] (Alexander Roshal) ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2018-09-30] (Alexander Roshal) ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-09-19] (Malwarebytes) ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\Windows\System32\DriverStore\FileRepository\cui_component.inf_amd64_df4f60b1cae9b14a\igfxDTCM.dll [2018-05-28] (Intel Corporation) ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\Windows\system32\nvshext.dll [2018-03-07] (NVIDIA Corporation) ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-09-19] (Malwarebytes) ContextMenuHandlers6: [McCtxMenuFrmWrk] -> {CCA9EFD3-29ED-430A-BA6D-E6BBFF0A60C2} => c:\Program Files\mcafee\msc\McCtxMenuFrmWrk.dll [2018-10-05] (McAfee, Inc.) ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2018-09-30] (Alexander Roshal) ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2018-09-30] (Alexander Roshal) ==================== Scheduled Tasks (Whitelisted) ============= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) Task: {0253572B-C718-495E-AEB8-B861752D1DC9} - System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [2018-01-10] (NVIDIA Corporation) Task: {1C377B75-DD52-4822-8D54-BA8123C3973E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2018-10-03] (Google Inc.) Task: {2B957BE9-4850-42CA-947B-91F1B680BE75} - System32\Tasks\McAfee Remediation (Prepare) => C:\Program Files\Common Files\AV\McAfee VirusScan\upgrade.exe [2018-08-18] (McAfee, Inc.) Task: {2E9A2C84-8982-40DA-A372-1D06EEFAEA71} - System32\Tasks\ATK Package 36D18D69AFC3 => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\SimAppExec.exe [2017-11-24] (ASUSTek Computer Inc.) Task: {42EDCFF0-6A57-41D1-BBCD-F9E2DEFF95A5} - System32\Tasks\McAfeeLogon => C:\Program Files\Common Files\mcafee\platform\McUICnt.exe [2018-07-14] (McAfee, Inc.) Task: {590642CC-4E56-49B3-B178-5D889C4D9420} - System32\Tasks\McAfee\McAfee Auto Maintenance Task Agent Task: {65B85F6F-35B3-4459-A179-28255D5B7B25} - System32\Tasks\Microsoft\Windows\HelloFace\FODCleanupTask => C:\Windows\System32\WinBioPlugIns\FaceFodUninstaller.exe [2018-04-12] () Task: {6DEEF2F1-7E7A-4602-8D56-7DE05070D6D6} - System32\Tasks\Update Checker => C:\Program Files (x86)\ASUS\ASUS Live Update\UpdateChecker.exe [2018-04-27] () Task: {7A5FFB40-30D9-40AF-8378-DCEDF7C46C69} - System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe [2018-01-10] (NVIDIA Corporation) Task: {7B2FD588-09E6-419D-A137-0F21CFD04654} - System32\Tasks\McAfee\DAD.Execute.Updates => C:\Program Files\Common Files\McAfee\DynamicAppDownloader\DADUpdater.exe [2018-06-07] (McAfee, Inc.) Task: {8E1FC546-0BE9-4297-B6E7-822D06055EBA} - System32\Tasks\McAfee\McAfee Idle Detection Task Task: {A2E36DA8-4AA0-4FA4-955D-1D67FC6607AA} - System32\Tasks\ASUS Hello => C:\Program Files (x86)\ASUS\ASUS Hello\ASUSHelloBG.exe [2018-06-01] () Task: {A8A88031-DD30-46F8-8A5C-E966589AAA96} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2018-01-10] (NVIDIA Corporation) Task: {AA2E1A04-6035-42FD-A759-9D91AB64E08F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2018-10-03] (Google Inc.) Task: {B7B53F61-60D3-4182-869B-513E1F0CEBE6} - System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe [2018-01-10] (NVIDIA Corporation) Task: {C70A7440-96A8-43CC-B3AD-6021BE14E197} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2018-01-10] (NVIDIA Corporation) Task: {D01AA421-5C8C-4B10-8622-B25683265DA3} - System32\Tasks\ATK Package A22126881260 => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\SimAppExec.exe [2017-11-24] (ASUSTek Computer Inc.) Task: {D391BC59-7A21-45DF-AE6E-D8A6B5E2953B} - System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2018-01-10] (NVIDIA Corporation) Task: {F9784532-9D03-4F15-BB27-B761982E71B8} - System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2018-01-10] (NVIDIA Corporation) Task: {FA81DB6D-E861-483B-BC7C-A7111BB623D3} - System32\Tasks\NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA GeForce Experience.exe [2018-01-10] (NVIDIA Corporation) (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.) ==================== Shortcuts & WMI ======================== (The entries could be listed to be restored or removed.) ShortcutWithArgument: C:\Users\Thor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Anaconda3 (64-bit)\Anaconda Prompt.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation) -> "/K" C:\Users\Thor\Anaconda3\Scripts\activate.bat C:\Users\Thor\Anaconda3 ==================== Loaded Modules (Whitelisted) ============== 2018-06-15 13:48 - 2018-05-13 13:05 - 000182800 _____ () C:\Windows\system32\IntelWifiIhv06.dll 2018-11-11 10:54 - 2018-10-18 08:44 - 002821952 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MwacLib.dll 2018-11-11 10:54 - 2018-10-18 08:44 - 002695360 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SelfProtectionSdk.dll 2018-06-30 02:04 - 2018-06-30 02:04 - 000896136 _____ () C:\Program Files\Common Files\McAfee\CSP\3.0.127.0\McCSPMsgBusDLL.dll 2018-06-01 02:30 - 2018-06-01 02:30 - 000642448 _____ () C:\Program Files (x86)\ASUS\ASUS Hello\ASUSHelloBG.exe 2018-04-12 05:04 - 2018-04-12 05:04 - 000491744 _____ () C:\Windows\SYSTEM32\inputhost.dll 2018-04-12 05:04 - 2018-04-12 05:04 - 000472064 _____ () C:\Windows\ShellExperiences\TileControl.dll 2018-04-12 05:04 - 2018-04-12 05:04 - 002759168 _____ () C:\Windows\ShellComponents\TaskFlowUI.dll 2018-10-10 11:39 - 2018-09-20 09:08 - 002185728 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll 2018-10-16 14:16 - 2018-10-16 14:16 - 000009216 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.33.41.0_x64__kzf8qxf38zg5c\ImagePipelineNative.dll 2018-10-24 09:45 - 2018-10-24 09:45 - 000060416 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.33.41.0_x64__kzf8qxf38zg5c\ChakraBridge.dll 2018-10-24 09:45 - 2018-10-24 09:45 - 000019456 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.33.41.0_x64__kzf8qxf38zg5c\SkypeProxiesAndStubs.dll 2018-10-24 09:45 - 2018-10-24 09:45 - 010978304 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.33.41.0_x64__kzf8qxf38zg5c\LibWrapper.dll 2018-10-24 09:45 - 2018-10-24 09:45 - 002810368 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.33.41.0_x64__kzf8qxf38zg5c\skypert.dll 2018-10-24 09:45 - 2018-10-24 09:45 - 000685056 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.33.41.0_x64__kzf8qxf38zg5c\RtmMvrUap.dll 2018-10-03 23:43 - 2018-10-03 23:43 - 001922224 _____ () C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.10314.31700.1000_x64__8wekyb3d8bbwe\Microsoft.Applications.Telemetry.Windows.dll 2018-10-24 09:45 - 2018-10-24 09:45 - 000183808 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.33.41.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe 2018-10-26 11:34 - 2018-10-24 02:54 - 005020504 _____ () C:\Program Files (x86)\Google\Chrome\Application\70.0.3538.77\libglesv2.dll 2018-10-26 11:34 - 2018-10-24 02:54 - 000116056 _____ () C:\Program Files (x86)\Google\Chrome\Application\70.0.3538.77\libegl.dll 2018-11-06 10:20 - 2018-11-06 10:20 - 000194048 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_11810.1001.12.0_x64__8wekyb3d8bbwe\WinStore.Preview.dll 2018-11-06 10:20 - 2018-11-06 10:20 - 002538056 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_11810.1001.12.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll 2018-11-06 10:20 - 2018-11-06 10:20 - 001754112 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_11810.1001.12.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl.dll 2018-10-03 23:31 - 2018-10-03 23:36 - 000479232 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18081.14710.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe 2018-10-03 23:31 - 2018-10-03 23:36 - 069128192 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18081.14710.0_x64__8wekyb3d8bbwe\Microsoft.Photos.dll 2018-10-03 23:31 - 2018-10-03 23:36 - 002523136 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18081.14710.0_x64__8wekyb3d8bbwe\UnityEngineDelegates.dll 2018-10-03 23:31 - 2018-10-03 23:36 - 000010752 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18081.14710.0_x64__8wekyb3d8bbwe\RenderingPlugin.dll 2018-10-03 23:31 - 2018-10-03 23:36 - 003699200 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18081.14710.0_x64__8wekyb3d8bbwe\MediaEngineCSWrapper.dll 2018-10-03 23:31 - 2018-10-03 23:36 - 000009216 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18081.14710.0_x64__8wekyb3d8bbwe\ImagePipelineNative.dll 2018-10-03 23:31 - 2018-10-03 23:36 - 000035328 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18081.14710.0_x64__8wekyb3d8bbwe\WinMLWrapper.UWP.dll 2018-10-03 23:31 - 2018-10-03 23:36 - 002480640 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18081.14710.0_x64__8wekyb3d8bbwe\opencv_imgproc320.dll 2018-10-03 23:31 - 2018-10-03 23:36 - 002280960 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18081.14710.0_x64__8wekyb3d8bbwe\opencv_core320.dll 2018-10-03 23:31 - 2018-10-03 23:36 - 002283008 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18081.14710.0_x64__8wekyb3d8bbwe\TrackingDLLUWP.dll 2018-10-03 23:31 - 2018-10-03 23:36 - 014171648 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18081.14710.0_x64__8wekyb3d8bbwe\PhotosApp.Windows.dll 2018-10-03 23:31 - 2018-10-03 23:36 - 003544576 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18081.14710.0_x64__8wekyb3d8bbwe\MediaEngine.dll 2018-10-03 23:31 - 2018-10-03 23:32 - 002866176 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18081.14710.0_x64__8wekyb3d8bbwe\AppCore.Windows.dll 2018-10-03 23:31 - 2018-10-03 23:36 - 000973312 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18081.14710.0_x64__8wekyb3d8bbwe\RuntimeConfiguration.dll 2018-10-03 23:31 - 2018-10-03 23:36 - 004584960 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18081.14710.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll 2017-12-22 22:28 - 2017-12-22 22:28 - 000033168 _____ () C:\Program Files (x86)\ASUS\ASUS Hello\AsGAUpd.dll 2017-12-04 00:48 - 2017-12-04 00:48 - 001244304 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll ==================== Alternate Data Streams (Whitelisted) ========= (If an entry is included in the fixlist, only the ADS will be removed.) ==================== Safe Mode (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""="" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ModuleCoreService => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcapexe => ""="" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""="" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeaack => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeaack.sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeavfk => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeavfk.sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfemms => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeplk => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeplk.sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfetdi2k => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfetdi2k.sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ModuleCoreService => ""="Service" ==================== Association (Whitelisted) =============== (If an entry is included in the fixlist, the registry item will be restored to default or removed.) ==================== Internet Explorer trusted/restricted =============== (If an entry is included in the fixlist, it will be removed from the registry.) ==================== Hosts content: =============================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2018-04-12 05:08 - 2018-04-12 05:06 - 000000824 _____ C:\Windows\system32\Drivers\etc\hosts ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-2452082275-3313010305-2762231402-1001\Control Panel\Desktop\\Wallpaper -> c:\users\thor\downloads\1377956196_attitude_quotes_wallpaper_q8pjskp.jpg DNS Servers: 192.168.1.1 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: ) Windows Firewall is enabled. ==================== MSCONFIG/TASK MANAGER disabled items == If an entry is included in the fixlist, it will be removed. ==================== FirewallRules (Whitelisted) =============== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) FirewallRules: [{42BD3EB2-4BC6-4AEE-B72D-FAF444DEFF02}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe FirewallRules: [{8A8C5127-9527-4368-84F2-C43EC409F060}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe FirewallRules: [{B2DDC4FF-F8C2-476C-9F81-97B1C6FF9340}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe FirewallRules: [{84858023-249A-4ABC-8AF7-89430D108E20}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe FirewallRules: [{4A8AE292-4E37-4BDE-8E5D-853BD708A47C}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe FirewallRules: [{1AB58F40-786B-4E20-B514-071D543C516D}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe FirewallRules: [{04664582-9433-4D81-8D70-28C861177AF8}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe FirewallRules: [{5A405DFA-1136-4B08-9CD2-184C46A1E3E3}] => (Allow) C:\Program Files (x86)\Common Files\Mcafee\MMSSHost\MMSSHost.exe FirewallRules: [{CAC132D6-032C-4BD9-92A8-26AEE7F956D4}] => (Allow) C:\Program Files\Common Files\McAfee\MMSSHost\MMSSHost.exe FirewallRules: [{9B294DD3-0DD1-4DA9-921C-F4F5358538B7}] => (Allow) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe FirewallRules: [{0F7E97C1-C7C3-4AB1-9B7B-9DA01C4CCF9A}] => (Allow) C:\Program Files\TxGameAssistant\AppMarket\AppMarket.exe FirewallRules: [{371DE183-4CE5-499A-892C-17E6C127BE41}] => (Allow) C:\Program Files\TxGameAssistant\AppMarket\TInst.exe FirewallRules: [{45597AA9-E2E8-4359-B5B3-3E0A29D4E2B0}] => (Allow) C:\Program Files\TxGameAssistant\AppMarket\bugreport.exe FirewallRules: [{4A6D696E-0208-412B-ABB7-C0CF8EBA4DBF}] => (Allow) C:\Program Files\TxGameAssistant\AppMarket\QQExternal.exe FirewallRules: [{76389647-E7FE-496E-BF55-3A6D267AF5AF}] => (Allow) C:\Program Files\TxGameAssistant\AppMarket\GameDownload.exe FirewallRules: [{B1DCAE6C-763B-4362-B1A2-B977E3B302CB}] => (Allow) C:\Program Files\TxGameAssistant\AppMarket\GF186\TUpdate.exe FirewallRules: [{4C38BE41-D181-4526-9570-B98E9545DB3C}] => (Allow) C:\Program Files\TxGameAssistant\UI\AndroidEmulator.exe FirewallRules: [{561507FD-716E-44BA-B319-EED05551F7E8}] => (Allow) C:\Program Files\TxGameAssistant\UI\adb.exe FirewallRules: [{B5698B9F-1235-4DC5-96D7-E10DDC90E11B}] => (Allow) C:\Program Files\TxGameAssistant\UI\TInst.exe FirewallRules: [{F98CD287-FD93-41BD-BB83-7444F3E7055E}] => (Allow) C:\Program Files\TxGameAssistant\UI\bugreport.exe FirewallRules: [{DC2C56D2-F4B9-4133-83EB-DE9DDAF27528}] => (Allow) C:\Program Files\TxGameAssistant\UI\TxGaDcc.exe FirewallRules: [{42F9C931-08E2-4B15-9349-54C24FD3F16B}] => (Allow) C:\Users\Thor\AppData\Roaming\uTorrent\uTorrent.exe FirewallRules: [{51D53696-CBB1-47C4-9215-B8A0F1E11CB5}] => (Allow) C:\Users\Thor\AppData\Roaming\uTorrent\uTorrent.exe FirewallRules: [{D85394FC-2926-455B-8EB9-0CF994DCF0E0}] => (Allow) C:\Users\Thor\AppData\Roaming\uTorrent\uTorrent.exe FirewallRules: [{2342DA99-7341-45DF-A4F0-42D7F0514A65}] => (Allow) C:\Users\Thor\AppData\Roaming\uTorrent\uTorrent.exe FirewallRules: [{D1F69D3B-7173-4F37-B856-240F70DAA18C}] => (Allow) C:\Users\Thor\AppData\Roaming\uTorrent\uTorrent.exe FirewallRules: [{21D13707-123F-4A72-BC1D-E71E7C8B2B6A}] => (Allow) C:\Users\Thor\AppData\Roaming\uTorrent\uTorrent.exe FirewallRules: [{FCB188D6-45A4-40D9-A168-2FD399ED02F8}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe FirewallRules: [{CE2A1244-2956-4962-B038-D10C9A817B5E}] => (Allow) C:\Program Files\WindowsApps\Microsoft.Office.Desktop.Outlook_16040.11001.20074.0_x86__8wekyb3d8bbwe\Office16\OUTLOOK.exe ==================== Restore Points ========================= 01-11-2018 10:42:39 Windows Update 09-11-2018 23:15:06 Scheduled Checkpoint 11-11-2018 01:14:40 Windows Modules Installer ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (11/11/2018 12:23:50 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: AUDIODG.EXE, version: 10.0.17134.137, time stamp: 0xecd85e98 Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000 Exception code: 0xc0000005 Fault offset: 0x0000000000000000 Faulting process id: 0x20b8 Faulting application start time: 0x01d47926b69e8a8a Faulting application path: C:\Windows\system32\AUDIODG.EXE Faulting module path: unknown Report Id: b6b76a6c-d2b9-4aa1-977f-086989111cbe Faulting package full name: Faulting package-relative application ID: Error: (11/11/2018 12:18:39 AM) (Source: Application Hang) (EventID: 1002) (User: ) Description: The program RoadRedemption.exe version 5.3.5.61960 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel. Process ID: 1798 Start Time: 01d47925d97c3235 Termination Time: 12397 Application Path: C:\R.G. Catalyst\Road Redemption\RoadRedemption.exe Report Id: 269b55e2-e023-47d1-befe-0628907cc734 Faulting package full name: Faulting package-relative application ID: Error: (11/10/2018 12:46:12 AM) (Source: Application Hang) (EventID: 1002) (User: ) Description: The program RtkUWP.exe version 0.0.0.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel. Process ID: 2fc Start Time: 01d4784dd4edad2d Termination Time: 4294967295 Application Path: C:\Program Files\WindowsApps\RealtekSemiconductorCorp.RealtekAudioControl_1.1.133.0_x64__dt26b99r8h8gj\RtkUWP.exe Report Id: a376a46c-82c8-41fa-a7a4-18e05e32c60a Faulting package full name: RealtekSemiconductorCorp.RealtekAudioControl_1.1.133.0_x64__dt26b99r8h8gj Faulting package-relative application ID: App Error: (11/08/2018 02:52:17 PM) (Source: VSS) (EventID: 8193) (User: ) Description: Volume Shadow Copy Service error: Unexpected error calling routine QueryFullProcessImageNameW. hr = 0x80070006, The handle is invalid. . Operation: Executing Asynchronous Operation Context: Current State: DoSnapshotSet Error: (11/08/2018 12:34:15 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: The program RtkUWP.exe version 0.0.0.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel. Process ID: 30a8 Start Time: 01d4758f04322ffd Termination Time: 4294967295 Application Path: C:\Program Files\WindowsApps\RealtekSemiconductorCorp.RealtekAudioControl_1.1.133.0_x64__dt26b99r8h8gj\RtkUWP.exe Report Id: 526c4d77-92bf-4d20-a23e-81ca492cc822 Faulting package full name: RealtekSemiconductorCorp.RealtekAudioControl_1.1.133.0_x64__dt26b99r8h8gj Faulting package-relative application ID: App Error: (11/05/2018 01:15:33 PM) (Source: VSS) (EventID: 8193) (User: ) Description: Volume Shadow Copy Service error: Unexpected error calling routine QueryFullProcessImageNameW. hr = 0x80070006, The handle is invalid. . Operation: Executing Asynchronous Operation Context: Current State: DoSnapshotSet Error: (11/03/2018 11:50:05 AM) (Source: Application Hang) (EventID: 1002) (User: ) Description: The program RtkUWP.exe version 0.0.0.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel. Process ID: 4878 Start Time: 01d47332c8a84ad5 Termination Time: 4294967295 Application Path: C:\Program Files\WindowsApps\RealtekSemiconductorCorp.RealtekAudioControl_1.1.133.0_x64__dt26b99r8h8gj\RtkUWP.exe Report Id: 18e24039-8aa2-4600-b59d-a93e9215c029 Faulting package full name: RealtekSemiconductorCorp.RealtekAudioControl_1.1.133.0_x64__dt26b99r8h8gj Faulting package-relative application ID: App Error: (11/02/2018 10:45:57 AM) (Source: VSS) (EventID: 8193) (User: ) Description: Volume Shadow Copy Service error: Unexpected error calling routine QueryFullProcessImageNameW. hr = 0x80070006, The handle is invalid. . Operation: Executing Asynchronous Operation Context: Current State: DoSnapshotSet System errors: ============= Error: (11/11/2018 11:32:23 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY) Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D63B10C5-BB46-4990-A94F-E40B9D520160} and APPID {9CA88EE3-ACB7-47C8-AFC4-AB702511C276} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. Error: (11/11/2018 11:30:58 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY) Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D63B10C5-BB46-4990-A94F-E40B9D520160} and APPID {9CA88EE3-ACB7-47C8-AFC4-AB702511C276} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. Error: (11/11/2018 11:20:19 AM) (Source: DCOM) (EventID: 10016) (User: LAPTOP-4H9BO7BO) Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D63B10C5-BB46-4990-A94F-E40B9D520160} and APPID {9CA88EE3-ACB7-47C8-AFC4-AB702511C276} to the user LAPTOP-4H9BO7BO\Thor SID (S-1-5-21-2452082275-3313010305-2762231402-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. Error: (11/11/2018 11:19:19 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY) Description: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID Windows.SecurityCenter.WscBrokerManager and APPID Unavailable to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. Error: (11/11/2018 11:18:59 AM) (Source: DCOM) (EventID: 10016) (User: LAPTOP-4H9BO7BO) Description: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID Windows.SecurityCenter.WscCloudBackupProvider and APPID Unavailable to the user LAPTOP-4H9BO7BO\Thor SID (S-1-5-21-2452082275-3313010305-2762231402-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. Error: (11/11/2018 11:17:32 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY) Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {6B3B8D23-FA8D-40B9-8DBD-B950333E2C52} and APPID {4839DDB7-58C2-48F5-8283-E1D1807D0D7D} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. Error: (11/11/2018 11:17:32 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY) Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {6B3B8D23-FA8D-40B9-8DBD-B950333E2C52} and APPID {4839DDB7-58C2-48F5-8283-E1D1807D0D7D} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. Error: (11/11/2018 11:17:32 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY) Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {6B3B8D23-FA8D-40B9-8DBD-B950333E2C52} and APPID {4839DDB7-58C2-48F5-8283-E1D1807D0D7D} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. Windows Defender: =================================== Date: 2018-10-03 23:13:31.546 Description: Windows Defender Antivirus has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.277.515.0 Update Source: Microsoft Update Server Signature Type: AntiVirus Update Type: Full Current Engine Version: Previous Engine Version: 1.1.15300.6 Error code: 0x80240016 Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support. CodeIntegrity: =================================== Date: 2018-11-11 11:18:12.593 Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements. Date: 2018-11-11 11:18:12.593 Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements. Date: 2018-10-18 01:12:05.697 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\SaferVPNNetfilter2.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2018-10-18 01:09:12.535 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\SaferVPNNetfilter2.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2018-10-17 10:53:10.861 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\SaferVPNNetfilter2.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2018-10-17 10:50:18.773 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\SaferVPNNetfilter2.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2018-10-17 10:11:09.048 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\SaferVPNNetfilter2.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2018-10-17 10:10:51.190 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\SaferVPNNetfilter2.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. ==================== Memory info =========================== Processor: Intel(R) Core(TM) i5-8250U CPU @ 1.60GHz Percentage of memory in use: 49% Total physical RAM: 8070.11 MB Available physical RAM: 4070.02 MB Total Virtual: 9350.11 MB Available Virtual: 5306.94 MB ==================== Drives ================================ Drive ? (OS) (Fixed) (Total:930.46 GB) (Free:767.55 GB) NTFS \\?\Volume{2d588acd-7c4f-444f-8d76-cc45bf96ccde}\ (RECOVERY) (Fixed) (Total:0.78 GB) (Free:0.36 GB) NTFS \\?\Volume{6839f4b2-c13c-4e12-9c06-a06020f5a5be}\ (SYSTEM) (Fixed) (Total:0.25 GB) (Free:0.23 GB) FAT32 ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 931.5 GB) (Disk ID: 8FB20D6F) Partition: GPT. ==================== End of Addition.txt ============================
  3. Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 10.11.2018 Ran by Thor (administrator) on LAPTOP-4H9BO7BO (11-11-2018 11:32:55) Running from C:\Users\Thor\Downloads Loaded Profiles: Thor (Available Profiles: Thor) Platform: Windows 10 Home Single Language Version 1803 17134.345 (X64) Language: English (United States) Internet Explorer Version 11 (Default browser: Edge) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\cui_component.inf_amd64_df4f60b1cae9b14a\igfxCUIService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe (Tencent) C:\Program Files\TxGameAssistant\AppMarket\QMEmulatorService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe (ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS GiftBox Service\GiftBoxService.exe (Intel Corporation) C:\Windows\System32\Intel\DPTF\esif_uf.exe (Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iigd_base.inf_amd64_2af995b9695ca8e3\IntelCpHDCPSvc.exe (ICEpower a/s) C:\Windows\System32\DriverStore\FileRepository\icesoundapo64.inf_amd64_9f7fae81e4e966ff\ICEsoundService64.exe (McAfee, LLC) C:\Program Files\Common Files\mcafee\SystemCore\mfemms.exe (McAfee, Inc.) C:\Program Files\mcafee\WebAdvisor\servicehost.exe (Intel Corporation) C:\Windows\System32\ibtsiva.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe (McAfee, Inc.) C:\Program Files\Common Files\mcafee\modulecore\ModuleCoreService.exe (McAfee, Inc.) C:\Program Files\Common Files\mcafee\pef\CORE\PEFService.exe (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Realtek Semiconductor) C:\Windows\System32\RtkAudUService64.exe (Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe (McAfee, LLC) C:\Windows\System32\mfevtps.exe (McAfee, Inc.) C:\Program Files\Common Files\mcafee\mmsshost\MMSSHOST.exe (McAfee, LLC) C:\Windows\System32\mfevtps.exe (McAfee, Inc.) C:\Program Files\Common Files\mcafee\modulecore\ProtectedModuleHost.exe (Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iigd_base.inf_amd64_2af995b9695ca8e3\IntelCpHeciSvc.exe (Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe (McAfee, Inc.) C:\Program Files\mcafee\mfeav\MfeAVSvc.exe (McAfee, LLC) C:\Program Files\Common Files\mcafee\SystemCore\mfefire.exe (McAfee, Inc.) C:\Program Files\Common Files\mcafee\csp\3.0.127.0\McCSPServiceHost.exe (McAfee, Inc.) C:\Program Files\Common Files\mcafee\VSCore_18_6\mcapexe.exe (McAfee LLC.) C:\Program Files\Common Files\mcafee\amcore\mcshield.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe (Intel Corporation) C:\Windows\System32\Intel\DPTF\dptf_helper.exe (McAfee, Inc.) C:\Program Files\mcafee\WebAdvisor\uihost.exe () C:\Program Files (x86)\ASUS\ASUS Hello\ASUSHelloBG.exe (Malwarebytes) C:\Users\Thor\Downloads\adwcleaner_7.2.4.0.exe (Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\cui_component.inf_amd64_df4f60b1cae9b14a\igfxEM.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.33.41.0_x64__kzf8qxf38zg5c\SkypeApp.exe (Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.10314.31700.1000_x64__8wekyb3d8bbwe\Office16\OfficeHubTaskHost.exe (Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe (Microsoft Corporation) C:\Windows\System32\browser_broker.exe (Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe (Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe () C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.33.41.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe (Realtek Semiconductor) C:\Windows\System32\RtkAudUService64.exe (McAfee, Inc.) C:\Program Files\Common Files\mcafee\modulecore\ModuleCoreService.exe (McAfee, Inc.) C:\Program Files\Common Files\mcafee\platform\McUICnt.exe (ASUSTek Computer Inc.) C:\Program Files\WindowsApps\B9ECED6F.ASUSBatteryHealthCharging_1.0.7.0_x86__qmba6cd70vzyy\ASUS Battery Health Charging\BhcMgr.exe (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\redirector.exe (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\Receiver\Receiver.exe (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\Receiver\ConfigurationWizard.exe (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\SelfServicePlugin\SelfServicePlugin.exe (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler64.exe (Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsStore_11810.1001.12.0_x64__8wekyb3d8bbwe\WinStore.App.exe (Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe (Microsoft Corporation) C:\Windows\System32\smartscreen.exe () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18081.14710.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe (McAfee, Inc.) C:\Program Files\mcafee\msc\mcsync.exe ==================== Registry (Whitelisted) =========================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [638872 2018-04-12] (Microsoft Corporation) HKLM\...\Run: [RtkAudUService] => C:\Windows\System32\RtkAudUService64.exe [674760 2018-04-25] (Realtek Semiconductor) HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch HKLM-x32\...\Run: [ConnectionCenter] => C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [555920 2018-02-23] (Citrix Systems, Inc.) HKLM-x32\...\Run: [Redirector] => C:\Program Files (x86)\Citrix\ICA Client\redirector.exe [402832 2018-02-23] (Citrix Systems, Inc.) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 Tcpip\..\Interfaces\{8e59d1a2-1def-4022-bbd1-f35cf18fe1d1}: [DhcpNameServer] 192.168.1.1 Tcpip\..\Interfaces\{ad2df368-e6d6-4f14-a214-59997e75266a}: [DhcpNameServer] 10.66.32.1 Internet Explorer: ================== HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank HKU\S-1-5-21-2452082275-3313010305-2762231402-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKU\S-1-5-21-2452082275-3313010305-2762231402-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus17win10.msn.com/?pc=ASTE SearchScopes: HKU\S-1-5-21-2452082275-3313010305-2762231402-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-2452082275-3313010305-2762231402-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: McAfee WebAdvisor -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> C:\Program Files\McAfee\WebAdvisor\x64\IEPlugin.dll [2018-10-03] (McAfee, Inc.) BHO-x32: McAfee WebAdvisor -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> C:\Program Files\McAfee\WebAdvisor\win32\IEPlugin.dll [2018-10-03] (McAfee, Inc.) Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2018-02-23] (Citrix Systems, Inc.) Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2018-02-23] (Citrix Systems, Inc.) Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2018-02-23] (Citrix Systems, Inc.) Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2018-02-23] (Citrix Systems, Inc.) Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2018-02-23] (Citrix Systems, Inc.) Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2018-02-23] (Citrix Systems, Inc.) Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2018-02-23] (Citrix Systems, Inc.) Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2018-02-23] (Citrix Systems, Inc.) Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2018-02-23] (Citrix Systems, Inc.) Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2018-02-23] (Citrix Systems, Inc.) Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2018-02-23] (Citrix Systems, Inc.) Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2018-02-23] (Citrix Systems, Inc.) Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2018-02-23] (Citrix Systems, Inc.) Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2018-02-23] (Citrix Systems, Inc.) Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2018-02-23] (Citrix Systems, Inc.) Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\mcafee\msc\McSnIePl64.dll [2018-10-05] (McAfee, Inc.) Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\msc\McSnIePl.dll [2018-10-05] (McAfee, Inc.) Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2018-02-23] (Citrix Systems, Inc.) FireFox: ======== FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files\McAfee\WebAdvisor\e10ssaffplg.xpi FF Extension: (McAfee® WebAdvisor) - C:\Program Files\McAfee\WebAdvisor\e10ssaffplg.xpi [2018-11-02] FF HKLM\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSKHKLM => not found FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files\McAfee\WebAdvisor\e10ssaffplg.xpi FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK FF Extension: (McAfee Anti-Spam Thunderbird Extension) - C:\Program Files\McAfee\MSK [2018-10-25] [Legacy] [not signed] FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL [2018-10-05] () FF Plugin-x32: @Citrix.com/npican -> C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll [2018-02-23] (Citrix Systems, Inc.) FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL [2018-10-05] () FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-10-03] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-10-03] (Google Inc.) Chrome: ======= CHR Profile: C:\Users\Thor\AppData\Local\Google\Chrome\User Data\Default [2018-11-11] CHR Extension: (Slides) - C:\Users\Thor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2018-10-03] CHR Extension: (Docs) - C:\Users\Thor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2018-10-03] CHR Extension: (Google Drive) - C:\Users\Thor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2018-10-17] CHR Extension: (YouTube) - C:\Users\Thor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2018-10-03] CHR Extension: (Sheets) - C:\Users\Thor\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2018-10-03] CHR Extension: (Google Docs Offline) - C:\Users\Thor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2018-10-03] CHR Extension: (Ghostery – Privacy Ad Blocker) - C:\Users\Thor\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlomiejdfkolichcflejclcbmpeaniij [2018-10-13] CHR Extension: (Hoxx VPN Proxy) - C:\Users\Thor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nbcojefnccbanplpoffopkoepjmhgdgh [2018-10-21] CHR Extension: (Chrome Web Store Payments) - C:\Users\Thor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-10-03] CHR Extension: (Gmail) - C:\Users\Thor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2018-10-03] CHR Extension: (Chrome Media Router) - C:\Users\Thor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-10-27] CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - hxxp://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - hxxp://clients2.google.com/service/update2/crx ==================== Services (Whitelisted) ==================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) S3 ClientAnalyticsService; C:\Program Files\Common Files\McAfee\ClientAnalytics\Legacy\McClientAnalytics.exe [1511728 2017-09-22] (McAfee, Inc.) S3 DevActSvc; C:\Program Files (x86)\ASUS\ASUS Device Activation\DevActSvc.exe [326032 2018-06-06] () R2 esifsvc; C:\Windows\System32\Intel\DPTF\esif_uf.exe [1699368 2018-01-28] (Intel Corporation) R2 GiftBox.Service; C:\Program Files (x86)\ASUS\ASUS GiftBox Service\GiftBoxService.exe [302416 2018-06-29] (ASUSTeK Computer Inc.) S3 iaStorAfsService; C:\Windows\IAStorAfsService\iaStorAfsService.exe [2593848 2018-03-10] (Intel Corporation) R2 ibtsiva; C:\Windows\System32\ibtsiva.exe [550568 2018-05-02] (Intel Corporation) R2 ICEsoundService; C:\Windows\System32\DriverStore\FileRepository\icesoundapo64.inf_amd64_9f7fae81e4e966ff\ICEsoundService64.exe [483712 2018-03-07] (ICEpower a/s) S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\Intel(R) Management Engine Components\iCLS\SocketHeciServer.exe [758552 2018-03-03] (Intel(R) Corporation) S2 Intel(R) TPM Provisioning Service; C:\Program Files\Intel\Intel(R) Management Engine Components\iCLS\TPMProvisioningService.exe [719640 2018-03-03] (Intel(R) Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [205968 2017-12-04] (Intel Corporation) R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6347056 2018-09-19] (Malwarebytes) R2 McAfee WebAdvisor; C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe [675736 2018-10-03] (McAfee, Inc.) R2 McAPExe; C:\Program Files\Common Files\McAfee\VSCore_18_6\McApExe.exe [729320 2018-10-05] (McAfee, Inc.) S3 McAWFwk; c:\Program Files\Common Files\mcafee\actwiz\McAWFwk.exe [455584 2017-09-27] (McAfee, Inc.) R2 mccspsvc; C:\Program Files\Common Files\McAfee\CSP\3.0.127.0\\McCSPServiceHost.exe [2159464 2018-06-30] (McAfee, Inc.) S3 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe [366968 2018-08-22] (McAfee, LLC) R2 mfemms; C:\Program Files\Common Files\McAfee\SystemCore\mfemms.exe [539512 2018-08-22] (McAfee, LLC) R2 mfevtp; C:\Windows\system32\mfevtps.exe [490360 2018-08-22] (McAfee, LLC) R2 ModuleCoreService; C:\Program Files\Common Files\McAfee\ModuleCore\ModuleCoreService.exe [1690976 2018-07-28] (McAfee, Inc.) S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [265824 2018-04-17] () S3 NvContainerLocalSystem; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [519240 2018-01-10] (NVIDIA Corporation) S3 NvContainerNetworkService; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [519240 2018-01-10] (NVIDIA Corporation) R2 PEFService; C:\Program Files\Common Files\McAfee\PEF\CORE\PEFService.exe [1316024 2018-07-25] (McAfee, Inc.) R2 QMEmulatorService; C:\Program Files\TxGameAssistant\AppMarket\QMEmulatorService.exe [342776 2018-06-22] (Tencent) R2 RtkAudioUniversalService; C:\Windows\System32\RtkAudUService64.exe [674760 2018-04-25] (Realtek Semiconductor) S4 ssh-agent; C:\Windows\System32\OpenSSH\ssh-agent.exe [495616 2018-03-10] () S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [4451616 2018-04-12] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [107136 2018-09-21] (Microsoft Corporation) R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3848288 2018-04-17] (Intel® Corporation) R2 NVDisplay.ContainerLocalSystem; "C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe" -s NVDisplay.ContainerLocalSystem -f "C:\ProgramData\NVIDIA\NVDisplay.ContainerLocalSystem.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\LocalSystem" -r -p 30000 R2 NvTelemetryContainer; "C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe" -s NvTelemetryContainer -f "C:\ProgramData\NVIDIA\NvTelemetryContainer.log" -l 3 -d "C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\plugins" -r ===================== Drivers (Whitelisted) ====================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R2 aow_drv; C:\Program Files\TxGameAssistant\UI\2.0.6479.123\aow_drv_x64_ev.sys [853776 2018-09-14] (Tencent) R3 AsusPTPDrv; C:\Windows\System32\drivers\AsusPTPFilter.sys [104808 2018-03-13] (ASUSTek COMPUTER INC.) R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [77336 2018-10-03] (McAfee, LLC) R3 dptf_acpi; C:\Windows\System32\drivers\dptf_acpi.sys [74696 2017-11-28] (Intel Corporation) R3 dptf_cpu; C:\Windows\System32\drivers\dptf_cpu.sys [70088 2017-11-28] (Intel Corporation) R3 esif_lf; C:\Windows\System32\drivers\esif_lf.sys [383432 2017-11-28] (Intel Corporation) R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [152688 2018-10-18] (Malwarebytes) R3 HIDSwitch; C:\Windows\System32\drivers\AsRadioControl.sys [31144 2017-11-23] (ASUS) S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [235784 2018-10-03] (McAfee, Inc.) R3 iaLPSS2_GPIO2; C:\Windows\System32\drivers\iaLPSS2_GPIO2.sys [98968 2017-10-16] (Intel Corporation) R0 iaStorAC; C:\Windows\System32\drivers\iaStorAC.sys [941624 2018-03-10] (Intel Corporation) S3 iaStorAfs; C:\Windows\System32\drivers\iaStorAfs.sys [72248 2018-03-10] (Intel Corporation) R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [199192 2018-05-15] (Intel Corporation) R2 MBAMChameleon; C:\Windows\System32\Drivers\MbamChameleon.sys [198000 2018-11-11] (Malwarebytes) R3 MBAMFarflt; C:\Windows\System32\DRIVERS\farflt.sys [119136 2018-11-11] (Malwarebytes) R3 MBAMProtection; C:\Windows\system32\DRIVERS\mbam.sys [63768 2018-11-11] (Malwarebytes) R3 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [260480 2018-11-11] (Malwarebytes) R3 MBAMWebProtection; C:\Windows\system32\DRIVERS\mwac.sys [111152 2018-11-11] (Malwarebytes) R3 mfeaack; C:\Windows\System32\drivers\mfeaack.sys [506384 2018-10-03] (McAfee, LLC) R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [367664 2018-10-03] (McAfee, LLC) S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [85104 2018-10-03] (McAfee, LLC) R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [533520 2018-10-03] (McAfee, LLC) R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [967696 2018-10-03] (McAfee, LLC) R3 mfencbdc; C:\Windows\System32\DRIVERS\mfencbdc.sys [555824 2018-10-03] (McAfee LLC.) S3 mfencrk; C:\Windows\System32\DRIVERS\mfencrk.sys [108848 2018-10-03] (McAfee LLC.) R3 mfeplk; C:\Windows\System32\drivers\mfeplk.sys [115728 2018-10-03] (McAfee, LLC) R3 mfesapsn; C:\Program Files\McAfee\WebAdvisor\mfesapsn.sys [111976 2018-10-03] (McAfee, Inc.) R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [252952 2018-10-03] (McAfee, LLC) S3 Netwtw04; C:\Windows\System32\drivers\Netwtw04.sys [7689728 2018-04-12] (Intel Corporation) R3 Netwtw06; C:\Windows\System32\drivers\Netwtw06.sys [8810336 2018-05-13] (Intel Corporation) R3 nvlddmkm; C:\Windows\System32\DriverStore\FileRepository\nvam.inf_amd64_7a10e27d01ea1abb\nvlddmkm.sys [17147136 2018-03-14] (NVIDIA Corporation) S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [30280 2018-01-10] (NVIDIA Corporation) R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [59240 2017-12-14] (NVIDIA Corporation) R3 nvvhci; C:\Windows\System32\drivers\nvvhci.sys [57928 2018-01-10] (NVIDIA Corporation) S3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [604160 2018-04-12] (Realtek ) S3 rtux64w10; C:\Windows\System32\drivers\rtux64w10.sys [348672 2018-04-12] (Realtek ) S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44616 2018-04-12] (Microsoft Corporation) S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [331680 2018-04-12] (Microsoft Corporation) S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [44032 2018-04-12] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2018-11-11 11:33 - 2018-11-11 11:33 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee 2018-11-11 11:32 - 2018-11-11 11:33 - 000024857 _____ C:\Users\Thor\Downloads\FRST.txt 2018-11-11 11:32 - 2018-11-11 11:32 - 000000000 ____D C:\FRST 2018-11-11 11:21 - 2018-11-11 11:22 - 002415616 _____ (Farbar) C:\Users\Thor\Downloads\FRST64.exe 2018-11-11 11:20 - 2018-11-11 11:21 - 079596656 _____ (Malwarebytes ) C:\Users\Thor\Downloads\mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7783 (1).exe 2018-11-11 11:20 - 2018-11-11 11:20 - 000002473 _____ C:\Users\Thor\Desktop\2nd.txt 2018-11-11 11:17 - 2018-11-11 11:17 - 000260480 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys 2018-11-11 11:17 - 2018-11-11 11:17 - 000119136 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys 2018-11-11 11:17 - 2018-11-11 11:17 - 000111152 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys 2018-11-11 11:17 - 2018-11-11 11:17 - 000063768 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys 2018-11-11 11:17 - 2018-11-11 11:17 - 000000000 ____D C:\ProgramData\Tencent 2018-11-11 11:08 - 2018-11-11 11:15 - 000000000 ____D C:\AdwCleaner 2018-11-11 11:08 - 2018-11-11 11:08 - 007592144 _____ (Malwarebytes) C:\Users\Thor\Downloads\adwcleaner_7.2.4.0.exe 2018-11-11 11:07 - 2018-11-11 11:07 - 000001231 _____ C:\Users\Thor\Desktop\1st.txt 2018-11-11 10:55 - 2018-11-11 10:55 - 000198000 _____ (Malwarebytes) C:\Windows\system32\Drivers\MbamChameleon.sys 2018-11-11 10:55 - 2018-11-11 10:55 - 000000000 ____D C:\Users\Thor\AppData\Local\mbamtray 2018-11-11 10:55 - 2018-11-11 10:55 - 000000000 ____D C:\Users\Thor\AppData\Local\mbam 2018-11-11 10:54 - 2018-11-11 10:54 - 000001914 _____ C:\Users\Public\Desktop\Malwarebytes.lnk 2018-11-11 10:54 - 2018-11-11 10:54 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes 2018-11-11 10:54 - 2018-11-11 10:54 - 000000000 ____D C:\ProgramData\Malwarebytes 2018-11-11 10:54 - 2018-11-11 10:54 - 000000000 ____D C:\Program Files\Malwarebytes 2018-11-11 10:54 - 2018-10-18 08:44 - 000152688 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbae64.sys 2018-11-11 10:52 - 2018-11-11 10:52 - 079596656 _____ (Malwarebytes ) C:\Users\Thor\Downloads\mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7783.exe 2018-11-11 10:47 - 2018-11-11 10:47 - 000000000 ___HD C:\OneDriveTemp 2018-11-11 00:18 - 2018-11-11 00:18 - 000000000 ____D C:\Users\Thor\AppData\LocalLow\Pixel Dash Studios & EQ Games 2018-11-11 00:09 - 2018-11-11 00:39 - 000001772 _____ C:\Users\Thor\Desktop\Road Redemption.lnk 2018-11-11 00:09 - 2018-11-11 00:09 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\R.G. Catalyst 2018-11-11 00:06 - 2018-11-11 00:06 - 000000000 ____D C:\R.G. Catalyst 2018-11-10 23:10 - 2018-11-11 10:47 - 000000000 ____D C:\Users\Thor\AppData\LocalLow\uTorrent 2018-11-10 22:10 - 2018-11-10 22:10 - 000019672 _____ C:\Users\Thor\Downloads\Road.Redemption.v20180712.torrent 2018-11-05 11:19 - 2018-11-05 11:19 - 000450364 _____ C:\Users\Thor\Downloads\Mathematical Formula Handbook.pdf 2018-11-04 22:59 - 2018-11-04 22:59 - 000000000 ____D C:\Users\Thor\AppData\Local\ElevatedDiagnostics 2018-11-03 01:44 - 2018-11-03 01:54 - 000000812 _____ C:\Users\Thor\Untitled.ipynb 2018-11-03 01:44 - 2018-11-03 01:44 - 000000000 ____D C:\Users\Thor\.ipython 2018-11-03 01:44 - 2018-11-03 01:44 - 000000000 ____D C:\Users\Thor\.ipynb_checkpoints 2018-11-03 01:36 - 2018-11-03 18:14 - 000000000 ____D C:\Users\Thor\AppData\Roaming\jupyter 2018-11-03 01:33 - 2018-11-03 01:33 - 000000000 ____D C:\Users\Thor\AppData\Local\conda 2018-11-03 01:03 - 2018-11-03 01:03 - 000000000 ____D C:\Users\Thor\AppData\Local\ContinuumIO 2018-11-03 00:45 - 2018-11-03 00:45 - 000000000 ____D C:\Users\Thor\Documents\Python Scripts 2018-11-03 00:45 - 2018-11-03 00:45 - 000000000 ____D C:\Users\Thor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Anaconda3 (64-bit) 2018-11-03 00:29 - 2018-11-03 00:45 - 000000000 ____D C:\Users\Thor\Anaconda3 2018-11-03 00:16 - 2018-11-03 00:19 - 662059680 _____ (Anaconda, Inc.) C:\Users\Thor\Downloads\Anaconda3-5.3.0-Windows-x86_64.exe 2018-11-02 13:19 - 2018-11-02 13:19 - 026260496 _____ (Python Software Foundation) C:\Users\Thor\Downloads\python-3.7.1-amd64.exe 2018-11-02 13:18 - 2018-11-02 13:18 - 000001050 _____ C:\Users\Thor\Desktop\PY.txt 2018-11-01 14:17 - 2018-11-01 14:17 - 000012463 _____ C:\Users\Thor\Downloads\themes.csv 2018-11-01 01:09 - 2018-11-01 01:09 - 012773229 _____ C:\Users\Thor\Downloads\inventory_parts.csv 2018-11-01 00:35 - 2018-11-01 00:35 - 000003627 _____ C:\Users\Thor\Downloads\colors.csv 2018-10-30 14:10 - 2018-10-30 14:10 - 000188128 _____ C:\Users\Thor\Downloads\Statement of Accomplishment (4).pdf 2018-10-26 17:13 - 2018-10-26 17:13 - 000188667 _____ C:\Users\Thor\Downloads\Statement of Accomplishment (3).pdf 2018-10-26 12:54 - 2018-10-26 12:54 - 000000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf 2018-10-25 23:16 - 2018-10-25 23:16 - 000002152 _____ C:\Users\Thor\Desktop\Popcorn-Time.lnk 2018-10-25 23:16 - 2018-10-25 23:16 - 000000000 ____D C:\Users\Thor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Popcorn-Time 2018-10-25 23:15 - 2018-11-09 02:14 - 000000000 ____D C:\Users\Thor\AppData\Local\Popcorn-Time 2018-10-24 23:56 - 2018-10-24 23:56 - 061757061 _____ (Popcorn Time) C:\Users\Thor\Downloads\Popcorn-Time-0.3.10-Setup (1).exe 2018-10-20 16:49 - 2018-10-20 16:50 - 000188273 _____ C:\Users\Thor\Downloads\Statement of Accomplishment (2).pdf 2018-10-18 01:12 - 2018-10-18 01:20 - 000000000 ____D C:\Users\Thor\Documents\FIFA 18 2018-10-18 01:03 - 2018-10-18 01:03 - 000000827 _____ C:\Users\Public\Desktop\FIFA18.lnk 2018-10-18 00:45 - 2018-10-18 01:07 - 000000000 ____D C:\Program Files\FIFA18 2018-10-18 00:16 - 2018-10-18 00:16 - 000000000 ____D C:\Users\Thor\AppData\Roaming\WinRAR 2018-10-18 00:15 - 2018-10-18 00:15 - 003118192 _____ (Alexander Roshal) C:\Users\Thor\Downloads\winrar-x64-561.exe 2018-10-18 00:15 - 2018-10-18 00:15 - 000000000 ____D C:\Users\Thor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR 2018-10-18 00:15 - 2018-10-18 00:15 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR 2018-10-18 00:15 - 2018-10-18 00:15 - 000000000 ____D C:\Program Files\WinRAR 2018-10-17 10:58 - 2018-10-18 00:42 - 000000000 ____D C:\Users\Thor\Downloads\FIFA.18-STEAMPUNKS 2018-10-17 10:57 - 2018-10-17 10:57 - 000039944 _____ C:\Users\Thor\Downloads\FIFA.18-STEAMPUNKS.torrent 2018-10-17 10:54 - 2018-11-11 11:13 - 000000000 ____D C:\Users\Thor\AppData\Roaming\uTorrent 2018-10-17 10:54 - 2018-10-17 10:54 - 002439352 _____ (BitTorrent Inc.) C:\Users\Thor\Downloads\uTorrent (2).exe 2018-10-17 10:44 - 2018-10-17 10:44 - 002969488 _____ (BitTorrent Inc.) C:\Users\Thor\Downloads\uTorrent.exe 2018-10-17 10:11 - 2018-10-18 08:54 - 000000000 ____D C:\Users\Thor\AppData\Local\SaferVPN 2018-10-17 10:10 - 2016-04-21 14:40 - 000027136 _____ (The OpenVPN Project) C:\Windows\system32\Drivers\tap0901.sys 2018-10-17 10:09 - 2018-10-17 10:10 - 010043968 _____ (Safer Social Ltd) C:\Users\Thor\Downloads\SaferVPN.exe 2018-10-16 08:08 - 2018-10-16 08:08 - 003310244 _____ C:\Users\Thor\Downloads\morning.pdf 2018-10-16 08:07 - 2018-10-16 08:07 - 004394582 _____ C:\Users\Thor\Downloads\AAI-JE-ATC-Question-Paper-26-Dec.-2015-Shift-1.pdf 2018-10-13 19:27 - 2018-10-13 19:27 - 000000000 ____D C:\Users\Thor\Documents\Custom Office Templates 2018-10-13 19:25 - 2018-10-25 11:07 - 000000000 ____D C:\Users\Thor\AppData\Local\CrashDumps 2018-10-13 02:55 - 2018-10-13 03:01 - 1649348306 _____ C:\Users\Thor\Downloads\Unconfirmed 832943.crdownload 2018-10-12 09:29 - 2018-10-12 09:29 - 014982013 _____ C:\Users\Thor\Downloads\video.mp4 ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2018-11-11 11:32 - 2018-04-12 05:08 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft 2018-11-11 11:21 - 2018-08-15 22:29 - 001310946 _____ C:\Windows\system32\PerfStringBackup.INI 2018-11-11 11:21 - 2018-05-10 04:30 - 000404906 _____ C:\Windows\system32\prfh0804.dat 2018-11-11 11:21 - 2018-05-10 04:30 - 000124978 _____ C:\Windows\system32\prfc0804.dat 2018-11-11 11:21 - 2018-04-12 05:06 - 000000000 ____D C:\Windows\INF 2018-11-11 11:18 - 2018-08-16 03:28 - 000000000 ___RD C:\Users\Thor\OneDrive 2018-11-11 11:17 - 2018-08-16 00:02 - 000000000 __SHD C:\Users\Thor\IntelGraphicsProfiles 2018-11-11 11:17 - 2018-08-15 22:44 - 000000000 ____D C:\ProgramData\NVIDIA 2018-11-11 11:17 - 2018-05-10 03:46 - 000000006 ____H C:\Windows\Tasks\SA.DAT 2018-11-11 11:16 - 2018-04-12 02:34 - 000524288 _____ C:\Windows\system32\config\BBI 2018-11-11 10:49 - 2018-10-04 12:31 - 000004166 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{6AD1D339-EA6C-4DBF-9197-50F9D94C066B} 2018-11-11 01:21 - 2018-04-12 05:00 - 000000000 ____D C:\Windows\CbsTemp 2018-11-11 00:18 - 2018-10-07 12:23 - 000000000 ____D C:\Users\Thor\AppData\Local\D3DSCache 2018-11-11 00:04 - 2018-05-10 03:46 - 000000000 ____D C:\Windows\system32\SleepStudy 2018-11-10 22:22 - 2018-04-12 02:34 - 000032768 _____ C:\Windows\system32\config\ELAM 2018-11-10 22:16 - 2018-04-12 05:08 - 000000000 ____D C:\Windows\AppReadiness 2018-11-09 23:11 - 2018-04-12 05:08 - 000000000 ___HD C:\Program Files\WindowsApps 2018-11-03 01:54 - 2018-08-16 00:01 - 000000000 ____D C:\Users\Thor 2018-11-02 10:11 - 2018-08-15 23:09 - 000000000 ____D C:\ProgramData\McAfee 2018-10-31 10:14 - 2018-10-04 00:04 - 000000000 ____D C:\ProgramData\Packages 2018-10-29 09:52 - 2018-08-15 23:09 - 000000000 ____D C:\Program Files (x86)\McAfee 2018-10-26 11:34 - 2018-10-03 22:56 - 000002303 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk 2018-10-26 11:34 - 2018-10-03 22:56 - 000002262 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2018-10-25 22:47 - 2018-08-15 23:11 - 000003126 _____ C:\Windows\System32\Tasks\McAfeeLogon 2018-10-25 22:47 - 2018-08-15 23:09 - 000000000 ____D C:\Program Files\Common Files\mcafee 2018-10-25 22:45 - 2018-04-12 05:08 - 000000000 ___HD C:\Windows\ELAMBKUP 2018-10-18 01:07 - 2018-08-15 22:37 - 000000000 ____D C:\ProgramData\Package Cache 2018-10-17 12:24 - 2018-08-15 23:09 - 000003710 _____ C:\Windows\System32\Tasks\McAfee Remediation (Prepare) 2018-10-17 09:59 - 2018-10-04 00:06 - 000003376 _____ C:\Windows\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-2452082275-3313010305-2762231402-1001 2018-10-17 09:59 - 2018-08-16 00:01 - 000002366 _____ C:\Users\Thor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk ==================== Bamital & volsnap ====================== (There is no automatic fix for files that do not pass verification.) C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\dnsapi.dll => File is digitally signed C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2018-05-10 03:46 ==================== End of FRST.txt ============================
  4. # ------------------------------- # Malwarebytes AdwCleaner 7.2.4.0 # ------------------------------- # Build: 09-25-2018 # Database: 2018-11-05.1 (Cloud) # Support: https://www.malwarebytes.com/support # # ------------------------------- # Mode: Clean # ------------------------------- # Start: 11-11-2018 # Duration: 00:00:09 # OS: Windows 10 Home Single Language # Cleaned: 10 # Failed: 0 ***** [ Services ] ***** No malicious services cleaned. ***** [ Folders ] ***** Deleted C:\ProgramData\Tencent Deleted C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Tencent Deleted C:\Users\Thor\AppData\Roaming\Tencent ***** [ Files ] ***** No malicious files cleaned. ***** [ DLL ] ***** No malicious DLLs cleaned. ***** [ WMI ] ***** No malicious WMI cleaned. ***** [ Shortcuts ] ***** No malicious shortcuts cleaned. ***** [ Tasks ] ***** No malicious tasks cleaned. ***** [ Registry ] ***** Deleted HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules|{7AED8592-3DCA-4796-AC5E-2140193DA073} Deleted HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules|{55A3CE4E-A3D7-443E-B31C-33C20552904D} Deleted HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules|{BED8834C-5550-4FC4-B197-12F92161BF3F} Deleted HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules|{1F6D4434-4D43-4B7A-9B17-29059FDD42B0} Deleted HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules|{3F42D25D-2E16-4141-882F-FF95456F9F5F} Deleted HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules|{91B56246-9344-4AA4-8F83-CA16C5A50CA3} Deleted HKLM\Software\Classes\METNSD ***** [ Chromium (and derivatives) ] ***** No malicious Chromium entries cleaned. ***** [ Chromium URLs ] ***** No malicious Chromium URLs cleaned. ***** [ Firefox (and derivatives) ] ***** No malicious Firefox entries cleaned. ***** [ Firefox URLs ] ***** No malicious Firefox URLs cleaned. ************************* [+] Delete Tracing Keys [+] Reset Winsock ************************* AdwCleaner[S00].txt - [2471 octets] - [11/11/2018 11:10:29] ########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C00].txt ##########
  5. Malwarebytes www.malwarebytes.com -Log Details- Scan Date: 11/11/18 Scan Time: 10:56 AM Log File: 5d7d9610-e572-11e8-8bec-2016b9480a1b.json -Software Information- Version: 3.6.1.2711 Components Version: 1.0.482 Update Package Version: 1.0.7791 License: Trial -System Information- OS: Windows 10 (Build 17134.345) CPU: x64 File System: NTFS User: LAPTOP-4H9BO7BO\Thor -Scan Summary- Scan Type: Threat Scan Scan Initiated By: Manual Result: Completed Objects Scanned: 268171 Threats Detected: 0 Threats Quarantined: 0 Time Elapsed: 4 min, 12 sec -Scan Options- Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Enabled Heuristics: Enabled PUP: Detect PUM: Detect -Scan Details- Process: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registry Key: 0 (No malicious items detected) Registry Value: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Data Stream: 0 (No malicious items detected) Folder: 0 (No malicious items detected) File: 0 (No malicious items detected) Physical Sector: 0 (No malicious items detected) WMI: 0 (No malicious items detected) (end)
  6. HI Everyone, I installed a file on my WIN 10 machine today. After installing it is not opening , and when trying to delete it from Control Panel I get an error runtime error could not call proc (at 399:4752).. Can someone please help>???
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.