Jump to content

runtime error could not call proc (at 399:4752)


anindya

Recommended Posts

Hello anindya and welcome to Malwarebytes,

Continue with the following:

If you do not have Malwarebytes installed do the following:

Download Malwarebytes version 3 from the following link:

https://www.malwarebytes.com/mwb-download/thankyou/

Double click on the installer and follow the prompts. If necessary select the Blue Help tab for video instructions....

When the install completes or Malwarebytes is already installed do the following:

Open Malwarebytes, select > "settings" > "protection tab"

Scroll down to "Scan Options" ensure Scan for Rootkits and Scan within Archives are both on....

Go back to "DashBoard" select the Blue "Scan Now" tab......

When the scan completes quarantine any found entries...

To get the log from Malwarebytes do the following:
 
  • Click on the Report tab > from main interface.
  • Double click on the Scan log which shows the Date and time of the scan just performed.
  • Click Export > From export you have two options:
    Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
    Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply

     
  • Please use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply…


Next,

Download AdwCleaner by Malwarebytes onto your Desktop.

Or from this Mirror
 
  • Right-click on AdwCleaner.exe and select user posted imageRun as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
  • Accept the EULA (I accept), then click on Scan
  • Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean button. This will kill all the active processes
  • Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it
  • After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply


Next,

Download Farbar Recovery Scan Tool and save it to your desktop.

Alternative download option: http://www.techspot.com/downloads/6731-farbar-recovery-scan-tool.html

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

If your security alerts to FRST either, accept the alert or turn your security off to allow FRST to run. It is not malicious or infected in any way...

Be aware FRST must be run from an account with Administrator status...
 
  • Double-click to run it. When the tool opens click Yes to disclaimer.(Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.)
  • Make sure Addition.txt is checkmarked under "Optional scans"
    user posted image
     
  • Press Scan button to run the tool....
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The tool will also make a log named (Addition.txt) Please attach that log to your reply.


Let me see those logs in your reply...

Thank you,

Kevin....
Link to post
Share on other sites

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 11/11/18
Scan Time: 10:56 AM
Log File: 5d7d9610-e572-11e8-8bec-2016b9480a1b.json

-Software Information-
Version: 3.6.1.2711
Components Version: 1.0.482
Update Package Version: 1.0.7791
License: Trial

-System Information-
OS: Windows 10 (Build 17134.345)
CPU: x64
File System: NTFS
User: LAPTOP-4H9BO7BO\Thor

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 268171
Threats Detected: 0
Threats Quarantined: 0
Time Elapsed: 4 min, 12 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 0
(No malicious items detected)

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)


(end)

Link to post
Share on other sites

# -------------------------------
# Malwarebytes AdwCleaner 7.2.4.0
# -------------------------------
# Build:    09-25-2018
# Database: 2018-11-05.1 (Cloud)
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start:    11-11-2018
# Duration: 00:00:09
# OS:       Windows 10 Home Single Language
# Cleaned:  10
# Failed:   0


***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

Deleted       C:\ProgramData\Tencent
Deleted       C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Tencent
Deleted       C:\Users\Thor\AppData\Roaming\Tencent

***** [ Files ] *****

No malicious files cleaned.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

Deleted       HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules|{7AED8592-3DCA-4796-AC5E-2140193DA073}
Deleted       HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules|{55A3CE4E-A3D7-443E-B31C-33C20552904D}
Deleted       HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules|{BED8834C-5550-4FC4-B197-12F92161BF3F}
Deleted       HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules|{1F6D4434-4D43-4B7A-9B17-29059FDD42B0}
Deleted       HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules|{3F42D25D-2E16-4141-882F-FF95456F9F5F}
Deleted       HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules|{91B56246-9344-4AA4-8F83-CA16C5A50CA3}
Deleted       HKLM\Software\Classes\METNSD

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

No malicious Chromium URLs cleaned.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.


*************************

[+] Delete Tracing Keys
[+] Reset Winsock

*************************

AdwCleaner[S00].txt - [2471 octets] - [11/11/2018 11:10:29]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C00].txt ##########
 

Link to post
Share on other sites

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 10.11.2018
Ran by Thor (administrator) on LAPTOP-4H9BO7BO (11-11-2018 11:32:55)
Running from C:\Users\Thor\Downloads
Loaded Profiles: Thor (Available Profiles: Thor)
Platform: Windows 10 Home Single Language Version 1803 17134.345 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Edge)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\cui_component.inf_amd64_df4f60b1cae9b14a\igfxCUIService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(Tencent) C:\Program Files\TxGameAssistant\AppMarket\QMEmulatorService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS GiftBox Service\GiftBoxService.exe
(Intel Corporation) C:\Windows\System32\Intel\DPTF\esif_uf.exe
(Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iigd_base.inf_amd64_2af995b9695ca8e3\IntelCpHDCPSvc.exe
(ICEpower a/s) C:\Windows\System32\DriverStore\FileRepository\icesoundapo64.inf_amd64_9f7fae81e4e966ff\ICEsoundService64.exe
(McAfee, LLC) C:\Program Files\Common Files\mcafee\SystemCore\mfemms.exe
(McAfee, Inc.) C:\Program Files\mcafee\WebAdvisor\servicehost.exe
(Intel Corporation) C:\Windows\System32\ibtsiva.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\modulecore\ModuleCoreService.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\pef\CORE\PEFService.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Realtek Semiconductor) C:\Windows\System32\RtkAudUService64.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(McAfee, LLC) C:\Windows\System32\mfevtps.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\mmsshost\MMSSHOST.exe
(McAfee, LLC) C:\Windows\System32\mfevtps.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\modulecore\ProtectedModuleHost.exe
(Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iigd_base.inf_amd64_2af995b9695ca8e3\IntelCpHeciSvc.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(McAfee, Inc.) C:\Program Files\mcafee\mfeav\MfeAVSvc.exe
(McAfee, LLC) C:\Program Files\Common Files\mcafee\SystemCore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\csp\3.0.127.0\McCSPServiceHost.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\VSCore_18_6\mcapexe.exe
(McAfee LLC.) C:\Program Files\Common Files\mcafee\amcore\mcshield.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(Intel Corporation) C:\Windows\System32\Intel\DPTF\dptf_helper.exe
(McAfee, Inc.) C:\Program Files\mcafee\WebAdvisor\uihost.exe
() C:\Program Files (x86)\ASUS\ASUS Hello\ASUSHelloBG.exe
(Malwarebytes) C:\Users\Thor\Downloads\adwcleaner_7.2.4.0.exe
(Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\cui_component.inf_amd64_df4f60b1cae9b14a\igfxEM.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.33.41.0_x64__kzf8qxf38zg5c\SkypeApp.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.10314.31700.1000_x64__8wekyb3d8bbwe\Office16\OfficeHubTaskHost.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
(Microsoft Corporation) C:\Windows\System32\browser_broker.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.33.41.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Realtek Semiconductor) C:\Windows\System32\RtkAudUService64.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\modulecore\ModuleCoreService.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\platform\McUICnt.exe
(ASUSTek Computer Inc.) C:\Program Files\WindowsApps\B9ECED6F.ASUSBatteryHealthCharging_1.0.7.0_x86__qmba6cd70vzyy\ASUS Battery Health Charging\BhcMgr.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\redirector.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\Receiver\Receiver.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\Receiver\ConfigurationWizard.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\SelfServicePlugin\SelfServicePlugin.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler64.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsStore_11810.1001.12.0_x64__8wekyb3d8bbwe\WinStore.App.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
() C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18081.14710.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
(McAfee, Inc.) C:\Program Files\mcafee\msc\mcsync.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [638872 2018-04-12] (Microsoft Corporation)
HKLM\...\Run: [RtkAudUService] => C:\Windows\System32\RtkAudUService64.exe [674760 2018-04-25] (Realtek Semiconductor)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM-x32\...\Run: [ConnectionCenter] => C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [555920 2018-02-23] (Citrix Systems, Inc.)
HKLM-x32\...\Run: [Redirector] => C:\Program Files (x86)\Citrix\ICA Client\redirector.exe [402832 2018-02-23] (Citrix Systems, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{8e59d1a2-1def-4022-bbd1-f35cf18fe1d1}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{ad2df368-e6d6-4f14-a214-59997e75266a}: [DhcpNameServer] 10.66.32.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2452082275-3313010305-2762231402-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2452082275-3313010305-2762231402-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus17win10.msn.com/?pc=ASTE
SearchScopes: HKU\S-1-5-21-2452082275-3313010305-2762231402-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2452082275-3313010305-2762231402-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: McAfee WebAdvisor -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> C:\Program Files\McAfee\WebAdvisor\x64\IEPlugin.dll [2018-10-03] (McAfee, Inc.)
BHO-x32: McAfee WebAdvisor -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> C:\Program Files\McAfee\WebAdvisor\win32\IEPlugin.dll [2018-10-03] (McAfee, Inc.)
Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2018-02-23] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2018-02-23] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2018-02-23] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2018-02-23] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2018-02-23] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2018-02-23] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2018-02-23] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2018-02-23] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2018-02-23] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2018-02-23] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2018-02-23] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2018-02-23] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2018-02-23] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2018-02-23] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2018-02-23] (Citrix Systems, Inc.)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\mcafee\msc\McSnIePl64.dll [2018-10-05] (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\msc\McSnIePl.dll [2018-10-05] (McAfee, Inc.)
Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2018-02-23] (Citrix Systems, Inc.)

FireFox:
========
FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files\McAfee\WebAdvisor\e10ssaffplg.xpi
FF Extension: (McAfee® WebAdvisor) - C:\Program Files\McAfee\WebAdvisor\e10ssaffplg.xpi [2018-11-02]
FF HKLM\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSKHKLM => not found
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files\McAfee\WebAdvisor\e10ssaffplg.xpi
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: (McAfee Anti-Spam Thunderbird Extension) - C:\Program Files\McAfee\MSK [2018-10-25] [Legacy] [not signed]
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL [2018-10-05] ()
FF Plugin-x32: @Citrix.com/npican -> C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll [2018-02-23] (Citrix Systems, Inc.)
FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL [2018-10-05] ()
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-10-03] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-10-03] (Google Inc.)

Chrome: 
=======
CHR Profile: C:\Users\Thor\AppData\Local\Google\Chrome\User Data\Default [2018-11-11]
CHR Extension: (Slides) - C:\Users\Thor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2018-10-03]
CHR Extension: (Docs) - C:\Users\Thor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2018-10-03]
CHR Extension: (Google Drive) - C:\Users\Thor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2018-10-17]
CHR Extension: (YouTube) - C:\Users\Thor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2018-10-03]
CHR Extension: (Sheets) - C:\Users\Thor\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2018-10-03]
CHR Extension: (Google Docs Offline) - C:\Users\Thor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2018-10-03]
CHR Extension: (Ghostery – Privacy Ad Blocker) - C:\Users\Thor\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlomiejdfkolichcflejclcbmpeaniij [2018-10-13]
CHR Extension: (Hoxx VPN Proxy) - C:\Users\Thor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nbcojefnccbanplpoffopkoepjmhgdgh [2018-10-21]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Thor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-10-03]
CHR Extension: (Gmail) - C:\Users\Thor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2018-10-03]
CHR Extension: (Chrome Media Router) - C:\Users\Thor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-10-27]
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - hxxp://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 ClientAnalyticsService; C:\Program Files\Common Files\McAfee\ClientAnalytics\Legacy\McClientAnalytics.exe [1511728 2017-09-22] (McAfee, Inc.)
S3 DevActSvc; C:\Program Files (x86)\ASUS\ASUS Device Activation\DevActSvc.exe [326032 2018-06-06] ()
R2 esifsvc; C:\Windows\System32\Intel\DPTF\esif_uf.exe [1699368 2018-01-28] (Intel Corporation)
R2 GiftBox.Service; C:\Program Files (x86)\ASUS\ASUS GiftBox Service\GiftBoxService.exe [302416 2018-06-29] (ASUSTeK Computer Inc.)
S3 iaStorAfsService; C:\Windows\IAStorAfsService\iaStorAfsService.exe [2593848 2018-03-10] (Intel Corporation)
R2 ibtsiva; C:\Windows\System32\ibtsiva.exe [550568 2018-05-02] (Intel Corporation)
R2 ICEsoundService; C:\Windows\System32\DriverStore\FileRepository\icesoundapo64.inf_amd64_9f7fae81e4e966ff\ICEsoundService64.exe [483712 2018-03-07] (ICEpower a/s)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\Intel(R) Management Engine Components\iCLS\SocketHeciServer.exe [758552 2018-03-03] (Intel(R) Corporation)
S2 Intel(R) TPM Provisioning Service; C:\Program Files\Intel\Intel(R) Management Engine Components\iCLS\TPMProvisioningService.exe [719640 2018-03-03] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [205968 2017-12-04] (Intel Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6347056 2018-09-19] (Malwarebytes)
R2 McAfee WebAdvisor; C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe [675736 2018-10-03] (McAfee, Inc.)
R2 McAPExe; C:\Program Files\Common Files\McAfee\VSCore_18_6\McApExe.exe [729320 2018-10-05] (McAfee, Inc.)
S3 McAWFwk; c:\Program Files\Common Files\mcafee\actwiz\McAWFwk.exe [455584 2017-09-27] (McAfee, Inc.)
R2 mccspsvc; C:\Program Files\Common Files\McAfee\CSP\3.0.127.0\\McCSPServiceHost.exe [2159464 2018-06-30] (McAfee, Inc.)
S3 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe [366968 2018-08-22] (McAfee, LLC)
R2 mfemms; C:\Program Files\Common Files\McAfee\SystemCore\mfemms.exe [539512 2018-08-22] (McAfee, LLC)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [490360 2018-08-22] (McAfee, LLC)
R2 ModuleCoreService; C:\Program Files\Common Files\McAfee\ModuleCore\ModuleCoreService.exe [1690976 2018-07-28] (McAfee, Inc.)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [265824 2018-04-17] ()
S3 NvContainerLocalSystem; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [519240 2018-01-10] (NVIDIA Corporation)
S3 NvContainerNetworkService; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [519240 2018-01-10] (NVIDIA Corporation)
R2 PEFService; C:\Program Files\Common Files\McAfee\PEF\CORE\PEFService.exe [1316024 2018-07-25] (McAfee, Inc.)
R2 QMEmulatorService; C:\Program Files\TxGameAssistant\AppMarket\QMEmulatorService.exe [342776 2018-06-22] (Tencent)
R2 RtkAudioUniversalService; C:\Windows\System32\RtkAudUService64.exe [674760 2018-04-25] (Realtek Semiconductor)
S4 ssh-agent; C:\Windows\System32\OpenSSH\ssh-agent.exe [495616 2018-03-10] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [4451616 2018-04-12] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [107136 2018-09-21] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3848288 2018-04-17] (Intel® Corporation)
R2 NVDisplay.ContainerLocalSystem; "C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe" -s NVDisplay.ContainerLocalSystem -f "C:\ProgramData\NVIDIA\NVDisplay.ContainerLocalSystem.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\LocalSystem" -r -p 30000
R2 NvTelemetryContainer; "C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe" -s NvTelemetryContainer -f "C:\ProgramData\NVIDIA\NvTelemetryContainer.log" -l 3 -d "C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\plugins" -r

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 aow_drv; C:\Program Files\TxGameAssistant\UI\2.0.6479.123\aow_drv_x64_ev.sys [853776 2018-09-14] (Tencent)
R3 AsusPTPDrv; C:\Windows\System32\drivers\AsusPTPFilter.sys [104808 2018-03-13] (ASUSTek COMPUTER INC.)
R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [77336 2018-10-03] (McAfee, LLC)
R3 dptf_acpi; C:\Windows\System32\drivers\dptf_acpi.sys [74696 2017-11-28] (Intel Corporation)
R3 dptf_cpu; C:\Windows\System32\drivers\dptf_cpu.sys [70088 2017-11-28] (Intel Corporation)
R3 esif_lf; C:\Windows\System32\drivers\esif_lf.sys [383432 2017-11-28] (Intel Corporation)
R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [152688 2018-10-18] (Malwarebytes)
R3 HIDSwitch; C:\Windows\System32\drivers\AsRadioControl.sys [31144 2017-11-23] (ASUS)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [235784 2018-10-03] (McAfee, Inc.)
R3 iaLPSS2_GPIO2; C:\Windows\System32\drivers\iaLPSS2_GPIO2.sys [98968 2017-10-16] (Intel Corporation)
R0 iaStorAC; C:\Windows\System32\drivers\iaStorAC.sys [941624 2018-03-10] (Intel Corporation)
S3 iaStorAfs; C:\Windows\System32\drivers\iaStorAfs.sys [72248 2018-03-10] (Intel Corporation)
R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [199192 2018-05-15] (Intel Corporation)
R2 MBAMChameleon; C:\Windows\System32\Drivers\MbamChameleon.sys [198000 2018-11-11] (Malwarebytes)
R3 MBAMFarflt; C:\Windows\System32\DRIVERS\farflt.sys [119136 2018-11-11] (Malwarebytes)
R3 MBAMProtection; C:\Windows\system32\DRIVERS\mbam.sys [63768 2018-11-11] (Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [260480 2018-11-11] (Malwarebytes)
R3 MBAMWebProtection; C:\Windows\system32\DRIVERS\mwac.sys [111152 2018-11-11] (Malwarebytes)
R3 mfeaack; C:\Windows\System32\drivers\mfeaack.sys [506384 2018-10-03] (McAfee, LLC)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [367664 2018-10-03] (McAfee, LLC)
S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [85104 2018-10-03] (McAfee, LLC)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [533520 2018-10-03] (McAfee, LLC)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [967696 2018-10-03] (McAfee, LLC)
R3 mfencbdc; C:\Windows\System32\DRIVERS\mfencbdc.sys [555824 2018-10-03] (McAfee LLC.)
S3 mfencrk; C:\Windows\System32\DRIVERS\mfencrk.sys [108848 2018-10-03] (McAfee LLC.)
R3 mfeplk; C:\Windows\System32\drivers\mfeplk.sys [115728 2018-10-03] (McAfee, LLC)
R3 mfesapsn; C:\Program Files\McAfee\WebAdvisor\mfesapsn.sys [111976 2018-10-03] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [252952 2018-10-03] (McAfee, LLC)
S3 Netwtw04; C:\Windows\System32\drivers\Netwtw04.sys [7689728 2018-04-12] (Intel Corporation)
R3 Netwtw06; C:\Windows\System32\drivers\Netwtw06.sys [8810336 2018-05-13] (Intel Corporation)
R3 nvlddmkm; C:\Windows\System32\DriverStore\FileRepository\nvam.inf_amd64_7a10e27d01ea1abb\nvlddmkm.sys [17147136 2018-03-14] (NVIDIA Corporation)
S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [30280 2018-01-10] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [59240 2017-12-14] (NVIDIA Corporation)
R3 nvvhci; C:\Windows\System32\drivers\nvvhci.sys [57928 2018-01-10] (NVIDIA Corporation)
S3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [604160 2018-04-12] (Realtek )
S3 rtux64w10; C:\Windows\System32\drivers\rtux64w10.sys [348672 2018-04-12] (Realtek )
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44616 2018-04-12] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [331680 2018-04-12] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [44032 2018-04-12] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-11-11 11:33 - 2018-11-11 11:33 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2018-11-11 11:32 - 2018-11-11 11:33 - 000024857 _____ C:\Users\Thor\Downloads\FRST.txt
2018-11-11 11:32 - 2018-11-11 11:32 - 000000000 ____D C:\FRST
2018-11-11 11:21 - 2018-11-11 11:22 - 002415616 _____ (Farbar) C:\Users\Thor\Downloads\FRST64.exe
2018-11-11 11:20 - 2018-11-11 11:21 - 079596656 _____ (Malwarebytes ) C:\Users\Thor\Downloads\mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7783 (1).exe
2018-11-11 11:20 - 2018-11-11 11:20 - 000002473 _____ C:\Users\Thor\Desktop\2nd.txt
2018-11-11 11:17 - 2018-11-11 11:17 - 000260480 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys
2018-11-11 11:17 - 2018-11-11 11:17 - 000119136 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
2018-11-11 11:17 - 2018-11-11 11:17 - 000111152 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
2018-11-11 11:17 - 2018-11-11 11:17 - 000063768 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2018-11-11 11:17 - 2018-11-11 11:17 - 000000000 ____D C:\ProgramData\Tencent
2018-11-11 11:08 - 2018-11-11 11:15 - 000000000 ____D C:\AdwCleaner
2018-11-11 11:08 - 2018-11-11 11:08 - 007592144 _____ (Malwarebytes) C:\Users\Thor\Downloads\adwcleaner_7.2.4.0.exe
2018-11-11 11:07 - 2018-11-11 11:07 - 000001231 _____ C:\Users\Thor\Desktop\1st.txt
2018-11-11 10:55 - 2018-11-11 10:55 - 000198000 _____ (Malwarebytes) C:\Windows\system32\Drivers\MbamChameleon.sys
2018-11-11 10:55 - 2018-11-11 10:55 - 000000000 ____D C:\Users\Thor\AppData\Local\mbamtray
2018-11-11 10:55 - 2018-11-11 10:55 - 000000000 ____D C:\Users\Thor\AppData\Local\mbam
2018-11-11 10:54 - 2018-11-11 10:54 - 000001914 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2018-11-11 10:54 - 2018-11-11 10:54 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2018-11-11 10:54 - 2018-11-11 10:54 - 000000000 ____D C:\ProgramData\Malwarebytes
2018-11-11 10:54 - 2018-11-11 10:54 - 000000000 ____D C:\Program Files\Malwarebytes
2018-11-11 10:54 - 2018-10-18 08:44 - 000152688 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbae64.sys
2018-11-11 10:52 - 2018-11-11 10:52 - 079596656 _____ (Malwarebytes ) C:\Users\Thor\Downloads\mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7783.exe
2018-11-11 10:47 - 2018-11-11 10:47 - 000000000 ___HD C:\OneDriveTemp
2018-11-11 00:18 - 2018-11-11 00:18 - 000000000 ____D C:\Users\Thor\AppData\LocalLow\Pixel Dash Studios & EQ Games
2018-11-11 00:09 - 2018-11-11 00:39 - 000001772 _____ C:\Users\Thor\Desktop\Road Redemption.lnk
2018-11-11 00:09 - 2018-11-11 00:09 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\R.G. Catalyst
2018-11-11 00:06 - 2018-11-11 00:06 - 000000000 ____D C:\R.G. Catalyst
2018-11-10 23:10 - 2018-11-11 10:47 - 000000000 ____D C:\Users\Thor\AppData\LocalLow\uTorrent
2018-11-10 22:10 - 2018-11-10 22:10 - 000019672 _____ C:\Users\Thor\Downloads\Road.Redemption.v20180712.torrent
2018-11-05 11:19 - 2018-11-05 11:19 - 000450364 _____ C:\Users\Thor\Downloads\Mathematical Formula Handbook.pdf
2018-11-04 22:59 - 2018-11-04 22:59 - 000000000 ____D C:\Users\Thor\AppData\Local\ElevatedDiagnostics
2018-11-03 01:44 - 2018-11-03 01:54 - 000000812 _____ C:\Users\Thor\Untitled.ipynb
2018-11-03 01:44 - 2018-11-03 01:44 - 000000000 ____D C:\Users\Thor\.ipython
2018-11-03 01:44 - 2018-11-03 01:44 - 000000000 ____D C:\Users\Thor\.ipynb_checkpoints
2018-11-03 01:36 - 2018-11-03 18:14 - 000000000 ____D C:\Users\Thor\AppData\Roaming\jupyter
2018-11-03 01:33 - 2018-11-03 01:33 - 000000000 ____D C:\Users\Thor\AppData\Local\conda
2018-11-03 01:03 - 2018-11-03 01:03 - 000000000 ____D C:\Users\Thor\AppData\Local\ContinuumIO
2018-11-03 00:45 - 2018-11-03 00:45 - 000000000 ____D C:\Users\Thor\Documents\Python Scripts
2018-11-03 00:45 - 2018-11-03 00:45 - 000000000 ____D C:\Users\Thor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Anaconda3 (64-bit)
2018-11-03 00:29 - 2018-11-03 00:45 - 000000000 ____D C:\Users\Thor\Anaconda3
2018-11-03 00:16 - 2018-11-03 00:19 - 662059680 _____ (Anaconda, Inc.) C:\Users\Thor\Downloads\Anaconda3-5.3.0-Windows-x86_64.exe
2018-11-02 13:19 - 2018-11-02 13:19 - 026260496 _____ (Python Software Foundation) C:\Users\Thor\Downloads\python-3.7.1-amd64.exe
2018-11-02 13:18 - 2018-11-02 13:18 - 000001050 _____ C:\Users\Thor\Desktop\PY.txt
2018-11-01 14:17 - 2018-11-01 14:17 - 000012463 _____ C:\Users\Thor\Downloads\themes.csv
2018-11-01 01:09 - 2018-11-01 01:09 - 012773229 _____ C:\Users\Thor\Downloads\inventory_parts.csv
2018-11-01 00:35 - 2018-11-01 00:35 - 000003627 _____ C:\Users\Thor\Downloads\colors.csv
2018-10-30 14:10 - 2018-10-30 14:10 - 000188128 _____ C:\Users\Thor\Downloads\Statement of Accomplishment (4).pdf
2018-10-26 17:13 - 2018-10-26 17:13 - 000188667 _____ C:\Users\Thor\Downloads\Statement of Accomplishment (3).pdf
2018-10-26 12:54 - 2018-10-26 12:54 - 000000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2018-10-25 23:16 - 2018-10-25 23:16 - 000002152 _____ C:\Users\Thor\Desktop\Popcorn-Time.lnk
2018-10-25 23:16 - 2018-10-25 23:16 - 000000000 ____D C:\Users\Thor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Popcorn-Time
2018-10-25 23:15 - 2018-11-09 02:14 - 000000000 ____D C:\Users\Thor\AppData\Local\Popcorn-Time
2018-10-24 23:56 - 2018-10-24 23:56 - 061757061 _____ (Popcorn Time) C:\Users\Thor\Downloads\Popcorn-Time-0.3.10-Setup (1).exe
2018-10-20 16:49 - 2018-10-20 16:50 - 000188273 _____ C:\Users\Thor\Downloads\Statement of Accomplishment (2).pdf
2018-10-18 01:12 - 2018-10-18 01:20 - 000000000 ____D C:\Users\Thor\Documents\FIFA 18
2018-10-18 01:03 - 2018-10-18 01:03 - 000000827 _____ C:\Users\Public\Desktop\FIFA18.lnk
2018-10-18 00:45 - 2018-10-18 01:07 - 000000000 ____D C:\Program Files\FIFA18
2018-10-18 00:16 - 2018-10-18 00:16 - 000000000 ____D C:\Users\Thor\AppData\Roaming\WinRAR
2018-10-18 00:15 - 2018-10-18 00:15 - 003118192 _____ (Alexander Roshal) C:\Users\Thor\Downloads\winrar-x64-561.exe
2018-10-18 00:15 - 2018-10-18 00:15 - 000000000 ____D C:\Users\Thor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2018-10-18 00:15 - 2018-10-18 00:15 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2018-10-18 00:15 - 2018-10-18 00:15 - 000000000 ____D C:\Program Files\WinRAR
2018-10-17 10:58 - 2018-10-18 00:42 - 000000000 ____D C:\Users\Thor\Downloads\FIFA.18-STEAMPUNKS
2018-10-17 10:57 - 2018-10-17 10:57 - 000039944 _____ C:\Users\Thor\Downloads\FIFA.18-STEAMPUNKS.torrent
2018-10-17 10:54 - 2018-11-11 11:13 - 000000000 ____D C:\Users\Thor\AppData\Roaming\uTorrent
2018-10-17 10:54 - 2018-10-17 10:54 - 002439352 _____ (BitTorrent Inc.) C:\Users\Thor\Downloads\uTorrent (2).exe
2018-10-17 10:44 - 2018-10-17 10:44 - 002969488 _____ (BitTorrent Inc.) C:\Users\Thor\Downloads\uTorrent.exe
2018-10-17 10:11 - 2018-10-18 08:54 - 000000000 ____D C:\Users\Thor\AppData\Local\SaferVPN
2018-10-17 10:10 - 2016-04-21 14:40 - 000027136 _____ (The OpenVPN Project) C:\Windows\system32\Drivers\tap0901.sys
2018-10-17 10:09 - 2018-10-17 10:10 - 010043968 _____ (Safer Social Ltd) C:\Users\Thor\Downloads\SaferVPN.exe
2018-10-16 08:08 - 2018-10-16 08:08 - 003310244 _____ C:\Users\Thor\Downloads\morning.pdf
2018-10-16 08:07 - 2018-10-16 08:07 - 004394582 _____ C:\Users\Thor\Downloads\AAI-JE-ATC-Question-Paper-26-Dec.-2015-Shift-1.pdf
2018-10-13 19:27 - 2018-10-13 19:27 - 000000000 ____D C:\Users\Thor\Documents\Custom Office Templates
2018-10-13 19:25 - 2018-10-25 11:07 - 000000000 ____D C:\Users\Thor\AppData\Local\CrashDumps
2018-10-13 02:55 - 2018-10-13 03:01 - 1649348306 _____ C:\Users\Thor\Downloads\Unconfirmed 832943.crdownload
2018-10-12 09:29 - 2018-10-12 09:29 - 014982013 _____ C:\Users\Thor\Downloads\video.mp4

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-11-11 11:32 - 2018-04-12 05:08 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2018-11-11 11:21 - 2018-08-15 22:29 - 001310946 _____ C:\Windows\system32\PerfStringBackup.INI
2018-11-11 11:21 - 2018-05-10 04:30 - 000404906 _____ C:\Windows\system32\prfh0804.dat
2018-11-11 11:21 - 2018-05-10 04:30 - 000124978 _____ C:\Windows\system32\prfc0804.dat
2018-11-11 11:21 - 2018-04-12 05:06 - 000000000 ____D C:\Windows\INF
2018-11-11 11:18 - 2018-08-16 03:28 - 000000000 ___RD C:\Users\Thor\OneDrive
2018-11-11 11:17 - 2018-08-16 00:02 - 000000000 __SHD C:\Users\Thor\IntelGraphicsProfiles
2018-11-11 11:17 - 2018-08-15 22:44 - 000000000 ____D C:\ProgramData\NVIDIA
2018-11-11 11:17 - 2018-05-10 03:46 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2018-11-11 11:16 - 2018-04-12 02:34 - 000524288 _____ C:\Windows\system32\config\BBI
2018-11-11 10:49 - 2018-10-04 12:31 - 000004166 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{6AD1D339-EA6C-4DBF-9197-50F9D94C066B}
2018-11-11 01:21 - 2018-04-12 05:00 - 000000000 ____D C:\Windows\CbsTemp
2018-11-11 00:18 - 2018-10-07 12:23 - 000000000 ____D C:\Users\Thor\AppData\Local\D3DSCache
2018-11-11 00:04 - 2018-05-10 03:46 - 000000000 ____D C:\Windows\system32\SleepStudy
2018-11-10 22:22 - 2018-04-12 02:34 - 000032768 _____ C:\Windows\system32\config\ELAM
2018-11-10 22:16 - 2018-04-12 05:08 - 000000000 ____D C:\Windows\AppReadiness
2018-11-09 23:11 - 2018-04-12 05:08 - 000000000 ___HD C:\Program Files\WindowsApps
2018-11-03 01:54 - 2018-08-16 00:01 - 000000000 ____D C:\Users\Thor
2018-11-02 10:11 - 2018-08-15 23:09 - 000000000 ____D C:\ProgramData\McAfee
2018-10-31 10:14 - 2018-10-04 00:04 - 000000000 ____D C:\ProgramData\Packages
2018-10-29 09:52 - 2018-08-15 23:09 - 000000000 ____D C:\Program Files (x86)\McAfee
2018-10-26 11:34 - 2018-10-03 22:56 - 000002303 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2018-10-26 11:34 - 2018-10-03 22:56 - 000002262 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2018-10-25 22:47 - 2018-08-15 23:11 - 000003126 _____ C:\Windows\System32\Tasks\McAfeeLogon
2018-10-25 22:47 - 2018-08-15 23:09 - 000000000 ____D C:\Program Files\Common Files\mcafee
2018-10-25 22:45 - 2018-04-12 05:08 - 000000000 ___HD C:\Windows\ELAMBKUP
2018-10-18 01:07 - 2018-08-15 22:37 - 000000000 ____D C:\ProgramData\Package Cache
2018-10-17 12:24 - 2018-08-15 23:09 - 000003710 _____ C:\Windows\System32\Tasks\McAfee Remediation (Prepare)
2018-10-17 09:59 - 2018-10-04 00:06 - 000003376 _____ C:\Windows\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-2452082275-3313010305-2762231402-1001
2018-10-17 09:59 - 2018-08-16 00:01 - 000002366 _____ C:\Users\Thor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2018-05-10 03:46

==================== End of FRST.txt ============================

Link to post
Share on other sites

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10.11.2018
Ran by Thor (11-11-2018 11:34:20)
Running from C:\Users\Thor\Downloads
Windows 10 Home Single Language Version 1803 17134.345 (X64) (2018-08-15 18:27:05)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-2452082275-3313010305-2762231402-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-2452082275-3313010305-2762231402-503 - Limited - Disabled)
Guest (S-1-5-21-2452082275-3313010305-2762231402-501 - Limited - Disabled)
Thor (S-1-5-21-2452082275-3313010305-2762231402-1001 - Administrator - Enabled) => C:\Users\Thor
WDAGUtilityAccount (S-1-5-21-2452082275-3313010305-2762231402-504 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}
AV: McAfee VirusScan (Enabled - Up to date) {8BCDACFA-D264-3528-5EF8-E94FD0BC1FBC}
AS: Malwarebytes (Enabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: McAfee VirusScan (Enabled - Up to date) {30AC4D1E-F45E-3AA6-6448-D23DAB3B5501}
FW: McAfee Firewall (Enabled) {B3F62DDF-980B-3470-75A7-407A2E6F58C7}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

«Road Redemption» (1.01) (HKLM-x32\...\«Road Redemption»_is1) (Version: 1.01 - Pixel Dash Studios, EQ)
µTorrent (HKU\S-1-5-21-2452082275-3313010305-2762231402-1001\...\uTorrent) (Version: 3.5.4.44809 - BitTorrent Inc.)
ASUS Device Activation (HKLM-x32\...\{9C4B0706-9F9A-47BF-B417-0A111FC52B04}) (Version: 1.0.4.0 - ASUSTeK COMPUTER INC.)
ASUS GiftBox Service (HKLM-x32\...\{4701E5AB-AF91-4D40-8F18-358CC80E4E5B}) (Version: 3.2.3.0 - ASUSTeK COMPUTER INC.)
ASUS Hello (HKLM-x32\...\{D8CE1923-92A9-4036-817E-9E0D8AA2169B}) (Version: 1.1.4.0 - ASUSTeK COMPUTER INC.)
ASUS Live Update (HKLM-x32\...\{FA540E67-095C-4A1B-97BA-4D547DEC9AF4}) (Version: 3.5.2 - ASUSTeK COMPUTER INC.)
ATK Package (ASUS Keyboard Hotkeys) (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version: 1.0.0060 - ASUSTeK COMPUTER INC.)
AudioWizard (HKLM-x32\...\{57E770A2-2BAF-4CAA-BAA3-BD896E2254D3}) (Version: 1.0.8.5 - ICEpower a/s)
Citrix Receiver 4.9 LTSR (HKLM-x32\...\CitrixOnlinePluginPackWeb) (Version: 14.9.2000.21 - Citrix Systems, Inc.)
FIFA18 version 1.0 (HKLM\...\FIFA18_is1) (Version: 1.0 - STEAMPUNKS) <==== ATTENTION
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 70.0.3538.77 - Google Inc.)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.17 - Google Inc.) Hidden
Intel(R) Chipset Device Software (HKLM-x32\...\{55d73ea7-6354-42db-8831-02d048ae57f8}) (Version: 10.1.17541.8066 - Intel(R) Corporation) Hidden
Intel(R) Dynamic Platform and Thermal Framework (HKLM-x32\...\{654EE65D-FAA4-4EA6-8C07-DC94E6A304D4}) (Version: 8.3.10208.5644 - Intel Corporation)
Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 11.7.0.1068 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 23.20.16.4974 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 16.0.4.1093 - Intel Corporation)
Intel(R) Serial IO (HKLM\...\{9FD91C5C-44AE-4D9D-85BE-AE52816B0294}) (Version: 30.100.1725.1 - Intel Corporation)
Intel(R) Trusted Connect Service Client x86 (HKLM-x32\...\{C9552825-7BF2-4344-BA91-D3CD46F4C441}) (Version: 1.49.166.0 - Intel Corporation) Hidden
Intel(R) Trusted Connect Services Client (HKLM-x32\...\{df682aff-4294-4ad1-aaa7-276931d5781f}) (Version: 1.49.166.0 - Intel Corporation) Hidden
Intel® PROSet/Wireless Software (HKLM-x32\...\{d5c53162-d8b4-4547-8a40-917a25c0172e}) (Version: 20.60.0 - Intel Corporation)
Logitech Unifying Software 2.50 (HKLM\...\Logitech Unifying) (Version: 2.50.25 - Logitech)
Malwarebytes version 3.6.1.2711 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.6.1.2711 - Malwarebytes)
McAfee LiveSafe   (HKLM-x32\...\MSC) (Version: 16.0 R14 - McAfee, Inc.)
McAfee WebAdvisor (HKLM-x32\...\{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}) (Version: 4.0.8.19377 - McAfee, Inc.)
Microsoft OneDrive (HKU\S-1-5-21-2452082275-3313010305-2762231402-1001\...\OneDriveSetup.exe) (Version: 18.172.0826.0010 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual Studio Code (User) (HKU\S-1-5-21-2452082275-3313010305-2762231402-1001\...\{771FD6B0-FA20-440A-A002-3B3BAC16DC50}_is1) (Version: 1.27.2 - Microsoft Corporation)
NVIDIA GeForce Experience 3.12.0.84 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 3.12.0.84 - NVIDIA Corporation)
NVIDIA Graphics Driver 389.12 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 389.12 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.17.0524 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.17.0524 - NVIDIA Corporation)
Online Plug-in (HKLM-x32\...\{D9BD3EBD-36EB-4F89-B7A3-2451AD374496}) (Version: 14.9.2000.21 - Citrix Systems, Inc.) Hidden
Popcorn-Time (HKU\S-1-5-21-2452082275-3313010305-2762231402-1001\...\Popcorn-Time) (Version: 0.3.10 - Popcorn Time)
Python 3.7.0 (32-bit) (HKU\S-1-5-21-2452082275-3313010305-2762231402-1001\...\{ece37911-ffeb-4f29-95d6-abcf555d7364}) (Version: 3.7.150.0 - Python Software Foundation)
Python 3.7.0 (Anaconda3 5.3.0 64-bit) (HKU\S-1-5-21-2452082275-3313010305-2762231402-1001\...\Python 3.7.0 (Anaconda3 5.3.0 64-bit)) (Version: 5.3.0 - Anaconda, Inc.)
Python 3.7.0 Core Interpreter (32-bit) (HKLM-x32\...\{13BB06D9-FD38-47E5-946E-C2606C554030}) (Version: 3.7.150.0 - Python Software Foundation) Hidden
Python 3.7.0 Development Libraries (32-bit) (HKLM-x32\...\{B424BE74-3C96-4974-8754-9D6442286112}) (Version: 3.7.150.0 - Python Software Foundation) Hidden
Python 3.7.0 Documentation (32-bit) (HKLM-x32\...\{ABEE159E-FE5B-4E58-BDD7-1DED2F10AAEB}) (Version: 3.7.150.0 - Python Software Foundation) Hidden
Python 3.7.0 Executables (32-bit) (HKLM-x32\...\{4642A126-F999-4407-801B-C1C89BDA58C5}) (Version: 3.7.150.0 - Python Software Foundation) Hidden
Python 3.7.0 pip Bootstrap (32-bit) (HKLM-x32\...\{69CFC76B-3434-4919-8885-BA7960725137}) (Version: 3.7.150.0 - Python Software Foundation) Hidden
Python 3.7.0 Standard Library (32-bit) (HKLM-x32\...\{09160A5D-8B99-4A89-9E9D-8A6D8E9C7EC1}) (Version: 3.7.150.0 - Python Software Foundation) Hidden
Python 3.7.0 Tcl/Tk Support (32-bit) (HKLM-x32\...\{8A09EA6B-C86C-4ECA-8742-C4C1BCA96845}) (Version: 3.7.150.0 - Python Software Foundation) Hidden
Python 3.7.0 Test Suite (32-bit) (HKLM-x32\...\{717DB3B4-C457-447B-A8A6-6921A4D917EF}) (Version: 3.7.150.0 - Python Software Foundation) Hidden
Python 3.7.0 Utility Scripts (32-bit) (HKLM-x32\...\{FC756D1E-1252-406E-8414-E11FAF97F3C7}) (Version: 3.7.150.0 - Python Software Foundation) Hidden
Python 3.7.1rc1 (64-bit) (HKU\S-1-5-21-2452082275-3313010305-2762231402-1001\...\{81649048-4dad-4376-a160-cf35dc9ebdb6}) (Version: 3.7.1121.0 - Python Software Foundation)
Python 3.7.1rc1 Add to Path (64-bit) (HKLM\...\{15E5D203-C806-4A41-AE47-304B17A61B99}) (Version: 3.7.1121.0 - Python Software Foundation) Hidden
Python 3.7.1rc1 Core Interpreter (64-bit) (HKLM\...\{16B55EA2-53B8-4431-85C9-D8A1066CD703}) (Version: 3.7.1121.0 - Python Software Foundation) Hidden
Python 3.7.1rc1 Development Libraries (64-bit) (HKLM\...\{EA3F1CFF-FFDB-411D-8892-CE8785C03536}) (Version: 3.7.1121.0 - Python Software Foundation) Hidden
Python 3.7.1rc1 Documentation (64-bit) (HKLM\...\{E480639A-23BA-4EC1-9BFB-29A9927F4384}) (Version: 3.7.1121.0 - Python Software Foundation) Hidden
Python 3.7.1rc1 Executables (64-bit) (HKLM\...\{6D6E1822-0071-4C72-B2B5-A489A4BACF98}) (Version: 3.7.1121.0 - Python Software Foundation) Hidden
Python 3.7.1rc1 pip Bootstrap (64-bit) (HKLM\...\{738800A2-D31E-4117-8B5C-AAFC464BF96C}) (Version: 3.7.1121.0 - Python Software Foundation) Hidden
Python 3.7.1rc1 Standard Library (64-bit) (HKLM\...\{4C7A44F1-4444-4D5A-AFB2-2C1739A29544}) (Version: 3.7.1121.0 - Python Software Foundation) Hidden
Python 3.7.1rc1 Tcl/Tk Support (64-bit) (HKLM\...\{410E210A-440C-44F1-8B21-F9B463F14395}) (Version: 3.7.1121.0 - Python Software Foundation) Hidden
Python 3.7.1rc1 Test Suite (64-bit) (HKLM\...\{0E079D36-B148-4217-929C-320DBAF1A37B}) (Version: 3.7.1121.0 - Python Software Foundation) Hidden
Python 3.7.1rc1 Utility Scripts (64-bit) (HKLM\...\{BCEA126E-FBB4-42E4-9F42-847AE2C4FB84}) (Version: 3.7.1121.0 - Python Software Foundation) Hidden
Python Launcher (HKLM-x32\...\{BBC22881-C285-4A60-971A-F2A275E57706}) (Version: 3.7.6477.0 - Python Software Foundation)
Self-service Plug-in (HKLM-x32\...\{2A7454B7-827C-45C8-8946-77230183FAAD}) (Version: 4.9.2000.16 - Citrix Systems, Inc.) Hidden
Tencent Gaming Buddy (HKLM-x32\...\MobileGamePC) (Version: 1.0.0.1 - Tencent Technology Company)
Vulkan Run Time Libraries 1.0.61.0 (HKLM\...\VulkanRT1.0.61.0) (Version: 1.0.61.0 - LunarG, Inc.) Hidden
Vulkan Run Time Libraries 1.0.65.1 (HKLM\...\VulkanRT1.0.65.1) (Version: 1.0.65.1 - LunarG, Inc.) Hidden
WinFlash (HKLM-x32\...\{8F21291E-0444-4B1D-B9F9-4370A73E346D}) (Version: 3.2.9.0 - ASUSTeK COMPUTER INC.)
WinRAR 5.61 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.61.0 - win.rar GmbH)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

ContextMenuHandlers1: [McCtxMenuFrmWrk] -> {CCA9EFD3-29ED-430A-BA6D-E6BBFF0A60C2} => c:\Program Files\mcafee\msc\McCtxMenuFrmWrk.dll [2018-10-05] (McAfee, Inc.)
ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2018-09-30] (Alexander Roshal)
ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2018-09-30] (Alexander Roshal)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-09-19] (Malwarebytes)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\Windows\System32\DriverStore\FileRepository\cui_component.inf_amd64_df4f60b1cae9b14a\igfxDTCM.dll [2018-05-28] (Intel Corporation)
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\Windows\system32\nvshext.dll [2018-03-07] (NVIDIA Corporation)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-09-19] (Malwarebytes)
ContextMenuHandlers6: [McCtxMenuFrmWrk] -> {CCA9EFD3-29ED-430A-BA6D-E6BBFF0A60C2} => c:\Program Files\mcafee\msc\McCtxMenuFrmWrk.dll [2018-10-05] (McAfee, Inc.)
ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2018-09-30] (Alexander Roshal)
ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2018-09-30] (Alexander Roshal)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0253572B-C718-495E-AEB8-B861752D1DC9} - System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [2018-01-10] (NVIDIA Corporation)
Task: {1C377B75-DD52-4822-8D54-BA8123C3973E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2018-10-03] (Google Inc.)
Task: {2B957BE9-4850-42CA-947B-91F1B680BE75} - System32\Tasks\McAfee Remediation (Prepare) => C:\Program Files\Common Files\AV\McAfee VirusScan\upgrade.exe [2018-08-18] (McAfee, Inc.)
Task: {2E9A2C84-8982-40DA-A372-1D06EEFAEA71} - System32\Tasks\ATK Package 36D18D69AFC3 => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\SimAppExec.exe [2017-11-24] (ASUSTek Computer Inc.)
Task: {42EDCFF0-6A57-41D1-BBCD-F9E2DEFF95A5} - System32\Tasks\McAfeeLogon => C:\Program Files\Common Files\mcafee\platform\McUICnt.exe [2018-07-14] (McAfee, Inc.)
Task: {590642CC-4E56-49B3-B178-5D889C4D9420} - System32\Tasks\McAfee\McAfee Auto Maintenance Task Agent
Task: {65B85F6F-35B3-4459-A179-28255D5B7B25} - System32\Tasks\Microsoft\Windows\HelloFace\FODCleanupTask => C:\Windows\System32\WinBioPlugIns\FaceFodUninstaller.exe [2018-04-12] ()
Task: {6DEEF2F1-7E7A-4602-8D56-7DE05070D6D6} - System32\Tasks\Update Checker => C:\Program Files (x86)\ASUS\ASUS Live Update\UpdateChecker.exe [2018-04-27] ()
Task: {7A5FFB40-30D9-40AF-8378-DCEDF7C46C69} - System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe [2018-01-10] (NVIDIA Corporation)
Task: {7B2FD588-09E6-419D-A137-0F21CFD04654} - System32\Tasks\McAfee\DAD.Execute.Updates => C:\Program Files\Common Files\McAfee\DynamicAppDownloader\DADUpdater.exe [2018-06-07] (McAfee, Inc.)
Task: {8E1FC546-0BE9-4297-B6E7-822D06055EBA} - System32\Tasks\McAfee\McAfee Idle Detection Task
Task: {A2E36DA8-4AA0-4FA4-955D-1D67FC6607AA} - System32\Tasks\ASUS Hello => C:\Program Files (x86)\ASUS\ASUS Hello\ASUSHelloBG.exe [2018-06-01] ()
Task: {A8A88031-DD30-46F8-8A5C-E966589AAA96} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2018-01-10] (NVIDIA Corporation)
Task: {AA2E1A04-6035-42FD-A759-9D91AB64E08F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2018-10-03] (Google Inc.)
Task: {B7B53F61-60D3-4182-869B-513E1F0CEBE6} - System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe [2018-01-10] (NVIDIA Corporation)
Task: {C70A7440-96A8-43CC-B3AD-6021BE14E197} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2018-01-10] (NVIDIA Corporation)
Task: {D01AA421-5C8C-4B10-8622-B25683265DA3} - System32\Tasks\ATK Package A22126881260 => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\SimAppExec.exe [2017-11-24] (ASUSTek Computer Inc.)
Task: {D391BC59-7A21-45DF-AE6E-D8A6B5E2953B} - System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2018-01-10] (NVIDIA Corporation)
Task: {F9784532-9D03-4F15-BB27-B761982E71B8} - System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2018-01-10] (NVIDIA Corporation)
Task: {FA81DB6D-E861-483B-BC7C-A7111BB623D3} - System32\Tasks\NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA GeForce Experience.exe [2018-01-10] (NVIDIA Corporation)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


ShortcutWithArgument: C:\Users\Thor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Anaconda3 (64-bit)\Anaconda Prompt.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation) -> "/K" C:\Users\Thor\Anaconda3\Scripts\activate.bat C:\Users\Thor\Anaconda3

==================== Loaded Modules (Whitelisted) ==============

2018-06-15 13:48 - 2018-05-13 13:05 - 000182800 _____ () C:\Windows\system32\IntelWifiIhv06.dll
2018-11-11 10:54 - 2018-10-18 08:44 - 002821952 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MwacLib.dll
2018-11-11 10:54 - 2018-10-18 08:44 - 002695360 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SelfProtectionSdk.dll
2018-06-30 02:04 - 2018-06-30 02:04 - 000896136 _____ () C:\Program Files\Common Files\McAfee\CSP\3.0.127.0\McCSPMsgBusDLL.dll
2018-06-01 02:30 - 2018-06-01 02:30 - 000642448 _____ () C:\Program Files (x86)\ASUS\ASUS Hello\ASUSHelloBG.exe
2018-04-12 05:04 - 2018-04-12 05:04 - 000491744 _____ () C:\Windows\SYSTEM32\inputhost.dll
2018-04-12 05:04 - 2018-04-12 05:04 - 000472064 _____ () C:\Windows\ShellExperiences\TileControl.dll
2018-04-12 05:04 - 2018-04-12 05:04 - 002759168 _____ () C:\Windows\ShellComponents\TaskFlowUI.dll
2018-10-10 11:39 - 2018-09-20 09:08 - 002185728 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2018-10-16 14:16 - 2018-10-16 14:16 - 000009216 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.33.41.0_x64__kzf8qxf38zg5c\ImagePipelineNative.dll
2018-10-24 09:45 - 2018-10-24 09:45 - 000060416 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.33.41.0_x64__kzf8qxf38zg5c\ChakraBridge.dll
2018-10-24 09:45 - 2018-10-24 09:45 - 000019456 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.33.41.0_x64__kzf8qxf38zg5c\SkypeProxiesAndStubs.dll
2018-10-24 09:45 - 2018-10-24 09:45 - 010978304 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.33.41.0_x64__kzf8qxf38zg5c\LibWrapper.dll
2018-10-24 09:45 - 2018-10-24 09:45 - 002810368 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.33.41.0_x64__kzf8qxf38zg5c\skypert.dll
2018-10-24 09:45 - 2018-10-24 09:45 - 000685056 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.33.41.0_x64__kzf8qxf38zg5c\RtmMvrUap.dll
2018-10-03 23:43 - 2018-10-03 23:43 - 001922224 _____ () C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.10314.31700.1000_x64__8wekyb3d8bbwe\Microsoft.Applications.Telemetry.Windows.dll
2018-10-24 09:45 - 2018-10-24 09:45 - 000183808 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.33.41.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe
2018-10-26 11:34 - 2018-10-24 02:54 - 005020504 _____ () C:\Program Files (x86)\Google\Chrome\Application\70.0.3538.77\libglesv2.dll
2018-10-26 11:34 - 2018-10-24 02:54 - 000116056 _____ () C:\Program Files (x86)\Google\Chrome\Application\70.0.3538.77\libegl.dll
2018-11-06 10:20 - 2018-11-06 10:20 - 000194048 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_11810.1001.12.0_x64__8wekyb3d8bbwe\WinStore.Preview.dll
2018-11-06 10:20 - 2018-11-06 10:20 - 002538056 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_11810.1001.12.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll
2018-11-06 10:20 - 2018-11-06 10:20 - 001754112 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_11810.1001.12.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl.dll
2018-10-03 23:31 - 2018-10-03 23:36 - 000479232 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18081.14710.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
2018-10-03 23:31 - 2018-10-03 23:36 - 069128192 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18081.14710.0_x64__8wekyb3d8bbwe\Microsoft.Photos.dll
2018-10-03 23:31 - 2018-10-03 23:36 - 002523136 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18081.14710.0_x64__8wekyb3d8bbwe\UnityEngineDelegates.dll
2018-10-03 23:31 - 2018-10-03 23:36 - 000010752 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18081.14710.0_x64__8wekyb3d8bbwe\RenderingPlugin.dll
2018-10-03 23:31 - 2018-10-03 23:36 - 003699200 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18081.14710.0_x64__8wekyb3d8bbwe\MediaEngineCSWrapper.dll
2018-10-03 23:31 - 2018-10-03 23:36 - 000009216 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18081.14710.0_x64__8wekyb3d8bbwe\ImagePipelineNative.dll
2018-10-03 23:31 - 2018-10-03 23:36 - 000035328 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18081.14710.0_x64__8wekyb3d8bbwe\WinMLWrapper.UWP.dll
2018-10-03 23:31 - 2018-10-03 23:36 - 002480640 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18081.14710.0_x64__8wekyb3d8bbwe\opencv_imgproc320.dll
2018-10-03 23:31 - 2018-10-03 23:36 - 002280960 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18081.14710.0_x64__8wekyb3d8bbwe\opencv_core320.dll
2018-10-03 23:31 - 2018-10-03 23:36 - 002283008 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18081.14710.0_x64__8wekyb3d8bbwe\TrackingDLLUWP.dll
2018-10-03 23:31 - 2018-10-03 23:36 - 014171648 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18081.14710.0_x64__8wekyb3d8bbwe\PhotosApp.Windows.dll
2018-10-03 23:31 - 2018-10-03 23:36 - 003544576 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18081.14710.0_x64__8wekyb3d8bbwe\MediaEngine.dll
2018-10-03 23:31 - 2018-10-03 23:32 - 002866176 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18081.14710.0_x64__8wekyb3d8bbwe\AppCore.Windows.dll
2018-10-03 23:31 - 2018-10-03 23:36 - 000973312 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18081.14710.0_x64__8wekyb3d8bbwe\RuntimeConfiguration.dll
2018-10-03 23:31 - 2018-10-03 23:36 - 004584960 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18081.14710.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll
2017-12-22 22:28 - 2017-12-22 22:28 - 000033168 _____ () C:\Program Files (x86)\ASUS\ASUS Hello\AsGAUpd.dll
2017-12-04 00:48 - 2017-12-04 00:48 - 001244304 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ModuleCoreService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcapexe => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeaack => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeaack.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeavfk => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeavfk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfemms => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeplk => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeplk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfetdi2k => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfetdi2k.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ModuleCoreService => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2018-04-12 05:08 - 2018-04-12 05:06 - 000000824 _____ C:\Windows\system32\Drivers\etc\hosts


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2452082275-3313010305-2762231402-1001\Control Panel\Desktop\\Wallpaper -> c:\users\thor\downloads\1377956196_attitude_quotes_wallpaper_q8pjskp.jpg
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: )
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

If an entry is included in the fixlist, it will be removed.


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{42BD3EB2-4BC6-4AEE-B72D-FAF444DEFF02}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{8A8C5127-9527-4368-84F2-C43EC409F060}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{B2DDC4FF-F8C2-476C-9F81-97B1C6FF9340}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{84858023-249A-4ABC-8AF7-89430D108E20}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{4A8AE292-4E37-4BDE-8E5D-853BD708A47C}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{1AB58F40-786B-4E20-B514-071D543C516D}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{04664582-9433-4D81-8D70-28C861177AF8}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{5A405DFA-1136-4B08-9CD2-184C46A1E3E3}] => (Allow) C:\Program Files (x86)\Common Files\Mcafee\MMSSHost\MMSSHost.exe
FirewallRules: [{CAC132D6-032C-4BD9-92A8-26AEE7F956D4}] => (Allow) C:\Program Files\Common Files\McAfee\MMSSHost\MMSSHost.exe
FirewallRules: [{9B294DD3-0DD1-4DA9-921C-F4F5358538B7}] => (Allow) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe
FirewallRules: [{0F7E97C1-C7C3-4AB1-9B7B-9DA01C4CCF9A}] => (Allow) C:\Program Files\TxGameAssistant\AppMarket\AppMarket.exe
FirewallRules: [{371DE183-4CE5-499A-892C-17E6C127BE41}] => (Allow) C:\Program Files\TxGameAssistant\AppMarket\TInst.exe
FirewallRules: [{45597AA9-E2E8-4359-B5B3-3E0A29D4E2B0}] => (Allow) C:\Program Files\TxGameAssistant\AppMarket\bugreport.exe
FirewallRules: [{4A6D696E-0208-412B-ABB7-C0CF8EBA4DBF}] => (Allow) C:\Program Files\TxGameAssistant\AppMarket\QQExternal.exe
FirewallRules: [{76389647-E7FE-496E-BF55-3A6D267AF5AF}] => (Allow) C:\Program Files\TxGameAssistant\AppMarket\GameDownload.exe
FirewallRules: [{B1DCAE6C-763B-4362-B1A2-B977E3B302CB}] => (Allow) C:\Program Files\TxGameAssistant\AppMarket\GF186\TUpdate.exe
FirewallRules: [{4C38BE41-D181-4526-9570-B98E9545DB3C}] => (Allow) C:\Program Files\TxGameAssistant\UI\AndroidEmulator.exe
FirewallRules: [{561507FD-716E-44BA-B319-EED05551F7E8}] => (Allow) C:\Program Files\TxGameAssistant\UI\adb.exe
FirewallRules: [{B5698B9F-1235-4DC5-96D7-E10DDC90E11B}] => (Allow) C:\Program Files\TxGameAssistant\UI\TInst.exe
FirewallRules: [{F98CD287-FD93-41BD-BB83-7444F3E7055E}] => (Allow) C:\Program Files\TxGameAssistant\UI\bugreport.exe
FirewallRules: [{DC2C56D2-F4B9-4133-83EB-DE9DDAF27528}] => (Allow) C:\Program Files\TxGameAssistant\UI\TxGaDcc.exe
FirewallRules: [{42F9C931-08E2-4B15-9349-54C24FD3F16B}] => (Allow) C:\Users\Thor\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{51D53696-CBB1-47C4-9215-B8A0F1E11CB5}] => (Allow) C:\Users\Thor\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{D85394FC-2926-455B-8EB9-0CF994DCF0E0}] => (Allow) C:\Users\Thor\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{2342DA99-7341-45DF-A4F0-42D7F0514A65}] => (Allow) C:\Users\Thor\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{D1F69D3B-7173-4F37-B856-240F70DAA18C}] => (Allow) C:\Users\Thor\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{21D13707-123F-4A72-BC1D-E71E7C8B2B6A}] => (Allow) C:\Users\Thor\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{FCB188D6-45A4-40D9-A168-2FD399ED02F8}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{CE2A1244-2956-4962-B038-D10C9A817B5E}] => (Allow) C:\Program Files\WindowsApps\Microsoft.Office.Desktop.Outlook_16040.11001.20074.0_x86__8wekyb3d8bbwe\Office16\OUTLOOK.exe

==================== Restore Points =========================

01-11-2018 10:42:39 Windows Update
09-11-2018 23:15:06 Scheduled Checkpoint
11-11-2018 01:14:40 Windows Modules Installer

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (11/11/2018 12:23:50 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: AUDIODG.EXE, version: 10.0.17134.137, time stamp: 0xecd85e98
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x0000000000000000
Faulting process id: 0x20b8
Faulting application start time: 0x01d47926b69e8a8a
Faulting application path: C:\Windows\system32\AUDIODG.EXE
Faulting module path: unknown
Report Id: b6b76a6c-d2b9-4aa1-977f-086989111cbe
Faulting package full name: 
Faulting package-relative application ID:

Error: (11/11/2018 12:18:39 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program RoadRedemption.exe version 5.3.5.61960 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

Process ID: 1798

Start Time: 01d47925d97c3235

Termination Time: 12397

Application Path: C:\R.G. Catalyst\Road Redemption\RoadRedemption.exe

Report Id: 269b55e2-e023-47d1-befe-0628907cc734

Faulting package full name: 

Faulting package-relative application ID:

Error: (11/10/2018 12:46:12 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program RtkUWP.exe version 0.0.0.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

Process ID: 2fc

Start Time: 01d4784dd4edad2d

Termination Time: 4294967295

Application Path: C:\Program Files\WindowsApps\RealtekSemiconductorCorp.RealtekAudioControl_1.1.133.0_x64__dt26b99r8h8gj\RtkUWP.exe

Report Id: a376a46c-82c8-41fa-a7a4-18e05e32c60a

Faulting package full name: RealtekSemiconductorCorp.RealtekAudioControl_1.1.133.0_x64__dt26b99r8h8gj

Faulting package-relative application ID: App

Error: (11/08/2018 02:52:17 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine QueryFullProcessImageNameW.  hr = 0x80070006, The handle is invalid.
.


Operation:
   Executing Asynchronous Operation

Context:
   Current State: DoSnapshotSet

Error: (11/08/2018 12:34:15 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program RtkUWP.exe version 0.0.0.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

Process ID: 30a8

Start Time: 01d4758f04322ffd

Termination Time: 4294967295

Application Path: C:\Program Files\WindowsApps\RealtekSemiconductorCorp.RealtekAudioControl_1.1.133.0_x64__dt26b99r8h8gj\RtkUWP.exe

Report Id: 526c4d77-92bf-4d20-a23e-81ca492cc822

Faulting package full name: RealtekSemiconductorCorp.RealtekAudioControl_1.1.133.0_x64__dt26b99r8h8gj

Faulting package-relative application ID: App

Error: (11/05/2018 01:15:33 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine QueryFullProcessImageNameW.  hr = 0x80070006, The handle is invalid.
.


Operation:
   Executing Asynchronous Operation

Context:
   Current State: DoSnapshotSet

Error: (11/03/2018 11:50:05 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program RtkUWP.exe version 0.0.0.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

Process ID: 4878

Start Time: 01d47332c8a84ad5

Termination Time: 4294967295

Application Path: C:\Program Files\WindowsApps\RealtekSemiconductorCorp.RealtekAudioControl_1.1.133.0_x64__dt26b99r8h8gj\RtkUWP.exe

Report Id: 18e24039-8aa2-4600-b59d-a93e9215c029

Faulting package full name: RealtekSemiconductorCorp.RealtekAudioControl_1.1.133.0_x64__dt26b99r8h8gj

Faulting package-relative application ID: App

Error: (11/02/2018 10:45:57 AM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine QueryFullProcessImageNameW.  hr = 0x80070006, The handle is invalid.
.


Operation:
   Executing Asynchronous Operation

Context:
   Current State: DoSnapshotSet


System errors:
=============
Error: (11/11/2018 11:32:23 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 and APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (11/11/2018 11:30:58 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 and APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (11/11/2018 11:20:19 AM) (Source: DCOM) (EventID: 10016) (User: LAPTOP-4H9BO7BO)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 and APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 to the user LAPTOP-4H9BO7BO\Thor SID (S-1-5-21-2452082275-3313010305-2762231402-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (11/11/2018 11:19:19 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (11/11/2018 11:18:59 AM) (Source: DCOM) (EventID: 10016) (User: LAPTOP-4H9BO7BO)
Description: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscCloudBackupProvider
 and APPID 
Unavailable
 to the user LAPTOP-4H9BO7BO\Thor SID (S-1-5-21-2452082275-3313010305-2762231402-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (11/11/2018 11:17:32 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (11/11/2018 11:17:32 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (11/11/2018 11:17:32 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.


Windows Defender:
===================================
Date: 2018-10-03 23:13:31.546
Description: 
Windows Defender Antivirus has encountered an error trying to update signatures.
New Signature Version: 
Previous Signature Version: 1.277.515.0
Update Source: Microsoft Update Server
Signature Type: AntiVirus
Update Type: Full
Current Engine Version: 
Previous Engine Version: 1.1.15300.6
Error code: 0x80240016
Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support. 

CodeIntegrity:
===================================

Date: 2018-11-11 11:18:12.593
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.

Date: 2018-11-11 11:18:12.593
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.

Date: 2018-10-18 01:12:05.697
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\SaferVPNNetfilter2.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2018-10-18 01:09:12.535
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\SaferVPNNetfilter2.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2018-10-17 10:53:10.861
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\SaferVPNNetfilter2.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2018-10-17 10:50:18.773
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\SaferVPNNetfilter2.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2018-10-17 10:11:09.048
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\SaferVPNNetfilter2.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2018-10-17 10:10:51.190
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\SaferVPNNetfilter2.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-8250U CPU @ 1.60GHz
Percentage of memory in use: 49%
Total physical RAM: 8070.11 MB
Available physical RAM: 4070.02 MB
Total Virtual: 9350.11 MB
Available Virtual: 5306.94 MB

==================== Drives ================================

Drive ? (OS) (Fixed) (Total:930.46 GB) (Free:767.55 GB) NTFS

\\?\Volume{2d588acd-7c4f-444f-8d76-cc45bf96ccde}\ (RECOVERY) (Fixed) (Total:0.78 GB) (Free:0.36 GB) NTFS
\\?\Volume{6839f4b2-c13c-4e12-9c06-a06020f5a5be}\ (SYSTEM) (Fixed) (Total:0.25 GB) (Free:0.23 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 8FB20D6F)

Partition: GPT.

==================== End of Addition.txt ============================

Link to post
Share on other sites

I do not see any obvious Malware or Infection in your logs...

Going back to your original thread opening response:

Quote

I installed a file on my WIN 10 machine today. After installing it is not opening , and when trying to delete it from Control Panel I get an error runtime error could not call proc (at 399:4752)..

What file did you install, what is the navigational address...

Thanks,

Kevin...

Link to post
Share on other sites

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Thanks

 

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.