Potential Malware?

rstew2207 · November 1, 2020

Hi everyone!

I'm in a bit of a panic here. I have windows 8.1. Windows Defender is running scans everyday and hasn't detected anything (no pop up) and Malwarebytes hasn't either but today I got a redirect when searching something on google stating something like " Our systems have detected unusual traffic from your network" with a captcha. It was my ip address and nothing else. Scared I went to run a Microsoft defender scan only to be met with a " preliminary scan results show that malicious or potentially unwanted software might exist" but there's no quarantined items, nothing comes up. I ran a malwarebytes (free version) scan and absolutely nothing came up, i even included rookits. I haven't installed anything or downloaded anything suspicious. I don't recall visiting any suspicious websites. I've ran multiple MD and Malwarebytes scans and none show anything. What should do?

Thanks in advance.

kevinf80 · November 1, 2020

Hello rstew2207 and welcome to Malwarebytes,

Run the following:

Download Farbar Recovery Scan Tool and save it to your desktop.

Alternative download option: http://www.techspot.com/downloads/6731-farbar-recovery-scan-tool.html

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

If your security alerts to FRST either, accept the alert or turn your security off to allow FRST to run. It is not malicious or infected in any way...

Be aware FRST must be run from an account with Administrator status...

Double-click to run it. When the tool opens click Yes to disclaimer.(Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.)
Make sure Addition.txt is checkmarked under "Optional scans"
Press Scan button to run the tool....
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The tool will also make a log named (Addition.txt) Please attach that log to your reply.

Thank you,

Kevin

rstew2207 · November 1, 2020

10 minutes ago, kevinf80 said:

Hello rstew2207 and welcome to Malwarebytes,

Run the following:

Download Farbar Recovery Scan Tool and save it to your desktop.

Alternative download option: http://www.techspot.com/downloads/6731-farbar-recovery-scan-tool.html

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

If your security alerts to FRST either, accept the alert or turn your security off to allow FRST to run. It is not malicious or infected in any way...

Be aware FRST must be run from an account with Administrator status...

Double-click to run it. When the tool opens click Yes to disclaimer.(Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.)

Make sure Addition.txt is checkmarked under "Optional scans"

Press Scan button to run the tool....

It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.

The tool will also make a log named (Addition.txt) Please attach that log to your reply.

Thank you,

Kevin

Hi Kevin, thank you for assisting me. Here is the file.

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 24-10-2020
Ran by Rita (administrator) on CALI (TOSHIBA SATELLITE L50-B) (01-11-2020 18:30:24)
Running from C:\Users\Rita\Downloads
Loaded Profiles: Rita & Rita Work
Platform: Windows 8.1 (Update) (X64) Language: Português (Portugal)
Default browser: Chrome
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Adobe Inc. -> Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe
(Adobe Inc. -> Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
(Avast Software s.r.o. -> AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1065.0\AvastBrowserCrashHandler.exe
(Avast Software s.r.o. -> AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1065.0\AvastBrowserCrashHandler64.exe
(Electronic Arts, Inc. -> Electronic Arts) C:\Program Files (x86)\Origin\OriginWebHelperService.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe <21>
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.36.32\GoogleCrashHandler.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.36.32\GoogleCrashHandler64.exe
(Intel Corporation -> Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel Corporation -> Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Intel(R) pGFX -> ) C:\Windows\System32\igfxTray.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\igfxHK.exe
(Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\wlanext.exe
(SurfRight B.V. -> SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe
(SurfRight B.V. -> SurfRight B.V.) C:\Users\Rita\Downloads\HitmanPro_x64.exe

==================== Registry (Whitelisted) ===================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [AdobeGCInvoker-1.0] => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [3402832 2020-09-23] (Adobe Inc. -> Adobe Systems, Incorporated)
HKLM\...\Run: [WindowsDefender] => "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
HKU\S-1-5-21-1423373995-1004855960-1227593991-1001\...\Run: [Spotify] => C:\Users\Rita\AppData\Roaming\Spotify\Spotify.exe [22941928 2020-10-25] (Spotify AB -> Spotify Ltd)
HKU\S-1-5-21-1423373995-1004855960-1227593991-1001\...\Run: [CCXProcess] => "C:\Program Files (x86)\Adobe\Adobe Creative Cloud Experience\CCXProcess.exe"
HKU\S-1-5-21-1423373995-1004855960-1227593991-1001\...\MountPoints2: {5ec93414-da1c-11e9-827e-a088699b1d05} - "D:\autorun.exe" /autorun
HKLM\...\Windows x64\Print Processors\Canon MP280 series Print Processor: C:\Windows\System32\spool\prtprocs\x64\CNMPDAA.DLL [30208 2012-03-14] (Microsoft Windows Hardware Compatibility Publisher -> CANON INC.)
HKLM\...\Print\Monitors\Canon BJ Language Monitor MP280 series: C:\Windows\system32\CNMLMAA.DLL [385024 2012-03-14] (Microsoft Windows Hardware Compatibility Publisher -> CANON INC.)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe [2020-10-22] (Google LLC -> Google LLC)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{A8504530-742B-42BC-895D-2BAD6406F698}] -> C:\Program Files (x86)\AVAST Software\Browser\Application\86.0.6394.76\Installer\chrmstp.exe [2020-11-01] (Avast Software s.r.o. -> AVAST Software)
GroupPolicy: Restriction ? <==== ATTENTION
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION

==================== Scheduled Tasks (Whitelisted) ============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {26629E70-3A4C-459E-BD0C-F1E28BF3C6B4} - System32\Tasks\AdobeGCInvoker-1.0 => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [3402832 2020-09-23] (Adobe Inc. -> Adobe Systems, Incorporated)
Task: {2BC71FE0-6F69-4699-BD6B-2A3E8BC31023} - System32\Tasks\Antivirus Emergency Update => C:\Program Files\AVG\Antivirus\AvEmUpdate.exe
Task: {3C4CB13B-9859-4EFB-ACC9-AB5F34ABA04F} - System32\Tasks\AvastUpdateTaskMachineUA => C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [194200 2020-11-01] (Avast Software s.r.o. -> AVAST Software)
Task: {5F22B91B-2894-4216-8AB8-BF0E1B7045CC} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\Program Files\Windows Defender\\MpCmdRun.exe [410792 2017-01-12] (Microsoft Corporation -> Microsoft Corporation)
Task: {70318ED9-945C-458D-B98C-1107D601B472} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153168 2018-10-02] (Google Inc -> Google Inc.)
Task: {7C225AFC-289A-4F2E-86DF-2F966B39BD2C} - System32\Tasks\AVG\Overseer => C:\Program Files\Common Files\AVG\Overseer\overseer.exe
Task: {970C584F-1842-4BCD-9E17-16782872F129} - System32\Tasks\AdwCleaner_onReboot => C:\Users\Rita\Downloads\AdwCleaner.exe [8447152 2020-11-01] (Malwarebytes Inc -> Malwarebytes)
Task: {979813F0-ADE7-4AB3-B2A6-4A8751D92847} - System32\Tasks\Avast Secure Browser Heartbeat Task (Logon) => C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe [2117880 2020-10-13] (Avast Software s.r.o. -> AVAST Software)
Task: {A31B6D28-F033-493E-9C58-88F3B5D5AAD8} - System32\Tasks\AvastUpdateTaskMachineCore => C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [194200 2020-11-01] (Avast Software s.r.o. -> AVAST Software)
Task: {E67EAF63-EB0D-438B-8DA3-2E4BFA90631A} - System32\Tasks\Avast Secure Browser Heartbeat Task (Hourly) => C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe [2117880 2020-10-13] (Avast Software s.r.o. -> AVAST Software)
Task: {EF1621E5-8466-495C-9839-159CEA489FF9} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\Program Files\Windows Defender\\MpCmdRun.exe [410792 2017-01-12] (Microsoft Corporation -> Microsoft Corporation)
Task: {F1C205C4-1B52-4991-8368-313D3EB7B0AB} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153168 2018-10-02] (Google Inc -> Google Inc.)
Task: {F75C9AFA-6E15-4BB3-811C-77206021C2A0} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\Program Files\Windows Defender\\MpCmdRun.exe [410792 2017-01-12] (Microsoft Corporation -> Microsoft Corporation)
Task: {F9ECEA70-B2AC-4163-9C94-567886FB7D8D} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\Program Files\Windows Defender\\MpCmdRun.exe [410792 2017-01-12] (Microsoft Corporation -> Microsoft Corporation)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{C67FECE2-A0BC-4F05-A8D8-7A3754E0BB0B}: [DhcpNameServer] 192.168.1.1

Edge:
======
Edge DefaultProfile: Default
Edge Profile: C:\Users\Rita\AppData\Local\Microsoft\Edge\User Data\Default [2020-07-20]

FireFox:
========
FF Plugin: @videolan.org/vlc,version=3.0.10 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2020-04-23] (VideoLAN -> VideoLAN)
FF Plugin-x32: @update.avastbrowser.com/Avast Browser;version=3 -> C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1065.0\npAvastBrowserUpdate3.dll [2020-11-01] (Avast Software s.r.o. -> AVAST Software)
FF Plugin-x32: @update.avastbrowser.com/Avast Browser;version=9 -> C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1065.0\npAvastBrowserUpdate3.dll [2020-11-01] (Avast Software s.r.o. -> AVAST Software)
FF Plugin HKU\S-1-5-21-1423373995-1004855960-1227593991-1001: SkypeForBusinessPlugin-16.2 -> C:\Users\Rita\AppData\Local\Microsoft\SkypeForBusinessPlugin\16.2.0.511\npGatewayNpapi.dll [2019-08-03] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin HKU\S-1-5-21-1423373995-1004855960-1227593991-1001: SkypeForBusinessPlugin64-16.2 -> C:\Users\Rita\AppData\Local\Microsoft\SkypeForBusinessPlugin\16.2.0.511\npGatewayNpapi-x64.dll [2019-08-03] (Microsoft Corporation -> Microsoft Corporation)

Chrome:
=======
CHR Profile: C:\Users\Rita\AppData\Local\Google\Chrome\User Data\Default [2020-11-01]
CHR Notifications: Default -> hxxps://catracalivre.com.br; hxxps://mail.google.com
CHR Extension: (Slides) - C:\Users\Rita\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2018-10-02]
CHR Extension: (Docs) - C:\Users\Rita\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2018-10-02]
CHR Extension: (Google Drive) - C:\Users\Rita\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2020-11-01]
CHR Extension: (WOT Web of Trust, Website Reputation Ratings) - C:\Users\Rita\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhmmomiinigofkjcapegjjndpbikblnp [2020-11-01]
CHR Extension: (YouTube) - C:\Users\Rita\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2018-10-02]
CHR Extension: (Sheets) - C:\Users\Rita\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2018-10-02]
CHR Extension: (Google Docs Offline) - C:\Users\Rita\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2020-11-01]
CHR Extension: (AdBlock — best ad blocker) - C:\Users\Rita\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2020-11-01]
CHR Extension: (Tailwind Publisher) - C:\Users\Rita\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkbhgdhhefdphpikedbinecandoigdel [2020-11-01]
CHR Extension: (Pinterest Save Button) - C:\Users\Rita\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpdjojdkbbmdfjfahjcgigfpmkopogic [2020-10-06]
CHR Extension: (Grammarly for Chrome) - C:\Users\Rita\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbfnbcaeplbcioakkpcpgfkobkghlhen [2020-11-01]
CHR Extension: (Iron Man-Material Design) - C:\Users\Rita\AppData\Local\Google\Chrome\User Data\Default\Extensions\nekeenfmlfhgoaojceionblcpbbjmnpk [2019-03-27]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Rita\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2019-10-06]
CHR Extension: (Gmail) - C:\Users\Rita\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2020-11-01]
CHR Extension: (Chrome Media Router) - C:\Users\Rita\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2020-10-19]

==================== Services (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AGMService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe [3739728 2020-09-23] (Adobe Inc. -> Adobe Systems, Incorporated)
R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [3511376 2020-09-23] (Adobe Inc. -> Adobe Systems, Incorporated)
S2 avast; C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [194200 2020-11-01] (Avast Software s.r.o. -> AVAST Software)
S3 avastm; C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [194200 2020-11-01] (Avast Software s.r.o. -> AVAST Software)
S3 AvastSecureBrowserElevationService; C:\Program Files (x86)\AVAST Software\Browser\Application\86.0.6394.76\elevation_service.exe [1348304 2020-10-13] (Avast Software s.r.o. -> AVAST Software)
R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [162392 2020-11-01] (SurfRight B.V. -> SurfRight B.V.)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [7265328 2020-11-01] (Malwarebytes Inc -> Malwarebytes)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2329392 2019-06-11] (Electronic Arts, Inc. -> Electronic Arts)
R2 Origin Web Helper Service; C:\Program Files (x86)\Origin\OriginWebHelperService.exe [3203888 2019-06-11] (Electronic Arts, Inc. -> Electronic Arts)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [361824 2017-01-12] (Microsoft Corporation -> Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [119872 2017-01-12] (Microsoft Corporation -> Microsoft Corporation)

===================== Drivers (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [153312 2020-11-01] (Malwarebytes Corporation -> Malwarebytes)
R3 hitmanpro37; C:\Windows\system32\drivers\hitmanpro37.sys [57728 2020-11-01] (SurfRight B.V. -> )
R2 MBAMChameleon; C:\Windows\System32\Drivers\MbamChameleon.sys [217600 2020-11-01] (Malwarebytes Inc -> Malwarebytes)
R3 MBAMFarflt; C:\Windows\System32\DRIVERS\farflt.sys [197792 2020-11-01] (Malwarebytes Inc -> Malwarebytes)
R3 MBAMProtection; C:\Windows\system32\DRIVERS\mbam.sys [74936 2020-11-01] (Malwarebytes Inc -> Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [248968 2020-11-01] (Malwarebytes Inc -> Malwarebytes)
R3 MBAMWebProtection; C:\Windows\system32\DRIVERS\mwac.sys [134304 2020-11-01] (Malwarebytes Inc -> Malwarebytes)
R3 MpKsl4798acf0; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{8BFAC00F-5EB1-4437-9C1F-E9EDC5BA1942}\MpKslDrv.sys [47336 2020-11-01] (Microsoft Windows -> Microsoft Corporation)
U5 NdisImPlatform; C:\Windows\System32\Drivers\NdisImPlatform.sys [126464 2014-11-21] (Microsoft Windows -> Microsoft Corporation)
S3 qcfilter; C:\Windows\System32\drivers\qcusbfilter.sys [49208 2017-03-15] (Microsoft Windows Hardware Compatibility Publisher -> QUALCOMM Incorporated)
S3 qcusbnet; C:\Windows\system32\DRIVERS\qcusbnet.sys [428600 2017-03-15] (Microsoft Windows Hardware Compatibility Publisher -> QUALCOMM Incorporated)
R3 QIOMem; C:\Windows\System32\drivers\QIOMem.sys [14000 2013-08-22] (WDKTestCert 1,130202426583431586 -> TOSHIBA)
R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [293592 2014-02-11] (Realtek Semiconductor Corp -> Realtek Semiconductor Corp.)
S3 tapnordvpn; C:\Windows\system32\DRIVERS\tapnordvpn.sys [35592 2018-07-24] (TEFINCOM S.A. -> The OpenVPN Project)
R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [32624 2013-08-19] (TOSHIBA CORPORATION -> Windows (R) Win 7 DDK provider)
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [46600 2017-02-10] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [274776 2017-01-12] (Microsoft Windows -> Microsoft Corporation)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [117592 2017-01-12] (Microsoft Windows -> Microsoft Corporation)
U3 aswbdisk; no ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One month (created) ===================

(If an entry is included in the fixlist, the file/folder will be moved.)

2020-11-01 18:30 - 2020-11-01 18:32 - 000016798 _____ C:\Users\Rita\Downloads\FRST.txt
2020-11-01 18:29 - 2020-11-01 18:31 - 000000000 ____D C:\FRST
2020-11-01 18:28 - 2020-11-01 18:28 - 002299904 _____ (Farbar) C:\Users\Rita\Downloads\FRST64.exe
2020-11-01 18:22 - 2020-11-01 18:22 - 011431000 _____ (SurfRight B.V.) C:\Users\Rita\Downloads\HitmanPro_x64.exe
2020-11-01 18:22 - 2020-11-01 18:22 - 000057728 _____ C:\Windows\system32\Drivers\hitmanpro37.sys
2020-11-01 18:22 - 2020-11-01 18:22 - 000001869 _____ C:\Users\Public\Desktop\HitmanPro.lnk
2020-11-01 18:22 - 2020-11-01 18:22 - 000001869 _____ C:\ProgramData\Desktop\HitmanPro.lnk
2020-11-01 18:22 - 2020-11-01 18:22 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
2020-11-01 18:22 - 2020-11-01 18:22 - 000000000 ____D C:\ProgramData\HitmanPro
2020-11-01 18:22 - 2020-11-01 18:22 - 000000000 ____D C:\Program Files\HitmanPro
2020-11-01 18:12 - 2020-11-01 18:12 - 000074936 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2020-11-01 18:11 - 2020-11-01 18:11 - 000217600 _____ (Malwarebytes) C:\Windows\system32\Drivers\MbamChameleon.sys
2020-11-01 18:11 - 2020-11-01 18:11 - 000197792 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
2020-11-01 18:11 - 2020-11-01 18:11 - 000134304 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
2020-11-01 18:08 - 2020-11-01 18:08 - 008447152 _____ (Malwarebytes) C:\Users\Rita\Downloads\AdwCleaner (1).exe
2020-11-01 18:07 - 2020-11-01 18:07 - 000003088 _____ C:\Windows\system32\Tasks\AdwCleaner_onReboot
2020-11-01 18:04 - 2020-11-01 18:04 - 008447152 _____ (Malwarebytes) C:\Users\Rita\Downloads\AdwCleaner.exe
2020-11-01 17:25 - 2020-11-01 17:35 - 000248968 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys
2020-11-01 17:20 - 2020-11-01 17:28 - 000422580 _____ C:\Windows\ntbtlog.txt
2020-11-01 16:52 - 2020-11-01 16:52 - 000288440 _____ C:\Windows\Minidump\110120-65156-01.dmp
2020-11-01 16:28 - 2020-11-01 16:29 - 000288520 _____ C:\Windows\Minidump\110120-45500-01.dmp
2020-11-01 16:06 - 2020-11-01 16:06 - 000003732 _____ C:\Windows\system32\Tasks\Avast Secure Browser Heartbeat Task (Hourly)
2020-11-01 16:06 - 2020-11-01 16:06 - 000003150 _____ C:\Windows\system32\Tasks\Avast Secure Browser Heartbeat Task (Logon)
2020-11-01 16:06 - 2020-11-01 16:06 - 000002513 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast Secure Browser.lnk
2020-11-01 16:06 - 2020-11-01 16:06 - 000002478 _____ C:\Users\Public\Desktop\Avast Secure Browser.lnk
2020-11-01 16:06 - 2020-11-01 16:06 - 000002478 _____ C:\ProgramData\Desktop\Avast Secure Browser.lnk
2020-11-01 16:06 - 2020-11-01 16:06 - 000000000 ____D C:\Users\Rita\AppData\Local\AVAST Software
2020-11-01 16:05 - 2020-11-01 16:05 - 000003482 _____ C:\Windows\system32\Tasks\AvastUpdateTaskMachineUA
2020-11-01 16:05 - 2020-11-01 16:05 - 000003354 _____ C:\Windows\system32\Tasks\AvastUpdateTaskMachineCore
2020-11-01 16:05 - 2020-11-01 16:05 - 000000000 ____D C:\Program Files (x86)\AVAST Software
2020-11-01 15:37 - 2020-11-01 16:51 - 000000000 ____D C:\ProgramData\Avast Software
2020-11-01 15:30 - 2020-11-01 15:30 - 000000000 ____D C:\Windows\system32\Tasks\AVG
2020-11-01 15:29 - 2020-11-01 16:33 - 000004162 _____ C:\Windows\system32\Tasks\Antivirus Emergency Update
2020-11-01 15:24 - 2020-11-01 17:33 - 000000000 ____D C:\ProgramData\AVG
2020-11-01 15:19 - 2020-11-01 15:19 - 000001976 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes.lnk
2020-10-24 21:23 - 2020-10-24 21:23 - 000009746 _____ C:\Users\Rita\AppData\Local\recently-used.xbel
2020-10-14 10:47 - 2020-09-30 07:20 - 000135240 _____ (Microsoft Corporation) C:\Windows\system32\gpapi.dll
2020-10-14 10:47 - 2020-09-30 03:04 - 003332608 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2020-10-14 10:47 - 2020-09-30 02:56 - 000445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2020-10-14 10:47 - 2020-09-30 02:48 - 001118720 _____ (Microsoft Corporation) C:\Windows\system32\gpedit.dll
2020-10-14 10:47 - 2020-09-30 02:15 - 001381888 _____ (Microsoft Corporation) C:\Windows\system32\gpsvc.dll
2020-10-14 10:47 - 2020-09-29 05:32 - 000115616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gpapi.dll
2020-10-14 10:47 - 2020-09-29 04:11 - 003642368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2020-10-14 10:47 - 2020-09-29 04:00 - 000324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2020-10-14 10:47 - 2020-09-29 03:54 - 001067520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gpedit.dll
2020-10-14 10:47 - 2020-09-24 06:47 - 000120832 _____ (Microsoft Corporation) C:\Windows\system32\userenv.dll
2020-10-14 10:47 - 2020-09-24 06:43 - 002535968 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2020-10-14 10:47 - 2020-09-24 06:36 - 007363320 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2020-10-14 10:47 - 2020-09-24 06:36 - 002173392 _____ (Microsoft Corporation) C:\Windows\system32\combase.dll
2020-10-14 10:47 - 2020-09-24 06:01 - 025759232 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2020-10-14 10:47 - 2020-09-24 05:01 - 000098104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\userenv.dll
2020-10-14 10:47 - 2020-09-24 05:00 - 001902240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2020-10-14 10:47 - 2020-09-24 04:53 - 001561296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\combase.dll
2020-10-14 10:47 - 2020-09-24 04:28 - 002914304 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2020-10-14 10:47 - 2020-09-24 04:25 - 000581120 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2020-10-14 10:47 - 2020-09-24 04:25 - 000088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2020-10-14 10:47 - 2020-09-24 04:16 - 005500416 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2020-10-14 10:47 - 2020-09-24 04:14 - 000785408 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2020-10-14 10:47 - 2020-09-24 04:13 - 020293632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2020-10-14 10:47 - 2020-09-24 04:04 - 000517120 _____ (Microsoft Corporation) C:\Windows\system32\cmdial32.dll
2020-10-14 10:47 - 2020-09-24 03:57 - 000498176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2020-10-14 10:47 - 2020-09-24 03:55 - 000064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2020-10-14 10:47 - 2020-09-24 03:54 - 002306048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2020-10-14 10:47 - 2020-09-24 03:53 - 000477696 _____ (Microsoft Corporation) C:\Windows\system32\puiobj.dll
2020-10-14 10:47 - 2020-09-24 03:53 - 000092672 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2020-10-14 10:47 - 2020-09-24 03:52 - 000145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2020-10-14 10:47 - 2020-09-24 03:51 - 000315904 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2020-10-14 10:47 - 2020-09-24 03:47 - 001033216 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2020-10-14 10:47 - 2020-09-24 03:47 - 000653824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2020-10-14 10:47 - 2020-09-24 03:41 - 000262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2020-10-14 10:47 - 2020-09-24 03:40 - 015494144 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2020-10-14 10:47 - 2020-09-24 03:39 - 000728064 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2020-10-14 10:47 - 2020-09-24 03:39 - 000484352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cmdial32.dll
2020-10-14 10:47 - 2020-09-24 03:39 - 000381952 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2020-10-14 10:47 - 2020-09-24 03:38 - 000809472 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2020-10-14 10:47 - 2020-09-24 03:37 - 002132992 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2020-10-14 10:47 - 2020-09-24 03:33 - 003631616 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll
2020-10-14 10:47 - 2020-09-24 03:32 - 000392192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssph.dll
2020-10-14 10:47 - 2020-09-24 03:32 - 000272896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
2020-10-14 10:47 - 2020-09-24 03:31 - 000076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2020-10-14 10:47 - 2020-09-24 03:30 - 000279552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2020-10-14 10:47 - 2020-09-24 03:30 - 000128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2020-10-14 10:47 - 2020-09-24 03:29 - 002750464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tquery.dll
2020-10-14 10:47 - 2020-09-24 03:27 - 000880640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2020-10-14 10:47 - 2020-09-24 03:27 - 000230400 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2020-10-14 10:47 - 2020-09-24 03:26 - 004859904 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2020-10-14 10:47 - 2020-09-24 03:26 - 000699392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssvp.dll
2020-10-14 10:47 - 2020-09-24 03:26 - 000110080 _____ (Microsoft Corporation) C:\Windows\system32\fdSSDP.dll
2020-10-14 10:47 - 2020-09-24 03:25 - 004112384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2020-10-14 10:47 - 2020-09-24 03:23 - 000230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2020-10-14 10:47 - 2020-09-24 03:22 - 000696320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2020-10-14 10:47 - 2020-09-24 03:22 - 000333312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2020-10-14 10:47 - 2020-09-24 03:21 - 002058752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2020-10-14 10:47 - 2020-09-24 03:20 - 013872640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2020-10-14 10:47 - 2020-09-24 03:18 - 000172032 _____ (Microsoft Corporation) C:\Windows\system32\fdWSD.dll
2020-10-14 10:47 - 2020-09-24 03:15 - 001566720 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2020-10-14 10:47 - 2020-09-24 03:13 - 000092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fdSSDP.dll
2020-10-14 10:47 - 2020-09-24 03:10 - 000133120 _____ (Microsoft Corporation) C:\Windows\system32\mssprxy.dll
2020-10-14 10:47 - 2020-09-24 03:08 - 000905728 _____ (Microsoft Corporation) C:\Windows\system32\SearchIndexer.exe
2020-10-14 10:47 - 2020-09-24 03:08 - 000145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fdWSD.dll
2020-10-14 10:47 - 2020-09-24 03:07 - 002551808 _____ (Microsoft Corporation) C:\Windows\system32\mssrch.dll
2020-10-14 10:47 - 2020-09-24 03:07 - 001099264 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2020-10-14 10:47 - 2020-09-24 03:06 - 000866304 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2020-10-14 10:47 - 2020-09-24 03:04 - 004387840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2020-10-14 10:47 - 2020-09-24 03:03 - 000801280 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2020-10-14 10:47 - 2020-09-24 03:01 - 001920512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssrch.dll
2020-10-14 10:47 - 2020-09-24 03:00 - 001341952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2020-10-14 10:47 - 2020-09-24 03:00 - 000711168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchIndexer.exe
2020-10-14 10:47 - 2020-09-24 02:59 - 000710656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2020-10-14 10:47 - 2020-09-24 02:55 - 003826176 _____ (Microsoft Corporation) C:\Windows\system32\rdpcore.dll
2020-10-14 10:47 - 2020-09-24 02:55 - 003551744 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2020-10-14 10:47 - 2020-09-24 02:53 - 001684992 _____ (Microsoft Corporation) C:\Windows\system32\workfolderssvc.dll
2020-10-14 10:47 - 2020-09-24 02:52 - 003278848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpcore.dll
2020-10-14 10:47 - 2020-09-15 07:06 - 001311776 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2020-10-14 10:47 - 2020-09-15 06:57 - 000325320 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2020-10-14 10:47 - 2020-09-15 05:24 - 000245752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2020-10-14 10:47 - 2020-09-15 04:49 - 000281088 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbt.sys
2020-10-14 10:47 - 2020-09-15 04:15 - 001040384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2020-10-14 10:47 - 2020-09-11 16:31 - 000367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\es.dll
2020-10-14 10:47 - 2020-09-11 09:39 - 000288768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ks.sys
2020-10-14 10:47 - 2020-09-11 08:23 - 000516608 _____ (Microsoft Corporation) C:\Windows\system32\es.dll
2020-10-14 10:47 - 2020-09-10 23:49 - 001370680 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2020-10-14 10:47 - 2020-09-10 21:27 - 000564224 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2020-10-14 10:47 - 2020-09-10 20:51 - 000642560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll
2020-10-14 10:47 - 2020-09-10 20:51 - 000005632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll
2020-10-14 10:47 - 2020-09-10 20:20 - 001757184 _____ (Microsoft Corporation) C:\Windows\system32\GdiPlus.dll
2020-10-14 10:47 - 2020-09-10 20:14 - 002349056 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2020-10-14 10:47 - 2020-09-10 20:11 - 001088512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2020-10-14 10:47 - 2020-09-10 20:02 - 001495040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GdiPlus.dll
2020-10-14 10:47 - 2020-09-10 19:56 - 001551360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2020-10-14 10:47 - 2020-09-10 01:24 - 000353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrd3x40.dll
2020-10-06 19:31 - 2020-11-01 17:54 - 000000000 ____D C:\Users\Rita\AppData\Roaming\Zoom

==================== One month (modified) ==================

(If an entry is included in the fixlist, the file/folder will be moved.)

2020-11-01 18:28 - 2018-10-02 15:04 - 000003598 _____ C:\Windows\system32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1423373995-1004855960-1227593991-1001
2020-11-01 18:18 - 2018-10-02 15:51 - 000003922 _____ C:\Windows\system32\Tasks\User_Feed_Synchronization-{C703184D-32CD-4421-ADA6-45EB4E27C911}
2020-11-01 18:10 - 2018-10-08 21:25 - 000000000 __SHD C:\Users\Rita\IntelGraphicsProfiles
2020-11-01 18:10 - 2013-08-22 14:45 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2020-11-01 18:07 - 2018-10-02 16:01 - 000000000 ____D C:\AdwCleaner
2020-11-01 17:46 - 2019-10-29 00:29 - 000000000 ____D C:\Users\Rita Work
2020-11-01 17:38 - 2020-07-17 19:12 - 000000000 ____D C:\Users\Rita\AppData\Local\CrashDumps
2020-11-01 17:12 - 2013-08-22 13:36 - 000000000 ____D C:\Windows\Inf
2020-11-01 17:11 - 2018-10-02 14:58 - 000000000 ____D C:\Users\Rita
2020-11-01 16:52 - 2019-02-12 15:38 - 000000000 ____D C:\Windows\Minidump
2020-11-01 16:51 - 2019-02-12 15:38 - 475126123 _____ C:\Windows\MEMORY.DMP
2020-11-01 16:18 - 2014-11-21 03:49 - 001731048 _____ C:\Windows\system32\PerfStringBackup.INI
2020-11-01 16:18 - 2014-11-21 03:05 - 000754718 _____ C:\Windows\system32\prfh0816.dat
2020-11-01 16:18 - 2014-11-21 03:05 - 000156386 _____ C:\Windows\system32\prfc0816.dat
2020-11-01 15:19 - 2019-08-31 00:10 - 000001964 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2020-11-01 15:19 - 2019-08-31 00:10 - 000001964 _____ C:\ProgramData\Desktop\Malwarebytes.lnk
2020-11-01 15:16 - 2019-08-31 00:10 - 000153312 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbae64.sys
2020-10-31 12:58 - 2019-10-03 11:50 - 000000000 ___HD C:\Users\Public\Documents\AdobeGCData
2020-10-31 12:58 - 2019-10-03 11:50 - 000000000 ___HD C:\ProgramData\Documents\AdobeGCData
2020-10-29 22:06 - 2018-10-04 19:22 - 000795000 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2020-10-25 22:18 - 2018-12-25 00:46 - 000000000 ____D C:\Users\Rita\AppData\Local\Spotify
2020-10-25 22:16 - 2018-12-25 00:45 - 000000000 ____D C:\Users\Rita\AppData\Roaming\Spotify
2020-10-24 21:31 - 2018-10-23 20:58 - 000000000 ____D C:\Users\Rita\AppData\Local\gtk-2.0
2020-10-24 21:31 - 2018-10-23 20:47 - 000000000 ____D C:\Users\Rita\AppData\Local\babl-0.1
2020-10-22 11:20 - 2018-10-02 15:53 - 000002240 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2020-10-22 11:20 - 2018-10-02 15:53 - 000002199 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2020-10-22 11:20 - 2018-10-02 15:53 - 000002199 _____ C:\ProgramData\Desktop\Google Chrome.lnk
2020-10-21 14:08 - 2013-08-22 15:36 - 000000000 ____D C:\Windows\rescache
2020-10-19 20:24 - 2020-05-07 17:43 - 000000000 ____D C:\Users\Rita\AppData\Roaming\vlc
2020-10-19 11:17 - 2013-08-22 13:25 - 000262144 ___SH C:\Windows\system32\config\BBI
2020-10-19 11:15 - 2013-08-22 15:36 - 000000000 ___RD C:\Windows\ToastData
2020-10-15 19:40 - 2018-10-02 15:52 - 000003442 _____ C:\Windows\system32\Tasks\GoogleUpdateTaskMachineUA
2020-10-15 19:40 - 2018-10-02 15:52 - 000003314 _____ C:\Windows\system32\Tasks\GoogleUpdateTaskMachineCore
2020-10-14 11:09 - 2013-08-22 15:20 - 000000000 ____D C:\Windows\CbsTemp
2020-10-08 21:20 - 2019-10-23 20:41 - 000003450 _____ C:\Windows\system32\Tasks\AdobeGCInvoker-1.0
2020-10-08 19:34 - 2019-10-29 00:39 - 000003600 _____ C:\Windows\system32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1423373995-1004855960-1227593991-1003
2020-10-05 17:58 - 2013-08-22 15:36 - 000000000 ___HD C:\Program Files\WindowsApps
2020-10-05 17:58 - 2013-08-22 15:36 - 000000000 ____D C:\Windows\AppReadiness
2020-10-05 14:48 - 2019-10-29 00:30 - 000000000 __SHD C:\Users\Rita Work\IntelGraphicsProfiles
2020-10-02 20:58 - 2020-06-14 21:01 - 000835472 _____ (Adobe) C:\Windows\SysWOW64\FlashPlayerApp.exe
2020-10-02 20:58 - 2020-06-14 21:01 - 000179608 _____ (Adobe) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

==================== Files in the root of some directories ========

2019-09-28 21:25 - 2019-09-28 21:25 - 000000410 _____ () C:\Users\Rita\AppData\Local\oobelibMkey.log
2020-10-24 21:23 - 2020-10-24 21:23 - 000009746 _____ () C:\Users\Rita\AppData\Local\recently-used.xbel

==================== SigCheck ============================

(There is no automatic fix for files that do not pass verification.)

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 24-10-2020
Ran by Rita (administrator) on CALI (TOSHIBA SATELLITE L50-B) (01-11-2020 18:38:15)
Running from C:\Users\Rita\Downloads
Loaded Profiles: Rita & Rita Work
Platform: Windows 8.1 (Update) (X64) Language: Português (Portugal)
Default browser: Chrome
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Adobe Inc. -> Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe
(Adobe Inc. -> Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
(Avast Software s.r.o. -> AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1065.0\AvastBrowserCrashHandler.exe
(Avast Software s.r.o. -> AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1065.0\AvastBrowserCrashHandler64.exe
(Electronic Arts, Inc. -> Electronic Arts) C:\Program Files (x86)\Origin\OriginWebHelperService.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe <13>
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.36.32\GoogleCrashHandler.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.36.32\GoogleCrashHandler64.exe
(Intel Corporation -> Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel Corporation -> Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Intel(R) pGFX -> ) C:\Windows\System32\igfxTray.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\igfxHK.exe
(Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\wlanext.exe
(SurfRight B.V. -> SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe
(SurfRight B.V. -> SurfRight B.V.) C:\Users\Rita\Downloads\HitmanPro_x64.exe