Jump to content

trojan and hacktool.agents detected. installed and ran pre initial scan.


Recommended Posts

Hello I ran this program before I had malware and got a few detection alerts once d/l and ran malware. I was installing the Program whonix OS in a virtual box(which i have done before) and got detections of 1trojan and 2exploits.  When i first ran malware 2 days two hacktoolagents and one pup.optiona....leinstaller quarantined. I included the Log file of each detection im not sure if im infected since i ran program before and maleware just blocked the outbound connections only.  Any insights and help greatly appreciated                                                                                 

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 7/12/22
Protection Event Time: 10:26 AM
Log File: 5e65dada-01ff-11ed-ba59-10d1dcaaf8f9.json

-Software Information-
Version: 4.5.10.200
Components Version: 1.0.1709
Update Package Version: 1.0.57142
License: Trial

-System Information-
OS: Windows 10 (Build 19044.1766)
CPU: x64
File System: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, , Blocked, -1, -1, 0.0.0, , 

-Website Data-
Category: Trojan
Domain: 
IP Address: 199.58.81.140
Port: 443
Type: Outbound
File: 

(end)


 

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 7/12/22
Protection Event Time: 10:26 AM
Log File: 5c9e6000-01ff-11ed-b362-10d1dcaaf8f9.json

-Software Information-
Version: 4.5.10.200
Components Version: 1.0.1709
Update Package Version: 1.0.57142
License: Trial

-System Information-
OS: Windows 10 (Build 19044.1766)
CPU: x64
File System: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, , Blocked, -1, -1, 0.0.0, , 

-Website Data-
Category: Exploit
Domain: 
IP Address: 109.201.133.100
Port: 443
Type: Outbound
File: 

(end)



 

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 7/12/22
Protection Event Time: 10:26 AM
Log File: 5b4e440e-01ff-11ed-a62e-10d1dcaaf8f9.json

-Software Information-
Version: 4.5.10.200
Components Version: 1.0.1709
Update Package Version: 1.0.57142
License: Trial

-System Information-
OS: Windows 10 (Build 19044.1766)
CPU: x64
File System: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, , Blocked, -1, -1, 0.0.0, , 

-Website Data-
Category: Exploit
Domain: 
IP Address: 81.17.18.58
Port: 9001
Type: Outbound
File: 

(end)


 

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 7/10/22
Scan Time: 8:09 PM
Log File: 7a311a64-00be-11ed-a0d4-f065dd82a973.json

-Software Information-
Version: 4.5.10.200
Components Version: 1.0.1709
Update Package Version: 1.0.57071
License: Trial

-System Information-
OS: Windows 10 (Build 19044.1766)
CPU: x64
File System: NTFS
User: BasassPC\Joe

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 270755
Threats Detected: 3
Threats Quarantined: 3
Time Elapsed: 7 min, 10 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 3
HackTool.Agent, C:\USERS\JOE\APPDATA\ROAMING\Microsoft\Windows\Recent\kc81r.zip.lnk, Quarantined, 3770, 380903, , , , , 4776F2727C85F704A945335D75B83000, 4DE73410A4F83BCE8C4434FA333E8DC4E158AA204B53E4250D1CE0715A58A2F6
HackTool.Agent, D:\KC81R.ZIP, Quarantined, 3770, 380903, 1.0.57071, , ame, , 73E0D36457CAF1FC4BB6DB63FEB41AFF, 21F0C34F3452C71FD4D1285B1B941260402627008668670936E000FE36DA0C39
PUP.Optional.BundleInstaller, C:\USERS\JOE\DOWNLOADS\UTWEB_INSTALLER.EXE, Quarantined, 507, 875791, 1.0.57071, , ame, , 0A6A273312EABF4D971FB55B52B781AE, D4E60BE1204DF950E20B1968E14458E3A9CCF40A7FE7B0A6D2C2B4E01D646FC6

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)


(end)


 

Malwarebytes
www.malwarebytes.com                                  This was opened from USB.

-Log Details-
Scan Date: 7/10/22
Scan Time: 8:09 PM
Log File: 7a311a64-00be-11ed-a0d4-f065dd82a973.json

-Software Information-
Version: 4.5.10.200
Components Version: 1.0.1709
Update Package Version: 1.0.57071
License: Trial

-System Information-
OS: Windows 10 (Build 19044.1766)
CPU: x64
File System: NTFS
User: BasassPC\Joe

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 270755
Threats Detected: 3
Threats Quarantined: 3
Time Elapsed: 7 min, 10 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 3
HackTool.Agent, C:\USERS\JOE\APPDATA\ROAMING\Microsoft\Windows\Recent\kc81r.zip.lnk, Quarantined, 3770, 380903, , , , , 4776F2727C85F704A945335D75B83000, 4DE73410A4F83BCE8C4434FA333E8DC4E158AA204B53E4250D1CE0715A58A2F6
HackTool.Agent, D:\KC81R.ZIP, Quarantined, 3770, 380903, 1.0.57071, , ame, , 73E0D36457CAF1FC4BB6DB63FEB41AFF, 21F0C34F3452C71FD4D1285B1B941260402627008668670936E000FE36DA0C39
PUP.Optional.BundleInstaller, C:\USERS\JOE\DOWNLOADS\UTWEB_INSTALLER.EXE, Quarantined, 507, 875791, 1.0.57071, , ame, , 0A6A273312EABF4D971FB55B52B781AE, D4E60BE1204DF950E20B1968E14458E3A9CCF40A7FE7B0A6D2C2B4E01D646FC6

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)


(end)

 

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 7/10/22
Scan Time: 8:09 PM
Log File: 7a311a64-00be-11ed-a0d4-f065dd82a973.json

-Software Information-
Version: 4.5.10.200
Components Version: 1.0.1709
Update Package Version: 1.0.57071
License: Trial

-System Information-
OS: Windows 10 (Build 19044.1766)
CPU: x64
File System: NTFS
User: BasassPC\Joe

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 270755
Threats Detected: 3
Threats Quarantined: 3
Time Elapsed: 7 min, 10 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 3
HackTool.Agent, C:\USERS\JOE\APPDATA\ROAMING\Microsoft\Windows\Recent\kc81r.zip.lnk, Quarantined, 3770, 380903, , , , , 4776F2727C85F704A945335D75B83000, 4DE73410A4F83BCE8C4434FA333E8DC4E158AA204B53E4250D1CE0715A58A2F6
HackTool.Agent, D:\KC81R.ZIP, Quarantined, 3770, 380903, 1.0.57071, , ame, , 73E0D36457CAF1FC4BB6DB63FEB41AFF, 21F0C34F3452C71FD4D1285B1B941260402627008668670936E000FE36DA0C39
PUP.Optional.BundleInstaller, C:\USERS\JOE\DOWNLOADS\UTWEB_INSTALLER.EXE, Quarantined, 507, 875791, 1.0.57071, , ame, , 0A6A273312EABF4D971FB55B52B781AE, D4E60BE1204DF950E20B1968E14458E3A9CCF40A7FE7B0A6D2C2B4E01D646FC6

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)


(end)

Link to post
Share on other sites

Hello @tuser001  and  :welcome:

 

My name is MKDB and I will assist you.

 

 

Some ground rules:

  • Please follow the steps in the given order and post back the log files.
  • Please attach all log files into your post.
  • Temporarily disable your antivirus or other security software first. Make sure to turn it back on once the scans are completed.
  • Temporarily disable Microsoft SmartScreen to download software below if needed. Make sure to turn it back on once the scans are completed.
  • Searching, detecting and removing malware isn't instantaneous and there is no guarantee to repair every system. Before we start, please make sure that you have an external backup, not connected to this system, of all private data.
  • Please be patient and stick with me until I give you the "all clear".
  • Only run the tools I guide you to. Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
  • Cracked or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure.
  • As English is not my native language, please do not use slang or idoms. It may be hard for me to understand.
  • If you do not respond within 4 days, your topic will be closed.

 

 

Step 1

Please download the suitable version of Farbar Recovery Scan Tool (FRST) and save it to your desktop: 32bit | 64bit

  • Double-click to run it. When the tool opens, click Yes to disclaimer.
  • Press the Scan button.
  • FRST will create two logs (FRST.txt + Addition.txt) in the same directory the tool is run.
  • Please attach these logfiles to your next reply.

 

 

Thank you!

Link to post
Share on other sites

Hello, Here are logs. Thanks.


 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 11-07-2022
Ran by Joe (administrator) on BASASSPC (Dell Inc. Inspiron 3880) (12-07-2022 16:33:40)
Running from C:\Users\Joe\Downloads
Loaded Profiles: Joe
Platform: Microsoft Windows 10 Home Version 21H2 19044.1766 (X64) Language: English (United States)
Default browser: Brave
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Brave Software, Inc. -> BraveSoftware Inc.) C:\Program Files (x86)\BraveSoftware\Update\1.3.361.111\BraveCrashHandler.exe
(Brave Software, Inc. -> BraveSoftware Inc.) C:\Program Files (x86)\BraveSoftware\Update\1.3.361.111\BraveCrashHandler64.exe
(C:\Program Files (x86)\GlassWire\GWCtlSrv.exe ->) (GlassWire -> SecureMix LLC) C:\Program Files (x86)\GlassWire\GWIdlMon.exe
(C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe ->) (Malwarebytes Inc. -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(C:\Program Files\Oracle\VirtualBox\VBoxSVC.exe ->) (Oracle Corporation -> Oracle Corporation) C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe <6>
(explorer.exe ->) (Brave Software, Inc. -> Brave Software, Inc.) C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe <42>
(explorer.exe ->) (GlassWire -> SecureMix LLC) C:\Program Files (x86)\GlassWire\GlassWire.exe
(explorer.exe ->) (Oracle Corporation -> Oracle Corporation) C:\Program Files\Oracle\VirtualBox\VirtualBox.exe
(explorer.exe ->) (Scott Brogden) C:\Program Files\WindowsApps\60145ScottBrogden.ditto-cp_3.24.214.0_x86__n6b029mg40na2\Ditto.exe
(Oracle America, Inc. -> Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(RCS LT, UAB -> RCS LT) C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe
(services.exe ->) (GlassWire -> SecureMix LLC) C:\Program Files (x86)\GlassWire\GWCtlSrv.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_ffb22091d2be88a5\IntelCpHDCPSvc.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_ffb22091d2be88a5\IntelCpHeciSvc.exe
(services.exe ->) (Intel(R) Embedded Subsystems and IP Blocks Group -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\lms.inf_amd64_8a00302ff60aed46\LMS.exe
(services.exe ->) (Malwarebytes Inc. -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(services.exe ->) (Microsoft Windows -> ) C:\Windows\System32\OpenSSH\ssh-agent.exe
(services.exe ->) (Oracle Corporation -> Oracle Corporation) C:\Program Files\Oracle\VirtualBox\VBoxSDS.exe
(services.exe ->) (RCS LT, UAB -> RCS LT) C:\Program Files (x86)\Combo Cleaner\ComboCleaner.Guard.exe
(services.exe ->) (RCS LT, UAB -> RCS LT) C:\Program Files (x86)\Combo Cleaner\ComboCleaner.WinService.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MoUsoCoreWorker.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(svchost.exe ->) (Oracle Corporation -> Oracle Corporation) C:\Program Files\Oracle\VirtualBox\VBoxSVC.exe
(Technitium) [File not signed] C:\Program Files (x86)\Technitium\TMACv6.0\TMAC.exe

==================== Registry (All) ===================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Combo Cleaner] => C:\Program Files (x86)\Combo Cleaner\ComboCleaner.exe [2024064 2021-11-05] (RCS LT, UAB -> RCS LT)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [708840 2022-04-26] (Oracle America, Inc. -> Oracle Corporation)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe [58368 2022-06-15] (Microsoft Windows -> Microsoft Corporation)
HKLM-x32\...\Winlogon: [Userinit] C:\Windows\sysWOW64\userinit.exe [45568 2022-06-15] (Microsoft Windows -> Microsoft Corporation)
HKLM\...\Winlogon: [Shell] C:\Windows\explorer.exe [5117448 2022-06-15] (Microsoft Windows -> Microsoft Corporation)
HKLM-x32\...\Winlogon: [Shell] C:\Windows\SysWOW64\explorer.exe [4493040 2022-06-15] (Microsoft Windows -> Microsoft Corporation)
HKLM\...\Policies\Explorer: [ForceActiveDesktopOn] 0
HKLM\...\Policies\Explorer: [NoActiveDesktop] 1
HKLM\...\Policies\Explorer: [NoActiveDesktopChanges] 1
HKLM\...\Policies\Explorer: [NoRecentDocsHistory] 0
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Restriction <==== ATTENTION
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Restriction <==== ATTENTION
HKU\S-1-5-19\...\Run: [OneDriveSetup] => C:\Windows\SysWOW64\OneDriveSetup.exe [30870320 2019-12-07] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-20\...\Run: [OneDriveSetup] => C:\Windows\SysWOW64\OneDriveSetup.exe [30870320 2019-12-07] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-3849092577-732279574-2253760070-1001\...\Run: [GlassWire] => C:\Program Files (x86)\GlassWire\glasswire.exe [9933824 2022-05-06] (GlassWire -> SecureMix LLC)
HKU\S-1-5-21-3849092577-732279574-2253760070-1001\...\RunOnce: [Application Restart #2] => C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe [2753456 2022-07-04] (Brave Software, Inc. -> Brave Software, Inc.)
HKLM\...\Providers\LanMan Print Services: C:\Windows\system32\win32spl.dll [920576 2022-04-14] (Microsoft Windows -> Microsoft Corporation)
HKLM\...\Windows x64\Print Processors\Canon TS3300 series Print Processor: C:\Windows\System32\spool\prtprocs\x64\CNMPDG3.DLL [482816 2019-03-26] (Microsoft Windows Hardware Compatibility Publisher -> CANON INC.)
HKLM\...\Windows x64\Print Processors\winprint: C:\Windows\System32\spool\prtprocs\x64\winprint.dll [46080 2022-06-15] (Microsoft Windows -> Microsoft Corporation)
HKLM\...\Print\Monitors\Appmon: C:\Windows\system32\AppMon.dll [116224 2022-04-14] (Microsoft Windows -> Microsoft Corporation)
HKLM\...\Print\Monitors\Canon BJ Language Monitor TS3300 series: C:\Windows\system32\CNMLMG3.DLL [1311232 2019-03-26] (Microsoft Windows Hardware Compatibility Publisher -> CANON INC.)
HKLM\...\Print\Monitors\Local Port: C:\Windows\system32\localspl.dll [1274880 2022-06-15] (Microsoft Windows -> Microsoft Corporation)
HKLM\...\Print\Monitors\Standard TCP/IP Port: C:\Windows\system32\tcpmon.dll [248320 2022-06-15] (Microsoft Windows -> Microsoft Corporation)
HKLM\...\Print\Monitors\USB Monitor: C:\Windows\system32\usbmon.dll [933376 2022-04-14] (Microsoft Windows -> Microsoft Corporation)
HKLM\...\Print\Monitors\WSD Port: C:\Windows\system32\APMon.dll [1487360 2022-04-14] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\Microsoft\Active Setup\Installed Components: [>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] -> C:\Windows\system32\unregmp2.exe [2019-12-06] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] -> C:\Windows\system32\themeui.dll [2021-10-06] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{6BF52A52-394A-11d3-B153-00C04F79FAA6}] -> C:\Windows\system32\unregmp2.exe [2019-12-06] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{89820200-ECBD-11cf-8B85-00AA005B4340}] -> C:\Windows\system32\shell32.dll [2022-06-15] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{89820200-ECBD-11cf-8B85-00AA005B4383}] -> C:\Windows\System32\ie4uinit.exe [2022-03-10] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{89B4C1CD-B018-4511-B0A1-5476DBF70820}] -> C:\Windows\System32\mscories.dll [2019-12-07] (Microsoft Corporation -> Microsoft Corporation)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files\Google\Chrome\Application\103.0.5060.114\Installer\chrmstp.exe [2022-07-06] (Google LLC -> Google LLC)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}] -> C:\Program Files\BraveSoftware\Brave-Browser\Application\103.1.40.113\Installer\chrmstp.exe [2022-07-05] (Brave Software, Inc. -> Brave Software, Inc.)
HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components: [>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] -> C:\Windows\SysWOW64\unregmp2.exe [2019-12-06] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components: [{6BF52A52-394A-11d3-B153-00C04F79FAA6}] -> C:\Windows\SysWOW64\unregmp2.exe [2019-12-06] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components: [{89B4C1CD-B018-4511-B0A1-5476DBF70820}] -> C:\Windows\SysWOW64\mscories.dll [2019-12-07] (Microsoft Corporation -> Microsoft Corporation)
HKLM\Software\...\Authentication\Credential Providers: [{01A30791-40AE-4653-AB2E-FD210019AE88}] -> C:\Windows\system32\mgmtrefreshcredprov.dll [2022-06-15] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Authentication\Credential Providers: [{1b283861-754f-4022-ad47-a5eaaa618894}] -> C:\Windows\system32\SmartcardCredentialProvider.dll [2021-10-06] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Authentication\Credential Providers: [{1ee7337f-85ac-45e2-a23c-37c753209769}] -> C:\Windows\system32\SmartcardCredentialProvider.dll [2021-10-06] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Authentication\Credential Providers: [{2135f72a-90b5-4ed3-a7f1-8bb705ac276a}] -> C:\Windows\system32\credprovslegacy.dll [2021-10-06] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Authentication\Credential Providers: [{25CBB996-92ED-457e-B28C-4774084BD562}] -> C:\Windows\system32\credprovs.dll [2022-03-10] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Authentication\Credential Providers: [{27FBDB57-B613-4AF2-9D7E-4FA7A66C21AD}] -> C:\Windows\system32\TrustedSignalCredProv.dll [2021-10-06] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Authentication\Credential Providers: [{3dd6bec0-8193-4ffe-ae25-e08e39ea4063}] -> C:\Windows\system32\credprovs.dll [2022-03-10] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Authentication\Credential Providers: [{48B4E58D-2791-456C-9091-D524C6C706F2}] -> C:\Windows\System32\devicengccredprov.dll [2021-10-06] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Authentication\Credential Providers: [{600e7adb-da3e-41a4-9225-3c0399e88c0c}] -> C:\Windows\system32\cngcredui.dll [2019-12-07] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Authentication\Credential Providers: [{60b78e88-ead8-445c-9cfd-0b87f74ea6cd}] -> C:\Windows\system32\credprovs.dll [2022-03-10] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Authentication\Credential Providers: [{8AF662BF-65A0-4D0A-A540-A338A999D36F}] -> C:\Windows\System32\FaceCredentialProvider.dll [2021-10-06] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Authentication\Credential Providers: [{8FD7E19C-3BF7-489B-A72C-846AB3678C96}] -> C:\Windows\system32\SmartcardCredentialProvider.dll [2021-10-06] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Authentication\Credential Providers: [{94596c7e-3744-41ce-893e-bbf09122f76a}] -> C:\Windows\system32\SmartcardCredentialProvider.dll [2021-10-06] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Authentication\Credential Providers: [{BEC09223-B018-416D-A0AC-523971B639F5}] -> C:\Windows\System32\BioCredProv.dll [2022-03-10] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Authentication\Credential Providers: [{C5D7540A-CD51-453B-B22B-05305BA03F07}] -> C:\Windows\System32\cxcredprov.dll [2021-10-06] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Authentication\Credential Providers: [{C885AA15-1764-4293-B82A-0586ADD46B35}] -> C:\Windows\System32\FaceCredentialProvider.dll [2021-10-06] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Authentication\Credential Providers: [{cb82ea12-9f71-446d-89e1-8d0924e1256e}] -> C:\Windows\system32\credprovslegacy.dll [2021-10-06] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Authentication\Credential Providers: [{D6886603-9D2F-4EB2-B667-1971041FA96B}] -> C:\Windows\System32\ngccredprov.dll [2022-03-10] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Authentication\Credential Providers: [{e74e57b0-6c6d-44d5-9cda-fb2df5ed7435}] -> C:\Windows\system32\certCredProvider.dll [2019-12-07] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Authentication\Credential Providers: [{F8A0B131-5F68-486c-8040-7E8FC3C85BB6}] -> C:\Windows\system32\wlidcredprov.dll [2021-10-06] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Authentication\Credential Providers: [{F8A1793B-7873-4046-B2A7-1F318747F427}] -> C:\Windows\system32\fidocredprov.dll [2022-06-15] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Authentication\Credential Provider Filters: [{DDC0EED2-ADBE-40b6-A217-EDE16A79A0DE}] -> C:\Windows\system32\credprovs.dll [2022-03-10] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Authentication\PLAP Providers: [{5537E283-B1E7-4EF8-9C6E-7AB0AFE5056D}] -> C:\Windows\system32\rasplap.dll [2021-10-06] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Winlogon\GPExtensions: [{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}] -> C:\Windows\system32\wlgpclnt.dll [2021-10-06] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Winlogon\GPExtensions: [{16be69fa-4209-4250-88cb-716cf41954e0}] -> C:\Windows\system32\auditcse.dll [2019-12-07] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Winlogon\GPExtensions: [{25537BA6-77A8-11D2-9B6C-0000F8080861}] -> C:\Windows\system32\fdeploy.dll [2019-12-07] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Winlogon\GPExtensions: [{35378EAC-683F-11D2-A89A-00C04FBBCFA2}] -> 
HKLM\Software\...\Winlogon\GPExtensions: [{3610eda5-77ef-11d2-8dc5-00c04fa31a66}] -> C:\Windows\System32\dskquota.dll [2019-12-07] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Winlogon\GPExtensions: [{426031c0-0b47-4852-b0ca-ac3d37bfcb39}] -> C:\Windows\system32\gptext.dll [2019-12-07] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Winlogon\GPExtensions: [{4bcd6cde-777b-48b6-9804-43568e23545d}] -> C:\Windows\System32\TsUsbRedirectionGroupPolicyExtension.dll [2019-12-07] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Winlogon\GPExtensions: [{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}] -> C:\Windows\System32\iedkcs32.dll [2022-02-03] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Winlogon\GPExtensions: [{4D2F9B6F-1E52-4711-A382-6A8B1A003DE6}] -> C:\Windows\System32\tsworkspace.dll [2021-10-06] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Winlogon\GPExtensions: [{7909AD9E-09EE-4247-BAB9-7029D5F0A278}] -> C:\Windows\system32\dmenrollengine.dll [2022-06-15] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Winlogon\GPExtensions: [{7933F41E-56F8-41d6-A31C-4148A711EE93}] -> C:\Windows\System32\srchadmin.dll [2021-10-06] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Winlogon\GPExtensions: [{7B849a69-220F-451E-B3FE-2CB811AF94AE}] -> C:\Windows\System32\iedkcs32.dll [2022-02-03] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Winlogon\GPExtensions: [{827D319E-6EAC-11D2-A4EA-00C04F79F83A}] -> C:\Windows\system32\scecli.dll [2022-05-12] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Winlogon\GPExtensions: [{8A28E2C5-8D06-49A4-A08C-632DAA493E17}] -> C:\Windows\system32\gpprnext.dll [2019-12-07] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Winlogon\GPExtensions: [{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}] -> C:\Windows\system32\dot3gpclnt.dll [2019-12-07] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Winlogon\GPExtensions: [{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}] -> C:\Windows\system32\pwlauncher.dll [2021-10-06] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Winlogon\GPExtensions: [{C34B2751-1CF4-44F5-9262-C3FC39666591}] -> C:\Windows\system32\pwlauncher.dll [2021-10-06] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Winlogon\GPExtensions: [{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}] -> C:\Windows\system32\gptext.dll [2019-12-07] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Winlogon\GPExtensions: [{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}] -> C:\Windows\System32\iedkcs32.dll [2022-02-03] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Winlogon\GPExtensions: [{CFF649BD-601D-4361-AD3D-0FC365DB4DB7}] -> C:\Windows\system32\domgmt.dll [2022-03-10] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Winlogon\GPExtensions: [{e437bc1c-aa7d-11d2-a382-00c04f991e27}] -> C:\Windows\System32\polstore.dll [2022-05-12] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Winlogon\GPExtensions: [{f3ccc681-b74c-4060-9f26-cd84525dca2a}] -> C:\Windows\system32\auditcse.dll [2019-12-07] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Winlogon\GPExtensions: [{FB2CA36D-0B40-4307-821B-A13B252DE56C}] -> C:\Windows\system32\gptext.dll [2019-12-07] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\Winlogon\GPExtensions: [{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}] -> C:\Windows\system32\gptext.dll [2019-12-07] (Microsoft Windows -> Microsoft Corporation)
Lsa: [Authentication Packages] msv1_0
Lsa: [Notification Packages] scecli
SecurityProviders: credssp.dll
BootExecute: autocheck autochk * 
AlternateShell: cmd.exe

==================== Scheduled Tasks (Whitelisted) ============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {1555BB50-50C2-4CDB-AA7F-E5D63EC34BEA} - System32\Tasks\GoogleUpdateTaskMachineCore{CDD433EC-7DE3-46A8-9234-305C11B9ECB7} => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [156232 2022-02-16] (Google LLC -> Google LLC)
Task: {23CF29DA-A2BD-4F36-A16B-6DAE5DBD9617} - System32\Tasks\BraveSoftwareUpdateTaskMachineCore => C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe [162968 2022-02-03] (Brave Software, Inc. -> BraveSoftware Inc.)
Task: {27F14BB8-52A7-41AD-AD6B-4E8175B53373} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe --automatic (No File)
Task: {A80D564E-4E1D-4209-8F22-0352F6F887C7} - System32\Tasks\BraveSoftwareUpdateTaskMachineUA => C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe [162968 2022-02-03] (Brave Software, Inc. -> BraveSoftware Inc.)
Task: {B411A6ED-E04F-4DB9-A57C-9EBC3DC546A1} - System32\Tasks\GoogleUpdateTaskMachineUA{326E8C9C-EADE-49F6-8221-9E2CDA7C1301} => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [156232 2022-02-16] (Google LLC -> Google LLC)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\CreateExplorerShellUnelevatedTask.job => C:\Windows\explorer.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{2d966d70-0b96-44ba-96b3-b463006576e8}: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF Plugin: @java.com/DTPlugin,version=11.333.2 -> C:\Program Files\Java\jre1.8.0_333\bin\dtplugin\npDeployJava1.dll [2022-07-04] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.333.2 -> C:\Program Files\Java\jre1.8.0_333\bin\plugin2\npjp2.dll [2022-07-04] (Oracle America, Inc. -> Oracle Corporation)

Chrome: 
=======
CHR Profile: C:\Users\Joe\AppData\Local\Google\Chrome\User Data\Default [2022-07-12]
CHR Extension: (Google Docs Offline) - C:\Users\Joe\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2022-06-22]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Joe\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2022-02-16]

Brave: 
=======
BRA Profile: C:\Users\Joe\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default [2022-07-12]
BRA DefaultSearchKeyword: Default -> :g
BRA Extension: (Google Translate) - C:\Users\Joe\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb [2022-03-13]
BRA Extension: (AdBlock — best ad blocker) - C:\Users\Joe\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2022-07-01]
BRA Extension: (Brave Local Data Files Updater) - C:\Users\Joe\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal [2022-07-11]
BRA Extension: (Brave NTP background images) - C:\Users\Joe\AppData\Local\BraveSoftware\Brave-Browser\User Data\aoojcmojmmcbpfgoecoadbdpnagfchel [2022-07-08]
BRA Extension: (Wallet Data Files Updater) - C:\Users\Joe\AppData\Local\BraveSoftware\Brave-Browser\User Data\BraveWallet [2022-07-11]
BRA Extension: (Brave Ad Block Updater (Default)) - C:\Users\Joe\AppData\Local\BraveSoftware\Brave-Browser\User Data\cffkpbalmllkdoenhmdmpbkajipdjfam [2022-07-11]
BRA Extension: (Brave Ad Block Updater (ABPindo)) - C:\Users\Joe\AppData\Local\BraveSoftware\Brave-Browser\User Data\egooomckhdgnfbpofhkbhbkiejaihdll [2022-07-11]
BRA Extension: (Brave Ad Block Updater (BitBlock List (Дополнительная подписка фильтров))) - C:\Users\Joe\AppData\Local\BraveSoftware\Brave-Browser\User Data\fmcofgdkijoanfaodpdfjipdgnjbiolk [2022-07-11]
BRA Extension: (Brave NTP sponsored images) - C:\Users\Joe\AppData\Local\BraveSoftware\Brave-Browser\User Data\gccbbckogglekeggclmmekihdgdpdgoe [2022-07-12]
BRA Extension: (Brave Ad Block Updater (Hufilter)) - C:\Users\Joe\AppData\Local\BraveSoftware\Brave-Browser\User Data\gemncmbgjgcjjepjkindgdhdilnaanlc [2022-07-11]
BRA Extension: (Brave Ad Block Updater (Adguard Japanese filters (日本用フィルタ))) - C:\Users\Joe\AppData\Local\BraveSoftware\Brave-Browser\User Data\ghnjmapememheddlfgmklijahiofgkea [2022-07-11]
BRA Extension: (Brave Ad Block Updater (Liste AR)) - C:\Users\Joe\AppData\Local\BraveSoftware\Brave-Browser\User Data\gpgegghiabhggiplapgdfnfcmodkccji [2022-07-11]
BRA Extension: (Brave Ads Resources) - C:\Users\Joe\AppData\Local\BraveSoftware\Brave-Browser\User Data\iblokdlgekdjophgeonmanpnjihcjkjj [2022-07-08]
BRA Extension: (Brave SpeedReader Updater) - C:\Users\Joe\AppData\Local\BraveSoftware\Brave-Browser\User Data\jicbkmdloagakknpihibphagfckhjdih [2022-03-13]
BRA Extension: (Brave Ad Block Updater (EasyList China (中文))) - C:\Users\Joe\AppData\Local\BraveSoftware\Brave-Browser\User Data\llhecljkijgcaalnbfadljdpkpbehakp [2022-07-11]
BRA Extension: (Brave Ads Resources) - C:\Users\Joe\AppData\Local\BraveSoftware\Brave-Browser\User Data\ocilmpijebaopmdifcomolmpigakocmo [2022-04-02]
BRA Extension: (Brave HTTPS Everywhere Updater) - C:\Users\Joe\AppData\Local\BraveSoftware\Brave-Browser\User Data\oofiananboodjbbmdelgdommihjbkfag [2022-07-08]
BRA Extension: (Brave Ad Block Updater (Oficjalne Polskie Filtry do AdBlocka, uBlocka Origin i AdGuarda)) - C:\Users\Joe\AppData\Local\BraveSoftware\Brave-Browser\User Data\paoecjnjjbclkgbempaeemcbeldldlbo [2022-07-11]

==================== Services (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S4 brave; C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe [162968 2022-02-03] (Brave Software, Inc. -> BraveSoftware Inc.)
S3 bravem; C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe [162968 2022-02-03] (Brave Software, Inc. -> BraveSoftware Inc.)
R2 ComboCleaner.Guard; C:\Program Files (x86)\Combo Cleaner\ComboCleaner.Guard.exe [143488 2021-11-05] (RCS LT, UAB -> RCS LT)
R2 ComboCleaner.WinService; C:\Program Files (x86)\Combo Cleaner\ComboCleaner.WinService.exe [151168 2021-11-05] (RCS LT, UAB -> RCS LT)
R2 GlassWire; C:\Program Files (x86)\GlassWire\GWCtlSrv.exe [7068672 2022-05-06] (GlassWire -> SecureMix LLC)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [8677120 2022-07-10] (Malwarebytes Inc. -> Malwarebytes)
S3 ss_conn_launcher_service; C:\Windows\System32\Samsung\EasySetup\ss_conn_launcher.exe [182392 2021-10-08] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
R3 VBoxSDS; C:\Program Files\Oracle\VirtualBox\VBoxSDS.exe [694016 2020-07-09] (Oracle Corporation -> Oracle Corporation)
S3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2205.7-0\NisSrv.exe [3120992 2022-06-22] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2205.7-0\MsMpEng.exe [133544 2022-06-22] (Microsoft Windows Publisher -> Microsoft Corporation)
S4 WMIRegistrationService; C:\Windows\System32\DriverStore\FileRepository\mewmiprov.inf_amd64_cad1db73e8c782a6\WMIRegistrationService.exe [538736 2021-07-25] (Intel Corporation -> Intel Corporation)

===================== Drivers (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 BdDci; C:\Windows\system32\DRIVERS\bddci.sys [802976 2020-12-04] (Bitdefender SRL -> Bitdefender)
S3 dg_ssudbus; C:\Windows\system32\DRIVERS\ssudbus2.sys [160376 2021-10-08] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [158640 2022-07-10] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R1 gwdrv; C:\Windows\system32\DRIVERS\gwdrv.sys [33152 2015-05-29] (GlassWire -> SecureMix LLC)
R3 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [176008 2021-09-30] (Microsoft Windows Hardware Compatibility Publisher -> BitDefender LLC)
R2 MBAMChameleon; C:\Windows\System32\Drivers\MbamChameleon.sys [223176 2022-07-11] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
S0 MbamElam; C:\Windows\System32\DRIVERS\MbamElam.sys [21480 2022-07-10] (Microsoft Windows Early Launch Anti-malware Publisher -> Malwarebytes)
R3 MBAMFarflt; C:\Windows\System32\DRIVERS\farflt.sys [192960 2022-07-11] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R3 MBAMProtection; C:\Windows\system32\DRIVERS\mbam.sys [74704 2022-07-11] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [239544 2022-07-11] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R3 MBAMWebProtection; C:\Windows\system32\DRIVERS\mwac.sys [181992 2022-07-11] (Malwarebytes Inc. -> Malwarebytes)
S3 MpKsl0a398492; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{C405B57A-DADA-40FB-88F5-AE16CDBA7EC6}\MpKslDrv.sys [141568 2022-07-11] (Microsoft Windows -> Microsoft Corporation)
S3 ssudmdm; C:\Windows\system32\DRIVERS\ssudmdm.sys [167544 2021-10-08] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
S3 ss_conn_usb_driver2; C:\Windows\System32\Drivers\ss_conn_usb_driver2.sys [43640 2021-10-08] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
R3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [615840 2021-10-01] (Microsoft Windows Hardware Compatibility Publisher -> Bitdefender)
R3 VBoxNetAdp; C:\Windows\system32\DRIVERS\VBoxNetAdp6.sys [237376 2020-07-10] (Oracle Corporation -> Oracle Corporation)
R1 VBoxNetLwf; C:\Windows\system32\DRIVERS\VBoxNetLwf.sys [248248 2020-07-10] (Oracle Corporation -> Oracle Corporation)
R1 veracrypt; C:\Windows\System32\drivers\veracrypt.sys [817672 2022-07-10] (Microsoft Windows Hardware Compatibility Publisher -> IDRIX)
S3 WdBoot; C:\Windows\system32\drivers\wd\WdBoot.sys [49576 2022-06-22] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\wd\WdFilter.sys [452856 2022-06-22] (Microsoft Windows -> Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\drivers\wd\WdNisDrv.sys [91384 2022-06-22] (Microsoft Windows -> Microsoft Corporation)
S3 semav6msr64; \??\C:\Windows\system32\drivers\semav6msr64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One month (created) (Whitelisted) =========

(If an entry is included in the fixlist, the file/folder will be moved.)

2022-07-12 16:33 - 2022-07-12 16:35 - 000029282 _____ C:\Users\Joe\Downloads\FRST.txt
2022-07-12 16:32 - 2022-07-12 16:35 - 000000000 ____D C:\FRST
2022-07-12 16:31 - 2022-07-12 16:31 - 002369536 _____ (Farbar) C:\Users\Joe\Downloads\FRST64.exe
2022-07-12 10:47 - 2022-07-12 10:47 - 000001810 _____ C:\Users\Joe\Documents\puphack.txt
2022-07-12 10:45 - 2022-07-12 10:45 - 000001810 _____ C:\Users\Joe\Documents\hacktools.txt
2022-07-12 10:41 - 2022-07-12 10:41 - 000001810 _____ C:\Users\Joe\Documents\hacktool1.txt
2022-07-12 10:40 - 2022-07-12 10:40 - 000000603 _____ C:\Users\Joe\Documents\expolit3.txt
2022-07-12 10:38 - 2022-07-12 10:38 - 000000607 _____ C:\Users\Joe\Documents\expolit2.txt
2022-07-12 10:37 - 2022-07-12 10:37 - 000000606 _____ C:\Users\Joe\Documents\epoloit1.txt
2022-07-12 10:28 - 2022-07-12 10:28 - 000000603 _____ C:\Users\Joe\Documents\trojanlogline.txt
2022-07-11 19:59 - 2022-07-11 19:59 - 000223176 _____ (Malwarebytes) C:\Windows\system32\Drivers\MbamChameleon.sys
2022-07-11 19:59 - 2022-07-11 19:59 - 000192960 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
2022-07-11 19:59 - 2022-07-11 19:59 - 000181992 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
2022-07-11 19:59 - 2022-07-11 19:59 - 000074704 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2022-07-11 11:08 - 2022-07-11 11:08 - 000000000 ____D C:\Users\Joe\AppData\Local\RCS_LT
2022-07-11 11:07 - 2022-07-11 11:16 - 000000000 ____D C:\Program Files (x86)\Combo Cleaner
2022-07-11 11:07 - 2022-07-11 11:07 - 000001959 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Combo Cleaner.lnk
2022-07-11 11:07 - 2022-07-11 11:07 - 000001953 _____ C:\Users\Public\Desktop\Combo Cleaner.lnk
2022-07-11 11:07 - 2022-07-11 11:07 - 000001953 _____ C:\ProgramData\Desktop\Combo Cleaner.lnk
2022-07-11 11:07 - 2022-07-11 11:07 - 000000000 ____D C:\Program Files (x86)\InstallShield Installation Information
2022-07-11 11:05 - 2022-07-11 11:05 - 003594016 _____ (RCS LT) C:\Users\Joe\Downloads\CCSetup.exe
2022-07-11 02:55 - 2022-07-11 03:02 - 000573586 _____ C:\TDSSKiller.3.1.0.28_11.07.2022_02.55.34_log.txt
2022-07-11 02:55 - 2022-07-11 02:55 - 000000851 _____ C:\Users\Joe\Desktop\Install Kaspersky Anti-Virus version 21.3.10.391.lnk
2022-07-11 02:46 - 2022-07-11 02:46 - 002758992 _____ (Kaspersky) C:\Users\Joe\Downloads\kav21.3.10.391en_26074.exe
2022-07-11 02:46 - 2022-07-11 02:46 - 000000000 ____D C:\ProgramData\Kaspersky Lab Setup Files
2022-07-11 02:41 - 2022-07-11 02:44 - 000002278 _____ C:\CoinVaultDecryptor.1.0.0.6_11.07.2022_02.41.03_log.txt
2022-07-11 02:40 - 2022-07-11 02:40 - 001255157 _____ C:\Users\Joe\Downloads\CoinVaultDecryptor.zip
2022-07-11 02:38 - 2022-07-11 02:40 - 000289982 _____ C:\TDSSKiller.3.1.0.28_11.07.2022_02.38.27_log.txt
2022-07-11 02:38 - 2022-07-11 02:38 - 005054744 _____ (AO Kaspersky Lab) C:\Users\Joe\Downloads\tdsskiller.exe
2022-07-11 02:22 - 2022-07-11 02:24 - 119041688 _____ (AO Kaspersky Lab) C:\Users\Joe\Downloads\KVRT.exe
2022-07-11 00:47 - 2022-07-11 00:47 - 000255928 _____ (Malwarebytes) C:\Windows\system32\Drivers\6412956C.sys
2022-07-11 00:36 - 2022-07-11 00:36 - 000255928 _____ (Malwarebytes) C:\Windows\system32\Drivers\7617F252.sys
2022-07-11 00:18 - 2022-07-12 02:53 - 000000000 ____D C:\Users\Joe\AppData\LocalLow\IGDump
2022-07-10 23:39 - 2022-07-10 23:39 - 000000266 _____ C:\Users\Joe\Downloads\new.txt
2022-07-10 21:21 - 2022-07-10 21:21 - 000255928 _____ (Malwarebytes) C:\Windows\system32\Drivers\64110649.sys
2022-07-10 20:57 - 2022-07-11 00:22 - 000001376 _____ C:\Users\Joe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ESET Online Scanner.lnk
2022-07-10 20:57 - 2022-07-11 00:21 - 000001270 _____ C:\Users\Joe\Desktop\ESET Online Scanner.lnk
2022-07-10 20:57 - 2022-07-10 22:26 - 000000000 ____D C:\Users\Joe\AppData\Local\CrashDumps
2022-07-10 20:57 - 2022-07-10 20:57 - 015274968 _____ (ESET) C:\Users\Joe\Downloads\esetonlinescanner.exe
2022-07-10 20:57 - 2022-07-10 20:57 - 000000000 ____D C:\Users\Joe\AppData\Local\ESET
2022-07-10 20:12 - 2022-07-10 20:12 - 014178840 _____ (Malwarebytes Corp.) C:\Users\Joe\Downloads\mbar-1.10.3.1001 (1).exe
2022-07-10 20:07 - 2022-07-10 20:07 - 000000000 ____D C:\Users\Joe\AppData\Local\mbam
2022-07-10 20:05 - 2022-07-11 00:18 - 000239544 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys
2022-07-10 20:05 - 2022-07-10 20:05 - 000158640 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbae64.sys
2022-07-10 20:05 - 2022-07-10 20:05 - 000002033 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes.lnk
2022-07-10 20:05 - 2022-07-10 20:05 - 000002021 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2022-07-10 20:05 - 2022-07-10 20:05 - 000002021 _____ C:\ProgramData\Desktop\Malwarebytes.lnk
2022-07-10 20:05 - 2022-07-10 20:04 - 000021480 _____ (Malwarebytes) C:\Windows\system32\Drivers\MbamElam.sys
2022-07-10 20:03 - 2022-07-10 21:21 - 000000000 ____D C:\ProgramData\Malwarebytes
2022-07-10 20:03 - 2022-07-10 20:03 - 000000000 ____D C:\Program Files\Malwarebytes
2022-07-10 20:01 - 2022-07-10 20:01 - 002556344 _____ (Malwarebytes) C:\Users\Joe\Downloads\MBSetup (1).exe
2022-07-10 19:53 - 2022-07-10 19:53 - 002556344 _____ (Malwarebytes) C:\Users\Joe\Downloads\MBSetup.exe
2022-07-10 19:34 - 2022-07-11 01:04 - 000000000 ____D C:\Users\Joe\Desktop\mbar
2022-07-10 19:34 - 2022-07-11 01:04 - 000000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2022-07-10 19:34 - 2022-07-10 19:34 - 014178840 _____ (Malwarebytes Corp.) C:\Users\Joe\Downloads\mbar-1.10.3.1001.exe
2022-07-10 15:55 - 2022-07-12 10:17 - 000000000 ____D C:\Users\Joe\VirtualBox VMs
2022-07-10 14:56 - 2022-07-10 14:56 - 000001269 _____ C:\Users\Public\Desktop\TMAC v6.lnk
2022-07-10 14:56 - 2022-07-10 14:56 - 000001269 _____ C:\ProgramData\Desktop\TMAC v6.lnk
2022-07-10 14:56 - 2022-07-10 14:56 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Technitium MAC Address Changer v6
2022-07-10 14:56 - 2022-07-10 14:56 - 000000000 ____D C:\Program Files (x86)\Technitium
2022-07-10 14:55 - 2022-07-10 14:55 - 002212462 _____ C:\Users\Joe\Downloads\TMACv6.0.7_Setup.zip
2022-07-10 14:31 - 2022-07-10 14:31 - 000000000 ____D C:\Users\Joe\AppData\Roaming\VeraCrypt
2022-07-10 12:56 - 2022-07-10 12:56 - 000817672 _____ (IDRIX) C:\Windows\system32\Drivers\veracrypt.sys
2022-07-10 12:56 - 2022-07-10 12:56 - 000000888 _____ C:\Users\Public\Desktop\VeraCrypt.lnk
2022-07-10 12:56 - 2022-07-10 12:56 - 000000888 _____ C:\ProgramData\Desktop\VeraCrypt.lnk
2022-07-10 12:56 - 2022-07-10 12:56 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VeraCrypt
2022-07-10 12:56 - 2022-07-10 12:56 - 000000000 ____D C:\Program Files\VeraCrypt
2022-07-10 12:54 - 2022-07-10 13:44 - 2235339264 _____ C:\Users\Joe\Downloads\Whonix-XFCE-16.0.5.3.ova
2022-07-10 12:46 - 2022-07-10 12:46 - 011137259 _____ C:\Users\Joe\Downloads\Oracle_VM_VirtualBox_Extension_Pack-6.1.34.vbox-extpack
2022-07-10 12:09 - 2022-07-12 11:30 - 000000000 ____D C:\Users\Joe\.VirtualBox
2022-07-10 12:09 - 2022-07-12 10:16 - 000000000 ____D C:\ProgramData\VirtualBox
2022-07-10 12:09 - 2022-07-10 12:09 - 000001149 _____ C:\Users\Public\Desktop\Oracle VM VirtualBox.lnk
2022-07-10 12:09 - 2022-07-10 12:09 - 000001149 _____ C:\ProgramData\Desktop\Oracle VM VirtualBox.lnk
2022-07-10 12:09 - 2022-07-10 12:09 - 000000000 ____D C:\Program Files\Oracle
2022-07-10 12:09 - 2020-07-10 01:36 - 001024848 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxDrv.sys
2022-07-10 12:09 - 2020-07-10 01:36 - 000188072 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxUSBMon.sys
2022-07-08 20:37 - 2022-07-08 20:38 - 000000000 ____D C:\Users\Joe\AppData\Local\glasswire
2022-07-08 20:37 - 2022-07-08 20:37 - 000001970 _____ C:\Users\Public\Desktop\GlassWire.lnk
2022-07-08 20:37 - 2022-07-08 20:37 - 000001970 _____ C:\ProgramData\Desktop\GlassWire.lnk
2022-07-08 20:37 - 2022-07-08 20:37 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GlassWire
2022-07-08 20:37 - 2022-07-08 20:37 - 000000000 ____D C:\ProgramData\GlassWire
2022-07-08 20:37 - 2022-07-08 20:37 - 000000000 ____D C:\Program Files (x86)\GlassWire
2022-07-08 20:37 - 2015-05-29 01:30 - 000008392 _____ C:\Windows\system32\Drivers\gwdrv.cat
2022-07-08 20:37 - 2015-05-29 01:15 - 000033152 _____ (SecureMix LLC) C:\Windows\system32\Drivers\gwdrv.sys
2022-07-08 20:36 - 2022-07-08 20:36 - 022165328 _____ (IDRIX) C:\Users\Joe\Downloads\VeraCrypt Setup 1.25.9.exe
2022-07-08 20:33 - 2022-07-08 20:33 - 069155024 _____ (SecureMix LLC) C:\Users\Joe\Downloads\GlassWireSetup.exe
2022-07-08 15:26 - 2022-07-08 15:26 - 000000000 ___HD C:\ProgramData\CanonBJ
2022-07-08 15:26 - 2019-03-26 05:00 - 001311232 _____ (CANON INC.) C:\Windows\system32\CNMLMG3.DLL
2022-07-08 15:25 - 2018-11-06 11:13 - 000388608 _____ (CANON INC.) C:\Windows\system32\CNC_G3L.dll
2022-07-08 15:25 - 2018-11-06 10:55 - 000559616 _____ (CANON INC.) C:\Windows\system32\CNC_G3C.dll
2022-07-08 15:25 - 2018-11-06 10:55 - 000273408 _____ (CANON INC.) C:\Windows\system32\CNC_G3I.dll
2022-07-08 15:25 - 2018-11-02 10:39 - 000089600 _____ C:\Windows\system32\CNC18A2D.TBL
2022-07-08 15:25 - 2008-08-25 18:02 - 000017920 _____ (CANON INC.) C:\Windows\system32\CNHMCA6.dll
2022-07-08 14:43 - 2022-07-08 14:45 - 170537992 _____ (Oracle Corporation) C:\Users\Joe\Downloads\VirtualBox-6.0.24-139119-Win.exe
2022-07-05 19:03 - 2022-07-05 19:03 - 000011504 _____ C:\Users\Joe\Downloads\0x5A32C366-sec.asc
2022-07-05 19:03 - 2022-07-05 19:03 - 000006071 _____ C:\Users\Joe\Downloads\0x5A32C366-pub.asc
2022-07-05 14:21 - 2022-07-05 14:21 - 000021319 _____ C:\Users\Joe\Downloads\The.Secrets.To.Civilization.S01.1080p.HDTV.H264-CBFM[eztv.re] (1).torrent
2022-07-05 14:21 - 2022-07-05 14:21 - 000000218 _____ C:\Users\Joe\AppData\Local\recently-used.xbel
2022-07-04 16:25 - 2022-03-19 16:41 - 000000832 _____ C:\Users\Joe\Desktop\Start Tor Browser.lnk
2022-07-04 14:17 - 2022-07-04 14:17 - 000000000 ____D C:\Users\Joe\.pgptool
2022-07-04 14:15 - 2022-07-04 14:15 - 000193816 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2022-07-04 14:15 - 2022-07-04 14:15 - 000000000 ____D C:\Users\Joe\AppData\Roaming\Sun
2022-07-04 14:15 - 2022-07-04 14:15 - 000000000 ____D C:\Users\Joe\AppData\LocalLow\Sun
2022-07-04 14:15 - 2022-07-04 14:15 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2022-07-04 14:14 - 2022-07-04 14:14 - 000000000 ____D C:\ProgramData\Oracle
2022-07-04 14:14 - 2022-07-04 14:14 - 000000000 ____D C:\Program Files\Java
2022-07-04 11:32 - 2022-07-04 11:32 - 000000000 ____D C:\Users\Joe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PGP Tool
2022-07-04 11:32 - 2022-07-04 11:32 - 000000000 ____D C:\Program Files (x86)\PGP Tool
2022-07-03 19:55 - 2022-07-04 08:27 - 000000000 ____D C:\Users\Joe\Downloads\The.Secrets.To.Civilization.S01.1080p.HDTV.H264-CBFM[eztv.re]
2022-07-03 19:48 - 2022-07-03 19:48 - 000021319 _____ C:\Users\Joe\Downloads\The.Secrets.To.Civilization.S01.1080p.HDTV.H264-CBFM[eztv.re].torrent
2022-07-03 19:37 - 2022-07-03 19:37 - 000034803 _____ C:\Users\Joe\Downloads\The.Bridge.Race.to.a.Fortune.S01.720p.HMAX.WEBRip.DD5.1.x264-SCONES[eztv.re] (2).torrent
2022-07-03 19:36 - 2022-07-03 19:36 - 000034803 _____ C:\Users\Joe\Downloads\The.Bridge.Race.to.a.Fortune.S01.720p.HMAX.WEBRip.DD5.1.x264-SCONES[eztv.re] (1).torrent
2022-07-03 18:30 - 2022-07-03 18:30 - 000021040 _____ C:\Users\Joe\Downloads\the.bridge.lb.s01e03.1080p.web.h264-skyfire[eztv.re].mkv.torrent
2022-06-30 12:17 - 2022-07-03 22:09 - 000000000 ____D C:\Users\Joe\Downloads\The.Bridge.Race.to.a.Fortune.S01.720p.HMAX.WEBRip.DD5.1.x264-SCONES[eztv.re]
2022-06-30 12:16 - 2022-06-30 12:16 - 000034803 _____ C:\Users\Joe\Downloads\The.Bridge.Race.to.a.Fortune.S01.720p.HMAX.WEBRip.DD5.1.x264-SCONES[eztv.re].torrent
2022-06-28 09:50 - 2022-06-28 09:50 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
2022-06-28 09:50 - 2022-06-28 09:50 - 000000000 ____D C:\Program Files\7-Zip
2022-06-27 20:12 - 2022-06-27 20:12 - 000021357 _____ C:\Users\Joe\Downloads\Signs.of.a.Psychopath.S04E10.480p.x264-mSD[eztv.re].mkv.torrent
2022-06-15 17:46 - 2022-06-15 17:46 - 000053448 _____ C:\Users\Joe\Downloads\Iron.Chef.Quest.for.an.Iron.Legend.S01.WEBRip.x264-ION10[eztv.re].torrent
2022-06-15 08:18 - 2022-06-15 08:18 - 001333760 _____ C:\Windows\SysWOW64\TextInputMethodFormatter.dll
2022-06-15 08:18 - 2022-06-15 08:18 - 000104448 _____ C:\Windows\system32\nettraceex.dll
2022-06-15 08:18 - 2022-06-15 08:18 - 000011787 _____ C:\Windows\system32\DrtmAuthTxt.wim
2022-06-15 08:17 - 2022-06-15 08:17 - 002260480 _____ C:\Windows\system32\TextInputMethodFormatter.dll
2022-06-15 08:17 - 2022-06-15 08:17 - 000232288 _____ C:\Windows\system32\containerdevicemanagement.dll
2022-06-15 08:01 - 2022-06-15 08:01 - 000000000 ___HD C:\$WinREAgent

==================== One month (modified) ==================

(If an entry is included in the fixlist, the file/folder will be moved.)

2022-07-12 16:20 - 2022-02-03 16:47 - 000000000 ____D C:\Windows\system32\SleepStudy
2022-07-12 16:19 - 2022-02-16 17:08 - 000000000 ____D C:\Program Files (x86)\Google
2022-07-11 20:05 - 2022-02-03 16:57 - 000004460 _____ C:\Windows\system32\PerfStringBackup.INI
2022-07-11 20:01 - 2019-12-07 03:14 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2022-07-11 19:58 - 2022-02-03 16:48 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2022-07-11 19:58 - 2022-02-03 16:47 - 000008192 ___SH C:\DumpStack.log.tmp
2022-07-11 19:56 - 2019-12-07 03:03 - 000262144 _____ C:\Windows\system32\config\BBI
2022-07-10 22:26 - 2022-02-03 17:40 - 001333112 _____ C:\Windows\ntbtlog.txt
2022-07-10 21:04 - 2022-02-03 18:11 - 000000214 _____ C:\Windows\Tasks\CreateExplorerShellUnelevatedTask.job
2022-07-10 21:02 - 2022-02-03 16:57 - 000000000 ____D C:\Users\Joe
2022-07-10 21:02 - 2019-12-07 03:03 - 000032768 _____ C:\Windows\system32\config\ELAM
2022-07-10 20:05 - 2019-12-07 03:14 - 000000000 ___HD C:\Windows\ELAMBKUP
2022-07-10 19:28 - 2019-12-07 03:14 - 000000000 ____D C:\Windows\AppReadiness
2022-07-10 18:09 - 2022-03-19 16:41 - 000000000 ____D C:\Users\Joe\AppData\LocalLow\Mozilla
2022-07-10 12:09 - 2019-12-07 03:13 - 000000000 ____D C:\Windows\INF
2022-07-07 19:10 - 2019-12-07 03:14 - 000000000 ___HD C:\Program Files\WindowsApps
2022-07-06 16:20 - 2022-02-16 17:09 - 000002247 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2022-07-06 16:20 - 2022-02-16 17:09 - 000002206 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2022-07-06 16:20 - 2022-02-16 17:09 - 000002206 _____ C:\ProgramData\Desktop\Google Chrome.lnk
2022-07-05 20:26 - 2022-02-03 17:20 - 000000000 ____D C:\Users\Joe\Desktop\diskprograms
2022-07-05 14:26 - 2022-02-03 21:20 - 000002364 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brave.lnk
2022-07-05 14:26 - 2022-02-03 21:20 - 000002323 _____ C:\Users\Public\Desktop\Brave.lnk
2022-07-05 14:26 - 2022-02-03 21:20 - 000002323 _____ C:\ProgramData\Desktop\Brave.lnk
2022-07-04 14:13 - 2022-02-03 21:19 - 000000000 ____D C:\Users\Joe\AppData\Local\PlaceholderTileLogoFolder
2022-07-04 14:13 - 2022-02-03 16:57 - 000000000 ____D C:\Users\Joe\AppData\Local\Packages
2022-07-04 02:51 - 2022-03-27 20:24 - 000000000 ____D C:\Users\Joe\AppData\Roaming\deluge
2022-06-27 14:56 - 2019-12-07 03:14 - 000000000 ____D C:\Windows\system32\NDF
2022-06-27 03:30 - 2022-03-27 15:46 - 000000000 ____D C:\Program Files\Wondershare
2022-06-24 13:40 - 2022-02-09 02:52 - 000000000 ____D C:\Users\Joe\AppData\Local\ElevatedDiagnostics
2022-06-22 17:38 - 2022-02-03 16:48 - 000000000 ____D C:\Windows\system32\Drivers\wd
2022-06-15 15:14 - 2022-02-03 16:47 - 000458424 _____ C:\Windows\system32\FNTCACHE.DAT
2022-06-15 15:11 - 2019-12-07 03:14 - 000000000 ___RD C:\Windows\ImmersiveControlPanel
2022-06-15 15:11 - 2019-12-07 03:14 - 000000000 ____D C:\Windows\SysWOW64\lv-LV
2022-06-15 15:11 - 2019-12-07 03:14 - 000000000 ____D C:\Windows\SysWOW64\lt-LT
2022-06-15 15:11 - 2019-12-07 03:14 - 000000000 ____D C:\Windows\SysWOW64\et-EE
2022-06-15 15:11 - 2019-12-07 03:14 - 000000000 ____D C:\Windows\SysWOW64\es-MX
2022-06-15 15:11 - 2019-12-07 03:14 - 000000000 ____D C:\Windows\SysWOW64\Dism
2022-06-15 15:11 - 2019-12-07 03:14 - 000000000 ____D C:\Windows\SystemResources
2022-06-15 15:11 - 2019-12-07 03:14 - 000000000 ____D C:\Windows\system32\ShellExperiences
2022-06-15 15:11 - 2019-12-07 03:14 - 000000000 ____D C:\Windows\system32\oobe
2022-06-15 15:11 - 2019-12-07 03:14 - 000000000 ____D C:\Windows\system32\lv-LV
2022-06-15 15:11 - 2019-12-07 03:14 - 000000000 ____D C:\Windows\system32\lt-LT
2022-06-15 15:11 - 2019-12-07 03:14 - 000000000 ____D C:\Windows\system32\et-EE
2022-06-15 15:11 - 2019-12-07 03:14 - 000000000 ____D C:\Windows\system32\es-MX
2022-06-15 15:11 - 2019-12-07 03:14 - 000000000 ____D C:\Windows\system32\Dism
2022-06-15 15:11 - 2019-12-07 03:14 - 000000000 ____D C:\Windows\system32\DDFs
2022-06-15 15:11 - 2019-12-07 03:14 - 000000000 ____D C:\Windows\bcastdvr
2022-06-15 15:11 - 2019-12-07 03:03 - 000000000 ____D C:\Windows\servicing
2022-06-15 08:27 - 2019-12-07 03:03 - 000000000 ____D C:\Windows\CbsTemp
2022-06-15 08:17 - 2022-02-03 16:50 - 002877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PrintConfig.dll
2022-06-15 07:59 - 2022-02-03 21:29 - 000000000 ____D C:\Windows\system32\MRT
2022-06-15 07:57 - 2022-02-03 21:29 - 145918784 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe

==================== Files in the root of some directories ========

2022-07-05 14:21 - 2022-07-05 14:21 - 000000218 _____ () C:\Users\Joe\AppData\Local\recently-used.xbel
2022-02-05 05:22 - 2022-02-05 06:34 - 000007612 _____ () C:\Users\Joe\AppData\Local\resmon.resmoncfg

==================== SigCheck ============================

(There is no automatic fix for files that do not pass verification.)

==================== End of FRST.txt ========================



 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-07-2022
Ran by Joe (12-07-2022 16:37:20)
Running from C:\Users\Joe\Downloads
Microsoft Windows 10 Home Version 21H2 19044.1766 (X64) (2022-02-03 22:53:09)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================


(If an entry is included in the fixlist, it will be removed.)

Administrator (S-1-5-21-3849092577-732279574-2253760070-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-3849092577-732279574-2253760070-503 - Limited - Disabled)
Guest (S-1-5-21-3849092577-732279574-2253760070-501 - Limited - Disabled)
Joe (S-1-5-21-3849092577-732279574-2253760070-1001 - Administrator - Enabled) => C:\Users\Joe
WDAGUtilityAccount (S-1-5-21-3849092577-732279574-2253760070-504 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 22.00 (x64) (HKLM\...\7-Zip) (Version: 22.00 - Igor Pavlov)
AmericasCardroom version 1.21.61 (HKLM-x32\...\{1B17EB4E-3E9C-4611-B8B5-31C0A00A1F68}_is1) (Version: 1.21.61 - Winning Poker Network, Inc.)
Brave (HKLM-x32\...\BraveSoftware Brave-Browser) (Version: 103.1.40.113 - Brave Software Inc)
Combo Cleaner (HKLM\...\{8C9F8853-52F7-46F3-BC78-98001D3FF40C}) (Version: 1.0.58.0 - RCS LT) Hidden
Combo Cleaner (HKLM-x32\...\InstallShield_{8C9F8853-52F7-46F3-BC78-98001D3FF40C}) (Version: 1.0.58.0 - RCS LT)
Deluge 1.3.15 (HKLM-x32\...\Deluge) (Version:  - )
GlassWire 2.3 (remove only) (HKLM-x32\...\GlassWire 2.3) (Version: 2.3.413 - SecureMix LLC)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 103.0.5060.114 - Google LLC)
Guarda 1.0.20 (HKU\S-1-5-21-3849092577-732279574-2253760070-1001\...\efc221e4-8306-5d6f-a018-a3ceae4bc72c) (Version: 1.0.20 - Guardarian OU)
Java 8 Update 333 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180333F0}) (Version: 8.0.3330.2 - Oracle Corporation)
K-Lite Codec Pack 16.0.5 Basic (HKLM-x32\...\KLiteCodecPack_is1) (Version: 16.0.5 - KLCP)
LibreOffice 7.3.3.2 (HKLM\...\{2C4A93B5-0849-44CC-8302-C73E05930E93}) (Version: 7.3.3.2 - The Document Foundation)
Malwarebytes version 4.5.10.200 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 4.5.10.200 - Malwarebytes)
Microsoft Update Health Tools (HKLM\...\{7B1FCD52-8F6B-4F12-A143-361EA39F5E7C}) (Version: 3.67.0.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2015-2019 Redistributable (x64) - 14.28.29325 (HKLM-x32\...\{33628a12-6787-4b9f-95a1-92449f69fae0}) (Version: 14.28.29325.2 - Microsoft Corporation)
Microsoft Visual C++ 2019 X64 Additional Runtime - 14.28.29325 (HKLM\...\{26AF0C35-55EC-4025-8D83-349E8FB1419F}) (Version: 14.28.29325 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2019 X64 Minimum Runtime - 14.28.29325 (HKLM\...\{7D0362D5-C699-4403-BC09-0C1DAD1D93AB}) (Version: 14.28.29325 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.30.30704 (HKLM-x32\...\{BF08E976-B92E-4336-B56F-2171179476C4}) (Version: 14.30.30704 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.30.30704 (HKLM-x32\...\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}) (Version: 14.30.30704 - Microsoft Corporation) Hidden
Oracle VM VirtualBox 6.0.24 (HKLM\...\{9EC88BBB-BAFD-4666-BFB1-5F737A76C055}) (Version: 6.0.24 - Oracle Corporation)
PGP Tool (HKLM-x32\...\{F4B842A1-6B0E-4B57-94E9-1F347EC1FE28}) (Version: 0.5.9.2 - Sergey Karpushin)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.54.1111.2021 - Realtek)
Revo Uninstaller 2.3.8 (HKLM\...\{A28DBDA2-3CC7-4ADC-8BFE-66D7743C6C97}_is1) (Version: 2.3.8 - VS Revo Group, Ltd.)
RuneScape Launcher 2.2.9 (HKLM\...\RuneScape Launcher_is1) (Version: 2.2.9 - Jagex Ltd)
Technitium MAC Address Changer v6.0 (HKLM-x32\...\TMACv6.0) (Version: 6.0 - Technitium)
VeraCrypt (HKLM-x32\...\VeraCrypt) (Version: 1.25.9 - IDRIX)
Windows PC Health Check (HKLM\...\{6798C408-2636-448C-8AC6-F4E341102D27}) (Version: 3.6.2204.08001 - Microsoft Corporation)

Packages:
=========
Ditto Clipboard -> C:\Program Files\WindowsApps\60145ScottBrogden.ditto-cp_3.24.214.0_x86__n6b029mg40na2 [2022-02-09] (Scott Brogden) [Startup Task]

==================== Custom CLSID (Whitelisted): ==============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-3849092577-732279574-2253760070-1001_Classes\CLSID\{0BAD39CB-DD3E-4F21-9156-649B0156C28E}\localserver32 -> C:\Windows\System32\DriverStore\FileRepository\wavesapo9de.inf_amd64_e99a314c3593d5e7\WavesSvc64.exe (Waves Inc -> Waves Audio Ltd.)
CustomCLSID: HKU\S-1-5-21-3849092577-732279574-2253760070-1001_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 -> C:\Users\Joe\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-3849092577-732279574-2253760070-1001_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 -> C:\Users\Joe\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-3849092577-732279574-2253760070-1001_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 -> C:\Users\Joe\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\amd64\FileSyncShell64.dll => No File
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} =>  -> No File
ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2022-06-15] (Igor Pavlov) [File not signed]
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2022-07-10] (Malwarebytes Inc. -> Malwarebytes)
ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2022-06-15] (Igor Pavlov) [File not signed]
ContextMenuHandlers6: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2022-06-15] (Igor Pavlov) [File not signed]
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2022-07-10] (Malwarebytes Inc. -> Malwarebytes)

==================== Codecs (Whitelisted) ====================

==================== Shortcuts & WMI ========================

==================== Loaded Modules (Whitelisted) =============

2019-08-15 17:13 - 2019-08-15 17:13 - 001265664 _____ () [File not signed] C:\Program Files (x86)\Combo Cleaner\runtimes\win-x64\native\e_sqlite3.dll
2022-02-09 16:51 - 2022-02-09 16:51 - 000017408 _____ () [File not signed] C:\Program Files\WindowsApps\60145ScottBrogden.ditto-cp_3.24.214.0_x86__n6b029mg40na2\ICU_Loader.dll
2022-02-09 16:51 - 2022-02-09 16:51 - 000043008 _____ (Ditto Utility Addin) [File not signed] C:\Program Files\WindowsApps\60145ScottBrogden.ditto-cp_3.24.214.0_x86__n6b029mg40na2\Addins\DittoUtil.dll
2022-06-28 09:50 - 2022-06-15 07:00 - 000094720 _____ (Igor Pavlov) [File not signed] C:\Program Files\7-Zip\7-zip.dll

==================== Alternate Data Streams (Whitelisted) ========

==================== Safe Mode (Whitelisted) ==================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Association (Whitelisted) =================

==================== Internet Explorer (Whitelisted) ==========

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = 
HKU\S-1-5-21-3849092577-732279574-2253760070-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:NewsFeed
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_333\bin\ssv.dll [2022-07-04] (Oracle America, Inc. -> Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_333\bin\jp2ssv.dll [2022-07-04] (Oracle America, Inc. -> Oracle Corporation)
IE Session Restore: HKU\S-1-5-21-3849092577-732279574-2253760070-1001 -> is enabled.

==================== Hosts content: =========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2019-12-07 03:14 - 2019-12-07 03:12 - 000000824 _____ C:\Windows\system32\drivers\etc\hosts

==================== Other Areas ===========================

(Currently there is no automatic fix for this section.)

HKLM\System\CurrentControlSet\Control\Session Manager\Environment\\Path -> C:\Program Files (x86)\Common Files\Oracle\Java\javapath;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;%SYSTEMROOT%\System32\OpenSSH\
HKU\S-1-5-21-3849092577-732279574-2253760070-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\Windows\img0.jpg
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 2) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: )
Windows Firewall is enabled.

Network Binding:
=============
VirtualBox Host-Only Network: VirtualBox NDIS6 Bridged Networking Driver -> oracle_VBoxNetLwf (enabled) 
Ethernet: VirtualBox NDIS6 Bridged Networking Driver -> oracle_VBoxNetLwf (enabled) 

==================== MSCONFIG/TASK MANAGER disabled items ==

(If an entry is included in the fixlist, it will be removed.)

MSCONFIG\Services: BTAGService => 3
MSCONFIG\Services: edgeupdate => 2
MSCONFIG\Services: edgeupdatem => 3
MSCONFIG\Services: Fax => 3
MSCONFIG\Services: MicrosoftEdgeElevationService => 3
HKLM\...\StartupApproved\StartupFolder: => "WinZip Preloader.lnk"
HKLM\...\StartupApproved\Run: => "WinZip FAH"
HKLM\...\StartupApproved\Run: => "WinZip UN"

==================== FirewallRules (Whitelisted) ================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [PlayTo-Out-UDP-PlayToScope] => (Block) C:\Windows\system32\mdeserver.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{42F8303C-6769-4F24-B065-705BCDAD508D}] => (Allow) LPort=57209
FirewallRules: [{79E5CCFE-E8D7-4B6D-B08C-19705D15D6EF}] => (Allow) LPort=57210
FirewallRules: [{72B02527-A515-4459-8D38-7987EEA0B49B}] => (Allow) LPort=57211
FirewallRules: [{BC3FCCDF-21B1-4024-A65F-12C810E69E57}] => (Allow) LPort=57212
FirewallRules: [{AA60BEA5-9DD7-4B10-852A-E95725A0B40A}] => (Allow) LPort=57213
FirewallRules: [{89CF8A51-2498-47AC-9DC8-05679C91718E}] => (Allow) LPort=57214
FirewallRules: [{6E97B614-99A3-4B9F-B45C-410CD085A9CB}] => (Allow) LPort=57215
FirewallRules: [{38FD68AC-4FD6-4F7C-B801-F3C62652CF4D}] => (Allow) LPort=57216
FirewallRules: [{DE970F42-233B-4205-AA72-6739F441074E}] => (Allow) LPort=57217
FirewallRules: [{DBD591BA-D5DF-4ADA-9129-1DAD88E61682}] => (Allow) LPort=57218
FirewallRules: [{218B4AE5-80E2-4040-A2D7-5DF344BAD2FF}] => (Allow) LPort=57209
FirewallRules: [{D83FA2D8-0EF0-418D-8BDD-2B723ECD022D}] => (Allow) LPort=57210
FirewallRules: [{6CB64AFB-99EB-4B8D-96CD-A9ABD3016726}] => (Allow) LPort=57211
FirewallRules: [{69FDD140-B8F0-4488-AC06-E56229BB1665}] => (Allow) LPort=57212
FirewallRules: [{86632BF0-9448-4F41-B102-F541778E9106}] => (Allow) LPort=57213
FirewallRules: [{A8B0C604-EB5B-41CB-A0F5-A2E0C11DB0C0}] => (Allow) LPort=57214
FirewallRules: [{BD972CCA-F860-4279-BF4A-5045B8888E90}] => (Allow) LPort=57215
FirewallRules: [{7050D961-1655-4100-BFC8-1C4D07924390}] => (Allow) LPort=57216
FirewallRules: [{054D3F2D-C330-4D06-8D3C-69B5B211CDBC}] => (Allow) LPort=57217
FirewallRules: [{E1678272-E6D9-4AF2-AB2F-AF0C44DA585A}] => (Allow) LPort=57218
FirewallRules: [{8B70E058-E68B-4CFE-A23A-56C44D3383AD}] => (Allow) LPort=23007
FirewallRules: [{59D9A2DD-8FBB-417C-880C-D000D4D391FE}] => (Allow) LPort=23008
FirewallRules: [{FBC6D3F2-7250-48CE-9D93-2CBCB4CFD8AD}] => (Allow) LPort=33009
FirewallRules: [{2BFD31A5-DB5E-4280-8FA3-DE18D87E5BD3}] => (Allow) LPort=33010
FirewallRules: [{A1CCC4E5-8C2A-4C91-82CF-DA8AF3FA9F0D}] => (Allow) LPort=33011
FirewallRules: [{F0E12F51-EB9E-4FA2-BC1A-D5F9376C8E23}] => (Allow) LPort=43012
FirewallRules: [{AD9FD02D-E481-4100-9433-4DCC6EEDC8C6}] => (Allow) LPort=43013
FirewallRules: [{A50AFCB8-55EF-4478-83E5-4CD0BFFDA107}] => (Allow) LPort=53014
FirewallRules: [{65DBB7FA-52BE-46FD-890A-166A8B5CA494}] => (Allow) LPort=53015
FirewallRules: [{53E2FB6B-D167-480D-9712-5F652B6781FE}] => (Allow) LPort=53016
FirewallRules: [{C3B2812A-DC11-40FE-8D80-95FFEDA62D6C}] => (Allow) LPort=23007
FirewallRules: [{11E2E188-EC74-4BFD-A704-CA7472075CF2}] => (Allow) LPort=23008
FirewallRules: [{2F43D48F-41E4-4440-A62F-9219787C7C1A}] => (Allow) LPort=33009
FirewallRules: [{258231E9-E795-4A64-846B-5BAC8444AA1E}] => (Allow) LPort=33010
FirewallRules: [{CF263972-ACAD-4A88-ACB0-353678260C21}] => (Allow) LPort=33011
FirewallRules: [{90E713D6-B816-452C-AEA3-F711D71A997D}] => (Allow) LPort=43012
FirewallRules: [{843F3868-1081-4EE7-8AD1-C9217BD7738A}] => (Allow) LPort=43013
FirewallRules: [{95035FFA-5B1D-458A-BC72-E270FDDFD0CD}] => (Allow) LPort=53014
FirewallRules: [{5DF1D473-A0CA-42A0-A623-CF1B1DB4A065}] => (Allow) LPort=53015
FirewallRules: [{59729738-3617-480E-9AE3-B2883C11F9CD}] => (Allow) LPort=53016
FirewallRules: [{A33917F1-3F5D-45E0-BCB1-78162D2D69C6}] => (Allow) LPort=50053
FirewallRules: [{626B8FE8-692E-4664-B79B-6E39172446A8}] => (Allow) LPort=50053
FirewallRules: [TCP Query User{AB556B5A-CC60-4DD0-A15E-3A46A6850BFA}C:\program files (x86)\deluge\deluge.exe] => (Allow) C:\program files (x86)\deluge\deluge.exe (Deluge Team) [File not signed]
FirewallRules: [UDP Query User{110F5D66-E29F-4692-89E7-172ACC502EE6}C:\program files (x86)\deluge\deluge.exe] => (Allow) C:\program files (x86)\deluge\deluge.exe (Deluge Team) [File not signed]
FirewallRules: [TCP Query User{2CBEF578-3909-4949-BFBA-EDB1BABBC95E}C:\program files (x86)\deluge\deluge.exe] => (Allow) C:\program files (x86)\deluge\deluge.exe (Deluge Team) [File not signed]
FirewallRules: [UDP Query User{32F9683D-3001-4C0D-89B1-44803B8127EE}C:\program files (x86)\deluge\deluge.exe] => (Allow) C:\program files (x86)\deluge\deluge.exe (Deluge Team) [File not signed]
FirewallRules: [{FC1DF530-119C-4FA7-8996-BEE9CFEE3701}] => (Allow) C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe (Brave Software, Inc. -> Brave Software, Inc.)
FirewallRules: [{CD1A4D21-0BD9-4BDA-9346-B05C5CA359A1}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe (Google LLC -> Google LLC)
FirewallRules: [{49091C40-30E1-41DA-A7B4-B16AB0E5DC01}] => (Allow) C:\Program Files (x86)\GlassWire\GWCtlSrv.exe (GlassWire -> SecureMix LLC)
FirewallRules: [{A90C42D4-67A1-4A27-ABB8-28B2A4EFDC56}] => (Allow) C:\Program Files (x86)\GlassWire\GWCtlSrv.exe (GlassWire -> SecureMix LLC)
FirewallRules: [{519100F7-7F91-41CF-BDD1-EDA42662B0A1}] => (Allow) c:\program files (x86)\glasswire\gwctlsrv.exe (GlassWire -> SecureMix LLC)
FirewallRules: [{895B0F1C-C102-4250-BE52-A3B529AF7098}] => (Allow) c:\program files\malwarebytes\anti-malware\mbamtray.exe (Malwarebytes Inc. -> Malwarebytes)
FirewallRules: [{BF83EBB4-5466-464C-BE05-6BABAD256961}] => (Allow) c:\program files (x86)\google\update\googleupdate.exe (Google LLC -> Google LLC)
FirewallRules: [{7464BC6F-ED6F-4C73-934B-B51000727FCF}] => (Allow) c:\users\joe\desktop\mbar\mbar.exe (Malwarebytes Corporation -> Malwarebytes Corporation)
FirewallRules: [{37203E91-58B9-4A38-894B-630BB7FF69F5}] => (Allow) c:\program files\oracle\virtualbox\virtualbox.exe (Oracle Corporation -> Oracle Corporation)
FirewallRules: [{4F09AB14-B1E1-41D2-B70E-694791957ADC}] => (Allow) c:\program files (x86)\bravesoftware\update\braveupdate.exe (Brave Software, Inc. -> BraveSoftware Inc.)
FirewallRules: [{986C48DD-BE77-489B-85EC-4C26B71D4231}] => (Allow) c:\windows\system32\msiexec.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{E98BC090-EA3B-44A3-AFAD-9D31B2BC0AAE}] => (Allow) c:\windows\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{2A667BFC-43B3-46F5-BE43-3198E0CE7D9A}] => (Allow) c:\windows\syswow64\werfault.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{0D995698-B1AF-433A-9CB4-15D69E253C39}] => (Allow) c:\program files\malwarebytes\anti-malware\mbaminstallerservice.exe (Malwarebytes Inc. -> Malwarebytes)
FirewallRules: [{370B435F-2AE8-4E42-830C-BCF429345BAE}] => (Block) c:\program files\vs revo group\revo uninstaller\revounin.exe (VS Revo Group Ltd. -> VS Revo Group)
FirewallRules: [{A7349C9B-E970-46CE-A7F7-40A70A54807E}] => (Allow) c:\windows\system32\devicecensus.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{E704112F-FE2F-40B7-AD77-54F9B833C648}] => (Allow) c:\windows\system32\smartscreen.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{20F29E81-3D34-446C-B837-7BDACFC9F318}] => (Allow) c:\windows\immersivecontrolpanel\systemsettings.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{009AE661-1994-4612-9AE1-081C1D662C04}] => (Allow) c:\windows\system32\taskhostw.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{AD391811-3B17-4FC7-ADF4-DE6599080BAD}] => (Allow) c:\windows\syswow64\rundll32.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{9FB530E3-C834-45F1-8F26-18E034C01F4E}] => (Allow) c:\program files\oracle\virtualbox\virtualboxvm.exe (Oracle Corporation -> Oracle Corporation)
FirewallRules: [{941DA881-25E5-4C9C-B4B5-9490FACFE4D9}] => (Allow) c:\program files\windowsapps\microsoft.windowsstore_22205.1401.13.0_x64__8wekyb3d8bbwe\winstore.app.exe (Microsoft Corporation) [File not signed]
FirewallRules: [{1037DEBB-9EB6-4AB2-A28C-DF8E0F01ECD5}] => (Allow) c:\users\joe\desktop\tor browser\browser\torbrowser\tor\tor.exe () [File not signed]
FirewallRules: [{BA93EDAC-1D73-4307-B7A1-BBABA869FF37}] => (Allow) c:\program files\malwarebytes\anti-malware\mbam.exe (Malwarebytes Inc -> Malwarebytes)
FirewallRules: [{1D1BF095-3492-49F1-923B-3B0AF79CED30}] => (Allow) c:\windows\system32\backgroundtaskhost.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{02B8198A-8D1B-4B18-A711-9C89C5206468}] => (Allow) c:\program files\google\chrome\application\chrome.exe (Google LLC -> Google LLC)
FirewallRules: [{750704F9-C82B-4D04-9A19-909C1A654A7C}] => (Allow) c:\program files\bravesoftware\brave-browser\application\brave.exe (Brave Software, Inc. -> Brave Software, Inc.)
FirewallRules: [{BCAD787A-87EC-4EA3-83CA-18E6D66D5AAD}] => (Allow) c:\windows\system32\mousocoreworker.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{61E42C0C-3E0B-4467-9E52-243CA479554D}] => (Allow) c:\program files (x86)\technitium\tmacv6.0\tmac.exe (Technitium) [File not signed]
FirewallRules: [{306598FF-C543-445B-92E7-991E325D02E2}] => (Allow) c:\program files (x86)\common files\java\java update\jusched.exe (Oracle America, Inc. -> Oracle Corporation)
FirewallRules: [{57885DA8-08CF-4CAC-A80B-4E36F780CBFC}] => (Allow) c:\windows\system32\backgroundtransferhost.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{69DF9D98-3BE7-448D-9D57-E4BD2FC8982F}] => (Allow) c:\users\joe\appdata\local\eset\esetonlinescanner\esetonlinescanner.exe (ESET, spol. s r.o. -> ESET)
FirewallRules: [{7C9EE53C-A0FB-4886-B2FB-F1DCE8974540}] => (Allow) c:\program files\malwarebytes\anti-malware\mbamservice.exe (Malwarebytes Inc. -> Malwarebytes)
FirewallRules: [{B08CED60-9F8E-43E0-BFCA-FF48A58F49C5}] => (Allow) c:\windows\system32\apphostregistrationverifier.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{08E12063-AF95-4D62-A5A0-4EF79BDE8673}] => (Allow) c:\windows\system32\sihclient.exe (Microsoft Windows Publisher -> Microsoft Corporation)
FirewallRules: [{27D0C8C3-EF59-45CE-BF0E-6ACA07266EE2}] => (Block) c:\users\joe\downloads\mbsetup (1).exe (Malwarebytes Inc. -> Malwarebytes)
FirewallRules: [{65B4D845-2F28-4596-AA10-5E1797C3A38E}] => (Allow) c:\programdata\microsoft\windows defender\platform\4.18.2205.7-0\msmpeng.exe (Microsoft Windows Publisher -> Microsoft Corporation)
FirewallRules: [{5E838B64-4BF1-414B-A84D-4250EE042B6C}] => (Allow) c:\windows\system32\compattelrunner.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{BABE7F5E-2816-4DF9-AF12-2BC5097B7AE2}] => (Allow) c:\program files (x86)\glasswire\gwctlsrv.exe (GlassWire -> SecureMix LLC)
FirewallRules: [{70EE75CE-DF7E-42F2-9EDD-3C05023C2E55}] => (Allow) c:\program files\malwarebytes\anti-malware\mbamtray.exe (Malwarebytes Inc. -> Malwarebytes)
FirewallRules: [{E343DFC3-56B6-420D-A104-F507EA43C34B}] => (Allow) c:\program files (x86)\google\update\googleupdate.exe (Google LLC -> Google LLC)
FirewallRules: [{2D9084C3-E9A3-46A6-81E9-0695901453AA}] => (Allow) c:\users\joe\desktop\mbar\mbar.exe (Malwarebytes Corporation -> Malwarebytes Corporation)
FirewallRules: [{5DC6E7F5-2700-409F-BCAB-FDDC7345B693}] => (Allow) c:\program files\oracle\virtualbox\virtualbox.exe (Oracle Corporation -> Oracle Corporation)
FirewallRules: [{AE2C3CB3-9A49-41E2-BBC2-59BEC476FC22}] => (Allow) c:\program files (x86)\bravesoftware\update\braveupdate.exe (Brave Software, Inc. -> BraveSoftware Inc.)
FirewallRules: [{A683B5BA-4388-47DF-93BF-529E4B52BD4B}] => (Allow) c:\windows\system32\msiexec.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{349EE6A7-668C-4A76-AE8A-6171F439AA95}] => (Allow) c:\windows\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{36F6329D-DD99-4F40-9AAA-6B180BCF88A2}] => (Allow) c:\windows\syswow64\werfault.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{989B598C-1E80-4BDA-B1A1-8E19040A2BD4}] => (Allow) c:\program files\malwarebytes\anti-malware\mbaminstallerservice.exe (Malwarebytes Inc. -> Malwarebytes)
FirewallRules: [{CAAC6CD2-5D2D-405C-98D5-1B2E77588BE1}] => (Block) c:\program files\vs revo group\revo uninstaller\revounin.exe (VS Revo Group Ltd. -> VS Revo Group)
FirewallRules: [{BE8DF911-D139-45D6-87CB-9266EBECA848}] => (Allow) c:\windows\system32\devicecensus.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{89FFE6A3-BF76-4086-A476-546D7935281C}] => (Allow) c:\windows\system32\smartscreen.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{CFD00E4C-FEF5-48FD-A785-4CB7061B8B64}] => (Allow) c:\windows\immersivecontrolpanel\systemsettings.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{200019A0-3CD5-45E9-9C6B-BDED2F3BB517}] => (Allow) c:\windows\system32\taskhostw.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{DF937113-BCF1-4030-991D-2B44192A7F8E}] => (Allow) c:\windows\syswow64\rundll32.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{EF557729-AD8E-44EA-BFCF-AB3D5238973B}] => (Allow) c:\program files\oracle\virtualbox\virtualboxvm.exe (Oracle Corporation -> Oracle Corporation)
FirewallRules: [{4A56FF89-6F05-405A-8D21-D6E9F1BFA6AE}] => (Allow) c:\program files\windowsapps\microsoft.windowsstore_22205.1401.13.0_x64__8wekyb3d8bbwe\winstore.app.exe (Microsoft Corporation) [File not signed]
FirewallRules: [{8EDF8F23-2FAA-45DF-AC93-4276196FA6A4}] => (Allow) c:\users\joe\desktop\tor browser\browser\torbrowser\tor\tor.exe () [File not signed]
FirewallRules: [{1E1C5D29-C318-4035-8193-5A5D007CAD48}] => (Allow) c:\program files\malwarebytes\anti-malware\mbam.exe (Malwarebytes Inc -> Malwarebytes)
FirewallRules: [{5E9BFEAB-5EA0-4998-B196-2F24C8601DBA}] => (Allow) c:\windows\system32\backgroundtaskhost.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{B4C9A562-A192-4513-A7FC-144A3A72949F}] => (Allow) c:\program files\google\chrome\application\chrome.exe (Google LLC -> Google LLC)
FirewallRules: [{D5C559F3-F513-41E7-92F6-963A035E3571}] => (Allow) c:\program files\bravesoftware\brave-browser\application\brave.exe (Brave Software, Inc. -> Brave Software, Inc.)
FirewallRules: [{F41B7E94-5C4F-4D39-8522-2994B5C8323A}] => (Allow) c:\windows\system32\mousocoreworker.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{11F0C01D-56B2-4517-8AC1-AC54B82833A5}] => (Allow) c:\program files (x86)\technitium\tmacv6.0\tmac.exe (Technitium) [File not signed]
FirewallRules: [{1EA72AE8-5FC7-4163-B2DA-90020E6C81FB}] => (Allow) c:\program files (x86)\common files\java\java update\jusched.exe (Oracle America, Inc. -> Oracle Corporation)
FirewallRules: [{C8FCEDD4-F8F1-41E6-9260-18C6850FF400}] => (Allow) c:\windows\system32\backgroundtransferhost.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{AC472B6E-0513-47D4-9EFD-16B3B4064F54}] => (Allow) c:\users\joe\appdata\local\eset\esetonlinescanner\esetonlinescanner.exe (ESET, spol. s r.o. -> ESET)
FirewallRules: [{115C5823-EF39-40CF-B2F7-932E07E70543}] => (Allow) c:\program files\malwarebytes\anti-malware\mbamservice.exe (Malwarebytes Inc. -> Malwarebytes)
FirewallRules: [{F4325DBE-6C97-42E2-A48E-C2967B9F57C3}] => (Allow) c:\windows\system32\apphostregistrationverifier.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{644B02D5-F45E-4255-9377-F38FE8205864}] => (Allow) c:\windows\system32\sihclient.exe (Microsoft Windows Publisher -> Microsoft Corporation)
FirewallRules: [{29DE8F7F-9AC5-472E-928B-AF39124C8566}] => (Block) c:\users\joe\downloads\mbsetup (1).exe (Malwarebytes Inc. -> Malwarebytes)
FirewallRules: [{946E38A5-A0FB-4E1A-955D-E52D68C50151}] => (Allow) c:\programdata\microsoft\windows defender\platform\4.18.2205.7-0\msmpeng.exe (Microsoft Windows Publisher -> Microsoft Corporation)
FirewallRules: [{F64B6A13-6D3A-4645-A62E-B897A1B7BC28}] => (Allow) c:\windows\system32\compattelrunner.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{5DFFC5D3-F5F3-4A56-99E2-685CCE532D87}] => (Block) c:\users\joe\appdata\local\temp\{fb3c3690-0753-42e7-a4a7-fa10eacc306b}\{91b345ba-3b56-43d1-8368-b473ef2a90fc}.exe => No File
FirewallRules: [{DCA649FA-4C3C-441F-955F-DCB9FF07F233}] => (Block) c:\users\joe\appdata\local\temp\{fb3c3690-0753-42e7-a4a7-fa10eacc306b}\{91b345ba-3b56-43d1-8368-b473ef2a90fc}.exe => No File
FirewallRules: [{E367B830-B72F-4FEF-9FCB-8C5429C2F110}] => (Allow) c:\users\joe\appdata\local\temp\{e601b0e7-7adf-49f0-89f7-d580fe6f2db6}\{55fe374f-0da6-402a-8d01-a19f19fccdc7}.exe => No File
FirewallRules: [{3B080532-57F7-4572-A6FD-4AB77F066301}] => (Allow) c:\users\joe\appdata\local\temp\{e601b0e7-7adf-49f0-89f7-d580fe6f2db6}\{55fe374f-0da6-402a-8d01-a19f19fccdc7}.exe => No File
FirewallRules: [{4E4F3443-0486-4B8F-B2AD-622E455CB069}] => (Block) c:\users\joe\downloads\kav21.3.10.391en_26074.exe (Kaspersky Lab JSC -> Kaspersky)
FirewallRules: [{FC856AC5-A3E2-4FEC-A6C3-C265A2E530E8}] => (Block) c:\users\joe\downloads\kav21.3.10.391en_26074.exe (Kaspersky Lab JSC -> Kaspersky)
FirewallRules: [{BDC2CC0C-EAA9-41E8-8AA5-3E7BFDF5DC5B}] => (Block) c:\users\joe\appdata\local\temp\{772c7ed8-fb83-4cc3-8efa-e6cb8f54cf74}\{da99d10e-5fc3-4d3d-a2d2-48ab25ddd00b}.exe => No File
FirewallRules: [{14A7CA90-4A71-4622-9DD4-DC7BA5E21360}] => (Block) c:\users\joe\appdata\local\temp\{772c7ed8-fb83-4cc3-8efa-e6cb8f54cf74}\{da99d10e-5fc3-4d3d-a2d2-48ab25ddd00b}.exe => No File
FirewallRules: [{30A7E52F-4541-4D5B-8BB5-377485DD2C35}] => (Allow) c:\program files (x86)\windows media player\wmplayer.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{BCE0D7C7-B384-40EE-AED5-6CF6B83699E5}] => (Allow) c:\program files (x86)\windows media player\wmplayer.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{0D23CC7A-FB82-4675-9584-D6C4CF1EF897}] => (Allow) c:\users\joe\appdata\local\temp\{ef7371c4-b18e-4daa-b686-3d2508ecd67c}\ccsetup.exe (RCS LT, UAB -> RCS LT)
FirewallRules: [{D7C78BA4-8703-4247-B8F8-D053B9B98335}] => (Allow) c:\users\joe\appdata\local\temp\{ef7371c4-b18e-4daa-b686-3d2508ecd67c}\ccsetup.exe (RCS LT, UAB -> RCS LT)
FirewallRules: [{0ABEC064-F2D5-407F-92E4-4BCA1FEE5223}] => (Allow) c:\program files (x86)\combo cleaner\combocleaner.winservice.exe (RCS LT, UAB -> RCS LT)
FirewallRules: [{910D2880-9B1F-44BE-8BF2-5339C550EE5E}] => (Allow) c:\program files (x86)\combo cleaner\combocleaner.winservice.exe (RCS LT, UAB -> RCS LT)
FirewallRules: [{94D78331-ED0E-470C-8A91-EF56FAE02821}] => (Allow) c:\program files (x86)\combo cleaner\combocleaner.guard.exe (RCS LT, UAB -> RCS LT)
FirewallRules: [{0FD4023B-F9D4-4417-A87F-6F6AE86356C2}] => (Allow) c:\program files (x86)\combo cleaner\combocleaner.guard.exe (RCS LT, UAB -> RCS LT)
FirewallRules: [{FCD3E030-E0CF-48B5-8B31-8B016FD1A47A}] => (Allow) c:\program files (x86)\combo cleaner\combocleaner.exe (RCS LT, UAB -> RCS LT)
FirewallRules: [{575BFF07-C79A-4D11-B748-1FD960007985}] => (Allow) c:\program files (x86)\combo cleaner\combocleaner.exe (RCS LT, UAB -> RCS LT)
FirewallRules: [{973806A7-8335-4085-B1BA-6F4591B1DEDB}] => (Allow) c:\program files\java\jre1.8.0_333\bin\javaw.exe
FirewallRules: [{B264D9DA-3B7A-485C-85E3-0C2BD21EDD6F}] => (Allow) c:\program files\java\jre1.8.0_333\bin\javaw.exe
FirewallRules: [{AB43C1B7-36E1-42D2-80AA-92390EC5E64E}] => (Allow) c:\windows\system32\wermgr.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{A02A9C1A-7F3B-47D4-8C72-56D0759FDEE4}] => (Allow) c:\windows\system32\wermgr.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{9C0B80BD-F1C6-4C4B-B1CA-F28C989BFA62}] => (Allow) c:\users\joe\downloads\frst64.exe (Farbar) [File not signed]
FirewallRules: [{0A09B05A-25E8-4ECD-B317-F466CC703869}] => (Allow) c:\users\joe\downloads\frst64.exe (Farbar) [File not signed]

==================== Restore Points =========================

24-06-2022 19:13:51 Scheduled Checkpoint
27-06-2022 03:31:49 Removed WinZip 26.0.
04-07-2022 11:31:58 Installed PGP Tool
08-07-2022 15:25:05 Windows Update
10-07-2022 12:08:41 Installed Oracle VM VirtualBox 6.0.24

==================== Faulty Device Manager Devices ============


==================== Event log errors: ========================

Application errors:
==================

System errors:
=============
Error: (07/11/2022 07:59:04 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (45000 milliseconds) while waiting for the ComboCleaner.Guard service to connect.

Error: (07/11/2022 07:59:04 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (45000 milliseconds) while waiting for the ComboCleaner.WinService service to connect.

Error: (07/11/2022 07:55:48 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The ComboCleaner.WinService service terminated unexpectedly.  It has done this 1 time(s).

Error: (07/11/2022 07:55:47 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The ComboCleaner.Guard service terminated unexpectedly.  It has done this 1 time(s).

Error: (07/11/2022 12:23:01 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The eapihdrv service failed to start due to the following error: 
This driver has been blocked from loading

Error: (07/11/2022 12:23:01 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\Joe\AppData\Local\Temp\ehdrv.sys

Error: (07/11/2022 12:23:00 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The eapihdrv service failed to start due to the following error: 
This driver has been blocked from loading

Error: (07/11/2022 12:23:00 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\Joe\AppData\Local\Temp\ehdrv.sys


Windows Defender:
================
Date: 2022-07-11 20:01:26
Description: 
Controlled Folder Access blocked C:\Program Files (x86)\Combo Cleaner\ComboCleaner.Guard.exe from making changes to memory.
Detection time: 2022-07-12T02:01:26.990Z
Path: \Device\Harddisk0\DR0
Process Name: C:\Program Files (x86)\Combo Cleaner\ComboCleaner.Guard.exe
Security intelligence Version: 1.369.1114.0
Engine Version: 1.1.19300.2
Product Version: 4.18.2205.7

Date: 2022-07-10 08:06:18
Description: 
C:\Program Files (x86)\Windows Media Player\wmplayer.exe has been blocked from modifying %userprofile%\Music by Controlled Folder Access.
Detection time: 2022-07-10T14:06:18.935Z
Path: %userprofile%\Music
Process Name: C:\Program Files (x86)\Windows Media Player\wmplayer.exe
Security intelligence Version: 1.369.1053.0
Engine Version: 1.1.19300.2
Product Version: 4.18.2205.7

Date: 2022-07-10 07:51:18
Description: 
C:\Program Files (x86)\Windows Media Player\wmplayer.exe has been blocked from modifying %userprofile%\Music by Controlled Folder Access.
Detection time: 2022-07-10T13:51:18.886Z
Path: %userprofile%\Music
Process Name: C:\Program Files (x86)\Windows Media Player\wmplayer.exe
Security intelligence Version: 1.369.1053.0
Engine Version: 1.1.19300.2
Product Version: 4.18.2205.7

Date: 2022-07-10 07:36:18
Description: 
C:\Program Files (x86)\Windows Media Player\wmplayer.exe has been blocked from modifying %userprofile%\Music by Controlled Folder Access.
Detection time: 2022-07-10T13:36:18.808Z
Path: %userprofile%\Music
Process Name: C:\Program Files (x86)\Windows Media Player\wmplayer.exe
Security intelligence Version: 1.369.1053.0
Engine Version: 1.1.19300.2
Product Version: 4.18.2205.7

Date: 2022-07-10 07:21:18
Description: 
C:\Program Files (x86)\Windows Media Player\wmplayer.exe has been blocked from modifying %userprofile%\Music by Controlled Folder Access.
Detection time: 2022-07-10T13:21:18.741Z
Path: %userprofile%\Music
Process Name: C:\Program Files (x86)\Windows Media Player\wmplayer.exe
Security intelligence Version: 1.369.1053.0
Engine Version: 1.1.19300.2
Product Version: 4.18.2205.7
Event[0]:

Date: 2022-07-10 21:04:14
Description: 
Microsoft Defender Antivirus Real-Time Protection feature has encountered an error and failed.
Feature: On Access
Error Code: 0x8007043c
Error description: This service cannot be started in Safe Mode 
Reason: Antimalware security intelligence has stopped functioning for an unknown reason. In some instances, restarting the service may resolve the problem.

Date: 2022-06-28 09:31:11
Description: 
Microsoft Defender Antivirus has encountered an error trying to update security intelligence.
New security intelligence Version: 
Previous security intelligence Version: 1.369.385.0
Update Source: Microsoft Update Server
Security intelligence Type: AntiVirus
Update Type: Full
Current Engine Version: 
Previous Engine Version: 1.1.19300.2
Error code: 0x80240438
Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support. 

Date: 2022-06-27 14:55:32
Description: 
Microsoft Defender Antivirus has encountered an error trying to update security intelligence.
New security intelligence Version: 
Previous security intelligence Version: 1.369.339.0
Update Source: Microsoft Update Server
Security intelligence Type: AntiVirus
Update Type: Full
Current Engine Version: 
Previous Engine Version: 1.1.19300.2
Error code: 0x80240438
Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support. 

CodeIntegrity:
===============
Date: 2022-07-12 11:06:36
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume3\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Microsoft signing level requirements.


==================== Memory info =========================== 

BIOS: Dell Inc. 1.5.1 08/20/2021
Motherboard: Dell Inc. 05GD68
Processor: Intel(R) Core(TM) i3-10100 CPU @ 3.60GHz
Percentage of memory in use: 88%
Total physical RAM: 7939.7 MB
Available physical RAM: 875.48 MB
Total Virtual: 107939.7 MB
Available Virtual: 96313.85 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:930.9 GB) (Free:735.43 GB) (Model: ST1000DM003-1ER162) NTFS

\\?\Volume{ed0d7c0f-3ac1-432b-aaff-68efd11e914e}\ () (Fixed) (Total:0.09 GB) (Free:0.07 GB) FAT32

==================== MBR & Partition Table ====================

==========================================================
Disk: 0 (Size: 238.5 GB) (Disk ID: AEAF30DB)

Partition: GPT.

==========================================================
Disk: 1 (Size: 931.5 GB) (Disk ID: 950BCDB1)

Partition: GPT.

==================== End of Addition.txt =======================

Link to post
Share on other sites

Okay files attached. I also got this from event viewer.

 

Fault bucket 1954560954796592393, type 5
Event Name: RADAR_PRE_LEAK_64
Response: Not available
Cab Id: 0

Problem signature:
P1: FRST64.exe
P2: 11.7.2022.0
P3: 10.0.19044.2.0.0
P4: 
P5: 
P6: 
P7: 
P8: 
P9: 
P10: 

Attached files:
\\?\C:\Users\Joe\AppData\Local\Temp\RDRBE7D.tmp\empty.txt
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF1A.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERC005.tmp.xml

These files may be available here:


Analysis symbol: 
Rechecking for solution: 0
Report Id: 8a35389a-8d50-4904-a8bd-923369d85cff
Report Status: 268435456
Hashed bucket: 81f4a397ddc61204db1ffed52a7fcd09
Cab Guid: 0

Addition.txt FRST.txt

Link to post
Share on other sites

Also have Crypto miners on my router. Hive OS GPU's and a couple asic miners...
My connect keeps going out for the web but lights and everything say connected on modem and router, but can't connect. Or modem drops and reset randomly, multiple times a day, now.
HiveOS has alot of events that seem shady to me, but i dont know.
I not sure if i did the scan with them connected should I?



 

Link to post
Share on other sites

  • Root Admin

Did you install the Crypto miners on your router on purpose?

Please consider doing a Factory Reset of your router if you own it.

 

 

Please ensure that you have the user manual for your router. Then perform a factory reset.

How To Reset Your Router
https://setuprouter.com/networking/how-to-reset-your-router/

 

Depending on one's preferences and the Router's capabilities please consider the following.

  • Disable acceptance of ICMP Pings
  • Change the Default Router password using a Strong Password
  • Use a Strong WiFi password on WPA2  using AES encryption or Enable WPA3 if it is an option.
  • Disable Remote Management
  • Create separate WiFi networks for groups of devices with similar purposes to prevent an entire network of devices from being compromised if a malicious actor is able to gain unauthorized access to one device or network. Example: Keep IoT devices on one network and mobile devices on another.
  • Change the network name (SSID).  Do not use your; Name, Postal address, or other personal information.  Make it unique or whimsical and known to your family/group.
  • Is the Router Firmware up-to-date?  Updating the firmware mitigates exploitable vulnerabilities.
  • Specifically set Firewall rules to BLOCK;   TCP and UDP ports 135 ~ 139, 445, 1234, 3389 and 5555
  • Document passwords created and store them in a safe but accessible location.

 

 

 

Please temporarily uninstall the following program. Go to Control Panel, Programs, Programs and Features and uninstall

Combo Cleaner
 

 

 

Your DNS Servers: 192.168.1.1

Please consider changing your default DNS Server settings. Please choose one provider only

DNS is what lets users connect to websites using domain names instead of IP addresses

  • Google Public DNS: IPv4   8.8.8.8 and 8.8.4.4   IPv6   2001:4860:4860::8888 and 2001:4860:4860::8844
  • Cloudflare: IPv4   1.1.1.1 and 1.0.0.1   IPv6   2606:4700:4700::1111 and 2606:4700:4700::1001
  • OpenDNS: IPv4   208.67.222.222 and 208.67.220.220  IPv6  2620:119:35::35 and 2620:119:53::53
  • DNSWATCH: IPv4   84.200.69.80 and 84.200.70.40   IPv6  2001:1608:10:25::1c04:b12f and 2001:1608:10:25::9249:d69b

The Ultimate Guide to Changing Your DNS Server
https://www.howtogeek.com/167533/the-ultimate-guide-to-changing-your-dns-server/

Here is a YouTube video on Changing DNS settings if needed

 

 

 

After you have uninstalled Combo Cleaner please run the following fix.

Once the fix has been completed, please attach back the FIXLOG.txt file.

 

Please download the attached fixlist.txt file and save it to the Desktop or location where you ran FRST from.
NOTE. It's important that both files, FRST or FRST64, and fixlist.txt are in the same location or the fix will not work.

Please make sure you disable any real-time antivirus or security software before running this script. Once completed, make sure you re-enable it.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt) or wherever you ran FRST from. Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

NOTE-1:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity. Depending on the speed of your computer this fix may take 30 minutes or more.

NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. Also, make sure you know the passwords for all websites as cookies will also be removed. The use of an external password manager is highly recommended instead of using your browser to store passwords.

NOTE-3: As part of this fix it will also reset the network to default settings including the firewall. If you have custom firewall rules you need to save please export or save them first before running this fix.

The following directories are emptied:

  • Windows Temp
  • Users Temp folders
  • Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
  • Recently opened files cache
  • Discord cache
  • Java cache
  • Steam HTML cache
  • Explorer thumbnail and icon cache
  • BITS transfer queue (qmgr*.dat files)
  • Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run.

fixlist.txt

Thanks

 

Link to post
Share on other sites

Okay..... This pc is getting old.....Im open to just getting new PC, modem and router. I had setup vpn with nord and ran that thru DD-wrt netgear router. But i felt(observed)what seemed to be  possible exploits, high jacking, etc, get by..... and i cant say for sure, but event viewer and other logs i would search would say restore anything deleted silent, erase log files.......

ANWAYS, end of day, ill factory reboot like nothing, i have no files that i NEED to keep. I dont have money in bank accounts,... So there really nothing they can get or havent tried to cause there not much to get. 
ADVICE?

But in scheme of things, id be fine with just getting all new gear instead of chasing down possible exploits in root, boot, etc and trying to chase them all over my PC.

Its time vs money..... rather start fresh in few days, than take the time and research and try and hunt them down for how long  if they deep in here rooted?


BUT 100% I will implement everything you advised  unless you like save possible headache and time and just go all new.....


Thank you so much for your time.....

Fixlog.txt

Link to post
Share on other sites

also,, I use Technitium MAC Address Changer, before every time i connect. but after couple hours modem starts flashing all its lights, drops connects or all the lights stay on and browser wont connect and lights show data transfer. and if i change mac addresses connected on the fly, everything will work find for couple hours, then same thing modem starts flashing all its lights and no connections, but then all lights go to normal connect display and show traffic, but browsers wont work and cant get into router via ip  until i unplg devices they reset and then work fine for 10-20min and then same thing over......????

Link to post
Share on other sites

  • Root Admin

I'm not aware of any exploits to the dd-wrt but perhaps it's best you check on their site for your make and model and to see how to update the firmware for it and reset using their methods.

https://dd-wrt.com/

According to the logs this is not an old computer.

BIOS: Dell Inc. 1.5.1 08/20/2021
Motherboard: Dell Inc. 05GD68

We can do a CLEAN install of Windows 10 or Windows 11 if you like. Since this is a OEM Dell computer the license should be baked in so to speak.

 

Please click on START SEARCH and type in "Activation" and you should get something like the following

image.png

Click on that and take a screenshot of it and post back here please.

 

Example:

image.png

 

 

 

Edited by AdvancedSetup
Updated information
Link to post
Share on other sites

Did i do everything i could, i got my pc with NO wifi card so its always disabled connect through nordvpn double proxy configured in ddwrt router.   Was everything good in fix list? anything else i can do 

  • Disable acceptance of ICMP Pings
     
  • Specifically set Firewall rules to BLOCK;   TCP and UDP ports 135 ~ 139, 445, 1234, 3389 and 5555

     
Link to post
Share on other sites

  • Root Admin

I don't know how the computer got infected. We don't do forensic analysis. We try to detect and remove infections.

Once we have the computer cleaned up we can discuss ways to help better protect it.

 

 

 

 

Please click on START SEARCH and type in "Activation" and you should get something like the following

image.png

Click on that and take a screenshot of it and post back here please.

 

Example:

image.png

 

 

 

Link to post
Share on other sites

  • 3 weeks later...
  • Root Admin

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks

 

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.