Suoer Slow Laptop - Help Needed

Thank you! Here are the logs:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 02.08.2018
Ran by [removed] (administrator) on DESKTOP-QE7O08I (10-08-2018 14:32:32)
Running from C:\Users\[removed]\Downloads
[removed] Platform: Windows 10 Home Version 1703 15063.786 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Edge)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Antivirus\AVGSvc.exe
(Intel Corporation) C:\Windows\SysWOW64\esif_uf.exe
(ASUS) C:\Program Files (x86)\ASUS\ASUS GIFTBOX Desktop\ASUSGiftBoxDesktop.exe
(ASUS Cloud Corporation) C:\Program Files (x86)\ASUS\WebStorage\2.2.2.524\AsusWSWinService.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Antivirus\x64\aswidsagenta.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Security Assist\isa.exe
(Microsoft Corporation) C:\Program Files\rempl\sedlauncher.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(Intel Corporation) C:\Windows\Temp\DPTF\esif_assist_64.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
() C:\Windows\System32\igfxTray.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Antivirus\AVGUI.exe
(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
(CenturyLink Inc) C:\Program Files (x86)\CenturyLink\Desktop\CenturyLinkTouchPointAgent.exe
(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
() C:\Program Files (x86)\ASUS\ASUS Live Update\UpdateChecker.exe
(Microsoft Corporation) C:\Windows\System32\InstallAgent.exe
(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Microsoft Corporation) C:\Windows\System32\InstallAgentUserBroker.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\Install\{E5157F2A-9A62-4313-B8E4-3653CE3934BB}\68.0.3440.106_chrome_installer.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe
(Google Inc.) C:\Windows\Temp\CR_DD554.tmp\setup.exe
(Google Inc.) C:\Windows\Temp\CR_DD554.tmp\setup.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.13.274.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Antivirus\asulaunch.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(ASUS Cloud Corporation) C:\Program Files (x86)\ASUS\WebStorage\2.2.2.524\AsusWSPanel.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.15063.724_none_9e8a868b2d8a538d\TiWorker.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [629152 2017-03-18] (Microsoft Corporation)
HKLM\…\Run: [AVGUI.exe] => C:\Program Files (x86)\AVG\Antivirus\AvLaunch.exe [291568 2018-08-09] (AVG Technologies CZ, s.r.o.)
HKLM-x32\…\Run: [WebStorage] => C:\Program Files (x86)\ASUS\WebStorage\2.2.2.524\ASUSWSLoader.exe [63272 2015-05-31] ()
HKLM-x32\…\Run: [CenturyLinkTouchPointAgent] => C:\Program Files (x86)\CenturyLink\Desktop\CenturyLinkTouchPointAgent.exe [48616 2015-07-21] (CenturyLink Inc)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled [2017-10-18] ()
Startup: C:\Users\mjall\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk [2016-03-04]
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76
Tcpip\..\Interfaces\{79ab866d-8695-453f-a818-e450e7d80021}: [DhcpNameServer] 192.168.40.1
Tcpip\..\Interfaces\{b401b3e5-c40a-41b9-b496-d8e07ffa8023}: [DhcpNameServer] 75.75.75.75 75.75.76.76

Internet Explorer:
==================
HKU\S-1-5-21-2715154610-2889254933-3016229676-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus15.msn.com/?pc=ASTE
HKU\S-1-5-21-2715154610-2889254933-3016229676-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus15.msn.com/?pc=ASTE
HKU\S-1-5-21-2715154610-2889254933-3016229676-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08102018142049279\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus15.msn.com/?pc=ASTE
HKU\S-1-5-21-2715154610-2889254933-3016229676-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08102018142049279\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus15.msn.com/?pc=ASTE
SearchScopes: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08102018142049279 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2015-04-30] (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)

FireFox:
========
FF DefaultProfile: xv4gzqjh.default
FF ProfilePath: C:\Users\mjall\AppData\Roaming\Mozilla\Firefox\Profiles\xv4gzqjh.default [2018-08-10]
FF Homepage: Mozilla\Firefox\Profiles\xv4gzqjh.default -> google.com
FF Extension: (Firefox Hotfix) - C:\Users\mjall\AppData\Roaming\Mozilla\Firefox\Profiles\xv4gzqjh.default\Extensions\[removed] [2016-11-05] [Legacy]
FF Extension: (Google Code Correction) - C:\Users\mjall\AppData\Roaming\Mozilla\Firefox\Profiles\xv4gzqjh.default\features\{5d7675a5-29b1-49bb-b706-910a16763af5}\[removed] [2018-08-09] [Legacy]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.68 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2015-04-21] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2015-04-21] (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-16] (Google Inc.)

Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.com
CHR Profile: C:\Users\mjall\AppData\Local\Google\Chrome\User Data\Default [2018-05-30]
CHR Extension: (Slides) - C:\Users\mjall\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-12-22]
CHR Extension: (Docs) - C:\Users\mjall\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2018-01-02]
CHR Extension: (Google Drive) - C:\Users\mjall\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2018-01-02]
CHR Extension: (YouTube) - C:\Users\mjall\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2018-01-02]
CHR Extension: (Sheets) - C:\Users\mjall\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-12-22]
CHR Extension: (Google Docs Offline) - C:\Users\mjall\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2018-01-02]
CHR Extension: (AVG SafePrice) - C:\Users\mjall\AppData\Local\Google\Chrome\User Data\Default\Extensions\mbckjcfnjmoiinpgddefodcighgikkgn [2018-05-02]
CHR Extension: (Chrome Web Store Payments) - C:\Users\mjall\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-05-02]
CHR Extension: (Gmail) - C:\Users\mjall\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2018-01-02]
CHR Extension: (Chrome Media Router) - C:\Users\mjall\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-05-02]
CHR HKLM-x32\…\Chrome\Extension: [mbckjcfnjmoiinpgddefodcighgikkgn] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Asus WebStorage Windows Service; C:\Program Files (x86)\ASUS\WebStorage\2.2.2.524\AsusWSWinService.exe [71168 2015-05-31] (ASUS Cloud Corporation) [File not signed]
R2 ASUSGiftBoxDekstop; C:\Program Files (x86)\ASUS\ASUS GIFTBOX Desktop\ASUSGIFTBOXDesktop.exe [315704 2015-07-20] (ASUS)
R2 AVG Antivirus; C:\Program Files (x86)\AVG\Antivirus\AVGSvc.exe [323512 2018-08-09] (AVG Technologies CZ, s.r.o.)
R3 avgbIDSAgent; C:\Program Files (x86)\AVG\Antivirus\x64\aswidsagenta.exe [7829784 2018-08-09] (AVG Technologies CZ, s.r.o.)
R2 esifsvc; C:\WINDOWS\SysWOW64\esif_uf.exe [1385640 2015-08-16] (Intel Corporation)
R2 igfxCUIService2.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [373728 2016-11-30] (Intel Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [881152 2015-05-22] (Intel(R) Corporation)
R3 Intel(R) Security Assist; C:\Program Files (x86)\Intel\Intel(R) Security Assist\isa.exe [335872 2015-05-19] (Intel Corporation) [File not signed]
S2 isaHelperSvc; C:\Program Files (x86)\Intel\Intel(R) Security Assist\isaHelperService.exe [7680 2015-05-19] () [File not signed]
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [207648 2015-08-07] (Intel Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6541008 2018-05-09] (Malwarebytes)
R2 osrss; C:\WINDOWS\system32\osrss.dll [131288 2018-06-27] (Microsoft Corporation)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [389896 2014-04-14] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [342264 2017-03-18] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [102816 2017-07-10] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 AsusTP; C:\WINDOWS\System32\drivers\AsusTP.sys [101872 2017-04-11] (ASUS Corporation)
R1 avgArPot; C:\WINDOWS\System32\drivers\avgArPot.sys [189544 2018-08-09] (AVG Technologies CZ, s.r.o.)
R1 avgbidsdriver; C:\WINDOWS\System32\drivers\avgbidsdrivera.sys [222288 2018-08-09] (AVG Technologies CZ, s.r.o.)
R0 avgbidsh; C:\WINDOWS\System32\drivers\avgbidsha.sys [194224 2018-08-09] (AVG Technologies CZ, s.r.o.)
R0 avgblog; C:\WINDOWS\System32\drivers\avgbloga.sys [339048 2018-08-09] (AVG Technologies CZ, s.r.o.)
R0 avgbuniv; C:\WINDOWS\System32\drivers\avgbuniva.sys [51952 2018-08-09] (AVG Technologies CZ, s.r.o.)
S3 avgElam; C:\WINDOWS\System32\drivers\avgElam.sys [15352 2018-08-09] (AVG Technologies CZ, s.r.o.)
S3 avgHwid; C:\WINDOWS\System32\drivers\avgHwid.sys [39352 2018-08-09] (AVG Technologies CZ, s.r.o.)
R2 avgMonFlt; C:\WINDOWS\System32\drivers\avgMonFlt.sys [152016 2018-08-09] (AVG Technologies CZ, s.r.o.)
R1 avgRdr; C:\WINDOWS\System32\drivers\avgRdr2.sys [104256 2018-08-09] (AVG Technologies CZ, s.r.o.)
R0 avgRvrt; C:\WINDOWS\System32\drivers\avgRvrt.sys [78352 2018-08-09] (AVG Technologies CZ, s.r.o.)
R1 avgSnx; C:\WINDOWS\System32\drivers\avgSnx.sys [1020112 2018-08-09] (AVG Technologies CZ, s.r.o.)
R1 avgSP; C:\WINDOWS\System32\drivers\avgSP.sys [458024 2018-08-09] (AVG Technologies CZ, s.r.o.)
R2 avgStm; C:\WINDOWS\System32\drivers\avgStm.sys [203544 2018-08-09] (AVG Technologies CZ, s.r.o.)
R0 avgVmm; C:\WINDOWS\System32\drivers\avgVmm.sys [373944 2018-08-09] (AVG Technologies CZ, s.r.o.)
R3 dptf_cpu; C:\WINDOWS\System32\drivers\dptf_cpu.sys [53752 2015-08-16] (Intel Corporation)
R3 dptf_pch; C:\WINDOWS\System32\drivers\dptf_pch.sys [50696 2015-08-16] (Intel Corporation)
R3 esif_lf; C:\WINDOWS\system32\DRIVERS\esif_lf.sys [261624 2015-08-16] (Intel Corporation)
R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [152688 2018-06-19] (Malwarebytes)
R0 IntelHSWPcc; C:\WINDOWS\System32\drivers\IntelPcc.sys [88256 2015-06-25] (Intel Corporation)
R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [191208 2018-08-09] (Malwarebytes)
R3 MBAMFarflt; C:\WINDOWS\System32\DRIVERS\farflt.sys [114920 2018-08-09] (Malwarebytes)
R3 MBAMProtection; C:\WINDOWS\system32\DRIVERS\mbam.sys [48360 2018-08-09] (Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [253664 2018-08-09] (Malwarebytes)
R3 MBAMWebProtection; C:\WINDOWS\system32\DRIVERS\mwac.sys [102632 2018-08-10] (Malwarebytes)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [887552 2015-07-14] (Realtek )
R3 RTSUER; C:\WINDOWS\system32\Drivers\RtsUer.sys [428032 2017-02-16] (Realsil Semiconductor Corporation)
S3 SDFRd; C:\WINDOWS\System32\drivers\SDFRd.sys [31128 2017-03-18] ()
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44632 2017-03-18] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [294816 2017-03-18] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [121248 2017-03-18] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-08-10 14:32 - 2018-08-10 14:33 - 000016540 _____ C:\Users\mjall\Downloads\FRST.txt
2018-08-10 14:31 - 2018-08-10 14:32 - 000000000 ____D C:\FRST
2018-08-10 14:29 - 2018-08-10 14:29 - 002412544 _____ (Farbar) C:\Users\mjall\Downloads\FRST64.exe
2018-08-10 14:26 - 2018-08-10 14:27 - 001773056 _____ (Farbar) C:\Users\mjall\Downloads\FRST.exe
2018-08-09 21:53 - 2018-08-09 21:54 - 000000000 ___HD C:\$WINDOWS.~BT
2018-08-09 21:53 - 2018-08-09 21:53 - 000000000 ____D C:\Windows.old
2018-08-09 20:34 - 2018-08-09 20:35 - 000462172 _____ C:\WINDOWS\Minidump\080918-30734-01.dmp
2018-08-09 20:19 - 2018-08-09 20:20 - 000435412 _____ C:\WINDOWS\Minidump\080918-34484-01.dmp
2018-08-09 20:03 - 2018-08-09 20:03 - 000000000 ____D C:\Users\mjall\AppData\Local\CrashDumps
2018-08-09 20:02 - 2018-08-10 14:20 - 000102632 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2018-08-09 20:02 - 2018-08-09 20:36 - 000253664 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys
2018-08-09 20:02 - 2018-08-09 20:36 - 000114920 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
2018-08-09 20:02 - 2018-08-09 20:36 - 000048360 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2018-08-09 20:02 - 2018-08-09 20:02 - 000191208 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamChameleon.sys
2018-08-09 20:01 - 2018-08-09 20:01 - 000001914 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2018-08-09 20:01 - 2018-08-09 20:01 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2018-08-09 20:01 - 2018-08-09 20:01 - 000000000 ____D C:\ProgramData\Malwarebytes
2018-08-09 20:01 - 2018-08-09 20:01 - 000000000 ____D C:\Program Files\Malwarebytes
2018-08-09 20:01 - 2018-06-19 14:09 - 000152688 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbae64.sys
2018-08-09 20:00 - 2018-08-09 20:00 - 078989872 _____ (Malwarebytes ) C:\Users\mjall\Downloads\mb3-setup-consumer-3.5.1.2522-1.0.391-1.0.6237.exe
2018-08-09 19:49 - 2018-08-09 19:50 - 000419140 _____ C:\WINDOWS\Minidump\080918-36484-01.dmp
2018-08-09 19:37 - 2018-08-09 20:34 - 000000000 ____D C:\WINDOWS\Minidump
2018-08-09 19:37 - 2018-08-09 20:33 - 608355178 _____ C:\WINDOWS\MEMORY.DMP
2018-08-09 19:37 - 2018-08-09 19:38 - 000422764 _____ C:\WINDOWS\Minidump\080918-27359-01.dmp
2018-08-09 19:36 - 2018-05-17 10:52 - 000023024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Luadgmgt.dll
2018-08-09 19:35 - 2018-08-09 19:35 - 000000000 ____D C:\WINDOWS\UpdateAssistant
2018-08-09 19:34 - 2018-08-09 19:35 - 005198336 _____ (AVAST Software) C:\Users\mjall\Downloads\aswMBR.exe
2018-08-09 19:31 - 2018-08-09 19:31 - 000000000 ___HD C:\$GetCurrent
2018-08-09 19:28 - 2018-08-09 19:27 - 000379120 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\avgBoot.exe
2018-08-09 19:28 - 2018-08-09 19:27 - 000015352 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgElam.sys
2018-08-09 19:23 - 2018-08-09 19:23 - 000000000 ___HD C:\OneDriveTemp

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-08-10 14:24 - 2017-12-22 11:32 - 000004278 _____ C:\WINDOWS\System32\Tasks\Antivirus Emergency Update
2018-08-10 14:22 - 2016-03-04 16:19 - 000000165 _____ C:\Users\mjall\AppData\Roaming\sp_data.sys
2018-08-10 14:21 - 2016-03-04 16:23 - 000000000 ___RD C:\Users\mjall\OneDrive
2018-08-10 14:19 - 2017-08-02 17:27 - 000000000 ____D C:\ProgramData\ASUS Smart Gesture
2018-08-10 14:19 - 2016-03-04 16:19 - 000000000 __SHD C:\Users\mjall\IntelGraphicsProfiles
2018-08-10 14:18 - 2017-10-18 15:29 - 000000180 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2018-08-10 01:53 - 2017-10-18 15:26 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2018-08-09 21:55 - 2017-09-30 08:33 - 000000000 ___DC C:\WINDOWS\Panther
2018-08-09 21:03 - 2017-03-18 15:03 - 000000000 ____D C:\WINDOWS\rescache
2018-08-09 20:59 - 2017-10-18 15:31 - 000000000 ____D C:\Users\mjall
2018-08-09 20:57 - 2017-03-18 14:51 - 000000000 ____D C:\WINDOWS\CbsTemp
2018-08-09 20:34 - 2017-10-18 15:46 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2018-08-09 19:42 - 2017-03-18 15:03 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2018-08-09 19:42 - 2017-03-18 15:01 - 000000000 ____D C:\WINDOWS\INF
2018-08-09 19:39 - 2017-03-18 15:03 - 000000000 ____D C:\WINDOWS\AppReadiness
2018-08-09 19:36 - 2017-09-30 08:14 - 000000000 ____D C:\Program Files\rempl
2018-08-09 19:36 - 2017-03-18 15:03 - 000000000 ___HD C:\Program Files\WindowsApps
2018-08-09 19:30 - 2017-10-18 15:45 - 000003550 _____ C:\WINDOWS\System32\Tasks\ASUS Live Update1
2018-08-09 19:30 - 2017-10-18 15:45 - 000003540 _____ C:\WINDOWS\System32\Tasks\ASUS Live Update2
2018-08-09 19:30 - 2016-07-27 11:02 - 000000000 ____D C:\Windows10Upgrade
2018-08-09 19:29 - 2017-12-22 11:32 - 000458024 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgSP.sys
2018-08-09 19:28 - 2017-03-18 15:03 - 000000000 ___HD C:\WINDOWS\ELAMBKUP
2018-08-09 19:27 - 2017-12-22 11:32 - 001020112 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgSnx.sys
2018-08-09 19:27 - 2017-12-22 11:32 - 000373944 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgVmm.sys
2018-08-09 19:27 - 2017-12-22 11:32 - 000339048 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgbloga.sys
2018-08-09 19:27 - 2017-12-22 11:32 - 000222288 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgbidsdrivera.sys
2018-08-09 19:27 - 2017-12-22 11:32 - 000203544 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgStm.sys
2018-08-09 19:27 - 2017-12-22 11:32 - 000194224 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgbidsha.sys
2018-08-09 19:27 - 2017-12-22 11:32 - 000189544 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgArPot.sys
2018-08-09 19:27 - 2017-12-22 11:32 - 000152016 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgMonFlt.sys
2018-08-09 19:27 - 2017-12-22 11:32 - 000104256 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgRdr2.sys
2018-08-09 19:27 - 2017-12-22 11:32 - 000078352 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgRvrt.sys
2018-08-09 19:27 - 2017-12-22 11:32 - 000051952 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgbuniva.sys
2018-08-09 19:27 - 2017-12-22 11:32 - 000039352 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgHwid.sys
2018-08-09 19:24 - 2017-10-18 15:45 - 001058898 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2018-08-09 19:22 - 2017-10-18 15:46 - 000003378 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-2715154610-2889254933-3016229676-1001
2018-08-09 19:22 - 2017-09-14 13:10 - 000002369 _____ C:\Users\mjall\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2018-08-09 19:21 - 2016-05-09 13:10 - 000000000 ____D C:\Users\mjall\AppData\Local\Avg
2018-08-09 19:16 - 2017-03-18 05:40 - 000786432 _____ C:\WINDOWS\system32\config\BBI

==================== Files in the root of some directories =======

2016-03-04 16:19 - 2018-08-10 14:22 - 000000165 _____ () C:\Users\mjall\AppData\Roaming\sp_data.sys

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2018-08-09 20:59

==================== End of FRST.txt ============================Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02.08.2018
Ran by [removed] (10-08-2018 14:34:14)
Running from C:\Users\[removed]\Downloads
Windows 10 Home Version 1703 15063.786 (X64) (2017-10-18 21:55:04)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-2715154610-2889254933-3016229676-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-2715154610-2889254933-3016229676-503 - Limited - Disabled)
Guest (S-1-5-21-2715154610-2889254933-3016229676-501 - Limited - Disabled)
mjall (S-1-5-21-2715154610-2889254933-3016229676-1001 - Administrator - Enabled) => C:\Users\mjall

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: AVG Antivirus (Enabled - Up to date) {C50510DE-367A-330C-FD5C-556ACFB11243}
AS: AVG Antivirus (Enabled - Up to date) {7E64F13A-1040-3C82-C7EC-6E18B43658FE}
AS: Malwarebytes (Enabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

ASUS GIFTBOX Desktop (HKLM-x32\…\{4701E5AB-AF91-4D40-8F18-358CC80E4E5B}) (Version: 1.1.6 - ASUS)
ASUS HiPost (HKLM-x32\…\{04768366-F421-4BA5-8423-B84F644B5249}) (Version: 1.0.6 - ASUS)
ASUS Live Update (HKLM-x32\…\{FA540E67-095C-4A1B-97BA-4D547DEC9AF4}) (Version: 3.4.3 - ASUS)
ASUS Smart Gesture (HKLM-x32\…\{4D3286A6-F6AB-498A-82A4-E4F040529F3D}) (Version: 4.0.18 - ASUS)
ASUS Splendid Video Enhancement Technology (HKLM-x32\…\{0969AF05-4FF6-4C00-9406-43599238DE0D}) (Version: 3.13.0004 - ASUS)
ASUS USB Charger Plus (HKLM-x32\…\{A859E3E5-C62F-4BFA-AF1D-2B95E03166AF}) (Version: 4.1.6 - ASUS)
ATK Package (HKLM-x32\…\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version: 1.0.0041 - ASUS)
AudioWizard (HKLM-x32\…\{57E770A2-2BAF-4CAA-BAA3-BD896E2254D3}) (Version: 1.0.0.105 - ICEpower a/s)
AVG AntiVirus FREE (HKLM-x32\…\AVG Antivirus) (Version: 18.5.3059 - AVG Technologies)
CenturyLink Installer (HKLM-x32\…\{C96FF998-45BD-411E-9253-B7F2660FE280}) (Version: 1.0 - CenturyLink, Inc.)
CyberLink PhotoDirector 5 (HKLM\…\{5A454EC5-217A-42a5-8CE1-2DDEC4E70E01}) (Version: 5.0.5.6515 - CyberLink Corp.) Hidden
CyberLink PhotoDirector 5 (HKLM-x32\…\InstallShield_{5A454EC5-217A-42a5-8CE1-2DDEC4E70E01}) (Version: 5.0.5.6515 - CyberLink Corp.)
CyberLink PowerDirector 12 (HKLM\…\{E1646825-D391-42A0-93AA-27FA810DA093}) (Version: 12.0.4010.0 - CyberLink Corp.) Hidden
CyberLink PowerDirector 12 (HKLM-x32\…\InstallShield_{E1646825-D391-42A0-93AA-27FA810DA093}) (Version: 12.0.4010.0 - CyberLink Corp.)
Device Setup (HKLM-x32\…\{8D6B05E0-F457-408C-9D13-549334D8FAE1}) (Version: 2.0.2 - ASUSTek Computer Inc.)
Dropbox 25 GB (HKLM-x32\…\{597A58EC-42D6-4940-8739-FB94491B013C}) (Version: 1.0.8.0 - Dropbox, Inc.)
Evernote v. 5.8.6 (HKLM-x32\…\{FEDC7C10-EF67-11E4-9B07-00505695D7B0}) (Version: 5.8.6.7519 - Evernote Corp.)
Google Chrome (HKLM-x32\…\Google Chrome) (Version: 67.0.3396.99 - Google Inc.)
Google Update Helper (HKLM-x32\…\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.17 - Google Inc.) Hidden
Google Update Helper (HKLM-x32\…\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.21.123 - Google Inc.) Hidden
Intel Collaborative Processor Performance Control (HKLM-x32\…\0E7DAF70-FB54-4B91-B192-7E771C25AEEB) (Version: 1.0.0.1018 - Intel Corporation)
Intel(R) Chipset Device Software (HKLM-x32\…\{60c073df-e736-4210-9c3a-5fc2b651cef3}) (Version: 10.1.1.7 - Intel(R) Corporation) Hidden
Intel(R) Dynamic Platform and Thermal Framework (HKLM-x32\…\{654EE65D-FAA4-4EA6-8C07-DC94E6A304D4}) (Version: 8.1.10603.192 - Intel Corporation)
Intel(R) Management Engine Components (HKLM\…\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 11.0.0.1162 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\…\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 20.19.15.4549 - Intel Corporation)
Intel® Security Assist (HKLM-x32\…\{4B230374-6475-4A73-BA6E-41015E9C5013}) (Version: 1.0.0.532 - Intel Corporation)
Malwarebytes version 3.5.1.2522 (HKLM\…\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.5.1.2522 - Malwarebytes)
Microsoft Office (HKLM-x32\…\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4693.1005 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-2715154610-2889254933-3016229676-1001\…\OneDriveSetup.exe) (Version: 18.111.0603.0006 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-2715154610-2889254933-3016229676-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08102018142049279\…\OneDriveSetup.exe) (Version: 18.111.0603.0006 - Microsoft Corporation)
Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50428.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\…\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 47.0.2 (x86 en-US) (HKLM-x32\…\Mozilla Firefox 47.0.2 (x86 en-US)) (Version: 47.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\…\MozillaMaintenanceService) (Version: 47.0.2.6148 - Mozilla)
osrss (HKLM-x32\…\{1BA1133B-1C7A-41A0-8CBF-9B993E63D296}) (Version: 1.0.0 - Microsoft Corporation) Hidden
Qualcomm Atheros Client Installation Program (HKLM-x32\…\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Qualcomm Atheros)
Realtek Card Reader (HKLM-x32\…\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 10.0.14393.31233 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\…\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.2.703.2015 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7571 - Realtek Semiconductor Corp.)
Update for Windows 10 for x64-based Systems (KB4023057) (HKLM\…\{A951B9A0-13C0-4A4B-8E04-3CCF05701086}) (Version: 2.47.0.0 - Microsoft Corporation)
UpdateAssistant (HKLM\…\{52C1DD03-104E-4AC6-9DC6-21D585721ED1}) (Version: 1.19.0.0 - Microsoft Corporation) Hidden
WebStorage (HKLM-x32\…\WebStorage) (Version: 2.2.2.524 - ASUS Cloud Corporation)
Windows 10 Update and Privacy Settings (HKLM\…\{4DFCD818-036A-4229-A67D-CF17DC461D92}) (Version: 1.0.14.0 - Microsoft Corporation)
Windows 10 Update Assistant (HKLM-x32\…\{D5C69738-B486-402E-85AC-2456D98A64E4}) (Version: 1.4.9200.22452 - Microsoft Corporation)
Windows Setup Remediations (x64) (KB4023057) (HKLM\…\{5534e02f-0f5d-40dd-ba92-bea38d22384d}.sdb) (Version:  - )
WinFlash (HKLM-x32\…\{8F21291E-0444-4B1D-B9F9-4370A73E346D}) (Version: 3.0.1 - ASUS)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

ShellIconOverlayIdentifiers: [!AsusWSShellExt_B] -> {6D4133E5-0742-4ADC-8A8C-9303440F7191} => C:\Program Files (x86)\Common Files\AWS\2.2.2.524\ASUSWSShellExt64.dll [2015-04-22] (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [!AsusWSShellExt_O] -> {64174815-8D98-4CE6-8646-4C039977D809} => C:\Program Files (x86)\Common Files\AWS\2.2.2.524\ASUSWSShellExt64.dll [2015-04-22] (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [!AsusWSShellExt_U] -> {1C5AB7B1-0B38-4EC4-9093-7FD277E2AF4E} => C:\Program Files (x86)\Common Files\AWS\2.2.2.524\ASUSWSShellExt64.dll [2015-04-22] (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [00avg] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
ContextMenuHandlers1: [AVG] -> {472083B1-C522-11CF-8763-00608CC02F24} => C:\Program Files (x86)\AVG\Antivirus\ashShA64.dll [2018-08-09] (AVG Technologies CZ, s.r.o.)
ContextMenuHandlers3: [00avg] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
ContextMenuHandlers3: [BackupContextMenuExtension] -> {b1b96b20-da1d-4a3c-92c1-7229b32f2326} => C:\WINDOWS\system32\mscoree.dll [2017-03-18] (Microsoft Corporation)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-05-09] (Malwarebytes)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\system32\igfxDTCM.dll [2016-11-30] (Intel Corporation)
ContextMenuHandlers6: [AVG] -> {472083B1-C522-11CF-8763-00608CC02F24} => C:\Program Files (x86)\AVG\Antivirus\ashShA64.dll [2018-08-09] (AVG Technologies CZ, s.r.o.)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-05-09] (Malwarebytes)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {2CAD9BCF-7714-4E61-87EB-2C2341696352} - System32\Tasks\ATK Package 36D18D69AFC3 => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\SimAppExec.exe [2015-03-10] (ASUSTek Computer Inc.)
Task: {5608B6A1-A8BB-48F9-932B-08059F1B0D74} - \Safer-Networking\Spybot - Search and Destroy\Refresh immunization -> No File <==== ATTENTION
Task: {567549BD-FFAA-4A0A-8917-60E3B58942CD} - System32\Tasks\Update Checker => C:\Program Files (x86)\ASUS\ASUS Live Update\UpdateChecker.exe [2016-08-01] ()
Task: {5BB741AB-DE48-4A4C-B581-6759FB64806C} - System32\Tasks\Microsoft\Windows\rempl\shell-maintenance => C:\Program Files\rempl\remsh.exe
Task: {66D8FB88-74A9-4962-B028-51AF598AEA50} - \Safer-Networking\Spybot - Search and Destroy\Check for updates -> No File <==== ATTENTION
Task: {674DE2B8-3DF6-40FC-A861-233598B0BF9B} - System32\Tasks\DropboxOEM => C:\Program Files (x86)\Dropbox\DropboxOEM\DropboxOEM.exe [2015-05-29] ()
Task: {71BAB4D1-E63D-4113-8BA8-C8431D46585E} - System32\Tasks\AVG\Overseer => C:\Program Files\Common Files\AVG\Overseer\overseer.exe [2018-05-16] (AVG Technologies CZ, s.r.o.)
Task: {755DF974-CF52-452C-A083-BFDEC24C68D4} - System32\Tasks\RTKCPL => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2015-07-29] (Realtek Semiconductor)
Task: {7DF50913-0B90-483D-BA7C-76BB51B135C0} - System32\Tasks\RtHDVBg_ListenToDevice => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2015-07-29] (Realtek Semiconductor)
Task: {82923DC3-6B7B-441E-9F1B-A6981622A17D} - System32\Tasks\Antivirus Emergency Update => C:\Program Files (x86)\AVG\Antivirus\AvEmUpdate.exe [2018-08-09] (AVG Technologies CZ, s.r.o.)
Task: {940A0557-C370-41DC-9CE9-78D1CD4510E5} - \Safer-Networking\Spybot - Search and Destroy\Scan the system -> No File <==== ATTENTION
Task: {99101A73-A741-4FD3-AAE9-C648823D39F6} - System32\Tasks\ASUS USB Charger Plus => C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe [2015-05-25] (ASUSTek Computer Inc.)
Task: {9D502014-7A9C-4CF9-B9F7-21935BE839C3} - System32\Tasks\Microsoft\Windows\rempl\shell => C:\Program Files\rempl\sedlauncher.exe [2018-08-03] (Microsoft Corporation)
Task: {A2F3F4B3-729D-4F0B-99F3-85257027C85A} - System32\Tasks\ASUS Live Update2 => C:\Program Files (x86)\ASUS\ASUS Live Update\UpdateChecker.exe [2016-08-01] ()
Task: {A3B92BE0-5778-4162-8048-66AFA17BFBB5} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-12-22] (Google Inc.)
Task: {C19705DE-233C-488D-BB4B-7C1BE3977FA3} - \Microsoft\Windows\UpdateOrchestrator\AC Power Download -> No File <==== ATTENTION
Task: {D0F4B7E8-5F0F-4D9F-9D16-F2937D9E8A6C} - System32\Tasks\ASUS Splendid ACMON => C:\Program Files (x86)\ASUS\Splendid\ACMON.exe [2015-08-25] (ASUS)
Task: {DFDC65B3-D8AC-4519-B4EB-E945AD660D51} - System32\Tasks\ASUS Live Update1 => C:\Program Files (x86)\ASUS\ASUS Live Update\UpdateChecker.exe [2016-08-01] ()
Task: {E3743588-7A16-4C43-8C71-1C01151FD07B} - System32\Tasks\ASUS\ASUS Product Register Service => C:\Program Files (x86)\ASUS\APRP\aprp.exe [2015-05-14] (ASUSTek Computer Inc.)
Task: {EC3C5F67-FF00-415E-8FF9-024757B28EAA} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-12-22] (Google Inc.)
Task: {F23E358B-86FA-4713-88E7-0403774B0837} - System32\Tasks\Microsoft\Office\Microsoft Office Touchless Attach Notification => C:\Program Files (x86)\Microsoft Office\Office15\FirstRun.exe [2015-03-14] (Microsoft Corporation)
Task: {F6859C4A-AC79-4772-8DFC-AD5D7395C157} - System32\Tasks\ASUS Smart Gesture Launcher => C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLauncher.exe [2017-04-11] (AsusTek)
Task: {FC9681E3-0E28-44B2-96E9-6DCA4064ACBE} - System32\Tasks\ATK Package A22126881260 => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\SimAppExec.exe [2015-03-10] (ASUSTek Computer Inc.)
Task: {FDEE679E-B3CE-4ECC-A935-A72F94C0E27E} - System32\Tasks\Microsoft\Windows\rempl\RemediationReboot => C:\Program Files\rempl\remsh.exe

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


==================== Loaded Modules (Whitelisted) ==============

2015-11-27 12:03 - 2014-04-14 20:59 - 000389896 _____ () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2018-08-09 20:01 - 2018-06-18 13:32 - 002433744 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SelfProtectionSdk.dll
2018-08-09 20:01 - 2018-07-03 12:59 - 002535120 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MwacLib.dll
2017-03-18 14:58 - 2017-03-18 14:58 - 000138000 _____ () C:\WINDOWS\SYSTEM32\inputhost.dll
2016-11-30 22:57 - 2016-11-30 22:57 - 000401888 _____ () C:\WINDOWS\system32\igfxTray.exe
2017-03-18 14:59 - 2017-03-18 20:31 - 001731072 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2016-08-01 10:35 - 2016-08-01 10:35 - 000017920 _____ () C:\Program Files (x86)\ASUS\ASUS Live Update\UpdateChecker.exe
2018-01-23 08:36 - 2018-01-23 08:36 - 000086528 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.13.274.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2018-01-23 08:36 - 2018-01-23 08:36 - 000195072 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.13.274.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2018-01-23 08:36 - 2018-01-23 08:36 - 024677376 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.13.274.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2018-01-06 09:25 - 2018-01-06 09:25 - 002550272 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.13.274.0_x64__kzf8qxf38zg5c\skypert.dll
2018-01-23 08:36 - 2018-01-23 08:36 - 000667648 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.13.274.0_x64__kzf8qxf38zg5c\RtmMvrUap.dll
2015-08-07 03:09 - 2015-08-07 03:09 - 001243936 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2015-08-25 11:40 - 2015-08-25 11:40 - 000027648 _____ () C:\Program Files (x86)\ASUS\Splendid\DetectDisplayDC.dll
2015-08-25 11:40 - 2015-08-25 11:40 - 000124928 _____ () C:\Program Files (x86)\ASUS\Splendid\CCTAdjust.dll
2018-05-16 16:05 - 2018-05-16 16:05 - 067127976 _____ () C:\Program Files (x86)\AVG\Antivirus\libcef.dll
2018-08-09 19:27 - 2018-08-09 19:27 - 000481520 _____ () C:\Program Files (x86)\AVG\Antivirus\streamback.dll
2015-04-30 14:17 - 2015-04-30 14:17 - 000439304 _____ () C:\Program Files (x86)\Evernote\Evernote\libxml2.dll
2015-04-30 14:17 - 2015-04-30 14:17 - 000321032 _____ () C:\Program Files (x86)\Evernote\Evernote\libtidy.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:5C321E34 [125]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001\…\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001\…\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001\…\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001\…\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001\…\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001\…\0190-dialers.com -> 0190-dialers.com
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001\…\01i.info -> 01i.info
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001\…\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001\…\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001\…\0411dd.com -> 0411dd.com
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001\…\0511zfhl.com -> 0511zfhl.com
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001\…\05p.com -> 05p.com
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001\…\0632qyw.com -> 0632qyw.com
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001\…\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001\…\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001\…\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001\…\0calories.net -> 0calories.net
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001\…\0cj.net -> 0cj.net
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001\…\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001\…\1-2005-search.com -> www.1-2005-search.com

There are 12715 more sites.

IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08102018142049279\…\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08102018142049279\…\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08102018142049279\…\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08102018142049279\…\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08102018142049279\…\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08102018142049279\…\0190-dialers.com -> 0190-dialers.com
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08102018142049279\…\01i.info -> 01i.info
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08102018142049279\…\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08102018142049279\…\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08102018142049279\…\0411dd.com -> 0411dd.com
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08102018142049279\…\0511zfhl.com -> 0511zfhl.com
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08102018142049279\…\05p.com -> 05p.com
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08102018142049279\…\0632qyw.com -> 0632qyw.com
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08102018142049279\…\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08102018142049279\…\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08102018142049279\…\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08102018142049279\…\0calories.net -> 0calories.net
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08102018142049279\…\0cj.net -> 0cj.net
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08102018142049279\…\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08102018142049279\…\1-2005-search.com -> www.1-2005-search.com

There are 12715 more sites.


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2015-07-10 05:04 - 2017-12-22 11:33 - 000452268 ____R C:\WINDOWS\system32\Drivers\etc\hosts

127.0.0.1    www.007guard.com
127.0.0.1    007guard.com
127.0.0.1    008i.com
127.0.0.1    www.008k.com
127.0.0.1    008k.com
127.0.0.1    www.00hq.com
127.0.0.1    00hq.com
127.0.0.1    010402.com
127.0.0.1    www.032439.com
127.0.0.1    032439.com
127.0.0.1    www.0scan.com
127.0.0.1    0scan.com
127.0.0.1    1000gratisproben.com
127.0.0.1    www.1000gratisproben.com
127.0.0.1    1001namen.com
127.0.0.1    www.1001namen.com
127.0.0.1    100888290cs.com
127.0.0.1    www.100888290cs.com
127.0.0.1    www.100sexlinks.com
127.0.0.1    100sexlinks.com
127.0.0.1    10sek.com
127.0.0.1    www.10sek.com
127.0.0.1    www.1-2005-search.com
127.0.0.1    1-2005-search.com
127.0.0.1    123fporn.info
127.0.0.1    www.123fporn.info
127.0.0.1    123haustiereundmehr.com
127.0.0.1    www.123haustiereundmehr.com
127.0.0.1    123moviedownload.com
127.0.0.1    www.123moviedownload.com

There are 15520 more lines.


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08102018142046528\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Windows\img0.jpg
HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08102018142047732\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Windows\img0.jpg
HKU\S-1-5-21-2715154610-2889254933-3016229676-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\mjall\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\asus.jpg
HKU\S-1-5-21-2715154610-2889254933-3016229676-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08102018142049279\Control Panel\Desktop\\Wallpaper -> C:\Users\mjall\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\asus.jpg
DNS Servers: 75.75.75.75 - 75.75.76.76
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{13174C41-4E38-4C0D-8F9C-718797C45F90}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{5F419F51-908A-4077-AA11-46730C449837}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{A00FBCF4-9C96-499D-AEEA-11514A014A6E}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{57E8F4BD-9BBC-4F75-AA4A-77B81A34D8E4}] => (Allow) C:\Program Files (x86)\AVG\Antivirus\AvEmUpdate.exe
FirewallRules: [{FD7AF316-84AE-4674-846D-864945037396}] => (Allow) C:\Program Files (x86)\AVG\Antivirus\AvEmUpdate.exe

==================== Restore Points =========================

09-08-2018 22:48:09 Scheduled Checkpoint

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (08/10/2018 02:24:29 PM) (Source: Perflib) (EventID: 1023) (User: )
Description: Windows cannot load the extensible counter DLL rdyboost. The first four bytes (DWORD) of the Data section contains the Windows error code.

Error: (08/10/2018 02:24:13 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: The Open Procedure for service "BITS" in DLL "C:\Windows\System32\bitsperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

Error: (08/09/2018 08:02:16 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mbamtray.exe, version: 3.0.0.1523, time stamp: 0x5b2a6c92
Faulting module name: Qt5Core.dll, version: 5.6.3.0, time stamp: 0x5a61293e
Exception code: 0xc0000005
Fault offset: 0x0018e4f3
Faulting process id: 0x1e7c
Faulting application start time: 0x01d4304e274e7a66
Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
Faulting module path: C:\Program Files\Malwarebytes\Anti-Malware\Qt5Core.dll
Report Id: 09876904-f240-4a80-bd33-f11224e0e95e
Faulting package full name:
Faulting package-relative application ID:

Error: (08/09/2018 07:17:53 PM) (Source: COM) (EventID: 10031) (User: )
Description: An unmarshaling policy check was performed when unmarshaling a custom marshaled object and the class {95CABCC9-BC57-4C12-B8DF-BA193232AA01} was rejected

Error: (08/09/2018 07:14:54 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2484) (User: DESKTOP-QE7O08I)
Description: Package Microsoft.MicrosoftEdge_40.15063.674.0_neutral__8wekyb3d8bbwe+MicrosoftEdge was terminated because it took too long to suspend.

Error: (08/09/2018 07:13:15 PM) (Source: COM) (EventID: 10031) (User: )
Description: An unmarshaling policy check was performed when unmarshaling a custom marshaled object and the class {95CABCC9-BC57-4C12-B8DF-BA193232AA01} was rejected

Error: (08/09/2018 07:12:55 PM) (Source: COM) (EventID: 10031) (User: )
Description: An unmarshaling policy check was performed when unmarshaling a custom marshaled object and the class {95CABCC9-BC57-4C12-B8DF-BA193232AA01} was rejected

Error: (08/09/2018 07:12:46 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-QE7O08I)
Description: Activation of app Microsoft.Windows.Photos_8wekyb3d8bbwe!App failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information.


System errors:
=============
Error: (08/09/2018 10:37:50 PM) (Source: volsnap) (EventID: 36) (User: )
Description: The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.

Error: (08/09/2018 08:35:02 PM) (Source: BugCheck) (EventID: 1001) (User: )
Description: The computer has rebooted from a bugcheck.  The bugcheck was: 0x000000d1 (0xffffe500c33f0010, 0x00000000000000ff, 0x0000000000000000, 0xfffff8071ec595ae). A dump was saved in: C:\WINDOWS\MEMORY.DMP. Report Id: 373f5723-66f1-427e-a58b-e98ad5b5566c.

Error: (08/09/2018 08:34:03 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The CldFlt service failed to start due to the following error:
The request is not supported.

Error: (08/09/2018 08:34:03 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 8:19:17 PM on ‎8/‎9/‎2018 was unexpected.

Error: (08/09/2018 08:26:25 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The Downloaded Maps Manager service hung on starting.

Error: (08/09/2018 08:24:03 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The Delivery Optimization service hung on starting.

Error: (08/09/2018 08:20:53 PM) (Source: BugCheck) (EventID: 1001) (User: )
Description: The computer has rebooted from a bugcheck.  The bugcheck was: 0x000000d1 (0xfffff80356da1010, 0x00000000000000ff, 0x0000000000000000, 0xfffff806d38b95ae). A dump was saved in: C:\WINDOWS\MEMORY.DMP. Report Id: 01237c3b-28bd-4309-8ced-3fb4b7792678.

Error: (08/09/2018 08:20:50 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Windows Presentation Foundation Font Cache 3.0.0.0 service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.


Windows Defender:
===================================
Date: 2017-11-22 13:05:40.754
Description:
Windows Defender Antivirus scan has been stopped before completion.
Scan ID: {FD9CC906-DB8B-45FC-AAB9-3F91F2BF5F1A}
Scan Type: Antimalware
Scan Parameters: Quick Scan

Date: 2017-10-30 14:54:24.408
Description:
Windows Defender Antivirus scan has been stopped before completion.
Scan ID: {A54520B2-CDD9-474E-80D0-071F7B8798EA}
Scan Type: Antimalware
Scan Parameters: Quick Scan

Date: 2017-12-19 10:13:04.709
Description:
Windows Defender Antivirus has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.259.416.0
Update Source: Microsoft Malware Protection Center
Signature Type: AntiVirus
Update Type: Full
Current Engine Version:
Previous Engine Version: 1.1.14405.2
Error code: 0x80072ee7
Error description: The server name or address could not be resolved

Date: 2017-12-19 10:13:04.708
Description:
Windows Defender Antivirus has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 118.2.0.0
Update Source: Microsoft Malware Protection Center
Signature Type: Network Inspection System
Update Type: Full
Current Engine Version:
Previous Engine Version: 2.1.14202.0
Error code: 0x80072ee7
Error description: The server name or address could not be resolved

Date: 2017-12-19 10:13:04.626
Description:
Windows Defender Antivirus has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.259.416.0
Update Source: Microsoft Malware Protection Center
Signature Type: AntiVirus
Update Type: Full
Current Engine Version:
Previous Engine Version: 1.1.14405.2
Error code: 0x80072ee7
Error description: The server name or address could not be resolved

Date: 2017-12-19 10:13:04.626
Description:
Windows Defender Antivirus has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.259.416.0
Update Source: Microsoft Malware Protection Center
Signature Type: AntiSpyware
Update Type: Full
Current Engine Version:
Previous Engine Version: 1.1.14405.2
Error code: 0x80072ee7
Error description: The server name or address could not be resolved

Date: 2017-12-19 10:13:04.626
Description:
Windows Defender Antivirus has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.259.416.0
Update Source: Microsoft Malware Protection Center
Signature Type: AntiVirus
Update Type: Full
Current Engine Version:
Previous Engine Version: 1.1.14405.2
Error code: 0x80072ee7
Error description: The server name or address could not be resolved

==================== Memory info ===========================

Processor: Intel(R) Core(TM) i3-5020U CPU @ 2.20GHz
Percentage of memory in use: 70%
Total physical RAM: 3998.71 MB
Available physical RAM: 1196.75 MB
Total Virtual: 6814.71 MB
Available Virtual: 3553.55 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:371.39 GB) (Free:323.05 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive d: (DATA) (Fixed) (Total:558.91 GB) (Free:558.37 GB) NTFS

\\?\Volume{8744a483-5391-4199-91f4-74ceff932e47}\ () (Fixed) (Total:0.94 GB) (Free:0.33 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: C1F75065)

Partition: GPT.

==================== End of Addition.txt ============================

Thanks again. Here are the first 2. I will post the roguekiller when it is done.

Fix result of Farbar Recovery Scan Tool (x64) Version: 02.08.2018
Ran by [removed] (11-08-2018 08:28:24) Run:1
Running from C:\Users\[removed]\Downloads
[removed] Boot Mode: Normal
==============================================

fixlist content:
*****************
CloseProcesses:
CreateRestorePoint:
SearchScopes: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08102018142049279 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
ShellIconOverlayIdentifiers: [00avg] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File
ContextMenuHandlers3: [00avg] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File
Task: {5608B6A1-A8BB-48F9-932B-08059F1B0D74} - \Safer-Networking\Spybot - Search and Destroy\Refresh immunization -> No File <==== ATTENTION
Task: {66D8FB88-74A9-4962-B028-51AF598AEA50} - \Safer-Networking\Spybot - Search and Destroy\Check for updates -> No File <==== ATTENTION
Task: {940A0557-C370-41DC-9CE9-78D1CD4510E5} - \Safer-Networking\Spybot - Search and Destroy\Scan the system -> No File <==== ATTENTION
Task: {C19705DE-233C-488D-BB4B-7C1BE3977FA3} - \Microsoft\Windows\UpdateOrchestrator\AC Power Download -> No File <==== ATTENTION
AlternateDataStreams: C:\ProgramData\Temp:5C321E34 [125]
Emptytemp:

*****************

Processes closed successfully.
Restore point was successfully created.
"HKU\S-1-5-21-2715154610-2889254933-3016229676-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope" => removed successfully
SearchScopes: HKU\S-1-5-21-2715154610-2889254933-3016229676-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08102018142049279 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = => Error: No automatic fix found for this entry.
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00avg" => removed successfully
HKLM\Software\Classes\CLSID\{472083B0-C522-11CF-8763-00608CC02F24} => not found
"HKLM\Software\Classes\AllFileSystemObjects\ShellEx\ContextMenuHandlers\00avg" => removed successfully
HKLM\Software\Classes\CLSID\{472083B0-C522-11CF-8763-00608CC02F24} => not found
"HKLM\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers\igfxcui" => removed successfully
HKLM\Software\Classes\CLSID\{3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => not found
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5608B6A1-A8BB-48F9-932B-08059F1B0D74}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5608B6A1-A8BB-48F9-932B-08059F1B0D74}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Safer-Networking\Spybot - Search and Destroy\Refresh immunization" => not found
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{66D8FB88-74A9-4962-B028-51AF598AEA50}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{66D8FB88-74A9-4962-B028-51AF598AEA50}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Safer-Networking\Spybot - Search and Destroy\Check for updates" => not found
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{940A0557-C370-41DC-9CE9-78D1CD4510E5}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{940A0557-C370-41DC-9CE9-78D1CD4510E5}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Safer-Networking\Spybot - Search and Destroy\Scan the system" => not found
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C19705DE-233C-488D-BB4B-7C1BE3977FA3}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C19705DE-233C-488D-BB4B-7C1BE3977FA3}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\AC Power Download" => removed successfully
C:\ProgramData\Temp => ":5C321E34" ADS removed successfully

=========== EmptyTemp: ==========

BITS transfer queue => 7888896 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 40229324 B
Java, Flash, Steam htmlcache => 8868 B
Windows/system/drivers => 947811006 B
Edge => 213145079 B
Chrome => 181058665 B
Firefox => 368778649 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 128 B
LocalService => 8370 B
NetworkService => 1122662 B
mjall => 671456896 B

RecycleBin => 834023 B
EmptyTemp: => 2.3 GB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 08:31:21 ====

# ——————————-
# Malwarebytes AdwCleaner 7.2.1.0
# ——————————-
# Build:    06-26-2018
# Database: 2018-08-10.2
# Support:  https://www.malwarebytes.com/support
#
# ——————————-
# Mode: Clean
# ——————————-
# Start:    08-11-2018
# Duration: 00:00:05
# OS:       Windows 10 Home
# Cleaned:  4
# Failed:   0


***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

Deleted       C:\ProgramData\Auslogics

***** [ Files ] *****

No malicious files cleaned.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

Deleted       HKLM\Software\Wow6432Node\Auslogics

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

Deleted       Ask
Deleted       AOL

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.


*************************

[+] Delete Tracing Keys
[+] Reset Winsock

*************************

AdwCleaner[S00].txt - [1349 octets] - [11/08/2018 08:43:41]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C00].txt ##########