WE'RE SURE THAT YOU'LL LOVE US!

Hey there! :wub: Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. Join 93084 other members! Anybody can ask, anybody can answer. Consistently helpful members may be invited to become staff. Here's how it works. Virus cleanup? Start here -> Malware Removal Forum.

Try What the Tech -- It's free!

Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Scareware email-Keylogger installed?

Started by poporacer , Nov 21 2019 10:09 AM

This topic is locked

11 replies to this topic

#1 poporacer

Authentic Member

Authentic Member
106 posts

Posted 21 November 2019 - 10:09 AM

I received an email that had one of my passwords in the title. In the email, there was a PDF file that I opened and it stated that they had hacked my computer and installed an RDS-Keylogger etc and had taken control of my webcam and gained access to all of my accounts.
Is this possible?
I downloaded the frst and aswMBR programs to my desktop. When I ran aswMBR it asked if I wanted to use a virtualization for rootkit detection. When I clicked yes. I got an error message that there was an error and had to reboot. The page mentioned something about a pagefault in non system area? I tried this a couple times and deleted and re-installed with the same results. I ran aswMBR again without selecting the virtualization option and it began to scan the computer and then crashed again and the error was a little different, Driver IRQL not less than or equal.
Here are the logs from frst and I will try to figure out why aswMBR wont run and if I get it running, I will add to this post.
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 19-11-2019
Ran by rahsr (administrator) on RICK-LAPTOP (Acer Aspire E5-575) (20-11-2019 23:25:05)
Running from C:\Users\rahsr\Desktop
Loaded Profiles: rahsr & postgres (Available Profiles: rahsr & postgres)
Platform: Windows 10 Home Version 1909 18363.476 (X64) Language: English (United States)
Default browser: Edge
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Acer Incorporated -> ) C:\Program Files (x86)\Acer\Care Center\ACCStd.exe
(Acer Incorporated -> Acer Incorporated) C:\Program Files (x86)\Acer\AOP Framework\BackgroundAgent.exe
(Acer Incorporated -> Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\ePowerButton_NB.exe
(Acer Incorporated -> Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QAAdminAgent.exe
(Acer Incorporated -> Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QAAgent.exe
(Acer Incorporated -> Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QALockHandler.exe
(Acer Incorporated -> Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QALSvc.exe
(Acer Incorporated -> Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QASvc.exe
(Acer Incorporated -> acer) C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe
(Adobe Inc. -> Adobe Systems) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
(Amazon Services LLC -> ) C:\Program Files (x86)\Amazon\Amazon Assistant\amazonAssistantService.exe
(Apple Inc. -> Apple Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
(Autodesk, Inc. -> Autodesk Inc.) C:\Program Files (x86)\Autodesk\Autodesk Desktop App\AdAppMgrSvc.exe
(Autodesk, Inc. -> Autodesk Inc.) C:\Windows\Temp\AdAppMgrUpdater.exe
(Autodesk, Inc. -> Autodesk) C:\Program Files (x86)\Autodesk\Autodesk Desktop App\AcWebBrowser\AcWebBrowser.exe
(Autodesk, Inc. -> Autodesk) C:\Program Files (x86)\Autodesk\Autodesk Desktop App\AcWebBrowser\AcWebBrowser.exe
(Autodesk, Inc. -> Autodesk, Inc.) C:\Program Files (x86)\Autodesk\Autodesk Desktop App\AutodeskDesktopApp.exe
(Flexera Software LLC -> Flexera Software LLC) C:\Program Files\Common Files\Macrovision Shared\FlexNet Publisher\FNPLicensingService64.exe
(Google Inc -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.35.342\GoogleCrashHandler.exe
(Google Inc -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.35.342\GoogleCrashHandler64.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(GoPro Media, Inc. -> ) C:\Program Files\GoPro\GoPro Desktop App\GoProDeviceDetection.exe
(ICEpower a/s -> ICEpower) C:\Windows\System32\ICEsoundService64.exe
(IDSA Production signing key -> Intel) C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAService.exe
(IDSA Production signing key -> Intel) C:\Program Files (x86)\Intel\Driver and Support Assistant\DSATray.exe
(IDSA Production signing key -> Intel) C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAUpdateService.exe
(Intel Corporation - Embedded Subsystems and IP Blocks Group -> Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
(Intel Corporation - Embedded Subsystems and IP Blocks Group -> Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Intel Corporation) [File not signed] C:\Program Files (x86)\Intel\Intel® Security Assist\isa.exe
(Intel® pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_587befb80671fb38\igfxCUIService.exe
(Intel® pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_587befb80671fb38\igfxEM.exe
(Intel® pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_587befb80671fb38\igfxext.exe
(Intel® pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_587befb80671fb38\IntelCpHDCPSvc.exe
(Intel® pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_587befb80671fb38\IntelCpHeciSvc.exe
(Intel® Rapid Storage Technology -> Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel® Rapid Storage Technology -> Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE
(Microsoft Corporation -> Microsoft Corporation) C:\Users\rahsr\AppData\Local\Microsoft\OneDrive\OneDrive.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftPdfReader.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.BingWeather_4.33.13094.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.17920.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1908.0.0_x64__8wekyb3d8bbwe\Calculator.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12026.20368.0_x64__8wekyb3d8bbwe\HxOutlook.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12026.20368.0_x64__8wekyb3d8bbwe\HxTsr.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_3.34.15002.0_x64__8wekyb3d8bbwe\GameBar.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_3.34.15002.0_x64__8wekyb3d8bbwe\GameBarFT.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19101.10711.0_x64__8wekyb3d8bbwe\Video.UI.exe
(Microsoft Windows -> ) C:\Windows\System32\Windows.WARP.JITService.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\splwow64.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\browser_broker.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\DataExchangeHost.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeCP.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeCP.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeCP.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeCP.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeCP.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeCP.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeCP.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeCP.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeCP.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeCP.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeCP.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeCP.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeCP.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeCP.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeCP.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeCP.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeCP.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeCP.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeCP.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeCP.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeCP.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeCP.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeCP.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeCP.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeCP.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeCP.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeCP.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeCP.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeSH.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeSH.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeSH.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\mshta.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\SecurityHealthHost.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1910.4-0\MsMpEng.exe
(Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1910.4-0\NisSrv.exe
(PostgreSQL Global Development Group) [File not signed] C:\Program Files\PostgreSQL\9.2\bin\pg_ctl.exe
(PostgreSQL Global Development Group) [File not signed] C:\Program Files\PostgreSQL\9.2\bin\postgres.exe
(PostgreSQL Global Development Group) [File not signed] C:\Program Files\PostgreSQL\9.2\bin\postgres.exe
(PostgreSQL Global Development Group) [File not signed] C:\Program Files\PostgreSQL\9.2\bin\postgres.exe
(PostgreSQL Global Development Group) [File not signed] C:\Program Files\PostgreSQL\9.2\bin\postgres.exe
(PostgreSQL Global Development Group) [File not signed] C:\Program Files\PostgreSQL\9.2\bin\postgres.exe
(PostgreSQL Global Development Group) [File not signed] C:\Program Files\PostgreSQL\9.2\bin\postgres.exe
(PostgreSQL Global Development Group) [File not signed] C:\Program Files\PostgreSQL\9.2\bin\postgres.exe
(Qualcomm Atheros -> Windows ® Win 7 DDK provider) C:\Windows\System32\AdminService.exe
(Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Spotify AB -> Spotify Ltd) C:\Users\rahsr\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(SweetLabs Inc. -> SweetLabs, Inc) C:\Users\rahsr\AppData\Local\Host App Service\Engine\HostAppServiceUpdater.exe
(TeamViewer GmbH -> TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(WildTangent Inc -> WildTangent) C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe

==================== Registry (Whitelisted) ===================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [18390912 2018-11-08] (Realtek Semiconductor Corp. -> Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_TrueHarmony] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1506176 2018-11-08] (Realtek Semiconductor Corp. -> Realtek Semiconductor)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [319544 2019-02-26] (Intel® Rapid Storage Technology -> Intel Corporation)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation -> Microsoft Corporation)
HKLM-x32\...\Run: [Autodesk Desktop App] => C:\Program Files (x86)\Autodesk\Autodesk Desktop App\AutodeskDesktopApp.exe [636712 2018-11-30] (Autodesk, Inc. -> Autodesk, Inc.)
HKLM-x32\...\Run: [Intel Driver & Support Assistant] => C:\Program Files (x86)\Intel\Driver and Support Assistant\DSATray.exe [139624 2019-11-14] (IDSA Production signing key -> Intel)
HKU\S-1-5-21-3395428246-187305771-252134375-1001\...\Run: [Spotify Web Helper] => C:\Users\rahsr\AppData\Roaming\Spotify\SpotifyWebHelper.exe [777840 2017-10-28] (Spotify AB -> Spotify Ltd)
HKU\S-1-5-21-3395428246-187305771-252134375-1001\...\Run: [Akamai NetSession Interface] => "C:\Users\rahsr\AppData\Local\Akamai\netsession_win.exe"
HKU\S-1-5-21-3395428246-187305771-252134375-1001\...\Run: [Xvid] => WScript "C:\Program Files (x86)\Xvid\CheckUpdateLauncher.vbs" "C:\Program Files (x86)\Xvid\CheckUpdate.ps1"
HKU\S-1-5-21-3395428246-187305771-252134375-1001\...\RunOnce: [Delete Cached Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\rahsr\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe"
HKU\S-1-5-21-3395428246-187305771-252134375-1001\...\RunOnce: [Delete Cached Standalone Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\rahsr\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe"
HKU\S-1-5-21-3395428246-187305771-252134375-1001\...\RunOnce: [Uninstall 19.174.0902.0013\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\rahsr\AppData\Local\Microsoft\OneDrive\19.174.0902.0013\amd64"
HKU\S-1-5-21-3395428246-187305771-252134375-1001\...\RunOnce: [Uninstall 19.174.0902.0013] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\rahsr\AppData\Local\Microsoft\OneDrive\19.174.0902.0013"
HKU\S-1-5-21-3395428246-187305771-252134375-1002\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518656 2019-03-18] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\78.0.3904.97\Installer\chrmstp.exe [2019-11-06] (Google LLC -> Google LLC)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\$McRebootA5E6DEAA56$.lnk [2017-05-18]
ShortcutTarget: $McRebootA5E6DEAA56$.lnk -> (No File)
GroupPolicy: Restriction ? <==== ATTENTION

==================== Scheduled Tasks (Whitelisted) ============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0C07C175-3D9F-4E14-8CAA-2B5514E150AB} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153752 2017-03-01] (Google Inc -> Google Inc.)
Task: {0F1F25F8-7715-4B0F-9567-3F602C616ADE} - System32\Tasks\ACCBackgroundApplication => C:\Program Files (x86)\Acer\Care Center\ACCStd.exe [4644256 2016-01-20] (Acer Incorporated -> )
Task: {0FBEF40C-BB68-479B-8E2F-9F33EDE0A447} - System32\Tasks\LaunchChromeTask111 => C:\Program Files\FileZilla FTP Client\FileZilla.exe [9244424 2019-09-25] (Tim Kosse -> FileZilla Project)
Task: {1173EB6F-F968-4C40-BA7C-170C4FDE5C47} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1910.4-0\MpCmdRun.exe [469928 2019-10-21] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {156174FF-0BBA-4B79-BFB6-FC222C4F0060} - System32\Tasks\BacKGroundAgent => C:\Program Files (x86)\Acer\AOP Framework\BackgroundAgent.exe [65752 2017-03-20] (Acer Incorporated -> Acer Incorporated)
Task: {157D3F87-B002-401E-B519-6989B1E5763C} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [335416 2019-11-13] (Adobe Inc. -> Adobe)
Task: {1EFC99AB-E2E0-47D7-BE2F-3A00E830702E} - System32\Tasks\Oem\AcerJumpstartTask => C:\Program Files (x86)\Acer\Acer Jumpstart\hermes.exe [64320 2019-07-11] (Acer Incorporated -> Acer)
Task: {3477EB2D-013D-47B6-8B41-408AFEBA787D} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel® Update Manager\bin\iumsvc.exe
Task: {37CD8D63-2376-431F-B360-DD954BC68E2D} - System32\Tasks\Power Button => C:\Program Files\Acer\Acer Quick Access\ePowerButton_NB.exe [2766240 2016-07-29] (Acer Incorporated -> Acer Incorporated)
Task: {3B125365-E1EF-4E7F-8431-9A9C20E61C0F} - System32\Tasks\Software Update Application => C:\ProgramData\OEM\UpgradeTool\ListCheck.exe [472992 2016-07-29] (Acer Incorporated -> Acer Incorporated)
Task: {4CC643B7-1AC4-4AA4-94C8-050EA339C6CD} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1240656 2019-09-10] (Adobe Inc. -> Adobe Systems)
Task: {4FF17F34-9C25-4BB0-B212-2D4B7B1CF83A} - System32\Tasks\App Explorer => C:\Users\rahsr\AppData\Local\Host App Service\Engine\HostAppServiceUpdater.exe [7407784 2019-10-18] (SweetLabs Inc. -> SweetLabs, Inc) <==== ATTENTION
Task: {50CD3C22-967A-44D3-91B8-7719F33FD14F} - System32\Tasks\AcerCMUpdateTask2.1.16258 => C:\Program Files (x86)\Acer\Amundsen\2.1.16258\AWC.exe [152880 2016-09-20] (Acer Incorporated -> )
Task: {5AD3773E-8FCD-4B64-AE3D-CEAE5673AB13} - System32\Tasks\Adobe Flash Player NPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_32_0_0_293_Plugin.exe [1457720 2019-11-13] (Adobe Inc. -> Adobe)
Task: {6060B0B6-9AA3-49BE-876D-52FDBF281457} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1910.4-0\MpCmdRun.exe [469928 2019-10-21] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {64EB9655-8931-49AA-BD26-097910E42849} - System32\Tasks\FUBTrackingByPLD => C:\OEM\Preload\FubTracking\FubTracking.exe [30976 2015-05-14] (Acer Incorporated -> )
Task: {65B0C647-3D5A-48F3-91F2-BE9F82BC9ABC} - System32\Tasks\ACCAgent => C:\Program Files (x86)\Acer\Care Center\LiveUpdateAgent.exe [40352 2016-01-20] (Acer Incorporated -> )
Task: {82154C4C-EAA1-42F3-A5B7-D3984CA7EC1D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153752 2017-03-01] (Google Inc -> Google Inc.)
Task: {90722BBF-439D-41CE-95E9-7DBFD862929D} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1910.4-0\MpCmdRun.exe [469928 2019-10-21] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {94E596BC-9870-431C-961F-A6371F56C2EF} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
Task: {C248554A-84FA-4B03-8E21-E694D6BE55F2} - System32\Tasks\Intel PTT EK Recertification => C:\Program Files\Intel\iCLS Client\IntelPTTEKRecertification.exe [857568 2016-01-14] (Intel® Trusted Connect Service -> Intel® Corporation)
Task: {CBF80CFB-1FE2-4B8A-897E-59FDBFA668CF} - System32\Tasks\Quick Access => C:\Program Files\Acer\Acer Quick Access\QALauncher.exe [421792 2016-07-29] (Acer Incorporated -> Acer Incorporated)
Task: {DC911A9F-8342-4A4E-B361-210CFF970748} - System32\Tasks\UbtFrameworkService => C:\Program Files\Acer\User Experience Improvement Program\Framework\TriggerFramework.exe [216296 2014-03-12] (Acer Incorporated -> TODO: <Company name>)
Task: {DD865787-AF3A-4398-ACE9-2360BA38BED7} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1910.4-0\MpCmdRun.exe [469928 2019-10-21] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {F0E277E2-1635-4F52-9ACB-EF164905B871} - System32\Tasks\DashlaneUpgradeCheck => net [Argument = start "Dashlane Upgrade Service"]
Task: {F4CE2DFA-064D-4737-9187-0B4D67AA5661} - System32\Tasks\GetNorton => C:\Program Files (x86)\Acer\Get Norton\GetNorton.exe [77104 2018-03-07] (Acer Incorporated -> )
Task: {F53D4274-6AC2-4980-AB2E-6C572658FF32} - System32\Tasks\ACC => C:\Program Files (x86)\Acer\Care Center\LiveUpdateChecker.exe [2919840 2016-01-20] (Acer Incorporated -> )

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{4025965a-7914-41a5-84ab-3bbb0849da3c}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{54ceacef-c166-4bf8-9248-beaa57b35404}: [DhcpNameServer] 192.168.0.1 205.171.3.25
Tcpip\..\Interfaces\{d6583d06-7416-4e66-bb4b-d656a14b4c5b}: [DhcpNameServer] 192.168.0.1 205.171.3.25

Internet Explorer:
==================
HKU\S-1-5-21-3395428246-187305771-252134375-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer15.msn.com/?pc=ACTE
HKU\S-1-5-21-3395428246-187305771-252134375-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer15.msn.com/?pc=ACTE
SearchScopes: HKU\S-1-5-21-3395428246-187305771-252134375-1001 -> DefaultScope {69A632CF-6C9A-47BD-95AB-58CBCDBE5EE6} URL =
SearchScopes: HKU\S-1-5-21-3395428246-187305771-252134375-1001 -> {69A632CF-6C9A-47BD-95AB-58CBCDBE5EE6} URL =
BHO: Amazon Assistant -> {0ddcea2a-7b00-4349-8acb-af7ba6da251f} -> C:\Program Files (x86)\Amazon\Amazon Assistant\aaMessenger.dll [2018-02-22] (Amazon Services LLC -> )
BHO-x32: Amazon Assistant -> {0ddcea2a-7b00-4349-8acb-af7ba6da251f} -> C:\Program Files (x86)\Amazon\Amazon Assistant\aaMessenger.dll [2018-02-22] (Amazon Services LLC -> )
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation -> Microsoft Corporation)

Edge:
======
DownloadDir: C:\Users\rahsr\Downloads
Edge Notifications: HKU\S-1-5-21-3395428246-187305771-252134375-1001 -> hxxps://football.fantasysports.yahoo.com; hxxps://app.slack.com; hxxps://falconchristmas.com

FireFox:
========
FF DefaultProfile: gr36eeqx.default
FF DefaultProfile: 7hohxqk0.default-1531401064131
FF ProfilePath: C:\Users\rahsr\AppData\Roaming\Mozilla\SeaMonkey\Profiles\gr36eeqx.default [2019-11-05]
FF Extension: (ADB Helper) - C:\Users\rahsr\AppData\Roaming\Mozilla\SeaMonkey\Profiles\gr36eeqx.default\Extensions\adbhelper@mozilla.org.xpi [2018-12-13] [Legacy]
FF Extension: (Valence) - C:\Users\rahsr\AppData\Roaming\Mozilla\SeaMonkey\Profiles\gr36eeqx.default\Extensions\fxdevtools-adapters@mozilla.org [2018-12-13] [Legacy]
FF Extension: (DOM Inspector) - C:\Users\rahsr\AppData\Roaming\Mozilla\SeaMonkey\Profiles\gr36eeqx.default\Extensions\inspector@mozilla.org.xpi [2019-10-29] [Legacy] [not signed]
FF Extension: (ChatZilla) - C:\Users\rahsr\AppData\Roaming\Mozilla\SeaMonkey\Profiles\gr36eeqx.default\Extensions\{59c81df5-4b7a-477b-912d-4e0fdf64e5f2}.xpi [2019-10-29] [Legacy] [not signed]
FF Extension: (Lightning) - C:\Users\rahsr\AppData\Roaming\Mozilla\SeaMonkey\Profiles\gr36eeqx.default\Extensions\{e2fda1a4-762b-4020-b5ad-a41df1933103} [2019-10-29] [Legacy] [not signed]
FF ProfilePath: C:\Users\rahsr\AppData\Roaming\Mozilla\Firefox\Profiles\7hohxqk0.default-1531401064131 [2019-11-20]
FF Extension: (All Aboard) - C:\Users\rahsr\AppData\Roaming\Mozilla\Firefox\Profiles\7hohxqk0.default-1531401064131\Extensions\@all-aboard-v1-5 [2018-07-12] [Legacy]
FF ProfilePath: C:\Users\rahsr\AppData\Roaming\kompozer.net\KompoZer\Profiles\bcu7ll8z.default [2019-10-29]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_32_0_0_293.dll [2019-11-13] (Adobe Inc. -> )
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50918.0\npctrl.dll [2018-10-23] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [2018-04-24] (Tracker Software Products (Canada) Ltd. -> Tracker Software Products (Canada) Ltd.)
FF Plugin: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/vnd.adobe.xfdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [2018-04-24] (Tracker Software Products (Canada) Ltd. -> Tracker Software Products (Canada) Ltd.)
FF Plugin: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/vnd.fdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [2018-04-24] (Tracker Software Products (Canada) Ltd. -> Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_32_0_0_293.dll [2019-11-13] (Adobe Inc. -> )
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.68 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2015-08-24] (Intel® Identity Protection Technology Software -> Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2015-08-24] (Intel® Identity Protection Technology Software -> Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\npctrl.dll [2018-10-23] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.35.342\npGoogleUpdate3.dll [2019-11-05] (Google Inc -> Google LLC)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.35.342\npGoogleUpdate3.dll [2019-11-05] (Google Inc -> Google LLC)
FF Plugin-x32: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x86.dll [2018-04-24] (Tracker Software Products (Canada) Ltd. -> Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/vnd.adobe.xfdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x86.dll [2018-04-24] (Tracker Software Products (Canada) Ltd. -> Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/vnd.fdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x86.dll [2018-04-24] (Tracker Software Products (Canada) Ltd. -> Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2014-11-14] (WildTangent Inc -> )
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2019-10-16] (Adobe Inc. -> Adobe Systems Inc.)
FF Plugin HKU\.DEFAULT: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [2018-04-24] (Tracker Software Products (Canada) Ltd. -> Tracker Software Products (Canada) Ltd.)
FF Plugin HKU\.DEFAULT: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/vnd.adobe.xfdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [2018-04-24] (Tracker Software Products (Canada) Ltd. -> Tracker Software Products (Canada) Ltd.)
FF Plugin HKU\.DEFAULT: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/vnd.fdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [2018-04-24] (Tracker Software Products (Canada) Ltd. -> Tracker Software Products (Canada) Ltd.)
FF Plugin HKU\S-1-5-21-3395428246-187305771-252134375-1001: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [2018-04-24] (Tracker Software Products (Canada) Ltd. -> Tracker Software Products (Canada) Ltd.)
FF Plugin HKU\S-1-5-21-3395428246-187305771-252134375-1001: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/vnd.adobe.xfdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [2018-04-24] (Tracker Software Products (Canada) Ltd. -> Tracker Software Products (Canada) Ltd.)
FF Plugin HKU\S-1-5-21-3395428246-187305771-252134375-1001: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/vnd.fdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [2018-04-24] (Tracker Software Products (Canada) Ltd. -> Tracker Software Products (Canada) Ltd.)
FF Plugin HKU\S-1-5-21-3395428246-187305771-252134375-1001: @zoom.us/ZoomVideoPlugin -> C:\Users\rahsr\AppData\Roaming\Zoom\bin\npzoomplugin.dll [2019-10-14] (Zoom Video Communications, Inc. -> Zoom Video Communications, Inc.)

Chrome:
=======
CHR Notifications: Default -> hxxps://drive.google.com
CHR Profile: C:\Users\rahsr\AppData\Local\Google\Chrome\User Data\Default [2019-11-20]
CHR Extension: (Slides) - C:\Users\rahsr\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2018-10-29]
CHR Extension: (Docs) - C:\Users\rahsr\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2018-10-29]
CHR Extension: (Google Drive) - C:\Users\rahsr\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-03-01]
CHR Extension: (YouTube) - C:\Users\rahsr\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-03-01]
CHR Extension: (Adobe Acrobat) - C:\Users\rahsr\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2019-10-01]
CHR Extension: (Sheets) - C:\Users\rahsr\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2018-10-29]
CHR Extension: (Google Docs Offline) - C:\Users\rahsr\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2018-10-29]
CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\rahsr\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2019-04-07]
CHR Extension: (Chrome Web Store Payments) - C:\Users\rahsr\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2019-10-05]
CHR Extension: (Amazon Assistant for Chrome) - C:\Users\rahsr\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbjikboenpfhbbejgkoklgkhjpfogcam [2019-10-14]
CHR Extension: (Gmail) - C:\Users\rahsr\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2019-04-26]
CHR Extension: (Chrome Media Router) - C:\Users\rahsr\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2019-11-01]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]
CHR HKLM-x32\...\Chrome\Extension: [pbjikboenpfhbbejgkoklgkhjpfogcam]

==================== Services (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdAppMgrSvc; C:\Program Files (x86)\Autodesk\Autodesk Desktop App\AdAppMgrSvc.exe [1162616 2018-11-30] (Autodesk, Inc. -> Autodesk Inc.)
R2 Amazon Assistant Service; C:\Program Files (x86)\Amazon\Amazon Assistant\amazonAssistantService.exe [105136 2018-02-22] (Amazon Services LLC -> )
S2 Dashlane Upgrade Service; C:\Program Files (x86)\Dashlane\Upgrade\DashlaneUpgradeService.exe [83992 2017-08-23] (Dashlane -> Dashlane, Inc.)
R2 DSAService; C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAService.exe [37736 2019-11-14] (IDSA Production signing key -> Intel)
R3 DSAUpdateService; C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAUpdateService.exe [142696 2019-11-14] (IDSA Production signing key -> Intel)
R2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [373312 2015-04-14] (WildTangent Inc -> WildTangent)
R2 GoProDeviceDetectionService; C:\Program Files\GoPro\GoPro Desktop App\GoProDeviceDetection.exe [38328 2018-06-11] (GoPro Media, Inc. -> )
R2 ICEsoundService; C:\WINDOWS\system32\ICEsoundService64.exe [806144 2018-11-08] (ICEpower a/s -> ICEpower)
S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [976848 2016-01-14] (Intel® Trusted Connect Service -> Intel® Corporation)
R3 Intel® Security Assist; C:\Program Files (x86)\Intel\Intel® Security Assist\isa.exe [335872 2016-02-05] (Intel Corporation) [File not signed]
S2 isaHelperSvc; C:\Program Files (x86)\Intel\Intel® Security Assist\isaHelperService.exe [8704 2016-02-05] (Intel Corporation) [File not signed]
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [209184 2016-02-11] (Intel Corporation - Embedded Subsystems and IP Blocks Group -> Intel Corporation)
R3 QALSvc; C:\Program Files\Acer\Acer Quick Access\QALSvc.exe [440224 2016-07-29] (Acer Incorporated -> Acer Incorporated)
R3 QASvc; C:\Program Files\Acer\Acer Quick Access\QASvc.exe [481696 2016-07-29] (Acer Incorporated -> Acer Incorporated)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [11660528 2018-12-07] (TeamViewer GmbH -> TeamViewer GmbH)
R3 UEIPSvc; C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe [291232 2016-02-01] (Acer Incorporated -> acer)
R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1910.4-0\NisSrv.exe [3201616 2019-10-21] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1910.4-0\MsMpEng.exe [103168 2019-10-21] (Microsoft Windows Publisher -> Microsoft Corporation)
S2 IntelSSTSvc; "C:\WINDOWS\system32\IntelSSTAPO\ParameterService\ParameterService.exe" [X]
R2 postgresql-x64-9.2; C:/Program Files/PostgreSQL/9.2/bin/pg_ctl.exe runservice -N "postgresql-x64-9.2" -D "C:/Program Files/PostgreSQL/9.2/data" -w [X]

===================== Drivers (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131712 2016-09-05] (Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.)
R0 iaStorAC; C:\WINDOWS\System32\drivers\iaStorAC.sys [1018032 2019-02-26] (Intel® Rapid Storage Technology -> Intel Corporation)
S3 libusb0; C:\WINDOWS\system32\DRIVERS\libusb0.sys [71176 2018-02-26] (SZ DJI Technology Co., Ltd. -> hxxp://libusb-win32.sourceforge.net)
S3 libusb0; C:\Windows\SysWOW64\DRIVERS\libusb0.sys [42592 2014-02-06] (Travis Lee Robinson -> hxxp://libusb-win32.sourceforge.net)
R3 LMDriver; C:\WINDOWS\System32\drivers\LMDriver.sys [31000 2018-05-15] (Acer Incorporated -> Acer Incorporated)
R3 Qcamain10x64; C:\WINDOWS\System32\drivers\Qcamain10x64.sys [2360048 2018-08-29] (Qualcomm Atheros -> Qualcomm Atheros, Inc.)
R3 RadioShim; C:\WINDOWS\System32\drivers\RadioShim.sys [25368 2018-05-15] (Acer Incorporated -> Acer Incorporated)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [935168 2015-11-18] (Realtek Semiconductor Corp -> Realtek )
R3 RTSPER; C:\WINDOWS\system32\DRIVERS\RtsPer.sys [769752 2015-12-17] (Realtek Semiconductor Corp -> Realsil Semiconductor Corporation)
S3 semav6msr64; C:\WINDOWS\system32\drivers\semav6msr64.sys [43008 2019-05-15] (Intel Corporation -> )
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [165504 2016-09-05] (Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.)
R3 SynRMIHID; C:\WINDOWS\system32\DRIVERS\SynRMIHID.sys [57448 2015-10-22] (Synaptics Incorporated -> Synaptics Incorporated)
S3 usbrndis6; C:\WINDOWS\System32\drivers\usb80236.sys [24576 2019-09-17] (Microsoft Windows -> Microsoft Corporation)
R1 VBoxNetLwf; C:\WINDOWS\system32\DRIVERS\VBoxNetLwf.sys [223000 2018-11-08] (Oracle Corporation -> Oracle Corporation)
S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [46472 2019-10-21] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [351968 2019-10-21] (Microsoft Windows -> Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [53984 2019-10-21] (Microsoft Windows -> Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One month (created) ===================

(If an entry is included in the fixlist, the file/folder will be moved.)

2019-11-20 23:25 - 2019-11-20 23:30 - 000038325 _____ C:\Users\rahsr\Desktop\FRST.txt
2019-11-20 23:24 - 2019-11-20 23:29 - 000000000 ____D C:\FRST
2019-11-20 23:21 - 2019-11-20 23:21 - 002260480 _____ (Farbar) C:\Users\rahsr\Desktop\FRST64.exe
2019-11-20 23:20 - 2019-11-20 23:20 - 005198336 _____ (AVAST Software) C:\Users\rahsr\Desktop\aswMBR.exe
2019-11-20 22:49 - 2019-11-20 22:49 - 000000000 ___HD C:\OneDriveTemp
2019-11-18 22:10 - 2019-11-18 22:10 - 000086309 _____ C:\Users\rahsr\Desktop\StaticLights.zip
2019-11-12 18:42 - 2019-11-12 18:42 - 000249856 _____ (Gracenote, Inc.) C:\WINDOWS\SysWOW64\gnsdk_fp.dll
2019-11-12 18:42 - 2019-11-12 18:42 - 000009216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\spwmp.dll
2019-11-12 18:42 - 2019-11-12 18:42 - 000005632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msdxm.ocx
2019-11-12 18:42 - 2019-11-12 18:42 - 000005632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxmasf.dll
2019-11-12 18:42 - 2019-11-12 18:42 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmploc.DLL
2019-11-12 18:41 - 2019-11-12 18:42 - 009711616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 025901056 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 025444352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Hydrogen.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 022627840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 019849216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 018020352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 008011264 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 007754240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 007195648 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 007015936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 006232576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 005914112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 005763848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 005501952 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdp.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 004578816 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 004307968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdp.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 004129408 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 003487232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 002956472 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 002399232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcGenral.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 001866272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 001610752 _____ (Microsoft Corporation) C:\WINDOWS\system32\HologramCompositor.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 001399096 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2019-11-12 18:41 - 2019-11-12 18:41 - 001312256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msjet40.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 001283072 _____ (Microsoft Corporation) C:\WINDOWS\system32\werconcpl.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 001189376 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft.Graphics.Display.DisplayEnhancementService.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 001098712 _____ (Microsoft Corporation) C:\WINDOWS\system32\DolbyDecMFT.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 001072952 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2019-11-12 18:41 - 2019-11-12 18:41 - 001059840 _____ (Microsoft Corporation) C:\WINDOWS\HelpPane.exe
2019-11-12 18:41 - 2019-11-12 18:41 - 001007616 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorSvc.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000842752 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000774456 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe
2019-11-12 18:41 - 2019-11-12 18:41 - 000701440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Mirage.Internal.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000689664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000532480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000516544 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000496640 _____ (Microsoft Corporation) C:\WINDOWS\system32\werui.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000487424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.FileExplorer.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000455168 _____ (Microsoft Corporation) C:\WINDOWS\system32\upnphost.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000431616 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BioFeedback.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000429568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werui.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000380928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcLayers.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000358400 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcGenral.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000327680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\upnphost.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000327680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgeIso.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000315392 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcLayers.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000251904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msIso.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000227840 _____ (Microsoft Corporation) C:\WINDOWS\system32\IndexedDbLegacy.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000224768 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWWIN.EXE
2019-11-12 18:41 - 2019-11-12 18:41 - 000219136 _____ (Microsoft Corporation) C:\WINDOWS\system32\wscinterop.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000214528 _____ (Microsoft Corporation) C:\WINDOWS\system32\DiagSvc.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000186880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWWIN.EXE
2019-11-12 18:41 - 2019-11-12 18:41 - 000175616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\IndexedDbLegacy.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000164864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wscinterop.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000155136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000139776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakrathunk.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000126464 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinHvPlatform.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000122880 _____ (Microsoft Corporation) C:\WINDOWS\system32\wercplsupport.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000117248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000105472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakrathunk.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000093496 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000090624 _____ (Microsoft Corporation) C:\WINDOWS\system32\tsgqec.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000086528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcXtrnal.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000084488 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\winhvr.sys
2019-11-12 18:41 - 2019-11-12 18:41 - 000084488 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hvservice.sys
2019-11-12 18:41 - 2019-11-12 18:41 - 000083456 _____ (Microsoft Corporation) C:\WINDOWS\system32\wscui.cpl
2019-11-12 18:41 - 2019-11-12 18:41 - 000074240 _____ (Microsoft Corporation) C:\WINDOWS\system32\reg.exe
2019-11-12 18:41 - 2019-11-12 18:41 - 000070144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tsgqec.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000068096 _____ (Microsoft Corporation) C:\WINDOWS\system32\udhisapi.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000067584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wscui.cpl
2019-11-12 18:41 - 2019-11-12 18:41 - 000065536 _____ (Microsoft Corporation) C:\WINDOWS\system32\iemigplugin.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000063488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iemigplugin.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000061240 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvhostsvc.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000059392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\reg.exe
2019-11-12 18:41 - 2019-11-12 18:41 - 000058368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\udhisapi.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000040960 _____ (Microsoft Corporation) C:\WINDOWS\system32\upnpcont.exe
2019-11-12 18:41 - 2019-11-12 18:41 - 000035328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\upnpcont.exe
2019-11-12 18:41 - 2019-11-12 18:41 - 000026112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msimsg.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000026112 _____ (Microsoft Corporation) C:\WINDOWS\system32\msimsg.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000021304 _____ (Microsoft Corporation) C:\WINDOWS\system32\kdhvcom.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000015360 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcXtrnal.dll
2019-11-12 18:41 - 2019-11-12 18:41 - 000013824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDJPN.DLL
2019-11-12 18:41 - 2019-11-12 18:41 - 000007680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kbd106.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 014816256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 009928208 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 007600448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 007262456 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 006521768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 006435840 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 006082808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 005943296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 005112320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 004150272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.AI.MachineLearning.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 004047360 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRH.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 003967920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 003791360 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 003752960 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 003742544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OneCoreUAPCommonProxyStub.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 003371928 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 002988344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2019-11-12 18:40 - 2019-11-12 18:40 - 002871848 _____ (Microsoft Corporation) C:\WINDOWS\system32\aitstatic.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 002800640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2019-11-12 18:40 - 2019-11-12 18:40 - 002772272 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 002763016 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 002703872 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebRuntimeManager.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 002698768 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2019-11-12 18:40 - 2019-11-12 18:40 - 002586816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 002576384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 002562048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 002305536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssrch.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 002258848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 002081976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 001974824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\refs.sys
2019-11-12 18:40 - 2019-11-12 18:40 - 001916984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 001856512 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 001757096 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2019-11-12 18:40 - 2019-11-12 18:40 - 001743888 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 001726480 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 001691648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 001664688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 001647064 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 001413864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 001394168 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinTypes.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 001348096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Wpc.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 001327064 _____ (Microsoft Corporation) C:\WINDOWS\system32\crypt32.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 001257472 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 001171704 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 001154656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 001017680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\crypt32.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000982840 _____ (Microsoft Corporation) C:\WINDOWS\system32\winhttp.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000975872 _____ (Microsoft Corporation) C:\WINDOWS\system32\uDWM.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000892696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinTypes.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000874936 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000864256 _____ (Microsoft Corporation) C:\WINDOWS\system32\netlogon.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000844800 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 000832000 _____ (Microsoft Corporation) C:\WINDOWS\system32\iphlpsvc.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000822200 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 000822072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000811536 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000768528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winhttp.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000768488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000747320 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000700416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BTAGService.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000679152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000673664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 000669696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchIndexer.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 000669352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000663552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netlogon.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000642560 _____ (Microsoft Corporation) C:\WINDOWS\system32\osk.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 000638264 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000632320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WpcWebFilter.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000618496 _____ (Microsoft Corporation) C:\WINDOWS\system32\CredProvDataModel.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000606720 _____ (Microsoft Corporation) C:\WINDOWS\system32\uxtheme.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000604984 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcasvc.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000599552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActivationManager.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000598528 _____ (Microsoft Corporation) C:\WINDOWS\system32\webio.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000595968 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000586768 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netio.sys
2019-11-12 18:40 - 2019-11-12 18:40 - 000578560 _____ (Microsoft Corporation) C:\WINDOWS\system32\SppExtComObj.Exe
2019-11-12 18:40 - 2019-11-12 18:40 - 000517432 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 000514576 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcntel.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000513336 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000510792 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64win.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000492032 _____ (Microsoft Corporation) C:\WINDOWS\system32\Narrator.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 000491520 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000477712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS
2019-11-12 18:40 - 2019-11-12 18:40 - 000477184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\uxtheme.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000469504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webio.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000466928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000465208 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000461320 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000457216 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cldflt.sys
2019-11-12 18:40 - 2019-11-12 18:40 - 000453632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CredProvDataModel.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000452920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 000446464 _____ (Microsoft Corporation) C:\WINDOWS\system32\Magnify.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 000443904 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgeIso.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000435200 _____ (Microsoft Corporation) C:\WINDOWS\system32\wincorlib.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000415544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aepic.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000404904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000401920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Wldap32.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000382976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FirewallAPI.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000381952 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppLockerCSP.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000380944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000375720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000372752 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msrpc.sys
2019-11-12 18:40 - 2019-11-12 18:40 - 000354816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Magnify.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 000336384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchProtocolHost.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 000332288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Wldap32.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000324624 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32k.sys
2019-11-12 18:40 - 2019-11-12 18:40 - 000308736 _____ (Microsoft Corporation) C:\WINDOWS\system32\msIso.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000307712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wincorlib.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000299520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssvp.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000283648 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptui.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000283136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Search.ProtocolHandler.MAPI2.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000251512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wscapi.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000247856 _____ (Microsoft Corporation) C:\WINDOWS\system32\weretw.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000237056 _____ (Microsoft Corporation) C:\WINDOWS\system32\accessibilitycpl.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000236032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptui.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000236032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cmd.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 000225280 _____ (Microsoft Corporation) C:\WINDOWS\system32\wersvc.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000220472 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 000211968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchFilterHost.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 000206336 _____ (Microsoft Corporation) C:\WINDOWS\system32\wincredui.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000202552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\appid.sys
2019-11-12 18:40 - 2019-11-12 18:40 - 000199680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\accessibilitycpl.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000199480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 000197632 _____ (Microsoft Corporation) C:\WINDOWS\system32\Win32CompatibilityAppraiserCSP.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000193800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\weretw.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000189440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fwpolicyiomgr.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000164776 _____ (Microsoft Corporation) C:\WINDOWS\system32\omadmapi.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000164368 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 000162816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wincredui.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000160768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssph.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000159232 _____ (Microsoft Corporation) C:\WINDOWS\system32\srpapi.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000157184 _____ (Microsoft Corporation) C:\WINDOWS\system32\RMapi.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000150528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dmvdsitf.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000143872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SpatialAudioLicenseSrv.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 000136536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\omadmapi.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000131584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fwbase.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000128512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tunnel.sys
2019-11-12 18:40 - 2019-11-12 18:40 - 000125952 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontsub.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000118784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Utilman.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 000118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\EaseOfAccessDialog.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 000113160 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mountmgr.sys
2019-11-12 18:40 - 2019-11-12 18:40 - 000113152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssitlb.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000111104 _____ (Microsoft Corporation) C:\WINDOWS\system32\AxInstSv.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000105984 _____ (Microsoft Corporation) C:\WINDOWS\system32\utcutil.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000100352 _____ (Microsoft Corporation) C:\WINDOWS\system32\sethc.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 000099328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontsub.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000094720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Utilman.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 000093696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EaseOfAccessDialog.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 000092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsqmcons.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 000089568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32u.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AtBroker.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 000081408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dtdump.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 000079360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sethc.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 000079360 _____ (Microsoft Corporation) C:\WINDOWS\system32\usp10.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000077824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\usp10.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000073024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\remoteaudioendpoint.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000071480 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32appinventorycsp.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000066048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AtBroker.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 000064512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ApiSetHost.AppExecutionAlias.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000064512 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcadm.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000060416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssprxy.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000060416 _____ (Microsoft Corporation) C:\WINDOWS\system32\AxInstUI.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 000051200 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcalua.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 000048128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\nsiproxy.sys
2019-11-12 18:40 - 2019-11-12 18:40 - 000047616 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000046080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msscntrs.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000044544 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000043520 _____ (Microsoft Corporation) C:\WINDOWS\system32\LaunchWinApp.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 000039936 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000038912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000036368 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCensus.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 000034816 _____ (Microsoft Corporation) C:\WINDOWS\system32\winnsi.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LaunchWinApp.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 000033280 _____ (Microsoft Corporation) C:\WINDOWS\system32\posetup.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000030720 _____ (Microsoft Corporation) C:\WINDOWS\system32\nsisvc.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000028344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winnsi.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000025600 _____ (Microsoft Corporation) C:\WINDOWS\system32\appidtel.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 000024792 _____ (Microsoft Corporation) C:\WINDOWS\system32\nsi.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000020352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nsi.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000018944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wfapigp.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000018432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\applockerfltr.sys
2019-11-12 18:40 - 2019-11-12 18:40 - 000014336 _____ (Microsoft Corporation) C:\WINDOWS\system32\dciman32.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000012800 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcaevts.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000012288 _____ (Microsoft Corporation) C:\WINDOWS\system32\pacjsworker.exe
2019-11-12 18:40 - 2019-11-12 18:40 - 000011776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dciman32.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000003072 _____ (Microsoft Corporation) C:\WINDOWS\system32\lpk.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tzres.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\lpk.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\system32\tzres.dll
2019-11-12 18:40 - 2019-11-12 18:40 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\system32\tier2punctuations.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 017787904 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 007904152 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 007849424 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneCoreUAPCommonProxyStub.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 007278592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 006227104 _____ (Microsoft Corporation) C:\WINDOWS\system32\StartTileData.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 006166016 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.pcshell.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 005890048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.AI.MachineLearning.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 004615616 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2019-11-12 18:39 - 2019-11-12 18:39 - 004140544 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsThresholdAdminFlowUI.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 004005888 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeContent.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 003728384 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2019-11-12 18:39 - 2019-11-12 18:39 - 003703296 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 003591208 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2019-11-12 18:39 - 2019-11-12 18:39 - 003387392 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkMobileSettings.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 003263488 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 003105792 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 003084800 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 002870784 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssrch.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 002716672 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2019-11-12 18:39 - 2019-11-12 18:39 - 002284032 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 002126112 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 002120704 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcDesktopMonSvc.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 002114048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.CloudStore.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 001942528 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 001920512 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 001748480 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 001687040 _____ (Microsoft Corporation) C:\WINDOWS\system32\Wpc.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 001656392 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 001451520 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocoreworker.exe
2019-11-12 18:39 - 2019-11-12 18:39 - 001428992 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthport.sys
2019-11-12 18:39 - 2019-11-12 18:39 - 001413912 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 001259416 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcMon.exe
2019-11-12 18:39 - 2019-11-12 18:39 - 001149712 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplyTrustOffline.exe
2019-11-12 18:39 - 2019-11-12 18:39 - 001094656 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcRefreshTask.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 001070080 _____ (Microsoft Corporation) C:\WINDOWS\system32\BTAGService.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 001069064 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 001066496 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 001062912 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 001027000 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipSVC.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000913920 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcWebFilter.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000911824 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000874536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2019-11-12 18:39 - 2019-11-12 18:39 - 000868864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Management.Service.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000849920 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchIndexer.exe
2019-11-12 18:39 - 2019-11-12 18:39 - 000765440 _____ (Microsoft Corporation) C:\WINDOWS\system32\spoolsv.exe
2019-11-12 18:39 - 2019-11-12 18:39 - 000750080 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActivationManager.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000735744 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000708096 _____ (Microsoft Corporation) C:\WINDOWS\system32\agentactivationruntimewindows.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000704000 _____ (Microsoft Corporation) C:\WINDOWS\system32\agentactivationruntime.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000657424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spaceport.sys
2019-11-12 18:39 - 2019-11-12 18:39 - 000649728 _____ (Microsoft Corporation) C:\WINDOWS\system32\DevicesFlowBroker.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000644096 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdpsvc.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000598016 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe
2019-11-12 18:39 - 2019-11-12 18:39 - 000589592 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2019-11-12 18:39 - 2019-11-12 18:39 - 000563712 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpnprv.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000552448 _____ (Microsoft Corporation) C:\WINDOWS\system32\FirewallAPI.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000551736 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Vid.sys
2019-11-12 18:39 - 2019-11-12 18:39 - 000550400 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2019-11-12 18:39 - 2019-11-12 18:39 - 000534528 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft.Bluetooth.UserService.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000530944 _____ (Microsoft Corporation) C:\WINDOWS\system32\usosvc.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000524800 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdpusersvc.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000522176 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlows.exe
2019-11-12 18:39 - 2019-11-12 18:39 - 000513536 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe
2019-11-12 18:39 - 2019-11-12 18:39 - 000456192 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.ConversationalAgent.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000441144 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2019-11-12 18:39 - 2019-11-12 18:39 - 000416016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000401408 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchProtocolHost.exe
2019-11-12 18:39 - 2019-11-12 18:39 - 000392192 _____ (Microsoft Corporation) C:\WINDOWS\system32\Search.ProtocolHandler.MAPI2.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000368128 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssvp.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000359424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\MbbCx.sys
2019-11-12 18:39 - 2019-11-12 18:39 - 000350720 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_SpeechPrivacy.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000322504 _____ (Microsoft Corporation) C:\WINDOWS\system32\wscsvc.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000292664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msiscsi.sys
2019-11-12 18:39 - 2019-11-12 18:39 - 000291256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wscapi.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000280064 _____ (Microsoft Corporation) C:\WINDOWS\system32\cmd.exe
2019-11-12 18:39 - 2019-11-12 18:39 - 000278016 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcTok.exe
2019-11-12 18:39 - 2019-11-12 18:39 - 000277504 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_CapabilityAccess.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000265216 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdd.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000256000 _____ (Microsoft Corporation) C:\WINDOWS\system32\UpdateDeploymentProvider.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000250880 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\winnat.sys
2019-11-12 18:39 - 2019-11-12 18:39 - 000241152 _____ (Microsoft Corporation) C:\WINDOWS\system32\policymanagerprecheck.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000240640 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchFilterHost.exe
2019-11-12 18:39 - 2019-11-12 18:39 - 000239104 _____ (Microsoft Corporation) C:\WINDOWS\system32\vdsbas.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000235008 _____ (Microsoft Corporation) C:\WINDOWS\system32\fwpolicyiomgr.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000204816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spacedump.sys
2019-11-12 18:39 - 2019-11-12 18:39 - 000204800 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssph.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXApplicabilityBlob.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000184832 _____ (Microsoft Corporation) C:\WINDOWS\system32\AarSvc.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000175616 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmvdsitf.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000169472 _____ (Microsoft Corporation) C:\WINDOWS\system32\SpatialAudioLicenseSrv.exe
2019-11-12 18:39 - 2019-11-12 18:39 - 000162304 _____ (Microsoft Corporation) C:\WINDOWS\system32\fwbase.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\dssvc.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000147456 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000132608 _____ (Microsoft Corporation) C:\WINDOWS\splwow64.exe
2019-11-12 18:39 - 2019-11-12 18:39 - 000129024 _____ (Microsoft Corporation) C:\WINDOWS\system32\UtcDecoderHost.exe
2019-11-12 18:39 - 2019-11-12 18:39 - 000128512 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssitlb.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000127064 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32u.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000123904 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplicationControlCSP.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000114688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthenum.sys
2019-11-12 18:39 - 2019-11-12 18:39 - 000108032 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmTasks.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000105488 _____ (Microsoft Corporation) C:\WINDOWS\system32\icfupgd.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000098304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\BTHUSB.SYS
2019-11-12 18:39 - 2019-11-12 18:39 - 000088568 _____ (Microsoft Corporation) C:\WINDOWS\system32\remoteaudioendpoint.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000087552 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApiSetHost.AppExecutionAlias.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000077824 _____ (Microsoft Corporation) C:\WINDOWS\system32\CustomInstallExec.exe
2019-11-12 18:39 - 2019-11-12 18:39 - 000076288 _____ (Microsoft Corporation) C:\WINDOWS\system32\autopilot.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000070656 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Management.EnrollmentStatusTracking.ConfigProvider.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000065272 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsManagementServiceWinRt.ProxyStub.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000061952 _____ (Microsoft Corporation) C:\WINDOWS\system32\vss_ps.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000060416 _____ (Microsoft Corporation) C:\WINDOWS\system32\msscntrs.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000057856 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000057344 _____ (Microsoft Corporation) C:\WINDOWS\system32\audioresourceregistrar.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000047208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2019-11-12 18:39 - 2019-11-12 18:39 - 000036864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\BthMini.SYS
2019-11-12 18:39 - 2019-11-12 18:39 - 000027648 _____ (Microsoft Corporation) C:\WINDOWS\system32\wscisvif.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000025088 _____ (Microsoft Corporation) C:\WINDOWS\system32\autopilotdiag.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000024576 _____ (Microsoft Corporation) C:\WINDOWS\system32\wfapigp.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000018944 _____ (Microsoft Corporation) C:\WINDOWS\system32\wscproxystub.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000016896 _____ (Microsoft Corporation) C:\WINDOWS\system32\iscsilog.dll
2019-11-12 18:39 - 2019-11-12 18:39 - 000013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\dstokenclean.exe
2019-11-12 18:39 - 2019-11-12 18:39 - 000009216 _____ (Microsoft Corporation) C:\WINDOWS\system32\wscadminui.exe
2019-11-12 18:02 - 2019-11-12 18:02 - 000492544 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe
2019-11-12 18:02 - 2019-11-12 18:02 - 000390656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe
2019-11-09 12:23 - 2019-11-09 12:23 - 000047192 _____ C:\Users\rahsr\AppData\Local\recently-used.xbel
2019-11-02 11:39 - 2019-11-03 14:11 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2019-11-01 14:21 - 2019-11-01 14:39 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DJI Product
2019-11-01 14:21 - 2018-02-26 15:17 - 000086024 _____ (hxxp://libusb-win32.sourceforge.net) C:\WINDOWS\system32\libusb0.dll
2019-10-31 22:47 - 2019-10-31 22:56 - 109173168 _____ C:\Users\rahsr\Desktop\KidsDancing.mp4
2019-10-31 22:32 - 2019-10-31 22:34 - 131527124 _____ C:\Users\rahsr\Desktop\KidsDancingHalloween.mp4
2019-10-29 21:47 - 2019-10-29 21:47 - 007976792 _____ (Tim Kosse) C:\Users\rahsr\Downloads\FileZilla_3.45.1_win64-setup.exe
2019-10-29 19:16 - 2019-10-29 19:16 - 000002055 _____ C:\Users\Public\Desktop\SeaMonkey.lnk
2019-10-29 19:16 - 2019-10-29 19:16 - 000002055 _____ C:\ProgramData\Desktop\SeaMonkey.lnk
2019-10-29 19:05 - 2019-10-29 19:06 - 044820438 _____ (Mozilla) C:\Users\rahsr\Downloads\seamonkey-2.49.5.installer.exe
2019-10-27 17:21 - 2019-10-27 17:21 - 001789201 _____ C:\Users\rahsr\Downloads\FPP_Logs_20191028.0021.zip
2019-10-25 07:29 - 2019-10-25 07:30 - 000000000 ____D C:\Users\rahsr\Documents\LightingOverview
2019-10-25 07:11 - 2019-10-25 07:11 - 000007522 _____ C:\Users\rahsr\Downloads\PBRightSide_all-backup_v2_unprotected_20191025081153.json
2019-10-23 16:54 - 2019-10-25 08:27 - 000324243 _____ C:\Users\rahsr\Desktop\Driving route to Halloween Decoration contestants.pdf
2019-10-22 20:31 - 2019-11-19 08:51 - 000001514 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel Driver & Support Assistant.lnk

==================== One month (modified) ==================

(If an entry is included in the fixlist, the file/folder will be moved.)

2019-11-20 23:32 - 2019-09-17 01:12 - 000003534 _____ C:\WINDOWS\system32\Tasks\DashlaneUpgradeCheck
2019-11-20 23:21 - 2019-03-18 21:52 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2019-11-20 23:12 - 2019-09-17 00:27 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2019-11-20 22:49 - 2019-09-17 01:12 - 000003368 _____ C:\WINDOWS\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-3395428246-187305771-252134375-1001
2019-11-20 22:49 - 2019-09-17 00:37 - 000002367 _____ C:\Users\rahsr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2019-11-20 22:49 - 2016-09-05 21:00 - 000000000 ___RD C:\Users\rahsr\OneDrive
2019-11-20 20:53 - 2018-06-07 06:58 - 000000000 ____D C:\Users\rahsr\AppData\Local\Host App Service
2019-11-20 19:49 - 2019-09-17 01:12 - 000004164 _____ C:\WINDOWS\system32\Tasks\User_Feed_Synchronization-{DB725F63-DBCD-4AEB-A485-34646D23FBE9}
2019-11-20 14:34 - 2016-12-03 13:29 - 000000000 ____D C:\Users\rahsr\AppData\LocalLow\Mozilla
2019-11-19 08:53 - 2019-03-18 21:52 - 000000000 ____D C:\WINDOWS\AppReadiness
2019-11-19 08:52 - 2019-03-18 21:52 - 000000000 ___HD C:\Program Files\WindowsApps
2019-11-19 08:51 - 2016-05-04 20:02 - 000000000 ____D C:\ProgramData\Package Cache
2019-11-18 14:14 - 2018-03-04 08:34 - 000000000 ____D C:\Users\rahsr\AppData\Local\PlaceholderTileLogoFolder
2019-11-18 14:14 - 2017-12-19 07:56 - 000000000 ____D C:\Users\rahsr\AppData\Local\Packages
2019-11-18 14:13 - 2019-03-28 12:48 - 000000000 ____D C:\Users\rahsr\Desktop\Temp Desktop
2019-11-17 12:18 - 2016-12-05 17:24 - 000092848 _____ C:\Users\rahsr\AppData\Local\GDIPFONTCACHEV1.DAT
2019-11-16 07:58 - 2019-02-17 18:31 - 000000000 ____D C:\ProgramData\Autodesk
2019-11-16 07:07 - 2018-03-07 22:47 - 000000000 ____D C:\Users\rahsr\Desktop\Xmas lights
2019-11-16 07:00 - 2016-09-05 20:56 - 000000000 __SHD C:\Users\rahsr\IntelGraphicsProfiles
2019-11-15 23:30 - 2017-03-01 19:11 - 000002305 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2019-11-15 23:28 - 2019-09-17 01:12 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2019-11-15 23:28 - 2017-06-08 18:21 - 000000000 ____D C:\Program Files (x86)\TeamViewer
2019-11-15 23:27 - 2019-03-18 21:37 - 000786432 _____ C:\WINDOWS\system32\config\BBI
2019-11-15 11:27 - 2019-03-18 21:52 - 000000000 ____D C:\WINDOWS\system32\NDF
2019-11-15 11:26 - 2019-03-18 21:37 - 000000000 ____D C:\WINDOWS\CbsTemp
2019-11-15 11:22 - 2019-03-18 21:50 - 000000000 ____D C:\WINDOWS\INF
2019-11-15 07:38 - 2017-06-02 15:10 - 000002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2019-11-14 21:37 - 2017-05-22 23:33 - 000000000 ____D C:\Program Files (x86)\Intel
2019-11-13 22:03 - 2019-09-17 00:51 - 000842732 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2019-11-13 21:59 - 2019-01-25 09:53 - 000000000 ____D C:\Users\rahsr\AppData\Roaming\balena-etcher
2019-11-13 16:56 - 2019-09-17 01:12 - 000004580 _____ C:\WINDOWS\system32\Tasks\Adobe Flash Player NPAPI Notifier
2019-11-13 16:56 - 2019-09-17 01:12 - 000004386 _____ C:\WINDOWS\system32\Tasks\Adobe Flash Player Updater
2019-11-13 16:56 - 2019-03-18 21:52 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed
2019-11-13 16:56 - 2019-03-18 21:52 - 000000000 ____D C:\WINDOWS\system32\Macromed
2019-11-13 12:21 - 2016-12-03 10:01 - 000748816 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2019-11-13 10:19 - 2018-11-27 10:46 - 000000000 ____D C:\Users\rahsr\AppData\Local\babl-0.1
2019-11-13 08:16 - 2016-12-03 09:23 - 000000000 ____D C:\Users\rahsr\AppData\Local\CrashDumps
2019-11-13 00:27 - 2016-12-07 18:54 - 000000000 ___RD C:\Users\rahsr\3D Objects
2019-11-13 00:27 - 2016-02-13 06:20 - 000000000 __RHD C:\Users\Public\AccountPictures
2019-11-13 00:23 - 2019-09-17 00:27 - 000441632 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2019-11-13 00:19 - 2019-03-18 21:52 - 000000000 ___RD C:\WINDOWS\PrintDialog
2019-11-13 00:19 - 2019-03-18 21:52 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2019-11-13 00:19 - 2019-03-18 21:52 - 000000000 ____D C:\WINDOWS\SystemResources
2019-11-13 00:19 - 2019-03-18 21:52 - 000000000 ____D C:\WINDOWS\system32\appraiser
2019-11-13 00:19 - 2019-03-18 21:52 - 000000000 ____D C:\WINDOWS\ShellExperiences
2019-11-13 00:19 - 2019-03-18 21:52 - 000000000 ____D C:\WINDOWS\ShellComponents
2019-11-13 00:19 - 2019-03-18 21:52 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
2019-11-13 00:19 - 2019-03-18 21:52 - 000000000 ____D C:\WINDOWS\DiagTrack
2019-11-13 00:19 - 2019-03-18 21:52 - 000000000 ____D C:\WINDOWS\bcastdvr
2019-11-12 18:57 - 2016-09-10 20:45 - 000000000 ____D C:\WINDOWS\system32\MRT
2019-11-12 18:49 - 2016-09-10 20:45 - 128443096 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2019-11-12 14:44 - 2017-12-24 15:31 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\xLights
2019-11-12 14:44 - 2017-12-24 15:31 - 000000000 ____D C:\Program Files\xLights
2019-11-10 12:13 - 2019-04-07 21:39 - 000002077 _____ C:\Users\Public\Desktop\Google Slides.lnk
2019-11-10 12:13 - 2019-04-07 21:39 - 000002077 _____ C:\ProgramData\Desktop\Google Slides.lnk
2019-11-10 12:13 - 2019-04-07 21:39 - 000002075 _____ C:\Users\Public\Desktop\Google Sheets.lnk
2019-11-10 12:13 - 2019-04-07 21:39 - 000002075 _____ C:\ProgramData\Desktop\Google Sheets.lnk
2019-11-10 12:13 - 2019-04-07 21:39 - 000002065 _____ C:\Users\Public\Desktop\Google Docs.lnk
2019-11-10 12:13 - 2019-04-07 21:39 - 000002065 _____ C:\ProgramData\Desktop\Google Docs.lnk
2019-11-10 12:13 - 2019-04-07 21:39 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Backup and Sync from Google
2019-11-09 12:23 - 2018-04-23 17:08 - 000000000 ____D C:\Users\rahsr\AppData\Local\gtk-2.0
2019-11-09 12:13 - 2018-12-07 16:21 - 000000000 ____D C:\Users\rahsr\.dbus-keyrings
2019-11-07 12:58 - 2018-01-20 09:27 - 000000000 ____D C:\Users\rahsr\AppData\Roaming\audacity
2019-11-07 00:16 - 2019-03-18 21:52 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2019-11-06 21:35 - 2019-09-17 00:37 - 000000000 ____D C:\Users\rahsr
2019-11-06 11:18 - 2019-02-17 18:30 - 000000000 ____D C:\Users\rahsr\AppData\Local\Akamai
2019-11-05 15:52 - 2017-08-13 09:34 - 000000000 ____D C:\Users\rahsr\AppData\Roaming\FileZilla
2019-11-05 06:05 - 2019-09-17 01:12 - 000003420 _____ C:\WINDOWS\system32\Tasks\GoogleUpdateTaskMachineUA
2019-11-05 06:05 - 2019-09-17 01:12 - 000003296 _____ C:\WINDOWS\system32\Tasks\GoogleUpdateTaskMachineCore
2019-11-05 06:05 - 2017-03-01 19:09 - 000000000 ____D C:\Program Files (x86)\Google
2019-11-03 14:11 - 2019-09-17 00:37 - 000000000 ____D C:\Users\postgres
2019-11-03 14:11 - 2016-05-04 20:02 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2019-11-02 14:17 - 2016-05-04 20:02 - 000001238 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2019-11-02 14:15 - 2017-08-13 09:34 - 000000000 ____D C:\Users\rahsr\AppData\Local\FileZilla
2019-11-01 14:51 - 2017-07-28 18:25 - 000000000 ____D C:\Users\rahsr\AppData\Roaming\DJI Assistant 2
2019-11-01 14:39 - 2017-07-28 18:24 - 000000000 ____D C:\Program Files (x86)\DJI Product
2019-10-30 12:52 - 2017-08-13 09:34 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2019-10-30 12:52 - 2017-08-13 09:34 - 000000000 ____D C:\Program Files\FileZilla FTP Client
2019-10-29 22:44 - 2018-07-10 15:48 - 000000000 ____D C:\ProgramData\Packages
2019-10-29 19:16 - 2018-11-22 10:05 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SeaMonkey
2019-10-29 19:16 - 2018-11-22 10:05 - 000000000 ____D C:\Program Files (x86)\SeaMonkey
2019-10-26 12:55 - 2018-05-27 14:58 - 000000000 ____D C:\Backup
2019-10-23 21:43 - 2016-09-05 20:56 - 000000000 ____D C:\Users\rahsr\AppData\Local\VirtualStore
2019-10-23 17:11 - 2019-06-10 15:09 - 000000000 ____D C:\Users\rahsr\Desktop\Kingston Temp
2019-10-22 20:31 - 2019-02-18 19:02 - 000000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel
2019-10-21 16:19 - 2019-09-17 01:12 - 000004562 _____ C:\WINDOWS\system32\Tasks\Adobe Acrobat Update Task
2019-10-21 16:06 - 2018-02-24 08:19 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd

==================== Files in the root of some directories ========

2017-12-18 22:12 - 2019-11-20 23:19 - 002179531 _____ () C:\Users\rahsr\AppData\Roaming\xLights_l4cpp.log
2017-12-19 06:36 - 2019-07-09 19:28 - 000634970 _____ () C:\Users\rahsr\AppData\Roaming\xSchedule_l4cpp.log
2017-12-19 06:36 - 2018-09-04 20:45 - 001024070 _____ () C:\Users\rahsr\AppData\Roaming\xSchedule_l4cpp.log.1
2017-12-19 06:36 - 2018-09-04 20:38 - 001024013 _____ () C:\Users\rahsr\AppData\Roaming\xSchedule_l4cpp.log.2
2017-12-19 06:36 - 2018-09-04 20:31 - 001024024 _____ () C:\Users\rahsr\AppData\Roaming\xSchedule_l4cpp.log.3
2017-12-19 06:36 - 2018-09-04 20:24 - 001024025 _____ () C:\Users\rahsr\AppData\Roaming\xSchedule_l4cpp.log.4
2017-07-15 08:27 - 2019-03-08 20:28 - 000009216 _____ () C:\Users\rahsr\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2017-04-09 19:22 - 2017-04-09 19:22 - 000004096 ____H () C:\Users\rahsr\AppData\Local\keyfile3.drm
2018-11-12 11:27 - 2019-09-08 13:40 - 000000600 _____ () C:\Users\rahsr\AppData\Local\PUTTY.RND
2019-11-09 12:23 - 2019-11-09 12:23 - 000047192 _____ () C:\Users\rahsr\AppData\Local\recently-used.xbel
2018-10-07 07:48 - 2018-10-07 07:48 - 000007605 _____ () C:\Users\rahsr\AppData\Local\Resmon.ResmonCfg

==================== SigCheck ============================

(There is no automatic fix for files that do not pass verification.)

==================== End of FRST.txt ========================
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 19-11-2019
Ran by rahsr (20-11-2019 23:35:53)
Running from C:\Users\rahsr\Desktop
Windows 10 Home Version 1909 18363.476 (X64) (2019-09-17 08:13:56)
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-3395428246-187305771-252134375-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-3395428246-187305771-252134375-503 - Limited - Disabled)
Guest (S-1-5-21-3395428246-187305771-252134375-501 - Limited - Disabled)
postgres (S-1-5-21-3395428246-187305771-252134375-1002 - Limited - Enabled) => C:\Users\postgres
rahsr (S-1-5-21-3395428246-187305771-252134375-1001 - Administrator - Enabled) => C:\Users\rahsr
WDAGUtilityAccount (S-1-5-21-3395428246-187305771-252134375-504 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

12 Labours of Hercules III: Girl Power (HKLM-x32\...\WTA-7a494eda-e560-4ca8-b761-791e32285009) (Version: 3.0.2.118 - WildTangent) Hidden
3DF Zephyr Free version 4.350 (HKLM\...\{53B4E599-2462-4A8F-B8D1-E736E7B5477D}_is1) (Version: 4.350 - 3Dflow srl)
7-Zip 16.04 (x64) (HKLM\...\7-Zip) (Version: 16.04 - Igor Pavlov)
abFiles (HKLM-x32\...\{13885028-098C-4799-9B71-27DAC96502D5}) (Version: 2.03.2003 - Acer Incorporated)
abPhoto (HKLM-x32\...\{B5AD89F2-03D3-4206-8487-018298007DD0}) (Version: 4.00.2001.1 - Acer Incorporated)
Acer Care Center (HKLM\...\{1AF41E84-3408-499A-8C93-8891F0612719}) (Version: 2.00.3019 - Acer Incorporated)
Acer Configuration Manager (HKLM-x32\...\{414D554E-4453-454E-0201-000000016258}) (Version: 2.1.16258 - Acer)
Acer Jumpstart (HKLM-x32\...\{4B92BFBE-917D-4FA1-97E9-DB9D91286E90}) (Version: 3.0.18135.100 - Acer)
Acer Portal (HKLM-x32\...\{A5AD0B17-F34D-49BE-A157-C8B3D52ACD13}) (Version: 3.12.2006 - Acer Incorporated)
Acer Quick Access (HKLM\...\{8BBF04F1-C68A-441C-B5EF-446EE9960EAF}) (Version: 2.01.3007 - Acer Incorporated)
Acer UEIP Framework (HKLM\...\{12A718F2-2357-4D41-9E1F-18583A4745F7}) (Version: 3.01.3001 - Acer Incorporated)
Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 19.021.20056 - Adobe Systems Incorporated)
Adobe Flash Player 32 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 32.0.0.293 - Adobe)
Agisoft Metashape Standard (HKLM\...\{21D4DB3F-D816-49B9-9581-E1DED3758A38}) (Version: 1.5.0 - Agisoft)
Amazon Assistant (HKLM-x32\...\{0538B1C2-85C1-4ECC-BA77-61F537D81092}) (Version: 10.18.0221 - Amazon) <==== ATTENTION
AOP Framework (HKLM-x32\...\{4A37A114-702F-4055-A4B6-16571D4A5353}) (Version: 3.25.2001.0 - Acer Incorporated)
App Explorer (HKU\S-1-5-21-3395428246-187305771-252134375-1001\...\Host App Service) (Version: 0.273.3.686 - SweetLabs)
App Explorer (HKU\S-1-5-21-3395428246-187305771-252134375-1002\...\Host App Service) (Version: 0.272.1.160 - SweetLabs)
ARM Toolchain (HKLM-x32\...\{1B814763-49DF-4377-A11D-64CD519EF997}) (Version: 7.0.1359 - Atmel) Hidden
Atmel Driver Files (HKLM-x32\...\{07C063CE-9BCE-4CFB-A2B6-2583E9092F77}) (Version: 8.0.16 - Atmel Corporation)
Atmel LibUSB0 Driver (x64) (HKLM\...\{C1F86585-CDAC-4ABE-B163-161DDBCC4332}) (Version: 7.0.125 - Atmel)
Atmel Segger USB Drivers (501e) (HKLM-x32\...\{156C0C95-4DDE-4F88-97A0-5EEE22269CE3}) (Version: 7.0.417 - Atmel)
Atmel Software Framework (HKLM-x32\...\{91574A83-3A5D-4624-8531-7E0E0DC0EF12}) (Version: 7.0.1384 - Atmel) Hidden
Atmel Studio 7.0 (HKLM-x32\...\{f472442b-eb34-456b-a41c-b0df497f7d8a}) (Version: 7.0.1417 - Atmel)
Atmel Studio Development Environment (HKLM-x32\...\{2F0BD0E9-AB59-43FA-9B75-CEF5F2E0EB65}) (Version: 7.0.1417 - Atmel) Hidden
Atmel WinUSB (HKLM-x32\...\{22D3C72E-42F9-4B0F-B331-E0AA134ADF76}) (Version: 6.2.32 - Atmel)
Audacity 2.2.1 (HKLM-x32\...\Audacity_is1) (Version: 2.2.1 - Audacity Team)
Audacity Vamp Plugins for 64 Bit version 1.7 (HKLM-x32\...\Audacity Vamp Plugins for 64 Bit_is1) (Version: 1.7 - )
Autodesk Desktop App (HKLM-x32\...\Autodesk Desktop App) (Version: 7.0.12.84 - Autodesk)
Autodesk License Service (x64) - 7.1.4 (HKLM\...\{F53D6D10-7A75-4A39-8C53-A3D855C7C50A}) (Version: 7.1.4.0 - Autodesk)
Autodesk ReCap (HKLM\...\{50EDF910-0000-1033-0102-E3D118CE2EEA}) (Version: 5.0.3.58 - Autodesk) Hidden
Autodesk ReCap (HKLM\...\Autodesk ReCap 360) (Version: 5.0.3.58 - Autodesk)
Autodesk ReCap Photo (HKLM\...\{0E4FA9C0-0000-1033-0102-1B3A7F15D307}) (Version: 19.1.1.2 - Autodesk) Hidden
Autodesk ReCap Photo (HKLM\...\Autodesk ReCap Photo) (Version: 19.1.1.2 - Autodesk)
Autodesk ReCap Photo Update 19.1.0 (HKLM-x32\...\{11b0543e-b0f6-438b-8de5-ac6bbe34cc8f}) (Version: 19.1.0.10 - Autodesk)
AVR32 Device Support (HKLM-x32\...\{DB78B4A4-187F-47EF-BC4A-9A2291E96116}) (Version: 7.0.1363 - Atmel) Hidden
AVR32 Toolchain 7.0 (HKLM-x32\...\{8AF6AD1C-A2DE-412D-9FEE-ECF60AD534BB}) (Version: 7.0.536 - Atmel) Hidden
AVR8 Device Support (HKLM-x32\...\{7FF04DC1-32C7-4DF4-A477-2EFDD1DCC5B6}) (Version: 7.0.1409 - Atmel) Hidden
AVR8 Toolchain (HKLM-x32\...\{002338F5-BE99-40F8-A88A-D91F420A3169}) (Version: 7.0.1328 - Atmel) Hidden
AVS Audio Converter 9.1.1 (HKLM-x32\...\AVS Audio Converter_is1) (Version: 9.1.1.597 - Online Media Technologies Ltd.)
AVS Audio Editor 9.1.1 (HKLM-x32\...\AVS Audio Editor_is1) (Version: 9.1.1.537 - Online Media Technologies Ltd.)
AVS Disc Creator 6.1.7 (HKLM-x32\...\AVS Disc Creator_is1) (Version: 6.1.7.557 - Online Media Technologies Ltd.)
AVS Document Converter 4.2.2 (HKLM-x32\...\AVS Document Converter_is1) (Version: 4.2.2.267 - Online Media Technologies Ltd.)
AVS Image Converter 5.2.2 (HKLM-x32\...\AVS Image Converter_is1) (Version: 5.2.2.301 - Online Media Technologies Ltd.)
AVS Media Player 5.1.2 (HKLM-x32\...\AVS Media Player_is1) (Version: 5.1.2.135 - Online Media Technologies Ltd.)
AVS Photo Editor 3.2.2 (HKLM-x32\...\AVS Photo Editor_is1) (Version: 3.2.2.166 - Online Media Technologies Ltd.)
AVS Registry Cleaner 4.1.3 (HKLM-x32\...\AVS Registry Cleaner_is1) (Version: 4.1.3.289 - Online Media Technologies Ltd.)
AVS Video Converter 12.0.1 (HKLM-x32\...\AVS4YOU Video Converter 7_is1) (Version: 12.0.1.650 - Online Media Technologies Ltd.)
AVS Video Editor 9.1.1 (HKLM-x32\...\AVS Video Editor_is1) (Version: 9.1.1.336 - Online Media Technologies Ltd.)
AVS Video ReMaker 6.3.1 (HKLM-x32\...\AVS Video ReMaker_is1) (Version: 6.3.1.230 - Online Media Technologies Ltd.)
Backup and Sync from Google (HKLM\...\{93EBD8BA-7A14-4636-8F1F-E929ADF2C3A9}) (Version: 3.47.7654.0300 - Google, Inc.)
balenaEtcher 1.5.52 (HKU\S-1-5-21-3395428246-187305771-252134375-1001\...\d2f3b6c7-6f49-59e2-b8a5-f72e33900c2b) (Version: 1.5.52 - Balena Inc.)
Blender (HKLM\...\{E29A1273-2E7A-40E7-AA63-428A11D59429}) (Version: 2.79.2 - Blender Foundation)
Bonjour (HKLM\...\{B91110FB-33B4-468B-90C2-4D5E8AE3FAE1}) (Version: 2.0.2.0 - Apple Inc.)
CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.6329.02 - CyberLink Corp.)
Dashlane Upgrade Service (HKLM-x32\...\Dashlane Upgrade Service) (Version: 2.1.17.0 - Dashlane, Inc.)
DaVinci Resolve (HKLM\...\{A6768A12-548B-45FF-9474-A62153C7DAB4}) (Version: 12.5.3014 - Blackmagic Design)
DJI Assistant 2 For Phantom version V2.0.8.4 (HKLM-x32\...\{00DD3702-DB3B-4137-843C-3147F46B749E}_is1) (Version: V2.0.8.4 - DJI)
DJI Assistant 2 version V1.2.5 (HKLM-x32\...\{D939E096-78F1-4A32-A711-C1AD3F3D082A}_is1) (Version: V1.2.5 - DJI)
DriverSetupUtility (HKLM\...\{2B51C83A-465D-4EA9-9CDC-1ED95ED09AC6}) (Version: 1.00.3013 - Acer Incorporated)
EAGLE 8.3.2 (HKLM\...\{AUTODESK-EAGLE-8-3-2}_is1) (Version: 8.3.2 - Autodesk, Inc.)
Edraw Max 9.3 (HKLM-x32\...\Edraw Max_is1) (Version: - EdrawSoft)
EncFS MP (HKLM\...\Regard3D) (Version: 0.9.5 - Roman Hiestand)
Escaperoom Software (HKLM-x32\...\{95739F80-C40C-47F0-8E1C-F79300F986F8}) (Version: 3.4.1.0 - Escaperoom Software)
Etcher 1.4.4 (only current user) (HKU\S-1-5-21-3395428246-187305771-252134375-1001\...\573339af-d9e1-5dd3-804c-e0162fac1f41) (Version: 1.4.4 - Resin Inc.)
Falcon Update Tool (HKU\S-1-5-21-3395428246-187305771-252134375-1001\...\{MainFrame}}_is1) (Version: 1.0 - David)
FARO LS 1.1.700.0 (64bit) (HKLM-x32\...\{FF6E9382-0B85-48DE-888F-76EFD9A87038}) (Version: 7.0.0.23 - FARO Scanner Production)
FileZilla Client 3.45.1 (HKLM-x32\...\FileZilla Client) (Version: 3.45.1 - Tim Kosse)
Flip 3.4.7 (HKLM-x32\...\flip.exe) (Version: 3.4.7 - Atmel)
Freedome VPN (source) (HKLM-x32\...\{83A4BF20-6745-437C-98D8-3C4B94D174EB}) (Version: 1.16.0612 - Acer)
Game Explorer Categories - genres (HKLM-x32\...\WildTangentGameProvider-acer-genres) (Version: 13.0.0.6 - WildTangent, Inc.)
Game Explorer Categories - main (HKLM-x32\...\WildTangentGameProvider-acer-main) (Version: 13.0.0.6 - WildTangent, Inc.)
Get Norton (HKLM-x32\...\{2754D1B9-B13E-443C-B09D-12AA910010DE}) (Version: 3.0.18066.2 - Acer)
GIMP 2.10.8 (HKLM\...\GIMP-2_is1) (Version: 2.10.8 - The GIMP Team)
GitHub Desktop (HKU\S-1-5-21-3395428246-187305771-252134375-1001\...\GitHubDesktop) (Version: 2.1.3 - GitHub, Inc.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 78.0.3904.97 - Google LLC)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.35.341 - Google LLC) Hidden
GoPro Quik (HKLM\...\{8B7D1DD1-5CA4-4B6E-9A86-3EA9E3601DF3}) (Version: 0.1.841 - GoPro, Inc.) Hidden
GoPro Quik (HKLM-x32\...\{f1aab631-23ee-456b-a5ef-6e4d9d638068}) (Version: 2.6.2.841 - GoPro, Inc.)
Home Makeover (HKLM-x32\...\WTA-51652966-5361-4b80-9399-ee22d5141f96) (Version: 3.0.2.59 - WildTangent) Hidden
Inkscape 0.92.2 (HKLM-x32\...\Inkscape) (Version: 0.92.2 - Inkscape Project)
Intel Driver && Support Assistant (HKLM-x32\...\{31990087-E845-4714-B8D2-750497D90341}) (Version: 19.11.46.6 - Intel) Hidden
Intel® Chipset Device Software (HKLM-x32\...\{fb610cea-ba50-4d4b-a717-cf025419035c}) (Version: 10.1.1.13 - Intel® Corporation) Hidden
Intel® Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 11.0.2.1183 - Intel Corporation)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 24.20.100.6286 - Intel Corporation)
Intel® Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 17.2.0.1009 - Intel Corporation)
Intel® Serial IO (HKLM\...\{9FD91C5C-44AE-4D9D-85BE-AE52816B0294}) (Version: 30.63.1519.7 - Intel Corporation)
Intel® Driver & Support Assistant (HKLM-x32\...\{9d54562c-195e-463a-9d06-3c71c3998dfb}) (Version: 19.11.46.6 - Intel)
Intel® Security Assist (HKLM-x32\...\{CCBE9F01-C2C3-469C-A508-2E23A7495E91}) (Version: 1.0.0.609 - Intel Corporation)
Jewel Match 3 (HKLM-x32\...\WTA-366dde42-9c64-456e-bb98-1cbc67da6c1d) (Version: 2.2.0.97 - WildTangent) Hidden
Jewel Match Snowscapes (HKLM-x32\...\WTA-61d46cd4-8d54-4212-8eb3-39ff0d6ba278) (Version: 3.0.2.118 - WildTangent) Hidden
KompoZer 0.8b3 (HKLM-x32\...\{20aa4150-b5f4-11de-8a39-0800200c9a66}_is1) (Version: - KompoZer)
LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version: - )
Magic Academy (HKLM-x32\...\WTA-b65f01c3-338a-4bbc-8448-9e52a90bc16f) (Version: 2.2.0.97 - WildTangent) Hidden
Microsoft .NET Framework 4.5 Multi-Targeting Pack (HKLM-x32\...\{56E962F0-4FB0-3C67-88DB-9EAA6EEFC493}) (Version: 4.5.50710 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 Multi-Targeting Pack (ENU) (HKLM-x32\...\{D3517C62-68A5-37CF-92F7-93C029A89681}) (Version: 4.5.50932 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 Multi-Targeting Pack (HKLM-x32\...\{6A0C6700-EA93-372C-8871-DCCF13D160A4}) (Version: 4.5.50932 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 SDK (HKLM-x32\...\{19A5926D-66E1-46FC-854D-163AA10A52D3}) (Version: 4.5.51641 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 Multi-Targeting Pack (ENU) (HKLM-x32\...\{290FC320-2F5A-329E-8840-C4193BD7A9EE}) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 Multi-Targeting Pack (HKLM-x32\...\{B941AFB4-8851-33A1-9E72-0C33D463C41C}) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Help Viewer 2.2 (HKLM-x32\...\Microsoft Help Viewer 2.2) (Version: 2.2.23107 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-3395428246-187305771-252134375-1001\...\OneDriveSetup.exe) (Version: 19.192.0926.0012 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50918.0 - Microsoft Corporation)
Microsoft SQL Server 2014 Management Objects (HKLM-x32\...\{2774595F-BC2A-4B12-A25B-0C37A37049B0}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft System CLR Types for SQL Server 2014 (HKLM-x32\...\{718FFB65-F6E4-4D62-861F-ED10ED32C936}) (Version: 12.0.2402.11 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 (HKLM-x32\...\{d992c12e-cab2-426f-bde3-fb8c53950b0d}) (Version: 14.0.24215.1 - Microsoft Corporation)
Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.22.27821 (HKLM-x32\...\{5bfc1380-fd35-4b85-9715-7351535d077e}) (Version: 14.22.27821.0 - Microsoft Corporation)
Microsoft Visual Studio 2015 Shell (Isolated) (HKLM-x32\...\{d2981c27-a434-4c9a-96c7-0209e97c4eac}) (Version: 14.0.23107.10 - Microsoft Corporation)
Movavi Video Suite 18 (HKU\S-1-5-21-3395428246-187305771-252134375-1001\...\Movavi Video Suite 18) (Version: 18.2.0 - Movavi)
Mozilla Firefox 70.0.1 (x64 en-US) (HKLM\...\Mozilla Firefox 70.0.1 (x64 en-US)) (Version: 70.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 70.0.1.7242 - Mozilla)
Notepad++ (64-bit x64) (HKLM\...\Notepad++) (Version: 7.7.1 - Notepad++ Team)
OpenAL (HKLM-x32\...\OpenAL) (Version: - )
Oracle VM VirtualBox 5.2.22 (HKLM\...\{85307853-1C18-4D00-AA0B-B561502BD7C0}) (Version: 5.2.22 - Oracle Corporation)
PDF-XChange Editor (HKLM\...\{F15CB44E-856E-4872-A767-5628971A761C}) (Version: 7.0.325.1 - Tracker Software Products (Canada) Ltd.) Hidden
PDF-XChange Editor (HKLM-x32\...\{2be0fb67-0906-4428-ab19-02ae10c7e4bc}) (Version: 7.0.325.1 - Tracker Software Products (Canada) Ltd.)
Polar Bowler 1st Frame (HKLM-x32\...\WTA-e72139d1-5a9a-4df1-b71a-deffc1afaf07) (Version: 3.0.2.59 - WildTangent) Hidden
PostgreSQL 9.2 (HKLM\...\PostgreSQL 9.2) (Version: 9.2 - PostgreSQL Global Development Group)
PuTTY release 0.70 (64-bit) (HKLM\...\{45B3032F-22CC-40CD-9E97-4DA7095FA5A2}) (Version: 0.70.0.0 - Simon Tatham)
Qualcomm Atheros 11ac Wireless LAN Installer (HKLM-x32\...\{20CA507E-24AA-4741-87CF-CC1B250790B7}) (Version: 11.0.10299 - Qualcomm Atheros)
Qualcomm Atheros Bluetooth Installer (64) (HKLM\...\{628988B4-3FA5-4EA6-BAA3-DA640F6718BD}) (Version: 10.0.0.191 - Qualcomm Atheros)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 10.0.10586.21287 - Realtek Semiconduct Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.6.1001.2015 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.8569 - Realtek Semiconductor Corp.)
REAPER (x64) (HKLM\...\REAPER) (Version: - )
Rory's Restaurant (HKLM-x32\...\WTA-fc1192e6-c484-4157-ba1d-f2e27d1e9ac7) (Version: 3.0.2.126 - WildTangent) Hidden
Runefall (HKLM-x32\...\WTA-3f91a1e9-5983-449e-9aaa-f089bb09684a) (Version: 3.0.2.126 - WildTangent) Hidden
SAM Device Support (HKLM-x32\...\{05E11282-DFA2-4C2E-9C59-3E9DD479863F}) (Version: 7.0.1392 - Atmel) Hidden
Screencast-O-Matic (HKU\S-1-5-21-3395428246-187305771-252134375-1001\...\Screencast-O-Matic) (Version: - Screencast-O-Matic)
SD Card Formatter (HKLM-x32\...\{A61131DC-B92D-4AD8-A925-E2D6D5FE217C}) (Version: 5.0.1 - SD Association)
SeaMonkey 2.49.5 (x86 en-US) (HKLM-x32\...\SeaMonkey 2.49.5 (x86 en-US)) (Version: 2.49.5 - Mozilla)
Spotify (HKU\S-1-5-21-3395428246-187305771-252134375-1001\...\Spotify) (Version: 1.0.65.320.gac7a8e02 - Spotify AB)
TeamViewer 14 (HKLM-x32\...\TeamViewer) (Version: 14.1.3399 - TeamViewer)
Update for (KB2504637) (HKLM-x32\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}.KB2504637) (Version: 1 - Microsoft Corporation)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for Windows 10 for x64-based Systems (KB4023057) (HKLM\...\{C3ACFCEA-240F-4DCC-A0C3-DD55FEE6C3C2}) (Version: 2.58.0.0 - Microsoft Corporation)
Update Installer for WildTangent Games App (HKLM-x32\...\{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App) (Version: - WildTangent) Hidden
Vegas World (HKLM-x32\...\WildTangentGDF-acer-vegasworld) (Version: 13.0.0.6 - WildTangent) Hidden
Villagers and Heroes (HKLM-x32\...\WildTangentGDF-acer-villagersandheroes) (Version: 13.0.0.6 - WildTangent) Hidden
WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
WildTangent Games App (HKLM-x32\...\{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-acer) (Version: 4.1.1.12 - WildTangent) Hidden
Win32DiskImager version 1.0.0 (HKLM-x32\...\{3DFFA293-DF2C-4B23-92E5-3433BDC310E1}}_is1) (Version: 1.0.0 - ImageWriter Developers)
xLights version 2019.64 (HKLM\...\xLights_is1) (Version: 2019.64 - )
Xvid Video Codec (HKLM-x32\...\Xvid Video Codec 1.3.5) (Version: 1.3.5 - Xvid Team)
Zoom (HKU\S-1-5-21-3395428246-187305771-252134375-1001\...\ZoomUMX) (Version: 4.5 - Zoom Video Communications, Inc.)

Packages:
=========
Amazon -> C:\Program Files\WindowsApps\Amazon.com.Amazon_2018.519.2811.0_x64__343d40qqvtj1t [2018-06-28] (Amazon.com)
Autodesk SketchBook -> C:\Program Files\WindowsApps\89006A2E.AutodeskSketchBook_5.1.0.0_x64__tf1gferkr813w [2019-11-05] (Autodesk Inc.)
Candy Crush Soda Saga -> C:\Program Files\WindowsApps\king.com.CandyCrushSodaSaga_1.151.300.0_x86__kgqvnymyfvs32 [2019-10-31] (king.com)
GIF Viewer -> C:\Program Files\WindowsApps\600CCC33.GIFViewer_2.21.74.0_x64__npmv4c3p4dm00 [2019-10-15] (Biyee SciTech Inc.) [MS Ad]
Google -> C:\Program Files\WindowsApps\GoogleInc.GoogleSearch_2.1.19.0_x64__yfg5n0ztvskxp [2018-05-20] (Google Inc)
HP Smart -> C:\Program Files\WindowsApps\AD2F1837.HPPrinterControl_105.1.623.0_x64__v10z8vjag6ke6 [2019-11-15] (HP Inc.)
Kindle -> C:\Program Files\WindowsApps\AMZNMobileLLC.KindleforWindows8_2.1.0.2_neutral__stfe6vwa9jnbp [2016-09-10] (AMZN Mobile LLC)
Mail and Calendar -> C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12026.20368.0_x64__8wekyb3d8bbwe [2019-11-05] (Microsoft Corporation) [MS Ad]
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x64__8wekyb3d8bbwe [2019-01-28] (Microsoft Corporation) [MS Ad]
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x86__8wekyb3d8bbwe [2019-01-28] (Microsoft Corporation) [MS Ad]
Microsoft News -> C:\Program Files\WindowsApps\Microsoft.BingNews_4.33.13094.0_x64__8wekyb3d8bbwe [2019-11-13] (Microsoft Corporation) [MS Ad]
Microsoft Solitaire Collection -> C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.11052.0_x64__8wekyb3d8bbwe [2019-11-08] (Microsoft Studios) [MS Ad]
Movie Maker 10 - Tell Your Story -> C:\Program Files\WindowsApps\21336V3TApps.MovieMaker-FREE_2.8.83.0_x64__bzg06mxvgh4fa [2019-10-08] (V3TApps) [MS Ad]
MPEG-2 Video Extension -> C:\Program Files\WindowsApps\Microsoft.MPEG2VideoExtension_1.0.22661.0_x64__8wekyb3d8bbwe [2019-09-24] (Microsoft Corporation)
MSN Money -> C:\Program Files\WindowsApps\Microsoft.BingFinance_4.31.11905.0_x64__8wekyb3d8bbwe [2019-07-19] (Microsoft Corporation) [MS Ad]
MSN Sports -> C:\Program Files\WindowsApps\Microsoft.BingSports_4.31.11905.0_x64__8wekyb3d8bbwe [2019-07-19] (Microsoft Corporation) [MS Ad]
MSN Weather -> C:\Program Files\WindowsApps\Microsoft.BingWeather_4.33.13094.0_x64__8wekyb3d8bbwe [2019-11-19] (Microsoft Corporation) [MS Ad]
Music Maker Jam -> C:\Program Files\WindowsApps\MAGIX.MusicMakerJam_3.0.0.0_x64__a2t3txkz9j1jw [2019-07-26] (MAGIX)
Netflix -> C:\Program Files\WindowsApps\4DF9E0F8.Netflix_6.95.602.0_x64__mcm4njqhnhss8 [2019-10-25] (Netflix, Inc.)
Photos Add-on -> C:\Program Files\WindowsApps\Microsoft.Windows.Photos.DLC.Main_2017.39121.36610.0_x64__8wekyb3d8bbwe [2019-02-24] (Microsoft Corporation)
Photos Media Engine Add-on -> C:\Program Files\WindowsApps\Microsoft.Photos.MediaEngineDLC_1.0.0.0_x64__8wekyb3d8bbwe [2019-11-18] (Microsoft Corporation)
Speedtest by Ookla -> C:\Program Files\WindowsApps\Ookla.SpeedtestbyOokla_1.8.39.0_x64__43tkc6nmykmb6 [2019-11-09] (Ookla)
Spotify Music -> C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.119.480.0_x86__zpdnekdrzrea0 [2019-11-12] (Spotify AB) [Startup Task]
Twitter -> C:\Program Files\WindowsApps\9E2F88E3.Twitter_6.1.4.1000_neutral__wgeqdkkx372wm [2018-09-08] (Twitter Inc.)
Xbox 360 SmartGlass -> C:\Program Files\WindowsApps\Microsoft.XboxCompanion_1.4.3.0_x64__8wekyb3d8bbwe [2019-07-26] (Microsoft Corporation) [MS Ad]

==================== Custom CLSID (Whitelisted): ==============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-3395428246-187305771-252134375-1001_Classes\CLSID\{233525e0-5434-46ef-b464-fd7e45e2e145}\localserver32 -> C:\Program Files (x86)\Intel\Driver and Support Assistant\DSATray.exe (IDSA Production signing key -> Intel)
ShellExecuteHooks-x32: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2217832 2009-02-26] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files\Google\Drive\googledrivesync64.dll [2019-10-24] (Google LLC -> Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files\Google\Drive\googledrivesync64.dll [2019-10-24] (Google LLC -> Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files\Google\Drive\googledrivesync64.dll [2019-10-24] (Google LLC -> Google)
ShellIconOverlayIdentifiers: [ ACloudSynced] -> {5CCE71FA-9F61-4F24-9CD1-98D819B40D68} => C:\Program Files (x86)\Acer\shellext\x64\shellext_win.dll [2017-10-02] (Acer Incorporated -> Acer Incorporated)
ShellIconOverlayIdentifiers: [ ACloudSyncing] -> {C1E1456F-C2D8-4C96-870D-35F1E13941EE} => C:\Program Files (x86)\Acer\shellext\x64\shellext_win.dll [2017-10-02] (Acer Incorporated -> Acer Incorporated)
ShellIconOverlayIdentifiers: [ ACloudToBeSynced] -> {307523FA-DDC0-4068-983F-2A6B34627744} => C:\Program Files (x86)\Acer\shellext\x64\shellext_win.dll [2017-10-02] (Acer Incorporated -> Acer Incorporated)
ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov) [File not signed]
ContextMenuHandlers1: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} => C:\Program Files\Notepad++\NppShell_06.dll [2018-12-11] (Notepad++ -> )
ContextMenuHandlers1: [GDContextMenu] -> {BB02B294-8425-42E5-983F-41A1FA970CD6} => C:\Program Files\Google\Drive\contextmenu64.dll [2019-10-24] (Google LLC -> Google)
ContextMenuHandlers1: [PDFXChange Editor Context menu] -> {2ACD35AB-F74A-4C20-AA9B-2DE80081626D} => C:\Program Files\Tracker Software\Shell Extensions\XCShellMenu.x64.dll [2018-04-24] (Tracker Software Products (Canada) Ltd. -> Tracker Software Products (Canada) Ltd.)
ContextMenuHandlers1: [ShellConverter] -> {30A4E07E-068A-4d91-8F05-691283A1336B} => C:\Program Files (x86)\Common Files\AVSMedia\ActiveX\AVSShellConverter64.dll [2017-12-18] (Online Media Technologies Ltd. -> Online Media Technologies Ltd.)
ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov) [File not signed]
ContextMenuHandlers4: [GDContextMenu] -> {BB02B294-8425-42E5-983F-41A1FA970CD6} => C:\Program Files\Google\Drive\contextmenu64.dll [2019-10-24] (Google LLC -> Google)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\System32\DriverStore\FileRepository\igdlh64.inf_amd64_587befb80671fb38\igfxDTCM.dll [2018-10-14] (Microsoft Windows Hardware Compatibility Publisher -> Intel Corporation)
ContextMenuHandlers6: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov) [File not signed]

==================== Codecs (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Drivers32: [vidc.XVID] => C:\WINDOWS\system32\xvidvfw.dll [251392 2017-12-08] () [File not signed]
HKLM\...\Drivers32: [vidc.XVID] => C:\Windows\SysWOW64\xvidvfw.dll [235520 2017-12-08] () [File not signed]

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)

ShortcutWithArgument: C:\Users\rahsr\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\7d5cad5df1643bee\piskel.lnk -> C:\Users\rahsr\Desktop\Xmas lights\Piskel-0.12.1\Piskel-0.12.1\Piskel-0.12.1.exe (The NWJS Community) -> --user-data-dir="C:\Users\rahsr\AppData\Local\piskel\User Data" --profile-directory=Default --app-id=ipkokkhkdmkpjefoobgfdglgmbehndab

==================== Loaded Modules (Whitelisted) =============

2016-10-29 20:28 - 2013-04-01 20:41 - 000176128 _____ () [File not signed] C:\Program Files\PostgreSQL\9.2\bin\LIBPQ.dll
2016-10-29 20:28 - 2012-08-14 06:31 - 001328128 _____ () [File not signed] C:\Program Files\PostgreSQL\9.2\bin\libxml2.dll
2016-10-29 20:28 - 2012-05-08 14:00 - 000981504 _____ (Free Software Foundation) [File not signed] C:\Program Files\PostgreSQL\9.2\bin\iconv.dll
2016-10-29 20:28 - 2011-01-10 08:16 - 000240862 _____ (Free Software Foundation) [File not signed] C:\Program Files\PostgreSQL\9.2\bin\libintl-8.dll
2017-09-06 16:58 - 2016-10-04 07:51 - 000076800 _____ (Igor Pavlov) [File not signed] C:\Program Files\7-Zip\7-zip.dll
2019-09-17 01:53 - 2019-09-17 01:53 - 000113664 _____ (Microsoft Corporation) [File not signed] C:\WINDOWS\WinSxS\amd64_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.6195_none_8a1dd9552ed7f8d8\ATL80.DLL
2016-10-29 20:28 - 2012-10-12 03:58 - 001577472 _____ (The OpenSSL Project, hxxp://www.openssl.org/) [File not signed] C:\Program Files\PostgreSQL\9.2\bin\LIBEAY32.dll
2016-10-29 20:28 - 2012-10-12 03:58 - 000338944 _____ (The OpenSSL Project, hxxp://www.openssl.org/) [File not signed] C:\Program Files\PostgreSQL\9.2\bin\SSLEAY32.dll

==================== Alternate Data Streams (Whitelisted) ========

==================== Safe Mode (Whitelisted) ==================

==================== Association (Whitelisted) =================

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

HKLM\...\.scr: EAGLESCR => "C:\EAGLE 8.3.2\eagle.exe" -C "" "%1" <==== ATTENTION

==================== Internet Explorer trusted/restricted ==========

==================== Hosts content: =========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2015-10-30 00:24 - 2019-03-28 12:51 - 000000842 _____ C:\WINDOWS\system32\drivers\etc\hosts

==================== Other Areas ===========================

(Currently there is no automatic fix for this section.)

HKLM\System\CurrentControlSet\Control\Session Manager\Environment\\Path -> C:\Program Files (x86)\Intel\iCLS Client\;C:\Program Files\Intel\iCLS Client\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL;C:\Program Files\Intel\Intel® Management Engine Components\DAL;C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT;C:\Program Files\Intel\Intel® Management Engine Components\IPT;C:\Program Files\xLights;%SYSTEMROOT%\System32\OpenSSH\;C:\Program Files (x86)\xLights\xLights;C:\Program Files\PuTTY\
HKU\S-1-5-21-3395428246-187305771-252134375-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\rahsr\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\win7 ltblue 1920x1200.jpg
HKU\S-1-5-21-3395428246-187305771-252134375-1002\Control Panel\Desktop\\Wallpaper ->
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

==================== FirewallRules (Whitelisted) ================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [UDP Query User{26F35BED-8614-44DD-AFD3-BAA53F2DA086}C:\program files\xlights\xlights.exe] => (Allow) C:\program files\xlights\xlights.exe () [File not signed]
FirewallRules: [TCP Query User{4CE60AFA-6910-4607-899C-21F39FF40C5A}C:\program files\xlights\xlights.exe] => (Allow) C:\program files\xlights\xlights.exe () [File not signed]
FirewallRules: [UDP Query User{C3B84818-0E5A-4F24-85F2-7E30CB852B4E}C:\program files\xlightstest\xschedule.exe] => (Allow) C:\program files\xlightstest\xschedule.exe () [File not signed]
FirewallRules: [TCP Query User{FB307922-BB3F-49C4-AABB-9718D6A8D323}C:\program files\xlightstest\xschedule.exe] => (Allow) C:\program files\xlightstest\xschedule.exe () [File not signed]
FirewallRules: [UDP Query User{26A1BBEC-977F-44CA-A967-C0D902FF6D50}C:\program files (x86)\escaperoom software\escaperoom.exe] => (Allow) C:\program files (x86)\escaperoom software\escaperoom.exe (Escaperoom Software) [File not signed]
FirewallRules: [TCP Query User{2DCF7F4F-DF73-4634-B618-2FF0A8FC5A41}C:\program files (x86)\escaperoom software\escaperoom.exe] => (Allow) C:\program files (x86)\escaperoom software\escaperoom.exe (Escaperoom Software) [File not signed]
FirewallRules: [UDP Query User{2DF30091-D5EF-45A7-8DB4-E2E13F3A237F}C:\program files\xlights\xschedule.exe] => (Allow) C:\program files\xlights\xschedule.exe () [File not signed]
FirewallRules: [TCP Query User{723CC049-5FAF-4B4A-A754-22DCE13FC6A8}C:\program files\xlights\xschedule.exe] => (Allow) C:\program files\xlights\xschedule.exe () [File not signed]
FirewallRules: [UDP Query User{1D1FEE10-E3A1-4D7F-9181-C65ED4EBC406}C:\program files (x86)\dji product\dji assistant 2\assistant\root.exe] => (Allow) C:\program files (x86)\dji product\dji assistant 2\assistant\root.exe (SZ DJI Technology Co., Ltd. -> DJI)
FirewallRules: [TCP Query User{845B18B0-5E9A-40AE-91B3-E00979A08AA5}C:\program files (x86)\dji product\dji assistant 2\assistant\root.exe] => (Allow) C:\program files (x86)\dji product\dji assistant 2\assistant\root.exe (SZ DJI Technology Co., Ltd. -> DJI)
FirewallRules: [{8FE46E36-6097-46C9-B94D-04C3771C6564}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{A39A0342-6DFE-42C3-A648-76B724BF1BF3}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{2D3CD0F4-EA05-400A-826E-A08212D9CA3A}] => (Allow) C:\Program Files (x86)\Acer\AOP Framework\acer\ccd.exe (Acer Incorporated -> Acer Cloud Technology)
FirewallRules: [{B3339414-F9A7-450A-97F2-F739D85297E3}] => (Allow) C:\Program Files (x86)\Acer\AOP Framework\acer\ccd.exe (Acer Incorporated -> Acer Cloud Technology)
FirewallRules: [{CA7DB177-8790-411D-8BC7-CB1B6BF806FD}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\DMCDaemon.exe (Acer Incorporated -> acer)
FirewallRules: [{1375A0AA-74D5-4730-B801-85A386BE5CB5}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\DMCDaemon.exe (Acer Incorporated -> acer)
FirewallRules: [{3F5A4D9E-CB9B-4F94-882B-2FBE793FCC83}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\WindowsUpnp.exe (Acer Incorporated -> acer)
FirewallRules: [{CF1D77F8-5C09-4F16-B39E-EF7FF7328110}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\WindowsUpnp.exe (Acer Incorporated -> acer)
FirewallRules: [{832850BA-1427-41F6-B6E2-87D50AC9ED81}] => (Allow) C:\Program Files\Blackmagic Design\DaVinci Resolve\Resolve.exe (Blackmagic Design Pty Ltd -> Blackmagic Design Pty. Ltd.)
FirewallRules: [{7FE7ADC5-9B7D-4793-8B00-919FB495444E}] => (Allow) C:\Program Files\Blackmagic Design\DaVinci Resolve\bmdpaneld.exe () [File not signed]
FirewallRules: [{4BCD1397-B1D5-4FC3-9F74-AA8346CB77A4}] => (Allow) C:\Program Files\Blackmagic Design\DaVinci Resolve\JLCooperPanelDaemon.exe () [File not signed]
FirewallRules: [{859C3B1A-40BA-48DD-9C45-F775304FEF33}] => (Allow) C:\Program Files\Blackmagic Design\DaVinci Resolve\EuphonixPanelDaemon.exe () [File not signed]
FirewallRules: [{E4B507CA-121A-49D4-A966-123F3A84CDE9}] => (Allow) C:\Program Files\Blackmagic Design\DaVinci Resolve\TangentPanelDaemon.exe () [File not signed]
FirewallRules: [{49B00CD2-EED7-421E-AF6A-4D49961B9DC7}] => (Allow) C:\Program Files\Blackmagic Design\DaVinci Resolve\ElementsPanelDaemon.exe () [File not signed]
FirewallRules: [{2E0DE74E-58FA-4153-B2E9-E59A163E5083}] => (Allow) C:\Program Files\Blackmagic Design\DaVinci Resolve\DPDecoder.exe (Blackmagic Design Pty Ltd -> )
FirewallRules: [{6C1601DF-D3AD-44FF-81EA-88ADBADDDB99}] => (Allow) C:\ProgramData\Blackmagic Design\DaVinci Resolve\Support\QtDecoder\QTDecoder.exe No File
FirewallRules: [{4D18FF10-50F6-484F-B9CF-73FDF56E8A5D}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12.exe (CyberLink Corp. -> CyberLink Corp.)
FirewallRules: [{03804781-48C6-4E0D-9E0D-AACA46BE0424}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe No File
FirewallRules: [{71996537-F475-4ACD-A19C-5C1AF8EC9460}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe No File
FirewallRules: [{1DD5FE1A-3BE2-4C3D-AAF9-404B867D36DF}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe No File
FirewallRules: [{C29B84AF-811E-4FF6-94B4-8E321A3071A2}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12ML.exe (CyberLink Corp. -> CyberLink Corp.)
FirewallRules: [{DC41A988-DEE8-4D6D-9501-46A10E620DC8}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\Movie\PowerDVD.exe (CyberLink Corp. -> CyberLink Corp.)
FirewallRules: [TCP Query User{B38544C6-1320-467E-899B-CDC269CA0EC8}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [UDP Query User{A20DAAE9-96BB-4199-A28C-60CC4F6EF0C4}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [TCP Query User{8C637CAD-DA3D-4B69-95A4-6EB012B19DE4}C:\program files (x86)\dji product\dji assistant 2\assistant\root.exe] => (Allow) C:\program files (x86)\dji product\dji assistant 2\assistant\root.exe (SZ DJI Technology Co., Ltd. -> DJI)
FirewallRules: [UDP Query User{76BC9902-CEAF-42A5-8DA7-4A511CB222EB}C:\program files (x86)\dji product\dji assistant 2\assistant\root.exe] => (Allow) C:\program files (x86)\dji product\dji assistant 2\assistant\root.exe (SZ DJI Technology Co., Ltd. -> DJI)
FirewallRules: [TCP Query User{94FF2075-7102-4A0C-92CF-812046AAF972}C:\program files (x86)\dji product\dji assistant 2\assistant\visionstarter.exe] => (Allow) C:\program files (x86)\dji product\dji assistant 2\assistant\visionstarter.exe (SZ DJI Technology Co., Ltd. -> )
FirewallRules: [UDP Query User{6937B053-5708-4F16-B989-EAA925EC70C8}C:\program files (x86)\dji product\dji assistant 2\assistant\visionstarter.exe] => (Allow) C:\program files (x86)\dji product\dji assistant 2\assistant\visionstarter.exe (SZ DJI Technology Co., Ltd. -> )
FirewallRules: [{C88DD8DE-D75F-46A3-9798-FF8B25B3EB37}] => (Allow) C:\Program Files (x86)\Atmel\Studio\7.0\atbackend\atbackend.exe (Atmel Norway -> Atmel Corporation)
FirewallRules: [{7CCD9C12-CE7C-4980-B5AD-DE5E3F563EB4}] => (Allow) C:\Program Files (x86)\Atmel\Studio\7.0\AtmelStudio.exe (Atmel Norway -> Atmel)
FirewallRules: [TCP Query User{E6DA77E2-4C8F-46C8-A776-417F7EF09A1B}C:\users\rahsr\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\rahsr\appdata\roaming\spotify\spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [UDP Query User{2BF4509F-83D5-425B-8602-AECC078CE407}C:\users\rahsr\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\rahsr\appdata\roaming\spotify\spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{2EC3D599-44EA-4CC1-BD77-7329DDA00898}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.)
FirewallRules: [{C704ED8D-464A-4200-BBC7-1ABDCBA31E58}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.)
FirewallRules: [{1C317753-E3C6-4388-B617-F9618C10E51D}] => (Allow) C:\Program Files\GoPro\GoPro Desktop App\GoPro Quik.exe (GoPro Media, Inc. -> )
FirewallRules: [{8AE07EA2-BABB-4186-9D8E-946DDC28FBD5}] => (Allow) C:\Program Files\GoPro\GoPro Desktop App\GoProMsgBus.exe (GoPro Media, Inc. -> )
FirewallRules: [{F4E64981-B262-4B5B-9FFF-DE56CA269850}] => (Allow) C:\Program Files\GoPro\GoPro Desktop App\GoProIDService.exe (GoPro Media, Inc. -> )
FirewallRules: [{10FD0378-48A5-4180-A2CA-1FFBB5FAB85C}] => (Allow) C:\Program Files\GoPro\GoPro Desktop App\GoProLauncher.exe (GoPro Media, Inc. -> )
FirewallRules: [TCP Query User{CF961644-87C7-4DA0-ABA8-2A3A0A264178}C:\program files (x86)\seamonkey\seamonkey.exe] => (Allow) C:\program files (x86)\seamonkey\seamonkey.exe (mozilla.org) [File not signed]
FirewallRules: [UDP Query User{9F4F1340-FC5B-499B-B119-981D02EA5F80}C:\program files (x86)\seamonkey\seamonkey.exe] => (Allow) C:\program files (x86)\seamonkey\seamonkey.exe (mozilla.org) [File not signed]
FirewallRules: [TCP Query User{0FFB651B-530B-4C5E-BF73-638C4C684F1A}C:\program files\blackmagic design\davinci resolve\dpdecoder.exe] => (Allow) C:\program files\blackmagic design\davinci resolve\dpdecoder.exe (Blackmagic Design Pty Ltd -> )
FirewallRules: [UDP Query User{45C51AA2-E739-4341-A951-9800DA0C3591}C:\program files\blackmagic design\davinci resolve\dpdecoder.exe] => (Allow) C:\program files\blackmagic design\davinci resolve\dpdecoder.exe (Blackmagic Design Pty Ltd -> )
FirewallRules: [{BCEBFB5E-3BF8-4126-ABF6-429D897B9185}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe (TeamViewer GmbH -> TeamViewer GmbH)
FirewallRules: [{736ED427-789F-4295-BB2F-E84216BC7636}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe (TeamViewer GmbH -> TeamViewer GmbH)
FirewallRules: [{F8CC544C-25EF-4FC5-930A-A225972A7A75}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe (TeamViewer GmbH -> TeamViewer GmbH)
FirewallRules: [{38C4F90F-F74D-4542-82B6-67EDCC52CEE9}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe (TeamViewer GmbH -> TeamViewer GmbH)
FirewallRules: [TCP Query User{45B07042-842F-46E2-A09F-AE3410265922}C:\program files\xlights\xlights.exe] => (Allow) C:\program files\xlights\xlights.exe () [File not signed]
FirewallRules: [UDP Query User{BE9FDBBA-1258-4CA3-8B8A-AD8DCF9F9C39}C:\program files\xlights\xlights.exe] => (Allow) C:\program files\xlights\xlights.exe () [File not signed]
FirewallRules: [TCP Query User{5106DBBC-A5C9-4699-A1E4-1552259EB137}C:\users\rahsr\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\rahsr\appdata\local\akamai\netsession_win.exe No File
FirewallRules: [UDP Query User{3D3BD02B-34E0-4653-9561-0A03E6B774FD}C:\users\rahsr\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\rahsr\appdata\local\akamai\netsession_win.exe No File
FirewallRules: [TCP Query User{78691550-3C67-41BF-B78B-6C30ABC1B4EC}C:\program files (x86)\dji product\dji assistant 2\assistant\visionstarter.exe] => (Allow) C:\program files (x86)\dji product\dji assistant 2\assistant\visionstarter.exe (SZ DJI Technology Co., Ltd. -> )
FirewallRules: [UDP Query User{6CA0A19D-CD55-4A24-91ED-A8BD001369C0}C:\program files (x86)\dji product\dji assistant 2\assistant\visionstarter.exe] => (Allow) C:\program files (x86)\dji product\dji assistant 2\assistant\visionstarter.exe (SZ DJI Technology Co., Ltd. -> )
FirewallRules: [TCP Query User{84359C25-9C10-44C4-84DC-78835F5D0795}C:\program files (x86)\dji product\dji assistant 2 for phantom\djiengine\djiservice.exe] => (Allow) C:\program files (x86)\dji product\dji assistant 2 for phantom\djiengine\djiservice.exe (SZ DJI Technology Co., Ltd. -> )
FirewallRules: [UDP Query User{19C86A65-5198-4EA4-AF09-2319229455C9}C:\program files (x86)\dji product\dji assistant 2 for phantom\djiengine\djiservice.exe] => (Allow) C:\program files (x86)\dji product\dji assistant 2 for phantom\djiengine\djiservice.exe (SZ DJI Technology Co., Ltd. -> )
FirewallRules: [TCP Query User{62B0DE77-6A29-4B5B-B766-8B866151524C}C:\program files (x86)\dji product\dji assistant 2 for phantom\djiengine\visionstarter.exe] => (Allow) C:\program files (x86)\dji product\dji assistant 2 for phantom\djiengine\visionstarter.exe () [File not signed]
FirewallRules: [UDP Query User{E0A6326F-E0DC-484F-8A62-359793B27154}C:\program files (x86)\dji product\dji assistant 2 for phantom\djiengine\visionstarter.exe] => (Allow) C:\program files (x86)\dji product\dji assistant 2 for phantom\djiengine\visionstarter.exe () [File not signed]
FirewallRules: [{E06D8587-DC07-4D25-A855-810491682027}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google LLC)
FirewallRules: [{95A7B8F4-3C8D-47E2-A079-0680F7BB8E52}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.119.480.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{A79FA0E6-26AC-4484-B118-5B3CF43B5E85}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.119.480.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{F30F2B72-2A1E-4B79-9740-EB24953C74F4}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.119.480.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{9BA48F52-B82F-4375-AB95-7E26A7739682}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.119.480.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{6D6946DA-D7BF-4B36-8AD1-BFE5B06FC893}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.119.480.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{7A00DD82-3B8C-44F1-98CA-47DCD22AE3CD}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.119.480.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{D3AA646D-13F6-4450-9BFB-BB9EFF35E013}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.119.480.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{3A90A557-2DB2-4A2E-B6E9-DC4AB71B029A}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.119.480.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)

==================== Restore Points =========================

09-11-2019 01:38:50 Scheduled Checkpoint
12-11-2019 18:00:53 Windows Update
15-11-2019 11:25:21 Windows Modules Installer

==================== Faulty Device Manager Devices ============

==================== Event log errors: ========================

Application errors:
==================
Error: (11/20/2019 11:37:28 PM) (Source: ESENT) (EventID: 455) (User: )
Description: svchost (1585740,R,98) TILEREPOSITORYS-1-5-18: Error -1023 (0xfffffc01) occurred while opening logfile C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database\EDB.log.

Error: (11/20/2019 11:33:55 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program MicrosoftEdgeCP.exe version 11.0.18362.1 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

Process ID: 1540c4

Start Time: 01d59fc47a7f6961

Termination Time: 18

Application Path: C:\Windows\System32\MicrosoftEdgeCP.exe

Report Id: 625a2d36-ad83-45bd-8d4b-dfd273e30c1e

Faulting package full name: Microsoft.MicrosoftEdge_44.18362.449.0_neutral__8wekyb3d8bbwe

Faulting package-relative application ID: MicrosoftEdge

Hang type: Unknown

Error: (11/20/2019 11:16:51 PM) (Source: ESENT) (EventID: 455) (User: )
Description: svchost (1578496,R,98) TILEREPOSITORYS-1-5-18: Error -1023 (0xfffffc01) occurred while opening logfile C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database\EDB.log.

Error: (11/20/2019 10:55:31 PM) (Source: ESENT) (EventID: 455) (User: )
Description: svchost (1574880,R,98) TILEREPOSITORYS-1-5-18: Error -1023 (0xfffffc01) occurred while opening logfile C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database\EDB.log.

Error: (11/20/2019 10:46:50 PM) (Source: ESENT) (EventID: 455) (User: )
Description: svchost (1572524,R,98) TILEREPOSITORYS-1-5-18: Error -1023 (0xfffffc01) occurred while opening logfile C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database\EDB.log.

Error: (11/20/2019 10:16:50 PM) (Source: ESENT) (EventID: 455) (User: )
Description: svchost (1563760,R,98) TILEREPOSITORYS-1-5-18: Error -1023 (0xfffffc01) occurred while opening logfile C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database\EDB.log.

Error: (11/20/2019 09:46:50 PM) (Source: ESENT) (EventID: 455) (User: )
Description: svchost (1558124,R,98) TILEREPOSITORYS-1-5-18: Error -1023 (0xfffffc01) occurred while opening logfile C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database\EDB.log.

Error: (11/20/2019 09:16:50 PM) (Source: ESENT) (EventID: 455) (User: )
Description: svchost (1551092,R,98) TILEREPOSITORYS-1-5-18: Error -1023 (0xfffffc01) occurred while opening logfile C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database\EDB.log.

System errors:
=============
Error: (11/16/2019 07:04:11 AM) (Source: DCOM) (EventID: 10010) (User: RICK-LAPTOP)
Description: The server Microsoft.Windows.Photos_2019.19071.17920.0_x64__8wekyb3d8bbwe!App.AppX65n3t4j73ch7cremsjxn7q8bph1ma8jw.mca did not register with DCOM within the required timeout.

Error: (11/15/2019 11:28:25 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The IntelSSTSvc service failed to start due to the following error:
The system cannot find the file specified.

Error: (11/15/2019 11:26:32 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The IntelSSTSvc service failed to start due to the following error:
The system cannot find the file specified.

Error: (11/15/2019 10:17:33 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The IntelSSTSvc service failed to start due to the following error:
The system cannot find the file specified.

Error: (11/15/2019 10:14:31 AM) (Source: Microsoft-Windows-NDIS) (EventID: 10317) (User: NT AUTHORITY)
Description: Miniport Qualcomm Atheros QCA9377 Wireless Network Adapter, {4025965a-7914-41a5-84ab-3bbb0849da3c}, had event 71

Error: (11/15/2019 10:14:31 AM) (Source: Qcamain10x64) (EventID: 5002) (User: )
Description: Qualcomm Atheros QCA9377 Wireless Network Adapter : Has determined that the network adapter is not functioning properly.

Error: (11/15/2019 07:38:08 AM) (Source: DCOM) (EventID: 10005) (User: RICK-LAPTOP)
Description: DCOM got error "1053" attempting to start the service WSearch with arguments "Unavailable" in order to run the server:
{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}

Error: (11/15/2019 07:38:08 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Windows Search service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.

Windows Defender:
===================================
Date: 2019-11-16 17:46:24.022
Description:
Windows Defender Antivirus scan has been stopped before completion.
Scan ID: {28F6E16F-1BCB-46C0-8601-5F38C4D94DA5}
Scan Type: Antimalware
Scan Parameters: Quick Scan

Date: 2019-11-15 15:55:49.161
Description:
Windows Defender Antivirus scan has been stopped before completion.
Scan ID: {4A6CC2B7-6D9F-4812-8557-8C8F2DBDE29F}
Scan Type: Antimalware
Scan Parameters: Quick Scan

Date: 2019-11-15 15:44:22.921
Description:
Windows Defender Antivirus scan has been stopped before completion.
Scan ID: {7883116C-3953-40C5-920E-CE3DC3D66BD8}
Scan Type: Antimalware
Scan Parameters: Quick Scan

Date: 2019-11-13 10:25:09.335
Description:
Windows Defender Antivirus scan has been stopped before completion.
Scan ID: {C0ABA878-7D1B-43E4-B34A-08B45D7E988F}
Scan Type: Antimalware
Scan Parameters: Quick Scan

Date: 2019-11-13 10:10:44.453
Description:
Windows Defender Antivirus scan has been stopped before completion.
Scan ID: {E9E429C4-41FF-4038-A1D8-CBC53154390A}
Scan Type: Antimalware
Scan Parameters: Quick Scan

Date: 2019-11-15 23:38:51.027
Description:
Windows Defender Antivirus has encountered an error trying to update security intelligence.
New security intelligence Version:
Previous security intelligence Version: 1.305.2170.0
Update Source: Microsoft Update Server
Security intelligence Type: AntiVirus
Update Type: Full
Current Engine Version:
Previous Engine Version: 1.1.16500.1
Error code: 0x8024402c
Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.

Date: 2019-11-15 10:29:28.811
Description:
Windows Defender Antivirus has encountered an error trying to update security intelligence.
New security intelligence Version:
Previous security intelligence Version: 1.305.2147.0
Update Source: Microsoft Update Server
Security intelligence Type: AntiVirus
Update Type: Full
Current Engine Version:
Previous Engine Version: 1.1.16500.1
Error code: 0x80240438
Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.

Date: 2019-11-13 00:32:40.857
Description:
Windows Defender Antivirus has encountered an error trying to update security intelligence.
New security intelligence Version:
Previous security intelligence Version: 1.305.1968.0
Update Source: Microsoft Update Server
Security intelligence Type: AntiVirus
Update Type: Full
Current Engine Version:
Previous Engine Version: 1.1.16500.1
Error code: 0x8024402c
Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.

Date: 2019-11-01 15:59:18.080
Description:
Windows Defender Antivirus has encountered an error trying to update security intelligence.
New security intelligence Version:
Previous security intelligence Version: 1.305.1184.0
Update Source: Microsoft Update Server
Security intelligence Type: AntiVirus
Update Type: Full
Current Engine Version:
Previous Engine Version: 1.1.16500.1
Error code: 0x80240438
Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.

CodeIntegrity:
===================================

Date: 2019-11-16 14:05:15.171
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\browser_broker.exe) attempted to load \Device\HarddiskVolume3\Program Files\Google\Drive\googledrivesync64.dll that did not meet the Microsoft signing level requirements.

Date: 2019-11-16 14:05:15.164
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\browser_broker.exe) attempted to load \Device\HarddiskVolume3\Program Files\Google\Drive\googledrivesync64.dll that did not meet the Microsoft signing level requirements.

Date: 2019-11-16 14:05:15.157
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\browser_broker.exe) attempted to load \Device\HarddiskVolume3\Program Files\Google\Drive\googledrivesync64.dll that did not meet the Microsoft signing level requirements.

Date: 2019-11-15 14:05:09.508
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\browser_broker.exe) attempted to load \Device\HarddiskVolume3\Program Files\Google\Drive\googledrivesync64.dll that did not meet the Microsoft signing level requirements.

Date: 2019-11-15 14:05:09.490
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\browser_broker.exe) attempted to load \Device\HarddiskVolume3\Program Files\Google\Drive\googledrivesync64.dll that did not meet the Microsoft signing level requirements.

Date: 2019-11-15 14:05:09.470
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\browser_broker.exe) attempted to load \Device\HarddiskVolume3\Program Files\Google\Drive\googledrivesync64.dll that did not meet the Microsoft signing level requirements.

Date: 2019-11-14 14:05:00.010
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\browser_broker.exe) attempted to load \Device\HarddiskVolume3\Program Files\Google\Drive\googledrivesync64.dll that did not meet the Microsoft signing level requirements.

Date: 2019-11-14 14:05:00.003
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\browser_broker.exe) attempted to load \Device\HarddiskVolume3\Program Files\Google\Drive\googledrivesync64.dll that did not meet the Microsoft signing level requirements.

==================== Memory info ===========================

BIOS: Insyde Corp. V1.04 04/26/2016
Motherboard: Acer Ironman_SK
Processor: Intel® Core™ i5-6200U CPU @ 2.30GHz
Percentage of memory in use: 66%
Total physical RAM: 12161.9 MB
Available physical RAM: 4128.95 MB
Total Virtual: 28300.25 MB
Available Virtual: 16625.99 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:930.91 GB) (Free:113.12 GB) NTFS

\\?\Volume{1efdad30-2461-4e3a-9ab2-319bbb8f014a}\ (Recovery) (Fixed) (Total:0.49 GB) (Free:0.07 GB) NTFS
\\?\Volume{f410680d-2364-4d69-bf4c-6a361f2c24d7}\ (ESP) (Fixed) (Total:0.09 GB) (Free:0.05 GB) FAT32

==================== MBR & Partition Table ====================

==========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 1F033B6E)

Partition: GPT.

==================== End of Addition.txt =======================

Advertisements

Register to Remove

#2 Juliet

SuperHelper

Retired Classroom Teacher
7,686 posts

Interests:Boo!....

Posted 21 November 2019 - 03:57 PM

I received an email that had one of my passwords in the title.

Man, don't click on anything like that, it is typical scare-ware.

go into 'System settings - Networking' and ensure that any controls for remote access are turned off.

TeamViewer and computer webcam are off.

Next, using your AV, whether it be Windows Defender or some other product, run a system scan.

~~

Please go into your add/remove programs on control panel and uninstall
Amazon Assistant (HKLM-x32\...\{0538B1C2-85C1-4ECC-BA77-61F537D81092}) (Version: 10.18.0221 - Amazon) <==== ATTENTION

~~~~~~~~~~~~~~~~~~

Start Farbar Recovery Scan Tool with Administrator privileges
(Right click on the FRST icon and select Run as administrator)

highlight on the text below and select Copy.
beginning with Start:: and finishing with End::
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Highlight the entire content of the quote box below and select Copy.

Start::
CloseProcesses:
CreateRestorePoint:
C:\Program Files (x86)\Amazon\Amazon Assistant\amazonAssistantService.exe
C:\Program Files (x86)\Amazon\Amazon Assistant
ShortcutTarget: $McRebootA5E6DEAA56$.lnk -> (No File)
GroupPolicy: Restriction ? <==== ATTENTION
Task: {4FF17F34-9C25-4BB0-B212-2D4B7B1CF83A} - System32\Tasks\App Explorer => C:\Users\rahsr\AppData\Local\Host App Service\Engine\HostAppServiceUpdater.exe [7407784 2019-10-18] (SweetLabs Inc. -> SweetLabs, Inc) <==== ATTENTION
Task: {94E596BC-9870-431C-961F-A6371F56C2EF} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
SearchScopes: HKU\S-1-5-21-3395428246-187305771-252134375-1001 -> {69A632CF-6C9A-47BD-95AB-58CBCDBE5EE6} URL =
BHO: Amazon Assistant -> {0ddcea2a-7b00-4349-8acb-af7ba6da251f} -> C:\Program Files (x86)\Amazon\Amazon Assistant\aaMessenger.dll [2018-02-22] (Amazon Services LLC -> )
BHO-x32: Amazon Assistant -> {0ddcea2a-7b00-4349-8acb-af7ba6da251f} -> C:\Program Files (x86)\Amazon\Amazon Assistant\aaMessenger.dll [2018-02-22] (Amazon Services LLC -> )
R2 Amazon Assistant Service; C:\Program Files (x86)\Amazon\Amazon Assistant\amazonAssistantService.exe [105136 2018-02-22] (Amazon Services LLC -> )
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File
ShortcutWithArgument: C:\Users\rahsr\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\7d5cad5df1643bee\piskel.lnk -> C:\Users\rahsr\Desktop\Xmas lights\Piskel-0.12.1\Piskel-0.12.1\Piskel-0.12.1.exe (The NWJS Community) -> --user-data-dir="C:\Users\rahsr\AppData\Local\piskel\User Data" --profile-directory=Default --app-id=ipkokkhkdmkpjefoobgfdglgmbehndab
FirewallRules: [{6C1601DF-D3AD-44FF-81EA-88ADBADDDB99}] => (Allow) C:\ProgramData\Blackmagic Design\DaVinci Resolve\Support\QtDecoder\QTDecoder.exe No File
EmptyTemp:
C:\Windows\Temp\*.*
End::

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Start FRST (FRST64) with Administrator privileges
Press the Fix button. FRST will process the lines copied above from the clipboard.
When finished, a log file Fixlog.txt will pop up and saved in the same location the tool was ran from.

Please copy and paste its contents in your next reply.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

AdwCleaner - Fix Mode

Download AdwCleaner and move it to your Desktop
Right-click on AdwCleaner.exe and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
Accept the EULA (I accept), then click on Scan
Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean & Repair button. This will kill all the active processes
Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it
After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply

~~~~~~~~~~~~~~~~~~~~~~~~~~~``

RogueKiller

Download the right version of RogueKiller for your Windows version (32 or 64-bit)
Once done, move the executable file to your Desktop, right-click on it and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
Click on the Start Scan button in the right panel, which will bring you to another tab, and click on it again (this time it'll be in the bottom right corner)
Wait for the scan to complete
On completion, the results will be displayed
Check every single entry (threat found), and click on the Remove Selected button
On completion, the results will be displayed. Click on the Open Report button in the bottom left corner, followed by the Open TXT button (also in the bottom left corner)
This will open the report in Notepad. Copy/paste its content in your next reply

Please post these 3 logs when finished.

Sometimes the angels fly close enough to you that you can hear the flutter of their wings...

MS - MVP Consumer Security 2009 - 2016, WI-MVP 2016-17
Antivirus Scanners Online Scanners Firewalls Slow Computer??

#3 poporacer

Authentic Member

Authentic Member
106 posts

Posted 21 November 2019 - 11:13 PM

Opening a PDF can cause malware? I didn't know.

Thank you so much for helping!

I couldn't find anything in the network settings about sharing. I removed TeamViewer and the camera is off.

I ran a scan with Malwarebytes and got the following report:

Malwarebytes

www.malwarebytes.com

-Log Details-

Scan Date: 11/21/19

Scan Time: 4:03 PM

Log File: 12a7a45a-0cb3-11ea-b4e7-74dfbf8e4e9a.json

-Software Information-

Version: 4.0.4.49

Components Version: 1.0.750

Update Package Version: 1.0.15244

License: Free

-System Information-

OS: Windows 10 (Build 18362.476)

CPU: x64

File System: NTFS

User: RICK-LAPTOP\rahsr

-Scan Summary-

Scan Type: Threat Scan

Scan Initiated By: Manual

Result: Completed

Objects Scanned: 387286

Threats Detected: 33

Threats Quarantined: 0

Time Elapsed: 18 min, 24 sec

-Scan Options-

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Detect

PUM: Detect

-Scan Details-

Process: 0

(No malicious items detected)

Module: 0

(No malicious items detected)

Registry Key: 31

PUP.Optional.Amazon1Button, HKLM\SOFTWARE\CLASSES\CLSID\{BAC72C85-CEC6-4B86-AF06-FA20C259FAB8}, No Action By User, 3183, 386607, , , ,

PUP.Optional.Amazon1Button, HKLM\SOFTWARE\CLASSES\TYPELIB\{921462B2-5269-45A2-AA8D-F8F7A3690255}, No Action By User, 3183, 386607, , , ,

PUP.Optional.Amazon1Button, HKLM\SOFTWARE\CLASSES\INTERFACE\{FD1B7376-A344-48BD-857D-C87B4D8502EF}, No Action By User, 3183, 386607, , , ,

PUP.Optional.Amazon1Button, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{FD1B7376-A344-48BD-857D-C87B4D8502EF}, No Action By User, 3183, 386607, , , ,

PUP.Optional.Amazon1Button, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{FD1B7376-A344-48BD-857D-C87B4D8502EF}, No Action By User, 3183, 386607, , , ,

PUP.Optional.Amazon1Button, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{921462B2-5269-45A2-AA8D-F8F7A3690255}, No Action By User, 3183, 386607, , , ,

PUP.Optional.Amazon1Button, HKLM\SOFTWARE\CLASSES\WOW6432NODE\TYPELIB\{921462B2-5269-45A2-AA8D-F8F7A3690255}, No Action By User, 3183, 386607, , , ,

PUP.Optional.Amazon1Button, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{BAC72C85-CEC6-4B86-AF06-FA20C259FAB8}, No Action By User, 3183, 386607, , , ,

PUP.Optional.Amazon1Button, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{BAC72C85-CEC6-4B86-AF06-FA20C259FAB8}, No Action By User, 3183, 386607, , , ,

PUP.Optional.Amazon1Button, HKLM\SOFTWARE\CLASSES\Amazon1ButtonBrowserHelper.Amazon1ButtonBHO, No Action By User, 3183, 386607, 1.0.15244, , ame,

PUP.Optional.Amazon1Button, HKLM\SOFTWARE\CLASSES\Amazon1ButtonRuntime.AmazonRuntimeServer, No Action By User, 3183, 386607, , , ,

PUP.Optional.Amazon1Button, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{6557DB6C-EFE1-45AC-92A6-FBB1554B7502}, No Action By User, 3183, 386607, , , ,

PUP.Optional.Amazon1Button, HKLM\SOFTWARE\CLASSES\TYPELIB\{48DDEC26-CEC3-478E-9566-0842DAF10CEA}, No Action By User, 3183, 386607, , , ,

PUP.Optional.Amazon1Button, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{6B7479D5-C493-40F0-99B6-BFC901980034}, No Action By User, 3183, 386607, , , ,

PUP.Optional.Amazon1Button, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{BFF94CF8-2D3B-4B2F-BB83-3600280AFEBA}, No Action By User, 3183, 386607, , , ,

PUP.Optional.Amazon1Button, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{6B7479D5-C493-40F0-99B6-BFC901980034}, No Action By User, 3183, 386607, , , ,

PUP.Optional.Amazon1Button, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{BFF94CF8-2D3B-4B2F-BB83-3600280AFEBA}, No Action By User, 3183, 386607, , , ,

PUP.Optional.Amazon1Button, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{48DDEC26-CEC3-478E-9566-0842DAF10CEA}, No Action By User, 3183, 386607, , , ,

PUP.Optional.Amazon1Button, HKLM\SOFTWARE\CLASSES\WOW6432NODE\TYPELIB\{48DDEC26-CEC3-478E-9566-0842DAF10CEA}, No Action By User, 3183, 386607, , , ,

PUP.Optional.Amazon1Button, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{6557DB6C-EFE1-45AC-92A6-FBB1554B7502}, No Action By User, 3183, 386607, , , ,

PUP.Optional.Amazon1Button, HKLM\SOFTWARE\CLASSES\Amazon1ButtonRuntime.Amazon1ButtonRuntime, No Action By User, 3183, 386607, 1.0.15244, , ame,

PUP.Optional.Amazon1Button, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\Amazon1ButtonBrowserHelper.dll, No Action By User, 3183, 468987, 1.0.15244, , ame,

PUP.Optional.Amazon1Button, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\Amazon1ButtonRuntime.dll, No Action By User, 3183, 468987, 1.0.15244, , ame,

PUP.Optional.Amazon1Button, HKLM\SOFTWARE\CLASSES\WOW6432NODE\APPID\Amazon1ButtonBrowserHelper.dll, No Action By User, 3183, 468987, 1.0.15244, , ame,

PUP.Optional.Amazon1Button, HKU\S-1-5-18\SOFTWARE\APPDATALOW\SOFTWARE\AMAZON\Amazon1ButtonApp, No Action By User, 3183, 441167, 1.0.15244, , ame,

PUP.Optional.Amazon1Button, HKLM\SOFTWARE\CLASSES\WOW6432NODE\APPID\Amazon1ButtonRuntime.dll, No Action By User, 3183, 468987, 1.0.15244, , ame,

PUP.Optional.Amazon1Button, HKU\S-1-5-21-3395428246-187305771-252134375-1001\SOFTWARE\APPDATALOW\SOFTWARE\AMAZON\Amazon1ButtonApp, No Action By User, 3183, 441167, 1.0.15244, , ame,

PUP.Optional.Amazon1Button, HKLM\SOFTWARE\CLASSES\APPID\Amazon1ButtonBrowserHelper.dll, No Action By User, 3183, 468987, 1.0.15244, , ame,

PUP.Optional.Amazon1Button, HKLM\SOFTWARE\CLASSES\APPID\Amazon1ButtonRuntime.dll, No Action By User, 3183, 468987, 1.0.15244, , ame,

PUP.Optional.Amazon1Button, HKU\S-1-5-21-3395428246-187305771-252134375-1002\SOFTWARE\APPDATALOW\SOFTWARE\AMAZON\Amazon1ButtonApp, No Action By User, 3183, 441167, 1.0.15244, , ame,

PUP.Optional.Amazon1Button, HKLM\SOFTWARE\WOW6432NODE\APPDATALOW\SOFTWARE\AMAZON\Amazon1ButtonApp, No Action By User, 3183, 441168, 1.0.15244, , ame,

Registry Value: 2

PUP.Optional.Amazon1Button, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_BROWSER_EMULATION|AMAZON1BUTTONTASKBARAPP.EXE, No Action By User, 3183, 493348, 1.0.15244, , ame,

PUP.Optional.Amazon1Button, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_BROWSER_EMULATION|AMAZON1BUTTONTASKBARAPP.EXE, No Action By User, 3183, 493348, 1.0.15244, , ame,

Registry Data: 0

(No malicious items detected)

Data Stream: 0

(No malicious items detected)

Folder: 0

(No malicious items detected)

File: 0

(No malicious items detected)

Physical Sector: 0

(No malicious items detected)

WMI: 0

(No malicious items detected)

(end)

I tried to Uninstall Amazon Assistant but the Uninstall button was inactive

Here is the fixlog

Fix result of Farbar Recovery Scan Tool (x64) Version: 21-11-2019

Ran by rahsr (21-11-2019 16:24:32) Run:1

Running from C:\Users\rahsr\Desktop

Loaded Profiles: rahsr & postgres (Available Profiles: rahsr & postgres)

Boot Mode: Normal

==============================================

fixlist content:

*****************

CloseProcesses:

CreateRestorePoint:

C:\Program Files (x86)\Amazon\Amazon Assistant\amazonAssistantService.exe

C:\Program Files (x86)\Amazon\Amazon Assistant

ShortcutTarget: $McRebootA5E6DEAA56$.lnk -> (No File)

GroupPolicy: Restriction ? <==== ATTENTION

Task: {4FF17F34-9C25-4BB0-B212-2D4B7B1CF83A} - System32\Tasks\App Explorer => C:\Users\rahsr\AppData\Local\Host App Service\Engine\HostAppServiceUpdater.exe [7407784 2019-10-18] (SweetLabs Inc. -> SweetLabs, Inc) <==== ATTENTION

Task: {94E596BC-9870-431C-961F-A6371F56C2EF} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION

SearchScopes: HKU\S-1-5-21-3395428246-187305771-252134375-1001 -> {69A632CF-6C9A-47BD-95AB-58CBCDBE5EE6} URL =

BHO: Amazon Assistant -> {0ddcea2a-7b00-4349-8acb-af7ba6da251f} -> C:\Program Files (x86)\Amazon\Amazon Assistant\aaMessenger.dll [2018-02-22] (Amazon Services LLC -> )

BHO-x32: Amazon Assistant -> {0ddcea2a-7b00-4349-8acb-af7ba6da251f} -> C:\Program Files (x86)\Amazon\Amazon Assistant\aaMessenger.dll [2018-02-22] (Amazon Services LLC -> )

R2 Amazon Assistant Service; C:\Program Files (x86)\Amazon\Amazon Assistant\amazonAssistantService.exe [105136 2018-02-22] (Amazon Services LLC -> )

ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File

ShortcutWithArgument: C:\Users\rahsr\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\7d5cad5df1643bee\piskel.lnk -> C:\Users\rahsr\Desktop\Xmas lights\Piskel-0.12.1\Piskel-0.12.1\Piskel-0.12.1.exe (The NWJS Community) -> --user-data-dir="C:\Users\rahsr\AppData\Local\piskel\User Data" --profile-directory=Default --app-id=ipkokkhkdmkpjefoobgfdglgmbehndab

FirewallRules: [{6C1601DF-D3AD-44FF-81EA-88ADBADDDB99}] => (Allow) C:\ProgramData\Blackmagic Design\DaVinci Resolve\Support\QtDecoder\QTDecoder.exe No File

EmptyTemp:

C:\Windows\Temp\*.*

*****************

Processes closed successfully.

Restore point was successfully created.

C:\Program Files (x86)\Amazon\Amazon Assistant\amazonAssistantService.exe => moved successfully

"C:\Program Files (x86)\Amazon\Amazon Assistant" folder move:

Could not move "C:\Program Files (x86)\Amazon\Amazon Assistant" => Scheduled to move on reboot.

"ShortcutTarget: $McRebootA5E6DEAA56$.lnk -> (No File)" => not found

C:\WINDOWS\system32\GroupPolicy\Machine => moved successfully

C:\WINDOWS\system32\GroupPolicy\GPT.ini => moved successfully

"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{4FF17F34-9C25-4BB0-B212-2D4B7B1CF83A}" => removed successfully

"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4FF17F34-9C25-4BB0-B212-2D4B7B1CF83A}" => removed successfully

C:\WINDOWS\System32\Tasks\App Explorer => moved successfully

"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\App Explorer" => removed successfully

"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{94E596BC-9870-431C-961F-A6371F56C2EF}" => removed successfully

"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{94E596BC-9870-431C-961F-A6371F56C2EF}" => removed successfully

"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UNP\RunCampaignManager" => not found

HKU\S-1-5-21-3395428246-187305771-252134375-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{69A632CF-6C9A-47BD-95AB-58CBCDBE5EE6} => removed successfully

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0ddcea2a-7b00-4349-8acb-af7ba6da251f} => removed successfully

HKLM\Software\Classes\CLSID\{0ddcea2a-7b00-4349-8acb-af7ba6da251f} => removed successfully

HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0ddcea2a-7b00-4349-8acb-af7ba6da251f} => removed successfully

HKLM\Software\Wow6432Node\Classes\CLSID\{0ddcea2a-7b00-4349-8acb-af7ba6da251f} => removed successfully

Amazon Assistant Service => Unable to stop service.

HKLM\System\CurrentControlSet\Services\Amazon Assistant Service => removed successfully

Amazon Assistant Service => service removed successfully

HKLM\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers\igfxcui => removed successfully

C:\Users\rahsr\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\7d5cad5df1643bee\piskel.lnk => Shortcut argument removed successfully

"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{6C1601DF-D3AD-44FF-81EA-88ADBADDDB99}" => removed successfully

=========== "C:\Windows\Temp\*.*" ==========

C:\Windows\Temp\AdAppMgrUpdater.exe => moved successfully

C:\Windows\Temp\AdobeARM.log => moved successfully

C:\Windows\Temp\ArmUI.ini => moved successfully

C:\Windows\Temp\chrome_installer.log => moved successfully

C:\Windows\Temp\IDSAUpdate.exe => moved successfully

C:\Windows\Temp\Intel®_Driver_&_Support_Assistant_20191114213557.log => moved successfully

C:\Windows\Temp\Intel®_Driver_&_Support_Assistant_20191114213557_000_DriverSupportAssistantInstaller.log => moved successfully

C:\Windows\Temp\Intel®_Driver_&_Support_Assistant_20191114213757.log => moved successfully

C:\Windows\Temp\Intel®_Driver_&_Support_Assistant_20191119084800.log => moved successfully

C:\Windows\Temp\Intel®_Driver_&_Support_Assistant_20191119084800_000_DriverSupportAssistantInstaller.log => moved successfully

C:\Windows\Temp\Intel®_Driver_&_Support_Assistant_20191119085105.log => moved successfully

C:\Windows\Temp\Intel®_Driver_&_Support_Assistant_20191119085105_000_DriverSupportAssistantInstaller.log => moved successfully

C:\Windows\Temp\mbamiservice.log => moved successfully

C:\Windows\Temp\mb_errors98716.log => moved successfully

C:\Windows\Temp\MpCmdRun.log => moved successfully

C:\Windows\Temp\MpSigStub.log => moved successfully

C:\Windows\Temp\update.ini => moved successfully

C:\Windows\Temp\WER124C.tmp.WERDataCollectionStatus.txt => moved successfully

C:\Windows\Temp\WER8E22.tmp.WERDataCollectionStatus.txt => moved successfully

C:\Windows\Temp\WERAF56.tmp.WERDataCollectionStatus.txt => moved successfully

C:\Windows\Temp\WERF227.tmp.WERDataCollectionStatus.txt => moved successfully

========= End -> "C:\Windows\Temp\*.*" ========

=========== EmptyTemp: ==========

BITS transfer queue => 11034624 B

DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 268388740 B

Java, Flash, Steam htmlcache => 2916 B

Windows/system/drivers => 148107443 B

Edge => 235315999 B

Chrome => 275807946 B

Firefox => 194161299 B

Opera => 0 B

Temp, IE cache, history, cookies, recent:

Default => 0 B

Users => 0 B

ProgramData => 0 B

Public => 0 B

systemprofile => 0 B

systemprofile32 => 0 B

LocalService => 0 B

NetworkService => 250454 B

rahsr => 285311666 B

postgres => 285311666 B

RecycleBin => 51119055748 B

EmptyTemp: => 49.2 GB temporary data Removed.

================================

Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 21-11-2019 16:41:13)

C:\Program Files (x86)\Amazon\Amazon Assistant => moved successfully

==== End of Fixlog 16:41:23 ====

And Adware Cleaner (C00)

# -------------------------------

# Malwarebytes AdwCleaner 7.4.2.0

# -------------------------------

# Build: 10-21-2019

# Database: 2019-11-20.1 (Cloud)

# Support: https://www.malwarebytes.com/support

# -------------------------------

# Mode: Clean

# -------------------------------

# Start: 11-21-2019

# Duration: 00:01:02

# OS: Windows 10 Home

# Cleaned: 126

# Failed: 0

***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

Deleted C:\Users\Default\AppData\Local\Host App Service

Deleted C:\Users\Public\App Explorer

Deleted C:\Users\postgres\AppData\Local\Host App Service

Deleted C:\Users\rahsr\AppData\Local\Host App Service

Deleted C:\Windows\ServiceProfiles\LocalService\AppData\Local\Host App Service

Deleted C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Host App Service

***** [ Files ] *****

Deleted C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AmazonAssistant.lnk

Deleted C:\ProgramData\Microsoft\Windows\Start Menu\Programs\App Explorer.lnk

Deleted C:\Users\postgres\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\AmazonAssistant.lnk

Deleted C:\Users\postgres\Desktop\App Explorer.lnk

Deleted C:\Users\rahsr\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\AmazonAssistant.lnk

Deleted C:\Users\rahsr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\App Explorer.lnk

Deleted C:\Windows\ServiceProfiles\LocalService\Desktop\App Explorer.lnk

Deleted C:\Windows\ServiceProfiles\NetworkService\Desktop\App Explorer.lnk

Deleted C:\Windows\System32\Tasks_Migrated\App Explorer

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

Deleted HKCU\Software\APPDATALOW\SOFTWARE\AMAZON\Amazon1ButtonApp

Deleted HKCU\Software\App Host Service

Deleted HKCU\Software\AppDataLow\Software\Amazon\AmazonAssistant

Deleted HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\ak.staticimgfarm.com

Deleted HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\dotomi.com

Deleted HKCU\Software\Classes\Software\APPDATALOW\SOFTWARE\AMAZON\Amazon1ButtonApp

Deleted HKCU\Software\Host App Service

Deleted HKCU\Software\Microsoft\Internet Explorer\DOMStorage\amazonbrowserapp.com

Deleted HKCU\Software\Microsoft\Internet Explorer\DOMStorage\analytics.app.amazonbrowserapp.com

Deleted HKCU\Software\Microsoft\Internet Explorer\DOMStorage\titan.service.amazonbrowserapp.com

Deleted HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\thebrighttag.com

Deleted HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0ddcea2a-7b00-4349-8acb-af7ba6da251f}

Deleted HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0ddcea2a-7b00-4349-8acb-af7ba6da251f}

Deleted HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Host App Service

Deleted HKLM\SOFTWARE\Classes\AppID\AmazonAppIE.dll

Deleted HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION|Amazon1ButtonTaskbarApp.exe

Deleted HKLM\SYSTEM\Setup\FirstBoot\Services\Amazon Assistant Service

Deleted HKLM\Software\Classes\Amazon1ButtonBrowserHelper.Amazon1ButtonBHO

Deleted HKLM\Software\Classes\Amazon1ButtonRuntime.Amazon1ButtonRuntime

Deleted HKLM\Software\Classes\Amazon1ButtonRuntime.AmazonRuntimeServer

Deleted HKLM\Software\Classes\AppID\{F18AE3C4-D2AD-42AC-9282-509DCF035D06}

Deleted HKLM\Software\Classes\CLSID\{7B28BD81-CC45-4ADB-A043-12E35A15C402}

Deleted HKLM\Software\Classes\CLSID\{BAC72C85-CEC6-4B86-AF06-FA20C259FAB8}

Deleted HKLM\Software\Classes\CLSID\{BD6ECB00-7C4A-4F97-B425-44117F2A7AAE}

Deleted HKLM\Software\Classes\CLSID\{E4ADC61E-D06A-4E0E-8582-78C809CC8450}

Deleted HKLM\Software\Classes\Installer\Features\A38C15B2D5649AE4C9CDE19DE50DA96C

Deleted HKLM\Software\Classes\Installer\Products\A38C15B2D5649AE4C9CDE19DE50DA96C

Deleted HKLM\Software\Classes\Interface\{3268A00F-D329-42E1-ABF0-E78D5656BA2A}

Deleted HKLM\Software\Classes\Interface\{571139B2-8D93-4B29-9AA9-496EF27D6AF8}

Deleted HKLM\Software\Classes\TypeLib\{55B621F9-BAE8-4CF7-9D76-1DB25CD95850}

Deleted HKLM\Software\Classes\TypeLib\{E6AB05A4-A387-4083-91A5-E89A8DCEEBC0}

Deleted HKLM\Software\Classes\TypeLib\{EB2BEAEF-150C-4DE4-9D09-F16403C22769}

Deleted HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A38C15B2D5649AE4C9CDE19DE50DA96C

Deleted HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\F5415905096AA504A9FB967C7A138943

Deleted HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{2B51C83A-465D-4EA9-9CDC-1ED95ED09AC6}

Deleted HKLM\Software\Wow6432Node\APPDATALOW\SOFTWARE\AMAZON\Amazon1ButtonApp

Deleted HKLM\Software\Wow6432Node\Amazon\AmazonAssistant

Deleted HKLM\Software\Wow6432Node\\AppDataLow\Software\Amazon\AmazonAssistant

Deleted HKLM\Software\Wow6432Node\\Classes\AppID\AmazonAppIE.dll

Deleted HKLM\Software\Wow6432Node\\Classes\AppID\{F18AE3C4-D2AD-42AC-9282-509DCF035D06}

Deleted HKLM\Software\Wow6432Node\\Classes\CLSID\{6557DB6C-EFE1-45AC-92A6-FBB1554B7502}

Deleted HKLM\Software\Wow6432Node\\Classes\CLSID\{7B28BD81-CC45-4ADB-A043-12E35A15C402}

Deleted HKLM\Software\Wow6432Node\\Classes\CLSID\{BAC72C85-CEC6-4B86-AF06-FA20C259FAB8}

Deleted HKLM\Software\Wow6432Node\\Classes\CLSID\{BD6ECB00-7C4A-4F97-B425-44117F2A7AAE}

Deleted HKLM\Software\Wow6432Node\\Classes\CLSID\{E4ADC61E-D06A-4E0E-8582-78C809CC8450}

Deleted HKLM\Software\Wow6432Node\\Classes\Interface\{3268A00F-D329-42E1-ABF0-E78D5656BA2A}

Deleted HKLM\Software\Wow6432Node\\Classes\Interface\{571139B2-8D93-4B29-9AA9-496EF27D6AF8}

Deleted HKLM\Software\Wow6432Node\\Classes\Interface\{6B7479D5-C493-40F0-99B6-BFC901980034}

Deleted HKLM\Software\Wow6432Node\\Classes\Interface\{BFF94CF8-2D3B-4B2F-BB83-3600280AFEBA}

Deleted HKLM\Software\Wow6432Node\\Classes\TypeLib\{55B621F9-BAE8-4CF7-9D76-1DB25CD95850}

Deleted HKLM\Software\Wow6432Node\\Classes\TypeLib\{E6AB05A4-A387-4083-91A5-E89A8DCEEBC0}

Deleted HKLM\Software\Wow6432Node\\Classes\TypeLib\{EB2BEAEF-150C-4DE4-9D09-F16403C22769}

Deleted HKLM\Software\Wow6432Node\\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION|Amazon1ButtonTaskbarApp.exe

Deleted HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\{5095145F-A690-405A-9ABF-69C7A7319834}

Deleted HKLM\System\CurrentControlSet\Services\EventLog\Application\Amazon Assistant Service

Deleted HKU\.DEFAULT\Software\APPDATALOW\SOFTWARE\AMAZON\Amazon1ButtonApp

Deleted HKU\.DEFAULT\Software\AppDataLow\Software\Amazon\AmazonAssistant

Deleted HKU\S-1-5-18\Software\APPDATALOW\SOFTWARE\AMAZON\Amazon1ButtonApp

Deleted HKU\S-1-5-18\Software\AppDataLow\Software\Amazon\AmazonAssistant

Deleted HKU\S-1-5-21-3395428246-187305771-252134375-1002\Software\APPDATALOW\SOFTWARE\AMAZON\Amazon1ButtonApp

Deleted HKU\S-1-5-21-3395428246-187305771-252134375-1002\Software\AppDataLow\Software\Amazon\AmazonAssistant

Deleted HKU\S-1-5-21-3395428246-187305771-252134375-1002\Software\Classes\Software\APPDATALOW\SOFTWARE\AMAZON\Amazon1ButtonApp

Deleted HKU\S-1-5-21-3395428246-187305771-252134375-1002\Software\Host App Service

Deleted HKU\S-1-5-21-3395428246-187305771-252134375-1002\Software\Microsoft\Windows\CurrentVersion\Uninstall\Host App Service

***** [ Chromium (and derivatives) ] *****

Deleted Amazon Assistant for Chrome

***** [ Chromium URLs ] *****

No malicious Chromium URLs cleaned.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.

***** [ Preinstalled Software ] *****

Deleted Preinstalled.WildTangentGamesBundle File C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WildTangent Games App - acer.lnk

Deleted Preinstalled.WildTangentGamesBundle Folder C:\Program Files (x86)\WILDGAMES

Deleted Preinstalled.WildTangentGamesBundle Folder C:\Program Files (x86)\WILDGAMES\12 LABOURS OF HERCULES III GIRL POWER

Deleted Preinstalled.WildTangentGamesBundle Folder C:\Program Files (x86)\WILDGAMES\HOME MAKEOVER

Deleted Preinstalled.WildTangentGamesBundle Folder C:\Program Files (x86)\WILDGAMES\JEWEL MATCH 3

Deleted Preinstalled.WildTangentGamesBundle Folder C:\Program Files (x86)\WILDGAMES\JEWEL MATCH SNOWSCAPES

Deleted Preinstalled.WildTangentGamesBundle Folder C:\Program Files (x86)\WILDGAMES\MAGIC ACADEMY

Deleted Preinstalled.WildTangentGamesBundle Folder C:\Program Files (x86)\WILDGAMES\POLAR BOWLER 1ST FRAME

Deleted Preinstalled.WildTangentGamesBundle Folder C:\Program Files (x86)\WILDGAMES\RUNEFALL

Deleted Preinstalled.WildTangentGamesBundle Folder C:\Program Files (x86)\WILDTANGENT GAMES

Deleted Preinstalled.WildTangentGamesBundle Folder C:\Program Files (x86)\WILDTANGENT GAMES\APP

Deleted Preinstalled.WildTangentGamesBundle Registry HKLM\Software\Wow6432Node\\Classes\CLSID\{7A97880C-7DD3-4C6E-8DE0-881B1FC02BE6}

Deleted Preinstalled.WildTangentGamesBundle Registry HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Ext\Preapproved\{7A97880C-7DD3-4C6E-8DE0-881B1FC02BE6}

Deleted Preinstalled.WildTangentGamesBundle Registry HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\WildTangent wildgames Master Uninstall

Deleted Preinstalled.WildTangentGamesBundle Registry HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\WildTangentGDF-acer-vegasworld

Deleted Preinstalled.WildTangentGamesBundle Registry HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\WildTangentGDF-acer-villagersandheroes

Deleted Preinstalled.WildTangentGamesBundle Registry HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\WildTangentGameProvider-acer-genres

Deleted Preinstalled.WildTangentGamesBundle Registry HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\WildTangentGameProvider-acer-main

Deleted Preinstalled.WildTangentGamesBundle Registry HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App

Deleted Preinstalled.WildTangentGamesBundle Registry HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-acer

Deleted Preinstalled.WildTangentGamesBundle Registry HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7A97880C-7DD3-4C6E-8DE0-881B1FC02BE6}

Deleted Preinstalled.WildTangentGamesBundle Registry HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7A97880C-7DD3-4C6E-8DE0-881B1FC02BE6}

*************************

[+] Delete Tracing Keys

[+] Reset Winsock

*************************

AdwCleaner_Debug.log - [207904 octets] - [21/11/2019 16:49:48]

AdwCleaner[S00].txt - [23774 octets] - [21/11/2019 16:52:12]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C00].txt ##########

And Adware S00

# -------------------------------

# Malwarebytes AdwCleaner 7.4.2.0

# -------------------------------

# Build: 10-21-2019

# Database: 2019-11-20.1 (Cloud)

# Support: https://www.malwarebytes.com/support

# -------------------------------

# Mode: Scan

# -------------------------------

# Start: 11-21-2019

# Duration: 00:02:04

# OS: Windows 10 Home

# Scanned: 35226

# Detected: 167

***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

Adware.pokki C:\Users\Default\AppData\Local\Host App Service

Adware.pokki C:\Users\Public\App Explorer

Adware.pokki C:\Users\postgres\AppData\Local\Host App Service

Adware.pokki C:\Users\rahsr\AppData\Local\Host App Service

Adware.pokki C:\Windows\ServiceProfiles\LocalService\AppData\Local\Host App Service

Adware.pokki C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Host App Service

***** [ Files ] *****

Adware.pokki C:\ProgramData\Microsoft\Windows\Start Menu\Programs\App Explorer.lnk

Adware.pokki C:\Users\postgres\Desktop\App Explorer.lnk

Adware.pokki C:\Users\rahsr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\App Explorer.lnk

Adware.pokki C:\Windows\ServiceProfiles\LocalService\Desktop\App Explorer.lnk

Adware.pokki C:\Windows\ServiceProfiles\NetworkService\Desktop\App Explorer.lnk

Adware.pokki C:\Windows\System32\Tasks_Migrated\App Explorer

PUP.Optional.Assistant C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AmazonAssistant.lnk

PUP.Optional.Assistant C:\Users\postgres\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\AmazonAssistant.lnk

PUP.Optional.Assistant C:\Users\rahsr\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\AmazonAssistant.lnk

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

No malicious tasks found.

***** [ Registry ] *****

Adware.pokki HKCU\Software\App Host Service

Adware.pokki HKCU\Software\Host App Service

Adware.pokki HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Host App Service

Adware.pokki HKU\S-1-5-21-3395428246-187305771-252134375-1002\Software\Host App Service

Adware.pokki HKU\S-1-5-21-3395428246-187305771-252134375-1002\Software\Microsoft\Windows\CurrentVersion\Uninstall\Host App Service

PUP.Optional.Amazon1Button HKCU\Software\APPDATALOW\SOFTWARE\AMAZON\Amazon1ButtonApp

PUP.Optional.Amazon1Button HKCU\Software\Classes\Software\APPDATALOW\SOFTWARE\AMAZON\Amazon1ButtonApp

PUP.Optional.Amazon1Button HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION|Amazon1ButtonTaskbarApp.exe

PUP.Optional.Amazon1Button HKLM\Software\Classes\Amazon1ButtonBrowserHelper.Amazon1ButtonBHO

PUP.Optional.Amazon1Button HKLM\Software\Classes\Amazon1ButtonRuntime.Amazon1ButtonRuntime

PUP.Optional.Amazon1Button HKLM\Software\Classes\Amazon1ButtonRuntime.AmazonRuntimeServer

PUP.Optional.Amazon1Button HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\F5415905096AA504A9FB967C7A138943

PUP.Optional.Amazon1Button HKLM\Software\Wow6432Node\APPDATALOW\SOFTWARE\AMAZON\Amazon1ButtonApp

PUP.Optional.Amazon1Button HKLM\Software\Wow6432Node\\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION|Amazon1ButtonTaskbarApp.exe

PUP.Optional.Amazon1Button HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\{5095145F-A690-405A-9ABF-69C7A7319834}

PUP.Optional.Amazon1Button HKU\.DEFAULT\Software\APPDATALOW\SOFTWARE\AMAZON\Amazon1ButtonApp

PUP.Optional.Amazon1Button HKU\S-1-5-18\Software\APPDATALOW\SOFTWARE\AMAZON\Amazon1ButtonApp

PUP.Optional.Amazon1Button HKU\S-1-5-21-3395428246-187305771-252134375-1002\Software\APPDATALOW\SOFTWARE\AMAZON\Amazon1ButtonApp

PUP.Optional.Amazon1Button HKU\S-1-5-21-3395428246-187305771-252134375-1002\Software\Classes\Software\APPDATALOW\SOFTWARE\AMAZON\Amazon1ButtonApp

PUP.Optional.AmazonAssistant HKCU\Software\AppDataLow\Software\Amazon\AmazonAssistant

PUP.Optional.AmazonAssistant HKLM\SOFTWARE\Classes\AppID\AmazonAppIE.dll

PUP.Optional.AmazonAssistant HKLM\SYSTEM\Setup\FirstBoot\Services\Amazon Assistant Service

PUP.Optional.AmazonAssistant HKLM\Software\Classes\AppID\{F18AE3C4-D2AD-42AC-9282-509DCF035D06}

PUP.Optional.AmazonAssistant HKLM\Software\Classes\CLSID\{7B28BD81-CC45-4ADB-A043-12E35A15C402}

PUP.Optional.AmazonAssistant HKLM\Software\Classes\Interface\{3268A00F-D329-42E1-ABF0-E78D5656BA2A}

PUP.Optional.AmazonAssistant HKLM\Software\Classes\Interface\{571139B2-8D93-4B29-9AA9-496EF27D6AF8}

PUP.Optional.AmazonAssistant HKLM\Software\Classes\TypeLib\{55B621F9-BAE8-4CF7-9D76-1DB25CD95850}

PUP.Optional.AmazonAssistant HKLM\Software\Classes\TypeLib\{E6AB05A4-A387-4083-91A5-E89A8DCEEBC0}

PUP.Optional.AmazonAssistant HKLM\Software\Wow6432Node\Amazon\AmazonAssistant

PUP.Optional.AmazonAssistant HKLM\Software\Wow6432Node\\AppDataLow\Software\Amazon\AmazonAssistant

PUP.Optional.AmazonAssistant HKLM\Software\Wow6432Node\\Classes\AppID\AmazonAppIE.dll

PUP.Optional.AmazonAssistant HKLM\Software\Wow6432Node\\Classes\AppID\{F18AE3C4-D2AD-42AC-9282-509DCF035D06}

PUP.Optional.AmazonAssistant HKLM\Software\Wow6432Node\\Classes\CLSID\{7B28BD81-CC45-4ADB-A043-12E35A15C402}

PUP.Optional.AmazonAssistant HKLM\Software\Wow6432Node\\Classes\Interface\{3268A00F-D329-42E1-ABF0-E78D5656BA2A}

PUP.Optional.AmazonAssistant HKLM\Software\Wow6432Node\\Classes\Interface\{571139B2-8D93-4B29-9AA9-496EF27D6AF8}

PUP.Optional.AmazonAssistant HKLM\Software\Wow6432Node\\Classes\Interface\{6B7479D5-C493-40F0-99B6-BFC901980034}

PUP.Optional.AmazonAssistant HKLM\Software\Wow6432Node\\Classes\Interface\{BFF94CF8-2D3B-4B2F-BB83-3600280AFEBA}

PUP.Optional.AmazonAssistant HKLM\Software\Wow6432Node\\Classes\TypeLib\{55B621F9-BAE8-4CF7-9D76-1DB25CD95850}

PUP.Optional.AmazonAssistant HKLM\Software\Wow6432Node\\Classes\TypeLib\{E6AB05A4-A387-4083-91A5-E89A8DCEEBC0}

PUP.Optional.AmazonAssistant HKU\.DEFAULT\Software\AppDataLow\Software\Amazon\AmazonAssistant

PUP.Optional.AmazonAssistant HKU\S-1-5-18\Software\AppDataLow\Software\Amazon\AmazonAssistant

PUP.Optional.AmazonAssistant HKU\S-1-5-21-3395428246-187305771-252134375-1002\Software\AppDataLow\Software\Amazon\AmazonAssistant

PUP.Optional.Assistant HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0ddcea2a-7b00-4349-8acb-af7ba6da251f}

PUP.Optional.Assistant HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0ddcea2a-7b00-4349-8acb-af7ba6da251f}

PUP.Optional.Assistant HKLM\System\CurrentControlSet\Services\EventLog\Application\Amazon Assistant Service

PUP.Optional.Legacy HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\ak.staticimgfarm.com

PUP.Optional.Legacy HKCU\Software\Microsoft\Internet Explorer\DOMStorage\amazonbrowserapp.com

PUP.Optional.Legacy HKCU\Software\Microsoft\Internet Explorer\DOMStorage\analytics.app.amazonbrowserapp.com

PUP.Optional.Legacy HKCU\Software\Microsoft\Internet Explorer\DOMStorage\titan.service.amazonbrowserapp.com

PUP.Optional.Legacy HKLM\Software\Classes\CLSID\{BAC72C85-CEC6-4B86-AF06-FA20C259FAB8}

PUP.Optional.Legacy HKLM\Software\Classes\CLSID\{BD6ECB00-7C4A-4F97-B425-44117F2A7AAE}

PUP.Optional.Legacy HKLM\Software\Classes\CLSID\{E4ADC61E-D06A-4E0E-8582-78C809CC8450}

PUP.Optional.Legacy HKLM\Software\Classes\Installer\Features\A38C15B2D5649AE4C9CDE19DE50DA96C

PUP.Optional.Legacy HKLM\Software\Classes\Installer\Products\A38C15B2D5649AE4C9CDE19DE50DA96C

PUP.Optional.Legacy HKLM\Software\Classes\TypeLib\{EB2BEAEF-150C-4DE4-9D09-F16403C22769}

PUP.Optional.Legacy HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A38C15B2D5649AE4C9CDE19DE50DA96C

PUP.Optional.Legacy HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{2B51C83A-465D-4EA9-9CDC-1ED95ED09AC6}

PUP.Optional.Legacy HKLM\Software\Wow6432Node\\Classes\CLSID\{6557DB6C-EFE1-45AC-92A6-FBB1554B7502}

PUP.Optional.Legacy HKLM\Software\Wow6432Node\\Classes\CLSID\{BAC72C85-CEC6-4B86-AF06-FA20C259FAB8}

PUP.Optional.Legacy HKLM\Software\Wow6432Node\\Classes\CLSID\{BD6ECB00-7C4A-4F97-B425-44117F2A7AAE}

PUP.Optional.Legacy HKLM\Software\Wow6432Node\\Classes\CLSID\{E4ADC61E-D06A-4E0E-8582-78C809CC8450}

PUP.Optional.Legacy HKLM\Software\Wow6432Node\\Classes\TypeLib\{EB2BEAEF-150C-4DE4-9D09-F16403C22769}

PUP.Optional.TheBrightTag HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\s.thebrighttag.com

PUP.Optional.TheBrightTag HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\thebrighttag.com

***** [ Chromium (and derivatives) ] *****

PUP.Optional.AmazonBrowserBar Amazon Assistant for Chrome

***** [ Chromium URLs ] *****

No malicious Chromium URLs found.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries found.

***** [ Firefox URLs ] *****

No malicious Firefox URLs found.

***** [ Preinstalled Software ] *****

Preinstalled.ACERAOPFramework Folder C:\Program Files (x86)\ACER\AOP FRAMEWORK

Preinstalled.ACERAOPFramework Registry HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run32|BacKGround Agent

Preinstalled.ACERAOPFramework Registry HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\{4A37A114-702F-4055-A4B6-16571D4A5353}

Preinstalled.ACERClear.fiShellExtension Registry HKLM\Software\Classes\CLSID\{ED32C084-BABB-11E1-B491-D4D66088709B}

Preinstalled.ACERClear.fiShellExtension Registry HKLM\Software\Wow6432Node\\Classes\CLSID\{ED32C084-BABB-11E1-B491-D4D66088709B}

Preinstalled.AcerCareCenter Folder C:\Program Files (x86)\ACER\CARE CENTER

Preinstalled.AcerCareCenter Registry HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{65B0C647-3D5A-48F3-91F2-BE9F82BC9ABC}

Preinstalled.AcerCareCenter Registry HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0F1F25F8-7715-4B0F-9567-3F602C616ADE}

Preinstalled.AcerCareCenter Registry HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{65B0C647-3D5A-48F3-91F2-BE9F82BC9ABC}

Preinstalled.AcerCareCenter Registry HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ACCAgent

Preinstalled.AcerCareCenter Registry HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ACCBackgroundApplication

Preinstalled.AcerCareCenter Registry HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1AF41E84-3408-499A-8C93-8891F0612719}

Preinstalled.AcerCareCenter Task C:\Windows\System32\Tasks\ACCAGENT

Preinstalled.AcerCareCenter Task C:\Windows\System32\Tasks\ACCBACKGROUNDAPPLICATION

Preinstalled.AcerConfigurationManager Folder C:\Program Files (x86)\ACER\AMUNDSEN\2.1.16258

Preinstalled.AcerConfigurationManager Registry HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{50CD3C22-967A-44D3-91B8-7719F33FD14F}

Preinstalled.AcerConfigurationManager Registry HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AcerCMUpdateTask2.1.16258

Preinstalled.AcerConfigurationManager Registry HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\{414D554E-4453-454E-0201-000000016258}

Preinstalled.AcerConfigurationManager Task C:\Windows\System32\Tasks\ACERCMUPDATETASK2.1.16258

Preinstalled.AcerJumpstart Folder C:\Program Files (x86)\ACER\ACER JUMPSTART

Preinstalled.AcerJumpstart Registry HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\{4B92BFBE-917D-4FA1-97E9-DB9D91286E90}

Preinstalled.AcerPortal Folder C:\Program Files (x86)\ACER\ACER PORTAL

Preinstalled.AcerPortal Registry HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\{A5AD0B17-F34D-49BE-A157-C8B3D52ACD13}

Preinstalled.AcerQuickAccess Folder C:\Program Files\ACER\ACER QUICK ACCESS

Preinstalled.AcerQuickAccess Registry HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{37CD8D63-2376-431F-B360-DD954BC68E2D}

Preinstalled.AcerQuickAccess Registry HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CBF80CFB-1FE2-4B8A-897E-59FDBFA668CF}

Preinstalled.AcerQuickAccess Registry HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Power Button

Preinstalled.AcerQuickAccess Registry HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Quick Access

Preinstalled.AcerQuickAccess Registry HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{8BBF04F1-C68A-441C-B5EF-446EE9960EAF}

Preinstalled.AcerQuickAccess Task C:\Windows\System32\Tasks\POWER BUTTON

Preinstalled.AcerQuickAccess Task C:\Windows\System32\Tasks\QUICK ACCESS

Preinstalled.AcerUEIPFramework Folder C:\Program Files\ACER\USER EXPERIENCE IMPROVEMENT PROGRAM\FRAMEWORK

Preinstalled.AcerUEIPFramework Folder C:\Program Files\ACER\USER EXPERIENCE IMPROVEMENT PROGRAM\PLUGIN\APPMONITOR

Preinstalled.AcerUEIPFramework Registry HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DC911A9F-8342-4A4E-B361-210CFF970748}

Preinstalled.AcerUEIPFramework Registry HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\UbtFrameworkService

Preinstalled.AcerUEIPFramework Registry HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{12A718F2-2357-4D41-9E1F-18583A4745F7}

Preinstalled.AcerUEIPFramework Task C:\Windows\System32\Tasks\UBTFRAMEWORKSERVICE

Preinstalled.AcerUpdater Folder C:\ProgramData\ACER\ACER UPDATER

Preinstalled.AcerabBox Registry HKLM\Software\Classes\CLSID\{5CCE71FA-9F61-4F24-9CD1-98D819B40D68}

Preinstalled.LenovoPowerDVD Registry HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}

Preinstalled.LenovoPowerDVD Registry HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\{B46BEA36-0B71-4A4E-AE41-87241643FA0A}

Preinstalled.WildTangentGamesBundle File C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WildTangent Games App - acer.lnk

Preinstalled.WildTangentGamesBundle Folder C:\Program Files (x86)\WILDGAMES

Preinstalled.WildTangentGamesBundle Folder C:\Program Files (x86)\WILDGAMES\12 LABOURS OF HERCULES III GIRL POWER

Preinstalled.WildTangentGamesBundle Folder C:\Program Files (x86)\WILDGAMES\HOME MAKEOVER

Preinstalled.WildTangentGamesBundle Folder C:\Program Files (x86)\WILDGAMES\JEWEL MATCH 3

Preinstalled.WildTangentGamesBundle Folder C:\Program Files (x86)\WILDGAMES\JEWEL MATCH SNOWSCAPES

Preinstalled.WildTangentGamesBundle Folder C:\Program Files (x86)\WILDGAMES\MAGIC ACADEMY

Preinstalled.WildTangentGamesBundle Folder C:\Program Files (x86)\WILDGAMES\POLAR BOWLER 1ST FRAME

Preinstalled.WildTangentGamesBundle Folder C:\Program Files (x86)\WILDGAMES\RUNEFALL

Preinstalled.WildTangentGamesBundle Folder C:\Program Files (x86)\WILDTANGENT GAMES

Preinstalled.WildTangentGamesBundle Folder C:\Program Files (x86)\WILDTANGENT GAMES\APP

Preinstalled.WildTangentGamesBundle Registry HKLM\Software\Wow6432Node\\Classes\CLSID\{7A97880C-7DD3-4C6E-8DE0-881B1FC02BE6}

Preinstalled.WildTangentGamesBundle Registry HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Ext\Preapproved\{7A97880C-7DD3-4C6E-8DE0-881B1FC02BE6}

Preinstalled.WildTangentGamesBundle Registry HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\WildTangent wildgames Master Uninstall

Preinstalled.WildTangentGamesBundle Registry HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\WildTangentGDF-acer-vegasworld

Preinstalled.WildTangentGamesBundle Registry HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\WildTangentGDF-acer-villagersandheroes

Preinstalled.WildTangentGamesBundle Registry HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\WildTangentGameProvider-acer-genres

Preinstalled.WildTangentGamesBundle Registry HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\WildTangentGameProvider-acer-main

Preinstalled.WildTangentGamesBundle Registry HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App

Preinstalled.WildTangentGamesBundle Registry HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-acer

Preinstalled.WildTangentGamesBundle Registry HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7A97880C-7DD3-4C6E-8DE0-881B1FC02BE6}

Preinstalled.WildTangentGamesBundle Registry HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7A97880C-7DD3-4C6E-8DE0-881B1FC02BE6}

AdwCleaner_Debug.log - [40834 octets] - [21/11/2019 16:49:48]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S00].txt ##########

#4 Juliet

SuperHelper

Retired Classroom Teacher
7,686 posts

Interests:Boo!....

Posted 22 November 2019 - 04:41 AM

Opening a PDF can cause malware? I didn't know.

Oh yeah.
PDF or any kind of attachments can render a machine......a door stop.

AmazonAssistant has been rendered useless.

When you ran MalwareBytes scan, did you allow it to remove/quarantine what it found?
What I saw was.......No Action By User

~~~~

Were you able to run RogueKiller?

#5 poporacer

Authentic Member

Authentic Member
106 posts

Posted 22 November 2019 - 09:34 AM

No I didn't let the MalwareBytes scan fix anything. I wasn't sure if I should. Yes I ran RogueKiller, I thought I posted the file. Here it is:

RogueKiller Anti-Malware V13.5.7.0 (x64) [Nov 20 2019] (Free) by Adlice Software

mail : https://adlice.com/contact/

Website : https://adlice.com/d...ad/roguekiller/

Operating System : Windows 10 (10.0.18363) 64 bits

Started in : Normal mode

User : rahsr [Administrator]

Started from : C:\Program Files\RogueKiller\RogueKiller64.exe

Signatures : 20191121_092516, Driver : Loaded

Mode : Standard Scan, Scan -- Date : 2019/11/21 17:14:56 (Duration : 00:55:20)

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Process Modules ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Services ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Tasks ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Registry ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ WMI ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Hosts File ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Files ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

[PUP.Gen1 (Potentially Malicious)] (folder) DriverSetupUtility -- C:\ProgramData\DriverSetupUtility -> Found

[PUP.Gen1 (Potentially Malicious)] (folder) DriverSetupUtility -- C:\Program Files\DriverSetupUtility -> Found

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Web browsers ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

>>>>>> Chrome Addon

[PUP.Gen0 (Potentially Malicious)] Amazon Assistant for Chrome (C:\Users\rahsr\AppData\Local\Google\Chrome\User Data\Default\Extensions\PBJIKB~1) -- pbjikboenpfhbbejgkoklgkhjpfogcam -> Found

#6 Juliet

SuperHelper

Retired Classroom Teacher
7,686 posts

Interests:Boo!....

Posted 22 November 2019 - 04:30 PM

For RogueKiller, click on the Remove Selected button <== did you do this?

I went back over the logs and mostly what I saw that you didn't remove/quarantine was Preinstalled Bloatware.

So far, no sign of anything malicious.

ESET Online Scanner:

Please go here, download the ESET Smart Installer, and save it to your desktop.
Double-click on the you just downloaded.
Place a checkmark next to "YES, I accept the Terms of Use" and click the button.
Click "Yes" to the UAC (User Account Control) warning, then ESET will download its components, register itself, and start itself.
In the new window that opens, tick the radio button next to Enable detection of potentially unwanted applications.
Then click Advanced settings, and make sure there is a checkmark next to only the following items (uncheck everything else):
Remove found threats
Scan archives
Scan for potentially unsafe applications
Enable Anti-Stealth technology
Now click on:
The virus signature database will begin to download. Be patient this make take some time depending on the speed of your internet connection
When the download has completed, the Online Scan will begin automatically it could take several hours to complete the scan. Please be patient
When the scan has completed, click List Found Threats (only if anything is found)
Then click Export, and save the file to your desktop using a unique name, such as ESETScan
Copy and paste the contents of this report into your next reply to me
Click Back, then click Finish to exit ESET Online Scanner

#7 poporacer

Authentic Member

Authentic Member
106 posts

Posted 23 November 2019 - 07:54 AM

I missed the part about removing the selected items. I went back and did that. Here is the Eset Scan results

C:\AdwCleaner\Quarantine\v1\20191121.165533\50\Host App Service\Uninstall (1).exe#895879AA94E52644 a variant of Win32/Pokki.A potentially unwanted application cleaned by deleting
C:\AdwCleaner\Quarantine\v1\20191121.165533\51\Host App Service\Engine\HostAppServiceUpdater (1).exe#B3D56172C1308D4E a variant of Win64/Pokki.B potentially unwanted application cleaned by deleting
C:\AdwCleaner\Quarantine\v1\20191121.165533\51\Host App Service\Engine\HostAppServiceUpdater.exe#FA6841909C8E267B a variant of Win64/Pokki.B potentially unwanted application cleaned by deleting
C:\AdwCleaner\Quarantine\v1\20191121.165533\52\Host App Service\Engine\HostAppServiceUpdater.exe#FA6841909C8E267B a variant of Win64/Pokki.B potentially unwanted application cleaned by deleting
C:\AdwCleaner\Quarantine\v1\20191121.165533\54\Host App Service\Engine\HostAppServiceUpdater.exe#FA6841909C8E267B a variant of Win64/Pokki.B potentially unwanted application cleaned by deleting
C:\AdwCleaner\Quarantine\v1\20191121.165533\55\Host App Service\Engine\HostAppServiceUpdater.exe#FA6841909C8E267B a variant of Win64/Pokki.B potentially unwanted application cleaned by deleting
C:\Users\rahsr\Desktop\Temp Desktop\Old desktop\Work temp\Temp Transfer Kingston\WINZIP\2wzcrack.exe Win32/Keygen.AIX potentially unsafe application cleaned by deleting
C:\Users\rahsr\Downloads\FileZilla_3.27.0.1_win64-setup_bundled3.exe a variant of MSIL/WebCompanion.A potentially unwanted application cleaned by deleting

#8 Juliet

SuperHelper

Retired Classroom Teacher
7,686 posts

Interests:Boo!....

Posted 23 November 2019 - 09:44 AM

That looks pretty good actually.
What it went after was AdwCleaner\Quarantine <== we would remove at closing.
crack.exe /Keygen <==bad news for computers. Most all places on the net that have downloads for these are malicious.

How's the computer doing now?, Any alerts?

#9 poporacer

Authentic Member

Authentic Member
106 posts

Posted 23 November 2019 - 09:55 AM

Things seem to be running good and no alerts! Thanks a million for the time you are taking to look into this!

#10 Juliet

SuperHelper

Retired Classroom Teacher
7,686 posts

Interests:Boo!....

Posted 23 November 2019 - 10:39 AM

I think we can cut you lose.

Use this tool to remove quarantined items:

Please download KpRm by Kernel-panik and save to your Desktop.

Click on KpRm.exe to run the tool.

Vista/Windows 7/8/10 users right-click and select Run As Administrator.

Put a check mark next to these items:

- Delete tools

Click the "Run" button.

When the tool has finished, it will create and open a log report and delete itself.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~`

Answers to common security questions - Best Practices by quietman7, MVP
How Malware Spreads - How did I get infected? by quietman7, MVP
Simple and easy ways to keep your computer safe and secure on the Internet by Lawrence Abrams, MVP
How to Prevent Malware by miekiemoes, MVP
How to backup and restore your data using Cobian Backup by YourHighness
Slow Computer/browser? It May Not Be Malware by quietman7, MVP
- AdBlock is a browser add-on that blocks annoying banners, pop-ups and video ads.
- CryptoPrevent places policy restrictions on loading points for ransomware (eg. CryptoWall), helping prevent the execution of malware.
- Malwarebytes Anti-Exploit (MBAE) is designed to prevent zero-day malware from exploiting vulnerable software.
- Malwarebytes Anti-Malware Premium (MBAM) works in real-time along side your Anti-Virus to prevent malware execution.
- NoScript is a Firefox add-on that blocks the actions of malicious scripts by using whitelisting and other technology.
- Sandboxie isolates programmes of your choice, preventing files from being written to your HDD unless approved by you.
- Secunia PSI will scan your computer for vulnerable software that is outdated, and automatically find the latest update for you.
- SpywareBlaster is a form of passive protection, designed to block the actions of malicious websites and tracking cookies.
- Unchecky automatically removes checkmarks for bunlded software in programme installers; helping you avoid adware and PUPs.