This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

PC apparently infected [Solved]

12 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 14-12-2020
Ran by [removed] (administrator) on DESKTOP-IUVD0RS (Hewlett-Packard HP Z420 Workstation) (17-12-2020 11:17:47)
Running from C:\Users\[removed]\Desktop
[removed]
Platform: Windows 10 Pro Version 2004 19041.685 (X64) Language: English (United States)
Default browser: Edge
Boot Mode: Normal
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
(Intuit, Inc. -> Intuit Inc.) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
(Kaspersky Lab -> AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 21.1\avp.exe
(Kaspersky Lab -> AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 21.1\avpui.exe
(Kaspersky Lab -> AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Password Manager 9.0.2\kpm_tray.exe
(Kaspersky Lab JSC -> AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky VPN 5.2\ksde.exe
(Kaspersky Lab JSC -> AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky VPN 5.2\ksdeui.exe
(Malwarebytes Corporation -> Malwarebytes) C:\ProgramData\MB3Install\MBAMIService.exe
(Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe <9>
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.13426.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.13426.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.13426.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MoUsoCoreWorker.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\oobe\UserOOBEBroker.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(NVIDIA Corporation -> NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation -> NVIDIA Corporation) C:\Windows\System32\nvwmi64.exe <2>
(Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Spotify AB) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.148.625.0_x86__zpdnekdrzrea0\Spotify.exe <5>
(Wondershare Technology Co.,Ltd -> Wondershare) C:\Program Files (x86)\Wondershare\WAF\2.4.3.233\WsAppService.exe
 
==================== Registry (Whitelisted) ===================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\…\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [18381792 2017-06-29] (Realtek Semiconductor Corp. -> Realtek Semiconductor)
HKLM-x32\…\Run: [kpm_tray.exe] => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Password Manager 9.0.2\kpm_tray.exe [629352 2020-04-01] (Kaspersky Lab -> AO Kaspersky Lab)
HKU\S-1-5-21-564737261-2307367983-4277817321-1002\…\Run: [CCleaner Smart Cleaning] => C:\Program Files\CCleaner\CCleaner64.exe [32414392 2020-12-08] (Piriform Software Ltd -> Piriform Software Ltd)
HKU\S-1-5-21-564737261-2307367983-4277817321-1002\…\Run: [VideoGuardMonitor] => C:\Users\Lew Gresham\AppData\Local\Synamedia\VideoGuardPlayer\VideoGuardMonitor\VideoGuardMonitor.exe [2610920 2019-11-21] (Cisco Video Technologies Israel Ltd. -> Synamedia)
HKU\S-1-5-21-564737261-2307367983-4277817321-1002\…\Run: [GarminExpress] => C:\Program Files (x86)\Garmin\Express\express.exe [30885360 2020-03-04] (Garmin International, Inc. -> Garmin Ltd. or its subsidiaries)
HKU\S-1-5-21-564737261-2307367983-4277817321-1002\…\RunOnce: [Application Restart #1] => C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe [382464 2020-12-09] (Microsoft Windows -> Microsoft Corporation)
HKLM\…\Print\Monitors\HP E511 Status Monitor: C:\WINDOWS\system32\hpinkstsE511LM.dll [393352 2017-03-10] (Hewlett Packard -> HP Inc.)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\87.0.4280.88\Installer\chrmstp.exe [2020-12-02] (Google LLC -> Google LLC)
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
 
==================== Scheduled Tasks (Whitelisted) ============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {03C6EA1E-296F-43B6-9EB8-C4E0FD4C6AB5} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1349200 2020-11-03] (Adobe Inc. -> Adobe Inc.)
Task: {26857597-CF9A-4909-9C03-204ECAD7E64C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153168 2018-03-23] (Google Inc -> Google Inc.)
Task: {42C5A97D-5139-4ED7-81C2-D59CB3F05BE8} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [26896568 2020-12-08] (Piriform Software Ltd -> Piriform Software Ltd)
Task: {4F338524-95F9-4933-BE8C-EA394ACD75A8} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [686384 2020-12-08] (Piriform Software Ltd -> Piriform Software Ltd)
Task: {52422D74-70ED-4EFA-BED4-54DEE8AF0233} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153168 2018-03-23] (Google Inc -> Google Inc.)
Task: {5FACE720-E17C-4382-945C-98BF915097F7} - System32\Tasks\OneDrive Standalone Update Task v2 => C:\Users\Lew Gresham\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
Task: {B88A7996-917B-4F52-AE6B-0D8CD90214B8} - System32\Tasks\nWizard_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\nview\nwiz.exe
Task: {BB8BD5DD-950C-4A4B-8513-5F9AD7BB8AF0} - System32\Tasks\Kaspersky_Upgrade_Launcher_{278ADC42-419D-4547-A6CA-5B74BE0AD901} => C:\Program Files\Common Files\AV\Kaspersky Lab\upgrade_launcher.exe [791232 2020-11-07] (Kaspersky Lab -> AO Kaspersky Lab)
Task: {BEC8CBA1-93C8-4283-8365-BC70852B958F} - System32\Tasks\HPCustParticipation HP OfficeJet 3830 series => C:\Program Files\HP\HP OfficeJet 3830 series\Bin\HPCustPartic.exe [6438536 2017-03-27] (Hewlett Packard -> HP Inc.)
Task: {FA6CEBFC-F824-410E-9925-424F0FB3231E} - System32\Tasks\GarminUpdaterTask => C:\Program Files (x86)\Garmin\Express SelfUpdater\ExpressSelfUpdater.exe [40432 2020-03-04] (Garmin International, Inc. -> )
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76
Tcpip\..\Interfaces\{a04e56ed-2bbb-40ae-9bc1-bacbee57d5d9}: [DhcpNameServer] 75.75.75.75 75.75.76.76
 
Edge: 
======
DownloadDir: C:\Users\Lew Gresham\Downloads
Edge HomeButtonPage: HKU\S-1-5-21-564737261-2307367983-4277817321-1002 -> hxxps://duckduckgo.com/?q=&atb;=v168-5__
Edge Notifications: HKU\S-1-5-21-564737261-2307367983-4277817321-1002 -> hxxps://www.rain-alarm.com; hxxps://journeys.os.tc; hxxps://www.cbssports.com; hxxps://bringatrailer.com; hxxps://twitter.com
Edge Extension: (Honey) -> EdgeExtension_HoneyScienceCorporationHoney_cbe4c63gm1mzr => C:\Program Files\WindowsApps\HoneyScienceCorporation.Honey_11.4.2.0_neutral__cbe4c63gm1mzr [2020-12-12]
Edge DefaultProfile: Default
Edge Profile: C:\Users\Lew Gresham\AppData\Local\Microsoft\Edge\User Data\Default [2020-12-17]
Edge DownloadDir: C:\Users\Lew Gresham\Downloads
Edge Notifications: Default -> hxxps://bringatrailer.com; hxxps://carsandyachts.com; hxxps://journeys.os.tc; hxxps://twitter.com; hxxps://www.cbssports.com; hxxps://www.rain-alarm.com
Edge HomePage: Default -> hxxps://duckduckgo.com/?q=&atb;=v168-5__
Edge StartupUrls: Default -> "hxxps://microsoftnews.msn.com/?start=1"
Edge DefaultSearchURL: Default -> hxxps://duckduckgo.com/?q={searchTerms}
Edge DefaultSearchKeyword: Default -> duckduckgo.com
Edge DefaultNewTabURL: Default -> hxxps://duckduckgo.com/chrome_newtab
Edge DefaultSuggestURL: Default -> hxxps://duckduckgo.com/ac/?q={searchTerms}&type;=list
Edge Extension: (Honey) - C:\Users\Lew Gresham\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\amnbcmdbanbkjhnfoeceemmmdiepnbpp [2020-11-16]
Edge Profile: C:\Users\Lew Gresham\AppData\Local\Microsoft\Edge\User Data\Guest Profile [2020-12-08]
Edge HKU\S-1-5-21-564737261-2307367983-4277817321-1002\SOFTWARE\Microsoft\Edge\Extensions\…\Edge\Extension: [ahkjpbeeocnddjkakilopmfdlnjdpcdm]
 
FireFox:
========
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2020-12-07] (Adobe Inc. -> Adobe Systems Inc.)
 
Chrome: 
=======
CHR Profile: C:\Users\Lew Gresham\AppData\Local\Google\Chrome\User Data\Default [2020-12-17]
CHR HomePage: Default -> hxxp://www.google.com
CHR DefaultSearchURL: Default -> hxxps://duckduckgo.com/?q={searchTerms}
CHR DefaultSearchKeyword: Default -> duckduckgo.com
CHR DefaultNewTabURL: Default -> hxxps://duckduckgo.com/chrome_newtab
CHR DefaultSuggestURL: Default -> hxxps://duckduckgo.com/ac/?q={searchTerms}&type;=list
CHR Extension: (Slides) - C:\Users\Lew Gresham\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2018-03-22]
CHR Extension: (Docs) - C:\Users\Lew Gresham\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2018-03-23]
CHR Extension: (Google Drive) - C:\Users\Lew Gresham\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2018-03-23]
CHR Extension: (DuckDuckGo) - C:\Users\Lew Gresham\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkdgflcldnnnapblkhphbgpggdiikppg [2020-10-03]
CHR Extension: (YouTube) - C:\Users\Lew Gresham\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2018-03-23]
CHR Extension: (Adobe Acrobat) - C:\Users\Lew Gresham\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2020-12-17]
CHR Extension: (Sheets) - C:\Users\Lew Gresham\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2018-03-22]
CHR Extension: (Google Docs Offline) - C:\Users\Lew Gresham\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2020-12-17]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Lew Gresham\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2019-10-07]
CHR Extension: (Gmail) - C:\Users\Lew Gresham\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2019-04-24]
CHR Extension: (Chrome Media Router) - C:\Users\Lew Gresham\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2020-12-17]
CHR HKLM\…\Chrome\Extension: [ahkjpbeeocnddjkakilopmfdlnjdpcdm] - hxxps://chrome.google.com/webstore/detail/ahkjpbeeocnddjkakilopmfdlnjdpcdm
CHR HKLM-x32\…\Chrome\Extension: [ahkjpbeeocnddjkakilopmfdlnjdpcdm] - hxxps://chrome.google.com/webstore/detail/ahkjpbeeocnddjkakilopmfdlnjdpcdm
CHR HKLM-x32\…\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]
 
==================== Services (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 AdobeARMservice; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [170056 2020-11-03] (Adobe Inc. -> Adobe Inc.)
R2 AVP21.1; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 21.1\avp.exe [381968 2020-06-29] (Kaspersky Lab -> AO Kaspersky Lab)
S3 klvssbridge64_21.1; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 21.1\x64\vssbridge64.exe [436168 2020-06-29] (Kaspersky Lab -> AO Kaspersky Lab)
S3 kpm_launch_service; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Password Manager 9.0.2\kpm_service.exe [354152 2020-04-01] (Kaspersky Lab -> AO Kaspersky Lab)
R2 KSDE5.2; C:\Program Files (x86)\Kaspersky Lab\Kaspersky VPN 5.2\ksde.exe [644264 2020-10-21] (Kaspersky Lab JSC -> AO Kaspersky Lab)
R2 MBAMIService; C:\ProgramData\MB3Install\MBAMIService.exe [231120 2019-06-26] (Malwarebytes Corporation -> Malwarebytes)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6933272 2020-04-26] (Malwarebytes Inc -> Malwarebytes)
R2 NVWMI; C:\windows\system32\nvwmi64.exe [4167528 2018-01-13] (NVIDIA Corporation -> NVIDIA Corporation)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [5197552 2020-12-12] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [3004048 2019-12-07] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103384 2019-12-07] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 WsAppService; C:\Program Files (x86)\Wondershare\WAF\2.4.3.233\WsAppService.exe [493792 2017-11-07] (Wondershare Technology Co.,Ltd -> Wondershare)
S2 NVDisplay.ContainerLocalSystem; "C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe" -s NVDisplay.ContainerLocalSystem -f "C:\ProgramData\NVIDIA\NVDisplay.ContainerLocalSystem.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\LocalSystem"
 
===================== Drivers (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R0 cm_km; C:\WINDOWS\System32\DRIVERS\cm_km.sys [248504 2020-06-29] (Kaspersky Lab -> AO Kaspersky Lab)
R1 klbackupdisk; C:\WINDOWS\system32\DRIVERS\klbackupdisk.sys [104712 2020-06-29] (Kaspersky Lab -> AO Kaspersky Lab)
R1 klbackupflt; C:\WINDOWS\System32\DRIVERS\klbackupflt.sys [205048 2020-06-29] (Kaspersky Lab -> AO Kaspersky Lab)
R1 kldisk; C:\WINDOWS\system32\DRIVERS\kldisk.sys [121088 2020-06-29] (Kaspersky Lab -> AO Kaspersky Lab)
S0 klelam; C:\WINDOWS\System32\DRIVERS\klelam.sys [37496 2020-06-29] (Microsoft Windows Early Launch Anti-malware Publisher -> AO Kaspersky Lab)
R1 klflt; C:\WINDOWS\system32\DRIVERS\klflt.sys [509184 2020-06-29] (Kaspersky Lab -> AO Kaspersky Lab)
R1 klgse; C:\WINDOWS\System32\DRIVERS\klgse.sys [659768 2020-09-30] (Kaspersky Lab JSC -> AO Kaspersky Lab)
R1 klhk; C:\WINDOWS\System32\drivers\klhk.sys [1341232 2020-09-30] (Kaspersky Lab JSC -> AO Kaspersky Lab)
R3 klids; C:\ProgramData\Kaspersky Lab\AVP21.1\Bases\klids.sys [244768 2020-12-01] (Kaspersky Lab JSC -> AO Kaspersky Lab)
R1 KLIF; C:\WINDOWS\System32\DRIVERS\klif.sys [984320 2020-06-29] (Kaspersky Lab -> AO Kaspersky Lab)
R1 klim6; C:\WINDOWS\system32\DRIVERS\klim6.sys [87808 2020-06-29] (Kaspersky Lab -> AO Kaspersky Lab)
R3 klkbdflt; C:\WINDOWS\system32\DRIVERS\klkbdflt.sys [106768 2020-06-29] (Kaspersky Lab -> AO Kaspersky Lab)
R3 klmouflt; C:\WINDOWS\system32\DRIVERS\klmouflt.sys [106752 2020-06-29] (Kaspersky Lab -> AO Kaspersky Lab)
R1 klpd; C:\WINDOWS\System32\DRIVERS\klpd.sys [79104 2020-06-29] (Kaspersky Lab -> AO Kaspersky Lab)
R1 klpnpflt; C:\WINDOWS\system32\DRIVERS\klpnpflt.sys [90368 2020-06-29] (Kaspersky Lab -> AO Kaspersky Lab)
R3 kltap; C:\WINDOWS\System32\drivers\kltap.sys [55592 2020-10-21] (AnchorFree Inc -> The OpenVPN Project)
R0 klupd_klif_arkmon; C:\WINDOWS\System32\Drivers\klupd_klif_arkmon.sys [257208 2020-10-22] (Kaspersky Lab JSC -> AO Kaspersky Lab)
R3 klupd_klif_kimul; C:\WINDOWS\System32\Drivers\klupd_klif_kimul.sys [99152 2019-03-15] (Kaspersky Lab -> AO Kaspersky Lab)
R3 klupd_klif_klark; C:\WINDOWS\System32\Drivers\klupd_klif_klark.sys [310232 2020-10-26] (Kaspersky Lab JSC -> AO Kaspersky Lab)
R0 klupd_klif_klbg; C:\WINDOWS\System32\Drivers\klupd_klif_klbg.sys [117456 2020-10-26] (Kaspersky Lab JSC -> AO Kaspersky Lab)
R3 klupd_klif_mark; C:\WINDOWS\System32\Drivers\klupd_klif_mark.sys [207352 2020-11-01] (Kaspersky Lab JSC -> AO Kaspersky Lab)
S4 klwfp; C:\WINDOWS\system32\DRIVERS\klwfp.sys [133888 2020-06-29] (Kaspersky Lab -> AO Kaspersky Lab)
R1 Klwtp; C:\WINDOWS\system32\DRIVERS\klwtp.sys [242944 2020-06-29] (Kaspersky Lab -> AO Kaspersky Lab)
R1 kneps; C:\WINDOWS\system32\DRIVERS\kneps.sys [279824 2020-06-29] (Kaspersky Lab -> AO Kaspersky Lab)
R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [216056 2020-08-05] (Malwarebytes Inc -> Malwarebytes)
S0 MbamElam; C:\WINDOWS\System32\DRIVERS\MbamElam.sys [19912 2020-06-06] (Microsoft Windows Early Launch Anti-malware Publisher -> Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [248968 2020-06-06] (Malwarebytes Inc -> Malwarebytes)
R3 tilfilter; C:\WINDOWS\System32\drivers\TIxHCIlfilter.sys [34424 2016-08-20] (Texas Instruments, Inc. -> Texas Instruments, Inc.)
R3 tiufilter; C:\WINDOWS\System32\drivers\TIxHCIufilter.sys [39032 2016-08-20] (Texas Instruments, Inc. -> Texas Instruments, Inc.)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [46688 2019-12-07] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
S3 WDC_SAM; C:\WINDOWS\System32\drivers\wdcsam64.sys [35584 2018-02-26] (WDKTestCert wdclab,130885612892544312 -> Western Digital Technologies, Inc.)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [350136 2019-12-07] (Microsoft Windows -> Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [54200 2019-12-07] (Microsoft Windows -> Microsoft Corporation)
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One month (created) (Whitelisted) =========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2020-12-17 11:17 - 2020-12-17 11:18 - 000018755 _____ C:\Users\Lew Gresham\Desktop\FRST.txt
2020-12-17 10:21 - 2020-12-17 10:21 - 000000008 __RSH C:\ProgramData\ntuser.pol
2020-12-17 10:18 - 2020-12-17 10:19 - 000011579 _____ C:\Users\Lew Gresham\Desktop\Fixlog.txt
2020-12-17 08:11 - 2020-12-17 08:11 - 001195706 _____ C:\Users\Lew Gresham\Documents\News Feed — Nextdoor.html
2020-12-17 08:11 - 2020-12-17 08:11 - 000000000 ____D C:\Users\Lew Gresham\Documents\News Feed — Nextdoor_files
2020-12-17 06:41 - 2020-12-17 09:00 - 000004829 _____ C:\Users\Lew Gresham\Downloads\fixlist.txt.txt
2020-12-15 17:39 - 2020-12-15 17:43 - 000034657 _____ C:\Users\Lew Gresham\Downloads\Addition.txt
2020-12-15 17:33 - 2020-12-15 17:43 - 000044032 _____ C:\Users\Lew Gresham\Downloads\FRST.txt
2020-12-15 17:32 - 2020-12-17 11:18 - 000000000 ____D C:\FRST
2020-12-15 17:32 - 2020-12-15 17:32 - 002286592 _____ (Farbar) C:\Users\Lew Gresham\Desktop\FRST64.exe
2020-12-15 17:28 - 2020-12-15 17:29 - 002000384 _____ (Farbar) C:\Users\Lew Gresham\Downloads\FRST.exe
2020-12-13 23:30 - 2020-12-13 23:30 - 000019132 _____ C:\Users\Lew Gresham\Documents\cc_20201213_233015.reg
2020-12-13 23:30 - 2020-12-13 23:30 - 000000082 _____ C:\Users\Lew Gresham\Documents\cc_20201213_233043.reg
2020-12-13 21:47 - 2020-12-13 21:47 - 040473968 _____ (Adlice Software ) C:\Users\Lew Gresham\Downloads\setup.exe
2020-12-13 21:44 - 2020-12-13 21:44 - 008447152 _____ (Malwarebytes) C:\Users\Lew Gresham\Downloads\adwcleaner_8.0.8.exe
2020-12-13 19:01 - 2020-10-02 19:33 - 000835472 _____ (Adobe) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2020-12-13 19:01 - 2020-10-02 19:33 - 000179608 _____ (Adobe) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2020-12-12 18:13 - 2020-12-12 18:13 - 002755584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2020-12-12 18:12 - 2020-12-12 18:12 - 002755584 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2020-12-12 18:12 - 2020-12-12 18:12 - 001333248 _____ C:\WINDOWS\SysWOW64\TextInputMethodFormatter.dll
2020-12-12 18:12 - 2020-12-12 18:12 - 000266240 _____ C:\WINDOWS\SysWOW64\Windows.Internal.UI.Shell.WindowTabManager.dll
2020-12-12 18:12 - 2020-12-12 18:12 - 000240640 _____ C:\WINDOWS\SysWOW64\CoreMas.dll
2020-12-12 18:12 - 2020-12-12 18:12 - 000100864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncpa.cpl
2020-12-12 18:12 - 2020-12-12 18:12 - 000039936 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2020-12-12 18:12 - 2020-12-12 18:12 - 000010912 _____ C:\WINDOWS\system32\DrtmAuthTxt.wim
2020-12-12 18:12 - 2020-12-12 18:12 - 000010752 _____ C:\WINDOWS\SysWOW64\agentactivationruntimestarter.exe
2020-12-12 18:11 - 2020-12-12 18:11 - 002260480 _____ C:\WINDOWS\system32\TextInputMethodFormatter.dll
2020-12-12 18:11 - 2020-12-12 18:11 - 001822272 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2020-12-12 18:11 - 2020-12-12 18:11 - 001393496 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2020-12-12 18:11 - 2020-12-12 18:11 - 000102912 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncpa.cpl
2020-12-12 18:11 - 2020-12-12 18:11 - 000060928 _____ C:\WINDOWS\system32\runexehelper.exe
2020-12-12 18:11 - 2020-12-12 18:11 - 000048640 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2020-12-12 18:11 - 2020-12-12 18:11 - 000001370 _____ C:\WINDOWS\system32\ThirdPartyNoticesBySHS.txt
2020-12-12 18:10 - 2020-12-12 18:10 - 000363520 _____ C:\WINDOWS\system32\Windows.Internal.UI.Shell.WindowTabManager.dll
2020-12-12 18:10 - 2020-12-12 18:10 - 000287232 _____ C:\WINDOWS\system32\CoreMas.dll
2020-12-12 18:10 - 2020-12-12 18:10 - 000165376 _____ C:\WINDOWS\system32\DataStoreCacheDumpTool.exe
2020-12-12 18:10 - 2020-12-12 18:10 - 000089088 _____ C:\WINDOWS\system32\windows.applicationmodel.conversationalagent.proxystub.dll
2020-12-12 18:10 - 2020-12-12 18:10 - 000073216 _____ C:\WINDOWS\system32\windows.applicationmodel.conversationalagent.internal.proxystub.dll
2020-12-12 18:10 - 2020-12-12 18:10 - 000013312 _____ C:\WINDOWS\system32\agentactivationruntimestarter.exe
2020-12-09 22:47 - 2020-12-09 22:47 - 000000000 ____D C:\ProgramData\Microsoft OneDrive
2020-12-09 21:00 - 2020-12-09 18:34 - 000000000 ____D C:\Windows.old
2020-12-09 20:56 - 2020-12-09 21:00 - 000000000 ____D C:\WINDOWS\system32\config\bbimigrate
2020-12-09 20:55 - 2020-12-09 20:56 - 000000000 ____D C:\WINDOWS\ServiceProfiles
2020-12-09 20:55 - 2020-12-09 20:55 - 000008192 _____ C:\WINDOWS\system32\config\userdiff
2020-12-09 20:51 - 2020-12-09 20:51 - 000000000 ____D C:\ProgramData\ssh
2020-12-09 20:45 - 2020-12-09 20:45 - 000580096 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhotoScreensaver.scr
2020-12-09 20:45 - 2020-12-09 20:45 - 000499200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhotoScreensaver.scr
2020-12-09 20:45 - 2020-12-09 20:45 - 000467968 _____ C:\WINDOWS\system32\AssignedAccessCsp.dll
2020-12-09 20:45 - 2020-12-09 20:45 - 000204800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mpg2splt.ax
2020-12-09 20:45 - 2020-12-09 20:45 - 000137016 _____ C:\WINDOWS\system32\HvsiManagementApi.dll
2020-12-09 20:45 - 2020-12-09 20:45 - 000111616 _____ C:\WINDOWS\system32\RDVGHelper.exe
2020-12-09 20:45 - 2020-12-09 20:45 - 000101688 _____ C:\WINDOWS\SysWOW64\HvsiManagementApi.dll
2020-12-09 20:44 - 2020-12-09 20:44 - 003860832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rtmpltfm.dll
2020-12-09 20:44 - 2020-12-09 20:44 - 001309504 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2020-12-09 20:44 - 2020-12-09 20:44 - 000980320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rtmpal.dll
2020-12-09 20:44 - 2020-12-09 20:44 - 000915296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rtmcodecs.dll
2020-12-09 20:44 - 2020-12-09 20:44 - 000732000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ortcengine.dll
2020-12-09 20:44 - 2020-12-09 20:44 - 000595968 _____ (Microsoft Corporation) C:\WINDOWS\system32\appwiz.cpl
2020-12-09 20:44 - 2020-12-09 20:44 - 000469504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\appwiz.cpl
2020-12-09 20:44 - 2020-12-09 20:44 - 000266240 _____ (Microsoft Corporation) C:\WINDOWS\system32\mpg2splt.ax
2020-12-09 20:44 - 2020-12-09 20:44 - 000221184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bthprops.cpl
2020-12-09 20:44 - 2020-12-09 20:44 - 000178176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\intl.cpl
2020-12-09 20:44 - 2020-12-09 20:44 - 000112128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\activeds.tlb
2020-12-09 20:44 - 2020-12-09 20:44 - 000087552 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdc.ocx
2020-12-09 20:44 - 2020-12-09 20:44 - 000072704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdc.ocx
2020-12-09 20:44 - 2020-12-09 20:44 - 000055376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rtmmvrortc.dll
2020-12-09 20:44 - 2020-12-09 20:44 - 000045880 _____ C:\WINDOWS\system32\HvSocket.dll
2020-12-09 20:43 - 2020-12-09 20:43 - 004898144 _____ (Microsoft Corporation) C:\WINDOWS\system32\rtmpltfm.dll
2020-12-09 20:43 - 2020-12-09 20:43 - 001354080 _____ (Microsoft Corporation) C:\WINDOWS\system32\rtmpal.dll
2020-12-09 20:43 - 2020-12-09 20:43 - 001162240 _____ C:\WINDOWS\system32\MBR2GPT.EXE
2020-12-09 20:43 - 2020-12-09 20:43 - 001091936 _____ (Microsoft Corporation) C:\WINDOWS\system32\rtmcodecs.dll
2020-12-09 20:43 - 2020-12-09 20:43 - 001032544 _____ (Microsoft Corporation) C:\WINDOWS\system32\ortcengine.dll
2020-12-09 20:43 - 2020-12-09 20:43 - 000611952 _____ C:\WINDOWS\SysWOW64\TextShaping.dll
2020-12-09 20:43 - 2020-12-09 20:43 - 000455168 _____ C:\WINDOWS\SysWOW64\WindowManagementAPI.dll
2020-12-09 20:43 - 2020-12-09 20:43 - 000422912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winspool.drv
2020-12-09 20:43 - 2020-12-09 20:43 - 000238592 _____ (Microsoft Corporation) C:\WINDOWS\system32\intl.cpl
2020-12-09 20:43 - 2020-12-09 20:43 - 000056672 _____ (Microsoft Corporation) C:\WINDOWS\system32\rtmmvrortc.dll
2020-12-09 20:43 - 2020-12-09 20:43 - 000047472 _____ C:\WINDOWS\SysWOW64\umpdc.dll
2020-12-09 20:43 - 2020-12-09 20:43 - 000023552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msacm32.drv
2020-12-09 20:42 - 2020-12-09 20:42 - 002260480 _____ (The ICU Project) C:\WINDOWS\system32\icu.dll
2020-12-09 20:42 - 2020-12-09 20:42 - 000707544 _____ C:\WINDOWS\system32\TextShaping.dll
2020-12-09 20:42 - 2020-12-09 20:42 - 000645120 _____ C:\WINDOWS\system32\WindowManagementAPI.dll
2020-12-09 20:42 - 2020-12-09 20:42 - 000306176 _____ C:\WINDOWS\system32\HeatCore.dll
2020-12-09 20:42 - 2020-12-09 20:42 - 000266752 _____ (Microsoft Corporation) C:\WINDOWS\system32\bthprops.cpl
2020-12-09 20:42 - 2020-12-09 20:42 - 000152576 _____ C:\WINDOWS\system32\EoAExperiences.exe
2020-12-09 20:42 - 2020-12-09 20:42 - 000112128 _____ (Microsoft Corporation) C:\WINDOWS\system32\activeds.tlb
2020-12-09 20:42 - 2020-12-09 20:42 - 000029696 _____ (The ICU Project) C:\WINDOWS\system32\icuuc.dll
2020-12-09 20:42 - 2020-12-09 20:42 - 000025088 _____ (The ICU Project) C:\WINDOWS\system32\icuin.dll
2020-12-09 20:41 - 2020-12-09 20:41 - 004227116 _____ C:\WINDOWS\system32\DefaultHrtfs.bin
2020-12-09 20:41 - 2020-12-09 20:41 - 000562688 _____ (Microsoft Corporation) C:\WINDOWS\system32\winspool.drv
2020-12-09 20:41 - 2020-12-09 20:41 - 000455168 _____ C:\WINDOWS\system32\ssdm.dll
2020-12-09 20:41 - 2020-12-09 20:41 - 000197632 _____ C:\WINDOWS\system32\IHDS.dll
2020-12-09 20:41 - 2020-12-09 20:41 - 000064552 _____ C:\WINDOWS\system32\umpdc.dll
2020-12-09 20:41 - 2020-12-09 20:41 - 000030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\msacm32.drv
2020-12-09 20:29 - 2020-12-09 20:29 - 000076060 _____ C:\WINDOWS\SysWOW64\xpsrchvw.xml
2020-12-09 20:29 - 2020-12-09 20:29 - 000076060 _____ C:\WINDOWS\system32\xpsrchvw.xml
2020-12-09 20:25 - 2020-12-09 20:25 - 000000000 ____D C:\Program Files\Reference Assemblies
2020-12-09 20:25 - 2020-12-09 20:25 - 000000000 ____D C:\Program Files\MSBuild
2020-12-09 20:25 - 2020-12-09 20:25 - 000000000 ____D C:\Program Files (x86)\Reference Assemblies
2020-12-09 20:25 - 2020-12-09 20:25 - 000000000 ____D C:\Program Files (x86)\MSBuild
2020-12-09 18:34 - 2020-12-09 18:34 - 000000020 ___SH C:\Users\Lew Gresham\ntuser.ini
2020-12-09 18:33 - 2020-12-17 10:21 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2020-12-09 18:33 - 2020-12-17 06:28 - 000004178 _____ C:\WINDOWS\system32\Tasks\User_Feed_Synchronization-{31844977-4BB8-4B03-8628-972A4818C5FA}
2020-12-09 18:33 - 2020-12-15 09:59 - 000003936 _____ C:\WINDOWS\system32\Tasks\CCleaner Update
2020-12-09 18:33 - 2020-12-09 18:34 - 000003408 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
2020-12-09 18:33 - 2020-12-09 18:34 - 000002702 _____ C:\WINDOWS\system32\Tasks\GarminUpdaterTask
2020-12-09 18:33 - 2020-12-09 18:34 - 000002676 _____ C:\WINDOWS\system32\Tasks\HPCustParticipation HP OfficeJet 3830 series
2020-12-09 18:33 - 2020-12-09 18:33 - 000003482 _____ C:\WINDOWS\system32\Tasks\Adobe Acrobat Update Task
2020-12-09 18:33 - 2020-12-09 18:33 - 000003346 _____ C:\WINDOWS\system32\Tasks\GoogleUpdateTaskMachineUA
2020-12-09 18:33 - 2020-12-09 18:33 - 000003184 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore
2020-12-09 18:33 - 2020-12-09 18:33 - 000003122 _____ C:\WINDOWS\system32\Tasks\GoogleUpdateTaskMachineCore
2020-12-09 18:33 - 2020-12-09 18:33 - 000002768 _____ C:\WINDOWS\system32\Tasks\OneDrive Standalone Update Task v2
2020-12-09 18:33 - 2020-12-09 18:33 - 000002618 _____ C:\WINDOWS\system32\Tasks\nWizard_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2020-12-09 18:33 - 2020-12-09 18:33 - 000002486 _____ C:\WINDOWS\system32\Tasks\Kaspersky_Upgrade_Launcher_{278ADC42-419D-4547-A6CA-5B74BE0AD901}
2020-12-09 18:33 - 2020-12-09 18:33 - 000002218 _____ C:\WINDOWS\system32\Tasks\CCleanerSkipUAC
2020-12-09 18:33 - 2020-12-09 18:33 - 000000000 ____D C:\WINDOWS\system32\Tasks\S-1-5-21-564737261-2307367983-4277817321-1002
2020-12-09 18:33 - 2020-12-09 18:33 - 000000000 ____D C:\WINDOWS\system32\Tasks\MEGA
2020-12-09 18:27 - 2020-12-09 18:33 - 000007623 _____ C:\WINDOWS\diagwrn.xml
2020-12-09 18:27 - 2020-12-09 18:33 - 000007623 _____ C:\WINDOWS\diagerr.xml
2020-12-09 18:19 - 2020-12-17 10:28 - 000840598 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2020-12-09 18:07 - 2020-12-13 18:59 - 000000000 ____D C:\Users\Lew Gresham
2020-12-09 18:07 - 2019-12-07 04:10 - 000001105 _____ C:\Users\Lew Gresham\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2020-12-09 18:02 - 2020-12-17 11:04 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2020-12-09 18:01 - 2020-12-17 10:21 - 000008192 ___SH C:\DumpStack.log.tmp
2020-12-09 18:01 - 2020-12-13 19:01 - 000277464 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2020-12-08 22:59 - 2020-12-08 22:59 - 000007066 _____ C:\Users\Lew Gresham\Documents\cc_20201208_225930.reg
2020-12-07 19:39 - 2020-12-09 18:34 - 000000000 ___DC C:\WINDOWS\Panther
2020-12-07 19:11 - 2020-12-07 19:11 - 000000000 ___HD C:\$WinREAgent
2020-12-07 18:42 - 2020-12-08 09:27 - 000000000 ____D C:\Users\Lew Gresham\AppData\Local\Adobe
2020-11-22 13:40 - 2020-11-22 13:40 - 000014226 _____ C:\Users\Lew Gresham\Documents\cc_20201122_134003.reg
 
==================== One month (modified) ==================
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2020-12-17 11:16 - 2019-12-07 04:14 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2020-12-17 10:44 - 2019-12-07 04:14 - 000000000 ___HD C:\Program Files\WindowsApps
2020-12-17 10:44 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\AppReadiness
2020-12-17 10:28 - 2019-12-07 04:13 - 000000000 ____D C:\WINDOWS\INF
2020-12-17 10:27 - 2018-04-15 10:01 - 000000000 ____D C:\Program Files\CCleaner
2020-12-17 10:21 - 2018-03-20 13:46 - 000000000 ____D C:\ProgramData\NVIDIA
2020-12-17 10:20 - 2019-12-07 04:03 - 000786432 _____ C:\WINDOWS\system32\config\BBI
2020-12-17 10:18 - 2018-11-08 21:09 - 000000000 ____D C:\Users\Lew Gresham\AppData\LocalLow\Temp
2020-12-17 10:18 - 2017-03-18 16:03 - 000000000 ___HD C:\WINDOWS\system32\GroupPolicy
2020-12-16 21:24 - 2018-03-22 22:58 - 018612224 _____ C:\Users\Lew Gresham\Documents\QDATA1_20060727_200608013_20120819_20120828_20120911.QDF
2020-12-15 10:55 - 2018-03-25 09:48 - 018604032 _____ C:\Users\Lew Gresham\Documents\QDATA1_20060727_200608013_20120819_20120828_20120911.QDF-backup
2020-12-15 10:55 - 2018-03-22 22:58 - 000000000 ____D C:\Users\Lew Gresham\Documents\BACKUP
2020-12-13 18:55 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2020-12-13 18:55 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\SystemResources
2020-12-13 18:55 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\migwiz
2020-12-13 18:55 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\Dism
2020-12-13 18:54 - 2019-12-07 04:54 - 000000000 ____D C:\Program Files\Windows Defender Advanced Threat Protection
2020-12-13 18:54 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
2020-12-13 18:54 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\bcastdvr
2020-12-13 18:54 - 2019-12-07 04:14 - 000000000 ____D C:\Program Files\Windows Defender
2020-12-13 18:54 - 2019-12-07 04:14 - 000000000 ____D C:\Program Files (x86)\Windows Defender
2020-12-13 18:43 - 2019-12-07 04:03 - 000000000 ____D C:\WINDOWS\CbsTemp
2020-12-13 09:20 - 2019-12-07 04:03 - 000000000 ____D C:\WINDOWS\servicing
2020-12-12 22:32 - 2020-05-23 00:46 - 000002428 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
2020-12-12 22:32 - 2020-05-23 00:46 - 000002266 _____ C:\Users\Public\Desktop\Microsoft Edge.lnk
2020-12-12 22:32 - 2020-05-23 00:46 - 000002266 _____ C:\ProgramData\Desktop\Microsoft Edge.lnk
2020-12-12 12:29 - 2019-12-07 04:54 - 000000000 ___SD C:\WINDOWS\system32\AppV
2020-12-12 12:29 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed
2020-12-12 12:29 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\SysWOW64\Keywords
2020-12-12 12:29 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\Sysprep
2020-12-12 12:29 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\Macromed
2020-12-12 12:29 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\Keywords
2020-12-12 12:29 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\DDFs
2020-12-12 12:29 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\ShellExperiences
2020-12-12 12:29 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\L2Schemas
2020-12-12 12:29 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\DiagTrack
2020-12-12 11:59 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\registration
2020-12-10 07:30 - 2018-03-24 20:28 - 000000000 ____D C:\Users\Lew Gresham\AppData\Local\Packages
2020-12-10 07:26 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\appcompat
2020-12-09 22:46 - 2019-12-07 04:14 - 000000000 ___RD C:\WINDOWS\PrintDialog
2020-12-09 21:01 - 2019-12-07 04:14 - 000028672 _____ C:\WINDOWS\system32\config\BCD-Template
2020-12-09 21:01 - 2019-03-18 23:52 - 000000000 ____D C:\WINDOWS\system32\Tasks_Migrated
2020-12-09 21:00 - 2020-11-16 17:21 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky VPN
2020-12-09 21:00 - 2020-11-11 19:24 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Anti-Virus
2020-12-09 21:00 - 2019-12-15 13:23 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Password Manager
2020-12-09 21:00 - 2019-12-07 04:18 - 000000000 ____D C:\WINDOWS\Setup
2020-12-09 21:00 - 2019-12-07 04:14 - 000000000 __RHD C:\Users\Public\Libraries
2020-12-09 21:00 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\WinBioDatabase
2020-12-09 21:00 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\spool
2020-12-09 21:00 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\NDF
2020-12-09 21:00 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\ServiceState
2020-12-09 21:00 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\Help
2020-12-09 21:00 - 2019-12-07 04:03 - 000008192 _____ C:\WINDOWS\system32\config\ELAM
2020-12-09 21:00 - 2019-06-19 08:33 - 000000000 ____D C:\Program Files\UNP
2020-12-09 21:00 - 2019-01-19 22:07 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TurboTax 2018
2020-12-09 21:00 - 2018-10-29 12:26 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Garmin
2020-12-09 21:00 - 2018-09-15 02:33 - 000000000 ____D C:\WINDOWS\system32\MsDtc
2020-12-09 21:00 - 2018-06-21 08:36 - 000000000 ____D C:\WINDOWS\system32\appmgmt
2020-12-09 21:00 - 2018-04-22 09:48 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2020-12-09 21:00 - 2018-04-15 10:02 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2020-12-09 21:00 - 2018-03-22 22:51 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Quicken 2012
2020-12-09 21:00 - 2018-03-22 18:29 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TurboTax 2017
2020-12-09 21:00 - 2018-03-20 13:45 - 000000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2020-12-09 20:58 - 2018-03-20 13:49 - 000000000 ____D C:\WINDOWS\system32\SRSLabs
2020-12-09 20:57 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\Resources
2020-12-09 20:57 - 2018-11-08 10:39 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
2020-12-09 20:57 - 2018-07-10 16:00 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare
2020-12-09 20:56 - 2018-05-06 09:53 - 000000000 ____D C:\Program Files\Realtek
2020-12-09 20:52 - 2019-12-07 04:54 - 000000000 ____D C:\Program Files\Windows Photo Viewer
2020-12-09 20:52 - 2019-12-07 04:54 - 000000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ___SD C:\WINDOWS\SysWOW64\F12
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ___SD C:\WINDOWS\system32\UNP
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ___SD C:\WINDOWS\system32\F12
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ___SD C:\WINDOWS\system32\DiagSvcs
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\SysWOW64\WinMetadata
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\SysWOW64\setup
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\SysWOW64\oobe
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\SysWOW64\migwiz
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\SysWOW64\Com
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\SysWOW64\AdvancedInstallers
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\WinMetadata
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\SystemResetPlatform
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\ShellExperiences
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\setup
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\PerceptionSimulation
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\es-MX
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\Com
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\appraiser
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\AdvancedInstallers
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\ShellComponents
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\Provisioning
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\Program Files\Common Files\System
2020-12-09 20:50 - 2019-12-07 04:54 - 000023552 _____ (Microsoft Corporation) C:\WINDOWS\system32\OEMDefaultAssociations.dll
2020-12-09 20:50 - 2019-12-07 04:54 - 000020908 _____ C:\WINDOWS\system32\OEMDefaultAssociations.xml
2020-12-09 20:29 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\SysWOW64\lv-LV
2020-12-09 20:29 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\SysWOW64\lt-LT
2020-12-09 20:29 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\SysWOW64\et-EE
2020-12-09 20:29 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\SysWOW64\es-MX
2020-12-09 20:29 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\lv-LV
2020-12-09 20:29 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\lt-LT
2020-12-09 20:29 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\et-EE
2020-12-09 18:39 - 2018-05-07 06:50 - 000002143 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2020-12-09 18:37 - 2018-06-13 17:17 - 000000000 ____D C:\ProgramData\Packages
2020-12-09 18:36 - 2018-03-24 18:08 - 000000000 ___RD C:\Users\Lew Gresham\3D Objects
2020-12-09 18:36 - 2018-03-20 13:40 - 000000000 __RHD C:\Users\Public\AccountPictures
2020-12-09 18:35 - 2019-12-07 04:14 - 000000000 ____D C:\ProgramData\USOPrivate
2020-12-09 18:34 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\oobe
2020-12-09 18:15 - 2018-03-22 23:11 - 000002308 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2020-12-09 18:15 - 2018-03-22 23:11 - 000002267 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2020-12-09 18:15 - 2018-03-22 23:11 - 000002267 _____ C:\ProgramData\Desktop\Google Chrome.lnk
2020-12-09 18:10 - 2018-11-02 15:36 - 000000000 ____D C:\Users\Lew Gresham\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Balabolka
2020-12-09 18:06 - 2018-03-20 15:17 - 000000000 ____D C:\Temp
2020-12-09 18:06 - 2018-03-20 13:49 - 000000000 ____D C:\WINDOWS\SysWOW64\RTCOM
2020-12-09 18:05 - 2018-03-20 13:45 - 000000000 ____D C:\Program Files\NVIDIA Corporation
2020-11-20 20:10 - 2020-09-30 23:20 - 000000000 ____D C:\Program Files\Microsoft Update Health Tools
2020-11-19 10:13 - 2018-03-27 12:14 - 000000000 ____D C:\ProgramData\Kaspersky Lab
 
==================== SigCheck ============================
 
(There is no automatic fix for files that do not pass verification.)
 
==================== End of FRST.txt ========================

Run Malwarebytes Anti-Malware

I notice you have Malwarebytes Anti-Malware installed.

  • run the programme
  • click on the Scan
  • the scan will begin when it has updated itself
  • when the scan has completed and if malware was found, click the Quarantine Selected button to allow MBAM to quarantine what was found
  • if prompted to restart the computer, close all other programmes and click Yes to restart your computer
  • once you are back at your desktop, open MBAM once more
  • click on the ‘Reports’ tab
  • double-click on the most recent Scan Report
  • click on Export, then Copy to Clipboard

Please paste the contents of the clipboard into your next reply to me.

Thanks

Satchfan

 

Malwarebytes
www.malwarebytes.com
 
-Log Details-
Scan Date: 12/17/20
Scan Time: 8:16 PM
Log File: a940f362-40ce-11eb-8a52-8851fb3f4928.json
 
-Software Information-
Version: 4.3.0.98
Components Version: 1.0.1130
Update Package Version: 1.0.34471
License: Trial
 
-System Information-
OS: Windows 10 (Build 19041.685)
CPU: x64
File System: NTFS
User: DESKTOP-IUVD0RS\Lew Gresham
 
-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 269522
Threats Detected: 0
Threats Quarantined: 0
Time Elapsed: 0 min, 58 sec
 
-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect
 
-Scan Details-
Process: 0
(No malicious items detected)
 
Module: 0
(No malicious items detected)
 
Registry Key: 0
(No malicious items detected)
 
Registry Value: 0
(No malicious items detected)
 
Registry Data: 0
(No malicious items detected)
 
Data Stream: 0
(No malicious items detected)
 
Folder: 0
(No malicious items detected)
 
File: 0
(No malicious items detected)
 
Physical Sector: 0
(No malicious items detected)
 
WMI: 0
(No malicious items detected)
 
 
(end)

That's good. Now we need to sort out your mouse.

Run Farbar Recovery Scan Tool

Open notepad. Please copy the contents of the code box below and paste it into Notepad.

CloseProcesses:
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
2020-12-17 10:21 - 2020-12-17 10:21 - 000000008 __RSH C:\ProgramData\ntuser.pol
CMD: sc config i8042prt start= demand
EmptyTemp:

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

  • save the files as fixlist.txt in the same folder as FRST – NOTE: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work
  • run FRST64 then click Fix just once and wait
  • it will create a log on your desktop, (Fixlog.txt); please post it to your reply.

When it has rebooted, can you tell me if your mouse is now working well.

 

Thanks

Satchfan

Fix result of Farbar Recovery Scan Tool (x64) Version: 14-12-2020
Ran by [removed] (18-12-2020 11:04:20) Run:2
Running from C:\Users\[removed]\Desktop
[removed]
Boot Mode: Normal
==============================================
 
fixlist content:
*****************
CloseProcesses:
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
2020-12-17 10:21 - 2020-12-17 10:21 - 000000008 __RSH C:\ProgramData\ntuser.pol
CMD: sc config i8042prt start= demand
EmptyTemp:
*****************
 
Processes closed successfully.
C:\ProgramData\NTUSER.pol => moved successfully
"C:\ProgramData\ntuser.pol" => not found
 
========= sc config i8042prt start= demand =========
 
[SC] ChangeServiceConfig SUCCESS
 
========= End of CMD: =========
 
 
=========== EmptyTemp: ==========
 
BITS transfer queue => 11034624 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 31672883 B
Java, Flash, Steam htmlcache => 0 B
Windows/system/drivers => 59241 B
Edge => 0 B
Chrome => 0 B
Firefox => 0 B
Opera => 0 B
 
Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 4008 B
NetworkService => 4008 B
Lew Gresham => 201769 B
 
RecycleBin => 139580 B
EmptyTemp: => 41.1 MB temporary data Removed.
 
================================
 
 
The system needed a reboot.
 
==== End of Fixlog 11:04:36 ====

Something happened when I went to post the Fixlog.txt the cursor froze and I had to reboot my PC. Not sure what's going on with that now.  I wonder if I should post up a hijackthis log file. 

Something happened when I went to post the Fixlog.txt the cursor froze and I had to reboot my PC.

You would hae to have re-boot anyway as I changed driver settings.

 

How are things now?

Fix result of Farbar Recovery Scan Tool (x64) Version: 14-12-2020
Ran by [removed] (18-12-2020 11:04:20) Run:2
Running from C:\Users\[removed]\Desktop
[removed]
Boot Mode: Normal
==============================================
 
fixlist content:
*****************
CloseProcesses:
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
2020-12-17 10:21 - 2020-12-17 10:21 - 000000008 __RSH C:\ProgramData\ntuser.pol
CMD: sc config i8042prt start= demand
EmptyTemp:
*****************
 
Processes closed successfully.
C:\ProgramData\NTUSER.pol => moved successfully
"C:\ProgramData\ntuser.pol" => not found
 
========= sc config i8042prt start= demand =========
 
[SC] ChangeServiceConfig SUCCESS
 
========= End of CMD: =========
 
 
=========== EmptyTemp: ==========
 
BITS transfer queue => 11034624 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 31672883 B
Java, Flash, Steam htmlcache => 0 B
Windows/system/drivers => 59241 B
Edge => 0 B
Chrome => 0 B
Firefox => 0 B
Opera => 0 B
 
Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 4008 B
NetworkService => 4008 B
Lew Gresham => 201769 B
 
RecycleBin => 139580 B
EmptyTemp: => 41.1 MB temporary data Removed.
 
================================
 
 
The system needed a reboot.
 
==== End of Fixlog 11:04:36 ====

I did not see you post until I posted up the fixlog.txt file again. Not sure what's going on. As I mentioned my cursor froze earlier on the site and I had to reboot. Not sure what's going on with that now. Would you like to see a hijackthis log file? Not sure If you saw the earlier post I asked the same thing.  

Should be alright now.

 

Let’s run an online scan to be sure nothing is left and if that’s clear I’ll send instructions to tidy up.

Download ESET Online Scanner and save it to your desktop.

  • right-click on esetonlinescanner_enu.exe and select Run as Administrator.
  • when the tool opens, click Get Started.
  • read and accept the license agreement.
  • at the Welcome to ESET Online Scanner window, click Get Started.
  • select whether you would like to send anonymous data to ESET.
  • Note: if you see the "Welcome Back to ESET Online Scanner" screen, click Computer Scan > Full Scan.
  • click on the Full Scan option.
  • select Enable ESET to detect and remove potentially unwanted applications, then click Start scan.
  • ESET will now begin scanning your computer. This may take some time.
  • when the scan is finished and if threats have been detected, select Save scan log. Save it to your desktop as eset.txt. Click on Continue.
  • ESET Online Scanner may ask if you'd like to turn on the Periodic Scan feature: click on Continue.
  • on the next screen, you can leave feedback about the program if you wish. Check the box for Delete application data on closing. If you left feedback, click Submit and continue. If not, Close without feedback.
  • open the scan log on your desktop (eset.txt) and copy and paste its contents into your next reply.

 

12/18/2020 19:05:35 PM
Files scanned: 556623
Detected files: 1
Cleaned files: 1
Total scan time 03:40:11
Scan status: Finished
 
 
C:\Users\Lew Gresham\Downloads\ccsetup541.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application cleaned by deleting

That's fine.

 

You can get rid of the setup file as you no longer need it.

 

Using File Explorer delete ccsetup541.exe from your Downloads folder.

 

Any remaining problems?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI