Lewg
Trying to post all seems ok earlier, my mouse froze again and I had to reboot my pc in order to get back online. .
Spyware / Malware / Virus Removal
PC apparently infected [Solved]
12 min read
Satchfan
There was a problem, but the last 'fix' I sent, and the resulting fixlog, showed that it was dealt with. Let's have a look.
Please run FRST again and make sure there is a checkmark next to ‘Addition.txt’ before you hit Scan.
Logs to include with next post:
New Frst.txt
New Addition.txt
It's nearly 3am here so I won't reply again tonight.
Lewg
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 14-12-2020
Ran by [removed] (administrator) on DESKTOP-IUVD0RS (Hewlett-Packard HP Z420 Workstation) (18-12-2020 23:40:11)
Running from C:\Users\[removed]\Desktop
[removed]
Platform: Windows 10 Pro Version 2004 19041.685 (X64) Language: English (United States)
Default browser: Edge
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
(Intuit, Inc. -> Intuit Inc.) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
(Kaspersky Lab -> AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 21.1\avp.exe
(Kaspersky Lab -> AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 21.1\avpui.exe
(Kaspersky Lab -> AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Password Manager 9.0.2\kpm_tray.exe
(Kaspersky Lab JSC -> AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky VPN 5.2\ksde.exe
(Kaspersky Lab JSC -> AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky VPN 5.2\ksdeui.exe
(Malwarebytes Corporation -> Malwarebytes) C:\ProgramData\MB3Install\MBAMIService.exe
(Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2011.16.0_x64__8wekyb3d8bbwe\Calculator.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.13426.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.13426.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.13426.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsStore_12011.1001.1.0_x64__8wekyb3d8bbwe\WinStore.App.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MoUsoCoreWorker.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\oobe\UserOOBEBroker.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(NVIDIA Corporation -> NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation -> NVIDIA Corporation) C:\Windows\System32\nvwmi64.exe <2>
(Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Spotify AB) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.148.625.0_x86__zpdnekdrzrea0\Spotify.exe <5>
(Wondershare Technology Co.,Ltd -> Wondershare) C:\Program Files (x86)\Wondershare\WAF\2.4.3.233\WsAppService.exe
==================== Registry (Whitelisted) ===================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\…\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [18381792 2017-06-29] (Realtek Semiconductor Corp. -> Realtek Semiconductor)
HKLM-x32\…\Run: [kpm_tray.exe] => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Password Manager 9.0.2\kpm_tray.exe [629352 2020-04-01] (Kaspersky Lab -> AO Kaspersky Lab)
HKU\S-1-5-21-564737261-2307367983-4277817321-1002\…\Run: [CCleaner Smart Cleaning] => C:\Program Files\CCleaner\CCleaner64.exe [32414392 2020-12-08] (Piriform Software Ltd -> Piriform Software Ltd)
HKU\S-1-5-21-564737261-2307367983-4277817321-1002\…\Run: [VideoGuardMonitor] => C:\Users\Lew Gresham\AppData\Local\Synamedia\VideoGuardPlayer\VideoGuardMonitor\VideoGuardMonitor.exe [2610920 2019-11-21] (Cisco Video Technologies Israel Ltd. -> Synamedia)
HKU\S-1-5-21-564737261-2307367983-4277817321-1002\…\Run: [GarminExpress] => C:\Program Files (x86)\Garmin\Express\express.exe [30885360 2020-03-04] (Garmin International, Inc. -> Garmin Ltd. or its subsidiaries)
HKU\S-1-5-21-564737261-2307367983-4277817321-1002\…\RunOnce: [Application Restart #1] => C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe [382464 2020-12-09] (Microsoft Windows -> Microsoft Corporation)
HKLM\…\Print\Monitors\HP E511 Status Monitor: C:\WINDOWS\system32\hpinkstsE511LM.dll [393352 2017-03-10] (Hewlett Packard -> HP Inc.)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\87.0.4280.88\Installer\chrmstp.exe [2020-12-02] (Google LLC -> Google LLC)
==================== Scheduled Tasks (Whitelisted) ============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {03C6EA1E-296F-43B6-9EB8-C4E0FD4C6AB5} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1349200 2020-11-03] (Adobe Inc. -> Adobe Inc.)
Task: {19BE9213-DD5D-4C26-BE43-D5DBB7D6FC74} - System32\Tasks\EOSv3 Scheduler onTime => C:\Users\Lew Gresham\Downloads\esetonlinescanner.exe [15012440 2020-12-18] (ESET, spol. s r.o. -> ESET spol. s r.o.)
Task: {26857597-CF9A-4909-9C03-204ECAD7E64C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153168 2018-03-23] (Google Inc -> Google Inc.)
Task: {42C5A97D-5139-4ED7-81C2-D59CB3F05BE8} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [26896568 2020-12-08] (Piriform Software Ltd -> Piriform Software Ltd)
Task: {4F338524-95F9-4933-BE8C-EA394ACD75A8} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [686384 2020-12-08] (Piriform Software Ltd -> Piriform Software Ltd)
Task: {501DA594-6875-449B-A0FF-959CA2AF7A76} - System32\Tasks\EOSv3 Scheduler onLogOn => C:\Users\Lew Gresham\Downloads\esetonlinescanner.exe [15012440 2020-12-18] (ESET, spol. s r.o. -> ESET spol. s r.o.)
Task: {52422D74-70ED-4EFA-BED4-54DEE8AF0233} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153168 2018-03-23] (Google Inc -> Google Inc.)
Task: {5FACE720-E17C-4382-945C-98BF915097F7} - System32\Tasks\OneDrive Standalone Update Task v2 => C:\Users\Lew Gresham\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
Task: {B88A7996-917B-4F52-AE6B-0D8CD90214B8} - System32\Tasks\nWizard_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\nview\nwiz.exe
Task: {BB8BD5DD-950C-4A4B-8513-5F9AD7BB8AF0} - System32\Tasks\Kaspersky_Upgrade_Launcher_{278ADC42-419D-4547-A6CA-5B74BE0AD901} => C:\Program Files\Common Files\AV\Kaspersky Lab\upgrade_launcher.exe [791232 2020-11-07] (Kaspersky Lab -> AO Kaspersky Lab)
Task: {BEC8CBA1-93C8-4283-8365-BC70852B958F} - System32\Tasks\HPCustParticipation HP OfficeJet 3830 series => C:\Program Files\HP\HP OfficeJet 3830 series\Bin\HPCustPartic.exe [6438536 2017-03-27] (Hewlett Packard -> HP Inc.)
Task: {FA6CEBFC-F824-410E-9925-424F0FB3231E} - System32\Tasks\GarminUpdaterTask => C:\Program Files (x86)\Garmin\Express SelfUpdater\ExpressSelfUpdater.exe [40432 2020-03-04] (Garmin International, Inc. -> )
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76
Tcpip\..\Interfaces\{a04e56ed-2bbb-40ae-9bc1-bacbee57d5d9}: [DhcpNameServer] 75.75.75.75 75.75.76.76
Edge:
======
DownloadDir: C:\Users\Lew Gresham\Downloads
Edge HomeButtonPage: HKU\S-1-5-21-564737261-2307367983-4277817321-1002 -> hxxps://duckduckgo.com/?q=&atb;=v168-5__
Edge Notifications: HKU\S-1-5-21-564737261-2307367983-4277817321-1002 -> hxxps://www.rain-alarm.com; hxxps://journeys.os.tc; hxxps://www.cbssports.com; hxxps://bringatrailer.com; hxxps://twitter.com
Edge Extension: (Honey) -> EdgeExtension_HoneyScienceCorporationHoney_cbe4c63gm1mzr => C:\Program Files\WindowsApps\HoneyScienceCorporation.Honey_11.4.2.0_neutral__cbe4c63gm1mzr [2020-12-12]
Edge DefaultProfile: Default
Edge Profile: C:\Users\Lew Gresham\AppData\Local\Microsoft\Edge\User Data\Default [2020-12-18]
Edge DownloadDir: C:\Users\Lew Gresham\Downloads
Edge Notifications: Default -> hxxps://bringatrailer.com; hxxps://carsandyachts.com; hxxps://journeys.os.tc; hxxps://twitter.com; hxxps://www.cbssports.com; hxxps://www.rain-alarm.com
Edge HomePage: Default -> hxxps://duckduckgo.com/?q=&atb;=v168-5__
Edge StartupUrls: Default -> "hxxps://microsoftnews.msn.com/?start=1"
Edge DefaultSearchURL: Default -> hxxps://duckduckgo.com/?q={searchTerms}
Edge DefaultSearchKeyword: Default -> duckduckgo.com
Edge DefaultNewTabURL: Default -> hxxps://duckduckgo.com/chrome_newtab
Edge DefaultSuggestURL: Default -> hxxps://duckduckgo.com/ac/?q={searchTerms}&type;=list
Edge Extension: (Honey) - C:\Users\Lew Gresham\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\amnbcmdbanbkjhnfoeceemmmdiepnbpp [2020-11-16]
Edge Profile: C:\Users\Lew Gresham\AppData\Local\Microsoft\Edge\User Data\Guest Profile [2020-12-08]
Edge HKU\S-1-5-21-564737261-2307367983-4277817321-1002\SOFTWARE\Microsoft\Edge\Extensions\…\Edge\Extension: [ahkjpbeeocnddjkakilopmfdlnjdpcdm]
FireFox:
========
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2020-12-07] (Adobe Inc. -> Adobe Systems Inc.)
Chrome:
=======
CHR Profile: C:\Users\Lew Gresham\AppData\Local\Google\Chrome\User Data\Default [2020-12-17]
CHR HomePage: Default -> hxxp://www.google.com
CHR DefaultSearchURL: Default -> hxxps://duckduckgo.com/?q={searchTerms}
CHR DefaultSearchKeyword: Default -> duckduckgo.com
CHR DefaultNewTabURL: Default -> hxxps://duckduckgo.com/chrome_newtab
CHR DefaultSuggestURL: Default -> hxxps://duckduckgo.com/ac/?q={searchTerms}&type;=list
CHR Extension: (Slides) - C:\Users\Lew Gresham\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2018-03-22]
CHR Extension: (Docs) - C:\Users\Lew Gresham\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2018-03-23]
CHR Extension: (Google Drive) - C:\Users\Lew Gresham\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2018-03-23]
CHR Extension: (DuckDuckGo) - C:\Users\Lew Gresham\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkdgflcldnnnapblkhphbgpggdiikppg [2020-10-03]
CHR Extension: (YouTube) - C:\Users\Lew Gresham\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2018-03-23]
CHR Extension: (Adobe Acrobat) - C:\Users\Lew Gresham\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2020-12-17]
CHR Extension: (Sheets) - C:\Users\Lew Gresham\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2018-03-22]
CHR Extension: (Google Docs Offline) - C:\Users\Lew Gresham\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2020-12-17]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Lew Gresham\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2019-10-07]
CHR Extension: (Gmail) - C:\Users\Lew Gresham\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2019-04-24]
CHR Extension: (Chrome Media Router) - C:\Users\Lew Gresham\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2020-12-17]
CHR HKLM\…\Chrome\Extension: [ahkjpbeeocnddjkakilopmfdlnjdpcdm] - hxxps://chrome.google.com/webstore/detail/ahkjpbeeocnddjkakilopmfdlnjdpcdm
CHR HKLM-x32\…\Chrome\Extension: [ahkjpbeeocnddjkakilopmfdlnjdpcdm] - hxxps://chrome.google.com/webstore/detail/ahkjpbeeocnddjkakilopmfdlnjdpcdm
CHR HKLM-x32\…\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]
==================== Services (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AdobeARMservice; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [170056 2020-11-03] (Adobe Inc. -> Adobe Inc.)
R2 AVP21.1; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 21.1\avp.exe [381968 2020-06-29] (Kaspersky Lab -> AO Kaspersky Lab)
S3 klvssbridge64_21.1; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 21.1\x64\vssbridge64.exe [436168 2020-06-29] (Kaspersky Lab -> AO Kaspersky Lab)
S3 kpm_launch_service; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Password Manager 9.0.2\kpm_service.exe [354152 2020-04-01] (Kaspersky Lab -> AO Kaspersky Lab)
R2 KSDE5.2; C:\Program Files (x86)\Kaspersky Lab\Kaspersky VPN 5.2\ksde.exe [644264 2020-10-21] (Kaspersky Lab JSC -> AO Kaspersky Lab)
R2 MBAMIService; C:\ProgramData\MB3Install\MBAMIService.exe [231120 2019-06-26] (Malwarebytes Corporation -> Malwarebytes)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [7456464 2020-12-17] (Malwarebytes Inc -> Malwarebytes)
R2 NVWMI; C:\windows\system32\nvwmi64.exe [4167528 2018-01-13] (NVIDIA Corporation -> NVIDIA Corporation)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [5197552 2020-12-12] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [3004048 2019-12-07] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103384 2019-12-07] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 WsAppService; C:\Program Files (x86)\Wondershare\WAF\2.4.3.233\WsAppService.exe [493792 2017-11-07] (Wondershare Technology Co.,Ltd -> Wondershare)
S2 NVDisplay.ContainerLocalSystem; "C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe" -s NVDisplay.ContainerLocalSystem -f "C:\ProgramData\NVIDIA\NVDisplay.ContainerLocalSystem.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\LocalSystem"
===================== Drivers (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R0 cm_km; C:\WINDOWS\System32\DRIVERS\cm_km.sys [248504 2020-06-29] (Kaspersky Lab -> AO Kaspersky Lab)
R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [153312 2020-12-17] (Malwarebytes Corporation -> Malwarebytes)
R1 klbackupdisk; C:\WINDOWS\system32\DRIVERS\klbackupdisk.sys [104712 2020-06-29] (Kaspersky Lab -> AO Kaspersky Lab)
R1 klbackupflt; C:\WINDOWS\System32\DRIVERS\klbackupflt.sys [205048 2020-06-29] (Kaspersky Lab -> AO Kaspersky Lab)
R1 kldisk; C:\WINDOWS\system32\DRIVERS\kldisk.sys [121088 2020-06-29] (Kaspersky Lab -> AO Kaspersky Lab)
S0 klelam; C:\WINDOWS\System32\DRIVERS\klelam.sys [37496 2020-06-29] (Microsoft Windows Early Launch Anti-malware Publisher -> AO Kaspersky Lab)
R1 klflt; C:\WINDOWS\system32\DRIVERS\klflt.sys [509184 2020-06-29] (Kaspersky Lab -> AO Kaspersky Lab)
R1 klgse; C:\WINDOWS\System32\DRIVERS\klgse.sys [659768 2020-09-30] (Kaspersky Lab JSC -> AO Kaspersky Lab)
R1 klhk; C:\WINDOWS\System32\drivers\klhk.sys [1341232 2020-09-30] (Kaspersky Lab JSC -> AO Kaspersky Lab)
R3 klids; C:\ProgramData\Kaspersky Lab\AVP21.1\Bases\klids.sys [244768 2020-12-01] (Kaspersky Lab JSC -> AO Kaspersky Lab)
R1 KLIF; C:\WINDOWS\System32\DRIVERS\klif.sys [984320 2020-06-29] (Kaspersky Lab -> AO Kaspersky Lab)
R1 klim6; C:\WINDOWS\system32\DRIVERS\klim6.sys [87808 2020-06-29] (Kaspersky Lab -> AO Kaspersky Lab)
R3 klkbdflt; C:\WINDOWS\system32\DRIVERS\klkbdflt.sys [106768 2020-06-29] (Kaspersky Lab -> AO Kaspersky Lab)
R3 klmouflt; C:\WINDOWS\system32\DRIVERS\klmouflt.sys [106752 2020-06-29] (Kaspersky Lab -> AO Kaspersky Lab)
R1 klpd; C:\WINDOWS\System32\DRIVERS\klpd.sys [79104 2020-06-29] (Kaspersky Lab -> AO Kaspersky Lab)
R1 klpnpflt; C:\WINDOWS\system32\DRIVERS\klpnpflt.sys [90368 2020-06-29] (Kaspersky Lab -> AO Kaspersky Lab)
R3 kltap; C:\WINDOWS\System32\drivers\kltap.sys [55592 2020-10-21] (AnchorFree Inc -> The OpenVPN Project)
R0 klupd_klif_arkmon; C:\WINDOWS\System32\Drivers\klupd_klif_arkmon.sys [257208 2020-10-22] (Kaspersky Lab JSC -> AO Kaspersky Lab)
R3 klupd_klif_kimul; C:\WINDOWS\System32\Drivers\klupd_klif_kimul.sys [99152 2019-03-15] (Kaspersky Lab -> AO Kaspersky Lab)
R3 klupd_klif_klark; C:\WINDOWS\System32\Drivers\klupd_klif_klark.sys [310232 2020-10-26] (Kaspersky Lab JSC -> AO Kaspersky Lab)
R0 klupd_klif_klbg; C:\WINDOWS\System32\Drivers\klupd_klif_klbg.sys [117456 2020-10-26] (Kaspersky Lab JSC -> AO Kaspersky Lab)
R3 klupd_klif_mark; C:\WINDOWS\System32\Drivers\klupd_klif_mark.sys [207352 2020-11-01] (Kaspersky Lab JSC -> AO Kaspersky Lab)
S4 klwfp; C:\WINDOWS\system32\DRIVERS\klwfp.sys [133888 2020-06-29] (Kaspersky Lab -> AO Kaspersky Lab)
R1 Klwtp; C:\WINDOWS\system32\DRIVERS\klwtp.sys [242944 2020-06-29] (Kaspersky Lab -> AO Kaspersky Lab)
R1 kneps; C:\WINDOWS\system32\DRIVERS\kneps.sys [279824 2020-06-29] (Kaspersky Lab -> AO Kaspersky Lab)
R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [220160 2020-12-17] (Malwarebytes Inc -> Malwarebytes)
S0 MbamElam; C:\WINDOWS\System32\DRIVERS\MbamElam.sys [19912 2020-12-17] (Microsoft Windows Early Launch Anti-malware Publisher -> Malwarebytes)
R3 MBAMFarflt; C:\WINDOWS\System32\DRIVERS\farflt.sys [197792 2020-12-18] (Malwarebytes Inc -> Malwarebytes)
R3 MBAMProtection; C:\WINDOWS\system32\DRIVERS\mbam.sys [77496 2020-12-18] (Malwarebytes Inc -> Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [248968 2020-12-17] (Malwarebytes Inc -> Malwarebytes)
R3 MBAMWebProtection; C:\WINDOWS\system32\DRIVERS\mwac.sys [139424 2020-12-18] (Malwarebytes Inc -> Malwarebytes)
R3 tilfilter; C:\WINDOWS\System32\drivers\TIxHCIlfilter.sys [34424 2016-08-20] (Texas Instruments, Inc. -> Texas Instruments, Inc.)
R3 tiufilter; C:\WINDOWS\System32\drivers\TIxHCIufilter.sys [39032 2016-08-20] (Texas Instruments, Inc. -> Texas Instruments, Inc.)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [46688 2019-12-07] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
S3 WDC_SAM; C:\WINDOWS\System32\drivers\wdcsam64.sys [35584 2018-02-26] (WDKTestCert wdclab,130885612892544312 -> Western Digital Technologies, Inc.)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [350136 2019-12-07] (Microsoft Windows -> Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [54200 2019-12-07] (Microsoft Windows -> Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One month (created) (Whitelisted) =========
(If an entry is included in the fixlist, the file/folder will be moved.)
2020-12-18 23:40 - 2020-12-18 23:42 - 000019784 _____ C:\Users\Lew Gresham\Desktop\FRST.txt
2020-12-18 19:07 - 2020-12-18 19:07 - 000003828 _____ C:\WINDOWS\system32\Tasks\EOSv3 Scheduler onLogOn
2020-12-18 19:07 - 2020-12-18 19:07 - 000003386 _____ C:\WINDOWS\system32\Tasks\EOSv3 Scheduler onTime
2020-12-18 14:57 - 2020-12-18 14:57 - 000000663 _____ C:\Users\Lew Gresham\Desktop\ESET Online Scanner.lnk
2020-12-18 14:55 - 2020-12-18 20:16 - 000000000 ____D C:\Users\Lew Gresham\AppData\Local\ESET
2020-12-18 14:55 - 2020-12-18 14:57 - 000000791 _____ C:\Users\Lew Gresham\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ESET Online Scanner.lnk
2020-12-18 14:54 - 2020-12-18 14:55 - 015012440 _____ (ESET spol. s r.o.) C:\Users\Lew Gresham\Downloads\esetonlinescanner.exe
2020-12-18 11:06 - 2020-12-18 11:06 - 000197792 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
2020-12-18 11:06 - 2020-12-18 11:06 - 000139424 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2020-12-18 11:06 - 2020-12-18 11:06 - 000077496 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2020-12-18 10:56 - 2020-12-18 10:56 - 000000213 _____ C:\Users\Lew Gresham\Downloads\fixlist.txt
2020-12-17 20:09 - 2020-12-17 20:09 - 000248968 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys
2020-12-17 20:09 - 2020-12-17 20:08 - 000019912 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamElam.sys
2020-12-17 16:24 - 2020-12-17 16:24 - 000388608 _____ (Trend Micro Inc.) C:\Users\Lew Gresham\Downloads\HiJackThis.exe
2020-12-17 08:11 - 2020-12-17 08:11 - 001195706 _____ C:\Users\Lew Gresham\Documents\News Feed — Nextdoor.html
2020-12-17 08:11 - 2020-12-17 08:11 - 000000000 ____D C:\Users\Lew Gresham\Documents\News Feed — Nextdoor_files
2020-12-15 17:39 - 2020-12-15 17:43 - 000034657 _____ C:\Users\Lew Gresham\Downloads\Addition.txt
2020-12-15 17:32 - 2020-12-18 23:41 - 000000000 ____D C:\FRST
2020-12-15 17:32 - 2020-12-15 17:32 - 002286592 _____ (Farbar) C:\Users\Lew Gresham\Desktop\FRST64.exe
2020-12-15 17:28 - 2020-12-15 17:29 - 002000384 _____ (Farbar) C:\Users\Lew Gresham\Downloads\FRST.exe
2020-12-13 23:30 - 2020-12-13 23:30 - 000019132 _____ C:\Users\Lew Gresham\Documents\cc_20201213_233015.reg
2020-12-13 23:30 - 2020-12-13 23:30 - 000000082 _____ C:\Users\Lew Gresham\Documents\cc_20201213_233043.reg
2020-12-13 21:47 - 2020-12-13 21:47 - 040473968 _____ (Adlice Software ) C:\Users\Lew Gresham\Downloads\setup.exe
2020-12-13 21:44 - 2020-12-13 21:44 - 008447152 _____ (Malwarebytes) C:\Users\Lew Gresham\Downloads\adwcleaner_8.0.8.exe
2020-12-13 19:01 - 2020-10-02 19:33 - 000835472 _____ (Adobe) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2020-12-13 19:01 - 2020-10-02 19:33 - 000179608 _____ (Adobe) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2020-12-12 18:13 - 2020-12-12 18:13 - 002755584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2020-12-12 18:12 - 2020-12-12 18:12 - 002755584 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2020-12-12 18:12 - 2020-12-12 18:12 - 001333248 _____ C:\WINDOWS\SysWOW64\TextInputMethodFormatter.dll
2020-12-12 18:12 - 2020-12-12 18:12 - 000266240 _____ C:\WINDOWS\SysWOW64\Windows.Internal.UI.Shell.WindowTabManager.dll
2020-12-12 18:12 - 2020-12-12 18:12 - 000240640 _____ C:\WINDOWS\SysWOW64\CoreMas.dll
2020-12-12 18:12 - 2020-12-12 18:12 - 000100864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncpa.cpl
2020-12-12 18:12 - 2020-12-12 18:12 - 000039936 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2020-12-12 18:12 - 2020-12-12 18:12 - 000010912 _____ C:\WINDOWS\system32\DrtmAuthTxt.wim
2020-12-12 18:12 - 2020-12-12 18:12 - 000010752 _____ C:\WINDOWS\SysWOW64\agentactivationruntimestarter.exe
2020-12-12 18:11 - 2020-12-12 18:11 - 002260480 _____ C:\WINDOWS\system32\TextInputMethodFormatter.dll
2020-12-12 18:11 - 2020-12-12 18:11 - 001822272 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2020-12-12 18:11 - 2020-12-12 18:11 - 001393496 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2020-12-12 18:11 - 2020-12-12 18:11 - 000102912 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncpa.cpl
2020-12-12 18:11 - 2020-12-12 18:11 - 000060928 _____ C:\WINDOWS\system32\runexehelper.exe
2020-12-12 18:11 - 2020-12-12 18:11 - 000048640 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2020-12-12 18:11 - 2020-12-12 18:11 - 000001370 _____ C:\WINDOWS\system32\ThirdPartyNoticesBySHS.txt
2020-12-12 18:10 - 2020-12-12 18:10 - 000363520 _____ C:\WINDOWS\system32\Windows.Internal.UI.Shell.WindowTabManager.dll
2020-12-12 18:10 - 2020-12-12 18:10 - 000287232 _____ C:\WINDOWS\system32\CoreMas.dll
2020-12-12 18:10 - 2020-12-12 18:10 - 000165376 _____ C:\WINDOWS\system32\DataStoreCacheDumpTool.exe
2020-12-12 18:10 - 2020-12-12 18:10 - 000089088 _____ C:\WINDOWS\system32\windows.applicationmodel.conversationalagent.proxystub.dll
2020-12-12 18:10 - 2020-12-12 18:10 - 000073216 _____ C:\WINDOWS\system32\windows.applicationmodel.conversationalagent.internal.proxystub.dll
2020-12-12 18:10 - 2020-12-12 18:10 - 000013312 _____ C:\WINDOWS\system32\agentactivationruntimestarter.exe
2020-12-09 22:47 - 2020-12-09 22:47 - 000000000 ____D C:\ProgramData\Microsoft OneDrive
2020-12-09 21:00 - 2020-12-09 18:34 - 000000000 ____D C:\Windows.old
2020-12-09 20:56 - 2020-12-09 21:00 - 000000000 ____D C:\WINDOWS\system32\config\bbimigrate
2020-12-09 20:55 - 2020-12-09 20:56 - 000000000 ____D C:\WINDOWS\ServiceProfiles
2020-12-09 20:55 - 2020-12-09 20:55 - 000008192 _____ C:\WINDOWS\system32\config\userdiff
2020-12-09 20:51 - 2020-12-09 20:51 - 000000000 ____D C:\ProgramData\ssh
2020-12-09 20:45 - 2020-12-09 20:45 - 000580096 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhotoScreensaver.scr
2020-12-09 20:45 - 2020-12-09 20:45 - 000499200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhotoScreensaver.scr
2020-12-09 20:45 - 2020-12-09 20:45 - 000467968 _____ C:\WINDOWS\system32\AssignedAccessCsp.dll
2020-12-09 20:45 - 2020-12-09 20:45 - 000204800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mpg2splt.ax
2020-12-09 20:45 - 2020-12-09 20:45 - 000137016 _____ C:\WINDOWS\system32\HvsiManagementApi.dll
2020-12-09 20:45 - 2020-12-09 20:45 - 000111616 _____ C:\WINDOWS\system32\RDVGHelper.exe
2020-12-09 20:45 - 2020-12-09 20:45 - 000101688 _____ C:\WINDOWS\SysWOW64\HvsiManagementApi.dll
2020-12-09 20:44 - 2020-12-09 20:44 - 003860832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rtmpltfm.dll
2020-12-09 20:44 - 2020-12-09 20:44 - 001309504 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2020-12-09 20:44 - 2020-12-09 20:44 - 000980320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rtmpal.dll
2020-12-09 20:44 - 2020-12-09 20:44 - 000915296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rtmcodecs.dll
2020-12-09 20:44 - 2020-12-09 20:44 - 000732000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ortcengine.dll
2020-12-09 20:44 - 2020-12-09 20:44 - 000595968 _____ (Microsoft Corporation) C:\WINDOWS\system32\appwiz.cpl
2020-12-09 20:44 - 2020-12-09 20:44 - 000469504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\appwiz.cpl
2020-12-09 20:44 - 2020-12-09 20:44 - 000266240 _____ (Microsoft Corporation) C:\WINDOWS\system32\mpg2splt.ax
2020-12-09 20:44 - 2020-12-09 20:44 - 000221184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bthprops.cpl
2020-12-09 20:44 - 2020-12-09 20:44 - 000178176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\intl.cpl
2020-12-09 20:44 - 2020-12-09 20:44 - 000112128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\activeds.tlb
2020-12-09 20:44 - 2020-12-09 20:44 - 000087552 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdc.ocx
2020-12-09 20:44 - 2020-12-09 20:44 - 000072704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdc.ocx
2020-12-09 20:44 - 2020-12-09 20:44 - 000055376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rtmmvrortc.dll
2020-12-09 20:44 - 2020-12-09 20:44 - 000045880 _____ C:\WINDOWS\system32\HvSocket.dll
2020-12-09 20:43 - 2020-12-09 20:43 - 004898144 _____ (Microsoft Corporation) C:\WINDOWS\system32\rtmpltfm.dll
2020-12-09 20:43 - 2020-12-09 20:43 - 001354080 _____ (Microsoft Corporation) C:\WINDOWS\system32\rtmpal.dll
2020-12-09 20:43 - 2020-12-09 20:43 - 001162240 _____ C:\WINDOWS\system32\MBR2GPT.EXE
2020-12-09 20:43 - 2020-12-09 20:43 - 001091936 _____ (Microsoft Corporation) C:\WINDOWS\system32\rtmcodecs.dll
2020-12-09 20:43 - 2020-12-09 20:43 - 001032544 _____ (Microsoft Corporation) C:\WINDOWS\system32\ortcengine.dll
2020-12-09 20:43 - 2020-12-09 20:43 - 000611952 _____ C:\WINDOWS\SysWOW64\TextShaping.dll
2020-12-09 20:43 - 2020-12-09 20:43 - 000455168 _____ C:\WINDOWS\SysWOW64\WindowManagementAPI.dll
2020-12-09 20:43 - 2020-12-09 20:43 - 000422912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winspool.drv
2020-12-09 20:43 - 2020-12-09 20:43 - 000238592 _____ (Microsoft Corporation) C:\WINDOWS\system32\intl.cpl
2020-12-09 20:43 - 2020-12-09 20:43 - 000056672 _____ (Microsoft Corporation) C:\WINDOWS\system32\rtmmvrortc.dll
2020-12-09 20:43 - 2020-12-09 20:43 - 000047472 _____ C:\WINDOWS\SysWOW64\umpdc.dll
2020-12-09 20:43 - 2020-12-09 20:43 - 000023552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msacm32.drv
2020-12-09 20:42 - 2020-12-09 20:42 - 002260480 _____ (The ICU Project) C:\WINDOWS\system32\icu.dll
2020-12-09 20:42 - 2020-12-09 20:42 - 000707544 _____ C:\WINDOWS\system32\TextShaping.dll
2020-12-09 20:42 - 2020-12-09 20:42 - 000645120 _____ C:\WINDOWS\system32\WindowManagementAPI.dll
2020-12-09 20:42 - 2020-12-09 20:42 - 000306176 _____ C:\WINDOWS\system32\HeatCore.dll
2020-12-09 20:42 - 2020-12-09 20:42 - 000266752 _____ (Microsoft Corporation) C:\WINDOWS\system32\bthprops.cpl
2020-12-09 20:42 - 2020-12-09 20:42 - 000152576 _____ C:\WINDOWS\system32\EoAExperiences.exe
2020-12-09 20:42 - 2020-12-09 20:42 - 000112128 _____ (Microsoft Corporation) C:\WINDOWS\system32\activeds.tlb
2020-12-09 20:42 - 2020-12-09 20:42 - 000029696 _____ (The ICU Project) C:\WINDOWS\system32\icuuc.dll
2020-12-09 20:42 - 2020-12-09 20:42 - 000025088 _____ (The ICU Project) C:\WINDOWS\system32\icuin.dll
2020-12-09 20:41 - 2020-12-09 20:41 - 004227116 _____ C:\WINDOWS\system32\DefaultHrtfs.bin
2020-12-09 20:41 - 2020-12-09 20:41 - 000562688 _____ (Microsoft Corporation) C:\WINDOWS\system32\winspool.drv
2020-12-09 20:41 - 2020-12-09 20:41 - 000455168 _____ C:\WINDOWS\system32\ssdm.dll
2020-12-09 20:41 - 2020-12-09 20:41 - 000197632 _____ C:\WINDOWS\system32\IHDS.dll
2020-12-09 20:41 - 2020-12-09 20:41 - 000064552 _____ C:\WINDOWS\system32\umpdc.dll
2020-12-09 20:41 - 2020-12-09 20:41 - 000030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\msacm32.drv
2020-12-09 20:29 - 2020-12-09 20:29 - 000076060 _____ C:\WINDOWS\SysWOW64\xpsrchvw.xml
2020-12-09 20:29 - 2020-12-09 20:29 - 000076060 _____ C:\WINDOWS\system32\xpsrchvw.xml
2020-12-09 20:25 - 2020-12-09 20:25 - 000000000 ____D C:\Program Files\Reference Assemblies
2020-12-09 20:25 - 2020-12-09 20:25 - 000000000 ____D C:\Program Files\MSBuild
2020-12-09 20:25 - 2020-12-09 20:25 - 000000000 ____D C:\Program Files (x86)\Reference Assemblies
2020-12-09 20:25 - 2020-12-09 20:25 - 000000000 ____D C:\Program Files (x86)\MSBuild
2020-12-09 18:34 - 2020-12-09 18:34 - 000000020 ___SH C:\Users\Lew Gresham\ntuser.ini
2020-12-09 18:33 - 2020-12-18 22:20 - 000004178 _____ C:\WINDOWS\system32\Tasks\User_Feed_Synchronization-{31844977-4BB8-4B03-8628-972A4818C5FA}
2020-12-09 18:33 - 2020-12-18 20:16 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2020-12-09 18:33 - 2020-12-15 09:59 - 000003936 _____ C:\WINDOWS\system32\Tasks\CCleaner Update
2020-12-09 18:33 - 2020-12-09 18:34 - 000003408 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
2020-12-09 18:33 - 2020-12-09 18:34 - 000002702 _____ C:\WINDOWS\system32\Tasks\GarminUpdaterTask
2020-12-09 18:33 - 2020-12-09 18:34 - 000002676 _____ C:\WINDOWS\system32\Tasks\HPCustParticipation HP OfficeJet 3830 series
2020-12-09 18:33 - 2020-12-09 18:33 - 000003482 _____ C:\WINDOWS\system32\Tasks\Adobe Acrobat Update Task
2020-12-09 18:33 - 2020-12-09 18:33 - 000003346 _____ C:\WINDOWS\system32\Tasks\GoogleUpdateTaskMachineUA
2020-12-09 18:33 - 2020-12-09 18:33 - 000003184 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore
2020-12-09 18:33 - 2020-12-09 18:33 - 000003122 _____ C:\WINDOWS\system32\Tasks\GoogleUpdateTaskMachineCore
2020-12-09 18:33 - 2020-12-09 18:33 - 000002768 _____ C:\WINDOWS\system32\Tasks\OneDrive Standalone Update Task v2
2020-12-09 18:33 - 2020-12-09 18:33 - 000002618 _____ C:\WINDOWS\system32\Tasks\nWizard_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2020-12-09 18:33 - 2020-12-09 18:33 - 000002486 _____ C:\WINDOWS\system32\Tasks\Kaspersky_Upgrade_Launcher_{278ADC42-419D-4547-A6CA-5B74BE0AD901}
2020-12-09 18:33 - 2020-12-09 18:33 - 000002218 _____ C:\WINDOWS\system32\Tasks\CCleanerSkipUAC
2020-12-09 18:33 - 2020-12-09 18:33 - 000000000 ____D C:\WINDOWS\system32\Tasks\S-1-5-21-564737261-2307367983-4277817321-1002
2020-12-09 18:33 - 2020-12-09 18:33 - 000000000 ____D C:\WINDOWS\system32\Tasks\MEGA
2020-12-09 18:27 - 2020-12-09 18:33 - 000007623 _____ C:\WINDOWS\diagwrn.xml
2020-12-09 18:27 - 2020-12-09 18:33 - 000007623 _____ C:\WINDOWS\diagerr.xml
2020-12-09 18:19 - 2020-12-18 11:12 - 000840598 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2020-12-09 18:07 - 2020-12-18 20:30 - 000000000 ____D C:\Users\Lew Gresham
2020-12-09 18:07 - 2019-12-07 04:10 - 000001105 _____ C:\Users\Lew Gresham\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2020-12-09 18:02 - 2020-12-18 23:37 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2020-12-09 18:01 - 2020-12-18 20:16 - 000008192 ___SH C:\DumpStack.log.tmp
2020-12-09 18:01 - 2020-12-13 19:01 - 000277464 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2020-12-08 22:59 - 2020-12-08 22:59 - 000007066 _____ C:\Users\Lew Gresham\Documents\cc_20201208_225930.reg
2020-12-07 19:39 - 2020-12-09 18:34 - 000000000 ___DC C:\WINDOWS\Panther
2020-12-07 19:11 - 2020-12-07 19:11 - 000000000 ___HD C:\$WinREAgent
2020-12-07 18:42 - 2020-12-08 09:27 - 000000000 ____D C:\Users\Lew Gresham\AppData\Local\Adobe
2020-11-22 13:40 - 2020-11-22 13:40 - 000014226 _____ C:\Users\Lew Gresham\Documents\cc_20201122_134003.reg
==================== One month (modified) ==================
(If an entry is included in the fixlist, the file/folder will be moved.)
2020-12-18 23:37 - 2019-12-07 04:14 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2020-12-18 21:59 - 2018-04-15 10:01 - 000000000 ____D C:\Program Files\CCleaner
2020-12-18 20:16 - 2018-03-20 13:46 - 000000000 ____D C:\ProgramData\NVIDIA
2020-12-18 19:49 - 2018-03-25 09:48 - 018616320 _____ C:\Users\Lew Gresham\Documents\QDATA1_20060727_200608013_20120819_20120828_20120911.QDF-backup
2020-12-18 19:49 - 2018-03-22 22:58 - 018616799 _____ C:\Users\Lew Gresham\Documents\QDATA1_20060727_200608013_20120819_20120828_20120911.QDF
2020-12-18 19:44 - 2019-12-07 04:13 - 000000000 ____D C:\WINDOWS\INF
2020-12-18 19:44 - 2018-03-22 22:58 - 000000000 ____D C:\Users\Lew Gresham\Documents\BACKUP
2020-12-18 12:18 - 2019-12-07 04:14 - 000000000 ___HD C:\Program Files\WindowsApps
2020-12-18 12:18 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\AppReadiness
2020-12-18 11:05 - 2019-12-07 04:03 - 000786432 _____ C:\WINDOWS\system32\config\BBI
2020-12-18 10:53 - 2018-03-22 14:49 - 000000000 ____D C:\Users\Lew Gresham\AppData\Local\VirtualStore
2020-12-17 20:09 - 2020-08-05 11:26 - 000220160 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamChameleon.sys
2020-12-17 20:09 - 2020-04-26 07:39 - 000002040 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes.lnk
2020-12-17 20:09 - 2019-12-07 04:14 - 000000000 ___HD C:\WINDOWS\ELAMBKUP
2020-12-17 20:09 - 2019-11-01 07:39 - 000002028 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2020-12-17 20:09 - 2019-11-01 07:39 - 000002028 _____ C:\ProgramData\Desktop\Malwarebytes.lnk
2020-12-17 20:08 - 2019-11-01 07:39 - 000153312 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbae64.sys
2020-12-17 10:18 - 2018-11-08 21:09 - 000000000 ____D C:\Users\Lew Gresham\AppData\LocalLow\Temp
2020-12-17 10:18 - 2017-03-18 16:03 - 000000000 ___HD C:\WINDOWS\system32\GroupPolicy
2020-12-13 18:55 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2020-12-13 18:55 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\SystemResources
2020-12-13 18:55 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\migwiz
2020-12-13 18:55 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\Dism
2020-12-13 18:54 - 2019-12-07 04:54 - 000000000 ____D C:\Program Files\Windows Defender Advanced Threat Protection
2020-12-13 18:54 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
2020-12-13 18:54 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\bcastdvr
2020-12-13 18:54 - 2019-12-07 04:14 - 000000000 ____D C:\Program Files\Windows Defender
2020-12-13 18:54 - 2019-12-07 04:14 - 000000000 ____D C:\Program Files (x86)\Windows Defender
2020-12-13 18:43 - 2019-12-07 04:03 - 000000000 ____D C:\WINDOWS\CbsTemp
2020-12-13 09:20 - 2019-12-07 04:03 - 000000000 ____D C:\WINDOWS\servicing
2020-12-12 22:32 - 2020-05-23 00:46 - 000002428 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
2020-12-12 22:32 - 2020-05-23 00:46 - 000002266 _____ C:\Users\Public\Desktop\Microsoft Edge.lnk
2020-12-12 22:32 - 2020-05-23 00:46 - 000002266 _____ C:\ProgramData\Desktop\Microsoft Edge.lnk
2020-12-12 12:29 - 2019-12-07 04:54 - 000000000 ___SD C:\WINDOWS\system32\AppV
2020-12-12 12:29 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed
2020-12-12 12:29 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\SysWOW64\Keywords
2020-12-12 12:29 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\Sysprep
2020-12-12 12:29 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\Macromed
2020-12-12 12:29 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\Keywords
2020-12-12 12:29 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\DDFs
2020-12-12 12:29 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\ShellExperiences
2020-12-12 12:29 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\L2Schemas
2020-12-12 12:29 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\DiagTrack
2020-12-12 11:59 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\registration
2020-12-10 07:30 - 2018-03-24 20:28 - 000000000 ____D C:\Users\Lew Gresham\AppData\Local\Packages
2020-12-10 07:26 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\appcompat
2020-12-09 22:46 - 2019-12-07 04:14 - 000000000 ___RD C:\WINDOWS\PrintDialog
2020-12-09 21:01 - 2019-12-07 04:14 - 000028672 _____ C:\WINDOWS\system32\config\BCD-Template
2020-12-09 21:01 - 2019-03-18 23:52 - 000000000 ____D C:\WINDOWS\system32\Tasks_Migrated
2020-12-09 21:00 - 2020-11-16 17:21 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky VPN
2020-12-09 21:00 - 2020-11-11 19:24 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Anti-Virus
2020-12-09 21:00 - 2019-12-15 13:23 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Password Manager
2020-12-09 21:00 - 2019-12-07 04:18 - 000000000 ____D C:\WINDOWS\Setup
2020-12-09 21:00 - 2019-12-07 04:14 - 000000000 __RHD C:\Users\Public\Libraries
2020-12-09 21:00 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\WinBioDatabase
2020-12-09 21:00 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\spool
2020-12-09 21:00 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\NDF
2020-12-09 21:00 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\ServiceState
2020-12-09 21:00 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\Help
2020-12-09 21:00 - 2019-12-07 04:03 - 000008192 _____ C:\WINDOWS\system32\config\ELAM
2020-12-09 21:00 - 2019-06-19 08:33 - 000000000 ____D C:\Program Files\UNP
2020-12-09 21:00 - 2019-01-19 22:07 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TurboTax 2018
2020-12-09 21:00 - 2018-10-29 12:26 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Garmin
2020-12-09 21:00 - 2018-09-15 02:33 - 000000000 ____D C:\WINDOWS\system32\MsDtc
2020-12-09 21:00 - 2018-06-21 08:36 - 000000000 ____D C:\WINDOWS\system32\appmgmt
2020-12-09 21:00 - 2018-04-22 09:48 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2020-12-09 21:00 - 2018-04-15 10:02 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2020-12-09 21:00 - 2018-03-22 22:51 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Quicken 2012
2020-12-09 21:00 - 2018-03-22 18:29 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TurboTax 2017
2020-12-09 21:00 - 2018-03-20 13:45 - 000000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2020-12-09 20:58 - 2018-03-20 13:49 - 000000000 ____D C:\WINDOWS\system32\SRSLabs
2020-12-09 20:57 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\Resources
2020-12-09 20:57 - 2018-11-08 10:39 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
2020-12-09 20:57 - 2018-07-10 16:00 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare
2020-12-09 20:56 - 2018-05-06 09:53 - 000000000 ____D C:\Program Files\Realtek
2020-12-09 20:52 - 2019-12-07 04:54 - 000000000 ____D C:\Program Files\Windows Photo Viewer
2020-12-09 20:52 - 2019-12-07 04:54 - 000000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ___SD C:\WINDOWS\SysWOW64\F12
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ___SD C:\WINDOWS\system32\UNP
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ___SD C:\WINDOWS\system32\F12
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ___SD C:\WINDOWS\system32\DiagSvcs
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\SysWOW64\WinMetadata
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\SysWOW64\setup
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\SysWOW64\oobe
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\SysWOW64\migwiz
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\SysWOW64\Com
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\SysWOW64\AdvancedInstallers
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\WinMetadata
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\SystemResetPlatform
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\ShellExperiences
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\setup
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\PerceptionSimulation
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\es-MX
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\Com
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\appraiser
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\AdvancedInstallers
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\ShellComponents
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\Provisioning
2020-12-09 20:52 - 2019-12-07 04:14 - 000000000 ____D C:\Program Files\Common Files\System
2020-12-09 20:50 - 2019-12-07 04:54 - 000023552 _____ (Microsoft Corporation) C:\WINDOWS\system32\OEMDefaultAssociations.dll
2020-12-09 20:50 - 2019-12-07 04:54 - 000020908 _____ C:\WINDOWS\system32\OEMDefaultAssociations.xml
2020-12-09 20:29 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\SysWOW64\lv-LV
2020-12-09 20:29 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\SysWOW64\lt-LT
2020-12-09 20:29 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\SysWOW64\et-EE
2020-12-09 20:29 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\SysWOW64\es-MX
2020-12-09 20:29 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\lv-LV
2020-12-09 20:29 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\lt-LT
2020-12-09 20:29 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\et-EE
2020-12-09 18:39 - 2018-05-07 06:50 - 000002143 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2020-12-09 18:37 - 2018-06-13 17:17 - 000000000 ____D C:\ProgramData\Packages
2020-12-09 18:36 - 2018-03-24 18:08 - 000000000 ___RD C:\Users\Lew Gresham\3D Objects
2020-12-09 18:36 - 2018-03-20 13:40 - 000000000 __RHD C:\Users\Public\AccountPictures
2020-12-09 18:35 - 2019-12-07 04:14 - 000000000 ____D C:\ProgramData\USOPrivate
2020-12-09 18:34 - 2019-12-07 04:14 - 000000000 ____D C:\WINDOWS\system32\oobe
2020-12-09 18:15 - 2018-03-22 23:11 - 000002308 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2020-12-09 18:15 - 2018-03-22 23:11 - 000002267 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2020-12-09 18:15 - 2018-03-22 23:11 - 000002267 _____ C:\ProgramData\Desktop\Google Chrome.lnk
2020-12-09 18:10 - 2018-11-02 15:36 - 000000000 ____D C:\Users\Lew Gresham\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Balabolka
2020-12-09 18:06 - 2018-03-20 15:17 - 000000000 ____D C:\Temp
2020-12-09 18:06 - 2018-03-20 13:49 - 000000000 ____D C:\WINDOWS\SysWOW64\RTCOM
2020-12-09 18:05 - 2018-03-20 13:45 - 000000000 ____D C:\Program Files\NVIDIA Corporation
2020-11-20 20:10 - 2020-09-30 23:20 - 000000000 ____D C:\Program Files\Microsoft Update Health Tools
2020-11-19 10:13 - 2018-03-27 12:14 - 000000000 ____D C:\ProgramData\Kaspersky Lab
==================== SigCheck ============================
(There is no automatic fix for files that do not pass verification.)
==================== End of FRST.txt ========================
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 14-12-2020
Ran by [removed] (18-12-2020 23:50:14)
Running from C:\Users\[removed]\Desktop
Windows 10 Pro Version 2004 19041.685 (X64) (2020-12-09 23:34:50)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-564737261-2307367983-4277817321-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-564737261-2307367983-4277817321-503 - Limited - Disabled)
Guest (S-1-5-21-564737261-2307367983-4277817321-501 - Limited - Disabled)
Lew Gresham (S-1-5-21-564737261-2307367983-4277817321-1002 - Administrator - Enabled) => C:\Users\Lew Gresham
WDAGUtilityAccount (S-1-5-21-564737261-2307367983-4277817321-504 - Limited - Disabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Kaspersky Anti-Virus (Enabled - Up to date) {0AB30972-4BAC-7BEE-CBCA-B8F9E68797D8}
AS: Kaspersky Anti-Virus (Enabled - Up to date) {B1D2E896-6D96-7460-F17A-838B9D00DD65}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Acrobat Reader DC (HKLM-x32\…\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 20.013.20074 - Adobe Systems Incorporated)
ANT Drivers Installer x64 (HKLM\…\{9A9FF300-3725-4934-A0D7-86F109A88ACF}) (Version: 2.3.4 - Garmin Ltd or its subsidiaries) Hidden
Balabolka (HKLM-x32\…\Balabolka) (Version: 2.14.0.677 - Ilya Morozov)
CCleaner (HKLM\…\CCleaner) (Version: 5.75 - Piriform)
Elevated Installer (HKLM-x32\…\{9427DAC2-91FD-418E-87D4-8914B437CC06}) (Version: 6.21.0.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin BaseCamp (HKLM-x32\…\{1ac25e24-a380-4f68-bb3c-f9b1d7cdb2df}) (Version: 4.7.0.0 - Garmin Ltd or its subsidiaries)
Garmin BaseCamp (HKLM-x32\…\{3B93218E-3D19-4063-A578-2722B8C4E161}) (Version: 4.7.0.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin City Navigator North America NT 2019.30 (HKLM-x32\…\{7641E1DF-801E-483D-86E9-6A546EC801E9}) (Version: 2.0.0.0 - Garmin Ltd or its subsidiaries)
Garmin Express (HKLM-x32\…\{0934EADA-3DAF-4A21-829D-1BB3C315DCB4}) (Version: 6.21.0.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin Express (HKLM-x32\…\{d3b4366e-9163-44f4-a381-d431031c2841}) (Version: 6.21.0.0 - Garmin Ltd or its subsidiaries)
Garmin POI Loader (HKLM-x32\…\{68ca17aa-815c-4a71-8894-39e537ecb526}) (Version: 2.7.3 - Garmin Ltd or its subsidiaries)
Garmin POILoader (HKLM-x32\…\{9EC5D99E-F5E5-4B88-AAAC-EA810E52CD4A}) (Version: 2.7.3 - Garmin Ltd or its subsidiaries) Hidden
Garmin USB Drivers (HKLM-x32\…\{3D5D6CFC-3097-425A-8D8F-7EAF5D57641D}) (Version: 2.3.1.0 - Garmin Ltd or its subsidiaries)
Google Chrome (HKLM-x32\…\Google Chrome) (Version: 87.0.4280.88 - Google LLC)
Google Update Helper (HKLM-x32\…\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.36.51 - Google LLC) Hidden
Google Update Helper (HKLM-x32\…\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.21.123 - Google Inc.) Hidden
HP Dropbox Plugin (HKLM-x32\…\{D12BC084-97D6-438A-AA7C-5962608D17A0}) (Version: 36.0.41.58587 - HP)
HP Google Drive Plugin (HKLM-x32\…\{BFA42100-DB54-467A-BB87-CF70732B4065}) (Version: 36.0.41.58587 - HP)
HP OfficeJet 3830 series Basic Device Software (HKLM\…\{165CDB14-4CD3-4D4D-A38A-3FF93FAAFD5C}) (Version: 40.11.1119.1786 - HP Inc.)
HP OfficeJet 3830 series Help (HKLM-x32\…\{1FCCD112-2F27-463D-8C36-1D5C29A3BB3E}) (Version: 35.0.0 - Hewlett Packard)
HP Photo Creations (HKLM-x32\…\HP Photo Creations) (Version: 1.0.0.9572 - HP)
iSEEK AnswerWorks English Runtime (HKLM-x32\…\{18A8E78B-9EF2-496E-B310-BCD8E4C1DAB3}) (Version: [removed] - Vantage Linguistics)
Kaspersky Anti-Virus (HKLM-x32\…\{0124CD8C-8A9A-4A95-BF8C-F084040A93CE}) (Version: 21.1.15.500 - Kaspersky) Hidden
Kaspersky Anti-Virus (HKLM-x32\…\InstallWIX_{0124CD8C-8A9A-4A95-BF8C-F084040A93CE}) (Version: 21.1.15.500 - Kaspersky)
Kaspersky Password Manager (HKLM-x32\…\{B2F7333E-6C8D-4994-AAC4-FEC8EBBF9611}) (Version: 9.0.2.767 - Kaspersky Lab) Hidden
Kaspersky Password Manager (HKLM-x32\…\InstallWIX_{B2F7333E-6C8D-4994-AAC4-FEC8EBBF9611}) (Version: 9.0.2.767 - Kaspersky Lab)
Kaspersky VPN (HKLM-x32\…\{221FA56C-0A92-4E58-98FD-CAF82237540C}) (Version: 21.2.16.590 - Kaspersky) Hidden
Kaspersky VPN (HKLM-x32\…\InstallWIX_{221FA56C-0A92-4E58-98FD-CAF82237540C}) (Version: 21.2.16.590 - Kaspersky)
Malwarebytes version 4.3.0.98 (HKLM\…\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 4.3.0.98 - Malwarebytes)
Microsoft Edge (HKLM-x32\…\Microsoft Edge) (Version: 87.0.664.60 - Microsoft Corporation)
Microsoft Edge Update (HKLM-x32\…\Microsoft Edge Update) (Version: 1.3.139.59 - )
Microsoft Update Health Tools (HKLM\…\{0BCA8FBE-0C1C-4C65-98A3-5D34AAF41737}) (Version: 2.70.0.0 - Microsoft Corporation)
Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.23.27820 (HKLM-x32\…\{45231ab4-69fd-486a-859d-7a59fcd11013}) (Version: 14.23.27820.0 - Microsoft Corporation)
NVIDIA nView 148.47 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView) (Version: 148.47 - NVIDIA Corporation)
NVIDIA WMI 2.29.0 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVWMI) (Version: 2.29.0 - NVIDIA Corporation)
Product Improvement Study for HP OfficeJet 3830 series (HKLM\…\{F1E13468-92EB-4AB7-8F1C-CC09A286C9B9}) (Version: 40.11.1119.1786 - HP Inc.)
Quicken 2012 (HKLM-x32\…\{0A1E0BDA-5E8F-436d-8BE5-7E97C5CB899D}) (Version: 21.1.2.12 - Intuit)
Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.8186 - Realtek Semiconductor Corp.)
Synamedia VideoGuard Player (HKLM-x32\…\{c04440a1-d5cb-4d2e-9a36-c3b8266b3f7c}) (Version: 13.0 - Synamedia)
TurboTax 2017 (HKLM-x32\…\TurboTax 2017) (Version: 2017.0 - Intuit, Inc)
TurboTax 2018 (HKLM-x32\…\TurboTax 2018) (Version: 2018.0 - Intuit, Inc)
UpdateAssistant (HKLM\…\{B8B01E04-5393-4902-98E6-0E2787F03C80}) (Version: 1.13.0.0 - Microsoft Corporation) Hidden
VLC media player (HKLM-x32\…\VLC media player) (Version: 3.0.4 - VideoLAN)
Vulkan Run Time Libraries 1.0.26.0 (HKLM\…\VulkanRT1.0.26.0) (Version: 1.0.26.0 - LunarG, Inc.)
Windows Driver Package - Dynastream Innovations, Inc. ANT LibUSB Drivers (04/11/2012 1.2.40.201) (HKLM\…\F9D2A789F9CFF8CEC36B544F53877C80F1F73C46) (Version: 04/11/2012 1.2.40.201 - Dynastream Innovations, Inc.)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (04/19/2012 2.3.1.0) (HKLM\…\98157A226B40B173301B0F53C8E98C47805D5152) (Version: 04/19/2012 2.3.1.0 - Garmin)
Windows Driver Package - Silicon Labs Software (DSI_SiUSBXp_3_1) USB (02/06/2007 3.1) (HKLM\…\D1506E0025B5A3F9EB8270FE81C1EEDD9388B8A2) (Version: 02/06/2007 3.1 - Silicon Labs Software)
Windows Setup Remediations (x64) (KB4023057) (HKLM\…\{5534e02f-0f5d-40dd-ba92-bea38d22384d}.sdb) (Version: - )
Wondershare Helper Compact 2.5.2 (HKLM-x32\…\{5363CE84-5F09-48A1-8B6C-6BB590FFEDF2}_is1) (Version: 2.5.2 - Wondershare)
Wondershare Recoverit(Build 7.1.4.2) (HKLM-x32\…\{829555DC-31E5-4FEA-B350-8FCF24CECD95}_is1) (Version: 7.1.4.2 - Wondershare Software Co.,Ltd.)
Packages:
=========
Amazon Alexa -> C:\Program Files\WindowsApps\57540AMZNMobileLLC.AmazonAlexa_3.1.663.0_x64__22t9g3sebte08 [2020-12-16] (AMZN Mobile LLC.) [Startup Task]
Autodesk SketchBook -> C:\Program Files\WindowsApps\89006A2E.AutodeskSketchBook_5.1.0.0_x64__tf1gferkr813w [2020-12-12] (Autodesk Inc.)
Bubble Witch 3 Saga -> C:\Program Files\WindowsApps\king.com.BubbleWitch3Saga_7.1.17.0_x86__kgqvnymyfvs32 [2020-12-17] (king.com)
Disney Magic Kingdoms -> C:\Program Files\WindowsApps\A278AB0D.DisneyMagicKingdoms_5.6.10.0_x86__h6adky7gbf63m [2020-12-17] (Gameloft SE)
Dolby Access -> C:\Program Files\WindowsApps\DolbyLaboratories.DolbyAccess_3.6.413.0_x64__rz1tebttyb220 [2020-12-12] (Dolby Laboratories)
GT Racing 2: The Real Car Experience -> C:\Program Files\WindowsApps\GAMELOFTSA.GTRacing2TheRealCarExperience_1.2.8.1_x86__0pp20fcewvvtj [2020-12-12] (GAMELOFT SA)
Honey -> C:\Program Files\WindowsApps\HoneyScienceCorporation.Honey_11.4.2.0_neutral__cbe4c63gm1mzr [2020-12-12] (Honey Science Corporation)
HP Smart -> C:\Program Files\WindowsApps\AD2F1837.HPPrinterControl_122.1.778.0_x64__v10z8vjag6ke6 [2020-12-18] (HP Inc.)
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe [2020-12-12] (Microsoft Corporation) [MS Ad]
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x64__8wekyb3d8bbwe [2020-12-12] (Microsoft Corporation) [MS Ad]
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x86__8wekyb3d8bbwe [2020-12-12] (Microsoft Corporation) [MS Ad]
Microsoft Solitaire Collection -> C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.7.10142.0_x64__8wekyb3d8bbwe [2020-12-12] (Microsoft Studios) [MS Ad]
Netflix -> C:\Program Files\WindowsApps\4DF9E0F8.Netflix_6.97.752.0_x64__mcm4njqhnhss8 [2020-12-12] (Netflix, Inc.)
Photos Add-on -> C:\Program Files\WindowsApps\Microsoft.Windows.Photos.DLC.Main_2017.39121.36610.0_x64__8wekyb3d8bbwe [2020-12-12] (Microsoft Corporation)
Photos Media Engine Add-on -> C:\Program Files\WindowsApps\Microsoft.Photos.MediaEngineDLC_1.0.0.0_x64__8wekyb3d8bbwe [2020-12-12] (Microsoft Corporation)
Plex -> C:\Program Files\WindowsApps\CAF9E577.Plex_3.2.20.0_x64__aam28m9va5cke [2020-12-12] (Plex)
Shoppr for Walmart -> C:\Program Files\WindowsApps\7697Busams.ShopprforWalmart_1.5.0.3_x64__s9xzztvb898st [2020-12-12] (AppSplice)
Spotify Music -> C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.148.625.0_x86__zpdnekdrzrea0 [2020-12-12] (Spotify AB) [Startup Task]
Twitter -> C:\Program Files\WindowsApps\9E2F88E3.Twitter_6.1.4.1000_neutral__wgeqdkkx372wm [2020-12-12] (Twitter Inc.)
==================== Custom CLSID (Whitelisted): ==============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
ContextMenuHandlers1: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => -> No File
ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => -> No File
ContextMenuHandlers1: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} => -> No File
ContextMenuHandlers1: [Balabolka] -> {6CB83A5A-AA68-4895-9F54-175E789AE149} => C:\Program Files (x86)\Balabolka\BFileExt.dll [2017-06-09] (Ilya Morozov) [File not signed]
ContextMenuHandlers1: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} => -> No File
ContextMenuHandlers1: [Kaspersky Anti-Virus 21.1] -> {091EC05A-4A09-4108-8D41-F7B1078DAA9E} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 21.1\x64\shellex.dll [2020-11-07] (Kaspersky Lab -> AO Kaspersky Lab)
ContextMenuHandlers2: [Kaspersky Anti-Virus 21.1] -> {091EC05A-4A09-4108-8D41-F7B1078DAA9E} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 21.1\x64\shellex.dll [2020-11-07] (Kaspersky Lab -> AO Kaspersky Lab)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2019-06-26] (Malwarebytes Corporation -> Malwarebytes)
ContextMenuHandlers3: [{4A7C4306-57E0-4C0C-83A9-78C1528F618C}] -> {4A7C4306-57E0-4C0C-83A9-78C1528F618C} => -> No File
ContextMenuHandlers4: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => -> No File
ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => -> No File
ContextMenuHandlers4: [Kaspersky Anti-Virus 21.1] -> {091EC05A-4A09-4108-8D41-F7B1078DAA9E} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 21.1\x64\shellex.dll [2020-11-07] (Kaspersky Lab -> AO Kaspersky Lab)
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\WINDOWS\system32\nvshext.dll [2016-08-01] (NVIDIA Corporation -> NVIDIA Corporation)
ContextMenuHandlers6: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} => -> No File
ContextMenuHandlers6: [Kaspersky Anti-Virus 21.1] -> {091EC05A-4A09-4108-8D41-F7B1078DAA9E} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 21.1\x64\shellex.dll [2020-11-07] (Kaspersky Lab -> AO Kaspersky Lab)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2019-06-26] (Malwarebytes Corporation -> Malwarebytes)
==================== Codecs (Whitelisted) ====================
==================== Shortcuts & WMI ========================
==================== Loaded Modules (Whitelisted) =============
2020-12-16 10:40 - 2020-12-16 10:40 - 067054080 _____ () [File not signed] C:\Program Files\WindowsApps\57540AMZNMobileLLC.AmazonAlexa_3.1.663.0_x64__22t9g3sebte08\Alexa.dll
2019-01-31 19:12 - 2019-01-31 19:12 - 000948736 _____ () [File not signed] C:\Program Files\WindowsApps\57540AMZNMobileLLC.AmazonAlexa_3.1.663.0_x64__22t9g3sebte08\e_sqlite3.dll
2020-11-07 11:08 - 2020-11-07 11:09 - 000129536 _____ () [File not signed] C:\Program Files\WindowsApps\57540AMZNMobileLLC.AmazonAlexa_3.1.663.0_x64__22t9g3sebte08\libpryon_lite.dll
2020-12-16 10:40 - 2020-12-16 10:40 - 008084588 _____ () [File not signed] C:\Program Files\WindowsApps\57540AMZNMobileLLC.AmazonAlexa_3.1.663.0_x64__22t9g3sebte08\NativeRingService.dll
2017-06-09 10:37 - 2017-06-09 10:37 - 000369664 _____ (Ilya Morozov) [File not signed] C:\Program Files (x86)\Balabolka\BFileExt.dll
2020-11-07 11:08 - 2020-11-07 11:09 - 000297265 _____ (MingW-W64 Project. All rights reserved.) [File not signed] C:\Program Files\WindowsApps\57540AMZNMobileLLC.AmazonAlexa_3.1.663.0_x64__22t9g3sebte08\libwinpthread-1.dll
2018-07-10 16:00 - 2017-09-27 16:30 - 000489984 _____ (Newtonsoft) [File not signed] [File is in use] C:\Program Files (x86)\Wondershare\WAF\2.4.3.233\Newtonsoft.Json.dll
2020-05-14 22:23 - 2020-05-14 22:23 - 000266752 _____ (Un4seen Developments) [File not signed] C:\Program Files\WindowsApps\57540AMZNMobileLLC.AmazonAlexa_3.1.663.0_x64__22t9g3sebte08\bass.dll
2020-05-14 22:23 - 2020-05-14 22:23 - 000112640 _____ (Un4seen Developments) [File not signed] C:\Program Files\WindowsApps\57540AMZNMobileLLC.AmazonAlexa_3.1.663.0_x64__22t9g3sebte08\bassmidi.dll
2020-05-14 22:23 - 2020-05-14 22:23 - 000045056 _____ (Un4seen Developments) [File not signed] C:\Program Files\WindowsApps\57540AMZNMobileLLC.AmazonAlexa_3.1.663.0_x64__22t9g3sebte08\bassmix.dll
2018-07-10 16:00 - 2017-11-07 15:37 - 000088064 _____ (Wondershare) [File not signed] [File is in use] C:\Program Files (x86)\Wondershare\WAF\2.4.3.233\WsAppCollect.dll
2018-07-10 16:00 - 2017-11-07 15:37 - 000200192 _____ (Wondershare) [File not signed] [File is in use] C:\Program Files (x86)\Wondershare\WAF\2.4.3.233\WsAppCommon.dll
==================== Alternate Data Streams (Whitelisted) ========
==================== Safe Mode (Whitelisted) ==================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
==================== Association (Whitelisted) =================
==================== Internet Explorer (Whitelisted) ==========
HKU\S-1-5-21-564737261-2307367983-4277817321-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://go.microsoft.com/fwlink/p/?LinkId=619797&pc;=UE01&ocid;=UE01DHP
==================== Hosts content: =========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2017-03-18 16:03 - 2017-03-18 16:01 - 000000824 _____ C:\WINDOWS\system32\drivers\etc\hosts
==================== Other Areas ===========================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-564737261-2307367983-4277817321-1002\Control Panel\Desktop\\Wallpaper ->
DNS Servers: 75.75.75.75 - 75.75.76.76
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: )
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
(If an entry is included in the fixlist, it will be removed.)
HKLM\…\StartupApproved\Run: => "RTHDVCPL"
HKU\S-1-5-21-564737261-2307367983-4277817321-1002\…\StartupApproved\Run: => "CCleaner Monitoring"
HKU\S-1-5-21-564737261-2307367983-4277817321-1002\…\StartupApproved\Run: => "GarminExpressTrayApp"
HKU\S-1-5-21-564737261-2307367983-4277817321-1002\…\StartupApproved\Run: => "CCleaner Smart Cleaning"
HKU\S-1-5-21-564737261-2307367983-4277817321-1002\…\StartupApproved\Run: => "GarminExpress"
HKU\S-1-5-21-564737261-2307367983-4277817321-1002\…\StartupApproved\Run: => "VideoGuardMonitor"
HKU\S-1-5-21-564737261-2307367983-4277817321-1002\…\StartupApproved\Run: => "Application Restart #1"
==================== FirewallRules (Whitelisted) ================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{D55E0DBC-FC09-4863-BD8F-73554763C61F}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google LLC)
FirewallRules: [{49EA8514-6C3C-44A0-A642-66DAA106DF1D}] => (Allow) C:\Program Files\HP\HP OfficeJet 3830 series\Bin\HPNetworkCommunicatorCom.exe (Hewlett Packard -> HP Inc.)
FirewallRules: [{2F29A425-0D45-4426-B4EA-A8EC19B52A7E}] => (Allow) LPort=5357
FirewallRules: [{DEAF244C-795C-4766-8983-18A54F40989B}] => (Allow) C:\Program Files\HP\HP OfficeJet 3830 series\Bin\DeviceSetup.exe (Hewlett Packard -> HP Inc.)
FirewallRules: [{1965DB09-5827-4EF7-847C-2D32CA40B9D3}] => (Allow) C:\Program Files\HP\HP OfficeJet 3830 series\bin\FaxPrinterUtility.exe (Hewlett Packard -> HP Inc.)
FirewallRules: [{5FBF6071-14C3-4402-AE05-F1822911FFF1}] => (Allow) C:\Program Files\HP\HP OfficeJet 3830 series\bin\SendAFax.exe (Hewlett Packard -> HP Inc.)
FirewallRules: [{AA2E625B-CB1C-426B-9BE8-05EDE1EA0155}] => (Allow) C:\Program Files\HP\HP OfficeJet 3830 series\bin\DigitalWizards.exe (Hewlett Packard -> HP Inc.)
FirewallRules: [{3E912DA9-4915-41FD-91CC-03ABC9433BE1}] => (Allow) C:\Program Files\HP\HP OfficeJet 3830 series\bin\FaxApplications.exe (Hewlett Packard -> HP Inc.)
FirewallRules: [{91DC82EE-03DA-419F-8AFC-1E945F0EE073}] => (Allow) C:\Program Files\CCleaner\CCUpdate.exe (Piriform Software Ltd -> Piriform Software Ltd)
FirewallRules: [{A01B3BA0-6282-48C9-B867-786B6E7FD98A}] => (Allow) C:\Program Files\CCleaner\CCUpdate.exe (Piriform Software Ltd -> Piriform Software Ltd)
FirewallRules: [{3419F108-0B85-41B3-95E2-3F92A10AE3BC}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdater.exe (Intuit, Inc. -> Intuit Inc.)
FirewallRules: [{56F6EE0E-F9AD-4BBA-B91B-07872D66233E}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe (Intuit, Inc. -> Intuit Inc.)
FirewallRules: [{5D1E49EA-7D0A-4214-B1BC-ED4B75A1302E}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe (Intuit, Inc. -> Intuit Inc.)
FirewallRules: [{DE05C282-08B0-436C-A3E9-F11A90383F43}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe (Intuit, Inc. -> Intuit Inc.)
FirewallRules: [{CE6FAE35-BFEB-4C36-9974-C96F00B06C0F}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe (Intuit, Inc. -> Intuit Inc.)
FirewallRules: [{DB6AF0F4-4AFB-4A4C-A962-B7196BABC9CF}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe (Intuit, Inc. -> Intuit Inc.)
FirewallRules: [{86CFD8F0-2834-466E-9F7C-392878AC10A3}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.148.625.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{B6A53756-38BB-4CBF-AEB3-0A8A7381A133}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.148.625.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{0EE08071-C32B-49FF-8BC5-B6403CEB3F9E}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.148.625.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{E4092711-B85A-445C-B1CD-FC350374F648}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.148.625.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{2C52360D-7F3B-404A-87AA-44605C5019C9}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.148.625.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{91DEBA85-A795-4CB9-B27F-E8F8E5BB89DA}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.148.625.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{89D2AF33-16D2-42C9-A7DF-C610E93428C4}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.148.625.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{CD1D31E6-4B9D-4F84-8025-1288C0BFECF2}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.148.625.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{006616B5-0F76-4EB3-878E-A220A3345B1A}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.67.96.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)
FirewallRules: [{C53B4CAC-1A77-4281-BA0E-7ADDDDE122DF}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.67.96.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)
FirewallRules: [{3CF3DDC2-0472-4D6C-B053-B1B3759636AC}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.67.96.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)
FirewallRules: [{50C80B16-98C7-4DEB-974F-E7F6FD7C48A2}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.67.96.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)
==================== Restore Points =========================
18-12-2020 18:44:58 Scheduled Checkpoint
==================== Faulty Device Manager Devices ============
Name: Microsoft PS/2 Mouse
Description: Microsoft PS/2 Mouse
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
Name: Standard PS/2 Keyboard
Description: Standard PS/2 Keyboard
Class Guid: {4d36e96b-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standard keyboards)
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
==================== Event log errors: ========================
Application errors:
==================
Error: (12/18/2020 10:09:05 PM) (Source: Microsoft-Windows-Defrag) (EventID: 264) (User: )
Description: The storage optimizer couldn't complete retrim on Windows (C:) because: The operation requested is not supported by the hardware backing the volume. (0x8900002A)
Error: (12/18/2020 08:16:58 PM) (Source: MBAMIService) (EventID: 0) (User: )
Description: Event-ID 0
Error: (12/18/2020 08:16:58 PM) (Source: MBAMIService) (EventID: 0) (User: )
Description: Event-ID 0
Error: (12/18/2020 11:06:11 AM) (Source: MBAMIService) (EventID: 0) (User: )
Description: Event-ID 0
Error: (12/18/2020 11:06:11 AM) (Source: MBAMIService) (EventID: 0) (User: )
Description: Event-ID 0
Error: (12/18/2020 09:36:20 AM) (Source: Microsoft-Windows-Defrag) (EventID: 264) (User: )
Description: The storage optimizer couldn't complete retrim on Windows (C:) because: The operation requested is not supported by the hardware backing the volume. (0x8900002A)
Error: (12/18/2020 09:26:23 AM) (Source: Microsoft-Windows-Defrag) (EventID: 264) (User: )
Description: The storage optimizer couldn't complete retrim on System Reserved because: The operation requested is not supported by the hardware backing the volume. (0x8900002A)
Error: (12/18/2020 09:22:19 AM) (Source: Microsoft-Windows-Defrag) (EventID: 264) (User: )
Description: The storage optimizer couldn't complete retrim on System Reserved because: The operation requested is not supported by the hardware backing the volume. (0x8900002A)
System errors:
=============
Error: (12/18/2020 08:16:44 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 7:48:09 PM on 12/18/2020 was unexpected.
Error: (12/18/2020 03:04:20 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The eapihdrv service failed to start due to the following error:
This driver has been blocked from loading
Error: (12/18/2020 03:04:20 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\LEWGRE~1\AppData\Local\Temp\ehdrv.sys
Error: (12/18/2020 03:04:20 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The eapihdrv service failed to start due to the following error:
This driver has been blocked from loading
Error: (12/18/2020 03:04:20 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\LEWGRE~1\AppData\Local\Temp\ehdrv.sys
Error: (12/18/2020 03:04:20 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The eapihdrv service failed to start due to the following error:
This driver has been blocked from loading
Error: (12/18/2020 03:04:20 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\LEWGRE~1\AppData\Local\Temp\ehdrv.sys
Error: (12/18/2020 03:04:19 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The eapihdrv service failed to start due to the following error:
This driver has been blocked from loading
CodeIntegrity:
===================================
Date: 2020-12-18 20:19:38.6140000Z
Description:
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 21.1\x64\antimalware_provider.dll that did not meet the Windows signing level requirements.
Date: 2020-12-18 20:19:37.3570000Z
Description:
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 21.1\x64\antimalware_provider.dll that did not meet the Windows signing level requirements.
Date: 2020-12-18 20:19:37.3290000Z
Description:
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 21.1\x64\antimalware_provider.dll that did not meet the Windows signing level requirements.
Date: 2020-12-18 20:17:37.1800000Z
Description:
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\SIHClient.exe) attempted to load \Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 21.1\x64\antimalware_provider.dll that did not meet the Windows signing level requirements.
Date: 2020-12-18 20:17:37.1620000Z
Description:
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\SIHClient.exe) attempted to load \Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 21.1\x64\antimalware_provider.dll that did not meet the Windows signing level requirements.
Date: 2020-12-18 20:17:37.1410000Z
Description:
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\SIHClient.exe) attempted to load \Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 21.1\x64\antimalware_provider.dll that did not meet the Windows signing level requirements.
Date: 2020-12-18 20:17:37.1230000Z
Description:
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\SIHClient.exe) attempted to load \Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 21.1\x64\antimalware_provider.dll that did not meet the Windows signing level requirements.
Date: 2020-12-18 20:17:35.2460000Z
Description:
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\SIHClient.exe) attempted to load \Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 21.1\x64\antimalware_provider.dll that did not meet the Windows signing level requirements.
==================== Memory info ===========================
BIOS: Hewlett-Packard J61 v03.06 03/27/2013
Motherboard: Hewlett-Packard 1589
Processor: Intel(R) Xeon(R) CPU E5-1603 0 @ 2.80GHz
Percentage of memory in use: 49%
Total physical RAM: 8115.6 MB
Available physical RAM: 4085.3 MB
Total Virtual: 9395.6 MB
Available Virtual: 4899.74 MB
==================== Drives ================================
Drive c: (Windows) (Fixed) (Total:921.71 GB) (Free:822.07 GB) NTFS
Drive d: (Desktop Favorite) (CDROM) (Total:0.2 GB) (Free:0 GB) CDFS
\\?\Volume{f17540bb-0000-0000-0000-100000000000}\ (System Reserved) (Fixed) (Total:0.49 GB) (Free:0.45 GB) NTFS
\\?\Volume{f17540bb-0000-0000-0000-e08ce6000000}\ (Recovery) (Fixed) (Total:9.31 GB) (Free:8.85 GB) NTFS
==================== MBR & Partition Table ====================
==========================================================
Disk: 0 (MBR Code: Windows 7/8/10) (Size: 931.5 GB) (Disk ID: F17540BB)
Partition 1: (Active) - (Size=499 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=921.7 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=9.3 GB) - (Type=27)
==================== End of Addition.txt =======================
Lewg
I did away with the hard wired mouse and now using a wireless. Should have done it sometime ago. Annoying wire! I think everything is going to be OK now with the wireless mouse. Let's see!
Satchfan
I think everything is going to be OK now with the wireless mouse.
Good.
Your computer appears to be clean. Now that it seems to be running well, let’s tidy up
Run KpRm
Download KpRm by kernel-panik and save it to your desktop.
- right-click kprm.exe and select Run as Administrator
- put a check mark next to these items:
Delete tools
Delete Now
- click Run.
- when it has finished, it will create and open a log and then delete itself.
===================================================
Recommended
Update and run Malwarebytes. This really is an excellent program that you should update and run on a regular basis, probably weekly.
===================================================
I also recommend that you read the following:
Simple and easy ways to keep your computer safe and secure on the Internet by Lawrence Abrams
Answers to Common Security Questions - Best Practices by quietman7
I will keep this open for 24 hours in case you have any problems with the mouse, after which I’ll close the topic.
Safe computing
Satchfan
Lewg
All completed as you requested. Thanks for all the help. Hope you have a Merry Christmas and the best New Year. Gotta get to the UK at some point in time. However this VIrus is stopping many from traveling, like me. If you ever want to visit America….Got a nice house on the SE coast of Georgia it's St Simons Island.
Lew
Satchfan
Thanks for the good wishes and have a Merry Christmas and a great New Year yourself.
I doubt I'll visit America as I hate flying but it was a lovely thought.
Take care and stay healthy.
Nina (Satchfan)
Satchfan
I've just noticed a few Eset entries which need to be removed so that there is no conflict with your antivirus.
Please delete these in File Explorer:
C:\Users\Lew Gresham\Downloads\esetonlinescanner.exe
C:\Users\Lew Gresham\Desktop\ESET Online Scanner.lnk
C:\Users\Lew Gresham\AppData\Local\ESET
C:\Users\Lew Gresham\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ESET Online Scanner.lnk
If you have a problem, I'll send a batch file to delete them, (rather than downloading FRST again).
Lewg
I prefer a batch file to delete them. Thanks!
Satchfan
Here you go:
Please copy all text in the code box below and paste it into Notepad:
@echo off del /f /s /q "C:\Users\Lew Gresham\Downloads\esetonlinescanner.exe” del /f /s /q “C:\Users\Lew Gresham\Desktop\ESET Online Scanner.lnk” del /f /s /q "C:\Users\Lew Gresham\AppData\Local\ESET” del /f /s /q "C:\Users\Lew Gresham\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ESET Online Scanner.lnk” del %0
- save the Notepad file to your desktop and name it delfiles.bat
- save type as 'All Files'
- on your desktop, double-click on delfiles.bat to run it, (a black CMD window will flash, then disappear - this is normal).
The files/folders, if found, will have been deleted and the "delfile.bat" file will also be deleted.
Lewg
Ran the bat file, apparently all was deleted earlier since the bat file did not find any.
Satchfan
the bat file did not find any.
It was the .bat file that deleted them.
Lewg
We are all done. Wireless mouse is the ticket! All good now. Keeping my fingers and eyes crossed. 
Silver Member Lew
Satchfan
I'm pleased that you're pleased. 
Satchfan
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI