Serveur d'impression

Après le téléchargement accidentel d'un malware, l'ordinateur n'est plus le même – Bien choisir son serveur d impression

Par Titanfall , le 13 juin 2020 - 75 minutes de lecture

J'ai cliqué sur un lien que je ne devrais pas avoir vu, j'ai vu les URL changer rapidement et j'ai immédiatement fermé la fenêtre. Une semaine plus tard, mon logiciel parental m'a signalé qu'il essayait de visiter des sites Web pornographiques 100 fois en une minute. J'ai téléchargé des octets malveillants premium et supprimé 2 fichiers, un PUP.Optional.InstallCore dans mon registre et un fichier générique de malware appelé $ RFHLJ6G.EXE dans ma corbeille. J'ai également installé symantec qui ne signalait rien sauf mon pirate de processus. Dans les jours suivants, mon malwarebytes nouvellement installé me dit que le logiciel parental visite plusieurs fois des sites Web malveillants via le fichier proxy, et je scanne mais rien ne vient. Mon ordinateur portable a été extrêmement lent et surchauffe pour une raison inconnue, les programmes malveillants ne détectent rien et le gestionnaire de tâches dit que rien ne va pas. Je suis presque prêt à simplement réinitialiser les paramètres d'usine. Voici mes journaux:

Résultat de l'analyse de Farbar Recovery Scan Tool (FRST) (x64) Version: 06-06-2020

Ran by Ethan (ATTENTION: L'utilisateur n'est pas administrateur) sur ETHANLAPTOP (HUAWEI KPL-W0X) (13-06-2020 05:42:15)

Exécution à partir de C: Users Ethan Desktop

Profils chargés: Ethan

Plateforme: Windows 10 Home Version 1809 17763.1217 (X64) Langue: anglais (États-Unis)

Navigateur par défaut: Chrome

Mode de démarrage: Normal

==================== Processus (liste blanche) =================

(Si une entrée est incluse dans la liste de correctifs, le processus sera fermé. Le fichier ne sera pas déplacé.)

(Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.) C: Program Files AMD CNext CNext amdow.exe

(Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.) C: Program Files AMD CNext CNext AMDRSServ.exe

(Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.) C: Program Files AMD CNext CNext RadeonSoftware.exe

(Google LLC -> Google LLC) C: Program Files (x86) Google Chrome Application chrome.exe <21>

(Malwarebytes Inc -> Malwarebytes) C: Program Files Malwarebytes Anti-Malware mbamtray.exe

(Microsoft Corporation -> Microsoft Corporation) C: Windows SystemApps Microsoft.MicrosoftEdge_8wekyb3d8bbwe MicrosoftEdge.exe

(Microsoft Corporation) C: Program Files WindowsApps Microsoft.WindowsCalculator_10.1910.0.0_x64__8wekyb3d8bbwe Calculator.exe

(Microsoft Corporation) C: Program Files WindowsApps Microsoft.WindowsStore_12006.1001.1.0_x64__8wekyb3d8bbwe WinStore.App.exe

(Microsoft Windows -> Microsoft Corporation) C: Windows ImmersiveControlPanel SystemSettings.exe

(Microsoft Windows -> Microsoft Corporation) C: Windows System32 browser_broker.exe

(Microsoft Windows -> Microsoft Corporation) C: Windows System32 CastSrv.exe

(Microsoft Windows -> Microsoft Corporation) C: Windows System32 dllhost.exe

(Microsoft Windows -> Microsoft Corporation) C: Windows System32 MicrosoftEdgeCP.exe

(Microsoft Windows -> Microsoft Corporation) C: Windows System32 MicrosoftEdgeSH.exe

(Microsoft Windows -> Microsoft Corporation) C: Windows System32 rundll32.exe

(Microsoft Windows -> Microsoft Corporation) C: Windows System32 smartscreen.exe

(Oracle America, Inc. -> Oracle Corporation) C: Program Files (x86) Common Files Java Java Update jusched.exe

(Qustodio Technologies, SL ->) C: Program Files (x86) Qustodio qapp crashpad_handler.exe

(Qustodio Technologies, SL -> Qustodio Technologies) C: Program Files (x86) Qustodio qapp QAppTray.exe

(Realtek Semiconductor Corp. -> Realtek Semiconductor) C: Windows System32 RtkAudUService64.exe

(Symantec Corporation -> Symantec Corporation) C: Program Files (x86) Symantec Symantec Endpoint Protection 14.2.5569.2100.105 Bin ccSvcHst.exe

Impossible d'accéder au processus -> amdlogsr.exe

Impossible d'accéder au processus -> atieclxx.exe

Impossible d'accéder au processus -> atiesrxx.exe

Impossible d'accéder au processus -> ccSvcHst.exe

Impossible d'accéder au processus -> conhost.exe

Impossible d'accéder au processus -> crashpad_handler.exe

Impossible d'accéder au processus -> csrss.exe

Impossible d'accéder au processus -> dasHost.exe

Impossible d'accéder au processus -> DAX3API.exe

Impossible d'accéder au processus -> dllhost.exe

Impossible d'accéder au processus -> dwm.exe

Impossible d'accéder au processus -> EvtEng.exe

Impossible d'accéder au processus -> FMService64.exe

Impossible d'accéder au processus -> fontdrvhost.exe

Impossible d'accéder au processus -> GoogleCrashHandler.exe

Impossible d'accéder au processus -> GoogleCrashHandler64.exe

Impossible d'accéder au processus -> LCD_Service.exe

Impossible d'accéder au processus -> lsass.exe

Impossible d'accéder au processus -> MateBookService.exe

Impossible d'accéder au processus -> MBAMService.exe

Impossible d'accéder au processus -> OfficeClickToRun.exe

Impossible d'accéder au processus -> qengine.exe

Impossible d'accéder au processus -> QUpdateService.exe

Impossible d'accéder au processus -> RegSrvc.exe

Impossible d'accéder au processus -> RtkAudUService64.exe

Impossible d'accéder au processus -> SearchFilterHost.exe

Impossible d'accéder au processus -> SearchIndexer.exe

Impossible d'accéder au processus -> SearchProtocolHost.exe

Impossible d'accéder au processus -> SecurityHealthService.exe

Impossible d'accéder au processus -> sepWscSvc64.exe

Impossible d'accéder au processus -> services.exe

Impossible d'accéder au processus -> SgrmBroker.exe

Impossible d'accéder au processus -> smss.exe

Impossible d'accéder au processus -> spoolsv.exe

Impossible d'accéder au processus -> svchost.exe

Impossible d'accéder au processus -> unsecapp.exe

Impossible d'accéder au processus -> wininit.exe

Impossible d'accéder au processus -> winlogon.exe

Impossible d'accéder au processus -> wlanext.exe

Impossible d'accéder au processus -> WMIADAP.exe

Impossible d'accéder au processus -> WmiPrvSE.exe

Impossible d'accéder au processus -> ZeroConfigService.exe

==================== Registre (liste blanche) ===================

(Si une entrée est incluse dans la liste de correctifs, l'élément de registre sera restauré par défaut ou supprimé. Le fichier ne sera pas déplacé.)

HKLM … Run: [RtkAudUService] => C: WINDOWS System32 RtkAudUService64.exe [836672 2018-11-29] (Realtek Semiconductor Corp. -> Realtek Semiconductor)

HKLM … Run: [Logitech Download Assistant] => C: Windows System32 LogiLDA.dll [3942864 2016-10-14] (Logitech -> Logitech, Inc.)

HKLM-x32 … Exécuter: [SunJavaUpdateSched] => C: Program Files (x86) Fichiers communs Java Java Update jusched.exe [601424 2018-07-07] (Oracle America, Inc. -> Oracle Corporation)

HKLM-x32 … Exécuter: [KeePass 2 PreLoad] => C: Program Files (x86) KeePass Password Safe 2 KeePass.exe [3331264 2020-01-20] (Développeur Open Source, Dominik Reichl -> Dominik Reichl)

HKLM-x32 … Exécuter: [QAppTray] => C: Program Files (x86) Qustodio qapp QAppTray.exe [6429456 2020-06-04] (Qustodio Technologies, SL -> Qustodio Technologies)

HKU S-1-5-21-1017088884-3281645122-1580351492-1002 … Run: [GoogleChromeAutoLaunch_C4C526BDE8624B78F748783A47890366] => "C: Program Files (x86) Google Chrome Application chrome.exe" –no-startup-window / prefetch: 5

HKU S-1-5-21-1017088884-3281645122-1580351492-1002 … Run: [launchOnStartup] => C: Program Files (x86) GOG Galaxy GalaxyClient.exe [13971528 2020-05-06] (GOG Sp. Z o.o. -> GOG.com)

HKU S-1-5-21-1017088884-3281645122-1580351492-1002 … Run: [CCXProcess] => "C: Program Files Adobe Adobe Creative Cloud Experience CCXProcess.exe"

HKU S-1-5-21-1017088884-3281645122-1580351492-1002 … MountPoints2: d731a143-c473-11e8-aff7-ef1b4a682e27 – "E: HiSuiteDownLoader.exe"

HKU S-1-5-21-1017088884-3281645122-1580351492-1002- ED1FC765-E35E-4C3D-BF15-2C2B11260CE4 -06132020053622750 … Run: [GoogleChromeAutoLaunch_C4C526BDE8624B78F748783A47890366] => "C: Program Files (x86) Google Chrome Application chrome.exe" –no-startup-window / prefetch: 5

HKU S-1-5-21-1017088884-3281645122-1580351492-1002- ED1FC765-E35E-4C3D-BF15-2C2B11260CE4 -06132020053622750 … Run: [launchOnStartup] => C: Program Files (x86) GOG Galaxy GalaxyClient.exe [13971528 2020-05-06] (GOG Sp. Z o.o. -> GOG.com)

HKU S-1-5-21-1017088884-3281645122-1580351492-1002- ED1FC765-E35E-4C3D-BF15-2C2B11260CE4 -06132020053622750 … Run: [CCXProcess] => "C: Program Files Adobe Adobe Creative Cloud Experience CCXProcess.exe"

HKU S-1-5-21-1017088884-3281645122-1580351492-1002- ED1FC765-E35E-4C3D-BF15-2C2B11260CE4 -06132020053622750 … RunOnce: [Application Restart #0] => C: Windows HelpPane.exe [1071616 2020-03-10] (Microsoft Windows -> Microsoft Corporation)

HKU S-1-5-21-1017088884-3281645122-1580351492-1002- ED1FC765-E35E-4C3D-BF15-2C2B11260CE4 -06132020053622750 … RunOnce: [Application Restart #1] => C: Program Files (x86) Google Chrome Application chrome.exe –profile-directory = Par défaut –flag-switches-begin –flag-switches-end –enable-audio-service-sandbox –restore-last-session

HKU S-1-5-21-1017088884-3281645122-1580351492-1002- ED1FC765-E35E-4C3D-BF15-2C2B11260CE4 -06132020053622750 … MountPoints2: {d731a143-c473-11e8-aff7-aff4-a7274e2-aff4-aff7-aff4-aff7-aff4-aff7-aff4-aff7-aff4-e7a-b7 "E: HiSuiteDownLoader.exe"

HKLM … Windows x64 Processeurs d'impression Processeur d'impression Canon iP110 series: C: Windows System32 spool prtprocs x64 CNMPDCH.DLL [30208 2014-06-08] (Éditeur de compatibilité matérielle Microsoft Windows -> CANON INC.)

HKLM … Windows x64 Processeurs d'impression Canon MX920 series Processeur d'impression: C: Windows System32 spool prtprocs x64 CNMPDBL.DLL [30208 2012-09-20] (Éditeur de compatibilité matérielle Microsoft Windows -> CANON INC.)

HKLM … Print Monitors Canon BJ FAX Language Monitor MX920 series: C: WINDOWS system32 CNCALBL.DLL [303104 2012-09-21] (Éditeur de compatibilité matérielle Microsoft Windows -> CANON INC.)

HKLM … Print Monitors Canon BJ Language Monitor MX920 series: C: WINDOWS system32 CNMLMBL.DLL [390656 2012-09-20] (Éditeur de compatibilité matérielle Microsoft Windows -> CANON INC.)

HKLM Software Microsoft Active Setup Installed Components: [8A69D345-D564-463c-AFF1-A69D9E530F96] -> C: Program Files (x86) Google Chrome Application 83.0.4103.97 Installer chrmstp.exe [2020-06-05] (Google LLC -> Google LLC)

Démarrage: C: Users Ethan AppData Roaming Microsoft Windows Start Menu Programs Startup Rainmeter.lnk [2019-11-29]

ShortcutTarget: Rainmeter.lnk -> C: Program Files Rainmeter Rainmeter.exe (aucun fichier)

Démarrage: C: Users Ethan AppData Roaming Microsoft Windows Start Menu Programs Startup Send to OneNote.lnk [2018-08-13]

ShortcutTarget: Envoyer à OneNote.lnk -> C: Program Files (x86) Microsoft Office root Office16 ONENOTEM.EXE (Microsoft Corporation -> Microsoft Corporation)

GroupPolicy: Restriction? <==== ATTENTION

==================== Tâches planifiées (liste blanche) ============

(Si une entrée est incluse dans la liste de correctifs, elle sera supprimée du registre. Le fichier ne sera pas déplacé sauf s'il est répertorié séparément.)

(Si une entrée est incluse dans la liste de correctifs, le fichier de tâche (.job) sera déplacé. Le fichier exécuté par la tâche ne sera pas déplacé.)

==================== Internet (liste blanche) ====================

(Si un élément est inclus dans la liste de correctifs, s'il s'agit d'un élément du registre, il sera supprimé ou restauré par défaut.)

Tcpip Paramètres: [DhcpNameServer] 68.105.28.11 68.105.29.11 68.105.28.12

Tcpip .. Interfaces 0fd44dc5-54d3-4548-a4de-121a058f2fb6: [DhcpNameServer] 68.105.28.11 68.105.29.11 68.105.28.12

Tcpip .. Interfaces 42687b4e-4fd5-4ba8-b5dc-191ac714846c: [DhcpNameServer] 192.168.0.1

Tcpip .. Interfaces 794c4cd7-35de-4e43-975d-105099c2323b: [DhcpNameServer] 40.40.1.12

Tcpip .. Interfaces a73bdab8-9a7e-48ee-b785-5ecc46657b1c: [DhcpNameServer] 8.8.8.8 8.8.4.4

Internet Explorer:

==================

HKU S-1-5-21-1017088884-3281645122-1580351492-1002 Software Microsoft Internet Explorer Main, page de démarrage = hxxps: //go.microsoft.com/fwlink/p/? LinkId = 620947 & OCID = AVRES000 & pc = UE00

HKU S-1-5-21-1017088884-3281645122-1580351492-1002 Software Microsoft Internet Explorer Main, Default_Page_URL = hxxp: //OEM17SWIN10.MSN.COM/? PC = NSJE

HKU S-1-5-21-1017088884-3281645122-1580351492-1002- ED1FC765-E35E-4C3D-BF15-2C2B11260CE4 -06132020053622750 Software Microsoft Internet Explorer Main, Start Page = hxxps: // go. microsoft.com/fwlink/p/?LinkId=620947&OCID=AVRES000&pc=UE00

HKU S-1-5-21-1017088884-3281645122-1580351492-1002- ED1FC765-E35E-4C3D-BF15-2C2B11260CE4 -06132020053622750 Software Microsoft Internet Explorer Main, Default_Page_URL = hxxp: //OEM17S .COM /? PC = NSJE

URLSearchHook: [S-1-5-21-1017088884-3281645122-1580351492-1001-ED1FC765-E35E-4C3D-BF15-2C2B11260CE4-06132020053623422] ATTENTION => URLSearchHook par défaut est manquant

SearchScopes: HKU S-1-5-21-1017088884-3281645122-1580351492-1002 -> DefaultScope 19DD036C-D3F6-4E92-AC6C-D795D806EB14 URL =

SearchScopes: HKU S-1-5-21-1017088884-3281645122-1580351492-1002 -> 19DD036C-D3F6-4E92-AC6C-D795D806EB14 URL =

SearchScopes: HKU S-1-5-21-1017088884-3281645122-1580351492-1002- ED1FC765-E35E-4C3D-BF15-2C2B11260CE4 -06132020053622750 -> DefaultScope {19DD036C-D3F6-4E92-AC6-D6C6-AC6 D6

SearchScopes: HKU S-1-5-21-1017088884-3281645122-1580351492-1002- ED1FC765-E35E-4C3D-BF15-2C2B11260CE4 -06132020053622750 -> {19DD036C-D3F6-4E92-AC6C-D6F6E6-AC6C

BHO: Skype Entreprise Browser Helper -> 31D09BA0-12F5-4CCE-BE8A-2923E76605DA -> C: Program Files (x86) Microsoft Office root VFS ProgramFilesX64 Microsoft Office Office16 OCHelper.dll [2020-01-13] (Microsoft Corporation -> Microsoft Corporation)

BHO: Java ™ Plug-In SSV Helper -> 761497BB-D6F0-462C-B6EB-D4DAF1D92D43 -> C: Program Files Java jre1.8.0_181 bin ssv.dll [2018-07-28] (Oracle America, Inc. -> Oracle Corporation)

BHO: Java ™ Plug-In 2 SSV Helper -> DBC80044-A445-435b-BC74-9C25C1C588A9 -> C: Program Files Java jre1.8.0_181 bin jp2ssv.dll [2018-07-28] (Oracle America, Inc. -> Oracle Corporation)

Handler-x32: mso-minsb-roaming.16 – 83C25742-A9F7-49FB-9138-434302C88D07 – C: Program Files (x86) Microsoft Office root Office16 MSOSB.DLL [2020-06-09] (Microsoft Corporation -> Microsoft Corporation)

Handler-x32: mso-minsb.16 – 42089D2D-912D-4018-9087-2B87803E93FB – C: Program Files (x86) Microsoft Office root Office16 MSOSB.DLL [2020-06-09] (Microsoft Corporation -> Microsoft Corporation)

Handler-x32: osf-roaming.16 – 42089D2D-912D-4018-9087-2B87803E93FB – C: Program Files (x86) Microsoft Office root Office16 MSOSB.DLL [2020-06-09] (Microsoft Corporation -> Microsoft Corporation)

Handler-x32: osf.16 – 5504BE45-A83B-4808-900A-3A5C36E7F77A – C: Program Files (x86) Microsoft Office root Office16 MSOSB.DLL [2020-06-09] (Microsoft Corporation -> Microsoft Corporation)

Bord:

======

DownloadDir: C: Users Ethan Downloads

FireFox:

========

Plugin FF: @ java.com / DTPlugin, version = 11.181.2 -> C: Program Files Java jre1.8.0_181 bin dtplugin npDeployJava1.dll [2018-07-28] (Oracle America, Inc. -> Oracle Corporation)

Plugin FF: @ java.com / JavaPlugin, version = 11.181.2 -> C: Program Files Java jre1.8.0_181 bin plugin2 npjp2.dll [2018-07-28] (Oracle America, Inc. -> Oracle Corporation)

FF Plugin-x32: @ microsoft.com / SharePoint, version = 14.0 -> C: Program Files (x86) Microsoft Office root Office16 NPSPWRAP.DLL [2020-01-13] (Microsoft Corporation -> Microsoft Corporation)

Plugin FF HKU S-1-5-21-1017088884-3281645122-1580351492-1002: @ zoom.us / ZoomVideoPlugin -> C: Users Ethan AppData Roaming Zoom bin npzoomplugin.dll [2020-05-14] (Zoom Video Communications, Inc. -> Zoom Video Communications, Inc.)

Plugin FF HKU S-1-5-21-1017088884-3281645122-1580351492-1002- ED1FC765-E35E-4C3D-BF15-2C2B11260CE4 -06132020053622750: @ zoom.us / ZoomVideoPlugin -> C: Users Ethan Roaming Zoom bin npzoomplugin.dll [2020-05-14] (Zoom Video Communications, Inc. -> Zoom Video Communications, Inc.)

Chrome:

=======

CHR DefaultProfile: Par défaut

Profil CHR: C: Users Ethan AppData Local Google Chrome User Data Default [2020-06-13]

Notifications CHR: Par défaut -> hxxps: //www.youtube.com

CHR StartupUrls: Par défaut -> "chrome: // newtab /", "hxxps: //mail.google.com/mail/u/0/#inbox"

Restauration de session CHR: Par défaut -> est activé.

Extension CHR: (diapositives) – C: Users Ethan AppData Local Google Chrome User Data Default Extensions aapocclcgogkmnckokdopfmhonfmgoek [2018-07-27]

Extension CHR: (Docs) – C: Users Ethan AppData Local Google Chrome User Data Default Extensions aohghmighlieiainnegkcijnfilokake [2018-07-27]

Extension CHR: (Google Drive) – C: Users Ethan AppData Local Google Chrome User Data Default Extensions apdfllckaahabafndbhieahigkjlhalf [2019-12-21]

Extension CHR: (YouTube) – C: Users Ethan AppData Local Google Chrome User Data Default Extensions blpcfgokakmgnkcojhhkbfbldkacnbeo [2018-07-27]

Extension CHR: (Honey) – C: Users Ethan AppData Local Google Chrome User Data Default Extensions bmnlcjabgnpnenekpadlanbbkooimhnj [2020-05-30]

Extension CHR: (Google Docs hors ligne) – C: Users Ethan AppData Local Google Chrome User Data Default Extensions ghbmnnjooekpmoecnnililnnbdlolhkhi [2020-05-30]

Extension CHR: (Chrometana – Rediriger Bing quelque part mieux) – C: Users Ethan AppData Local Google Chrome User Data Default Extensions kaicbfmipfpfpjmlbpejaoaflfdnabnc [2018-07-28]

Extension CHR: (Paiements Chrome Web Store) – C: Users Ethan AppData Local Google Chrome User Data Default Extensions nmmhkkegccagdldgiimedpiccmgmieda [2019-10-03]

Extension CHR: (AdBlocker Ultimate) – C: Users Ethan AppData Local Google Chrome User Data Default Extensions ohahllgiabjaoigichmmfljhkcfikeof [2020-06-11]

Extension CHR: (Modern Flat) – C: Users Ethan AppData Local Google Chrome User Data Default Extensions pdcjjgefkpoemmlcjfcfkeminneboaob [2018-09-05]

Extension CHR: (Gmail) – C: Users Ethan AppData Local Google Chrome User Data Default Extensions pjkljhegncpnkpknbcohdijeoejaedia [2019-04-30]

Extension CHR: (Chrome Media Router) – C: Users Ethan AppData Local Google Chrome User Data Default Extensions pkedcjkdefgpdelpbcmbmeomcjbeemfm [2020-05-24]

Extension CHR: (extension de réponse quotidienne au questionnaire de la Couronne) – C: Users Ethan Documents Other Chrome Crowns Extension [2019-11-28]

Profil CHR: C: Users Ethan AppData Local Google Chrome User Data System Profile [2020-06-08]

==================== Services (liste blanche) ===================

(Si une entrée est incluse dans la liste de correctifs, elle sera supprimée du registre. Le fichier ne sera pas déplacé sauf s'il est répertorié séparément.)

S3 AALSvc; C: AlphaAntiLeak AAL bin server AALSvc.exe [11439992 2020-06-09] (Constantin Schreiber ->)

S4 AGMService; C: Program Files (x86) Common Files Adobe AdobeGCClient AGMService.exe [3673680 2020-05-05] (Adobe Inc. -> Adobe Systems, Incorporated)

R2 AMD External Events Utility; C: WINDOWS System32 DriverStore FileRepository u0355166.inf_amd64_b850e0f0c3bce936 B355483 atiesrxx.exe [529624 2020-05-27] (Advanced Micro Devices, Inc. -> AMD)

R2 AMD Log Utility; C: WINDOWS System32 amdlogsr.exe [483248 2020-05-05] (Éditeur de compatibilité matérielle Microsoft Windows -> Advanced Micro Devices, Inc.)

S3 BEService; C: Program Files (x86) Common Files BattlEye BEService.exe [7356680 2018-10-03] (BattlEye Innovations e.K. ->)

R2 ClickToRunSvc; C: Program Files Fichiers communs Microsoft Shared ClickToRun OfficeClickToRun.exe [10637168 2020-05-29] (Microsoft Corporation -> Microsoft Corporation)

R2 DolbyDAXAPI; C: WINDOWS system32 dolbyaposvc DAX3API.exe [602544 2018-09-27] (Dolby Laboratories, Inc. ->)

S3 EasyAntiCheat; C: Program Files (x86) EasyAntiCheat EasyAntiCheat.exe [781440 2018-08-17] (EasyAntiCheat Oy -> EasyAntiCheat Ltd)

R2 FMAPOService; C: WINDOWS System32 FMService64.exe [294968 2018-09-19] (Éditeur de compatibilité matérielle Microsoft Windows -> Fortemedia)

S3 GalaxyClientService; C: Program Files (x86) GOG Galaxy GalaxyClientService.exe [1748552 2020-05-06] (GOG Sp. Z o.o. -> GOG.com)

S3 GalaxyCommunication; C: ProgramData GOG.com Galaxy redists GalaxyCommunication.exe [6821960 2020-05-06] (GOG Sp. Z o.o. -> GOG.com)

R2 LCD_Service; C: Program Files Huawei HwLcdEnhancement LCD_Service.exe [25584 2020-01-10] (Huawei Technologies Co., Ltd. -> Microsoft)

Lmhosts R3; C: WINDOWS System32 svchost.exe [51696 2018-09-15] (Microsoft Windows Publisher -> Microsoft Corporation)

Lmhosts R3; C: WINDOWS SysWOW64 svchost.exe [45448 2018-09-15] (Microsoft Windows Publisher -> Microsoft Corporation)

R2 MBAMainService; C: Program Files Huawei PCManager MateBookService.exe [1005040 2020-01-10] (Huawei Technologies Co., Ltd. ->)

R2 MBAMService; C: Program Files Malwarebytes Anti-Malware MBAMService.exe [6933272 2020-05-20] (Malwarebytes Inc -> Malwarebytes)

S3 MyWiFiDHCPDNS; C: Program Files Intel WiFi bin PanDhcpDns.exe [265864 2018-03-20] (Intel Corporation ->)

R2 NlaSvc; C: WINDOWS System32 svchost.exe [51696 2018-09-15] (Microsoft Windows Publisher -> Microsoft Corporation)

R2 NlaSvc; C: WINDOWS SysWOW64 svchost.exe [45448 2018-09-15] (Microsoft Windows Publisher -> Microsoft Corporation)

R2 nsi; C: WINDOWS system32 svchost.exe [51696 2018-09-15] (Microsoft Windows Publisher -> Microsoft Corporation)

R2 nsi; C: WINDOWS SysWOW64 svchost.exe [45448 2018-09-15] (Microsoft Windows Publisher -> Microsoft Corporation)

R2 qengine; C: Program Files (x86) Qustodio qproxy qengine.exe [4139792 2020-06-04] (Qustodio Technologies, SL -> Qustodio Technologies)

R2 qupdate; C: Program Files (x86) Qustodio qapp QUpdateService.exe [2358544 2020-06-04] (Qustodio Technologies, SL -> Qustodio Technologies)

S4 SepLpsService; C: Program Files (x86) Symantec Symantec Endpoint Protection 14.2.5569.2100.105 Bin ccSvcHst.exe [159088 2020-05-20] (Symantec Corporation -> Symantec Corporation)

R2 SepMasterService; C: Program Files (x86) Symantec Symantec Endpoint Protection 14.2.5569.2100.105 Bin ccSvcHst.exe [159088 2020-05-20] (Symantec Corporation -> Symantec Corporation)

R2 sepWscSvc; C: Program Files (x86) Symantec Symantec Endpoint Protection 14.2.5569.2100.105 Bin64 sepWscSvc64.exe [1834776 2020-05-20] (Symantec Corporation -> Symantec Corporation)

S3 SNAC; C: Program Files (x86) Symantec Symantec Endpoint Protection 14.2.5569.2100.105 Bin64 snac64.exe [394680 2020-05-20] (Symantec Corporation -> Symantec Corporation)

S3 WdNisSvc; C: ProgramData Microsoft Windows Defender platform 4.18.2004.6-0 NisSrv.exe [3304992 2020-05-01] (Microsoft Windows Publisher -> Microsoft Corporation)

S3 WinDefend; C: ProgramData Microsoft Windows Defender platform 4.18.2004.6-0 MsMpEng.exe [103376 2020-05-01] (Microsoft Windows Publisher -> Microsoft Corporation)

R2 ZeroConfigService; C: Program Files Intel WiFi bin ZeroConfigService.exe [3848328 2018-03-20] (Intel Corporation -> Intel® Corporation)

S2 EraserSvc11910; "C: Program Files (x86) Fichiers communs Symantec Shared EENGINE ccSvcHst.exe" / h ccCommon [X]

U4 weClientDataTransferService; "C: Program Files WE_Client wecdt.exe" [X]

U4 weClientMessengerService; "C: Program Files WE_Client wecmsg.exe" [X]

===================== Pilotes (sur liste blanche) ===================

(Si une entrée est incluse dans la liste de correctifs, elle sera supprimée du registre. Le fichier ne sera pas déplacé sauf s'il est répertorié séparément.)

S3 AALProtect; C: AlphaAntiLeak AAL bin server AALProtect.sys [35984 2020-03-24] (OOO AMEKS ->)

R3 amdacpbus; C: WINDOWS System32 drivers amdacpbus.sys [6170544 2020-05-19] (Éditeur de compatibilité matérielle Microsoft Windows -> Micro périphériques avancés)

R3 amdgpio2; C: WINDOWS System32 drivers amdgpio2.sys [34664 2018-03-31] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc)

R3 AMDHDAudBusService; C: WINDOWS System32 drivers amdhdaudbus.sys [79224 2018-08-08] (Éditeur de compatibilité matérielle Microsoft Windows -> Micro périphériques avancés)

R3 amdi2c; C: WINDOWS System32 drivers amdi2c.sys [52680 2017-10-16] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc)

R3 amdkmdag; C: WINDOWS System32 DriverStore FileRepository u0355166.inf_amd64_b850e0f0c3bce936 B355483 amdkmdag.sys [71066320 2020-05-27] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.)

R0 amdlog; C: WINDOWS System32 drivers amdlog.sys [89200 2020-05-05] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.)

R0 amdpsp; C: WINDOWS System32 drivers amdpsp.sys [137104 2017-11-07] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.)

R3 AMDXE; C: WINDOWS System32 drivers amdxe.sys [60216 2020-03-31] (Advanced Micro Devices, Inc. ->)

S3 AppleLowerFilter; C: WINDOWS System32 drivers AppleLowerFilter.sys [35560 2018-05-10] (Version WDKTestCert, 131474841775766162 -> Apple Inc.)

R3 AtiHDAudioService; C: WINDOWS system32 drivers AtihdWT6.sys [107936 2020-03-13] (Éditeur de compatibilité matérielle Microsoft Windows -> Micro périphériques avancés)

S3 BEDaisy; C: Program Files (x86) Fichiers communs BattlEye BEDaisy.sys [2551864 2018-10-03] (BattlEye Innovations e.K. ->)

R1 BHDrvx64; C: ProgramData Symantec Symantec Endpoint Protection 14.2.5569.2100.105 Data Definitions BASHDefs 20200609.001 BHDrvx64.sys [1952136 2020-05-11] (Symantec Corporation -> Symantec Corporation)

R1 ccSettings_ D8E0573B-6B4C-4DC0-8F5C-4764B8E079F9; C: WINDOWS System32 Drivers SEP 0E0215C1 0834.105 x64 ccSetx64.sys [179416 2020-05-20] (Symantec Corporation -> Symantec Corporation)

S3 CH341SER_A64; C: WINDOWS System32 Drivers CH341S64.SYS [69024 2019-05-29] (Éditeur de compatibilité matérielle Microsoft Windows -> www.winchiphead.com)

R1 eeCtrl; C: Program Files (x86) Common Files Symantec Shared EENGINE eeCtrl64.sys [516784 2020-05-20] (Symantec Corporation -> Symantec Corporation)

R3 EraserUtilRebootDrv; C: Program Files (x86) Common Files Symantec Shared EENGINE EraserUtilRebootDrv.sys [154288 2020-05-23] (Symantec Corporation -> Symantec Corporation)

R1 ESProtectionDriver; C: WINDOWS system32 drivers mbae64.sys [153312 2020-05-20] (Malwarebytes Corporation -> Malwarebytes)

R1 IDSVia64; C: ProgramData Symantec Symantec Endpoint Protection 14.2.5569.2100.105 Data Definitions IPSDefs 20200611.061 IDSvia64.sys [1455288 2020-05-19] (Symantec Corporation -> Symantec Corporation)

R2 MBAMChameleon; C: WINDOWS System32 Drivers MbamChameleon.sys [214496 2020-06-02] (Malwarebytes Inc -> Malwarebytes)

S0 MbamElam; C: WINDOWS System32 DRIVERS MbamElam.sys [19912 2020-06-02] (Microsoft Windows Early Launch Anti-malware Publisher -> Malwarebytes)

R3 MBAMFarflt; C: WINDOWS System32 DRIVERS farflt.sys [195432 2020-06-13] (Malwarebytes Inc -> Malwarebytes)

R3 MBAMProtection; C: WINDOWS system32 DRIVERS mbam.sys [73368 2020-06-13] (Malwarebytes Inc -> Malwarebytes)

R3 MBAMSwissArmy; C: WINDOWS System32 Drivers mbamswissarmy.sys [248968 2020-06-13] (Malwarebytes Inc -> Malwarebytes)

R3 MBAMWebProtection; C: WINDOWS system32 DRIVERS mwac.sys [131736 2020-06-13] (Malwarebytes Inc -> Malwarebytes)

R1 netfilter_wfp_ev_64; C: WINDOWS System32 drivers netfilter_wfp_ev_64.sys [96864 2018-04-12] (Éditeur de compatibilité matérielle Microsoft Windows -> Fournisseur Windows® Win 7 DDK)

R1 qwdf64; C: WINDOWS system32 Drivers qwdf64.sys [41872 2019-08-01] (Qustodio Technologies, SL -> Qustodio Technologies)

R1 qwdr64; C: WINDOWS system32 Drivers qwdr64.sys [55696 2019-08-01] (Qustodio Technologies, SL -> Qustodio Technologies)

R2 qwfp; C: WINDOWS system32 Drivers qwfp64.sys [47736 2019-08-01] (Éditeur de compatibilité matérielle Microsoft Windows -> Technologies Qustodio)

S3 SPUVCbv; C: WINDOWS System32 Drivers SPUVCbv64.sys [766040 2017-10-26] (SUNPLUS INNOVATION TECHNOLOGY INC. -> Sunplus Innovation Technology Inc.)

R1 SRTSP; C: WINDOWS System32 Drivers SEP 0E0215C1 0834.105 x64 SRTSP64.SYS [870792 2020-05-20] (Symantec Corporation -> Symantec Corporation)

R1 SRTSPX; C: WINDOWS System32 Drivers SEP 0E0215C1 0834.105 x64 SRTSPX64.SYS [51080 2020-05-20] (Symantec Corporation -> Symantec Corporation)

S3 SyDvCtrl; C: Program Files (x86) Symantec Symantec Endpoint Protection 14.2.5569.2100.105 Bin64 SyDvCtrl64.sys [44568 2020-05-20] (Symantec Corporation -> Symantec Corporation)

R0 SymEFASI; C: WINDOWS System32 drivers symefasi 0603040.009 symefasi64.sys [1822600 2020-05-20] (Symantec Corporation -> Symantec Corporation)

S0 SymELAM; C: WINDOWS System32 Drivers SEP 0E0215C1 0834.105 x64 SymELAM.sys [26000 2020-05-20] (Microsoft Windows Early Launch Anti-malware Publisher -> Symantec Corporation)

R3 SymEvent; C: WINDOWS system32 Drivers SYMEVENT64x86.SYS [99920 2020-05-20] (Symantec Corporation -> Symantec Corporation)

R1 SymIRON; C: WINDOWS System32 Drivers SEP 0E0215C1 0834.105 x64 Ironx64.SYS [311264 2020-05-20] (Symantec Corporation -> Symantec Corporation)

R1 SYMNETS; C: WINDOWS System32 Drivers SEP 0E0215C1 0834.105 x64 SYMNETS.SYS [568712 2020-05-20] (Symantec Corporation -> Symantec Corporation)

R1 SysPlant; C: WINDOWS System32 Drivers SysPlant.sys [231360 2020-05-20] (Symantec Corporation -> Symantec Corporation)

S3 tapnordvpn; C: WINDOWS System32 drivers tapnordvpn.sys [44896 2018-07-24] (TEFINCOM S.A. -> Le projet OpenVPN)

R1 Teefer2; C: WINDOWS system32 DRIVERS Teefer.sys [132992 2020-05-20] (Symantec Corporation -> Symantec Corporation)

S3 USBTINSP; C: WINDOWS System32 drivers tinspusb.sys [142848 2017-07-27] (Éditeur de compatibilité matérielle Microsoft Windows -> Texas Instruments)

S3 WdBoot; C: WINDOWS system32 drivers wd WdBoot.sys [45960 2020-05-01] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)

S3 WdFilter; C: WINDOWS system32 drivers wd WdFilter.sys [394680 2020-05-01] (Microsoft Windows -> Microsoft Corporation)

S3 WdNisDrv; C: WINDOWS System32 drivers wd WdNisDrv.sys [64944 2020-05-01] (Microsoft Windows -> Microsoft Corporation)

R3 WDTDrv; C: WINDOWS System32 Drivers WDTDrv.sys [27048 2018-02-27] (Huawei Technologies Co., Ltd. -> Appareil Huawei)

S3 EraserUtilDrv11910; ?? C: Program Files (x86) Common Files Symantec Shared EENGINE EraserUtilDrv11910.sys [X]

==================== NetSvcs (liste blanche) ====================

(Si une entrée est incluse dans la liste de correctifs, elle sera supprimée du registre. Le fichier ne sera pas déplacé sauf s'il est répertorié séparément.)

==================== Un mois (créé) ===================

(Si une entrée est incluse dans la liste de correctifs, le fichier / dossier sera déplacé.)

2020-06-13 05:42 – 2020-06-13 05:42 – 000031721 _____ C: Users Ethan Desktop FRST.txt

2020-06-13 05:42 – 2020-06-13 05:42 – 000000000 ____D C: FRST

2020-06-13 05:40 – 2020-06-13 05:40 – 002289152 _____ (Farbar) C: Users Ethan Desktop FRST64.exe

2020-06-13 05:36 – 2020-06-13 05:36 – 000195432 _____ (Malwarebytes) C: WINDOWS system32 Drivers farflt.sys

2020-06-13 05:36 – 2020-06-13 05:36 – 000131736 _____ (Malwarebytes) C: WINDOWS system32 Drivers mwac.sys

2020-06-13 05:36 – 2020-06-13 05:36 – 000073368 _____ (Malwarebytes) C: WINDOWS system32 Drivers mbam.sys

2020-06-13 05:36 – 2020-06-13 05:36 – 000000000 ____D C: Users Ethan AppData LocalLow IGDump

2020-06-13 05:30 – 2020-06-13 05:34 – 000417646 _____ C: WINDOWS ntbtlog.txt

2020-06-12 22:53 – 2020-06-12 22:53 – 001920738 _____ C: Users Ethan Downloads iCloud Photos.zip

2020-06-12 20:53 – 2020-06-12 22:54 – 000511438 _____ C: Users Ethan Downloads IMG_1020.JPEG

2020-06-12 19:02 – 2019-08-01 16:48 – 000055696 _____ (Qustodio Technologies) C: WINDOWS system32 Drivers qwdr64.sys

2020-06-12 19:02 – 2019-08-01 16:48 – 000041872 _____ (Qustodio Technologies) C: WINDOWS system32 Drivers qwdf64.sys

2020-06-12 07:53 – 2020-06-12 07:53 – 000002608 _____ C: Users Ethan Downloads Player.plr

2020-06-12 05:00 – 2020-06-12 05:00 – 000000000 ____D C: Users Ethan Downloads processhacker-2.39-bin

2020-06-12 04:59 – 2020-06-12 04:59 – 003392412 _____ C: Users Ethan Downloads processhacker-2.39-bin.zip

2020-06-12 02:28 – 2020-06-12 02:28 – 000000000 ____D C: Users Ethan Desktop tools

2020-06-09 19:06 – 2020-06-09 19:06 – 000002357 _____ C: Users Ethan AppData Roaming Microsoft Windows Menu Démarrer Programmes Lunar Client.lnk

2020-06-09 19:06 – 2020-06-09 19:06 – 000002349 _____ C:UsersEthanDesktopLunar Client.lnk

2020-06-09 19:05 – 2020-06-09 19:05 – 000755688 _____ (Moonsworth, LLC) C:UsersEthanDownloadsLunar Client v2.0.2.exe

2020-06-09 01:47 – 2020-06-09 01:47 – 000000000 ____D C:UsersEthanAppDataLocalATI

2020-06-09 01:43 – 2020-06-09 01:43 – 000000000 ____D C:UsersEthanDesktopruntime

2020-06-09 01:42 – 2020-06-09 01:43 – 000000000 ____D C:UsersEthanDesktopgame

2020-06-09 01:33 – 2020-06-12 02:28 – 002970008 _____ (Mojang) C:UsersEthanDesktopMinecraft.exe

2020-06-09 00:03 – 2020-06-09 00:03 – 009589547 _____ C:UsersEthanDownloadsRevoUninstaller_Portable (1).zip

2020-06-08 23:35 – 2020-06-08 23:58 – 000000000 ____D C:UsersEthanDownloadsRevoUninstaller_Portable

2020-06-08 23:34 – 2020-06-08 23:34 – 009589547 _____ C:UsersEthanDownloadsRevoUninstaller_Portable.zip

2020-06-08 23:11 – 2020-06-08 23:11 – 000000761 _____ C:UsersEthanDocumentsDownloads.lnk

2020-06-08 22:13 – 2020-06-08 22:14 – 000000000 ___HD C:temp

2020-06-08 09:38 – 2020-06-08 22:06 – 000000000 ____D C:35cf2c581e43e0fd0f2302ce54fb

2020-06-08 09:29 – 2020-06-08 22:06 – 000000000 ____D C:68e9a7aba4aecf4ec4

2020-06-08 08:06 – 2020-06-08 08:06 – 000000000 ___HD C:ProgramDataCanonIJFAX

2020-06-07 23:17 – 2020-06-07 23:22 – 000000000 ____D C:UsersEthanEpubee Library

2020-06-07 23:17 – 2020-06-07 23:17 – 000000000 ____D C:UsersEthanBookManager

2020-06-07 23:17 – 2020-06-07 23:17 – 000000000 ____D C:UsersEthanAppDataRoaming.cover

2020-06-07 23:17 – 2020-06-07 23:17 – 000000000 ____D C:UsersEthan.Epubor_Keys

2020-06-07 23:14 – 2020-06-08 22:16 – 000000000 ____D C:Program Files (x86)ePUBee

2020-06-05 23:17 – 2020-06-05 23:17 – 000000000 ____D C:8527c8ea7501eb69401877adc732

2020-06-05 23:07 – 2020-06-05 23:07 – 000000000 ____D C:de22f4d81bbf950b5e0f7a8642297b

2020-06-05 22:57 – 2020-06-05 22:57 – 000000000 ____D C:f4b9a65bd3630368995b8ced06

2020-06-05 22:37 – 2020-06-05 22:37 – 000000000 ____D C:faa6e5d10903a99a286ff6

2020-06-05 22:27 – 2020-06-05 22:28 – 000000000 ____D C:4fa0f45da0c207e28fce354dfbcbb45a

2020-06-05 22:24 – 2020-06-05 22:24 – 000000000 ____D C:UsersEthanAppDataLocalcache

2020-06-05 22:19 – 2020-06-05 22:19 – 000000000 ____D C:ProgramDataMicrosoftWindowsStart MenuProgramsAMD Radeon Software

2020-06-05 22:17 – 2020-06-05 22:22 – 000000000 ____D C:25a06eb4cb678d6510bb02b4e69c

2020-06-05 22:17 – 2020-06-05 22:17 – 000000000 ____D C:ProgramDataAMD

2020-06-05 22:04 – 2020-06-05 22:12 – 000000000 ____D C:96699b5329d1ea66b0a663de302c5a

2020-06-05 22:03 – 2020-06-05 22:03 – 000000000 ____D C:AMD

2020-06-05 21:56 – 2020-06-05 21:56 – 000000000 ____D C:UsersEthanAppDataLocalRadeonSettings

2020-06-05 21:52 – 2020-06-05 22:12 – 000000000 ____D C:59149044dd0aac2303de

2020-06-05 21:44 – 2020-06-05 22:12 – 000000000 ____D C:bd86fd4774132980229e4d5232ae

2020-06-05 04:05 – 2020-06-05 21:37 – 000000000 ____D C:873d716d2277afe5bee1c44e0b878d87

2020-06-05 03:54 – 2020-06-05 21:37 – 000000000 ____D C:dbd59e3d47cf23fa38e6b2b4

2020-06-05 03:46 – 2020-06-05 21:37 – 000000000 ____D C:8878178fedc450c4b9

2020-06-05 03:30 – 2020-06-05 21:37 – 000000000 ____D C:3aa04f0e181a6ef6283335

2020-06-05 02:34 – 2020-06-05 21:37 – 000000000 ____D C:b7af3d3859975eec9620db8b5a5f6e41

2020-06-05 02:26 – 2020-06-05 21:37 – 000000000 ____D C:487c789bbfdb27e0f8

2020-06-05 02:14 – 2020-06-05 21:37 – 000000000 ____D C:d88254605b4e82c096

2020-06-05 02:05 – 2020-06-05 21:37 – 000000000 ____D C:e25ee765e720e9e181c0a4

2020-06-05 01:55 – 2020-06-05 21:37 – 000000000 ____D C:8986be08c43b083cf019

2020-06-05 01:45 – 2020-06-05 21:37 – 000000000 ____D C:24b77074821232b8eee377b656

2020-06-05 01:35 – 2020-06-05 21:37 – 000000000 ____D C:76cca42bb37e3cd7e09f354112b60b

2020-06-05 01:25 – 2020-06-05 21:37 – 000000000 ____D C:514f6c63d0b4235c42ea

2020-06-05 01:15 – 2020-06-05 21:37 – 000000000 ____D C:a82951183443a4c4ff

2020-06-05 01:05 – 2020-06-05 21:37 – 000000000 ____D C:1500873c57dc503bb2583144b776

2020-06-05 00:55 – 2020-06-05 21:37 – 000000000 ____D C:2608ecb4b26d61af942bbe9aef91a4

2020-06-05 00:45 – 2020-06-05 21:37 – 000000000 ____D C:d0bd3ae4cfc3cb2d19

2020-06-05 00:35 – 2020-06-05 21:37 – 000000000 ____D C:b8593ace07e295202c

2020-06-05 00:25 – 2020-06-05 21:37 – 000000000 ____D C:aefea5c399639a508a8d0cc319bada

2020-06-05 00:15 – 2020-06-05 21:37 – 000000000 ____D C:d34e9191b27aad94f2aa2e6e

2020-06-05 00:05 – 2020-06-05 21:37 – 000000000 ____D C:746cad1319b45c0fa13d3542b5

2020-06-04 23:55 – 2020-06-05 21:37 – 000000000 ____D C:761aa80eda44dc967c55336087417a

2020-06-04 23:45 – 2020-06-05 21:37 – 000000000 ____D C:b015b1b5cce422460fcedb4

2020-06-04 23:35 – 2020-06-05 21:37 – 000000000 ____D C:21bb368a3acf317e654c

2020-06-04 23:25 – 2020-06-05 21:37 – 000000000 ____D C:1eb161e731e359e492622ac3330bc8

2020-06-04 23:15 – 2020-06-05 21:37 – 000000000 ____D C:9954edefd2c4ee760f21

2020-06-04 23:05 – 2020-06-05 21:37 – 000000000 ____D C:4996eff18111c7145a68

2020-06-04 22:55 – 2020-06-05 21:37 – 000000000 ____D C:dbfc9b3663e052d664a93b73

2020-06-04 22:45 – 2020-06-05 21:37 – 000000000 ____D C:e15f2439316aa3b95ecb

2020-06-04 22:35 – 2020-06-05 21:37 – 000000000 ____D C:812b054302348352f

2020-06-03 21:45 – 2020-06-05 21:42 – 000000000 ___HD C:adobeTemp

2020-06-02 22:05 – 2020-06-02 22:05 – 000000000 ___HD C:ProgramDataCanonBJ

2020-06-02 21:50 – 2020-06-02 21:50 – 000000000 ____D C:UsersEthanAppDataLocalUXP

2020-06-02 21:49 – 2020-06-02 21:49 – 000000000 ____D C:UsersEthanAppDataLocalLowAdobe

2020-06-02 21:47 – 2020-06-08 22:09 – 000000000 ___RD C:UsersEthanCreative Cloud Files

2020-06-02 21:42 – 2020-06-02 21:47 – 000000000 ____D C:ProgramDataAdobe

2020-06-02 21:40 – 2020-06-08 22:13 – 000000000 ____D C:Program FilesCommon FilesAdobe

2020-06-02 21:40 – 2020-06-08 22:12 – 000000000 ____D C:Program FilesAdobe

2020-06-02 21:38 – 2020-06-02 21:47 – 000000000 ____D C:UsersEthanAppDataLocalAdobe

2020-06-02 17:15 – 2020-06-13 05:36 – 000248968 _____ (Malwarebytes) C:WINDOWSsystem32Driversmbamswissarmy.sys

2020-06-02 17:15 – 2020-06-02 17:15 – 000214496 _____ (Malwarebytes) C:WINDOWSsystem32DriversMbamChameleon.sys

2020-06-01 01:12 – 2020-06-01 01:12 – 000000000 ____D C:UsersEthanAppDataLocalAdobe_Systems_Incorporate

2020-06-01 01:06 – 2020-06-08 23:12 – 000000000 ____D C:Program Files (x86)Adobe

2020-05-27 14:20 – 2020-05-27 14:20 – 064809688 _____ C:WINDOWSsystem32amd_comgr.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 053685456 _____ C:WINDOWSSysWOW64amd_comgr32.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 004631248 _____ (Advanced Micro Devices, Inc.) C:WINDOWSsystem32amfrt64.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 004141776 _____ (Advanced Micro Devices, Inc.) C:WINDOWSSysWOW64amfrt32.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 001784536 _____ C:WINDOWSsystem32vulkaninfo-1-999-0-0-0.exe

2020-05-27 14:20 – 2020-05-27 14:20 – 001784536 _____ C:WINDOWSsystem32vulkaninfo.exe

2020-05-27 14:20 – 2020-05-27 14:20 – 001775320 _____ (Advanced Micro Devices, Inc.) C:WINDOWSsystem32atiadlxx.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 001374936 _____ C:WINDOWSSysWOW64vulkaninfo-1-999-0-0-0.exe

2020-05-27 14:20 – 2020-05-27 14:20 – 001374936 _____ C:WINDOWSSysWOW64vulkaninfo.exe

2020-05-27 14:20 – 2020-05-27 14:20 – 001342168 _____ (Advanced Micro Devices, Inc.) C:WINDOWSSysWOW64atiadlxy.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 001342168 _____ (Advanced Micro Devices, Inc.) C:WINDOWSSysWOW64atiadlxx.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 001085976 _____ C:WINDOWSsystem32vulkan-1-999-0-0-0.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 001085976 _____ C:WINDOWSsystem32vulkan-1.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 000944824 _____ C:WINDOWSSysWOW64vulkan-1-999-0-0-0.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 000944824 _____ C:WINDOWSSysWOW64vulkan-1.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 000761040 _____ (AMD) C:WINDOWSsystem32atieclxx.exe

2020-05-27 14:20 – 2020-05-27 14:20 – 000737496 _____ (Advanced Micro Devices, Inc.) C:WINDOWSsystem32Rapidfire64.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 000621784 _____ (Advanced Micro Devices, Inc.) C:WINDOWSSysWOW64Rapidfire.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 000497360 _____ C:WINDOWSsystem32GameManager64.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 000493776 _____ C:WINDOWSsystem32dgtrayicon.exe

2020-05-27 14:20 – 2020-05-27 14:20 – 000469200 _____ (Advanced Micro Devices, Inc.) C:WINDOWSsystem32atidemgy.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 000456920 _____ C:WINDOWSsystem32atieah64.exe

2020-05-27 14:20 – 2020-05-27 14:20 – 000433360 _____ C:WINDOWSsystem32EEURestart.exe

2020-05-27 14:20 – 2020-05-27 14:20 – 000380624 _____ C:WINDOWSSysWOW64GameManager32.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 000352464 _____ C:WINDOWSSysWOW64atieah32.exe

2020-05-27 14:20 – 2020-05-27 14:20 – 000340176 _____ C:WINDOWSsystem32clinfo.exe

2020-05-27 14:20 – 2020-05-27 14:20 – 000245976 _____ (Advanced Micro Devices, Inc. ) C:WINDOWSsystem32atig6txx.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 000213712 _____ (Advanced Micro Devices, Inc. ) C:WINDOWSSysWOW64atigktxx.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 000187600 _____ (Advanced Micro Devices, Inc. ) C:WINDOWSsystem32mantle64.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 000183008 _____ (Advanced Micro Devices, Inc. ) C:WINDOWSsystem32aticfx64.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 000167632 _____ (Advanced Micro Devices, Inc. ) C:WINDOWSsystem32atisamu64.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 000167128 _____ (Advanced Micro Devices, Inc. ) C:WINDOWSsystem32mantleaxl64.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 000159264 _____ (Advanced Micro Devices, Inc. ) C:WINDOWSSysWOW64aticfx32.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 000157408 _____ (Advanced Micro Devices, Inc. ) C:WINDOWSSysWOW64mantle32.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 000143056 _____ (Advanced Micro Devices, Inc. ) C:WINDOWSSysWOW64mantleaxl32.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 000141528 _____ (Advanced Micro Devices, Inc. ) C:WINDOWSSysWOW64atisamu32.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 000136400 _____ (AMD) C:WINDOWSsystem32atimuixx.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 000135384 _____ (Khronos Group) C:WINDOWSsystem32OpenCL.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 000126160 _____ C:WINDOWSsystem32atidxx64.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 000123088 _____ (Advanced Micro Devices, Inc. ) C:WINDOWSsystem32amdxc64.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 000121048 _____ (Khronos Group) C:WINDOWSSysWOW64OpenCL.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 000108240 _____ C:WINDOWSSysWOW64atidxx32.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 000107728 _____ (Advanced Micro Devices, Inc. ) C:WINDOWSSysWOW64amdxc32.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 000091352 _____ (Advanced Micro Devices, Inc. ) C:WINDOWSsystem32mcl64.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 000075984 _____ (Advanced Micro Devices, Inc. ) C:WINDOWSSysWOW64mcl32.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 000070872 _____ (Advanced Micro Devices, Inc.) C:WINDOWSsystem32ati2erec.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 000047320 _____ (Advanced Micro Devices, Inc.) C:WINDOWSsystem32RapidFireServer64.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 000044248 _____ (Advanced Micro Devices, Inc.) C:WINDOWSSysWOW64RapidFireServer.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 000020392 _____ (Microsoft Corporation) C:WINDOWSSysWOW64detoured.dll

2020-05-27 14:20 – 2020-05-27 14:20 – 000020392 _____ (Microsoft Corporation) C:WINDOWSsystem32detoured.dll

2020-05-27 14:19 – 2020-05-27 14:19 – 071473360 _____ (Advanced Micro Devices Inc.) C:WINDOWSsystem32amdhip64.dll

2020-05-27 14:19 – 2020-05-27 14:19 – 001686624 _____ (AMD) C:WINDOWSsystem32amf-mft-mjpeg-decoder64.dll

2020-05-27 14:19 – 2020-05-27 14:19 – 001365984 _____ (AMD) C:WINDOWSSysWOW64amf-mft-mjpeg-decoder32.dll

2020-05-27 14:19 – 2020-05-27 14:19 – 000941776 _____ (Advanced Micro Devices, Inc.) C:WINDOWSsystem32amdlvr64.dll

2020-05-27 14:19 – 2020-05-27 14:19 – 000769232 _____ (Advanced Micro Devices, Inc.) C:WINDOWSSysWOW64amdlvr32.dll

2020-05-27 14:19 – 2020-05-27 14:19 – 000554192 _____ (Advanced Micro Devices, Inc. ) C:WINDOWSsystem32amdmcl64.dll

2020-05-27 14:19 – 2020-05-27 14:19 – 000547424 _____ C:WINDOWSsystem32amdmiracast.dll

2020-05-27 14:19 – 2020-05-27 14:19 – 000490192 _____ C:WINDOWSsystem32amdgfxinfo64.dll

2020-05-27 14:19 – 2020-05-27 14:19 – 000467152 _____ C:WINDOWSsystem32amdlogum.exe

2020-05-27 14:19 – 2020-05-27 14:19 – 000384208 _____ (Advanced Micro Devices, Inc. ) C:WINDOWSSysWOW64amdmcl32.dll

2020-05-27 14:19 – 2020-05-27 14:19 – 000380624 _____ C:WINDOWSSysWOW64amdgfxinfo32.dll

2020-05-27 14:19 – 2020-05-27 14:19 – 000198928 _____ (Advanced Micro Devices, Inc.) C:WINDOWSsystem32amdihk64.dll

2020-05-27 14:19 – 2020-05-27 14:19 – 000168016 _____ (Advanced Micro Devices, Inc.) C:WINDOWSSysWOW64amdihk32.dll

2020-05-27 14:19 – 2020-05-27 14:19 – 000130864 _____ (Advanced Micro Devices, Inc. ) C:WINDOWSsystem32atimpc64.dll

2020-05-27 14:19 – 2020-05-27 14:19 – 000130864 _____ (Advanced Micro Devices, Inc. ) C:WINDOWSsystem32amdpcom64.dll

2020-05-27 14:19 – 2020-05-27 14:19 – 000108880 _____ (Advanced Micro Devices, Inc. ) C:WINDOWSSysWOW64amdpcom32.dll

2020-05-27 14:19 – 2020-05-27 14:19 – 000108864 _____ (Advanced Micro Devices, Inc. ) C:WINDOWSSysWOW64atimpc32.dll

2020-05-27 14:18 – 2020-05-27 14:18 – 000136544 _____ (Advanced Micro Devices, Inc. ) C:WINDOWSsystem32amdave64.dll

2020-05-27 14:18 – 2020-05-27 14:18 – 000120896 _____ (Advanced Micro Devices, Inc. ) C:WINDOWSSysWOW64amdave32.dll

2020-05-26 20:09 – 2020-05-26 20:09 – 000000000 ____D C:UsersEthanAppDataLocalpackage.nw.new

2020-05-25 20:28 – 2020-05-25 20:28 – 003471376 _____ C:WINDOWSSysWOW64atiumdva.cap

2020-05-25 20:28 – 2020-05-25 20:28 – 003437632 _____ C:WINDOWSsystem32atiumd6a.cap

2020-05-25 20:26 – 2020-05-25 20:26 – 000204952 _____ C:WINDOWSSysWOW64ativvsvl.dat

2020-05-25 20:26 – 2020-05-25 20:26 – 000204952 _____ C:WINDOWSsystem32ativvsvl.dat

2020-05-25 20:26 – 2020-05-25 20:26 – 000157144 _____ C:WINDOWSSysWOW64ativvsva.dat

2020-05-25 20:26 – 2020-05-25 20:26 – 000157144 _____ C:WINDOWSsystem32ativvsva.dat

2020-05-25 20:01 – 2020-05-25 20:01 – 000543400 _____ C:WINDOWSSysWOW64atiapfxx.blb

2020-05-25 20:01 – 2020-05-25 20:01 – 000543400 _____ C:WINDOWSsystem32atiapfxx.blb

2020-05-24 02:33 – 2020-06-09 18:08 – 000001445 _____ C:UsersPublicDesktopTerraria.lnk

2020-05-24 02:23 – 2020-05-24 02:23 – 000000000 ____D C:ProgramDataMicrosoftWindowsStart MenuProgramsGOG.com

2020-05-24 02:20 – 2020-05-24 02:33 – 000000000 ____D C:ProgramDataGOG.com

2020-05-23 16:18 – 2020-06-12 05:07 – 000000000 ____D C:UsersEthanAppDataLocalCrashDumps

2020-05-20 08:04 – 2020-06-13 05:26 – 000074800 _____ (Symantec Corporation) C:WINDOWSsystem32msln.exe

2020-05-20 08:00 – 2020-05-20 08:00 – 000000000 ____D C:UsersEthanAppDataLocalSymantec

2020-05-20 07:56 – 2020-05-20 07:56 – 000609208 _____ (Symantec Corporation) C:WINDOWSsystem32SymVPN.dll

2020-05-20 07:56 – 2020-05-20 07:56 – 000505120 _____ (Symantec Corporation) C:WINDOWSsystem32sysfer.dll

2020-05-20 07:56 – 2020-05-20 07:56 – 000485304 _____ (Symantec Corporation) C:WINDOWSSysWOW64SymVPN.dll

2020-05-20 07:56 – 2020-05-20 07:56 – 000434976 _____ (Symantec Corporation) C:WINDOWSSysWOW64sysfer.dll

2020-05-20 07:56 – 2020-05-20 07:56 – 000231360 _____ (Symantec Corporation) C:WINDOWSsystem32DriversSysPlant.sys

2020-05-20 07:56 – 2020-05-20 07:56 – 000224184 _____ (Symantec Corporation) C:WINDOWSsystem32FwsVpn.dll

2020-05-20 07:56 – 2020-05-20 07:56 – 000219576 _____ (Symantec Corporation) C:WINDOWSSysWOW64FwsVpn.dll

2020-05-20 07:56 – 2020-05-20 07:56 – 000099920 _____ (Symantec Corporation) C:WINDOWSsystem32DriversSYMEVENT64x86.SYS

2020-05-20 07:56 – 2020-05-20 07:56 – 000096184 _____ (Symantec Corporation) C:WINDOWSsystem32snacnp.dll

2020-05-20 07:56 – 2020-05-20 07:56 – 000085432 _____ (Symantec Corporation) C:WINDOWSSysWOW64snacnp.dll

2020-05-20 07:56 – 2020-05-20 07:56 – 000048232 _____ (Symantec Corporation) C:WINDOWSsystem32DriversWGX64.SYS

2020-05-20 07:56 – 2020-05-20 07:56 – 000010396 _____ C:WINDOWSsystem32DriversSYMEVENT64x86.CAT

2020-05-20 07:56 – 2020-05-20 07:56 – 000000000 ____D C:WINDOWSsystem32Driverssymefasi

2020-05-20 07:56 – 2020-05-20 07:56 – 000000000 ____D C:ProgramDataSymEFASI

2020-05-20 07:56 – 2020-05-20 07:56 – 000000000 ____D C:Program FilesCommon FilesSymantec Shared

2020-05-20 07:55 – 2020-05-20 16:02 – 000000000 ____D C:ProgramDataSymantec

2020-05-20 07:55 – 2020-05-20 07:56 – 000000000 ____D C:ProgramDataMicrosoftWindowsStart MenuProgramsSymantec Endpoint Protection

2020-05-20 07:55 – 2020-05-20 07:55 – 000000000 ____D C:WINDOWSsystem32DriversSEP

2020-05-20 07:55 – 2020-05-20 07:55 – 000000000 ____D C:ProgramDataregid.1992-12.com.symantec

2020-05-20 07:55 – 2020-05-20 07:55 – 000000000 ____D C:Program Files (x86)Symantec

2020-05-20 07:53 – 2020-05-20 07:53 – 000132992 _____ (Symantec Corporation) C:WINDOWSsystem32DriversTeefer.sys

2020-05-20 07:25 – 2020-06-02 17:14 – 000019912 _____ (Malwarebytes) C:WINDOWSsystem32DriversMbamElam.sys

2020-05-20 07:25 – 2020-05-20 07:25 – 000002040 _____ C:ProgramDataMicrosoftWindowsStart MenuProgramsMalwarebytes.lnk

2020-05-20 07:25 – 2020-05-20 07:25 – 000000000 ____D C:UsersEthanAppDataLocalmbamtray

2020-05-20 07:25 – 2020-05-20 07:25 – 000000000 ____D C:UsersEthanAppDataLocalmbam

2020-05-20 07:25 – 2020-05-20 07:24 – 000153312 _____ (Malwarebytes) C:WINDOWSsystem32Driversmbae64.sys

2020-05-20 07:24 – 2020-05-20 07:24 – 000000000 ____D C:ProgramDataMalwarebytes

2020-05-20 07:24 – 2020-05-20 07:24 – 000000000 ____D C:Program FilesMalwarebytes

2020-05-19 11:20 – 2020-05-19 11:20 – 006170544 _____ (Advanced Micro Devices) C:WINDOWSsystem32Driversamdacpbus.sys

2020-05-16 22:50 – 2020-05-16 22:50 – 000000000 ____D C:UsersEthanAppDataLocalLow3D Aim Trainer

2020-05-16 22:50 – 2020-05-16 22:50 – 000000000 ____D C:UsersEthanAppDataLocal3D Aim Trainer

2020-05-16 22:49 – 2020-05-16 22:49 – 000000000 ____D C:ProgramDataMicrosoftWindowsStart MenuPrograms3D Aim Trainer

2020-05-16 22:49 – 2020-05-16 22:49 – 000000000 ____D C:Program Files (x86)3D Aim Trainer Launcher

2020-05-14 07:59 – 2020-05-14 07:59 – 000000000 ____D C:UsersEthanAppDataRoamingMicrosoftWindowsStart MenuProgramsZoom

==================== One month (modified) ==================

(If an entry is included in the fixlist, the file/folder will be moved.)

2020-06-13 05:43 – 2018-07-27 21:24 – 000013008 _____ C:WINDOWSSysWOW64qengineOff.ini

2020-06-13 05:43 – 2018-07-27 21:24 – 000013008 _____ C:WINDOWSsystem32qengineOff.ini

2020-06-13 05:42 – 2019-05-04 21:51 – 000840852 _____ C:WINDOWSsystem32PerfStringBackup.INI

2020-06-13 05:42 – 2018-09-15 09:31 – 000000000 ____D C:WINDOWSINF

2020-06-13 05:40 – 2018-07-27 21:20 – 000000000 ____D C:ProgramDataQustodio

2020-06-13 05:36 – 2020-04-03 14:18 – 000000000 ____D C:ProgramDataboost_interprocess

2020-06-13 05:36 – 2019-05-04 21:52 – 000000006 ____H C:WINDOWSTasksSA.DAT

2020-06-13 05:36 – 2018-09-15 09:33 – 000000000 ____D C:ProgramDataregid.1991-06.com.microsoft

2020-06-13 05:35 – 2019-06-28 22:15 – 000000000 ____D C:UsersEthanAppDataRoaming.minecraft

2020-06-13 05:29 – 2019-05-04 21:42 – 000000000 ____D C:UsersEthan

2020-06-13 05:28 – 2018-12-18 11:43 – 000000000 ____D C:UsersEthanAppDataRoamingdiscord

2020-06-13 04:54 – 2019-05-04 21:41 – 000000000 ____D C:WINDOWSsystem32SleepStudy

2020-06-13 02:51 – 2018-09-25 19:31 – 000000000 ____D C:WINDOWSsystem32AMD

2020-06-12 20:23 – 2019-03-19 09:02 – 000000000 ___HD C:$WINDOWS.~BT

2020-06-12 19:59 – 2018-09-15 09:33 – 000000000 ____D C:WINDOWSAppReadiness

2020-06-12 19:57 – 2018-09-15 09:33 – 000000000 ___HD C:Program FilesWindowsApps

2020-06-12 19:01 – 2018-09-14 19:13 – 000000000 ____D C:Program Files (x86)Qustodio

2020-06-12 19:01 – 2018-07-27 21:24 – 000000000 __SHD C:WINDOWSSysWOW64AI_RecycleBin

2020-06-12 03:02 – 2018-09-15 09:33 – 000000000 ____D C:WINDOWSLiveKernelReports

2020-06-12 02:28 – 2020-04-06 17:11 – 000000000 ____D C:UsersEthanAppDataRoaminglunarclient

2020-06-11 03:58 – 2019-05-03 10:10 – 000000000 ___DC C:WINDOWSPanther

2020-06-09 22:11 – 2018-09-15 09:23 – 000000000 ____D C:WINDOWSCbsTemp

2020-06-09 19:14 – 2020-03-24 13:02 – 000000000 ____D C:UsersEthan.lunarclient

2020-06-09 18:08 – 2018-09-29 13:09 – 000000000 ____D C:ProgramDataMicrosoftWindowsStart MenuProgramsTerraria [GOG.com]

2020-06-09 04:19 – 2019-05-04 21:51 – 000028578 _____ C:WINDOWSdiagwrn.xml

2020-06-09 04:19 – 2019-05-04 21:51 – 000028578 _____ C:WINDOWSdiagerr.xml

2020-06-09 03:07 – 2018-09-15 09:33 – 000000000 ____D C:WINDOWSRegistration

2020-06-09 00:08 – 2018-07-27 21:22 – 000000000 ____D C:Program Files (x86)Microsoft Office

2020-06-08 23:57 – 2018-08-31 20:24 – 000000000 ____D C:UsersEthanDocumentsChurch

2020-06-08 22:16 – 2018-07-27 21:35 – 000000000 ____D C:UsersEthanAppDataLocalPackages

2020-06-08 22:12 – 2018-07-27 21:35 – 000000000 ____D C:UsersEthanAppDataRoamingAdobe

2020-06-08 22:06 – 2020-05-01 05:13 – 000000000 ____D C:Program FilesBadlion Client

2020-06-08 22:06 – 2019-05-04 21:42 – 000000000 ____D C:Usersdadministrator

2020-06-07 23:18 – 2018-07-27 21:35 – 000000000 ____D C:UsersEthanAppDataLocalVirtualStore

2020-06-07 22:50 – 2018-07-30 00:34 – 000000000 ____D C:UsersEthanAppDataLocalD3DSCache

2020-06-07 19:08 – 2019-05-04 21:41 – 000488632 _____ C:WINDOWSsystem32FNTCACHE.DAT

2020-06-05 22:24 – 2018-07-27 21:35 – 000000000 ____D C:UsersEthanAppDataLocalAMD

2020-06-05 22:19 – 2018-05-03 21:32 – 000000000 ____D C:Program FilesAMD

2020-06-05 02:56 – 2018-07-27 21:18 – 000002308 _____ C:ProgramDataMicrosoftWindowsStart MenuProgramsGoogle Chrome.lnk

2020-06-03 03:32 – 2018-09-15 09:36 – 000835480 _____ (Adobe) C:WINDOWSSysWOW64FlashPlayerApp.exe

2020-06-03 03:32 – 2018-09-15 09:36 – 000179608 _____ (Adobe) C:WINDOWSSysWOW64FlashPlayerCPLApp.cpl

2020-06-02 21:45 – 2018-07-28 19:27 – 000000000 ____D C:ProgramDataPackages

2020-06-02 21:42 – 2018-05-03 20:44 – 000000000 ____D C:ProgramDataPackage Cache

2020-06-02 21:40 – 2018-09-15 09:33 – 000000000 ____D C:Program FilesCommon Filesmicrosoft shared

2020-05-24 02:27 – 2018-09-29 08:34 – 000000000 ____D C:Program Files (x86)GOG Galaxy

2020-05-20 07:56 – 2018-09-15 09:33 – 000000000 ___HD C:WINDOWSELAMBKUP

2020-05-17 05:16 – 2018-09-15 08:09 – 000000000 ____D C:WINDOWSservicing

2020-05-14 07:59 – 2020-04-02 11:01 – 000000000 ____D C:UsersEthanAppDataRoamingZoom

==================== Files in the root of some directories ========

2020-06-02 21:50 – 2020-06-02 21:50 – 000000000 _____ () C:UsersEthanAppDataLocaloobelibMkey.log

2020-02-09 15:02 – 2020-02-09 15:02 – 000000218 _____ () C:UsersEthanAppDataLocalrecently-used.xbel

==================== FLock ==============================

2020-05-13 20:50 C:PerfLogs

2020-06-12 19:49 C:WINDOWSsystem32config

2018-09-15 09:33 C:WINDOWSsystem32Configuration

2018-09-15 09:33 C:WINDOWSsystem32DriverState

2018-09-15 09:33 C:WINDOWSsystem32FxsTmp

2018-09-15 09:34 C:WINDOWSsystem32ias

2018-09-15 09:34 C:WINDOWSsystem32MsDtc

2018-09-15 09:33 C:WINDOWSsystem32networklist

2020-06-13 04:54 C:WINDOWSsystem32SleepStudy

2020-06-13 05:29 C:WINDOWSsystem32sru

2020-06-05 22:22 C:WINDOWSsystem32Tasks

2019-05-05 07:40 C:WINDOWSsystem32Tasks_Migrated

2019-07-19 20:15 C:WINDOWSsystem32WDI

2020-06-12 19:57 C:Program FilesWindowsApps

2020-06-09 04:19 C:WINDOWSdiagerr.xml

2020-06-09 04:19 C:WINDOWSdiagwrn.xml

2019-05-05 07:38 C:WINDOWSInfusedApps

2020-06-12 03:02 C:WINDOWSLiveKernelReports

2020-02-15 18:45 C:WINDOWSMinidump

2018-09-15 09:33 C:WINDOWSModemLogs

2020-06-13 05:42 C:WINDOWSPrefetch

2019-05-04 22:10 C:WINDOWSServiceState

2020-06-13 05:41 C:WINDOWSTemp

2018-09-15 09:33 C:WINDOWSSysWOW64config

2018-09-15 09:33 C:WINDOWSSysWOW64Configuration

2018-09-15 09:33 C:WINDOWSSysWOW64Msdtc

2018-09-15 09:33 C:WINDOWSSysWOW64networklist

2018-09-15 09:33 C:WINDOWSSysWOW64sru

2018-09-15 09:33 C:WINDOWSSysWOW64Tasks

2018-09-15 09:33 C:WINDOWSsystem32DriversDriverData

2020-06-08 22:06 C:Usersdadministrator

2020-06-02 21:45 C:ProgramDataPackages

2019-05-04 21:44 C:ProgramDataUSOPrivate

==================== SigCheck ============================

(There is no automatic fix for files that do not pass verification.)

ATTENTION: ==> Could not access BCD. The user is not administrator -> The boot configuration data store could not be opened.

Access is denied.

==================== End of FRST.txt ========================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 06-06-2020

Ran by Ethan (13-06-2020 05:43:40)

Running from C:UsersEthanDesktop

Windows 10 Home Version 1809 17763.1217 (X64) (2019-05-04 19:53:29)

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-1017088884-3281645122-1580351492-500 – Administrator – Disabled)

dadministrator (S-1-5-21-1017088884-3281645122-1580351492-1001 – Administrator – Enabled) => C:Usersdadministrator

DefaultAccount (S-1-5-21-1017088884-3281645122-1580351492-503 – Limited – Disabled)

Ethan (S-1-5-21-1017088884-3281645122-1580351492-1002 – Limited – Enabled) => C:UsersEthan

Guest (S-1-5-21-1017088884-3281645122-1580351492-501 – Limited – Disabled)

WDAGUtilityAccount (S-1-5-21-1017088884-3281645122-1580351492-504 – Limited – Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Symantec Endpoint Protection (Enabled – Up to date) 1122B19A-E671-38EC-8EAC-87048FD4528D

AV: Windows Defender (Disabled – Up to date) D68DDC3A-831F-4fae-9E44-DA132C1ACF46

AV: Malwarebytes (Enabled – Up to date) 23007AD3-69FE-687C-2629-D584AFFAF72B

AS: Windows Defender (Disabled – Up to date) D68DDC3A-831F-4fae-9E44-DA132C1ACF46

FW: Symantec Endpoint Protection (Enabled) 291930BF-AC1E-39B4-A5F3-2E31710715F6

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

3D Aim Trainer Launcher version 1.01 (HKLM-x32…DEBD852F-7476-4715-B6AC-8A3C560EAAAA_is1) (Version: 1.01 – 3D Aim Trainer)

7-Zip 18.05 (x64) (HKLM…7-Zip) (Version: 18.05 – Igor Pavlov)

AMD Software (HKLM…AMD Catalyst Install Manager) (Version: 20.5.1 – Advanced Micro Devices, Inc.)

ASIO4ALL (HKLM-x32…ASIO4ALL) (Version: 2.14 – Michael Tippach)

Branding64 (HKLM…856DA29A-EA4A-468B-BBC2-B5F60DD75BFE) (Version: 1.00.0002 – Advanced Micro Devices, Inc.) Hidden

Discord (HKUS-1-5-21-1017088884-3281645122-1580351492-1002…Discord) (Version: 0.0.306 – Discord Inc.)

Discord (HKUS-1-5-21-1017088884-3281645122-1580351492-1002-ED1FC765-E35E-4C3D-BF15-2C2B11260CE4-06132020053622750…Discord) (Version: 0.0.306 – Discord Inc.)

EdgeDeflector (HKLM-x32…EdgeDeflector) (Version: – )

Epic Games Launcher Prerequisites (x64) (HKLM…66C5838F-B854-4A55-89E6-A6138747A4DF) (Version: 1.0.0.0 – Epic Games, Inc.) Hidden

Glorious Model O Software (HKLM-x32…969D386-B5B4-41BD-98E3-4A1A7D32CB97_is1) (Version: 1.0.9 – Glorious PC Gaming Race LLC.)

GOG GALAXY (HKLM-x32…7258BA11-600C-430E-A759-27E2C691A335_is1) (Version: – GOG.com)

Google Chrome (HKLM-x32…Google Chrome) (Version: 83.0.4103.97 – Google LLC)

Google Update Helper (HKLM-x32…60EC980A-BDA2-4CB6-A427-B07A5498B4CA) (Version: 1.3.35.451 – Google LLC) Hidden

Intel® PROSet/Wireless Software (HKLM-x32…3c598844-1b8b-41f0-b5b2-bc1dcf4d47ad) (Version: 20.50.0 – Intel Corporation)

Java 8 Update 181 (64-bit) (HKLM…26A24AE4-039D-4CA4-87B4-2F64180181F0) (Version: 8.0.1810.13 – Oracle Corporation)

KeePass Password Safe 2.44 (HKLM-x32…KeePassPasswordSafe2_is1) (Version: 2.44 – Dominik Reichl)

Launcher Prerequisites (x64) (HKLM-x32…c6c5a357-c7ca-4a5f-9789-3bb1af579253) (Version: 1.0.0.0 – Epic Games, Inc.) Hidden

Logger Pro 3.15 (HKLM-x32…096EA23-A525-41C3-9DBC-E7FA5F02608C) (Version: 5.185.1506 – Vernier Software & Technology)

Logitech Unifying Software 2.50 (HKLM…Logitech Unifying) (Version: 2.50.25 – Logitech)

Lunar Client (HKUS-1-5-21-1017088884-3281645122-1580351492-1002…1fcec38f-e773-5444-8669-32b8eb41524b) (Version: 2.0.2 – Moonsworth, LLC)

Lunar Client (HKUS-1-5-21-1017088884-3281645122-1580351492-1002-ED1FC765-E35E-4C3D-BF15-2C2B11260CE4-06132020053622750…1fcec38f-e773-5444-8669-32b8eb41524b) (Version: 2.0.2 – Moonsworth, LLC)

Malwarebytes version 4.1.0.56 (HKLM…35065F43-4BB2-439A-BFF7-0F1014F2E0CD_is1) (Version: 4.1.0.56 – Malwarebytes)

Microsoft 365 – en-us (HKLM…O365HomePremRetail – en-us) (Version: 16.0.12827.20268 – Microsoft Corporation)

Microsoft Visual C++ 2010 x64 Redistributable – 10.0.40219 (HKLM…1D8E6291-B0D5-35EC-8441-6616F567A0F7) (Version: 10.0.40219 – Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable – 10.0.40219 (HKLM-x32…F0C3E5D1-1ADE-321E-8167-68EF0DE699A5) (Version: 10.0.40219 – Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) – 11.0.61030 (HKLM-x32…ca67548a-5ebe-413a-b50c-4b9ceb6d66c6) (Version: 11.0.61030.0 – Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) – 11.0.61030 (HKLM-x32…33d1fd90-4274-48a1-9bc1-97e33d9c2d6f) (Version: 11.0.61030.0 – Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x64) – 12.0.40660 (HKLM-x32…ef6b00ec-13e1-4c25-9064-b2f383cb8412) (Version: 12.0.40660.0 – Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x86) – 12.0.40660 (HKLM-x32…61087a79-ac85-455c-934d-1fa22cc64f36) (Version: 12.0.40660.0 – Microsoft Corporation)

Microsoft Visual C++ 2015-2019 Redistributable (x64) – 14.23.27820 (HKLM-x32…852adda4-4c78-4a38-b583-c0b360a329d6) (Version: 14.23.27820.0 – Microsoft Corporation)

Microsoft Visual C++ 2015-2019 Redistributable (x86) – 14.23.27820 (HKLM-x32…45231ab4-69fd-486a-859d-7a59fcd11013) (Version: 14.23.27820.0 – Microsoft Corporation)

Microsoft XNA Framework Redistributable 4.0 (HKLM-x32…2BFC7AA0-544C-4E3A-8796-67F3BE655BE9) (Version: 4.0.20823.0 – Microsoft Corporation)

Minecraft (HKLM-x32…756E195A-CB58-4B99-917F-0DDA0D881204) (Version: 1.0.4.0 – Mojang)

Minecraft Launcher (HKLM-x32…E15F69FA-660D-45CC-B28F-6CBC4CAD2091) (Version: 1.0.0.0 – Mojang)

OEM Application Profile (HKLM-x32…12C2AEB0-ED60-4CCF-DD83-C65BC7CCFB50) (Version: 1.00.0000 – Advanced Micro Devices, Inc.)

Office 16 Click-to-Run Extensibility Component (HKLM-x32…90160000-008C-0000-0000-0000000FF1CE) (Version: 16.0.12827.20160 – Microsoft Corporation) Hidden

Office 16 Click-to-Run Extensibility Component 64-bit Registration (HKLM…90160000-00DD-0000-1000-0000000FF1CE) (Version: 16.0.12827.20160 – Microsoft Corporation) Hidden

Office 16 Click-to-Run Licensing Component (HKLM…90160000-008F-0000-1000-0000000FF1CE) (Version: 16.0.12827.20268 – Microsoft Corporation) Hidden

Office 16 Click-to-Run Localization Component (HKLM-x32…90160000-008C-0409-0000-0000000FF1CE) (Version: 16.0.12827.20160 – Microsoft Corporation) Hidden

PC Manager (HKLM…PC Manager) (Version: 10.0.5.51 – Huawei Technologies Co., Ltd.)

Popcorn-Time (HKUS-1-5-21-1017088884-3281645122-1580351492-1002…Popcorn-Time) (Version: 0.4.1 – Popcorn Time)

Popcorn-Time (HKUS-1-5-21-1017088884-3281645122-1580351492-1002-ED1FC765-E35E-4C3D-BF15-2C2B11260CE4-06132020053622750…Popcorn-Time) (Version: 0.4.1 – Popcorn Time)

Qustodio (HKLM-x32…3BE72491-5A26-4935-9500-4EADA48A4068) (Version: 181.11.274.0 – Qustodio Technologies) Hidden

Qustodio (HKLM-x32…Qustodio) (Version: 181.11.274.0 – Qustodio)

Realtek High Definition Audio Driver (HKLM-x32…F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC) (Version: 6.0.1.8459 – Realtek Semiconductor Corp.)

Symantec Endpoint Protection (HKLM…CE2F0EC1-BF6B-42A6-993C-1D9655D0C9DF) (Version: 14.2.5569.2100 – Symantec Corporation)

Terraria (HKLM-x32…1207665503_is1) (Version: v1.4.0.5 – GOG.com)

TI-Nspire™ CX Student Software (HKLM-x32…465DD59-DB1D-4245-9050-B5C04EED9F52) (Version: 4.5.0.1180 – Texas Instruments Inc.)

Vulkan Run Time Libraries 1.0.61.0 (HKLM…VulkanRT1.0.61.0) (Version: 1.0.61.0 – LunarG, Inc.) Hidden

Vulkan Run Time Libraries 1.1.70.0 (HKLM…VulkanRT1.1.70.0) (Version: 1.1.70.0 – LunarG, Inc.) Hidden

WDT Device Driver version 1.0.2.5 (HKLM-x32…5B06CB06-0929-48BC-BE1F-7E41461440C7_is1) (Version: 1.0.2.5 – Huawei Technologies Co., Ltd.)

Windows Driver Package – Texas Instruments Inc. (SilvrLnk) USB (06/11/2009 1.0.0.0) (HKLM…EC3E466026556D3EB760B01C4772277614354E11) (Version: 06/11/2009 1.0.0.0 – Texas Instruments Inc.)

Windows Driver Package – Texas Instruments Inc. (TIEHDUSB) USB (09/02/2009 1.0.0.1) (HKLM…7511B29C86C398B4D11A0B0E4176CAD68D1B7057) (Version: 09/02/2009 1.0.0.1 – Texas Instruments Inc.)

Wizard101 (HKUS-1-5-21-1017088884-3281645122-1580351492-1002…A9E27FF5-6294-46A8-B8FD-77B1DECA3021) (Version: 1.0.0 – KingsIsle Entertainment, Inc.)

Wizard101 (HKUS-1-5-21-1017088884-3281645122-1580351492-1002-ED1FC765-E35E-4C3D-BF15-2C2B11260CE4-06132020053622750…A9E27FF5-6294-46A8-B8FD-77B1DECA3021) (Version: 1.0.0 – KingsIsle Entertainment, Inc.)

Zoom (HKUS-1-5-21-1017088884-3281645122-1580351492-1002…ZoomUMX) (Version: 5.0 – Zoom Video Communications, Inc.)

Zoom (HKUS-1-5-21-1017088884-3281645122-1580351492-1002-ED1FC765-E35E-4C3D-BF15-2C2B11260CE4-06132020053622750…ZoomUMX) (Version: 5.0 – Zoom Video Communications, Inc.)

Packages:

=========

Adobe Reader Touch -> C:Program FilesWindowsAppsAdobeSystemsIncorporated.AdobeReader_3.1.8.7675_x86__ynb6jyjzte8ga [0000-00-00] (Adobe Systems Incorporated)

Arduino IDE -> C:Program FilesWindowsAppsArduinoLLC.ArduinoIDE_1.8.33.0_x86__mdqgnx93n4wtt [0000-00-00] (Arduino LLC)

Dolby Access -> C:Program FilesWindowsAppsDolbyLaboratories.DolbyAccess_3.0.2204.0_x64__rz1tebttyb220 [0000-00-00] (Dolby Laboratories)

Dolby Atmos Sound System -> C:Program FilesWindowsAppsDolbyLaboratories.DolbyAtmosSoundSystem_3.20201.249.0_x64__rz1tebttyb220 [0000-00-00] (Dolby Laboratories)

Microsoft Advertising SDK for XAML -> C:Program FilesWindowsAppsMicrosoft.Advertising.Xaml_10.1811.1.0_x64__8wekyb3d8bbwe [0000-00-00] (Microsoft Corporation) [MS Ad]

Microsoft Advertising SDK for XAML -> C:Program FilesWindowsAppsMicrosoft.Advertising.Xaml_10.1811.1.0_x86__8wekyb3d8bbwe [0000-00-00] (Microsoft Corporation) [MS Ad]

MPEG-2 Video Extension -> C:Program FilesWindowsAppsMicrosoft.MPEG2VideoExtension_1.0.22661.0_x64__8wekyb3d8bbwe [0000-00-00] (Microsoft Corporation)

Photos Media Engine Add-on -> C:Program FilesWindowsAppsMicrosoft.Photos.MediaEngineDLC_1.0.0.0_x64__8wekyb3d8bbwe [0000-00-00] (Microsoft Corporation)

Realtek Audio Control -> C:Program FilesWindowsAppsRealtekSemiconductorCorp.RealtekAudioControl_1.2.156.0_x64__dt26b99r8h8gj [0000-00-00] (Realtek Semiconductor Corp)

Spotify Music -> C:Program FilesWindowsAppsSpotifyAB.SpotifyMusic_1.134.694.0_x86__zpdnekdrzrea0 [0000-00-00] (Spotify AB) [Startup Task]

==================== Custom CLSID (Whitelisted): ==============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKUS-1-5-21-1017088884-3281645122-1580351492-1002_ClassesCLSIDE270DAA-1BE6-48F2-AC49-5AC63241FAAA -> [Creative Cloud Files] => C:UsersEthanCreative Cloud Files [2020-06-02 21:47]

CustomCLSID: HKUS-1-5-21-1017088884-3281645122-1580351492-1002_ClassesCLSID1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63EInprocServer32 -> C:UsersEthanAppDataLocalMicrosoftOneDrive19.152.0801.0007amd64FileSyncShell64.dll => No File

CustomCLSID: HKUS-1-5-21-1017088884-3281645122-1580351492-1002_ClassesCLSID7AFDFDDB-F914-11E4-8377-6C3BE50D980CInprocServer32 -> C:UsersEthanAppDataLocalMicrosoftOneDrive19.152.0801.0007amd64FileSyncShell64.dll => No File

CustomCLSID: HKUS-1-5-21-1017088884-3281645122-1580351492-1002_ClassesCLSID82CA8DE3-01AD-4CEA-9D75-BE4C51810A9EInprocServer32 -> C:UsersEthanAppDataLocalMicrosoftOneDrive19.152.0801.0007amd64FileSyncShell64.dll => No File

ContextMenuHandlers1: [7-Zip] -> 23170F69-40C1-278A-1000-000100020000 => C:Program Files7-Zip7-zip.dll [2018-04-30] (Igor Pavlov) [File not signed]

ContextMenuHandlers1: [HwShareMenu] -> 41b3b91f-d6b3-3430-bb86-a143f85353ca => C:Program FilesHuaweiPCManagerHwShellMenuHwShareMenu9.DLL [2020-01-10] (Huawei Technologies Co., Ltd. -> )

ContextMenuHandlers1: [LDVPMenu] -> 8BEEE74D-455E-4616-A97A-F6E86C317F32 => C:Program Files (x86)SymantecSymantec Endpoint Protection14.2.5569.2100.105Bin64vpshell2.dll [2020-05-20] (Symantec Corporation -> Symantec Corporation)

ContextMenuHandlers2: [LDVPMenu] -> 8BEEE74D-455E-4616-A97A-F6E86C317F32 => C:Program Files (x86)SymantecSymantec Endpoint Protection14.2.5569.2100.105Bin64vpshell2.dll [2020-05-20] (Symantec Corporation -> Symantec Corporation)

ContextMenuHandlers3: [MBAMShlExt] -> 57CE581A-0CB6-4266-9CA0-19364C90A0B3 => C:Program FilesMalwarebytesAnti-Malwarembshlext.dll [2020-05-20] (Malwarebytes Corporation -> Malwarebytes)

ContextMenuHandlers4: [7-Zip] -> 23170F69-40C1-278A-1000-000100020000 => C:Program Files7-Zip7-zip.dll [2018-04-30] (Igor Pavlov) [File not signed]

ContextMenuHandlers5: [ACE] -> 5E2121EE-0300-11D4-8D3B-444553540000 => C:Program FilesAMDCNextCNextatiacm64.dll [2020-05-25] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.)

ContextMenuHandlers6: [7-Zip] -> 23170F69-40C1-278A-1000-000100020000 => C:Program Files7-Zip7-zip.dll [2018-04-30] (Igor Pavlov) [File not signed]

ContextMenuHandlers6: [LDVPMenu] -> 8BEEE74D-455E-4616-A97A-F6E86C317F32 => C:Program Files (x86)SymantecSymantec Endpoint Protection14.2.5569.2100.105Bin64vpshell2.dll [2020-05-20] (Symantec Corporation -> Symantec Corporation)

ContextMenuHandlers6: [MBAMShlExt] -> 57CE581A-0CB6-4266-9CA0-19364C90A0B3 => C:Program FilesMalwarebytesAnti-Malwarembshlext.dll [2020-05-20] (Malwarebytes Corporation -> Malwarebytes)

==================== Codecs (Whitelisted) ====================

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)

ShortcutWithArgument: C:UsersEthanDocumentsShortcutsChrome School.lnk -> C:Program Files (x86)GoogleChromeApplicationchrome.exe (Google LLC) -> –profile-directory="Profile 1"

ShortcutWithArgument: C:UsersEthanDocumentsShortcutsChrome.lnk -> C:Program Files (x86)GoogleChromeApplicationchrome.exe (Google LLC) -> –profile-directory="Default"

ShortcutWithArgument: C:UsersEthanAppDataRoamingMicrosoftInternet ExplorerQuick LaunchUser PinnedTaskBarChrome.lnk -> C:Program Files (x86)GoogleChromeApplicationchrome.exe (Google LLC) -> –profile-directory="Default"

ShortcutWithArgument: C:UsersEthanAppDataRoamingMicrosoftInternet ExplorerQuick LaunchUser PinnedImplicitAppShortcutsd249d9ddd424b688Ethan – Chrome.lnk -> C:Program Files (x86)GoogleChromeApplicationchrome.exe (Google LLC) -> –profile-directory=Default

ShortcutWithArgument: C:UsersEthanAppDataRoamingMicrosoftInternet ExplorerQuick LaunchUser PinnedImplicitAppShortcuts76f9e4d33b60b312Popcorn-Time.lnk -> C:UsersEthanAppDataLocalPopcorn-TimePopcorn-Time.exe (The NW.js Community) -> –user-data-dir="C:UsersEthanAppDataLocalPopcorn-TimeUser Data" –profile-directory=Default –app-id=hecfofbbdfadifpemejbbdcjmfmboohj

==================== Loaded Modules (Whitelisted) =============

2019-07-18 11:23 – 2019-07-18 11:23 – 000017920 _____ () [File not signed] C:Program FilesAMDCNextCNextlibEGL.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 003567616 _____ () [File not signed] C:Program FilesAMDCNextCNextlibGLESv2.dll

2018-07-29 18:39 – 2018-04-30 14:00 – 000075776 _____ (Igor Pavlov) [File not signed] C:Program Files7-Zip7-zip.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 000031744 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextpluginsimageformatsqgif.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 000039424 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextpluginsimageformatsqicns.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 000031744 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextpluginsimageformatsqico.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 000413696 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextpluginsimageformatsqjpeg.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 000025088 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextpluginsimageformatsqsvg.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 000025088 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextpluginsimageformatsqtga.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 000023552 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextpluginsimageformatsqwbmp.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 000519168 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextpluginsimageformatsqwebp.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 001431040 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextpluginsplatformsqwindows.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 001180672 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextpluginssqldriversqsqlite.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 000135680 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextpluginsstylesqwindowsvistastyle.dll

2020-05-25 14:17 – 2020-05-25 14:17 – 006010880 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextQt5Core.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 006345216 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextQt5Gui.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 001078272 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextQt5Network.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 000313856 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextQt5Positioning.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 004000256 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextQt5Qml.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 003802624 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextQt5Quick.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 000171008 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextQt5QuickControls2.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 001083904 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextQt5QuickTemplates2.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 000205312 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextQt5Sql.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 000329728 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextQt5Svg.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 000113152 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextQt5WebChannel.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 000376320 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextQt5WebEngine.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 092323328 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextQt5WebEngineCore.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 005560832 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextQt5Widgets.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 000463360 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextQt5WinExtras.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 000188416 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextQt5Xml.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 002888704 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextQt5XmlPatterns.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 000053760 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextQtGraphicalEffectsprivateqtgraphicaleffectsprivate.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 000059392 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextQtGraphicalEffectsqtgraphicaleffectsplugin.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 000017408 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextQtQuick.2qtquick2plugin.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 000287232 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextQtQuickControls.2qtquickcontrols2plugin.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 000329216 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextQtQuickControlsqtquickcontrolsplugin.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 000136192 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextQtQuickDialogsdialogplugin.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 000089088 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextQtQuickLayoutsqquicklayoutsplugin.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 000312320 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextQtQuickTemplates.2qtquicktemplates2plugin.dll

2019-07-18 11:23 – 2019-07-18 11:23 – 000017920 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextQtQuickWindow.2windowplugin.dll

2020-05-25 14:17 – 2020-05-25 14:17 – 000085504 _____ (The Qt Company Ltd.) [File not signed] C:Program FilesAMDCNextCNextQtWebEngineqtwebengineplugin.dll

2019-07-31 18:28 – 2019-07-31 18:28 – 005112440 _____ (The Qt Company Oy -> The Qt Company Ltd.) [File not signed] C:Program Files (x86)QustodioqappQt5Core.dll

==================== Alternate Data Streams (Whitelisted) ========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:WINDOWSsystem32msln.exe:31b498626fde803a3eb44bd105d3469d [1818]

AlternateDataStreams: C:UsersEthanOneDrive:$3D0CE612-FDEE-43f7-8ACA-957BEC0CCBA0.SyncRootIdentity [118]

AlternateDataStreams: C:UsersPublicShared Files:VersionCache [482]

==================== Safe Mode (Whitelisted) ==================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLMSYSTEMCurrentControlSetControlSafeBootMinimalMBAMService => ""="Service"

HKLMSYSTEMCurrentControlSetControlSafeBootNetworkccSettings_D8E0573B-6B4C-4DC0-8F5C-4764B8E079F9.sys => ""="Driver"

HKLMSYSTEMCurrentControlSetControlSafeBootNetworkMBAMService => ""="Service"

HKLMSYSTEMCurrentControlSetControlSafeBootNetworkSepMasterService => ""="Service"

==================== Association (Whitelisted) =================

==================== Internet Explorer trusted/restricted ==========

==================== Hosts content: =========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2017-09-29 15:46 – 2017-09-29 15:44 – 000000824 _____ C:WINDOWSsystem32driversetchosts

2018-07-30 02:34 – 2020-03-23 22:02 – 000000854 _____ C:WINDOWSsystem32driversetchosts.ics

2.168.137.66 HUAWEI_Mate_10_lite-22508.mshome.net # 2020 3 3 25 17 48 50 703

135 Selims-android.mshome.net # 2020 3 2 17 12 35 10 156

68.137.72 iPhone.mshome.net # 2020 3 2 17 10 10 44 788

192.168.137.155 Ismails-iPhone.mshome.net # 2020 3 2 17 10 20 26 328

192.168.137.205 Mustafas-iPhone.mshome.net # 2020 3 2 17 11 31 44 941

192.168.137.135 Selims-android.mshome.net # 2020 3 2 17 11 34 45 162

45 162

==================== Other Areas ===========================

(Currently there is no automatic fix for this section.)

HKLMSystemCurrentControlSetControlSession ManagerEnvironment\Path -> C:Program Files (x86)Common FilesOracleJavajavapath;%SystemRoot%system32;%SystemRoot%;%SystemRoot%System32Wbem;%SYSTEMROOT%System32WindowsPowerShellv1.0;C:Program FilesIntelWiFibin;C:Program FilesCommon FilesIntelWirelessCommon;%SYSTEMROOT%System32OpenSSH

HKUS-1-5-21-1017088884-3281645122-1580351492-1002Control PanelDesktop\Wallpaper -> C:UsersEthanAppDataRoamingMicrosoftWindowsThemesTranscodedWallpaper

HKUS-1-5-21-1017088884-3281645122-1580351492-1002-ED1FC765-E35E-4C3D-BF15-2C2B11260CE4-06132020053622750Control PanelDesktop\Wallpaper -> C:UsersEthanAppDataRoamingMicrosoftWindowsThemesTranscodedWallpaper

DNS Servers: 68.105.28.11 – 68.105.29.11

HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorer => (SmartScreenEnabled: )

Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(If an entry is included in the fixlist, it will be removed.)

HKUS-1-5-21-1017088884-3281645122-1580351492-1002…StartupApprovedStartupFolder: => "Send to OneNote.lnk"

HKUS-1-5-21-1017088884-3281645122-1580351492-1002…StartupApprovedStartupFolder: => "Rainmeter.lnk"

HKUS-1-5-21-1017088884-3281645122-1580351492-1002…StartupApprovedRun: => "OneDrive"

HKUS-1-5-21-1017088884-3281645122-1580351492-1002…StartupApprovedRun: => "EpicGamesLauncher"

HKUS-1-5-21-1017088884-3281645122-1580351492-1002…StartupApprovedRun: => "NordVPN"

HKUS-1-5-21-1017088884-3281645122-1580351492-1002…StartupApprovedRun: => "CCXProcess"

HKUS-1-5-21-1017088884-3281645122-1580351492-1002…StartupApprovedRun: => "launchOnStartup"

HKUS-1-5-21-1017088884-3281645122-1580351492-1002-ED1FC765-E35E-4C3D-BF15-2C2B11260CE4-06132020053622750…StartupApprovedStartupFolder: => "Send to OneNote.lnk"

HKUS-1-5-21-1017088884-3281645122-1580351492-1002-ED1FC765-E35E-4C3D-BF15-2C2B11260CE4-06132020053622750…StartupApprovedStartupFolder: => "Rainmeter.lnk"

HKUS-1-5-21-1017088884-3281645122-1580351492-1002-ED1FC765-E35E-4C3D-BF15-2C2B11260CE4-06132020053622750…StartupApprovedRun: => "OneDrive"

HKUS-1-5-21-1017088884-3281645122-1580351492-1002-ED1FC765-E35E-4C3D-BF15-2C2B11260CE4-06132020053622750…StartupApprovedRun: => "EpicGamesLauncher"

HKUS-1-5-21-1017088884-3281645122-1580351492-1002-ED1FC765-E35E-4C3D-BF15-2C2B11260CE4-06132020053622750…StartupApprovedRun: => "NordVPN"

HKUS-1-5-21-1017088884-3281645122-1580351492-1002-ED1FC765-E35E-4C3D-BF15-2C2B11260CE4-06132020053622750…StartupApprovedRun: => "CCXProcess"

HKUS-1-5-21-1017088884-3281645122-1580351492-1002-ED1FC765-E35E-4C3D-BF15-2C2B11260CE4-06132020053622750…StartupApprovedRun: => "launchOnStartup"

==================== FirewallRules (Whitelisted) ================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [UDP Query User12F0F1BF-0F1F-4AB8-B85A-D9666E12CC7BC:program filesjetbrainspycharm community edition 2018.2.4binpycharm64.exe] => (Allow) C:program filesjetbrainspycharm community edition 2018.2.4binpycharm64.exe => No File

FirewallRules: [TCP Query UserAAC7522B-41B2-483C-98AB-7D9706CC568CC:program filesjetbrainspycharm community edition 2018.2.4binpycharm64.exe] => (Allow) C:program filesjetbrainspycharm community edition 2018.2.4binpycharm64.exe => No File

FirewallRules: [UDP Query UserB655ADFE-D471-4273-8DF6-3AA2EB7238D0C:usersethanappdatalocalpopcorn-timepopcorn-time.exe] => (Block) C:usersethanappdatalocalpopcorn-timepopcorn-time.exe (The NW.js Community) [File not signed]

FirewallRules: [TCP Query User3772B830-C4A3-434E-84E3-0675F7D0A32AC:usersethanappdatalocalpopcorn-timepopcorn-time.exe] => (Block) C:usersethanappdatalocalpopcorn-timepopcorn-time.exe (The NW.js Community) [File not signed]

FirewallRules: [UDP Query User88BB2546-D116-4625-B254-3335A5E7E666C:program files (x86)epic gameslauncherportalbinarieswin64epicgameslauncher.exe] => (Block) C:program files (x86)epic gameslauncherportalbinarieswin64epicgameslauncher.exe => No File

FirewallRules: [TCP Query User7AEAEE55-FD0D-4187-A7DD-74DF301A87D5C:program files (x86)epic gameslauncherportalbinarieswin64epicgameslauncher.exe] => (Block) C:program files (x86)epic gameslauncherportalbinarieswin64epicgameslauncher.exe => No File

FirewallRules: [UDP Query UserEFD389F3-4BB9-4F23-877E-D3EFCF7F504EC:usersethanappdatalocalpopcorn-timepopcorn-time.exe] => (Block) C:usersethanappdatalocalpopcorn-timepopcorn-time.exe (The NW.js Community) [File not signed]

FirewallRules: [TCP Query User55312368-2298-429C-8470-337C2DFF83EBC:usersethanappdatalocalpopcorn-timepopcorn-time.exe] => (Block) C:usersethanappdatalocalpopcorn-timepopcorn-time.exe (The NW.js Community) [File not signed]

FirewallRules: [UDP Query User87D15FF9-546C-4936-80E1-FA5C69CFB167C:program filesepic gamesfortnitefortnitegamebinarieswin64fortniteclient-win64-shipping.exe] => (Block) C:program filesepic gamesfortnitefortnitegamebinarieswin64fortniteclient-win64-shipping.exe => No File

FirewallRules: [TCP Query UserB3624AFD-AF17-4707-AE2A-1FA524548AE6C:program filesepic gamesfortnitefortnitegamebinarieswin64fortniteclient-win64-shipping.exe] => (Block) C:program filesepic gamesfortnitefortnitegamebinarieswin64fortniteclient-win64-shipping.exe => No File

FirewallRules: [UDP Query UserBED176F5-E088-4E80-A439-A2E0C5296F65C:program files (x86)epic gameslauncherportalbinarieswin64epicgameslauncher.exe] => (Block) C:program files (x86)epic gameslauncherportalbinarieswin64epicgameslauncher.exe => No File

FirewallRules: [TCP Query UserE8066C27-5541-4B56-82F1-DC100EEC4D6AC:program files (x86)epic gameslauncherportalbinarieswin64epicgameslauncher.exe] => (Block) C:program files (x86)epic gameslauncherportalbinarieswin64epicgameslauncher.exe => No File

FirewallRules: [UDP Query UserEB916461-5625-4A23-8084-B456FFFB8368C:program files (x86)ti educationti-nspire cx student softwarejrebinjava.exe] => (Block) C:program files (x86)ti educationti-nspire cx student softwarejrebinjava.exe

FirewallRules: [TCP Query UserFA84BDB4-5A67-486F-B1CD-3E992B6E3C80C:program files (x86)ti educationti-nspire cx student softwarejrebinjava.exe] => (Block) C:program files (x86)ti educationti-nspire cx student softwarejrebinjava.exe

FirewallRules: [UDP Query User36DCE1FF-F8D8-495A-A43E-D2BF089793F5C:program files (x86)ti educationti-nspire cx student softwareti-nspire cx student software.exe] => (Block) C:program files (x86)ti educationti-nspire cx student softwareti-nspire cx student software.exe (Texas Instruments -> Texas Instruments Incorporated)

FirewallRules: [TCP Query User645C505C-46E6-4752-9BC5-AA58291278D5C:program files (x86)ti educationti-nspire cx student softwareti-nspire cx student software.exe] => (Block) C:program files (x86)ti educationti-nspire cx student softwareti-nspire cx student software.exe (Texas Instruments -> Texas Instruments Incorporated)

FirewallRules: [36DD776C-BEF9-4E6F-AD69-D718727D2319] => (Allow) C:Program FilesIntelWiFibinPanDhcpDns.exe (Intel Corporation -> )

FirewallRules: [TCP Query UserCBBD9637-D57F-4C62-BCCE-9A803B3B51EEC:program files (x86)minecraftruntimejre-x641.8.0_51binjavaw.exe] => (Block) C:program files (x86)minecraftruntimejre-x641.8.0_51binjavaw.exe => No File

FirewallRules: [UDP Query User5276D7A7-B6C4-4FFB-8C82-6EFA3165BB39C:program files (x86)minecraftruntimejre-x641.8.0_51binjavaw.exe] => (Block) C:program files (x86)minecraftruntimejre-x641.8.0_51binjavaw.exe => No File

FirewallRules: [TCP Query UserEF82179C-59B6-4ADE-A26D-446FA52A5CCDC:usersethandownloadsruntimejre-x64binjavaw.exe] => (Block) C:usersethandownloadsruntimejre-x64binjavaw.exe => No File

FirewallRules: [UDP Query User6A83EBA7-F319-4BCF-8D93-1EDB3C5AACFCC:usersethandownloadsruntimejre-x64binjavaw.exe] => (Block) C:usersethandownloadsruntimejre-x64binjavaw.exe => No File

FirewallRules: [TCP Query User3FCC1C5D-9C46-4511-A102-919442135289C:program files (x86)minecraftruntimejre-x64binjavaw.exe] => (Block) C:program files (x86)minecraftruntimejre-x64binjavaw.exe

FirewallRules: [UDP Query User1AE9246F-C286-436B-BB56-3037FBD0481FC:program files (x86)minecraftruntimejre-x64binjavaw.exe] => (Block) C:program files (x86)minecraftruntimejre-x64binjavaw.exe

FirewallRules: [TCP Query User02EFDE10-5C83-432F-ADA9-8BB6C6F18B59C:program fileswindowsappsarduinollc.arduinoide_1.8.21.0_x86__mdqgnx93n4wttjavabinjavaw.exe] => (Block) C:program fileswindowsappsarduinollc.arduinoide_1.8.21.0_x86__mdqgnx93n4wttjavabinjavaw.exe => No File

FirewallRules: [UDP Query User984318C3-E844-45F5-95DF-9A4E8E08A073C:program fileswindowsappsarduinollc.arduinoide_1.8.21.0_x86__mdqgnx93n4wttjavabinjavaw.exe] => (Block) C:program fileswindowsappsarduinollc.arduinoide_1.8.21.0_x86__mdqgnx93n4wttjavabinjavaw.exe => No File

FirewallRules: [TCP Query UserB552C42A-EC61-4C72-8990-FE2ED796B10FC:program files (x86)ti educationti-nspire cx student softwareti-nspire cx student software.exe] => (Block) C:program files (x86)ti educationti-nspire cx student softwareti-nspire cx student software.exe (Texas Instruments -> Texas Instruments Incorporated)

FirewallRules: [UDP Query UserD3A17CA4-E12F-4B7A-96D3-066637371298C:program files (x86)ti educationti-nspire cx student softwareti-nspire cx student software.exe] => (Block) C:program files (x86)ti educationti-nspire cx student softwareti-nspire cx student software.exe (Texas Instruments -> Texas Instruments Incorporated)

FirewallRules: [TCP Query User9F107497-D41A-46D3-80D9-C6B45B400C64C:program fileswindowsappsarduinollc.arduinoide_1.8.33.0_x86__mdqgnx93n4wttjavabinjavaw.exe] => (Block) C:program fileswindowsappsarduinollc.arduinoide_1.8.33.0_x86__mdqgnx93n4wttjavabinjavaw.exe

FirewallRules: [UDP Query User5FF66BEF-280F-4A88-A2EF-C5DA5956F1AFC:program fileswindowsappsarduinollc.arduinoide_1.8.33.0_x86__mdqgnx93n4wttjavabinjavaw.exe] => (Block) C:program fileswindowsappsarduinollc.arduinoide_1.8.33.0_x86__mdqgnx93n4wttjavabinjavaw.exe

FirewallRules: [TCP Query UserD1CECEFF-BED1-4434-B871-8D5885AB6954C:alphaantileakaalbinserveralphaantileak.exe] => (Block) C:alphaantileakaalbinserveralphaantileak.exe (Constantin Schreiber -> )

FirewallRules: [UDP Query User126BD9DD-AF43-48E6-B4D2-BD72730DC3FAC:alphaantileakaalbinserveralphaantileak.exe] => (Block) C:alphaantileakaalbinserveralphaantileak.exe (Constantin Schreiber -> )

FirewallRules: [TCP Query User9D7BDA86-7780-4BCB-9F94-9EF418916881C:program files (x86)minecraft launcherruntimejre-x64binjavaw.exe] => (Block) C:program files (x86)minecraft launcherruntimejre-x64binjavaw.exe

FirewallRules: [UDP Query UserD5BF7527-430F-4B92-BCA0-899E2AF39F0AC:program files (x86)minecraft launcherruntimejre-x64binjavaw.exe] => (Block) C:program files (x86)minecraft launcherruntimejre-x64binjavaw.exe

FirewallRules: [6FC5A841-7F25-40DE-8A63-9D024257A7B8] => (Allow) C:Program Files (x86)Microsoft OfficerootOffice16outlook.exe (Microsoft Corporation -> Microsoft Corporation)

FirewallRules: [TCP Query User81B37590-D222-4DC8-8999-59D3EDCA5718C:programdatabadlionclientjrebinjavaw.exe] => (Block) C:programdatabadlionclientjrebinjavaw.exe

FirewallRules: [UDP Query User14E58F6C-EBC9-4F1F-9F87-8795FF5F6FB8C:programdatabadlionclientjrebinjavaw.exe] => (Block) C:programdatabadlionclientjrebinjavaw.exe

FirewallRules: [TCP Query User250ED133-0730-488D-A1D2-179D8124346CC:program fileswe_clientwecdt.exe] => (Allow) C:program fileswe_clientwecdt.exe => No File

FirewallRules: [UDP Query UserE77D4C9A-65EF-415A-A9F6-720AA01E83F1C:program fileswe_clientwecdt.exe] => (Allow) C:program fileswe_clientwecdt.exe => No File

FirewallRules: [BE86A0A2-2E3A-45BF-BD16-4FA988C2D2CF] => (Allow) C:Program FilesHuaweiPCManagerMBAMessageCenter.exe (Huawei Technologies Co., Ltd. -> )

FirewallRules: [582DC69D-F666-438F-AEEF-F7A98301E425] => (Allow) C:Program Files (x86)SymantecSymantec Endpoint Protection14.2.5569.2100.105BinccSvcHst.exe (Symantec Corporation -> Symantec Corporation)

FirewallRules: [5B801E2C-89CA-45F2-8C8A-E34140BA5CB2] => (Allow) C:Program Files (x86)SymantecSymantec Endpoint Protection14.2.5569.2100.105BinccSvcHst.exe (Symantec Corporation -> Symantec Corporation)

FirewallRules: [D01E0175-B747-4800-B9EF-8D085402C350] => (Allow) C:Program Files (x86)SymantecSymantec Endpoint Protection14.2.5569.2100.105Bin64snac64.exe (Symantec Corporation -> Symantec Corporation)

FirewallRules: [3B512B5A-785E-4623-9D5E-A0B20854D1AA] => (Allow) C:Program Files (x86)SymantecSymantec Endpoint Protection14.2.5569.2100.105Bin64snac64.exe (Symantec Corporation -> Symantec Corporation)

FirewallRules: [EE510510-A744-49B4-A8FB-3BCD9EC53DF5] => (Allow) C:Program FilesWindowsAppsSpotifyAB.SpotifyMusic_1.134.694.0_x86__zpdnekdrzrea0Spotify.exe (Spotify AB -> Spotify Ltd)

FirewallRules: [398E3692-9769-4C56-8B5B-47860A11AC06] => (Allow) C:Program FilesWindowsAppsSpotifyAB.SpotifyMusic_1.134.694.0_x86__zpdnekdrzrea0Spotify.exe (Spotify AB -> Spotify Ltd)

FirewallRules: [AE3B13C3-5BAC-4FCD-925E-65903C1B41E6] => (Allow) C:Program FilesWindowsAppsSpotifyAB.SpotifyMusic_1.134.694.0_x86__zpdnekdrzrea0Spotify.exe (Spotify AB -> Spotify Ltd)

FirewallRules: [83D17164-7624-4A27-8562-A4FAD02C5D6A] => (Allow) C:Program FilesWindowsAppsSpotifyAB.SpotifyMusic_1.134.694.0_x86__zpdnekdrzrea0Spotify.exe (Spotify AB -> Spotify Ltd)

FirewallRules: [7CE68124-5460-4E6B-9835-6B827DFAFEE4] => (Allow) C:Program FilesWindowsAppsSpotifyAB.SpotifyMusic_1.134.694.0_x86__zpdnekdrzrea0Spotify.exe (Spotify AB -> Spotify Ltd)

FirewallRules: [49B3A2C1-1884-4FBC-AEAB-3D91BAF96F05] => (Allow) C:Program FilesWindowsAppsSpotifyAB.SpotifyMusic_1.134.694.0_x86__zpdnekdrzrea0Spotify.exe (Spotify AB -> Spotify Ltd)

FirewallRules: [FA9DE9FF-0B3D-4BF4-9967-5F9758AC2AF9] => (Allow) C:Program FilesWindowsAppsSpotifyAB.SpotifyMusic_1.134.694.0_x86__zpdnekdrzrea0Spotify.exe (Spotify AB -> Spotify Ltd)

FirewallRules: [94F091D3-8AB0-4970-9FF7-69DFB31E5651] => (Allow) C:Program FilesWindowsAppsSpotifyAB.SpotifyMusic_1.134.694.0_x86__zpdnekdrzrea0Spotify.exe (Spotify AB -> Spotify Ltd)

FirewallRules: [7AEC1DCC-8FBC-4CAE-8D3D-3D42B7A3B744] => (Allow) C:Program Files (x86)GoogleChromeApplicationchrome.exe (Google LLC -> Google LLC)

FirewallRules: [C59750B7-A6AD-486A-886B-D9F7DC67C995] => (Allow) %programfiles%Qustodioqappqwelcomewzd.exe => No File

FirewallRules: [6C6EC456-3AE1-487B-A7E7-9E1897801E6B] => (Allow) %programfiles%QustodioqappQUpdateService.exe => No File

FirewallRules: [68715DB0-C67D-4FF5-AA9C-FAE2AF083407] => (Allow) %programfiles%QustodioqappQReport.exe => No File

FirewallRules: [32281869-1447-48F6-AB4A-0AE369098AD9] => (Allow) %programfiles%Qustodioqproxyqengine.exe => No File

FirewallRules: [87EFFECC-2FD3-40DB-8A19-C7CE3164F080] => (Allow) %programfiles%QustodioqappQAppTray.exe => No File

==================== Restore Points =========================

ATTENTION: System Restore is disabled (Total:237.36 GB) (Free:96.61 GB) (41%)

Check "VSS" service

==================== Faulty Device Manager Devices ============

==================== Event log errors: ========================

Application errors:

==================

Error: (06/13/2020 05:34:12 AM) (Source: Symantec Network Protection) (EventID: 400) (User: )

Description: Memory Exploit Mitigation is malfunctioning

Error: (06/13/2020 05:33:19 AM) (Source: Symantec AntiVirus) (EventID: 80) (User: )

Description: Symantec Endpoint Protection has failed to load the latest virus definitions.

Error: (06/13/2020 05:33:03 AM) (Source: Symantec AntiVirus) (EventID: 80) (User: )

Description: Symantec Endpoint Protection has failed to load the latest virus definitions.

Error: (06/13/2020 05:26:46 AM) (Source: Symantec AntiVirus) (EventID: 51) (User: )

Description: Security Risk Found! Hacktool.ProcHack in File: c:UsersEthandownloadsprocesshacker-2.39-binx64kprocesshacker.sys by: Auto-Protect scan. Action: Quarantine failed : Leave Alone failed. Action Description: Reboot Processing

Error: (06/13/2020 05:26:44 AM) (Source: Symantec AntiVirus) (EventID: 51) (User: )

Error: (06/13/2020 05:26:43 AM) (Source: Symantec AntiVirus) (EventID: 51) (User: )

System errors:

=============

Error: (06/13/2020 05:42:37 AM) (Source: DCOM) (EventID: 10016) (User: ETHANLAPTOP)

Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID