15 replies to this topic

[Krishna]

This PC has Windows 8.1 on it, running Google Chrome Version 76.0.3809.100 (Official Build) (64-bit)

 

The problem my sister's PC had in the beginning when I started playing with it, was that during Windows Updates, the following message was on the Screen, "We couldn't complete the updates.  Undoing Changes.  Don't turn off your computer."

 

I was under the "assumption," that when Windows 8.1 first was available, the provision set forth by Microsoft was that it was going to update your 8.1 computer to Windows 10 whether you wanted it or not.  I was thinking that maybe it was in the process of doing that and that's why 8.1 wouldn't update.  Initially the first time around in trying to fix the update problem, I downloaded Malwarebytes and it found 45 PUPs which it quarantined.  I also ran CCleaner and it fixed a bunch of stuff.  And finally I ran TFC.exe to get rid of any temp files that might have not been needed.

 

When I attempted to have Windows check for Updates, it downloaded them, but didn't install them because the updater still isn't working and still get the message same as above.  So then I did a Refresh on it, but don't know if that has fixed the update issue?

 

I was not able to run the Farbar Recovery Scan Tool.  Program says I need an Application to run it.

 

I ran the Eset Online Scanner.  It found 9 things wrong, but I don't know how to access the log.

 

Bit Defender Agent doesn't like AVG

 

Trend Micro House Call says there's a Privacy Error

 

The F Secure Online Scanner did not find any threats.

 

Here's the Logs I do Have.

 

Malwarebytes

www.malwarebytes.com

 

-Log Details-

Scan Date: 8/10/19

Scan Time: 5:37 PM

Log File: 057f103b-bbb7-11e9-bc33-10c37b4c8808.json

 

-Software Information-

Version: 3.8.3.2965

Components Version: 1.0.613

Update Package Version: 1.0.11950

License: Trial

 

-System Information-

OS: Windows 8.1

CPU: x64

File System: NTFS

User: mjpc\mj

 

-Scan Summary-

Scan Type: Threat Scan

Scan Initiated By: Manual

Result: Completed

Objects Scanned: 222755

Threats Detected: 1

Threats Quarantined: 1

Time Elapsed: 1 min, 34 sec

 

-Scan Options-

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Detect

PUM: Detect

 

-Scan Details-

Process: 0

(No malicious items detected)

 

Module: 0

(No malicious items detected)

 

Registry Key: 0

(No malicious items detected)

 

Registry Value: 0

(No malicious items detected)

 

Registry Data: 0

(No malicious items detected)

 

Data Stream: 0

(No malicious items detected)

 

Folder: 0

(No malicious items detected)

 

File: 1

PUP.Optional.Conduit, C:\USERS\MJ\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Replaced, [205], [454832],1.0.11950

 

Physical Sector: 0

(No malicious items detected)

 

WMI: 0

(No malicious items detected)

 

 

(end)

 

&

 

Result of Security Analysis by Rocket Grannie (x86) Updated: 09th, August 2019

Running from:C:\Users\mj\Desktop (18:19:57 - 08/10/2019)

***---------------------------------------------------------***

Microsoft Windows 8.1 X64

UAC is Enabled

Internet Explorer 11

Default Browser: Google Chrome

***------------Antivirus - Antispyware - Firewall-----------***

Windows Defender (Disabled - up to Date)

AVG Antivirus (Enabled - up to Date)

Malwarebytes (Enabled - up to Date)

Malwarebytes (Enabled - up to Date)

Windows Defender (Disabled - up to Date)

AVG Antivirus (Enabled - up to Date)

Windows Firewall (Enabled)

No other Firewall Installed

***-------Security Programs - Browsers - Miscellaneous------***

Adobe Flash Player NPAPI is not installed

CCleaner (5.60)

Google Chrome (76.0.3809.100)

Malwarebytes (3.8.3.2965)

 

***----------------Analysis Complete-------------------------***

 

Thanks in advance,

 

Krishna

 

[nasdaq]

Hello, Welcome to Spywareinfo Forum

I'm nasdaq and will be helping you.

 

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.

===

 

Please boot the computer in Safe Mode and run the Farbar program.

 

If successful post the FRST.TXT and Addition.txt logs for my review.

 

Wait for further instructions.

===

 

 

Now try this. Follow the instructions on each step.

 

Locate the CMD.EXE and run it as an Administrator.

 

At the DOS prompt execute this command in bold.

 

a) net stop wuauserv

b) net stop bits

c) net stop cryptSvc

d) net stop msiserver

 

Renames the C:\Windows\SoftwareDistribution folder to C:\Windows\SoftwareDistribution.old , essentially clearing the Windows Update download cache so that it can start over.

 

Restart the Windows Update service

a) net start wuauserv

b) net start cryptSvc

c) net start bits

d) net start msiserver

 

 

Restart the computer normally.

 

Can you now install the missing Windows Updates?

<<<>>>

[Krishna]

When I got to Safe Mode on my Sister's PC, I remembered that I didn't have the Farbar Recovery Scan Tool.  You said Safe Mode.  Maybe I should've done Safe Mode with Networking (?), because in Safe Mode I didn't have access to the Internet.  After I rebooted I went to Bleeping Computer to find the FRST64.exe file, but at Bleeping it's like being on Google.  So then I came back here, but I couldn't remember how to get to the page for "Instructions For Posting Requested Logs," so I could get the link for the Farbar Recovery Scan Tool.  Luckily my Sister uses Google Chrome.  I was able to access my Gmail account and get the link Rocker Grannie gave me in an email.  Eset Online Scanner must have fixed the issue with the Farbar Recovery Scan Tool, not working yesterday, because yesterday the Tool said it needed a application to run.

 

You didn't specify if I was to run your next instructions in Safe Mode or Normal Mode.  To access the Administrator's Command Prompt, I just right mouse clicked on the Window's Start key and selected Administrators Command Prompt.  By changing the Font in Notepad I was able to select bold.  I just typed in Notepad what you had listed for stopping and starting the Windows Update Service.  I was able to copy and paste each command followed by the Enter key and was amazed to see that it ran the command.  I had to save the File, because Windows said I had to reboot to Normal from Safe Mode, so the Administrator's Command Prompt would accept the commands for restarting the Windows Update Service, which it did.

 

I went to Windows Update in Control Panel and had it Search for New Updates.  After 15 minutes of watch the horizontal thermometer moving in the Searching for Updates Window, I exited Control Panel.  Windows Updater is either not working, or there are no updates.

 

Here are the logs you requested from me.

 

FRST.txt

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 10-08-2019

Ran by mj (administrator) on MJPC (ASUS All Series) (11-08-2019 21:20:01)

Running from C:\Users\mj\Desktop

Loaded Profiles: mj (Available Profiles: mj)

Platform: Windows 8.1 (X64) Language: English (United States)

Default browser: Chrome

Boot Mode: Safe Mode (minimal)

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

 

==================== Processes (Whitelisted) =================

 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

 

(Microsoft Windows -> Microsoft Corporation) C:\Windows\HelpPane.exe

(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe

 

==================== Registry (Whitelisted) ===========================

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

 

HKLM\...\Run: [AVGUI.exe] => C:\Program Files\AVG\Antivirus\AvLaunch.exe [316848 2019-07-27] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [843712 2012-04-04] (Adobe Systems, Incorporated -> Adobe Systems Incorporated)

HKU\S-1-5-21-3810651120-1967127889-315127114-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\scrnsave.scr [11776 2013-08-22] (Microsoft Windows -> Microsoft Corporation)

HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\76.0.3809.100\Installer\chrmstp.exe [2019-08-07] (Google LLC -> Google LLC)

FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION

 

==================== Scheduled Tasks (Whitelisted) =============

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

Task: {05975CD6-672E-44D9-B5DE-692604748E29} - System32\Tasks\EOSv3 Scheduler onTime => C:\Users\mj\Desktop\esetonlinescanner_enu.exe [7969304 2019-08-10] (ESET, spol. s r.o. -> ESET spol. s r.o.)

Task: {1200C363-AD23-4B5E-8D91-23BD58B3591D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [156456 2019-07-27] (Google Inc -> Google LLC)

Task: {19221A11-871E-4023-8F1E-6B56AA174BFB} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [16835256 2019-07-11] (Piriform Software Ltd -> Piriform Software Ltd)

Task: {1D10B8AF-4D3C-4317-8122-2DF680BAA713} - System32\Tasks\Driver Support-RTMUpdater => C:\Program Files (x86)\Driver Support\DriverSupport.exe [10714752 2018-12-12] (PC DRIVERS HEADQUARTERS I, INC -> PC Drivers Headquarters LP) <==== ATTENTION

Task: {1DC742D2-3829-4715-8035-B6A4BFA47FBE} - System32\Tasks\Driver Support-RTMRules => C:\Program Files (x86)\Driver Support\DriverSupport.exe [10714752 2018-12-12] (PC DRIVERS HEADQUARTERS I, INC -> PC Drivers Headquarters LP) <==== ATTENTION

Task: {4E7ADB49-3725-4FFE-B2A7-C9BCA910E987} - System32\Tasks\Antivirus Emergency Update => C:\Program Files\AVG\Antivirus\AvEmUpdate.exe [3987888 2019-07-27] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)

Task: {56D905B5-9F52-49E0-8C29-67FE05329AFD} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_32_0_0_223_pepper.exe [1453112 2019-07-28] (Adobe Inc. -> Adobe)

Task: {743FD5F4-5F03-4AE2-918A-D86C08C16B74} - System32\Tasks\Driver Support => C:\Program Files (x86)\Driver Support\DriverSupport.exe [10714752 2018-12-12] (PC DRIVERS HEADQUARTERS I, INC -> PC Drivers Headquarters LP) <==== ATTENTION

Task: {8829A589-1C0D-4373-BE0A-B733C9E62769} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [156456 2019-07-27] (Google Inc -> Google LLC)

Task: {88854AB4-A662-4F50-A36B-B6412C631E24} - System32\Tasks\AVG\Overseer => C:\Program Files\Common Files\AVG\Overseer\overseer.exe [2081712 2019-08-08] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)

Task: {8E1C0F25-0283-4880-8577-BAC12EA59849} - System32\Tasks\EOSv3 Scheduler onLogOn => C:\Users\mj\Desktop\esetonlinescanner_enu.exe [7969304 2019-08-10] (ESET, spol. s r.o. -> ESET spol. s r.o.)

Task: {900FE79B-98F7-4078-98B9-3738556ADEE8} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [619416 2019-07-11] (Piriform Software Ltd -> Piriform Software Ltd)

Task: {C2456C5E-1F92-4F8F-A823-843E3A00E3F8} - System32\Tasks\Driver Support-RTMScan => C:\Program Files (x86)\Driver Support\DriverSupport.exe [10714752 2018-12-12] (PC DRIVERS HEADQUARTERS I, INC -> PC Drivers Headquarters LP) <==== ATTENTION

Task: {C3842C6E-D196-44CF-B4AC-77D6FD0B15D4} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [335416 2019-07-28] (Adobe Inc. -> Adobe)

 

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

 

 

==================== Internet (Whitelisted) ====================

 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

 

Tcpip\Parameters: [DhcpNameServer] 209.18.47.63 209.18.47.62

Tcpip\..\Interfaces\{08333B4B-2B4A-44B6-852A-F9BBD839B240}: [DhcpNameServer] 209.18.47.63 209.18.47.62

Tcpip\..\Interfaces\{E8CA8C53-C80A-4865-9324-2EDB5C311F42}: [DhcpNameServer] 209.18.47.63 209.18.47.62

 

Internet Explorer:

==================

BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-04-04] (Adobe Systems, Incorporated -> Adobe Systems Incorporated)

 

FireFox:

========

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.34.11\npGoogleUpdate3.dll [2019-07-27] (Google Inc -> Google LLC)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.34.11\npGoogleUpdate3.dll [2019-07-27] (Google Inc -> Google LLC)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2012-04-04] (Adobe Systems, Incorporated -> Adobe Systems Inc.)

 

Chrome: 

=======

CHR HomePage: Default -> hxxp://search.conduit.com/?ctid=CT3289663&SearchSource=48&CUI=UN20142812231541829&UM=2

CHR Session Restore: Default -> is enabled.

CHR Profile: C:\Users\mj\AppData\Local\Google\Chrome\User Data\Default [2019-08-11]

CHR DownloadDir: C:\Users\mj\Desktop

CHR Extension: (Google Drive) - C:\Users\mj\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2019-07-27]

CHR Extension: (YouTube) - C:\Users\mj\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2019-07-27]

CHR Extension: (Chrome Web Store Payments) - C:\Users\mj\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2019-07-27]

CHR Extension: (Gmail) - C:\Users\mj\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2019-07-27]

CHR Extension: (Chrome Media Router) - C:\Users\mj\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2019-08-08]

CHR Profile: C:\Users\mj\AppData\Local\Google\Chrome\User Data\System Profile [2019-08-08]

CHR HKLM-x32\...\Chrome\Extension: [mbckjcfnjmoiinpgddefodcighgikkgn] - hxxps://clients2.google.com/service/update2/crx

 

==================== Services (Whitelisted) ====================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

S2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.01.02\atkexComSvc.exe [936728 2013-07-03] (ASUSTeK Computer Inc. -> )

S2 AVG Antivirus; C:\Program Files\AVG\Antivirus\AVGSvc.exe [415032 2019-07-27] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)

S3 avgbIDSAgent; C:\Program Files\AVG\Antivirus\aswidsagent.exe [6845400 2019-07-27] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)

S2 DSAO; C:\Program Files (x86)\driver support\svc\DriverSupportAOsvc.exe [2033104 2016-10-22] (PC DRIVERS HEADQUARTERS I, INC -> PC Drivers HeadQuarters LP) <==== ATTENTION

S2 igfxCUIService1.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [355232 2015-08-09] (Intel Corporation - pGFX -> Intel Corporation)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [346872 2013-08-22] (Microsoft Corporation -> Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23840 2013-08-22] (Microsoft Corporation -> Microsoft Corporation)

S2 WirelessKB850NotificationService; C:\WINDOWS\system32\WirelessKB850NotificationService.exe [176632 2018-05-14] (Microsoft Corporation -> Microsoft Corporation)

 

===================== Drivers (Whitelisted) ======================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

S1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2013-07-03] (ASUSTeK Computer Inc. -> )

R0 avgArDisk; C:\WINDOWS\System32\drivers\avgArDisk.sys [37368 2019-07-27] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)

S1 avgArPot; C:\WINDOWS\System32\drivers\avgArPot.sys [209304 2019-07-27] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)

S1 avgbidsdriver; C:\WINDOWS\System32\drivers\avgbidsdriver.sys [263784 2019-07-27] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)

S0 avgbidsh; C:\WINDOWS\System32\drivers\avgbidsh.sys [206624 2019-07-27] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)

S0 avgbuniv; C:\WINDOWS\System32\drivers\avgbuniv.sys [61736 2019-07-27] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)

R1 avgKbd; C:\WINDOWS\System32\drivers\avgKbd.sys [42552 2019-07-27] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)

S2 avgMonFlt; C:\WINDOWS\System32\drivers\avgMonFlt.sys [168944 2019-07-31] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)

S1 avgRdr; C:\WINDOWS\System32\drivers\avgRdr2.sys [112568 2019-07-27] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)

S0 avgRvrt; C:\WINDOWS\System32\drivers\avgRvrt.sys [88208 2019-07-27] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)

S1 avgSnx; C:\WINDOWS\System32\drivers\avgSnx.sys [1030832 2019-07-31] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)

S1 avgSP; C:\WINDOWS\System32\drivers\avgSP.sys [477336 2019-07-27] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)

S2 avgStm; C:\WINDOWS\System32\drivers\avgStm.sys [225864 2019-07-27] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)

S0 avgVmm; C:\WINDOWS\System32\drivers\avgVmm.sys [387736 2019-08-05] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)

S3 bcmfn2; C:\WINDOWS\System32\drivers\bcmfn2.sys [17624 2013-08-12] (Broadcom Corporation -> Windows ® Win 7 DDK provider)

R3 dc3d; C:\WINDOWS\System32\drivers\dc3d.sys [47616 2011-05-18] (Hardware Group Test Cert -> Microsoft Corporation)

S3 e1dexpress; C:\WINDOWS\system32\DRIVERS\e1d62x64.sys [534512 2017-04-25] (Intel® INTELND1617 -> Intel Corporation)

S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [34760 2013-08-22] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)

S0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [265056 2013-08-22] (Microsoft Windows -> Microsoft Corporation)

S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [124256 2013-08-22] (Microsoft Windows -> Microsoft Corporation)

R3 WirelessKeyboardFilter; C:\WINDOWS\System32\drivers\WirelessKeyboardFilter.sys [49336 2018-03-11] (Microsoft Corporation -> Microsoft Corporation)

 

==================== NetSvcs (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

 

==================== One month (created) ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2019-08-11 21:20 - 2019-08-11 21:20 - 000012171 _____ C:\Users\mj\Desktop\FRST.txt

2019-08-11 21:19 - 2019-08-11 21:20 - 000000000 ____D C:\FRST

2019-08-11 21:03 - 2019-08-11 21:03 - 002097664 _____ (Farbar) C:\Users\mj\Desktop\FRST64.exe

2019-08-11 21:01 - 2019-08-11 21:01 - 001448960 _____ (Farbar) C:\Users\mj\Desktop\FRST.exe

2019-08-11 21:00 - 2019-08-11 21:00 - 000000232 _____ C:\Users\mj\Documents\SteveFix.txt

2019-08-11 20:37 - 2019-08-11 21:20 - 000343132 _____ C:\WINDOWS\ntbtlog.txt

2019-08-10 20:24 - 2019-08-11 20:37 - 000000000 ____D C:\Users\mj\AppData\Local\FSDART

2019-08-10 20:24 - 2019-08-10 20:27 - 000000000 ____D C:\ProgramData\F-Secure

2019-08-10 20:24 - 2019-08-10 20:24 - 000000000 ____D C:\Users\mj\AppData\Local\F-Secure

2019-08-10 20:23 - 2019-08-10 20:23 - 009603600 _____ (F-Secure Corporation) C:\Users\mj\Desktop\F-SecureOnlineScanner.exe

2019-08-10 20:18 - 2019-08-10 20:18 - 000060784 _____ C:\ProgramData\agent.uninstall.1565482727.bdinstall.v2.bin

2019-08-10 20:15 - 2019-08-10 20:15 - 000102296 _____ C:\ProgramData\agent.1565482537.bdinstall.v2.bin

2019-08-10 20:15 - 2019-08-10 20:15 - 000000000 ____D C:\ProgramData\Bitdefender Agent

2019-08-10 19:01 - 2019-08-11 19:57 - 000003692 _____ C:\WINDOWS\System32\Tasks\EOSv3 Scheduler onLogOn

2019-08-10 19:01 - 2019-08-11 19:57 - 000003252 _____ C:\WINDOWS\System32\Tasks\EOSv3 Scheduler onTime

2019-08-10 18:31 - 2019-08-10 20:28 - 000000536 _____ C:\Users\mj\Desktop\ESET Online Scanner.lnk

2019-08-10 18:31 - 2019-08-10 18:31 - 000000000 ____D C:\Users\mj\AppData\Local\ESET

2019-08-10 18:30 - 2019-08-10 18:30 - 007969304 _____ (ESET spol. s r.o.) C:\Users\mj\Desktop\esetonlinescanner_enu.exe

2019-08-10 18:19 - 2019-08-10 18:24 - 000000908 _____ C:\Users\mj\Desktop\SALog.txt

2019-08-10 18:05 - 2019-08-10 18:05 - 000899584 _____ C:\Users\mj\Desktop\RGSA.exe

2019-08-10 17:41 - 2019-08-10 17:41 - 000001307 _____ C:\Users\mj\Desktop\Malwarebytes.txt

2019-08-10 17:33 - 2019-08-10 17:33 - 064333800 _____ (Malwarebytes ) C:\Users\mj\Desktop\mb3-setup-37469.37469-3.8.3.2965-1.0.613-1.0.11270.exe

2019-08-10 11:28 - 2019-08-10 11:28 - 000002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk

2019-08-10 11:28 - 2019-08-10 11:28 - 000002039 _____ C:\Users\Public\Desktop\Adobe Reader X.lnk

2019-08-10 11:28 - 2019-08-10 11:28 - 000002039 _____ C:\ProgramData\Desktop\Adobe Reader X.lnk

2019-08-10 11:26 - 2019-08-10 11:26 - 000000000 ____D C:\Program Files (x86)\Adobe

2019-08-10 11:04 - 2019-08-10 11:04 - 000032832 _____ C:\WINDOWS\SysWOW64\rnd_chunk.bin

2019-08-10 11:03 - 2019-08-11 19:57 - 000003752 _____ C:\WINDOWS\System32\Tasks\Driver Support-RTMUpdater

2019-08-10 11:03 - 2019-08-11 19:57 - 000003742 _____ C:\WINDOWS\System32\Tasks\Driver Support-RTMRules

2019-08-10 11:03 - 2019-08-11 19:57 - 000003632 _____ C:\WINDOWS\System32\Tasks\Driver Support-RTMScan

2019-08-10 11:03 - 2019-08-11 19:57 - 000003440 _____ C:\WINDOWS\System32\Tasks\Driver Support

2019-08-10 11:03 - 2019-08-11 11:40 - 000000000 ____D C:\ProgramData\UAB

2019-08-10 11:03 - 2019-08-10 11:03 - 000000000 ____D C:\Users\mj\Downloads\Driver Support

2019-08-10 11:03 - 2019-08-10 11:03 - 000000000 ____D C:\Users\mj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Driver Support

2019-08-10 11:03 - 2019-08-10 11:03 - 000000000 ____D C:\Users\mj\AppData\Local\PC_Drivers_Headquarters

2019-08-10 11:03 - 2019-08-10 11:03 - 000000000 ____D C:\ProgramData\Driver Support

2019-08-10 11:03 - 2019-08-10 11:03 - 000000000 ____D C:\Program Files (x86)\Driver Support

2019-08-10 11:02 - 2019-08-10 11:02 - 000689864 _____ (PC Drivers HeadQuarters LP) C:\Users\mj\Desktop\DriverSupport.exe

2019-08-02 10:13 - 2019-08-02 10:13 - 000023117 _____ C:\Users\mj\Desktop\Callahan-30 day_1.pdf

2019-08-01 11:59 - 2019-08-01 11:59 - 000012317 _____ C:\Users\mj\Desktop\VRRENEWAL.pdf

2019-08-01 11:50 - 2019-08-01 11:50 - 000138878 _____ C:\Users\mj\Desktop\IDCARD.pdf

2019-07-31 09:29 - 2019-07-31 09:29 - 000092944 _____ C:\Users\mj\Desktop\Pat meds.pdf

2019-07-30 21:41 - 2019-07-30 21:41 - 000001769 _____ C:\WINDOWS\Language_trs.ini

2019-07-30 21:39 - 2019-08-10 22:21 - 000036952 _____ C:\WINDOWS\Ascd_tmp.ini

2019-07-30 21:39 - 2009-04-02 08:30 - 000010296 _____ C:\WINDOWS\SysWOW64\Drivers\ASUSHWIO.SYS

2019-07-30 21:25 - 2019-07-30 21:25 - 000000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_LocationProvider_01_11_00.Wdf

2019-07-30 21:18 - 2019-07-30 21:18 - 000000118 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat

2019-07-28 15:02 - 2019-08-11 19:57 - 000000000 ____D C:\WINDOWS\System32\Tasks\AVAST Software

2019-07-28 13:17 - 2019-07-28 13:17 - 000000000 ____D C:\Users\mj\AppData\Roaming\Macromedia

2019-07-28 13:15 - 2019-08-11 20:40 - 000000000 ____D C:\Users\mj\AppData\Local\ElevatedDiagnostics

2019-07-28 13:01 - 2019-08-10 11:27 - 000000000 ____D C:\ProgramData\Adobe

2019-07-28 12:59 - 2019-08-11 19:57 - 000004418 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player PPAPI Notifier

2019-07-28 12:59 - 2019-08-11 19:57 - 000004282 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater

2019-07-28 12:58 - 2019-07-28 13:05 - 000000000 ____D C:\Users\mj\AppData\Local\Adobe

2019-07-28 12:54 - 2019-07-28 12:54 - 000130868 _____ C:\Users\mj\Desktop\Apps removed while refreshing your PC.pdf

2019-07-28 12:50 - 2019-07-28 12:50 - 000000401 _____ C:\WINDOWS\system32\{F33C3B9B-72AF-418A-B3FD-560646F7CDA2}.bat

2019-07-28 02:18 - 2019-08-02 17:20 - 000000000 ____D C:\Windows.old

2019-07-28 02:18 - 2019-07-28 00:06 - 000000000 ___DC C:\WINDOWS\Panther

2019-07-28 02:17 - 2019-07-28 02:17 - 000262144 _____ C:\WINDOWS\system32\config\userdiff

2019-07-28 00:18 - 2019-07-28 00:18 - 000000363 _____ C:\Users\mj\Desktop\Control Panel - Shortcut.lnk

2019-07-28 00:11 - 2019-07-28 00:11 - 000000851 _____ C:\Users\mj\Desktop\Documents - Shortcut.lnk

2019-07-28 00:10 - 2019-07-28 00:10 - 000000509 _____ C:\Users\mj\Desktop\Seagate Expansion Drive (E) - Shortcut.lnk

2019-07-28 00:10 - 2019-07-28 00:10 - 000000476 _____ C:\Users\mj\Desktop\Local Disk © - Shortcut.lnk

2019-07-28 00:08 - 2019-07-28 00:08 - 000000424 _____ C:\Users\mj\Desktop\This PC - Shortcut.lnk

2019-07-28 00:07 - 2019-07-28 00:07 - 000001032 _____ C:\Users\mj\Desktop\TFC - Shortcut.lnk

2019-07-28 00:04 - 2019-08-11 19:57 - 000003870 _____ C:\WINDOWS\System32\Tasks\CCleaner Update

2019-07-28 00:04 - 2019-08-11 19:57 - 000002794 _____ C:\WINDOWS\System32\Tasks\CCleanerSkipUAC

2019-07-28 00:04 - 2019-07-28 00:04 - 000000834 _____ C:\Users\Public\Desktop\CCleaner.lnk

2019-07-28 00:04 - 2019-07-28 00:04 - 000000834 _____ C:\ProgramData\Desktop\CCleaner.lnk

2019-07-28 00:04 - 2019-07-28 00:04 - 000000000 ____D C:\Program Files\CCleaner

2019-07-28 00:01 - 2019-07-28 00:01 - 000000000 ____D C:\Users\mj\AppData\Local\mbamtray

2019-07-28 00:01 - 2019-07-28 00:01 - 000000000 ____D C:\Users\mj\AppData\Local\mbam

2019-07-28 00:00 - 2019-08-11 20:45 - 000000000 ____D C:\ProgramData\Malwarebytes

2019-07-27 23:55 - 2019-08-08 20:08 - 000000000 ____D C:\Program Files (x86)\AVG

2019-07-27 23:54 - 2019-08-08 20:37 - 000000000 ____D C:\Users\mj\AppData\Local\Avg

2019-07-27 23:54 - 2019-08-08 20:37 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG

2019-07-27 23:54 - 2019-07-27 23:54 - 000002002 _____ C:\Users\Public\Desktop\AVG AntiVirus FREE.lnk

2019-07-27 23:54 - 2019-07-27 23:54 - 000002002 _____ C:\ProgramData\Desktop\AVG AntiVirus FREE.lnk

2019-07-27 23:54 - 2019-07-27 23:54 - 000000000 ____D C:\Users\mj\AppData\Roaming\AVG

2019-07-27 23:54 - 2019-07-27 23:54 - 000000000 ____D C:\Users\mj\AppData\Local\CEF

2019-07-27 23:52 - 2019-08-11 19:57 - 000004162 _____ C:\WINDOWS\System32\Tasks\Antivirus Emergency Update

2019-07-27 23:52 - 2019-08-08 20:37 - 000000000 ____D C:\WINDOWS\System32\Tasks\AVG

2019-07-27 23:52 - 2019-08-05 09:19 - 000387736 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgVmm.sys

2019-07-27 23:52 - 2019-07-31 19:37 - 001030832 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgSnx.sys

2019-07-27 23:52 - 2019-07-31 19:37 - 000168944 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgMonFlt.sys

2019-07-27 23:52 - 2019-07-27 23:52 - 000000000 ____D C:\Program Files\Common Files\AVG

2019-07-27 23:52 - 2019-07-27 23:51 - 000477336 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgSP.sys

2019-07-27 23:52 - 2019-07-27 23:51 - 000363440 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\avgBoot.exe

2019-07-27 23:52 - 2019-07-27 23:51 - 000263784 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgbidsdriver.sys

2019-07-27 23:52 - 2019-07-27 23:51 - 000225864 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgStm.sys

2019-07-27 23:52 - 2019-07-27 23:51 - 000209304 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgArPot.sys

2019-07-27 23:52 - 2019-07-27 23:51 - 000206624 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgbidsh.sys

2019-07-27 23:52 - 2019-07-27 23:51 - 000112568 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgRdr2.sys

2019-07-27 23:52 - 2019-07-27 23:51 - 000088208 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgRvrt.sys

2019-07-27 23:52 - 2019-07-27 23:51 - 000061736 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgbuniv.sys

2019-07-27 23:52 - 2019-07-27 23:51 - 000042552 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgKbd.sys

2019-07-27 23:52 - 2019-07-27 23:51 - 000037368 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgArDisk.sys

2019-07-27 23:51 - 2019-07-27 23:51 - 000000000 ____D C:\Program Files\KeyboardNotification

2019-07-27 23:50 - 2019-07-28 12:50 - 000000000 ____D C:\Intel

2019-07-27 23:50 - 2019-07-27 23:50 - 000000000 ____D C:\Program Files\Intel

2019-07-27 23:50 - 2019-07-27 23:50 - 000000000 ____D C:\Program Files\AVG

2019-07-27 23:50 - 2019-07-27 23:50 - 000000000 ____D C:\Program Files (x86)\Intel

2019-07-27 23:50 - 2015-08-09 04:50 - 000096752 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.DLL

2019-07-27 23:50 - 2015-08-09 04:50 - 000092648 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.DLL

2019-07-27 23:49 - 2019-07-30 21:56 - 000000000 ____D C:\ProgramData\AVG

2019-07-27 23:49 - 2019-07-27 23:49 - 000268624 _____ (AVG Technologies CZ, s.r.o.) C:\Users\mj\Downloads\avg_antivirus_free_setup (2).exe

2019-07-27 23:49 - 2019-07-27 23:49 - 000000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_ASMBSW_01_11_00.Wdf

2019-07-27 23:49 - 2019-07-27 23:49 - 000000000 ____D C:\Program Files\ASUS

2019-07-27 23:49 - 2019-07-27 23:49 - 000000000 ____D C:\Program Files (x86)\ASUS

2019-07-27 23:49 - 2013-07-03 20:32 - 000028672 _____ (ASUSTek Computer Inc.) C:\WINDOWS\SysWOW64\AsIO.dll

2019-07-27 23:49 - 2013-07-03 20:32 - 000015232 _____ C:\WINDOWS\SysWOW64\Drivers\AsIO.sys

2019-07-27 23:47 - 2019-07-27 23:47 - 000000000 ___HD C:\ProgramData\CanonBJ

2019-07-27 23:47 - 2019-07-27 23:47 - 000000000 ____D C:\Users\mj\AppData\Roaming\Google

2019-07-27 23:47 - 2012-02-08 16:36 - 000363520 _____ (CANON INC.) C:\WINDOWS\system32\CNC_B8L.dll

2019-07-27 23:47 - 2012-01-24 16:18 - 000077568 _____ C:\WINDOWS\system32\CNC1762D.TBL

2019-07-27 23:47 - 2012-01-16 14:21 - 000287744 _____ (CANON INC.) C:\WINDOWS\system32\CNC_B8C.dll

2019-07-27 23:47 - 2012-01-16 14:20 - 000106496 _____ (CANON INC.) C:\WINDOWS\system32\CNC_B8I.dll

2019-07-27 23:47 - 2008-08-25 18:02 - 000017920 _____ (CANON INC.) C:\WINDOWS\system32\CNHMCA6.dll

2019-07-27 23:46 - 2012-03-26 05:00 - 000389120 _____ (CANON INC.) C:\WINDOWS\system32\CNMLMB8.DLL

2019-07-27 23:45 - 2019-08-11 19:57 - 000003332 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA

2019-07-27 23:45 - 2019-08-11 19:57 - 000003204 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore

2019-07-27 23:45 - 2019-08-07 08:26 - 000002244 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

2019-07-27 23:45 - 2019-08-07 08:26 - 000002203 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2019-07-27 23:45 - 2019-08-07 08:26 - 000002203 _____ C:\ProgramData\Desktop\Google Chrome.lnk

2019-07-27 23:45 - 2019-07-27 23:58 - 000000000 ____D C:\Users\mj\AppData\Local\Google

2019-07-27 23:45 - 2019-07-27 23:45 - 000000000 ____D C:\Program Files (x86)\Google

2019-07-27 23:15 - 2019-07-27 23:15 - 000000765 _____ C:\Users\mj\Desktop\Mj.lnk

2019-07-27 22:37 - 2019-08-11 20:51 - 000003596 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3810651120-1967127889-315127114-1001

2019-07-27 22:36 - 2019-07-27 22:36 - 000000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf

2019-07-27 22:33 - 2019-07-27 22:33 - 000000000 __SHD C:\Users\mj\AppData\Local\EmieUserList

2019-07-27 22:33 - 2019-07-27 22:33 - 000000000 __SHD C:\Users\mj\AppData\Local\EmieSiteList

2019-07-27 22:27 - 2019-07-27 22:27 - 000000000 ____D C:\WINDOWS\System32\Tasks\WPD

2019-07-27 22:25 - 2019-07-27 22:25 - 000001442 _____ C:\Users\mj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2019-07-27 22:25 - 2019-07-27 22:25 - 000000020 ___SH C:\Users\mj\ntuser.ini

2019-07-27 22:25 - 2019-07-27 22:25 - 000000000 ____D C:\Users\mj\AppData\Roaming\Adobe

2019-07-27 22:25 - 2019-07-27 22:25 - 000000000 ____D C:\Users\mj\AppData\Local\VirtualStore

2019-07-27 22:22 - 2019-08-08 20:38 - 000000000 ____D C:\Users\mj

2019-07-27 22:22 - 2019-07-27 22:23 - 000013338 _____ C:\WINDOWS\diagwrn.xml

2019-07-27 22:22 - 2019-07-27 22:23 - 000013338 _____ C:\WINDOWS\diagerr.xml

2019-07-27 22:22 - 2014-03-18 06:13 - 000000369 _____ C:\Users\mj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk

2019-07-27 22:22 - 2014-03-18 06:13 - 000000369 _____ C:\Users\mj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk

2019-07-27 18:48 - 2019-07-27 18:48 - 000000082 _____ C:\Users\mj\Documents\cc_20190727_184855.reg

2019-07-27 18:41 - 2019-07-27 18:41 - 064333800 _____ (Malwarebytes ) C:\Users\mj\Downloads\mb3-setup-43841.43841-3.8.3.2965-1.0.613-1.0.11270.exe

2019-07-27 18:18 - 2019-07-27 18:18 - 000448512 _____ (OldTimer Tools) C:\Users\mj\Downloads\TFC.exe

2019-07-25 23:34 - 2019-07-25 23:34 - 000017800 _____ C:\Users\mj\Documents\cc_20190725_233436.reg

2019-07-25 23:30 - 2019-07-25 23:32 - 000001563 _____ C:\Users\mj\Documents\Windows Update Fixes.txt

2019-07-25 23:04 - 2019-07-25 23:18 - 000000502 _____ C:\Users\mj\Documents\2nd.AttemptUpdateRepair.txt

2019-07-25 22:17 - 2019-07-25 22:17 - 000000849 _____ C:\Users\mj\Documents - Shortcut.lnk

2019-07-25 22:04 - 2019-07-25 22:04 - 000000866 _____ C:\Users\mj\Documents\WindowsUpdateFix.txt

2019-07-25 21:54 - 2019-07-25 21:54 - 000001090 _____ C:\Users\mj\Desktop\notepad - Shortcut.lnk

2019-07-25 21:43 - 2019-07-25 22:28 - 000000259 _____ C:\Users\mj\Documents\ClearWindowsStoreCache.txt

2019-07-25 20:58 - 2019-07-25 20:58 - 020891464 _____ (Piriform Software Ltd) C:\Users\mj\Downloads\ccsetup560.exe

 

==================== One month (modified) ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2019-08-11 21:08 - 2013-08-22 10:45 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT

2019-08-11 20:42 - 2014-08-27 03:34 - 000000000 __SHD C:\Users\mj\IntelGraphicsProfiles

2019-08-11 20:41 - 2013-08-22 09:25 - 000262144 ___SH C:\WINDOWS\system32\config\BBI

2019-08-10 18:38 - 2011-05-10 16:58 - 000000000 ____D C:\Users\mj\Documents\My Downloads

2019-08-10 12:03 - 2013-08-22 09:36 - 000000000 ____D C:\WINDOWS\Inf

2019-08-08 20:37 - 2013-08-22 09:36 - 000000000 ____D C:\WINDOWS\system32\Sysprep

2019-08-08 20:37 - 2013-08-22 09:36 - 000000000 ____D C:\WINDOWS\system32\AdvancedInstallers

2019-08-08 20:37 - 2011-05-10 16:49 - 000000000 ____D C:\Users\mj\Documents\Corel User Files

2019-08-08 20:35 - 2013-08-22 11:36 - 000000000 ___HD C:\Program Files\WindowsApps

2019-08-08 20:32 - 2013-08-22 11:36 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed

2019-08-08 20:32 - 2013-08-22 11:36 - 000000000 ____D C:\WINDOWS\system32\Macromed

2019-08-08 20:32 - 2013-08-22 11:36 - 000000000 ____D C:\WINDOWS\registration

2019-08-08 10:00 - 2017-05-06 09:14 - 000000000 ____D C:\Users\mj\Desktop\Sean

2019-08-07 22:17 - 2012-01-06 14:19 - 000000000 ____D C:\Users\mj\Documents\universal 2012

2019-08-02 12:32 - 2014-03-18 06:03 - 000818732 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2019-07-29 21:36 - 2013-08-22 11:36 - 000000000 ____D C:\WINDOWS\AppReadiness

2019-07-28 13:21 - 2015-08-13 19:41 - 000000000 ____D C:\Users\mj\Desktop\all things wild photos

2019-07-28 02:18 - 2014-08-26 08:31 - 000008192 __RSH C:\BOOTSECT.BAK

2019-07-28 02:18 - 2013-08-22 11:36 - 000262144 _____ C:\WINDOWS\system32\config\BCD-Template

2019-07-28 00:55 - 2013-08-22 11:20 - 000000000 ____D C:\WINDOWS\CbsTemp

2019-07-27 23:47 - 2013-08-22 11:36 - 000000000 ____D C:\WINDOWS\system32\FxsTmp

2019-07-27 23:42 - 2013-08-22 11:36 - 000000000 ____D C:\WINDOWS\system32\NDF

2019-07-27 22:37 - 2014-08-27 01:49 - 000000000 __SHD C:\Users\mj\AppData\LocalLow\EmieUserList

2019-07-27 22:37 - 2014-08-27 01:48 - 000000000 __SHD C:\Users\mj\AppData\LocalLow\EmieSiteList

2019-07-27 22:33 - 2013-08-22 09:25 - 000262144 ___SH C:\WINDOWS\system32\config\ELAM

2019-07-27 22:26 - 2014-08-27 01:29 - 000000851 _____ C:\Users\mj\Desktop\Downloads.lnk

2019-07-27 22:26 - 2013-08-22 11:36 - 000000000 ____D C:\WINDOWS\rescache

2019-07-27 22:25 - 2014-08-27 01:29 - 000000000 ____D C:\Users\mj\AppData\Local\Packages

2019-07-27 22:23 - 2013-08-22 11:36 - 000000000 __RHD C:\Users\Public\Libraries

2019-07-27 22:23 - 2009-07-14 03:48 - 000000000 ___RD C:\Users\Public\Recorded TV

2019-07-27 22:21 - 2013-08-22 10:44 - 000335784 _____ C:\WINDOWS\system32\FNTCACHE.DAT

2019-07-27 21:23 - 2017-06-28 12:51 - 000000000 ____D C:\Users\mj\Desktop\Patrick

 

==================== Files in the root of some directories ================

 

2018-04-18 19:59 - 2018-04-18 19:59 - 001129816 _____ (Google Inc.) C:\Users\mj\ChromeSetup.exe

 

==================== SigCheck ===============================

 

(There is no automatic fix for files that do not pass verification.)

 

 

LastRegBack: 2019-08-10 12:03

==================== End of FRST.txt ============================

 

Addition.txt

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-08-2019

Ran by mj (11-08-2019 21:20:49)

Running from C:\Users\mj\Desktop

Windows 8.1 (X64) (2019-07-28 02:25:20)

Boot Mode: Safe Mode (minimal)

==========================================================

 

 

==================== Accounts: =============================

 

Administrator (S-1-5-21-3810651120-1967127889-315127114-500 - Administrator - Disabled)

Guest (S-1-5-21-3810651120-1967127889-315127114-501 - Limited - Disabled)

mj (S-1-5-21-3810651120-1967127889-315127114-1001 - Administrator - Enabled) => C:\Users\mj

 

==================== Security Center ========================

 

(If an entry is included in the fixlist, it will be removed.)

 

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AV: AVG Antivirus (Enabled - Up to date) {4FC75CA5-1654-5411-7CFB-1893D506BCF4}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: AVG Antivirus (Enabled - Up to date) {F4A6BD41-306E-5B9F-464B-23E1AE81F649}

 

==================== Installed Programs ======================

 

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 

Adobe Flash Player 32 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 32.0.0.223 - Adobe)

Adobe Reader X (10.1.3) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.3 - Adobe Systems Incorporated)

AVG AntiVirus FREE (HKLM-x32\...\AVG Antivirus) (Version: 19.6.3098 - AVG Technologies)

CCleaner (HKLM\...\CCleaner) (Version: 5.60 - Piriform)

Driver Support (HKLM-x32\...\DriverSupport) (Version: 10.1.6.14 - PC Drivers HeadQuarters LP) <==== ATTENTION

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 76.0.3809.100 - Google LLC)

Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.34.11 - Google LLC) Hidden

Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.14.4264 - Intel Corporation)

 

Packages:

=========

Games -> C:\Program Files\WindowsApps\Microsoft.XboxLIVEGames_2.0.139.0_x64__8wekyb3d8bbwe [2019-08-08] (Microsoft Corporation) [MS Ad]

MSN Food & Drink -> C:\Program Files\WindowsApps\Microsoft.BingFoodAndDrink_3.0.4.336_x64__8wekyb3d8bbwe [2019-08-08] (Microsoft Corporation) [MS Ad]

MSN Health & Fitness -> C:\Program Files\WindowsApps\Microsoft.BingHealthAndFitness_3.0.4.336_x64__8wekyb3d8bbwe [2019-08-08] (Microsoft Corporation) [MS Ad]

MSN Money -> C:\Program Files\WindowsApps\Microsoft.BingFinance_3.0.4.344_x64__8wekyb3d8bbwe [2019-08-08] (Microsoft Corporation) [MS Ad]

MSN News -> C:\Program Files\WindowsApps\Microsoft.BingNews_3.0.4.344_x64__8wekyb3d8bbwe [2019-08-08] (Microsoft Corporation) [MS Ad]

MSN Sports -> C:\Program Files\WindowsApps\Microsoft.BingSports_3.0.4.345_x64__8wekyb3d8bbwe [2019-08-08] (Microsoft Corporation) [MS Ad]

MSN Travel -> C:\Program Files\WindowsApps\Microsoft.BingTravel_3.0.4.336_x64__8wekyb3d8bbwe [2019-08-08] (Microsoft Corporation) [MS Ad]

MSN Weather -> C:\Program Files\WindowsApps\Microsoft.BingWeather_3.0.4.350_x64__8wekyb3d8bbwe [2019-08-08] (Microsoft Corporation) [MS Ad]

Music -> C:\Program Files\WindowsApps\Microsoft.ZuneMusic_2.6.672.0_x64__8wekyb3d8bbwe [2019-08-08] (Microsoft Corporation) [MS Ad]

Skype -> C:\Program Files\WindowsApps\Microsoft.SkypeApp_3.1.0.1016_x86__kzf8qxf38zg5c [2019-08-08] (Skype) [MS Ad]

Video -> C:\Program Files\WindowsApps\Microsoft.ZuneVideo_2.6.446.0_x64__8wekyb3d8bbwe [2019-08-08] (Microsoft Corporation) [MS Ad]

 

==================== Custom CLSID (Whitelisted): ==========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

CustomCLSID: HKU\S-1-5-21-3810651120-1967127889-315127114-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation - pGFX -> Intel Corporation)

ShellIconOverlayIdentifiers: [00avg] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File

ContextMenuHandlers1: [AVG] -> {472083B1-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVG\Antivirus\ashShell.dll [2019-07-27] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)

ContextMenuHandlers3: [00avg] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File

ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File

ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\system32\igfxDTCM.dll [2015-08-09] (Microsoft Windows Hardware Compatibility Publisher -> Intel Corporation)

ContextMenuHandlers6: [AVG] -> {472083B1-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVG\Antivirus\ashShell.dll [2019-07-27] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)

 

==================== Shortcuts & WMI ========================

 

(The entries could be listed to be restored or removed.)

 

 

==================== Loaded Modules (Whitelisted) ==============

 

 

==================== Alternate Data Streams (Whitelisted) =========

 

(If an entry is included in the fixlist, only the ADS will be removed.)

 

 

==================== Safe Mode (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "OptionValue"="1"

 

==================== Association (Whitelisted) ===============

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

 

 

==================== Internet Explorer trusted/restricted ===============

 

(If an entry is included in the fixlist, it will be removed from the registry.)

 

 

==================== Hosts content: ===============================

 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

 

2013-08-22 09:25 - 2013-08-22 09:25 - 000000824 _____ C:\WINDOWS\system32\drivers\etc\hosts

 

 

==================== Other Areas ============================

 

(Currently there is no automatic fix for this section.)

 

HKU\S-1-5-21-3810651120-1967127889-315127114-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\mj\AppData\Roaming\Microsoft\Windows Photo Viewer\Windows Photo Viewer Wallpaper.jpg

DNS Servers: Media is not connected to internet.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)

 

==================== MSCONFIG/TASK MANAGER disabled items ==

 

If an entry is included in the fixlist, it will be removed.

 

 

==================== FirewallRules (Whitelisted) ===============

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

FirewallRules: [{87E0AF9A-190B-4E90-8E9D-BC0B7927B81B}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google LLC)

 

==================== Restore Points =========================

 

05-08-2019 16:39:59 Scheduled Checkpoint

08-08-2019 19:54:20 Restore Operation

10-08-2019 11:26:17 Installed Adobe Reader X MUI.

 

==================== Faulty Device Manager Devices =============

 

Name: SM Bus Controller

Description: SM Bus Controller

Class Guid: 

Manufacturer: 

Service: 

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

 

Name: AMDA00 Interface

Description: AMDA00 Interface

Class Guid: {4d36e97d-e325-11ce-bfc1-08002be10318}

Manufacturer: ASUSTeK Computer Inc.

Service: WUDFRd

Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)

Resolution: Update the driver

 

Name: Wireless Device

Description: Wireless Device

Class Guid: {4d36e97d-e325-11ce-bfc1-08002be10318}

Manufacturer: Surface

Service: WUDFRd

Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)

Resolution: Update the driver

 

 

==================== Event log errors: =========================

 

Application errors:

==================

Error: (08/11/2019 08:41:02 PM) (Source: PerfNet) (EventID: 2002) (User: )

Description: Unable to open the Redirector service performance object. The first four bytes (DWORD) of the Data section contains the status code.

 

Error: (08/11/2019 08:41:02 PM) (Source: PerfNet) (EventID: 2004) (User: )

Description: Unable to open the Server service performance object. The first four bytes (DWORD) of the Data section contains the status code.

 

Error: (08/11/2019 08:41:02 PM) (Source: PerfNet) (EventID: 2002) (User: )

Description: Unable to open the Redirector service performance object. The first four bytes (DWORD) of the Data section contains the status code.

 

Error: (08/11/2019 08:41:02 PM) (Source: PerfNet) (EventID: 2004) (User: )

Description: Unable to open the Server service performance object. The first four bytes (DWORD) of the Data section contains the status code.

 

Error: (08/11/2019 08:39:02 PM) (Source: Perflib) (EventID: 1008) (User: )

Description: The Open Procedure for service "WmiApRpl" in DLL "C:\WINDOWS\system32\wbem\wmiaprpl.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

 

Error: (08/11/2019 08:39:02 PM) (Source: Perflib) (EventID: 1010) (User: )

Description: The Collect Procedure for the "C:\Windows\System32\winspool.drv" service in DLL "Spooler" generated an exception or returned an invalid status. The performance data returned by the counter DLL will not be returned in the Perf Data Block. The first four bytes (DWORD) of the Data section contains the exception code or status code.

 

Error: (08/11/2019 08:39:01 PM) (Source: PerfNet) (EventID: 2002) (User: )

Description: Unable to open the Redirector service performance object. The first four bytes (DWORD) of the Data section contains the status code.

 

Error: (08/11/2019 08:39:01 PM) (Source: PerfNet) (EventID: 2004) (User: )

Description: Unable to open the Server service performance object. The first four bytes (DWORD) of the Data section contains the status code.

 

 

System errors:

=============

Error: (08/11/2019 09:20:49 PM) (Source: DCOM) (EventID: 10005) (User: mjpc)

Description: DCOM got error "1084" attempting to start the service WSearch with arguments "Unavailable" in order to run the server:

{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}

 

Error: (08/11/2019 09:20:49 PM) (Source: DCOM) (EventID: 10005) (User: mjpc)

Description: DCOM got error "1084" attempting to start the service WSearch with arguments "Unavailable" in order to run the server:

{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}

 

Error: (08/11/2019 09:20:49 PM) (Source: DCOM) (EventID: 10005) (User: mjpc)

Description: DCOM got error "1084" attempting to start the service WSearch with arguments "Unavailable" in order to run the server:

{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}

 

Error: (08/11/2019 09:20:49 PM) (Source: DCOM) (EventID: 10005) (User: mjpc)

Description: DCOM got error "1084" attempting to start the service WSearch with arguments "Unavailable" in order to run the server:

{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}

 

Error: (08/11/2019 09:20:35 PM) (Source: DCOM) (EventID: 10005) (User: mjpc)

Description: DCOM got error "1084" attempting to start the service WSearch with arguments "Unavailable" in order to run the server:

{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}

 

Error: (08/11/2019 09:20:35 PM) (Source: DCOM) (EventID: 10005) (User: mjpc)

Description: DCOM got error "1084" attempting to start the service WSearch with arguments "Unavailable" in order to run the server:

{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}

 

Error: (08/11/2019 09:20:20 PM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The WinHTTP Web Proxy Auto-Discovery Service service depends on the DHCP Client service which failed to start because of the following error: 

The dependency service or group failed to start.

 

Error: (08/11/2019 09:20:16 PM) (Source: DCOM) (EventID: 10005) (User: mjpc)

Description: DCOM got error "1084" attempting to start the service WSearch with arguments "Unavailable" in order to run the server:

{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}

 

 

==================== Memory info =========================== 

 

BIOS: American Megatrends Inc. 0317 04/23/2014

Motherboard: ASUSTeK COMPUTER INC. H97M-PLUS

Processor: Intel® Core™ i5-4460 CPU @ 3.20GHz

Percentage of memory in use: 9%

Total physical RAM: 8068.36 MB

Available physical RAM: 7312.16 MB

Total Virtual: 9348.36 MB

Available Virtual: 8659.75 MB

 

==================== Drives ================================

 

Drive c: () (Fixed) (Total:931.51 GB) (Free:832.6 GB) NTFS ==>[drive with boot components (obtained from BCD)]

 

 

==================== MBR & Partition Table ==================

 

========================================================

Disk: 0 (MBR Code: Windows 7/8/10) (Size: 931.5 GB) (Disk ID: AA0C14BA)

Partition 1: (Active) - (Size=931.5 GB) - (Type=07 NTFS)

 

==================== End of Addition.txt ============================

[nasdaq]

Hi,

 

Remove this program in bold via the Control Panel > Programs > Programs and Features.

Driver Support (HKLM-x32\...\DriverSupport) (Version: 10.1.6.14 - PC Drivers HeadQuarters LP) <==== ATTENTION

===

 

Press the Windows key + r on your keyboard at the same time. This will open the RUN BOX.

Type Notepad and and click the OK key.

Please copy the entire contents of the code box below to the a new file.

 

start
 
CreateRestorePoint:
CloseProcesses:
 
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
Task: {1D10B8AF-4D3C-4317-8122-2DF680BAA713} - System32\Tasks\Driver Support-RTMUpdater => C:\Program Files (x86)\Driver Support\DriverSupport.exe [10714752 2018-12-12] (PC DRIVERS HEADQUARTERS I, INC -> PC Drivers Headquarters LP) <==== ATTENTION
Task: {1DC742D2-3829-4715-8035-B6A4BFA47FBE} - System32\Tasks\Driver Support-RTMRules => C:\Program Files (x86)\Driver Support\DriverSupport.exe [10714752 2018-12-12] (PC DRIVERS HEADQUARTERS I, INC -> PC Drivers Headquarters LP) <==== ATTENTION
Task: {743FD5F4-5F03-4AE2-918A-D86C08C16B74} - System32\Tasks\Driver Support => C:\Program Files (x86)\Driver Support\DriverSupport.exe [10714752 2018-12-12] (PC DRIVERS HEADQUARTERS I, INC -> PC Drivers Headquarters LP) <==== ATTENTION
Task: {C2456C5E-1F92-4F8F-A823-843E3A00E3F8} - System32\Tasks\Driver Support-RTMScan => C:\Program Files (x86)\Driver Support\DriverSupport.exe [10714752 2018-12-12] (PC DRIVERS HEADQUARTERS I, INC -> PC Drivers Headquarters LP) <==== ATTENTION
CHR HomePage: Default -> hxxp://search.conduit.com/?ctid=CT3289663&SearchSource=48&CUI=UN20142812231541829&UM=2
S2 DSAO; C:\Program Files (x86)\driver support\svc\DriverSupportAOsvc.exe [2033104 2016-10-22] (PC DRIVERS HEADQUARTERS I, INC -> PC Drivers HeadQuarters LP) <==== ATTENTION
 
ShellIconOverlayIdentifiers: [00avg] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
ContextMenuHandlers3: [00avg] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
 
C:\Program Files (x86)\Driver Support
2019-08-10 11:04 - 2019-08-10 11:04 - 000032832 _____ C:\WINDOWS\SysWOW64\rnd_chunk.bin
2019-08-10 11:03 - 2019-08-10 11:03 - 000000000 ____D C:\Users\mj\Downloads\Driver Support
2019-08-10 11:03 - 2019-08-10 11:03 - 000000000 ____D C:\Users\mj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Driver Support
2019-08-10 11:03 - 2019-08-10 11:03 - 000000000 ____D C:\Users\mj\AppData\Local\PC_Drivers_Headquarters
2019-08-10 11:02 - 2019-08-10 11:02 - 000689864 _____ (PC Drivers HeadQuarters LP) C:\Users\mj\Desktop\DriverSupport.exe
 
CMD: "%WINDIR%\SYSTEM32\lodctr.exe" /R
CMD: "%WINDIR%\SysWOW64\lodctr.exe" /R
CMD:  C:\Windows\SYSTEM32\lodctr.exe" /R
CMD:  C:\Windows\SysWOW64\lodctr.exe" /R
 
EmptyTemp:
 
End

 

Save the file as fixlist.txt in the same folder where the Farbar tool is running from.

The location is listed in the 3rd line of the Farbar log you have submitted.

 

Run FRST and click Fix only once and wait.

 

The tool will create a log (Fixlog.txt) please post it to your reply.

===

 

The computer should restart after the fix.

 

Please download AdwCleaner by Malwarebytes your Desktop.

 

Close all open programs and internet browsers.

Double click on AdwCleaner.exe to run the tool.

Click the Scan button and wait for the process to complete.

Click the LogFile button and the report will open in Notepad.

 

IMPORTANT

If you click the Clean button all items listed in the report will be removed.

 

If you find some false positive items or programs that you wish to keep, Close the AdwCleaner windows.

Close all open programs and internet browsers.

Double click on AdwCleaner.exe to run the tool.

Click the Scan button and wait for the process to complete.

Check off the element(s) you wish to keep.

Click on the Clean button follow the prompts.

A log file will automatically open after the scan has finished.

Please post the content of that log file with your next answer.

You can find the log file at C:\AdwCleanerCx.txt (x is a number).

===

 

Download   Farbar's Service Scanner utility

http://www.bleepingc...-scanner/dl/62/

and Save to your Desktop.

If using Windows 7 or above, Right-Click on fss.exe and select Run As Administrator.

If using XP, double-click to start.

Answer Yes to ok when prompted.

If your firewall then puts out a prompt, again, allow it to run.

Once FSS is on-screen, be sure the following items are checkmarked:

Internet Services

Windows Firewall

System Restore

Security Center/Action Center

Windows Update

Windows Defender

Other Services

  

Click on "Scan".

It will create a log (FSS.txt) in the same directory the tool is run.

Copy & Paste contents of FSS.txt into your reply.

===

 

p.s.

If you are working in normal mode please run the Farbar program and post fresh FRST.TXT and Addition.txt logs for my review.

[Krishna]

I uninstalled from Programs and Features in Control Panel the Program "Driver Support PC Drivers Headquarter LP," that you asked me to uninstall.  My past experience has shown that even if a program has been uninstalled from Programs and Features in Control Panel, there's always a Folder Left over in Program Files or Program Files(x86).  There's such a Folder called  Driver Support in C:\Program Files(x86).  Same Icon as the Program you asked me to remove.  Should I Delete this Folder?  I have not tried running Windows Update as I wanted to hear back from you first.

 

Notepad is such a versatile program,,,I use it every day.  When you look at the logs you'll see I have a shortcut just for that program on the Desktop.  Enough about me, onto what the Readers of this Forum really want to see.  The Logs.

 

Here are the Logs you requested.  Awaiting further Instructions.

 

Fixlog.txt

 

Fix result of Farbar Recovery Scan Tool (x64) Version: 10-08-2019
Ran by mj (12-08-2019 17:50:22) Run:1
Running from C:\Users\mj\Desktop
Loaded Profiles: mj (Available Profiles: mj)
Boot Mode: Normal
==============================================

fixlist content:
*****************
start

CreateRestorePoint:
CloseProcesses:

FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
Task: {1D10B8AF-4D3C-4317-8122-2DF680BAA713} - System32\Tasks\Driver Support-RTMUpdater => C:\Program Files (x86)\Driver Support\DriverSupport.exe [10714752 2018-12-12] (PC DRIVERS HEADQUARTERS I, INC -> PC Drivers Headquarters LP) <==== ATTENTION
Task: {1DC742D2-3829-4715-8035-B6A4BFA47FBE} - System32\Tasks\Driver Support-RTMRules => C:\Program Files (x86)\Driver Support\DriverSupport.exe [10714752 2018-12-12] (PC DRIVERS HEADQUARTERS I, INC -> PC Drivers Headquarters LP) <==== ATTENTION
Task: {743FD5F4-5F03-4AE2-918A-D86C08C16B74} - System32\Tasks\Driver Support => C:\Program Files (x86)\Driver Support\DriverSupport.exe [10714752 2018-12-12] (PC DRIVERS HEADQUARTERS I, INC -> PC Drivers Headquarters LP) <==== ATTENTION
Task: {C2456C5E-1F92-4F8F-A823-843E3A00E3F8} - System32\Tasks\Driver Support-RTMScan => C:\Program Files (x86)\Driver Support\DriverSupport.exe [10714752 2018-12-12] (PC DRIVERS HEADQUARTERS I, INC -> PC Drivers Headquarters LP) <==== ATTENTION
CHR HomePage: Default -> hxxp://search.conduit.com/?ctid=CT3289663&SearchSource=48&CUI=UN20142812231541829&UM=2
S2 DSAO; C:\Program Files (x86)\driver support\svc\DriverSupportAOsvc.exe [2033104 2016-10-22] (PC DRIVERS HEADQUARTERS I, INC -> PC Drivers HeadQuarters LP) <==== ATTENTION

ShellIconOverlayIdentifiers: [00avg] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File
ContextMenuHandlers3: [00avg] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File

C:\Program Files (x86)\Driver Support
2019-08-10 11:04 - 2019-08-10 11:04 - 000032832 _____ C:\WINDOWS\SysWOW64\rnd_chunk.bin
2019-08-10 11:03 - 2019-08-10 11:03 - 000000000 ____D C:\Users\mj\Downloads\Driver Support
2019-08-10 11:03 - 2019-08-10 11:03 - 000000000 ____D C:\Users\mj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Driver Support
2019-08-10 11:03 - 2019-08-10 11:03 - 000000000 ____D C:\Users\mj\AppData\Local\PC_Drivers_Headquarters
2019-08-10 11:02 - 2019-08-10 11:02 - 000689864 _____ (PC Drivers HeadQuarters LP) C:\Users\mj\Desktop\DriverSupport.exe

CMD: "%WINDIR%\SYSTEM32\lodctr.exe" /R
CMD: "%WINDIR%\SysWOW64\lodctr.exe" /R
CMD: C:\Windows\SYSTEM32\lodctr.exe" /R
CMD: C:\Windows\SysWOW64\lodctr.exe" /R

EmptyTemp:

End
*****************

Restore point was successfully created.
Processes closed successfully.
HKLM\SOFTWARE\Policies\Mozilla => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1D10B8AF-4D3C-4317-8122-2DF680BAA713}" => not found
"C:\WINDOWS\System32\Tasks\Driver Support-RTMUpdater" => not found
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Driver Support-RTMUpdater" => not found
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1DC742D2-3829-4715-8035-B6A4BFA47FBE}" => not found
"C:\WINDOWS\System32\Tasks\Driver Support-RTMRules" => not found
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Driver Support-RTMRules" => not found
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{743FD5F4-5F03-4AE2-918A-D86C08C16B74}" => not found
"C:\WINDOWS\System32\Tasks\Driver Support" => not found
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Driver Support" => not found
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C2456C5E-1F92-4F8F-A823-843E3A00E3F8}" => not found
"C:\WINDOWS\System32\Tasks\Driver Support-RTMScan" => not found
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Driver Support-RTMScan" => not found
"Chrome HomePage" => removed successfully
DSAO => service not found.
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00avg => removed successfully
HKLM\Software\Classes\CLSID\{472083B0-C522-11CF-8763-00608CC02F24} => not found
HKLM\Software\Classes\AllFileSystemObjects\ShellEx\ContextMenuHandlers\00avg => removed successfully
HKLM\Software\Classes\CLSID\{472083B0-C522-11CF-8763-00608CC02F24} => not found
HKLM\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers\igfxcui => removed successfully
HKLM\Software\Classes\CLSID\{3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => not found
"C:\Program Files (x86)\Driver Support" => not found
C:\WINDOWS\SysWOW64\rnd_chunk.bin => moved successfully
"C:\Users\mj\Downloads\Driver Support" => not found
"C:\Users\mj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Driver Support" => not found
"C:\Users\mj\AppData\Local\PC_Drivers_Headquarters" => not found
C:\Users\mj\Desktop\DriverSupport.exe => moved successfully

========= "%WINDIR%\SYSTEM32\lodctr.exe" /R =========


Info: Successfully rebuilt performance counter setting from system backup store
========= End of CMD: =========


========= "%WINDIR%\SysWOW64\lodctr.exe" /R =========


Info: Successfully rebuilt performance counter setting from system backup store
========= End of CMD: =========


========= C:\Windows\SYSTEM32\lodctr.exe" /R =========


========= End of CMD: =========


========= C:\Windows\SysWOW64\lodctr.exe" /R =========


========= End of CMD: =========


=========== EmptyTemp: ==========

BITS transfer queue => 8388608 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 37981981 B
Java, Flash, Steam htmlcache => 0 B
Windows/system/drivers => 416313395 B
Edge => 0 B
Chrome => 10746197 B
Firefox => 0 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 128 B
systemprofile32 => 0 B
LocalService => 8340 B
NetworkService => 0 B
mj => 24278392 B

RecycleBin => 0 B
EmptyTemp: => 474.7 MB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 17:50:48 ====

 

AdwCleaner[Soo].txt

 

# -------------------------------
# Malwarebytes AdwCleaner 7.4.0.0
# -------------------------------
# Build: 07-23-2019
# Database: 2019-08-09.1 (Cloud)
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Scan
# -------------------------------
# Start: 08-12-2019
# Duration: 00:00:07
# OS: Windows 8.1
# Scanned: 35457
# Detected: 0


***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

No malicious folders found.

***** [ Files ] *****

No malicious files found.

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

No malicious tasks found.

***** [ Registry ] *****

No malicious registry entries found.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries found.

***** [ Chromium URLs ] *****

No malicious Chromium URLs found.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries found.

***** [ Firefox URLs ] *****

No malicious Firefox URLs found.

***** [ Preinstalled Software ] *****

No Preinstalled Software found.

 

FSS.txt

 

Farbar Service Scanner Version: 27-01-2016
Ran by mj (administrator) on 12-08-2019 at 18:12:16
Running from "C:\Users\mj\Desktop"
Microsoft Windows 8.1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Policy:
========================


Action Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend: ""%ProgramFiles%\Windows Defender\MsMpEng.exe"".


Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1


Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcore.dll => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MsMpEng.exe => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****

 

FRST.txt

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 10-08-2019
Ran by mj (administrator) on MJPC (ASUS All Series) (12-08-2019 19:04:35)
Running from C:\Users\mj\Desktop
Loaded Profiles: mj (Available Profiles: mj)
Platform: Windows 8.1 (X64) Language: English (United States)
Default browser: Chrome
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Adobe Systems, Incorporated -> Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
(ASUSTeK Computer Inc. -> ) C:\Program Files (x86)\ASUS\AXSP\1.01.02\atkexComSvc.exe
(AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Antivirus\aswidsagent.exe
(AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Antivirus\AVGSvc.exe
(AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Antivirus\AVGUI.exe
(Google Inc -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.34.11\GoogleCrashHandler.exe
(Google Inc -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.34.11\GoogleCrashHandler64.exe
(Intel Corporation - pGFX -> ) C:\Windows\System32\igfxTray.exe
(Intel Corporation - pGFX -> Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Intel Corporation - pGFX -> Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation - pGFX -> Intel Corporation) C:\Windows\System32\igfxHK.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Windows\System32\WirelessKB850NotificationService.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [AVGUI.exe] => C:\Program Files\AVG\Antivirus\AvLaunch.exe [316848 2019-07-27] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [843712 2012-04-04] (Adobe Systems, Incorporated -> Adobe Systems Incorporated)
HKU\S-1-5-21-3810651120-1967127889-315127114-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\scrnsave.scr [11776 2013-08-22] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\76.0.3809.100\Installer\chrmstp.exe [2019-08-07] (Google LLC -> Google LLC)
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {05975CD6-672E-44D9-B5DE-692604748E29} - System32\Tasks\EOSv3 Scheduler onTime => C:\Users\mj\Desktop\esetonlinescanner_enu.exe [7969304 2019-08-10] (ESET, spol. s r.o. -> ESET spol. s r.o.)
Task: {1200C363-AD23-4B5E-8D91-23BD58B3591D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [156456 2019-07-27] (Google Inc -> Google LLC)
Task: {19221A11-871E-4023-8F1E-6B56AA174BFB} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [16835256 2019-07-11] (Piriform Software Ltd -> Piriform Software Ltd)
Task: {4E7ADB49-3725-4FFE-B2A7-C9BCA910E987} - System32\Tasks\Antivirus Emergency Update => C:\Program Files\AVG\Antivirus\AvEmUpdate.exe [3987888 2019-07-27] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)
Task: {56D905B5-9F52-49E0-8C29-67FE05329AFD} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_32_0_0_223_pepper.exe [1453112 2019-07-28] (Adobe Inc. -> Adobe)
Task: {8829A589-1C0D-4373-BE0A-B733C9E62769} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [156456 2019-07-27] (Google Inc -> Google LLC)
Task: {88854AB4-A662-4F50-A36B-B6412C631E24} - System32\Tasks\AVG\Overseer => C:\Program Files\Common Files\AVG\Overseer\overseer.exe [2081712 2019-08-08] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)
Task: {8E1C0F25-0283-4880-8577-BAC12EA59849} - System32\Tasks\EOSv3 Scheduler onLogOn => C:\Users\mj\Desktop\esetonlinescanner_enu.exe [7969304 2019-08-10] (ESET, spol. s r.o. -> ESET spol. s r.o.)
Task: {900FE79B-98F7-4078-98B9-3738556ADEE8} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [619416 2019-07-11] (Piriform Software Ltd -> Piriform Software Ltd)
Task: {C3842C6E-D196-44CF-B4AC-77D6FD0B15D4} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [335416 2019-07-28] (Adobe Inc. -> Adobe)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 209.18.47.63 209.18.47.62
Tcpip\..\Interfaces\{08333B4B-2B4A-44B6-852A-F9BBD839B240}: [DhcpNameServer] 209.18.47.63 209.18.47.62
Tcpip\..\Interfaces\{E8CA8C53-C80A-4865-9324-2EDB5C311F42}: [DhcpNameServer] 209.18.47.63 209.18.47.62

Internet Explorer:
==================
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-04-04] (Adobe Systems, Incorporated -> Adobe Systems Incorporated)

FireFox:
========
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.34.11\npGoogleUpdate3.dll [2019-07-27] (Google Inc -> Google LLC)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.34.11\npGoogleUpdate3.dll [2019-07-27] (Google Inc -> Google LLC)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2012-04-04] (Adobe Systems, Incorporated -> Adobe Systems Inc.)

Chrome:
=======
CHR Profile: C:\Users\mj\AppData\Local\Google\Chrome\User Data\Default [2019-08-12]
CHR DownloadDir: C:\Users\mj\Desktop
CHR Extension: (Google Drive) - C:\Users\mj\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2019-07-27]
CHR Extension: (YouTube) - C:\Users\mj\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2019-07-27]
CHR Extension: (Chrome Web Store Payments) - C:\Users\mj\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2019-07-27]
CHR Extension: (Gmail) - C:\Users\mj\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2019-07-27]
CHR Extension: (Chrome Media Router) - C:\Users\mj\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2019-08-08]
CHR Profile: C:\Users\mj\AppData\Local\Google\Chrome\User Data\System Profile [2019-08-12]
CHR HKLM-x32\...\Chrome\Extension: [mbckjcfnjmoiinpgddefodcighgikkgn] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.01.02\atkexComSvc.exe [936728 2013-07-03] (ASUSTeK Computer Inc. -> )
R2 AVG Antivirus; C:\Program Files\AVG\Antivirus\AVGSvc.exe [415032 2019-07-27] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)
R3 avgbIDSAgent; C:\Program Files\AVG\Antivirus\aswidsagent.exe [6845400 2019-07-27] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)
R2 igfxCUIService1.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [355232 2015-08-09] (Intel Corporation - pGFX -> Intel Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [346872 2013-08-22] (Microsoft Corporation -> Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23840 2013-08-22] (Microsoft Corporation -> Microsoft Corporation)
R2 WirelessKB850NotificationService; C:\WINDOWS\system32\WirelessKB850NotificationService.exe [176632 2018-05-14] (Microsoft Corporation -> Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2013-07-03] (ASUSTeK Computer Inc. -> )
R0 avgArDisk; C:\WINDOWS\System32\drivers\avgArDisk.sys [37368 2019-07-27] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)
R1 avgArPot; C:\WINDOWS\System32\drivers\avgArPot.sys [209304 2019-07-27] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)
R1 avgbidsdriver; C:\WINDOWS\System32\drivers\avgbidsdriver.sys [263784 2019-07-27] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)
R0 avgbidsh; C:\WINDOWS\System32\drivers\avgbidsh.sys [206624 2019-07-27] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)
R0 avgbuniv; C:\WINDOWS\System32\drivers\avgbuniv.sys [61736 2019-07-27] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)
R1 avgKbd; C:\WINDOWS\System32\drivers\avgKbd.sys [42552 2019-07-27] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)
R2 avgMonFlt; C:\WINDOWS\System32\drivers\avgMonFlt.sys [168944 2019-07-31] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)
R1 avgRdr; C:\WINDOWS\System32\drivers\avgRdr2.sys [112568 2019-07-27] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)
R0 avgRvrt; C:\WINDOWS\System32\drivers\avgRvrt.sys [88208 2019-07-27] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)
R1 avgSnx; C:\WINDOWS\System32\drivers\avgSnx.sys [1030832 2019-07-31] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)
R1 avgSP; C:\WINDOWS\System32\drivers\avgSP.sys [477336 2019-07-27] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)
R2 avgStm; C:\WINDOWS\System32\drivers\avgStm.sys [225864 2019-07-27] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)
R0 avgVmm; C:\WINDOWS\System32\drivers\avgVmm.sys [387736 2019-08-05] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)
S3 bcmfn2; C:\WINDOWS\System32\drivers\bcmfn2.sys [17624 2013-08-12] (Broadcom Corporation -> Windows ® Win 7 DDK provider)
R3 dc3d; C:\WINDOWS\System32\drivers\dc3d.sys [47616 2011-05-18] (Hardware Group Test Cert -> Microsoft Corporation)
R3 e1dexpress; C:\WINDOWS\system32\DRIVERS\e1d62x64.sys [534512 2017-04-25] (Intel® INTELND1617 -> Intel Corporation)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [34760 2013-08-22] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [265056 2013-08-22] (Microsoft Windows -> Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [124256 2013-08-22] (Microsoft Windows -> Microsoft Corporation)
R3 WirelessKeyboardFilter; C:\WINDOWS\System32\drivers\WirelessKeyboardFilter.sys [49336 2018-03-11] (Microsoft Corporation -> Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One month (created) ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2019-08-12 19:04 - 2019-08-12 19:04 - 000011992 _____ C:\Users\mj\Desktop\FRST.txt
2019-08-12 18:12 - 2019-08-12 18:12 - 000002783 _____ C:\Users\mj\Desktop\FSS.txt
2019-08-12 18:07 - 2019-08-12 18:07 - 000899584 _____ (Farbar) C:\Users\mj\Desktop\FSS.exe
2019-08-12 18:03 - 2019-08-12 18:03 - 000001322 _____ C:\Users\mj\Desktop\AdwCleaner[S00].txt
2019-08-12 18:00 - 2019-08-12 18:00 - 000000000 ____D C:\AdwCleaner
2019-08-12 17:57 - 2019-08-12 17:57 - 007623880 _____ (Malwarebytes) C:\Users\mj\Desktop\adwcleaner_7.4.exe
2019-08-12 17:50 - 2019-08-12 17:50 - 000006372 _____ C:\Users\mj\Desktop\Fixlog.txt
2019-08-11 21:39 - 2019-08-11 21:39 - 000000149 _____ C:\Users\mj\Documents\WindowsUpdateService.txt
2019-08-11 21:19 - 2019-08-12 19:04 - 000000000 ____D C:\FRST
2019-08-11 21:03 - 2019-08-11 21:03 - 002097664 _____ (Farbar) C:\Users\mj\Desktop\FRST64.exe
2019-08-11 21:01 - 2019-08-11 21:01 - 001448960 _____ (Farbar) C:\Users\mj\Desktop\FRST.exe
2019-08-11 21:00 - 2019-08-11 21:00 - 000000232 _____ C:\Users\mj\Documents\SteveFix.txt
2019-08-11 20:37 - 2019-08-11 21:40 - 000343188 _____ C:\WINDOWS\ntbtlog.txt
2019-08-10 20:24 - 2019-08-11 20:37 - 000000000 ____D C:\Users\mj\AppData\Local\FSDART
2019-08-10 20:24 - 2019-08-10 20:27 - 000000000 ____D C:\ProgramData\F-Secure
2019-08-10 20:24 - 2019-08-10 20:24 - 000000000 ____D C:\Users\mj\AppData\Local\F-Secure
2019-08-10 20:23 - 2019-08-10 20:23 - 009603600 _____ (F-Secure Corporation) C:\Users\mj\Desktop\F-SecureOnlineScanner.exe
2019-08-10 20:18 - 2019-08-10 20:18 - 000060784 _____ C:\ProgramData\agent.uninstall.1565482727.bdinstall.v2.bin
2019-08-10 20:15 - 2019-08-10 20:15 - 000102296 _____ C:\ProgramData\agent.1565482537.bdinstall.v2.bin
2019-08-10 20:15 - 2019-08-10 20:15 - 000000000 ____D C:\ProgramData\Bitdefender Agent
2019-08-10 19:01 - 2019-08-11 19:57 - 000003692 _____ C:\WINDOWS\System32\Tasks\EOSv3 Scheduler onLogOn
2019-08-10 19:01 - 2019-08-11 19:57 - 000003252 _____ C:\WINDOWS\System32\Tasks\EOSv3 Scheduler onTime
2019-08-10 18:31 - 2019-08-10 20:28 - 000000536 _____ C:\Users\mj\Desktop\ESET Online Scanner.lnk
2019-08-10 18:31 - 2019-08-10 18:31 - 000000000 ____D C:\Users\mj\AppData\Local\ESET
2019-08-10 18:30 - 2019-08-10 18:30 - 007969304 _____ (ESET spol. s r.o.) C:\Users\mj\Desktop\esetonlinescanner_enu.exe
2019-08-10 18:19 - 2019-08-10 18:24 - 000000908 _____ C:\Users\mj\Desktop\SALog.txt
2019-08-10 18:05 - 2019-08-10 18:05 - 000899584 _____ C:\Users\mj\Desktop\RGSA.exe
2019-08-10 17:41 - 2019-08-10 17:41 - 000001307 _____ C:\Users\mj\Desktop\Malwarebytes.txt
2019-08-10 11:28 - 2019-08-10 11:28 - 000002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2019-08-10 11:28 - 2019-08-10 11:28 - 000002039 _____ C:\Users\Public\Desktop\Adobe Reader X.lnk
2019-08-10 11:26 - 2019-08-10 11:26 - 000000000 ____D C:\Program Files (x86)\Adobe
2019-08-02 10:13 - 2019-08-02 10:13 - 000023117 _____ C:\Users\mj\Desktop\Callahan-30 day_1.pdf
2019-08-01 11:59 - 2019-08-01 11:59 - 000012317 _____ C:\Users\mj\Desktop\VRRENEWAL.pdf
2019-08-01 11:50 - 2019-08-01 11:50 - 000138878 _____ C:\Users\mj\Desktop\IDCARD.pdf
2019-07-31 09:29 - 2019-07-31 09:29 - 000092944 _____ C:\Users\mj\Desktop\Pat meds.pdf
2019-07-30 21:41 - 2019-07-30 21:41 - 000001769 _____ C:\WINDOWS\Language_trs.ini
2019-07-30 21:39 - 2019-08-10 22:21 - 000036952 _____ C:\WINDOWS\Ascd_tmp.ini
2019-07-30 21:39 - 2009-04-02 08:30 - 000010296 _____ C:\WINDOWS\SysWOW64\Drivers\ASUSHWIO.SYS
2019-07-30 21:25 - 2019-07-30 21:25 - 000000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_LocationProvider_01_11_00.Wdf
2019-07-30 21:18 - 2019-07-30 21:18 - 000000118 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2019-07-28 15:02 - 2019-08-11 19:57 - 000000000 ____D C:\WINDOWS\System32\Tasks\AVAST Software
2019-07-28 13:17 - 2019-07-28 13:17 - 000000000 ____D C:\Users\mj\AppData\Roaming\Macromedia
2019-07-28 13:15 - 2019-08-11 20:40 - 000000000 ____D C:\Users\mj\AppData\Local\ElevatedDiagnostics
2019-07-28 13:01 - 2019-08-10 11:27 - 000000000 ____D C:\ProgramData\Adobe
2019-07-28 12:59 - 2019-08-11 19:57 - 000004418 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player PPAPI Notifier
2019-07-28 12:59 - 2019-08-11 19:57 - 000004282 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2019-07-28 12:58 - 2019-07-28 13:05 - 000000000 ____D C:\Users\mj\AppData\Local\Adobe
2019-07-28 12:54 - 2019-07-28 12:54 - 000130868 _____ C:\Users\mj\Desktop\Apps removed while refreshing your PC.pdf
2019-07-28 12:50 - 2019-07-28 12:50 - 000000401 _____ C:\WINDOWS\system32\{F33C3B9B-72AF-418A-B3FD-560646F7CDA2}.bat
2019-07-28 02:18 - 2019-08-02 17:20 - 000000000 ____D C:\Windows.old
2019-07-28 02:18 - 2019-07-28 00:06 - 000000000 ___DC C:\WINDOWS\Panther
2019-07-28 02:17 - 2019-07-28 02:17 - 000262144 _____ C:\WINDOWS\system32\config\userdiff
2019-07-28 00:18 - 2019-07-28 00:18 - 000000363 _____ C:\Users\mj\Desktop\Control Panel - Shortcut.lnk
2019-07-28 00:11 - 2019-07-28 00:11 - 000000851 _____ C:\Users\mj\Desktop\Documents - Shortcut.lnk
2019-07-28 00:10 - 2019-07-28 00:10 - 000000509 _____ C:\Users\mj\Desktop\Seagate Expansion Drive (E) - Shortcut.lnk
2019-07-28 00:10 - 2019-07-28 00:10 - 000000476 _____ C:\Users\mj\Desktop\Local Disk © - Shortcut.lnk
2019-07-28 00:08 - 2019-07-28 00:08 - 000000424 _____ C:\Users\mj\Desktop\This PC - Shortcut.lnk
2019-07-28 00:07 - 2019-07-28 00:07 - 000001032 _____ C:\Users\mj\Desktop\TFC - Shortcut.lnk
2019-07-28 00:04 - 2019-08-11 19:57 - 000003870 _____ C:\WINDOWS\System32\Tasks\CCleaner Update
2019-07-28 00:04 - 2019-08-11 19:57 - 000002794 _____ C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
2019-07-28 00:04 - 2019-07-28 00:04 - 000000834 _____ C:\Users\Public\Desktop\CCleaner.lnk
2019-07-28 00:04 - 2019-07-28 00:04 - 000000000 ____D C:\Program Files\CCleaner
2019-07-28 00:01 - 2019-07-28 00:01 - 000000000 ____D C:\Users\mj\AppData\Local\mbamtray
2019-07-28 00:01 - 2019-07-28 00:01 - 000000000 ____D C:\Users\mj\AppData\Local\mbam
2019-07-28 00:00 - 2019-08-11 20:45 - 000000000 ____D C:\ProgramData\Malwarebytes
2019-07-27 23:55 - 2019-08-08 20:08 - 000000000 ____D C:\Program Files (x86)\AVG
2019-07-27 23:54 - 2019-08-08 20:37 - 000000000 ____D C:\Users\mj\AppData\Local\Avg
2019-07-27 23:54 - 2019-08-08 20:37 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2019-07-27 23:54 - 2019-07-27 23:54 - 000002002 _____ C:\Users\Public\Desktop\AVG AntiVirus FREE.lnk
2019-07-27 23:54 - 2019-07-27 23:54 - 000000000 ____D C:\Users\mj\AppData\Roaming\AVG
2019-07-27 23:54 - 2019-07-27 23:54 - 000000000 ____D C:\Users\mj\AppData\Local\CEF
2019-07-27 23:52 - 2019-08-11 19:57 - 000004162 _____ C:\WINDOWS\System32\Tasks\Antivirus Emergency Update
2019-07-27 23:52 - 2019-08-08 20:37 - 000000000 ____D C:\WINDOWS\System32\Tasks\AVG
2019-07-27 23:52 - 2019-08-05 09:19 - 000387736 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgVmm.sys
2019-07-27 23:52 - 2019-07-31 19:37 - 001030832 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgSnx.sys
2019-07-27 23:52 - 2019-07-31 19:37 - 000168944 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgMonFlt.sys
2019-07-27 23:52 - 2019-07-27 23:52 - 000000000 ____D C:\Program Files\Common Files\AVG
2019-07-27 23:52 - 2019-07-27 23:51 - 000477336 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgSP.sys
2019-07-27 23:52 - 2019-07-27 23:51 - 000363440 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\avgBoot.exe
2019-07-27 23:52 - 2019-07-27 23:51 - 000263784 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgbidsdriver.sys
2019-07-27 23:52 - 2019-07-27 23:51 - 000225864 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgStm.sys
2019-07-27 23:52 - 2019-07-27 23:51 - 000209304 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgArPot.sys
2019-07-27 23:52 - 2019-07-27 23:51 - 000206624 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgbidsh.sys
2019-07-27 23:52 - 2019-07-27 23:51 - 000112568 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgRdr2.sys
2019-07-27 23:52 - 2019-07-27 23:51 - 000088208 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgRvrt.sys
2019-07-27 23:52 - 2019-07-27 23:51 - 000061736 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgbuniv.sys
2019-07-27 23:52 - 2019-07-27 23:51 - 000042552 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgKbd.sys
2019-07-27 23:52 - 2019-07-27 23:51 - 000037368 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgArDisk.sys
2019-07-27 23:51 - 2019-07-27 23:51 - 000000000 ____D C:\Program Files\KeyboardNotification
2019-07-27 23:50 - 2019-07-28 12:50 - 000000000 ____D C:\Intel
2019-07-27 23:50 - 2019-07-27 23:50 - 000000000 ____D C:\Program Files\Intel
2019-07-27 23:50 - 2019-07-27 23:50 - 000000000 ____D C:\Program Files\AVG
2019-07-27 23:50 - 2019-07-27 23:50 - 000000000 ____D C:\Program Files (x86)\Intel
2019-07-27 23:50 - 2015-08-09 04:50 - 000096752 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.DLL
2019-07-27 23:50 - 2015-08-09 04:50 - 000092648 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.DLL
2019-07-27 23:49 - 2019-07-30 21:56 - 000000000 ____D C:\ProgramData\AVG
2019-07-27 23:49 - 2019-07-27 23:49 - 000268624 _____ (AVG Technologies CZ, s.r.o.) C:\Users\mj\Downloads\avg_antivirus_free_setup (2).exe
2019-07-27 23:49 - 2019-07-27 23:49 - 000000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_ASMBSW_01_11_00.Wdf
2019-07-27 23:49 - 2019-07-27 23:49 - 000000000 ____D C:\Program Files\ASUS
2019-07-27 23:49 - 2019-07-27 23:49 - 000000000 ____D C:\Program Files (x86)\ASUS
2019-07-27 23:49 - 2013-07-03 20:32 - 000028672 _____ (ASUSTek Computer Inc.) C:\WINDOWS\SysWOW64\AsIO.dll
2019-07-27 23:49 - 2013-07-03 20:32 - 000015232 _____ C:\WINDOWS\SysWOW64\Drivers\AsIO.sys
2019-07-27 23:47 - 2019-07-27 23:47 - 000000000 ___HD C:\ProgramData\CanonBJ
2019-07-27 23:47 - 2019-07-27 23:47 - 000000000 ____D C:\Users\mj\AppData\Roaming\Google
2019-07-27 23:47 - 2012-02-08 16:36 - 000363520 _____ (CANON INC.) C:\WINDOWS\system32\CNC_B8L.dll
2019-07-27 23:47 - 2012-01-24 16:18 - 000077568 _____ C:\WINDOWS\system32\CNC1762D.TBL
2019-07-27 23:47 - 2012-01-16 14:21 - 000287744 _____ (CANON INC.) C:\WINDOWS\system32\CNC_B8C.dll
2019-07-27 23:47 - 2012-01-16 14:20 - 000106496 _____ (CANON INC.) C:\WINDOWS\system32\CNC_B8I.dll
2019-07-27 23:47 - 2008-08-25 18:02 - 000017920 _____ (CANON INC.) C:\WINDOWS\system32\CNHMCA6.dll
2019-07-27 23:46 - 2012-03-26 05:00 - 000389120 _____ (CANON INC.) C:\WINDOWS\system32\CNMLMB8.DLL
2019-07-27 23:45 - 2019-08-11 19:57 - 000003332 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2019-07-27 23:45 - 2019-08-11 19:57 - 000003204 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2019-07-27 23:45 - 2019-08-07 08:26 - 000002244 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2019-07-27 23:45 - 2019-08-07 08:26 - 000002203 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2019-07-27 23:45 - 2019-07-27 23:58 - 000000000 ____D C:\Users\mj\AppData\Local\Google
2019-07-27 23:45 - 2019-07-27 23:45 - 000000000 ____D C:\Program Files (x86)\Google
2019-07-27 23:15 - 2019-07-27 23:15 - 000000765 _____ C:\Users\mj\Desktop\Mj.lnk
2019-07-27 22:37 - 2019-08-12 17:56 - 000003596 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3810651120-1967127889-315127114-1001
2019-07-27 22:36 - 2019-07-27 22:36 - 000000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2019-07-27 22:33 - 2019-07-27 22:33 - 000000000 __SHD C:\Users\mj\AppData\Local\EmieUserList
2019-07-27 22:33 - 2019-07-27 22:33 - 000000000 __SHD C:\Users\mj\AppData\Local\EmieSiteList
2019-07-27 22:27 - 2019-07-27 22:27 - 000000000 ____D C:\WINDOWS\System32\Tasks\WPD
2019-07-27 22:25 - 2019-07-27 22:25 - 000001442 _____ C:\Users\mj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2019-07-27 22:25 - 2019-07-27 22:25 - 000000020 ___SH C:\Users\mj\ntuser.ini
2019-07-27 22:25 - 2019-07-27 22:25 - 000000000 ____D C:\Users\mj\AppData\Roaming\Adobe
2019-07-27 22:25 - 2019-07-27 22:25 - 000000000 ____D C:\Users\mj\AppData\Local\VirtualStore
2019-07-27 22:22 - 2019-08-08 20:38 - 000000000 ____D C:\Users\mj
2019-07-27 22:22 - 2019-07-27 22:23 - 000013338 _____ C:\WINDOWS\diagwrn.xml
2019-07-27 22:22 - 2019-07-27 22:23 - 000013338 _____ C:\WINDOWS\diagerr.xml
2019-07-27 22:22 - 2014-03-18 06:13 - 000000369 _____ C:\Users\mj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk
2019-07-27 22:22 - 2014-03-18 06:13 - 000000369 _____ C:\Users\mj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk
2019-07-27 18:48 - 2019-07-27 18:48 - 000000082 _____ C:\Users\mj\Documents\cc_20190727_184855.reg
2019-07-27 18:41 - 2019-07-27 18:41 - 064333800 _____ (Malwarebytes ) C:\Users\mj\Downloads\mb3-setup-43841.43841-3.8.3.2965-1.0.613-1.0.11270.exe
2019-07-27 18:18 - 2019-07-27 18:18 - 000448512 _____ (OldTimer Tools) C:\Users\mj\Downloads\TFC.exe
2019-07-25 23:34 - 2019-07-25 23:34 - 000017800 _____ C:\Users\mj\Documents\cc_20190725_233436.reg
2019-07-25 23:30 - 2019-07-25 23:32 - 000001563 _____ C:\Users\mj\Documents\Windows Update Fixes.txt
2019-07-25 23:04 - 2019-07-25 23:18 - 000000502 _____ C:\Users\mj\Documents\2nd.AttemptUpdateRepair.txt
2019-07-25 22:17 - 2019-07-25 22:17 - 000000849 _____ C:\Users\mj\Documents - Shortcut.lnk
2019-07-25 22:04 - 2019-07-25 22:04 - 000000866 _____ C:\Users\mj\Documents\WindowsUpdateFix.txt
2019-07-25 21:54 - 2019-07-25 21:54 - 000001090 _____ C:\Users\mj\Desktop\notepad - Shortcut.lnk
2019-07-25 21:43 - 2019-07-25 22:28 - 000000259 _____ C:\Users\mj\Documents\ClearWindowsStoreCache.txt
2019-07-25 20:58 - 2019-07-25 20:58 - 020891464 _____ (Piriform Software Ltd) C:\Users\mj\Downloads\ccsetup560.exe

==================== One month (modified) ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2019-08-12 17:51 - 2014-08-27 03:34 - 000000000 __SHD C:\Users\mj\IntelGraphicsProfiles
2019-08-12 17:51 - 2013-08-22 10:45 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2019-08-12 17:50 - 2015-10-12 11:58 - 000000000 ____D C:\Users\mj\AppData\LocalLow\Temp
2019-08-11 20:41 - 2013-08-22 09:25 - 000262144 ___SH C:\WINDOWS\system32\config\BBI
2019-08-10 18:38 - 2011-05-10 16:58 - 000000000 ____D C:\Users\mj\Documents\My Downloads
2019-08-10 12:03 - 2013-08-22 09:36 - 000000000 ____D C:\WINDOWS\Inf
2019-08-08 20:37 - 2013-08-22 09:36 - 000000000 ____D C:\WINDOWS\system32\Sysprep
2019-08-08 20:37 - 2013-08-22 09:36 - 000000000 ____D C:\WINDOWS\system32\AdvancedInstallers
2019-08-08 20:37 - 2011-05-10 16:49 - 000000000 ____D C:\Users\mj\Documents\Corel User Files
2019-08-08 20:35 - 2013-08-22 11:36 - 000000000 ___HD C:\Program Files\WindowsApps
2019-08-08 20:32 - 2013-08-22 11:36 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed
2019-08-08 20:32 - 2013-08-22 11:36 - 000000000 ____D C:\WINDOWS\system32\Macromed
2019-08-08 20:32 - 2013-08-22 11:36 - 000000000 ____D C:\WINDOWS\registration
2019-08-08 10:00 - 2017-05-06 09:14 - 000000000 ____D C:\Users\mj\Desktop\Sean
2019-08-07 22:17 - 2012-01-06 14:19 - 000000000 ____D C:\Users\mj\Documents\universal 2012
2019-08-02 12:32 - 2014-03-18 06:03 - 000818732 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2019-07-29 21:36 - 2013-08-22 11:36 - 000000000 ____D C:\WINDOWS\AppReadiness
2019-07-28 13:21 - 2015-08-13 19:41 - 000000000 ____D C:\Users\mj\Desktop\all things wild photos
2019-07-28 02:18 - 2014-08-26 08:31 - 000008192 __RSH C:\BOOTSECT.BAK
2019-07-28 02:18 - 2013-08-22 11:36 - 000262144 _____ C:\WINDOWS\system32\config\BCD-Template
2019-07-28 00:55 - 2013-08-22 11:20 - 000000000 ____D C:\WINDOWS\CbsTemp
2019-07-27 23:47 - 2013-08-22 11:36 - 000000000 ____D C:\WINDOWS\system32\FxsTmp
2019-07-27 23:42 - 2013-08-22 11:36 - 000000000 ____D C:\WINDOWS\system32\NDF
2019-07-27 22:37 - 2014-08-27 01:49 - 000000000 __SHD C:\Users\mj\AppData\LocalLow\EmieUserList
2019-07-27 22:37 - 2014-08-27 01:48 - 000000000 __SHD C:\Users\mj\AppData\LocalLow\EmieSiteList
2019-07-27 22:33 - 2013-08-22 09:25 - 000262144 ___SH C:\WINDOWS\system32\config\ELAM
2019-07-27 22:26 - 2014-08-27 01:29 - 000000851 _____ C:\Users\mj\Desktop\Downloads.lnk
2019-07-27 22:26 - 2013-08-22 11:36 - 000000000 ____D C:\WINDOWS\rescache
2019-07-27 22:25 - 2014-08-27 01:29 - 000000000 ____D C:\Users\mj\AppData\Local\Packages
2019-07-27 22:23 - 2013-08-22 11:36 - 000000000 __RHD C:\Users\Public\Libraries
2019-07-27 22:23 - 2009-07-14 03:48 - 000000000 ___RD C:\Users\Public\Recorded TV
2019-07-27 22:21 - 2013-08-22 10:44 - 000335784 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2019-07-27 21:23 - 2017-06-28 12:51 - 000000000 ____D C:\Users\mj\Desktop\Patrick

==================== Files in the root of some directories ================

2018-04-18 19:59 - 2018-04-18 19:59 - 001129816 _____ (Google Inc.) C:\Users\mj\ChromeSetup.exe

==================== SigCheck ===============================

(There is no automatic fix for files that do not pass verification.)


LastRegBack: 2019-08-10 12:03
==================== End of FRST.txt ============================

 

Addition.txt

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-08-2019
Ran by mj (12-08-2019 19:04:59)
Running from C:\Users\mj\Desktop
Windows 8.1 (X64) (2019-07-28 02:25:20)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3810651120-1967127889-315127114-500 - Administrator - Disabled)
Guest (S-1-5-21-3810651120-1967127889-315127114-501 - Limited - Disabled)
mj (S-1-5-21-3810651120-1967127889-315127114-1001 - Administrator - Enabled) => C:\Users\mj

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: AVG Antivirus (Enabled - Up to date) {4FC75CA5-1654-5411-7CFB-1893D506BCF4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG Antivirus (Enabled - Up to date) {F4A6BD41-306E-5B9F-464B-23E1AE81F649}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 32 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 32.0.0.223 - Adobe)
Adobe Reader X (10.1.3) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.3 - Adobe Systems Incorporated)
AVG AntiVirus FREE (HKLM-x32\...\AVG Antivirus) (Version: 19.6.3098 - AVG Technologies)
CCleaner (HKLM\...\CCleaner) (Version: 5.60 - Piriform)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 76.0.3809.100 - Google LLC)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.34.11 - Google LLC) Hidden
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.14.4264 - Intel Corporation)

Packages:
=========
Games -> C:\Program Files\WindowsApps\Microsoft.XboxLIVEGames_2.0.139.0_x64__8wekyb3d8bbwe [2019-08-08] (Microsoft Corporation) [MS Ad]
MSN Food & Drink -> C:\Program Files\WindowsApps\Microsoft.BingFoodAndDrink_3.0.4.336_x64__8wekyb3d8bbwe [2019-08-08] (Microsoft Corporation) [MS Ad]
MSN Health & Fitness -> C:\Program Files\WindowsApps\Microsoft.BingHealthAndFitness_3.0.4.336_x64__8wekyb3d8bbwe [2019-08-08] (Microsoft Corporation) [MS Ad]
MSN Money -> C:\Program Files\WindowsApps\Microsoft.BingFinance_3.0.4.344_x64__8wekyb3d8bbwe [2019-08-08] (Microsoft Corporation) [MS Ad]
MSN News -> C:\Program Files\WindowsApps\Microsoft.BingNews_3.0.4.344_x64__8wekyb3d8bbwe [2019-08-08] (Microsoft Corporation) [MS Ad]
MSN Sports -> C:\Program Files\WindowsApps\Microsoft.BingSports_3.0.4.345_x64__8wekyb3d8bbwe [2019-08-08] (Microsoft Corporation) [MS Ad]
MSN Travel -> C:\Program Files\WindowsApps\Microsoft.BingTravel_3.0.4.336_x64__8wekyb3d8bbwe [2019-08-08] (Microsoft Corporation) [MS Ad]
MSN Weather -> C:\Program Files\WindowsApps\Microsoft.BingWeather_3.0.4.350_x64__8wekyb3d8bbwe [2019-08-08] (Microsoft Corporation) [MS Ad]
Music -> C:\Program Files\WindowsApps\Microsoft.ZuneMusic_2.6.672.0_x64__8wekyb3d8bbwe [2019-08-08] (Microsoft Corporation) [MS Ad]
Skype -> C:\Program Files\WindowsApps\Microsoft.SkypeApp_3.1.0.1016_x86__kzf8qxf38zg5c [2019-08-08] (Skype) [MS Ad]
Video -> C:\Program Files\WindowsApps\Microsoft.ZuneVideo_2.6.446.0_x64__8wekyb3d8bbwe [2019-08-08] (Microsoft Corporation) [MS Ad]

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-3810651120-1967127889-315127114-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation - pGFX -> Intel Corporation)
ContextMenuHandlers1: [AVG] -> {472083B1-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVG\Antivirus\ashShell.dll [2019-07-27] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\system32\igfxDTCM.dll [2015-08-09] (Microsoft Windows Hardware Compatibility Publisher -> Intel Corporation)
ContextMenuHandlers6: [AVG] -> {472083B1-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVG\Antivirus\ashShell.dll [2019-07-27] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


==================== Loaded Modules (Whitelisted) ==============

2019-07-27 23:49 - 2019-08-12 17:51 - 000028672 _____ () [File not signed] C:\Program Files (x86)\ASUS\AXSP\1.01.02\PEbiosinterface32.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 09:25 - 2013-08-22 09:25 - 000000824 _____ C:\WINDOWS\system32\drivers\etc\hosts


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3810651120-1967127889-315127114-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\mj\AppData\Roaming\Microsoft\Windows Photo Viewer\Windows Photo Viewer Wallpaper.jpg
DNS Servers: 209.18.47.63 - 209.18.47.62
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

If an entry is included in the fixlist, it will be removed.


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{87E0AF9A-190B-4E90-8E9D-BC0B7927B81B}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google LLC)

==================== Restore Points =========================

05-08-2019 16:39:59 Scheduled Checkpoint
08-08-2019 19:54:20 Restore Operation
10-08-2019 11:26:17 Installed Adobe Reader X MUI.
12-08-2019 17:50:24 Restore Point Created by FRST

==================== Faulty Device Manager Devices =============

Name: SM Bus Controller
Description: SM Bus Controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: High Definition Audio Device
Description: High Definition Audio Device
Class Guid: {4d36e96c-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: HdAudAddService
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (08/12/2019 05:50:24 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied.
.
This is often caused by incorrect security settings in either the writer or requestor process.


Operation:
Gathering Writer Data

Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {c95fd468-4fc7-4041-ae3a-305d435fb3ac}

Error: (08/12/2019 05:28:24 PM) (Source: Application) (EventID: 0) (User: )
Description: Event-ID 0

Error: (08/11/2019 08:41:02 PM) (Source: PerfNet) (EventID: 2002) (User: )
Description: Unable to open the Redirector service performance object. The first four bytes (DWORD) of the Data section contains the status code.

Error: (08/11/2019 08:41:02 PM) (Source: PerfNet) (EventID: 2004) (User: )
Description: Unable to open the Server service performance object. The first four bytes (DWORD) of the Data section contains the status code.

Error: (08/11/2019 08:41:02 PM) (Source: PerfNet) (EventID: 2002) (User: )
Description: Unable to open the Redirector service performance object. The first four bytes (DWORD) of the Data section contains the status code.

Error: (08/11/2019 08:41:02 PM) (Source: PerfNet) (EventID: 2004) (User: )
Description: Unable to open the Server service performance object. The first four bytes (DWORD) of the Data section contains the status code.

Error: (08/11/2019 08:39:02 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: The Open Procedure for service "WmiApRpl" in DLL "C:\WINDOWS\system32\wbem\wmiaprpl.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

Error: (08/11/2019 08:39:02 PM) (Source: Perflib) (EventID: 1010) (User: )
Description: The Collect Procedure for the "C:\Windows\System32\winspool.drv" service in DLL "Spooler" generated an exception or returned an invalid status. The performance data returned by the counter DLL will not be returned in the Perf Data Block. The first four bytes (DWORD) of the Data section contains the exception code or status code.


System errors:
=============
Error: (08/12/2019 06:20:27 PM) (Source: DCOM) (EventID: 10010) (User: mjpc)
Description: The server {1B1F472E-3221-4826-97DB-2C2324D389AE} did not register with DCOM within the required timeout.

Error: (08/12/2019 05:51:07 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Windows Search service failed to start due to the following error:
The service did not start due to a logon failure.

Error: (08/12/2019 05:51:07 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: The WSearch service was unable to log on as NT AUTHORITY\SYSTEM with the currently configured password due to the following error:
%%50 = The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).

Error: (08/12/2019 05:50:37 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.

Error: (08/12/2019 05:50:37 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Wireless Keyboard 850 Notification Service service terminated unexpectedly. It has done this 1 time(s).

Error: (08/12/2019 05:50:37 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The ASUS Com Service service terminated unexpectedly. It has done this 1 time(s).

Error: (08/12/2019 05:50:37 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Adobe Acrobat Update Service service terminated unexpectedly. It has done this 1 time(s).

Error: (08/12/2019 05:50:37 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Intel® HD Graphics Control Panel Service service terminated unexpectedly. It has done this 1 time(s).


==================== Memory info ===========================

BIOS: American Megatrends Inc. 0317 04/23/2014
Motherboard: ASUSTeK COMPUTER INC. H97M-PLUS
Processor: Intel® Core™ i5-4460 CPU @ 3.20GHz
Percentage of memory in use: 20%
Total physical RAM: 8068.36 MB
Available physical RAM: 6432.78 MB
Total Virtual: 9348.36 MB
Available Virtual: 7807.56 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:931.51 GB) (Free:833.7 GB) NTFS ==>[drive with boot components (obtained from BCD)]


==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7/8/10) (Size: 931.5 GB) (Disk ID: AA0C14BA)
Partition 1: (Active) - (Size=931.5 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================



########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S00].txt ##########

[nasdaq]

Hi,

 

If the folder in bold is still present you can deleted.

C:\Program Files (x86)\Driver Support

 

Your logs are clean.

 

I suggest you try the Windows Updates.

 

Let me know of any remaining issues with this computer.

[Krishna]

When I went in to check on that Windows 8.1 PC yesterday afternoon, I couldn't find the Folder Driver Support.  So I typed regedit in Run, went into the Registry, and under Edit I selected Find, typed in  PC Drivers HeadQuarters LP.  And checked, Keys Values, Data, and Match whole string only.  Then Find.  It found 1 item and I deleted it.  There was nothing left even when I unchecked Match whole string and run Find again.  Then I closed Find and then Exited the Registry.

 

When I opened Control Panel, then Windows Update, the Update Window still says there are no new updates, no hidden updates.  I did not have it Search.  Windows Updater still must not be working?  What do we do now?  Search for Updates works just fine on this Windows 8.1 Computer. What's the function of Windows Defender?  Hers is still not up and running.

 

She's also having a problem with Google Chrome.  One day it won't save her her passwords and the next day it does.  Now it appears that it's not Saving Bookmarks, but they are listed in the History File just not on the Bookmarks page.

 

I'm stumped.  What do we do now?

[nasdaq]

Hi,

 

What's the function of Windows Defender?  Hers is still not up and running.

It's disabled by the AVG security program. They cannot be running simultaneously.

 

===

 

Quoted from this article which is 2 years old.

https://betanews.com...tended-support/

 

During mainstream support, which ended January 9 (2017), Microsoft provided security and non-security updates and accepted requests for product changes. Extended support means that the average Windows 8.1 user will only receive security updates.

 

Microsoft says that it is possible to receive non-security updates as well, but that only applies to Windows 8.1 customers who have what it calls "Extended Hotfix Support." Even so, this does not apply to "desktop operating system consumer products" -- which most likely means Windows 8.1 users with a non-Pro or Enterprise version installed.

 

You co not have the 8.1 pro version. My understanding is that you have all the latest updates.

No more support from Microsoft. Hope that you can get a few more years with this computer.

 

===

 

Your copy of Chrome may have been compromised. Proceed with these instructions.

 

Remove Chrome from your Computer and reinstall a fresh copy later.

 

If you remove the syncing of your account you must remove it before you save your bookmarks etc...

Delete Your Google Chrome Browser Sync Data if you sync with other devices. <- Important ...

https://forums.malwa...ays-comes-back/

 

Before you remove Chrome Export your Bookmarks

Chrome will export your bookmarks as a HTML file, which you can then import into another browser.

How To: http://ccm.net/faq/3...hrome-bookmarks

 

Before you remove Chrome Export your Passwords

How to export your saved passwords from Chrome

https://www.google.c...chrome&ie=UTF-8

 

Clear your Chrome cache and cookies

https://support.goog...er/183083?hl=en

 

Remove Chrome using the the instructions on this page.

https://support.goog...wer/95319?hl=en

 

Re-install Chrome and the Bookmarks.

<<<>>

[Krishna]

I printed out a copy of your instructions for uninstalling Google Chrome, but didn't uninstall it as she said she changed the Bookmarks, turned on Sync (has Smart Phone), and it seems to be saving bookmarks now.

 

I removed all the Programs I ran on her PC at the Start of the Diagnostic, and all the Programs and Text files associated with what you had me download at the beginning of this thread.  I installed a fresh FREE version of Malwarebytes and did a scan day before yesterday.  It found 1 PUP and put it in Quarantine.  I downloaded a program that makes the Windows Start act like the Start of old, which the person put on her PC when she first got it, but was removed when I did a Refresh on that PC.

 

Is there anything else you wanted me to do?

 

Could you answer a question for me?  Thanks.  Over the years I have borrowed great programs the volunteers have advised people to get to run on their systems.  One of the Programs I got from here was a FREE Program called Secunia PSI (Personal Software Inspector), that updated all the drivers on this laptop, until April of 2018, when the company that had bought that program decided they weren't going to support the software any more.  I would have been happy to pay money for that program.  So the question is, what Driver Updating Software Program do you like that is as simple to run as the Secunia PSI program?  

[nasdaq]

Hi,

 

I downloaded a program that makes the Windows Start act like the Start of old, which the person put on her PC when she first got it, but was removed when I did a Refresh on that PC.

 

Which program was it?

Check on this page.

https://www.cnet.com...k-in-windows-8/

 

I'm not recommending any of them as I have not knowledge on this.

I know that you should not use  the Pokki for Windows 8.

 

If you download any other programs check the integrity of the file at Virus Total before installing it..

 

Follow the instructions on this page.

https://www.virustot...gui/home/upload

===

 

As for the Hardware Driver updates.

 

Check this out.

https://www.howtogee...ers-on-windows/

 

Quoted from  the page.

Just use the option you have with Windows 8.1

On Windows 7, 8, and 8.1, hardware drivers appear in the Windows Update interface as an optional update. If you want the latest hardware drivers, be sure to go open Windows Update, check for updates, and install any available hardware driver updates.

 

You may be interested in some of the programs suggested at BleepingComputer a respectable site.

https://www.bleeping...inued-in-april/

I'm an Helper at the site also.

 

===

 

Let me know if you have issues with this computer.

 

[Krishna]

I Downloaded Classic Shell as talked about in the video below.  (cnet)

 

How to bring back the Start Menu in Windows 8.1 / Windows 8

 

 

I haven't actually tried it yet, as this is for Windows 8 and I have 8.1 on this laptop, but the "Classic" is talked about in changing a value in the Registry for a certain key from this video.

 

Enable The Classic Start Menu in Windows 8

 

 

 

Would appreciate your knowledge on the above link (Enable The Classic Start Menu in Windows 8).

 

Thanks in advance,

[Krishna]

Forgot to ask.  Is there a good Ad Blocking Software that you like.  I look at a lot of Music videos on YouTube, and YouTube is always bugging me with Commercials.  $9.95 a month for Commercial Free YouTube Professional is ridiculous.

 

Thanks in advance,

[Krishna]

If you were thinking, doesn't he stop?  While I got your attention  ,  are there any VPNs (Virtual Private Networks) or Track Blocking Software that you also like?

 

Thanks for your time.    

[nasdaq]

Hi,

 

Would appreciate your knowledge on the above link (Enable The Classic Start Menu in Windows 8).

 

I never had any on hands experience with Wndows 8.1.

I suggest you ask in the 8.1 Forum.

If you do not find your answer in browsing the Forum, start a new topic.

https://www.bleeping...and-windows-81/

 

===

 

Is there a good Ad Blocking Software that you like.  I look at a lot of Music videos on YouTube, and YouTube is always bugging me with Commercials.

 

uBlock Origin is safe and recommended.

https://chrome.googl...hjbkeiagm?hl=en

 

===

 

VPNs (Virtual Private Networks) or Track Blocking Software that you also like?

 

VPN that are nor recommended. i'm sure they are others.

https://www.bleeping...n-android-apps/

 

Some recommendations. 

https://www.howtogee...-what-is-a-vpn/

 

ExpressVPN

https://www.expressvpn.com/

 

Read the remarks 

https://chrome.googl...naemmogpe?hl=en

===

 

Tunnelbear

https://www.tunnelbear.com/

 

Remarks

https://chrome.googl...okpfjihpa?hl=en

 

---

 

StrongVPN

https://strongvpn.com/

 

Remarsk

https://play.google....strongvpn&hl=en

 

===

 

Hope that helps.

[Krishna]

Thanks.  I always liked this smiley.    

[nasdaq]

Glad we could help.