I updated my drivers via CCleaner and my keyboard on my Surface Pro 3, with attached screen [not detachable], has stopped working . i'm typing this on the onscreen keyboard. everything else seems to be working. Here are my MBAM file and FRST and Addition files, unable to download Security Analysis RGSA, doesn't seem to be available anymore. l'm traveling for business with this laptop so any help you can give me would be greatly appreciated. thank you . Carl
Malwarebytes
www.malwarebytes.com
-Log Details-
Scan Date: 7/15/22
Scan Time: 10:22 AM
Log File: 7fa7a916-0449-11ed-8d62-c8348e022bf6.json
-Software Information-
Version: 4.5.11.202
Components Version: 1.0.1716
Update Package Version: 1.0.57265
License: Premium
-System Information-
OS: Windows 11 (Build 22000.795)
CPU: x64
File System: NTFS
User: DESKTOP-RA8BHB0\cruss
-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 335225
Threats Detected: 0
Threats Quarantined: 0
Time Elapsed: 3 min, 40 sec
-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Detect
PUM: Detect
-Scan Details-
Process: 0
(No malicious items detected)
Module: 0
(No malicious items detected)
Registry Key: 0
(No malicious items detected)
Registry Value: 0
(No malicious items detected)
Registry Data: 0
(No malicious items detected)
Data Stream: 0
(No malicious items detected)
Folder: 0
(No malicious items detected)
File: 0
(No malicious items detected)
Physical Sector: 0
(No malicious items detected)
WMI: 0
(No malicious items detected)
(end)
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 14-07-2022
Ran by cruss (administrator) on DESKTOP-RA8BHB0 (Microsoft Corporation Surface Laptop 3) (15-07-2022 10:37:37)
Running from C:\Users\cruss\Downloads
Loaded Profiles: cruss
Platform: Microsoft Windows 11 Pro Version 21H2 22000.795 (X64) Language: English (United States)
Default browser: FF
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Avast Software s.r.o. -> AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1065.0\AvastBrowserCrashHandler.exe
(Avast Software s.r.o. -> AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1065.0\AvastBrowserCrashHandler64.exe
(Avast Software s.r.o. -> AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe <4>
(C:\Program Files (x86)\ACT\Act for Windows\Act!.exe ->) (The CefSharp Authors) [File not signed] [File is in use] C:\Program Files (x86)\ACT\Act for Windows\CefSharp.BrowserSubprocess.exe <2>
(C:\Program Files (x86)\Kamo\Kamo.exe ->) (Piriform Software Ltd -> The CefSharp Authors) C:\Program Files (x86)\Kamo\CefSharp.BrowserSubprocess.exe <5>
(C:\Program Files\AVAST Software\Avast\AvastSvc.exe ->) (Avast Software s.r.o. -> AVAST Software) C:\Program Files\AVAST Software\Avast\aswEngSrv.exe
(C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe ->) (Malwarebytes Inc. -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(C:\Program Files\Mozilla Firefox\firefox.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\osk.exe
(C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_421.20070.545.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft\EdgeWebView\Application\103.0.1264.49\msedgewebview2.exe <6>
(DriverStore\FileRepository\cui_dch.inf_amd64_23cd4a524b85fcc6\igfxCUIServiceN.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_23cd4a524b85fcc6\igfxEMN.exe
(Dropbox, Inc -> Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe <7>
(dwm.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\ISM.exe
(explorer.exe ->) (Act! LLC -> Act! LLC) C:\Program Files (x86)\ACT\Act for Windows\Act!.exe
(explorer.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
(explorer.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft OneDrive\OneDrive.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleCrashHandler.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleCrashHandler64.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe <15>
(Piriform Software Ltd -> Piriform Software Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(services.exe ->) () [File not signed] C:\ActConnectLink\nssm-x64.exe
(services.exe ->) () [File not signed] C:\Program Files (x86)\ACT\Act.Web.API\bin\act.web.api.hosting.exe
(services.exe ->) (Act! LLC) [File not signed] [File is in use] C:\Program Files (x86)\ACT\Act for Windows\Act.Server.Host.exe
(services.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
(services.exe ->) (Apple Inc. -> Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(services.exe ->) (Avast Software s.r.o. -> AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe
(services.exe ->) (Avast Software s.r.o. -> AVAST Software) C:\Program Files\AVAST Software\Avast\aswidsagent.exe
(services.exe ->) (Avast Software s.r.o. -> AVAST Software) C:\Program Files\AVAST Software\Avast\aswToolsSvc.exe
(services.exe ->) (Avast Software s.r.o. -> AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(services.exe ->) (Avast Software s.r.o. -> AVAST Software) C:\Program Files\AVAST Software\Avast\wsc_proxy.exe
(services.exe ->) (Avast Software s.r.o. -> AVAST Software) C:\Program Files\AVAST Software\Driver Updater\DriverUpdSvc.exe
(services.exe ->) (Avast Software s.r.o. -> AVAST Software) C:\Program Files\AVAST Software\SecureLine VPN\VpnSvc.exe
(services.exe ->) (Cisco WebEx LLC -> Cisco WebEx LLC) C:\Windows\SysWOW64\atashost.exe
(services.exe ->) (Dropbox, Inc -> Dropbox, Inc.) C:\Windows\System32\DbxSvc.exe
(services.exe ->) (Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome Remote Desktop\103.0.5060.46\remoting_host.exe <2>
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_23cd4a524b85fcc6\igfxCUIServiceN.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\dptf_cpu.inf_amd64_c2c5b0e17a28a48f\esif_uf.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_d73f88d32ddb95d3\IntelCpHDCPSvc.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\lms.inf_amd64_fddb643595e0b8d0\LMS.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\mewmiprov.inf_amd64_cad1db73e8c782a6\WMIRegistrationService.exe
(services.exe ->) (Intel® Embedded Subsystems and IP Blocks Group -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\dal.inf_amd64_b5484efd38adbe8d\jhi_service.exe
(services.exe ->) (Malwarebytes Inc. -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL12.ACT7\MSSQL\Binn\sqlservr.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(services.exe ->) (Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.SurfaceAppProxy_5.37.139.0_x64__8wekyb3d8bbwe\Services\SurfaceBroker.exe
(services.exe ->) (Piriform Software Ltd -> ) C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe
(services.exe ->) (Piriform Software Ltd -> Piriform Software Ltd) C:\Program Files (x86)\Kamo\KamoSvc.exe
(services.exe ->) (Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Windows\System32\DriverStore\FileRepository\hdxsstm2.inf_amd64_549ec1e4af1ff178\RtkAudUService64.exe <2>
(services.exe ->) (Safer-Networking Ltd. -> Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(services.exe ->) (Sanford, L.P.) [File not signed] C:\Program Files (x86)\DYMO\DYMO Connect\DYMOConnectPnPService.exe
(services.exe ->) (Smart Sound Technology -> Intel) C:\Windows\System32\cAVS\IAS\IntelAudioService.exe
(services.exe ->) (Zoom Video Communications, Inc. -> Zoom Video Communications, Inc.) C:\Program Files\Common Files\Zoom\Support\CptService.exe
(sihost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe <12>
(svchost.exe ->) (Dropbox, Inc -> Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe <2>
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\wlanext.exe
(svchost.exe ->) (Microsoft Windows) C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_421.20070.545.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe
(svchost.exe ->) (Piriform Software Ltd -> Piriform) C:\Program Files (x86)\Kamo\Kamo.exe
==================== Registry (Whitelisted) ===================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtkAudUService] => C:\WINDOWS\System32\DriverStore\FileRepository\hdxsstm2.inf_amd64_549ec1e4af1ff178\RtkAudUService64.exe [835680 2021-06-25] (Realtek Semiconductor Corp. -> Realtek Semiconductor)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [213760 2022-07-14] (Avast Software s.r.o. -> AVAST Software)
HKLM\...\Run: [TechSmithSnagit] => C:\Program Files\TechSmith\Snagit 2020\Snagit32.exe [9094872 2022-02-25] (TechSmith Corporation -> TechSmith Corporation)
HKLM\...\Run: [DriverUpdUI.exe] => C:\Program Files\Avast Software\Driver Updater\DriverUpdUI.exe [4560720 2022-05-25] (Avast Software s.r.o. -> AVAST Software)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [11186440 2022-07-04] (Dropbox, Inc -> Dropbox, Inc.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard Company -> Hewlett-Packard)
HKLM-x32\...\Run: [HeimdalAgentLoader] => C:\Program Files (x86)\Heimdal\Heimdal.AgentLoader.exe [43224 2022-02-11] (Heimdal Security A/S -> Heimdal Security)
HKLM-x32\...\Run: [Zwift] => C:\Program Files (x86)\Zwift\ZwiftLauncher.exe [18040192 2022-01-05] (Zwift, Inc. -> Zwift, Inc)
HKLM-x32\...\Run: [Act! Preloader] => C:\Program Files (x86)\ACT\Act for Windows\Act!.exe [272504 2021-02-24] (Act! LLC -> Act! LLC)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [6787856 2019-03-19] (Safer-Networking Ltd. -> Safer-Networking Ltd.)
HKLM-x32\...\Run: [DYMOWebApi] => C:\Program Files (x86)\DYMO\DYMO Connect\DYMO.WebApi.Win.Host.exe [181230592 2022-02-24] (Sanford, L.P. -> DYMO.WebApi.Win.Host)
HKLM-x32\...\Run: [DymoOfficeHelper] => C:\Program Files (x86)\DYMO\DYMO Connect\DYMO.OfficeHelper.exe [63488 2022-02-24] () [File not signed]
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Restriction <==== ATTENTION
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-19\...\RunOnce: [OneDrive] => C:\Program Files\Microsoft OneDrive\OneDrive.exe [2632088 2022-07-10] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-20\...\RunOnce: [OneDrive] => C:\Program Files\Microsoft OneDrive\OneDrive.exe [2632088 2022-07-10] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-3941208988-4064051922-1525667148-1001\...\Run: [OneDrive] => C:\Program Files\Microsoft OneDrive\OneDrive.exe [2632088 2022-07-10] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-3941208988-4064051922-1525667148-1001\...\Run: [CCleaner Smart Cleaning] => C:\Program Files\CCleaner\CCleaner64.exe [36976728 2022-06-14] (Piriform Software Ltd -> Piriform Software Ltd)
HKU\S-1-5-21-3941208988-4064051922-1525667148-1001\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [67384 2020-09-08] (Apple Inc. -> Apple Inc.)
HKU\S-1-5-21-3941208988-4064051922-1525667148-1001\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [67896 2020-09-08] (Apple Inc. -> Apple Inc.)
HKU\S-1-5-21-3941208988-4064051922-1525667148-1001\...\Run: [DymoQuickPrint] => C:\Program Files (x86)\DYMO\DYMO Label Software\DymoQuickPrint.exe [1866544 2013-03-05] (Sanford, L.P. -> Sanford, L.P.)
HKU\S-1-5-21-3941208988-4064051922-1525667148-1001\...\Run: [AvastBrowserAutoLaunch_38E8DBE963846923F5008B0D528FC97A] => C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe [2793640 2022-07-05] (Avast Software s.r.o. -> AVAST Software)
HKU\S-1-5-21-3941208988-4064051922-1525667148-1001\...\Run: [HP Officejet Pro 8600 (NET)] => C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett Packard -> Hewlett-Packard Co.)
HKU\S-1-5-21-3941208988-4064051922-1525667148-1001\...\Run: [ZoomInfo Contact Contributor] => C:\Users\cruss\AppData\Local\ZoomInfoCEUtility\launch.bat [108 2021-01-11] () [File not signed]
HKU\S-1-5-21-3941208988-4064051922-1525667148-1001\...\Run: [iCloudPhotos] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe [356664 2020-09-08] (Apple Inc. -> Apple Inc.)
HKU\S-1-5-21-3941208988-4064051922-1525667148-1001\...\Run: [Nextcloud] => C:\Program Files\Nextcloud\nextcloud.exe [3825944 2022-03-18] (Nextcloud GmbH -> Nextcloud GmbH)
HKU\S-1-5-21-3941208988-4064051922-1525667148-1001\...\Run: [] => [X]
HKU\S-1-5-21-3941208988-4064051922-1525667148-1001\...\Run: [DYMOConnectLauncher] => C:\Program Files (x86)\DYMO\DYMO Connect\DYMOConnectLauncher.exe [163968 2022-02-24] (Sanford, L.P. -> )
HKU\S-1-5-21-3941208988-4064051922-1525667148-1001\...\Run: [MicrosoftEdgeAutoLaunch_88CD0AC2E08AC39BA3E5773C80221B99] => "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 [3601824 2022-07-05] (Microsoft Corporation -> Microsoft Corporation)
HKLM\...\Print\Monitors\HP 5912 Status Monitor: C:\WINDOWS\system32\hpinksts5912LM.dll [331664 2012-06-18] (Hewlett Packard -> Hewlett-Packard Co.)
HKLM\...\Print\Monitors\HP Discovery Port Monitor (HP Officejet Pro 8600): C:\WINDOWS\system32\HPDiscoPM5912.dll [741480 2012-10-17] (Hewlett Packard -> Hewlett-Packard Co.)
HKLM\...\Print\Monitors\rica5Xlm: C:\WINDOWS\system32\rica5Xlm.dll [28160 2013-12-26] (Microsoft Windows Hardware Compatibility Publisher -> RICOH CO.,Ltd.)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> "C:\Program Files (x86)\Google\Chrome\Application\85.0.4183.83\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level
HKLM\Software\Microsoft\Active Setup\Installed Components: [{A8504530-742B-42BC-895D-2BAD6406F698}] -> C:\Program Files (x86)\AVAST Software\Browser\Application\103.0.17593.114\Installer\chrmstp.exe [2022-07-13] (Avast Software s.r.o. -> AVAST Software)
HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\103.0.5060.114\Installer\chrmstp.exe [2022-07-05] (Google LLC -> Google LLC)
HKLM\Software\...\Authentication\Credential Providers: [{C885AA15-1764-4293-B82A-0586ADD46B35}] ->
Startup: C:\Users\cruss\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Officejet Pro 8600 (Network).lnk [2021-04-22]
ShortcutAndArgument: Monitor Ink Alerts - HP Officejet Pro 8600 (Network).lnk -> C:\WINDOWS\system32\RunDll32.exe => "C:\Program Files\HP\HP Officejet Pro 8600\bin\HPStatusBL.dll",RunDLLEntry SERIALNUMBER=CN36QDXGHQ05KC;CONNECTION=NW;MONITOR=1;
GroupPolicy: Restriction ? <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
==================== Scheduled Tasks (Whitelisted) ============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {0565D503-41ED-405D-89F6-192A6930C1AA} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [130320 2021-11-12] (Dropbox, Inc -> Dropbox, Inc.)
Task: {07666173-3780-4E7D-8088-420A5C8E4109} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [155432 2019-11-03] (Google Inc -> Google LLC)
Task: {0BAF53F1-AF06-457D-89A4-7BA1D0129EBF} - System32\Tasks\AvastUpdateTaskMachineUA => C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [194200 2021-01-26] (Avast Software s.r.o. -> AVAST Software)
Task: {201FD886-3793-4EA8-972D-547FC18F51CB} - System32\Tasks\G2MUploadTask-S-1-5-21-3941208988-4064051922-1525667148-1001 => C:\Users\cruss\AppData\Local\GoToMeeting\19932\g2mupload.exe [31176 2021-11-11] (LogMeIn, Inc. -> LogMeIn, Inc.)
Task: {2699BFE8-133C-4FA4-A84E-38F20A0783BE} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [155432 2019-11-03] (Google Inc -> Google LLC)
Task: {27BACBBE-3A05-4788-B144-5EFDF97E71AC} - System32\Tasks\Avast Emergency Update => C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe [4938496 2022-07-14] (Avast Software s.r.o. -> AVAST Software)
Task: {28F1AEE0-B9A2-46A2-8245-FC28C103A039} - System32\Tasks\Avast SecureLine VPN Update => C:\Program Files\Avast Software\SecureLine VPN\VpnUpdate.exe [1197392 2022-06-20] (Avast Software s.r.o. -> AVAST Software)
Task: {2A6199A1-F252-4C33-B4A4-5ECA328726AC} - System32\Tasks\Apple Diagnostics => C:\Program Files (x86)\Common Files\Apple\Internet Services\EReporter.exe [67896 2020-09-08] (Apple Inc. -> Apple Inc.)
Task: {2DC16A3E-2F6F-43A4-B8C1-60FE8CD823C3} - System32\Tasks\EOSv3 Scheduler onLogOn => C:\Users\cruss\Downloads\esetonlinescanner.exe LOGON (No File)
Task: {2FF8580B-2B7D-4ADF-874A-52180D78C9A6} - System32\Tasks\Microsoft\Office\Office Automatic Updates 2.0 => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [23378872 2022-07-12] (Microsoft Corporation -> Microsoft Corporation)
Task: {32DC7478-72FF-4E26-8FEF-16BC293099E9} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [6189624 2020-04-26] (Safer-Networking Ltd. -> Safer-Networking Ltd.)
Task: {368FEC66-27BD-41E3-BC1A-26BEBD11F6F7} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [130320 2021-11-12] (Dropbox, Inc -> Dropbox, Inc.)
Task: {39F8018F-7EBF-4A73-88D5-2C2DB0F6F50D} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [23378872 2022-07-12] (Microsoft Corporation -> Microsoft Corporation)
Task: {3AFF63AA-19DA-4282-AFE5-3DFCAB6693FF} - System32\Tasks\CCleanerSkipUAC - cruss => C:\Program Files\CCleaner\CCleaner.exe [31027800 2022-06-14] (Piriform Software Ltd -> Piriform Software Ltd)
Task: {48322853-9738-4EB9-9D00-AF706023EB04} - System32\Tasks\AvastUpdateTaskMachineCore => C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [194200 2021-01-26] (Avast Software s.r.o. -> AVAST Software)
Task: {486F2677-B1E8-4D04-B40B-3169F9542749} - System32\Tasks\Avast Secure Browser Heartbeat Task (Hourly) => C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe [2793640 2022-07-05] (Avast Software s.r.o. -> AVAST Software)
Task: {4E5E608A-24B6-4520-B73A-BF9D17639764} - System32\Tasks\Microsoft\Office\Office Feature Updates Logon => C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [145320 2022-07-12] (Microsoft Corporation -> Microsoft Corporation)
Task: {501E8539-76D9-40B6-94BC-F9D1E67C7144} - System32\Tasks\EOSv3 Scheduler onTime => C:\Users\cruss\Downloads\esetonlinescanner.exe SCHED (No File)
Task: {53D547E5-4143-4E05-A44D-7AD3E230453E} - System32\Tasks\Microsoft\Office\Office Performance Monitor => C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\operfmon.exe [64416 2022-07-11] (Microsoft Corporation -> Microsoft Corporation)
Task: {6DB332C7-887E-4873-B721-0EADE023BFD3} - System32\Tasks\OneDrive Reporting Task-S-1-5-21-3941208988-4064051922-1525667148-1001 => C:\Program Files\Microsoft OneDrive\OneDriveStandaloneUpdater.exe [4214144 2022-07-10] (Microsoft Corporation -> Microsoft Corporation)
Task: {6FB855B8-FFD4-4808-A9F3-E71510B0C20A} - System32\Tasks\G2MUpdateTask-S-1-5-21-3941208988-4064051922-1525667148-1001 => C:\Users\cruss\AppData\Local\GoToMeeting\19932\g2mupdate.exe [31176 2021-11-11] (LogMeIn, Inc. -> LogMeIn, Inc.)
Task: {72A8C9D0-EECE-475B-8B67-C982B4589E3D} - System32\Tasks\Avast Software\Avast Driver Updater BugReport => C:\Program Files\Avast Software\Driver Updater\AvBugReport.exe [4613456 2022-05-25] (Avast Software s.r.o. -> AVAST Software) -> --send "dumps|report" --silent --product 148 --programpath "C:\Program Files\Avast Software\Driver Updater\Setup\.." --configpath "C:\Program Files\Avast Software\Driver Updater\Setup" --path "C:\ProgramData\Avast Software\Driver Updater\log" --path "C:\ProgramData\Avast Software\Icarus\Logs" --guid f49bcb77-354e-4fa1-b521-40b247cda57e
Task: {768B3DD0-DBF6-4C43-8F13-EE3307FDB9B7} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [7177168 2020-04-26] (Safer-Networking Ltd. -> Safer-Networking Ltd.)
Task: {7ACE9DAD-8BF7-4079-8594-9C959A60037E} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [616832 2019-09-04] (Apple Inc. -> Apple Inc.)
Task: {87BD8628-3366-49F5-ABFE-E10276366CA1} - System32\Tasks\Avast Software\Overseer => C:\Program Files\Common Files\AVAST Software\Overseer\overseer.exe [2250576 2022-05-24] (Avast Software s.r.o. -> Avast Software)
Task: {8DE917F7-843D-4D40-8ADC-C98B92F4EA31} - System32\Tasks\Avast Software\Avast SecureLine VPN Update => C:\Program Files\Common Files\Avast Software\Icarus\avast-vpn\icarus.exe [6634776 2022-05-30] (Avast Software s.r.o. -> Avast Software)
Task: {8E9CA863-2CA8-42FE-BB85-4B0F9C273B36} - System32\Tasks\CCleanerSkipUAC - SYSTEM => C:\Program Files\CCleaner\CCleaner.exe [31027800 2022-06-14] (Piriform Software Ltd -> Piriform Software Ltd)
Task: {93142CA3-3C0A-4BDB-8524-421373C6C6C2} - System32\Tasks\SoftwareInformerService => C:\Program Files\Software Informer\softinfo.exe [1689600 2018-01-31] (Informer Technologies, Inc.) [File not signed]
Task: {93E9AC07-AE04-4A30-90D5-81963064F261} - System32\Tasks\HPCustParticipation HP Officejet Pro 8600 => C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPCustPartic.exe [4119656 2012-10-17] (Hewlett Packard -> Hewlett-Packard Co.)
Task: {946652F4-765F-41A9-BE4D-6D5E9B4E4C8E} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1564424 2021-11-18] (Adobe Inc. -> Adobe Inc.)
Task: {A0ACD289-6C75-4D8F-BBB1-167DE9645166} - System32\Tasks\Heimdal Security Service Monitor => C:\WINDOWS\SysWOW64\Heimdal Security\Heimdal Jobs\Heimdal.MonitorServices.exe [42200 2022-02-11] (Heimdal Security A/S -> Heimdal Security)
Task: {A614C253-0A36-4DFC-B80A-5DA18FE27BA8} - System32\Tasks\Avast Secure Browser Heartbeat Task (Logon) => C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe [2793640 2022-07-05] (Avast Software s.r.o. -> AVAST Software)
Task: {A86320A3-5859-4FB7-A252-BA2D6555184D} - System32\Tasks\Kamo\KamoStart => C:\Program Files (x86)\Kamo\Kamo.exe [900352 2022-06-28] (Piriform Software Ltd -> Piriform)
Task: {ADDD1D7B-3CF6-4901-90CE-70159106305D} - System32\Tasks\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\default-browser-agent.exe do-task "308046B0AF4A39CB"
Task: {B380C96F-9963-48CA-BDFA-96D0086D0791} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [5723640 2019-09-04] (Safer-Networking Ltd. -> Safer-Networking Ltd.)
Task: {B9070784-2B80-4E30-84D2-70668FB5F701} - System32\Tasks\Mozilla\Firefox Background Update 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\firefox.exe --MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask backgroundupdate
Task: {BCAEC4FE-76EC-4F3B-AA26-5DCBBC44B718} - System32\Tasks\Avast Software\Avast Driver Updater Update => C:\Program Files\Common Files\Avast Software\Icarus\avast-du\icarus.exe [6667600 2022-05-19] (Avast Software s.r.o. -> Avast Software)
Task: {C444747D-7C2B-436E-BB18-3D41B42E3CA1} - System32\Tasks\Avast Software\Avast SecureLine VPN Bug Report => C:\Program Files\Avast Software\SecureLine VPN\AvBugReport.exe [4615504 2022-06-20] (Avast Software s.r.o. -> AVAST Software) -> --send "dumps|report" --silent --product 11 --programpath "C:\Program Files\Avast Software\SecureLine VPN" --configpath "C:\ProgramData\Avast Software\SecureLine VPN" --path "C:\ProgramData\Avast Software\SecureLine VPN\log" --path "C:\ProgramData\Avast Software\Icarus\Logs" --logpath "C:\ProgramData\Avast Software\SecureLine VPN\log" --guid 8555d14e-76f8-43de-ac00-c5de57528bcf
Task: {C77D7B51-5BD7-4FB4-BD10-7AEA6E48F316} - System32\Tasks\Microsoft\Office\Office Feature Updates => C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [145320 2022-07-12] (Microsoft Corporation -> Microsoft Corporation)
Task: {CCDFC0B8-01A3-4E74-A820-4F13F51D269E} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => C:\WINDOWS\System32\MbaeParserTask.exe (No File)
Task: {CEE01250-8B26-4684-9314-0078E8E1B49B} - System32\Tasks\OneDrive Per-Machine Standalone Update Task => C:\Program Files\Microsoft OneDrive\OneDriveStandaloneUpdater.exe [4214144 2022-07-10] (Microsoft Corporation -> Microsoft Corporation)
Task: {D7D85984-7C81-499E-81EA-DEFB806FB085} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [619416 2022-06-21] (Piriform Software Ltd -> Piriform Software Ltd)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\G2MUpdateTask-S-1-5-21-3941208988-4064051922-1525667148-1001.job => C:\Users\cruss\AppData\Local\GoToMeeting\19932\g2mupdate.exe
Task: C:\WINDOWS\Tasks\G2MUploadTask-S-1-5-21-3941208988-4064051922-1525667148-1001.job => C:\Users\cruss\AppData\Local\GoToMeeting\19932\g2mupload.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 8.8.8.8
Tcpip\..\Interfaces\{0594af8b-abec-469b-9745-ab935433be86}: [DhcpNameServer] 172.16.235.200 172.17.132.200 172.16.255.200
Tcpip\..\Interfaces\{1939fd7b-6712-4265-a4c3-e6b48f2ce4ff}: [DhcpNameServer] 192.168.1.1 8.8.8.8
Tcpip\..\Interfaces\{e5e98d18-3337-4e3d-b67d-43a7156029e8}: [DhcpNameServer] 192.168.1.1 8.8.8.8
Edge:
=======
DownloadDir: C:\Users\cruss\Downloads
Edge Extension: (No Name) -> AutoFormFill_5ED10D46BD7E47DEB1F3685D2C0FCE08 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\AutoFormFill [not found]
Edge Extension: (No Name) -> BookReader_B171F20233094AC88D05A8EF7B9763E8 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\BookViewer [not found]
Edge Extension: (No Name) -> LearningTools_7706F933-971C-41D1-9899-8A026EB5D824 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\LearningTools [not found]
Edge Extension: (No Name) -> PinJSAPI_EC01B57063BE468FAB6DB7EBFC3BF368 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\PinJSAPI [not found]
Edge DefaultProfile: Default
Edge Profile: C:\Users\cruss\AppData\Local\Microsoft\Edge\User Data\Default [2022-07-15]
Edge HomePage: Default -> hxxps://www.bing.com/?pc=U528
Edge StartupUrls: Default -> "hxxps://www.bing.com/?pc=U528"
Edge Extension: (Dashlane - Password Manager) - C:\Users\cruss\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\gehmmocbbkpblljhkekmfhjpfbkclbph [2022-07-12]
Edge Extension: (Malwarebytes Browser Guard) - C:\Users\cruss\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ihcjicgdanjaechkgeegckofjjedodee [2022-06-28]
Edge Extension: (Capital One Shopping: Add to Edge for Free) - C:\Users\cruss\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\kiiaghlmeikbpmeabhilfphikfcefljn [2022-07-15]
Edge HKLM-x32\...\Edge\Extension: [ihcjicgdanjaechkgeegckofjjedodee]
FireFox:
========
FF DefaultProfile: g5xy1w6g.default
FF ProfilePath: C:\Users\cruss\AppData\Roaming\Mozilla\Firefox\Profiles\g5xy1w6g.default [2022-06-21]
FF user.js: detected! => C:\Users\cruss\AppData\Roaming\Mozilla\Firefox\Profiles\g5xy1w6g.default\user.js [2022-06-21]
FF ProfilePath: C:\Users\cruss\AppData\Roaming\Mozilla\Firefox\Profiles\me5mm2m4.default-release-1581612878046 [2022-07-15]
FF user.js: detected! => C:\Users\cruss\AppData\Roaming\Mozilla\Firefox\Profiles\me5mm2m4.default-release-1581612878046\user.js [2022-06-21]
FF Homepage: Mozilla\Firefox\Profiles\me5mm2m4.default-release-1581612878046 -> hxxps://www.bing.com/?pc=U528
FF Notifications: Mozilla\Firefox\Profiles\me5mm2m4.default-release-1581612878046 -> hxxps://zwiftinsider.com; hxxps://www.youtube.com; hxxps://www.overstock.com; hxxps://www.statista.com
FF HomepageOverride: Mozilla\Firefox\Profiles\me5mm2m4.default-release-1581612878046 -> Enabled: {3e06d96e-26f5-4a68-ac64-2b6bc583a35d}
FF Extension: (Cisco Webex Extension) - C:\Users\cruss\AppData\Roaming\Mozilla\Firefox\Profiles\me5mm2m4.default-release-1581612878046\Extensions\ciscowebexstart1@cisco.com.xpi [2022-07-05]
FF Extension: (iCloud Bookmarks) - C:\Users\cruss\AppData\Roaming\Mozilla\Firefox\Profiles\me5mm2m4.default-release-1581612878046\Extensions\firefoxdav@icloud.com.xpi [2020-02-13]
FF Extension: (Dashlane) - C:\Users\cruss\AppData\Roaming\Mozilla\Firefox\Profiles\me5mm2m4.default-release-1581612878046\Extensions\jetpack-extension@dashlane.com.xpi [2022-07-12] [UpdateUrl:hxxps://ws1.dashlane.com/5/binaries/query?logins=&platform=firefox&target=ff_web_extension&format=json&version=]
FF Extension: (Avast SafePrice | Comparison, deals, coupons) - C:\Users\cruss\AppData\Roaming\Mozilla\Firefox\Profiles\me5mm2m4.default-release-1581612878046\Extensions\sp@avast.com.xpi [2022-06-27]
FF Extension: (Avast Online Security & Privacy) - C:\Users\cruss\AppData\Roaming\Mozilla\Firefox\Profiles\me5mm2m4.default-release-1581612878046\Extensions\wrc@avast.com.xpi [2022-06-07]
FF Extension: (Malwarebytes Browser Guard) - C:\Users\cruss\AppData\Roaming\Mozilla\Firefox\Profiles\me5mm2m4.default-release-1581612878046\Extensions\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi [2022-06-28]
FF Extension: (Microsoft Bing Homepage and Search Engine) - C:\Users\cruss\AppData\Roaming\Mozilla\Firefox\Profiles\me5mm2m4.default-release-1581612878046\Extensions\{3e06d96e-26f5-4a68-ac64-2b6bc583a35d}.xpi [2022-03-09] [UpdateUrl:hxxps://browserdefaults.microsoft.com/FirefoxExtn/updateextension.json]
FF Extension: (Capital One Shopping: Online Coupon Tool) - C:\Users\cruss\AppData\Roaming\Mozilla\Firefox\Profiles\me5mm2m4.default-release-1581612878046\Extensions\{aff8af88-06a9-4eee-b383-3af08c47b8c8}.xpi [2022-07-10]
FF Extension: (Zoom Scheduler) - C:\Users\cruss\AppData\Roaming\Mozilla\Firefox\Profiles\me5mm2m4.default-release-1581612878046\Extensions\{bf855ead-d7c3-4c7b-9f88-9a7e75c0efdf}.xpi [2022-06-06]
FF Extension: (Adblock Plus - free ad blocker) - C:\Users\cruss\AppData\Roaming\Mozilla\Firefox\Profiles\me5mm2m4.default-release-1581612878046\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2022-07-05]
FF Extension: (Safe Search powered by Yahoo) - C:\Users\cruss\AppData\Roaming\Mozilla\Firefox\Profiles\me5mm2m4.default-release-1581612878046\Extensions\{fd299ce1-1602-4490-b659-f45504f9324c}.xpi [2021-08-03] [UpdateUrl:hxxps://addons.safetybrowsing.com/gyff/updates.json]
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL [2022-07-11] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin: Adobe Acrobat -> C:\Program Files\Adobe\Acrobat DC\Acrobat\Air\nppdf32.dll [2022-07-05] (Adobe Inc. -> Adobe Systems Inc.)
FF Plugin-x32: @dymo.com/DymoLabelFramework -> C:\Program Files (x86)\DYMO\DYMO Label Software\Framework\npDYMOLabelFramework.dll [2013-03-05] (Sanford, L.P. -> Sanford L.P.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\NPSPWRAP.DLL [2022-07-11] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @update.avastbrowser.com/Avast Browser;version=3 -> C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1065.0\npAvastBrowserUpdate3.dll [2021-01-26] (Avast Software s.r.o. -> AVAST Software)
FF Plugin-x32: @update.avastbrowser.com/Avast Browser;version=9 -> C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1065.0\npAvastBrowserUpdate3.dll [2021-01-26] (Avast Software s.r.o. -> AVAST Software)
FF Plugin ProgramFiles/Appdata: C:\Users\cruss\AppData\Roaming\mozilla\plugins\npatgpc.dll [2020-04-01]
Chrome:
=======
CHR DefaultProfile: Default
CHR Profile: C:\Users\cruss\AppData\Local\Google\Chrome\User Data\Default [2022-07-14]
CHR HomePage: Default -> hxxps://www.bing.com/
CHR StartupUrls: Default -> "hxxps://www.google.com/"
CHR Extension: (Bitmoji) - C:\Users\cruss\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfgdeiadkckfbkeigkoncpdieiiefpig [2022-01-21]
CHR Extension: (Adblock Plus - free ad blocker) - C:\Users\cruss\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2022-07-05]
CHR Extension: (Adobe Acrobat: PDF edit, convert, sign tools) - C:\Users\cruss\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2022-06-14]
CHR Extension: (Avast SafePrice | Comparison, deals, coupons) - C:\Users\cruss\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2022-06-27]
CHR Extension: (Dashlane - Password Manager) - C:\Users\cruss\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdjamakpfbbddfjaooikfcpapjohcfmg [2022-06-27]
CHR Extension: (Chrome Remote Desktop) - C:\Users\cruss\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbchcmhmhahfdphkhkmpfmihenigjmpp [2019-11-03]
CHR Extension: (Google Docs Offline) - C:\Users\cruss\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2022-06-27]
CHR Extension: (Malwarebytes Browser Guard) - C:\Users\cruss\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihcjicgdanjaechkgeegckofjjedodee [2022-06-29]
CHR Extension: (Chrome Remote Desktop) - C:\Users\cruss\AppData\Local\Google\Chrome\User Data\Default\Extensions\inomeogfingihgjfjlpeplalcfajhgai [2019-11-03]
CHR Extension: (Disconnect) - C:\Users\cruss\AppData\Local\Google\Chrome\User Data\Default\Extensions\jeoacafpbcihiomhlakheieifhpjdfeo [2020-10-08]
CHR Extension: (Cisco Webex Extension) - C:\Users\cruss\AppData\Local\Google\Chrome\User Data\Default\Extensions\jlhmfgmfgeifomenelglieieghnjghma [2021-12-17]
CHR Extension: (Chrome Web Store Payments) - C:\Users\cruss\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2021-01-29]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck]
CHR HKLM-x32\...\Chrome\Extension: [ihcjicgdanjaechkgeegckofjjedodee]
==================== Services (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
U2 ActConnectLink; C:\ActConnectLink\nssm-x64.exe [331264 2014-08-31] () [File not signed]
R2 ActService; C:\Program Files (x86)\ACT\Act for Windows\Act.Server.Host.exe [26624 2021-02-24] (Act! LLC) [File not signed] [File is in use]
R2 ActSmartTaskService; C:\Program Files (x86)\ACT\Act for Windows\Act.Server.Host.exe [26624 2021-02-24] (Act! LLC) [File not signed] [File is in use]
R2 ActWebApiService; C:\Program Files (x86)\ACT\Act.Web.API\bin\act.web.api.hosting.exe [22528 2021-05-17] () [File not signed]
S4 ActWebHookMessengerService; C:\Program Files (x86)\ACT\act.webhook.notifications\bin\act.webhook.notifications.exe [93696 2021-05-17] () [File not signed]
R2 AdobeARMservice; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [169728 2021-11-18] (Adobe Inc. -> Adobe Inc.)
R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\aswidsagent.exe [8486968 2022-07-14] (Avast Software s.r.o. -> AVAST Software)
S2 avast; C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [194200 2021-01-26] (Avast Software s.r.o. -> AVAST Software)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [590080 2022-07-14] (Avast Software s.r.o. -> AVAST Software)
R2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [2009344 2022-07-14] (Avast Software s.r.o. -> AVAST Software)
R2 avast! Tools; C:\Program Files\AVAST Software\Avast\aswToolsSvc.exe [589056 2022-07-14] (Avast Software s.r.o. -> AVAST Software)
S3 avastm; C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [194200 2021-01-26] (Avast Software s.r.o. -> AVAST Software)
S3 AvastSecureBrowserElevationService; C:\Program Files (x86)\AVAST Software\Browser\Application\103.0.17593.114\elevation_service.exe [1991960 2022-07-05] (Avast Software s.r.o. -> AVAST Software)
R2 AvastWscReporter; C:\Program Files\AVAST Software\Avast\wsc_proxy.exe [56912 2021-06-02] (Avast Software s.r.o. -> AVAST Software)
R2 CCleanerPerformanceOptimizerService; C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe [1081432 2022-06-14] (Piriform Software Ltd -> )
R2 chromoting; C:\Program Files (x86)\Google\Chrome Remote Desktop\103.0.5060.46\remoting_host.exe [73104 2022-06-09] (Google LLC -> Google LLC)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [12111288 2022-07-12] (Microsoft Corporation -> Microsoft Corporation)
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [130320 2021-11-12] (Dropbox, Inc -> Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [130320 2021-11-12] (Dropbox, Inc -> Dropbox, Inc.)
R2 DbxSvc; C:\WINDOWS\system32\DbxSvc.exe [46872 2022-07-04] (Dropbox, Inc -> Dropbox, Inc.)
S4 DFWSIDService; C:\Program Files (x86)\Wondershare\drfone\WsidService.exe [1051136 2021-10-13] (wondershare) [File not signed]
R2 DriverUpdSvc; C:\Program Files\Avast Software\Driver Updater\DriverUpdSvc.exe [7680336 2022-05-25] (Avast Software s.r.o. -> AVAST Software)
R2 DYMOConnectPnPService; C:\Program Files (x86)\DYMO\DYMO Connect\DYMOConnectPnPService.exe [26112 2022-02-24] (Sanford, L.P.) [File not signed]
S4 DymoPnpService; C:\Program Files (x86)\DYMO\DYMO Label Software\DymoPnpService.exe [33072 2013-03-05] (Sanford, L.P. -> Sanford, L.P.)
S4 ElevationService; C:\Program Files (x86)\Wondershare\drfone\Addins\Repair\ElevationService.exe [907776 2021-09-23] () [File not signed]
S3 FileSyncHelper; C:\Program Files\Microsoft OneDrive\22.131.0619.0001\FileSyncHelper.exe [3381632 2022-07-10] (Microsoft Corporation -> Microsoft Corporation)
S4 GoToAssist Remote Support Customer; C:\Program Files (x86)\GoToAssist Remote Support Customer\1702\g2ax_service.exe [614856 2022-02-09] (LogMeIn, Inc. -> LogMeIn, Inc.)
S4 Heimdal Admin Privilege; C:\Program Files (x86)\Heimdal\Heimdal.AdminPrivilege.exe [162008 2022-02-11] (Heimdal Security A/S -> Heimdal Security)
S4 Heimdal Antivirus; C:\Program Files (x86)\Heimdal\Heimdal.Antivirus.exe [345304 2022-02-11] (Heimdal Security A/S -> Heimdal Security)
S4 Heimdal Client Host; C:\Program Files (x86)\Heimdal\Heimdal.ClientHost.exe [132824 2022-02-11] (Heimdal Security A/S -> Heimdal Security)
S4 Heimdal DarkLayer Guard; C:\Program Files (x86)\Heimdal\Heimdal.DarkLayerGuard.exe [221912 2022-02-11] (Heimdal Security A/S -> Heimdal Security)
S4 Heimdal Firewall; C:\Program Files (x86)\Heimdal\Heimdal.Firewall.exe [75480 2022-02-11] (Heimdal Security A/S -> Heimdal Security)
S4 Heimdal Insights; C:\Program Files (x86)\Heimdal\Heimdal.Insights.exe [74968 2022-02-11] (Heimdal Security A/S -> Heimdal Security)
S4 Heimdal MailSentry; C:\Program Files (x86)\Heimdal\Heimdal.MailSentry.exe [85720 2022-02-11] (Heimdal Security A/S -> Heimdal Security)
S4 Heimdal Monitor; C:\Program Files (x86)\Heimdal\Heimdal.Monitor.exe [53976 2022-02-11] (Heimdal Security A/S -> Heimdal Security)
S4 Heimdal ProcessLock; C:\Program Files (x86)\Heimdal\Heimdal.ProcessLock.exe [112856 2022-02-11] (Heimdal Security A/S -> Heimdal Security)
S4 Heimdal RemoteDesktop; C:\Program Files (x86)\Heimdal\Heimdal.RemoteDesktop.exe [59608 2022-02-11] (Heimdal Security A/S -> Heimdal Security)
S4 Heimdal Update Service; C:\Program Files (x86)\Heimdal\Heimdal.UpdateService.exe [59464 2020-06-25] (Heimdal Security A/S -> Heimdal Security)
S4 Heimdal Uptime Checker; C:\Program Files (x86)\Heimdal\Heimdal.UptimeChecker.exe [63192 2022-02-11] (Heimdal Security A/S -> Heimdal Security)
R2 KamoSvc; C:\Program Files (x86)\Kamo\KamoSvc.exe [1974528 2022-06-28] (Piriform Software Ltd -> Piriform Software Ltd)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [8683336 2022-07-15] (Malwarebytes Inc. -> Malwarebytes)
R2 MSSQL$ACT7; C:\Program Files\Microsoft SQL Server\MSSQL12.ACT7\MSSQL\Binn\sqlservr.exe [370368 2015-06-10] (Microsoft Corporation -> Microsoft Corporation)
S3 OneDrive Updater Service; C:\Program Files\Microsoft OneDrive\22.131.0619.0001\OneDriveUpdaterService.exe [3822496 2022-07-10] (Microsoft Corporation -> Microsoft Corporation)
S4 rkrtservice; C:\Program Files\RogueKiller\RogueKillerSvc.exe [13921616 2021-07-01] (Adlice -> )
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [940976 2019-09-04] (Safer-Networking Ltd. -> Safer-Networking Ltd.)
R2 SecureLine; C:\Program Files\Avast Software\SecureLine VPN\VpnSvc.exe [9762128 2022-06-20] (Avast Software s.r.o. -> AVAST Software)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [6207688 2022-06-28] (Microsoft Windows Publisher -> Microsoft Corporation)
S4 SQLAgent$ACT7; C:\Program Files\Microsoft SQL Server\MSSQL12.ACT7\MSSQL\Binn\SQLAGENT.EXE [613056 2015-06-10] (Microsoft Corporation -> Microsoft Corporation)
R2 SurfaceExperienceService-5.37; C:\Program Files\WindowsApps\Microsoft.SurfaceAppProxy_5.37.139.0_x64__8wekyb3d8bbwe\Services\SurfaceBroker.exe [8726944 2022-07-14] (Microsoft Corporation -> Microsoft)
S4 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [14585248 2022-06-23] (TeamViewer Germany GmbH -> TeamViewer Germany GmbH)
S3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2110.6-0\NisSrv.exe [2872024 2021-11-19] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2110.6-0\MsMpEng.exe [128376 2021-11-19] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 WMIRegistrationService; C:\WINDOWS\System32\DriverStore\FileRepository\mewmiprov.inf_amd64_cad1db73e8c782a6\WMIRegistrationService.exe [538736 2021-07-25] (Intel Corporation -> Intel Corporation)
S4 Wondershare InstallAssist; C:\ProgramData\Wondershare\Service\InstallAssistService.exe [262880 2021-10-14] (Wondershare Technology Co.,Ltd -> Wondershare)
S4 WsDrvInst; C:\Program Files (x86)\Wondershare\drfone\Addins\Repair\DriverInstall.exe [124424 2021-09-23] (Wondershare Technology Co.,Ltd -> Wondershare)
R2 ZoomCptService; "C:\Program Files\Common Files\Zoom\Support\CptService.exe" -user_path "C:\Users\Default\AppData\Roaming\Zoom"
===================== Drivers (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 AppleKmdfFilter; C:\WINDOWS\System32\drivers\AppleKmdfFilter.sys [20032 2020-10-09] (WDKTestCert build,132303256403278908 -> Apple Inc.)
S3 AppleLowerFilter; C:\WINDOWS\System32\drivers\AppleLowerFilter.sys [35976 2020-10-09] (WDKTestCert build,132303256403278908 -> Apple Inc.)
R1 aswArPot; C:\WINDOWS\System32\drivers\aswArPot.sys [235584 2022-07-14] (Avast Software s.r.o. -> AVAST Software)
R1 aswbidsdriver; C:\WINDOWS\System32\drivers\aswbidsdriver.sys [385560 2022-07-14] (Avast Software s.r.o. -> AVAST Software)
R0 aswbidsh; C:\WINDOWS\System32\drivers\aswbidsh.sys [258072 2022-07-14] (Avast Software s.r.o. -> AVAST Software)
R0 aswbuniv; C:\WINDOWS\System32\drivers\aswbuniv.sys [104976 2022-07-14] (Avast Software s.r.o. -> AVAST Software)
R0 aswElam; C:\WINDOWS\System32\drivers\aswElam.sys [25048 2022-06-27] (Microsoft Windows Early Launch Anti-malware Publisher -> AVAST Software)
R1 aswKbd; C:\WINDOWS\System32\drivers\aswKbd.sys [47976 2022-07-14] (Avast Software s.r.o. -> AVAST Software)
R1 aswMonFlt; C:\WINDOWS\System32\drivers\aswMonFlt.sys [274536 2022-07-14] (Avast Software s.r.o. -> AVAST Software)
R1 aswNetHub; C:\WINDOWS\System32\drivers\aswNetHub.sys [553928 2022-07-14] (Avast Software s.r.o. -> AVAST Software)
R1 aswRdr; C:\WINDOWS\System32\drivers\aswRdr2.sys [113984 2022-07-14] (Avast Software s.r.o. -> AVAST Software)
R0 aswRvrt; C:\WINDOWS\System32\drivers\aswRvrt.sys [89056 2022-07-14] (Avast Software s.r.o. -> AVAST Software)
R1 aswSnx; C:\WINDOWS\System32\drivers\aswSnx.sys [860416 2022-07-14] (Avast Software s.r.o. -> AVAST Software)
R1 aswSP; C:\WINDOWS\System32\drivers\aswSP.sys [668208 2022-07-14] (Avast Software s.r.o. -> AVAST Software)
R2 aswStm; C:\WINDOWS\System32\drivers\aswStm.sys [221528 2022-07-14] (Avast Software s.r.o. -> AVAST Software)
R0 aswVmm; C:\WINDOWS\System32\drivers\aswVmm.sys [324864 2022-07-14] (Avast Software s.r.o. -> AVAST Software)
S3 aswVpnRdr; C:\WINDOWS\System32\drivers\aswVpnRdr.sys [65944 2022-06-20] (Avast Software s.r.o. -> Avast Software)
R3 aswWintun; C:\WINDOWS\System32\drivers\aswWintun.sys [37104 2022-06-20] (Avast Software s.r.o. -> WireGuard LLC)
R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [158640 2022-07-05] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
S3 iaLPSS2_GPIO2_ICL; C:\WINDOWS\System32\DriverStore\FileRepository\ialpss2_gpio2_icl.inf_amd64_90beccc7e046abab\iaLPSS2_GPIO2_ICL.sys [132872 2021-05-25] (Intel Corporation -> Intel Corporation)
S3 iaLPSS2_I2C_ICL; C:\WINDOWS\System32\DriverStore\FileRepository\ialpss2_i2c_icl.inf_amd64_c8c0638291b9b209\iaLPSS2_I2C_ICL.sys [200456 2021-05-25] (Intel Corporation -> Intel Corporation)
S3 iaLPSS2_UART2_ICL; C:\WINDOWS\System32\DriverStore\FileRepository\ialpss2_uart2_icl.inf_amd64_b535659b9405201a\iaLPSS2_UART2_ICL.sys [312600 2021-05-25] (Intel Corporation -> Intel Corporation)
R3 IntcAudioBus; C:\WINDOWS\System32\DriverStore\FileRepository\intcaudiobus.inf_amd64_2b27d88d994fb23c\IntcAudioBus.sys [300864 2021-01-27] ((PREPRODUCTION USE ONLY) Smart Sound Technology -> Intel® Corporation)
R3 IntcOED; C:\WINDOWS\System32\DriverStore\FileRepository\intcoed.inf_amd64_687314a06853d3c2\IntcOED.sys [1278272 2021-01-27] ((PREPRODUCTION USE ONLY) Smart Sound Technology -> Intel® Corporation)
S3 libusb0; C:\WINDOWS\system32\DRIVERS\libusb0.sys [52832 2019-06-18] (Travis Lee Robinson -> hxxp://libusb-win32.sourceforge.net)
R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [223176 2022-07-15] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
S0 MbamElam; C:\WINDOWS\System32\DRIVERS\MbamElam.sys [21480 2022-07-05] (Microsoft Windows Early Launch Anti-malware Publisher -> Malwarebytes)
R3 MBAMFarflt; C:\WINDOWS\System32\DRIVERS\farflt.sys [192960 2022-07-15] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R3 MBAMProtection; C:\WINDOWS\system32\DRIVERS\mbam.sys [74704 2022-07-15] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [239544 2022-07-05] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R3 MBAMWebProtection; C:\WINDOWS\system32\DRIVERS\mwac.sys [181992 2022-07-15] (Malwarebytes Inc. -> Malwarebytes)
R1 netfilter2; C:\WINDOWS\System32\drivers\netfilter2.sys [116296 2022-06-20] (Piriform Software Ltd -> Windows ® Win 7 DDK provider)
S4 RsFx0300; C:\WINDOWS\System32\DRIVERS\RsFx0300.sys [247488 2014-02-21] (Microsoft Corporation -> Microsoft Corporation)
S3 rtump63x64; C:\WINDOWS\System32\drivers\rtump63x64.sys [971360 2021-12-21] (Realtek Semiconductor Corp. -> Realtek Corporation)
R3 rtump64x64; C:\WINDOWS\System32\drivers\rtump64x64.sys [1073608 2022-05-13] (Realtek Semiconductor Corp. -> Realtek Corporation)
S0 Spybot3ELAM; C:\WINDOWS\System32\drivers\Spybot3ELAM.sys [19904 2019-06-21] (Microsoft Windows Early Launch Anti-malware Publisher -> Windows ® Win 7 DDK provider)
S3 SurfaceBattery; C:\WINDOWS\System32\DriverStore\FileRepository\surfacebattery.inf_amd64_1028dadb684c3ca6\SurfaceBattery.sys [334856 2020-11-20] (Microsoft Corporation -> Microsoft Corporation)
S3 SurfaceHotPlug; C:\WINDOWS\System32\DriverStore\FileRepository\surfacehotplug.inf_amd64_969ca64342a7b9bf\SurfaceHotPlug.sys [426840 2021-06-24] (Microsoft Corporation -> Microsoft Corporation)
R3 SurfaceLightSensor; C:\WINDOWS\System32\DriverStore\FileRepository\surfacelightsensor.inf_amd64_2e1054954bf6a237\SurfaceLightSensor.sys [244216 2020-10-06] (Microsoft Corporation -> Microsoft Corporation)
S3 SurfacePowerTrackerCore; C:\WINDOWS\System32\DriverStore\FileRepository\surfacepowertrackercore.inf_amd64_617dc1f6160f71ab\SurfacePowerTrackerCore.sys [405872 2021-07-01] (Microsoft Corporation -> Microsoft Corporation)
S3 SurfaceSerialHubDriver; C:\WINDOWS\System32\DriverStore\FileRepository\surfaceserialhubdriver.inf_amd64_0fbecbb6d745fcec\SurfaceSerialHubDriver.sys [395640 2021-06-24] (Microsoft Corporation -> Microsoft Corporation)
R3 SurfaceTconDriver; C:\WINDOWS\System32\DriverStore\FileRepository\surfacetcondriver.inf_amd64_ffe66823cceccded\SurfaceTconDriver.sys [308600 2021-05-25] (Microsoft Corporation -> Microsoft Corporation)
R3 SurfaceVirtualFunctionEnum; C:\WINDOWS\System32\DriverStore\FileRepository\surfacevirtualfunctionenum.inf_amd64_2fa2ee1a8b7bba84\SurfaceVirtualFunctionEnum.sys [199536 2021-06-20] (Microsoft Corporation -> Microsoft Corporation)
S3 tap0901; C:\WINDOWS\System32\drivers\tap0901.sys [39920 2021-05-26] (Microsoft Windows Hardware Compatibility Publisher -> The OpenVPN Project)
S3 WdBoot; C:\WINDOWS\system32\drivers\wd\WdBoot.sys [48520 2021-11-19] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\wd\WdFilter.sys [435424 2021-11-19] (Microsoft Windows -> Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [86240 2021-11-19] (Microsoft Windows -> Microsoft Corporation)
S1 WinSetupMon; system32\DRIVERS\WinSetupMon.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One month (created) (Whitelisted) =========
(If an entry is included in the fixlist, the file/folder will be moved.)
2022-07-15 10:36 - 2022-07-15 10:36 - 002369536 _____ (Farbar) C:\Users\cruss\Downloads\FRST64(1).exe
2022-07-15 10:27 - 2022-07-15 10:27 - 001802704 _____ (Bleeping Computer, LLC) C:\Users\cruss\Downloads\rkill.exe
2022-07-15 10:19 - 2022-07-15 10:19 - 000074704 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2022-07-15 10:19 - 2022-07-15 10:19 - 000002031 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2022-07-15 10:18 - 2022-07-15 10:18 - 002556344 _____ (Malwarebytes) C:\Users\cruss\Downloads\MBSetup-37335.37335.exe
2022-07-15 10:05 - 2022-07-15 10:05 - 051296144 _____ C:\Users\cruss\Downloads\IMG_7020.MOV
2022-07-14 18:16 - 2022-07-15 10:19 - 000192960 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
2022-07-14 18:15 - 2022-07-15 10:19 - 000181992 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2022-07-14 18:13 - 2022-07-14 18:13 - 000000000 ____D C:\Users\cruss\Downloads\Surface Pro 3 AssetTag
2022-07-14 18:12 - 2022-07-14 18:12 - 000002729 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Surface Pro 3 TPM Update Tool.lnk
2022-07-14 18:12 - 2022-07-14 18:12 - 000000000 ____D C:\Program Files\Microsoft Surface Pro 3 TPM Update Tool
2022-07-14 18:10 - 2022-07-14 18:10 - 007911935 _____ C:\Users\cruss\Downloads\Surface Pro 3 KB2978002.zip
2022-07-14 18:10 - 2022-07-14 18:10 - 001998848 _____ C:\Users\cruss\Downloads\Microsoft_Surface_Pro_3_Tpm_Update_Tool_Setup.msi
2022-07-14 18:10 - 2022-07-14 18:10 - 000491520 _____ C:\Users\cruss\Downloads\Surface Firmware Tool.msi
2022-07-14 18:10 - 2022-07-14 18:10 - 000061094 _____ C:\Users\cruss\Downloads\Surface Pro 3 AssetTag.zip
2022-07-14 18:07 - 2022-07-14 18:11 - 689688576 _____ C:\Users\cruss\Downloads\SurfacePro7_Win11_22000_22.032.19761.0.msi
2022-07-14 18:04 - 2022-07-14 18:04 - 000000000 ____D C:\ProgramData\SurfaceExperienceService
2022-07-14 11:12 - 2022-07-14 11:12 - 000270592 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2022-07-14 11:12 - 2022-07-14 11:12 - 000221528 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswStm.sys
2022-07-12 17:35 - 2022-07-15 10:19 - 000223176 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamChameleon.sys
2022-07-12 17:25 - 2022-07-12 17:25 - 000530944 _____ (curl, hxxps://curl.se/) C:\WINDOWS\system32\curl.exe
2022-07-12 17:25 - 2022-07-12 17:25 - 000470528 _____ (curl, hxxps://curl.se/) C:\WINDOWS\SysWOW64\curl.exe
2022-07-12 17:25 - 2022-07-12 17:25 - 000015040 _____ C:\WINDOWS\system32\DrtmAuthTxt.wim
2022-07-12 17:23 - 2022-07-12 17:23 - 000000000 ___HD C:\$WinREAgent
2022-07-11 13:37 - 2022-07-11 13:37 - 001214328 _____ C:\Users\cruss\Downloads\110_Webb_Street_Flyer_For_Lease.pdf
2022-07-11 13:27 - 2022-07-11 13:27 - 009741490 _____ C:\Users\cruss\Downloads\104_Spreadsheets_2018-12-27-1.zip
2022-07-10 13:27 - 2022-07-12 17:35 - 000000000 ____D C:\Program Files\Mozilla Firefox
2022-07-07 10:17 - 2022-07-07 10:17 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
2022-07-07 10:16 - 2022-07-07 10:16 - 000000000 ____D C:\Users\cruss\OneDrive\Documents\RingCentral
2022-07-04 10:42 - 2022-07-04 10:42 - 000047600 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-stable.sys
2022-07-04 10:42 - 2022-07-04 10:42 - 000047600 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-dev.sys
2022-07-04 10:42 - 2022-07-04 10:42 - 000047600 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-canary.sys
2022-07-04 10:42 - 2022-07-04 10:42 - 000046872 _____ (Dropbox, Inc.) C:\WINDOWS\system32\DbxSvc.exe
2022-07-01 16:09 - 2022-07-01 16:09 - 006248819 _____ C:\Users\cruss\Downloads\60WellingtonCBCSaleBrochureL (1).pdf
2022-06-28 09:50 - 2022-06-28 09:50 - 000335872 _____ C:\WINDOWS\system32\Windows.Management.InprocObjects.dll
2022-06-27 09:18 - 2022-06-27 09:18 - 000025048 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswElam.sys
2022-06-23 09:56 - 2022-06-23 09:56 - 000000000 ____D C:\Users\cruss\.ms-ad
2022-06-21 11:00 - 2022-06-21 11:00 - 000000000 ____D C:\Users\cruss\OneDrive\Documents\DYMO Connect
2022-06-21 10:58 - 2022-06-21 10:58 - 000002769 _____ C:\Users\Public\Desktop\DYMO Connect.lnk
2022-06-21 10:52 - 2022-06-21 10:54 - 299079768 _____ (DYMO) C:\Users\cruss\Downloads\DCDSetup1.4.3.131.exe
2022-06-20 09:32 - 2022-06-20 09:32 - 008234296 _____ (Piriform Software Ltd) C:\Users\cruss\Downloads\spsetup132.exe
2022-06-20 09:32 - 2022-06-20 09:32 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Speccy
2022-06-20 09:31 - 2022-06-20 09:31 - 000000000 ____D C:\Program Files\Speccy
2022-06-20 09:31 - 2022-06-20 09:31 - 000000000 ____D C:\Program Files\Recuva
2022-06-20 09:31 - 2022-06-20 09:31 - 000000000 ____D C:\Program Files\Defraggler
2022-06-20 09:29 - 2022-06-20 09:30 - 059317896 _____ (Piriform Software Ltd) C:\Users\cruss\Downloads\CCleanerBundle-600-Setup.exe
2022-06-20 09:28 - 2022-06-20 09:28 - 001358416 _____ (Piriform) C:\Users\cruss\Downloads\kamo_2.1.1.3164.0_bundle(2).exe
2022-06-20 09:26 - 2022-07-15 08:11 - 000000000 ____D C:\Users\cruss\AppData\Local\Kamo
2022-06-20 09:26 - 2022-07-14 18:17 - 000004028 _____ C:\WINDOWS\system32\Tasks\Avast SecureLine VPN Update
2022-06-20 09:26 - 2022-06-20 09:26 - 000065944 _____ (Avast Software) C:\WINDOWS\system32\Drivers\aswVpnRdr.sys
2022-06-20 09:26 - 2022-06-20 09:26 - 000037104 _____ (WireGuard LLC) C:\WINDOWS\system32\Drivers\aswWintun.sys
2022-06-20 09:26 - 2022-06-20 09:25 - 000116296 _____ (Windows ® Win 7 DDK provider) C:\WINDOWS\system32\Drivers\netfilter2.sys
2022-06-20 09:25 - 2022-07-14 13:47 - 000000000 ____D C:\Program Files (x86)\Kamo
2022-06-20 09:25 - 2022-06-21 10:49 - 000000000 ____D C:\WINDOWS\system32\Tasks\Kamo
2022-06-20 09:25 - 2022-06-20 09:25 - 001358416 _____ (Piriform) C:\Users\cruss\Downloads\kamo_2.1.1.3164.0_bundle(1).exe
2022-06-20 09:25 - 2022-06-20 09:25 - 000001965 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kamo.lnk
2022-06-20 09:25 - 2022-06-20 09:25 - 000000000 ____D C:\Program Files\Microsoft SQL Server Compact Edition
2022-06-20 09:25 - 2022-06-20 09:25 - 000000000 ____D C:\Program Files\Common Files\Piriform
2022-06-20 09:25 - 2022-06-20 09:25 - 000000000 ____D C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2022-06-20 09:24 - 2022-06-20 09:24 - 001358416 _____ (Piriform) C:\Users\cruss\Downloads\kamo_2.1.1.3164.0_bundle.exe
2022-06-15 15:27 - 2022-06-15 15:27 - 000024919 _____ C:\Users\cruss\Downloads\US-Canada-Powerbroker-Submissions-Sales.xlsx
2022-06-15 12:26 - 2022-06-15 12:26 - 000874867 _____ C:\Users\cruss\Downloads\Concept Plan 31-49 Silvermine Road - 100K SF -.pdf
2022-06-15 12:23 - 2022-06-15 12:23 - 002276371 _____ C:\Users\cruss\Downloads\Fact Sheet HL w Demographics & price reduc - 31-47 Silvermine Rd, Seym - 5-24-22 PDF.pdf
==================== One month (modified) ==================
(If an entry is included in the fixlist, the file/folder will be moved.)
2022-07-15 10:38 - 2020-06-03 18:51 - 000052175 _____ C:\Users\cruss\Downloads\FRST.txt
2022-07-15 10:37 - 2020-02-11 14:07 - 000000000 ____D C:\FRST
2022-07-15 10:29 - 2021-06-05 08:10 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2022-07-15 10:19 - 2021-06-05 08:10 - 000000000 ____D C:\WINDOWS\SystemTemp
2022-07-15 10:19 - 2020-08-13 14:44 - 000002043 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes.lnk
2022-07-15 10:19 - 2019-11-03 23:01 - 000000000 ____D C:\ProgramData\Malwarebytes
2022-07-15 10:19 - 2019-11-03 23:01 - 000000000 ____D C:\Program Files\Malwarebytes
2022-07-15 10:16 - 2019-11-03 22:21 - 000000000 ____D C:\Program Files (x86)\Google
2022-07-15 10:10 - 2019-11-03 15:02 - 000000000 ____D C:\Users\cruss\OneDrive\Documents\Outlook Files
2022-07-15 10:03 - 2022-02-09 11:51 - 000000000 ____D C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38
2022-07-15 10:02 - 2019-11-03 17:46 - 000000000 ____D C:\Users\cruss\AppData\LocalLow\Mozilla
2022-07-15 09:40 - 2021-06-05 08:10 - 000000000 ____D C:\WINDOWS\system32\WinBioDatabase
2022-07-15 09:30 - 2021-03-19 14:57 - 000018960 _____ (Logitech, Inc.) C:\WINDOWS\system32\Drivers\LNonPnP.sys
2022-07-15 09:25 - 2021-10-30 09:17 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2022-07-15 09:25 - 2021-06-05 08:09 - 000000000 ____D C:\WINDOWS\INF
2022-07-15 09:11 - 2019-11-03 22:59 - 000000000 ____D C:\Users\cruss\AppData\Local\AVAST Software
2022-07-15 08:38 - 2021-06-05 08:10 - 000000000 ____D C:\WINDOWS\A
