Page 1 of 2 12 LastLast
Results 1 to 10 of 17

Thread: well i hadn't planned on such a quick return...

  1. #1
    Senior Member
    Join Date
    Feb 2008
    Location
    L.A. (Lower Arkansas)
    Posts
    341

    Default well i hadn't planned on such a quick return...

    but it appears something else had other plans. maybe a browser hijack of some sorts, i don't know but may involve yahoo. including a screenshot of a simple bing search i use and google is the same, note in the right hand corner the logo yahoo. that never use to be and i have never used yahoo really and not in years since. just an old yahoo mail box i tend to some. pc has no obvious troubles except when i search it always goes to a page like this.

    Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 22-01-2021
    Ran by ronny (administrator) on DADS (Hewlett-Packard HP EliteDesk 800 G1 SFF) (22-01-2021 19:37:12)
    Running from C:\Users\ronny\OneDrive\Desktop
    Loaded Profiles: ronny
    Platform: Windows 10 Home Version 20H2 19042.746 (X64) Language: English (United States)
    Default browser: FF
    Boot Mode: Normal

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (A.V.M. SOFTWARE, INC. -> AVM Software) C:\Program Files (x86)\Paltalk\update\pt_update_service.exe
    (Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
    (Andrea Electronics -> Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
    (Apple Inc. -> Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
    (Baltic Latvian Universal Electronics LLC -> ) C:\Program Files\Blue Sherpa\sherpa_service.exe
    (Dropbox, Inc -> Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe <3>
    (Dropbox, Inc -> Dropbox, Inc.) C:\Windows\System32\DbxSvc.exe
    (Dropbox, Inc -> The Qt Company Ltd.) C:\Program Files (x86)\Dropbox\Client\113.4.507\QtWebEngineProcess.exe <2>
    (HP Inc. -> HP Inc.) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
    (HP Inc. -> HP) C:\Program Files (x86)\HP\Shared\hpqwmiex.exe
    (Intel Corporation -> ) C:\Windows\System32\igfxTray.exe
    (Intel Corporation -> Intel Corporation) C:\Windows\System32\igfxCUIService.exe
    (Intel Corporation -> Intel Corporation) C:\Windows\System32\igfxHK.exe
    (Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe <19>
    (Microsoft Corporation -> Microsoft Corporation) C:\Users\ronny\AppData\Local\Microsoft\OneDrive\20.201.1005.0009\FileCoAuth.exe
    (Microsoft Corporation -> Microsoft Corporation) C:\Users\ronny\AppData\Local\Microsoft\OneDrive\OneDrive.exe
    (Microsoft Corporation -> Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
    (Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsStore_12011.1001.1.0_x64__8wekyb3d8bbwe\WinStore.App.exe
    (Microsoft Windows -> Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
    (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe <2>
    (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\oobe\UserOOBEBroker.exe
    (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
    (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2011.6-0\MsMpEng.exe
    (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2011.6-0\NisSrv.exe
    (Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    (NCH Software Pty Ltd -> NCH Software) C:\Program Files (x86)\NCH Software\VRS\vrs.exe
    (Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe <2>
    (Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
    (Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
    (WEB ENTERTAINMENT LIMITED -> Y8 Games) C:\Users\ronny\AppData\Local\Programs\y8-browser\Y8 Browser.exe <17>

    ==================== Registry (Whitelisted) ===================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [9240512 2017-12-21] (Realtek Semiconductor Corp. -> Realtek Semiconductor)
    HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1492928 2017-12-21] (Realtek Semiconductor Corp. -> Realtek Semiconductor)
    HKLM-x32\...\Run: [VRS] => C:\Program Files (x86)\NCH Software\VRS\vrs.exe [1313808 2018-10-17] (NCH Software Pty Ltd -> NCH Software)
    HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [7992336 2021-01-13] (Dropbox, Inc -> Dropbox, Inc.)
    HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [706680 2020-12-09] (Oracle America, Inc. -> Oracle Corporation)
    HKLM\...\Policies\Explorer: [HideSCAMeetNow] 0
    HKLM\...\Policies\Explorer: [New Value #1]
    HKU\S-1-5-21-687888615-3449104039-937635755-1001\...\Run: [CCleaner Smart Cleaning] => C:\Program Files\CCleaner\CCleaner64.exe [32414392 2020-12-08] (Piriform Software Ltd -> Piriform Software Ltd)
    HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\87.0.4280.141\Installer\chrmstp.exe [2021-01-11] (Google LLC -> Google LLC)

    ==================== Scheduled Tasks (Whitelisted) ============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    Task: {29AC548F-9476-4DD6-8189-44F32348EB59} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater - resources updates => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [665944 2020-08-20] (HP Inc. -> HP Inc.)
    Task: {36EE3A7E-07D4-4A76-BCE5-42FDCFECFFA4} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2021-01-16] (Dropbox, Inc -> Dropbox, Inc.)
    Task: {3B6321DB-721A-4315-A19A-25ABB21C9BA6} - System32\Tasks\NCH Software\WavePadReminder => C:\Program Files (x86)\NCH Software\WavePad\WavePad.exe [2320900 2021-01-14] (NCH Software) [File not signed]
    Task: {3FC5FCA1-32EA-4B4C-B1CD-D0A3A909232F} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [1506648 2020-08-20] (HP Inc. -> HP Inc.)
    Task: {441BD810-A4CD-4666-A99B-7ACDCA1D4C67} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2011.6-0\MpCmdRun.exe [545704 2020-12-04] (Microsoft Windows Publisher -> Microsoft Corporation)
    Task: {561E6F49-EC06-4A67-AF3C-7321394EE673} - System32\Tasks\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\default-browser-agent.exe [124112 2020-12-07] (Mozilla Corporation -> Mozilla Foundation)
    Task: {626D0279-7154-47A3-BDD9-19ABE890F470} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [155432 2019-10-23] (Google Inc -> Google LLC)
    Task: {64B4806A-2CF4-45B0-97A8-4BEE96D34FBE} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Product Configurator => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\ProductConfig.exe [348504 2020-11-06] (HP Inc. -> HP Inc.)
    Task: {6BD67C7B-1EED-4037-A8C9-B4B6359EADD4} - System32\Tasks\Adobe Flash Player NPAPI Notifier => C:\windows\SysWOW64\Macromed\Flash\FlashUtil32_32_0_0_465_Plugin.exe [1504312 2020-12-08] (Adobe Inc. -> Adobe)
    Task: {6FC97267-27C8-4D04-9BCE-88F13078CD42} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater - Resources => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [665944 2020-08-20] (HP Inc. -> HP Inc.)
    Task: {74AF6DB3-FF65-4212-929C-69F819C4AE4C} - System32\Tasks\EOSv3 Scheduler onTime => C:\Users\ronny\OneDrive\Desktop\esetonlinescanner.exe
    Task: {77A028AC-F461-46A2-85CC-F517C8B39E6B} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2011.6-0\MpCmdRun.exe [545704 2020-12-04] (Microsoft Windows Publisher -> Microsoft Corporation)
    Task: {7D14A629-B295-47BB-9607-5A955A6F2FAF} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [26896568 2020-12-08] (Piriform Software Ltd -> Piriform Software Ltd)
    Task: {8663AC4B-AB4E-42A4-A137-E14AC8DFB327} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [1136984 2020-09-17] (HP Inc. -> HP Inc.)
    Task: {8766E59D-101C-4588-B666-A114A59C0CBF} - System32\Tasks\EOSv3 Scheduler onLogOn => C:\Users\ronny\OneDrive\Desktop\esetonlinescanner.exe
    Task: {8B6D01E4-94A8-4857-AE55-329F3D14C65D} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSFReport.exe [135000 2020-08-20] (HP Inc. -> HP Inc.)
    Task: {97604842-DA68-4926-806B-C0861C13882C} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [686384 2020-12-08] (Piriform Software Ltd -> Piriform Software Ltd)
    Task: {9DCEA3AF-311F-46BC-87C9-C880614AC30C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [155432 2019-10-23] (Google Inc -> Google LLC)
    Task: {A0CB5320-9F28-403B-A9E7-FCAB9E88D0E0} - System32\Tasks\Maxthon Update => C:\Program Files (x86)\Maxthon\Bin\MxStart.exe [155936 2017-04-19] (Maxthon (Asia) Limited. -> Maxthon International ltd.)
    Task: {A7D476E4-2920-47C7-88A2-9491F9258CC9} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Update Notice => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\BingPopup\BingPopup.exe [553304 2020-10-28] (HP Inc. -> HP Inc.)
    Task: {CA874257-FCBE-4F0D-B598-D3118165BA49} - System32\Tasks\NCH Software\WavePadDowngrade => C:\Program Files (x86)\NCH Software\WavePad\wavepad.exe [2320900 2021-01-14] (NCH Software) [File not signed]
    Task: {D09EC22C-0F9E-4EA5-9B38-A291FFD6DE6F} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [1506648 2020-08-20] (HP Inc. -> HP Inc.)
    Task: {D8488B58-84AC-4247-9E99-483325DE2D45} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2011.6-0\MpCmdRun.exe [545704 2020-12-04] (Microsoft Windows Publisher -> Microsoft Corporation)
    Task: {E01434BC-B825-49F7-BAD7-D42970B88A76} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [335416 2020-12-08] (Adobe Inc. -> Adobe)
    Task: {E58296AE-8072-4FAA-9C98-AE992F832EA7} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2011.6-0\MpCmdRun.exe [545704 2020-12-04] (Microsoft Windows Publisher -> Microsoft Corporation)
    Task: {E85E19FD-0C98-4D06-8129-FC4964EDB436} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2021-01-16] (Dropbox, Inc -> Dropbox, Inc.)
    Task: {ED5995CB-86D1-4018-A8AF-7B9B7C5930EB} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [665944 2020-08-20] (HP Inc. -> HP Inc.)
    Task: {F26B541D-2DF2-43FF-94FF-E09EAFECF0EE} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [1136984 2020-09-17] (HP Inc. -> HP Inc.)
    Task: {FA810C09-D881-4375-A1F0-17C65E6B4EEB} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1349200 2020-11-03] (Adobe Inc. -> Adobe Inc.)

    (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

    Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
    Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
    Tcpip\..\Interfaces\{38ae83d3-c5f7-44d3-984f-0acfc8cf2da0}: [DhcpNameServer] 192.168.1.1

    Edge:
    =======
    DownloadDir: C:\Users\ronny\Downloads
    Edge DefaultProfile: Default
    Edge Profile: C:\Users\ronny\AppData\Local\Microsoft\Edge\User Data\Default [2021-01-22]
    Edge DownloadDir: C:\Users\ronny\Downloads
    Edge HomePage: Default -> hxxps://www.oann.com/
    Edge Extension: (Cannon Balls 3D - Play Cannon Balls 3D on Crazy Games) - C:\Users\ronny\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\bifnnkpgakamifkjfppdlmmbeojlgdfi [2020-07-28]
    Edge Extension: (Featured Songs | SingSnap Karaoke) - C:\Users\ronny\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\hhiajehpjhiangplbhcdmaomkbcjkiok [2020-07-28]
    Edge Extension: (Amazon Assistant) - C:\Users\ronny\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\hkmnokmdbkkafgmpfhhiniclfnfpmogj [2020-12-23]
    Edge Extension: (No Name) - C:\Users\ronny\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\kiiaghlmeikbpmeabhilfphikfcefljn [2020-07-20]
    Edge Extension: (SecuryBrowse for Edge™) - C:\Users\ronny\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\lbeffjmildfgehghkejpfljhedlflfcn [2021-01-02]
    Edge Extension: (AdBlock — best ad blocker) - C:\Users\ronny\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ndcileolkflehcjpmjnfbnaibdcgglog [2021-01-16]
    Edge Extension: (The Mist) - C:\Users\ronny\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\npkohagpnckpnhenpjeeggdngjphfgkn [2021-01-14]
    Edge Extension: ((7) Facebook) - C:\Users\ronny\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ofohkhocbjomniionenjnkmhapjnahmj [2020-07-28]
    Edge Extension: (8 Ball Pool - A free Sports Game) - C:\Users\ronny\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\pflldibpeogkdfhedafalghhpnfofnaj [2020-07-28]
    Edge HKLM-x32\...\Edge\Extension: [ihcjicgdanjaechkgeegckofjjedodee]

    FireFox:
    ========
    FF DefaultProfile: 1a5my9te.default
    FF ProfilePath: C:\Users\ronny\AppData\Roaming\Mozilla\Firefox\Profiles\1a5my9te.default [2021-01-22]
    FF ProfilePath: C:\Users\ronny\AppData\Roaming\Mozilla\Firefox\Profiles\zb50iane.default-release [2021-01-18]
    FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_32_0_0_465.dll [2020-12-08] (Adobe Inc. -> )
    FF Plugin: @unity3d.com/UnityPlayer64,version=1.0 -> C:\Program Files\Unity\WebPlayer64\loader-x64\npUnity3D64.dll [2015-06-08] (Unity Technologies ApS -> Unity Technologies ApS)
    FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_32_0_0_465.dll [2020-12-08] (Adobe Inc. -> )
    FF Plugin-x32: @flyordie.com/GamesPlugin -> C:\Program Files (x86)\Flyordie Plugin\npfod.dll [2020-07-01] (Solware IT Ltd -> Solware)
    FF Plugin-x32: @java.com/DTPlugin,version=11.281.2 -> C:\Program Files (x86)\Java\jre1.8.0_281\bin\dtplugin\npDeployJava1.dll [2021-01-20] (Oracle America, Inc. -> Oracle Corporation)
    FF Plugin-x32: @java.com/JavaPlugin,version=11.281.2 -> C:\Program Files (x86)\Java\jre1.8.0_281\bin\plugin2\npjp2.dll [2021-01-20] (Oracle America, Inc. -> Oracle Corporation)
    FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2020-12-07] (Adobe Inc. -> Adobe Systems Inc.)

    Chrome:
    =======
    CHR Profile: C:\Users\ronny\AppData\Local\Google\Chrome\User Data\Default [2021-01-21]
    CHR Extension: (Slides) - C:\Users\ronny\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2021-01-16]
    CHR Extension: (Docs) - C:\Users\ronny\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2021-01-16]
    CHR Extension: (Google Drive) - C:\Users\ronny\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2021-01-16]
    CHR Extension: (YouTube) - C:\Users\ronny\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2021-01-16]
    CHR Extension: (Adobe Acrobat) - C:\Users\ronny\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2021-01-16]
    CHR Extension: (Sheets) - C:\Users\ronny\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2021-01-16]
    CHR Extension: (Google Docs Offline) - C:\Users\ronny\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2021-01-16]
    CHR Extension: (Malwarebytes Browser Guard) - C:\Users\ronny\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihcjicgdanjaechkgeegckofjjedodee [2021-01-16]
    CHR Extension: (Chrome Web Store Payments) - C:\Users\ronny\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2021-01-16]
    CHR Extension: (Gmail) - C:\Users\ronny\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2021-01-16]
    CHR Extension: (Chrome Media Router) - C:\Users\ronny\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2021-01-16]
    CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]
    CHR HKLM-x32\...\Chrome\Extension: [ihcjicgdanjaechkgeegckofjjedodee]

    ==================== Services (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    R2 AdobeARMservice; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [170056 2020-11-03] (Adobe Inc. -> Adobe Inc.)
    S3 AdobeFlashPlayerUpdateSvc; C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [335416 2020-12-08] (Adobe Inc. -> Adobe)
    R2 AERTFilters; C:\Program Files\Realtek\Audio\HDA\AERTSr64.EXE [117168 2015-08-07] (Andrea Electronics -> Andrea Electronics Corporation)
    S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2021-01-16] (Dropbox, Inc -> Dropbox, Inc.)
    S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2021-01-16] (Dropbox, Inc -> Dropbox, Inc.)
    R2 DbxSvc; C:\WINDOWS\System32\DbxSvc.exe [44064 2021-01-13] (Dropbox, Inc -> Dropbox, Inc.)
    R3 hpqcaslwmiex; C:\Program Files (x86)\HP\Shared\hpqwmiex.exe [1149480 2018-06-07] (HP Inc. -> HP)
    R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [379736 2020-08-20] (HP Inc. -> HP Inc.)
    S3 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [7456464 2020-12-21] (Malwarebytes Inc -> Malwarebytes)
    R2 paltalk_update_service; C:\Program Files (x86)\Paltalk\update\pt_update_service.exe [1337784 2020-09-30] (A.V.M. SOFTWARE, INC. -> AVM Software)
    R2 sherpa_service; C:\Program Files\Blue Sherpa\sherpa_service.exe [348080 2020-08-01] (Baltic Latvian Universal Electronics LLC -> )
    R2 VRSService; C:\Program Files (x86)\NCH Software\VRS\vrs.exe [1313808 2018-10-17] (NCH Software Pty Ltd -> NCH Software)
    R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2011.6-0\NisSrv.exe [2491880 2020-12-04] (Microsoft Windows Publisher -> Microsoft Corporation)
    R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2011.6-0\MsMpEng.exe [128376 2020-12-04] (Microsoft Windows Publisher -> Microsoft Corporation)

    ===================== Drivers (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    R3 CMUSBDAC; C:\WINDOWS\system32\DRIVERS\CMUSBDAC.sys [3819744 2018-07-24] (WDKTestCert cm359,131641702659254692 -> C-MEDIA)
    S3 DroidCam; C:\WINDOWS\System32\drivers\droidcam.sys [32240 2020-04-10] (Microsoft Windows Hardware Compatibility Publisher -> Dev47Apps)
    S3 DroidCamVideo; C:\WINDOWS\System32\drivers\droidcamvideo.sys [33784 2020-10-03] (Microsoft Windows Hardware Compatibility Publisher -> Windows (R) Win 7 DDK provider)
    R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [153312 2020-12-21] (Malwarebytes Corporation -> Malwarebytes)
    S3 EvoMouseDriverMini; C:\WINDOWS\system32\drivers\EvoMouseDriverMini.sys [25952 2018-09-20] (Microsoft Windows Hardware Compatibility Publisher -> Evoluent)
    S3 iVCam; C:\WINDOWS\system32\DRIVERS\iVCam.sys [1090536 2020-11-02] (Shanghai Yitu Information Technology Co., Ltd. -> e2eSoft)
    S3 ManyCam; C:\WINDOWS\system32\DRIVERS\mcvidrv.sys [66952 2018-07-29] (ManyCam (VISICOM MÉDIA INC.) -> Visicom Media Inc.)
    R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [220160 2021-01-04] (Malwarebytes Inc -> Malwarebytes)
    S0 MbamElam; C:\WINDOWS\System32\DRIVERS\MbamElam.sys [19912 2020-12-21] (Microsoft Windows Early Launch Anti-malware Publisher -> Malwarebytes)
    S3 MBAMFarflt; C:\WINDOWS\System32\DRIVERS\farflt.sys [197792 2021-01-14] (Malwarebytes Inc -> Malwarebytes)
    S3 MBAMProtection; C:\WINDOWS\system32\DRIVERS\mbam.sys [77496 2021-01-14] (Malwarebytes Inc -> Malwarebytes)
    S3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [248968 2020-12-21] (Malwarebytes Inc -> Malwarebytes)
    S3 MBAMWebProtection; C:\WINDOWS\system32\DRIVERS\mwac.sys [139424 2021-01-14] (Malwarebytes Inc -> Malwarebytes)
    S3 mcaudrv_simple; C:\WINDOWS\system32\drivers\mcaudrv_x64.sys [35960 2014-12-28] (ManyCam -> Visicom Media Inc.)
    R3 stdriver; C:\WINDOWS\system32\DRIVERS\stdriverx64.sys [54664 2021-01-14] (NCH Software Pty Ltd -> )
    S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [48536 2020-12-04] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
    R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [429296 2020-12-04] (Microsoft Windows -> Microsoft Corporation)
    R3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [70896 2020-12-04] (Microsoft Windows -> Microsoft Corporation)

    ==================== NetSvcs (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    ==================== One month (created) (Whitelisted) =========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2021-01-22 19:37 - 2021-01-22 19:38 - 005198336 _____ (AVAST Software) C:\Users\ronny\Downloads\aswMBR.exe
    2021-01-22 19:36 - 2021-01-22 19:38 - 000000000 ____D C:\FRST
    2021-01-22 18:40 - 2021-01-22 18:40 - 005766144 _____ (Tweaking.com) C:\Users\ronny\Downloads\tweaking.com_registry_backup_setup (1).exe
    2021-01-22 18:40 - 2021-01-22 18:40 - 000016294 _____ C:\WINDOWS\Tweaking.com - Registry Backup Setup Log.txt
    2021-01-22 02:34 - 2021-01-22 02:34 - 000000000 ____D C:\Users\ronny\AppData\Local\y8-browser-updater
    2021-01-21 14:24 - 2021-01-21 14:42 - 000000000 ___RD C:\Users\ronny\Dropbox
    2021-01-21 03:49 - 2021-01-22 08:38 - 000000000 ____D C:\Users\ronny\AppData\Roaming\y8-browser
    2021-01-21 03:49 - 2021-01-21 03:49 - 000002328 _____ C:\Users\ronny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Y8 Browser.lnk
    2021-01-21 03:49 - 2021-01-21 03:49 - 000000000 ____D C:\Users\ronny\AppData\Roaming\Y8 Browser
    2021-01-21 03:48 - 2021-01-21 03:48 - 000500440 _____ (Y8 Games) C:\Users\ronny\Downloads\y8-browser-web-setup-1.0.7.exe
    2021-01-21 03:48 - 2021-01-21 03:48 - 000500440 _____ (Y8 Games) C:\Users\ronny\Downloads\y8-browser-web-setup-1.0.7 (1).exe
    2021-01-20 13:48 - 2021-01-20 13:48 - 000165032 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
    2021-01-20 13:48 - 2021-01-20 13:48 - 000000000 ____D C:\Users\ronny\AppData\Roaming\Sun
    2021-01-20 13:48 - 2021-01-20 13:48 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
    2021-01-20 13:48 - 2021-01-20 13:48 - 000000000 ____D C:\Program Files (x86)\Java
    2021-01-20 13:47 - 2021-01-20 13:47 - 002079880 _____ (Oracle Corporation) C:\Users\ronny\Downloads\jre-8u281-windows-i586-iftw.exe
    2021-01-20 13:35 - 2021-01-20 13:36 - 002079880 _____ (Oracle Corporation) C:\Users\ronny\Downloads\JavaSetup8u281.exe
    2021-01-19 17:57 - 2021-01-19 17:57 - 000003386 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore1d6e19fdc9c5413
    2021-01-18 05:20 - 2021-01-18 05:20 - 000059992 _____ C:\WINDOWS\system32\cc_20210118_052003.reg
    2021-01-17 01:13 - 2021-01-17 01:13 - 003697441 _____ C:\Users\ronny\Downloads\H01-1669A.pdf
    2021-01-16 08:36 - 2021-01-16 08:36 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
    2021-01-16 08:35 - 2021-01-16 08:35 - 000000000 ____D C:\Users\ronny\AppData\Roaming\Dropbox
    2021-01-16 08:34 - 2021-01-22 01:23 - 000003976 _____ C:\WINDOWS\system32\Tasks\DropboxUpdateTaskMachineUA
    2021-01-16 08:34 - 2021-01-22 01:23 - 000003744 _____ C:\WINDOWS\system32\Tasks\DropboxUpdateTaskMachineCore
    2021-01-16 08:34 - 2021-01-22 01:23 - 000000916 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job
    2021-01-16 08:34 - 2021-01-22 01:23 - 000000912 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job
    2021-01-16 08:34 - 2021-01-21 14:24 - 000000000 ____D C:\Users\ronny\AppData\Local\Dropbox
    2021-01-16 08:34 - 2021-01-16 08:36 - 000000000 ____D C:\Program Files (x86)\Dropbox
    2021-01-16 08:34 - 2021-01-16 08:34 - 000669800 _____ (Dropbox, Inc.) C:\Users\ronny\Downloads\DropboxInstaller.exe
    2021-01-16 08:34 - 2021-01-16 08:34 - 000000000 ____D C:\ProgramData\Dropbox
    2021-01-14 14:18 - 2021-01-14 14:18 - 000000000 ____D C:\Users\ronny\NCH Software Suite
    2021-01-14 11:53 - 2021-01-14 11:53 - 000894072 _____ (NCH Software) C:\Users\ronny\Downloads\wavepad-5-15-2012-07-05.exe
    2021-01-14 11:51 - 2021-01-14 11:51 - 000787160 _____ (NCH Software) C:\Users\ronny\Downloads\soundtap-4-01-2017-09-28 (2).exe
    2021-01-14 11:50 - 2021-01-14 11:51 - 000787160 _____ (NCH Software) C:\Users\ronny\Downloads\soundtap-4-01-2017-09-28 (1).exe
    2021-01-14 09:44 - 2021-01-14 09:44 - 000197792 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
    2021-01-14 09:44 - 2021-01-14 09:44 - 000139424 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
    2021-01-14 09:44 - 2021-01-14 09:44 - 000077496 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
    2021-01-13 20:43 - 2021-01-13 20:43 - 000047600 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-stable.sys
    2021-01-13 20:43 - 2021-01-13 20:43 - 000047600 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-dev.sys
    2021-01-13 20:43 - 2021-01-13 20:43 - 000047600 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-canary.sys
    2021-01-13 20:43 - 2021-01-13 20:43 - 000044064 _____ (Dropbox, Inc.) C:\WINDOWS\system32\DbxSvc.exe
    2021-01-13 08:57 - 2021-01-13 08:57 - 000581120 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhotoScreensaver.scr
    2021-01-13 08:57 - 2021-01-13 08:57 - 000499200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhotoScreensaver.scr
    2021-01-13 08:57 - 2021-01-13 08:57 - 000234496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ksproxy.ax
    2021-01-13 08:57 - 2021-01-13 08:57 - 000135168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VBICodec.ax
    2021-01-13 08:57 - 2021-01-13 08:57 - 000095744 _____ C:\WINDOWS\system32\VirtualMonitorManager.dll
    2021-01-13 08:57 - 2021-01-13 08:57 - 000067584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wscui.cpl
    2021-01-13 08:56 - 2021-01-13 08:56 - 000575488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hhctrl.ocx
    2021-01-13 08:56 - 2021-01-13 08:56 - 000469504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\appwiz.cpl
    2021-01-13 08:56 - 2021-01-13 08:56 - 000304128 _____ (Microsoft Corporation) C:\WINDOWS\system32\ksproxy.ax
    2021-01-13 08:56 - 2021-01-13 08:56 - 000170496 _____ (Microsoft Corporation) C:\WINDOWS\system32\VBICodec.ax
    2021-01-13 08:56 - 2021-01-13 08:56 - 000087552 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdc.ocx
    2021-01-13 08:56 - 2021-01-13 08:56 - 000084992 _____ (Microsoft Corporation) C:\WINDOWS\system32\wscui.cpl
    2021-01-13 08:56 - 2021-01-13 08:56 - 000072704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdc.ocx
    2021-01-13 08:56 - 2021-01-13 08:56 - 000053760 _____ C:\WINDOWS\SysWOW64\BWContextHandler.dll
    2021-01-13 08:55 - 2021-01-13 08:55 - 001333760 _____ C:\WINDOWS\SysWOW64\TextInputMethodFormatter.dll
    2021-01-13 08:55 - 2021-01-13 08:55 - 000729600 _____ (Microsoft Corporation) C:\WINDOWS\system32\hhctrl.ocx
    2021-01-13 08:55 - 2021-01-13 08:55 - 000595968 _____ (Microsoft Corporation) C:\WINDOWS\system32\appwiz.cpl
    2021-01-13 08:55 - 2021-01-13 08:55 - 000455680 _____ C:\WINDOWS\SysWOW64\WindowManagementAPI.dll
    2021-01-13 08:55 - 2021-01-13 08:55 - 000446976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mmsys.cpl
    2021-01-13 08:55 - 2021-01-13 08:55 - 000235520 _____ C:\WINDOWS\SysWOW64\HeatCore.dll
    2021-01-13 08:55 - 2021-01-13 08:55 - 000178688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\intl.cpl
    2021-01-13 08:55 - 2021-01-13 08:55 - 000067072 _____ C:\WINDOWS\system32\BWContextHandler.dll
    2021-01-13 08:55 - 2021-01-13 08:55 - 000010894 _____ C:\WINDOWS\system32\DrtmAuthTxt.wim
    2021-01-13 08:54 - 2021-01-13 08:54 - 002254336 _____ C:\WINDOWS\system32\dwmscene.dll
    2021-01-13 08:54 - 2021-01-13 08:54 - 001162240 _____ C:\WINDOWS\system32\MBR2GPT.EXE
    2021-01-13 08:54 - 2021-01-13 08:54 - 000544768 _____ (Microsoft Corporation) C:\WINDOWS\system32\mmsys.cpl
    2021-01-13 08:54 - 2021-01-13 08:54 - 000422912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winspool.drv
    2021-01-13 08:54 - 2021-01-13 08:54 - 000330752 _____ C:\WINDOWS\SysWOW64\ssdm.dll
    2021-01-13 08:54 - 2021-01-13 08:54 - 000238592 _____ (Microsoft Corporation) C:\WINDOWS\system32\intl.cpl
    2021-01-13 08:54 - 2021-01-13 08:54 - 000190976 _____ C:\WINDOWS\system32\BthpanContextHandler.dll
    2021-01-13 08:54 - 2021-01-13 08:54 - 000182272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\timedate.cpl
    2021-01-13 08:54 - 2021-01-13 08:54 - 000152064 _____ C:\WINDOWS\system32\EoAExperiences.exe
    2021-01-13 08:53 - 2021-01-13 08:53 - 002260992 _____ C:\WINDOWS\system32\TextInputMethodFormatter.dll
    2021-01-13 08:53 - 2021-01-13 08:53 - 000643072 _____ C:\WINDOWS\system32\WindowManagementAPI.dll
    2021-01-13 08:53 - 2021-01-13 08:53 - 000306688 _____ C:\WINDOWS\system32\HeatCore.dll
    2021-01-13 08:53 - 2021-01-13 08:53 - 000165888 _____ C:\WINDOWS\system32\DataStoreCacheDumpTool.exe
    2021-01-13 08:52 - 2021-01-13 08:52 - 000562688 _____ (Microsoft Corporation) C:\WINDOWS\system32\winspool.drv
    2021-01-13 08:52 - 2021-01-13 08:52 - 000455168 _____ C:\WINDOWS\system32\ssdm.dll
    2021-01-13 08:52 - 2021-01-13 08:52 - 000243200 _____ (Microsoft Corporation) C:\WINDOWS\system32\timedate.cpl
    2021-01-13 08:52 - 2021-01-13 08:52 - 000074240 _____ C:\WINDOWS\system32\rdsxvmaudio.dll
    2021-01-12 08:13 - 2021-01-12 08:13 - 000000374 _____ C:\WINDOWS\system32\Drivers\etc\hosts.ics
    2021-01-10 09:20 - 2021-01-10 09:20 - 000000000 ____D C:\Users\ronny\AppData\Roaming\Hewlett-Packard
    2021-01-10 09:20 - 2021-01-10 09:20 - 000000000 ____D C:\Users\ronny\AppData\Local\Hewlett-Packard
    2021-01-10 09:16 - 2021-01-10 09:16 - 000002307 _____ C:\Users\Public\Desktop\HP Support Assistant.lnk
    2021-01-10 09:16 - 2021-01-10 09:16 - 000002307 _____ C:\ProgramData\Desktop\HP Support Assistant.lnk
    2021-01-10 09:16 - 2021-01-10 09:16 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Help and Support
    2021-01-10 09:14 - 2021-01-10 09:16 - 000000000 ____D C:\Program Files (x86)\InstallShield Installation Information
    2021-01-10 09:14 - 2021-01-10 09:14 - 000000000 ____D C:\Users\ronny\AppData\Roaming\hpqLog
    2021-01-10 09:14 - 2021-01-10 09:14 - 000000000 ____D C:\Program Files (x86)\HP
    2021-01-10 09:13 - 2021-01-10 20:15 - 000000000 ____D C:\WINDOWS\system32\Tasks\Hewlett-Packard
    2021-01-10 09:13 - 2021-01-10 09:13 - 000000000 ____D C:\ProgramData\Hewlett-Packard
    2021-01-10 09:12 - 2021-01-10 09:14 - 000000000 ____D C:\Program Files (x86)\Hewlett-Packard
    2021-01-10 09:12 - 2021-01-10 09:12 - 000000000 ____D C:\Users\ronny\AppData\Local\HP
    2021-01-10 09:12 - 2021-01-10 09:12 - 000000000 ____D C:\system.sav
    2021-01-10 09:12 - 2021-01-10 09:12 - 000000000 ____D C:\SWSetup
    2021-01-10 09:08 - 2021-01-10 09:11 - 184383976 _____ (HP Inc.) C:\Users\ronny\Downloads\sp111562.exe
    2021-01-10 08:57 - 2021-01-10 08:57 - 000002065 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DTS Audio Control.lnk
    2021-01-10 08:56 - 2017-12-21 00:55 - 001435104 _____ (Synopsys, Inc.) C:\WINDOWS\system32\SRRPTR64.dll
    2021-01-10 08:56 - 2017-12-21 00:55 - 000467120 _____ (Synopsys, Inc.) C:\WINDOWS\system32\SRAPO64.dll
    2021-01-10 08:56 - 2017-12-21 00:55 - 000381376 _____ (Synopsys, Inc.) C:\WINDOWS\system32\SRCOM64.dll
    2021-01-10 08:56 - 2017-12-21 00:55 - 000341112 _____ (Synopsys, Inc.) C:\WINDOWS\SysWOW64\SRCOM.dll
    2021-01-10 08:56 - 2017-12-21 00:55 - 000341112 _____ (Synopsys, Inc.) C:\WINDOWS\system32\SRCOM.dll
    2021-01-10 08:56 - 2017-12-21 00:50 - 000231880 _____ (Synopsys, Inc.) C:\WINDOWS\system32\SFNHK64.dll
    2021-01-10 08:56 - 2017-12-21 00:50 - 000190512 _____ (Sonic Focus, Inc.) C:\WINDOWS\system32\SFProc64.dll
    2021-01-10 08:56 - 2017-12-21 00:50 - 000096024 _____ (Sonic Focus, Inc.) C:\WINDOWS\system32\SFComm64.dll
    2021-01-10 08:56 - 2017-12-21 00:50 - 000093456 _____ (Sonic Focus, Inc.) C:\WINDOWS\system32\SFSAPO64.dll
    2021-01-10 08:56 - 2017-12-21 00:50 - 000092440 _____ (Sonic Focus, Inc.) C:\WINDOWS\system32\SFHAPO64.dll
    2021-01-10 08:56 - 2017-12-21 00:50 - 000092440 _____ (Sonic Focus, Inc.) C:\WINDOWS\system32\SFDAPO64.dll
    2021-01-10 08:56 - 2017-12-21 00:49 - 000343672 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RtlCPAPI64.dll
    2021-01-10 08:56 - 2017-12-21 00:49 - 000090880 _____ (Synopsys, Inc.) C:\WINDOWS\system32\SFCOM64.dll
    2021-01-10 08:56 - 2017-12-21 00:49 - 000088280 _____ (Synopsys, Inc.) C:\WINDOWS\system32\SFAPO64.dll
    2021-01-10 08:56 - 2017-12-21 00:49 - 000083592 _____ (Virage Logic Corporation / Sonic Focus) C:\WINDOWS\SysWOW64\SFCOM.dll
    2021-01-10 08:56 - 2017-12-21 00:44 - 001353288 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RTCOM64.dll
    2021-01-10 08:56 - 2017-12-21 00:44 - 000691640 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RtDataProc64.dll
    2021-01-10 08:56 - 2017-12-21 00:44 - 000392832 _____ (Dolby Laboratories, Inc.) C:\WINDOWS\system32\RTEEP64A.dll
    2021-01-10 08:56 - 2017-12-21 00:44 - 000327240 _____ (Dolby Laboratories, Inc.) C:\WINDOWS\system32\RP3DHT64.dll
    2021-01-10 08:56 - 2017-12-21 00:44 - 000220352 _____ (Dolby Laboratories, Inc.) C:\WINDOWS\system32\RTEED64A.dll
    2021-01-10 08:56 - 2017-12-21 00:44 - 000116504 _____ (Dolby Laboratories, Inc.) C:\WINDOWS\system32\RTEEL64A.dll
    2021-01-10 08:56 - 2017-12-21 00:44 - 000093864 _____ (Dolby Laboratories, Inc.) C:\WINDOWS\system32\RTEEG64A.dll
    2021-01-10 08:56 - 2017-12-21 00:43 - 000327240 _____ (Dolby Laboratories, Inc.) C:\WINDOWS\system32\RP3DAA64.dll
    2021-01-10 08:56 - 2017-12-21 00:40 - 003677120 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RTSnMg64.cpl
    2021-01-10 08:56 - 2017-12-21 00:40 - 003205568 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RtPgEx64.dll
    2021-01-10 08:56 - 2017-12-21 00:39 - 072520680 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RCoRes64.dat
    2021-01-10 08:56 - 2017-12-21 00:39 - 002922944 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RCoInstII64.dll
    2021-01-10 08:56 - 2017-12-21 00:38 - 000122280 _____ (Real Sound Lab SIA) C:\WINDOWS\system32\CONEQMSAPOGUILibrary.dll
    2021-01-10 08:56 - 2017-12-21 00:01 - 015335659 _____ C:\WINDOWS\system32\Drivers\RTAIODAT.DAT
    2021-01-07 22:23 - 2021-01-14 14:29 - 000000000 ____D C:\Users\ronny\AppData\Roaming\BlueSherpa
    2021-01-07 22:23 - 2021-01-07 22:23 - 000000000 ___HD C:\ProgramData\{1016C65D-A3D5-450B-913B-30CD2A9BF7C1}
    2021-01-07 22:23 - 2021-01-07 22:23 - 000000000 ____D C:\Users\ronny\AppData\Local\Blue
    2021-01-07 22:23 - 2021-01-07 22:23 - 000000000 ____D C:\Users\Public\Logi
    2021-01-07 22:23 - 2021-01-07 22:23 - 000000000 ____D C:\ProgramData\regid.2018-06.com.bluedesigns
    2021-01-07 22:23 - 2021-01-07 22:23 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Blue Sherpa
    2021-01-07 22:23 - 2021-01-07 22:23 - 000000000 ____D C:\Program Files\Blue Sherpa
    2021-01-07 22:22 - 2021-01-07 22:22 - 067488856 _____ (Blue Microphones ) C:\Users\ronny\Downloads\BlueSherpa-20200801.exe
    2021-01-07 22:22 - 2021-01-07 22:22 - 000000000 ____D C:\Users\ronny\AppData\Local\IIIQF
    2021-01-04 04:04 - 2021-01-04 04:04 - 000220160 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamChameleon.sys
    2021-01-03 02:59 - 2021-01-03 03:02 - 000000000 ____D C:\WINDOWS\system32\config\bbimigrate
    2021-01-03 02:58 - 2021-01-03 02:59 - 000000000 ____D C:\WINDOWS\ServiceProfiles
    2021-01-03 02:58 - 2021-01-03 02:58 - 000008192 _____ C:\WINDOWS\system32\config\userdiff
    2021-01-03 02:56 - 2021-01-03 02:56 - 000000000 ____D C:\ProgramData\ssh
    2021-01-03 02:50 - 2021-01-03 02:50 - 003860832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rtmpltfm.dll
    2021-01-03 02:50 - 2021-01-03 02:50 - 002755584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
    2021-01-03 02:50 - 2021-01-03 02:50 - 002755584 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
    2021-01-03 02:50 - 2021-01-03 02:50 - 001309504 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
    2021-01-03 02:50 - 2021-01-03 02:50 - 000980320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rtmpal.dll
    2021-01-03 02:50 - 2021-01-03 02:50 - 000915296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rtmcodecs.dll
    2021-01-03 02:50 - 2021-01-03 02:50 - 000732000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ortcengine.dll
    2021-01-03 02:50 - 2021-01-03 02:50 - 000266240 _____ (Microsoft Corporation) C:\WINDOWS\system32\mpg2splt.ax
    2021-01-03 02:50 - 2021-01-03 02:50 - 000204800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mpg2splt.ax
    2021-01-03 02:50 - 2021-01-03 02:50 - 000055376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rtmmvrortc.dll
    2021-01-03 02:50 - 2021-01-03 02:50 - 000045880 _____ C:\WINDOWS\system32\HvSocket.dll
    2021-01-03 02:49 - 2021-01-03 02:49 - 004898144 _____ (Microsoft Corporation) C:\WINDOWS\system32\rtmpltfm.dll
    2021-01-03 02:49 - 2021-01-03 02:49 - 001354080 _____ (Microsoft Corporation) C:\WINDOWS\system32\rtmpal.dll
    2021-01-03 02:49 - 2021-01-03 02:49 - 001091936 _____ (Microsoft Corporation) C:\WINDOWS\system32\rtmcodecs.dll
    2021-01-03 02:49 - 2021-01-03 02:49 - 001032544 _____ (Microsoft Corporation) C:\WINDOWS\system32\ortcengine.dll
    2021-01-03 02:49 - 2021-01-03 02:49 - 000611952 _____ C:\WINDOWS\SysWOW64\TextShaping.dll
    2021-01-03 02:49 - 2021-01-03 02:49 - 000266240 _____ C:\WINDOWS\SysWOW64\Windows.Internal.UI.Shell.WindowTabManager.dll
    2021-01-03 02:49 - 2021-01-03 02:49 - 000240640 _____ C:\WINDOWS\SysWOW64\CoreMas.dll
    2021-01-03 02:49 - 2021-01-03 02:49 - 000221184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bthprops.cpl
    2021-01-03 02:49 - 2021-01-03 02:49 - 000112128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\activeds.tlb
    2021-01-03 02:49 - 2021-01-03 02:49 - 000102912 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncpa.cpl
    2021-01-03 02:49 - 2021-01-03 02:49 - 000100864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncpa.cpl
    2021-01-03 02:49 - 2021-01-03 02:49 - 000056672 _____ (Microsoft Corporation) C:\WINDOWS\system32\rtmmvrortc.dll
    2021-01-03 02:49 - 2021-01-03 02:49 - 000048640 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
    2021-01-03 02:49 - 2021-01-03 02:49 - 000047472 _____ C:\WINDOWS\SysWOW64\umpdc.dll
    2021-01-03 02:49 - 2021-01-03 02:49 - 000039936 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
    2021-01-03 02:49 - 2021-01-03 02:49 - 000023552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msacm32.drv
    2021-01-03 02:49 - 2021-01-03 02:49 - 000010752 _____ C:\WINDOWS\SysWOW64\agentactivationruntimestarter.exe
    2021-01-03 02:48 - 2021-01-03 02:48 - 002260480 _____ (The ICU Project) C:\WINDOWS\system32\icu.dll
    2021-01-03 02:48 - 2021-01-03 02:48 - 001822272 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
    2021-01-03 02:48 - 2021-01-03 02:48 - 001393496 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
    2021-01-03 02:48 - 2021-01-03 02:48 - 000707544 _____ C:\WINDOWS\system32\TextShaping.dll
    2021-01-03 02:48 - 2021-01-03 02:48 - 000363520 _____ C:\WINDOWS\system32\Windows.Internal.UI.Shell.WindowTabManager.dll
    2021-01-03 02:48 - 2021-01-03 02:48 - 000266752 _____ (Microsoft Corporation) C:\WINDOWS\system32\bthprops.cpl
    2021-01-03 02:48 - 2021-01-03 02:48 - 000112128 _____ (Microsoft Corporation) C:\WINDOWS\system32\activeds.tlb
    2021-01-03 02:48 - 2021-01-03 02:48 - 000060928 _____ C:\WINDOWS\system32\runexehelper.exe
    2021-01-03 02:48 - 2021-01-03 02:48 - 000029696 _____ (The ICU Project) C:\WINDOWS\system32\icuuc.dll
    2021-01-03 02:48 - 2021-01-03 02:48 - 000025088 _____ (The ICU Project) C:\WINDOWS\system32\icuin.dll
    2021-01-03 02:48 - 2021-01-03 02:48 - 000001370 _____ C:\WINDOWS\system32\ThirdPartyNoticesBySHS.txt
    2021-01-03 02:47 - 2021-01-03 02:47 - 004227116 _____ C:\WINDOWS\system32\DefaultHrtfs.bin
    2021-01-03 02:47 - 2021-01-03 02:47 - 000287232 _____ C:\WINDOWS\system32\CoreMas.dll
    2021-01-03 02:47 - 2021-01-03 02:47 - 000197632 _____ C:\WINDOWS\system32\IHDS.dll
    2021-01-03 02:47 - 2021-01-03 02:47 - 000089088 _____ C:\WINDOWS\system32\windows.applicationmodel.conversationalagent.proxystub.dll
    2021-01-03 02:47 - 2021-01-03 02:47 - 000073216 _____ C:\WINDOWS\system32\windows.applicationmodel.conversationalagent.internal.proxystub.dll
    2021-01-03 02:47 - 2021-01-03 02:47 - 000064552 _____ C:\WINDOWS\system32\umpdc.dll
    2021-01-03 02:47 - 2021-01-03 02:47 - 000030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\msacm32.drv
    2021-01-03 02:47 - 2021-01-03 02:47 - 000013312 _____ C:\WINDOWS\system32\agentactivationruntimestarter.exe
    2021-01-03 02:34 - 2021-01-03 02:34 - 000000000 ____D C:\Program Files\Reference Assemblies
    2021-01-03 02:34 - 2021-01-03 02:34 - 000000000 ____D C:\Program Files\MSBuild
    2021-01-03 02:34 - 2021-01-03 02:34 - 000000000 ____D C:\Program Files (x86)\Reference Assemblies
    2021-01-03 02:34 - 2021-01-03 02:34 - 000000000 ____D C:\Program Files (x86)\MSBuild
    2021-01-03 01:24 - 2021-01-03 01:24 - 000000000 ____D C:\ProgramData\Microsoft OneDrive
    2021-01-03 01:21 - 2021-01-03 01:21 - 000000020 ___SH C:\Users\ronny\ntuser.ini
    2021-01-03 01:20 - 2021-01-22 19:25 - 000004142 _____ C:\WINDOWS\system32\Tasks\User_Feed_Synchronization-{6C960934-DC27-4EFF-89D5-F77C012D2312}
    2021-01-03 01:20 - 2021-01-21 14:18 - 000000000 ____D C:\WINDOWS\system32\Tasks\NCH Software
    2021-01-03 01:20 - 2021-01-20 19:52 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
    2021-01-03 01:20 - 2021-01-20 11:43 - 000004210 _____ C:\WINDOWS\system32\Tasks\CCleaner Update
    2021-01-03 01:20 - 2021-01-19 17:57 - 000003480 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
    2021-01-03 01:20 - 2021-01-03 01:20 - 000003706 _____ C:\WINDOWS\system32\Tasks\Adobe Flash Player NPAPI Notifier
    2021-01-03 01:20 - 2021-01-03 01:20 - 000003482 _____ C:\WINDOWS\system32\Tasks\Adobe Acrobat Update Task
    2021-01-03 01:20 - 2021-01-03 01:20 - 000003404 _____ C:\WINDOWS\system32\Tasks\Adobe Flash Player Updater
    2021-01-03 01:20 - 2021-01-03 01:20 - 000003346 _____ C:\WINDOWS\system32\Tasks\GoogleUpdateTaskMachineUA
    2021-01-03 01:20 - 2021-01-03 01:20 - 000003184 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore
    2021-01-03 01:20 - 2021-01-03 01:20 - 000003122 _____ C:\WINDOWS\system32\Tasks\GoogleUpdateTaskMachineCore
    2021-01-03 01:20 - 2021-01-03 01:20 - 000002978 _____ C:\WINDOWS\system32\Tasks\EOSv3 Scheduler onLogOn
    2021-01-03 01:20 - 2021-01-03 01:20 - 000002854 _____ C:\WINDOWS\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-687888615-3449104039-937635755-1001
    2021-01-03 01:20 - 2021-01-03 01:20 - 000002850 _____ C:\WINDOWS\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-687888615-3449104039-937635755-500
    2021-01-03 01:20 - 2021-01-03 01:20 - 000002682 _____ C:\WINDOWS\system32\Tasks\Maxthon Update
    2021-01-03 01:20 - 2021-01-03 01:20 - 000002598 _____ C:\WINDOWS\system32\Tasks\EOSv3 Scheduler onTime
    2021-01-03 01:20 - 2021-01-03 01:20 - 000002234 _____ C:\WINDOWS\system32\Tasks\CCleanerSkipUAC
    2021-01-03 01:20 - 2021-01-03 01:20 - 000000000 ____D C:\WINDOWS\system32\Tasks\Mozilla
    2021-01-03 01:20 - 2019-10-23 14:26 - 000002852 _____ C:\WINDOWS\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-2550722309-3792821881-174194002-500
    2021-01-03 01:20 - 2019-10-23 13:36 - 000003388 _____ C:\WINDOWS\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-2303179964-73108507-2273461309-500
    2021-01-03 01:18 - 2021-01-03 01:20 - 000007623 _____ C:\WINDOWS\diagwrn.xml
    2021-01-03 01:18 - 2021-01-03 01:20 - 000007623 _____ C:\WINDOWS\diagerr.xml
    2021-01-03 01:17 - 2021-01-20 19:58 - 000840598 _____ C:\WINDOWS\system32\PerfStringBackup.INI
    2021-01-03 01:08 - 2021-01-21 14:24 - 000000000 ____D C:\Users\ronny
    2021-01-03 01:08 - 2019-12-07 03:10 - 000001105 _____ C:\Users\ronny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
    2021-01-03 01:06 - 2020-06-01 04:04 - 000103744 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.DLL
    2021-01-03 01:06 - 2020-06-01 04:04 - 000099640 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.DLL
    2021-01-03 01:03 - 2021-01-22 18:27 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
    2021-01-03 01:03 - 2021-01-14 03:45 - 000444392 _____ C:\WINDOWS\system32\FNTCACHE.DAT
    2021-01-03 01:02 - 2021-01-20 19:52 - 000008192 ___SH C:\DumpStack.log.tmp
    2020-12-29 18:55 - 2021-01-20 11:55 - 000000000 ___DC C:\WINDOWS\Panther
    2020-12-29 18:44 - 2020-12-29 18:44 - 000000000 ___HD C:\$WinREAgent
    2020-12-29 10:24 - 2020-12-29 10:24 - 083364488 _____ (Oracle Corporation) C:\Users\ronny\Downloads\jre-8u271-windows-x64.exe
    2020-12-29 09:56 - 2021-01-03 03:02 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maxthon Cloud Browser
    2020-12-29 09:56 - 2020-12-29 09:56 - 000001226 _____ C:\Users\Public\Desktop\Maxthon Cloud Browser.lnk
    2020-12-29 09:56 - 2020-12-29 09:56 - 000001226 _____ C:\ProgramData\Desktop\Maxthon Cloud Browser.lnk
    2020-12-29 09:56 - 2020-12-29 09:56 - 000000000 ____D C:\Users\ronny\AppData\Roaming\Maxthon3
    2020-12-29 09:56 - 2020-12-29 09:56 - 000000000 ____D C:\Program Files (x86)\Maxthon
    2020-12-29 09:55 - 2020-12-29 09:55 - 048100816 _____ (Maxthon International ltd.) C:\Users\ronny\Downloads\mx4.9.5.1000.exe
    2020-12-29 09:43 - 2021-01-22 14:10 - 000000000 ____D C:\Users\ronny\AppData\Local\vback
    2020-12-29 09:43 - 2020-12-29 09:43 - 000000000 ____D C:\Users\ronny\AppData\Roaming\VBox
    2020-12-29 09:42 - 2020-12-29 09:43 - 000000000 ____D C:\Users\ronny\AppData\Local\Maxthon
    2020-12-29 09:42 - 2020-12-29 09:42 - 000002392 _____ C:\Users\ronny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maxthon.lnk
    2020-12-28 19:29 - 2020-12-28 19:29 - 042105776 _____ C:\Users\ronny\Downloads\Firefox Setup 40.0.2 (1).exe
    2020-12-28 17:28 - 2020-12-28 17:29 - 042105776 _____ C:\Users\ronny\Downloads\Firefox Setup 40.0.2.exe
    2020-12-27 15:21 - 2020-12-27 15:21 - 000000000 ____D C:\Users\ronny\OneDrive\Documents\Audacity
    2020-12-27 15:07 - 2020-12-27 15:54 - 000000000 ____D C:\Users\ronny\AppData\Roaming\audacity
    2020-12-27 15:07 - 2020-12-27 15:07 - 000000000 ____D C:\Users\ronny\AppData\Local\Audacity
    2020-12-27 15:06 - 2020-12-27 15:07 - 028141904 _____ (Audacity Team ) C:\Users\ronny\Downloads\audacity-win-2.4.2.exe
    2020-12-27 14:41 - 2020-12-27 14:41 - 002170400 _____ (NCH Software) C:\Users\ronny\Downloads\WavePadAudioEditingSoftware (1).exe
    2020-12-27 14:38 - 2020-12-27 14:38 - 000001162 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VRS Recording System.lnk
    2020-12-27 14:29 - 2020-12-27 14:29 - 000787160 _____ (NCH Software) C:\Users\ronny\Downloads\soundtap-4-01-2017-09-28.exe
    2020-12-27 14:29 - 2020-12-27 14:29 - 000001167 _____ C:\Users\ronny\AppData\Roaming\trace_FilterInstaller.txt
    2020-12-27 14:29 - 2020-12-27 14:29 - 000000000 _____ C:\Users\ronny\AppData\Roaming\trace_FilterInstaller.txt-CRT.txt
    2020-12-27 14:25 - 2020-12-27 14:25 - 000736344 _____ (NCH Software) C:\Users\ronny\Downloads\clickcharts-4-01-2019-01-17.exe
    2020-12-25 08:52 - 2020-12-25 08:52 - 000000000 ____D C:\Users\ronny\AppData\Local\Evoluent
    2020-12-25 08:51 - 2020-12-25 08:51 - 000020274 _____ C:\WINDOWS\system32\cc_20201225_085032.reg
    2020-12-24 22:30 - 2020-12-24 22:30 - 000000000 ____D C:\Users\ronny\AppData\Local\Visicom Media
    2020-12-24 11:23 - 2020-12-24 11:24 - 009792010 _____ C:\Users\ronny\Downloads\E5C9A275-7477-42EB-A324-9C408ABF984A.mov

    ==================== One month (modified) ==================

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2021-01-22 19:39 - 2019-12-07 03:14 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
    2021-01-22 18:40 - 2020-12-18 20:01 - 000002315 _____ C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
    2021-01-22 18:40 - 2020-12-18 20:01 - 000002315 _____ C:\ProgramData\Desktop\Tweaking.com - Registry Backup.lnk
    2021-01-22 11:35 - 2020-12-14 23:35 - 000000000 ____D C:\Program Files\CCleaner
    2021-01-22 02:19 - 2019-12-07 03:14 - 000000000 ___HD C:\Program Files\WindowsApps
    2021-01-22 02:19 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\AppReadiness
    2021-01-22 01:30 - 2020-07-01 22:15 - 000799104 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
    2021-01-21 02:33 - 2020-07-03 00:16 - 000000000 ____D C:\Users\ronny\AppData\Local\ElevatedDiagnostics
    2021-01-20 19:58 - 2019-12-07 03:13 - 000000000 ____D C:\WINDOWS\INF
    2021-01-20 19:53 - 2020-07-01 21:15 - 000000000 ___RD C:\Users\ronny\OneDrive
    2021-01-20 19:53 - 2020-06-08 10:08 - 000000180 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
    2021-01-20 11:42 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\system32\NDF
    2021-01-20 11:40 - 2019-12-07 03:03 - 000524288 _____ C:\WINDOWS\system32\config\BBI
    2021-01-18 05:17 - 2020-11-12 21:07 - 000000000 ____D C:\Users\ronny\AppData\Local\CrashDumps
    2021-01-14 14:18 - 2020-11-05 00:53 - 000002070 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WavePad Sound Editor.lnk
    2021-01-14 14:18 - 2020-11-05 00:53 - 000002026 _____ C:\Users\Public\Desktop\WavePad Sound Editor.lnk
    2021-01-14 14:18 - 2020-11-05 00:53 - 000002026 _____ C:\ProgramData\Desktop\WavePad Sound Editor.lnk
    2021-01-14 14:18 - 2020-07-15 22:54 - 000054664 _____ C:\WINDOWS\system32\Drivers\stdriverx64.sys
    2021-01-14 14:18 - 2020-07-15 22:54 - 000001366 _____ C:\Users\Public\Desktop\NCH Suite.lnk
    2021-01-14 14:18 - 2020-07-15 22:54 - 000001366 _____ C:\ProgramData\Desktop\NCH Suite.lnk
    2021-01-14 14:18 - 2020-07-15 22:54 - 000001250 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SoundTap Streaming Audio Recorder.lnk
    2021-01-14 14:18 - 2020-07-15 22:54 - 000001238 _____ C:\Users\Public\Desktop\SoundTap Streaming Audio Recorder.lnk
    2021-01-14 14:18 - 2020-07-15 22:54 - 000001238 _____ C:\ProgramData\Desktop\SoundTap Streaming Audio Recorder.lnk
    2021-01-14 09:44 - 2020-07-01 21:12 - 000000000 __SHD C:\Users\ronny\IntelGraphicsProfiles
    2021-01-14 03:41 - 2019-12-07 03:52 - 000000000 ____D C:\Program Files\Windows Photo Viewer
    2021-01-14 03:41 - 2019-12-07 03:52 - 000000000 ____D C:\Program Files (x86)\Windows Photo Viewer
    2021-01-14 03:41 - 2019-12-07 03:14 - 000000000 ___SD C:\WINDOWS\SysWOW64\F12
    2021-01-14 03:41 - 2019-12-07 03:14 - 000000000 ___SD C:\WINDOWS\SysWOW64\DiagSvcs
    2021-01-14 03:41 - 2019-12-07 03:14 - 000000000 ___SD C:\WINDOWS\system32\UNP
    2021-01-14 03:41 - 2019-12-07 03:14 - 000000000 ___SD C:\WINDOWS\system32\F12
    2021-01-14 03:41 - 2019-12-07 03:14 - 000000000 ___SD C:\WINDOWS\system32\DiagSvcs
    2021-01-14 03:41 - 2019-12-07 03:14 - 000000000 ___RD C:\WINDOWS\PrintDialog
    2021-01-14 03:41 - 2019-12-07 03:14 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
    2021-01-14 03:41 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\SysWOW64\setup
    2021-01-14 03:41 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\SysWOW64\PerceptionSimulation
    2021-01-14 03:41 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\SysWOW64\oobe
    2021-01-14 03:41 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
    2021-01-14 03:41 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\SysWOW64\Com
    2021-01-14 03:41 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\SysWOW64\AdvancedInstallers
    2021-01-14 03:41 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\SystemResources
    2021-01-14 03:41 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\system32\WinBioPlugIns
    2021-01-14 03:41 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\system32\SystemResetPlatform
    2021-01-14 03:41 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\system32\Sysprep
    2021-01-14 03:41 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\system32\setup
    2021-01-14 03:41 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\system32\PerceptionSimulation
    2021-01-14 03:41 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\system32\oobe
    2021-01-14 03:41 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\system32\Dism
    2021-01-14 03:41 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\system32\Com
    2021-01-14 03:41 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\system32\AdvancedInstallers
    2021-01-14 03:41 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\ShellExperiences
    2021-01-14 03:41 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\ShellComponents
    2021-01-14 03:41 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\Provisioning
    2021-01-14 03:41 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\IME
    2021-01-14 03:41 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\bcastdvr
    2021-01-14 03:41 - 2019-12-07 03:14 - 000000000 ____D C:\Program Files\Windows Defender
    2021-01-13 09:02 - 2019-12-07 03:03 - 000000000 ____D C:\WINDOWS\CbsTemp
    2021-01-13 09:01 - 2019-12-07 03:03 - 000000000 ____D C:\WINDOWS\servicing
    2021-01-13 08:27 - 2020-07-02 01:27 - 000000000 ____D C:\WINDOWS\system32\MRT
    2021-01-13 08:25 - 2020-07-02 01:27 - 135062968 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
    2021-01-11 14:23 - 2019-10-23 14:40 - 000002308 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
    2021-01-11 14:23 - 2019-10-23 14:40 - 000002267 _____ C:\Users\Public\Desktop\Google Chrome.lnk
    2021-01-11 14:23 - 2019-10-23 14:40 - 000002267 _____ C:\ProgramData\Desktop\Google Chrome.lnk
    2021-01-10 08:57 - 2020-07-01 21:06 - 000000000 ____D C:\WINDOWS\SysWOW64\RTCOM
    2021-01-10 08:57 - 2020-07-01 21:06 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Music, Photos and Videos
    2021-01-09 16:41 - 2020-07-02 13:13 - 000000000 ____D C:\Users\ronny\AppData\Local\D3DSCache
    2021-01-09 14:03 - 2020-07-19 07:00 - 000002445 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
    2021-01-09 14:03 - 2020-07-19 07:00 - 000002283 _____ C:\Users\Public\Desktop\Microsoft Edge.lnk
    2021-01-09 14:03 - 2020-07-19 07:00 - 000002283 _____ C:\ProgramData\Desktop\Microsoft Edge.lnk
    2021-01-03 03:15 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\appcompat
    2021-01-03 03:02 - 2020-12-14 23:35 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
    2021-01-03 03:02 - 2020-11-16 00:50 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Easy Thumbnails
    2021-01-03 03:02 - 2020-10-30 09:51 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ocenaudio
    2021-01-03 03:02 - 2020-09-05 14:07 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Karaoke Builder Player 5.0
    2021-01-03 03:02 - 2020-09-05 13:11 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kanto Player
    2021-01-03 03:02 - 2020-07-11 00:31 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\e2eSoft VCam
    2021-01-03 03:02 - 2020-07-02 18:49 - 000000000 ____D C:\Program Files\UNP
    2021-01-03 03:02 - 2020-07-01 21:06 - 000000000 ____D C:\WINDOWS\system32\SRSLabs
    2021-01-03 03:02 - 2020-06-08 10:08 - 000000000 ____D C:\Program Files\Intel
    2021-01-03 03:02 - 2019-12-07 03:18 - 000000000 ____D C:\WINDOWS\Setup
    2021-01-03 03:02 - 2019-12-07 03:14 - 000028672 _____ C:\WINDOWS\system32\config\BCD-Template
    2021-01-03 03:02 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed
    2021-01-03 03:02 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\system32\WinBioDatabase
    2021-01-03 03:02 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\system32\spool
    2021-01-03 03:02 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\system32\Macromed
    2021-01-03 03:02 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\LiveKernelReports
    2021-01-03 03:02 - 2019-10-23 14:38 - 000000000 ___SD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice 6.1
    2021-01-03 03:02 - 2019-03-18 22:52 - 000000000 ____D C:\WINDOWS\system32\Tasks_Migrated
    2021-01-03 03:02 - 2019-03-18 22:52 - 000000000 ____D C:\WINDOWS\system32\MsDtc
    2021-01-03 02:59 - 2020-12-18 20:01 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
    2021-01-03 02:59 - 2020-06-08 13:27 - 000000000 ____D C:\Program Files\Synaptics
    2021-01-03 02:56 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\SysWOW64\WinMetadata
    2021-01-03 02:56 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\SysWOW64\migwiz
    2021-01-03 02:56 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\system32\WinMetadata
    2021-01-03 02:56 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\system32\ShellExperiences
    2021-01-03 02:56 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\system32\migwiz
    2021-01-03 02:56 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\system32\es-MX
    2021-01-03 02:56 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\system32\appraiser
    2021-01-03 02:56 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
    2021-01-03 02:56 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\DiagTrack
    2021-01-03 02:56 - 2019-12-07 03:14 - 000000000 ____D C:\Program Files\Common Files\System
    2021-01-03 02:56 - 2019-12-07 03:14 - 000000000 ____D C:\Program Files (x86)\Windows Defender
    2021-01-03 02:54 - 2019-12-07 03:52 - 000023552 _____ (Microsoft Corporation) C:\WINDOWS\system32\OEMDefaultAssociations.dll
    2021-01-03 02:54 - 2019-12-07 03:52 - 000020908 _____ C:\WINDOWS\system32\OEMDefaultAssociations.xml
    2021-01-03 01:39 - 2020-07-01 21:12 - 000000000 ____D C:\Users\ronny\AppData\Local\Packages
    2021-01-03 01:23 - 2019-12-07 03:14 - 000000000 ____D C:\ProgramData\USOPrivate
    2021-01-03 01:22 - 2020-07-01 21:12 - 000000000 ___RD C:\Users\ronny\3D Objects
    2021-01-03 01:22 - 2019-10-23 13:34 - 000000000 __RHD C:\Users\Public\AccountPictures
    2021-01-03 01:22 - 2019-10-23 13:34 - 000000000 ____D C:\ProgramData\Packages
    2021-01-03 01:20 - 2019-12-07 03:03 - 000032768 _____ C:\WINDOWS\system32\config\ELAM
    2021-01-03 01:13 - 2019-12-07 03:14 - 000000000 __RHD C:\Users\Public\Libraries
    2021-01-03 01:09 - 2020-07-16 21:28 - 000000000 ____D C:\Users\ronny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ASIO4ALL v2
    2021-01-03 01:09 - 2020-07-12 10:01 - 000000000 ____D C:\Users\ronny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Paltalk
    2021-01-03 01:09 - 2020-07-10 04:03 - 000000000 ____D C:\Users\ronny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dwyco CDC-X
    2021-01-03 01:09 - 2020-07-09 12:04 - 000000000 ____D C:\Users\ronny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon Music
    2021-01-03 01:07 - 2020-07-02 21:57 - 000000000 ____D C:\Program Files\Common Files\logishrd
    2021-01-03 01:06 - 2020-09-24 03:44 - 000000200 _____ C:\WINDOWS\system32\{EC94D02F-D200-4428-9531-05AF7F9799CB}.bat
    2021-01-03 01:03 - 2019-12-07 03:14 - 000000000 ____D C:\WINDOWS\ServiceState
    2020-12-31 13:38 - 2020-07-01 21:28 - 000000000 ____D C:\Users\ronny\AppData\LocalLow\Mozilla
    2020-12-29 18:08 - 2020-07-01 21:28 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
    2020-12-29 09:47 - 2020-07-01 21:28 - 000001012 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
    2020-12-29 09:47 - 2020-07-01 21:28 - 000000000 ____D C:\Program Files\Mozilla Firefox
    2020-12-28 19:30 - 2020-07-17 19:18 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
    2020-12-28 19:30 - 2020-07-13 08:10 - 000001223 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
    2020-12-28 19:30 - 2020-07-13 08:10 - 000001223 _____ C:\ProgramData\Desktop\Mozilla Firefox.lnk
    2020-12-28 19:30 - 2020-07-01 21:37 - 000001235 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
    2020-12-28 18:11 - 2020-12-20 01:01 - 000000000 ____D C:\Program Files (x86)\ManyCam
    2020-12-27 14:38 - 2020-07-15 22:54 - 000000000 ____D C:\ProgramData\NCH Software
    2020-12-27 14:38 - 2020-07-15 22:54 - 000000000 ____D C:\Program Files (x86)\NCH Software
    2020-12-27 14:21 - 2020-10-30 11:57 - 000000000 ____D C:\Users\ronny\AppData\Roaming\ocenaudio
    2020-12-25 08:54 - 2020-12-15 21:59 - 000000000 ____D C:\Users\ronny\AppData\Roaming\Logishrd
    2020-12-25 08:54 - 2020-12-15 21:58 - 000000000 ____D C:\Program Files\Logitech
    2020-12-25 08:52 - 2020-07-01 21:12 - 000000000 ____D C:\Users\ronny\AppData\Local\VirtualStore

    ==================== Files in the root of some directories ========

    2020-12-27 14:29 - 2020-12-27 14:29 - 000001167 _____ () C:\Users\ronny\AppData\Roaming\trace_FilterInstaller.txt
    2020-12-27 14:29 - 2020-12-27 14:29 - 000000000 _____ () C:\Users\ronny\AppData\Roaming\trace_FilterInstaller.txt-CRT.txt
    2020-07-10 04:21 - 2020-07-10 04:21 - 000003584 _____ () C:\Users\ronny\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

    ==================== SigCheck ============================

    (There is no automatic fix for files that do not pass verification.)

    ==================== End of FRST.txt ========================

    Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-01-2021
    Ran by ronny (22-01-2021 19:42:58)
    Running from C:\Users\ronny\OneDrive\Desktop
    Windows 10 Home Version 20H2 19042.746 (X64) (2021-01-03 07:21:13)
    Boot Mode: Normal
    ==========================================================


    ==================== Accounts: =============================

    Administrator (S-1-5-21-687888615-3449104039-937635755-500 - Administrator - Disabled)
    DefaultAccount (S-1-5-21-687888615-3449104039-937635755-503 - Limited - Disabled)
    Guest (S-1-5-21-687888615-3449104039-937635755-501 - Limited - Disabled)
    ronny (S-1-5-21-687888615-3449104039-937635755-1001 - Administrator - Enabled) => C:\Users\ronny
    WDAGUtilityAccount (S-1-5-21-687888615-3449104039-937635755-504 - Limited - Disabled)

    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}

    ==================== Installed Programs ======================

    (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    (7) Facebook (HKU\S-1-5-21-687888615-3449104039-937635755-1001\...\876d02b7a154c12acc74dbe21dbbc4a7) (Version: 1.0 - (7) Facebook)
    8 Ball Pool - A free Sports Game (HKU\S-1-5-21-687888615-3449104039-937635755-1001\...\f2e784ea14e2058dcbf097ec01441184) (Version: 1.0 - 8 Ball Pool - A free Sports Game)
    Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 20.013.20074 - Adobe Systems Incorporated)
    Adobe Flash Player 32 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 32.0.0.465 - Adobe)
    ASIO4ALL (HKLM-x32\...\ASIO4ALL) (Version: 2.14 - Michael Tippach)
    Blue Sherpa (HKLM\...\{DF4B2C22-DFD0-4A11-AFBE-ADBC87F92853}) (Version: 1.4.16 - Blue Microphones) Hidden
    Blue Sherpa (HKLM-x32\...\Blue Sherpa) (Version: 1.4.16 - Blue Microphones)
    Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
    Cannon Balls 3D - Play Cannon Balls 3D on Crazy Games (HKU\S-1-5-21-687888615-3449104039-937635755-1001\...\5be0c4916bb74b139b07376939538cf5) (Version: 1.0 - Cannon Balls 3D - Play Cannon Balls 3D on Crazy Games)
    CCleaner (HKLM\...\CCleaner) (Version: 5.75 - Piriform)
    Documentation Manager (HKLM\...\{82FBBBC9-616A-4247-BEAD-87B8132D49D2}) (Version: 22.0.0.6 - Intel Corporation) Hidden
    Dropbox (HKLM-x32\...\Dropbox) (Version: 113.4.507 - Dropbox, Inc.)
    Dropbox Update Helper (HKLM-x32\...\{099218A5-A723-43DC-8DB5-6173656A1E94}) (Version: 1.3.415.1 - Dropbox, Inc.) Hidden
    Dwyco CDC-X version 2.30 (HKU\S-1-5-21-687888615-3449104039-937635755-1001\...\Dwyco CDC-X_is1) (Version: 2.30 - Dwyco, Inc.)
    Easy Thumbnails (Remove only) (HKLM-x32\...\Easy Thumbnails_is1) (Version: 3.0 - Fookes Software)
    Featured Songs _ SingSnap Karaoke (HKU\S-1-5-21-687888615-3449104039-937635755-1001\...\5c7ad6f550c744e9a98014f78df7bc92) (Version: 1.0 - Featured Songs _ SingSnap Karaoke)
    Google Chrome (HKLM-x32\...\Google Chrome) (Version: 87.0.4280.141 - Google LLC)
    Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.36.51 - Google LLC) Hidden
    HP Support Assistant (HKLM-x32\...\{54ECA61C-83AE-4EE3-A9F7-848155A33386}) (Version: 8.8.34.31 - HP Inc.)
    HP Support Solutions Framework (HKLM-x32\...\{D0873D1A-C420-483C-A2B7-08AACD6CAC00}) (Version: 12.18.34.21 - HP Inc.)
    Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 20.19.15.5126 - Intel Corporation)
    Intel® Software Installer (HKLM-x32\...\{056c22c9-0ef2-4a10-ba00-4d68d16c5669}) (Version: 22.0.0.6 - Intel Corporation) Hidden
    Java 8 Update 281 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180281F0}) (Version: 8.0.2810.9 - Oracle Corporation)
    Kanto Player version 12.0.0.0 (HKLM-x32\...\{B3749D9E-AFD6-49D6-8F40-4722B45859FF}_is1) (Version: 12.0.0.0 - Globosoft S.R.L.)
    Karaoke Builder Player 5.0 (HKLM-x32\...\{A9DDC2FC-2028-47E9-847C-0CFA77181C83}_is1) (Version: 5.0.0.528 - Gisburne Media)
    LibreOffice 6.1.6.3 (HKLM\...\{FDD378C0-438D-4E89-A692-6D010D5AF9D0}) (Version: 6.1.6.3 - The Document Foundation)
    Malwarebytes version 4.3.0.98 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 4.3.0.98 - Malwarebytes)
    Maxthon (HKU\S-1-5-21-687888615-3449104039-937635755-1001\...\Maxthon) (Version: 6.1.0.2000 - Maxthon Ltd.)
    Maxthon Cloud Browser (HKLM-x32\...\Maxthon3) (Version: 4.9.5.1000 - Maxthon International Limited)
    Microsoft Edge (HKLM-x32\...\Microsoft Edge) (Version: 87.0.664.75 - Microsoft Corporation)
    Microsoft Edge Update (HKLM-x32\...\Microsoft Edge Update) (Version: 1.3.139.71 - )
    Microsoft OneDrive (HKU\S-1-5-21-687888615-3449104039-937635755-1001\...\OneDriveSetup.exe) (Version: 20.201.1005.0009 - Microsoft Corporation)
    Microsoft Update Health Tools (HKLM\...\{0BCA8FBE-0C1C-4C65-98A3-5D34AAF41737}) (Version: 2.70.0.0 - Microsoft Corporation)
    Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
    Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24212 (HKLM-x32\...\{323dad84-0974-4d90-a1c1-e006c7fdbb7d}) (Version: 14.0.24212.0 - Microsoft Corporation)
    Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23026 (HKLM-x32\...\{74d0e5db-b326-4dae-a6b2-445b9de1836e}) (Version: 14.0.23026.0 - Microsoft Corporation)
    Mozilla Firefox 40.0.2 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 40.0.2 (x86 en-US)) (Version: 40.0.2 - Mozilla)
    Mozilla Firefox 78.6.0 ESR (x64 en-US) (HKLM\...\Mozilla Firefox 78.6.0 ESR (x64 en-US)) (Version: 78.6.0 - Mozilla)
    Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 78.6.0 - Mozilla)
    ocenaudio (HKLM-x32\...\ocenaudio) (Version: 3.9.5 - Ocenaudio Team)
    Paltalk (HKLM-x32\...\Paltalk) (Version: - )
    PhotoPad Image Editor (HKLM-x32\...\PhotoPad) (Version: 6.42 - NCH Software)
    Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.8328 - Realtek Semiconductor Corp.)
    RecordPad Sound Recorder (HKLM-x32\...\Recordpad) (Version: 9.03 - NCH Software)
    SoundTap Streaming Audio Recorder (HKLM-x32\...\SoundTap) (Version: 6.09 - NCH Software)
    Tweaking.com - Registry Backup (HKLM-x32\...\Tweaking.com - Registry Backup) (Version: 3.5.3 - Tweaking.com)
    Unity Web Player (x64) (All users) (HKLM\...\UnityWebPlayer) (Version: 4.6.6f2 - Unity Technologies ApS)
    VRS Recording System (HKLM-x32\...\VRS) (Version: 5.48 - NCH Software)
    WavePad Sound Editor (HKLM-x32\...\WavePad) (Version: 11.44 - NCH Software)
    Y8 Browser 1.0.8 (HKU\S-1-5-21-687888615-3449104039-937635755-1001\...\a6611861-70b4-5ed8-b9ef-d6448267637c) (Version: 1.0.8 - Y8 Games)

    Packages:
    =========
    All Video Player HD -> C:\Program Files\WindowsApps\22450.TotalVideoPlayer_2.0.29.0_x64__0aqw1zw0x2snt [2021-01-22] (韵华软件)
    Farkle Free!! -> C:\Program Files\WindowsApps\IronjawStudiosPrivateLimi.FarkleFree_1.1.0.0_x86__0ah1jqwq7j8nj [2020-12-11] (Ironjaw Studios Private Limited) [MS Ad]
    Mail -> C:\Program Files\WindowsApps\40811eyack.com.MAIL_10.1703.43.0_x64__xsbsxxypt8dh6 [2021-01-22] (eyacker.com)
    Media Player - All Formats, Video Player All Formats -> C:\Program Files\WindowsApps\2725Swisspix.MediaPlayer-AllFormatsVideoPlayerAllF_1.1.10.0_x64__q68sgvev02mx6 [2021-01-05] (Swisspix) [MS Ad]
    Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x64__8wekyb3d8bbwe [2021-01-03] (Microsoft Corporation) [MS Ad]
    Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x86__8wekyb3d8bbwe [2021-01-03] (Microsoft Corporation) [MS Ad]
    Microsoft Solitaire Collection -> C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.9.1102.0_x64__8wekyb3d8bbwe [2021-01-14] (Microsoft Studios) [MS Ad]
    Photos Add-on -> C:\Program Files\WindowsApps\Microsoft.Windows.Photos.DLC.Main_2017.39121.36610.0_x64__8wekyb3d8bbwe [2020-11-22] (Microsoft Corporation)
    Photos Media Engine Add-on -> C:\Program Files\WindowsApps\Microsoft.Photos.MediaEngineDLC_1.0.0.0_x64__8wekyb3d8bbwe [2020-11-22] (Microsoft Corporation)

    ==================== Custom CLSID (Whitelisted): ==============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    CustomCLSID: HKU\S-1-5-21-687888615-3449104039-937635755-1001_Classes\CLSID\{635EFA6F-08D6-4EC9-BD14-8A0FDE975159}\localserver32 -> C:\Users\ronny\AppData\Local\Maxthon\Application\6.1.0.2000\notification_helper.exe (Maxthon Technology Co, Ltd. -> Maxthon Ltd.)
    CustomCLSID: HKU\S-1-5-21-687888615-3449104039-937635755-1001_Classes\CLSID\{E31EA727-12ED-4702-820C-4B6445F28E1A} -> [Dropbox] => C:\Users\ronny\Dropbox [2021-01-21 14:24]
    ShellIconOverlayIdentifiers: [ DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.46.0.dll [2021-01-13] (Dropbox, Inc -> Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.46.0.dll [2021-01-13] (Dropbox, Inc -> Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.46.0.dll [2021-01-13] (Dropbox, Inc -> Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.46.0.dll [2021-01-13] (Dropbox, Inc -> Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.46.0.dll [2021-01-13] (Dropbox, Inc -> Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.46.0.dll [2021-01-13] (Dropbox, Inc -> Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.46.0.dll [2021-01-13] (Dropbox, Inc -> Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.46.0.dll [2021-01-13] (Dropbox, Inc -> Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.46.0.dll [2021-01-13] (Dropbox, Inc -> Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [ DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.46.0.dll [2021-01-13] (Dropbox, Inc -> Dropbox, Inc.)
    ShellIconOverlayIdentifiers-x32: [ DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.46.0.dll [2021-01-13] (Dropbox, Inc -> Dropbox, Inc.)
    ShellIconOverlayIdentifiers-x32: [ DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.46.0.dll [2021-01-13] (Dropbox, Inc -> Dropbox, Inc.)
    ShellIconOverlayIdentifiers-x32: [ DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.46.0.dll [2021-01-13] (Dropbox, Inc -> Dropbox, Inc.)
    ShellIconOverlayIdentifiers-x32: [ DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.46.0.dll [2021-01-13] (Dropbox, Inc -> Dropbox, Inc.)
    ShellIconOverlayIdentifiers-x32: [ DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.46.0.dll [2021-01-13] (Dropbox, Inc -> Dropbox, Inc.)
    ShellIconOverlayIdentifiers-x32: [ DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.46.0.dll [2021-01-13] (Dropbox, Inc -> Dropbox, Inc.)
    ShellIconOverlayIdentifiers-x32: [ DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.46.0.dll [2021-01-13] (Dropbox, Inc -> Dropbox, Inc.)
    ShellIconOverlayIdentifiers-x32: [ DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.46.0.dll [2021-01-13] (Dropbox, Inc -> Dropbox, Inc.)
    ShellIconOverlayIdentifiers-x32: [ DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.46.0.dll [2021-01-13] (Dropbox, Inc -> Dropbox, Inc.)
    ShellIconOverlayIdentifiers-x32: [ DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.46.0.dll [2021-01-13] (Dropbox, Inc -> Dropbox, Inc.)
    ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => -> No File
    ContextMenuHandlers1: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} => -> No File
    ContextMenuHandlers1: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} => -> No File
    ContextMenuHandlers1: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.46.0.dll [2021-01-13] (Dropbox, Inc -> Dropbox, Inc.)
    ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2020-07-06] (Malwarebytes Corporation -> Malwarebytes)
    ContextMenuHandlers3: [{4A7C4306-57E0-4C0C-83A9-78C1528F618C}] -> {4A7C4306-57E0-4C0C-83A9-78C1528F618C} => -> No File
    ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => -> No File
    ContextMenuHandlers4: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.46.0.dll [2021-01-13] (Dropbox, Inc -> Dropbox, Inc.)
    ContextMenuHandlers4: [Offline Files] -> {474C98EE-CF3D-41f5-80E3-4AAB0AB04301} => -> No File
    ContextMenuHandlers5: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.46.0.dll [2021-01-13] (Dropbox, Inc -> Dropbox, Inc.)
    ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File
    ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\system32\igfxDTCM.dll [2020-06-01] (Microsoft Windows Hardware Compatibility Publisher -> Intel Corporation)
    ContextMenuHandlers6: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} => -> No File
    ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2020-07-06] (Malwarebytes Corporation -> Malwarebytes)
    ContextMenuHandlers6: [Offline Files] -> {474C98EE-CF3D-41f5-80E3-4AAB0AB04301} => -> No File

    ==================== Codecs (Whitelisted) ====================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Drivers32: [vidc.i420] => C:\WINDOWS\system32\lvcod64.dll [175392 2012-10-26] (Logitech, Inc. -> Logitech Inc.)
    HKLM\...\Drivers32: [vidc.i420] => C:\Windows\SysWOW64\lvcodec2.dll [305000 2012-10-26] (Logitech, Inc. -> Logitech Inc.)

    ==================== Shortcuts & WMI ========================

    ==================== Loaded Modules (Whitelisted) =============

    2021-01-22 02:34 - 2021-01-22 02:34 - 002131456 _____ () [File not signed] C:\Users\ronny\AppData\Local\Programs\y8-browser\ffmpeg.dll
    2021-01-22 02:34 - 2021-01-22 02:34 - 000140288 _____ () [File not signed] C:\Users\ronny\AppData\Local\Programs\y8-browser\libegl.dll
    2021-01-22 02:34 - 2021-01-22 02:34 - 005425152 _____ () [File not signed] C:\Users\ronny\AppData\Local\Programs\y8-browser\libglesv2.dll

    ==================== Alternate Data Streams (Whitelisted) ========

    ==================== Safe Mode (Whitelisted) ==================

    ==================== Association (Whitelisted) =================

    ==================== Internet Explorer (Whitelisted) ==========

    HKU\S-1-5-21-687888615-3449104039-937635755-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://go.microsoft.com/fwlink/p/?LinkId=619797&pc=UE01&ocid=UE01DHP
    HKU\S-1-5-21-687888615-3449104039-937635755-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://mystart.lenovo.com/
    BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2020-08-20] (HP Inc. -> HP Inc.)
    BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_281\bin\ssv.dll [2021-01-20] (Oracle America, Inc. -> Oracle Corporation)
    BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_281\bin\jp2ssv.dll [2021-01-20] (Oracle America, Inc. -> Oracle Corporation)
    BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2020-08-20] (HP Inc. -> HP Inc.)

    ==================== Hosts content: =========================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2019-03-18 22:49 - 2019-03-18 22:49 - 000000824 _____ C:\WINDOWS\system32\drivers\etc\hosts

    2021-01-12 08:13 - 2021-01-12 08:13 - 000000374 _____ C:\WINDOWS\system32\drivers\etc\hosts.ics

    ==================== Other Areas ===========================

    (Currently there is no automatic fix for this section.)

    HKLM\System\CurrentControlSet\Control\Session Manager\Environment\\Path -> C:\Program Files (x86)\Common Files\Oracle\Java\javapath;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;%SYSTEMROOT%\System32\OpenSSH\
    HKU\S-1-5-21-687888615-3449104039-937635755-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\ronny\OneDrive\Pictures\Dad's\rose6.jpg
    DNS Servers: 192.168.1.1
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: )
    Windows Firewall is enabled.

    ==================== MSCONFIG/TASK MANAGER disabled items ==

    (If an entry is included in the fixlist, it will be removed.)

    HKLM\...\StartupApproved\Run: => "RtHDVBg"
    HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
    HKLM\...\StartupApproved\Run32: => "VRS"
    HKLM\...\StartupApproved\Run32: => "Dropbox"
    HKU\S-1-5-21-687888615-3449104039-937635755-1001\...\StartupApproved\Run: => "Paltalk"
    HKU\S-1-5-21-687888615-3449104039-937635755-1001\...\StartupApproved\Run: => "CCleaner Smart Cleaning"

    ==================== FirewallRules (Whitelisted) ================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    FirewallRules: [{982257A6-2960-4CC5-B218-9C82D0FDF538}] => (Allow) C:\Program Files (x86)\Maxthon\Bin\MxUp.exe (Maxthon (Asia) Limited. -> Maxthon International ltd.)
    FirewallRules: [{D878296B-3054-4CB8-AE02-04EDC6D71925}] => (Allow) C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe (Maxthon (Asia) Limited. -> Maxthon International ltd.)
    FirewallRules: [{AF67BDB6-1C1C-491B-9674-FFF1A21D5947}] => (Allow) C:\Program Files (x86)\Maxthon\Bin\MxUp.exe (Maxthon (Asia) Limited. -> Maxthon International ltd.)
    FirewallRules: [{DCD0CA11-52AF-44CB-B55B-190AFA8312BE}] => (Allow) C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe (Maxthon (Asia) Limited. -> Maxthon International ltd.)
    FirewallRules: [{A44ADCAB-F36B-4CE4-8019-BA7CD41B8738}] => (Allow) C:\Users\ronny\AppData\Local\Maxthon\Application\Maxthon.exe (Maxthon Technology Co, Ltd. -> Maxthon Ltd.)
    FirewallRules: [{67605349-E1B0-4A34-999E-4F40E09F08B8}] => (Allow) C:\Users\ronny\AppData\Local\Maxthon\Application\Maxthon.exe (Maxthon Technology Co, Ltd. -> Maxthon Ltd.)
    FirewallRules: [{B3A4C66C-2FF9-4A17-8A8C-90D574B68004}] => (Allow) C:\Users\ronny\AppData\Local\Maxthon\Application\Maxthon.exe (Maxthon Technology Co, Ltd. -> Maxthon Ltd.)
    FirewallRules: [{055DE081-7DF1-49FB-A657-4FE2FC430CC4}] => (Allow) C:\Users\ronny\AppData\Local\Maxthon\Application\Maxthon.exe (Maxthon Technology Co, Ltd. -> Maxthon Ltd.)
    FirewallRules: [{ED58E4D4-63E1-482D-8836-F4DDA5215099}] => (Allow) C:\Program Files (x86)\NCH Software\VRS\vrs.exe (NCH Software Pty Ltd -> NCH Software)
    FirewallRules: [{4942BF96-9725-4E37-A256-5B0B2ECB4079}] => (Allow) C:\Program Files (x86)\NCH Software\VRS\vrs.exe (NCH Software Pty Ltd -> NCH Software)
    FirewallRules: [{80726437-D855-42F0-9567-D7FCAC8B66D1}] => (Allow) C:\Program Files (x86)\NCH Software\VRS\vrs.exe (NCH Software Pty Ltd -> NCH Software)
    FirewallRules: [{63A43B1B-D2A0-405E-8244-3D4F50143137}] => (Allow) C:\Program Files (x86)\NCH Software\VRS\vrs.exe (NCH Software Pty Ltd -> NCH Software)
    FirewallRules: [{54A1549B-1042-48EC-9BD7-3F1186C1110B}] => (Allow) C:\Program Files (x86)\NCH Software\VRS\vrs.exe (NCH Software Pty Ltd -> NCH Software)
    FirewallRules: [{C0AC34D7-37A5-4B19-9296-58D831CEF53A}] => (Allow) C:\Program Files (x86)\NCH Software\VRS\vrs.exe (NCH Software Pty Ltd -> NCH Software)
    FirewallRules: [UDP Query User{72A359B6-8686-4D0C-9010-F5C4677C2F28}C:\program files (x86)\paltalk\qtwebengineprocess.exe] => (Allow) C:\program files (x86)\paltalk\qtwebengineprocess.exe (The Qt Company Oy -> )
    FirewallRules: [TCP Query User{8A6DCB1A-50FC-48A8-A88C-DA3907DFFDA1}C:\program files (x86)\paltalk\qtwebengineprocess.exe] => (Allow) C:\program files (x86)\paltalk\qtwebengineprocess.exe (The Qt Company Oy -> )
    FirewallRules: [{EE4753E1-9862-4FEA-8018-675B60397C5A}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.66.77.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)
    FirewallRules: [{A57B8224-7F4B-4CE6-AEC1-6CB81CFA8FE8}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.66.77.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)
    FirewallRules: [{C4419992-6231-4561-885A-8A0DF09DEC6D}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.66.77.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)
    FirewallRules: [{2E835BC0-9A0F-4588-9095-605F448A1D05}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.66.77.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)
    FirewallRules: [{DA9EFC59-0094-43A4-943D-169A65514486}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.)
    FirewallRules: [{B2F6D75D-3BEF-4A19-BA1E-EA4C0D942C1D}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.)
    FirewallRules: [{C42F249E-09CB-428F-A8EF-A1B612F17D9A}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.)
    FirewallRules: [{F64764EE-AF4C-40FF-B5DE-3A222E0C45E8}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.)
    FirewallRules: [{A1D3A289-3545-4A74-B10C-8AA1A9AEDD47}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
    FirewallRules: [{902624FE-B543-4700-98C7-9AB58B45E88E}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
    FirewallRules: [{EAA32B60-CC16-415D-AD4F-0042E68BCE5C}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
    FirewallRules: [{2EA6A1DC-9430-4FF9-B046-EA49C1225BAA}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
    FirewallRules: [{6554C7BA-EC36-40D8-A0AF-B45EA345CFEB}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
    FirewallRules: [{2EB78F90-60DD-414D-B0BE-959F79188F1F}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
    FirewallRules: [{36C6E4D0-167B-49A3-8637-0A8F5918E211}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google LLC)
    FirewallRules: [{C521D0FB-99FC-4772-8CCA-84D53684BD1F}] => (Allow) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe (Dropbox, Inc -> Dropbox, Inc.)

    ==================== Restore Points =========================

    20-01-2021 13:41:46 Removed Java 8 Update 281 (64-bit)

    ==================== Faulty Device Manager Devices ============

    Name: Microsoft PS/2 Mouse
    Description: Microsoft PS/2 Mouse
    Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
    Manufacturer: Microsoft
    Service: i8042prt
    Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
    Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
    Devices stay in this state if they have been prepared for removal.
    After you remove the device, this error disappears.Remove the device, and this error should be resolved.

    Name: Standard PS/2 Keyboard
    Description: Standard PS/2 Keyboard
    Class Guid: {4d36e96b-e325-11ce-bfc1-08002be10318}
    Manufacturer: (Standard keyboards)
    Service: i8042prt
    Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
    Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
    Devices stay in this state if they have been prepared for removal.
    After you remove the device, this error disappears.Remove the device, and this error should be resolved.


    ==================== Event log errors: ========================

    Application errors:
    ==================
    Error: (01/22/2021 02:34:55 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: m->NextScheduledSPRetry 2016

    Error: (01/22/2021 02:34:55 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: m->NextScheduledEvent 2016

    Error: (01/22/2021 02:34:55 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: Continuously busy for more than a second

    Error: (01/21/2021 09:54:00 AM) (Source: Microsoft-Windows-PerfNet) (EventID: 2004) (User: DADS)
    Description: Unable to open the Server service performance object. The first four bytes (DWORD) of the Data section contains the status code.

    Error: (01/21/2021 04:11:44 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: m->NextScheduledSPRetry 5969

    Error: (01/21/2021 04:11:44 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: m->NextScheduledEvent 5969

    Error: (01/21/2021 04:11:44 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: Continuously busy for more than a second

    Error: (01/21/2021 04:11:42 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: m->NextScheduledSPRetry 3969


    System errors:
    =============
    Error: (01/22/2021 02:18:03 AM) (Source: Schannel) (EventID: 4103) (User: NT AUTHORITY)
    Description: A fatal error occurred while creating a TLS client credential. The internal error state is 10013.

    Error: (01/22/2021 02:17:44 AM) (Source: Schannel) (EventID: 4103) (User: NT AUTHORITY)
    Description: A fatal error occurred while creating a TLS client credential. The internal error state is 10013.

    Error: (01/21/2021 09:29:13 AM) (Source: Tcpip) (EventID: 4207) (User: )
    Description: The IPv6 TCP/IP interface with index 4 failed to bind to its provider.

    Error: (01/21/2021 09:29:13 AM) (Source: Tcpip) (EventID: 4207) (User: )
    Description: The IPv4 TCP/IP interface with index 4 failed to bind to its provider.

    Error: (01/21/2021 09:29:13 AM) (Source: Microsoft-Windows-NDIS) (EventID: 10317) (User: NT AUTHORITY)
    Description: Miniport Remote NDIS based Internet Sharing Device, {38ae83d3-c5f7-44d3-984f-0acfc8cf2da0}, had event 74

    Error: (01/21/2021 02:33:29 AM) (Source: Schannel) (EventID: 4103) (User: NT AUTHORITY)
    Description: A fatal error occurred while creating a TLS client credential. The internal error state is 10013.

    Error: (01/21/2021 12:01:30 AM) (Source: Microsoft-Windows-BitLocker-Driver) (EventID: 24620) (User: NT AUTHORITY)
    Description: Encrypted volume check: Volume information on E: cannot be read.

    Error: (01/20/2021 07:52:21 PM) (Source: volmgr) (EventID: 46) (User: )
    Description: Crash dump initialization failed!


    Windows Defender:
    ===================================
    Date: 2021-01-22 18:47:21.3060000Z
    Description:
    Microsoft Defender Antivirus scan has been stopped before completion.
    Scan ID: {E1349058-6BFC-4D6C-BD2C-49D9651B815C}
    Scan Type: Antimalware
    Scan Parameters: Quick Scan

    Date: 2021-01-19 20:32:23.5820000Z
    Description:
    Microsoft Defender Antivirus scan has been stopped before completion.
    Scan ID: {A4922A00-D7DC-47A5-9798-D6A4FFC86656}
    Scan Type: Antimalware
    Scan Parameters: Quick Scan

    Date: 2021-01-17 19:28:01.6340000Z
    Description:
    Microsoft Defender Antivirus scan has been stopped before completion.
    Scan ID: {A13ED939-92C7-46DB-9ECC-232731BC68E2}
    Scan Type: Antimalware
    Scan Parameters: Quick Scan

    Date: 2021-01-17 05:42:45.6830000Z
    Description:
    Microsoft Defender Antivirus scan has been stopped before completion.
    Scan ID: {74AEC9DB-7C54-4711-8177-FD7612DC6D78}
    Scan Type: Antimalware
    Scan Parameters: Quick Scan

    Date: 2021-01-17 02:09:24.8220000Z
    Description:
    Microsoft Defender Antivirus scan has been stopped before completion.
    Scan ID: {A77F9496-CF37-4BF7-84D1-7A6EC4C728DA}
    Scan Type: Antimalware
    Scan Parameters: Quick Scan

    Date: 2021-01-20 11:51:22.6870000Z
    Description:
    Microsoft Defender Antivirus has encountered an error trying to update security intelligence.
    New security intelligence Version:
    Previous security intelligence Version: 1.329.2479.0
    Update Source: Microsoft Update Server
    Security intelligence Type: AntiVirus
    Update Type: Full
    Current Engine Version:
    Previous Engine Version: 1.1.17700.4
    Error code: 0x80072efd
    Error description: A connection with the server could not be established

    Date: 2021-01-14 03:47:11.3220000Z
    Description:
    Microsoft Defender Antivirus has encountered an error trying to update security intelligence.
    New security intelligence Version:
    Previous security intelligence Version: 1.329.675.0
    Update Source: Microsoft Update Server
    Security intelligence Type: AntiVirus
    Update Type: Full
    Current Engine Version:
    Previous Engine Version: 1.1.17700.4
    Error code: 0x80240022
    Error description: The program can't check for definition updates.

    Date: 2021-01-04 10:25:11.6580000Z
    Description:
    Microsoft Defender Antivirus has encountered an error trying to update security intelligence.
    New security intelligence Version: 1.329.1651.0
    Previous security intelligence Version: 1.329.675.0
    Update Source: User
    Security intelligence Type: AntiSpyware
    Update Type: Delta
    Current Engine Version: 1.1.17700.4
    Previous Engine Version: 1.1.17700.4
    Error code: 0x80509004
    Error description: An unexpected problem occurred. Install any available updates, and then try to start the program again. For information on installing updates, see Help and Support.

    Date: 2021-01-04 10:25:11.6570000Z
    Description:
    Microsoft Defender Antivirus has encountered an error trying to update security intelligence.
    New security intelligence Version: 1.329.1651.0
    Previous security intelligence Version: 1.329.675.0
    Update Source: User
    Security intelligence Type: AntiVirus
    Update Type: Delta
    Current Engine Version: 1.1.17700.4
    Previous Engine Version: 1.1.17700.4
    Error code: 0x80509004
    Error description: An unexpected problem occurred. Install any available updates, and then try to start the program again. For information on installing updates, see Help and Support.

    Date: 2021-01-04 04:02:54.4180000Z
    Description:
    Microsoft Defender Antivirus has encountered an error trying to update security intelligence.
    New security intelligence Version:
    Previous security intelligence Version: 1.329.675.0
    Update Source: Microsoft Update Server
    Security intelligence Type: AntiVirus
    Update Type: Full
    Current Engine Version:
    Previous Engine Version: 1.1.17700.4
    Error code: 0x8007045b
    Error description: A system shutdown is in progress.

    CodeIntegrity:
    ===================================

    Date: 2021-01-20 19:54:56.7260000Z
    Description:
    Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

    Date: 2021-01-20 19:54:56.6360000Z
    Description:
    Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

    Date: 2021-01-20 11:43:07.2800000Z
    Description:
    Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

    Date: 2021-01-20 11:43:07.2250000Z
    Description:
    Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

    Date: 2021-01-16 18:33:02.7290000Z
    Description:
    Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

    Date: 2021-01-16 18:33:02.6770000Z
    Description:
    Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

    ==================== Memory info ===========================

    BIOS: Hewlett-Packard L01 v02.65 07/13/2015
    Motherboard: Hewlett-Packard 1998
    Processor: Intel(R) Core(TM) i5-4590 CPU @ 3.30GHz
    Percentage of memory in use: 72%
    Total physical RAM: 8082.33 MB
    Available physical RAM: 2196.38 MB
    Total Virtual: 13488.44 MB
    Available Virtual: 5635.94 MB

    ==================== Drives ================================

    Drive c: (Windows) (Fixed) (Total:930.29 GB) (Free:868.96 GB) NTFS

    \\?\Volume{6936fdef-0000-0000-0000-100000000000}\ (System) (Fixed) (Total:0.49 GB) (Free:0.16 GB) NTFS
    \\?\Volume{6936fdef-0000-0000-0000-f0b1e8000000}\ () (Fixed) (Total:0.73 GB) (Free:0.31 GB) NTFS

    ==================== MBR & Partition Table ====================

    ==========================================================
    Disk: 0 (MBR Code: Windows 7/8/10) (Size: 931.5 GB) (Disk ID: 6936FDEF)
    Partition 1: (Active) - (Size=500 MB) - (Type=07 NTFS)
    Partition 2: (Not Active) - (Size=930.3 GB) - (Type=07 NTFS)
    Partition 3: (Not Active) - (Size=749 MB) - (Type=27)

    ==================== End of Addition.txt =======================

    aswMBR version 1.0.1.2252 Copyright(c) 2014 AVAST Software
    Run date: 2021-01-22 19:45:15
    -----------------------------
    19:45:15.516 OS Version: Windows x64 6.2.9200
    19:45:15.517 Number of processors: 4 586 0x3C03
    19:45:15.527 ComputerName: DADS UserName:
    19:45:25.244 Initialize success
    19:45:25.302 VM: initialized successfully
    19:45:25.303 VM: Intel CPU BiosDisabled
    19:46:34.467 AVAST engine defs: 17030301
    19:47:24.461 The log file has been saved successfully to "C:\Users\ronny\OneDrive\Desktop\aswMBR.txt"
    Attached Images Attached Images

  2. #2
    Security Expert Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    3,975

    Default

    Sorry, I didn't see that you had posted, I thought I had checked.

    This might be something simple.
    Let's see if changing the browser search engine helps because, nothing standing out in your logs to point to a problem other then
    (WEB ENTERTAINMENT LIMITED -> Y8 Games) C:\Users\ronny\AppData\Local\Programs\y8-browser\Y8 Browser.exe <== looks a bit iffy to me


    Set your default search engine for Google Chrome
    https://support.google.com/chrome/an...DDesktop&hl=en


    Change your default search settings in Firefox
    https://support.mozilla.org/en-US/kb...ttings-firefox


    Try the above and let's see if that helps.
    Last edited by Juliet; 2021-01-24 at 23:32. Reason: typo
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

  3. #3
    Security Expert Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    3,975

    Default

    when I tried to reply to your message

    rcb56 has exceeded their stored private messages quota and cannot accept further messages until they clear some space.
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

  4. #4
    Senior Member
    Join Date
    Feb 2008
    Location
    L.A. (Lower Arkansas)
    Posts
    341

    Default

    oh my...i had no idea it was full! it's empty now

  5. #5
    Security Expert Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    3,975

    Default

    Have you worked on post #2?
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

  6. #6
    Senior Member
    Join Date
    Feb 2008
    Location
    L.A. (Lower Arkansas)
    Posts
    341

    Default

    oh my...i had no idea it was full! it's empty now

  7. #7
    Security Expert Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    3,975

    Default

    No this one

    This might be something simple.
    Let's see if changing the browser search engine helps because, nothing standing out in your logs to point to a problem other then
    (WEB ENTERTAINMENT LIMITED -> Y8 Games) C:\Users\ronny\AppData\Local\Programs\y8-browser\Y8 Browser.exe <== looks a bit iffy to me


    Set your default search engine for Google Chrome
    https://support.google.com/chrome/an...DDesktop&hl=en


    Change your default search settings in Firefox
    https://support.mozilla.org/en-US/kb...ttings-firefox


    Try the above and let's see if that helps.
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

  8. #8
    Senior Member
    Join Date
    Feb 2008
    Location
    L.A. (Lower Arkansas)
    Posts
    341

    Default

    have i done anything to Y8 browser? no i just started using it at a game site to play pool, but if i's a problem it can go. this started before i has Y8. i use edge browser and firefox some. in edge google has been my default search and at times bing. i have removed yahoo search and still it comes to a yahoo page.

  9. #9
    Security Expert Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    3,975

    Default

    OK
    Let's dig deeper.

    Download AdwCleaner from here and save it to your desktop.

    • run AdwCleaner by clicking on Scan Now
    • when it has finished, leave everything that was found checked, (ticked), then click on Clean and Repair
    • if it asks to reboot, allow the reboot
    • on reboot, click on View Log File; please attach the content of the log to your next reply.

    =======================

    You may have Malwarebytes Anti-Malware installed but if not, you can download it from here:
    • run the program
    • click on the ‘Dashboard’ to make sure everything is up to date, (it is not necessary to upgrade to the premium version of MBAM)
    • click on the ‘Scan’ tab, (directly below the Dashboard tab)
    • select the Threat Scan option
    • slick the Scan Now button
    • Threat Scan will begin
    • when the scan has completed and if malware was found, click the Quarantine Selected button to allow MBAM to quarantine what was found
    • if prompted to restart the computer, close all other programs and click Yes to restart your computer
    • once you are back at your desktop, open MBAM once more
    • click on the ‘Reports’ tab
    • double-click on the most recent Scan Report
    • click on Export, then Copy to Clipboard

    Logs to include with the next post:

    AdwCleaner log
    Malwarebytes Anti-Malware

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~`

    reset your Microsoft Edge:

    Press the Windows + I keys from the keyboard to launch Settings.
    Click Apps, then Apps & features from the left pane.
    Locate and click Microsoft Edge.
    Click Advanced options, then click the Reset button.


    reset Firefox
    https://malwaretips.com/blogs/reset-firefox-settings/
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

  10. #10
    Senior Member
    Join Date
    Feb 2008
    Location
    L.A. (Lower Arkansas)
    Posts
    341

    Default

    juliet, it says it found preinstalled software it selected for quarantine but it's HPAssistance that was found. do i really want that gone? i never have used it.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •