Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Generic User Avatar

Possible infection running into many multiple problems


  • Please log in to reply
27 replies to this topic

#1 sh4rkbyt31

sh4rkbyt31

  •  Avatar image
  • Members
  • 86 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:09 AM

Posted 21 October 2025 - 09:19 AM

Not sure at this point what exactly is going on. 1) I cannot get my DVD Drive to work which may be petty but I need it for my work. 2) I have had different instances where it seems I may or may not have control of my computer. 3) Ongoing issues with the Windows 11 OS where things seem to disappear at different time and I am unable to locate them and other times I can? I'm at a loss at this point as to what is happening. I had to Copy and Paste the Addition.txt as it's not showing up in any file system anywhere.
Here are my FARBAR Files:
 

==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(C:\Program Files\Piriform\CCleaner 7\CCleaner_service.exe ->) (Gen Digital Inc. -> Gen Digital Inc.) C:\Program Files\Piriform\CCleaner 7\wa_3rd_party_host_32.exe
(C:\Program Files\Piriform\CCleaner 7\CCleaner_service.exe ->) (Gen Digital Inc. -> Gen Digital Inc.) C:\Program Files\Piriform\CCleaner 7\wa_3rd_party_host_64.exe
(C:\Program Files\Surfshark\Endpoint Protection SDK\endpointprotection.exe ->) (Avira Operations GmbH -> Avira Operations GmbH) C:\Program Files\Surfshark\Endpoint Protection SDK\SentryEye.exe
(explorer.exe ->) (Brave Software, Inc. -> Brave Software, Inc.) C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe <18>
(explorer.exe ->) (Microsoft Corporation -> MSPCManager) C:\Program Files\WindowsApps\Microsoft.MicrosoftPCManager_3.17.14.0_x64__8wekyb3d8bbwe\PCManager\MSPCManager.exe
(explorer.exe ->) (Surfshark B.V. -> Surfshark) C:\Program Files\Surfshark\Surfshark.exe
(Microsoft Corporation -> MSPCManagerCore) C:\Program Files\WindowsApps\Microsoft.MicrosoftPCManager_3.17.14.0_x64__8wekyb3d8bbwe\PCManager\MSPCManagerCore.exe
(services.exe ->) () [File not signed] C:\Program Files\Focusrite\Focusrite Control\Server\ControlServer.exe
(services.exe ->) (Advanced Micro Devices -> AMD) C:\Program Files\AMD\Performance Profile Client\AUEPDU.exe
(services.exe ->) (Avira Operations GmbH -> Avira Operations GmbH) C:\Program Files\Surfshark\Endpoint Protection SDK\endpointprotection.exe
(services.exe ->) (Canon Inc. -> ) C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
(services.exe ->) (Canon Inc. -> CANON INC.) C:\Program Files (x86)\Canon\IJ Scan Utility\SETEVENT.exe
(services.exe ->) (Gen Digital Inc. -> Gen Digital Inc.) C:\Program Files\Piriform\CCleaner 7\CCleaner_service.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_2.6.2.0_x64__8wekyb3d8bbwe\wslinstaller.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\WSL\wslservice.exe
(services.exe ->) (Microsoft Corporation -> MSPCManagerService) C:\Program Files\WindowsApps\Microsoft.MicrosoftPCManager_3.17.14.0_x64__8wekyb3d8bbwe\PCManager\MSPCManagerService.exe
(services.exe ->) (ND_Apps -> Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(services.exe ->) (NVIDIA Corporation -> NVIDIA Corporation) C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_6cdc9372d41a2731\Display.NvContainer\NVDisplay.Container.exe <2>
(services.exe ->) (NZXT, Inc. -> ) C:\Program Files\NZXT CAM\resources\app.asar.unpacked\node_modules\@nzxt\cam-core\dist\service.exe
(services.exe ->) (Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Windows\System32\DriverStore\FileRepository\realtekservice.inf_amd64_c2fa179f72a88c18\RtkAudUService64.exe
(services.exe ->) (Samsung Electronics CO., LTD. -> DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe
(services.exe ->) (Samsung Electronics CO., LTD. -> DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\28_ssconn2\conn\ss_conn_service2.exe
(services.exe ->) (ShenZhen Moyea Software Co., Ltd. -> Leawo Software) C:\Program Files (x86)\Common Files\cdagtsvc\cdagtsvc_v1.0.0_x86.exe
(services.exe ->) (Surfshark B.V. -> Surfshark.AntivirusService) C:\Program Files\Surfshark\Surfshark.AntivirusService.exe
(services.exe ->) (Surfshark B.V. -> Surfshark.Service) C:\Program Files\Surfshark\Surfshark.Service.exe
(services.exe ->) (Surfshark B.V. -> Surfshark.WireguardService) C:\Program Files\Surfshark\Surfshark.WireguardService.exe
(svchost.exe ->) (Advanced Micro Devices -> AMD) C:\Program Files\AMD\Performance Profile Client\AUEPMaster.exe
(svchost.exe ->) (Gen Digital Inc. -> Gen Digital Inc.) C:\Program Files\Piriform\CCleaner 7\CCleaner.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe
 
==================== Registry (Whitelisted) ===================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [RtkAudUService] => C:\WINDOWS\System32\DriverStore\FileRepository\realtekservice.inf_amd64_c2fa179f72a88c18\RtkAudUService64.exe [2257752 2024-09-11] (Realtek Semiconductor Corp. -> Realtek Semiconductor)
HKLM\...\Run: [Focusrite Notifier] => C:\Program Files\Focusrite\Drivers\Focusrite Notifier.exe [906840 2023-11-27] (Focusrite Audio Engineering Ltd -> Focusrite Audio Engineering, Ltd.)
HKLM\...\Run: [] => [X]
HKLM-x32\...\Run: [] => [X]
HKLM\...\Policies\Explorer: [HideSCAMeetNow] 1
HKLM\...\Policies\Explorer: [SettingsPageVisibility] hide:home
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Restriction <==== ATTENTION
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\MRT: Restriction <==== ATTENTION
HKLM\Software\Policies\...\system: [EnableActivityFeed] 0
HKLM\Software\Policies\...\system: [PublishUserActivities] 0
HKLM\Software\Policies\...\system: [UploadUserActivities] 0
HKLM\Software\Policies\...\system: [AllowClipboardHistory] 0
HKLM\Software\Policies\...\system: [AllowCrossDeviceClipboard] 0
HKLM\SYSTEM\...\Terminal Server: [fDenyTSConnections] = 0 <==== ATTENTION
HKU\S-1-5-21-996191584-2022938525-1902568006-1001\...\Run: [Surfshark] => C:\Program Files\Surfshark\Surfshark.exe [258816 2025-09-09] (Surfshark B.V. -> Surfshark)
HKU\S-1-5-21-996191584-2022938525-1902568006-1001\...\Run: [NZXT.CAM] => C:\Program Files\NZXT CAM\NZXT CAM.exe [186398072 2025-01-15] (NZXT, Inc. -> NZXT, Inc.)
HKU\S-1-5-21-996191584-2022938525-1902568006-1001\...\Run: [] => [X]
HKU\S-1-5-21-996191584-2022938525-1902568006-1001\...\Policies\Explorer: [HideSCAMeetNow] 1
HKLM\...\Windows x64\Print Processors\Canon G3070 series Print Processor: C:\Windows\System32\spool\prtprocs\x64\CNMPDHX.DLL [543744 2023-10-30] (CANON INC.) [File not signed]
HKLM\...\Print\Monitors\Canon BJ Language Monitor G3070 series: C:\WINDOWS\system32\CNMLMHX.DLL [989696 2023-10-30] (CANON INC.) [File not signed]
HKLM\...\Print\Monitors\EPSON XP-4200 Series 64MonitorBE: C:\WINDOWS\system32\E1YLMBBHE.DLL [237568 2021-09-21] (Seiko Epson Corporation) [File not signed]
HKLM\Software\Microsoft\Active Setup\Installed Components: [{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}] -> "C:\Program Files\BraveSoftware\Brave-Browser\Application\141.1.83.118\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level
HKLM\Software\...\Authentication\Credential Providers: [{C885AA15-1764-4293-B82A-0586ADD46B35}] -> 
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Ableton USB Audio Control Panel Autostart.lnk [2024-11-21]
ShortcutTarget: Ableton USB Audio Control Panel Autostart.lnk -> C:\Program Files\Ableton\USB Audio Driver\x64\AbletonAudioCpl.exe (Thesycon Software Solutions GmbH & Co. KG -> )
GroupPolicy: Restriction ? <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Edge: Restriction <==== ATTENTION
 
==================== Scheduled Tasks (Whitelisted) =================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {4F629B8C-7EC9-4867-A5F2-F469A8226893} - System32\Tasks\AMDAutoUpdate => C:\Program Files\AMD\AutoUpdate\AMDAutoUpdate.exe [671440 2024-07-24] (Advanced Micro Devices -> )
Task: {F6533783-F135-40D9-AD30-22E3CA0B1641} - System32\Tasks\BraveSoftwareUpdateTaskMachineCore{962AAB17-2D97-4B8A-AF90-EA7681598F29} => C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe [167448 2024-09-30] (Brave Software, Inc. -> BraveSoftware Inc.)
Task: {8BB1078A-260D-407D-9CA8-1511455E1699} - System32\Tasks\BraveSoftwareUpdateTaskMachineUA{37DD92FE-4571-48AE-95A9-F5BFB5743E71} => C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe [167448 2024-09-30] (Brave Software, Inc. -> BraveSoftware Inc.)
Task: {8CBCC8A5-6F26-4DA0-B708-175E11C581B1} - System32\Tasks\CCleaner 7 - Skip UAC - S-1-5-21-996191584-2022938525-1902568006-1001 => C:\Program Files\Piriform\CCleaner 7\CCleaner.exe [4717688 2025-10-17] (Gen Digital Inc. -> Gen Digital Inc.)
Task: {077BA067-7C15-40F0-B22E-C9DC2A54B4A2} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe  (No File)
Task: {CCDFC0B8-01A3-4E74-A820-4F13F51D269E} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => %SystemRoot%\System32\MbaeParserTask.exe  (No File)
Task: {0BB36A32-0D9E-4297-AFD7-6BD7B5DB4C9B} - System32\Tasks\Microsoft\Windows\UNP\RunUpdateNotificationMgr => %windir%\System32\UNP\UpdateNotificationMgr.exe  (No File)
Task: {7BC9F5B8-4888-437D-8E69-132470940556} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_AC => %systemroot%\system32\MusNotification.exe  /RunOnAC RebootDialog (No File)
Task: {51DADB31-C111-48E4-AC6A-D76F39791353} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery => %systemroot%\system32\MusNotification.exe  /RunOnBattery RebootDialog (No File)
Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe  (No File)
Task: {341C5D3A-38A6-4695-B374-095DD1BF165D} - System32\Tasks\npcapwatchdog => C:\Program Files\Npcap\CheckStatus.bat [815 2022-11-22] () [File not signed]
Task: {09A9F7C1-7C35-4E49-9FD2-7A162EA9F5BC} - System32\Tasks\Piriform\CCleaner 7 - S-1-5-21-996191584-2022938525-1902568006-1001 => C:\Program Files\Piriform\CCleaner 7\CCleaner.exe [4717688 2025-10-17] (Gen Digital Inc. -> Gen Digital Inc.)
Task: {6FC10ECE-56CA-4480-8869-4AF9CDC28EE3} - System32\Tasks\Piriform\CCleaner 7 - S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415 => C:\Program Files\Piriform\CCleaner 7\CCleaner.exe [4717688 2025-10-17] (Gen Digital Inc. -> Gen Digital Inc.)
Task: {5A739231-AF70-47CB-83C2-BFABEC8C78CD} - System32\Tasks\Piriform\CCleaner 7 BugReport => C:\Program Files\Piriform\CCleaner 7\CCleanerBugReport.exe [6243960 2025-10-17] (Gen Digital Inc. -> Gen Digital Inc.) -> --send "dumps|report" --product 234 --programpath "C:\Program Files\Piriform\CCleaner 7" --configpath "C:\Program Files\Piriform\CCleaner 7\data" --path "C:\Program Files\Piriform\CCleaner 7\log" --path "C:\Program Files\Piriform\CCleaner 7\data\dumps" --logpath "C:\Program Files\Piriform\CCleaner 7 (the data entry has 58 more characters).
Task: {A43DC670-FE8E-446D-8283-5EFECFE935A8} - System32\Tasks\Piriform\CCleaner 7 Update => C:\Program Files\Common Files\Piriform\Icarus\piriform-ccl\icarus.exe  /update:piriform-ccl /silent (No File)
Task: {8EB042C4-BB50-484F-ACBE-1F4751CAB221} - System32\Tasks\Remove AdwCleaner Application => C:\WINDOWS\system32\CMD.EXE [344064 2025-09-20] (Microsoft Windows -> Microsoft Corporation) -> /C DEL /F /Q "C:\Users\sh4rk\Downloads\tron\resources\stage_3_disinfect\malwarebytes_adwcleaner\adwcleaner.exe"
Task: {04AE3C42-5264-48B3-9AF4-167930BEFD0E} - System32\Tasks\StartAUEP => C:\Program Files\AMD\Performance Profile Client\AUEPMaster.exe [823512 2024-08-02] (Advanced Micro Devices -> AMD)
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\..\Interfaces\{89dfcb80-cae7-4d0d-85b9-dc04e83da193}: [DhcpNameServer] 192.168.12.1
Tcpip\..\Interfaces\{89dfcb80-cae7-4d0d-85b9-dc04e83da193}: [DhcpDomain] lan
Tcpip\..\Interfaces\{8d69708d-ddec-a599-bb02-0475a5d2150e}: [NameServer] 151.236.14.64,194.156.228.111
Tcpip\..\Interfaces\{cacc1257-3833-4a9e-b25f-7aa73c08b8e0}: [NameServer] 1.1.1.1,8.8.8.8
Tcpip\..\Interfaces\{cacc1257-3833-4a9e-b25f-7aa73c08b8e0}: [DhcpNameServer] 192.168.12.1
Tcpip\..\Interfaces\{cacc1257-3833-4a9e-b25f-7aa73c08b8e0}: [DhcpDomain] lan
 
Edge: 
=======
Edge DefaultProfile: Default
Edge Profile: C:\Users\sh4rk\AppData\Local\Microsoft\Edge\User Data\Default [2025-10-21]
Edge HomePage: Default -> hxxp://www.duckduckgo.com/
Edge StartupUrls: Default -> "hxxp://www.duckduckgo.com/"
Edge Extension: (HTTPS Everywhere) - C:\Users\sh4rk\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\fchjpkplmbeeeaaogdbhjbgbknjobohb [2024-10-17]
Edge Extension: (Google Docs Offline) - C:\Users\sh4rk\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2025-09-21]
Edge Extension: (Edge relevant text changes) - C:\Users\sh4rk\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha [2024-09-30]
Edge Extension: (uBlock Origin) - C:\Users\sh4rk\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\odfafepnkmbhccpbejgmiehpchacaeak [2025-09-21]
Edge HKLM\...\Edge\Extension: [bojobppfploabceghnmlahpoonbcbacn]
Edge HKLM-x32\...\Edge\Extension: [bojobppfploabceghnmlahpoonbcbacn]
 
FireFox:
========
FF Plugin: @videolan.org/vlc,version=3.0.21 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2024-06-08] (VideoLAN -> VideoLAN)
 
Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [ihcjicgdanjaechkgeegckofjjedodee]
CHR HKLM-x32\...\Chrome\Extension: [ihcjicgdanjaechkgeegckofjjedodee]
 
Brave: 
=======
BRA DefaultProfile: Default
BRA Profile: C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default [2025-10-21]
BRA DefaultSearchURL: Default -> hxxps://search.brave.com/search?q={searchTerms}&source=desktop
BRA DefaultSearchKeyword: Default -> :br
BRA DefaultSuggestURL: Default -> hxxps://search.brave.com/api/suggest?q={searchTerms}&rich=true&source=desktop
BRA Extension: (uBlock Origin) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Extensions\cjpalhdlnbpafiamejdnhcphjbkeiagm [2025-10-21]
BRA Extension: (Malwarebytes Browser Guard) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Extensions\ihcjicgdanjaechkgeegckofjjedodee [2025-09-08]
BRA Extension: (Brave Ad Block Updater (AdGuard URL Tracking Protection Filters (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\acjngemejiflkehbcbomjgkbfhjlgioh [2025-10-18]
BRA Extension: (Brave Ad Block Updater (Brave First Party Adblock Filters (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\adcocjohghhfpidemphmcmlmhnfgikei [2025-10-08]
BRA Extension: (Brave Local Data Files Updater) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal [2025-10-20]
BRA Extension: (Brave Ad Block Updater (YouTube Anti-Shorts (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\almolcgbkikkhliiibfjkohebgklegam [2025-09-21]
BRA Extension: (Brave NTP background images) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\aoojcmojmmcbpfgoecoadbdpnagfchel [2025-09-05]
BRA Extension: (Brave Ad Block Updater (Fanboy's Mobile Notifications (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\bfpgedeaaibpoidldhjcknekahbikncb [2025-10-21]
BRA Extension: (Brave Ad Block Updater (EasyList Cookie (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\cdbbhgbmjhfnhnmgeddbliobbofkgdhe [2025-10-21]
BRA Extension: (Brave Ad Block Updater (Romanian Ad (ROad) (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\cgmhmpbimmakidhlkcnnehhicoclofep [2025-10-18]
BRA Extension: (Brave Ad Block Updater (YouTube Mobile Distractions (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\cpapfkpkeaajehipopnaiihfmbfbnkdp [2025-09-05]
BRA Extension: (Brave Ad Block Updater (AdGuard Chinese (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\fbljdmoohhbifebddjnbbljgencmpjlb [2025-10-21]
BRA Extension: (Brave Ad Block Updater (AdGuard Français (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\flnkmpokemfpaajmiimmjeiandgoodgg [2025-10-21]
BRA Extension: (Brave NTP sponsored images) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\gigpfioocjkgbjgoonldcifaeajkbdln [2025-10-21]
BRA Extension: (Brave Ad Block Updater (Regional Catalog)) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\gkboaolpopklhgplhaaiboijnklogmbc [2025-10-10]
BRA Extension: (Brave Ad Block Updater (Adguard Turkish (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\gomenlogbembmkbghmaoledggliepdef [2025-10-21]
BRA Extension: (Brave NTP Super Referrer mapping table) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\heplpbhjcbmiibdlchlanmdenffpiibo [2024-09-30]
BRA Extension: (Brave Ad Block Updater (EasyList China (中文) (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\hmnnhojoekmmehfpmeegehbmifiijobb [2025-10-21]
BRA Extension: (Brave Ad Block Updater (Brave Default Adblock Filters (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\iodkpdagapdfkphljnddpjlldadblomo [2025-10-21]
BRA Extension: (Brave Ad Block Updater (Adguard Russian (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\jiajbjlakknofnkmlokcbanjbajpbdkl [2025-10-21]
BRA Extension: (Brave Ad Block Updater (EasyList Hebrew (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\kdakdkdknmkkafefhcbngpinlfoopoej [2025-10-20]
BRA Extension: (Brave Ad Block Updater (Brave Default Privacy Filters (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\kihnoaefogbkmblfimmibknnmkllbhlf [2025-10-21]
BRA Extension: (Brave Ad Block Updater (Adguard Japanese filters 日本用フィルタ (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\llgjaaddopeckcifdceaaadmemagkepi [2025-10-21]
BRA Extension: (Brave Ads Resources) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\lnbdfmpjjckjhnmahgdojnfnmdmpebfn [2025-10-21]
BRA Extension: (Brave Ad Block Updater (Adguard Spanish/Portuguese (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\meimhmgfbckapkbbbdaoefgnbppmkodp [2025-10-20]
BRA Extension: (Brave Ad Block Updater (Resources)) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\mfddibmblmbccpadfndgakiopmmhebop [2025-10-17]
BRA Extension: (Brave User Agent) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\nlpaeekllejnmhoonlpcefpfnpbajbpe [2025-10-21]
BRA Extension: (Brave Ad Block Updater (Slovenian (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\nnpbcdahaefknppiijdmnckpdgojejck [2025-09-21]
BRA Extension: (Brave Ads Resources) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\ocilmpijebaopmdifcomolmpigakocmo [2024-11-19]
BRA Extension: (Brave Ad Block Updater (Adguard Dutch (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\oojedkppeblkjkcdlmlahnhndjmbicoi [2025-10-20]
BRA Extension: (P3A Configuration) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\P3AConfig [2025-08-08]
BRA Extension: (Brave Ad Block Updater (YouTube Mobile Recommendations (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\phdmgpanpejkbmbljlhcehpadabljfbk [2025-09-21]
BRA Extension: (Brave Ad Block Updater (RU AdList Дополнительная региональная подписка (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\phmomndefejccjmpiehbogokakkmnmgb [2025-10-21]
 
==================== Services (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 AUEPLauncher; C:\Program Files\AMD\Performance Profile Client\AUEPDU.exe [542424 2024-08-02] (Advanced Micro Devices -> AMD)
S2 brave; C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe [167448 2024-09-30] (Brave Software, Inc. -> BraveSoftware Inc.)
S3 BraveElevationService; C:\Program Files\BraveSoftware\Brave-Browser\Application\141.1.83.118\elevation_service.exe [3237456 2025-10-15] (Brave Software, Inc. -> Brave Software, Inc.)
S3 bravem; C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe [167448 2024-09-30] (Brave Software, Inc. -> BraveSoftware Inc.)
R2 CAMService; C:\Program Files\NZXT CAM\resources\app.asar.unpacked\node_modules\@nzxt\cam-core\dist\service.exe [573816 2025-01-15] (NZXT, Inc. -> )
R2 CCleaner7; C:\Program Files\Piriform\CCleaner 7\CCleaner_service.exe [28276344 2025-10-17] (Gen Digital Inc. -> Gen Digital Inc.)
R2 CdRomAccessAgentService; C:\Program Files (x86)\Common Files\cdagtsvc\cdagtsvc_v1.0.0_x86.exe [111208 2025-07-18] (ShenZhen Moyea Software Co., Ltd. -> Leawo Software)
R2 CIJSRegister; C:\Program Files (x86)\Canon\IJ Scan Utility\SETEVENT.exe [157488 2022-03-16] (Canon Inc. -> CANON INC.)
R2 EndpointProtectionService; C:\Program Files\Surfshark\Endpoint Protection SDK\endpointprotection.exe [13051800 2025-10-09] (Avira Operations GmbH -> Avira Operations GmbH)
S3 EndpointProtectionService2; C:\Program Files\Surfshark\Endpoint Protection SDK\endpointprotection.exe [13051800 2025-10-09] (Avira Operations GmbH -> Avira Operations GmbH)
S3 EPMVssEaseusProvider; C:\WINDOWS\system32\dllhost.exe /Processid:{554247FC-C343-461B-8D55-9B0C9441E4C3} [50504 2025-09-01] (Microsoft Windows -> Microsoft Corporation)
R2 Focusrite Control Server; C:\Program Files\Focusrite\Focusrite Control\Server\ControlServer.exe [1297920 2024-03-11] () [File not signed]
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [460488 2024-04-03] (Canon Inc. -> )
S3 MDCoreSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpDefenderCoreService.exe [2026144 2025-10-03] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 NVDisplay.ContainerLocalSystem; C:\WINDOWS\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_6cdc9372d41a2731\Display.NvContainer\NVDisplay.Container.exe [1275608 2025-09-06] (NVIDIA Corporation -> NVIDIA Corporation)
R2 PCManager Service Store; C:\Program Files\WindowsApps\Microsoft.MicrosoftPCManager_3.17.14.0_x64__8wekyb3d8bbwe\PCManager\MSPCManagerService.exe [154144 2025-09-12] (Microsoft Corporation -> MSPCManagerService)
S3 Razer Elevation Service; C:\Program Files\Razer\razer_elevation_service\razer_elevation_service.exe [1741960 2025-04-25] (Razer USA Ltd. -> Razer Inc)
R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe [752224 2023-12-21] (Samsung Electronics CO., LTD. -> DEVGURU Co., LTD.)
R2 ss_conn_service2; C:\Program Files (x86)\Samsung\USB Drivers\28_ssconn2\conn\ss_conn_service2.exe [933432 2023-12-21] (Samsung Electronics CO., LTD. -> DEVGURU Co., LTD.)
R2 Surfshark Antivirus; C:\Program Files\Surfshark\Surfshark.AntivirusService.exe [151296 2025-09-09] (Surfshark B.V. -> Surfshark.AntivirusService)
R2 Surfshark Service; C:\Program Files\Surfshark\Surfshark.Service.exe [150784 2025-09-09] (Surfshark B.V. -> Surfshark.Service)
R3 Surfshark WireGuard; C:\Program Files\Surfshark\Surfshark.WireGuardService.exe [151296 2025-09-09] (Surfshark B.V. -> Surfshark.WireguardService)
S3 VSInstallerElevationService; C:\Program Files (x86)\Microsoft Visual Studio\Installer\VSInstallerElevationService.exe [43432 2025-08-25] (Microsoft Corporation -> Microsoft)
S3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\NisSrv.exe [4418608 2025-10-03] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe [282440 2025-10-03] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 WsaService; C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForAndroid_2407.40000.4.0_x64__8wekyb3d8bbwe\WsaService\WsaService.exe [320512 2025-08-23] (Microsoft Corporation -> )
S3 LibreOfficeMaintenance; "C:\Program Files\LibreOffice\program\update_service.exe" [X]
 
===================== Drivers (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R3 AmdTools64; C:\WINDOWS\System32\drivers\AmdTools64.sys [63392 2020-06-16] (Microsoft Windows Hardware Compatibility Publisher -> )
R0 BdNet; C:\WINDOWS\System32\DRIVERS\BdNet.sys [179768 2025-01-25] (Microsoft Windows Hardware Compatibility Publisher -> Avira Operations GmbH)
R1 BdSentry; C:\WINDOWS\System32\DRIVERS\BdSentry.sys [223296 2025-01-25] (Microsoft Windows Hardware Compatibility Publisher -> Avira Operations GmbH)
R1 CTIIO; C:\WINDOWS\system32\drivers\CtiIo64.sys [34920 2025-04-22] (Microsoft Windows Hardware Compatibility Publisher -> Creative Technology Innovation Co., LTd.)
R3 e1rexpress; C:\WINDOWS\System32\DriverStore\FileRepository\e1r.inf_amd64_ca8b162faaf4bb73\e1r.sys [610400 2025-04-22] (Intel Corporation -> Intel Corporation)
S3 ebrntdrv; C:\WINDOWS\system32\ebrntdrv.sys [27728 2025-06-10] (Microsoft Windows Hardware Compatibility Publisher -> )
S3 epmdkdrv; C:\WINDOWS\system32\epmdkdrv.sys [27728 2025-06-10] (Microsoft Windows Hardware Compatibility Publisher -> )
R0 EPMVolFl; C:\WINDOWS\System32\drivers\EPMVolFl.sys [30136 2025-06-10] (CHENGDU YIWO Tech Development Co., Ltd. -> Windows ® Codename Longhorn DDK provider)
R0 EUDCPEPM; C:\WINDOWS\System32\drivers\EUDCPEPM.sys [76344 2025-06-10] (Microsoft Windows Hardware Compatibility Publisher -> CHENGDU YIWO Tech Development Co., Ltd)
R1 EUEDKEPM; C:\WINDOWS\system32\drivers\EUEDKEPM.sys [24656 2025-06-10] (Microsoft Windows Hardware Compatibility Publisher -> CHENGDU YIWO Tech Development Co., Ltd)
R3 FocusritePCIeSwRoot; C:\WINDOWS\System32\drivers\FocusritePCIeSwRoot.sys [106208 2023-11-27] (Focusrite Audio Engineering Ltd -> Focusrite Audio Engineering Ltd.)
R3 FocusriteUsb; C:\WINDOWS\System32\drivers\FocusriteUsb.sys [170312 2023-11-27] (Focusrite Audio Engineering Ltd -> Focusrite Audio Engineering Ltd.)
R3 FocusriteUsbAudio; C:\WINDOWS\System32\drivers\FocusriteUsbAudio.sys [109896 2023-11-27] (Focusrite Audio Engineering Ltd -> Focusrite Audio Engineering Ltd.)
R3 FocusriteUsbSwRoot; C:\WINDOWS\System32\drivers\FocusriteUsbSwRoot.sys [112968 2023-11-27] (Focusrite Audio Engineering Ltd -> Focusrite Audio Engineering Ltd.)
R0 fse; C:\WINDOWS\System32\drivers\fse.sys [222528 2025-09-01] (Microsoft Windows -> Microsoft Corporation)
S3 gdrv3; C:\WINDOWS\System32\drivers\gdrv3.sys [52440 2025-01-16] (GIGA-BYTE TECHNOLOGY CO., LTD. -> GIGA-BYTE TECHNOLOGY CO., LTD.)
S3 KslD; C:\WINDOWS\System32\drivers\wd\KslD.sys [333216 2025-10-03] (Microsoft Windows -> Microsoft Corporation)
S2 l1vhlwf; C:\WINDOWS\System32\drivers\l1vhlwf.sys [140672 2025-09-13] (Microsoft Windows -> Microsoft Corporation)
S0 MbamElam; C:\WINDOWS\System32\DRIVERS\MbamElam.sys [22120 2025-05-19] (Microsoft Windows Early Launch Anti-malware Publisher -> Malwarebytes)
R1 MSIO; C:\WINDOWS\system32\drivers\MsIo64.sys [19672 2025-04-22] (Microsoft Windows Hardware Compatibility Publisher -> MICSYS Technology Co., LTd)
R1 netprotection_network_filter; C:\WINDOWS\System32\drivers\netprotection_network_filter.sys [119664 2025-10-09] (Avira Operations GmbH -> Avira Operations GmbH)
S3 netprotection_network_filter2; C:\WINDOWS\System32\drivers\netprotection_network_filter2.sys [119664 2025-10-09] (Avira Operations GmbH -> Avira Operations GmbH)
R1 npcap; C:\WINDOWS\system32\DRIVERS\npcap.sys [79424 2024-08-28] (Nmap Software LLC -> Insecure.Com LLC.)
R3 ovpn-dco; C:\WINDOWS\System32\drivers\ovpn-dco.sys [131984 2025-03-03] (WDKTestCert lev,133391533294737317 -> OpenVPN, Inc)
S3 RevoProcessDetector; C:\WINDOWS\System32\DRIVERS\RevoProcessDetector.sys [19504 2024-03-28] (Microsoft Windows Hardware Compatibility Publisher -> VS Revo Group)
R1 rtp1; C:\WINDOWS\System32\DRIVERS\rtp1.sys [452856 2025-10-09] (Avira Operations GmbH -> Avira Operations GmbH)
R1 rtp2; C:\WINDOWS\System32\DRIVERS\rtp2.sys [452880 2025-10-09] (Avira Operations GmbH -> Avira Operations GmbH)
S0 rtp_elam; C:\WINDOWS\System32\DRIVERS\rtp_elam.sys [30152 2025-10-09] (Microsoft Windows Early Launch Anti-malware Publisher -> Avira Operations GmbH)
S3 SharkDivert; C:\Program Files\Surfshark\Resources\x64\sharkdivert.sys [184480 2025-06-30] (Microsoft Windows Hardware Compatibility Publisher -> Surfshark)
S3 ss_conn_usb_driver2; C:\WINDOWS\System32\Drivers\ss_conn_usb_driver2.sys [50720 2023-12-21] (Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.)
S3 vmbusproxy; C:\WINDOWS\system32\drivers\vmbusproxy.sys [98304 2025-09-01] (Microsoft Windows -> Microsoft Corporation)
S3 WdBoot; C:\WINDOWS\system32\drivers\wd\WdBoot.sys [20888 2025-10-03] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\wd\WdFilter.sys [629128 2025-10-03] (Microsoft Windows -> Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [102832 2025-10-03] (Microsoft Windows -> Microsoft Corporation)
R3 WireGuard; C:\WINDOWS\System32\drivers\wireguard.sys [489368 2024-03-06] (Microsoft Windows Hardware Compatibility Publisher -> WireGuard LLC)
U4 npcap_wifi; no ImagePath
S3 SIVDriver; \??\C:\WINDOWS\system32\Drivers\SIVX64.sys [X]
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One month (created) (Whitelisted) =========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2025-10-21 10:02 - 2025-10-21 10:02 - 000031208 _____ C:\Users\sh4rk\Downloads\FRST.txt
2025-10-21 10:02 - 2025-10-21 10:02 - 000000000 ____D C:\FRST
2025-10-21 10:01 - 2025-10-21 10:01 - 002443264 _____ (Farbar) C:\Users\sh4rk\Downloads\FRST64.exe
2025-10-20 19:36 - 2025-10-20 19:36 - 163380314 _____ C:\Users\sh4rk\Desktop\balenaEtcher-linux-x64-2.1.4.zip
2025-10-20 19:34 - 2025-10-20 19:34 - 000029397 _____ C:\Users\sh4rk\Desktop\linuxmint-22.2-cinnamon-64bit.iso.torrent
2025-10-20 16:21 - 2025-10-20 16:21 - 000000000 ____D C:\WINDOWS\LastGood.Tmp
2025-10-20 16:14 - 2025-10-20 16:14 - 000000000 ____D C:\Program Files\Wireshark
2025-10-20 16:13 - 2025-10-20 16:13 - 000001197 _____ C:\Users\Public\Desktop\LibreOffice 25.8.lnk
2025-10-20 16:13 - 2025-10-20 16:13 - 000000000 ___SD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice
2025-10-11 10:18 - 2025-10-11 10:18 - 000003268 _____ C:\WINDOWS\system32\Tasks\CCleaner 7 - Skip UAC - S-1-5-21-996191584-2022938525-1902568006-1001
2025-10-09 21:14 - 2025-10-09 21:14 - 000002152 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner 7.lnk
2025-10-09 21:14 - 2025-10-09 21:14 - 000002140 _____ C:\Users\Public\Desktop\CCleaner 7.lnk
2025-10-09 21:14 - 2025-10-09 21:14 - 000000000 ____D C:\WINDOWS\system32\Tasks\Piriform
2025-10-09 21:14 - 2025-10-09 21:14 - 000000000 ____D C:\Users\sh4rk\AppData\Roaming\CCleaner
2025-10-09 21:13 - 2025-10-09 21:13 - 000055064 _____ (Gen Digital Inc.) C:\WINDOWS\system32\icarus_rvrt.exe
2025-10-09 21:13 - 2025-10-09 21:13 - 000000000 ____D C:\Program Files\Piriform
2025-10-09 21:13 - 2025-10-09 21:13 - 000000000 ____D C:\Program Files\Common Files\Piriform
2025-10-05 15:10 - 2025-10-21 08:23 - 000000000 ____D C:\WINDOWS\CbsTemp
2025-10-05 14:20 - 2025-10-05 14:20 - 000060128 _____ (Trellix US LLC.) C:\WINDOWS\system32\Drivers\mfeaacsk.sys.5111.deleteme
2025-10-01 18:45 - 2025-10-01 18:45 - 000000000 ____D C:\Program Files (x86)\WindowsInstallationAssistant
2025-10-01 10:35 - 2025-10-01 10:35 - 000000000 ___HD C:\$WinREAgent
2025-09-29 16:39 - 2025-09-29 16:39 - 112110040 _____ C:\Users\sh4rk\Downloads\tor-browser-windows-x86_64-portable-14.5.7.exe
2025-09-29 16:22 - 2025-09-29 16:22 - 041831970 _____ C:\Users\sh4rk\Downloads\wip10year-all.zip
2025-09-28 08:59 - 2025-09-28 08:59 - 000001201 _____ C:\Users\sh4rk\Downloads\Resume 2025 (1).txt
2025-09-28 08:36 - 2025-09-28 08:36 - 000001201 _____ C:\Users\sh4rk\Downloads\Resume 2022.txt
2025-09-27 03:45 - 2025-09-27 03:45 - 000066533 _____ C:\Users\sh4rk\Downloads\4187025152.pdf
2025-09-21 11:28 - 2025-09-21 11:28 - 016212526 _____ C:\Users\sh4rk\Downloads\2025-26 NHL Regular Season Schedule (By Club).pdf
 
==================== One month (modified) ==================
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2025-10-21 09:40 - 2024-04-01 03:26 - 000000000 ____D C:\WINDOWS\SystemTemp
2025-10-21 09:40 - 2024-04-01 03:26 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2025-10-21 09:37 - 2024-10-02 15:34 - 000000000 ____D C:\Users\sh4rk\AppData\Roaming\Surfshark
2025-10-21 09:35 - 2025-09-01 17:41 - 000873350 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2025-10-21 09:35 - 2024-04-01 03:24 - 000000000 ____D C:\WINDOWS\INF
2025-10-21 09:32 - 2024-10-02 15:34 - 000000000 ____D C:\ProgramData\Surfshark
2025-10-21 09:30 - 2025-09-01 17:38 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2025-10-21 09:30 - 2025-06-24 19:04 - 000041464 _____ C:\WINDOWS\system32\5E37410B-D6F1-471D-AE27-563CEAC0D6B2
2025-10-21 09:30 - 2025-01-07 02:26 - 000000000 ____D C:\ProgramData\NVIDIA
2025-10-21 09:30 - 2024-09-29 19:47 - 000012288 ___SH C:\DumpStack.log.tmp
2025-10-21 09:30 - 2024-04-01 03:26 - 000000000 ____D C:\WINDOWS\AppReadiness
2025-10-21 09:29 - 2024-11-02 10:31 - 001554640 _____ C:\WINDOWS\system32\rtp.db
2025-10-21 09:29 - 2024-04-01 03:21 - 000262144 _____ C:\WINDOWS\system32\config\BBI
2025-10-21 08:17 - 2025-01-07 02:28 - 000000000 ____D C:\Users\sh4rk\AppData\Local\D3DSCache
2025-10-20 18:20 - 2024-09-29 20:58 - 000000000 ____D C:\Users\sh4rk\AppData\Local\ConnectedDevicesPlatform
2025-10-20 17:54 - 2024-09-29 21:00 - 000000000 ____D C:\Users\sh4rk\AppData\Local\PlaceholderTileLogoFolder
2025-10-20 17:54 - 2024-09-29 20:58 - 000000000 ____D C:\Users\sh4rk\AppData\Local\Packages
2025-10-20 17:54 - 2024-09-29 20:44 - 000000000 ____D C:\ProgramData\Packages
2025-10-20 17:54 - 2024-04-01 03:26 - 000000000 ___HD C:\Program Files\WindowsApps
2025-10-20 16:45 - 2025-08-04 00:36 - 000000000 ____D C:\Users\sh4rk\Desktop\integrity_verification
2025-10-20 16:45 - 2024-12-23 01:04 - 000000000 ____D C:\Users\sh4rk\Desktop\PRS Photos Oct 2024
2025-10-20 16:43 - 2025-08-24 22:28 - 000000000 ____D C:\ProgramData\Windows App Certification Kit
2025-10-20 16:43 - 2024-09-30 09:13 - 000000000 ____D C:\Program Files\NZXT CAM
2025-10-20 16:42 - 2025-08-24 22:28 - 000000000 ____D C:\Program Files\Application Verifier
2025-10-20 16:41 - 2025-09-01 16:44 - 000000000 ____D C:\Users\sh4rk
2025-10-20 16:41 - 2025-09-01 16:44 - 000000000 ____D C:\Users\DefaultAppPool
2025-10-20 16:34 - 2025-09-01 17:36 - 000457760 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2025-10-20 16:14 - 2025-09-09 13:59 - 000001835 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wireshark.lnk
2025-10-20 16:14 - 2025-09-09 13:59 - 000001823 _____ C:\Users\Public\Desktop\Wireshark.lnk
2025-10-20 16:14 - 2024-09-30 13:45 - 000000000 ____D C:\ProgramData\Package Cache
2025-10-20 16:13 - 2024-10-13 21:11 - 000000000 ____D C:\Program Files\LibreOffice
2025-10-20 16:11 - 2025-08-12 18:26 - 000000000 ____D C:\Program Files\dotnet
2025-10-20 16:03 - 2024-09-29 22:11 - 000000000 ____D C:\Program Files (x86)\Steam
2025-10-20 08:16 - 2025-09-04 14:28 - 000000000 ____D C:\Users\sh4rk\Desktop\Dloaded songs
2025-10-19 18:59 - 2025-05-15 02:17 - 000000000 ____D C:\Program Files\Recuva
2025-10-18 05:35 - 2025-04-09 03:14 - 000000000 ____D C:\Users\sh4rk\Desktop\Nooter 02052025
2025-10-18 05:26 - 2024-12-08 14:52 - 000000000 ____D C:\fix
2025-10-18 05:26 - 2024-10-15 13:12 - 000000000 ____D C:\Program Files\Audacity
2025-10-18 05:24 - 2024-09-30 09:13 - 000000000 ____D C:\Users\sh4rk\AppData\Local\nzxt cam-updater
2025-10-18 05:24 - 2024-09-30 07:24 - 000000000 ____D C:\Program Files\Microsoft Update Health Tools
2025-10-18 05:23 - 2025-08-28 22:06 - 000000000 ____D C:\Users\sh4rk\AppData\Local\unali-3431406
2025-10-18 05:23 - 2025-08-28 22:06 - 000000000 ____D C:\Users\sh4rk\AppData\Local\unali-3431218
2025-10-18 05:23 - 2025-01-18 02:17 - 000000000 ____D C:\ProgramData\chocolatey
2025-10-18 05:22 - 2025-09-09 13:59 - 000000000 ____D C:\Program Files\Npcap
2025-10-16 18:47 - 2024-10-09 02:10 - 000000000 ____D C:\WINDOWS\system32\MRT
2025-10-16 18:46 - 2024-09-29 23:16 - 214534944 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2025-10-15 17:07 - 2024-09-29 21:01 - 000002364 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brave.lnk
2025-10-15 17:07 - 2024-09-29 21:01 - 000002323 _____ C:\Users\Public\Desktop\Brave.lnk
2025-10-13 20:45 - 2025-07-17 22:25 - 000000000 ____D C:\Users\sh4rk\AppData\Local\CrashDumps
2025-10-12 19:33 - 2024-09-29 23:46 - 000000000 ____D C:\Users\sh4rk\AppData\Roaming\Microsoft\MMC
2025-10-11 19:43 - 2025-09-01 17:38 - 000003536 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
2025-10-11 19:43 - 2025-09-01 17:38 - 000003410 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore
2025-10-11 12:18 - 2025-09-13 00:54 - 000037637 _____ C:\WINDOWS\system32\IntegratedServicesRegionPolicySet.json
2025-10-09 21:13 - 2025-05-15 02:17 - 000000000 ____D C:\ProgramData\Piriform
2025-10-09 16:33 - 2024-11-18 10:40 - 000119664 _____ (Avira Operations GmbH) C:\WINDOWS\system32\Drivers\netprotection_network_filter2.sys
2025-10-09 16:33 - 2024-11-02 10:31 - 000119664 _____ (Avira Operations GmbH) C:\WINDOWS\system32\Drivers\netprotection_network_filter.sys
2025-10-09 16:33 - 2024-11-02 10:29 - 000452880 _____ (Avira Operations GmbH) C:\WINDOWS\system32\Drivers\rtp2.sys
2025-10-09 16:33 - 2024-11-02 10:29 - 000452856 _____ (Avira Operations GmbH) C:\WINDOWS\system32\Drivers\rtp1.sys
2025-10-09 16:33 - 2024-11-02 10:29 - 000030152 _____ (Avira Operations GmbH) C:\WINDOWS\system32\Drivers\rtp_elam.sys
2025-10-09 16:33 - 2024-04-01 03:26 - 000000000 ___HD C:\WINDOWS\ELAMBKUP
2025-10-07 19:59 - 2025-01-18 02:30 - 000000000 ____D C:\Users\sh4rk\AppData\Local\NVIDIA
2025-10-07 19:59 - 2024-09-29 22:11 - 000000000 ____D C:\Users\sh4rk\AppData\Local\Steam
2025-10-06 20:02 - 2024-12-22 23:00 - 000000000 ___RD C:\Users\sh4rk\Dropbox
2025-10-06 20:01 - 2025-01-27 02:11 - 000000000 ____D C:\Users\sh4rk\whoami-project
2025-10-06 19:25 - 2025-02-02 20:17 - 000000000 ____D C:\Users\sh4rk\AppData\Roaming\vlc
2025-10-05 15:12 - 2025-09-01 17:36 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2025-10-05 15:09 - 2025-09-16 09:38 - 000000000 ____D C:\ProgramData\Malwarebytes
2025-10-05 14:58 - 2025-09-01 17:38 - 000003418 _____ C:\WINDOWS\system32\Tasks\Remove AdwCleaner Application
2025-10-05 14:15 - 2025-03-29 09:17 - 000000000 ____D C:\Users\sh4rk\Downloads\tron
2025-10-03 17:21 - 2024-09-30 02:27 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd
2025-10-01 10:02 - 2024-10-06 14:36 - 000000000 ____D C:\Program Files (x86)\GIGABYTE
2025-10-01 09:58 - 2024-12-24 03:53 - 000000000 ____D C:\WINDOWS\pss
2025-10-01 09:57 - 2024-12-24 03:59 - 000000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job
2025-09-29 16:50 - 2024-11-08 16:43 - 000000000 ___HD C:\ProgramData\CanonIJScan
2025-09-29 16:50 - 2024-10-13 19:44 - 000000000 ____D C:\ProgramData\CanonIJPLM
2025-09-21 15:04 - 2025-09-01 16:41 - 000000000 ____D C:\WINDOWS\system32\ruxim
2025-09-21 15:04 - 2024-04-01 03:26 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2025-09-21 15:04 - 2024-04-01 03:26 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2025-09-21 15:04 - 2024-04-01 03:26 - 000000000 ____D C:\WINDOWS\system32\oobe
2025-09-21 15:04 - 2024-04-01 03:26 - 000000000 ____D C:\WINDOWS\system32\migwiz
2025-09-21 15:04 - 2024-04-01 03:26 - 000000000 ____D C:\WINDOWS\system32\is-IS
2025-09-21 15:04 - 2024-04-01 03:26 - 000000000 ____D C:\WINDOWS\system32\hi-IN
2025-09-21 15:04 - 2024-04-01 03:26 - 000000000 ____D C:\WINDOWS\system32\fa-IR
2025-09-21 15:04 - 2024-04-01 03:26 - 000000000 ____D C:\WINDOWS\system32\Dism
2025-09-21 15:04 - 2024-04-01 03:26 - 000000000 ____D C:\WINDOWS\system32\cy-GB
2025-09-21 15:04 - 2024-04-01 03:26 - 000000000 ____D C:\WINDOWS\system32\af-ZA
2025-09-21 15:04 - 2024-04-01 03:26 - 000000000 ____D C:\WINDOWS\ShellExperiences
2025-09-21 15:04 - 2024-04-01 03:26 - 000000000 ____D C:\WINDOWS\BrowserCore
2025-09-21 15:04 - 2024-04-01 03:26 - 000000000 ____D C:\WINDOWS\bcastdvr
 
==================== Files in the root of some directories ========
 
2025-08-25 12:48 - 2025-08-25 12:48 - 000000028 _____ () C:\Users\sh4rk\AppData\Roaming\epm_user.ini
2025-03-28 05:41 - 2025-03-28 05:41 - 000000000 ____H () C:\Users\sh4rk\AppData\Local\BIT8090.tmp
2025-08-28 22:13 - 2025-08-28 22:13 - 000007601 _____ () C:\Users\sh4rk\AppData\Local\Resmon.ResmonCfg
 
==================== SigCheck ============================
 
(There is no automatic fix for files that do not pass verification.)
 
==================== End of FRST.txt ========================
 
 
 
 
 
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-10-2025
Ran by sh4rk (21-10-2025 10:03:33)
Running from C:\Users\sh4rk\Downloads
Microsoft Windows 11 Home Version 25H2 26220.6690 (X64) (2025-09-01 21:39:01)
Boot Mode: Normal
==========================================================
 
 
==================== Accounts: =============================
 
(If an entry is included in the fixlist, it will be removed.)
 
Administrator (S-1-5-21-996191584-2022938525-1902568006-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-996191584-2022938525-1902568006-503 - Limited - Disabled)
Guest (S-1-5-21-996191584-2022938525-1902568006-501 - Limited - Disabled)
sh4rk (S-1-5-21-996191584-2022938525-1902568006-1001 - Administrator - Enabled) => C:\Users\sh4rk
WDAGUtilityAccount (S-1-5-21-996191584-2022938525-1902568006-504 - Limited - Disabled)
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: Surfshark (Enabled - Up to date) {D7FFD2ED-EB9C-04AE-8A0C-F5F2E83D0F8A}
AV: Surfshark (Enabled - Up to date) {82560C2E-0583-D6DC-5BE2-9811130C7854}
AV: Surfshark (Enabled - Up to date) {970B6311-2CDA-ED73-3084-2EF9DC9CA3D7}
AV: Surfshark (Enabled - Up to date) {F2631BC7-010E-7D54-2FBD-B07987F3EEDE}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Surfshark (Enabled - Up to date) {ADA4BA53-B05E-977C-E7CD-2220F00D5371}
AV: Surfshark (Enabled - Up to date) {61D2ED93-F75C-BA0D-4274-43D53B8C0EEE}
AV: Surfshark (Enabled - Up to date) {D510FCF1-2919-5104-422A-2671F708D014}
AV: Surfshark (Enabled - Up to date) {C335AD55-7413-E224-8D24-B867300522DC}
AV: Surfshark (Enabled - Up to date) {3B5764D2-2866-322F-23EA-43612FE7E085}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
Ableton Live 12 Lite (HKLM\...\{A782CDBF-DE96-455C-ACB6-47F523789952}) (Version: 12.0.0.0 - Ableton) Hidden
Ableton Live 12 Lite (HKLM-x32\...\{9DF7B836-4FC5-4750-AB46-C95F839517C2}) (Version: 12.0.0.0 - Ableton)
Ableton USB Audio Driver v5.68.0 (HKLM\...\{A823612A-AA91-4911-886A-7C589452C65C}) (Version: 5.68.0 - Ableton)
AMD Chipset Software (HKLM-x32\...\AMD_Chipset_IODrivers) (Version: 7.03.21.2116 - Advanced Micro Devices, Inc.)
AMD GPIO2 Driver (HKLM-x32\...\{E9DD399F-21A3-479E-A7DF-D6CF4B2ADBF3}) (Version: 2.2.0.134 - Advanced Micro Devices, Inc.) Hidden
AMD PCI Driver (HKLM-x32\...\{80EC3CEE-2940-42A1-A776-B5D810D39F1E}) (Version: 1.0.0.9 - Advanced Micro Devices, Inc.) Hidden
AMD PSP Driver (HKLM-x32\...\{988F14B8-79A8-475D-BAC7-83F96AD3D821}) (Version: 5.39.0.0 - Advanced Micro Devices, Inc.) Hidden
AMD Ryzen Balanced Driver (HKLM-x32\...\{A171D320-C42C-4F3B-A2D8-C6A09F6788CC}) (Version: 8.0.0.13 - Advanced Micro Devices, Inc.) Hidden
AMD Ryzen Master (HKLM\...\{02247819-03CD-414E-AC8D-FD518BFBA445}) (Version: 2.14.1.3277 - Advanced Micro Devices, Inc.) Hidden
AMD Ryzen Master (HKLM\...\AMD Ryzen Master) (Version: 2.14.1.3277 - Advanced Micro Devices, Inc.)
AMD SBxxx SMBus Driver (HKLM-x32\...\{AAE0E27D-C88A-49BA-8715-77ADCD4286A3}) (Version: 5.12.0.44 - Advanced Micro Devices, Inc.) Hidden
AMD_Chipset_Drivers (HKLM-x32\...\{99280239-9b64-482f-8fad-135b939a973b}) (Version: 7.03.21.2116 - Advanced Micro Devices, Inc.) Hidden
Application Verifier x64 External Package (HKLM\...\{D5419286-34A7-E062-1C25-013A7FA94E9C}) (Version: 10.1.19041.5609 - Microsoft) Hidden
Audacity 3.7.5 (HKLM\...\Audacity_is1) (Version: 3.7.5 - Audacity Team)
Brave (HKLM-x32\...\BraveSoftware Brave-Browser) (Version: 141.1.83.118 - Brave Software Inc)
Canon G3070 series Driver (HKLM\...\{1199FAD5-9546-44F3-81CF-FFDB8040B7BF}_Canon_G3070_series) (Version: 1.03 - Canon Inc.)
Canon IJ Printer Assistant Tool (HKLM-x32\...\Canon IJ Printer Assistant Tool) (Version: 1.90.3.36 - Canon Inc.)
Canon IJ Scan Utility (HKLM-x32\...\Canon_IJ_Scan_Utility) (Version: 1.7.0.5 - Canon Inc.)
CCleaner 7 (HKLM\...\CCleaner 7) (Version: 7.0.1010.1196 - Piriform)
Display Driver Uninstaller (HKLM-x32\...\Display Driver Uninstaller) (Version: 18.1.3.1 - Wagnardsoft)
Endpoint Protection SDK (HKLM\...\{68E1CCB4-4965-4713-BDEB-77F6D6C9BF9D}_is1) (Version: 1.0.2410.4113 - Avira Operations GmbH) Hidden
ENE Video Capture Box HAL (HKLM\...\{A096611D-BA11-4A1A-8D09-0A0462D7C8F2}) (Version: 1.0.5.15 - Ene Tech.) Hidden
ENE Video Capture Box HAL (HKLM-x32\...\{974259bf-3ed1-4cd6-9ed1-40c7f601a786}) (Version: 1.0.5.15 - Ene Tech.) Hidden
ENE_AIC_Marvell_HAL (HKLM\...\{085E2365-0A70-4230-B664-02D5E4FE7E9C}) (Version: 1.0.7.0 - ENE TECHNOLOGY INC.) Hidden
ENE_AIC_Marvell_HAL (HKLM-x32\...\{887e18fb-6bc3-4cd4-b34e-32d9ff71bbae}) (Version: 1.0.7.0 - ENE TECHNOLOGY INC.) Hidden
ENE_DRAM_RGB_AIO (HKLM\...\{5D2EC6F2-7EC3-486E-A144-7174E537A148}) (Version: 1.0.14.4 - Ene Tech.) Hidden
ENE_DRAM_RGB_AIO (HKLM-x32\...\{35a6f7ad-3ff5-4bdc-89a5-e166ef586e81}) (Version: 1.0.14.4 - Ene Tech.) Hidden
ENE_EHD_M2_HAL (HKLM\...\{37A48B7F-D4EA-4863-844E-A284E2AA3C5D}) (Version: 1.0.14.0 - ENE TECHNOLOGY INC.) Hidden
ENE_EHD_M2_HAL (HKLM-x32\...\{c1d017c2-8846-4000-9254-5689eccd462e}) (Version: 1.0.14.0 - ENE TECHNOLOGY INC.) Hidden
ENE_External_Device_HAL (HKLM\...\{2B8E611F-0B51-4FAC-87BB-AF50D82E7DDA}) (Version: 1.0.12.7 - ENE Tech) Hidden
ENE_External_Device_HAL (HKLM-x32\...\{a7b1cf47-d8f0-423d-9494-568195f1c864}) (Version: 1.0.12.7 - ENE Tech) Hidden
ENE_MousePad_HAL (HKLM\...\{9E97178A-ADB8-4778-BE60-7E28E2A72721}) (Version: 1.0.1.8 - ENE TECHNOLOGY INC.) Hidden
ENE_MousePad_HAL (HKLM-x32\...\{bf256b46-8ff7-48be-ab7f-5661e9a0651f}) (Version: 1.0.1.8 - ENE TECHNOLOGY INC.) Hidden
ENE_X_AIC_HAL (HKLM\...\{CF703694-01C6-4062-B797-84DB215662BC}) (Version: 1.0.6.3 - ENE TECHNOLOGY INC.) Hidden
ENE_X_AIC_HAL (HKLM-x32\...\{c662a481-d76a-4188-95d2-6eb4ffd55542}) (Version: 1.0.6.3 - ENE TECHNOLOGY INC.) Hidden
Focusrite Audio Drivers 4.119.13.33 (HKLM\...\Focusrite Audio Drivers_is1) (Version: 4.119.13.33 - Focusrite Audio Engineering, Ltd.)
Focusrite Control 3.18.0.204 (HKLM\...\Focusrite Control_is1) (Version: 3.18.0.204 - Focusrite Audio Engineering Ltd.)
Intel® Network Connections 26.2.0.1 (HKLM\...\{AC44C09E-6D45-4F0F-8749-C3DF69A55FDE}) (Version: 26.2.0.1 - Intel) Hidden
Intel® Network Connections 26.2.0.1 (HKLM\...\PROSetDX) (Version: 26.2.0.1 - Intel)
Intel® Wireless Bluetooth® (HKLM-x32\...\{00000120-0230-1033-84C8-B8D95FA3C8C3}) (Version: 23.120.0.4 - Intel Corporation)
Kits Configuration Installer (HKLM-x32\...\{85FC198B-F293-0ED4-CD62-09F136CBF5AD}) (Version: 10.1.19041.5609 - Microsoft) Hidden
LibreOffice 25.8.2.2 (HKLM\...\{5A843271-3782-4BE4-B76B-C89C37FC791E}) (Version: 25.8.2.2 - The Document Foundation)
Microsoft .NET Framework 4 Multi-Targeting Pack (HKLM-x32\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}) (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Host - 8.0.21 (x64) (HKLM\...\{72357746-B194-485C-A161-FB80F419DC20}) (Version: 64.84.40925 - Microsoft Corporation) Hidden
Microsoft .NET Host FX Resolver - 8.0.19 (x64) (HKLM\...\{69A17DA9-300A-49B9-97F1-1EB7424570DE}) (Version: 64.76.37566 - Microsoft Corporation) Hidden
Microsoft .NET Host FX Resolver - 8.0.21 (x64) (HKLM\...\{B382D796-20D3-45DA-AB94-E98D99668B10}) (Version: 64.84.40925 - Microsoft Corporation) Hidden
Microsoft .NET Runtime - 8.0.19 (x64) (HKLM\...\{B9F7A454-0CCD-410C-A3E0-D1AAC300F150}) (Version: 64.76.37566 - Microsoft Corporation) Hidden
Microsoft .NET Runtime - 8.0.21 (x64) (HKLM\...\{EEFB29A5-3E62-4DCE-8527-0DF45D780126}) (Version: 64.84.40925 - Microsoft Corporation) Hidden
Microsoft Edge WebView2 Runtime (HKLM-x32\...\Microsoft EdgeWebView) (Version: 141.0.3537.85 - Microsoft Corporation) Hidden
Microsoft Update Health Tools (HKLM\...\{C6FD611E-7EFE-488C-A0E0-974C09EF6473}) (Version: 5.72.0.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.61030 (HKLM\...\{37B8F9C7-03FB-3253-8781-2517C99D7C00}) (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.61030 (HKLM\...\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}) (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 (HKLM-x32\...\{B175520C-86A2-35A7-8619-86DC379688B9}) (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 (HKLM-x32\...\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}) (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.40.33816 (HKLM-x32\...\{77169412-f642-45e7-b533-0c6f48de12f9}) (Version: 14.40.33816.0 - Microsoft Corporation)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.44.35211 (HKLM-x32\...\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}) (Version: 14.44.35211.0 - Microsoft Corporation)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.44.35211 (HKLM-x32\...\{0b5169e3-39da-4313-808e-1f9c0407f3bf}) (Version: 14.44.35211.0 - Microsoft Corporation)
Microsoft Visual C++ 2019 X64 Debug Runtime - 14.29.30157 (HKLM\...\{B2D2DB83-DEF0-4638-A634-025F645DFBDB}) (Version: 14.29.30157 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2019 X86 Debug Runtime - 14.29.30157 (HKLM-x32\...\{C45C7D61-1241-4033-BF55-3F7A99E06DCA}) (Version: 14.29.30157 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.44.35211 (HKLM\...\{86AB2CC9-08BD-4643-B0F9-F82D006D72FF}) (Version: 14.44.35211 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.44.35211 (HKLM\...\{43B0D101-A022-48F4-9D04-BA404CEB1D53}) (Version: 14.44.35211 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.44.35211 (HKLM-x32\...\{C18FB403-1E88-43C8-AD8A-CED50F23DE8B}) (Version: 14.44.35211 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.44.35211 (HKLM-x32\...\{922480B5-CAEB-4B1B-AAA4-9716EFDCE26B}) (Version: 14.44.35211 - Microsoft Corporation) Hidden
Microsoft Visual Studio Installer (HKLM\...\{6F320B93-EE3C-4826-85E0-ADF79F8D4C61}) (Version: 3.12.2320.19252 - Microsoft Corporation)
Microsoft Visual Studio Setup Configuration (HKLM-x32\...\{6AC5612A-D067-44B9-9C8E-2C1B3473B429}) (Version: 3.7.2182.35401 - Microsoft Corporation) Hidden
Microsoft Visual Studio Setup WMI Provider (HKLM-x32\...\{E281F6E2-136B-4AF0-895B-253279711697}) (Version: 3.7.2182.35401 - Microsoft Corporation) Hidden
Microsoft Windows Desktop Runtime - 8.0.19 (x64) (HKLM\...\{A6EA542C-884C-4FE7-89E4-8C28E14B601C}) (Version: 64.76.37602 - Microsoft Corporation) Hidden
Microsoft Windows Desktop Runtime - 8.0.19 (x64) (HKLM-x32\...\{6b2575e2-0248-44c3-93f3-2eba040331ed}) (Version: 8.0.19.35118 - Microsoft Corporation)
Microsoft Windows Desktop Runtime - 8.0.21 (x64) (HKLM\...\{A32777AD-F93A-4F26-BEE6-9C5961EA71D6}) (Version: 64.84.40919 - Microsoft Corporation) Hidden
Microsoft Windows Desktop Runtime - 8.0.21 (x64) (HKLM-x32\...\{69a28bd2-b8bd-491a-a39d-5bcb13678463}) (Version: 8.0.21.35325 - Microsoft Corporation)
MSI Development Tools (HKLM-x32\...\{4CDB315B-7D34-AADB-B87D-9C00F56A430D}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Npcap (HKLM-x32\...\NpcapInst) (Version: 1.80 - Nmap Project)
NVIDIA Graphics Driver 580.64 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 580.64 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.23.1019 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.23.1019 - NVIDIA Corporation)
NZXT CAM 4.74.0 (HKLM\...\ac0666ae-ee66-5310-ac01-9d6348133b2d) (Version: 4.74.0 - NZXT, Inc.)
Patriot Viper M2 SSD RGB (HKLM\...\{8B4C0A3D-C135-4E1F-98D8-3926494B4D61}) (Version: 1.1.0.3 - Patriot Memory) Hidden
Patriot Viper M2 SSD RGB (HKLM-x32\...\{6e0eff60-c502-43bb-8f56-360ca07e73d9}) (Version: 1.1.0.3 - Patriot Memory) Hidden
Printer Registration (HKLM-x32\...\Canon EISRegistration) (Version: 1.9.2 - Canon Inc.)
Razer Synapse (HKLM-x32\...\Razer Synapse) (Version: 4.0.503 - Razer Inc.)
Realtek Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.9733.1 - Realtek Semiconductor Corp.)
Recuva (HKLM\...\Recuva) (Version: 1.54 - Piriform)
Revo Uninstaller 2.6.0 (HKLM\...\{A28DBDA2-3CC7-4ADC-8BFE-66D7743C6C97}_is1) (Version: 2.6.0 - VS Revo Group, Ltd.)
Samsung USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.7.61.0 - Samsung Electronics Co., Ltd.)
SDK ARM Additions (HKLM-x32\...\{4392AB59-ABB1-2E5F-21DF-0029512F36DD}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
SDK ARM Redistributables (HKLM-x32\...\{EFF45DAA-D9C6-D242-802F-64D01D664406}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Smart Backup (x64) (HKLM\...\{BC1FA5CF-A36F-4C61-9638-09D0B431B006}) (Version: 3.24.0829.1 - Gigabyte) Hidden
Smart Backup (x64) (HKLM-x32\...\InstallShield_{BC1FA5CF-A36F-4C61-9638-09D0B431B006}) (Version: 3.24.0829.1 - Gigabyte)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Surfshark (HKLM\...\{40310151-CB75-4513-88B9-7D52EB447656}) (Version: 6.1.1999 - Surfshark) Hidden
Surfshark (HKLM\...\Surfshark 6.1.1999) (Version: 6.1.1999 - Surfshark)
Universal CRT Extension SDK (HKLM-x32\...\{2D78CDCA-CE1A-6007-089C-E09908F8B1FD}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Universal CRT Headers Libraries and Sources (HKLM-x32\...\{6D7ACCE0-E08A-78C8-2EF5-63E9FAEA185C}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Universal CRT Redistributable (HKLM-x32\...\{0460C87B-7F4C-3170-FAC9-B7A6AE5CE4E9}) (Version: 10.0.26624 - Microsoft Corporation) Hidden
Universal CRT Redistributable (HKLM-x32\...\{8FB7909F-7079-FECC-1A06-B90A324C11E9}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Universal CRT Tools x64 (HKLM\...\{099178C3-9374-7477-8D34-B28BC8FC5488}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Universal CRT Tools x86 (HKLM-x32\...\{FC8CD9CE-8902-BB8D-F832-B33100439483}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Universal General MIDI DLS Extension SDK (HKLM-x32\...\{D2C85BA9-DA49-E2D5-D4C2-351C6C2C616F}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Update for  (KB2504637) (HKLM-x32\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}.KB2504637) (Version: 1 - Microsoft Corporation)
Update for Windows 10 for x64-based Systems (KB5001716) (HKLM\...\{85C69797-7336-4E83-8D97-32A7C8465A3B}) (Version: 8.94.0.0 - Microsoft Corporation)
vcpp_crt.redist.clickonce (HKLM-x32\...\{E2121340-F05B-48E1-BE1D-175FA97B2FC0}) (Version: 14.29.30157 - Microsoft Corporation) Hidden
Verbatim_SureFireGaming_Product (HKLM\...\{35CB65C6-A7E3-4EE7-AD40-738D70A72164}) (Version: 1.0.3.11 - Verbatim) Hidden
Verbatim_SureFireGaming_Product (HKLM-x32\...\{d601832a-0d94-46ce-9b19-78e8a5887313}) (Version: 1.0.3.11 - Verbatim) Hidden
Visual Studio Build Tools 2019 (HKLM-x32\...\4e3fa07e) (Version: 16.11.50 - Microsoft Corporation)
VLC media player (HKLM\...\VLC media player) (Version: 3.0.21 - VideoLAN)
VS Script Debugging Common (HKLM\...\{A4272808-82F5-410F-A5F9-1BF6F63F6B9A}) (Version: 16.0.102.0 - Microsoft Corporation) Hidden
vs_communitymsi (HKLM-x32\...\{375AFBC1-2264-470C-9ADE-2C0BF23328A2}) (Version: 16.11.34930 - Microsoft Corporation) Hidden
vs_communitymsires (HKLM-x32\...\{3751D1CF-9A44-43D2-B4BB-80FA6E7925A8}) (Version: 16.10.31213 - Microsoft Corporation) Hidden
vs_filehandler_amd64 (HKLM-x32\...\{102E83BD-B6A0-4C74-AD22-7D594A3435D3}) (Version: 16.11.31503 - Microsoft Corporation) Hidden
vs_filehandler_x86 (HKLM-x32\...\{6CBDE7BE-E956-4E0E-81FB-2CB79190C924}) (Version: 16.11.31503 - Microsoft Corporation) Hidden
vs_FileTracker_Singleton (HKLM-x32\...\{AB0010C0-CA62-40C7-BDED-DB2514BDCF19}) (Version: 16.11.34827 - Microsoft Corporation) Hidden
vs_minshellinteropmsi (HKLM-x32\...\{883D29E5-9A41-4C45-A192-C10B8078BF0C}) (Version: 16.10.31306 - Microsoft Corporation) Hidden
vs_minshellmsi (HKLM-x32\...\{C1337DAC-D78B-4435-B795-29E8B7D5E75C}) (Version: 16.11.34902 - Microsoft Corporation) Hidden
vs_minshellmsires (HKLM-x32\...\{0916C6E1-6A0A-4887-9E00-D96FD44AFACE}) (Version: 16.10.31303 - Microsoft Corporation) Hidden
WD P40 Game Drive (HKLM-x32\...\{72b1a866-fc31-4381-bff3-fa6cd8823777}) (Version: 1.0.2.18 - Western Digital Corporation) Hidden
WinAppDeploy (HKLM-x32\...\{532B792A-577A-C684-3BE0-8266D973A314}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows 11 Installation Assistant (HKLM-x32\...\{115DF11E-4B4C-4EA9-9A79-00DB0C7EF02D}) (Version: 1.4.19041.6448 - Microsoft Corporation)
Windows App Certification Kit Native Components (HKLM\...\{524581F7-19EF-7567-B516-028842672D5C}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows App Certification Kit SupportedApiList x86 (HKLM-x32\...\{2FC6E546-6997-84F3-1877-1F91046B81E1}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows App Certification Kit x64 (HKLM-x32\...\{F814F02A-ECCD-2CB1-EB70-1E330C810521}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows Desktop Extension SDK (HKLM-x32\...\{16E355AC-58E7-65EE-794A-96ACB540AEA1}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows Desktop Extension SDK Contracts (HKLM-x32\...\{D721DCB8-0930-F41C-6110-A00C41A0D32C}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows IoT Extension SDK (HKLM-x32\...\{12A505CB-AA40-378D-854F-E2CF6A7FF75F}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows IoT Extension SDK Contracts (HKLM-x32\...\{C3D2FB47-9403-6F43-621C-5E5141B41EDA}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows Mobile Extension SDK (HKLM-x32\...\{D97824BC-1F9C-9A98-A458-5B0D06ECB755}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows Mobile Extension SDK Contracts (HKLM-x32\...\{DF4C943F-A46A-E489-69CE-189C54B0487E}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows PC Health Check (HKLM\...\{B008D72C-0326-421E-BB2F-98BA5F9DDE9C}) (Version: 4.0.2410.23001 - Microsoft Corporation)
Windows SDK (HKLM-x32\...\{D0CDB467-54EA-52D0-C1EC-B0D8323015B0}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows SDK AddOn (HKLM-x32\...\{E63F47A7-9DBA-4154-A52F-36653BFB4028}) (Version: 10.1.0.0 - Microsoft Corporation)
Windows SDK ARM Desktop Tools (HKLM-x32\...\{FB88CFF1-D06D-72C3-0887-53277E92DAD2}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows SDK Desktop Headers arm (HKLM-x32\...\{8BE03D0F-0D5D-67F0-B04C-EC13A64C4BAC}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows SDK Desktop Headers arm64 (HKLM-x32\...\{27B3D59D-9D54-3EA4-4CCE-AE5E57918284}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows SDK Desktop Headers x64 (HKLM-x32\...\{A3B7C26F-BE21-6D16-77CA-BD5F1394A538}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows SDK Desktop Headers x86 (HKLM-x32\...\{A309246D-0781-212D-1424-4A6505425A44}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows SDK Desktop Libs arm (HKLM-x32\...\{CE78C7EF-312F-35EB-82F9-FDC326F08658}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows SDK Desktop Libs arm64 (HKLM-x32\...\{CA8A9642-147B-190E-76A3-87A23B97ADF9}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows SDK Desktop Libs x64 (HKLM-x32\...\{E22D77C1-306A-C916-15A0-08189F27E575}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows SDK Desktop Libs x86 (HKLM-x32\...\{842FBFC4-CCCC-6799-1998-17DED2BCE174}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows SDK Desktop Tools arm64 (HKLM-x32\...\{2825810D-881C-9FBB-7836-B0117552064F}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows SDK Desktop Tools x64 (HKLM-x32\...\{2A0C6A0D-A8A7-89B6-AA43-B5DF54E1E837}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows SDK Desktop Tools x86 (HKLM-x32\...\{0A2BCE78-63A3-9F82-AD76-17C310B3EAEF}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows SDK DirectX x64 Remote (HKLM\...\{61CAE9AB-D59A-4180-FBD1-9DE7046D0BCF}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows SDK DirectX x86 Remote (HKLM-x32\...\{8D87E449-DE1F-375B-D142-5391C06ED75C}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows SDK EULA (HKLM-x32\...\{E2037558-0217-B40C-F00C-07FDBB82347B}) (Version: 10.1.19041.5609 - Microsoft Corporations) Hidden
Windows SDK Facade Windows WinMD Versioned (HKLM-x32\...\{DE56820F-73F3-83D6-DA12-CEF0E7585FDD}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows SDK for Windows Store Apps (HKLM-x32\...\{778D640A-21E7-0A4A-0FB6-7C6F7FA4FDC2}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows SDK for Windows Store Apps Contracts (HKLM-x32\...\{911F65D7-229E-FDF5-2CDC-7A778E965FAB}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows SDK for Windows Store Apps DirectX x86 Remote (HKLM-x32\...\{AF19AD5B-2DF6-9862-B161-26B5BDB6D8EE}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows SDK for Windows Store Apps Headers (HKLM-x32\...\{9AE69F25-AAA9-19CA-A490-FD002EF55FB0}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows SDK for Windows Store Apps Libs (HKLM-x32\...\{8A69A3F8-0D09-7AEC-714B-21F63FD4F131}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows SDK for Windows Store Apps Metadata (HKLM-x32\...\{80A87973-098D-8903-956C-3244FC0461A1}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows SDK for Windows Store Apps Tools (HKLM-x32\...\{A8E49937-CC70-12A0-8B88-22A2AE629655}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows SDK for Windows Store Managed Apps Libs (HKLM-x32\...\{EDD486C3-91EA-0B4E-2618-4F4885CC6945}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows SDK Modern Non-Versioned Developer Tools (HKLM-x32\...\{77E28521-C063-BF41-60C0-0140F5C2F811}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows SDK Modern Versioned Developer Tools (HKLM-x32\...\{6293EB7C-9B82-5D3F-016A-87D94E8C8E85}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows SDK Redistributables (HKLM-x32\...\{44C9B7CF-544B-6C2D-0AA9-DBABEE0A1D7B}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows SDK Signing Tools (HKLM-x32\...\{2BCF4E86-E0B2-C9E0-10DC-26935253CF3D}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows Software Development Kit - Windows 10.0.19041.5609 (HKLM-x32\...\{5f4dc51d-f151-4325-8ba1-8b26169529a9}) (Version: 10.1.19041.5609 - Microsoft Corporation)
Windows Subsystem for Linux (HKLM\...\{FE9F6D2C-A292-4552-A748-A2DFD5984F6C}) (Version: 2.5.9.0 - Microsoft Corporation) Hidden
Windows Team Extension SDK (HKLM-x32\...\{A5B25F16-0699-7F93-9154-D749B6037381}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Windows Team Extension SDK Contracts (HKLM-x32\...\{47B777FC-0E69-8326-B50D-FEAB5995B4D6}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
WinRT Intellisense Desktop - en-us (HKLM-x32\...\{78F26630-7E77-27FD-1780-651E8B0EF32A}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
WinRT Intellisense Desktop - Other Languages (HKLM-x32\...\{2D57E5F2-DE65-816E-0AB4-58E046C34205}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
WinRT Intellisense IoT - en-us (HKLM-x32\...\{D09F9C76-321B-88B7-316B-E655F86BDB37}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
WinRT Intellisense IoT - Other Languages (HKLM-x32\...\{EC30B4D9-09E0-D607-CA2D-05EFE8F39C53}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
WinRT Intellisense Mobile - en-us (HKLM-x32\...\{0C75EFBC-6D0C-7516-AE74-4F9FADE79EA2}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
WinRT Intellisense PPI - en-us (HKLM-x32\...\{ED40E403-CBE8-0CA3-5662-E8859CBFA1C0}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
WinRT Intellisense PPI - Other Languages (HKLM-x32\...\{EE47B659-7AF5-9302-D4A4-3204070DB9C6}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
WinRT Intellisense UAP - en-us (HKLM-x32\...\{17FAE644-5409-EA4F-91AE-B4F213FB087B}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
WinRT Intellisense UAP - Other Languages (HKLM-x32\...\{B9369888-3610-E674-C077-322D40A10123}) (Version: 10.1.19041.5609 - Microsoft Corporation) Hidden
Wireshark 4.6.0 x64 (HKLM-x32\...\Wireshark) (Version: 4.6.0 - The Wireshark developer community, hxxps://www.wireshark.org)
 
Packages:
=========
@{MicrosoftWindows.58683691.InpApp_1000.26100.5790.0_x64__cw5n1h2txyewy?ms-resource://MicrosoftWindows.58683691.InpApp/Resources/ProductPkgDisplayName} -> C:\WINDOWS\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy [2025-09-21] (Microsoft Windows)
@{MicrosoftWindows.58683691.InpApp_1000.26100.6682.0_x64__cw5n1h2txyewy?ms-resource://MicrosoftWindows.58683691.InpApp/Resources/ProductPkgDisplayName} -> C:\WINDOWS\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy [2025-09-21] (Microsoft Windows)
Microsoft.MicrosoftPCManager -> C:\Program Files\WindowsApps\Microsoft.MicrosoftPCManager_3.17.14.0_x64__8wekyb3d8bbwe [2025-09-16] (Microsoft Corporation) [Startup Task]
NVIDIA Control Panel -> C:\Program Files\WindowsApps\NVIDIACorp.NVIDIAControlPanel_8.1.968.0_x64__56jybvy8sckqj [2025-09-16] (NVIDIA Corp.)
PowerShell -> C:\Program Files\WindowsApps\Microsoft.PowerShell_7.5.3.0_x64__8wekyb3d8bbwe [2025-09-17] (Microsoft Corporation)
Realtek Audio Control -> C:\Program Files\WindowsApps\RealtekSemiconductorCorp.RealtekAudioControl_1.50.323.0_x64__dt26b99r8h8gj [2025-09-16] (Realtek Semiconductor Corp)
Windows Feature Experience Pack -> C:\WINDOWS\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy [2025-09-21] (Microsoft Windows)
Windows Subsystem for Android™ -> C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForAndroid_2407.40000.4.0_x64__8wekyb3d8bbwe [2025-09-16] (Microsoft Corp.) [Startup Task]
Wintoys -> C:\Program Files\WindowsApps\11413PtruceanBogdan.Wintoys_2.4.12.0_x64__ankwhmsh70gj6 [2025-10-11] (Bogdan Pătrăucean)
 
==================== Custom CLSID (Whitelisted): ==============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} =>  -> No File
ContextMenuHandlers4: [RecuvaShellExt] -> {435E5DF5-2510-463C-B223-BDA47006D002} => C:\Program Files\Recuva\RecuvaShell64.dll [2024-05-22] (PIRIFORM SOFTWARE LIMITED -> Piriform Software Ltd)
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\WINDOWS\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_6cdc9372d41a2731\nvshext.dll [2025-09-06] (NVIDIA Corporation -> NVIDIA Corporation)
ContextMenuHandlers6: [RecuvaShellExt] -> {435E5DF5-2510-463C-B223-BDA47006D002} => C:\Program Files\Recuva\RecuvaShell64.dll [2024-05-22] (PIRIFORM SOFTWARE LIMITED -> Piriform Software Ltd)
 
==================== Codecs (Whitelisted) ====================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Drivers32: [MidisrvTransferComplete] => 0
 
==================== Shortcuts & WMI ========================
 
==================== Loaded Modules (Whitelisted) =============
 
2024-10-13 19:45 - 2023-10-30 05:00 - 000989696 _____ (CANON INC.) [File not signed] C:\WINDOWS\System32\CNMLMHX.DLL
2024-10-13 19:39 - 2023-10-30 05:00 - 000543744 _____ (CANON INC.) [File not signed] C:\WINDOWS\system32\spool\PRTPROCS\x64\CNMPDHX.DLL
2024-09-30 13:44 - 2021-09-21 05:02 - 000237568 _____ (Seiko Epson Corporation) [File not signed] C:\WINDOWS\System32\E1YLMBBHE.DLL
 
==================== Alternate Data Streams (Whitelisted) ========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
AlternateDataStreams: C:\Users\sh4rk\Downloads\Audacity_(64bit)_v3.7.3.exe:MBAM.Zone.Identifier [61]
AlternateDataStreams: C:\Users\sh4rk\Downloads\Display_Driver_Uninstaller_v18.1.1.0.exe:MBAM.Zone.Identifier [61]
AlternateDataStreams: C:\Users\sh4rk\Downloads\Glary_Utilities_v6.25.0.29.exe:MBAM.Zone.Identifier [61]
AlternateDataStreams: C:\Users\sh4rk\Downloads\gu6setup.exe:MBAM.Zone.Identifier [62]
AlternateDataStreams: C:\Users\sh4rk\Downloads\LibreOffice_(64bit)_v25.2.2.msi:MBAM.Zone.Identifier [61]
 
==================== Safe Mode (Whitelisted) ==================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
 
==================== Association (Whitelisted) =================
 
==================== Internet Explorer (Whitelisted) =============
 
BHO: GBHO.BHO -> {45d30484-7ded-43d9-957a-d2fd1f046511} -> C:\WINDOWS\system32\mscoree.dll [2025-09-01] (Microsoft Windows -> Microsoft Corporation)
Toolbar: HKLM - Smart Backup - {1d09c093-f71e-43c3-b948-19316cbd695e} - C:\WINDOWS\system32\mscoree.dll [2025-09-01] (Microsoft Windows -> Microsoft Corporation)
 
==================== Hosts content: =========================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2024-04-01 03:26 - 2025-10-19 13:59 - 000002790 _____ C:\WINDOWS\system32\drivers\etc\hosts
0.0.0.0 choice.microsoft.com.nstac.net
0.0.0.0 df.telemetry.microsoft.com
0.0.0.0 oca.telemetry.microsoft.com
0.0.0.0 oca.telemetry.microsoft.com.nsatc.net
0.0.0.0 redir.metaservices.microsoft.com
0.0.0.0 reports.wes.df.telemetry.microsoft.com
0.0.0.0 services.wes.df.telemetry.microsoft.com
0.0.0.0 settings-sandbox.data.microsoft.com
0.0.0.0 settings-win.data.microsoft.com
0.0.0.0 sqm.df.telemetry.microsoft.com
0.0.0.0 sqm.telemetry.microsoft.com
0.0.0.0 sqm.telemetry.microsoft.com.nsatc.net
0.0.0.0 telecommand.telemetry.microsoft.com
0.0.0.0 telecommand.telemetry.microsoft.com.nsatc.net
0.0.0.0 telemetry.appex.bing.net
0.0.0.0 telemetry.microsoft.com
0.0.0.0 telemetry.urs.microsoft.com
0.0.0.0 vortex-sandbox.data.microsoft.com
0.0.0.0 vortex-win.data.microsoft.com
0.0.0.0 vortex.data.microsoft.com
0.0.0.0 watson.telemetry.microsoft.com
0.0.0.0 watson.telemetry.microsoft.com.nsatc.net
0.0.0.0 watson.ppe.telemetry.microsoft.com
0.0.0.0 wes.df.telemetry.microsoft.com
0.0.0.0 vortex-bn2.metron.live.com.nsatc.net
0.0.0.0 vortex-cy2.metron.live.com.nsatc.net
0.0.0.0 watson.live.com
0.0.0.0 watson.microsoft.com
0.0.0.0 feedback.search.microsoft.com
0.0.0.0 feedback.windows.com
 
2025-01-16 02:52 - 2025-01-28 22:55 - 000000443 _____ C:\WINDOWS\system32\drivers\etc\hosts.ics
172.28.208.1 DESKTOP-FFE1RS1.mshome.net # 2030 1 1 28 2 55 23 968
 
==================== Network ===========================
 
(Currently there is no automatic fix for this section.)
 
DNS Servers: 151.236.14.64 - 194.156.228.111
Windows Firewall is enabled.
 
Network Binding:
=============
Ethernet: Intel® I211 Gigabit Network Connection -> e1r.sys
SurfsharkWireGuard: WireGuard Tunnel -> wireguard.sys
Wi-Fi: Intel® Wireless-AC 9260 160MHz -> Netwtw08.sys
OpenVPN Data Channel Offload for Surfshark: OpenVPN Data Channel Offload -> ovpn-dco.sys
Bluetooth Network Connection: Bluetooth Device (Personal Area Network) -> bthpan.sys
 
vms_vsf: Hyper-V Virtual Switch Extension Filter
INSECURE_NPCAP: Npcap Packet Driver (NPCAP)
ms_l1vhlwf: Nested Network Virtualization
vms_vsp: Hyper-V Virtual Switch Extension Protocol
 
==================== Other Areas ===========================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-996191584-2022938525-1902568006-1001\Control Panel\Desktop\\Wallpaper -> C:\WINDOWS\web\wallpaper\Windows\img19.jpg
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows Defender\Features => (TamperProtection: 1) (TamperProtectionSource: 5)
HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection => (DpaDisabled: 0)
HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes|Surfshark
 
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
(If an entry is included in the fixlist, it will be removed.)
 
HKLM\...\StartupApproved\StartupFolder: => "Ableton USB Audio Control Panel Autostart.lnk"
HKLM\...\StartupApproved\Run: => "SecurityHealth"
HKLM\...\StartupApproved\Run: => "Focusrite Notifier"
HKLM\...\StartupApproved\Run: => "RtkAudUService"
HKU\S-1-5-21-996191584-2022938525-1902568006-1001\...\StartupApproved\Run: => "OneDrive"
HKU\S-1-5-21-996191584-2022938525-1902568006-1001\...\StartupApproved\Run: => "Steam"
HKU\S-1-5-21-996191584-2022938525-1902568006-1001\...\StartupApproved\Run: => "EPLTarget\P0000000000000000"
HKU\S-1-5-21-996191584-2022938525-1902568006-1001\...\StartupApproved\Run: => "BingWallpaperApp"
HKU\S-1-5-21-996191584-2022938525-1902568006-1001\...\StartupApproved\Run: => "MicrosoftEdgeAutoLaunch_B3C3950657DA5A3DDEAD0496095E2143"
HKU\S-1-5-21-996191584-2022938525-1902568006-1001\...\StartupApproved\Run: => "Surfshark"
HKU\S-1-5-21-996191584-2022938525-1902568006-1001\...\StartupApproved\Run: => "Docker Desktop"
HKU\S-1-5-21-996191584-2022938525-1902568006-1001\...\StartupApproved\Run: => "WingetUI"
HKU\S-1-5-21-996191584-2022938525-1902568006-1001\...\StartupApproved\Run: => "CCleaner Smart Cleaning"
HKU\S-1-5-21-996191584-2022938525-1902568006-1001\...\StartupApproved\Run: => "NZXT.CAM"
 
==================== FirewallRules (Whitelisted) ================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [Microsoft-Windows-Unified-Telemetry-Client] => (Block) C:\WINDOWS\system32\svchost.exe (Microsoft Windows Publisher -> Microsoft Corporation)
FirewallRules: [{0B2ED3E4-1166-4C3F-98BF-700A37B350F8}] => (Allow) C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForAndroid_2407.40000.4.0_x64__8wekyb3d8bbwe\WsaClient\WsaClient.exe (Microsoft Corporation -> )
FirewallRules: [{1FA3B9A9-4998-4590-A942-4CB0FB3853F6}] => (Allow) C:\Program Files\Razer\RazerAppEngine\app-4.0.503\RazerAppEngine.exe (Razer USA Ltd. -> Razer Inc.)
FirewallRules: [{D42C9EFF-9054-441F-9DEE-62AB49A700BB}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Rocksmith2014\Rocksmith2014.exe (UBISOFT ENTERTAINMENT INC. -> )
FirewallRules: [{B2CEEC48-2522-45EC-8F6B-4C9D853CB3C4}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Rocksmith2014\Rocksmith2014.exe (UBISOFT ENTERTAINMENT INC. -> )
FirewallRules: [{69E63554-0473-41F6-8350-3B5BD7468677}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Left 4 Dead 2\left4dead2.exe () [File not signed]
FirewallRules: [{FCC1CC74-FD7A-4DE0-ABE2-F370216E91E5}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Left 4 Dead 2\left4dead2.exe () [File not signed]
FirewallRules: [{74C0F0D3-B9ED-45C2-BFEA-88F6F3AB30CA}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (Valve Corp. -> Valve Corporation)
FirewallRules: [{573DB46F-4DCD-4886-B8F2-5C4A73F074DC}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (Valve Corp. -> Valve Corporation)
FirewallRules: [{683E03DC-BA07-4761-B658-A68845E30B60}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe (Valve Corp. -> Valve Corporation)
FirewallRules: [{85FD311A-CF05-4836-91E6-A34987EBB0F5}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe (Valve Corp. -> Valve Corporation)
FirewallRules: [{BF74B50C-DF73-460F-B266-13F26CE8A7A0}] => (Allow) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe => No File
FirewallRules: [{048CF07E-24B2-4BC1-8765-DAECDC7A1DC7}] => (Allow) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe => No File
FirewallRules: [{0ADEBD67-9E20-4AA7-8B8D-4CF5D5A2B9D0}] => (Allow) C:\Program Files\WindowsApps\MicrosoftTeams_24244.507.3118.4732_x64__8wekyb3d8bbwe\msteams.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{A22584D6-9561-4A1F-9F3C-0F6A6954C36D}] => (Allow) C:\Program Files\WindowsApps\MicrosoftTeams_24244.507.3118.4732_x64__8wekyb3d8bbwe\msteams.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [TCP Query User{3E6AA518-CE9F-4D1D-B2D3-DCF9ADAD5E75}C:\program files (x86)\gigabyte\@bios\flashbios.exe] => (Allow) C:\program files (x86)\gigabyte\@bios\flashbios.exe => No File
FirewallRules: [UDP Query User{45FB0E83-94F1-4DA4-8778-6408E93BA93D}C:\program files (x86)\gigabyte\@bios\flashbios.exe] => (Allow) C:\program files (x86)\gigabyte\@bios\flashbios.exe => No File
FirewallRules: [TCP Query User{39A3D332-5B34-4727-81D4-D030BC105331}C:\program files (x86)\gigabyte\@bios\flashbios.exe] => (Allow) C:\program files (x86)\gigabyte\@bios\flashbios.exe => No File
FirewallRules: [UDP Query User{99BF4602-EF4B-4382-BD35-CFA4320FA285}C:\program files (x86)\gigabyte\@bios\flashbios.exe] => (Allow) C:\program files (x86)\gigabyte\@bios\flashbios.exe => No File
FirewallRules: [{C3560730-C753-4941-A1DB-DB89D2ACAA2B}] => (Allow) C:\Program Files\Focusrite\Focusrite Control\Server\ControlServer.exe () [File not signed]
FirewallRules: [TCP Query User{62A048FE-F378-4F63-88A2-6EEBDF1D25FF}C:\programdata\ableton\live 12 lite\program\ableton live 12 lite.exe] => (Allow) C:\programdata\ableton\live 12 lite\program\ableton live 12 lite.exe (Ableton AG -> Ableton)
FirewallRules: [UDP Query User{16DB2FF2-0B6C-48DF-8694-3489F21CD3BE}C:\programdata\ableton\live 12 lite\program\ableton live 12 lite.exe] => (Allow) C:\programdata\ableton\live 12 lite\program\ableton live 12 lite.exe (Ableton AG -> Ableton)
FirewallRules: [{424A31E9-852A-4D65-9FAC-F23CAE474422}] => (Allow) C:\Program Files\GIGABYTE\Control Center\GCC.exe => No File
FirewallRules: [TCP Query User{8CA8B756-087F-4EE4-A54D-85462E608E67}C:\program files\gigabyte\control center\gcc.exe] => (Block) C:\program files\gigabyte\control center\gcc.exe => No File
FirewallRules: [UDP Query User{D26916BE-4C45-4028-9CDA-A36412AA5631}C:\program files\gigabyte\control center\gcc.exe] => (Block) C:\program files\gigabyte\control center\gcc.exe => No File
FirewallRules: [{DCAE659E-66B2-4205-8D0D-76A4F4A347C5}] => (Allow) C:\Program Files\GIGABYTE\Control Center\GCC.exe => No File
FirewallRules: [{C2242EDE-964F-4BC0-B1B1-0ABCAE7EEB48}] => (Allow) C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe (Brave Software, Inc. -> Brave Software, Inc.)
 
==================== Restore Points =========================
 
05-10-2025 14:17:29 TRON v12.0.8: Pre-run checkpoint
08-10-2025 19:41:25 Windows Update
13-10-2025 16:24:32 Windows Update
16-10-2025 18:46:42 Windows Update
19-10-2025 14:04:48 Revo Uninstaller's restore point - Tor Browser
20-10-2025 16:14:24 Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.40.33816
20-10-2025 16:15:56 Piriform Driver Updater Restore Point
20-10-2025 21:21:06 Piriform Driver Updater Restore Point
20-10-2025 23:57:54 Piriform Driver Updater Restore Point
21-10-2025 08:04:59 Piriform Driver Updater Restore Point
 
==================== Faulty Device Manager Devices ============
 
==================== Event log errors: ========================
 
Application errors:
==================
Error: (10/21/2025 10:02:24 AM) (Source: VSS) (EventID: 12292) (User: )
Description: Volume Shadow Copy Service error: Error creating the Shadow Copy Provider COM class with CLSID {e5b50e88-1fd9-4123-bdad-d0e79026fa55} [0x80110802].
 
 
Operation:
   Obtain a callable interface for this provider
   List interfaces for all providers supporting this context
   Delete Shadow Copies
 
Context:
   Provider ID: {02029a6e-d74a-4ecd-ba26-c12be9323128}
   Class ID: {e5b50e88-1fd9-4123-bdad-d0e79026fa55}
   Snapshot Context: -1
   Snapshot Context: -1
   Execution Context: Coordinator
 
Error: (10/21/2025 10:02:24 AM) (Source: VSS) (EventID: 13) (User: )
Description: Volume Shadow Copy Service information: The COM Server with CLSID {e5b50e88-1fd9-4123-bdad-d0e79026fa55} and name SW_PROV cannot be started. [0x80110802]
 
 
Operation:
   Obtain a callable interface for this provider
   List interfaces for all providers supporting this context
   Delete Shadow Copies
 
Context:
   Provider ID: {02029a6e-d74a-4ecd-ba26-c12be9323128}
   Class ID: {e5b50e88-1fd9-4123-bdad-d0e79026fa55}
   Snapshot Context: -1
   Snapshot Context: -1
   Execution Context: Coordinator
 
Error: (10/21/2025 10:02:24 AM) (Source: VSS) (EventID: 12292) (User: )
Description: Volume Shadow Copy Service error: Error creating the Shadow Copy Provider COM class with CLSID {e5b50e88-1fd9-4123-bdad-d0e79026fa55} [0x80110802].
 
 
Operation:
   Obtain a callable interface for this provider
   List interfaces for all providers supporting this context
   Get Shadow Copy Properties
   Delete Shadow Copies
 
Context:
   Provider ID: {02029a6e-d74a-4ecd-ba26-c12be9323128}
   Class ID: {e5b50e88-1fd9-4123-bdad-d0e79026fa55}
   Snapshot Context: -1
   Snapshot Context: -1
   Execution Context: Coordinator
   Execution Context: Coordinator
 
Error: (10/21/2025 10:02:24 AM) (Source: VSS) (EventID: 13) (User: )
Description: Volume Shadow Copy Service information: The COM Server with CLSID {e5b50e88-1fd9-4123-bdad-d0e79026fa55} and name SW_PROV cannot be started. [0x80110802]
 
 
Operation:
   Obtain a callable interface for this provider
   List interfaces for all providers supporting this context
   Get Shadow Copy Properties
   Delete Shadow Copies
 
Context:
   Provider ID: {02029a6e-d74a-4ecd-ba26-c12be9323128}
   Class ID: {e5b50e88-1fd9-4123-bdad-d0e79026fa55}
   Snapshot Context: -1
   Snapshot Context: -1
   Execution Context: Coordinator
   Execution Context: Coordinator
 
Error: (10/21/2025 10:02:24 AM) (Source: VSS) (EventID: 12292) (User: )
Description: Volume Shadow Copy Service error: Error creating the Shadow Copy Provider COM class with CLSID {e5b50e88-1fd9-4123-bdad-d0e79026fa55} [0x80110802].
 
 
Operation:
   Obtain a callable interface for this provider
   List interfaces for all providers supporting this context
   Query Shadow Copies
 
Context:
   Provider ID: {02029a6e-d74a-4ecd-ba26-c12be9323128}
   Class ID: {e5b50e88-1fd9-4123-bdad-d0e79026fa55}
   Snapshot Context: -1
   Snapshot Context: -1
   Execution Context: Coordinator
 
Error: (10/21/2025 10:02:24 AM) (Source: VSS) (EventID: 13) (User: )
Description: Volume Shadow Copy Service information: The COM Server with CLSID {e5b50e88-1fd9-4123-bdad-d0e79026fa55} and name SW_PROV cannot be started. [0x80110802]
 
 
Operation:
   Obtain a callable interface for this provider
   List interfaces for all providers supporting this context
   Query Shadow Copies
 
Context:
   Provider ID: {02029a6e-d74a-4ecd-ba26-c12be9323128}
   Class ID: {e5b50e88-1fd9-4123-bdad-d0e79026fa55}
   Snapshot Context: -1
   Snapshot Context: -1
   Execution Context: Coordinator
 
Error: (10/21/2025 10:02:24 AM) (Source: VSS) (EventID: 12292) (User: )
Description: Volume Shadow Copy Service error: Error creating the Shadow Copy Provider COM class with CLSID {e5b50e88-1fd9-4123-bdad-d0e79026fa55} [0x80110802].
 
 
Operation:
   Obtain a callable interface for this provider
   List interfaces for all providers supporting this context
   Query Shadow Copies
 
Context:
   Provider ID: {02029a6e-d74a-4ecd-ba26-c12be9323128}
   Class ID: {e5b50e88-1fd9-4123-bdad-d0e79026fa55}
   Snapshot Context: -1
   Snapshot Context: -1
   Execution Context: Coordinator
 
Error: (10/21/2025 10:02:24 AM) (Source: VSS) (EventID: 13) (User: )
Description: Volume Shadow Copy Service information: The COM Server with CLSID {e5b50e88-1fd9-4123-bdad-d0e79026fa55} and name SW_PROV cannot be started. [0x80110802]
 
 
Operation:
   Obtain a callable interface for this provider
   List interfaces for all providers supporting this context
   Query Shadow Copies
 
Context:
   Provider ID: {02029a6e-d74a-4ecd-ba26-c12be9323128}
   Class ID: {e5b50e88-1fd9-4123-bdad-d0e79026fa55}
   Snapshot Context: -1
   Snapshot Context: -1
   Execution Context: Coordinator
 
 
System errors:
=============
Error: (10/21/2025 09:30:09 AM) (Source: Microsoft-Windows-Kernel-Boot) (EventID: 124) (User: NT AUTHORITY)
Description: 03225747456
 
Error: (10/21/2025 09:30:09 AM) (Source: Microsoft-Windows-Hyper-V-Hypervisor) (EventID: 42) (User: NT AUTHORITY)
Description: Hypervisor launch failed; Either SVM not present or not enabled in BIOS.
 
Error: (10/21/2025 08:19:48 AM) (Source: Microsoft-Windows-Kernel-Boot) (EventID: 124) (User: NT AUTHORITY)
Description: 03225747456
 
Error: (10/21/2025 08:19:48 AM) (Source: Microsoft-Windows-Hyper-V-Hypervisor) (EventID: 42) (User: NT AUTHORITY)
Description: Hypervisor launch failed; Either SVM not present or not enabled in BIOS.
 
Error: (10/21/2025 08:19:16 AM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: The Background Intelligent Transfer Service service terminated with the following service-specific error: 
%%(2147942450 = The request is not supported.)
 
Error: (10/21/2025 08:19:16 AM) (Source: Microsoft-Windows-Bits-Client) (EventID: 16392) (User: NT AUTHORITY)
Description: The BITS service failed to start.  Error 2147942450.
 
Error: (10/21/2025 08:19:03 AM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-FFE1RS1)
Description: The server {2593F8B9-4EAF-457C-B68A-50F6B8EA6B54} did not register with DCOM within the required timeout.
 
Error: (10/21/2025 08:18:39 AM) (Source: Microsoft-Windows-Kernel-Boot) (EventID: 124) (User: NT AUTHORITY)
Description: 03225747456
 
 
Windows Defender:
================
Date: 2025-10-21 09:31:32
Description: 
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
Name: SettingsModifier:Win32/PossibleHostsFileHijack
Severity: Medium
Category: Settings Modifier
Path: file:_C:\Windows\System32\drivers\etc\hosts
Detection Origin: Local machine
Detection Type: Concrete
Detection Source: Real-Time Protection
Process Name: C:\Program Files\Surfshark\Endpoint Protection SDK\endpointprotection.exe
Security intelligence Version: AV: 1.439.315.0, AS: 1.439.315.0, NIS: 1.439.315.0
Engine Version: AM: 1.1.25100.3, NIS: 1.1.25100.3 
 
Date: 2025-10-21 08:21:10
Description: 
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
Name: SettingsModifier:Win32/PossibleHostsFileHijack
Severity: Medium
Category: Settings Modifier
Path: file:_C:\Windows\System32\drivers\etc\hosts
Detection Origin: Local machine
Detection Type: Concrete
Detection Source: Real-Time Protection
Process Name: C:\Program Files\Surfshark\Endpoint Protection SDK\endpointprotection.exe
Security intelligence Version: AV: 1.439.315.0, AS: 1.439.315.0, NIS: 1.439.315.0
Engine Version: AM: 1.1.25100.3, NIS: 1.1.25100.3 
 
Date: 2025-10-21 08:15:59
Description: 
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
Name: SettingsModifier:Win32/PossibleHostsFileHijack
Severity: Medium
Category: Settings Modifier
Path: file:_C:\Windows\System32\drivers\etc\hosts
Detection Origin: Local machine
Detection Type: Concrete
Detection Source: Real-Time Protection
Process Name: C:\Program Files\Surfshark\Endpoint Protection SDK\endpointprotection.exe
Security intelligence Version: AV: 1.439.315.0, AS: 1.439.315.0, NIS: 1.439.315.0
Engine Version: AM: 1.1.25100.3, NIS: 1.1.25100.3 
 
Date: 2025-10-21 06:49:21
Description: 
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
Name: SettingsModifier:Win32/PossibleHostsFileHijack
Severity: Medium
Category: Settings Modifier
Path: file:_C:\Windows\System32\drivers\etc\hosts
Detection Origin: Local machine
Detection Type: Concrete
Detection Source: Real-Time Protection
Process Name: C:\Program Files\Surfshark\Endpoint Protection SDK\endpointprotection.exe
Security intelligence Version: AV: 1.439.315.0, AS: 1.439.315.0, NIS: 1.439.315.0
Engine Version: AM: 1.1.25100.3, NIS: 1.1.25100.3 
 
Date: 2025-10-21 02:54:20
Description: 
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
Name: SettingsModifier:Win32/PossibleHostsFileHijack
Severity: Medium
Category: Settings Modifier
Path: file:_C:\Windows\System32\drivers\etc\hosts
Detection Origin: Local machine
Detection Type: Concrete
Detection Source: Real-Time Protection
Process Name: C:\Program Files\Surfshark\Endpoint Protection SDK\endpointprotection.exe
Security intelligence Version: AV: 1.439.315.0, AS: 1.439.315.0, NIS: 1.439.315.0
Engine Version: AM: 1.1.25100.3, NIS: 1.1.25100.3 
Event[0]
 
Date: 2025-10-20 08:18:06
Description: 
Microsoft Defender Antivirus has encountered an error trying to update security intelligence.
New security intelligence Version: 
Previous security intelligence Version: 0.0.0.0
Update Source: Microsoft Update Server
Security intelligence Type: AntiVirus
Update Type: Full
Current Engine Version: 
Previous Engine Version: 0.0.0.0
Error code: 0x80070643
Error description: Fatal error during installation.  
 
Date: 2025-10-18 12:22:38
Description: 
Microsoft Defender Antivirus has encountered an error trying to update security intelligence and will attempt to revert to a previous version.
Security intelligence Attempted: Current
Error Code: 0x80070002
Error description: The system cannot find the file specified. 
Security intelligence Version: 0.0.0.0;0.0.0.0
Engine Version: 0.0.0.0 
 
Date: 2025-10-03 16:59:06
Description: 
Microsoft Defender Antivirus has encountered an error trying to update security intelligence.
New security intelligence Version: 
Previous security intelligence Version: 1.435.575.0
Update Source: Microsoft Update Server
Security intelligence Type: AntiVirus
Update Type: Full
Current Engine Version: 
Previous Engine Version: 1.1.25080.5
Error code: 0x80240022
Error description: The program can't check for definition updates.  
 
CodeIntegrity:
===============
Date: 2025-10-21 10:02:13
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Surfshark\Endpoint Protection SDK\amsi\x64\avamsi.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. 
 
 
==================== Memory info =========================== 
 
BIOS: American Megatrends International, LLC. F38f 09/20/2023
Motherboard: Gigabyte Technology Co., Ltd. X570 AORUS ELITE WIFI
Processor: AMD Ryzen 7 5800X 8-Core Processor 
Percentage of memory in use: 20%
Total physical RAM: 32695.16 MB
Available physical RAM: 26021.74 MB
Total Virtual: 34743.16 MB
Available Virtual: 27255.88 MB
 
==================== Drives ================================
 
Drive c: () (Fixed) (Total:1906.77 GB) (Free:1769.44 GB) (Model: T-FORCE TM8FP8002T) NTFS
 
\\?\Volume{5fc09852-ac7f-41a3-9b96-f2fdf89bbf5a}\ () (Fixed) (Total:0.84 GB) (Free:0.15 GB) NTFS
\\?\Volume{6312b8bb-9354-4f45-8694-a1c6cbb2e8d4}\ () (Fixed) (Total:0.09 GB) (Free:0.06 GB) FAT32
 
==================== MBR & Partition Table ====================
 
==========================================================
Disk: 0 (MBR Code: Windows 7/8/10) (Size: 1907.7 GB) (Disk ID: 46A9EFE9)
 
Partition: GPT.
 
==================== End of Addition.txt =======================
 


BC AdBot (Login to Remove)

 


#2 dennis_l

dennis_l

  •  Avatar image
  • Malware Response Team
  • 5,062 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:03:09 PM

Posted 23 October 2025 - 03:56 AM

Hi sh4rkbyt31,
My name is Dennis and I will assist you with your computer problems.
Please read through these guidelines before we start.

  • Back up any important data, as a precaution, before starting this process.
  • If you are unsure about anything then please ask. This makes the task much easier in the long run.
  • Do not run any other tools or make changes to your system during the removal process.
  • Please do not start a new topic and keep all replies in this thread.
  • Follow the instructions in the sequence advised.
  • Copy and paste the logs into the reply. I will advise if anything needs to be added as an attachment.
  • Here at Bleeping Computer we are mostly volunteers, so please be patient with us. I’ll try to respond within 24 hours. You will be advised if it is expected to be longer than 48 hours. 
  • Please let me know if you are going to be delayed in responding. If you do not reply after 5 days, I’ll assume you do not want to continue and will close the topic.
  • Sometimes things might seem to be resolved, but there may still need to be more checks necessary, so please wait until I give the all clear.

Please give me some time to examine your logs and I will get back to you as soon as possible.

Dennis



#3 dennis_l

dennis_l

  •  Avatar image
  • Malware Response Team
  • 5,062 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:03:09 PM

Posted 23 October 2025 - 05:51 AM

Regarding your concerns.
1) Please advise what troubleshooting steps you have already taken on the DVD issue.
2) I noted this registry setting in the log.

HKLM\SYSTEM\...\Terminal Server: [fDenyTSConnections] = 0 <==== ATTENTION

This indicates that Remote Desktop connections are enabled, which is unusual for Windows Home edition.
Were you aware of this?
3) We can run some maintenace steps and if the file issue persists afterwards, then I'd need some specific examples.
Also
4) Are you aware of this folder?
C:\fix
5) There are nine AV: Surfshark  entries in the Security Center.
Any idea why there are so many?
6) Have you intentionally edited the hosts file to block Telemetry?
Please advise on the above and we can then run a cleanup/maintenence script.



#4 sh4rkbyt31

sh4rkbyt31
  • Topic Starter

  •  Avatar image
  • Members
  • 86 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:09 AM

Posted 23 October 2025 - 10:18 AM

Thank you so much for replying Dennis.

With the DVD issue I tried applying every suggestion I could find online and also what Microsoft advised, to no avail.

I was not aware of the Remote Desktop connections still being enabled. I think that was used months to a year ago when I was using Avast as my AV which I have since discontinued and they remoted in to my desktop to repair an installation.

(allegedly).

 

I will be happy to run whatever you think is necessary and would be helpful.

 

Yes, C:\fix I added about a year (?) ago which had tools inside I was using to cleanup my system.

 

Not sure why there are so many Surfshark entries to be honest. When I first started using their service there were a lot of problems with it starting up is all I remember?

Yes I intentionally edited the Telemetry hosts file to block at least some of MS.



#5 sh4rkbyt31

sh4rkbyt31
  • Topic Starter

  •  Avatar image
  • Members
  • 86 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:09 AM

Posted 23 October 2025 - 10:24 AM

The DVD drive worked until an MS Update and then it disappeared from my system. I could find it in My Devices but not in my File Explorer location on Windows 11? It both disappeared and stopped working altogether so that's why I went through the many suggestions online as well as the Microsoft suggestions.



#6 dennis_l

dennis_l

  •  Avatar image
  • Malware Response Team
  • 5,062 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:03:09 PM

Posted 23 October 2025 - 11:47 AM

We can come back to the DVD drive later.
Let's disable Remote Desktop then, which is included in the fix below.
I wouldn't have thought it was necessary to have all of those Surfshark AV entries and suspect some may be obsolete. Do you plan to keep Surfshark?
If you do, try clicking on the Windows Security shield and then Virus and threat protection.
Click on Manage providers on the right hand side and see if there is any more information on these.
(Version number etc.)
---------------------------------------------------
Could you please run this FRST script next.
As a part of this I have included the Emptytemp: command.
Note: This will remove cookies and may result in some websites (like banking) indicating they do not recognize your computer. It may be necessary to receive and apply a verification code.
Important: This script was written specifically for you, for use only on this machine. Running this on another machine may cause damage to your operating system

  • Right click on the FRST icon and select Run as administrator.
  • Highlight all of the information in the text box below then hit the Ctrl + C keys together to copy the text.
  • It is not necessary to paste the information anywhere as FRST will do this for you.
Start::
CreateRestorePoint:
CloseProcesses:
HKLM\...\Run: [] => [X]
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-996191584-2022938525-1902568006-1001\...\Run: [] => [X]
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\MRT: Restriction <==== ATTENTION
HKLM\SYSTEM\...\Terminal Server: [fDenyTSConnections] = 0 <==== ATTENTION
HKLM\Software\...\Authentication\Credential Providers: [{C885AA15-1764-4293-B82A-0586ADD46B35}] -> 
HKLM\SOFTWARE\Policies\Microsoft\Edge: Restriction <==== ATTENTION
AlternateDataStreams: C:\Users\sh4rk\Downloads\Audacity_(64bit)_v3.7.3.exe:MBAM.Zone.Identifier [61]
AlternateDataStreams: C:\Users\sh4rk\Downloads\Display_Driver_Uninstaller_v18.1.1.0.exe:MBAM.Zone.Identifier [61]
AlternateDataStreams: C:\Users\sh4rk\Downloads\Glary_Utilities_v6.25.0.29.exe:MBAM.Zone.Identifier [61]
AlternateDataStreams: C:\Users\sh4rk\Downloads\gu6setup.exe:MBAM.Zone.Identifier [62]
AlternateDataStreams: C:\Users\sh4rk\Downloads\LibreOffice_(64bit)_v25.2.2.msi:MBAM.Zone.Identifier [61]
Task: {077BA067-7C15-40F0-B22E-C9DC2A54B4A2} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe  (No File)
Task: {CCDFC0B8-01A3-4E74-A820-4F13F51D269E} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => %SystemRoot%\System32\MbaeParserTask.exe  (No File)
Task: {0BB36A32-0D9E-4297-AFD7-6BD7B5DB4C9B} - System32\Tasks\Microsoft\Windows\UNP\RunUpdateNotificationMgr => %windir%\System32\UNP\UpdateNotificationMgr.exe  (No File)
Task: {7BC9F5B8-4888-437D-8E69-132470940556} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_AC => %systemroot%\system32\MusNotification.exe  /RunOnAC RebootDialog (No File)
Task: {51DADB31-C111-48E4-AC6A-D76F39791353} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery => %systemroot%\system32\MusNotification.exe  /RunOnBattery RebootDialog (No File)
Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe  (No File)
Task: {A43DC670-FE8E-446D-8283-5EFECFE935A8} - System32\Tasks\Piriform\CCleaner 7 Update => C:\Program Files\Common Files\Piriform\Icarus\piriform-ccl\icarus.exe  /update:piriform-ccl /silent (No File)
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} =>  -> No File
FirewallRules: [{BF74B50C-DF73-460F-B266-13F26CE8A7A0}] => (Allow) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe => No File
FirewallRules: [{048CF07E-24B2-4BC1-8765-DAECDC7A1DC7}] => (Allow) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe => No File
FirewallRules: [TCP Query User{3E6AA518-CE9F-4D1D-B2D3-DCF9ADAD5E75}C:\program files (x86)\gigabyte\@bios\flashbios.exe] => (Allow) C:\program files (x86)\gigabyte\@bios\flashbios.exe => No File
FirewallRules: [UDP Query User{45FB0E83-94F1-4DA4-8778-6408E93BA93D}C:\program files (x86)\gigabyte\@bios\flashbios.exe] => (Allow) C:\program files (x86)\gigabyte\@bios\flashbios.exe => No File
FirewallRules: [TCP Query User{39A3D332-5B34-4727-81D4-D030BC105331}C:\program files (x86)\gigabyte\@bios\flashbios.exe] => (Allow) C:\program files (x86)\gigabyte\@bios\flashbios.exe => No File
FirewallRules: [UDP Query User{99BF4602-EF4B-4382-BD35-CFA4320FA285}C:\program files (x86)\gigabyte\@bios\flashbios.exe] => (Allow) C:\program files (x86)\gigabyte\@bios\flashbios.exe => No File
FirewallRules: [{424A31E9-852A-4D65-9FAC-F23CAE474422}] => (Allow) C:\Program Files\GIGABYTE\Control Center\GCC.exe => No File
FirewallRules: [TCP Query User{8CA8B756-087F-4EE4-A54D-85462E608E67}C:\program files\gigabyte\control center\gcc.exe] => (Block) C:\program files\gigabyte\control center\gcc.exe => No File
FirewallRules: [UDP Query User{D26916BE-4C45-4028-9CDA-A36412AA5631}C:\program files\gigabyte\control center\gcc.exe] => (Block) C:\program files\gigabyte\control center\gcc.exe => No File
FirewallRules: [{DCAE659E-66B2-4205-8D0D-76A4F4A347C5}] => (Allow) C:\Program Files\GIGABYTE\Control Center\GCC.exe => No File
S3 LibreOfficeMaintenance; "C:\Program Files\LibreOffice\program\update_service.exe" [X]
U4 npcap_wifi; no ImagePath
S3 SIVDriver; \??\C:\WINDOWS\system32\Drivers\SIVX64.sys [X]
cmd: bitsadmin /reset /allusers
cmd: sfc /scannow
cmd: DISM /Online /Cleanup-Image /RestoreHealth
Emptytemp:
End::
  • Click on the Fix button just once and wait.
  • If the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
  • When it's finished FRST will generate a log in the location you ran the tool from. (Fixlog.txt).

Please copy the contents from this text file and paste into your next reply.
Also advise how your computer is running now.



#7 sh4rkbyt31

sh4rkbyt31
  • Topic Starter

  •  Avatar image
  • Members
  • 86 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:09 AM

Posted 23 October 2025 - 01:32 PM

The only FRST file on my desktop looks like the original one? I'll copy and past it here though.

Yes, I do plan on keeping Surfshark.

When I clicked on Manage Providers under Web Protection it says No Providers

 

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 21-10-2025
Ran by sh4rk (administrator) on DESKTOP-FFE1RS1 (Gigabyte Technology Co., Ltd. X570 AORUS ELITE WIFI) (21-10-2025 10:02:16)
Running from C:\Users\sh4rk\Downloads\FRST64.exe
Loaded Profiles: sh4rk
Platform: Microsoft Windows 11 Home Version 25H2 26220.6690 (X64) Language: English (United States)
Default browser: Brave
Boot Mode: Normal
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(C:\Program Files\Piriform\CCleaner 7\CCleaner_service.exe ->) (Gen Digital Inc. -> Gen Digital Inc.) C:\Program Files\Piriform\CCleaner 7\wa_3rd_party_host_32.exe
(C:\Program Files\Piriform\CCleaner 7\CCleaner_service.exe ->) (Gen Digital Inc. -> Gen Digital Inc.) C:\Program Files\Piriform\CCleaner 7\wa_3rd_party_host_64.exe
(C:\Program Files\Surfshark\Endpoint Protection SDK\endpointprotection.exe ->) (Avira Operations GmbH -> Avira Operations GmbH) C:\Program Files\Surfshark\Endpoint Protection SDK\SentryEye.exe
(explorer.exe ->) (Brave Software, Inc. -> Brave Software, Inc.) C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe <18>
(explorer.exe ->) (Microsoft Corporation -> MSPCManager) C:\Program Files\WindowsApps\Microsoft.MicrosoftPCManager_3.17.14.0_x64__8wekyb3d8bbwe\PCManager\MSPCManager.exe
(explorer.exe ->) (Surfshark B.V. -> Surfshark) C:\Program Files\Surfshark\Surfshark.exe
(Microsoft Corporation -> MSPCManagerCore) C:\Program Files\WindowsApps\Microsoft.MicrosoftPCManager_3.17.14.0_x64__8wekyb3d8bbwe\PCManager\MSPCManagerCore.exe
(services.exe ->) () [File not signed] C:\Program Files\Focusrite\Focusrite Control\Server\ControlServer.exe
(services.exe ->) (Advanced Micro Devices -> AMD) C:\Program Files\AMD\Performance Profile Client\AUEPDU.exe
(services.exe ->) (Avira Operations GmbH -> Avira Operations GmbH) C:\Program Files\Surfshark\Endpoint Protection SDK\endpointprotection.exe
(services.exe ->) (Canon Inc. -> ) C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
(services.exe ->) (Canon Inc. -> CANON INC.) C:\Program Files (x86)\Canon\IJ Scan Utility\SETEVENT.exe
(services.exe ->) (Gen Digital Inc. -> Gen Digital Inc.) C:\Program Files\Piriform\CCleaner 7\CCleaner_service.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_2.6.2.0_x64__8wekyb3d8bbwe\wslinstaller.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\WSL\wslservice.exe
(services.exe ->) (Microsoft Corporation -> MSPCManagerService) C:\Program Files\WindowsApps\Microsoft.MicrosoftPCManager_3.17.14.0_x64__8wekyb3d8bbwe\PCManager\MSPCManagerService.exe
(services.exe ->) (ND_Apps -> Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(services.exe ->) (NVIDIA Corporation -> NVIDIA Corporation) C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_6cdc9372d41a2731\Display.NvContainer\NVDisplay.Container.exe <2>
(services.exe ->) (NZXT, Inc. -> ) C:\Program Files\NZXT CAM\resources\app.asar.unpacked\node_modules\@nzxt\cam-core\dist\service.exe
(services.exe ->) (Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Windows\System32\DriverStore\FileRepository\realtekservice.inf_amd64_c2fa179f72a88c18\RtkAudUService64.exe
(services.exe ->) (Samsung Electronics CO., LTD. -> DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe
(services.exe ->) (Samsung Electronics CO., LTD. -> DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\28_ssconn2\conn\ss_conn_service2.exe
(services.exe ->) (ShenZhen Moyea Software Co., Ltd. -> Leawo Software) C:\Program Files (x86)\Common Files\cdagtsvc\cdagtsvc_v1.0.0_x86.exe
(services.exe ->) (Surfshark B.V. -> Surfshark.AntivirusService) C:\Program Files\Surfshark\Surfshark.AntivirusService.exe
(services.exe ->) (Surfshark B.V. -> Surfshark.Service) C:\Program Files\Surfshark\Surfshark.Service.exe
(services.exe ->) (Surfshark B.V. -> Surfshark.WireguardService) C:\Program Files\Surfshark\Surfshark.WireguardService.exe
(svchost.exe ->) (Advanced Micro Devices -> AMD) C:\Program Files\AMD\Performance Profile Client\AUEPMaster.exe
(svchost.exe ->) (Gen Digital Inc. -> Gen Digital Inc.) C:\Program Files\Piriform\CCleaner 7\CCleaner.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe
 
==================== Registry (Whitelisted) ===================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [RtkAudUService] => C:\WINDOWS\System32\DriverStore\FileRepository\realtekservice.inf_amd64_c2fa179f72a88c18\RtkAudUService64.exe [2257752 2024-09-11] (Realtek Semiconductor Corp. -> Realtek Semiconductor)
HKLM\...\Run: [Focusrite Notifier] => C:\Program Files\Focusrite\Drivers\Focusrite Notifier.exe [906840 2023-11-27] (Focusrite Audio Engineering Ltd -> Focusrite Audio Engineering, Ltd.)
HKLM\...\Run: [] => [X]
HKLM-x32\...\Run: [] => [X]
HKLM\...\Policies\Explorer: [HideSCAMeetNow] 1
HKLM\...\Policies\Explorer: [SettingsPageVisibility] hide:home
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Restriction <==== ATTENTION
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\MRT: Restriction <==== ATTENTION
HKLM\Software\Policies\...\system: [EnableActivityFeed] 0
HKLM\Software\Policies\...\system: [PublishUserActivities] 0
HKLM\Software\Policies\...\system: [UploadUserActivities] 0
HKLM\Software\Policies\...\system: [AllowClipboardHistory] 0
HKLM\Software\Policies\...\system: [AllowCrossDeviceClipboard] 0
HKLM\SYSTEM\...\Terminal Server: [fDenyTSConnections] = 0 <==== ATTENTION
HKU\S-1-5-21-996191584-2022938525-1902568006-1001\...\Run: [Surfshark] => C:\Program Files\Surfshark\Surfshark.exe [258816 2025-09-09] (Surfshark B.V. -> Surfshark)
HKU\S-1-5-21-996191584-2022938525-1902568006-1001\...\Run: [NZXT.CAM] => C:\Program Files\NZXT CAM\NZXT CAM.exe [186398072 2025-01-15] (NZXT, Inc. -> NZXT, Inc.)
HKU\S-1-5-21-996191584-2022938525-1902568006-1001\...\Run: [] => [X]
HKU\S-1-5-21-996191584-2022938525-1902568006-1001\...\Policies\Explorer: [HideSCAMeetNow] 1
HKLM\...\Windows x64\Print Processors\Canon G3070 series Print Processor: C:\Windows\System32\spool\prtprocs\x64\CNMPDHX.DLL [543744 2023-10-30] (CANON INC.) [File not signed]
HKLM\...\Print\Monitors\Canon BJ Language Monitor G3070 series: C:\WINDOWS\system32\CNMLMHX.DLL [989696 2023-10-30] (CANON INC.) [File not signed]
HKLM\...\Print\Monitors\EPSON XP-4200 Series 64MonitorBE: C:\WINDOWS\system32\E1YLMBBHE.DLL [237568 2021-09-21] (Seiko Epson Corporation) [File not signed]
HKLM\Software\Microsoft\Active Setup\Installed Components: [{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}] -> "C:\Program Files\BraveSoftware\Brave-Browser\Application\141.1.83.118\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level
HKLM\Software\...\Authentication\Credential Providers: [{C885AA15-1764-4293-B82A-0586ADD46B35}] -> 
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Ableton USB Audio Control Panel Autostart.lnk [2024-11-21]
ShortcutTarget: Ableton USB Audio Control Panel Autostart.lnk -> C:\Program Files\Ableton\USB Audio Driver\x64\AbletonAudioCpl.exe (Thesycon Software Solutions GmbH & Co. KG -> )
GroupPolicy: Restriction ? <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Edge: Restriction <==== ATTENTION
 
==================== Scheduled Tasks (Whitelisted) =================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {4F629B8C-7EC9-4867-A5F2-F469A8226893} - System32\Tasks\AMDAutoUpdate => C:\Program Files\AMD\AutoUpdate\AMDAutoUpdate.exe [671440 2024-07-24] (Advanced Micro Devices -> )
Task: {F6533783-F135-40D9-AD30-22E3CA0B1641} - System32\Tasks\BraveSoftwareUpdateTaskMachineCore{962AAB17-2D97-4B8A-AF90-EA7681598F29} => C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe [167448 2024-09-30] (Brave Software, Inc. -> BraveSoftware Inc.)
Task: {8BB1078A-260D-407D-9CA8-1511455E1699} - System32\Tasks\BraveSoftwareUpdateTaskMachineUA{37DD92FE-4571-48AE-95A9-F5BFB5743E71} => C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe [167448 2024-09-30] (Brave Software, Inc. -> BraveSoftware Inc.)
Task: {8CBCC8A5-6F26-4DA0-B708-175E11C581B1} - System32\Tasks\CCleaner 7 - Skip UAC - S-1-5-21-996191584-2022938525-1902568006-1001 => C:\Program Files\Piriform\CCleaner 7\CCleaner.exe [4717688 2025-10-17] (Gen Digital Inc. -> Gen Digital Inc.)
Task: {077BA067-7C15-40F0-B22E-C9DC2A54B4A2} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe  (No File)
Task: {CCDFC0B8-01A3-4E74-A820-4F13F51D269E} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => %SystemRoot%\System32\MbaeParserTask.exe  (No File)
Task: {0BB36A32-0D9E-4297-AFD7-6BD7B5DB4C9B} - System32\Tasks\Microsoft\Windows\UNP\RunUpdateNotificationMgr => %windir%\System32\UNP\UpdateNotificationMgr.exe  (No File)
Task: {7BC9F5B8-4888-437D-8E69-132470940556} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_AC => %systemroot%\system32\MusNotification.exe  /RunOnAC RebootDialog (No File)
Task: {51DADB31-C111-48E4-AC6A-D76F39791353} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery => %systemroot%\system32\MusNotification.exe  /RunOnBattery RebootDialog (No File)
Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe  (No File)
Task: {341C5D3A-38A6-4695-B374-095DD1BF165D} - System32\Tasks\npcapwatchdog => C:\Program Files\Npcap\CheckStatus.bat [815 2022-11-22] () [File not signed]
Task: {09A9F7C1-7C35-4E49-9FD2-7A162EA9F5BC} - System32\Tasks\Piriform\CCleaner 7 - S-1-5-21-996191584-2022938525-1902568006-1001 => C:\Program Files\Piriform\CCleaner 7\CCleaner.exe [4717688 2025-10-17] (Gen Digital Inc. -> Gen Digital Inc.)
Task: {6FC10ECE-56CA-4480-8869-4AF9CDC28EE3} - System32\Tasks\Piriform\CCleaner 7 - S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415 => C:\Program Files\Piriform\CCleaner 7\CCleaner.exe [4717688 2025-10-17] (Gen Digital Inc. -> Gen Digital Inc.)
Task: {5A739231-AF70-47CB-83C2-BFABEC8C78CD} - System32\Tasks\Piriform\CCleaner 7 BugReport => C:\Program Files\Piriform\CCleaner 7\CCleanerBugReport.exe [6243960 2025-10-17] (Gen Digital Inc. -> Gen Digital Inc.) -> --send "dumps|report" --product 234 --programpath "C:\Program Files\Piriform\CCleaner 7" --configpath "C:\Program Files\Piriform\CCleaner 7\data" --path "C:\Program Files\Piriform\CCleaner 7\log" --path "C:\Program Files\Piriform\CCleaner 7\data\dumps" --logpath "C:\Program Files\Piriform\CCleaner 7 (the data entry has 58 more characters).
Task: {A43DC670-FE8E-446D-8283-5EFECFE935A8} - System32\Tasks\Piriform\CCleaner 7 Update => C:\Program Files\Common Files\Piriform\Icarus\piriform-ccl\icarus.exe  /update:piriform-ccl /silent (No File)
Task: {8EB042C4-BB50-484F-ACBE-1F4751CAB221} - System32\Tasks\Remove AdwCleaner Application => C:\WINDOWS\system32\CMD.EXE [344064 2025-09-20] (Microsoft Windows -> Microsoft Corporation) -> /C DEL /F /Q "C:\Users\sh4rk\Downloads\tron\resources\stage_3_disinfect\malwarebytes_adwcleaner\adwcleaner.exe"
Task: {04AE3C42-5264-48B3-9AF4-167930BEFD0E} - System32\Tasks\StartAUEP => C:\Program Files\AMD\Performance Profile Client\AUEPMaster.exe [823512 2024-08-02] (Advanced Micro Devices -> AMD)
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\..\Interfaces\{89dfcb80-cae7-4d0d-85b9-dc04e83da193}: [DhcpNameServer] 192.168.12.1
Tcpip\..\Interfaces\{89dfcb80-cae7-4d0d-85b9-dc04e83da193}: [DhcpDomain] lan
Tcpip\..\Interfaces\{8d69708d-ddec-a599-bb02-0475a5d2150e}: [NameServer] 151.236.14.64,194.156.228.111
Tcpip\..\Interfaces\{cacc1257-3833-4a9e-b25f-7aa73c08b8e0}: [NameServer] 1.1.1.1,8.8.8.8
Tcpip\..\Interfaces\{cacc1257-3833-4a9e-b25f-7aa73c08b8e0}: [DhcpNameServer] 192.168.12.1
Tcpip\..\Interfaces\{cacc1257-3833-4a9e-b25f-7aa73c08b8e0}: [DhcpDomain] lan
 
Edge: 
=======
Edge DefaultProfile: Default
Edge Profile: C:\Users\sh4rk\AppData\Local\Microsoft\Edge\User Data\Default [2025-10-21]
Edge HomePage: Default -> hxxp://www.duckduckgo.com/
Edge StartupUrls: Default -> "hxxp://www.duckduckgo.com/"
Edge Extension: (HTTPS Everywhere) - C:\Users\sh4rk\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\fchjpkplmbeeeaaogdbhjbgbknjobohb [2024-10-17]
Edge Extension: (Google Docs Offline) - C:\Users\sh4rk\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2025-09-21]
Edge Extension: (Edge relevant text changes) - C:\Users\sh4rk\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha [2024-09-30]
Edge Extension: (uBlock Origin) - C:\Users\sh4rk\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\odfafepnkmbhccpbejgmiehpchacaeak [2025-09-21]
Edge HKLM\...\Edge\Extension: [bojobppfploabceghnmlahpoonbcbacn]
Edge HKLM-x32\...\Edge\Extension: [bojobppfploabceghnmlahpoonbcbacn]
 
FireFox:
========
FF Plugin: @videolan.org/vlc,version=3.0.21 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2024-06-08] (VideoLAN -> VideoLAN)
 
Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [ihcjicgdanjaechkgeegckofjjedodee]
CHR HKLM-x32\...\Chrome\Extension: [ihcjicgdanjaechkgeegckofjjedodee]
 
Brave: 
=======
BRA DefaultProfile: Default
BRA Profile: C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default [2025-10-21]
BRA DefaultSearchURL: Default -> hxxps://search.brave.com/search?q={searchTerms}&source=desktop
BRA DefaultSearchKeyword: Default -> :br
BRA DefaultSuggestURL: Default -> hxxps://search.brave.com/api/suggest?q={searchTerms}&rich=true&source=desktop
BRA Extension: (uBlock Origin) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Extensions\cjpalhdlnbpafiamejdnhcphjbkeiagm [2025-10-21]
BRA Extension: (Malwarebytes Browser Guard) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Extensions\ihcjicgdanjaechkgeegckofjjedodee [2025-09-08]
BRA Extension: (Brave Ad Block Updater (AdGuard URL Tracking Protection Filters (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\acjngemejiflkehbcbomjgkbfhjlgioh [2025-10-18]
BRA Extension: (Brave Ad Block Updater (Brave First Party Adblock Filters (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\adcocjohghhfpidemphmcmlmhnfgikei [2025-10-08]
BRA Extension: (Brave Local Data Files Updater) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal [2025-10-20]
BRA Extension: (Brave Ad Block Updater (YouTube Anti-Shorts (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\almolcgbkikkhliiibfjkohebgklegam [2025-09-21]
BRA Extension: (Brave NTP background images) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\aoojcmojmmcbpfgoecoadbdpnagfchel [2025-09-05]
BRA Extension: (Brave Ad Block Updater (Fanboy's Mobile Notifications (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\bfpgedeaaibpoidldhjcknekahbikncb [2025-10-21]
BRA Extension: (Brave Ad Block Updater (EasyList Cookie (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\cdbbhgbmjhfnhnmgeddbliobbofkgdhe [2025-10-21]
BRA Extension: (Brave Ad Block Updater (Romanian Ad (ROad) (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\cgmhmpbimmakidhlkcnnehhicoclofep [2025-10-18]
BRA Extension: (Brave Ad Block Updater (YouTube Mobile Distractions (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\cpapfkpkeaajehipopnaiihfmbfbnkdp [2025-09-05]
BRA Extension: (Brave Ad Block Updater (AdGuard Chinese (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\fbljdmoohhbifebddjnbbljgencmpjlb [2025-10-21]
BRA Extension: (Brave Ad Block Updater (AdGuard Français (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\flnkmpokemfpaajmiimmjeiandgoodgg [2025-10-21]
BRA Extension: (Brave NTP sponsored images) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\gigpfioocjkgbjgoonldcifaeajkbdln [2025-10-21]
BRA Extension: (Brave Ad Block Updater (Regional Catalog)) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\gkboaolpopklhgplhaaiboijnklogmbc [2025-10-10]
BRA Extension: (Brave Ad Block Updater (Adguard Turkish (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\gomenlogbembmkbghmaoledggliepdef [2025-10-21]
BRA Extension: (Brave NTP Super Referrer mapping table) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\heplpbhjcbmiibdlchlanmdenffpiibo [2024-09-30]
BRA Extension: (Brave Ad Block Updater (EasyList China (中文) (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\hmnnhojoekmmehfpmeegehbmifiijobb [2025-10-21]
BRA Extension: (Brave Ad Block Updater (Brave Default Adblock Filters (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\iodkpdagapdfkphljnddpjlldadblomo [2025-10-21]
BRA Extension: (Brave Ad Block Updater (Adguard Russian (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\jiajbjlakknofnkmlokcbanjbajpbdkl [2025-10-21]
BRA Extension: (Brave Ad Block Updater (EasyList Hebrew (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\kdakdkdknmkkafefhcbngpinlfoopoej [2025-10-20]
BRA Extension: (Brave Ad Block Updater (Brave Default Privacy Filters (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\kihnoaefogbkmblfimmibknnmkllbhlf [2025-10-21]
BRA Extension: (Brave Ad Block Updater (Adguard Japanese filters 日本用フィルタ (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\llgjaaddopeckcifdceaaadmemagkepi [2025-10-21]
BRA Extension: (Brave Ads Resources) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\lnbdfmpjjckjhnmahgdojnfnmdmpebfn [2025-10-21]
BRA Extension: (Brave Ad Block Updater (Adguard Spanish/Portuguese (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\meimhmgfbckapkbbbdaoefgnbppmkodp [2025-10-20]
BRA Extension: (Brave Ad Block Updater (Resources)) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\mfddibmblmbccpadfndgakiopmmhebop [2025-10-17]
BRA Extension: (Brave User Agent) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\nlpaeekllejnmhoonlpcefpfnpbajbpe [2025-10-21]
BRA Extension: (Brave Ad Block Updater (Slovenian (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\nnpbcdahaefknppiijdmnckpdgojejck [2025-09-21]
BRA Extension: (Brave Ads Resources) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\ocilmpijebaopmdifcomolmpigakocmo [2024-11-19]
BRA Extension: (Brave Ad Block Updater (Adguard Dutch (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\oojedkppeblkjkcdlmlahnhndjmbicoi [2025-10-20]
BRA Extension: (P3A Configuration) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\P3AConfig [2025-08-08]
BRA Extension: (Brave Ad Block Updater (YouTube Mobile Recommendations (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\phdmgpanpejkbmbljlhcehpadabljfbk [2025-09-21]
BRA Extension: (Brave Ad Block Updater (RU AdList Дополнительная региональная подписка (plaintext))) - C:\Users\sh4rk\AppData\Local\BraveSoftware\Brave-Browser\User Data\phmomndefejccjmpiehbogokakkmnmgb [2025-10-21]
 
==================== Services (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 AUEPLauncher; C:\Program Files\AMD\Performance Profile Client\AUEPDU.exe [542424 2024-08-02] (Advanced Micro Devices -> AMD)
S2 brave; C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe [167448 2024-09-30] (Brave Software, Inc. -> BraveSoftware Inc.)
S3 BraveElevationService; C:\Program Files\BraveSoftware\Brave-Browser\Application\141.1.83.118\elevation_service.exe [3237456 2025-10-15] (Brave Software, Inc. -> Brave Software, Inc.)
S3 bravem; C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe [167448 2024-09-30] (Brave Software, Inc. -> BraveSoftware Inc.)
R2 CAMService; C:\Program Files\NZXT CAM\resources\app.asar.unpacked\node_modules\@nzxt\cam-core\dist\service.exe [573816 2025-01-15] (NZXT, Inc. -> )
R2 CCleaner7; C:\Program Files\Piriform\CCleaner 7\CCleaner_service.exe [28276344 2025-10-17] (Gen Digital Inc. -> Gen Digital Inc.)
R2 CdRomAccessAgentService; C:\Program Files (x86)\Common Files\cdagtsvc\cdagtsvc_v1.0.0_x86.exe [111208 2025-07-18] (ShenZhen Moyea Software Co., Ltd. -> Leawo Software)
R2 CIJSRegister; C:\Program Files (x86)\Canon\IJ Scan Utility\SETEVENT.exe [157488 2022-03-16] (Canon Inc. -> CANON INC.)
R2 EndpointProtectionService; C:\Program Files\Surfshark\Endpoint Protection SDK\endpointprotection.exe [13051800 2025-10-09] (Avira Operations GmbH -> Avira Operations GmbH)
S3 EndpointProtectionService2; C:\Program Files\Surfshark\Endpoint Protection SDK\endpointprotection.exe [13051800 2025-10-09] (Avira Operations GmbH -> Avira Operations GmbH)
S3 EPMVssEaseusProvider; C:\WINDOWS\system32\dllhost.exe /Processid:{554247FC-C343-461B-8D55-9B0C9441E4C3} [50504 2025-09-01] (Microsoft Windows -> Microsoft Corporation)
R2 Focusrite Control Server; C:\Program Files\Focusrite\Focusrite Control\Server\ControlServer.exe [1297920 2024-03-11] () [File not signed]
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [460488 2024-04-03] (Canon Inc. -> )
S3 MDCoreSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MpDefenderCoreService.exe [2026144 2025-10-03] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 NVDisplay.ContainerLocalSystem; C:\WINDOWS\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_6cdc9372d41a2731\Display.NvContainer\NVDisplay.Container.exe [1275608 2025-09-06] (NVIDIA Corporation -> NVIDIA Corporation)
R2 PCManager Service Store; C:\Program Files\WindowsApps\Microsoft.MicrosoftPCManager_3.17.14.0_x64__8wekyb3d8bbwe\PCManager\MSPCManagerService.exe [154144 2025-09-12] (Microsoft Corporation -> MSPCManagerService)
S3 Razer Elevation Service; C:\Program Files\Razer\razer_elevation_service\razer_elevation_service.exe [1741960 2025-04-25] (Razer USA Ltd. -> Razer Inc)
R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe [752224 2023-12-21] (Samsung Electronics CO., LTD. -> DEVGURU Co., LTD.)
R2 ss_conn_service2; C:\Program Files (x86)\Samsung\USB Drivers\28_ssconn2\conn\ss_conn_service2.exe [933432 2023-12-21] (Samsung Electronics CO., LTD. -> DEVGURU Co., LTD.)
R2 Surfshark Antivirus; C:\Program Files\Surfshark\Surfshark.AntivirusService.exe [151296 2025-09-09] (Surfshark B.V. -> Surfshark.AntivirusService)
R2 Surfshark Service; C:\Program Files\Surfshark\Surfshark.Service.exe [150784 2025-09-09] (Surfshark B.V. -> Surfshark.Service)
R3 Surfshark WireGuard; C:\Program Files\Surfshark\Surfshark.WireGuardService.exe [151296 2025-09-09] (Surfshark B.V. -> Surfshark.WireguardService)
S3 VSInstallerElevationService; C:\Program Files (x86)\Microsoft Visual Studio\Installer\VSInstallerElevationService.exe [43432 2025-08-25] (Microsoft Corporation -> Microsoft)
S3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\NisSrv.exe [4418608 2025-10-03] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe [282440 2025-10-03] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 WsaService; C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForAndroid_2407.40000.4.0_x64__8wekyb3d8bbwe\WsaService\WsaService.exe [320512 2025-08-23] (Microsoft Corporation -> )
S3 LibreOfficeMaintenance; "C:\Program Files\LibreOffice\program\update_service.exe" [X]
 
===================== Drivers (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R3 AmdTools64; C:\WINDOWS\System32\drivers\AmdTools64.sys [63392 2020-06-16] (Microsoft Windows Hardware Compatibility Publisher -> )
R0 BdNet; C:\WINDOWS\System32\DRIVERS\BdNet.sys [179768 2025-01-25] (Microsoft Windows Hardware Compatibility Publisher -> Avira Operations GmbH)
R1 BdSentry; C:\WINDOWS\System32\DRIVERS\BdSentry.sys [223296 2025-01-25] (Microsoft Windows Hardware Compatibility Publisher -> Avira Operations GmbH)
R1 CTIIO; C:\WINDOWS\system32\drivers\CtiIo64.sys [34920 2025-04-22] (Microsoft Windows Hardware Compatibility Publisher -> Creative Technology Innovation Co., LTd.)
R3 e1rexpress; C:\WINDOWS\System32\DriverStore\FileRepository\e1r.inf_amd64_ca8b162faaf4bb73\e1r.sys [610400 2025-04-22] (Intel Corporation -> Intel Corporation)
S3 ebrntdrv; C:\WINDOWS\system32\ebrntdrv.sys [27728 2025-06-10] (Microsoft Windows Hardware Compatibility Publisher -> )
S3 epmdkdrv; C:\WINDOWS\system32\epmdkdrv.sys [27728 2025-06-10] (Microsoft Windows Hardware Compatibility Publisher -> )
R0 EPMVolFl; C:\WINDOWS\System32\drivers\EPMVolFl.sys [30136 2025-06-10] (CHENGDU YIWO Tech Development Co., Ltd. -> Windows ® Codename Longhorn DDK provider)
R0 EUDCPEPM; C:\WINDOWS\System32\drivers\EUDCPEPM.sys [76344 2025-06-10] (Microsoft Windows Hardware Compatibility Publisher -> CHENGDU YIWO Tech Development Co., Ltd)
R1 EUEDKEPM; C:\WINDOWS\system32\drivers\EUEDKEPM.sys [24656 2025-06-10] (Microsoft Windows Hardware Compatibility Publisher -> CHENGDU YIWO Tech Development Co., Ltd)
R3 FocusritePCIeSwRoot; C:\WINDOWS\System32\drivers\FocusritePCIeSwRoot.sys [106208 2023-11-27] (Focusrite Audio Engineering Ltd -> Focusrite Audio Engineering Ltd.)
R3 FocusriteUsb; C:\WINDOWS\System32\drivers\FocusriteUsb.sys [170312 2023-11-27] (Focusrite Audio Engineering Ltd -> Focusrite Audio Engineering Ltd.)
R3 FocusriteUsbAudio; C:\WINDOWS\System32\drivers\FocusriteUsbAudio.sys [109896 2023-11-27] (Focusrite Audio Engineering Ltd -> Focusrite Audio Engineering Ltd.)
R3 FocusriteUsbSwRoot; C:\WINDOWS\System32\drivers\FocusriteUsbSwRoot.sys [112968 2023-11-27] (Focusrite Audio Engineering Ltd -> Focusrite Audio Engineering Ltd.)
R0 fse; C:\WINDOWS\System32\drivers\fse.sys [222528 2025-09-01] (Microsoft Windows -> Microsoft Corporation)
S3 gdrv3; C:\WINDOWS\System32\drivers\gdrv3.sys [52440 2025-01-16] (GIGA-BYTE TECHNOLOGY CO., LTD. -> GIGA-BYTE TECHNOLOGY CO., LTD.)
S3 KslD; C:\WINDOWS\System32\drivers\wd\KslD.sys [333216 2025-10-03] (Microsoft Windows -> Microsoft Corporation)
S2 l1vhlwf; C:\WINDOWS\System32\drivers\l1vhlwf.sys [140672 2025-09-13] (Microsoft Windows -> Microsoft Corporation)
S0 MbamElam; C:\WINDOWS\System32\DRIVERS\MbamElam.sys [22120 2025-05-19] (Microsoft Windows Early Launch Anti-malware Publisher -> Malwarebytes)
R1 MSIO; C:\WINDOWS\system32\drivers\MsIo64.sys [19672 2025-04-22] (Microsoft Windows Hardware Compatibility Publisher -> MICSYS Technology Co., LTd)
R1 netprotection_network_filter; C:\WINDOWS\System32\drivers\netprotection_network_filter.sys [119664 2025-10-09] (Avira Operations GmbH -> Avira Operations GmbH)
S3 netprotection_network_filter2; C:\WINDOWS\System32\drivers\netprotection_network_filter2.sys [119664 2025-10-09] (Avira Operations GmbH -> Avira Operations GmbH)
R1 npcap; C:\WINDOWS\system32\DRIVERS\npcap.sys [79424 2024-08-28] (Nmap Software LLC -> Insecure.Com LLC.)
R3 ovpn-dco; C:\WINDOWS\System32\drivers\ovpn-dco.sys [131984 2025-03-03] (WDKTestCert lev,133391533294737317 -> OpenVPN, Inc)
S3 RevoProcessDetector; C:\WINDOWS\System32\DRIVERS\RevoProcessDetector.sys [19504 2024-03-28] (Microsoft Windows Hardware Compatibility Publisher -> VS Revo Group)
R1 rtp1; C:\WINDOWS\System32\DRIVERS\rtp1.sys [452856 2025-10-09] (Avira Operations GmbH -> Avira Operations GmbH)
R1 rtp2; C:\WINDOWS\System32\DRIVERS\rtp2.sys [452880 2025-10-09] (Avira Operations GmbH -> Avira Operations GmbH)
S0 rtp_elam; C:\WINDOWS\System32\DRIVERS\rtp_elam.sys [30152 2025-10-09] (Microsoft Windows Early Launch Anti-malware Publisher -> Avira Operations GmbH)
S3 SharkDivert; C:\Program Files\Surfshark\Resources\x64\sharkdivert.sys [184480 2025-06-30] (Microsoft Windows Hardware Compatibility Publisher -> Surfshark)
S3 ss_conn_usb_driver2; C:\WINDOWS\System32\Drivers\ss_conn_usb_driver2.sys [50720 2023-12-21] (Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.)
S3 vmbusproxy; C:\WINDOWS\system32\drivers\vmbusproxy.sys [98304 2025-09-01] (Microsoft Windows -> Microsoft Corporation)
S3 WdBoot; C:\WINDOWS\system32\drivers\wd\WdBoot.sys [20888 2025-10-03] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\wd\WdFilter.sys [629128 2025-10-03] (Microsoft Windows -> Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [102832 2025-10-03] (Microsoft Windows -> Microsoft Corporation)
R3 WireGuard; C:\WINDOWS\System32\drivers\wireguard.sys [489368 2024-03-06] (Microsoft Windows Hardware Compatibility Publisher -> WireGuard LLC)
U4 npcap_wifi; no ImagePath
S3 SIVDriver; \??\C:\WINDOWS\system32\Drivers\SIVX64.sys [X]
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One month (created) (Whitelisted) =========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2025-10-21 10:02 - 2025-10-21 10:02 - 000031208 _____ C:\Users\sh4rk\Downloads\FRST.txt
2025-10-21 10:02 - 2025-10-21 10:02 - 000000000 ____D C:\FRST
2025-10-21 10:01 - 2025-10-21 10:01 - 002443264 _____ (Farbar) C:\Users\sh4rk\Downloads\FRST64.exe
2025-10-20 19:36 - 2025-10-20 19:36 - 163380314 _____ C:\Users\sh4rk\Desktop\balenaEtcher-linux-x64-2.1.4.zip
2025-10-20 19:34 - 2025-10-20 19:34 - 000029397 _____ C:\Users\sh4rk\Desktop\linuxmint-22.2-cinnamon-64bit.iso.torrent
2025-10-20 16:21 - 2025-10-20 16:21 - 000000000 ____D C:\WINDOWS\LastGood.Tmp
2025-10-20 16:14 - 2025-10-20 16:14 - 000000000 ____D C:\Program Files\Wireshark
2025-10-20 16:13 - 2025-10-20 16:13 - 000001197 _____ C:\Users\Public\Desktop\LibreOffice 25.8.lnk
2025-10-20 16:13 - 2025-10-20 16:13 - 000000000 ___SD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice
2025-10-11 10:18 - 2025-10-11 10:18 - 000003268 _____ C:\WINDOWS\system32\Tasks\CCleaner 7 - Skip UAC - S-1-5-21-996191584-2022938525-1902568006-1001
2025-10-09 21:14 - 2025-10-09 21:14 - 000002152 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner 7.lnk
2025-10-09 21:14 - 2025-10-09 21:14 - 000002140 _____ C:\Users\Public\Desktop\CCleaner 7.lnk
2025-10-09 21:14 - 2025-10-09 21:14 - 000000000 ____D C:\WINDOWS\system32\Tasks\Piriform
2025-10-09 21:14 - 2025-10-09 21:14 - 000000000 ____D C:\Users\sh4rk\AppData\Roaming\CCleaner
2025-10-09 21:13 - 2025-10-09 21:13 - 000055064 _____ (Gen Digital Inc.) C:\WINDOWS\system32\icarus_rvrt.exe
2025-10-09 21:13 - 2025-10-09 21:13 - 000000000 ____D C:\Program Files\Piriform
2025-10-09 21:13 - 2025-10-09 21:13 - 000000000 ____D C:\Program Files\Common Files\Piriform
2025-10-05 15:10 - 2025-10-21 08:23 - 000000000 ____D C:\WINDOWS\CbsTemp
2025-10-05 14:20 - 2025-10-05 14:20 - 000060128 _____ (Trellix US LLC.) C:\WINDOWS\system32\Drivers\mfeaacsk.sys.5111.deleteme
2025-10-01 18:45 - 2025-10-01 18:45 - 000000000 ____D C:\Program Files (x86)\WindowsInstallationAssistant
2025-10-01 10:35 - 2025-10-01 10:35 - 000000000 ___HD C:\$WinREAgent
2025-09-29 16:39 - 2025-09-29 16:39 - 112110040 _____ C:\Users\sh4rk\Downloads\tor-browser-windows-x86_64-portable-14.5.7.exe
2025-09-29 16:22 - 2025-09-29 16:22 - 041831970 _____ C:\Users\sh4rk\Downloads\wip10year-all.zip
2025-09-28 08:59 - 2025-09-28 08:59 - 000001201 _____ C:\Users\sh4rk\Downloads\Resume 2025 (1).txt
2025-09-28 08:36 - 2025-09-28 08:36 - 000001201 _____ C:\Users\sh4rk\Downloads\Resume 2022.txt
2025-09-27 03:45 - 2025-09-27 03:45 - 000066533 _____ C:\Users\sh4rk\Downloads\4187025152.pdf
2025-09-21 11:28 - 2025-09-21 11:28 - 016212526 _____ C:\Users\sh4rk\Downloads\2025-26 NHL Regular Season Schedule (By Club).pdf
 
==================== One month (modified) ==================
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2025-10-21 09:40 - 2024-04-01 03:26 - 000000000 ____D C:\WINDOWS\SystemTemp
2025-10-21 09:40 - 2024-04-01 03:26 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2025-10-21 09:37 - 2024-10-02 15:34 - 000000000 ____D C:\Users\sh4rk\AppData\Roaming\Surfshark
2025-10-21 09:35 - 2025-09-01 17:41 - 000873350 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2025-10-21 09:35 - 2024-04-01 03:24 - 000000000 ____D C:\WINDOWS\INF
2025-10-21 09:32 - 2024-10-02 15:34 - 000000000 ____D C:\ProgramData\Surfshark
2025-10-21 09:30 - 2025-09-01 17:38 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2025-10-21 09:30 - 2025-06-24 19:04 - 000041464 _____ C:\WINDOWS\system32\5E37410B-D6F1-471D-AE27-563CEAC0D6B2
2025-10-21 09:30 - 2025-01-07 02:26 - 000000000 ____D C:\ProgramData\NVIDIA
2025-10-21 09:30 - 2024-09-29 19:47 - 000012288 ___SH C:\DumpStack.log.tmp
2025-10-21 09:30 - 2024-04-01 03:26 - 000000000 ____D C:\WINDOWS\AppReadiness
2025-10-21 09:29 - 2024-11-02 10:31 - 001554640 _____ C:\WINDOWS\system32\rtp.db
2025-10-21 09:29 - 2024-04-01 03:21 - 000262144 _____ C:\WINDOWS\system32\config\BBI
2025-10-21 08:17 - 2025-01-07 02:28 - 000000000 ____D C:\Users\sh4rk\AppData\Local\D3DSCache
2025-10-20 18:20 - 2024-09-29 20:58 - 000000000 ____D C:\Users\sh4rk\AppData\Local\ConnectedDevicesPlatform
2025-10-20 17:54 - 2024-09-29 21:00 - 000000000 ____D C:\Users\sh4rk\AppData\Local\PlaceholderTileLogoFolder
2025-10-20 17:54 - 2024-09-29 20:58 - 000000000 ____D C:\Users\sh4rk\AppData\Local\Packages
2025-10-20 17:54 - 2024-09-29 20:44 - 000000000 ____D C:\ProgramData\Packages
2025-10-20 17:54 - 2024-04-01 03:26 - 000000000 ___HD C:\Program Files\WindowsApps
2025-10-20 16:45 - 2025-08-04 00:36 - 000000000 ____D C:\Users\sh4rk\Desktop\integrity_verification
2025-10-20 16:45 - 2024-12-23 01:04 - 000000000 ____D C:\Users\sh4rk\Desktop\PRS Photos Oct 2024
2025-10-20 16:43 - 2025-08-24 22:28 - 000000000 ____D C:\ProgramData\Windows App Certification Kit
2025-10-20 16:43 - 2024-09-30 09:13 - 000000000 ____D C:\Program Files\NZXT CAM
2025-10-20 16:42 - 2025-08-24 22:28 - 000000000 ____D C:\Program Files\Application Verifier
2025-10-20 16:41 - 2025-09-01 16:44 - 000000000 ____D C:\Users\sh4rk
2025-10-20 16:41 - 2025-09-01 16:44 - 000000000 ____D C:\Users\DefaultAppPool
2025-10-20 16:34 - 2025-09-01 17:36 - 000457760 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2025-10-20 16:14 - 2025-09-09 13:59 - 000001835 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wireshark.lnk
2025-10-20 16:14 - 2025-09-09 13:59 - 000001823 _____ C:\Users\Public\Desktop\Wireshark.lnk
2025-10-20 16:14 - 2024-09-30 13:45 - 000000000 ____D C:\ProgramData\Package Cache
2025-10-20 16:13 - 2024-10-13 21:11 - 000000000 ____D C:\Program Files\LibreOffice
2025-10-20 16:11 - 2025-08-12 18:26 - 000000000 ____D C:\Program Files\dotnet
2025-10-20 16:03 - 2024-09-29 22:11 - 000000000 ____D C:\Program Files (x86)\Steam
2025-10-20 08:16 - 2025-09-04 14:28 - 000000000 ____D C:\Users\sh4rk\Desktop\Dloaded songs
2025-10-19 18:59 - 2025-05-15 02:17 - 000000000 ____D C:\Program Files\Recuva
2025-10-18 05:35 - 2025-04-09 03:14 - 000000000 ____D C:\Users\sh4rk\Desktop\Nooter 02052025
2025-10-18 05:26 - 2024-12-08 14:52 - 000000000 ____D C:\fix
2025-10-18 05:26 - 2024-10-15 13:12 - 000000000 ____D C:\Program Files\Audacity
2025-10-18 05:24 - 2024-09-30 09:13 - 000000000 ____D C:\Users\sh4rk\AppData\Local\nzxt cam-updater
2025-10-18 05:24 - 2024-09-30 07:24 - 000000000 ____D C:\Program Files\Microsoft Update Health Tools
2025-10-18 05:23 - 2025-08-28 22:06 - 000000000 ____D C:\Users\sh4rk\AppData\Local\unali-3431406
2025-10-18 05:23 - 2025-08-28 22:06 - 000000000 ____D C:\Users\sh4rk\AppData\Local\unali-3431218
2025-10-18 05:23 - 2025-01-18 02:17 - 000000000 ____D C:\ProgramData\chocolatey
2025-10-18 05:22 - 2025-09-09 13:59 - 000000000 ____D C:\Program Files\Npcap
2025-10-16 18:47 - 2024-10-09 02:10 - 000000000 ____D C:\WINDOWS\system32\MRT
2025-10-16 18:46 - 2024-09-29 23:16 - 214534944 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2025-10-15 17:07 - 2024-09-29 21:01 - 000002364 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brave.lnk
2025-10-15 17:07 - 2024-09-29 21:01 - 000002323 _____ C:\Users\Public\Desktop\Brave.lnk
2025-10-13 20:45 - 2025-07-17 22:25 - 000000000 ____D C:\Users\sh4rk\AppData\Local\CrashDumps
2025-10-12 19:33 - 2024-09-29 23:46 - 000000000 ____D C:\Users\sh4rk\AppData\Roaming\Microsoft\MMC
2025-10-11 19:43 - 2025-09-01 17:38 - 000003536 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
2025-10-11 19:43 - 2025-09-01 17:38 - 000003410 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore
2025-10-11 12:18 - 2025-09-13 00:54 - 000037637 _____ C:\WINDOWS\system32\IntegratedServicesRegionPolicySet.json
2025-10-09 21:13 - 2025-05-15 02:17 - 000000000 ____D C:\ProgramData\Piriform
2025-10-09 16:33 - 2024-11-18 10:40 - 000119664 _____ (Avira Operations GmbH) C:\WINDOWS\system32\Drivers\netprotection_network_filter2.sys
2025-10-09 16:33 - 2024-11-02 10:31 - 000119664 _____ (Avira Operations GmbH) C:\WINDOWS\system32\Drivers\netprotection_network_filter.sys
2025-10-09 16:33 - 2024-11-02 10:29 - 000452880 _____ (Avira Operations GmbH) C:\WINDOWS\system32\Drivers\rtp2.sys
2025-10-09 16:33 - 2024-11-02 10:29 - 000452856 _____ (Avira Operations GmbH) C:\WINDOWS\system32\Drivers\rtp1.sys
2025-10-09 16:33 - 2024-11-02 10:29 - 000030152 _____ (Avira Operations GmbH) C:\WINDOWS\system32\Drivers\rtp_elam.sys
2025-10-09 16:33 - 2024-04-01 03:26 - 000000000 ___HD C:\WINDOWS\ELAMBKUP
2025-10-07 19:59 - 2025-01-18 02:30 - 000000000 ____D C:\Users\sh4rk\AppData\Local\NVIDIA
2025-10-07 19:59 - 2024-09-29 22:11 - 000000000 ____D C:\Users\sh4rk\AppData\Local\Steam
2025-10-06 20:02 - 2024-12-22 23:00 - 000000000 ___RD C:\Users\sh4rk\Dropbox
2025-10-06 20:01 - 2025-01-27 02:11 - 000000000 ____D C:\Users\sh4rk\whoami-project
2025-10-06 19:25 - 2025-02-02 20:17 - 000000000 ____D C:\Users\sh4rk\AppData\Roaming\vlc
2025-10-05 15:12 - 2025-09-01 17:36 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2025-10-05 15:09 - 2025-09-16 09:38 - 000000000 ____D C:\ProgramData\Malwarebytes
2025-10-05 14:58 - 2025-09-01 17:38 - 000003418 _____ C:\WINDOWS\system32\Tasks\Remove AdwCleaner Application
2025-10-05 14:15 - 2025-03-29 09:17 - 000000000 ____D C:\Users\sh4rk\Downloads\tron
2025-10-03 17:21 - 2024-09-30 02:27 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd
2025-10-01 10:02 - 2024-10-06 14:36 - 000000000 ____D C:\Program Files (x86)\GIGABYTE
2025-10-01 09:58 - 2024-12-24 03:53 - 000000000 ____D C:\WINDOWS\pss
2025-10-01 09:57 - 2024-12-24 03:59 - 000000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job
2025-09-29 16:50 - 2024-11-08 16:43 - 000000000 ___HD C:\ProgramData\CanonIJScan
2025-09-29 16:50 - 2024-10-13 19:44 - 000000000 ____D C:\ProgramData\CanonIJPLM
2025-09-21 15:04 - 2025-09-01 16:41 - 000000000 ____D C:\WINDOWS\system32\ruxim
2025-09-21 15:04 - 2024-04-01 03:26 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2025-09-21 15:04 - 2024-04-01 03:26 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2025-09-21 15:04 - 2024-04-01 03:26 - 000000000 ____D C:\WINDOWS\system32\oobe
2025-09-21 15:04 - 2024-04-01 03:26 - 000000000 ____D C:\WINDOWS\system32\migwiz
2025-09-21 15:04 - 2024-04-01 03:26 - 000000000 ____D C:\WINDOWS\system32\is-IS
2025-09-21 15:04 - 2024-04-01 03:26 - 000000000 ____D C:\WINDOWS\system32\hi-IN
2025-09-21 15:04 - 2024-04-01 03:26 - 000000000 ____D C:\WINDOWS\system32\fa-IR
2025-09-21 15:04 - 2024-04-01 03:26 - 000000000 ____D C:\WINDOWS\system32\Dism
2025-09-21 15:04 - 2024-04-01 03:26 - 000000000 ____D C:\WINDOWS\system32\cy-GB
2025-09-21 15:04 - 2024-04-01 03:26 - 000000000 ____D C:\WINDOWS\system32\af-ZA
2025-09-21 15:04 - 2024-04-01 03:26 - 000000000 ____D C:\WINDOWS\ShellExperiences
2025-09-21 15:04 - 2024-04-01 03:26 - 000000000 ____D C:\WINDOWS\BrowserCore
2025-09-21 15:04 - 2024-04-01 03:26 - 000000000 ____D C:\WINDOWS\bcastdvr
 
==================== Files in the root of some directories ========
 
2025-08-25 12:48 - 2025-08-25 12:48 - 000000028 _____ () C:\Users\sh4rk\AppData\Roaming\epm_user.ini
2025-03-28 05:41 - 2025-03-28 05:41 - 000000000 ____H () C:\Users\sh4rk\AppData\Local\BIT8090.tmp
2025-08-28 22:13 - 2025-08-28 22:13 - 000007601 _____ () C:\Users\sh4rk\AppData\Local\Resmon.ResmonCfg
 
==================== SigCheck ============================
 
(There is no automatic fix for files that do not pass verification.)
 
==================== End of FRST.txt ========================


#8 sh4rkbyt31

sh4rkbyt31
  • Topic Starter

  •  Avatar image
  • Members
  • 86 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:09 AM

Posted 23 October 2025 - 01:34 PM

Oops sorry, here is the Fixlog.txt file you requested:
 

Fix result of Farbar Recovery Scan Tool (x64) Version: 21-10-2025
Ran by sh4rk (23-10-2025 14:18:54) Run:1
Running from C:\Users\sh4rk\Downloads
Loaded Profiles: sh4rk & DefaultAppPool
Boot Mode: Normal
==============================================
 
fixlist content:
*****************
Start::
CreateRestorePoint:
CloseProcesses:
HKLM\...\Run: [] => [X]
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-996191584-2022938525-1902568006-1001\...\Run: [] => [X]
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\MRT: Restriction <==== ATTENTION
HKLM\SYSTEM\...\Terminal Server: [fDenyTSConnections] = 0 <==== ATTENTION
HKLM\Software\...\Authentication\Credential Providers: [{C885AA15-1764-4293-B82A-0586ADD46B35}] -> 
HKLM\SOFTWARE\Policies\Microsoft\Edge: Restriction <==== ATTENTION
AlternateDataStreams: C:\Users\sh4rk\Downloads\Audacity_(64bit)_v3.7.3.exe:MBAM.Zone.Identifier [61]
AlternateDataStreams: C:\Users\sh4rk\Downloads\Display_Driver_Uninstaller_v18.1.1.0.exe:MBAM.Zone.Identifier [61]
AlternateDataStreams: C:\Users\sh4rk\Downloads\Glary_Utilities_v6.25.0.29.exe:MBAM.Zone.Identifier [61]
AlternateDataStreams: C:\Users\sh4rk\Downloads\gu6setup.exe:MBAM.Zone.Identifier [62]
AlternateDataStreams: C:\Users\sh4rk\Downloads\LibreOffice_(64bit)_v25.2.2.msi:MBAM.Zone.Identifier [61]
Task: {077BA067-7C15-40F0-B22E-C9DC2A54B4A2} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe  (No File)
Task: {CCDFC0B8-01A3-4E74-A820-4F13F51D269E} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => %SystemRoot%\System32\MbaeParserTask.exe  (No File)
Task: {0BB36A32-0D9E-4297-AFD7-6BD7B5DB4C9B} - System32\Tasks\Microsoft\Windows\UNP\RunUpdateNotificationMgr => %windir%\System32\UNP\UpdateNotificationMgr.exe  (No File)
Task: {7BC9F5B8-4888-437D-8E69-132470940556} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_AC => %systemroot%\system32\MusNotification.exe  /RunOnAC RebootDialog (No File)
Task: {51DADB31-C111-48E4-AC6A-D76F39791353} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery => %systemroot%\system32\MusNotification.exe  /RunOnBattery RebootDialog (No File)
Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe  (No File)
Task: {A43DC670-FE8E-446D-8283-5EFECFE935A8} - System32\Tasks\Piriform\CCleaner 7 Update => C:\Program Files\Common Files\Piriform\Icarus\piriform-ccl\icarus.exe  /update:piriform-ccl /silent (No File)
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} =>  -> No File
FirewallRules: [{BF74B50C-DF73-460F-B266-13F26CE8A7A0}] => (Allow) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe => No File
FirewallRules: [{048CF07E-24B2-4BC1-8765-DAECDC7A1DC7}] => (Allow) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe => No File
FirewallRules: [TCP Query User{3E6AA518-CE9F-4D1D-B2D3-DCF9ADAD5E75}C:\program files (x86)\gigabyte\@bios\flashbios.exe] => (Allow) C:\program files (x86)\gigabyte\@bios\flashbios.exe => No File
FirewallRules: [UDP Query User{45FB0E83-94F1-4DA4-8778-6408E93BA93D}C:\program files (x86)\gigabyte\@bios\flashbios.exe] => (Allow) C:\program files (x86)\gigabyte\@bios\flashbios.exe => No File
FirewallRules: [TCP Query User{39A3D332-5B34-4727-81D4-D030BC105331}C:\program files (x86)\gigabyte\@bios\flashbios.exe] => (Allow) C:\program files (x86)\gigabyte\@bios\flashbios.exe => No File
FirewallRules: [UDP Query User{99BF4602-EF4B-4382-BD35-CFA4320FA285}C:\program files (x86)\gigabyte\@bios\flashbios.exe] => (Allow) C:\program files (x86)\gigabyte\@bios\flashbios.exe => No File
FirewallRules: [{424A31E9-852A-4D65-9FAC-F23CAE474422}] => (Allow) C:\Program Files\GIGABYTE\Control Center\GCC.exe => No File
FirewallRules: [TCP Query User{8CA8B756-087F-4EE4-A54D-85462E608E67}C:\program files\gigabyte\control center\gcc.exe] => (Block) C:\program files\gigabyte\control center\gcc.exe => No File
FirewallRules: [UDP Query User{D26916BE-4C45-4028-9CDA-A36412AA5631}C:\program files\gigabyte\control center\gcc.exe] => (Block) C:\program files\gigabyte\control center\gcc.exe => No File
FirewallRules: [{DCAE659E-66B2-4205-8D0D-76A4F4A347C5}] => (Allow) C:\Program Files\GIGABYTE\Control Center\GCC.exe => No File
S3 LibreOfficeMaintenance; "C:\Program Files\LibreOffice\program\update_service.exe" [X]
U4 npcap_wifi; no ImagePath
S3 SIVDriver; \??\C:\WINDOWS\system32\Drivers\SIVX64.sys [X]
cmd: bitsadmin /reset /allusers
cmd: sfc /scannow
cmd: DISM /Online /Cleanup-Image /RestoreHealth
Emptytemp:
End::
*****************
 
Restore point was successfully created.
Processes closed successfully.
"HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\" => removed successfully
"HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\" => removed successfully
"HKU\S-1-5-21-996191584-2022938525-1902568006-1001\Software\Microsoft\Windows\CurrentVersion\Run\\" => removed successfully
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate => removed successfully
HKLM\SOFTWARE\Policies\Microsoft\MRT => removed successfully
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\\"fDenyTSConnections"="1" => value restored successfully
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{C885AA15-1764-4293-B82A-0586ADD46B35} => removed successfully
HKLM\SOFTWARE\Policies\Microsoft\Edge => removed successfully
C:\Users\sh4rk\Downloads\Audacity_(64bit)_v3.7.3.exe => ":MBAM.Zone.Identifier" ADS removed successfully
C:\Users\sh4rk\Downloads\Display_Driver_Uninstaller_v18.1.1.0.exe => ":MBAM.Zone.Identifier" ADS removed successfully
C:\Users\sh4rk\Downloads\Glary_Utilities_v6.25.0.29.exe => ":MBAM.Zone.Identifier" ADS removed successfully
C:\Users\sh4rk\Downloads\gu6setup.exe => ":MBAM.Zone.Identifier" ADS removed successfully
C:\Users\sh4rk\Downloads\LibreOffice_(64bit)_v25.2.2.msi => ":MBAM.Zone.Identifier" ADS removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{077BA067-7C15-40F0-B22E-C9DC2A54B4A2}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{077BA067-7C15-40F0-B22E-C9DC2A54B4A2}" => removed successfully
C:\WINDOWS\System32\Tasks\Microsoft\Windows\Location\Notifications => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Location\Notifications" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CCDFC0B8-01A3-4E74-A820-4F13F51D269E}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CCDFC0B8-01A3-4E74-A820-4F13F51D269E}" => removed successfully
C:\WINDOWS\System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{0BB36A32-0D9E-4297-AFD7-6BD7B5DB4C9B}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0BB36A32-0D9E-4297-AFD7-6BD7B5DB4C9B}" => removed successfully
C:\WINDOWS\System32\Tasks\Microsoft\Windows\UNP\RunUpdateNotificationMgr => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UNP\RunUpdateNotificationMgr" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{7BC9F5B8-4888-437D-8E69-132470940556}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7BC9F5B8-4888-437D-8E69-132470940556}" => removed successfully
C:\WINDOWS\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_AC => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\Reboot_AC" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{51DADB31-C111-48E4-AC6A-D76F39791353}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{51DADB31-C111-48E4-AC6A-D76F39791353}" => removed successfully
C:\WINDOWS\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F3E6E7ED-A196-4E44-8803-55FAB3AD4E29}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F3E6E7ED-A196-4E44-8803-55FAB3AD4E29}" => removed successfully
C:\WINDOWS\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{A43DC670-FE8E-446D-8283-5EFECFE935A8}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A43DC670-FE8E-446D-8283-5EFECFE935A8}" => removed successfully
C:\WINDOWS\System32\Tasks\Piriform\CCleaner 7 Update => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Piriform\CCleaner 7 Update" => removed successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive1 => removed successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive2 => removed successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive3 => removed successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive4 => removed successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive5 => removed successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive6 => removed successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive7 => removed successfully
HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive1 => removed successfully
HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive2 => removed successfully
HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive3 => removed successfully
HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive4 => removed successfully
HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive5 => removed successfully
HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive6 => removed successfully
HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive7 => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{BF74B50C-DF73-460F-B266-13F26CE8A7A0}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{048CF07E-24B2-4BC1-8765-DAECDC7A1DC7}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{3E6AA518-CE9F-4D1D-B2D3-DCF9ADAD5E75}C:\program files (x86)\gigabyte\@bios\flashbios.exe" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{45FB0E83-94F1-4DA4-8778-6408E93BA93D}C:\program files (x86)\gigabyte\@bios\flashbios.exe" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{39A3D332-5B34-4727-81D4-D030BC105331}C:\program files (x86)\gigabyte\@bios\flashbios.exe" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{99BF4602-EF4B-4382-BD35-CFA4320FA285}C:\program files (x86)\gigabyte\@bios\flashbios.exe" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{424A31E9-852A-4D65-9FAC-F23CAE474422}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{8CA8B756-087F-4EE4-A54D-85462E608E67}C:\program files\gigabyte\control center\gcc.exe" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{D26916BE-4C45-4028-9CDA-A36412AA5631}C:\program files\gigabyte\control center\gcc.exe" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{DCAE659E-66B2-4205-8D0D-76A4F4A347C5}" => removed successfully
HKLM\System\CurrentControlSet\Services\LibreOfficeMaintenance => removed successfully
LibreOfficeMaintenance => service removed successfully
HKLM\System\CurrentControlSet\Services\npcap_wifi => removed successfully
npcap_wifi => service removed successfully
HKLM\System\CurrentControlSet\Services\SIVDriver => removed successfully
SIVDriver => service removed successfully
 
========= bitsadmin /reset /allusers =========
 
 
BITSADMIN version 3.0
BITS administration utility.
© Copyright Microsoft Corp.
 
0 out of 0 jobs canceled.
 
 
========= End of CMD: =========
 
 
========= sfc /scannow =========
 
 
Beginning system scan.  This process will take some time.
 
Beginning verification phase of system scan.
 
Verification 0% complete.
Verification 1% complete.
Verification 1% complete.
Verification 2% complete.
Verification 2% complete.
Verification 3% complete.
Verification 3% complete.
Verification 4% complete.
Verification 5% complete.
Verification 5% complete.
Verification 6% complete.
Verification 6% complete.
Verification 7% complete.
Verification 7% complete.
Verification 8% complete.
Verification 8% complete.
Verification 9% complete.
Verification 10% complete.
Verification 10% complete.
Verification 11% complete.
Verification 11% complete.
Verification 12% complete.
Verification 12% complete.
Verification 13% complete.
Verification 14% complete.
Verification 14% complete.
Verification 15% complete.
Verification 15% complete.
Verification 16% complete.
Verification 16% complete.
Verification 17% complete.
Verification 17% complete.
Verification 18% complete.
Verification 19% complete.
Verification 19% complete.
Verification 20% complete.
Verification 20% complete.
Verification 21% complete.
Verification 21% complete.
Verification 22% complete.
Verification 22% complete.
Verification 23% complete.
Verification 24% complete.
Verification 24% complete.
Verification 25% complete.
Verification 25% complete.
Verification 26% complete.
Verification 26% complete.
Verification 27% complete.
Verification 28% complete.
Verification 28% complete.
Verification 29% complete.
Verification 29% complete.
Verification 30% complete.
Verification 30% complete.
Verification 31% complete.
Verification 31% complete.
Verification 32% complete.
Verification 33% complete.
Verification 33% complete.
Verification 34% complete.
Verification 34% complete.
Verification 35% complete.
Verification 35% complete.
Verification 36% complete.
Verification 36% complete.
Verification 37% complete.
Verification 38% complete.
Verification 38% complete.
Verification 39% complete.
Verification 39% complete.
Verification 40% complete.
Verification 40% complete.
Verification 41% complete.
Verification 42% complete.
Verification 42% complete.
Verification 43% complete.
Verification 43% complete.
Verification 44% complete.
Verification 44% complete.
Verification 45% complete.
Verification 45% complete.
Verification 46% complete.
Verification 47% complete.
Verification 47% complete.
Verification 48% complete.
Verification 48% complete.
Verification 49% complete.
Verification 49% complete.
Verification 50% complete.
Verification 51% complete.
Verification 51% complete.
Verification 52% complete.
Verification 52% complete.
Verification 53% complete.
Verification 53% complete.
Verification 54% complete.
Verification 54% complete.
Verification 55% complete.
Verification 56% complete.
Verification 56% complete.
Verification 57% complete.
Verification 57% complete.
Verification 58% complete.
Verification 58% complete.
Verification 59% complete.
Verification 59% complete.
Verification 60% complete.
Verification 61% complete.
Verification 61% complete.
Verification 62% complete.
Verification 62% complete.
Verification 63% complete.
Verification 63% complete.
Verification 64% complete.
Verification 65% complete.
Verification 65% complete.
Verification 66% complete.
Verification 66% complete.
Verification 67% complete.
Verification 67% complete.
Verification 68% complete.
Verification 68% complete.
Verification 69% complete.
Verification 70% complete.
Verification 70% complete.
Verification 71% complete.
Verification 71% complete.
Verification 72% complete.
Verification 72% complete.
Verification 73% complete.
Verification 73% complete.
Verification 74% complete.
Verification 75% complete.
Verification 75% complete.
Verification 76% complete.
Verification 76% complete.
Verification 77% complete.
Verification 77% complete.
Verification 78% complete.
Verification 79% complete.
Verification 79% complete.
Verification 80% complete.
Verification 80% complete.
Verification 81% complete.
Verification 81% complete.
Verification 82% complete.
Verification 82% complete.
Verification 83% complete.
Verification 84% complete.
Verification 84% complete.
Verification 85% complete.
Verification 85% complete.
Verification 86% complete.
Verification 86% complete.
Verification 87% complete.
Verification 88% complete.
Verification 88% complete.
Verification 89% complete.
Verification 89% complete.
Verification 90% complete.
Verification 90% complete.
Verification 91% complete.
Verification 91% complete.
Verification 92% complete.
Verification 93% complete.
Verification 93% complete.
Verification 94% complete.
Verification 94% complete.
Verification 95% complete.
Verification 95% complete.
Verification 96% complete.
Verification 96% complete.
Verification 97% complete.
Verification 98% complete.
Verification 98% complete.
Verification 99% complete.
Verification 99% complete.
Verification 100% complete.
 
Windows Resource Protection found corrupt files and successfully repaired them.
For online repairs, details are included in the CBS log file located at
windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. For offline
repairs, details are included in the log file provided by the /OFFLOGFILE flag.
 
 
========= End of CMD: =========
 
 
========= DISM /Online /Cleanup-Image /RestoreHealth =========
 
 
Deployment Image Servicing and Management tool
Version: 10.0.26100.4741
 
Image Version: 10.0.26220.6690
 
 
[==                         3.8%                           ] 
 
[==                         4.8%                           ] 
 
[===                        5.7%                           ] 
 
[===                        6.7%                           ] 
 
[====                       7.7%                           ] 
 
[=====                      8.7%                           ] 
 
[=====                      9.7%                           ] 
 
[======                     10.6%                          ] 
 
[======                     11.6%                          ] 
 
[=======                    12.6%                          ] 
 
[=======                    13.1%                          ] 
 
[========                   14.0%                          ] 
 
[========                   15.0%                          ] 
 
[=========                  16.0%                          ] 
 
[=========                  17.0%                          ] 
 
[==========                 18.0%                          ] 
 
[==========                 18.9%                          ] 
 
[===========                19.9%                          ] 
 
[============               20.9%                          ] 
 
[============               21.4%                          ] 
 
[=============              22.4%                          ] 
 
[=============              23.4%                          ] 
 
[==============             24.4%                          ] 
 
[==============             25.4%                          ] 
 
[===============            26.3%                          ] 
 
[===============            27.3%                          ] 
 
[================           28.3%                          ] 
 
[================           29.3%                          ] 
 
[=================          29.9%                          ] 
 
[=================          30.9%                          ] 
 
[==================         31.8%                          ] 
 
[===================        32.8%                          ] 
 
[===================        33.4%                          ] 
 
[===================        34.4%                          ] 
 
[====================       35.4%                          ] 
 
[====================       36.0%                          ] 
 
[=====================      37.0%                          ] 
 
[======================     38.0%                          ] 
 
[======================     38.5%                          ] 
 
[======================     39.1%                          ] 
 
[======================     39.6%                          ] 
 
[=======================    40.5%                          ] 
 
[=======================    40.7%                          ] 
 
[========================   41.5%                          ] 
 
[========================   42.5%                          ] 
 
[=========================  43.2%                          ] 
 
[=========================  43.5%                          ] 
 
[=========================  43.8%                          ] 
 
[=========================  44.4%                          ] 
 
[========================== 44.9%                          ] 
 
[========================== 45.7%                          ] 
 
[========================== 46.5%                          ] 
 
[===========================46.9%                          ] 
 
[===========================47.2%                          ] 
 
[===========================48.2%                          ] 
 
[===========================49.2%                          ] 
 
[===========================50.2%                          ] 
 
[===========================51.2%                          ] 
 
[===========================52.2%                          ] 
 
[===========================53.1%                          ] 
 
[===========================54.1%                          ] 
 
[===========================54.4%                          ] 
 
[===========================54.5%                          ] 
 
[===========================54.7%                          ] 
 
[===========================54.8%                          ] 
 
[===========================54.9%                          ] 
 
[===========================55.0%                          ] 
 
[===========================55.0%                          ] 
 
[===========================55.1%                          ] 
 
[===========================55.2%                          ] 
 
[===========================55.2%                          ] 
 
[===========================55.3%                          ] 
 
[===========================55.5%                          ] 
 
[===========================55.5%                          ] 
 
[===========================55.5%                          ] 
 
[===========================55.6%                          ] 
 
[===========================55.6%                          ] 
 
[===========================55.8%                          ] 
 
[===========================55.8%                          ] 
 
[===========================55.9%                          ] 
 
[===========================56.0%                          ] 
 
[===========================56.2%                          ] 
 
[===========================56.2%                          ] 
 
[===========================56.4%                          ] 
 
[===========================56.5%                          ] 
 
[===========================56.6%                          ] 
 
[===========================57.4%=                         ] 
 
[===========================58.4%=                         ] 
 
[===========================59.4%==                        ] 
 
[===========================59.5%==                        ] 
 
[===========================59.5%==                        ] 
 
[===========================62.3%====                      ] 
 
[===========================84.9%=================         ] 
 
[==========================100.0%==========================] 
The restore operation completed successfully.
The operation completed successfully.
 
 
========= End of CMD: =========
 
 
=========== EmptyTemp: ==========
 
FlushDNS => completed
BITS transfer queue => 1572864 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 13828232 B
Java, Discord, Steam htmlcache, WinHttpAutoProxySvc/winhttp *.cache => 65886549 B
Windows/system/drivers => 50886954 B
Edge => 0 B
Brave => 286646727 B
Firefox => 0 B
Opera => 0 B
 
Temp, IE cache, history, cookies, recent:
Default => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 0 B
NetworkService => 0 B
sh4rk => 2229283 B
DefaultAppPool => 2229283 B
 
RecycleBin => 0 B
EmptyTemp: => 403.7 MB temporary data Removed.
 
================================
 
 
The system needed a reboot.
 
==== End of Fixlog 14:22:49 ====


#9 dennis_l

dennis_l

  •  Avatar image
  • Malware Response Team
  • 5,062 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:03:09 PM

Posted 23 October 2025 - 01:42 PM

Ok good.

Please now run a full scan with ESET Online Scanner, as follows.

 

  • Download ESET Online Scanner from here and save it to your Desktop.
  • Right click the esetonlinescanner.exe file you downloaded and select Run as administrator.
  • Select your desired language from the drop-down menu and click Get started.
  • Click Yes if a User Account window appears.
  • In the Terms of use screen, click Accept if you agree to the Terms of use.
  • Click Get started in the welcome screen.
  • Select your preference for the Customer Experience Improvement Program and the Detection feedback system.Click Continue.
  • Click Computer scan, in the Welcome back screen.
  • Choose Full scan on the next screen.
  • Select Enable ESET to detect and quarantine potentially unwanted applications.Then click Start scan
  • Please note that this process can take several hours to complete.
  • At the end of the scan, the Found and resolved detections screen may be displayed. You can click View detailed results to view specific information. Click Continue.
  • On the following screen click Save scan log and save it to your Desktop as ESETScan.txt. Click Continue.
  • ESET Online Scanner will now ask if you wish to turn on the Periodic Scan feature.I suggest that you do not do this for now Click Continue
  • You are offered a 30 day trial of ESET Internet Security on the next screen. Click Continue
  • On the next screen, you can leave feedback about the program if you wish.
  • There is an option to delete the application's data on closing, but we can but we can do this later.
  • If you left feedback, click Submit and Close. If not, click Close.
  • Copy and paste the contents of the ESETScan.txt file in your next reply.

 



#10 sh4rkbyt31

sh4rkbyt31
  • Topic Starter

  •  Avatar image
  • Members
  • 86 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:09 AM

Posted 23 October 2025 - 02:53 PM

10/23/2025 15:46:36 PM
Scanned files: 453408
Detected files: 6
Cleaned files: 3
Total scan time 00:51:48
Scan status: Finished
C:\ProgramData\Surfshark\Endpoint Protection SDK\common\sentry_temp\TDSSKiller.exe.5FD286316313BF88C621C0F553279418 Win32/RiskWare.TDSSKiller.A application unable to clean
 
C:\ProgramData\Surfshark\Endpoint Protection SDK\common\sentry_temp\{F09F079B-3329-44EA-B790-C80FDA842BFB}.exe.717CC55FEBF62E7C137EBC22A42C4C30 Win32/RiskWare.TDSSKiller.A application cleaned by deleting (after the next restart)
 
C:\Users\All Users\Surfshark\Endpoint Protection SDK\common\sentry_temp\TDSSKiller.exe.5FD286316313BF88C621C0F553279418 Win32/RiskWare.TDSSKiller.A application unable to clean
 
C:\Users\All Users\Surfshark\Endpoint Protection SDK\common\sentry_temp\{F09F079B-3329-44EA-B790-C80FDA842BFB}.exe.717CC55FEBF62E7C137EBC22A42C4C30 Win32/RiskWare.TDSSKiller.A application cleaned by deleting (after the next restart)
 
C:\Users\sh4rk\Downloads\tron\resources\stage_0_prep\tdss_killer\TDSSKiller.exe Win32/RiskWare.TDSSKiller.A application unable to clean
 
C:\Users\sh4rk\Downloads\BingWallpaper.exe a variant of MSIL/Microsoft.Bing.C potentially unwanted application cleaned by deleting


#11 sh4rkbyt31

sh4rkbyt31
  • Topic Starter

  •  Avatar image
  • Members
  • 86 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:09 AM

Posted 23 October 2025 - 02:54 PM

Sorry Dennis but I have to leave for work. Will pick this up tomorrow, thank you for your help.



#12 dennis_l

dennis_l

  •  Avatar image
  • Malware Response Team
  • 5,062 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:03:09 PM

Posted 24 October 2025 - 03:19 AM

That looks ok.
Could you please check if Real-time protection and Web protection are enabled  and definitions are up to date, in the Surfshark app. 
The logs show Surfshark processes and services running, but I'd like to be sure that your computer is protected ok.
Then run a Quick Scan.
This guide should be of assistance.
We'll leave those Security Center entries alone, in case removal causes issues.
------------------------------------------
Moving on to the DVD drive.
Can you work the CD/DVD tray manually?
If so insert a disk and see if the drive appears in File Explorer.
In the Device Manager, right click on DVD/CD-ROM drives and select Scan for hardware changes.
Then expand DVD/CD-ROM drives, double click on the drive and post screen shots of the General, Driver, Details and Events tabs. 



#13 sh4rkbyt31

sh4rkbyt31
  • Topic Starter

  •  Avatar image
  • Members
  • 86 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:09 AM

Posted 24 October 2025 - 10:15 AM

OK Surfshark updated this morning and I ran the virus scan for complete system and it found nothing. 

Anti Virus Surfshark is on, Firewall is turned on, Web Protection still says No Provider.

As far as the DVD Drive I can operate it (open and close) manually but when it's plugged into my system it's still doing the same thing. Light flashing on and off and not reading a disc.

 

It's not appearing in File Explorer either.

I right clicked on the specific DVD Drive and Scanned for hardware changes, it blinked as if it did something but nothing else happened.

 

Clipboard - Some of these settings are managed by your organization - I can't turn it on.

 

Clipboard sync is not available due to your organizations policy

 



#14 sh4rkbyt31

sh4rkbyt31
  • Topic Starter

  •  Avatar image
  • Members
  • 86 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:09 AM

Posted 24 October 2025 - 10:29 AM

 Got the 3 screenshots but I don't know how to copy & paste the pics on here?



#15 sh4rkbyt31

sh4rkbyt31
  • Topic Starter

  •  Avatar image
  • Members
  • 86 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:09 AM

Posted 24 October 2025 - 10:34 AM

Ok I think I've attached the file photos?

Attached Files






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users