Fix result of Farbar Recovery Scan Tool (x64) Version: 18-04-2022 01 Ran by [removed] (20-04-2022 03:36:49) Run:2 Running from C:\Users\[removed]\Desktop [removed] Boot Mode: Normal ============================================== fixlist content: ***************** Task: {37292EA8-F458-47ED-A55C-5A3A1CCF5FD5} - \Microsoft\Windows\WindowsUpdate\sih -> No File <==== ATTENTION Task: {3891CB81-CF07-4ECD-A7CE-59544F84AF7D} - \Microsoft\Windows\Shell\FamilySafetyMonitorToastTask -> No File <==== ATTENTION Task: {431488DB-07D9-46EE-90A5-EA31820619B0} - \HPJumpStartLaunch -> No File <==== ATTENTION Task: {64CCB79F-EF30-4F8A-9098-65B0D7EA3F51} - \Microsoft\Windows\UpdateOrchestrator\USO_Broker_Display -> No File <==== ATTENTION Task: {65F2D03D-0D30-443D-BD6B-E87A9D860AA3} - \Hewlett-Packard\HP Support Assistant\Product Configurator -> No File <==== ATTENTION Task: {67140C98-40BB-42B3-B8F6-C846E28045D9} - \HP\HP CoolSense\HP CoolSense Start at Logon -> No File <==== ATTENTION Task: {80BA2026-6538-4B6A-AD10-76F52F7B956B} - \OneDrive Standalone Update Task v2 -> No File <==== ATTENTION Task: {D0218C70-9C99-4043-BF17-667E1AE5C42E} - \Microsoft\Windows\UpdateOrchestrator\Reboot -> No File <==== ATTENTION Task: {D8460F43-8BF4-4285-B554-E60D9041C039} - \HPAudioSwitch -> No File <==== ATTENTION Task: {EA49841C-E4A6-4E37-8B64-2F02D084AC96} - \Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start -> No File <==== ATTENTION Task: {FACCD9E9-FCBB-44B3-AA8E-3DCC25157A6C} - \HPEA3JOBS -> No File <==== ATTENTION U3 aspnet_state; no ImagePath S3 EraserUtilDrv11912; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11912.sys [X] S3 MpKslcf98c015; \??\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{E0449B86-7E1E-45A3-A78D-247ABEB2A983}\MpKslDrv.sys [X] S3 nsvst_NGC; \SystemRoot\System32\drivers\NGCx64\1616030.009\nsvst.sys [X] 2022-04-17 03:22 - 2022-04-17 03:27 - 011140776 _____ (McAfee, LLC) C:\Users\Eldritch\Downloads\MCPR.exe 2022-04-17 02:30 - 2022-04-17 02:36 - 013059056 _____ (NortonLifeLock Inc.) C:\Users\Eldritch\Downloads\NRnR.exe 2022-04-10 03:23 - 2022-04-10 03:23 - 000000000 ____D C:\Users\Eldritch\AppData\Local\jILhSZuRqThbQPTW9VU VirusTotal: C:\Program Files (x86)\K-Lite Codec Pack\Filters\LAV64\libbluray.dll;C:\Program Files (x86)\K-Lite Codec Pack\Icaros\64-bit\libunarr-ics.dll;C:\windows\system32\x264vfw64.dll;C:\windows\system32\huffyuv.dll AV: Norton Security (Enabled - Up to date) {53C7D717-52E2-B95E-FA61-6F32ECC805DB} AV: Norton Security (Enabled - Up to date) {AECE2126-F4E7-6909-11F2-1B69D1FBCBD0} FW: Norton Security (Enabled) {96F5A003-BE88-6851-3AAD-B25C2F288CAB} FW: Norton Security (Enabled) {6BFC5632-188D-B806-D13E-C607121B42A0} ShellIconOverlayIdentifiers: [ OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => -> No File ShellIconOverlayIdentifiers: [ OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => -> No File ShellIconOverlayIdentifiers: [ OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => -> No File ShellIconOverlayIdentifiers-x32: [ OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => -> No File ShellIconOverlayIdentifiers-x32: [ OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => -> No File ShellIconOverlayIdentifiers-x32: [ OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => -> No File ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File AlternateDataStreams: C:\Users\Eldritch\Application Data:2e7adecd915fad7ede6cff9c6c6e4e6e [394] AlternateDataStreams: C:\Users\Eldritch\AppData\Roaming:2e7adecd915fad7ede6cff9c6c6e4e6e [394] BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_321\bin\ssv.dll [2022-04-10] (Oracle America, Inc. -> Oracle Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_321\bin\jp2ssv.dll [2022-04-10] (Oracle America, Inc. -> Oracle Corporation) EmptyTemp: Hosts: CMD: ipconfig /flushdns ***************** "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{37292EA8-F458-47ED-A55C-5A3A1CCF5FD5}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{37292EA8-F458-47ED-A55C-5A3A1CCF5FD5}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\WindowsUpdate\sih" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3891CB81-CF07-4ECD-A7CE-59544F84AF7D}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3891CB81-CF07-4ECD-A7CE-59544F84AF7D}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Shell\FamilySafetyMonitorToastTask" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{431488DB-07D9-46EE-90A5-EA31820619B0}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{431488DB-07D9-46EE-90A5-EA31820619B0}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\HPJumpStartLaunch" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{64CCB79F-EF30-4F8A-9098-65B0D7EA3F51}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{64CCB79F-EF30-4F8A-9098-65B0D7EA3F51}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\USO_Broker_Display" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{65F2D03D-0D30-443D-BD6B-E87A9D860AA3}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{65F2D03D-0D30-443D-BD6B-E87A9D860AA3}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Hewlett-Packard\HP Support Assistant\Product Configurator" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{67140C98-40BB-42B3-B8F6-C846E28045D9}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{67140C98-40BB-42B3-B8F6-C846E28045D9}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\HP\HP CoolSense\HP CoolSense Start at Logon" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{80BA2026-6538-4B6A-AD10-76F52F7B956B}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{80BA2026-6538-4B6A-AD10-76F52F7B956B}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\OneDrive Standalone Update Task v2" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D0218C70-9C99-4043-BF17-667E1AE5C42E}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D0218C70-9C99-4043-BF17-667E1AE5C42E}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\Reboot" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{D8460F43-8BF4-4285-B554-E60D9041C039}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D8460F43-8BF4-4285-B554-E60D9041C039}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\HPAudioSwitch" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{EA49841C-E4A6-4E37-8B64-2F02D084AC96}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{EA49841C-E4A6-4E37-8B64-2F02D084AC96}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{FACCD9E9-FCBB-44B3-AA8E-3DCC25157A6C}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FACCD9E9-FCBB-44B3-AA8E-3DCC25157A6C}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\HPEA3JOBS" => removed successfully HKLM\System\CurrentControlSet\Services\aspnet_state => removed successfully aspnet_state => service removed successfully HKLM\System\CurrentControlSet\Services\EraserUtilDrv11912 => removed successfully EraserUtilDrv11912 => service removed successfully MpKslcf98c015 => service not found. HKLM\System\CurrentControlSet\Services\nsvst_NGC => removed successfully nsvst_NGC => service removed successfully C:\Users\Eldritch\Downloads\MCPR.exe => moved successfully C:\Users\Eldritch\Downloads\NRnR.exe => moved successfully C:\Users\Eldritch\AppData\Local\jILhSZuRqThbQPTW9VU => moved successfully VirusTotal: C:\Program Files (x86)\K-Lite Codec Pack\Filters\LAV64\libbluray.dll => https://www.virustotal.com/gui/file/1dea9dc8cdd26fbe95d5ee9f98bebd2a334d21615ec9adf9ea295c705d45c071/detection/f-1dea9dc8cdd26fbe95d5ee9f98bebd2a334d21615ec9adf9ea295c705d45c071-1649040254 VirusTotal: C:\Program Files (x86)\K-Lite Codec Pack\Icaros\64-bit\libunarr-ics.dll => https://www.virustotal.com/gui/file/c73d9dd8176cd845dd9c047f354c8217c7881e9b47c1a15dca3979abed9514b1/detection/f-c73d9dd8176cd845dd9c047f354c8217c7881e9b47c1a15dca3979abed9514b1-1648311015 VirusTotal: C:\windows\system32\x264vfw64.dll => https://www.virustotal.com/gui/file/3bdcec7f1d6787df1d673558dfbf4ed3a24ca9aae8c8d010be7b9198a461e9b1/detection/f-3bdcec7f1d6787df1d673558dfbf4ed3a24ca9aae8c8d010be7b9198a461e9b1-1648649608 VirusTotal: C:\windows\system32\huffyuv.dll => https://www.virustotal.com/gui/file/c2810bd0d3737025c92f505733dff6538da2ac4e4cae7e62f7aae1967476efc8/detection/f-c2810bd0d3737025c92f505733dff6538da2ac4e4cae7e62f7aae1967476efc8-1643569424 "AV: Norton Security (Enabled - Up to date) {53C7D717-52E2-B95E-FA61-6F32ECC805DB}" => removed successfully "AV: Norton Security (Enabled - Up to date) {AECE2126-F4E7-6909-11F2-1B69D1FBCBD0}" => removed successfully "FW: Norton Security (Enabled) {96F5A003-BE88-6851-3AAD-B25C2F288CAB}" => removed successfully "FW: Norton Security (Enabled) {6BFC5632-188D-B806-D13E-C607121B42A0}" => removed successfully HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OverlayExcluded => removed successfully HKLM\Software\Classes\CLSID\{4433A54A-1AC8-432F-90FC-85F045CF383C} => removed successfully HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OverlayPending => removed successfully HKLM\Software\Classes\CLSID\{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => removed successfully HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OverlayProtected => removed successfully HKLM\Software\Classes\CLSID\{476D0EA3-80F9-48B5-B70B-05E677C9C148} => removed successfully HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OverlayExcluded => removed successfully HKLM\Software\Wow6432Node\Classes\CLSID\{4433A54A-1AC8-432F-90FC-85F045CF383C} => removed successfully HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OverlayPending => removed successfully HKLM\Software\Wow6432Node\Classes\CLSID\{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => removed successfully HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OverlayProtected => removed successfully HKLM\Software\Wow6432Node\Classes\CLSID\{476D0EA3-80F9-48B5-B70B-05E677C9C148} => removed successfully HKLM\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers\igfxcui => removed successfully C:\Users\Eldritch\Application Data => ":2e7adecd915fad7ede6cff9c6c6e4e6e" ADS removed successfully "C:\Users\Eldritch\AppData\Roaming" => ":2e7adecd915fad7ede6cff9c6c6e4e6e" ADS not found. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} => removed successfully HKLM\Software\Classes\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} => removed successfully HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9} => removed successfully HKLM\Software\Classes\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9} => removed successfully C:\Windows\System32\Drivers\etc\hosts => moved successfully Hosts restored successfully. ========= ipconfig /flushdns ========= Windows IP Configuration Successfully flushed the DNS Resolver Cache. ========= End of CMD: ========= =========== EmptyTemp: ========== BITS transfer queue => 0 B DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 54726544 B Java, Flash, Steam htmlcache => 0 B Windows/system/drivers => 32568655 B Edge => 0 B Firefox => 50249422 B Opera => 0 B Temp, IE cache, history, cookies, recent: Default => 6656 B ProgramData => 6656 B Public => 6656 B systemprofile => 6656 B systemprofile32 => 6656 B LocalService => 73768 B NetworkService => 7664330 B Eldritch => 97965899 B RecycleBin => 89714044 B EmptyTemp: => 317.6 MB temporary data Removed. ================================ The system needed a reboot. ==== End of Fixlog 03:37:14 ====