Additional scan result of Farbar Recovery Scan Tool (x64) Version: 16-06-2022 Ran by [removed] (18-06-2022 13:21:29) Running from C:\Users\[removed]\Downloads\Programs Microsoft Windows 10 Pro Version 21H2 19044.1766 (X64) (2022-06-17 15:31:56) Boot Mode: Normal ========================================================== ==================== Accounts: ============================= (If an entry is included in the fixlist, it will be removed.) Administrator (S-1-5-21-2119236083-4270076351-253614331-500 - Administrator - Disabled) DefaultAccount (S-1-5-21-2119236083-4270076351-253614331-503 - Limited - Disabled) Guest (S-1-5-21-2119236083-4270076351-253614331-501 - Limited - Disabled) JoeMe (S-1-5-21-2119236083-4270076351-253614331-1001 - Administrator - Enabled) => C:\Users\JoeMe WDAGUtilityAccount (S-1-5-21-2119236083-4270076351-253614331-504 - Limited - Disabled) ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AV: Norton 360 (Enabled - Up to date) {AECE2126-F4E7-6909-11F2-1B69D1FBCBD0} FW: Norton 360 (Enabled) {96F5A003-BE88-6851-3AAD-B25C2F288CAB} ==================== Installed Programs ====================== (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) Acronis True Image (HKLM-x32\...\{5B755A36-60DF-40E9-B490-D8A93421D547}) (Version: 24.8.38600 - Acronis) Hidden Acronis True Image (HKLM-x32\...\{5B755A36-60DF-40E9-B490-D8A93421D547}Visible) (Version: 24.8.38600 - Acronis) Adobe Acrobat DC (64-bit) (HKLM\...\{AC76BA86-1033-FFFF-7760-BC15014EA700}) (Version: 22.001.20142 - Adobe) Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 5.7.1.1 - Adobe Inc.) Adobe Dreamweaver 2021 (HKLM-x32\...\DRWV_21_2) (Version: 21.2 - Adobe Inc.) Adobe Genuine Service (HKLM-x32\...\AdobeGenuineService) (Version: 7.7.0.35 - Adobe Inc.) Applian Director 4.3.0.10 (HKLM-x32\...\Applian Director_is1) (Version: 4.3.0.10 - Applian LLC) ASUS AIOFan HAL (HKLM\...\{EAE80DED-1A39-41C5-9F60-87CC947F6454}) (Version: 1.1.47.0 - ASUSTek COMPUTER INC.) Hidden ASUS AIOFan HAL (HKLM-x32\...\{306eac2e-72d3-456a-9e4a-b866ff11d0df}) (Version: 1.1.47.0 - ASUSTek COMPUTER INC.) Hidden ASUS AURA Extension Card HAL (HKLM\...\{237E1CAC-1708-4940-AC34-DF15C079AB70}) (Version: 1.1.0.18 - ASUSTeK COMPUTER INC.) Hidden ASUS AURA Extension Card HAL (HKLM-x32\...\{4e2b05b0-eb08-41e5-9eb3-cdcc43d6bee0}) (Version: 1.1.0.18 - ASUSTeK COMPUTER INC.) Hidden ASUS AURA Motherboard HAL (HKLM\...\{4EBEAC95-76BC-46A8-8644-6E2F1C87CF70}) (Version: 1.3.0.0 - ASUSTeK COMPUTER INC.) Hidden ASUS AURA Motherboard HAL (HKLM-x32\...\{6085fcf6-a968-45bf-9f5a-ad97944d2cb4}) (Version: 1.3.0.0 - ASUSTeK COMPUTER INC.) Hidden ASUS AURA VGA Component (HKLM\...\{71BB96A6-EAC4-45AE-A17D-D3ED43FF1D14}) (Version: 0.0.4.3 - ASUSTek COMPUTER INC. ) Hidden ASUS AURA VGA Component (HKLM-x32\...\{7a0d5159-cb5e-4f66-91f8-bab46f864f14}) (Version: 0.0.4.3 - ASUSTek COMPUTER INC. ) Hidden ASUS Update Helper (HKLM-x32\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.107.79 - ASUSTeK Computer Inc.) Hidden ASUSTOR Control Center 2.1.3.7270 (HKLM-x32\...\{10F84A36-C641-4033-9B7C-D6A96F7D827C}_is1) (Version: 2.1.3.7270 - ASUSTOR) Audacity 3.1.3 (HKLM\...\Audacity_is1) (Version: 3.1.3 - Audacity Team) AURA DRAM Component (HKLM\...\{9AFE5429-866B-457D-A864-80BCF7672EE8}) (Version: 1.1.18 - ASUS) Hidden AURA DRAM Component (HKLM-x32\...\{c3ae9104-ed9b-4ab5-9eb1-569697f4514b}) (Version: 1.1.18 - ASUS) Hidden Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.) Bulk Rename Utility 3.4.3.0 (64-bit) (HKLM\...\Bulk Rename Utility Installation_is1) (Version: - TGRMN Software) CCleaner (HKLM\...\CCleaner) (Version: 6.00 - Piriform) Defraggler (HKLM\...\Defraggler) (Version: 2.22 - Piriform) EasiestSoft Movie Editor 5.1.0 (HKLM-x32\...\{8BB65DEC-BE2C-EB66-7595-ADAE2D710380}_is1) (Version: 5.1.0 - EasiestSoft International LLC.) ENE RGB HAL (HKLM\...\{E050E98C-5524-4AFB-9E53-97700BEF2C02}) (Version: 1.1.39.18 - Ene Tech.) Hidden ENE RGB HAL (HKLM-x32\...\{cf6be873-4fda-41b6-87c1-54f5f726365d}) (Version: 1.1.39.18 - Ene Tech.) Hidden ENE_EHD_M2_HAL (HKLM\...\{37A48B7F-D4EA-4863-844E-A284E2AA3C5D}) (Version: 1.0.9.12 - ENE TECHNOLOGY INC.) Hidden ENE_EHD_M2_HAL (HKLM-x32\...\{97f3a665-a91b-4def-91e2-97fec9f22bfa}) (Version: 1.0.9.12 - ENE TECHNOLOGY INC.) Hidden FlexHEX version 2.7 (HKLM-x32\...\FlexHEX_is1) (Version: 2.7 - Inv Softworks LLC) FolderSizes 9 (HKLM\...\{9ECB8915-CD7C-40CA-91FC-63EFBF06EA25}) (Version: 9.5.386 - Key Metric Software) GameSDK Service (HKLM-x32\...\{021d69c3-d686-4a94-8fb5-fd1ee782fb14}) (Version: 1.0.5.0 - ASUSTek COMPUTER INC.) GameSDK Service (HKLM-x32\...\{7160DA8D-3F25-4F6E-ABC8-F693551D82FA}) (Version: 1.0.5.0 - ASUSTek COMPUTER INC.) Hidden Google Chrome (HKLM-x32\...\Google Chrome) (Version: 102.0.5005.115 - Google LLC) Internet Download Manager (HKLM-x32\...\Internet Download Manager) (Version: 6.41.2 - Tonec Inc.) Kingston AURA DRAM Component (HKLM\...\{965CDF5F-901C-476F-B3A8-7396701B1129}) (Version: 1.1.12 - KINGSTON COMPONENTS INC.) Hidden Kingston AURA DRAM Component (HKLM-x32\...\{2237a879-7fa4-4e21-ae3b-00f6a649b9d9}) (Version: 1.1.12 - KINGSTON COMPONENTS INC.) Hidden Microsoft 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 16.0.15225.20288 - Microsoft Corporation) Microsoft Edge (HKLM-x32\...\Microsoft Edge) (Version: 102.0.1245.44 - Microsoft Corporation) Microsoft OneDrive (HKLM\...\OneDriveSetup.exe) (Version: 22.111.0522.0002 - Microsoft Corporation) Microsoft Update Health Tools (HKLM\...\{7B1FCD52-8F6B-4F12-A143-361EA39F5E7C}) (Version: 3.67.0.0 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.61030 (HKLM\...\{37B8F9C7-03FB-3253-8781-2517C99D7C00}) (Version: 11.0.61030 - Microsoft Corporation) Hidden Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.61030 (HKLM\...\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}) (Version: 11.0.61030 - Microsoft Corporation) Hidden Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 (HKLM-x32\...\{B175520C-86A2-35A7-8619-86DC379688B9}) (Version: 11.0.61030 - Microsoft Corporation) Hidden Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 (HKLM-x32\...\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}) (Version: 11.0.61030 - Microsoft Corporation) Hidden Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40664 (HKLM-x32\...\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}) (Version: 12.0.40664.0 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.40664 (HKLM-x32\...\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}) (Version: 12.0.40664.0 - Microsoft Corporation) Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.40664 (HKLM\...\{010792BA-551A-3AC0-A7EF-0FAB4156C382}) (Version: 12.0.40664 - Microsoft Corporation) Hidden Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.40664 (HKLM\...\{53CF6934-A98D-3D84-9146-FC4EDF3D5641}) (Version: 12.0.40664 - Microsoft Corporation) Hidden Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.40664 (HKLM-x32\...\{D401961D-3A20-3AC7-943B-6139D5BD490A}) (Version: 12.0.40664 - Microsoft Corporation) Hidden Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.40664 (HKLM-x32\...\{8122DAB1-ED4D-3676-BB0A-CA368196543E}) (Version: 12.0.40664 - Microsoft Corporation) Hidden Microsoft Visual C++ 2015-2019 Redistributable (x64) - 14.28.29913 (HKLM-x32\...\{855e31d2-9031-46e1-b06d-c9d7777deefb}) (Version: 14.28.29913.0 - Microsoft Corporation) Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.26.28720 (HKLM-x32\...\{86380aef-fd23-4fc3-8723-a98ccad8f2c6}) (Version: 14.26.28720.3 - Microsoft Corporation) Microsoft Visual C++ 2019 X64 Additional Runtime - 14.28.29913 (HKLM\...\{620A7633-7A09-42A8-8580-076A4483C4B0}) (Version: 14.28.29913 - Microsoft Corporation) Hidden Microsoft Visual C++ 2019 X64 Minimum Runtime - 14.28.29913 (HKLM\...\{EECDD137-13DA-46ED-ADA0-BDF7F8BE65B8}) (Version: 14.28.29913 - Microsoft Corporation) Hidden Microsoft Visual C++ 2019 X86 Additional Runtime - 14.26.28720 (HKLM-x32\...\{2F69FB2B-2C48-491C-B249-22C1BDCE1117}) (Version: 14.26.28720 - Microsoft Corporation) Hidden Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.26.28720 (HKLM-x32\...\{31C9EB3A-5F0C-49E7-8E6C-D404E48F433D}) (Version: 14.26.28720 - Microsoft Corporation) Hidden Movavi Video Editor Plus 2022 (HKU\S-1-5-21-2119236083-4270076351-253614331-1001\...\Movavi Video Editor Plus 2022) (Version: 22.3.0 - Movavi) Movavi Video Suite 2020 (HKU\S-1-5-21-2119236083-4270076351-253614331-1001\...\Movavi Video Suite 2020) (Version: 20.3.0 - Movavi) Norton 360 (HKLM-x32\...\NGC) (Version: 22.22.4.11 - NortonLifeLock Inc) Notepad++ (64-bit x64) (HKLM\...\Notepad++) (Version: 8.4.2 - Notepad++ Team) Npcap (HKLM-x32\...\NpcapInst) (Version: 1.60 - Nmap Project) Office 16 Click-to-Run Extensibility Component (HKLM\...\{90160000-008C-0000-1000-0000000FF1CE}) (Version: 16.0.15225.20150 - Microsoft Corporation) Hidden Office 16 Click-to-Run Licensing Component (HKLM\...\{90160000-007E-0000-1000-0000000FF1CE}) (Version: 16.0.15225.20288 - Microsoft Corporation) Hidden Patriot Viper DRAM RGB (HKLM\...\{1F9C282E-CCB4-4D8E-A5CB-7B74DFCD8C95}) (Version: 1.0.9.2 - Patriot Memory) Hidden Patriot Viper DRAM RGB (HKLM-x32\...\{fdc098ce-d76c-4e2e-a0a6-01a24e9a1f7d}) (Version: 1.0.9.2 - Patriot Memory) Patriot Viper M2 SSD RGB (HKLM\...\{8B4C0A3D-C135-4E1F-98D8-3926494B4D61}) (Version: 1.0.6.5 - Patriot Memory) Hidden Patriot Viper M2 SSD RGB (HKLM-x32\...\{387596e5-692e-4baf-bec2-3338d555df7a}) (Version: 1.0.6.5 - Patriot Memory) PHISON HAL (HKLM\...\{966E33F0-6786-4B38-AA29-C1B3F6C1955D}) (Version: 1.0.9.0 - PHISON Electronics Corp.) Hidden PHISON HAL (HKLM-x32\...\{549da357-1b81-456b-83f2-dcc47c41dfff}) (Version: 1.0.9.0 - PHISON Electronics Corp.) Hidden Recuva (HKLM\...\Recuva) (Version: 1.53 - Piriform) Replay Media Catcher 9 (9.2.6.0) (HKLM-x32\...\Replay Media Catcher 9) (Version: 9.2.6.0 - Applian Technologies) RoboForm 9-2-7-7 (All Users) (HKLM-x32\...\AI RoboForm) (Version: 9-2-7-7 - Siber Systems) Snagit 2020 (HKLM\...\{46DF39C3-F6AC-47FA-A1F5-D91ACB82530D}) (Version: 20.1.8 - TechSmith Corporation) Hidden Snagit 2020 (HKLM-x32\...\{8e06da60-b3fd-48c1-bf2d-d677cc66dfc9}) (Version: 20.1.8.16558 - TechSmith Corporation) Speccy (HKLM\...\Speccy) (Version: 1.32 - Piriform) SpyHunter 5 (HKLM-x32\...\SpyHunter5) (Version: 5.12.27.282 - EnigmaSoft Limited) Universal Holtek RGB DRAM (HKLM\...\{826388E4-E31F-4514-948B-3BB954FB3EAF}) (Version: 1.0.0.2 - PD) Hidden Universal Holtek RGB DRAM (HKLM-x32\...\{6870588f-9f28-488b-a169-cf548ad6b393}) (Version: 1.0.0.2 - PD) VLC media player (HKLM\...\VLC media player) (Version: 3.0.17.4 - VideoLAN) WD_BLACK AN1500 (HKLM\...\{085E2365-0A70-4230-B664-02D5E4FE7E9C}) (Version: 1.0.14.0 - ENE TECHNOLOGY INC.) Hidden WD_BLACK AN1500 (HKLM-x32\...\{e42c5874-37b0-4977-9e8d-70bf006e1f76}) (Version: 1.0.14.0 - ENE TECHNOLOGY INC.) Hidden Windows PC Health Check (HKLM\...\{6798C408-2636-448C-8AC6-F4E341102D27}) (Version: 3.6.2204.08001 - Microsoft Corporation) Wondershare Filmora9(Build 9.0.3) (HKLM\...\Wondershare Filmora9_is1) (Version: - Wondershare Software) Wondershare Helper Compact 2.5.3 (HKLM-x32\...\{5363CE84-5F09-48A1-8B6C-6BB590FFEDF2}_is1) (Version: 2.5.3 - Wondershare) Wondershare UniConverter 13(Build 13.6.4.1) (HKLM\...\UniConverter 13_is1) (Version: 13.6.4.1 - Wondershare Software) Packages: ========= Acrobat Notification Client -> C:\Program Files\WindowsApps\AcrobatNotificationClient_1.0.4.0_x86__e1rzdqpraam7r [2022-06-15] (Adobe Systems Incorporated) Adobe Notification Client -> C:\Program Files\WindowsApps\AdobeNotificationClient_3.0.1.1_x86__enpm4xejd91yc [2022-06-15] (Adobe Systems Incorporated) ARMOURY CRATE -> C:\Program Files\WindowsApps\B9ECED6F.ArmouryCrate_5.1.5.0_x64__qmba6cd70vzyy [2022-06-15] (ASUSTeK COMPUTER INC.) Disney+ -> C:\Program Files\WindowsApps\Disney.37853FC22B2CE_1.30.6.0_x64__6rarf9sa4v8jt [2022-06-17] (Disney) Intel® Graphics Command Center -> C:\Program Files\WindowsApps\AppUp.IntelGraphicsExperience_1.100.3408.0_x64__8j3eq9eme6ctt [2022-06-15] (INTEL CORP) [Startup Task] Microsoft Solitaire Collection -> C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.13.5310.0_x64__8wekyb3d8bbwe [2022-06-17] (Microsoft Studios) [MS Ad] Spotify Music -> C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.187.612.0_x86__zpdnekdrzrea0 [2022-06-17] (Spotify AB) [Startup Task] ==================== Custom CLSID (Whitelisted): ============== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) CustomCLSID: HKU\S-1-5-21-2119236083-4270076351-253614331-1001_Classes\CLSID\{0E270DAA-1BE6-48F2-AC49-E31330262FF3} -> [Creative Cloud Files] => C:\Users\JoeMe\Creative Cloud Files [2022-06-15 14:13] CustomCLSID: HKU\S-1-5-21-2119236083-4270076351-253614331-1001_Classes\CLSID\{2F81B25E-7507-4844-BFF2-77D2CC24CED4}\localserver32 -> C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe (Adobe Inc. -> Adobe Inc.) CustomCLSID: HKU\S-1-5-21-2119236083-4270076351-253614331-1001_Classes\CLSID\{6514CF27-CAB1-4577-81A9-EC81618C5003}\InprocServer32 -> C:\Program Files (x86)\FlexHEX\FlexCtx64.dll (Inv Softworks LLC -> Inv Softworks LLC) CustomCLSID: HKU\S-1-5-21-2119236083-4270076351-253614331-1001_Classes\CLSID\{e8c77137-e224-5791-b6e9-ff0305797a13}\InprocServer32 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Inc. -> Adobe Systems) ShellIconOverlayIdentifiers: [ IDM Shell Extension] -> {CDC95B92-E27C-4745-A8C5-64A52A78855D} => C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll [2021-03-03] (Tonec Inc. -> Tonec FZE) ShellIconOverlayIdentifiers: [ AcronisDrive] -> {5D74FD4B-4EFB-4586-8022-8637BBE40970} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64_24_8_38600.dll [2021-12-23] (Acronis International GmbH -> ) ShellIconOverlayIdentifiers: [ AcronisSyncError] -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64_24_8_38600.dll [2021-12-23] (Acronis International GmbH -> ) ShellIconOverlayIdentifiers: [ AcronisSyncInProgress] -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64_24_8_38600.dll [2021-12-23] (Acronis International GmbH -> ) ShellIconOverlayIdentifiers: [ AcronisSyncOk] -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64_24_8_38600.dll [2021-12-23] (Acronis International GmbH -> ) ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2022-05-24] (Adobe Inc. -> ) ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2022-05-24] (Adobe Inc. -> ) ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2022-05-24] (Adobe Inc. -> ) ShellIconOverlayIdentifiers: [ OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files\Norton Security\Engine\22.22.4.11\buShell.dll [2022-05-05] (NortonLifeLock Inc. -> NortonLifeLock Inc.) ShellIconOverlayIdentifiers: [ OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files\Norton Security\Engine\22.22.4.11\buShell.dll [2022-05-05] (NortonLifeLock Inc. -> NortonLifeLock Inc.) ShellIconOverlayIdentifiers: [ OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files\Norton Security\Engine\22.22.4.11\buShell.dll [2022-05-05] (NortonLifeLock Inc. -> NortonLifeLock Inc.) ShellIconOverlayIdentifiers-x32: [ OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files\Norton Security\Engine\22.22.4.11\buShell.dll [2022-05-05] (NortonLifeLock Inc. -> NortonLifeLock Inc.) ShellIconOverlayIdentifiers-x32: [ OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files\Norton Security\Engine\22.22.4.11\buShell.dll [2022-05-05] (NortonLifeLock Inc. -> NortonLifeLock Inc.) ShellIconOverlayIdentifiers-x32: [ OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files\Norton Security\Engine\22.22.4.11\buShell.dll [2022-05-05] (NortonLifeLock Inc. -> NortonLifeLock Inc.) ContextMenuHandlers1: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Program Files\Microsoft OneDrive\22.111.0522.0002\FileSyncShell64.dll [2022-06-17] (Microsoft Corporation -> Microsoft Corporation) ContextMenuHandlers1: [AccExt] -> {2A118EB5-5797-4F5E-8B3D-F4ECBA3C98E4} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2022-05-24] (Adobe Inc. -> ) ContextMenuHandlers1: [Adobe.Acrobat.ContextMenu] -> {A6595CD1-BF77-430A-A452-18696685F7C7} => C:\Program Files\Adobe\Acrobat DC\Acrobat Elements\ContextMenuShim64.dll [2022-06-04] (Adobe Inc. -> Adobe Systems Inc.) ContextMenuHandlers1: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} => C:\Program Files\Notepad++\NppShell_06.dll [2022-05-29] (Notepad++ -> ) ContextMenuHandlers1: [BRUMenuHandler] -> {5D924130-4CB1-11DB-B0DE-0800200C9A66} => C:\Program Files\Bulk Rename Utility\BRUhere64.dll [2021-02-03] (TGRMN Software -> Bulk Rename Utility) ContextMenuHandlers1: [BUContextMenu] -> {F7CAA2A1-67A2-44BB-B20F-202FD8EB1DAB} => C:\Program Files\Norton Security\Engine\22.22.4.11\buShell.dll [2022-05-05] (NortonLifeLock Inc. -> NortonLifeLock Inc.) ContextMenuHandlers1: [DefragglerShellExtension] -> {4380C993-0C43-4E02-9A7A-0D40B6EA7590} => C:\Program Files\Defraggler\DefragglerShell64.dll [2020-08-03] (Piriform Software Ltd -> Piriform Software Ltd) ContextMenuHandlers1: [NortonLifeLock.Norton.Antivirus.IEContextMenu] -> {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} => C:\Program Files\Norton Security\Engine\22.22.4.11\NavShExt.dll [2022-05-05] (NortonLifeLock Inc. -> NortonLifeLock Inc.) ContextMenuHandlers1: [SnagItMainShellExt] -> {CF74B903-3389-469c-B3B6-0204D204FCBD} => C:\Program Files\TechSmith\Snagit 2020\DLLx64\SnagitShellExt64.dll [2022-02-25] (TechSmith Corporation -> TechSmith Corporation) ContextMenuHandlers2: [BRUMenuHandler] -> {5D924130-4CB1-11DB-B0DE-0800200C9A66} => C:\Program Files\Bulk Rename Utility\BRUhere64.dll [2021-02-03] (TGRMN Software -> Bulk Rename Utility) ContextMenuHandlers2: [NortonLifeLock.Norton.Antivirus.IEContextMenu] -> {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} => C:\Program Files\Norton Security\Engine\22.22.4.11\NavShExt.dll [2022-05-05] (NortonLifeLock Inc. -> NortonLifeLock Inc.) ContextMenuHandlers4: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Program Files\Microsoft OneDrive\22.111.0522.0002\FileSyncShell64.dll [2022-06-17] (Microsoft Corporation -> Microsoft Corporation) ContextMenuHandlers4: [BRUMenuHandler] -> {5D924130-4CB1-11DB-B0DE-0800200C9A66} => C:\Program Files\Bulk Rename Utility\BRUhere64.dll [2021-02-03] (TGRMN Software -> Bulk Rename Utility) ContextMenuHandlers4: [RecuvaShellExt] -> {435E5DF5-2510-463C-B223-BDA47006D002} => C:\Program Files\Recuva\RecuvaShell64.dll [2022-04-06] (Piriform Software Ltd -> Piriform Software Ltd) ContextMenuHandlers4: [SnagItMainShellExt] -> {CF74B903-3389-469c-B3B6-0204D204FCBD} => C:\Program Files\TechSmith\Snagit 2020\DLLx64\SnagitShellExt64.dll [2022-02-25] (TechSmith Corporation -> TechSmith Corporation) ContextMenuHandlers5: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Program Files\Microsoft OneDrive\22.111.0522.0002\FileSyncShell64.dll [2022-06-17] (Microsoft Corporation -> Microsoft Corporation) ContextMenuHandlers6: [AccExt] -> {2A118EB5-5797-4F5E-8B3D-F4ECBA3C98E4} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2022-05-24] (Adobe Inc. -> ) ContextMenuHandlers6: [Adobe.Acrobat.ContextMenu] -> {A6595CD1-BF77-430A-A452-18696685F7C7} => C:\Program Files\Adobe\Acrobat DC\Acrobat Elements\ContextMenuShim64.dll [2022-06-04] (Adobe Inc. -> Adobe Systems Inc.) ContextMenuHandlers6: [BUContextMenu] -> {F7CAA2A1-67A2-44BB-B20F-202FD8EB1DAB} => C:\Program Files\Norton Security\Engine\22.22.4.11\buShell.dll [2022-05-05] (NortonLifeLock Inc. -> NortonLifeLock Inc.) ContextMenuHandlers6: [DefragglerShellExtension] -> {4380C993-0C43-4E02-9A7A-0D40B6EA7590} => C:\Program Files\Defraggler\DefragglerShell64.dll [2020-08-03] (Piriform Software Ltd -> Piriform Software Ltd) ContextMenuHandlers6: [FSShellExt] -> {56160A70-D083-4856-9998-F565ABC03F86} => C:\Program Files\Key Metric Software\FolderSizes 9\FSShellExt.dll [2022-04-13] (Key Metric Software LLC -> Key Metric Software, LLC.) ContextMenuHandlers6: [NortonLifeLock.Norton.Antivirus.IEContextMenu] -> {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} => C:\Program Files\Norton Security\Engine\22.22.4.11\NavShExt.dll [2022-05-05] (NortonLifeLock Inc. -> NortonLifeLock Inc.) ContextMenuHandlers6: [RecuvaShellExt] -> {435E5DF5-2510-463C-B223-BDA47006D002} => C:\Program Files\Recuva\RecuvaShell64.dll [2022-04-06] (Piriform Software Ltd -> Piriform Software Ltd) ContextMenuHandlers1_S-1-5-21-2119236083-4270076351-253614331-1001: [FlexHEX Menu] -> {6514CF27-CAB1-4577-81A9-EC81618C5003} => C:\Program Files (x86)\FlexHEX\FlexCtx64.dll [2018-06-30] (Inv Softworks LLC -> Inv Softworks LLC) ==================== Codecs (Whitelisted) ==================== ==================== Shortcuts & WMI ======================== ==================== Loaded Modules (Whitelisted) ============= 2022-06-15 14:18 - 2016-07-21 10:54 - 000137728 _____ () [File not signed] C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\CBSCreateVC.dll 2022-06-15 14:18 - 2017-03-23 09:49 - 001506304 _____ () [File not signed] C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\DAQExp.dll 2018-08-14 14:49 - 2018-08-14 14:49 - 001874432 _____ () [File not signed] C:\Program Files\TechSmith\Snagit 2020\cairo.dll 2018-08-14 14:49 - 2018-08-14 14:49 - 000790528 _____ () [File not signed] C:\Program Files\TechSmith\Snagit 2020\fontconfig.dll 2018-08-14 14:49 - 2018-08-14 14:49 - 001041920 _____ () [File not signed] C:\Program Files\TechSmith\Snagit 2020\harfbuzz-vs14.dll 2018-08-14 14:49 - 2018-08-14 14:49 - 000060928 _____ () [File not signed] C:\Program Files\TechSmith\Snagit 2020\iconv.dll 2018-12-11 15:09 - 2018-12-11 15:09 - 000790016 _____ () [File not signed] C:\Program Files\TechSmith\Snagit 2020\libhpdf.dll 2018-08-14 14:49 - 2018-08-14 14:49 - 000257536 _____ () [File not signed] C:\Program Files\TechSmith\Snagit 2020\libpng16.dll 2018-08-14 14:49 - 2018-08-14 14:49 - 001294336 _____ () [File not signed] C:\Program Files\TechSmith\Snagit 2020\libxml2.dll 2019-07-01 16:23 - 2019-07-01 16:23 - 016857600 _____ () [File not signed] C:\Program Files\TechSmith\Snagit 2020\opencv_core410.dll 2019-07-01 16:23 - 2019-07-01 16:23 - 046091264 _____ () [File not signed] C:\Program Files\TechSmith\Snagit 2020\opencv_imgproc410.dll 2018-08-14 14:49 - 2018-08-14 14:49 - 000086528 _____ () [File not signed] C:\Program Files\TechSmith\Snagit 2020\zlib1.dll 2022-04-11 20:05 - 2022-04-11 20:05 - 000100352 _____ () [File not signed] D:\1-SOFTWARE\winhex\winhex\zlib1.dll 2018-08-14 14:49 - 2018-08-14 14:49 - 000088576 _____ (Free Software Foundation) [File not signed] C:\Program Files\TechSmith\Snagit 2020\intl.dll 2016-01-08 13:28 - 2016-01-08 13:28 - 000356352 _____ (hxxp://hunspell.sourceforge.net/) [File not signed] C:\Program Files\TechSmith\Snagit 2020\libhunspell.dll 2022-06-17 03:13 - 2022-06-17 03:13 - 000000000 ____L (Microsoft Corporation) [simlink -> C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppvIsvSubsystems64.dll] C:\Program Files\Microsoft Office\root\Office16\AppVIsvSubsystems64.dll 2022-06-17 03:13 - 2022-06-17 03:13 - 000000000 ____L (Microsoft Corporation) [simlink -> C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2R64.dll] C:\Program Files\Microsoft Office\root\Office16\c2r64.dll 2018-08-14 14:49 - 2018-08-14 14:49 - 000291840 _____ (Red Hat Software) [File not signed] C:\Program Files\TechSmith\Snagit 2020\pango-1.0.dll 2018-08-14 14:49 - 2018-08-14 14:49 - 000578560 _____ (Red Hat Software) [File not signed] C:\Program Files\TechSmith\Snagit 2020\pangocairo-1.0.dll 2018-08-14 14:49 - 2018-08-14 14:49 - 000605184 _____ (Red Hat Software) [File not signed] C:\Program Files\TechSmith\Snagit 2020\pangoft2-1.0.dll 2018-08-14 14:49 - 2018-08-14 14:49 - 000064512 _____ (Red Hat Software) [File not signed] C:\Program Files\TechSmith\Snagit 2020\pangowin32-1.0.dll 2018-08-14 14:49 - 2018-08-14 14:49 - 001338368 _____ (The GLib developer community) [File not signed] C:\Program Files\TechSmith\Snagit 2020\glib-2.0.dll 2018-08-14 14:49 - 2018-08-14 14:49 - 000284160 _____ (The GLib developer community) [File not signed] C:\Program Files\TechSmith\Snagit 2020\gobject-2.0.dll 2019-09-23 08:44 - 2019-09-23 08:44 - 025338368 _____ (The ICU Project) [File not signed] C:\Program Files (x86)\Acronis\TrueImageHome\icudt54.dll 2019-09-23 08:44 - 2019-09-23 08:44 - 002056704 _____ (The ICU Project) [File not signed] C:\Program Files (x86)\Acronis\TrueImageHome\icuin54.dll 2019-09-23 08:44 - 2019-09-23 08:44 - 001425408 _____ (The ICU Project) [File not signed] C:\Program Files (x86)\Acronis\TrueImageHome\icuuc54.dll 2022-06-15 14:18 - 2017-03-23 09:52 - 000708608 _____ (Wondershare) [File not signed] C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\CBSProducstInfo.dll ==================== Alternate Data Streams (Whitelisted) ======== ==================== Safe Mode (Whitelisted) ================== ==================== Association (Whitelisted) ================= ==================== Internet Explorer (Whitelisted) ========== BHO: IDM integration (IDMIEHlprObj Class) -> {0055C089-8582-441B-A0BF-17B458C2A3A8} -> C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll [2021-11-08] (Tonec Inc. -> Internet Download Manager, Tonec Inc.) BHO: Norton Password Manager -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files\Norton Security\Engine\22.22.4.11\coIEPlg.dll [2022-05-05] (NortonLifeLock Inc. -> NortonLifeLock Inc.) BHO: RoboForm Toolbar Helper -> {724d43a9-0d85-11d4-9908-00400523e39a} -> C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboForm-x64.dll [2022-06-17] (Siber Systems -> Siber Systems Inc.) BHO: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2022-06-04] (Adobe Inc. -> Adobe Systems Incorporated) BHO: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2022-06-04] (Adobe Inc. -> Adobe Systems Incorporated) BHO-x32: IDM integration (IDMIEHlprObj Class) -> {0055C089-8582-441B-A0BF-17B458C2A3A8} -> C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll [2021-11-08] (Tonec Inc. -> Internet Download Manager, Tonec Inc.) BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll [2022-06-17] (Microsoft Corporation -> Microsoft Corporation) BHO-x32: Norton Password Manager -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files\Norton Security\Engine32\22.22.4.11\coIEPlg.dll [2022-05-05] (NortonLifeLock Inc. -> NortonLifeLock Inc.) BHO-x32: RoboForm Toolbar Helper -> {724d43a9-0d85-11d4-9908-00400523e39a} -> C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll [2022-06-17] (Siber Systems -> Siber Systems Inc.) BHO-x32: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.dll [2022-06-04] (Adobe Inc. -> Adobe Systems Incorporated) BHO-x32: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.dll [2022-06-04] (Adobe Inc. -> Adobe Systems Incorporated) Toolbar: HKLM - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2022-06-04] (Adobe Inc. -> Adobe Systems Incorporated) Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security\Engine\22.22.4.11\coIEPlg.dll [2022-05-05] (NortonLifeLock Inc. -> NortonLifeLock Inc.) Toolbar: HKLM - &RoboForm Toolbar - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboForm-x64.dll [2022-06-17] (Siber Systems -> Siber Systems Inc.) Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.dll [2022-06-04] (Adobe Inc. -> Adobe Systems Incorporated) Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security\Engine32\22.22.4.11\coIEPlg.dll [2022-05-05] (NortonLifeLock Inc. -> NortonLifeLock Inc.) Toolbar: HKLM-x32 - &RoboForm Toolbar - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll [2022-06-17] (Siber Systems -> Siber Systems Inc.) Handler: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2022-06-17] (Microsoft Corporation -> Microsoft Corporation) Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2022-06-17] (Microsoft Corporation -> Microsoft Corporation) Handler: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2022-06-17] (Microsoft Corporation -> Microsoft Corporation) Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2022-06-17] (Microsoft Corporation -> Microsoft Corporation) Handler: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2022-06-17] (Microsoft Corporation -> Microsoft Corporation) Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2022-06-17] (Microsoft Corporation -> Microsoft Corporation) Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2022-06-17] (Microsoft Corporation -> Microsoft Corporation) Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2022-06-17] (Microsoft Corporation -> Microsoft Corporation) (If an entry is included in the fixlist, it will be removed from the registry.) IE trusted site: HKU\S-1-5-21-2119236083-4270076351-253614331-1001\...\sharepoint.com -> hxxps://jamicrotek-files.sharepoint.com ==================== Hosts content: ========================= (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2019-12-07 05:14 - 2019-12-07 05:12 - 000000824 _____ C:\WINDOWS\system32\drivers\etc\hosts ==================== Other Areas =========================== (Currently there is no automatic fix for this section.) HKU\S-1-5-21-2119236083-4270076351-253614331-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\JoeMe\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper DNS Servers: 75.75.75.75 - 75.75.76.76 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: ) Windows Firewall is enabled. Network Binding: ============= Ethernet: Npcap Packet Driver (NPCAP) -> INSECURE_NPCAP (enabled) Wi-Fi: Npcap Packet Driver (NPCAP) -> INSECURE_NPCAP (enabled) Bluetooth Network Connection: Npcap Packet Driver (NPCAP) -> INSECURE_NPCAP (enabled) ==================== MSCONFIG/TASK MANAGER disabled items == (If an entry is included in the fixlist, it will be removed.) HKLM\...\StartupApproved\Run: => "Acrobat Assistant 8.0" HKLM\...\StartupApproved\Run: => "Adobe Creative Cloud" HKLM\...\StartupApproved\Run: => "AdobeGCInvoker-1.0" HKLM\...\StartupApproved\Run: => "AdobeAAMUpdater-1.0" HKLM\...\StartupApproved\Run: => "WSVCUUpdateHelper.exe" HKLM\...\StartupApproved\Run32: => "Wondershare Helper Compact.exe" HKLM\...\StartupApproved\Run32: => "Acronis Scheduler2 Service" HKLM\...\StartupApproved\Run32: => "AcronisTibMounterMonitor" HKLM\...\StartupApproved\Run32: => "Adobe CCXProcess" HKLM\...\StartupApproved\Run32: => "AdobeAAMUpdater-1.0" HKLM\...\StartupApproved\Run32: => "AdobeGCInvoker-1.0" HKLM\...\StartupApproved\Run32: => "WSVCUUpdateHelper.exe" HKLM\...\StartupApproved\Run32: => "Adobe Creative Cloud" HKU\S-1-5-21-2119236083-4270076351-253614331-1001\...\StartupApproved\Run: => "Adobe Acrobat Synchronizer" HKU\S-1-5-21-2119236083-4270076351-253614331-1001\...\StartupApproved\Run: => "MicrosoftEdgeAutoLaunch_4DCEC73C34109335E72EE8105F5CB3D1" ==================== FirewallRules (Whitelisted) ================ (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) FirewallRules: [{DFD503F4-0321-42A3-B32D-8EC1860FBE54}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\outlook.exe (Microsoft Corporation -> Microsoft Corporation) FirewallRules: [{2F07D5C1-923A-4000-AF1D-7FE355715942}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.187.612.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd) FirewallRules: [{8FD5F6E9-BFBB-465C-BFA4-67AD3090C566}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.187.612.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd) FirewallRules: [{36283F5A-C9F2-4535-9B64-91291DD9206B}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.187.612.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd) FirewallRules: [{8B58F807-546E-47BB-8585-7C494AAA9B0F}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.187.612.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd) FirewallRules: [{F5321F85-64D9-4C56-BEBE-599A2B2623B8}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.187.612.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd) FirewallRules: [{C03509AB-CC06-4C52-81B6-A35CBA8C34E1}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.187.612.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd) FirewallRules: [{B08A563D-C439-4A0A-9459-ED7DBCBC0BC8}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.187.612.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd) FirewallRules: [{C913939C-A1E5-4728-B607-CBBC85D416C2}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.187.612.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd) FirewallRules: [{453AF159-6DCA-48E5-9D36-DECD66155783}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\UcMapi.exe => No File FirewallRules: [{9066D3AB-FA40-4501-9537-CFDB72714C6A}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\Lync.exe => No File FirewallRules: [{F8606D3F-27B9-4AFF-9C7C-D4E8DEB58FA6}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.83.3409.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.) FirewallRules: [{FEE2A22C-305D-4BA7-8055-4EEF9E66EC27}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.83.3409.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.) FirewallRules: [{E659CE48-F44A-4D38-BEC4-4F255A49EEA2}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.83.3409.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.) FirewallRules: [{8297A59E-5A95-4F7B-8E0C-2F2A6653F2D1}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.83.3409.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.) FirewallRules: [{B1E65FE9-18A0-42AC-82C2-CAFD3AB6DF65}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\ActiveProtection\anti_ransomware_service.exe (Acronis International GmbH -> ) FirewallRules: [{90308F6B-2977-4303-AA93-789D8D98ED53}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\Home\report_sender.exe (Acronis International GmbH -> ) FirewallRules: [{369AE375-9BE9-4F96-B23A-39616B632AB3}] => (Allow) C:\Program Files (x86)\Acronis\TrueImageHome\LicenseActivator.exe (Acronis International GmbH -> ) FirewallRules: [{76652288-9F06-49A4-AB75-868204CA28BA}] => (Allow) C:\Program Files (x86)\Acronis\TrueImageHome\ga_service.exe (Acronis International GmbH -> ) FirewallRules: [{58B9B1EF-81C2-4238-9C22-2DA33A7506AC}] => (Allow) C:\Program Files (x86)\Acronis\TrueImageHome\mobile_backup_status_server.exe (Acronis International GmbH -> ) FirewallRules: [{D08B734A-A691-4579-B7DD-ED10BC4080BC}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\MobileBackupServer\mobile_backup_server.exe (Acronis International GmbH -> Acronis International GmbH) FirewallRules: [{17249688-7581-4ECF-BBBA-A10BEB95C327}] => (Allow) C:\Program Files (x86)\Acronis\TrueImageHome\acronis_drive.exe (Acronis International GmbH -> ) FirewallRules: [{37400654-C4E5-4ED0-AC91-480DA00EF5D2}] => (Allow) C:\Program Files (x86)\Acronis\TrueImageHome\SystemReport.exe (Acronis International GmbH -> ) FirewallRules: [{2D914251-1DFC-478C-80F8-ED6A728F5C2A}] => (Allow) C:\Program Files (x86)\Acronis\TrueImageHome\MediaBuilder.exe (Acronis International GmbH -> ) FirewallRules: [{95505371-0EBF-4F86-8188-3086F2906E70}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\TrueImageHome\TrueImageHomeService.exe (Acronis International GmbH -> ) FirewallRules: [{EA5ADD17-C9F0-44D7-A44D-A22CD025488B}] => (Allow) C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageTools.exe (Acronis International GmbH -> ) FirewallRules: [{02F6A1A3-DA5C-4D8F-A22B-0965F4C48D49}] => (Allow) C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe (Acronis International GmbH -> ) FirewallRules: [{9AED6019-D14B-4972-9BF2-D37384FF2C38}] => (Allow) C:\Program Files (x86)\Acronis\TrueImageHome\TrueImage.exe (Acronis International GmbH -> ) FirewallRules: [{6EC0B368-F328-4328-8382-9FE8F1C7604B}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\Infrastructure\mms_mini.exe (Acronis International GmbH -> Acronis International GmbH) FirewallRules: [{9E945191-5845-44E8-8C66-927B6DEF9E23}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe (Acronis International GmbH -> ) FirewallRules: [{0D531632-1269-4E9F-8F7B-7029AF5A8744}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.) FirewallRules: [{B1325F33-2690-4411-8B75-C28D8BF8982F}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.) FirewallRules: [{5B8CAD11-F020-4F9B-A0F2-B33A1B0EA0EE}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.) FirewallRules: [{3A1224E8-82A9-40EF-B58D-6629016CCB3F}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.) FirewallRules: [{E0C8DF75-7EA7-45A7-96F4-0BDFA4062CF5}] => (Allow) C:\Program Files (x86)\Applian Technologies\Replay Media Catcher 9\vsc\vp\Application\vivaldi.exe (Vivaldi Technologies AS -> Vivaldi Technologies AS) FirewallRules: [{5B03AA75-8D92-4E75-9B4D-BFB2BBC71AA0}] => (Allow) LPort=8299 FirewallRules: [{0FEC43A1-EAA2-4BA1-86CB-B5A7171934E3}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe (Google LLC -> Google LLC) FirewallRules: [UDP Query User{772E98D8-E41C-4B4D-B5FA-FE872BB933B1}C:\program files (x86)\asus\armourydevice\asus_framework.exe] => (Allow) C:\program files (x86)\asus\armourydevice\asus_framework.exe => No File FirewallRules: [TCP Query User{03DCA756-9A10-4E97-B61D-AE513FF78066}C:\program files (x86)\asus\armourydevice\asus_framework.exe] => (Allow) C:\program files (x86)\asus\armourydevice\asus_framework.exe => No File FirewallRules: [{380E74AD-568C-4D14-95BD-A31C0EE15B28}] => (Allow) C:\Program Files (x86)\ASUS\ArmouryDevice\dll\ArmourySocketServer\ArmourySocketServer.exe (ASUSTeK COMPUTER INC. -> ASUS) FirewallRules: [{DBF6CC73-1B73-4BE5-AE06-729734FFC7F3}] => (Allow) C:\Program Files (x86)\ASUS\ArmouryDevice\dll\ArmourySocketServer\ArmouryHtmlDebugServer.exe (ASUSTeK COMPUTER INC. -> ASUS) ==================== Restore Points ========================= 17-06-2022 14:57:50 Windows Modules Installer ==================== Faulty Device Manager Devices ============ Name: PCI Device Description: PCI Device Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. Name: Description: Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. Name: PCI Device Description: PCI Device Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. Name: PCI Device Description: PCI Device Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. Name: SM Bus Controller Description: SM Bus Controller Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. ==================== Event log errors: ======================== Application errors: ================== Error: (06/18/2022 11:51:39 AM) (Source: Application Hang) (EventID: 1002) (User: ) Description: The program FlexHEX.exe version 2.7.1.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel. Process ID: 2104 Start Time: 01d88329593ae010 Termination Time: 45 Application Path: C:\Program Files (x86)\FlexHEX\FlexHEX.exe Report Id: a5968c80-3b5a-4b78-958a-ac8aff867c7d Faulting package full name: Faulting package-relative application ID: Hang type: Unknown Error: (06/18/2022 06:34:31 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: AcPowerNotification.exe, version: 1.0.5.5, time stamp: 0xc17fab12 Faulting module name: clr.dll, version: 4.8.4515.0, time stamp: 0x624cf48c Exception code: 0xc00000fd Fault offset: 0x004c301a Faulting process id: 0x16dc Faulting application start time: 0x01d8827ccfed3557 Faulting application path: C:\Program Files (x86)\ASUS\ArmouryDevice\dll\AcPowerNotification\AcPowerNotification.exe Faulting module path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll Report Id: d32d5571-e5d0-447e-9f7e-c32c4f20efa2 Faulting package full name: Faulting package-relative application ID: Error: (06/18/2022 01:48:29 AM) (Source: Application Hang) (EventID: 1002) (User: ) Description: The program IDMan.exe version 6.41.2.2 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel. Process ID: 26d0 Start Time: 01d8827cdaa63cf0 Termination Time: 10 Application Path: C:\Program Files (x86)\Internet Download Manager\IDMan.exe Report Id: 9bd66a1c-d227-488f-988c-5893cebe30d8 Faulting package full name: Faulting package-relative application ID: Hang type: Cross-process Error: (06/17/2022 11:27:10 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Local Hostname 2NDBR.local already in use; will try 2NDBR-2.local instead Error: (06/17/2022 11:27:10 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: mDNSCoreReceiveResponse: ProbeCount 0; will deregister 4 2NDBR.local. Addr 10.0.0.14 Error: (06/17/2022 11:27:10 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: mDNSCoreReceiveResponse: Received from 10.0.0.14:5353 16 2NDBR.local. AAAA 2601:008B:8400:03B3:0000:0000:0000:5E51 Error: (06/17/2022 03:02:39 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: NoiseCancelingEngine.exe, version: 1.0.0.14, time stamp: 0x619e0f3f Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000 Exception code: 0xc0000005 Fault offset: 0x0000000000000000 Faulting process id: 0x1afc Faulting application start time: 0x01d8827ccfdcadb5 Faulting application path: C:\Program Files (x86)\ASUS\ArmouryDevice\dll\MBLedSDK\NoiseCancelingEngine.exe Faulting module path: unknown Report Id: 3ee04867-c526-4f2d-bd1e-d5f76ea67307 Faulting package full name: Faulting package-relative application ID: Error: (06/17/2022 03:00:54 PM) (Source: VSS) (EventID: 13) (User: ) Description: Volume Shadow Copy Service information: The COM Server with CLSID {4e14fba2-2e22-11d1-9964-00c04fbbb345} and name CEventSystem cannot be started. [0x8007045b, A system shutdown is in progress. ] System errors: ============= Error: (06/17/2022 03:02:03 PM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: A timeout was reached (45000 milliseconds) while waiting for the asComSvc service to connect. Error: (06/17/2022 03:00:54 PM) (Source: DCOM) (EventID: 10005) (User: NT AUTHORITY) Description: DCOM got error "1115" attempting to start the service TrustedInstaller with arguments "Unavailable" in order to run the server: {752073A1-23F2-4396-85F0-8FDB879ED0ED} Error: (06/17/2022 03:00:48 PM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: A timeout was reached (45000 milliseconds) while waiting for the asComSvc service to connect. Error: (06/17/2022 03:00:02 PM) (Source: EventLog) (EventID: 6008) (User: ) Description: The previous system shutdown at 12:10:34 PM on ‎6/‎17/‎2022 was unexpected. Error: (06/17/2022 12:11:19 PM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: A timeout was reached (45000 milliseconds) while waiting for the asComSvc service to connect. Error: (06/17/2022 12:10:14 PM) (Source: DCOM) (EventID: 10010) (User: 2NDBR) Description: The server Microsoft.Windows.Search_1.14.5.19041_neutral_neutral_cw5n1h2txyewy!CortanaUI did not register with DCOM within the required timeout. Error: (06/17/2022 12:10:12 PM) (Source: DCOM) (EventID: 10010) (User: 2NDBR) Description: The server Microsoft.Windows.Search_1.14.5.19041_neutral_neutral_cw5n1h2txyewy!CortanaUI did not register with DCOM within the required timeout. Error: (06/17/2022 12:10:10 PM) (Source: DCOM) (EventID: 10010) (User: 2NDBR) Description: The server Microsoft.Windows.Search_1.14.5.19041_neutral_neutral_cw5n1h2txyewy!CortanaUI.AppXf8r3d8cn5hd71h9jyzah6ak9f3shj2d2.mca did not register with DCOM within the required timeout. CodeIntegrity: =============== Date: 2022-06-18 09:01:50 Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Windows\System32\SIHClient.exe) attempted to load \Device\HarddiskVolume5\Program Files\Norton Security\Engine\22.22.4.11\symamsi.dll that did not meet the Windows signing level requirements. Date: 2022-06-17 15:04:04 Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume5\Program Files\Norton Security\Engine\22.22.4.11\symamsi.dll that did not meet the Windows signing level requirements. ==================== Memory info =========================== BIOS: American Megatrends Inc. 0820 04/27/2021 Motherboard: ASUSTeK COMPUTER INC. PRIME Z590-P WIFI Processor: 11th Gen Intel(R) Core(TM) i5-11400 @ 2.60GHz Percentage of memory in use: 60% Total physical RAM: 16149.48 MB Available physical RAM: 6458.8 MB Total Virtual: 19093.48 MB Available Virtual: 6399.04 MB ==================== Drives ================================ Drive c: (Solid) (Fixed) (Total:930.25 GB) (Free:802.77 GB) (Model: Samsung SSD 980 PRO 1TB) NTFS Drive d: (6TB-Black) (Fixed) (Total:5589.01 GB) (Free:4928.15 GB) (Model: WDC WD6004FZWX-00BKVA0) NTFS Drive g: (Local Disk) (Fixed) (Total:7452.02 GB) (Free:3956.42 GB) (Model: TO Exter nal USB 3.0 SCSI Disk Device) NTFS Drive v: (Video) (Network) (Total:7383.61 GB) (Free:1938.23 GB) (Model: WDC WD6004FZWX-00BKVA0) NTFS \\?\Volume{72585e5f-1466-4c88-9070-b958a6248db3}\ () (Fixed) (Total:0.54 GB) (Free:0.08 GB) NTFS \\?\Volume{751aa05e-59ce-4b04-8bc7-1d4502b53812}\ () (Fixed) (Total:0.5 GB) (Free:0.08 GB) NTFS \\?\Volume{e362ab83-f83d-4ab6-bd2e-1d3b3f623217}\ () (Fixed) (Total:0.1 GB) (Free:0.07 GB) FAT32 ==================== MBR & Partition Table ==================== ========================================================== Disk: 0 (Protective MBR) (Size: 5589 GB) (Disk ID: 00000000) Partition: GPT. ========================================================== Disk: 1 (Size: 931.5 GB) (Disk ID: 19687B42) Partition: GPT. ========================================================== Disk: 2 (Protective MBR) (Size: 7452 GB) (Disk ID: 00000000) Partition: GPT. ==================== End of Addition.txt =======================