Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 20-01-2023
Ran by [removed] (administrator) on LEE (Gigabyte Technology Co., Ltd. AB350M-Gaming 3) (20-01-2023 13:35:02)
Running from C:\Users\[removed]\Desktop
[removed]
Platform: Microsoft Windows 10 Enterprise Version 1809 17763.1577 (X64) Language: English (United States)
Default browser: Opera
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.) C:\WINDOWS\Installer\Config.Msi\2aa29c9.rbf
(C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe ->) (Malwarebytes Inc. -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(C:\Users\Mark\AppData\Local\Programs\Opera GX\opera.exe ->) (Opera Norway AS -> Opera Software) C:\Users\Mark\AppData\Local\Programs\Opera GX\94.0.4606.69\opera_crashreporter.exe
(C:\Users\Mark\AppData\Local\Temp\mwbA3BB.tmp\mb-support.exe ->) (Farbar) [File not signed] C:\Users\Mark\AppData\Local\Temp\mwbA3BB.tmp\FRSTEnglish.exe
(Creative Technology Ltd) [File not signed] C:\Program Files (x86)\Creative\SBAudigy5Rx\SB Audigy Control Panel\CTHKCtrl.exe
(Creative Technology Ltd.) [File not signed] C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe
(DriverStore\FileRepository\u0386220.inf_amd64_1894141ab65df02b\B386218\atiesrxx.exe ->) (Advanced Micro Devices Inc. -> AMD) C:\WINDOWS\System32\DriverStore\FileRepository\u0386220.inf_amd64_1894141ab65df02b\B386218\atieclxx.exe
(explorer.exe ->) (Blife) [File not signed] C:\Users\Mark\AppData\Local\Blife\CustomCursor\CustomCursor.exe
(explorer.exe ->) (cFos Software GmbH -> cFos Software GmbH) C:\Program Files\cFosSpeed\cfosspeed.exe
(explorer.exe ->) (Deluge Team) [File not signed] C:\Program Files (x86)\Deluge\deluge.exe
(explorer.exe ->) (Google LLC -> ) C:\Program Files\Google\Drive File Stream\57.0.5.0\crashpad_handler.exe <2>
(explorer.exe ->) (Ivaylo Beltchev -> IvoSoft) [File not signed] C:\Program Files\Classic Shell\ClassicStartMenu.exe
(explorer.exe ->) (Krzysztof Kowalczyk -> Krzysztof Kowalczyk) C:\Program Files (x86)\SumatraPDF\SumatraPDF.exe
(explorer.exe ->) (nordvpn s.a. -> TEFINCOM S.A.) C:\Program Files\NordVPN\NordVPN.exe
(explorer.exe ->) (Peter Eduard Verbeek -> ) C:\Program Files\EqualizerAPO\config\Peace.exe
(explorer.exe ->) (Thesycon Software Solutions GmbH & Co. KG -> ) C:\Program Files\IK Multimedia\AXE IO Control Panel\W10_x64\AXE IO Control Panel.exe
(GIGA-BYTE TECHNOLOGY CO., LTD. -> ) C:\Program Files (x86)\GIGABYTE\AppCenter\ApCent.exe
(GIGA-BYTE TECHNOLOGY CO., LTD. -> Gigabyte Technology CO.) C:\Program Files\Gigabyte\Smart Backup\RPMDaemon.exe
(GIGA-BYTE TECHNOLOGY CO., LTD. -> GIGA-BYTE TECHNOLOGY CO., LTD.) C:\Program Files (x86)\GIGABYTE\EasyTuneEngineService\GraphicsCardEngine.exe
(Malwarebytes Inc -> Malwarebytes Corporation) C:\Users\Mark\AppData\Local\Temp\mwbA3BB.tmp\mb-support.exe
(Microsoft Windows Hardware Compatibility Publisher -> Creative Technology Ltd) C:\WINDOWS\SysWOW64\CtHelper.exe
(Opera Norway AS -> Opera Software) C:\Users\Mark\AppData\Local\Programs\Opera GX\opera.exe <42>
(services.exe ->) () [File not signed] C:\Program Files (x86)\GIGABYTE\AppCenter\AdjustService.exe
(services.exe ->) (Adguard Software Limited -> Adguard Software Ltd) C:\Program Files (x86)\Adguard\AdguardSvc.exe
(services.exe ->) (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.) C:\WINDOWS\System32\amdfendrsr.exe
(services.exe ->) (Advanced Micro Devices Inc. -> AMD) C:\WINDOWS\System32\DriverStore\FileRepository\u0386220.inf_amd64_1894141ab65df02b\B386218\atiesrxx.exe
(services.exe ->) (cFos Software GmbH -> cFos Software GmbH) C:\Program Files\cFosSpeed\spd.exe
(services.exe ->) (Creative Technology Ltd) [File not signed] C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(services.exe ->) (GIGA-BYTE TECHNOLOGY CO., LTD. -> GIGA-BYTE TECHNOLOGY CO., LTD.) C:\Program Files (x86)\GIGABYTE\EasyTuneEngineService\EasyTuneEngineService.exe
(services.exe ->) (Malwarebytes Inc. -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(services.exe ->) (McAfee, Inc. -> McAfee, Inc.) C:\WINDOWS\System32\mfevtps.exe
(services.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Program Files\Microsoft Update Health Tools\uhssvc.exe
(services.exe ->) (nordvpn s.a. -> nordvpn S.A.) C:\Program Files\NordUpdater\NordUpdateService.exe
(services.exe ->) (nordvpn s.a. -> TEFINCOM S.A.) C:\Program Files\NordVPN\NordSec ThreatProtection\nordsec-threatprotection-service.exe
(services.exe ->) (nordvpn s.a. -> TEFINCOM S.A.) C:\Program Files\NordVPN\nordvpn-service.exe
(services.exe ->) (Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\WINDOWS\System32\DriverStore\FileRepository\realtekservice.inf_amd64_ee6fe91a35eb809c\RtkAudUService64.exe <2>
(services.exe ->) (SIA AVB Disc Soft -> Disc Soft Ltd) C:\Program Files\reWASD\reWASDService.exe
(services.exe ->) (voidtools -> voidtools) C:\Program Files (x86)\Everything\Everything.exe
(svchost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Users\Mark\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\WINDOWS\System32\dllhost.exe <3>
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\WINDOWS\System32\wlanext.exe

==================== Registry (Whitelisted) ===================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [163640 2018-07-15] (Ivaylo Beltchev -> IvoSoft) [File not signed]
HKLM\...\Run: [XboxStat] => C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-09-30] (Microsoft Corporation -> Microsoft Corporation)
HKLM\...\Run: [RtkAudUService] => C:\WINDOWS\System32\DriverStore\FileRepository\realtekservice.inf_amd64_ee6fe91a35eb809c\RtkAudUService64.exe [3450728 2022-02-16] (Realtek Semiconductor Corp. -> Realtek Semiconductor)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [3831808 2021-08-30] (Microsoft Windows Hardware Compatibility Publisher -> Logitech)
HKLM\...\Run: [Gigabyte Speed] => C:\Program Files\cFosSpeed\cFosSpeed.exe [1647880 2021-06-15] (cFos Software GmbH -> cFos Software GmbH)
HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG -> Elaborate Bytes AG)
HKLM-x32\...\Run: [Creative Hot Key Control] => C:\Program Files (x86)\Creative\SBAudigy5Rx\SB Audigy Control Panel\CTHKCtrl.exe [650752 2013-07-19] (Creative Technology Ltd) [File not signed]
HKLM-x32\...\Run: [Module Loader] => C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe [57344 2007-07-23] (Creative Technology Ltd.) [File not signed]
HKLM-x32\...\Run: [AsioThk32Reg] => REGSVR32.EXE /S CTASIO.DLL (No File)
HKLM-x32\...\Run: [CTHelper] => C:\Windows\SysWOW64\CTHELPER.EXE* [29776 2018-08-14] () [File not signed]
HKLM-x32\...\Run: [Adobe CCXProcess] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud Experience\CCXProcess.exe [129288 2022-02-25] (Adobe Inc. -> )
HKLM-x32\...\Run: [Everything] => C:\Program Files (x86)\Everything\Everything.exe [1775264 2021-12-16] (voidtools -> voidtools)
HKLM-x32\...\Run: [Adguard] => C:\Program Files (x86)\Adguard\Adguard.exe [6353472 2022-06-08] (Adguard Software Limited -> Adguard Software Ltd)
HKLM\...\RunOnce: [RPMKickstart] => C:\Program Files\Gigabyte\Smart Backup\RPMKickstartEx.exe [2320384 2014-04-01] (TODO: <Company name>) [File not signed]
HKLM-x32\...\RunOnce: [DualBiosRescue] => C:\Program Files (x86)\GIGABYTE\GigabyteFirmwareUpdateUtility\dbrro.exe [12096 2015-08-19] (GIGA-BYTE TECHNOLOGY CO., LTD. -> )
HKLM-x32\...\RunOnce: [PreRun] => C:\Program Files (x86)\Gigabyte\AppCenter\PreRun.exe [14632 2016-02-26] (GIGA-BYTE TECHNOLOGY CO., LTD. -> )
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION
HKU\S-1-5-19\...\Run: [GoogleDriveFS] => C:\Program Files\Google\Drive File Stream\57.0.5.0\GoogleDriveFS.exe [53934992 2022-04-14] (Google LLC -> Google, Inc.)
HKU\S-1-5-20\...\Run: [GoogleDriveFS] => C:\Program Files\Google\Drive File Stream\57.0.5.0\GoogleDriveFS.exe [53934992 2022-04-14] (Google LLC -> Google, Inc.)
HKU\S-1-5-21-266282535-48708807-158023499-1001\...\Run: [CCleaner Smart Cleaning] => C:\Program Files\CCleaner\CCleaner64.exe [38916432 2022-12-09] (PIRIFORM SOFTWARE LIMITED -> Piriform Software Ltd)
HKU\S-1-5-21-266282535-48708807-158023499-1001\...\Run: [CustomCursor] => C:\Users\Mark\AppData\Local\Blife\CustomCursor\CustomCursor.exe [454144 2020-09-15] (Blife) [File not signed]
HKU\S-1-5-21-266282535-48708807-158023499-1001\...\Run: [Opera GX Stable] => C:\Users\Mark\AppData\Local\Programs\Opera GX\launcher.exe [2542536 2023-01-14] (Opera Norway AS -> Opera Software)
HKU\S-1-5-21-266282535-48708807-158023499-1001\...\Run: [Opera GX Browser Assistant] => C:\Users\Mark\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe [3291288 2021-02-01] (Opera Software AS -> Opera Software)
HKU\S-1-5-21-266282535-48708807-158023499-1001\...\Run: [WiinUPro] => C:\Program Files\WiinUPro\WiinUPro.exe [10727936 2021-04-16] () [File not signed]
HKU\S-1-5-21-266282535-48708807-158023499-1001\...\Run: [] => [X]
HKU\S-1-5-21-266282535-48708807-158023499-1001\...\Run: [GoogleDriveFS] => C:\Program Files\Google\Drive File Stream\57.0.5.0\GoogleDriveFS.exe [53934992 2022-04-14] (Google LLC -> Google, Inc.)
HKU\S-1-5-21-266282535-48708807-158023499-1001\...\Run: [Battle.net] => E:\Battle.net\Battle.net.exe [1090168 2022-10-21] (Blizzard Entertainment, Inc. -> Blizzard Entertainment)
HKU\S-1-5-21-266282535-48708807-158023499-1001\...\Run: [OSDownloaderUpdate] => C:\Program Files (x86)\OSDownloader\OSDownloaderUpdate.exe [3921920 2017-03-22] (Opensubtitles.org) [File not signed]
HKU\S-1-5-21-266282535-48708807-158023499-1001\...\Run: [OSDownloader] => C:\Program Files (x86)\OSDownloader\OSDownloader.exe [5652992 2017-04-12] (OpenSubtitles.org) [File not signed]
HKU\S-1-5-21-266282535-48708807-158023499-1001\...\Run: [reWASD Engine] => C:\Program Files\reWASD\reWASDEngine.exe [23166712 2022-12-12] (SIA AVB Disc Soft -> Disc Soft Ltd)
HKU\S-1-5-21-266282535-48708807-158023499-1001\...\Run: [NordVPN] => C:\Program Files\NordVPN\NordVPN.exe [253816 2022-08-03] (nordvpn s.a. -> TEFINCOM S.A.)
HKU\S-1-5-21-266282535-48708807-158023499-1001\...\Run: [Pushbullet] => C:\Program Files (x86)\Pushbullet\pushbullet.exe [345600 2015-07-01] (Pushbullet inc) [File not signed]
HKU\S-1-5-21-266282535-48708807-158023499-1001\...\Run: [Microsoft Edge Update] => C:\Users\Mark\AppData\Local\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateCore.exe [263592 2023-01-12] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-266282535-48708807-158023499-1001\...\Run: [AMDNoiseSuppression] => "C:\WINDOWS\system32\AMD\ANR\AMDNoiseSuppression.exe" (No File)
HKU\S-1-5-21-266282535-48708807-158023499-1001\...\RunOnce: [StartRSX] => C:\Program Files\AMD\CNext\CNext\cncmd.exe [56760 2022-11-30] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)
HKU\S-1-5-21-266282535-48708807-158023499-1001\...\RunOnce: [AMDInstallLauncher] => schtasks /Run /TN "AMDInstallLauncher" (No File)
HKU\S-1-5-21-266282535-48708807-158023499-1001\...\MountPoints2: {d4a1da3e-f692-11e8-aa1d-e0d55e2ca266} - "J:\setup.exe" 
HKU\S-1-5-21-266282535-48708807-158023499-1001\...\Winlogon: [Shell] C:\Windows\explorer.exe [4443888 2022-01-17] (Microsoft Windows -> Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-21-266282535-48708807-158023499-1002\...\RunOnce: [Delete Cached Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\zeroone13\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" (No File)
HKU\S-1-5-21-266282535-48708807-158023499-1002\...\RunOnce: [Delete Cached Standalone Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\zeroone13\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" (No File)
HKU\S-1-5-18\...\Run: [Plex Media Server] => C:\Program Files (x86)\Plex\Plex Media Server\Plex Media Server.exe [24182768 2019-12-13] (Plex, Inc. -> Plex, Inc.)
HKU\S-1-5-18\...\Run: [GoogleDriveFS] => C:\Program Files\Google\Drive File Stream\57.0.5.0\GoogleDriveFS.exe [53934992 2022-04-14] (Google LLC -> Google, Inc.)
HKLM\...\Windows x64\Print Processors\Canon TS3100 series Print Processor: C:\Windows\System32\spool\prtprocs\x64\CNMPDDR.DLL [482816 2017-03-13] (Microsoft Windows Hardware Compatibility Publisher -> CANON INC.)
HKLM\...\Print\Monitors\Canon BJ Language Monitor TS3100 series: C:\Windows\System32\CNMLMDR.DLL [1302016 2017-03-13] (Microsoft Windows Hardware Compatibility Publisher -> CANON INC.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AudientAppLauncher Autostart.lnk [2020-09-10]
ShortcutTarget: AudientAppLauncher Autostart.lnk -> C:\Program Files\Audient\USBAudioDriver\W10_x64\AudientAppLauncher.exe (Thesycon Software Solutions GmbH & Co. KG -> Audient)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IK Multimedia AXE IO Control Panel Autostart.lnk [2020-10-20]
ShortcutTarget: IK Multimedia AXE IO Control Panel Autostart.lnk -> C:\Program Files\IK Multimedia\AXE IO Control Panel\W10_x64\AXE IO Control Panel.exe (Thesycon Software Solutions GmbH & Co. KG -> )
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Shanling Audio Control Panel Autostart.lnk [2019-07-28]
ShortcutTarget: Shanling Audio Control Panel Autostart.lnk -> C:\Program Files\Shanling\Audio_Driver\ShanlingAudioCplApp.exe () [File not signed]
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WSAndroidAppHelper.lnk [2020-12-02]
ShortcutTarget: WSAndroidAppHelper.lnk -> C:\Program Files (x86)\Wondershare\dr.fone\Addins\SocialApps\WSAndroidAppHelper.exe (Wondershare Technology Co.,Ltd -> Microsoft)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WSAppHelper.lnk [2020-12-02]
ShortcutTarget: WSAppHelper.lnk -> C:\Program Files (x86)\Wondershare\dr.fone\Addins\SocialApps\WSAppHelper.exe (Wondershare Technology Co.,Ltd -> Microsoft)
Startup: C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PC Remote Controller.lnk [2021-12-16]
ShortcutTarget: PC Remote Controller.lnk -> C:\Users\Mark\AppData\Roaming\Microsoft\Installer\{64351801-5DEA-49A8-9C3D-AE6F7D567A56}\_362106003D8A4C2F2D005E.exe () [File not signed]
Startup: C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Peace.lnk [2019-05-06]
ShortcutTarget: Peace.lnk -> C:\Program Files\EqualizerAPO\config\Peace.exe (Peter Eduard Verbeek -> )
BootExecute: autocheck autochk * Partizan
GroupPolicy: Restriction - Chrome <==== ATTENTION
GroupPolicy-Firefox: Restriction <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION

==================== Scheduled Tasks (Whitelisted) ============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {05B3CD53-D56B-4F10-8AF2-67151DA16121} - System32\Tasks\Microsoft\Windows\UpdateAssistant\UpdateAssistant => C:\WINDOWS\UpdateAssistant\UpdateAssistant.exe /ClientID Win10Upgrade:VNL:NHV20:{} (No File)
Task: {166CD135-D993-4029-BC7D-1CBFC4A92F6F} - System32\Tasks\microsoft\windows\windowsupdate\clean => cmd.exe /c attrib -h -s C:\Users\Mark\AppData\Roaming\*.exe & attrib -h -s C:\Users\Mark\AppData\Roaming\*.bat & del C:\Users\Mark\AppData\Roaming\*.bat & del C:\Users\Mark\AppData\Roaming\svchosts.exe
Task: {16AA2F1B-B92E-4C7C-90D6-FDC235F01F57} - System32\Tasks\Zoomdll => C:\Users\Mark\AppData\Roaming\Zoomdll.exe (No File) <==== ATTENTION
Task: {1888DAB3-2473-4FDE-9CDF-AD7129CBBEFD} - System32\Tasks\AMDRyzenMasterSDKTask => C:\Program Files\AMD\CNext\CNext\cpumetricsserver.exe [183224 2022-11-30] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)
Task: {229CE8E2-E39F-4DFF-ABF2-503222702E8C} - System32\Tasks\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\default-browser-agent.exe do-task "308046B0AF4A39CB"
Task: {24BDE902-D65C-4257-A6F0-B70920E38A2C} - System32\Tasks\CCleanerSkipUAC - Mark => C:\Program Files\CCleaner\CCleaner.exe [32602448 2022-12-09] (PIRIFORM SOFTWARE LIMITED -> Piriform Software Ltd)
Task: {2AD3D722-2B02-4D54-8A8A-24698F92F303} - System32\Tasks\EasyTune 1 => C:\Program Files (x86)\GIGABYTE\EasyTune\etocfile.exe [20352 2021-10-11] (GIGA-BYTE TECHNOLOGY CO., LTD. -> GIGA-BYTE TECHNOLOGY CO., LTD.)
Task: {2CD61FC0-EB1E-4ED9-BD55-284782A58436} - System32\Tasks\SmartDefrag_Update => C:\Program Files (x86)\IObit\Smart Defrag\AutoUpdate.exe [3031824 2020-07-07] (IObit Information Technology -> IObit)
Task: {36A0B050-E149-4C5A-8F72-35E3842DBF8F} - System32\Tasks\ModifyLinkUpdate => C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe [954808 2022-11-30] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)
Task: {3C5B78E6-6DA1-47C1-8655-A5C40257A5A2} - System32\Tasks\Uninstaller_SkipUac_Mark => C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe [9396232 2022-12-23] (IObit CO., LTD -> IObit)
Task: {3DC089C6-0231-4112-93DD-27980AE7F55E} - System32\Tasks\Nafdfnasia => C:\Users\Mark\AppData\Roaming\cmd32.exe [734003200 2022-11-01] (Google) [File not signed] <==== ATTENTION
Task: {3E4D1B8C-2385-4ECA-8BD1-6460827EAA28} - System32\Tasks\SIV => C:\Program Files (x86)\GIGABYTE\SIV\Thermald.exe [392296 2022-12-27] (GIGA-BYTE TECHNOLOGY CO., LTD. -> GIGA-BYTE TECHNOLOGY CO., LTD.)
Task: {45B3942B-0211-4F79-B505-1FA57F9A420D} - System32\Tasks\cFos\Registration Tasks\Open Browser => "c:\program files\mozilla firefox\firefox.exe" -osint -url "hxxps://www.cfos.de/en/cfosspeed/documentation/status.htm?reg-12.00.2512-gigabyte"
Task: {581204C5-B12D-477F-9A48-B91B6ACEEC98} - System32\Tasks\Microsoft\Windows\UpdateAssistant\UpdateAssistantCalendarRun => C:\WINDOWS\UpdateAssistant\UpdateAssistant.exe /ClientID Win10Upgrade:VNL:NHV20:{} /CalendarRun (No File)
Task: {5AFC22D6-163F-4214-AD11-1662E962AB64} - System32\Tasks\SmartDefrag_Startup => C:\Program Files (x86)\IObit\Smart Defrag\SmartDefrag.exe [5867280 2021-01-06] (IObit Information Technology -> IObit) [File not signed]
Task: {68BCAE52-1F87-4DF3-8AE2-7A4BE3D283D6} - System32\Tasks\Microsoft\Windows\UpdateAssistant\UpdateAssistantWakeupRun => C:\WINDOWS\UpdateAssistant\UpdateAssistant.exe /ClientID Win10Upgrade:VNL:NHV20:{} /WakeupRun (No File)
Task: {7C828235-7DF3-44C3-B3A7-045EBAF5FFE8} - System32\Tasks\CCleanerCrashReporting => C:\Program Files\CCleaner\CCleanerBugReport.exe [4669264 2022-12-09] (PIRIFORM SOFTWARE LIMITED -> Piriform Software) -> --product 90 --send dumps|report --path "C:\Program Files\CCleaner\LOG" --programpath "C:\Program Files\CCleaner" --configpath "C:\Program Files\CCleaner\Setup" --guid "9d65c9c3-94e7-4b2f-92e4-60f5e70c0803" --version "6.07.10191" --silent
Task: {7D141133-47E8-4CBC-ADCB-A7AAA88C06C4} - System32\Tasks\IObitSelfCheckTask => C:\Program Files (x86)\IObit\Smart Defrag\IObitSelfCheck.exe /dotip (No File)
Task: {80CCC8E9-E19A-48B3-88D0-77F9B64D25A3} - System32\Tasks\npcapwatchdog => C:\Program Files\Npcap\CheckStatus.bat [862 2020-06-09] () [File not signed]
Task: {88BF25FA-5AA9-4D10-AA9B-09DA4BFEE3C1} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun => C:\WINDOWS\UpdateAssistant\UpdateAssistant.exe /ClientID Win10Upgrade:VNL:EosWu:{} /CalendarRun (No File)
Task: {8EEF0701-388E-4782-8CD1-777C7F219BCA} - System32\Tasks\PlitchSkipUAC => C:\Program Files\Plitch\Plitch.exe [104260376 2021-10-18] (MegaDev GmbH -> MegaDev GmbH)
Task: {9C5FFA4A-BB50-44A2-BCA8-8D403FF45F74} - System32\Tasks\Microsoft\Windows\WindowsUpdate\RUXIM\RUXIMDisplay => C:\Program Files\ruxim\ruximics.exe /nonetwork (No File)
Task: {A0BFFCF7-F7F8-4222-B154-E2EE2A770ED2} - System32\Tasks\EasyTune => C:\Program Files (x86)\GIGABYTE\EasyTune\etinit.exe [17280 2021-04-08] (GIGA-BYTE TECHNOLOGY CO., LTD. -> GIGA-BYTE TECHNOLOGY CO., LTD.)
Task: {A1DE6A4D-D187-47F2-BC0B-394C0E7F0379} - System32\Tasks\GraphicsCardEngine => C:\Program Files (x86)\GIGABYTE\EasyTuneEngineService\GraphicsCardEngineStarter.exe [234880 2021-04-13] (GIGA-BYTE TECHNOLOGY CO., LTD. -> GIGA-BYTE TECHNOLOGY CO., LTD.)
Task: {A3DC111D-7CB0-42F1-AEF5-F77EC8800DF5} - System32\Tasks\klcp_update => C:\Program Files (x86)\K-Lite Codec Pack\Tools\CodecTweakTool.exe [2113024 2022-11-12] () [File not signed]
Task: {ABC8DAE4-2EAB-43E3-BE6C-61AD9E4F7A4D} - System32\Tasks\SIV-VGA => C:\Program Files (x86)\GIGABYTE\SIV\Sensord.exe [257408 2021-06-29] (GIGA-BYTE TECHNOLOGY CO., LTD. -> GIGA-BYTE TECHNOLOGY CO., LTD.)
Task: {ABF0550B-80DE-4C07-B97A-EE8057674F17} - System32\Tasks\MEGA\MEGAsync Update Task S-1-5-21-266282535-48708807-158023499-1001 => C:\Users\Mark\AppData\Local\MEGAsync\MEGAupdater.exe [2531504 2022-10-20] (Mega Limited -> )
Task: {ACA19AC3-B517-42B5-879E-43A3C9D64FA5} - System32\Tasks\SmartDefrag_AutoAnalyze => C:\Program Files (x86)\IObit\Smart Defrag\AutoDefrag.exe [314128 2018-05-02] (IObit Information Technology -> IObit)
Task: {AE619A4E-9842-4CE8-A180-0DEA8B4189CF} - System32\Tasks\Optimize Push Notification Data File-S-1-5-21-266282535-48708807-158023499-1001 => {201600D8-6EFF-48CE-B842-E14D37A0682D} C:\WINDOWS\System32\wpninprc.dll [24064 2018-09-15] (Microsoft Windows -> Microsoft Corporation)
Task: {B5177B32-7DCC-4E67-9C7F-2EF75D2E4A0E} - System32\Tasks\Microsoft\Windows\rempl\shell => C:\Program Files\rempl\sedlauncher.exe (No File)
Task: {B67046DC-76E4-436D-B6A6-5C13331255A2} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [684976 2022-12-09] (Piriform Software Ltd -> Piriform)
Task: {B691768F-DC13-482F-A146-005097196F03} - System32\Tasks\ViGEmBusUpdater => C:\Program Files\Nefarius Software Solutions\ViGEm Bus Driver\ViGEmBusUpdater.exe [888344 2019-12-28] (Nefarius Software Solutions e.U. -> Nefarius Software Solutions e.U.)
Task: {B6A56CB6-C1A9-47F9-9DCD-8C107E826B30} - System32\Tasks\Microsoft\Windows\WindowsUpdate\RUXIM\RUXIMSync => C:\Program Files\ruxim\ruximics.exe /onlyloadcampaigns (No File)
Task: {B6F366C8-510D-4B4B-983C-C2C1F1351789} - System32\Tasks\Microsoft\Windows\UpdateAssistant\UpdateAssistantAllUsersRun => C:\WINDOWS\UpdateAssistant\UpdateAssistant.exe /ClientID Win10Upgrade:VNL:NHV20:{} /AllUsersRun (No File)
Task: {BD739441-5521-4FCE-A1EB-EF94B478A992} - System32\Tasks\Opera GX scheduled assistant Autoupdate 1640804287 => C:\Users\Mark\AppData\Local\Programs\Opera GX\launcher.exe [2542536 2023-01-14] (Opera Norway AS -> Opera Software) -> --scheduledautoupdate --component-name=assistant --component-path="C:\Users\Mark\AppData\Local\Programs\Opera GX\assistant" $(Arg0)
Task: {BE323152-44A9-4FCA-ADC4-8244A04EC428} - System32\Tasks\AMDLinkUpdate => C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe [954808 2022-11-30] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)
Task: {BEABA9E2-357D-4095-893C-B4CEC49152F4} - System32\Tasks\MicrosoftEdgeUpdateTaskUserS-1-5-21-266282535-48708807-158023499-1001Core{4F101C71-1016-47D0-8520-9E8390E63663} => C:\Users\Mark\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe [206256 2023-01-12] (Microsoft Corporation -> Microsoft Corporation)
Task: {C70B9C10-D9E9-47C8-804B-6F014C2FE2A0} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant => C:\WINDOWS\UpdateAssistant\UpdateAssistant.exe /ClientID Win10Upgrade:VNL:EosWu:{} (No File)
Task: {CAC39108-9923-4D38-9FC5-42BE581A2BD4} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153168 2018-12-13] (Google Inc -> Google Inc.)
Task: {D1E1A48B-9A87-49D6-BC37-C465511CD45A} - System32\Tasks\VoEWrMHvSp => C:\WINDOWS\system32\rundll32.exe "C:\Program Files (x86)\VoEWrMHvSp\VoEWrMHvSp.dll",VoEWrMHvSp <==== ATTENTION
Task: {D6F3A115-7489-4D0C-AEB3-C2D29BD099FF} - System32\Tasks\StartDVR => C:\Program Files\AMD\CNext\CNext\RSServCmd.exe [291768 2022-11-30] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)
Task: {DB05742F-2575-449F-BD12-E42396E00FA9} - System32\Tasks\AmbientLED => C:\Program Files (x86)\GIGABYTE\AmbientLED\AmbLED.exe -autoexecute (No File)
Task: {DBA2C500-EBC6-4F09-AB0C-38E69E0CCE43} - System32\Tasks\rhFADKPYWfRr => C:\WINDOWS\system32\rundll32.exe "C:\Program Files (x86)\rhFADKPYWfRr\rhFADKPYWfRr.dll",rhFADKPYWfRr <==== ATTENTION
Task: {DC162C66-E6D4-4760-A428-834C7DAE57F9} - System32\Tasks\AMDInstallLauncher => C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe [954808 2022-11-30] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)
Task: {E3809F95-EC01-4742-B797-17359C105FA6} - System32\Tasks\Mozilla\Firefox Background Update 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\firefox.exe --MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask backgroundupdate
Task: {E4AB02C4-6A37-4BE8-A567-D217DDF869EA} - System32\Tasks\StartCN => C:\Program Files\AMD\CNext\CNext\cncmd.exe [56760 2022-11-30] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)
Task: {EA90EFB5-A284-4DEB-9390-13772A6063F0} - System32\Tasks\CreateExplorerShellUnelevatedTask => C:\WINDOWS\explorer.exe /NOUACCHECK
Task: {EB5EEB3E-0F71-43F3-8B4C-1106CD027399} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153168 2018-12-13] (Google Inc -> Google Inc.)
Task: {EDC532BE-16A8-4128-93D9-3587C9A8AB07} - System32\Tasks\MicrosoftEdgeUpdateTaskUserS-1-5-21-266282535-48708807-158023499-1001UA{05C8C730-B641-4394-87FC-5C696F5090CC} => C:\Users\Mark\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe [206256 2023-01-12] (Microsoft Corporation -> Microsoft Corporation)
Task: {F0172F66-A9E8-4D30-A3BF-C33B39489296} - System32\Tasks\Opera GX scheduled Autoupdate 1638929517 => C:\Users\Mark\AppData\Local\Programs\Opera GX\launcher.exe [2542536 2023-01-14] (Opera Norway AS -> Opera Software)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\CCleanerCrashReporting.job => C:\Program Files\CCleaner\CCleanerBugReport.exe
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

AutoConfigURL: [{3755F8F4-B4AB-4C3C-A891-793B9472A369}] => hxxp://104.155.207.188/win.pac <==== ATTENTION
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 4.2.2.2 8.8.8.8
Tcpip\..\Interfaces\{9272e2bf-6bd5-1513-a95c-605fd4c46776}: [NameServer] 103.86.96.100,103.86.99.100
Tcpip\..\Interfaces\{b8148e49-9a4a-4153-ae7f-b47afdcee1e9}: [DhcpNameServer] 4.2.2.2 8.8.8.8

Edge: 
=======
DownloadDir: C:\Users\Mark\Downloads
Edge DefaultProfile: Default
Edge HKU\S-1-5-21-266282535-48708807-158023499-1001\SOFTWARE\Microsoft\Edge\Extensions\...\Edge\Extension: [llbjbkhnmlidjebalopleeepgdfgcpec] - C:\Program Files (x86)\Internet Download Manager\IDMEdgeExt.crx <not found>

FireFox:
========
FF DefaultProfile: ob8d0ecy.default-1673331920826
FF ProfilePath: C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\ob8d0ecy.default-1673331920826 [2023-01-17]
FF Plugin-x32: @videolan.org/vlc,version=3.0.10 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2021-01-04] (VideoLAN -> VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=3.0.11 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2021-01-04] (VideoLAN -> VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=3.0.12 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2021-01-04] (VideoLAN -> VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=3.0.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2021-01-04] (VideoLAN -> VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=3.0.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2021-01-04] (VideoLAN -> VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=3.0.7.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2021-01-04] (VideoLAN -> VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=3.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2021-01-04] (VideoLAN -> VideoLAN)

Opera: 
=======
StartMenuInternet: (HKU\S-1-5-21-266282535-48708807-158023499-1001) Opera GXStable - "C:\Users\Mark\AppData\Local\Programs\Opera GX\Launcher.exe"

==================== Services (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Adguard Service; C:\Program Files (x86)\Adguard\AdguardSvc.exe [470080 2022-06-08] (Adguard Software Limited -> Adguard Software Ltd)
S4 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [8646752 2020-07-30] (BattlEye Innovations e.K. -> )
S3 CCleanerPerformanceOptimizerService; C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe [1003344 2022-12-09] (PIRIFORM SOFTWARE LIMITED -> Piriform Software Ltd)
S4 cfbackd; C:\Program Files\CleverFiles\Disk Drill\cfbackd.w32.exe [276992 2020-06-22] (CleverFiles) [File not signed]
R2 cFosSpeedS; C:\Program Files\cFosSpeed\spd.exe [602376 2021-06-15] (cFos Software GmbH -> cFos Software GmbH)
S4 Creative Dolby Digital Live Pack Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\DDLLicensing.exe [79360 2019-05-01] (Creative Labs) [File not signed]
R2 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [429056 2013-10-28] (Creative Technology Ltd) [File not signed]
S4 Ds3Service; C:\Program Files\WiinUPro\SCP_Driver\ScpService.exe [381952 2018-08-25] (Scarlet.Crush Productions) [File not signed]
S4 EaseUS Agent; C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe [40080 2018-10-22] (CHENGDU YIWO Tech Development Co., Ltd. -> CHENGDU YIWO Tech Development Co., Ltd) [File not signed]
S4 EaseUS UPDATE SERVICE; C:\Program Files (x86)\EaseUS\ENS\ensserver.exe [27784 2021-11-15] (CHENGDU YIWO Tech Development Co., Ltd. -> ) [File not signed]
S3 EasyAntiCheat; C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe [818304 2020-08-06] (EasyAntiCheat Oy -> Epic Games, Inc)
R2 EasyTuneEngineService; C:\Program Files (x86)\Gigabyte\EasyTuneEngineService\EasyTuneEngineService.exe [147824 2022-06-14] (GIGA-BYTE TECHNOLOGY CO., LTD. -> GIGA-BYTE TECHNOLOGY CO., LTD.)
S4 ElevationService; C:\Program Files (x86)\Wondershare\dr.fone\Addins\SocialApps\ElevationService.exe [907776 2020-05-19] () [File not signed]
R3 EPMVssEaseusProvider; C:\WINDOWS\system32\dllhost.exe /Processid:{76D3E043-F288-46B9-B82A-9B44B150C474} [21304 2018-09-15] (Microsoft Windows -> Microsoft Corporation)
R2 Everything; C:\Program Files (x86)\Everything\Everything.exe [1775264 2021-12-16] (voidtools -> voidtools)
S4 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [399296 2019-11-28] (Canon Inc. -> )
S4 InputMapper Cerberus Whitelister; C:\Program Files (x86)\DSDCS\InputMapper 1.7\HidGuardian\InputMapperCerberusWhitelister.exe [15360 2020-01-10] () [File not signed]
S2 IObitUnSvr; C:\Program Files (x86)\IObit\IObit Uninstaller\IUService.exe [167432 2022-10-20] (IObit CO., LTD -> IObit)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [8892256 2022-12-23] (Malwarebytes Inc. -> Malwarebytes)
S4 Media Center 25 Service; C:\Program Files\J River\Media Center 25\JRService.exe [458128 2019-06-14] (JRiver, Inc. -> JRiver, Inc.)
R2 mfevtp; C:\WINDOWS\system32\mfevtps.exe [343544 2023-01-18] (McAfee, Inc. -> McAfee, Inc.)
S4 MX5AudioDevMon; C:\Program Files (x86)\HeadRush\MX5\AudioDevMon.exe [376816 2021-02-15] (inMusic Brands Inc -> HeadRush)
R2 MyService1; C:\Program Files (x86)\Gigabyte\AppCenter\AdjustService.exe [18944 2021-04-08] () [File not signed]
S4 nebula; C:\Program Files\Logitech\Collaboration\Services\Video\ServiceLayer.exe [4489352 2019-06-12] (Logitech Inc -> Logitech)
R3 nordsec-threatprotection-service; C:\Program Files\NordVPN\NordSec ThreatProtection\nordsec-threatprotection-service.exe [310136 2021-06-11] (nordvpn s.a. -> TEFINCOM S.A.)
R2 NordUpdaterService; C:\Program Files\NordUpdater\NordUpdateService.exe [297848 2022-11-21] (nordvpn s.a. -> nordvpn S.A.)
R2 nordvpn-service; C:\Program Files\NordVPN\nordvpn-service.exe [254328 2022-08-03] (nordvpn s.a. -> TEFINCOM S.A.)
S2 OCButtonService; C:\Program Files (x86)\Gigabyte\EasyTuneEngineService\OcButtonService.exe [127360 2021-04-13] (GIGA-BYTE TECHNOLOGY CO., LTD. -> GIGA-BYTE TECHNOLOGY CO., LTD.)
S4 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2579272 2022-08-20] (Electronic Arts, Inc. -> Electronic Arts)
S2 Origin Web Helper Service; C:\Program Files (x86)\Origin\OriginWebHelperService.exe [3497808 2022-08-20] (Electronic Arts, Inc. -> Electronic Arts)
S4 PlexUpdateService; C:\Program Files (x86)\Plex\Plex Media Server\Plex Update Service.exe [2140656 2019-12-13] (Plex, Inc. -> Plex, Inc.)
S4 RealtekWlanU; C:\Program Files (x86)\Realtek\USB Wireless LAN Utility\RtlService.exe [48856 2014-10-09] (Realtek Semiconductor Corp -> Realtek)
R2 reWASDService; C:\Program Files\reWASD\reWASDService.exe [2956024 2022-12-12] (SIA AVB Disc Soft -> Disc Soft Ltd)
S4 RTLDHCPService; C:\Program Files (x86)\Realtek\USB Wireless LAN Utility\RTLDHCP.exe [262360 2014-10-09] (Realtek Semiconductor Corp -> Realtek)
S4 RunSwUSB; C:\WINDOWS\runSW.exe [44760 2021-10-10] (Realtek Semiconductor Corp -> )
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [6117960 2022-01-17] (Microsoft Windows Publisher -> Microsoft Corporation)
S4 ss_conn_launcher_service; C:\WINDOWS\System32\Samsung\EasySetup\ss_conn_launcher.exe [182392 2021-10-08] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
S4 TeraCopyService; C:\Program Files\TeraCopy\TeraCopyService.exe [110416 2017-05-05] (Code Sector -> Code Sector)
S4 ViGEmBusUpdater; C:\Program Files\Nefarius Software Solutions\ViGEm Bus Driver\ViGEmBusUpdater.exe [888344 2019-12-28] (Nefarius Software Solutions e.U. -> Nefarius Software Solutions e.U.)
S4 Wondershare InstallAssist; C:\ProgramData\Wondershare\Service\InstallAssistService.exe [269200 2020-04-02] (Wondershare Technology Co.,Ltd -> Wondershare)
S4 WsAppService; C:\Program Files (x86)\Wondershare\WAF\2.4.3.224\WsAppService.exe [473824 2017-04-20] (Wondershare Technology Co.,Ltd -> Wondershare)
S4 WsAppService3; C:\Program Files (x86)\Wondershare\WAF3\3.0.0.308\WsAppService3.exe [83232 2019-07-09] (Wondershare Technology Co.,Ltd -> Wondershare)
S4 WsDrvInst; C:\Program Files (x86)\Wondershare\dr.fone\Addins\SocialApps\DriverInstall.exe [122768 2020-06-03] (Wondershare Technology Co.,Ltd -> Wondershare)
S3 Browser; %SystemRoot%\System32\browser.dll [X]
S4 MaskVPNService; "C:\Program Files (x86)\MaskVPN\mask_svc.exe" [X]
S4 MullvadVPN; "C:\Program Files\Mullvad VPN\resources\mullvad-daemon.exe" --run-as-service -v [X]
S3 WdNisSvc; "%ProgramData%\Microsoft\Windows Defender\Platform\4.18.2210.6-0\NisSrv.exe" [X]
S2 WinDefend; "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2210.6-0\MsMpEng.exe" [X]
S2 wut; cmd.exe /c C:\Users\Mark\AppData\Roaming\svchosts.exe [X]

===================== Drivers (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 12531149; C:\WINDOWS\system32\drivers\12531149.sys [255928 2021-12-28] (Malwarebytes Corporation -> Malwarebytes)
S3 14272474; C:\WINDOWS\system32\drivers\14272474.sys [255928 2021-10-17] (Malwarebytes Corporation -> Malwarebytes)
R1 adgnetworkwfpdrv; C:\WINDOWS\System32\drivers\adgnetworkwfpdrv.sys [99896 2022-04-11] (Microsoft Windows Hardware Compatibility Publisher -> Adguard Software Ltd)
R3 amdfendrmgr; C:\WINDOWS\System32\drivers\amdfendrmgr.sys [35344 2022-09-08] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)
R2 AMDRyzenMasterDriverV19; C:\WINDOWS\system32\AMDRyzenMasterDriver.sys [43336 2022-11-30] (Advanced Micro Devices INC. -> Advanced Micro Devices)
R3 AMDSAFD; C:\WINDOWS\System32\DriverStore\FileRepository\amdsafd.inf_amd64_1a1a381a2c0e293c\amdsafd.sys [113056 2022-08-25] (Advanced Micro Devices Inc. -> Advanced Micro Devices)
R3 amdwddmg; C:\WINDOWS\System32\DriverStore\FileRepository\u0386220.inf_amd64_1894141ab65df02b\B386218\amdkmdag.sys [94455336 2022-11-30] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)
R3 AMDXE; C:\WINDOWS\System32\drivers\amdxe.sys [59920 2022-05-31] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)
S3 ampa; C:\WINDOWS\system32\ampa.sys [38320 2017-02-28] (CHENGDU AOMEI Tech Co., Ltd. -> )
R1 amsdk; C:\WINDOWS\system32\drivers\amsdk.sys [232792 2021-10-20] (Zemana D.O.O. Sarajevo -> Copyright 2018.)
S3 audientusbaudio; C:\WINDOWS\System32\drivers\audientusbaudio.sys [377384 2020-03-24] (Microsoft Windows Hardware Compatibility Publisher -> )
S3 audientusbaudioks; C:\WINDOWS\system32\DRIVERS\audientusbaudioks.sys [53800 2020-03-24] (Microsoft Windows Hardware Compatibility Publisher -> )
R1 cFosSpeed; C:\WINDOWS\system32\DRIVERS\cfosspeed6.sys [1694504 2021-06-15] (cFos Software GmbH -> cFos Software GmbH)
S3 cmb38464; C:\WINDOWS\system32\DRIVERS\cmb38464.sys [49184 2017-07-09] (Amanero SRL -> )
R3 CMUSBDAC; C:\WINDOWS\system32\DRIVERS\CMUSBDAC.sys [3819744 2018-07-24] (WDKTestCert cm359,131641702659254692 -> C-MEDIA)
S3 ddmdrv; C:\WINDOWS\system32\ddmdrv.sys [35760 2016-12-27] (CHENGDU AOMEI Tech Co., Ltd. -> )
S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus2.sys [160376 2021-10-08] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
S3 dtultrascsibus; C:\WINDOWS\System32\drivers\dtultrascsibus.sys [30264 2018-12-02] (Disc Soft Ltd -> Disc Soft Ltd)
S3 dtultrausbbus; C:\WINDOWS\System32\drivers\dtultrausbbus.sys [47672 2018-12-02] (Disc Soft Ltd -> Disc Soft Ltd)
S3 epmdkdrv; C:\WINDOWS\system32\epmdkdrv.sys [36280 2020-02-23] (CHENGDU YIWO Tech Development Co., Ltd. -> )
R0 EPMVolFl; C:\WINDOWS\System32\drivers\EPMVolFl.sys [30136 2020-02-23] (CHENGDU YIWO Tech Development Co., Ltd. -> Windows (R) Codename Longhorn DDK provider)
R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [158640 2022-11-23] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R0 EUBAKUP; C:\WINDOWS\System32\drivers\eubakup.sys [73448 2018-10-08] (Microsoft Windows Hardware Compatibility Publisher -> CHENGDU YIWO Tech Development Co., Ltd)
R0 EUBKMON; C:\WINDOWS\System32\drivers\EUBKMON.sys [53504 2018-10-08] (Microsoft Windows Hardware Compatibility Publisher -> )
R0 EUDCPEPM; C:\WINDOWS\System32\drivers\EUDCPEPM.sys [76344 2020-12-08] (Microsoft Windows Hardware Compatibility Publisher -> CHENGDU YIWO Tech Development Co., Ltd)
R1 EUDSKACS; C:\Windows\system32\drivers\eudskacs.sys [22784 2018-10-08] (Microsoft Windows Hardware Compatibility Publisher -> CHENGDU YIWO Tech Development Co., Ltd)
R1 EUEDKEPM; C:\WINDOWS\system32\drivers\EUEDKEPM.sys [33712 2020-02-23] (CHENGDU YIWO Tech Development Co., Ltd. -> CHENGDU YIWO Tech Development Co., Ltd)
R1 EUFDDISK; C:\Windows\system32\drivers\EuFdDisk.sys [341760 2018-10-08] (Microsoft Windows Hardware Compatibility Publisher -> CHENGDU YIWO Tech Development Co., Ltd)
S3 GDPL_BOOM; C:\WINDOWS\system32\drivers\boomvad.sys [51016 2019-09-11] (WDKTestCert Adarsh,131897759775447238 -> Windows (R) Win 7 DDK provider)
R3 gdrv2; C:\WINDOWS\gdrv2.sys [32600 2023-01-19] (GIGA-BYTE Technology Co., Ltd. -> GIGA-BYTE TECHNOLOGY CO., LTD.)
R3 gdrv3; C:\WINDOWS\System32\drivers\gdrv3.sys [45248 2022-11-01] (GIGA-BYTE TECHNOLOGY CO., LTD. -> GIGA-BYTE TECHNOLOGY CO., LTD.)
R1 googledrivefs3758; C:\WINDOWS\System32\DRIVERS\googledrivefs3758.sys [384584 2022-03-30] (Microsoft Windows Hardware Compatibility Publisher -> Google, Inc.)
R0 hidgamemap; C:\WINDOWS\System32\drivers\hidgamemap.sys [340856 2022-12-12] (AVB Disc Soft, SIA -> Disc Soft Ltd)
S3 HidGuardian; C:\WINDOWS\System32\drivers\HidGuardian.sys [26736 2017-04-17] (Microsoft Windows Hardware Compatibility Publisher -> Benjamin Höglinger-Stelzer)
S3 hitmanpro37; C:\WINDOWS\system32\drivers\hitmanpro37.sys [42000 2023-01-01] (Microsoft Windows Hardware Compatibility Publisher -> )
S3 IKMultimediaUsbAudio; C:\WINDOWS\System32\drivers\IKMultimediaUsbAudio.sys [381496 2020-10-05] (Microsoft Windows Hardware Compatibility Publisher -> )
S3 IKMultimediaUsbAudioks; C:\WINDOWS\system32\DRIVERS\IKMultimediaUsbAudioks.sys [53816 2020-10-05] (Microsoft Windows Hardware Compatibility Publisher -> )
R2 inpoutx64; C:\WINDOWS\System32\Drivers\inpoutx64.sys [15008 2022-11-08] (Red Fox UK Limited -> Highresolution Enterprises [www.highrez.co.uk])
S3 kmloop; C:\WINDOWS\System32\drivers\loop.sys [17408 2018-09-15] (Microsoft Windows -> Microsoft Corporation)
R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [223176 2023-01-14] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
S0 MbamElam; C:\WINDOWS\System32\DRIVERS\MbamElam.sys [21480 2022-11-23] (Microsoft Windows Early Launch Anti-malware Publisher -> Malwarebytes)
R3 MBAMFarflt; C:\WINDOWS\System32\DRIVERS\farflt.sys [197088 2023-01-18] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R3 MBAMProtection; C:\WINDOWS\system32\DRIVERS\mbam.sys [76216 2023-01-18] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [239544 2022-12-14] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R3 MBAMWebProtection; C:\WINDOWS\system32\DRIVERS\mwac.sys [181816 2023-01-18] (Malwarebytes Inc. -> Malwarebytes)
R0 mfehidk; C:\WINDOWS\System32\drivers\mfehidk.sys [917008 2023-01-18] (McAfee, Inc. -> McAfee, Inc.)
S3 mferkdet; C:\WINDOWS\System32\drivers\mferkdet.sys [124432 2023-01-18] (McAfee, Inc. -> McAfee, Inc.)
S3 MpKsle66b7a45; C:\WINDOWS\system32\MpEngineStore\MpKslDrv.sys [48360 2022-04-05] (Microsoft Windows -> Microsoft Corporation)
R3 mshield; C:\WINDOWS\System32\DRIVERS\mshield.sys [43112 2022-08-24] (nordvpn s.a. -> Nordvpn S.A.)
R2 NDivert; C:\Program Files\NordVPN\7.4.6.0\Drivers\NDivert.sys [131472 2022-06-28] (nordvpn s.a. -> Nordvpn S.A.)
R4 NordDivert10; C:\Program Files\NordVPN\NordSec ThreatProtection\1.3.260.372\NordDivert1064.sys [101240 2022-04-19] (nordvpn s.a. -> NordVPN/Basil)
R1 nordlwf; C:\WINDOWS\system32\DRIVERS\nordlwf.sys [44928 2022-02-22] (nordvpn s.a. -> TEFINCOM S.A.)
R1 npcap; C:\WINDOWS\system32\DRIVERS\npcap.sys [83728 2020-08-25] (Insecure.Com LLC -> Insecure.Com LLC.)
S4 npcap_wifi; C:\WINDOWS\system32\DRIVERS\npcap.sys [83728 2020-08-25] (Insecure.Com LLC -> Insecure.Com LLC.)
S3 rspLLL; C:\WINDOWS\System32\DRIVERS\rspLLL64.sys [26368 2015-07-13] (Daniel Terhell -> Resplendence Software Projects Sp.)
R2 RtsUapx; C:\WINDOWS\system32\drivers\RtsUapx.sys [29688 2019-10-10] (Realtek Semiconductor Corp. -> Realtek Semiconductor Corp.)
R3 ScpVBus; C:\WINDOWS\System32\drivers\ScpVBus.sys [39168 2018-08-25] (Bruce James -> Scarlet.Crush Productions)
R3 Serial; C:\WINDOWS\system32\DRIVERS\wdfserial.sys [89976 2018-04-26] (LG Electronics Inc. -> LG Electronics Inc.)
S3 shanling_audio; C:\WINDOWS\System32\drivers\shanling_audio_x64.sys [259072 2015-04-13] (Thesycon Systemsoftware Consulting GmbH -> )
S3 shanling_audioks; C:\WINDOWS\system32\DRIVERS\shanling_audioks_x64.sys [46080 2015-04-13] (Thesycon Systemsoftware Consulting GmbH -> )
S3 SIVDriver; C:\WINDOWS\system32\Drivers\SIVX64.sys [205552 2021-02-12] (RH Software Ltd -> Ray Hinchliffe)
R0 SmartDefragDriver; C:\WINDOWS\System32\Drivers\SmartDefragDriver.sys [30744 2017-03-09] (IObit Information Technology -> IObit)
S3 sonarworks_VirtualDevice; C:\WINDOWS\system32\DRIVERS\sonarworks.sys [442416 2021-02-07] (SIA Sonarworks -> Sonarworks)
R2 SSGDIO; C:\WINDOWS\SysWOW64\DRIVERS\ssgdio64.sys [14608 2022-12-12] (ATI Technologies, Inc -> ATI Technologies Inc.)
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [167544 2021-10-08] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
S3 ss_conn_usb_driver2; C:\WINDOWS\System32\Drivers\ss_conn_usb_driver2.sys [43640 2021-10-08] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
R1 steamxbox; C:\WINDOWS\System32\drivers\steamxbox.sys [232792 2021-09-05] (Valve Corp. -> Valve Corporation)
R3 tap0901; C:\WINDOWS\System32\drivers\tap0901.sys [27136 2018-10-12] (OpenVPN Technologies, Inc. -> The OpenVPN Project)
R3 tapnordvpn; C:\WINDOWS\System32\drivers\tapnordvpn.sys [44896 2018-07-24] (TEFINCOM S.A. -> The OpenVPN Project)
S3 TEACAHSD_SVC; C:\WINDOWS\system32\drivers\teacahsd.sys [174032 2018-08-05] (Microsoft Windows Hardware Compatibility Publisher -> TEAC)
S3 USBPcap; C:\WINDOWS\system32\DRIVERS\USBPcap.sys [52872 2020-05-22] (Tomasz Moń -> USBPcap)
R3 VBAudioHFVAIOMME; C:\WINDOWS\system32\DRIVERS\vbaudio_hfvaio64_win7.sys [33512 2020-09-15] (Vincent Burel -> Windows (R) Win 7 DDK provider)
S3 VBAudioVMAUXVAIOMME; C:\WINDOWS\system32\DRIVERS\vbaudio_vmauxvaio64_win10.sys [71920 2020-10-02] (Vincent Burel -> Windows (R) Win 7 DDK provider)
R1 veracrypt; C:\WINDOWS\System32\drivers\veracrypt.sys [829320 2018-12-22] (IDRIX -> IDRIX)
R3 ViGEmBus; C:\WINDOWS\System32\drivers\ViGEmBus.sys [69168 2019-04-04] (Microsoft Windows Hardware Compatibility Publisher -> Benjamin Höglinger-Stelzer)
S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [49616 2022-11-11] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [469288 2022-11-11] (Microsoft Windows -> Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [95520 2022-11-11] (Microsoft Windows -> Microsoft Corporation)
R3 wintun; C:\WINDOWS\System32\drivers\wintun.sys [29592 2023-01-02] (Microsoft Windows Hardware Compatibility Publisher -> WireGuard LLC)
S3 WiseUnlock; C:\WINDOWS\WiseUnlock64.sys [33864 2020-04-16] (Beijing Lang Xingda Network Technology Co., Ltd -> WiseCleaner.com)
R3 xmosusbaudiost30C8; C:\WINDOWS\System32\drivers\xmosusbaudiost30C8.sys [275032 2017-09-08] (Microsoft Windows Hardware Compatibility Publisher -> Thesycon Software Solutions GmbH & Co. KG)
R3 xmosusbaudiost30C8ks; C:\WINDOWS\system32\DRIVERS\xmosusbaudiost30C8ks.sys [52824 2017-09-08] (Microsoft Windows Hardware Compatibility Publisher -> Thesycon Software Solutions GmbH & Co. KG)
S2 AMDRyzenMasterDriverV17; \??\C:\Program Files\AMD\CNext\CNext\AMDRyzenMasterDriver.sys [X]
S3 cpuz148; \??\C:\WINDOWS\temp\cpuz148\cpuz148_x64.sys [X]
S1 epp; \??\C:\EEK\bin64\epp.sys [X]
S3 EuGdiDrv; \SystemRoot\system32\EuGdiDrv.sys [X]
S1 kokmvlaq; \??\C:\WINDOWS\system32\drivers\kokmvlaq.sys [X]
S3 KsUSBa64; \SystemRoot\system32\drivers\ksUSBa64.sys [X]
S3 MpKslbe46b44b; \??\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{B7C79271-4A98-4964-A781-259EEB659182}\MpKslDrv.sys [X]
U0 Partizan; system32\drivers\Partizan.sys [X]
S3 SoundGridMIDI; \SystemRoot\system32\drivers\SoundGridMidi.sys [X]
S3 VBAudioVMVAIOMME; \SystemRoot\system32\DRIVERS\vbaudio_vmvaio64_win10.sys [X]
S0 yqawutcu; System32\drivers\aygwuit.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One month (created) (Whitelisted) =========

(If an entry is included in the fixlist, the file/folder will be moved.)

2023-01-20 13:35 - 2023-01-20 13:36 - 000048530 _____ C:\Users\Mark\Desktop\FRST.txt
2023-01-20 13:34 - 2023-01-20 13:34 - 000000000 ____D C:\Users\Mark\Desktop\FRST-OlderVersion
2023-01-20 13:26 - 2023-01-20 13:35 - 000000000 ____D C:\FRST
2023-01-20 13:22 - 2023-01-20 13:22 - 002376704 _____ (Farbar) C:\Users\Mark\Downloads\FRSTEnglish.exe
2023-01-20 11:52 - 2023-01-20 11:52 - 001478312 _____ C:\Users\Mark\Downloads\NZXT-CAM-Setup.exe
2023-01-20 00:51 - 2023-01-20 00:51 - 000003092 _____ C:\WINDOWS\system32\Tasks\AMDInstallLauncher
2023-01-20 00:51 - 2023-01-20 00:51 - 000000000 ____D C:\Users\Mark\AppData\LocalLow\AMD
2023-01-20 00:50 - 2023-01-20 00:50 - 000003488 _____ C:\WINDOWS\system32\Tasks\ModifyLinkUpdate
2023-01-20 00:50 - 2023-01-20 00:50 - 000003152 _____ C:\WINDOWS\system32\Tasks\StartCN
2023-01-20 00:50 - 2023-01-20 00:50 - 000003084 _____ C:\WINDOWS\system32\Tasks\AMDLinkUpdate
2023-01-20 00:50 - 2023-01-20 00:50 - 000003072 _____ C:\WINDOWS\system32\Tasks\StartDVR
2023-01-20 00:50 - 2023-01-20 00:50 - 000002614 _____ C:\WINDOWS\system32\Tasks\AMDRyzenMasterSDKTask
2023-01-20 00:50 - 2023-01-20 00:50 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Software꞉ Adrenalin Edition
2023-01-20 00:50 - 2023-01-20 00:50 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Bug Report Tool
2023-01-19 20:27 - 2023-01-19 20:27 - 013471344 _____ C:\Users\Mark\Downloads\mb-support-1.8.7.918.exe
2023-01-19 12:29 - 2023-01-19 12:29 - 000032600 ____N (GIGA-BYTE TECHNOLOGY CO., LTD.) C:\WINDOWS\gdrv2.sys
2023-01-18 17:06 - 2023-01-18 17:06 - 000181816 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2023-01-18 10:34 - 2023-01-18 10:38 - 000149224 _____ C:\TDSSKiller.3.1.0.28_18.01.2023_10.34.26_log.txt
2023-01-18 10:30 - 2023-01-18 10:30 - 000917008 _____ (McAfee, Inc.) C:\WINDOWS\system32\Drivers\mfehidk.sys
2023-01-18 10:30 - 2023-01-18 10:30 - 000343544 _____ (McAfee, Inc.) C:\WINDOWS\system32\mfevtps.exe
2023-01-18 10:30 - 2023-01-18 10:30 - 000124432 _____ (McAfee, Inc.) C:\WINDOWS\system32\Drivers\mferkdet.sys
2023-01-18 10:22 - 2023-01-18 10:22 - 000000000 ____D C:\Program Files\McAfee
2023-01-18 10:01 - 2022-08-24 09:18 - 000043112 _____ (Nordvpn S.A.) C:\WINDOWS\system32\Drivers\SET9C55.tmp
2023-01-18 10:01 - 2022-08-24 09:18 - 000043112 _____ (Nordvpn S.A.) C:\WINDOWS\system32\Drivers\mshield.sys
2023-01-17 07:04 - 2023-01-17 07:04 - 008791352 _____ (Malwarebytes) C:\Users\Mark\Desktop\adwcleaner(2).exe
2023-01-15 12:12 - 2023-01-15 12:12 - 000000000 ____D C:\ProgramData\{F86B0233-9A85-4589-8AAF-524CC4F8211B}
2023-01-15 02:13 - 2023-01-15 15:59 - 000061873 _____ C:\Users\Mark\Downloads\the-pentagons-brain-an-uncensored-history-of-darpa-americas-top-secret-military_archive.torrent
2023-01-14 19:37 - 2023-01-14 19:37 - 000018422 _____ C:\Users\Mark\Downloads\surprise-kill-vanish-by-annie-jacobsen_archive.torrent
2023-01-14 09:56 - 2023-01-14 09:56 - 030862328 _____ (IObit ) C:\Users\Mark\Downloads\iobituninstaller (1).exe
2023-01-14 09:55 - 2023-01-14 09:55 - 030862328 ____N (IObit ) C:\Users\Mark\Downloads\iobituninstaller.exe
2023-01-13 03:29 - 2023-01-13 03:29 - 000003442 _____ C:\WINDOWS\system32\Tasks\EasyTune 1
2023-01-13 03:29 - 2023-01-13 03:29 - 000003342 _____ C:\WINDOWS\system32\Tasks\EasyTune
2023-01-13 03:28 - 2023-01-13 03:28 - 000003332 _____ C:\WINDOWS\system32\Tasks\SIV-VGA
2023-01-13 03:28 - 2023-01-13 03:28 - 000003326 _____ C:\WINDOWS\system32\Tasks\SIV
2023-01-13 03:23 - 2023-01-13 03:23 - 000003426 _____ C:\WINDOWS\system32\Tasks\GraphicsCardEngine
2023-01-13 03:14 - 2023-01-13 03:14 - 001151138 _____ C:\Users\Mark\Desktop\AMD Bug Reporting Form Submitted Data 20230113T031429.zip
2023-01-13 03:14 - 2023-01-13 03:14 - 000000000 ____D C:\Users\Mark\AppData\Local\AWSToolkit
2023-01-12 15:27 - 2023-01-12 15:27 - 000003858 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskUserS-1-5-21-266282535-48708807-158023499-1001UA{05C8C730-B641-4394-87FC-5C696F5090CC}
2023-01-12 15:27 - 2023-01-12 15:27 - 000003792 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskUserS-1-5-21-266282535-48708807-158023499-1001Core{4F101C71-1016-47D0-8520-9E8390E63663}
2023-01-10 18:22 - 2023-01-10 18:22 - 000001495 _____ C:\Users\Mark\Desktop\Audirvana - Shortcut (2).lnk
2023-01-10 18:21 - 2023-01-10 18:21 - 000001523 _____ C:\Users\Mark\Desktop\Audirvāna Studio - Shortcut.lnk
2023-01-10 18:05 - 2023-01-10 18:05 - 000001059 _____ C:\Users\Mark\Desktop\FileActivityWatch.cfg
2023-01-10 15:02 - 2023-01-10 15:14 - 000147734 _____ C:\TDSSKiller.3.1.0.28_10.01.2023_15.02.37_log.txt
2023-01-10 14:58 - 2023-01-10 14:59 - 000010628 _____ C:\TDSSKiller.3.1.0.28_10.01.2023_14.58.05_log.txt
2023-01-10 02:39 - 2023-01-10 02:39 - 000000000 ____D C:\Users\Mark\AppData\Local\Yandex
2023-01-10 02:32 - 2023-01-10 19:44 - 000905704 _____ (Gridinsoft LLC) C:\Users\Mark\Downloads\Install-Anti-Malware-ti.exe
2023-01-10 02:28 - 2023-01-20 13:34 - 002376704 _____ (Farbar) C:\Users\Mark\Desktop\FRST64.exe
2023-01-10 01:52 - 2023-01-10 02:20 - 000000000 ____D C:\ProgramData\Emsisoft
2023-01-10 01:05 - 2023-01-10 02:24 - 000000000 ____D C:\EEK
2023-01-10 00:58 - 2023-01-10 19:41 - 322321424 ____N C:\Users\Mark\Downloads\EmsisoftEmergencyKit (1).exe
2023-01-10 00:29 - 2023-01-10 00:30 - 322321424 _____ C:\Users\Mark\Downloads\EmsisoftEmergencyKit.exe
2023-01-09 15:39 - 2023-01-09 15:39 - 008791352 _____ (Malwarebytes) C:\Users\Mark\Desktop\adwcleaner(1).exe
2023-01-09 02:58 - 2023-01-15 21:36 - 000000000 ____D C:\Users\Mark\AppData\Local\Pushbullet
2023-01-09 02:58 - 2023-01-09 02:58 - 000001096 _____ C:\Users\Public\Desktop\Pushbullet.lnk
2023-01-09 02:58 - 2023-01-09 02:58 - 000001096 _____ C:\ProgramData\Desktop\Pushbullet.lnk
2023-01-09 02:58 - 2023-01-09 02:58 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pushbullet
2023-01-09 02:58 - 2023-01-09 02:58 - 000000000 ____D C:\Program Files (x86)\Pushbullet
2023-01-08 03:04 - 2023-01-08 03:07 - 009640760 _____ C:\Users\Mark\Downloads\AudirvanaSetup_3.5.51.0_x64.appxbundle
2023-01-08 03:03 - 2023-01-08 03:07 - 030887313 _____ C:\Users\Mark\Downloads\AudirvanaStudioSetup_2.2.2.0_x64_StudioRelease.appxbundle
2023-01-06 12:23 - 2023-01-06 12:23 - 000000000 ____D C:\@RestoreQuarantine
2023-01-06 01:17 - 2023-01-06 01:17 - 000000000 ___HD C:\$Windows.~WS
2023-01-05 03:19 - 2023-01-20 13:29 - 000000000 ____D C:\ProgramData\Adguard
2023-01-05 03:19 - 2023-01-05 03:19 - 000000000 ____D C:\Users\Mark\AppData\Roaming\Adguard Software Ltd
2023-01-05 03:19 - 2023-01-05 03:19 - 000000000 ____D C:\Users\Mark\AppData\Local\Adguard_Software_Ltd
2023-01-04 03:03 - 2023-01-04 03:04 - 000072921 _____ C:\Users\Mark\Downloads\tsp1995-02-28.flac16_archive.torrent
2023-01-04 00:35 - 2019-10-21 00:54 - 712167424 _____ C:\Users\Mark\Desktop\AudirvanaPlusDatabaseV2.sqlite
2023-01-02 02:04 - 2023-01-18 10:01 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NordSec
2023-01-02 02:04 - 2023-01-18 10:01 - 000000000 ____D C:\Program Files\NordVPN
2023-01-02 02:04 - 2023-01-02 02:04 - 000001752 _____ C:\Users\Mark\Desktop\NordVPN.lnk
2023-01-02 02:04 - 2023-01-02 02:04 - 000000000 ____D C:\ProgramData\NordUpdater
2023-01-02 02:04 - 2023-01-02 02:04 - 000000000 ____D C:\Program Files\NordUpdater
2023-01-02 02:04 - 2023-01-02 02:04 - 000000000 ____D C:\Program Files (x86)\NordVPN network TAP
2023-01-02 02:04 - 2022-10-11 11:13 - 000043576 _____ (TEFINCOM S.A.) C:\WINDOWS\Nord.Setup.dll
2023-01-02 02:04 - 2022-02-22 11:52 - 000044928 _____ (TEFINCOM S.A.) C:\WINDOWS\system32\Drivers\nordlwf.sys
2023-01-01 22:22 - 2023-01-01 22:22 - 000000000 ____D C:\Users\Mark\Downloads\Visual C++ v56
2023-01-01 22:13 - 2023-01-01 22:18 - 000235373 _____ C:\Users\Mark\Downloads\FixWin11.zip
2023-01-01 22:09 - 2023-01-01 22:09 - 000589184 _____ (WinTools.Info) C:\Users\Mark\Downloads\win10settings.exe
2023-01-01 22:05 - 2023-01-01 22:20 - 023871089 _____ (Igor Pavlov) C:\Users\Mark\Downloads\Visual C++ v56.exe
2023-01-01 22:04 - 2023-01-01 22:06 - 002162688 _____ C:\Users\Mark\Downloads\Visual-C-Runtimes-All-in-One-Nov-2022(1).o8tB7psS.zip.part
2023-01-01 22:04 - 2023-01-01 22:04 - 000000000 _____ C:\Users\Mark\Downloads\Visual-C-Runtimes-All-in-One-Nov-2022(1).zip
2023-01-01 21:42 - 2023-01-01 22:05 - 037453716 _____ C:\Users\Mark\Downloads\Visual-C-Runtimes-All-in-One-Nov-2022.kR4Fbesf.zip.part
2023-01-01 21:42 - 2023-01-01 21:53 - 000000000 _____ C:\Users\Mark\Downloads\Visual-C-Runtimes-All-in-One-Nov-2022.zip
2023-01-01 21:37 - 2023-01-01 21:37 - 000000000 ____D C:\Users\Mark\Documents\Xenia
2023-01-01 21:37 - 2023-01-01 21:37 - 000000000 ____D C:\Users\Mark\Desktop\xenia_master
2023-01-01 21:34 - 2023-01-01 21:34 - 000000000 ____D C:\Users\Mark\Desktop\xenia_canary
2023-01-01 21:14 - 2023-01-01 21:19 - 000000000 ____D C:\Users\Mark\Downloads\xenia_canary
2023-01-01 21:14 - 2023-01-01 21:14 - 000000000 ____D C:\Users\Mark\Downloads\xenia_master
2022-12-31 04:58 - 2022-12-31 04:58 - 000000000 ____D C:\Users\Mark\Documents\XLN Online Installer Logs
2022-12-31 04:56 - 2022-12-31 04:56 - 000000000 ____D C:\Users\Mark\AppData\Roaming\XLN Online Installer
2022-12-31 04:54 - 2023-01-02 22:47 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XLN Audio
2022-12-30 17:19 - 2023-01-18 11:56 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Process Hacker 2
2022-12-30 11:00 - 2022-12-30 11:00 - 000000000 ___HD C:\$WINDOWS.~BT
2022-12-30 08:19 - 2022-12-30 08:19 - 000240023 _____ C:\Users\Mark\Desktop\Archaeological Discoveries That Are Classified Top Secret [pack].torrent
2022-12-30 08:19 - 2022-12-30 08:19 - 000013127 _____ C:\Users\Mark\Desktop\18772.torrent
2022-12-30 08:18 - 2022-12-30 08:18 - 000671209 _____ C:\Users\Mark\Desktop\Remote Viewing ESP Psychic Spy Training Course [pack].torrent
2022-12-30 08:18 - 2022-12-30 08:18 - 000157409 _____ C:\Users\Mark\Desktop\29684.torrent
2022-12-30 08:17 - 2022-12-30 08:17 - 000399259 _____ C:\Users\Mark\Desktop\Military Underground Infrastructure Secret Deep Bases (2016).torrent
2022-12-30 08:17 - 2022-12-30 08:17 - 000020347 _____ C:\Users\Mark\Desktop\28837.torrent
2022-12-30 08:16 - 2022-12-30 08:16 - 000042010 _____ C:\Users\Mark\Desktop\Preston Nichols Montauk Time Travel Mind Control research pack.torrent
2022-12-30 08:16 - 2022-12-30 08:16 - 000020947 _____ C:\Users\Mark\Desktop\18550.torrent
2022-12-30 08:16 - 2022-12-30 08:16 - 000015243 _____ C:\Users\Mark\Desktop\30992.torrent
2022-12-30 08:15 - 2022-12-30 08:15 - 000148083 _____ C:\Users\Mark\Desktop\29703.torrent
2022-12-30 08:15 - 2022-12-30 08:15 - 000012105 _____ C:\Users\Mark\Desktop\21251.torrent
2022-12-30 08:13 - 2022-12-30 08:13 - 000423042 _____ C:\Users\Mark\Desktop\NASA Apollo 11 - What Happened on the Moon [pack].torrent
2022-12-30 08:12 - 2022-12-30 08:12 - 000111178 _____ C:\Users\Mark\Desktop\UFO MJ-12 Majestic-12 Group Special Operations [pack].torrent
2022-12-30 08:11 - 2022-12-30 08:11 - 000851964 _____ C:\Users\Mark\Desktop\Jim Marrs - What They Don't Want You to Know [pack].torrent
2022-12-30 08:10 - 2022-12-30 08:10 - 000188466 _____ C:\Users\Mark\Desktop\32240.torrent
2022-12-30 08:08 - 2022-12-30 08:08 - 000646354 _____ C:\Users\Mark\Desktop\UFOs Secret Space Programs & Underground Bases [pack].torrent
2022-12-30 04:06 - 2022-12-30 04:07 - 000000000 ____D C:\AdwCleaner
2022-12-30 04:06 - 2022-12-30 04:06 - 008551608 _____ (Malwarebytes) C:\Users\Mark\Desktop\AdwCleaner.exe
2022-12-30 04:04 - 2023-01-10 00:25 - 000000000 ____D C:\Users\Mark\Desktop\Old Firefox Data
2022-12-30 02:43 - 2022-12-30 02:44 - 000000000 ____D C:\ProgramData\HitmanPro
2022-12-30 02:43 - 2022-12-30 02:43 - 014248944 ____N (SurfRight B.V.) C:\Users\Mark\Downloads\HitmanPro_x64.exe
2022-12-30 02:43 - 2022-12-30 02:43 - 000001918 _____ C:\Users\Public\Desktop\HitmanPro.lnk
2022-12-30 02:43 - 2022-12-30 02:43 - 000001918 _____ C:\ProgramData\Desktop\HitmanPro.lnk
2022-12-30 02:43 - 2022-12-30 02:43 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
2022-12-30 02:43 - 2022-12-30 02:43 - 000000000 ____D C:\Program Files\HitmanPro
2022-12-29 14:14 - 2022-12-29 14:14 - 000000000 ___HD C:\$WinREAgent
2022-12-26 03:14 - 2022-12-26 03:14 - 000069800 _____ C:\TDSSKiller.3.1.0.28_26.12.2022_03.14.10_log.txt
2022-12-26 03:12 - 2022-12-26 03:13 - 000010446 _____ C:\TDSSKiller.3.1.0.28_26.12.2022_03.12.54_log.txt
2022-12-26 02:59 - 2022-12-26 02:59 - 000005234 _____ C:\Users\Mark\AppData\Roaming\qEdJzM2d.exe
2022-12-26 02:59 - 2022-12-26 02:59 - 000005234 _____ C:\Users\Mark\AppData\Roaming\H35c27gu.exe
2022-12-26 02:52 - 2022-12-26 02:52 - 000684984 _____ (Mozilla Foundation) C:\Users\Mark\AppData\LocalLow\freebl3.dll
2022-12-26 02:52 - 2022-12-26 02:52 - 000627128 _____ (Mozilla Foundation) C:\Users\Mark\AppData\LocalLow\mozglue.dll
2022-12-26 02:52 - 2022-12-26 02:52 - 000254392 _____ (Mozilla Foundation) C:\Users\Mark\AppData\LocalLow\softokn3.dll
2022-12-25 23:57 - 2022-12-29 08:19 - 000000760 _____ C:\WINDOWS\Tasks\CCleanerCrashReporting.job
2022-12-25 23:57 - 2022-12-25 23:57 - 000003468 _____ C:\WINDOWS\system32\Tasks\CCleanerCrashReporting
2022-12-25 15:55 - 2022-12-25 15:55 - 002925482 _____ C:\Users\Mark\Downloads\xenia_canary.zip
2022-12-25 15:54 - 2022-12-25 15:55 - 017335375 _____ C:\Users\Mark\Downloads\xenia_master.zip
2022-12-25 15:48 - 2022-12-25 15:49 - 003923351 _____ C:\Users\Mark\Downloads\Pass_10101-SRV81_NewFileV3.rar
2022-12-25 02:07 - 2022-12-25 02:07 - 000000000 ____D C:\Program Files (x86)\FTU APPS
2022-12-25 00:15 - 2022-12-25 00:15 - 000000994 _____ C:\Users\Public\Desktop\AdGuard.lnk
2022-12-25 00:15 - 2022-12-25 00:15 - 000000994 _____ C:\ProgramData\Desktop\AdGuard.lnk
2022-12-25 00:14 - 2023-01-08 01:50 - 000000000 ____D C:\Program Files (x86)\Adguard
2022-12-25 00:14 - 2022-12-25 00:14 - 000001638 _____ C:\Users\Public\Desktop\AdGuard Trial Reset.lnk
2022-12-25 00:14 - 2022-12-25 00:14 - 000001638 _____ C:\ProgramData\Desktop\AdGuard Trial Reset.lnk
2022-12-25 00:14 - 2022-12-25 00:14 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AdGuard
2022-12-23 02:46 - 2022-12-23 02:46 - 000000081 _____ C:\Users\Mark\Documents\Lee Nemesis Mkt Mnemonic Key.txt
2022-12-23 02:19 - 2022-12-23 02:19 - 000000000 ____D C:\Users\Mark\AppData\Roaming\UJAM
2022-12-22 22:38 - 2023-01-10 18:17 - 000000000 ____D C:\KVRT2020_Data
2022-12-22 22:37 - 2023-01-18 10:34 - 000000000 ____D C:\Program Files\stinger
2022-12-22 22:10 - 2022-12-22 22:11 - 000010614 _____ C:\TDSSKiller.3.1.0.28_22.12.2022_22.10.41_log.txt
2022-12-21 03:04 - 2022-12-21 03:04 - 000000000 ____D C:\Users\Mark\AppData\LocalLow\Google
2022-12-21 03:03 - 2023-01-19 20:57 - 000003514 _____ C:\WINDOWS\system32\Tasks\Nafdfnasia
2022-12-21 03:03 - 2022-11-01 13:03 - 734003200 _____ (Google) C:\Users\Mark\AppData\Roaming\cmd32.exe

==================== One month (modified) ==================

(If an entry is included in the fixlist, the file/folder will be moved.)

2023-01-20 13:36 - 2021-10-20 02:24 - 001220872 _____ C:\WINDOWS\ZAM.krnl.trace
2023-01-20 13:32 - 2018-11-30 19:42 - 000000000 ____D C:\Users\Mark\AppData\Local\ClassicShell
2023-01-20 13:26 - 2018-09-15 01:33 - 000000000 ____D C:\WINDOWS\Registration
2023-01-20 13:19 - 2019-05-13 14:37 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2023-01-20 12:31 - 2021-01-07 17:56 - 000000000 ____D C:\Program Files\CCleaner
2023-01-20 12:28 - 2018-09-15 01:33 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2023-01-20 09:53 - 2018-11-30 22:04 - 000000000 ____D C:\Users\Mark\AppData\Roaming\deluge
2023-01-20 01:27 - 2022-03-06 22:01 - 000000000 ____D C:\Users\Mark\AppData\Local\CrashDumps
2023-01-20 00:53 - 2021-10-30 05:27 - 000000000 ____D C:\Users\Mark\AppData\Local\AMD
2023-01-20 00:50 - 2021-11-23 09:09 - 000000000 ____D C:\Program Files\AMD
2023-01-20 00:45 - 2022-03-30 02:15 - 000000000 ____D C:\AMD
2023-01-20 00:45 - 2021-08-04 20:52 - 000000000 ____D C:\Users\Mark\AppData\Local\AMD_Common
2023-01-20 00:14 - 2018-09-15 01:33 - 000000000 __RHD C:\Program Files\WindowsApps
2023-01-20 00:14 - 2018-09-15 01:33 - 000000000 ____D C:\WINDOWS\AppReadiness
2023-01-19 22:41 - 2019-05-02 05:29 - 000035192 _____ C:\WINDOWS\system32\BMXStateBkp-{00000005-00000000-00000000-00001102-00000008-10241102}.rfx
2023-01-19 22:41 - 2019-05-02 05:29 - 000035192 _____ C:\WINDOWS\system32\BMXState-{00000005-00000000-00000000-00001102-00000008-10241102}.rfx
2023-01-19 22:41 - 2019-05-02 05:29 - 000030000 _____ C:\WINDOWS\system32\BMXCtrlState-{00000005-00000000-00000000-00001102-00000008-10241102}.rfx
2023-01-19 22:41 - 2019-05-02 05:29 - 000030000 _____ C:\WINDOWS\system32\BMXBkpCtrlState-{00000005-00000000-00000000-00001102-00000008-10241102}.rfx
2023-01-19 22:41 - 2019-05-02 05:29 - 000011564 _____ C:\WINDOWS\system32\DVCState-{00000005-00000000-00000000-00001102-00000008-10241102}.rfx
2023-01-19 22:40 - 2022-12-14 03:04 - 000001112 _____ C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\cFosSpeed.lnk
2023-01-19 16:24 - 2018-12-15 13:42 - 000000000 ____D C:\Users\Mark\AppData\Local\ElevatedDiagnostics
2023-01-19 15:57 - 2018-11-30 19:45 - 000000000 ____D C:\Users\Mark\AppData\LocalLow\Mozilla
2023-01-19 13:09 - 2022-11-30 10:02 - 000003446 _____ C:\WINDOWS\SysWOW64\pubfreeware.ini
2023-01-19 12:31 - 2019-03-19 23:24 - 000000000 ____D C:\Users\Mark\AppData\Local\NordVPN
2023-01-19 12:24 - 2019-05-13 14:44 - 000000000 ____D C:\Users\Mark
2023-01-19 12:23 - 2019-05-13 15:11 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2023-01-19 12:22 - 2022-03-01 14:45 - 000000254 _____ C:\WINDOWS\SysWOW64\PARTIZAN.TXT
2023-01-19 09:38 - 2020-03-26 04:13 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2023-01-18 17:02 - 2018-11-30 11:27 - 000065536 _____ C:\WINDOWS\system32\spu_storage.bin
2023-01-18 17:02 - 2018-09-15 00:09 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2023-01-18 15:39 - 2019-05-13 15:11 - 000003346 _____ C:\WINDOWS\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-266282535-48708807-158023499-1001
2023-01-18 15:38 - 2019-05-13 14:44 - 000002405 _____ C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2023-01-18 13:37 - 2018-12-01 21:52 - 000000000 ____D C:\Users\Mark\AppData\Roaming\vlc
2023-01-18 13:02 - 2022-03-28 15:28 - 000000000 ____D C:\Users\Mark\AppData\Roaming\dvdcss
2023-01-18 12:26 - 2019-05-13 14:55 - 000776292 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2023-01-18 12:26 - 2018-09-15 01:31 - 000000000 ____D C:\WINDOWS\INF
2023-01-18 12:20 - 2018-09-15 00:09 - 000032768 _____ C:\WINDOWS\system32\config\ELAM
2023-01-18 10:46 - 2022-11-19 00:50 - 001280766 _____ C:\Users\Mark\Desktop\Rkill.txt
2023-01-18 05:04 - 2021-01-07 17:56 - 000004210 _____ C:\WINDOWS\system32\Tasks\CCleaner Update
2023-01-17 22:11 - 2019-05-27 02:48 - 000000000 ____D C:\Users\Mark\AppData\Roaming\MPC-BE
2023-01-17 20:54 - 2018-09-15 01:33 - 000000000 ____D C:\WINDOWS\system32\NDF
2023-01-17 09:48 - 2019-01-02 02:14 - 000000000 ____D C:\Users\Mark\AppData\Roaming\MPC-HC
2023-01-17 09:44 - 2021-01-06 17:41 - 000000000 ____D C:\Users\Mark\AppData\LocalLow\IObit
2023-01-17 09:44 - 2021-01-06 17:41 - 000000000 ____D C:\ProgramData\IObit
2023-01-17 09:44 - 2021-01-06 17:38 - 000000000 ____D C:\Users\Mark\AppData\Roaming\IObit
2023-01-16 12:15 - 2022-12-01 08:37 - 000000000 ____D C:\Users\Mark\AppData\Roaming\5KPlayer
2023-01-16 03:16 - 2018-12-13 18:47 - 000000000 ____D C:\Program Files\Recuva
2023-01-16 00:37 - 2020-01-03 22:11 - 000000000 ____D C:\WINDOWS\Minidump
2023-01-15 22:01 - 2021-12-07 20:12 - 000004138 _____ C:\WINDOWS\system32\Tasks\Opera GX scheduled Autoupdate 1638929517
2023-01-15 22:01 - 2021-12-07 20:12 - 000001460 _____ C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Opera GX Browser.lnk
2023-01-15 12:13 - 2021-01-06 17:41 - 000000000 ____D C:\Program Files (x86)\IObit
2023-01-14 10:55 - 2022-11-24 06:17 - 000003114 _____ C:\WINDOWS\system32\Tasks\Uninstaller_SkipUac_Mark
2023-01-14 10:54 - 2022-11-24 06:17 - 000001420 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IObit Uninstaller.lnk
2023-01-14 10:54 - 2022-11-24 06:17 - 000001408 _____ C:\Users\Public\Desktop\IObit Uninstaller.lnk
2023-01-14 10:54 - 2022-11-24 06:17 - 000001408 _____ C:\ProgramData\Desktop\IObit Uninstaller.lnk
2023-01-14 10:54 - 2022-11-24 06:17 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IObit Uninstaller
2023-01-14 08:46 - 2022-02-09 02:30 - 000000000 ____D C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38
2023-01-13 03:29 - 2022-11-01 04:02 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gigabyte
2023-01-13 03:23 - 2021-06-26 08:30 - 000000000 ____D C:\Program Files (x86)\GIGABYTE
2023-01-13 03:16 - 2022-03-30 00:01 - 000000000 ___HD C:\Program Files (x86)\Temp
2023-01-13 03:15 - 2022-12-10 20:29 - 000000000 ____D C:\WINDOWS\LastGood
2023-01-13 03:13 - 2018-12-16 23:36 - 000000000 ____D C:\Users\Mark\AppData\Local\D3DSCache
2023-01-12 15:27 - 2021-12-13 03:54 - 000003576 _____ C:\WINDOWS\system32\Tasks\OneDrive Reporting Task-S-1-5-21-266282535-48708807-158023499-1001
2023-01-12 15:17 - 2021-01-06 17:42 - 000000000 ____D C:\ProgramData\ProductData
2023-01-10 15:16 - 2018-12-01 17:00 - 000000000 ____D C:\ProgramData\Packages
2023-01-10 15:16 - 2018-11-30 12:50 - 000000000 ____D C:\Users\Mark\AppData\Local\Packages
2023-01-10 14:57 - 2022-03-22 15:55 - 000000000 ____D C:\ProgramData\Piriform
2023-01-10 14:07 - 2019-08-09 22:41 - 000000000 ____D C:\Users\Mark\AppData\Roaming\AIMP
2023-01-10 14:03 - 2022-11-14 09:45 - 000000000 ____D C:\Users\Mark\Downloads\FireShot
2023-01-10 00:47 - 2022-05-03 08:52 - 000000000 ____D C:\Program Files\Mozilla Firefox
2023-01-10 00:47 - 2018-11-30 19:45 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2023-01-10 00:25 - 2022-12-12 02:36 - 000000000 ____D C:\WINDOWS\system32\Tasks\Mozilla
2023-01-10 00:25 - 2018-11-30 19:45 - 000000965 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2023-01-09 17:37 - 2018-12-13 18:46 - 000000000 ____D C:\Program Files (x86)\Google
2023-01-09 15:47 - 2018-11-30 19:42 - 000000000 ____D C:\Program Files\Classic Shell
2023-01-09 15:34 - 2019-04-29 19:00 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Creative
2023-01-09 15:05 - 2021-06-06 21:07 - 000002198 _____ C:\Users\Public\Desktop\Microsoft Edge.lnk
2023-01-09 15:05 - 2021-06-06 21:07 - 000002198 _____ C:\ProgramData\Desktop\Microsoft Edge.lnk
2023-01-09 15:03 - 2021-12-07 20:12 - 000001323 _____ C:\Users\Mark\Desktop\Opera GX Browser.lnk
2023-01-09 15:03 - 2019-05-06 10:34 - 000000996 _____ C:\Users\Public\Desktop\Firefox.lnk
2023-01-09 15:03 - 2019-05-06 10:34 - 000000996 _____ C:\ProgramData\Desktop\Firefox.lnk
2023-01-09 07:20 - 2021-10-20 02:24 - 000000000 ____D C:\Users\Mark\AppData\Local\AMSDK
2023-01-09 02:30 - 2019-05-27 01:39 - 000000000 ____D C:\Program Files\PeerBlock
2023-01-08 00:33 - 2020-10-20 21:24 - 000000000 ____D C:\WINDOWS\system32\AMD
2023-01-06 22:00 - 2022-01-26 00:37 - 000000000 ____D C:\Users\Mark\AppData\Local\UnHackMe
2023-01-06 12:00 - 2022-03-27 21:40 - 000000000 ____D C:\ESD
2023-01-06 01:17 - 2022-12-11 04:19 - 000000000 ____D C:\WINDOWS\Panther
2023-01-04 09:04 - 2021-12-30 02:09 - 000003004 _____ C:\WINDOWS\system32\Tasks\Optimize Push Notification Data File-S-1-5-21-266282535-48708807-158023499-1001
2023-01-04 02:56 - 2020-08-10 11:25 - 000000002 _____ C:\Users\Mark\AppData\Roaming\ExplorerFavorites.txt
2023-01-04 02:53 - 2020-08-10 08:35 - 000000000 ____D C:\Users\Mark\Documents\ACID Pro Projects
2023-01-04 01:07 - 2022-09-24 18:06 - 000000000 ____D C:\Users\Mark\Downloads\Arturia
2023-01-04 01:07 - 2020-08-10 11:09 - 000021040 _____ C:\Users\Mark\AppData\Roaming\plugin_scan_state_VST3_x64.scan
2023-01-04 01:04 - 2020-08-10 11:09 - 000006518 _____ C:\Users\Mark\AppData\Roaming\plugin_scan_state_VST2_x64.scan
2023-01-04 01:04 - 2020-08-10 08:36 - 000005662 _____ C:\Users\Mark\AppData\Roaming\plugin_scan_state_VST3_x32.scan
2023-01-04 01:04 - 2020-08-10 08:36 - 000004558 _____ C:\Users\Mark\AppData\Roaming\plugin_scan_state_VST2_x32.scan
2023-01-03 05:07 - 2019-03-19 23:26 - 000000000 ____D C:\ProgramData\NordVpn
2023-01-02 22:47 - 2022-12-07 03:33 - 000000000 ____D C:\Program Files\XLN Audio
2023-01-02 22:47 - 2022-03-04 04:25 - 000000000 ____D C:\Users\Mark\Documents\Addictive Drums 2
2023-01-02 22:47 - 2022-01-26 02:53 - 000000000 ____D C:\ProgramData\XLN Audio
2023-01-02 01:41 - 2019-04-03 23:12 - 000000000 ____D C:\Users\Mark\AppData\Local\Mullvad VPN
2023-01-01 05:30 - 2018-09-15 01:23 - 000000000 ____D C:\WINDOWS\CbsTemp
2022-12-31 05:10 - 2022-12-07 03:34 - 000000000 ____D C:\Users\Mark\Documents\XLN Online Installer
2022-12-31 05:10 - 2022-01-26 02:57 - 000000000 ____D C:\Users\Mark\Documents\Addictive Drums 2 Logs
2022-12-31 04:55 - 2022-01-26 02:57 - 000000000 ____D C:\ProgramData\boost_interprocess
2022-12-31 02:08 - 2021-03-01 23:38 - 000000000 ____D C:\Users\Mark\Documents\Peace backup
2022-12-30 04:07 - 2020-12-05 01:21 - 000000000 ____D C:\Users\Mark\AppData\Roaming\Lavasoft
2022-12-30 04:07 - 2020-12-05 01:21 - 000000000 ____D C:\Users\Mark\AppData\Local\Lavasoft
2022-12-30 04:07 - 2020-12-05 01:21 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
2022-12-30 04:07 - 2020-12-05 01:21 - 000000000 ____D C:\ProgramData\Lavasoft
2022-12-29 08:37 - 2019-05-06 12:41 - 000001835 _____ C:\Users\Mark\Desktop\Peace.lnk
2022-12-26 03:12 - 2018-11-30 11:28 - 000000000 ____D C:\ProgramData\Package Cache
2022-12-26 02:54 - 2018-12-22 15:42 - 000000000 ____D C:\Program Files (x86)\Steam
2022-12-24 01:13 - 2022-10-09 19:23 - 000000000 ____D C:\Users\Mark\AppData\Local\Battle.net
2022-12-23 02:38 - 2020-09-04 00:40 - 000000000 ____D C:\Users\Mark\AppData\Roaming\PositiveGrid
2022-12-23 02:34 - 2019-01-04 07:41 - 000001118 _____ C:\Users\Mark\Desktop\Start Tor Browser.lnk

==================== Files in the root of some directories ========

2022-06-13 01:35 - 2022-06-13 01:35 - 000000228 _____ () C:\ProgramData\fontcacheev1.dat
2021-05-23 04:31 - 2022-03-20 17:56 - 000000000 _____ () C:\Program Files (x86)\temp_files
2022-01-17 10:26 - 2022-01-17 10:26 - 000248887 ___SH () C:\Users\Mark\AppData\Roaming\aseuuhi
2018-12-21 23:15 - 2018-12-21 23:15 - 000002292 _____ () C:\Users\Mark\AppData\Roaming\ASSDraw3.cfg
2021-05-30 01:39 - 2021-05-30 01:39 - 000000068 _____ () C:\Users\Mark\AppData\Roaming\changzhi_leidian.data
2022-12-21 03:03 - 2022-11-01 13:03 - 734003200 _____ (Google) C:\Users\Mark\AppData\Roaming\cmd32.exe
2020-02-09 17:02 - 2020-02-09 17:02 - 000000447 ___SH () C:\Users\Mark\AppData\Roaming\d.vbs
2022-01-17 10:26 - 2022-01-17 10:26 - 000064704 ___SH (Microsoft Corporation) C:\Users\Mark\AppData\Roaming\deuafii
2018-09-15 01:28 - 2018-09-15 01:28 - 000320181 ___SH () C:\Users\Mark\AppData\Roaming\dweshci
2021-10-20 14:32 - 2022-10-09 19:09 - 000012288 _____ () C:\Users\Mark\AppData\Roaming\EMP.del
2020-08-10 11:25 - 2023-01-04 02:56 - 000000002 _____ () C:\Users\Mark\AppData\Roaming\ExplorerFavorites.txt
2019-04-08 13:40 - 2019-04-08 13:40 - 000000338 ___SH () C:\Users\Mark\AppData\Roaming\h.vbs
2022-12-26 02:59 - 2022-12-26 02:59 - 000005234 _____ () C:\Users\Mark\AppData\Roaming\H35c27gu.exe
2020-08-10 08:35 - 2022-03-03 02:38 - 000000032 _____ () C:\Users\Mark\AppData\Roaming\msregsvv.dll
2021-12-16 09:20 - 2021-12-16 09:22 - 000032768 _____ () C:\Users\Mark\AppData\Roaming\pc-remote-data.db
2020-08-10 08:36 - 2023-01-04 01:04 - 000004558 _____ () C:\Users\Mark\AppData\Roaming\plugin_scan_state_VST2_x32.scan
2020-08-10 11:09 - 2023-01-04 01:04 - 000006518 _____ () C:\Users\Mark\AppData\Roaming\plugin_scan_state_VST2_x64.scan
2020-08-10 08:36 - 2023-01-04 01:04 - 000005662 _____ () C:\Users\Mark\AppData\Roaming\plugin_scan_state_VST3_x32.scan
2020-08-10 11:09 - 2023-01-04 01:07 - 000021040 _____ () C:\Users\Mark\AppData\Roaming\plugin_scan_state_VST3_x64.scan
2022-12-26 02:59 - 2022-12-26 02:59 - 000005234 _____ () C:\Users\Mark\AppData\Roaming\qEdJzM2d.exe
2021-05-23 04:25 - 2021-05-23 04:25 - 000000116 _____ () C:\Users\Mark\AppData\Roaming\Y9QuxeJCZGmxxOGMOV2sEXu9.exe
2018-12-15 04:45 - 2018-12-15 04:45 - 000003584 _____ () C:\Users\Mark\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2022-03-15 22:16 - 2022-03-20 17:53 - 000000128 _____ () C:\Users\Mark\AppData\Local\PUTTY.RND
2022-12-17 19:43 - 2022-12-17 19:43 - 000000218 _____ () C:\Users\Mark\AppData\Local\recently-used.xbel
2020-10-15 02:03 - 2022-11-22 20:18 - 000007642 _____ () C:\Users\Mark\AppData\Local\resmon.resmoncfg

==================== SigCheck ============================

(There is no automatic fix for files that do not pass verification.)

==================== End of FRST.txt ========================