can't get rid of Trojans: Wacatac.B!ml and Phonzy.B!ml

Nothing in the last fixlist should have caused those symptoms. Please do this.

===================================================

Reverting to Previous System Restore Point - Windows 10

--------------------

• Disable your antivirus program
• Click Start, type rstrui then select Run as administrator
• Click Next
• Select the Restore Point dated 28-02-2024 09:13:46
• Click Next, then Finish
• Allow the process to complete and your computer will reboot
• Once completed let me know if you are able to access Windows Defender

===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.

• Results?

I don't seem to be able to disable Defender due to the issue described above.  I went ahead and tried to follow instructions for the restore anyway but get a message stating "no restore points have been created".   Maybe that is because Defender is still enabled? 

 

Not sure if related but of note, but I now see 2 Defender icons on my taskbar.  One has a green check mark and when I hover over it it says: "Windows Security-no action needed).  The other icon is the same but with no green check mark and it is labeled:  "Microsoft Defender".  In "my apps" it tells me that Defender was downloaded on 2/25/24 which would have been in the middle of all this.  I don't recall downloading the App so not sure if this was something automatic with Windows.  I hope I haven't made things worse!

Let's regroup. Please run a new FRST scan and copy/paste both reports in your reply.

Thank you for continuing to help. Here are the requested reports.

 

------

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 26.02.2024 01
Ran by jenfr (administrator) on XPS15 (Dell Inc. XPS 15 9520) (02-03-2024 13:57:23)
Running from C:\Users\jenfr\Downloads\FRST64.exe
Loaded Profiles: jenfr
Platform: Microsoft Windows 11 Home Version 23H2 22631.3235 (X64) Language: English (United States)
Default browser: FF
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAService.exe ->) (Intel Corporation -> Intel) C:\Program Files (x86)\Intel\Driver and Support Assistant\DSATray.exe
(C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe ->) (Malwarebytes Inc. -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\rundll32.exe
(drivers\RivetNetworks\Killer\KNDBWMService.exe ->) (Intel Corporation -> Intel® Corporation) C:\Windows\System32\drivers\RivetNetworks\Killer\KNDBWM.exe
(DriverStore\FileRepository\ipf_cpu.inf_amd64_07e81e065fff923d\ipf_uf.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\ipf_cpu.inf_amd64_07e81e065fff923d\ipf_helper.exe
(explorer.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft OneDrive\OneDrive.exe
(explorer.exe ->) (Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe <13>
(NVIDIA Corporation -> Node.js) C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe
(services.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
(services.exe ->) (Dell Inc -> ) C:\Program Files (x86)\Dell\UpdateService\ServiceShell.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\dal.inf_amd64_af50fdb80983f7bc\jhi_service.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\dtt_sw.inf_amd64_3ea1838906a8645a\ipfsvc.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iastorvd.inf_amd64_346bd04e375689ec\RstMwService.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_734897ab1d4f1106\IntelCpHDCPSvc.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\ipf_cpu.inf_amd64_07e81e065fff923d\ipf_uf.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\mewmiprov.inf_amd64_ab7d4ea1d12c01d4\WMIRegistrationService.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\piecomponent.inf_amd64_90ff6c7fe29f9dcf\Intel_PIE_Service.exe
(services.exe ->) (Intel Corporation -> Intel) C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAService.exe
(services.exe ->) (Intel Corporation -> Intel) C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAUpdateService.exe
(services.exe ->) (Intel Corporation -> Intel) C:\Windows\System32\drivers\RivetNetworks\Killer\KillerAnalyticsService.exe
(services.exe ->) (Intel Corporation -> Intel) C:\Windows\System32\drivers\RivetNetworks\Killer\KillerNetworkService.exe
(services.exe ->) (Intel Corporation -> Intel) C:\Windows\System32\DriverStore\FileRepository\intcoed.inf_amd64_29fd1afabcf5470c\AS\IAS\IntelAudioService.exe
(services.exe ->) (Intel Corporation -> Intel® Corporation) C:\Windows\System32\drivers\RivetNetworks\Killer\KNDBWMService.exe
(services.exe ->) (Malwarebytes Inc. -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24010.12-0\MsMpEng.exe
(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24010.12-0\NisSrv.exe
(services.exe ->) (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe <2>
(services.exe ->) (NVIDIA Corporation -> NVIDIA Corporation) C:\Windows\System32\DriverStore\FileRepository\nvdmi.inf_amd64_3fdff41f99f01256\Display.NvContainer\NVDisplay.Container.exe <2>
(services.exe ->) (Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Windows\System32\DriverStore\FileRepository\realtekservice.inf_amd64_04ff63d068f8c626\RtkAudUService64.exe <3>
(services.exe ->) (Shenzhen Goodix Technology Co., Ltd. -> Goodix) C:\Windows\System32\drivers\GoodixSessionService.exe
(services.exe ->) (Texas Instruments Inc. -> Texas Instuments) C:\Windows\System32\TISmartAmpService.exe <2>
(services.exe ->) (Waves Inc -> Waves Audio Ltd) C:\Windows\System32\DriverStore\FileRepository\wavesapo11de.inf_amd64_d4eabf4492fbb4d5\WavesAudioService.exe
(services.exe ->) (Waves Inc -> Waves Audio Ltd.) C:\Windows\System32\DriverStore\FileRepository\wavesapo11de.inf_amd64_d4eabf4492fbb4d5\WavesSysSvc64.exe
(sihost.exe ->) (EB51A5DA-0E72-4863-82E4-EA21C1F8DFE3 -> Intel Corporation) C:\Program Files\WindowsApps\AppUp.IntelGraphicsExperience_1.100.5336.0_x64__8j3eq9eme6ctt\GCP.ML.BackgroundSysTray\IGCCTray.exe
(sihost.exe ->) (Microsoft Corporation -> ) C:\Program Files\WindowsApps\Microsoft.6365217CE6EB4_102.2402.13002.0_x64__8wekyb3d8bbwe\MicrosoftSecurityApp\MicrosoftSecurityApp.exe
(svchost.exe ->) (Microsoft Windows -> ) C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_424.1301.170.0_x64__cw5n1h2txyewy\Dashboard\WidgetService.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\wlanext.exe

==================== Registry (Whitelisted) ===================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtkAudUService] => C:\WINDOWS\System32\DriverStore\FileRepository\realtekservice.inf_amd64_04ff63d068f8c626\RtkAudUService64.exe [1961360 2023-11-02] (Realtek Semiconductor Corp. -> Realtek Semiconductor)
HKLM\...\Run: [WavesSvc] => C:\WINDOWS\System32\DriverStore\FileRepository\wavesapo11de.inf_amd64_d4eabf4492fbb4d5\WavesSvc64.exe [5147784 2023-04-26] (Waves Inc -> Waves Audio Ltd.)
HKLM-x32\...\Run: [I17A] => C:\WINDOWS\twain_32\Brimi17a\Common\TwDsUiLaunch.exe [86128 2020-03-25] (Microsoft Windows Hardware Compatibility Publisher -> )
HKLM-x32\...\Run: [ControlCenter4] => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [145344 2019-07-26] (Brother Industries, Ltd. -> Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrotherSoftwareUpdateNotification] => C:\Program Files (x86)\Brother\SoftwareUpdateNotification\SoftwareUpdateNotificationService.exe [3591168 2022-10-09] (Brother Industries, Ltd.) [File not signed]
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [3146752 2022-02-07] (Brother Industries, Ltd.) [File not signed]
HKU\S-1-5-19\...\Run: [GoogleDriveFS] => C:\Program Files\Google\Drive File Stream\87.0.2.0\GoogleDriveFS.exe [59681568 2024-02-26] (Google LLC -> Google, Inc.)
HKU\S-1-5-20\...\Run: [GoogleDriveFS] => C:\Program Files\Google\Drive File Stream\87.0.2.0\GoogleDriveFS.exe [59681568 2024-02-26] (Google LLC -> Google, Inc.)
HKU\S-1-5-21-883358396-3808688255-3020804061-1001\...\Run: [OneDrive] => C:\Program Files\Microsoft OneDrive\OneDrive.exe [2598328 2024-02-14] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-883358396-3808688255-3020804061-1001\...\Run: [MicrosoftEdgeAutoLaunch_D3A6C3E91BD871936DC5E531BD1851E5] => "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start [4060728 2024-02-27] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-883358396-3808688255-3020804061-1001\...\Run: [GoogleDriveFS] => C:\Program Files\Google\Drive File Stream\87.0.2.0\GoogleDriveFS.exe [59681568 2024-02-26] (Google LLC -> Google, Inc.)
HKU\S-1-5-21-883358396-3808688255-3020804061-1002\...\Run: [OneDrive] => C:\Program Files\Microsoft OneDrive\OneDrive.exe [2598328 2024-02-14] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-883358396-3808688255-3020804061-1002\...\Run: [GoogleDriveFS] => C:\Program Files\Google\Drive File Stream\87.0.2.0\GoogleDriveFS.exe [59681568 2024-02-26] (Google LLC -> Google, Inc.)
HKU\S-1-5-21-883358396-3808688255-3020804061-1002\...\Run: [MicrosoftEdgeAutoLaunch_B14DBBE1EF03929244E921C90BE13BF3] => "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start [4060728 2024-02-27] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-883358396-3808688255-3020804061-1003\...\Run: [OneDrive] => C:\Program Files\Microsoft OneDrive\OneDrive.exe [2598328 2024-02-14] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-883358396-3808688255-3020804061-1003\...\Run: [GoogleDriveFS] => C:\Program Files\Google\Drive File Stream\87.0.2.0\GoogleDriveFS.exe [59681568 2024-02-26] (Google LLC -> Google, Inc.)
HKU\S-1-5-21-883358396-3808688255-3020804061-1003\...\Run: [MicrosoftEdgeAutoLaunch_840607CA24A5D0C24227941372696879] => "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start [4060728 2024-02-27] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-18\...\Run: [GoogleDriveFS] => C:\Program Files\Google\Drive File Stream\87.0.2.0\GoogleDriveFS.exe [59681568 2024-02-26] (Google LLC -> Google, Inc.)
Startup: C:\Users\jenfr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DDM2.0.lnk [2023-05-12]
ShortcutTarget: DDM2.0.lnk -> C:\Program Files\Dell\Dell Display Manager 2\DDM.exe (Qisda Corporation -> Dell Inc.)
Startup: C:\Users\jenfr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk [2024-02-11]
ShortcutTarget: Send to OneNote.lnk -> C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE (Microsoft Corporation -> Microsoft Corporation)

==================== Scheduled Tasks (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {3227B638-B8A6-40A8-83AD-794C71C7F449} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1547208 2024-01-31] (Adobe Inc. -> Adobe Inc.)
Task: {5D041810-97D2-4EA6-934E-1733CC0BB845} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [155592 2023-05-17] (Google LLC -> Google LLC)
Task: {55BE7223-3F37-446B-895E-25F560226D1C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [155592 2023-05-17] (Google LLC -> Google LLC)
Task: {78364180-D466-4D18-BFD1-DBBD2156E348} - System32\Tasks\Microsoft\Office\Office Automatic Updates 2.0 => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [28372672 2024-02-10] (Microsoft Corporation -> Microsoft Corporation)
Task: {2B0474E3-839C-471B-A191-F35E2FB21983} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [28372672 2024-02-10] (Microsoft Corporation -> Microsoft Corporation)
Task: {D8BE30A7-1D86-46AC-B9E5-B0B696A70622} - System32\Tasks\Microsoft\Office\Office Feature Updates => C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [306328 2024-02-17] (Microsoft Corporation -> Microsoft Corporation)
Task: {FF03F752-5B41-4D45-BB3A-141849404F20} - System32\Tasks\Microsoft\Office\Office Feature Updates Logon => C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [306328 2024-02-17] (Microsoft Corporation -> Microsoft Corporation)
Task: {4598E73D-40C9-4C4B-BC23-44F17B6099A3} - System32\Tasks\Microsoft\Office\Office Performance Monitor => C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\operfmon.exe [170128 2024-02-04] (Microsoft Corporation -> Microsoft Corporation)
Task: {66CB7C8F-04EA-41B8-B837-42CC3DD57E9C} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24010.12-0\MpCmdRun.exe [1646000 2024-02-27] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {54DA7AEA-1176-43D3-B7D5-DEDDECC1B751} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24010.12-0\MpCmdRun.exe [1646000 2024-02-27] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {6FF413C1-F25A-4B39-81FC-EC349FA6BFB1} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24010.12-0\MpCmdRun.exe [1646000 2024-02-27] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {810900A4-6BD4-4648-A2B0-9ABB2F9DFAAB} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24010.12-0\MpCmdRun.exe [1646000 2024-02-27] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {08221277-2463-4F39-A88D-27DD758F6523} - System32\Tasks\Mozilla\Firefox Background Update 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\firefox.exe [671136 2024-02-20] (Mozilla Corporation -> Mozilla Corporation) -> --MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask backgroundupdate
Task: {06AA380A-0732-42CD-AECD-9FDE5C07F53B} - System32\Tasks\Mozilla\Firefox Background Update S-1-5-21-883358396-3808688255-3020804061-1001 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\firefox.exe [671136 2024-02-20] (Mozilla Corporation -> Mozilla Corporation) -> --MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask backgroundupdate
Task: {42295D81-B8C7-4D66-A5D8-01484F43218C} - System32\Tasks\Mozilla\Firefox Background Update S-1-5-21-883358396-3808688255-3020804061-1002 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\firefox.exe [671136 2024-02-20] (Mozilla Corporation -> Mozilla Corporation) -> --MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask backgroundupdate
Task: {258934B9-7825-4AA6-A94F-7312412CEE8C} - System32\Tasks\Mozilla\Firefox Background Update S-1-5-21-883358396-3808688255-3020804061-1003 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\firefox.exe [671136 2024-02-20] (Mozilla Corporation -> Mozilla Corporation) -> --MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask backgroundupdate
Task: {7C9F7FB2-81F4-4728-97AE-2E26E3343781} - System32\Tasks\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\default-browser-agent.exe [34720 2024-02-20] (Mozilla Corporation -> Mozilla Foundation)
Task: {F1A59870-76DB-457E-BE36-F6EC820CF2DD} - System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [1005096 2023-11-01] (NVIDIA Corporation -> NVIDIA Corporation) -> -d "C:\Program Files\NVIDIA Corporation\NvDriverUpdateCheck" -l 3 -f C:\ProgramData\NVIDIA\NvContainerDriverUpdateCheck.log
Task: {D8A2D1A8-0426-4529-95C1-980B4EEBE8E7} - System32\Tasks\NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA GeForce Experience.exe [3345448 2023-11-01] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {6D823D0B-EBD3-4D17-8C2D-2ABCBB0397B4} - System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe [649256 2023-11-01] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {03304366-E18E-4CAD-866E-AAFFC3023C20} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [910888 2023-11-01] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {9264D698-301E-4F03-A98E-F77097BEC79D} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [910888 2023-11-01] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {CF68D83A-4ADF-4D7F-9855-22F25E59CE36} - System32\Tasks\NvTmRep_CrashReport1_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvBackend\NvTmRep.exe [1665064 2023-11-01] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {DFB335BD-4FCA-4120-AC32-16E7CAF82D47} - System32\Tasks\NvTmRep_CrashReport2_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvBackend\NvTmRep.exe [1665064 2023-11-01] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {1AC51A07-219D-4E05-84A5-6F050B031A66} - System32\Tasks\NvTmRep_CrashReport3_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvBackend\NvTmRep.exe [1665064 2023-11-01] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {14A0A089-09ED-4D19-8BE5-EE35F7FAF597} - System32\Tasks\NvTmRep_CrashReport4_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvBackend\NvTmRep.exe [1665064 2023-11-01] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {4B602E62-3A48-4691-B9CC-3D333CC6B0AC} - System32\Tasks\OneDrive Per-Machine Standalone Update Task => C:\Program Files\Microsoft OneDrive\OneDriveStandaloneUpdater.exe [4130320 2024-02-14] (Microsoft Corporation -> Microsoft Corporation)
Task: {EA08AD32-FC12-4C80-9921-73622163C669} - System32\Tasks\OneDrive Reporting Task-S-1-5-21-883358396-3808688255-3020804061-1001 => C:\Program Files\Microsoft OneDrive\OneDriveStandaloneUpdater.exe [4130320 2024-02-14] (Microsoft Corporation -> Microsoft Corporation)
Task: {3C7D0F7F-2F3A-4443-AE9C-7972F1B9DFF8} - System32\Tasks\OneDrive Reporting Task-S-1-5-21-883358396-3808688255-3020804061-1002 => C:\Program Files\Microsoft OneDrive\OneDriveStandaloneUpdater.exe [4130320 2024-02-14] (Microsoft Corporation -> Microsoft Corporation)
Task: {79BBF1F3-49F2-46A0-8B73-B12C3404B006} - System32\Tasks\OneDrive Reporting Task-S-1-5-21-883358396-3808688255-3020804061-1003 => C:\Program Files\Microsoft OneDrive\OneDriveStandaloneUpdater.exe [4130320 2024-02-14] (Microsoft Corporation -> Microsoft Corporation)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{76675811-5d92-43df-8de8-79eb90cacd06}: [NameServer] 1.1.1.1,1.0.0.1
Tcpip\..\Interfaces\{76675811-5d92-43df-8de8-79eb90cacd06}: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{76675811-5d92-43df-8de8-79eb90cacd06}: [DhcpDomain] attlocal.net
Tcpip\..\Interfaces\{76675811-5d92-43df-8de8-79eb90cacd06}\14E6F64697E6560234F666665656D2745756374775966496: [NameServer] 1.1.1.1,1.0.0.1
Tcpip\..\Interfaces\{76675811-5d92-43df-8de8-79eb90cacd06}\14E6F64697E6560234F666665656D2745756374775966496: [DhcpNameServer] 10.5.50.1
Tcpip\..\Interfaces\{76675811-5d92-43df-8de8-79eb90cacd06}\36F6C65636479667F6: [NameServer] 1.1.1.1,1.0.0.1
Tcpip\..\Interfaces\{76675811-5d92-43df-8de8-79eb90cacd06}\36F6C65636479667F6: [DhcpNameServer] 208.67.222.123 208.67.220.123
Tcpip\..\Interfaces\{76675811-5d92-43df-8de8-79eb90cacd06}\36F6C65636479667F6: [DhcpDomain] localdomain
Tcpip\..\Interfaces\{76675811-5d92-43df-8de8-79eb90cacd06}\64C6168756E686F6666623E243: [NameServer] 1.1.1.1,1.0.0.1
Tcpip\..\Interfaces\{76675811-5d92-43df-8de8-79eb90cacd06}\64C6168756E686F6666623E243: [DhcpNameServer] 192.168.48.1
Tcpip\..\Interfaces\{76675811-5d92-43df-8de8-79eb90cacd06}\64C6168756E686F6666623E243: [DhcpDomain] attlocal.net
Tcpip\..\Interfaces\{76675811-5d92-43df-8de8-79eb90cacd06}\D405C475942554C4543535: [NameServer] 1.1.1.1,1.0.0.1
Tcpip\..\Interfaces\{76675811-5d92-43df-8de8-79eb90cacd06}\D405C475942554C4543535: [DhcpNameServer] 10.101.8.10
Tcpip\..\Interfaces\{76675811-5d92-43df-8de8-79eb90cacd06}\D405C475942554C4543535: [DhcpDomain] mpl.org

Edge:
=======
Edge Profile: C:\Users\jenfr\AppData\Local\Microsoft\Edge\User Data\Default [2024-02-26]
Edge Extension: (Google Docs Offline) - C:\Users\jenfr\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2023-09-06]
Edge Extension: (Edge relevant text changes) - C:\Users\jenfr\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha [2024-02-26]

FireFox:
========
FF DefaultProfile: usi9fye1.default
FF ProfilePath: C:\Users\jenfr\AppData\Roaming\Mozilla\Firefox\Profiles\usi9fye1.default [2024-02-28]
FF ProfilePath: C:\Users\jenfr\AppData\Roaming\Mozilla\Firefox\Profiles\5iw0amtv.default-release [2024-03-02]
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL [2024-02-04] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin: Adobe Acrobat -> C:\Program Files\Adobe\Acrobat DC\Acrobat\Air\nppdf32.dll [2024-02-10] (Adobe Inc. -> Adobe Systems Inc.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\NPSPWRAP.DLL [2024-02-04] (Microsoft Corporation -> Microsoft Corporation)

==================== Services (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdobeARMservice; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [172992 2024-01-31] (Adobe Inc. -> Adobe Inc.)
S3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [321536 2022-01-26] (Brother Industries, Ltd.) [File not signed]
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [14048768 2024-02-10] (Microsoft Corporation -> Microsoft Corporation)
R2 DellClientManagementService; C:\Program Files (x86)\Dell\UpdateService\ServiceShell.exe [49880 2023-10-26] (Dell Inc -> )
R2 dptftcs; C:\WINDOWS\System32\DriverStore\FileRepository\dtt_sw.inf_amd64_3ea1838906a8645a\ipfsvc.exe [546416 2022-12-19] (Intel Corporation -> Intel Corporation)
R2 DSAService; C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAService.exe [43784 2023-09-25] (Intel Corporation -> Intel)
R3 DSAUpdateService; C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAUpdateService.exe [240392 2023-09-25] (Intel Corporation -> Intel)
S3 FileSyncHelper; C:\Program Files\Microsoft OneDrive\24.020.0128.0003\FileSyncHelper.exe [3515936 2024-02-14] (Microsoft Corporation -> Microsoft Corporation)
S2 Intel® Platform License Manager Service; C:\WINDOWS\System32\DriverStore\FileRepository\iclsclient.inf_amd64_fc84dfa25a6a7727\lib\PlatformLicenseManagerService.exe [741488 2023-12-14] (Intel Corporation -> Intel® Corporation)
R2 IntelAudioService; C:\WINDOWS\System32\DriverStore\FileRepository\intcoed.inf_amd64_29fd1afabcf5470c\AS\IAS\IntelAudioService.exe [530520 2023-10-18] (Intel Corporation -> Intel)
R2 ipfsvc; C:\WINDOWS\System32\DriverStore\FileRepository\ipf_cpu.inf_amd64_07e81e065fff923d\ipf_uf.exe [2781312 2022-12-13] (Intel Corporation -> Intel Corporation)
S3 KAPSService; C:\WINDOWS\System32\drivers\RivetNetworks\Killer\KAPSService.exe [78088 2023-07-13] (Intel Corporation -> Intel® Corporation)
R2 Killer Analytics Service; C:\WINDOWS\System32\drivers\RivetNetworks\Killer\KillerAnalyticsService.exe [2480944 2023-07-13] (Intel Corporation -> Intel)
R2 Killer Network Service; C:\WINDOWS\System32\drivers\RivetNetworks\Killer\KillerNetworkService.exe [2981168 2023-07-13] (Intel Corporation -> Intel)
R3 KNDBWM; C:\WINDOWS\System32\drivers\RivetNetworks\Killer\KNDBWMService.exe [78128 2023-07-13] (Intel Corporation -> Intel® Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [9410296 2024-01-29] (Malwarebytes Inc. -> Malwarebytes)
R2 NVDisplay.ContainerLocalSystem; C:\WINDOWS\System32\DriverStore\FileRepository\nvdmi.inf_amd64_3fdff41f99f01256\Display.NvContainer\NVDisplay.Container.exe [1274992 2024-02-17] (NVIDIA Corporation -> NVIDIA Corporation)
S3 OneDrive Updater Service; C:\Program Files\Microsoft OneDrive\24.020.0128.0003\OneDriveUpdaterService.exe [3853856 2024-02-14] (Microsoft Corporation -> Microsoft Corporation)
R2 SessionSvc; C:\WINDOWS\System32\drivers\GoodixSessionService.exe [45344 2023-12-15] (Shenzhen Goodix Technology Co., Ltd. -> Goodix)
R2 TISmartAmpService; C:\WINDOWS\System32\TISmartAmpService.exe [537344 2022-02-07] (Texas Instruments Inc. -> Texas Instuments)
R2 WavesAudioService; C:\WINDOWS\System32\DriverStore\FileRepository\wavesapo11de.inf_amd64_d4eabf4492fbb4d5\WavesAudioService.exe [160904 2023-04-26] (Waves Inc -> Waves Audio Ltd)
R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24010.12-0\NisSrv.exe [3191256 2024-02-27] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24010.12-0\MsMpEng.exe [133576 2024-02-27] (Microsoft Windows Publisher -> Microsoft Corporation)

===================== Drivers (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 DellInstrumentation; C:\WINDOWS\System32\drivers\DellInstrumentation.sys [46528 2023-03-14] (Microsoft Windows Hardware Compatibility Publisher -> Dell)
S3 DellPairDriver; C:\WINDOWS\System32\drivers\DellPairDriver.sys [74136 2022-12-05] (IndiLogic LLC -> Dell Inc.)
R1 googledrivefs31357; C:\WINDOWS\System32\DriverStore\FileRepository\googledrivefs31357.inf_amd64_a8bf31a168cf7d00\googledrivefs31357.sys [384712 2023-11-01] (Microsoft Windows Hardware Compatibility Publisher -> Google, Inc.)
R3 iaLPSS2_GPIO2_ADL; C:\WINDOWS\System32\DriverStore\FileRepository\ialpss2_gpio2_adl.inf_amd64_5559a053c66c287c\iaLPSS2_GPIO2_ADL.sys [139928 2021-12-09] (Intel Corporation -> Intel Corporation)
R3 iaLPSS2_I2C_ADL; C:\WINDOWS\System32\DriverStore\FileRepository\ialpss2_i2c_adl.inf_amd64_1c06c20c35bb4d6d\iaLPSS2_I2C_ADL.sys [209552 2021-12-09] (Intel Corporation -> Intel Corporation)
S3 iaLPSS2_SPI_ADL; C:\WINDOWS\System32\DriverStore\FileRepository\ialpss2_spi_adl.inf_amd64_cffe3669158cf91b\iaLPSS2_SPI_ADL.sys [160920 2021-12-09] (Intel Corporation -> Intel Corporation)
S3 iaLPSS2_UART2_ADL; C:\WINDOWS\System32\DriverStore\FileRepository\ialpss2_uart2_adl.inf_amd64_a12d81aa08d530a8\iaLPSS2_UART2_ADL.sys [318616 2021-12-09] (Intel Corporation -> Intel Corporation)
R0 iaStorVD; C:\WINDOWS\System32\drivers\iaStorVD.sys [1605296 2022-09-16] (Intel Corporation -> Intel Corporation)
R3 IntcUSB; C:\WINDOWS\System32\DriverStore\FileRepository\intcusb.inf_amd64_bc398e7169495415\IntcUSB.sys [922712 2023-10-18] (Intel Corporation -> Intel® Corporation)
R3 IntelGNA; C:\WINDOWS\System32\DriverStore\FileRepository\gna.inf_amd64_04d4eecc5838a558\gna.sys [88776 2022-06-23] (Intel Corporation -> Intel Corporation)
S3 Intel_NF_I2C; C:\WINDOWS\System32\DriverStore\FileRepository\intel_nf_i2c_child.inf_amd64_a329fd450939b60d\Intel_NF_I2C.sys [222856 2022-12-13] (Intel Corporation -> Intel Corporation)
R3 ipf_acpi; C:\WINDOWS\System32\DriverStore\FileRepository\ipf_acpi.inf_amd64_6808233353fa1d56\ipf_acpi.sys [87168 2022-12-13] (Intel Corporation -> Intel Corporation)
R3 ipf_cpu; C:\WINDOWS\System32\DriverStore\FileRepository\ipf_cpu.inf_amd64_07e81e065fff923d\ipf_cpu.sys [80512 2022-12-13] (Intel Corporation -> Intel Corporation)
R3 ipf_lf; C:\WINDOWS\System32\DriverStore\FileRepository\ipf_cpu.inf_amd64_07e81e065fff923d\ipf_lf.sys [445056 2022-12-13] (Intel Corporation -> Intel Corporation)
R3 KfeCoSvc; C:\WINDOWS\System32\drivers\RivetNetworks\Killer\KfeCo11X64.sys [209200 2023-07-13] (Intel Corporation -> Rivet Networks, LLC.)
R2 mbamchameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [223296 2024-02-20] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
S0 MbamElam; C:\WINDOWS\System32\DRIVERS\MbamElam.sys [21480 2023-04-17] (Microsoft Windows Early Launch Anti-malware Publisher -> Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [239576 2024-02-20] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R3 MpKsl68a04ff2; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{0C568CFF-8D60-4710-87D3-2F5D5B8DD8CB}\MpKslDrv.sys [272664 2024-03-02] (Microsoft Windows -> Microsoft Corporation)
R3 NvModuleTracker; C:\WINDOWS\System32\DriverStore\FileRepository\nvmoduletracker.inf_amd64_0c1cc60a4b422185\NvModuleTracker.sys [45656 2023-04-08] (Nvidia Corporation -> NVIDIA Corporation)
R3 nvpcf; C:\WINDOWS\System32\drivers\nvpcf.sys [235016 2024-02-15] (NVIDIA Corporation -> NVIDIA Corporation)
S3 rtu53cx22x64; C:\WINDOWS\System32\DriverStore\FileRepository\rtu53cx22x64sta.inf_amd64_0a6b2668b96622b9\rtu53cx22x64.sys [887688 2023-03-16] (Realtek Semiconductor Corp. -> Realtek Corporation)
S3 rtux64w10; C:\WINDOWS\System32\DriverStore\FileRepository\rtux64w10.inf_amd64_03831aeaaa2c730e\rtux64w10.sys [683520 2022-05-06] (Microsoft Windows -> Realtek Corporation)
R0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [21040 2024-02-27] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
U5 WdDevFlt; C:\Windows\System32\Drivers\WdDevFlt.sys [169232 2022-05-06] (Microsoft Windows -> Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [608648 2024-02-27] (Microsoft Windows -> Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [105752 2024-02-27] (Microsoft Windows -> Microsoft Corporation)
R3 WiManHu; C:\WINDOWS\System32\DriverStore\FileRepository\wiman.inf_amd64_e8edc74538613ea4\WiManHu\WiManHu.sys [211624 2023-12-18] (Intel Corporation -> Intel Corporation)
S4 DBUtilDrv2; \SystemRoot\System32\drivers\DBUtilDrv2.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One month (created) (Whitelisted) =========

(If an entry is included in the fixlist, the file/folder will be moved.)

2024-03-01 18:31 - 2024-03-01 18:31 - 000000000 ___HD C:\OneDriveTemp
2024-03-01 17:44 - 2024-03-01 17:44 - 000002260 _____ C:\Users\jenfr\AppData\LocalLow\fa24b537f2f5d1a360ba3da68814117963e3699cbac5fe0b23eef7c0fe91536b
2024-03-01 17:42 - 2024-03-01 17:44 - 000000128 _____ C:\Users\jenfr\AppData\LocalLow\1d8e9c6110ff2d094890d0aae63967d4b0adc17e9b5c2e012cd0ff3c5c88c81b
2024-03-01 17:42 - 2024-03-01 17:42 - 000282449 _____ C:\Users\jenfr\AppData\LocalLow\9cc0d6d075de49260ebc90788ba6fdd0fd73cb284d717aa1028fefb9de5a32f7
2024-03-01 15:22 - 2024-03-01 15:22 - 000000000 ____D C:\Users\jenfr\Downloads\Photos-001-1
2024-03-01 11:34 - 2024-03-01 11:34 - 000101074 _____ C:\Users\CBT_MKE\Downloads\BOIRLpbA0YlWIeWOL2KS.pdf
2024-03-01 08:55 - 2024-03-01 08:55 - 000002650 _____ C:\Users\jenfr\Downloads\FSS.txt
2024-03-01 08:53 - 2024-03-01 08:53 - 000959488 _____ (Farbar) C:\Users\jenfr\Downloads\FSS.exe
2024-02-29 16:51 - 2024-02-29 16:51 - 000020023 _____ C:\WINDOWS\SysWOW64\IntegratedServicesRegionPolicySet.json
2024-02-29 16:50 - 2024-02-29 16:50 - 000020023 _____ C:\WINDOWS\system32\IntegratedServicesRegionPolicySet.json
2024-02-29 16:33 - 2024-02-29 16:34 - 000000022 _____ C:\Users\CBT_MKE\Downloads\ScienceDirect_articles_29Feb2024_22-31-11.537.zip
2024-02-29 09:48 - 2024-02-29 09:49 - 002386944 _____ (Farbar) C:\Users\jenfr\Downloads\FRST64(2).exe
2024-02-29 09:33 - 2024-03-01 17:21 - 000016781 _____ C:\Users\Boss\AppData\LocalLow\1abc63b7c987f217521b29e18445c9b2a0b8a27bd4397fcda74dd662205af57f
2024-02-29 09:33 - 2024-02-29 09:33 - 000000026 _____ C:\Users\Boss\AppData\LocalLow\fd153706050abcf0886e001cfa6502f84dcec6faebb4c413e24263d44a873e5b
2024-02-29 09:32 - 2024-02-29 09:34 - 000030092 _____ C:\Users\Boss\AppData\LocalLow\e2e71d94b4a2d1ac543c9730c8edeb3f9c24f3df239f5830d59588abcd2d97d3
2024-02-29 09:32 - 2024-02-29 09:34 - 000000128 _____ C:\Users\Boss\AppData\LocalLow\69a789ecc2248ac851c5b7748341e0df97b19b51fc48632a1b8629e8974d6578
2024-02-29 09:28 - 2024-03-01 17:21 - 000000000 ____D C:\Users\Boss\AppData\Local\CrashDumps
2024-02-28 14:26 - 2024-02-28 14:26 - 002386944 _____ (Farbar) C:\Users\jenfr\Downloads\FRST64(1).exe
2024-02-28 12:41 - 2024-02-28 12:41 - 000104786 _____ C:\Users\CBT_MKE\Downloads\Customize Drive for desktop settings.pdf
2024-02-28 11:24 - 2024-02-28 11:24 - 000002260 _____ C:\Users\CBT_MKE\AppData\LocalLow\e7cc40f51e4c3980d50372beb28d8d931dd6df11132245b06d72bea14a9bee18
2024-02-28 10:19 - 2024-02-28 10:19 - 001226166 _____ C:\Users\CBT_MKE\Downloads\Hulsman_2024_avoidance_countercond_BXTh.pdf
2024-02-28 10:13 - 2024-03-01 17:22 - 000016781 _____ C:\Users\CBT_MKE\AppData\LocalLow\1abc63b7c987f217521b29e18445c9b2a0b8a27bd4397fcda74dd662205af57f
2024-02-28 09:22 - 2024-03-02 13:48 - 000025438 _____ C:\Users\jenfr\AppData\LocalLow\1abc63b7c987f217521b29e18445c9b2a0b8a27bd4397fcda74dd662205af57f
2024-02-28 09:20 - 2024-03-01 17:41 - 000032047 _____ C:\Users\jenfr\AppData\LocalLow\30fe1ad87c7a915f35214d537895d60e85a488378022b8dff9a42476846a224e
2024-02-28 09:20 - 2024-03-01 09:40 - 000000128 _____ C:\Users\jenfr\AppData\LocalLow\69a789ecc2248ac851c5b7748341e0df97b19b51fc48632a1b8629e8974d6578
2024-02-28 09:20 - 2024-03-01 08:55 - 000031209 _____ C:\Users\jenfr\AppData\LocalLow\e2e71d94b4a2d1ac543c9730c8edeb3f9c24f3df239f5830d59588abcd2d97d3
2024-02-27 10:51 - 2024-02-28 09:19 - 000131550 _____ C:\Users\jenfr\Downloads\Fixlog.txt
2024-02-27 10:44 - 2024-02-28 09:12 - 000000944 _____ C:\Users\jenfr\OneDrive\Desktop-OLD\FRST64.exe.lnk
2024-02-26 15:15 - 2024-02-26 15:15 - 000000000 ____D C:\Users\jenfr\Downloads\FRST-OlderVersion
2024-02-26 13:02 - 2024-02-26 13:02 - 008797968 _____ (Malwarebytes) C:\Users\jenfr\Downloads\adwcleaner(1).exe
2024-02-25 15:38 - 2024-02-17 05:38 - 002031464 _____ C:\WINDOWS\system32\vulkaninfo-1-999-0-0-0.exe
2024-02-25 15:38 - 2024-02-17 05:38 - 002031464 _____ C:\WINDOWS\system32\vulkaninfo.exe
2024-02-25 15:38 - 2024-02-17 05:38 - 001578752 _____ C:\WINDOWS\SysWOW64\vulkaninfo-1-999-0-0-0.exe
2024-02-25 15:38 - 2024-02-17 05:38 - 001578752 _____ C:\WINDOWS\SysWOW64\vulkaninfo.exe
2024-02-25 15:38 - 2024-02-17 05:38 - 001487904 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.dll
2024-02-25 15:38 - 2024-02-17 05:38 - 001445224 _____ C:\WINDOWS\system32\vulkan-1-999-0-0-0.dll
2024-02-25 15:38 - 2024-02-17 05:38 - 001445224 _____ C:\WINDOWS\system32\vulkan-1.dll
2024-02-25 15:38 - 2024-02-17 05:38 - 001295208 _____ C:\WINDOWS\SysWOW64\vulkan-1-999-0-0-0.dll
2024-02-25 15:38 - 2024-02-17 05:38 - 001295208 _____ C:\WINDOWS\SysWOW64\vulkan-1.dll
2024-02-25 15:38 - 2024-02-17 05:38 - 001227296 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.dll
2024-02-25 15:38 - 2024-02-17 05:35 - 001046152 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvml.dll
2024-02-25 15:38 - 2024-02-17 05:35 - 000669816 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvofapi64.dll
2024-02-25 15:38 - 2024-02-17 05:35 - 000505456 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvofapi.dll
2024-02-25 15:38 - 2024-02-17 05:34 - 002173448 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvFBC64.dll
2024-02-25 15:38 - 2024-02-17 05:34 - 001625096 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvFBC.dll
2024-02-25 15:38 - 2024-02-17 05:34 - 001541640 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFR64.dll
2024-02-25 15:38 - 2024-02-17 05:34 - 001199112 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFR.dll
2024-02-25 15:38 - 2024-02-17 05:34 - 001024032 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvEncodeAPI64.dll
2024-02-25 15:38 - 2024-02-17 05:34 - 000842272 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvidia-smi.exe
2024-02-25 15:38 - 2024-02-17 05:34 - 000786952 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvEncodeAPI.dll
2024-02-25 15:38 - 2024-02-17 05:33 - 016033824 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuvid.dll
2024-02-25 15:38 - 2024-02-17 05:33 - 012928032 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuvid.dll
2024-02-25 15:38 - 2024-02-17 05:33 - 006780528 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuda.dll
2024-02-25 15:38 - 2024-02-17 05:33 - 005773448 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcudadebugger.dll
2024-02-25 15:38 - 2024-02-17 05:33 - 003721760 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuda.dll
2024-02-25 15:38 - 2024-02-17 05:33 - 000459272 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdebugdump.exe
2024-02-25 15:38 - 2024-02-17 05:32 - 005912712 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcpl.dll
2024-02-25 15:38 - 2024-02-17 05:32 - 000853000 _____ (NVIDIA Corporation) C:\WINDOWS\system32\MCU.exe
2024-02-25 15:38 - 2024-02-17 05:31 - 006030584 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvapi.dll
2024-02-25 15:38 - 2024-02-15 10:42 - 000119184 _____ C:\WINDOWS\system32\nvinfo.pb
2024-02-21 10:35 - 2024-02-21 10:35 - 001213795 _____ C:\Users\CBT_MKE\Downloads\August-6-Teleseminar.pdf
2024-02-20 17:32 - 2024-02-20 17:32 - 000000383 _____ C:\Users\jenfr\Downloads\Backup-codes-jen.francis1.txt
2024-02-20 17:28 - 2024-02-27 10:48 - 000045295 _____ C:\Users\jenfr\Downloads\Addition.txt
2024-02-20 17:27 - 2024-03-02 13:57 - 000031906 _____ C:\Users\jenfr\Downloads\FRST.txt
2024-02-20 17:25 - 2024-03-02 13:57 - 000000000 ____D C:\FRST
2024-02-20 17:20 - 2024-02-26 15:15 - 002386944 _____ (Farbar) C:\Users\jenfr\Downloads\FRST64.exe
2024-02-20 14:50 - 2024-02-20 14:51 - 008797968 _____ (Malwarebytes) C:\Users\jenfr\Downloads\adwcleaner.exe
2024-02-20 13:41 - 2024-02-20 14:33 - 000553642 _____ C:\WINDOWS\ntbtlog.txt
2024-02-20 13:41 - 2024-02-20 13:41 - 000000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job
2024-02-20 12:07 - 2024-02-20 12:07 - 000000000 ____D C:\Users\Boss\AppData\Local\mbam
2024-02-20 09:45 - 2024-02-20 09:46 - 000000000 ____D C:\AdwCleaner
2024-02-20 09:23 - 2024-02-20 11:01 - 000000000 ____D C:\Program Files\Mozilla Firefox
2024-02-19 22:25 - 2024-02-19 22:25 - 000000000 ____D C:\Users\Boss\AppData\Roaming\Mozilla
2024-02-19 22:25 - 2024-02-19 22:25 - 000000000 ____D C:\Users\Boss\AppData\Local\Mozilla
2024-02-19 22:24 - 2024-02-19 22:24 - 000000000 ____D C:\Users\Boss\AppData\LocalLow\NVIDIA
2024-02-19 10:01 - 2024-02-19 10:01 - 000028883 _____ C:\Users\CBT_MKE\Downloads\Back-up codes CBT-1.pdf
2024-02-18 20:03 - 2024-02-18 20:03 - 000060658 _____ C:\Users\CBT_MKE\Downloads\Untitled document-2.pdf
2024-02-17 17:02 - 2024-02-17 17:02 - 000064721 _____ C:\Users\CBT_MKE\Downloads\Stream & mirror files with Drive for desktop.pdf
2024-02-17 13:11 - 2024-02-17 13:11 - 000091734 _____ C:\Users\CBT_MKE\Downloads\Device management security checklist-1.pdf
2024-02-17 13:04 - 2024-02-17 13:04 - 000089325 _____ C:\Users\CBT_MKE\Downloads\Device management security checklist.pdf
2024-02-17 11:40 - 2024-02-17 11:40 - 000000000 ____D C:\Program Files\Common Files\DESIGNER
2024-02-13 15:05 - 2024-02-13 15:05 - 000023632 _____ C:\Users\jenfr\OneDrive\Desktop-OLD\accounts_2024.xlsx
2024-02-12 15:32 - 2024-02-12 15:32 - 000079474 _____ C:\Users\CBT_MKE\Downloads\2024_ Telepsych Informed Consent .pdf
2024-02-12 14:08 - 2024-02-12 14:08 - 000000000 ____D C:\Users\CBT_MKE\AppData\Roaming\PowerENGAGE
2024-02-12 13:16 - 2024-02-12 13:16 - 000000000 ____D C:\Users\jenfr\AppData\Local\Brother_Industries,_Ltd
2024-02-12 13:04 - 2024-02-12 13:04 - 000000000 ____D C:\Users\CBT_MKE\AppData\Local\Brother_Industries,_Ltd
2024-02-12 13:03 - 2024-02-12 13:04 - 000000000 ____D C:\Users\CBT_MKE\AppData\Roaming\Brother
2024-02-12 13:03 - 2024-02-12 13:03 - 000000000 ____D C:\Users\CBT_MKE\AppData\Local\Brother
2024-02-12 09:22 - 2024-02-12 09:22 - 000000000 ____D C:\Users\CBT_MKE\AppData\Roaming\ControlCenter4
2024-02-12 08:14 - 2024-02-12 08:14 - 000164043 _____ C:\Users\jenfr\AppData\LocalLow\eda39b108ad638a48a673331ae068f49baf340b2c89c11e017eca6260bfb2885
2024-02-12 08:14 - 2024-02-12 08:14 - 000000026 _____ C:\Users\jenfr\AppData\LocalLow\7b5173d5fafc7ca7c2520d2a81837743e862da40c610545fd677456daf0b5c62
2024-02-12 08:14 - 2024-02-12 08:14 - 000000000 ____D C:\Users\jenfr\AppData\Roaming\FLEXnet
2024-02-12 08:10 - 2024-02-12 08:10 - 000000000 ____D C:\Users\jenfr\AppData\Roaming\Zeon
2024-02-11 21:30 - 2024-02-11 21:30 - 000000000 ____D C:\Users\jenfr\AppData\Roaming\ControlCenter4
2024-02-11 20:31 - 2024-02-26 15:03 - 000000000 ____D C:\Users\jenfr\AppData\Roaming\Brother
2024-02-11 20:31 - 2024-02-11 20:31 - 000000000 ____D C:\Users\jenfr\AppData\Local\Brother
2024-02-11 20:08 - 2024-02-11 20:08 - 000000000 ____D C:\Users\jenfr\AppData\Roaming\PowerENGAGE
2024-02-11 20:07 - 2024-02-11 20:07 - 000000000 ____D C:\ProgramData\Macrovision
2024-02-11 20:07 - 2024-02-11 20:07 - 000000000 ____D C:\ProgramData\FLEXnet
2024-02-11 20:03 - 2024-02-11 21:30 - 000000000 ____D C:\ProgramData\ControlCenter4
2024-02-11 20:03 - 2024-02-11 20:22 - 000000000 ____D C:\Program Files (x86)\PC-FAXReceive
2024-02-11 20:03 - 2024-02-11 20:10 - 000000000 ____D C:\Program Files (x86)\Browny02
2024-02-11 20:03 - 2024-02-11 20:09 - 000000000 ____D C:\Program Files (x86)\ControlCenter4
2024-02-11 20:03 - 2024-02-11 20:03 - 000000000 ____D C:\ProgramData\PCFaxTx
2024-02-11 20:03 - 2024-02-11 20:03 - 000000000 ____D C:\ProgramData\PCFaxRx
2024-02-11 20:03 - 2024-02-11 20:03 - 000000000 ____D C:\Program Files (x86)\RemoteSetup
2024-02-11 20:03 - 2024-02-11 20:03 - 000000000 ____D C:\Program Files (x86)\ControlCenter4 CSDK
2024-02-11 20:03 - 2017-12-26 13:13 - 000318464 _____ ( ) C:\WINDOWS\system32\BrFaxTxAppRunA64.dll
2024-02-11 20:03 - 2017-12-26 13:13 - 000000000 _____ C:\WINDOWS\Brpfx04a.ini
2024-02-11 20:02 - 2024-02-26 15:03 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother
2024-02-11 20:02 - 2024-02-11 20:02 - 000002811 _____ C:\WINDOWS\BRRBCOM.INI
2024-02-11 20:02 - 2018-11-12 11:25 - 000091648 _____ () C:\WINDOWS\system32\BrNetSti.dll
2024-02-11 20:02 - 2018-03-15 17:54 - 000252928 _____ () C:\WINDOWS\system32\NSSRH64.dll
2024-02-11 20:02 - 2018-03-15 17:54 - 000143360 _____ C:\WINDOWS\system32\BrSNMP64.dll
2024-02-11 20:02 - 2018-03-15 17:54 - 000072192 _____ () C:\WINDOWS\system32\BrWiaNCp.dll
2024-02-11 20:02 - 2018-03-15 17:54 - 000065024 _____ () C:\WINDOWS\system32\Brnsplg.dll
2024-02-11 20:01 - 2024-02-12 13:04 - 000000000 ____D C:\ProgramData\Brother
2024-02-11 20:00 - 2024-02-26 15:03 - 000000000 ____D C:\Program Files (x86)\Brother
2024-02-09 17:05 - 2024-02-09 17:06 - 000000000 ____D C:\Users\CBT_MKE\special
2024-02-09 17:04 - 2024-02-09 17:04 - 000000383 _____ C:\Users\CBT_MKE\Downloads\Backup-codes-admin2.txt
2024-02-08 18:07 - 2024-02-08 18:07 - 000026505 _____ C:\Users\CBT_MKE\Downloads\Back-up codes CBT.pdf
2024-02-08 16:04 - 2024-02-08 16:04 - 000427850 _____ C:\Users\CBT_MKE\Downloads\2-Step Verification GW.pdf
2024-02-07 19:27 - 2024-02-07 19:27 - 000000174 ____R C:\Users\jenfr\OneDrive\XPS13\OFFICE.url
2024-02-07 10:27 - 2024-02-07 10:27 - 000063342 _____ C:\Users\CBT_MKE\Downloads\Invoice 1004.pdf
2024-02-06 14:56 - 2024-02-06 14:56 - 000108385 _____ C:\Users\CBT_MKE\Downloads\PPRPInformedconsentToomuchofagoodthingornotenough.pdf
2024-02-05 17:58 - 2024-02-05 17:58 - 000088128 _____ C:\Users\CBT_MKE\Downloads\NPP_2024_V3.pdf
2024-02-05 17:52 - 2024-02-05 17:52 - 000678672 _____ C:\Users\CBT_MKE\Downloads\45 CFR Part 164 SECURITY PRIVACY.pdf
2024-02-05 14:02 - 2024-02-05 14:02 - 000106146 _____ C:\Users\CBT_MKE\Downloads\IPLUM CHEATSHEET-1.pdf
2024-02-05 13:45 - 2024-02-05 13:45 - 000104429 _____ C:\Users\CBT_MKE\Downloads\IPLUM CHEATSHEET.pdf
2024-02-02 12:59 - 2024-02-02 12:59 - 000206347 _____ C:\Users\CBT_MKE\Downloads\BOIR-1.pdf
2024-02-02 12:57 - 2024-02-02 12:57 - 000457622 _____ C:\Users\CBT_MKE\Downloads\BOIR_Filing_Instructions.pdf
2024-02-02 12:48 - 2024-02-02 12:48 - 000206347 _____ C:\Users\CBT_MKE\Downloads\BOIR.pdf
2024-02-01 14:49 - 2024-02-01 14:49 - 000042222 _____ C:\Users\CBT_MKE\Downloads\customForm-38689566.pdf
2024-02-01 14:25 - 2024-02-01 14:25 - 000013111 _____ C:\Users\CBT_MKE\Downloads\Template NOTICE OF PRIVACY PRACTICES.txt
2024-02-01 13:29 - 2024-02-01 13:29 - 000446037 _____ C:\Users\CBT_MKE\Downloads\d41586-024-00240-3.pdf

==================== One month (modified) ==================

(If an entry is included in the fixlist, the file/folder will be moved.)

2024-03-02 13:38 - 2023-04-19 10:51 - 000000000 ____D C:\Users\jenfr\AppData\Local\CrashDumps
2024-03-02 13:38 - 2022-05-06 23:24 - 000000000 ____D C:\WINDOWS\AppReadiness
2024-03-02 13:38 - 2022-05-06 23:24 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2024-03-02 13:09 - 2023-05-17 15:49 - 000000000 ____D C:\Program Files (x86)\Google
2024-03-02 13:09 - 2022-05-06 23:24 - 000000000 ____D C:\WINDOWS\SystemTemp
2024-03-02 12:53 - 2023-04-17 13:51 - 000000000 ____D C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38
2024-03-02 12:42 - 2023-04-14 17:14 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2024-03-02 12:37 - 2022-05-06 23:22 - 000000000 ____D C:\WINDOWS\INF
2024-03-01 18:57 - 2022-05-06 23:24 - 000000000 ___HD C:\Program Files\WindowsApps
2024-03-01 18:38 - 2023-04-14 15:24 - 000804932 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2024-03-01 18:31 - 2023-05-12 11:48 - 000000000 ____D C:\Users\jenfr\AppData\Local\Malwarebytes
2024-03-01 18:31 - 2023-04-14 17:21 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2024-03-01 18:31 - 2023-04-14 17:15 - 000000000 ____D C:\ProgramData\NVIDIA
2024-03-01 18:31 - 2023-04-14 17:14 - 000012288 ___SH C:\DumpStack.log.tmp
2024-03-01 18:31 - 2023-04-14 16:15 - 000000000 ___RD C:\Users\jenfr\OneDrive
2024-03-01 18:31 - 2022-05-06 23:24 - 000000000 ____D C:\WINDOWS\ServiceState
2024-03-01 18:30 - 2022-05-06 23:17 - 001572864 _____ C:\WINDOWS\system32\config\BBI
2024-03-01 17:47 - 2023-04-18 08:10 - 000000000 ____D C:\Users\jenfr\AppData\Roaming\Microsoft\Word
2024-03-01 17:44 - 2023-04-14 16:13 - 000000000 ____D C:\Users\jenfr\AppData\Local\D3DSCache
2024-03-01 17:22 - 2023-05-30 10:33 - 000000000 ____D C:\Users\CBT_MKE\dell display manager
2024-03-01 17:22 - 2023-05-22 09:39 - 000000000 ___RD C:\Users\CBT_MKE\My Drive
2024-03-01 17:22 - 2023-05-19 15:16 - 000000000 ____D C:\Users\CBT_MKE\AppData\Local\CrashDumps
2024-03-01 17:21 - 2023-05-12 13:38 - 000000000 ____D C:\Users\Boss\AppData\Local\Malwarebytes
2024-03-01 17:21 - 2023-04-18 09:58 - 000000000 ____D C:\Users\Boss\AppData\Local\Packages
2024-03-01 16:58 - 2023-04-27 12:33 - 000000000 ___SD C:\Users\CBT_MKE\AppData\Roaming\Microsoft\Credentials
2024-03-01 15:14 - 2023-04-17 14:45 - 000000000 ____D C:\Users\jenfr\AppData\LocalLow\Temp
2024-03-01 10:12 - 2023-05-15 10:00 - 000000000 ____D C:\Users\CBT_MKE\AppData\Local\Malwarebytes
2024-03-01 10:12 - 2023-04-27 12:33 - 000000000 ____D C:\Users\CBT_MKE\AppData\Local\Packages
2024-03-01 08:45 - 2023-04-14 17:20 - 000001623 _____ C:\WINDOWS\system32\config\VSMIDK
2024-02-29 17:16 - 2023-04-14 16:13 - 000000000 ____D C:\Users\jenfr\AppData\Local\Packages
2024-02-29 17:16 - 2023-03-26 06:43 - 000000000 ____D C:\ProgramData\Packages
2024-02-29 17:15 - 2022-05-06 23:24 - 000000000 ____D C:\ProgramData\USOPrivate
2024-02-29 16:59 - 2023-05-01 17:50 - 000474808 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2024-02-29 16:59 - 2022-05-06 23:24 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2024-02-29 16:59 - 2022-05-06 23:24 - 000000000 ____D C:\WINDOWS\SystemResources
2024-02-29 16:59 - 2022-05-06 23:24 - 000000000 ____D C:\WINDOWS\system32\oobe
2024-02-29 16:59 - 2022-05-06 23:24 - 000000000 ____D C:\WINDOWS\system32\appraiser
2024-02-29 16:59 - 2022-05-06 23:24 - 000000000 ____D C:\WINDOWS\ShellExperiences
2024-02-29 16:59 - 2022-05-06 23:24 - 000000000 ____D C:\WINDOWS\ShellComponents
2024-02-29 16:59 - 2022-05-06 23:24 - 000000000 ____D C:\WINDOWS\bcastdvr
2024-02-29 16:53 - 2022-05-06 23:17 - 000000000 ____D C:\WINDOWS\CbsTemp
2024-02-29 16:51 - 2023-04-14 17:17 - 003212288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2024-02-29 11:15 - 2023-04-27 12:33 - 000000000 ____D C:\Users\CBT_MKE\AppData\Local\D3DSCache
2024-02-29 10:42 - 2023-04-18 08:10 - 000000000 ____D C:\Users\jenfr\AppData\Roaming\Microsoft\Office
2024-02-29 03:09 - 2023-04-14 17:15 - 000002440 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
2024-02-28 13:44 - 2023-04-27 12:33 - 000000000 ____D C:\Users\CBT_MKE
2024-02-28 09:16 - 2023-09-01 15:41 - 000000000 ____D C:\Users\CBT_MKE\AppData\LocalLow\Temp
2024-02-27 17:41 - 2023-03-26 06:37 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd
2024-02-27 12:42 - 2023-05-11 08:13 - 000000000 ____D C:\Users\CBT_MKE\AppData\Roaming\Microsoft\Word
2024-02-27 12:26 - 2023-05-02 13:14 - 000000000 ____D C:\Users\CBT_MKE\AppData\Roaming\Microsoft\Excel
2024-02-26 15:03 - 2023-03-26 06:41 - 000000000 ____D C:\ProgramData\Package Cache
2024-02-26 14:55 - 2023-04-14 16:08 - 000000000 ___SD C:\Users\jenfr\AppData\Roaming\Microsoft\Credentials
2024-02-26 13:33 - 2023-04-27 16:22 - 000000000 ____D C:\Users\jenfr\AppData\Roaming\Microsoft\Excel
2024-02-26 13:05 - 2023-04-14 16:13 - 000000000 ____D C:\Users\jenfr\AppData\Local\NVIDIA
2024-02-26 12:53 - 2023-05-12 15:55 - 000000000 ____D C:\Users\jenfr\dell display manager
2024-02-26 09:25 - 2023-05-17 15:49 - 000002168 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive.lnk
2024-02-25 15:39 - 2023-04-14 17:15 - 000000000 ____D C:\ProgramData\NVIDIA Corporation
2024-02-25 15:36 - 2023-05-16 15:17 - 000004308 _____ C:\WINDOWS\system32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2024-02-25 15:36 - 2023-05-16 15:17 - 000003976 _____ C:\WINDOWS\system32\Tasks\NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2024-02-25 15:36 - 2023-05-16 15:17 - 000003940 _____ C:\WINDOWS\system32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2024-02-25 15:36 - 2023-05-16 15:17 - 000003894 _____ C:\WINDOWS\system32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2024-02-25 15:36 - 2023-05-16 15:17 - 000003858 _____ C:\WINDOWS\system32\Tasks\NvTmRep_CrashReport4_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2024-02-25 15:36 - 2023-05-16 15:17 - 000003858 _____ C:\WINDOWS\system32\Tasks\NvTmRep_CrashReport3_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2024-02-25 15:36 - 2023-05-16 15:17 - 000003858 _____ C:\WINDOWS\system32\Tasks\NvTmRep_CrashReport2_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2024-02-25 15:36 - 2023-05-16 15:17 - 000003858 _____ C:\WINDOWS\system32\Tasks\NvTmRep_CrashReport1_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2024-02-25 15:36 - 2023-05-16 15:17 - 000003654 _____ C:\WINDOWS\system32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2024-02-25 15:36 - 2023-03-27 03:08 - 000000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2024-02-25 15:36 - 2023-03-27 03:06 - 000000000 ____D C:\Program Files\NVIDIA Corporation
2024-02-25 15:34 - 2023-04-14 17:21 - 000003536 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
2024-02-25 15:34 - 2023-04-14 17:21 - 000003412 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore
2024-02-21 00:22 - 2022-05-06 23:24 - 000000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2024-02-20 16:34 - 2023-04-14 16:15 - 000000000 ____D C:\Users\jenfr\AppData\Local\PlaceholderTileLogoFolder
2024-02-20 14:40 - 2023-04-17 18:15 - 000239576 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys
2024-02-20 12:20 - 2023-04-17 13:51 - 000000000 ____D C:\WINDOWS\system32\Tasks\Mozilla
2024-02-20 12:07 - 2023-04-18 09:58 - 000000000 ____D C:\Users\Boss\AppData\Local\D3DSCache
2024-02-20 11:46 - 2023-07-31 12:58 - 000000000 ____D C:\WINDOWS\Minidump
2024-02-20 11:01 - 2023-04-17 13:51 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2024-02-20 10:42 - 2023-04-17 13:51 - 000001007 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2024-02-17 11:38 - 2023-03-26 06:42 - 000000000 ____D C:\Program Files\Microsoft Office
2024-02-17 05:31 - 2023-04-14 12:41 - 006943344 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvapi64.dll
2024-02-16 12:43 - 2023-04-28 11:58 - 000000000 ____D C:\Program Files\Microsoft OneDrive
2024-02-15 10:42 - 2023-04-14 12:41 - 000235016 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvpcf.sys
2024-02-15 10:10 - 2022-05-06 23:17 - 000032768 _____ C:\WINDOWS\system32\config\ELAM
2024-02-14 14:21 - 2023-04-27 16:41 - 000003194 _____ C:\WINDOWS\system32\Tasks\OneDrive Per-Machine Standalone Update Task
2024-02-14 14:21 - 2023-04-27 16:41 - 000002134 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2024-02-14 14:21 - 2023-04-27 12:34 - 000003592 _____ C:\WINDOWS\system32\Tasks\OneDrive Reporting Task-S-1-5-21-883358396-3808688255-3020804061-1003
2024-02-14 14:21 - 2023-04-18 09:59 - 000003592 _____ C:\WINDOWS\system32\Tasks\OneDrive Reporting Task-S-1-5-21-883358396-3808688255-3020804061-1002
2024-02-14 14:21 - 2023-04-14 16:15 - 000003592 _____ C:\WINDOWS\system32\Tasks\OneDrive Reporting Task-S-1-5-21-883358396-3808688255-3020804061-1001
2024-02-14 14:20 - 2023-09-26 16:26 - 000000000 ____D C:\WINDOWS\system32\Microsoft-Edge-WebView
2024-02-14 14:20 - 2022-05-06 23:24 - 000000000 ____D C:\WINDOWS\system32\Sgrm
2024-02-13 21:26 - 2023-04-14 16:18 - 000000000 ____D C:\WINDOWS\system32\MRT
2024-02-13 21:22 - 2023-04-14 16:18 - 191155960 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2024-02-13 18:28 - 2023-05-03 18:35 - 000004562 _____ C:\WINDOWS\system32\Tasks\Adobe Acrobat Update Task
2024-02-13 18:28 - 2023-05-03 18:35 - 000002075 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat.lnk
2024-02-12 09:18 - 2023-04-14 16:16 - 000000000 ____D C:\Users\jenfr\OneDrive\XPS13\Hx_Joppa
2024-02-11 23:45 - 2023-09-29 10:58 - 000000174 ____R C:\Users\jenfr\OneDrive\XPS13\TECH.url
2024-02-11 20:01 - 2022-05-06 23:24 - 000000000 ____D C:\Program Files\Common Files\microsoft shared

==================== Files in the root of some directories ========

2023-07-29 07:02 - 2023-07-29 07:02 - 017190096 _____ (Dell Inc.) C:\Users\jenfr\DellCommandUpdateApp_Setup.exe

==================== SigCheck ============================

(There is no automatic fix for files that do not pass verification.)

==================== End of FRST.txt ========================

 

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 26.02.2024 01
Ran by jenfr (02-03-2024 13:58:16)
Running from C:\Users\jenfr\Downloads
Microsoft Windows 11 Home Version 23H2 22631.3235 (X64) (2023-04-14 23:21:25)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================


(If an entry is included in the fixlist, it will be removed.)

Administrator (S-1-5-21-883358396-3808688255-3020804061-500 - Administrator - Disabled)
Boss (S-1-5-21-883358396-3808688255-3020804061-1002 - Administrator - Enabled) => C:\Users\Boss
CBT_MKE (S-1-5-21-883358396-3808688255-3020804061-1003 - Limited - Enabled) => C:\Users\CBT_MKE
DefaultAccount (S-1-5-21-883358396-3808688255-3020804061-503 - Limited - Disabled)
Guest (S-1-5-21-883358396-3808688255-3020804061-501 - Limited - Disabled)
jenfr (S-1-5-21-883358396-3808688255-3020804061-1001 - Administrator - Enabled) => C:\Users\jenfr
WDAGUtilityAccount (S-1-5-21-883358396-3808688255-3020804061-504 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Acrobat (64-bit) (HKLM\...\{AC76BA86-1033-FF00-7760-BC15014EA700}) (Version: 23.008.20533 - Adobe)
Adobe Refresh Manager (HKLM-x32\...\{AC76BA86-0804-1033-1959-018244601067}) (Version: 1.8.0 - Adobe Systems Incorporated) Hidden
AppLogLibSetup (HKLM-x32\...\{52FB0C8F-DF05-4C61-AEB6-18C55F8C385F}) (Version: 1.0.3.0 - Brother Industries Ltd.) Hidden
BrLauncher (HKLM-x32\...\{88FCD471-DBBF-4A75-8066-ACACE05DE3CF}) (Version: 2.0.14.0 - Brother Industries Ltd.) Hidden
BrLogRx (HKLM-x32\...\{190861E7-09C5-42D8-BB4B-0AFB234BCFC1}) (Version: 1.0.3.1 - Brother Industries Ltd.) Hidden
Brother PCFax Driver (HKLM-x32\...\{79262B43-9E15-4732-A034-BFD29D9BD077}) (Version: 1.4.1.0 - Brother Industries Ltd.) Hidden
Brother Printer Driver (HKLM-x32\...\{DB807453-2A2E-4FFE-9D85-253F41EAF321}) (Version: 7.1.0.0 - Brother Industries Ltd.) Hidden
Brother Scanner Driver (HKLM-x32\...\{C48F05FB-1568-42F5-BE89-526A26994C6C}) (Version: 1.0.37.1 - Brother Industries Ltd.) Hidden
BrSupportTools (HKLM-x32\...\{C0439A0D-8A66-4BD0-A3E0-85C8E2920762}) (Version: 1.0.26.0 - Brother Industries Ltd.) Hidden
ControlCenter4 (HKLM-x32\...\{9CE6D4F3-965F-4FA7-8431-4A4FDC7A01D9}) (Version: 4.6.23.1 - Brother Industries, Ltd.) Hidden
ControlCenter4 CSDK (HKLM-x32\...\{FD8A9511-BFC9-43B5-BB75-9CEC0EA03CF0}) (Version: 4.6.1.1 - Brother Industries, Ltd.) Hidden
Dell Command | Update for Windows Universal (HKLM\...\{612F7720-D28A-473F-8FB9-C8D300B5F534}) (Version: 5.1.0 - Dell Inc.)
Dell Display Manager 2.1 (HKLM\...\Dell Display Manager 2) (Version: 2.1.1.17 - Dell Inc.)
DeviceDetect (HKLM-x32\...\{5FE4CE95-1B55-4632-A3F1-851B07936498}) (Version: 1.4.10.0 - Brother Industries Ltd.) Hidden
Documentation Manager (HKLM\...\{BD72B4C5-F19D-4507-97C7-21F67DF098C4}) (Version: 23.10.0.8 - Intel Corporation) Hidden
Google Drive (HKLM\...\{6BBAE539-2232-434A-A4E5-9A33560C6283}) (Version: 87.0.2.0 - Google LLC)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.36.51 - Google LLC) Hidden
HowToGuide (HKLM-x32\...\{36580EEB-4EDF-4880-BBD4-097E2C645ECD}) (Version: 1.0.1.0 - Brother Industries Ltd.) Hidden
Intel Driver && Support Assistant (HKLM-x32\...\{63B67EA4-4AE1-4A45-A67D-21318B4345EF}) (Version: 23.4.39.9 - Intel) Hidden
Intel® Wireless Bluetooth® (HKLM-x32\...\{00000010-0230-1033-84C8-B8D95FA3C8C3}) (Version: 23.10.0.2 - Intel Corporation)
Intel® Driver & Support Assistant (HKLM-x32\...\{ecbee3cf-26b3-4f27-854c-e2e16b3f7fa9}) (Version: 23.4.39.9 - Intel)
Intel® Integrated Sensor Solution (HKLM-x32\...\{0561b886-1a4e-4be3-bea9-abdd6108b346}) (Version: 3.10.100.4572 - Intel Corporation)
Intel® Software Installer (HKLM-x32\...\{cd5b4033-2c6b-4241-acf1-1ee873737a03}) (Version: 23.10.0.8 - Intel Corporation) Hidden
ISS_Drivers_x64 (HKLM\...\{82C84C74-0E6B-4C31-848B-A7DE4F087D48}) (Version: 3.10.100.4572 - Intel Corporation) Hidden
Malwarebytes version 4.6.8.311 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 4.6.8.311 - Malwarebytes)
Microsoft .NET Host - 6.0.14 (x64) (HKLM\...\{40D4EC44-91F8-4EEE-869E-F4B3E90E6688}) (Version: 48.59.55225 - Microsoft Corporation) Hidden
Microsoft .NET Host FX Resolver - 6.0.14 (x64) (HKLM\...\{D1726E78-81F3-40A2-A7AF-6286BAA49B1C}) (Version: 48.59.55225 - Microsoft Corporation) Hidden
Microsoft .NET Host FX Resolver - 6.0.9 (x64) (HKLM\...\{FD10B803-97FD-4867-9753-8784BC35D2F8}) (Version: 48.39.47157 - Microsoft Corporation) Hidden
Microsoft .NET Runtime - 6.0.14 (x64) (HKLM\...\{61202CF9-3B84-4E5A-91A1-2984FAE38259}) (Version: 48.59.55225 - Microsoft Corporation) Hidden
Microsoft .NET Runtime - 6.0.14 (x64) (HKLM-x32\...\{a75f0c38-355e-478f-b573-1dbc42915c5c}) (Version: 6.0.14.32123 - Microsoft Corporation)
Microsoft .NET Runtime - 6.0.9 (x64) (HKLM\...\{0B4F742D-2D47-4E95-B756-402822D31C48}) (Version: 48.39.47157 - Microsoft Corporation) Hidden
Microsoft 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 16.0.17231.20236 - Microsoft Corporation)
Microsoft Edge (HKLM-x32\...\Microsoft Edge) (Version: 122.0.2365.59 - Microsoft Corporation)
Microsoft Edge WebView2 Runtime (HKLM-x32\...\Microsoft EdgeWebView) (Version: 122.0.2365.59 - Microsoft Corporation)
Microsoft OneDrive (HKLM\...\OneDriveSetup.exe) (Version: 24.020.0128.0003 - Microsoft Corporation)
Microsoft OneNote - en-us (HKLM\...\OneNoteFreeRetail - en-us) (Version: 16.0.17231.20236 - Microsoft Corporation)
Microsoft Update Health Tools (HKLM\...\{C6FD611E-7EFE-488C-A0E0-974C09EF6473}) (Version: 5.72.0.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4048 (HKLM\...\{91415F19-4C22-3609-A105-92ED3522D83C}) (Version: 9.0.30729.4048 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4048 (HKLM-x32\...\{5B1F2843-B379-3FF2-B0D3-64DD143ED53A}) (Version: 9.0.30729.4048 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.32.31332 (HKLM-x32\...\{3746f21b-c990-4045-bb33-1cf98cff7a68}) (Version: 14.32.31332.0 - Microsoft Corporation)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.32.31332 (HKLM-x32\...\{a98dc6ff-d360-4878-9f0a-915eba86eaf3}) (Version: 14.32.31332.0 - Microsoft Corporation)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.32.31332 (HKLM\...\{F4499EE3-A166-496C-81BB-51D1BCDC70A9}) (Version: 14.32.31332 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.32.31332 (HKLM\...\{3407B900-37F5-4CC2-B612-5CD5D580A163}) (Version: 14.32.31332 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.32.31332 (HKLM-x32\...\{8972AC25-452E-4FFE-945A-EB9E28C20322}) (Version: 14.32.31332 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.32.31332 (HKLM-x32\...\{AEAA18F7-9C96-4A43-BC07-8B88A4913EEB}) (Version: 14.32.31332 - Microsoft Corporation) Hidden
Microsoft Windows Desktop Runtime - 6.0.9 (x64) (HKLM\...\{C1CD2FC1-92E6-4DE2-89D8-6D309881856F}) (Version: 48.39.47171 - Microsoft Corporation) Hidden
Microsoft Windows Desktop Runtime - 6.0.9 (x64) (HKLM-x32\...\{569b351b-451b-48db-a2c7-7beb63411666}) (Version: 6.0.9.31620 - Microsoft Corporation)
Mozilla Firefox (x64 en-US) (HKLM\...\Mozilla Firefox 123.0 (x64 en-US)) (Version: 123.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 112.0.1 - Mozilla)
MyDell (HKLM-x32\...\{E131DFE7-2098-409A-B07F-82F2D76BF17B}) (Version: 3.0.358.0 - Dell, Inc.)
MyDell Application Management (HKLM\...\{1B52D862-39DF-4BC3-A86D-7123219EE3AE}) (Version: 1.0.103.1 - Dell Technologies, Inc.) Hidden
MyDell Components Installer (HKLM\...\{FC24D516-8B85-4D36-8E48-0EF4E6968DFB}) (Version: 1.0.212.1 - Dell, Technologies, Inc.) Hidden
MyDell Customer Connect (HKLM\...\{6BBE66E6-0F6C-4C11-B38F-407DA1E4C70D}) (Version: 1.0.220.1 - Dell Technologies, Inc.) Hidden
NetworkRepairTool (HKLM-x32\...\{86E68F57-FAFE-4052-BDD4-3B90C38236AE}) (Version: 1.2.16.0 - Brother Industries, Ltd.) Hidden
NexiGo version 1.0 (HKLM-x32\...\{36A02147-C92C-458A-8284-E3903A0C4239}_is1) (Version: 1.0 - Nexight Inc)
NVIDIA FrameView SDK 1.3.8513.32290073 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_FrameViewSdk) (Version: 1.3.8513.32290073 - NVIDIA Corporation)
NVIDIA GeForce Experience 3.27.0.120 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 3.27.0.120 - NVIDIA Corporation)
NVIDIA Graphics Driver 551.61 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 551.61 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.21.0713 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.21.0713 - NVIDIA Corporation)
Office 16 Click-to-Run Extensibility Component (HKLM\...\{90160000-008C-0000-1000-0000000FF1CE}) (Version: 16.0.17231.20236 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (HKLM\...\{90160000-007E-0000-1000-0000000FF1CE}) (Version: 16.0.17231.20236 - Microsoft Corporation) Hidden
PC-FAXReceive (HKLM-x32\...\{65D8385F-F858-4748-A7C2-676D04C2893E}) (Version: 1.8.402.0 - Brother Industries, Ltd.) Hidden
PCFaxTx (HKLM-x32\...\{90338D66-4493-4DC3-A8C7-EB6FD5282B02}) (Version: 3.7.12.1 - Brother Industries Ltd.) Hidden
Realtek Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.9509.1 - Realtek Semiconductor Corp.)
Realtek USB Ethernet Controller All-In-One Windows Driver (HKLM-x32\...\{04201224-2B34-4EE7-862B-B7BBF89DB3AB}) (Version: 11.12.0223.2023 - Realtek)
RemoteSetup (HKLM-x32\...\{EB4D046E-28C1-4884-9129-47F41317E9B0}) (Version: 3.10.3.0 - Brother Industries Ltd.) Hidden
ScannerUtilityInstaller (HKLM-x32\...\{D94DD953-F38C-4220-A17C-9217106510A6}) (Version: 1.20.0.1 - Brother) Hidden
SoftwareUpdateNotification (HKLM-x32\...\{3D1AD910-B82B-4635-B1C3-0CEF9F6F3D34}) (Version: 1.0.21.0 - Brother Industries, Ltd.) Hidden
StatusMonitor (HKLM-x32\...\{D9584EB4-1D28-4BD1-8F81-6E097C0827EE}) (Version: 1.33.1.0 - Brother Industries, Ltd.) Hidden
UsbRepairTool (HKLM-x32\...\{F8762A81-32B5-4144-9F3C-9274F515A651}) (Version: 1.4.0.0 - Brother Industries, Ltd.) Hidden
Zoom (HKU\S-1-5-21-883358396-3808688255-3020804061-1001\...\ZoomUMX) (Version: 5.14.6 (15434) - Zoom Video Communications, Inc.)

Packages:
=========

Adobe Acrobat Reader -> C:\Program Files\Adobe\Acrobat DC [2024-02-19] ()
AppUp.IntelGraphicsExperience -> C:\Program Files\WindowsApps\AppUp.IntelGraphicsExperience_1.100.5336.0_x64__8j3eq9eme6ctt [2024-02-19] (INTEL CORP) [Startup Task]
Dell Command | Update -> C:\Program Files\WindowsApps\DellInc.DellCommandUpdate_5.1.30.0_x86__htrsf667h5kn2 [2024-02-19] (Dell Inc)
Dev Home -> C:\Program Files\WindowsApps\Microsoft.Windows.DevHome_0.1100.416.0_x64__8wekyb3d8bbwe [2024-02-29] (Microsoft Corporation)
Dolby Vision Extensions -> C:\Program Files\WindowsApps\DolbyLaboratories.DolbyVisionAccess_2.20301.388.0_x64__rz1tebttyb220 [2024-02-19] (Dolby Laboratories)
Intel® Management and Security Status -> C:\Program Files\WindowsApps\AppUp.IntelManagementandSecurityStatus_2316.5.0.0_x64__8j3eq9eme6ctt [2024-02-19] (INTEL CORP) [Startup Task]
Intel® Optane™ Memory and Storage Management -> C:\Program Files\WindowsApps\AppUp.IntelOptaneMemoryandStorageManagement_20.0.1011.0_x64__8j3eq9eme6ctt [2024-02-19] (INTEL CORP)
Microsoft Defender -> C:\Program Files\WindowsApps\Microsoft.6365217CE6EB4_102.2402.13002.0_x64__8wekyb3d8bbwe [2024-02-29] (Microsoft Corporation) [Startup Task]
Microsoft Family -> C:\Program Files\WindowsApps\MicrosoftCorporationII.MicrosoftFamily_0.2.40.0_x64__8wekyb3d8bbwe [2024-02-19] (Microsoft Corp.)
Microsoft.BingSearch -> C:\Program Files\WindowsApps\Microsoft.BingSearch_1.0.91.0_x64__8wekyb3d8bbwe [2024-02-12] (Microsoft Corporation)
Microsoft.MPEG2VideoExtension -> C:\Program Files\WindowsApps\Microsoft.MPEG2VideoExtension_1.0.61931.0_x64__8wekyb3d8bbwe [2024-02-19] (Microsoft Corporation)
Microsoft.WindowsAppRuntime.CBS -> C:\WINDOWS\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe [2024-02-29] (Microsoft Corporation)
MicrosoftWindows.CrossDevice -> C:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.24012.115.0_x64__cw5n1h2txyewy [2024-03-01] (Microsoft Windows) [Startup Task]
NVIDIA Control Panel -> C:\Program Files\WindowsApps\nvidiacorp.nvidiacontrolpanel_8.1.964.0_x64__56jybvy8sckqj [2024-02-25] (NVIDIA Corp.)
Power Automate -> C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_11.2402.223.0_x64__8wekyb3d8bbwe [2024-02-19] (Microsoft Corporation) [Startup Task]
Waves MaxxAudio Pro for Dell 2022 -> C:\Program Files\WindowsApps\WavesAudio.MaxxAudioProforDell2022_5.0.59.0_x64__fh4rh281wavaa [2023-04-27] (Waves Audio)
Windows Feature Experience Pack -> C:\WINDOWS\SystemApps\MicrosoftWindows.Client.FileExp_cw5n1h2txyewy [2024-02-29] (Microsoft Corporation)

==================== Custom CLSID (Whitelisted): ==============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-883358396-3808688255-3020804061-1001_Classes\CLSID\{0BAD39CB-DD3E-4F21-9156-649B0156C28E}\localserver32 -> C:\WINDOWS\System32\DriverStore\FileRepository\wavesapo11de.inf_amd64_d4eabf4492fbb4d5\WavesSvc64.exe (Waves Inc -> Waves Audio Ltd.)
CustomCLSID: HKU\S-1-5-21-883358396-3808688255-3020804061-1001_Classes\CLSID\{13357088-9834-0409-1600-134951500000}\localserver32 -> C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe (Adobe Inc. -> Adobe)
CustomCLSID: HKU\S-1-5-21-883358396-3808688255-3020804061-1001_Classes\CLSID\{38142727-3008-9161-1521-349515000000}\localserver32 -> C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe (Adobe Inc. -> Adobe)
CustomCLSID: HKU\S-1-5-21-883358396-3808688255-3020804061-1001_Classes\CLSID\{989dacff-3a01-6b2c-f623-9ef1597c6141}\localserver32 -> C:\Program Files\Dell\Dell Display Manager 2\DDM.exe (Qisda Corporation -> Dell Inc.)
CustomCLSID: HKU\S-1-5-21-883358396-3808688255-3020804061-1001_Classes\CLSID\{a18c2235-f97e-71dd-b398-1f96bc9af93c}\localserver32 -> C:\Program Files\Dell\Dell Display Manager 2\DDM.exe (Qisda Corporation -> Dell Inc.)
ShellIconOverlayIdentifiers: [     OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Program Files\Microsoft OneDrive\24.020.0128.0003\FileSyncShell64.dll [2024-02-14] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [     OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Program Files\Microsoft OneDrive\24.020.0128.0003\FileSyncShell64.dll [2024-02-14] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [     OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Program Files\Microsoft OneDrive\24.020.0128.0003\FileSyncShell64.dll [2024-02-14] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [     OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Program Files\Microsoft OneDrive\24.020.0128.0003\FileSyncShell64.dll [2024-02-14] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [     OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Program Files\Microsoft OneDrive\24.020.0128.0003\FileSyncShell64.dll [2024-02-14] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [     OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => C:\Program Files\Microsoft OneDrive\24.020.0128.0003\FileSyncShell64.dll [2024-02-14] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [     OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => C:\Program Files\Microsoft OneDrive\24.020.0128.0003\FileSyncShell64.dll [2024-02-14] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [    GoogleDriveCloudOverlayIconHandler] -> {A8E52322-8734-481D-A7E2-27B309EF8D56} => C:\Program Files\Google\Drive File Stream\87.0.2.0\drivefsext.dll [2024-02-26] (Google LLC -> Google, Inc.)
ShellIconOverlayIdentifiers: [    GoogleDriveMirrorBlacklistedOverlayIconHandler] -> {51EF1569-67EE-4AD6-9646-E726C3FFC8A2} => C:\Program Files\Google\Drive File Stream\87.0.2.0\drivefsext.dll [2024-02-26] (Google LLC -> Google, Inc.)
ShellIconOverlayIdentifiers: [    GoogleDrivePinnedOverlayIconHandler] -> {CFE8B367-77A7-41D7-9C90-75D16D7DC6B6} => C:\Program Files\Google\Drive File Stream\87.0.2.0\drivefsext.dll [2024-02-26] (Google LLC -> Google, Inc.)
ShellIconOverlayIdentifiers: [    GoogleDriveProgressOverlayIconHandler] -> {C973DA94-CBDF-4E77-81D1-E5B794FBD146} => C:\Program Files\Google\Drive File Stream\87.0.2.0\drivefsext.dll [2024-02-26] (Google LLC -> Google, Inc.)
ShellIconOverlayIdentifiers-x32: [     OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Program Files\Microsoft OneDrive\24.020.0128.0003\FileSyncShell64.dll [2024-02-14] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [     OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Program Files\Microsoft OneDrive\24.020.0128.0003\FileSyncShell64.dll [2024-02-14] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [     OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Program Files\Microsoft OneDrive\24.020.0128.0003\FileSyncShell64.dll [2024-02-14] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [     OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Program Files\Microsoft OneDrive\24.020.0128.0003\FileSyncShell64.dll [2024-02-14] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [     OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Program Files\Microsoft OneDrive\24.020.0128.0003\FileSyncShell64.dll [2024-02-14] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [     OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => C:\Program Files\Microsoft OneDrive\24.020.0128.0003\FileSyncShell64.dll [2024-02-14] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [     OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => C:\Program Files\Microsoft OneDrive\24.020.0128.0003\FileSyncShell64.dll [2024-02-14] (Microsoft Corporation -> Microsoft Corporation)
ContextMenuHandlers1: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Program Files\Microsoft OneDrive\24.020.0128.0003\FileSyncShell64.dll [2024-02-14] (Microsoft Corporation -> Microsoft Corporation)
ContextMenuHandlers1: [DriveFS 28 or later] -> {EE15C2BD-CECB-49F8-A113-CA1BFC528F5B} => C:\Program Files\Google\Drive File Stream\87.0.2.0\drivefsext.dll [2024-02-26] (Google LLC -> Google, Inc.)
ContextMenuHandlers4: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Program Files\Microsoft OneDrive\24.020.0128.0003\FileSyncShell64.dll [2024-02-14] (Microsoft Corporation -> Microsoft Corporation)
ContextMenuHandlers4: [DriveFS 28 or later] -> {EE15C2BD-CECB-49F8-A113-CA1BFC528F5B} => C:\Program Files\Google\Drive File Stream\87.0.2.0\drivefsext.dll [2024-02-26] (Google LLC -> Google, Inc.)
ContextMenuHandlers5: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Program Files\Microsoft OneDrive\24.020.0128.0003\FileSyncShell64.dll [2024-02-14] (Microsoft Corporation -> Microsoft Corporation)
ContextMenuHandlers5: [DriveFS 28 or later] -> {EE15C2BD-CECB-49F8-A113-CA1BFC528F5B} => C:\Program Files\Google\Drive File Stream\87.0.2.0\drivefsext.dll [2024-02-26] (Google LLC -> Google, Inc.)
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\WINDOWS\System32\DriverStore\FileRepository\nvdmi.inf_amd64_3fdff41f99f01256\nvshext.dll [2024-02-17] (NVIDIA Corporation -> NVIDIA Corporation)

==================== Codecs (Whitelisted) ====================

==================== Shortcuts & WMI ========================

==================== Loaded Modules (Whitelisted) =============

2024-02-11 20:02 - 2018-11-12 11:25 - 000091648 _____ () [File not signed] C:\WINDOWS\system32\BrNetSti.dll
2024-02-11 20:02 - 2018-03-15 17:54 - 000143360 _____ () [File not signed] C:\WINDOWS\system32\BrSNMP64.dll

==================== Alternate Data Streams (Whitelisted) ========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\CBT_MKE\Downloads\OfficeSetup.exe:MBAM.Zone.Identifier [351]

==================== Safe Mode (Whitelisted) ==================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Association (Whitelisted) =================

==================== Internet Explorer (Whitelisted) ==========

BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll [2024-02-04] (Microsoft Corporation -> Microsoft Corporation)
Handler: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2024-02-04] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2024-02-04] (Microsoft Corporation -> Microsoft Corporation)
Handler: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2024-02-04] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2024-02-04] (Microsoft Corporation -> Microsoft Corporation)
Handler: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2024-02-04] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2024-02-04] (Microsoft Corporation -> Microsoft Corporation)
Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2024-02-04] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2024-02-04] (Microsoft Corporation -> Microsoft Corporation)

==================== Hosts content: =========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2022-05-06 23:24 - 2022-05-06 23:22 - 000000824 _____ C:\WINDOWS\system32\drivers\etc\hosts

==================== Other Areas ===========================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-883358396-3808688255-3020804061-1001\Control Panel\Desktop\\Wallpaper -> c:\users\jenfr\onedrive\pictures- pc\space\jwt rho.png
HKU\S-1-5-21-883358396-3808688255-3020804061-1002\Control Panel\Desktop\\Wallpaper -> C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\DesktopSpotlight\Assets\Images\image_2.jpg
HKU\S-1-5-21-883358396-3808688255-3020804061-1003\Control Panel\Desktop\\Wallpaper -> C:\Users\CBT_MKE\Desktop\crop7t.png
DNS Servers: 1.1.1.1 - 1.0.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(If an entry is included in the fixlist, it will be removed.)

HKLM\...\StartupApproved\Run: => "WavesSvc"
HKLM\...\StartupApproved\Run: => "Logitech Download Assistant"
HKLM\...\StartupApproved\Run32: => "ISUSPM"
HKLM\...\StartupApproved\Run32: => "ControlCenter4"
HKLM\...\StartupApproved\Run32: => "IndexSearch"
HKLM\...\StartupApproved\Run32: => "PaperPort PTD"
HKLM\...\StartupApproved\Run32: => "PDFProHook"
HKLM\...\StartupApproved\Run32: => "BrStsMon00"
HKLM\...\StartupApproved\Run32: => "BrotherSoftwareUpdateNotification"
HKLM\...\StartupApproved\Run32: => "I17A"
HKU\S-1-5-21-883358396-3808688255-3020804061-1001\...\StartupApproved\StartupFolder: => "DDM2.0.lnk"
HKU\S-1-5-21-883358396-3808688255-3020804061-1001\...\StartupApproved\StartupFolder: => "Send to OneNote.lnk"
HKU\S-1-5-21-883358396-3808688255-3020804061-1001\...\StartupApproved\Run: => "MicrosoftEdgeAutoLaunch_D3A6C3E91BD871936DC5E531BD1851E5"
HKU\S-1-5-21-883358396-3808688255-3020804061-1001\...\StartupApproved\Run: => "GoogleDriveFS"
HKU\S-1-5-21-883358396-3808688255-3020804061-1003\...\StartupApproved\Run: => "MicrosoftEdgeAutoLaunch_840607CA24A5D0C24227941372696879"

==================== FirewallRules (Whitelisted) ================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{A7E1E645-5446-4FBD-A488-34831C2DFEE9}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{8464D095-14FC-463D-B7D0-596BA6722BF2}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{8B21E403-DB38-4885-BA80-C2853CA7046B}] => (Allow) C:\Program Files\WindowsApps\MicrosoftTeams_23078.300.1950.927_x64__8wekyb3d8bbwe\msteams.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{215E8825-E3E0-4D7C-A3FA-7475F9E659FC}] => (Allow) C:\Program Files\WindowsApps\MicrosoftTeams_23078.300.1950.927_x64__8wekyb3d8bbwe\msteams.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{D56DB188-5F02-4266-ABFA-A396344709EF}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\outlook.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{5E2CC1F9-26E1-45F2-B414-B0E9504314EF}] => (Allow) C:\Users\jenfr\AppData\Roaming\Zoom\bin\Zoom.exe (Zoom Video Communications, Inc. -> Zoom Video Communications, Inc.)
FirewallRules: [{B156AB53-E57A-4B55-A3AE-C34E34FABF42}] => (Allow) C:\Program Files\WindowsApps\MicrosoftTeams_23091.406.2009.3890_x64__8wekyb3d8bbwe\msteams.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{E516DA98-0CBC-4991-839E-F29DFB0875ED}] => (Allow) C:\Program Files\WindowsApps\MicrosoftTeams_23091.406.2009.3890_x64__8wekyb3d8bbwe\msteams.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{EA97DA3A-2993-402E-B827-BF10F595BC16}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe (NVIDIA Corporation -> NVIDIA Corporation)
FirewallRules: [{54838C9E-600A-47CA-9BDB-2E528427CB1C}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe (NVIDIA Corporation -> NVIDIA Corporation)
FirewallRules: [TCP Query User{BBFB121A-B14D-4C4C-9AA5-065388CD6648}C:\program files\mozilla firefox\firefox.exe] => (Block) C:\program files\mozilla firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [UDP Query User{92810F53-08F0-4855-B666-68E5C8A04D8C}C:\program files\mozilla firefox\firefox.exe] => (Block) C:\program files\mozilla firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{8B250C32-057B-4080-997E-2773FE7321FE}] => (Allow) LPort=54925
FirewallRules: [{6491FFE7-5AA2-4A9C-9E23-9DAB96D3EF3A}] => (Allow) c:\program files (x86)\pc-faxreceive\brengineprocess.exe (Brother Industries, Ltd.) [File not signed]
FirewallRules: [{5E11CB48-A184-468C-9536-759ECE1F8F8E}] => (Allow) c:\program files (x86)\pc-faxreceive\brengineprocess.exe (Brother Industries, Ltd.) [File not signed]
FirewallRules: [{BDDDF7D6-68C7-4804-A607-B9BD258E8577}] => (Allow) C:\Program Files (x86)\Browny02\Brother\BrPrintFinishNotice\BrPrintFinishNotice.exe (Brother Industries, Ltd. -> )
FirewallRules: [{46B82DF3-0FB8-4B79-B53C-914EA5098903}] => (Allow) C:\Program Files (x86)\Browny02\Brother\BrPrintFinishNotice\BrPrintFinishNotice.exe (Brother Industries, Ltd. -> )
FirewallRules: [{37B93334-221B-485F-B578-2D1327588FDB}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe (NVIDIA Corporation -> NVIDIA Corporation)
FirewallRules: [{C27A1F43-1388-4DDA-98D8-905486941535}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe (NVIDIA Corporation -> NVIDIA Corporation)
FirewallRules: [{5FAC2887-41EA-4524-9363-179380AB23C4}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe (NVIDIA Corporation -> NVIDIA Corporation)
FirewallRules: [{6539E46D-CA3C-4223-B36B-B699FD89C4A5}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe (NVIDIA Corporation -> NVIDIA Corporation)
FirewallRules: [{15A7EBD3-6D13-4D3A-B23B-EA834A730B2F}] => (Allow) C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.59\msedgewebview2.exe (Microsoft Corporation -> Microsoft Corporation)

==================== Restore Points =========================

01-03-2024 18:56:45 Windows Update
01-03-2024 18:56:58 Windows Update

==================== Faulty Device Manager Devices ============

Name: Integrated Webcam
Description: USB Video Device
Class Guid: {ca3e7ab9-b4c3-4ae6-8251-579ef933890f}
Manufacturer: Microsoft
Service: usbvideo
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: ========================

Application errors:
==================
Error: (03/02/2024 01:38:36 PM) (Source: Application Error) (EventID: 1000) (User: XPS15)
Description: Faulting application name: SecHealthUI.exe, version: 10.0.25992.1000, time stamp: 0x1f92ee73
Faulting module name: Windows.UI.Xaml.dll, version: 10.0.22621.3235, time stamp: 0xe6498aa7
Exception code: 0xc000027b
Fault offset: 0x0000000000872e30
Faulting process id: 0x0x1ae0
Faulting application start time: 0x0x1da6cd937d77814
Faulting application path: C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.25992.9000.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
Faulting module path: C:\Windows\System32\Windows.UI.Xaml.dll
Report Id: 46640f04-383e-4baa-8c14-e987a2eb96a0
Faulting package full name: Microsoft.SecHealthUI_1000.25992.9000.0_x64__8wekyb3d8bbwe
Faulting package-relative application ID: SecHealthUI

Error: (03/02/2024 12:37:16 PM) (Source: Application Error) (EventID: 1000) (User: XPS15)
Description: Faulting application name: backgroundTaskHost.exe, version: 10.0.22621.1, time stamp: 0x004687c2
Faulting module name: twinapi.appcore.dll, version: 10.0.22621.3235, time stamp: 0xb6c4ed60
Exception code: 0xc0000409
Fault offset: 0x0000000000095f9f
Faulting process id: 0x0x2ff4
Faulting application start time: 0x0x1da6cd0a62d4342
Faulting application path: C:\WINDOWS\system32\backgroundTaskHost.exe
Faulting module path: C:\Windows\System32\twinapi.appcore.dll
Report Id: a34d69c0-a9aa-4931-9b03-d7e145c4570b
Faulting package full name: Microsoft.WindowsStore_22401.1401.7.0_x64__8wekyb3d8bbwe
Faulting package-relative application ID: App

Error: (03/01/2024 06:40:32 PM) (Source: Application Error) (EventID: 1000) (User: XPS15)
Description: Faulting application name: backgroundTaskHost.exe, version: 10.0.22621.1, time stamp: 0x004687c2
Faulting module name: twinapi.appcore.dll, version: 10.0.22621.3235, time stamp: 0xb6c4ed60
Exception code: 0xc0000409
Fault offset: 0x0000000000095f9f
Faulting process id: 0x0xd48
Faulting application start time: 0x0x1da6c3a3b7a24f4
Faulting application path: C:\WINDOWS\system32\backgroundTaskHost.exe
Faulting module path: C:\Windows\System32\twinapi.appcore.dll
Report Id: 3d7fca01-3781-4466-b498-2083310be441
Faulting package full name: Microsoft.WindowsStore_22401.1401.7.0_x64__8wekyb3d8bbwe
Faulting package-relative application ID: App

Error: (03/01/2024 06:31:27 PM) (Source: Application Error) (EventID: 1000) (User: XPS15)
Description: Faulting application name: IGCC.exe, version: 1.100.5336.0, time stamp: 0x65c36d8d
Faulting module name: combase.dll, version: 10.0.22621.3235, time stamp: 0x7afa92fc
Exception code: 0xc0000409
Fault offset: 0x000000000015b61e
Faulting process id: 0x0x36a0
Faulting application start time: 0x0x1da6c38f6a09ec6
Faulting application path: C:\Program Files\WindowsApps\AppUp.IntelGraphicsExperience_1.100.5336.0_x64__8j3eq9eme6ctt\IGCC.exe
Faulting module path: C:\WINDOWS\System32\combase.dll
Report Id: c17ce741-224d-441a-acc4-d5b78645a000
Faulting package full name: AppUp.IntelGraphicsExperience_1.100.5336.0_x64__8j3eq9eme6ctt
Faulting package-relative application ID: App

Error: (03/01/2024 06:31:19 PM) (Source: .NET Runtime) (EventID: 1023) (User: )
Description: Description: A .NET application failed.
Application: OneApp.IGCC.WinService.exe
Path: C:\WINDOWS\System32\DriverStore\FileRepository\igcc_dch.inf_amd64_a99b22aa15fa509a\OneApp.IGCC.WinService.exe
Message: You must install or update .NET to run this application.

App: C:\WINDOWS\System32\DriverStore\FileRepository\igcc_dch.inf_amd64_a99b22aa15fa509a\OneApp.IGCC.WinService.exe
Architecture: x64
Framework: 'Microsoft.NETCore.App', version '7.0.0' (x64)
.NET location: C:\Program Files\dotnet\

The following frameworks were found:
  6.0.9 at [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  6.0.14 at [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]

Learn about framework resolution:
https://aka.ms/dotnet/app-launch-failed

To install missing framework, download:
https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=7.0.0&arch=x64&rid=win10-x64

Error: (03/01/2024 06:30:48 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance.  hr = 0x8007045b, A system shutdown is in progress..

Error: (03/01/2024 06:30:48 PM) (Source: VSS) (EventID: 13) (User: )
Description: Volume Shadow Copy Service information: The COM Server with CLSID {4e14fba2-2e22-11d1-9964-00c04fbbb345} and name CEventSystem cannot be started. [0x8007045b, A system shutdown is in progress.]

Error: (03/01/2024 06:20:01 PM) (Source: Application Error) (EventID: 1000) (User: XPS15)
Description: Faulting application name: SecHealthUI.exe, version: 10.0.25992.1000, time stamp: 0x1f92ee73
Faulting module name: Windows.UI.Xaml.dll, version: 10.0.22621.3235, time stamp: 0xe6498aa7
Exception code: 0xc000027b
Fault offset: 0x0000000000872e30
Faulting process id: 0x0x38f8
Faulting application start time: 0x0x1da6c375d7507e0
Faulting application path: C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.25992.9000.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
Faulting module path: C:\Windows\System32\Windows.UI.Xaml.dll
Report Id: daa9d1d1-05e2-4568-8b26-44e0599a745d
Faulting package full name: Microsoft.SecHealthUI_1000.25992.9000.0_x64__8wekyb3d8bbwe
Faulting package-relative application ID: SecHealthUI


System errors:
=============
Error: (03/02/2024 12:37:17 PM) (Source: DCOM) (EventID: 10010) (User: XPS15)
Description: The server Microsoft.WindowsStore_22401.1401.7.0_x64__8wekyb3d8bbwe!App.AppX4kq775cvjnf3kamcw69d81vz8nk5q6hq.mca did not register with DCOM within the required timeout.

Error: (03/02/2024 05:36:45 AM) (Source: DCOM) (EventID: 10010) (User: NT AUTHORITY)
Description: The server {338B40F9-9D68-4B53-A793-6B9AA0C5F63B} did not register with DCOM within the required timeout.

Error: (03/01/2024 07:41:56 PM) (Source: DCOM) (EventID: 10010) (User: XPS15)
Description: The server {69B7FE84-6361-4423-B948-1D64820B1E96} did not register with DCOM within the required timeout.

Error: (03/01/2024 07:39:23 PM) (Source: DCOM) (EventID: 10010) (User: XPS15)
Description: The server {69B7FE84-6361-4423-B948-1D64820B1E96} did not register with DCOM within the required timeout.

Error: (03/01/2024 07:25:46 PM) (Source: DCOM) (EventID: 10010) (User: XPS15)
Description: The server {69B7FE84-6361-4423-B948-1D64820B1E96} did not register with DCOM within the required timeout.

Error: (03/01/2024 06:40:34 PM) (Source: DCOM) (EventID: 10010) (User: XPS15)
Description: The server Microsoft.WindowsStore_22401.1401.7.0_x64__8wekyb3d8bbwe!App.AppX4kq775cvjnf3kamcw69d81vz8nk5q6hq.mca did not register with DCOM within the required timeout.

Error: (03/01/2024 06:31:29 PM) (Source: DCOM) (EventID: 10010) (User: XPS15)
Description: The server AppUp.IntelGraphicsExperience_1.100.5336.0_x64__8j3eq9eme6ctt!App.AppXcjrspnpxq6fpk8kypepcdfq9xmwkspw1.mca did not register with DCOM within the required timeout.

Error: (03/01/2024 06:31:19 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The igccservice service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.


Windows Defender:
================
Date: 2024-03-01 18:45:40
Description:
Microsoft Defender Antivirus scan has been stopped before completion.
Scan Type: Antimalware
Scan Parameters: Quick Scan

Date: 2024-02-27 18:08:44
Description:
Microsoft Defender Antivirus scan has been stopped before completion.
Scan Type: Antimalware
Scan Parameters: Quick Scan

Date: 2024-02-27 17:58:59
Description:
Microsoft Defender Antivirus scan has been stopped before completion.
Scan Type: Antimalware
Scan Parameters: Quick Scan

Date: 2024-02-26 15:11:44
Description:
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:Script/Phonzy.B!ml&threatid=2147772967&enterprise=0
Name: Trojan:Script/Phonzy.B!ml
Severity: Severe
Category: Trojan
Path: file:_C:\Windows\Temp\PF4592.pdf; file:_C:\Windows\Temp\PF46EE.pdf; file:_C:\Windows\Temp\PF4891.pdf; file:_C:\Windows\Temp\PFC4A5.pdf; file:_C:\Windows\Temp\PFE427.pdf
Detection Origin: Local machine
Detection Type: Concrete
Detection Source: Real-Time Protection
Process Name: C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
Security intelligence Version: AV: 1.405.637.0, AS: 1.405.637.0, NIS: 1.405.637.0
Engine Version: AM: 1.1.24010.10, NIS: 1.1.24010.10

Date: 2024-02-26 15:11:44
Description:
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:Script/Phonzy.B!ml&threatid=2147772967&enterprise=0
Name: Trojan:Script/Phonzy.B!ml
Severity: Severe
Category: Trojan
Path: file:_C:\Windows\Temp\PF4592.pdf; file:_C:\Windows\Temp\PF46EE.pdf; file:_C:\Windows\Temp\PF4891.pdf; file:_C:\Windows\Temp\PFE427.pdf
Detection Origin: Local machine
Detection Type: Concrete
Detection Source: Real-Time Protection
Process Name: C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
Security intelligence Version: AV: 1.405.637.0, AS: 1.405.637.0, NIS: 1.405.637.0
Engine Version: AM: 1.1.24010.10, NIS: 1.1.24010.10
Event[0]

Date: 2024-02-20 15:16:46
Description:
Microsoft Defender Antivirus has encountered an error trying to download and configure Microsoft Defender Antivirus (offline scan).
Error code: 0x8000000a
Error description: The data necessary to complete this operation is not yet available.  

Date: 2024-02-20 15:16:29
Description:
Microsoft Defender Antivirus has encountered an error trying to download and configure Microsoft Defender Antivirus (offline scan).
Error code: 0x8000000a
Error description: The data necessary to complete this operation is not yet available.  

Date: 2024-02-20 13:41:08
Description:
Microsoft Defender Antivirus Real-Time Protection feature has encountered an error and failed.
Feature: On Access
Error Code: 0x8007043c
Error description: This service cannot be started in Safe Mode
Reason: Antimalware security intelligence has stopped functioning for an unknown reason. In some instances, restarting the service may resolve the problem.

CodeIntegrity:
===============
Date: 2024-02-27 17:41:11
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\ProgramData\Microsoft\Windows Defender\Platform\4.18.23110.3-0\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_734897ab1d4f1106\igd10iumd64.dll that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Memory info ===========================

BIOS: Dell Inc. 1.20.0 12/19/2023
Motherboard: Dell Inc. 0MWGD4
Processor: 12th Gen Intel® Core™ i7-12700H
Percentage of memory in use: 49%
Total physical RAM: 16055.05 MB
Available physical RAM: 8183.63 MB
Total Virtual: 18487.05 MB
Available Virtual: 9384.73 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:452.94 GB) (Free:360.69 GB) (Model: NVMe PC801 NVMe SK hynix 512GB) (Protected) NTFS

\\?\Volume{f8a3ebdd-af0e-49a4-97a7-f56a7c13995b}\ (WINRETOOLS) (Fixed) (Total:1.04 GB) (Free:0.27 GB) NTFS
\\?\Volume{5594054d-82f4-4050-8259-bc74bb712a22}\ (Image) (Fixed) (Total:21.11 GB) (Free:0.07 GB) NTFS
\\?\Volume{4189d6ca-e7db-45bb-a195-d68191830a9e}\ (DELLSUPPORT) (Fixed) (Total:1.47 GB) (Free:0.48 GB) NTFS
\\?\Volume{8cb6fe55-0d2f-4116-b3ab-004d38087eac}\ (ESP) (Fixed) (Total:0.23 GB) (Free:0.14 GB) FAT32

==================== MBR & Partition Table ====================

==================== End of Addition.txt =======================

Thank you.

Please do this.

===================================================

Farbar Recovery Scan Tool Fix From Recovery Partition

--------------------

• Download Farbar Recover Scan Tool for 64 bit systems and save it to a USB device
• Download  Fixlist.txt   2.24KB   3 downloads and save it to the same USB device
• Insert the USB device into your compromised computer
• Holding down the Shift Key click Start, click the power icon, then select Reboot
• Click Troubleshoot
• Click Advanced options
• Click Command Prompt
• Choose an account to continue
• If necessary, enter the password then hit Continue
• In the command window type in Notepad and press Enter
• Under File menu select Open
• Select This PC and double click on your USB drive letter
• Next to Files of type: select All Files
• Right click on the FRST icon and select Run as administrator
• Click Yes to disclaimer that may appear
• Press Fix button
• A fixlog.txt file will be saved on the USB drive
• Reboot your computer then copy and paste the contents of Fixlog.txt in your reply.
• Check Windows Defender

===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.

• Fixlog
• Windows Defender?

To clarify, the instructions indicate there are 2(?) downloads.   Does that mean the program file and the fixlist?  I didn't see an additional txt document.

"Download  Fixlist.txt   2.24KB   2 downloads and save it to the same USB device"

Log below.

Defender continues to have the same behavior.

 

----------

 

Fix result of Farbar Recovery Scan Tool (x64) Version: 26.02.2024 01
Ran by SYSTEM (03-03-2024 12:52:33) Run:5
Running from D:\
Boot Mode: Recovery
==============================================

fixlist content:
*****************
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\Detections.log
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\History.Log
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\Unknown.Log
C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\00\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\01\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\02\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\03\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\04\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\05\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\06\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\07\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\08\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\09\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\10\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\11\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\12\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\13\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\14\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\15\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\16\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\17\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\18\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\19\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\20\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\21\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\22\*
*****************

"C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\Detections.log" => not found
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\History.Log => moved successfully
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\Unknown.Log => moved successfully
C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db => moved successfully

=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\00\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\00\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\01\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\01\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\02\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\02\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\03\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\03\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\04\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\04\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\05\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\05\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\06\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\06\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\07\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\07\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\08\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\08\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\09\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\09\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\10\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\10\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\11\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\11\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\12\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\12\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\13\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\13\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\14\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\14\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\15\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\15\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\16\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\16\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\17\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\17\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\18\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\18\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\19\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\19\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\20\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\20\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\21\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\21\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\22\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\22\*" ========


==== End of Fixlog 12:52:33 ====

What the "2" refers to is the number of times it has been downloaded.

Please run this.

===================================================

Farbar Recovery Scan Tool Fix

--------------------

• Right click on the FRST64 icon and select Run as administrator
• Highlight the below information then hit the Ctrl + C keys at the same time and the text will be copied
• There is no need to paste the information anywhere, FRST64 will do it for you

Start::
Folder: C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory
End::

• Click Fix
• When completed the tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.

===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.

• Fixlog

here is the log:

 

 

Fix result of Farbar Recovery Scan Tool (x64) Version: 26.02.2024 01
Ran by jenfr (03-03-2024 19:25:25) Run:6
Running from C:\Users\jenfr\Downloads
Loaded Profiles: jenfr & Boss
Boot Mode: Normal
==============================================

fixlist content:
*****************
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\Detections.log
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\History.Log
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\Unknown.Log
C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\00\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\01\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\02\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\03\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\04\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\05\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\06\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\07\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\08\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\09\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\10\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\11\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\12\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\13\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\14\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\15\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\16\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\17\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\18\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\19\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\20\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\21\*
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\22\*
*****************

"C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\Detections.log" => not found
Could not move "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\History.Log" => Scheduled to move on reboot.
"C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\Unknown.Log" => not found
Could not move "C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db" => Scheduled to move on reboot.

=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\00\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\00\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\01\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\01\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\02\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\02\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\03\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\03\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\04\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\04\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\05\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\05\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\06\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\06\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\07\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\07\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\08\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\08\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\09\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\09\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\10\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\10\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\11\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\11\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\12\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\12\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\13\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\13\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\14\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\14\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\15\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\15\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\16\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\16\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\17\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\17\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\18\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\18\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\19\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\19\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\20\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\20\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\21\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\21\*" ========


=========== "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\22\*" ==========

not found

========= End -> "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\22\*" ========


Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 03-03-2024 19:26:53)

C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\History.Log => Could not move
C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db => Could not move

==== End of Fixlog 19:26:53 ====

That is the wrong Fixlist. See Post #22.

oops, sorry about that.

Here we go:

 

Fix result of Farbar Recovery Scan Tool (x64) Version: 26.02.2024 01
Ran by jenfr (04-03-2024 08:33:59) Run:7
Running from C:\Users\jenfr\Downloads
Loaded Profiles: jenfr
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start::
Folder: C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory
End::
*****************


========================= Folder: C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory ========================

2024-02-18 11:46 - 2024-02-28 16:51 - 000000000 ____D [00000000000000000000000000000000] C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\00
2024-02-26 15:11 - 2024-02-29 11:53 - 000000000 ____D [00000000000000000000000000000000] C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\01
2024-02-18 14:32 - 2024-02-28 16:51 - 000000000 ____D [00000000000000000000000000000000] C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\02
2024-02-18 12:42 - 2024-02-28 16:51 - 000000000 ____D [00000000000000000000000000000000] C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\03
2024-02-18 12:41 - 2024-02-29 11:53 - 000000000 ____D [00000000000000000000000000000000] C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\04
2024-02-18 11:45 - 2024-02-29 11:53 - 000000000 ____D [00000000000000000000000000000000] C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\06
2024-02-20 12:44 - 2024-02-28 16:51 - 000000000 ____D [00000000000000000000000000000000] C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\07
2024-02-18 10:39 - 2024-02-29 11:53 - 000000000 ____D [00000000000000000000000000000000] C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\08
2024-02-18 11:37 - 2024-02-28 16:51 - 000000000 ____D [00000000000000000000000000000000] C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\09
2024-02-18 13:43 - 2024-02-29 11:53 - 000000000 ____D [00000000000000000000000000000000] C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\10
2024-02-18 12:42 - 2024-02-28 16:51 - 000000000 ____D [00000000000000000000000000000000] C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\12
2024-02-18 12:42 - 2024-02-28 16:51 - 000000000 ____D [00000000000000000000000000000000] C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\13
2024-02-18 12:41 - 2024-02-29 11:53 - 000000000 ____D [00000000000000000000000000000000] C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\14
2024-02-18 12:42 - 2024-02-29 11:53 - 000000000 ____D [00000000000000000000000000000000] C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\15
2024-02-18 14:35 - 2024-02-28 16:51 - 000000000 ____D [00000000000000000000000000000000] C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\16
2024-02-18 11:46 - 2024-02-29 11:53 - 000000000 ____D [00000000000000000000000000000000] C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\17
2024-02-18 10:39 - 2024-02-28 16:51 - 000000000 ____D [00000000000000000000000000000000] C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\18
2024-02-18 14:32 - 2024-02-29 11:53 - 000000000 ____D [00000000000000000000000000000000] C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\19
2024-02-18 12:42 - 2024-02-28 16:51 - 000000000 ____D [00000000000000000000000000000000] C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\20
2024-02-18 18:27 - 2024-02-28 16:51 - 000000000 ____D [00000000000000000000000000000000] C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\21
2024-02-18 18:31 - 2024-02-29 11:53 - 000000000 ____D [00000000000000000000000000000000] C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\22

====== End of Folder: ======


==== End of Fixlog 08:33:59 ====

Thank you, that is what I needed.

Can you update me on the status of your computer and what issues you may be seeing?

Windows Security does not seem to load.  Once I get to the Windows Security settings(Settings--Privacy&Security--Windows Security) none of the options load.  For example, if I click on "Virus&Threat protection" the window responds as if its going to load (large blue shield in the window) but then reverts to main Windows Security page.  The same thing happens if I click on any other settings - 'open windows security', 'account protection", 'firewall&network protection' etc.  Each of the areas says "no actions needed" so it appears the original threats are removed but I can't figure out how to run a new scan or do anything in the Security panel.  I am able to access other Windows settings just nothing in the Security section.  I tried to run 'Windows Security' from the taskbar icon and same problem.

 

As I mentioned earlier, there appears to be a new "microsoft defender" icon and associated app that I don't recall being there previously.  From reading, it seems that this might have been auto-installed with my recent MS365 subscription renewal but shouldn't compete with Windows Security.  Within the 'Defender' app it says this device look good (eg. security history with no threats, virus&threat protection settings' active).

There is a blue button that says "manage in windows security' and when clicked it engages the same behavior as described above when trying to access 'Windows Security' from the computer settings panel.

 

I haven't done much troubleshooting because I didn't want to complicate matters by changing any settings while we are working together. 

 

A few questions:

1) It sounds like you don't think this is related to the recent fixes so maybe it is time for me to seek local assistance and/or do my own troubleshooting.   What are your thoughts? 

2) Were you able to determine where the identified threats came from? 

Thank you.

Greetings.

Let's work on this a bit.

I can't tell the source of the infected files. Our issue was more about Windows Defender itself and the historical information in the Defender folders not being cleared out.

Your research regarding the 2 entries is correct.

Can you take a screen shot of the manage in windows security button?

Please do this.

===================================================

Farbar Recovery Scan Tool Fix

--------------------

• Right click on the FRST64 icon and select Run as administrator
• Highlight the below information then hit the Ctrl + C keys at the same time and the text will be copied
• There is no need to paste the information anywhere, FRST64 will do it for you

Start::
StartRegedit:

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Virus and threat protection]
"UILockdown"=dword:00000000

EndRegedit:

ExportKey: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Virus and threat protection

Reboot:
End::

• Click Fix
• When completed the tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.
• Upon reboot check Windows Security

===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.

• Fixlog
• Windows Security?
• Screen shot

Ok, thank you.  Much appreciated.

 

Windows security is the same.....

 

I'm getting a error when I try to paste my screenshot.  I took screenshot, placed it into word, cropped and then tried to paste here.

Is there a preferred method?  Didn't want to attach unless instructed.

 

---

Fix result of Farbar Recovery Scan Tool (x64) Version: 05.03.2024
Ran by jenfr (05-03-2024 09:08:38) Run:8
Running from C:\Users\jenfr\Downloads
Loaded Profiles: jenfr
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start::
StartRegedit:

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Virus and threat protection]
"UILockdown"=dword:00000000

EndRegedit:

ExportKey: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Virus and threat protection

Reboot:
End::
*****************

Registry ====> The operation completed successfully.
================== ExportKey: ===================

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Virus and threat protection]
"UILockdown"="0"

=== End of ExportKey ===


The system needed a reboot.

==== End of Fixlog 09:08:38 ====

Zip the photo file and attach it.