Remote Access Tech Support Scam Victim

Elderly friend was victim of a phishing tech/fraud support scam.

The scammers definitely had remote access to their computer. The accessed the victims bank accounts and stole savings funds.

The elderly friend has asked for help to restore their computer for safe use.

We have backed up their personal information to USB sticks (documents and photos). They'd like to understand if there is high risk in accessing transferring that information in the future.

Thank you in advance for any advice or help you can provide!

------------------------------------------------------------------------------------

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 19.04.2024 01

Ran by dotco (administrator) on DESKTOP-N36GKIL (Dell Inc. Inspiron 15 5510) (25-04-2024 13:45:43)

Running from C:\Users\dotco\Desktop\FRST64.exe

Loaded Profiles: dotco

Platform: Microsoft Windows 11 Home Version 23H2 22631.3296 (X64) Language: English (United States)

Default browser: Edge

Boot Mode: Normal

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(C:\Program Files\Dell\DTP\InstrumentationSubAgent\Dell.TechHub.Instrumentation.SubAgent.exe ->) (Dell Technologies Inc. -> Dell, Inc.) C:\Program Files\Dell\DTP\InstrumentationSubAgent\Dell.TechHub.Instrumentation.UserProcess.exe

(C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe ->) (Dell Technologies Inc. -> Dell Inc.) C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssistHardwareDiags.exe

(C:\Program Files\Dell\TechHub\Dell.TechHub.exe ->) (Dell Inc -> ) C:\Program Files (x86)\Dell\UpdateService\DCF\Dell.DCF.UA.Bradbury.API.SubAgent.exe

(C:\Program Files\Dell\TechHub\Dell.TechHub.exe ->) (Dell Inc -> ) C:\Program Files\Dell\DTP\DiagnosticsSubAgent\Dell.TechHub.Diagnostics.SubAgent.exe

(C:\Program Files\Dell\TechHub\Dell.TechHub.exe ->) (Dell Technologies Inc. -> Dell) C:\Program Files\Dell\TechHub\Dell.CoreServices.Client.exe

(C:\Program Files\Dell\TechHub\Dell.TechHub.exe ->) (Dell Technologies Inc. -> Dell, Inc.) C:\Program Files\Dell\DTP\AnalyticsSubAgent\Dell.TechHub.Analytics.SubAgent.exe

(C:\Program Files\Dell\TechHub\Dell.TechHub.exe ->) (Dell Technologies Inc. -> Dell, Inc.) C:\Program Files\Dell\DTP\DataManagerSubAgent\Dell.TechHub.DataManager.SubAgent.exe

(C:\Program Files\Dell\TechHub\Dell.TechHub.exe ->) (Dell Technologies Inc. -> Dell, Inc.) C:\Program Files\Dell\DTP\InstrumentationSubAgent\Dell.TechHub.Instrumentation.SubAgent.exe

(C:\Program Files\McAfee\WebAdvisor\servicehost.exe ->) (McAfee, LLC -> McAfee, LLC) C:\Program Files\McAfee\WebAdvisor\uihost.exe

(C:\Program Files\Rivet Networks\SmartByte\RAPSService.exe ->) (Rivet Networks LLC) [File not signed] C:\Program Files\Rivet Networks\SmartByte\RAPS.exe

(C:\Program Files\WindowsApps\MicrosoftTeams_24088.3902.2792.6069_x64__8wekyb3d8bbwe\msteams.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.65\msedgewebview2.exe <7>

(C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24020.7-0\MsMpEng.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24020.7-0\MpCmdRun.exe <2>

(C:\Users\dotco\AppData\Local\Apps\2.0\ERKZXRNY.81G\EMNYGLLL.7LN\scre..tion_25b0fbb6ef7eb094_0017.0009_8a0714154a9bd7dd\ScreenConnect.ClientService.exe ->) (Connectwise, LLC -> ScreenConnect Software) C:\Users\dotco\AppData\Local\Apps\2.0\ERKZXRNY.81G\EMNYGLLL.7LN\scre..tion_25b0fbb6ef7eb094_0017.0009_8a0714154a9bd7dd\ScreenConnect.WindowsClient.exe

(DriverStore\FileRepository\cui_dch.inf_amd64_6673c5322430fc8a\igfxCUIServiceN.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_6673c5322430fc8a\igfxEMN.exe

(DriverStore\FileRepository\dptf_cpu.inf_amd64_1da48d5885266bb7\esif_uf.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\dptf_cpu.inf_amd64_1da48d5885266bb7\dptf_helper.exe

(explorer.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe <17>

(explorer.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE

(explorer.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft OneDrive\OneDrive.exe

(explorer.exe ->) (Waves Inc -> Waves Audio Ltd.) C:\Windows\System32\DriverStore\FileRepository\wavesapo10de.inf_amd64_f7373b847419c8d1\WavesSvc64.exe

(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleCrashHandler.exe

(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleCrashHandler64.exe

(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

(services.exe ->) (Connectwise, LLC -> ) C:\Users\dotco\AppData\Local\Apps\2.0\ERKZXRNY.81G\EMNYGLLL.7LN\scre..tion_25b0fbb6ef7eb094_0017.0009_8a0714154a9bd7dd\ScreenConnect.ClientService.exe

(services.exe ->) (CyberLink Corp. -> CyberLink) C:\Program Files\CyberLink\Shared files\RichVideo64.exe

(services.exe ->) (Dell Inc -> ) C:\Program Files (x86)\Dell Digital Delivery Services\Dell.D3.WinSvc.exe

(services.exe ->) (Dell Inc -> ) C:\Program Files (x86)\Dell\UpdateService\ServiceShell.exe

(services.exe ->) (Dell Inc -> Dell Inc.) C:\Program Files\Dell\Fusion\FusionService.exe

(services.exe ->) (Dell Inc -> Dell INC.) C:\Program Files\Dell\SARemediation\agent\DellSupportAssistRemedationService.exe

(services.exe ->) (Dell Technologies Inc. -> Dell Inc.) C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe

(services.exe ->) (Dell Technologies Inc. -> Dell Technologies Inc.) C:\Program Files\Dell\DellDataVault\DDVCollectorSvcApi.exe

(services.exe ->) (Dell Technologies Inc. -> Dell Technologies Inc.) C:\Program Files\Dell\DellDataVault\DDVDataCollector.exe

(services.exe ->) (Dell Technologies Inc. -> Dell Technologies Inc.) C:\Program Files\Dell\DellDataVault\DDVRulesProcessor.exe

(services.exe ->) (Dell Technologies Inc. -> Dell) C:\Program Files\Dell\TechHub\Dell.TechHub.exe

(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_6673c5322430fc8a\igfxCUIServiceN.exe

(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\dal.inf_amd64_af50fdb80983f7bc\jhi_service.exe

(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\dptf_cpu.inf_amd64_1da48d5885266bb7\esif_uf.exe

(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iastorvd.inf_amd64_15c9ea6001a5206d\RstMwService.exe

(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igcc_dch.inf_amd64_a687edda40db3316\OneApp.IGCC.WinService.exe

(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3fd734cf72127ac9\IntelCpHDCPSvc.exe

(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\mewmiprov.inf_amd64_ab7d4ea1d12c01d4\WMIRegistrationService.exe

(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\TbtP2pShortcutService.exe

(services.exe ->) (Intel Corporation -> Intel) C:\Windows\System32\DriverStore\FileRepository\intcoed.inf_amd64_29fd1afabcf5470c\AS\IAS\IntelAudioService.exe

(services.exe ->) (McAfee, LLC -> McAfee, LLC) C:\Program Files\McAfee\WebAdvisor\servicehost.exe

(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe

(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24020.7-0\MsMpEng.exe

(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24020.7-0\NisSrv.exe

(services.exe ->) (Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Windows\System32\DriverStore\FileRepository\realtekservice.inf_amd64_04ff63d068f8c626\RtkAudUService64.exe <3>

(services.exe ->) (Rivet Networks) [File not signed] C:\Program Files\Rivet Networks\SmartByte\SmartByteAnalyticsService.exe

(services.exe ->) (Rivet Networks) [File not signed] C:\Program Files\Rivet Networks\SmartByte\SmartByteNetworkService.exe

(services.exe ->) (Rivet Networks, LLC.) [File not signed] C:\Program Files\Rivet Networks\SmartByte\RAPSService.exe

(services.exe ->) (Shenzhen Goodix Technology Co., Ltd. -> Goodix) C:\Windows\System32\drivers\GoodixSessionService.exe

(services.exe ->) (Waves Inc -> Waves Audio Ltd) C:\Windows\System32\DriverStore\FileRepository\wavesapo10de.inf_amd64_f7373b847419c8d1\WavesAudioService.exe

(services.exe ->) (Waves Inc -> Waves Audio Ltd.) C:\Windows\System32\DriverStore\FileRepository\wavesapo10de.inf_amd64_f7373b847419c8d1\WavesSysSvc64.exe

(svchost.exe ->) (CyberLink Corp. -> CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe

(svchost.exe ->) (DELL) [File not signed] C:\Program Files\Rivet Networks\SmartByte\SmartByteTelemetry.exe

(svchost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

(svchost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft OneDrive\24.070.0407.0003\FileCoAuth.exe

(svchost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.25992.9000.0_x64__8wekyb3d8bbwe\SecHealthUI.exe

(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_424.1301.450.0_x64__cw5n1h2txyewy\Dashboard\WidgetService.exe

(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe

(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe <2>

(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\LocationNotificationWindows.exe

(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe

(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\wlanext.exe

(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\UUS\Packages\Preview\amd64\MoUsoCoreWorker.exe

(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\UUS\Packages\Preview\amd64\wuaucltcore.exe

(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22621.3447_none_e948831242de6298\TiWorker.exe

(svchost.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\Windows\System32\SecurityHealth\1.0.2402.27001-0\SecurityHealthHost.exe

==================== Registry (Whitelisted) ===================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtkAudUService] => C:\WINDOWS\System32\DriverStore\FileRepository\realtekservice.inf_amd64_04ff63d068f8c626\RtkAudUService64.exe [1961360 2023-11-02] (Realtek Semiconductor Corp. -> Realtek Semiconductor)

HKLM\...\Run: [WavesSvc] => C:\WINDOWS\System32\DriverStore\FileRepository\wavesapo10de.inf_amd64_f7373b847419c8d1\WavesSvc64.exe [4984408 2022-10-03] (Waves Inc -> Waves Audio Ltd.)

HKU\S-1-5-19\...\RunOnce: [OneDrive] => C:\Program Files\Microsoft OneDrive\OneDrive.exe [3306528 2024-04-25] (Microsoft Corporation -> Microsoft Corporation)

HKU\S-1-5-20\...\RunOnce: [OneDrive] => C:\Program Files\Microsoft OneDrive\OneDrive.exe [3306528 2024-04-25] (Microsoft Corporation -> Microsoft Corporation)

HKU\S-1-5-21-2222835479-4008314922-1056283517-1001\...\Run: [OneDrive] => C:\Program Files\Microsoft OneDrive\OneDrive.exe [3306528 2024-04-25] (Microsoft Corporation -> Microsoft Corporation)

HKU\S-1-5-21-2222835479-4008314922-1056283517-1001\...\Run: [MicrosoftEdgeAutoLaunch_13239A75A527524E44EDE66914248AED] => "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start [4063800 2024-03-27] (Microsoft Corporation -> Microsoft Corporation)

HKLM\...\Windows x64\Print Processors\Canon MG4100 series Print Processor: C:\Windows\System32\spool\prtprocs\x64\CNMPDAS.DLL [30208 2012-03-14] (Microsoft Windows Hardware Compatibility Publisher -> CANON INC.)

HKLM\...\Print\Monitors\Canon BJ Language Monitor MG4100 series: C:\WINDOWS\system32\CNMLMAS.DLL [385024 2012-03-14] (Microsoft Windows Hardware Compatibility Publisher -> CANON INC.)

HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files\Google\Chrome\Application\123.0.6312.88\Installer\chrmstp.exe [2024-04-03] (Google LLC -> Google LLC)

Startup: C:\Users\dotco\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk [2022-03-07]

ShortcutTarget: Send to OneNote.lnk -> C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE (Microsoft Corporation -> Microsoft Corporation)

==================== Scheduled Tasks (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {C473053A-0DB9-4025-B60A-679C28D20171} - System32\Tasks\CLMLSvc_P2G8 => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [190744 2018-03-02] (CyberLink Corp. -> CyberLink)

Task: {49F6606C-73EA-4274-9219-A43A0A8A5BAA} - System32\Tasks\CLVDLauncher => C:\Program Files (x86)\CyberLink\Power2Go8\CLVDLauncher.exe [347416 2018-02-27] (CyberLink Corp. -> CyberLink Corp.)

Task: {331E0267-7D68-48C8-9D7A-90DFF835847D} - System32\Tasks\Dell SupportAssistAgent AutoUpdate => C:\Program Files\Dell\SupportAssistAgent\bin\FrameworkAgents\SupportAssistInstaller.exe [964936 2024-03-20] (Dell Technologies Inc. -> Dell Inc.) -> C:\Program Files\Dell\SupportAssistAgent\bin\AutoUpdate

Task: {705302C3-1574-4FF6-B9E3-B5E40A5A169E} - System32\Tasks\GoogleUpdateTaskMachineCore{3BDD2D4B-301F-4BD6-8A62-88CD8EA42854} => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [156232 2022-03-07] (Google LLC -> Google LLC)

Task: {3AB726F3-C522-46D5-B8D4-4ADCE5CF7FE6} - System32\Tasks\GoogleUpdateTaskMachineUA{6BEC0B92-CCC1-4330-8202-9EC29A8E0D4D} => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [156232 2022-03-07] (Google LLC -> Google LLC)

Task: {375EA5F0-E197-4AAC-8969-ABB422C0B00F} - System32\Tasks\Microsoft\Office\Office Automatic Updates 2.0 => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [28491744 2024-03-07] (Microsoft Corporation -> Microsoft Corporation)

Task: {28EEB186-EFE1-4147-9691-E36C054FE587} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [28491744 2024-03-07] (Microsoft Corporation -> Microsoft Corporation)

Task: {42F92507-6DDE-4EAB-AB2A-E5058F0DA338} - System32\Tasks\Microsoft\Office\Office Feature Updates => C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [309184 2024-03-24] (Microsoft Corporation -> Microsoft Corporation)

Task: {D9F80C33-306E-4D24-98B8-CAE9D840AD7B} - System32\Tasks\Microsoft\Office\Office Feature Updates Logon => C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [309184 2024-03-24] (Microsoft Corporation -> Microsoft Corporation)

Task: {15772F17-C88D-4B1C-899D-0DD9AB34153F} - System32\Tasks\Microsoft\Office\Office Performance Monitor => C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\operfmon.exe [170136 2024-03-24] (Microsoft Corporation -> Microsoft Corporation)

Task: {E0F10DCF-44AD-40E8-9370-FB5DA59F93FB} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe (No File)

Task: {209A2AE7-2F5C-45DF-BBCF-D3EBDE7682D2} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24020.7-0\MpCmdRun.exe [1650024 2024-03-31] (Microsoft Windows Publisher -> Microsoft Corporation)

Task: {CA50DCFA-800D-4EF6-BC1A-A67C8C6F34A4} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24020.7-0\MpCmdRun.exe [1650024 2024-03-31] (Microsoft Windows Publisher -> Microsoft Corporation)

Task: {D445DAD5-F56A-4F95-AF20-A5980E7483B0} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24020.7-0\MpCmdRun.exe [1650024 2024-03-31] (Microsoft Windows Publisher -> Microsoft Corporation)

Task: {AECC9C02-341F-44A4-926E-1AF9F8F48F7B} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24020.7-0\MpCmdRun.exe [1650024 2024-03-31] (Microsoft Windows Publisher -> Microsoft Corporation)

Task: {55F5BB36-3A53-4A1C-8E63-44CB7DC68665} - System32\Tasks\OneDrive Per-Machine Standalone Update Task => C:\Program Files\Microsoft OneDrive\OneDriveStandaloneUpdater.exe [4207120 2024-04-25] (Microsoft Corporation -> Microsoft Corporation)

Task: {EF408257-9EEE-420B-AAB3-C7ADD69E7193} - System32\Tasks\OneDrive Reporting Task-S-1-5-21-2222835479-4008314922-1056283517-1001 => C:\Program Files\Microsoft OneDrive\OneDriveStandaloneUpdater.exe [4207120 2024-04-25] (Microsoft Corporation -> Microsoft Corporation)

Task: {5BEC38C2-BF9B-4C6B-B169-A3F125D421E6} - System32\Tasks\SmartByte Telemetry => C:\Program Files\Rivet Networks\SmartByte\SmartByteTelemetry.exe [87040 2022-07-28] (DELL) [File not signed]

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 203.109.191.1 203.118.191.1 192.168.68.1

Tcpip\..\Interfaces\{f0d492a4-93a3-42a3-ab5b-90dc6e81f024}: [DhcpNameServer] 203.109.191.1 203.118.191.1 192.168.68.1

Edge:

=======

Edge DefaultProfile: Default

Edge Profile: C:\Users\dotco\AppData\Local\Microsoft\Edge\User Data\Default [2024-04-25]

Edge Notifications: Default -> hxxps://www.facebook.com; hxxps://www.oversixty.co.nz

Edge Extension: (Google Docs Offline) - C:\Users\dotco\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2024-03-24]

Edge Extension: (Edge relevant text changes) - C:\Users\dotco\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha [2024-01-24]

Edge Extension: (Total Adblock - Ad Blocker) - C:\Users\dotco\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\kkkldohdhcfhpjchcefpkfhjfeapdmek [2024-04-25]

Edge HKLM-x32\...\Edge\Extension: [fdhgeoginicibhagdmblfikbgbkahibd]

FireFox:

========

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL [2024-02-04] (Microsoft Corporation -> Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\NPSPWRAP.DLL [2024-02-04] (Microsoft Corporation -> Microsoft Corporation)

Chrome:

=======

CHR Profile: C:\Users\dotco\AppData\Local\Google\Chrome\User Data\Default [2024-04-21]

CHR DefaultSearchURL: Default -> hxxps://nz.search.yahoo.com/search?fr=mcafee&type=E210NZ105G0&p={searchTerms}

CHR DefaultSearchKeyword: Default -> mcafee

CHR DefaultSuggestURL: Default -> hxxps://nz.search.yahoo.com/sugg/gossip/gossip-nz-partner?output=fxjson&appid=mca&source=yahoo_mcafee_searchassist&command={searchTerms}

CHR Extension: (Google Docs Offline) - C:\Users\dotco\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2024-04-02]

CHR Extension: (Chrome Web Store Payments) - C:\Users\dotco\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2024-04-02]

CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho]

CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho]

==================== Services (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [14097992 2024-03-07] (Microsoft Corporation -> Microsoft Corporation)

R2 DDVCollectorSvcApi; C:\Program Files\Dell\DellDataVault\DDVCollectorSvcApi.exe [458128 2023-12-07] (Dell Technologies Inc. -> Dell Technologies Inc.)

R2 DDVDataCollector; C:\Program Files\Dell\DellDataVault\DDVDataCollector.exe [159632 2023-12-07] (Dell Technologies Inc. -> Dell Technologies Inc.)

R2 DDVRulesProcessor; C:\Program Files\Dell\DellDataVault\DDVRulesProcessor.exe [481680 2023-12-07] (Dell Technologies Inc. -> Dell Technologies Inc.)

R2 Dell Digital Delivery Services; C:\Program Files (x86)\Dell Digital Delivery Services\Dell.D3.WinSvc.exe [57760 2023-12-20] (Dell Inc -> )

R2 Dell SupportAssist Remediation; C:\Program Files\Dell\SARemediation\agent\DellSupportAssistRemedationService.exe [22224 2023-12-13] (Dell Inc -> Dell INC.)

R2 DellClientManagementService; C:\Program Files (x86)\Dell\UpdateService\ServiceShell.exe [50392 2024-01-27] (Dell Inc -> )

R2 DellTechHub; C:\Program Files\Dell\TechHub\Dell.TechHub.exe [159664 2023-12-22] (Dell Technologies Inc. -> Dell)

S3 FileSyncHelper; C:\Program Files\Microsoft OneDrive\24.070.0407.0003\FileSyncHelper.exe [3507728 2024-04-25] (Microsoft Corporation -> Microsoft Corporation)

R2 FusionService; C:\Program Files\Dell\Fusion\FusionService.exe [25336 2022-03-29] (Dell Inc -> Dell Inc.)

R2 IntelAudioService; C:\WINDOWS\System32\DriverStore\FileRepository\intcoed.inf_amd64_29fd1afabcf5470c\AS\IAS\IntelAudioService.exe [530520 2023-10-18] (Intel Corporation -> Intel)

R2 McAfee WebAdvisor; C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe [889400 2024-04-25] (McAfee, LLC -> McAfee, LLC)

S3 OneDrive Updater Service; C:\Program Files\Microsoft OneDrive\24.070.0407.0003\OneDriveUpdaterService.exe [3848208 2024-04-25] (Microsoft Corporation -> Microsoft Corporation)

R2 RAPSService; C:\Program Files\Rivet Networks\SmartByte\RAPSService.exe [56832 2022-07-27] (Rivet Networks, LLC.) [File not signed]

R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [614664 2016-09-08] (CyberLink Corp. -> CyberLink)

S3 RNDBWM; C:\Program Files\Rivet Networks\SmartByte\RNDBWMService.exe [56832 2022-07-27] (Rivet Networks, LLC.) [File not signed]

R2 ScreenConnect Client (f034c877-df09-4862-b9ac-3a931e50ab76); C:\Users\dotco\AppData\Local\Apps\2.0\ERKZXRNY.81G\EMNYGLLL.7LN\scre..tion_25b0fbb6ef7eb094_0017.0009_8a0714154a9bd7dd\ScreenConnect.ClientService.exe [95520 2024-04-02] (Connectwise, LLC -> )

R2 SessionSvc; C:\WINDOWS\System32\drivers\GoodixSessionService.exe [44160 2021-03-18] (Shenzhen Goodix Technology Co., Ltd. -> Goodix)

R2 SmartByte Analytics Service; C:\Program Files\Rivet Networks\SmartByte\SmartByteAnalyticsService.exe [1623552 2022-07-28] (Rivet Networks) [File not signed]

R2 SmartByte Network Service x64; C:\Program Files\Rivet Networks\SmartByte\SmartByteNetworkService.exe [2381824 2022-07-28] (Rivet Networks) [File not signed]

R2 SupportAssistAgent; C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe [159048 2024-03-20] (Dell Technologies Inc. -> Dell Inc.)

R2 TbtP2pShortcutService; C:\WINDOWS\TbtP2pShortcutService.exe [256608 2022-06-29] (Intel Corporation -> Intel Corporation)

R2 WavesAudioService; C:\WINDOWS\System32\DriverStore\FileRepository\wavesapo10de.inf_amd64_f7373b847419c8d1\WavesAudioService.exe [160856 2022-10-03] (Waves Inc -> Waves Audio Ltd)

S3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24020.7-0\NisSrv.exe [3191272 2024-03-31] (Microsoft Windows Publisher -> Microsoft Corporation)

U2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24020.7-0\MsMpEng.exe [133688 2024-03-31] (Microsoft Windows Publisher -> Microsoft Corporation)

===================== Drivers (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 BthA2dp; C:\WINDOWS\System32\drivers\BthA2dp.sys [532480 2022-12-13] (Microsoft Corporation) [File not signed]

S3 BthHFEnum; C:\WINDOWS\System32\drivers\bthhfenum.sys [184320 2022-12-13] (Microsoft Corporation) [File not signed]

S3 BTHMODEM; C:\WINDOWS\System32\drivers\bthmodem.sys [106496 2022-05-07] (Microsoft Corporation) [File not signed]

S3 DDDriver; C:\WINDOWS\System32\drivers\dddriver64Dcsa.sys [43400 2021-09-09] (Microsoft Windows Hardware Compatibility Publisher -> Dell Technologies)

R3 DellInstrumentation; C:\WINDOWS\System32\drivers\DellInstrumentation.sys [46640 2023-08-29] (Microsoft Windows Hardware Compatibility Publisher -> Dell)

S3 GeneStor; C:\WINDOWS\System32\drivers\GeneStor.sys [137040 2021-01-21] (GENESYS LOGIC, INC. -> Genesys Logic)

S3 GSCAuxDriver; C:\WINDOWS\System32\DriverStore\FileRepository\gscauxdriver.inf_amd64_47dea9773e9dfab7\GSCAuxDriverx64.sys [78872 2021-08-23] (Intel Corporation -> Intel Corporation)

S3 GSCx64; C:\WINDOWS\System32\DriverStore\FileRepository\gscheci.inf_amd64_1027aa064fe1f3f7\TeeDriverGSCW8x64.sys [258088 2021-08-23] (Intel Corporation -> Intel Corporation)

R3 iaLPSS2_GPIO2_TGL; C:\WINDOWS\System32\DriverStore\FileRepository\ialpss2_gpio2_tgl.inf_amd64_c330c09d72f3e083\iaLPSS2_GPIO2_TGL.sys [128664 2021-01-28] (Intel Corporation -> Intel Corporation)

R3 iaLPSS2_I2C_TGL; C:\WINDOWS\System32\DriverStore\FileRepository\ialpss2_i2c_tgl.inf_amd64_312c3014729186bd\iaLPSS2_I2C_TGL.sys [201376 2021-01-28] (Intel Corporation -> Intel Corporation)

S3 iaLPSS2_SPI_TGL; C:\WINDOWS\System32\DriverStore\FileRepository\ialpss2_spi_tgl.inf_amd64_dae60954c36e87c0\iaLPSS2_SPI_TGL.sys [155808 2021-01-28] (Intel Corporation -> Intel Corporation)

S3 iaLPSS2_UART2_TGL; C:\WINDOWS\System32\DriverStore\FileRepository\ialpss2_uart2_tgl.inf_amd64_0b4251313af34984\iaLPSS2_UART2_TGL.sys [310432 2021-01-28] (Intel Corporation -> Intel Corporation)

R0 iaStorVD; C:\WINDOWS\System32\drivers\iaStorVD.sys [1548488 2022-10-27] (Intel Corporation -> Intel Corporation)

R3 IntcUSB; C:\WINDOWS\System32\DriverStore\FileRepository\intcusb.inf_amd64_bc398e7169495415\IntcUSB.sys [922712 2023-10-18] (Intel Corporation -> Intel® Corporation)

R3 MpKslfbc2308e; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{420E6C64-D9E0-4535-A438-783DDC34FF95}\MpKslDrv.sys [301336 2024-04-25] (Microsoft Windows -> Microsoft Corporation)

S3 ScrHIDDriver3; C:\WINDOWS\System32\drivers\ScrHIDDriver3.sys [63296 2021-10-02] (SCREENOVATE TECHNOLOGIES LTD. -> Screenovate Technologies Ltd.)

R3 SmbCoSvc; C:\WINDOWS\system32\DRIVERS\SmbCo10X64.sys [167080 2022-07-27] (Intel Corporation -> Rivet Networks, LLC.)

R0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [20928 2024-03-31] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)

U5 WdDevFlt; C:\Windows\System32\Drivers\WdDevFlt.sys [169232 2022-05-07] (Microsoft Windows -> Microsoft Corporation)

R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [603416 2024-03-31] (Microsoft Windows -> Microsoft Corporation)

S3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [105752 2024-03-31] (Microsoft Windows -> Microsoft Corporation)

R3 WiManH; C:\WINDOWS\System32\DriverStore\FileRepository\wiman.inf_amd64_f54d0a27ac206b8c\WiManH\WiManH.sys [175672 2021-07-28] (Intel Corporation -> Intel Corporation)

S1 WinSetupMon; system32\DRIVERS\WinSetupMon.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One month (created) (Whitelisted) =========

(If an entry is included in the fixlist, the file/folder will be moved.)

2024-04-25 13:45 - 2024-04-25 13:46 - 000028001 _____ C:\Users\dotco\Desktop\FRST.txt

2024-04-25 13:45 - 2024-04-25 13:45 - 000000000 ____D C:\FRST

2024-04-25 13:43 - 2024-04-25 13:44 - 000000000 ___HD C:\$WinREAgent

2024-04-25 13:43 - 2024-04-25 13:43 - 002394112 _____ (Farbar) C:\Users\dotco\Desktop\FRST64.exe

2024-04-25 13:37 - 2024-04-25 13:37 - 000000000 ____D C:\Users\dotco\Documents\Dell

2024-04-25 13:34 - 2024-04-25 13:34 - 000000650 _____ C:\WINDOWS\SysWOW64\user.config

2024-04-25 13:30 - 2024-04-25 13:30 - 000003194 _____ C:\WINDOWS\system32\Tasks\OneDrive Per-Machine Standalone Update Task

2024-04-25 13:30 - 2024-04-25 13:30 - 000002144 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk

2024-04-25 13:30 - 2024-04-25 13:30 - 000000000 ___HD C:\OneDriveTemp

2024-04-21 16:49 - 2024-04-21 16:50 - 000000000 ____D C:\Users\dotco\Documents\Back Up Folder Four - Documnets

2024-04-21 16:47 - 2024-04-21 16:48 - 000000000 ____D C:\Users\dotco\Desktop\Backup Folder Three

2024-04-02 14:34 - 2024-04-02 14:34 - 000000559 _____ C:\WINDOWS\system32\user.config

2024-04-02 14:33 - 2024-04-02 14:34 - 000000000 ____D C:\Users\dotco\AppData\Local\Deployment

2024-04-02 14:33 - 2024-04-02 14:33 - 000086304 _____ C:\Users\dotco\Downloads\Support.Client.exe

2024-04-02 14:33 - 2024-04-02 14:33 - 000000000 ____D C:\Users\dotco\AppData\Local\Apps\2.0

2024-04-02 14:09 - 2024-04-03 10:24 - 000002251 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

2024-04-02 14:09 - 2024-04-03 10:24 - 000002210 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2024-04-02 14:09 - 2024-04-02 14:09 - 001376816 _____ (Google LLC) C:\Users\dotco\Downloads\ChromeSetup (2).exe

2024-04-02 13:51 - 2024-04-03 10:29 - 000000000 ____D C:\Program Files (x86)\UltraViewer

2024-04-02 13:51 - 2024-04-02 14:01 - 000000000 ____D C:\Users\dotco\AppData\Roaming\UltraViewer

2024-04-02 13:49 - 2024-04-02 13:49 - 003635392 _____ (DucFabulous ) C:\Users\dotco\Downloads\UltraViewer_setup_6.6_en.exe

2024-04-02 13:38 - 2024-04-02 13:38 - 001376816 _____ (Google LLC) C:\Users\dotco\Downloads\ChromeSetup (1).exe

2024-04-02 13:37 - 2024-04-02 13:37 - 001376816 _____ (Google LLC) C:\Users\dotco\Downloads\ChromeSetup.exe

2024-04-02 13:36 - 2024-04-02 13:36 - 001544432 _____ (Driver Support) C:\Users\dotco\Downloads\DriverUpdate.exe

2024-03-31 14:06 - 2024-03-31 14:06 - 000020023 _____ C:\WINDOWS\SysWOW64\IntegratedServicesRegionPolicySet.json

2024-03-31 14:06 - 2024-03-31 14:06 - 000020023 _____ C:\WINDOWS\system32\IntegratedServicesRegionPolicySet.json

2024-03-31 13:18 - 2024-03-31 13:18 - 000003946 _____ C:\WINDOWS\system32\Tasks\Dell SupportAssistAgent AutoUpdate

==================== One month (modified) ==================

(If an entry is included in the fixlist, the file/folder will be moved.)

2024-04-25 13:46 - 2022-05-07 17:24 - 000000000 ____D C:\WINDOWS\SystemTemp

2024-04-25 13:46 - 2022-02-23 01:31 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd

2024-04-25 13:45 - 2022-05-07 17:17 - 000000000 ____D C:\WINDOWS\CbsTemp

2024-04-25 13:45 - 2022-02-23 01:34 - 000000000 ____D C:\Program Files (x86)\Dell Digital Delivery Services

2024-04-25 13:39 - 2022-12-13 20:48 - 000804924 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2024-04-25 13:39 - 2022-05-07 17:22 - 000000000 ____D C:\WINDOWS\INF

2024-04-25 13:37 - 2022-03-07 20:05 - 000000000 ____D C:\Program Files (x86)\Google

2024-04-25 13:36 - 2022-05-07 17:24 - 000000000 ____D C:\WINDOWS\AppReadiness

2024-04-25 13:35 - 2022-05-07 17:24 - 000000000 ___HD C:\Program Files\WindowsApps

2024-04-25 13:35 - 2022-03-07 17:36 - 000000000 ___RD C:\Users\dotco\OneDrive

2024-04-25 13:34 - 2023-08-20 13:13 - 000012288 ___SH C:\DumpStack.log.tmp

2024-04-25 13:34 - 2022-12-13 20:45 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT

2024-04-25 13:34 - 2022-05-07 17:24 - 000000000 ____D C:\WINDOWS\ServiceState

2024-04-25 13:34 - 2022-05-07 17:24 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft

2024-04-25 13:34 - 2022-05-07 17:17 - 000786432 _____ C:\WINDOWS\system32\config\BBI

2024-04-25 13:34 - 2022-03-08 18:27 - 000000000 ____D C:\Program Files\Microsoft OneDrive

2024-04-25 13:34 - 2022-03-07 17:35 - 000000000 __SHD C:\Users\dotco\IntelGraphicsProfiles

2024-04-25 13:34 - 2022-02-23 01:31 - 000000000 ____D C:\Intel

2024-04-25 13:33 - 2022-04-03 13:01 - 000000000 ____D C:\Program Files\dotnet

2024-04-25 13:33 - 2022-03-07 23:08 - 192651728 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

2024-04-25 13:33 - 2022-03-07 23:08 - 000000000 ____D C:\WINDOWS\system32\MRT

2024-04-25 13:33 - 2022-02-23 01:41 - 000000000 ____D C:\ProgramData\Package Cache

2024-04-25 13:30 - 2022-12-13 20:45 - 000003596 _____ C:\WINDOWS\system32\Tasks\OneDrive Reporting Task-S-1-5-21-2222835479-4008314922-1056283517-1001

2024-04-21 21:23 - 2022-12-13 20:43 - 000000000 ____D C:\WINDOWS\system32\SleepStudy

2024-04-03 15:45 - 2022-05-07 17:24 - 000000000 ____D C:\WINDOWS\LiveKernelReports

2024-04-03 10:26 - 2022-03-07 17:35 - 000000000 ____D C:\Users\dotco\AppData\Local\D3DSCache

2024-04-02 14:09 - 2022-03-07 20:05 - 000000000 ____D C:\Users\dotco\AppData\Local\Google

2024-04-02 14:09 - 2022-03-07 20:05 - 000000000 ____D C:\Program Files\Google

2024-03-31 15:08 - 2022-03-07 17:35 - 000000000 ____D C:\Users\dotco\AppData\Local\Packages

2024-03-31 15:08 - 2022-02-23 01:43 - 000000000 ____D C:\ProgramData\Packages

2024-03-31 15:06 - 2022-05-07 17:24 - 000000000 ____D C:\ProgramData\USOPrivate

2024-03-31 14:25 - 2022-12-14 09:15 - 000470400 _____ C:\WINDOWS\system32\FNTCACHE.DAT

2024-03-31 14:24 - 2023-10-19 13:50 - 000000000 ____D C:\WINDOWS\system32\Microsoft-Edge-WebView

2024-03-31 14:24 - 2022-12-13 20:29 - 000000000 ____D C:\WINDOWS\en-GB

2024-03-31 14:24 - 2022-05-07 17:24 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel

2024-03-31 14:24 - 2022-05-07 17:24 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism

2024-03-31 14:24 - 2022-05-07 17:24 - 000000000 ____D C:\WINDOWS\SystemResources

2024-03-31 14:24 - 2022-05-07 17:24 - 000000000 ____D C:\WINDOWS\system32\oobe

2024-03-31 14:24 - 2022-05-07 17:24 - 000000000 ____D C:\WINDOWS\system32\appraiser

2024-03-31 14:24 - 2022-05-07 17:24 - 000000000 ____D C:\WINDOWS\ShellExperiences

2024-03-31 14:24 - 2022-05-07 17:24 - 000000000 ____D C:\WINDOWS\ShellComponents

2024-03-31 14:24 - 2022-05-07 17:24 - 000000000 ____D C:\WINDOWS\bcastdvr

2024-03-31 14:24 - 2022-05-07 17:17 - 000000000 ____D C:\WINDOWS\servicing

2024-03-31 14:06 - 2022-12-13 20:45 - 003213824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll

2024-03-31 13:27 - 2022-05-07 17:24 - 000000000 ____D C:\WINDOWS\system32\SecurityHealth

2024-03-31 13:19 - 2023-01-19 16:35 - 000002280 _____ C:\Users\Public\Desktop\Microsoft Edge.lnk

2024-03-31 13:19 - 2022-02-23 01:33 - 000000000 ____D C:\Program Files\Dell

2024-03-31 13:19 - 2022-02-23 01:33 - 000000000 ____D C:\Program Files (x86)\Dell

2024-03-31 13:19 - 2022-02-23 01:31 - 000002442 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk

2024-03-31 13:09 - 2022-12-13 20:45 - 000003536 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA

2024-03-31 13:09 - 2022-12-13 20:45 - 000003412 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore

==================== Files in the root of some directories ========

2022-03-15 20:13 - 2022-03-15 20:13 - 000052348 _____ () C:\Users\dotco\AppData\Roaming\Comma Separated Values.ADR

==================== SigCheck ============================

(There is no automatic fix for files that do not pass verification.)

==================== End of FRST.txt ========================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 19.04.2024 01

Ran by dotco (25-04-2024 13:46:32)

Running from C:\Users\dotco\Desktop

Microsoft Windows 11 Home Version 23H2 22631.3296 (X64) (2022-12-13 08:45:36)

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

(If an entry is included in the fixlist, it will be removed.)

Administrator (S-1-5-21-2222835479-4008314922-1056283517-500 - Administrator - Disabled)

DefaultAccount (S-1-5-21-2222835479-4008314922-1056283517-503 - Limited - Disabled)

dotco (S-1-5-21-2222835479-4008314922-1056283517-1001 - Administrator - Enabled) => C:\Users\dotco

Guest (S-1-5-21-2222835479-4008314922-1056283517-501 - Limited - Disabled)

WDAGUtilityAccount (S-1-5-21-2222835479-4008314922-1056283517-504 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Canon MG4100 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG4100_series) (Version: - Canon Inc.)

CyberLink Media Suite 12 (HKLM-x32\...\{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}) (Version: 12.0.1.8706 - CyberLink Corp.) Hidden

CyberLink Media Suite 12 (HKLM-x32\...\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 12 - CyberLink Corp.)

CyberLink Power2Go 8 (HKLM-x32\...\{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.0.8627 - CyberLink Corp.) Hidden

CyberLink PowerDirector 15 (HKLM-x32\...\{FA285575-B543-4E6E-A573-A4F534AC9965}) (Version: 15.0.3807.0 - CyberLink Corp.) Hidden

CyberLink PowerDVD 14 (HKLM-x32\...\{32C8E300-BDB4-4398-92C2-E9B7D8A233DB}) (Version: 14.0.8.9611 - CyberLink Corp.) Hidden

Dell Digital Delivery Services (HKLM-x32\...\{16AE9E0C-0E0C-4AD6-82B4-D0F8AB94082F}) (Version: 5.0.86.0 - Dell Inc.)

Dell Mobile Connect Driver (HKLM\...\{6F9CB82D-BC34-4FC1-B90D-AFFAC5C85E7B}) (Version: 4.1.7498 - Screenovate Technologies Ltd.)

Dell SupportAssist (HKLM\...\{9F3787A9-CE46-4247-B387-F6D364914F40}) (Version: 4.0.1.57784 - Dell Inc.)

Dell SupportAssist OS Recovery Plugin for Dell Update (HKLM\...\{39BF0E71-7A16-4A80-BBCE-FBDD2D1CC2D5}) (Version: 5.5.9.18923 - Dell Inc.) Hidden

Dell SupportAssist OS Recovery Plugin for Dell Update (HKLM-x32\...\{f6a4df94-48f2-459a-8d40-16b1fbed13c5}) (Version: 5.5.9.18923 - Dell Inc.)

Dell SupportAssist Remediation (HKLM\...\{398E49A0-84CA-43B5-A926-42EF68619E91}) (Version: 5.5.10.19019 - Dell Inc.) Hidden

Dell SupportAssist Remediation (HKLM-x32\...\{3563aa3a-c8ae-48d8-ab19-b1f359265295}) (Version: 5.5.10.19019 - Dell Inc.)

Dell Update for Windows Universal (HKLM\...\{183DEF89-F000-4745-81FD-3B43101D5B9F}) (Version: 5.2.0 - Dell Inc.)

Dynamic Application Loader Host Interface Service (HKLM\...\{74DF895B-001F-456C-BEA4-9254A3FCC5E6}) (Version: 1.0.0.0 - Intel Corporation) Hidden

Fingerprint Sensor Driver (HKLM-x32\...\{D9C19E6E-4403-4DDF-B290-ECFAE2072FF9}) (Version: 20.6.0.7 - Realtek Semiconductor Corp.)

Fusion Service (HKLM\...\{091B2FD3-A3C7-4E3F-8633-02AE6F8306BB}) (Version: 2.0.58.0 - Dell.Inc) Hidden

Fusion Service (HKLM-x32\...\{4baf873a-44e8-403a-80ee-255fbed9777d}) (Version: 2.0.58.0 - Dell.Inc)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 123.0.6312.88 - Google LLC)

Google Workspace Migration for Microsoft Outlook® 4.3.14.0 (HKLM\...\{304559BE-BE12-4E06-A6FC-953D0EA1F0E1}) (Version: 4.3.14.0 - Google, Inc.)

Intel® Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 2218.2.2.0 - Intel Corporation)

Intel® Management Engine Components (HKLM\...\{72F03A9B-21C6-4599-95FC-FFB4D9B7F50C}) (Version: 1.0.0.0 - Intel Corporation) Hidden

Intel® Management Engine Driver (HKLM\...\{B9C358AF-2012-4BD3-A476-CAFB5761B5BC}) (Version: 1.0.0.0 - Intel Corporation) Hidden

Intel® ME WMI Provider (HKLM\...\{96EC8F94-3894-4F08-8FEF-227E9F790FFC}) (Version: 1.0.0.0 - Intel Corporation) Hidden

Intel® Software Installer (HKLM-x32\...\{761da2d6-6c6a-4188-a2e3-f20a107bc2a9}) (Version: 22.170.2.1 - Intel Corporation) Hidden

Microsoft .NET Host - 5.0.17 (x64) (HKLM\...\{E663ED1E-899C-40E8-91D0-8D37B95E3C69}) (Version: 40.68.31213 - Microsoft Corporation) Hidden

Microsoft .NET Host - 6.0.29 (x64) (HKLM\...\{E7C485FB-3329-43E3-965B-3DE4B863E1D9}) (Version: 48.116.12053 - Microsoft Corporation) Hidden

Microsoft .NET Host FX Resolver - 5.0.17 (x64) (HKLM\...\{8BA25391-0BE6-443A-8EBF-86A29BAFC479}) (Version: 40.68.31213 - Microsoft Corporation) Hidden

Microsoft .NET Host FX Resolver - 6.0.29 (x64) (HKLM\...\{724B2734-4B1A-46E2-9333-6D3B83351D02}) (Version: 48.116.12053 - Microsoft Corporation) Hidden

Microsoft .NET Runtime - 5.0.17 (x64) (HKLM\...\{5A66E598-37BD-4C8A-A7CB-A71C32ABCD78}) (Version: 40.68.31213 - Microsoft Corporation) Hidden

Microsoft .NET Runtime - 5.0.17 (x64) (HKLM-x32\...\{a699b48e-5748-4980-ad92-0b61b1d9d718}) (Version: 5.0.17.31213 - Microsoft Corporation)

Microsoft .NET Runtime - 6.0.29 (x64) (HKLM\...\{014E0350-0B29-483B-9252-8780DEBA0856}) (Version: 48.116.12053 - Microsoft Corporation) Hidden

Microsoft .NET Runtime - 6.0.29 (x64) (HKLM-x32\...\{d052745b-efe5-4690-886d-1d425a24a8a3}) (Version: 6.0.29.33521 - Microsoft Corporation)

Microsoft 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 16.0.17328.20184 - Microsoft Corporation)

Microsoft Edge (HKLM-x32\...\Microsoft Edge) (Version: 123.0.2420.65 - Microsoft Corporation)

Microsoft Edge WebView2 Runtime (HKLM-x32\...\Microsoft EdgeWebView) (Version: 123.0.2420.65 - Microsoft Corporation)

Microsoft Office Home and Student 2021 - en-us (HKLM\...\HomeStudent2021Retail - en-us) (Version: 16.0.17328.20184 - Microsoft Corporation)

Microsoft OneDrive (HKLM\...\OneDriveSetup.exe) (Version: 24.070.0407.0003 - Microsoft Corporation)

Microsoft OneNote - en-us (HKLM\...\OneNoteFreeRetail - en-us) (Version: 16.0.17328.20184 - Microsoft Corporation)

Microsoft Outlook 2021 - en-us (HKLM\...\Outlook2021Retail - en-us) (Version: 16.0.17328.20184 - Microsoft Corporation)

Microsoft Update Health Tools (HKLM\...\{C6FD611E-7EFE-488C-A0E0-974C09EF6473}) (Version: 5.72.0.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.61030 (HKLM\...\{37B8F9C7-03FB-3253-8781-2517C99D7C00}) (Version: 11.0.61030 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.61030 (HKLM\...\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}) (Version: 11.0.61030 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 (HKLM-x32\...\{B175520C-86A2-35A7-8619-86DC379688B9}) (Version: 11.0.61030 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 (HKLM-x32\...\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}) (Version: 11.0.61030 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 (HKLM-x32\...\{6913e92a-b64e-41c9-a5e6-cef39207fe89}) (Version: 14.25.28508.3 - Microsoft Corporation)

Microsoft Visual C++ 2019 X64 Additional Runtime - 14.25.28508 (HKLM\...\{7D0B74C2-C3F8-4AF1-940F-CD79AB4B2DCE}) (Version: 14.25.28508 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2019 X64 Minimum Runtime - 14.25.28508 (HKLM\...\{EEA66967-97E2-4561-A999-5C22E3CDE428}) (Version: 14.25.28508 - Microsoft Corporation) Hidden

Microsoft Windows Desktop Runtime - 6.0.29 (x64) (HKLM\...\{A0DA3EDD-9C41-491F-A77E-5F90AFDB64B2}) (Version: 48.116.12057 - Microsoft Corporation) Hidden

Microsoft Windows Desktop Runtime - 6.0.29 (x64) (HKLM-x32\...\{54679abd-8ed9-4bd3-8400-7684dd7c6f03}) (Version: 6.0.29.33521 - Microsoft Corporation)

Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 91.7.0 - Mozilla)

Mozilla Thunderbird (x64 en-US) (HKLM\...\Mozilla Thunderbird 91.13.1 (x64 en-US)) (Version: 91.13.1 - Mozilla)

Office 16 Click-to-Run Extensibility Component (HKLM\...\{90160000-008C-0000-1000-0000000FF1CE}) (Version: 16.0.17328.20142 - Microsoft Corporation) Hidden

Office 16 Click-to-Run Licensing Component (HKLM\...\{90160000-007E-0000-1000-0000000FF1CE}) (Version: 16.0.17328.20108 - Microsoft Corporation) Hidden

OptaneDowngradeGuard (HKLM\...\{86B0E6C1-32E0-42CC-BC4F-BF3C0730CECB}) (Version: 18.0.0.0 - Intel Corporation) Hidden

Realtek Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.9418.1 - Realtek Semiconductor Corp.)

RstDowngradeGuard (HKLM\...\{13C2A26E-7AD4-4D82-BB4F-DEA6E871B958}) (Version: 18.0.0.0 - Intel Corporation) Hidden

SmartByte Drivers and Services (HKLM\...\{19A754FE-0343-4311-835F-33EAB7ADEA7B}) (Version: 3.1122.728.7 - Rivet Networks)

WebAdvisor by McAfee (HKLM-x32\...\{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}) (Version: 4.1.1.883 - McAfee, LLC)

Packages:

=========

AppUp.IntelGraphicsExperience -> C:\Program Files\WindowsApps\AppUp.IntelGraphicsExperience_1.100.5390.0_x64__8j3eq9eme6ctt [2024-03-24] (INTEL CORP) [Startup Task]

AppUp.ThunderboltControlCenter -> C:\Program Files\WindowsApps\AppUp.ThunderboltControlCenter_1.0.37.0_x64__8j3eq9eme6ctt [2023-10-19] (INTEL CORP)

Canon Inkjet Print Utility -> C:\Program Files\WindowsApps\34791E63.CanonInkjetPrintUtility_3.1.0.0_neutral__6e5tt8cgb93ep [2022-03-09] (Canon Inc.)

Dell CinemaColor -> C:\Program Files\WindowsApps\PortraitDisplays.DellCinemaColor_2.4.78.0_x64__2dgmkzkw4h30c [2022-10-17] (Portrait Displays)

Dell Customer Connect -> C:\Program Files\WindowsApps\DellInc.DellCustomerConnect_5.4.9.0_x64__htrsf667h5kn2 [2024-03-24] (Dell Inc)

Dell Digital Delivery -> C:\Program Files\WindowsApps\DellInc.DellDigitalDelivery_5.0.86.0_x64__htrsf667h5kn2 [2024-03-04] (Dell Inc)

Dell Mobile Connect -> C:\Program Files\WindowsApps\ScreenovateTechnologies.DellMobileConnectPlus_4.1.8330.0_x64__0vhbc3ng4wbp0 [2024-01-25] (Screenovate Technologies)

Dell SupportAssist for Home PCs -> C:\Program Files\WindowsApps\DellInc.DellSupportAssistforPCs_4.0.14.0_x64__htrsf667h5kn2 [2024-03-31] (Dell Inc)

Dell Update -> C:\Program Files\WindowsApps\DellInc.DellUpdate_5.2.64.0_x86__htrsf667h5kn2 [2024-03-03] (Dell Inc)

Intel® Optane™ Memory and Storage Management -> C:\Program Files\WindowsApps\AppUp.IntelOptaneMemoryandStorageManagement_18.1.1041.0_x64__8j3eq9eme6ctt [2024-03-24] (INTEL CORP)

Microsoft Family -> C:\Program Files\WindowsApps\MicrosoftCorporationII.MicrosoftFamily_0.2.40.0_x64__8wekyb3d8bbwe [2023-09-20] (Microsoft Corp.)

Microsoft.MPEG2VideoExtension -> C:\Program Files\WindowsApps\Microsoft.MPEG2VideoExtension_1.0.61931.0_x64__8wekyb3d8bbwe [2023-08-29] (Microsoft Corporation)

Microsoft.Windows.Ai.Copilot.Provider -> C:\Program Files\WindowsApps\Microsoft.Windows.Ai.Copilot.Provider_1.0.3.0_neutral__8wekyb3d8bbwe [2024-03-31] (Microsoft Corporation)

Microsoft.WindowsAppRuntime.CBS -> C:\WINDOWS\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe [2024-03-31] (Microsoft Corporation)

MicrosoftWindows.CrossDevice -> C:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.24022.90.0_x64__cw5n1h2txyewy [2024-04-03] (Microsoft Windows) [Startup Task]

My Dell -> C:\Program Files\WindowsApps\DellInc.MyDell_2.2.6.0_x64__htrsf667h5kn2 [2023-09-13] (Dell Inc)

Photos Media Engine Add-on -> C:\Program Files\WindowsApps\Microsoft.Photos.MediaEngineDLC_1.0.0.0_x64__8wekyb3d8bbwe [2022-10-17] (Microsoft Corporation)

SmartByte -> C:\Program Files\WindowsApps\RivetNetworks.SmartByte_3.1.1002.0_x64__rh07ty8m5nkag [2023-06-13] (Rivet Networks LLC)

Spotify Music -> C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.233.1042.0_x64__zpdnekdrzrea0 [2024-03-31] (Spotify AB) [Startup Task]

Waves MaxxAudio Pro for Dell 2021 -> C:\Program Files\WindowsApps\WavesAudio.MaxxAudioProforDell2021_4.0.53.0_x64__fh4rh281wavaa [2024-03-24] (Waves Audio)

Windows Feature Experience Pack -> C:\WINDOWS\SystemApps\MicrosoftWindows.Client.FileExp_cw5n1h2txyewy [2024-03-31] (Microsoft Corporation)

==================== Custom CLSID (Whitelisted): ==============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Program Files\Microsoft OneDrive\24.070.0407.0003\FileSyncShell64.dll [2024-04-25] (Microsoft Corporation -> Microsoft Corporation)

ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Program Files\Microsoft OneDrive\24.070.0407.0003\FileSyncShell64.dll [2024-04-25] (Microsoft Corporation -> Microsoft Corporation)

ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Program Files\Microsoft OneDrive\24.070.0407.0003\FileSyncShell64.dll [2024-04-25] (Microsoft Corporation -> Microsoft Corporation)

ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Program Files\Microsoft OneDrive\24.070.0407.0003\FileSyncShell64.dll [2024-04-25] (Microsoft Corporation -> Microsoft Corporation)

ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Program Files\Microsoft OneDrive\24.070.0407.0003\FileSyncShell64.dll [2024-04-25] (Microsoft Corporation -> Microsoft Corporation)

ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => C:\Program Files\Microsoft OneDrive\24.070.0407.0003\FileSyncShell64.dll [2024-04-25] (Microsoft Corporation -> Microsoft Corporation)

ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => C:\Program Files\Microsoft OneDrive\24.070.0407.0003\FileSyncShell64.dll [2024-04-25] (Microsoft Corporation -> Microsoft Corporation)

ShellIconOverlayIdentifiers: [ OptaneIconOverlay] -> {A3AF6F6C-8BED-3D93-8B5D-33427B5D38E9} => C:\WINDOWS\System32\DriverStore\FileRepository\iastorpinningcomponent.inf_amd64_d51acc8493d6b911\OptaneShellExt.dll [2022-10-27] (Intel Corporation -> )

ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Program Files\Microsoft OneDrive\24.070.0407.0003\FileSyncShell64.dll [2024-04-25] (Microsoft Corporation -> Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Program Files\Microsoft OneDrive\24.070.0407.0003\FileSyncShell64.dll [2024-04-25] (Microsoft Corporation -> Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Program Files\Microsoft OneDrive\24.070.0407.0003\FileSyncShell64.dll [2024-04-25] (Microsoft Corporation -> Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Program Files\Microsoft OneDrive\24.070.0407.0003\FileSyncShell64.dll [2024-04-25] (Microsoft Corporation -> Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Program Files\Microsoft OneDrive\24.070.0407.0003\FileSyncShell64.dll [2024-04-25] (Microsoft Corporation -> Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => C:\Program Files\Microsoft OneDrive\24.070.0407.0003\FileSyncShell64.dll [2024-04-25] (Microsoft Corporation -> Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => C:\Program Files\Microsoft OneDrive\24.070.0407.0003\FileSyncShell64.dll [2024-04-25] (Microsoft Corporation -> Microsoft Corporation)

ContextMenuHandlers1: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Program Files\Microsoft OneDrive\24.070.0407.0003\FileSyncShell64.dll [2024-04-25] (Microsoft Corporation -> Microsoft Corporation)

ContextMenuHandlers1: [CLVDShellExt] -> {3E2A0A32-6E14-4BAD-AA87-BBB6A75EBFF2} => C:\Program Files (x86)\Common Files\CyberLink\ShellExtComponent\CLVDShellExt.dll [2018-03-14] (CyberLink Corp. -> Cyberlink)

ContextMenuHandlers2: [CLVDShellExt] -> {3E2A0A32-6E14-4BAD-AA87-BBB6A75EBFF2} => C:\Program Files (x86)\Common Files\CyberLink\ShellExtComponent\CLVDShellExt.dll [2018-03-14] (CyberLink Corp. -> Cyberlink)

ContextMenuHandlers3: [OptaneContextMenu] -> {AD7EBB13-617D-3270-8FA8-46583499C4FB} => C:\WINDOWS\System32\DriverStore\FileRepository\iastorpinningcomponent.inf_amd64_d51acc8493d6b911\OptaneShellExt.dll [2022-10-27] (Intel Corporation -> )

ContextMenuHandlers4: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Program Files\Microsoft OneDrive\24.070.0407.0003\FileSyncShell64.dll [2024-04-25] (Microsoft Corporation -> Microsoft Corporation)

ContextMenuHandlers5: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Program Files\Microsoft OneDrive\24.070.0407.0003\FileSyncShell64.dll [2024-04-25] (Microsoft Corporation -> Microsoft Corporation)

==================== Codecs (Whitelisted) ====================

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)

ShortcutWithArgument: C:\Users\dotco\AppData\Local\Microsoft\Edge\User Data\Default\Pinned Sites\MSEdge._pin_mbfefonkpgdabgjoiopokelgkj\Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe (Microsoft Corporation) -> --pin-url=hxxps://www.office.com/ --profile-directory=Default

ShortcutWithArgument: C:\Users\dotco\AppData\Local\Microsoft\Edge\User Data\Default\Pinned Sites\MSEdge._pin_celnaknmndgffhbhciignkeokb\Facebook.lnk -> C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe (Microsoft Corporation) -> --pin-url=hxxps://www.facebook.com/ --profile-directory=Default

ShortcutWithArgument: C:\Users\dotco\AppData\Local\Microsoft\Edge\User Data\Default\Pinned Sites\MSEdge._pin_adnlfjpnmiaohpidplnoimahfh\YouTube.lnk -> C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe (Microsoft Corporation) -> --pin-url=hxxps://www.youtube.com/ --profile-directory=Default

ShortcutWithArgument: C:\Users\dotco\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Facebook.lnk -> C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe (Microsoft Corporation) -> --pin-url=hxxps://www.facebook.com/ --profile-directory=Default

ShortcutWithArgument: C:\Users\dotco\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\YouTube.lnk -> C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe (Microsoft Corporation) -> --pin-url=hxxps://www.youtube.com/ --profile-directory=Default

==================== Loaded Modules (Whitelisted) =============

2022-02-23 01:43 - 2022-02-23 01:43 - 000000000 ____L (Microsoft Corporation) [symlink -> C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppvIsvSubsystems64.dll] C:\Program Files\Microsoft Office\root\Office16\AppVIsvSubsystems64.dll

2022-02-23 01:43 - 2022-02-23 01:43 - 000000000 ____L (Microsoft Corporation) [symlink -> C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2R64.dll] C:\Program Files\Microsoft Office\root\Office16\c2r64.dll

2018-03-08 07:18 - 2018-03-08 07:18 - 000015360 _____ (NHibernate community) [File not signed] C:\Program Files\Dell\SupportAssistAgent\bin\Iesi.Collections.dll

2018-02-06 17:25 - 2018-02-06 17:25 - 000176640 _____ (rubicon IT GmbH) [File not signed] C:\Program Files\Dell\SupportAssistAgent\bin\Remotion.Linq.dll

2018-03-23 12:10 - 2018-03-23 12:10 - 000028160 _____ (rubicon IT GmbH) [File not signed] C:\Program Files\Dell\SupportAssistAgent\bin\Remotion.Linq.EagerFetching.dll

2021-02-17 04:19 - 2021-02-17 04:19 - 000124928 _____ (Stateless Contributors) [File not signed] [File is in use] C:\Program Files\Dell\SupportAssistAgent\bin\stateless.dll

2021-12-17 05:45 - 2021-12-17 05:45 - 000258048 _____ (The Apache Software Foundation) [File not signed] [File is in use] C:\Program Files\Dell\SupportAssistAgent\bin\log4net.dll

2016-12-18 08:55 - 2016-12-18 08:55 - 000097280 _____ (Tunnel Vision Laboratories, LLC) [File not signed] C:\Program Files\Dell\SupportAssistAgent\bin\Antlr3.Runtime.dll

==================== Alternate Data Streams (Whitelisted) ========

==================== Safe Mode (Whitelisted) ==================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ScreenConnect Client (f034c877-df09-4862-b9ac-3a931e50ab76) => ""="Service"

==================== Association (Whitelisted) =================

==================== Internet Explorer (Whitelisted) ==========

SearchScopes: HKU\S-1-5-21-2222835479-4008314922-1056283517-1001 -> DefaultScope {0A251C3F-456C-456C-9125-60863646D4FA} URL =

SearchScopes: HKU\S-1-5-21-2222835479-4008314922-1056283517-1001 -> {0A251C3F-456C-456C-9125-60863646D4FA} URL =

BHO: McAfee WebAdvisor -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> C:\Program Files\McAfee\WebAdvisor\x64\IEPlugin.dll [2022-07-20] (McAfee, LLC -> McAfee, LLC)

BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll [2024-02-04] (Microsoft Corporation -> Microsoft Corporation)

BHO-x32: McAfee WebAdvisor -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> C:\Program Files\McAfee\WebAdvisor\win32\IEPlugin.dll [2022-07-20] (McAfee, LLC -> McAfee, LLC)

Handler: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2024-03-24] (Microsoft Corporation -> Microsoft Corporation)

Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2024-03-24] (Microsoft Corporation -> Microsoft Corporation)

Handler: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2024-03-24] (Microsoft Corporation -> Microsoft Corporation)

Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2024-03-24] (Microsoft Corporation -> Microsoft Corporation)

Handler: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2024-03-24] (Microsoft Corporation -> Microsoft Corporation)

Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2024-03-24] (Microsoft Corporation -> Microsoft Corporation)

Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2024-03-24] (Microsoft Corporation -> Microsoft Corporation)

Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2024-03-24] (Microsoft Corporation -> Microsoft Corporation)

==================== Hosts content: =========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2021-06-06 00:08 - 2021-06-06 00:08 - 000000824 _____ C:\WINDOWS\system32\drivers\etc\hosts

2022-11-07 15:07 - 2022-11-07 15:07 - 000000443 _____ C:\WINDOWS\system32\drivers\etc\hosts.ics

==================== Other Areas ===========================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2222835479-4008314922-1056283517-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\dotco\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper

DNS Servers: 203.109.191.1 - 203.118.191.1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

==================== FirewallRules (Whitelisted) ================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{26C010D9-81A7-4000-A453-48A8BB899E72}] => (Allow) C:\Program Files\WindowsApps\MicrosoftTeams_24088.3902.2792.6069_x64__8wekyb3d8bbwe\msteams.exe (Microsoft Corporation -> Microsoft Corporation)

FirewallRules: [{1947A73D-3797-4504-8D28-027FC20E003B}] => (Allow) C:\Program Files\WindowsApps\MicrosoftTeams_24088.3902.2792.6069_x64__8wekyb3d8bbwe\msteams.exe (Microsoft Corporation -> Microsoft Corporation)

==================== Restore Points =========================

ATTENTION: System Restore is disabled (Total:458.3 GB) (Free:220.8 GB) (48%)

==================== Faulty Device Manager Devices ============

==================== Event log errors: ========================

Application errors:

==================

Error: (04/21/2024 04:11:23 PM) (Source: VSS) (EventID: 8194) (User: )

Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied..This is often caused by incorrect security settings in either the writer or requestor process.

Operation:

Gathering Writer Data

Context:

Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}

Writer Name: System Writer

Writer Instance ID: {d21f47ba-9c9e-4134-9f56-984ebb6fd2fa}

Error: (04/21/2024 03:55:11 PM) (Source: VSS) (EventID: 8194) (User: )

Operation:

Gathering Writer Data

Context:

Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}

Writer Name: System Writer

Writer Instance ID: {d21f47ba-9c9e-4134-9f56-984ebb6fd2fa}

Error: (04/14/2024 02:45:11 PM) (Source: Application Error) (EventID: 1000) (User: DESKTOP-N36GKIL)

Description: Faulting application name: Widgets.exe, version: 424.1301.2920.0, time stamp: 0x65fa0747

Faulting module name: ntdll.dll, version: 10.0.22621.3235, time stamp: 0xa2c4352c

Exception code: 0xc0000409

Fault offset: 0x00000000000a7d18

Faulting process id: 0x0x3c6c

Faulting application start time: 0x0x1da8e1559914669

Faulting application path: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_424.1301.450.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe

Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll

Report Id: 576ff4ac-5917-4517-a013-25dc35784fd2

Faulting package full name: MicrosoftWindows.Client.WebExperience_424.1301.450.0_x64__cw5n1h2txyewy

Faulting package-relative application ID: Widgets

Error: (04/03/2024 10:30:22 AM) (Source: Application Error) (EventID: 1000) (User: DESKTOP-N36GKIL)

Description: Faulting application name: UltraViewer_Desktop.exe, version: 6.6.0.84, time stamp: 0x65e42053

Faulting module name: uvc.dll, version: 0.0.0.0, time stamp: 0x63397534

Exception code: 0xc000041d

Fault offset: 0x00013987

Faulting process id: 0x0x1e8c

Faulting application start time: 0x0x1da854ccd07a72f

Faulting application path: C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe

Faulting module path: C:\Program Files (x86)\UltraViewer\uvc.dll

Report Id: 70a70626-bdeb-4094-8025-c964287ec7e8

Faulting package full name:

Faulting package-relative application ID:

Error: (04/03/2024 10:30:20 AM) (Source: Application Error) (EventID: 1000) (User: DESKTOP-N36GKIL)

Description: Faulting application name: UltraViewer_Desktop.exe, version: 6.6.0.84, time stamp: 0x65e42053

Faulting module name: uvc.dll, version: 0.0.0.0, time stamp: 0x63397534

Exception code: 0xc0000005

Fault offset: 0x00013987

Faulting process id: 0x0x1e8c

Faulting application start time: 0x0x1da854ccd07a72f

Faulting application path: C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe

Faulting module path: C:\Program Files (x86)\UltraViewer\uvc.dll

Report Id: f8a5c33d-e8a2-4821-b9cf-de52cc905f4c

Faulting package full name:

Faulting package-relative application ID:

Error: (04/03/2024 10:30:20 AM) (Source: .NET Runtime) (EventID: 1026) (User: )

Description: Application: UltraViewer_Desktop.exe

Framework Version: v4.0.30319

Description: The process was terminated due to an unhandled exception.

Exception Info: exception code c0000005, exception address 733E3987

Stack:

Error: (04/02/2024 07:49:10 PM) (Source: VSS) (EventID: 8194) (User: )

Operation:

Gathering Writer Data

Context:

Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}

Writer Name: System Writer

Writer Instance ID: {d21f47ba-9c9e-4134-9f56-984ebb6fd2fa}

Error: (04/02/2024 07:34:20 PM) (Source: VSS) (EventID: 8194) (User: )

Operation:

Gathering Writer Data

Context:

Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}

Writer Name: System Writer

Writer Instance ID: {d21f47ba-9c9e-4134-9f56-984ebb6fd2fa}

System errors:

=============

Error: (04/25/2024 01:40:53 PM) (Source: disk) (EventID: 11) (User: )

Description: The driver detected a controller error on \Device\Harddisk1\DR1.

Error: (04/25/2024 01:36:41 PM) (Source: disk) (EventID: 11) (User: )

Description: The driver detected a controller error on \Device\Harddisk1\DR1.

Error: (04/25/2024 01:34:12 PM) (Source: Service Control Manager) (EventID: 7043) (User: )

Description: The Windows Update service did not shut down properly after receiving a preshutdown control.

Error: (04/25/2024 01:33:37 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-N36GKIL)

Description: The server {FD06603A-2BDF-4BB1-B7DF-5DC68F353601} did not register with DCOM within the required timeout.

Error: (04/25/2024 01:22:07 PM) (Source: disk) (EventID: 11) (User: )

Description: The driver detected a controller error on \Device\Harddisk1\DR4.

Error: (04/25/2024 01:16:38 PM) (Source: Microsoft-Windows-NDIS) (EventID: 10317) (User: )

Description: Miniport Microsoft Wi-Fi Direct Virtual Adapter #2, {62f997e9-d99f-42df-8a62-d84f51f5855e}, had event 74

Error: (04/21/2024 09:24:50 PM) (Source: disk) (EventID: 11) (User: )

Description: The driver detected a controller error on \Device\Harddisk1\DR3.

Error: (04/21/2024 08:19:50 PM) (Source: disk) (EventID: 11) (User: )

Description: The driver detected a controller error on \Device\Harddisk1\DR3.

Windows Defender:

================

Date: 2024-04-25 13:28:14

Description:

Microsoft Defender Antivirus scan has been stopped before completion.

Scan Type: Antimalware

Scan Parameters: Quick Scan

Date: 2024-04-21 14:42:21

Description:

Microsoft Defender Antivirus scan has been stopped before completion.

Scan Type: Antimalware

Scan Parameters: Quick Scan

Date: 2024-04-03 14:41:09

Description:

Microsoft Defender Antivirus scan has been stopped before completion.

Scan Type: Antimalware

Scan Parameters: Quick Scan

Date: 2024-03-31 14:20:44

Description:

Microsoft Defender Antivirus scan has been stopped before completion.

Scan Type: Antimalware

Scan Parameters: Quick Scan

Date: 2024-03-24 20:10:54

Description:

Microsoft Defender Antivirus scan has been stopped before completion.

Scan Type: Antimalware

Scan Parameters: Quick Scan

Event[0]

Date: 2024-04-21 15:26:37

Description:

Microsoft Defender Antivirus has encountered an error trying to update security intelligence.

New security intelligence Version:

Previous security intelligence Version: 1.407.910.0

Update Source: Microsoft Malware Protection Center

Security intelligence Type: AntiVirus

Update Type: Full

Current Engine Version:

Previous Engine Version: 1.1.24020.9

Error code: 0x80072ee7

Error description: The server name or address could not be resolved

Date: 2024-04-21 15:26:37

Description:

Microsoft Defender Antivirus has encountered an error trying to update security intelligence.

New security intelligence Version:

Previous security intelligence Version: 1.407.910.0

Update Source: Microsoft Malware Protection Center

Security intelligence Type: AntiSpyware

Update Type: Full

Current Engine Version:

Previous Engine Version: 1.1.24020.9

Error code: 0x80072ee7

Error description: The server name or address could not be resolved

Date: 2024-04-21 15:26:37

Description:

Microsoft Defender Antivirus has encountered an error trying to update security intelligence.

New security intelligence Version:

Previous security intelligence Version: 1.407.910.0

Update Source: Microsoft Malware Protection Center

Security intelligence Type: AntiVirus

Update Type: Full

Current Engine Version:

Previous Engine Version: 1.1.24020.9

Error code: 0x80072ee7

Error description: The server name or address could not be resolved

Date: 2024-04-21 15:26:37

Description:

Microsoft Defender Antivirus has encountered an error trying to update security intelligence.

New security intelligence Version:

Previous security intelligence Version: 1.407.910.0

Update Source: Microsoft Malware Protection Center

Security intelligence Type: AntiVirus

Update Type: Full

Current Engine Version:

Previous Engine Version: 1.1.24020.9

Error code: 0x80072ee7

Error description: The server name or address could not be resolved

Date: 2024-04-21 15:26:37

Description:

Microsoft Defender Antivirus has encountered an error trying to update security intelligence.

New security intelligence Version:

Previous security intelligence Version: 1.407.910.0

Update Source: Microsoft Malware Protection Center

Security intelligence Type: AntiSpyware

Update Type: Full

Current Engine Version:

Previous Engine Version: 1.1.24020.9

Error code: 0x80072ee7

Error description: The server name or address could not be resolved

CodeIntegrity:

===============

Date: 2024-01-15 19:56:47

Description:

Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\fcon.dll because the set of per-page image hashes could not be found on the system.

Date: 2023-11-20 18:32:41

Description:

Code Integrity determined that a process (\Device\HarddiskVolume3\ProgramData\Microsoft\Windows Defender\Platform\4.18.23100.2009-0\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2023-10-25 16:24:16

Description:

Code Integrity determined that a process (\Device\HarddiskVolume3\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2023-10-19 15:02:25

Description:

Code Integrity determined that a process (\Device\HarddiskVolume3\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3fd734cf72127ac9\igd10iumd64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

==================== Memory info ===========================

BIOS: Dell Inc. 2.18.0 03/13/2023

Motherboard: Dell Inc. 076F7Y

Processor: 11th Gen Intel® Core™ i7-11390H @ 3.40GHz

Percentage of memory in use: 61%

Total physical RAM: 16122.78 MB

Available physical RAM: 6219.63 MB

Total Virtual: 17146.78 MB

Available Virtual: 7331.56 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:458.3 GB) (Free:220.8 GB) (Model: NVMe KBG40ZNS512G NVMe KIOXIA 512GB) (Protected) NTFS

Drive d: () (Removable) (Total:28.66 GB) (Free:4.77 GB) FAT32