Hello. I made the mistake of falling for a phone call about a security breach on my icloud account and allowed someone to get onto my personal laptop for a brief few minutes, before shutting it down, realizing it was a fraud After calling Apple, they confirmed with me that there was no security breach and that it was definitely phishing. Please advise.
Possible phishing - please advise
- Thread starter Pearl2021
- Start date
- Status
- Nov 5, 2019
- 1,597
Hello, Welcome to MalwareTips.
I'm nasdaq and will be helping you.
If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===
Let have a look at what might have been installed.
Download the Farbar Recovery Scan Tool (FRST).
Choose the 32 or 64 bit version for your system.
and save it to a folder on your computer's Desktop.
Ensure that you are in an Administrator Account
Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
How to attach a file to your reply:
In the Reply section in the bottom of the topic Click the "more reply Options" button.
[img=[URL]http://deeprybka.trojaner-board.de/eset/eng/attachlogs.png[/URL]]
Attach the file(s). A 2 Steps process.
Reply to this topic.
Select the "Choose a File" navigate to the location of the File.
Click the file you wish to Attach. <- Step 1.
Click Attach this file. <- Step 2.
Click the Add reply button.
Please post the logs for my review.
Wait for further instructions
p.s.
The Farbar program is updated often.
If it's identified as suspicious by your Anti-Virus program trust it if Downloaded from the link I provided.
You should restore the program from the Quarantine folder.
====
I'm nasdaq and will be helping you.
If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===
Let have a look at what might have been installed.
Download the Farbar Recovery Scan Tool (FRST).
Choose the 32 or 64 bit version for your system.
and save it to a folder on your computer's Desktop.
Ensure that you are in an Administrator Account
Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
How to attach a file to your reply:
In the Reply section in the bottom of the topic Click the "more reply Options" button.
[img=[URL]http://deeprybka.trojaner-board.de/eset/eng/attachlogs.png[/URL]]
Attach the file(s). A 2 Steps process.
Reply to this topic.
Select the "Choose a File" navigate to the location of the File.
Click the file you wish to Attach. <- Step 1.
Click Attach this file. <- Step 2.
Click the Add reply button.
Please post the logs for my review.
Wait for further instructions
p.s.
The Farbar program is updated often.
If it's identified as suspicious by your Anti-Virus program trust it if Downloaded from the link I provided.
You should restore the program from the Quarantine folder.
====
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 14-03-2021
Ran by Jen (administrator) on JENPEARL (Dell Inc. Latitude 7400 2-in-1) (15-03-2021 18:50:32)
Running from C:\Users\Jen\Downloads
Loaded Profiles: Jen
Platform: Windows 10 Pro Version 20H2 19042.804 (X64) Language: English (United States)
Default browser: Chrome
Boot Mode: Normal
Ran by Jen (administrator) on JENPEARL (Dell Inc. Latitude 7400 2-in-1) (15-03-2021 18:50:32)
Running from C:\Users\Jen\Downloads
Loaded Profiles: Jen
Platform: Windows 10 Pro Version 20H2 19042.804 (X64) Language: English (United States)
Default browser: Chrome
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
(Adobe Inc. -> Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe <4>
(Adobe Inc. -> Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe <2>
(Apple Inc.) C:\Program Files\WindowsApps\AppleInc.iCloud_12.2.10.0_x86__nzyj5cx40ttqa\iCloud\ApplePhotoStreams.exe
(Apple Inc.) C:\Program Files\WindowsApps\AppleInc.iCloud_12.2.10.0_x86__nzyj5cx40ttqa\iCloud\APSDaemon.exe
(Apple Inc.) C:\Program Files\WindowsApps\AppleInc.iCloud_12.2.10.0_x86__nzyj5cx40ttqa\iCloud\iCloudDrive.exe
(Apple Inc.) C:\Program Files\WindowsApps\AppleInc.iCloud_12.2.10.0_x86__nzyj5cx40ttqa\iCloud\iCloudPhotos.exe
(Apple Inc.) C:\Program Files\WindowsApps\AppleInc.iCloud_12.2.10.0_x86__nzyj5cx40ttqa\iCloud\iCloudServices.exe
(Apple Inc.) C:\Program Files\WindowsApps\AppleInc.iCloud_12.2.10.0_x86__nzyj5cx40ttqa\iCloud\secd.exe
(Apple Inc.) C:\Program Files\WindowsApps\AppleInc.iTunes_12110.26.53016.0_x64__nzyj5cx40ttqa\AMDS64\AppleMobileDeviceProcess.exe
(Broadcom Corporation -> ) C:\Windows\System32\bcmUshUpgradeService.exe
(Broadcom Corporation -> Broadcom Corporation) C:\Windows\System32\bcmHostControlService.exe
(Broadcom Corporation -> Broadcom Corporation) C:\Windows\System32\bcmHostStorageService.exe
(Dell Inc -> ) C:\Program Files (x86)\Dell Digital Delivery Services\Dell.D3.WinSvc.exe
(Dell Inc -> ) C:\Program Files (x86)\Dell\UpdateService\ServiceShell.exe
(Dell Inc -> Dell INC.) C:\Program Files\Dell\SARemediation\agent\DellSupportAssistRemedationService.exe
(Dell Inc -> Dell Inc.) C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe
(Dell Inc) C:\Program Files\WindowsApps\DellInc.DellProximitySensor_3.0.3.0_neutral__htrsf667h5kn2\WALTrayApp\DellExpressSignIn.exe
(Dell Technologies Inc. -> Dell Technologies Inc.) C:\Program Files\Dell\DellDataVault\DDVCollectorSvcApi.exe
(Dell Technologies Inc. -> Dell Technologies Inc.) C:\Program Files\Dell\DellDataVault\DDVDataCollector.exe
(Dell Technologies Inc. -> Dell Technologies Inc.) C:\Program Files\Dell\DellDataVault\DDVRulesProcessor.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.36.72\GoogleCrashHandler.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.36.72\GoogleCrashHandler64.exe
(Google LLC -> Google LLC) C:\Program Files\Google\Chrome\Application\chrome.exe <47>
(HP Inc. -> HP Inc.) C:\Program Files\HPPrintScanDoctor\HPPrintScanDoctorService.exe
(HP Inc.) C:\Program Files\WindowsApps\AD2F1837.HPPrinterControl_122.3.838.0_x64__v10z8vjag6ke6\HP.Smart.exe
(Intel Context Sensing SDK -> Intel Corp) C:\Program Files\Intel\Intel(R) User Awareness Service\UserAwarenessHelper.exe
(Intel Context Sensing SDK -> Intel Corp) C:\Program Files\Intel\Intel(R) User Awareness Service\UserAwarenessService.exe
(Intel Corporation -> Intel Corporation) C:\Windows\System32\Intel\DPTF\dptf_helper.exe
(Intel Corporation -> Intel Corporation) C:\Windows\System32\Intel\DPTF\esif_uf.exe
(Intel(R) Embedded Subsystems and IP Blocks Group -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\dal.inf_amd64_0b214be229a13e84\jhi_service.exe
(Intel(R) Embedded Subsystems and IP Blocks Group -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\lms.inf_amd64_c0fd909ca6e7d672\LMS.exe
(Intel(R) pGFX 2020 -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_28efa2cb508b2ae9\igfxCUIService.exe
(Intel(R) pGFX 2020 -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_28efa2cb508b2ae9\igfxEM.exe
(Intel(R) pGFX 2020 -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igcc_dch.inf_amd64_70e7e4392a76adb3\OneApp.IGCC.WinService.exe
(Intel(R) pGFX 2020 -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_e0b6fab413a2f545\IntelCpHDCPSvc.exe
(Intel(R) pGFX 2020 -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_e0b6fab413a2f545\IntelCpHeciSvc.exe
(Intel(R) Rapid Storage Technology -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iastorac.inf_amd64_42f9d9bfb72d84cf\RstMwService.exe
(LogMeIn, Inc. -> LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(LogMeIn, Inc. -> LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe
(LogMeIn, Inc. -> LogMeIn, Inc.) C:\Program Files (x86)\GoToAssist Remote Support Customer\1692\g2ax_comm_customer.exe
(LogMeIn, Inc. -> LogMeIn, Inc.) C:\Program Files (x86)\GoToAssist Remote Support Customer\1692\g2ax_service.exe
(LogMeIn, Inc. -> LogMeIn, Inc.) C:\Program Files (x86)\GoToAssist Remote Support Customer\1692\g2ax_system_customer.exe
(LogMeIn, Inc. -> LogMeIn, Inc.) C:\Program Files (x86)\GoToAssist Remote Support Customer\1692\g2ax_user_customer.exe
(LogMeIn, Inc. -> LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
(Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE <2>
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Users\Jen\AppData\Local\Microsoft\OneDrive\21.030.0211.0002\FileCoAuth.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Users\Jen\AppData\Local\Microsoft\OneDrive\OneDrive.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2102.8653.0_x64__8wekyb3d8bbwe\Cortana.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2008.12711.0_x64__8wekyb3d8bbwe\LocalBridge.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.13801.20202.0_x64__8wekyb3d8bbwe\onenoteim.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsStore_12011.1001.1.0_x64__8wekyb3d8bbwe\WinStore.App.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.20122.11121.0_x64__8wekyb3d8bbwe\Music.UI.exe
(Microsoft Windows -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\splwow64.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe <3>
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MoUsoCoreWorker.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MusNotifyIcon.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\oobe\UserOOBEBroker.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\WWAHost.exe
(Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2102.3-0\MsMpEng.exe
(Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2102.3-0\NisSrv.exe
(PC-Doctor, Inc. -> PC-Doctor, Inc.) C:\Program Files\Dell\SupportAssistAgent\PCDr\SupportAssist\6.0.7240.285\DSAPI.exe
(Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Windows\System32\DriverStore\FileRepository\realtekservice.inf_amd64_c759ff49aef8a7cf\RtkAudUService64.exe <3>
(Skype Software Sarl -> Skype Technologies S.A.) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe <5>
(TBT_DCH_DRV_PROD -> Intel Corporation) C:\Windows\ThunderboltService.exe
(Waves Inc -> Waves Audio Ltd.) C:\Windows\System32\DriverStore\FileRepository\wavesapo8de.inf_amd64_9384fc4d30af89c3\WavesSvc64.exe
(Waves Inc -> Waves Audio Ltd.) C:\Windows\System32\DriverStore\FileRepository\wavesapo8de.inf_amd64_9384fc4d30af89c3\WavesSysSvc64.exe
==================== Registry (Whitelisted) ===================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [WavesSvc] => C:\Windows\System32\DriverStore\FileRepository\wavesapo8de.inf_amd64_9384fc4d30af89c3\WavesSvc64.exe [1645664 2020-04-24] (Waves Inc -> Waves Audio Ltd.)
HKLM\...\Run: [RtkAudUService] => C:\Windows\System32\DriverStore\FileRepository\realtekservice.inf_amd64_c759ff49aef8a7cf\RtkAudUService64.exe [1217808 2020-11-25] (Realtek Semiconductor Corp. -> Realtek Semiconductor)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [3951968 2019-07-09] (Logitech -> Logitech, Inc.)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [5890504 2019-04-02] (LogMeIn, Inc. -> LogMeIn Inc.)
HKU\S-1-5-21-925457469-728721832-1435735986-1001\...\Run: [Skype for Desktop] => C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe [91016584 2021-01-15] (Skype Software Sarl -> Skype Technologies S.A.)
HKU\S-1-5-21-925457469-728721832-1435735986-1001\...\Run: [com.squirrel.Teams.Teams] => C:\Users\Jen\AppData\Local\Microsoft\Teams\Update.exe [2452664 2021-01-11] (Microsoft 3rd Party Application Component -> Microsoft Corporation)
HKU\S-1-5-21-925457469-728721832-1435735986-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\FANTAS~1.SCR
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files\Google\Chrome\Application\89.0.4389.82\Installer\chrmstp.exe [2021-03-06] (Google LLC -> Google LLC)
==================== Scheduled Tasks (Whitelisted) ============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {09A9EAA5-9B4F-4FC8-81E8-EC91C9076D84} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2102.3-0\MpCmdRun.exe [566376 2021-03-06] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {26299D7B-3A25-49A6-B75F-CBD68061E5F4} - System32\Tasks\HP\HP Print Scan Doctor\Printer Health Monitor Logon => C:\Program Files\HPPrintScanDoctor\HPPrinterHealthMonitor.exe [35464 2021-02-04] (HP Inc. -> HP Inc.)
Task: {2888F2DA-EC64-4C0D-A9C9-D9FEC8F75833} - System32\Tasks\HP\HP Print Scan Doctor\Printer Health Monitor => C:\Program Files\HPPrintScanDoctor\HPPrinterHealthMonitor.exe [35464 2021-02-04] (HP Inc. -> HP Inc.)
Task: {29581299-103D-4D1D-8FC3-3EDE1450D120} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [4004296 2021-03-05] (Microsoft Corporation -> Microsoft Corporation)
Task: {49AA1E3C-D642-4A13-971F-D34BAE9293A5} - System32\Tasks\Microsoft\Office\Office Feature Updates => C:\Program Files (x86)\Microsoft Office\root\Office16\sdxhelper.exe [114048 2021-03-13] (Microsoft Corporation -> Microsoft Corporation)
Task: {634E4705-C3AA-4F58-B97C-72E5794F076F} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1557200 2021-01-25] (Adobe Inc. -> Adobe Inc.)
Task: {713548E3-75C7-46E5-9028-18B5057EB0C5} - System32\Tasks\Microsoft\Office\Office Feature Updates Logon => C:\Program Files (x86)\Microsoft Office\root\Office16\sdxhelper.exe [114048 2021-03-13] (Microsoft Corporation -> Microsoft Corporation)
Task: {8FD539AA-3EFB-45B6-8D02-343E932C131F} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [4004296 2021-03-05] (Microsoft Corporation -> Microsoft Corporation)
Task: {A17B87F5-5969-4915-8600-0524841F59E5} - System32\Tasks\Dell SupportAssistAgent AutoUpdate => C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssistInstaller.exe [1059336 2021-01-09] (Dell Inc -> Dell Inc.)
Task: {B6686BBE-7028-40C7-911E-D495D8C698D6} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2102.3-0\MpCmdRun.exe [566376 2021-03-06] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {C160355D-8957-4EB9-BDF4-8DF885F96F0F} - System32\Tasks\G2MUpdateTask-S-1-5-21-925457469-728721832-1435735986-1001 => C:\Users\Jen\AppData\Local\GoToMeeting\19228\g2mupdate.exe [31320 2021-01-28] (LogMeIn, Inc. -> LogMeIn, Inc.)
Task: {C70FD65E-9DAD-4BA7-BDE3-C8A7DB44AAD1} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [155592 2021-01-07] (Google LLC -> Google LLC)
Task: {D8C94690-81B2-447D-A451-1E9C812E7E36} - System32\Tasks\Microsoft\Office\Office Automatic Updates 2.0 => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [23079792 2021-03-05] (Microsoft Corporation -> Microsoft Corporation)
Task: {DBFBAF18-652D-4255-9A7C-B2A6909560B7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [155592 2021-01-07] (Google LLC -> Google LLC)
Task: {E689B95D-D987-4B61-AC5F-612D8DC70D1C} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [23079792 2021-03-05] (Microsoft Corporation -> Microsoft Corporation)
Task: {EF935D4C-8BA5-4356-BCFC-5A7FFF495392} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2102.3-0\MpCmdRun.exe [566376 2021-03-06] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {F2D0DEED-BB96-4439-9571-D4C50E2683DE} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2102.3-0\MpCmdRun.exe [566376 2021-03-06] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {FEB6F804-F986-4967-84A7-CEB90799A4E1} - System32\Tasks\G2MUploadTask-S-1-5-21-925457469-728721832-1435735986-1001 => C:\Users\Jen\AppData\Local\GoToMeeting\19228\g2mupload.exe [31320 2021-01-28] (LogMeIn, Inc. -> LogMeIn, Inc.)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-925457469-728721832-1435735986-1001.job => C:\Users\Jen\AppData\Local\GoToMeeting\19228\g2mupdate.exe
Task: C:\Windows\Tasks\G2MUploadTask-S-1-5-21-925457469-728721832-1435735986-1001.job => C:\Users\Jen\AppData\Local\GoToMeeting\19228\g2mupload.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 192.168.16.7
Tcpip\..\Interfaces\{69daf132-2a34-46b1-aa04-9839af0a8ee7}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{e574721b-b6ac-4801-8ee4-70036021a18d}: [DhcpNameServer] 172.20.10.1
Tcpip\..\Interfaces\{fbb3ae7f-1633-4dc7-9f62-ca445c68f177}: [DhcpNameServer] 192.168.16.7
Edge:
=======
Edge DefaultProfile: Default
Edge Profile: C:\Users\Jen\AppData\Local\Microsoft\Edge\User Data\Default [2021-03-15]
Edge HKLM-x32\...\Edge\Extension: [ihcjicgdanjaechkgeegckofjjedodee]
FireFox:
========
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2021-03-05] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2021-03-05] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2021-03-06] (Adobe Inc. -> Adobe Systems Inc.)
Chrome:
=======
CHR Profile: C:\Users\Jen\AppData\Local\Google\Chrome\User Data\Default [2021-03-15]
CHR Notifications: Default -> hxxps://app.slack.com; hxxps://www.facebook.com; hxxps://www.netflix.com; hxxps://www.usmagazine.com
CHR StartupUrls: Default -> "hxxp://www.gmail.com/"
CHR Extension: (Slides) - C:\Users\Jen\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2021-01-07]
CHR Extension: (Docs) - C:\Users\Jen\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2021-01-07]
CHR Extension: (Google Drive) - C:\Users\Jen\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2021-01-07]
CHR Extension: (YouTube) - C:\Users\Jen\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2021-01-07]
CHR Extension: (Sheets) - C:\Users\Jen\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2021-01-07]
CHR Extension: (Google Docs Offline) - C:\Users\Jen\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2021-03-15]
CHR Extension: (Malwarebytes Browser Guard) - C:\Users\Jen\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihcjicgdanjaechkgeegckofjjedodee [2021-03-15]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Jen\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2021-01-28]
CHR Extension: (Gmail) - C:\Users\Jen\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2021-01-07]
CHR Extension: (Chrome Media Router) - C:\Users\Jen\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2021-03-07]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]
CHR HKLM-x32\...\Chrome\Extension: [ihcjicgdanjaechkgeegckofjjedodee]
==================== Services (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AdobeARMservice; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [169672 2021-01-25] (Adobe Inc. -> Adobe Inc.)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [8988552 2021-03-05] (Microsoft Corporation -> Microsoft Corporation)
S3 dcpm-notify; C:\Program Files\Dell\CommandPowerManager\NotifyService.exe [315008 2020-08-18] (Dell Inc -> Dell Inc.)
R2 DDVCollectorSvcApi; C:\Program Files\Dell\DellDataVault\DDVCollectorSvcApi.exe [287776 2020-10-26] (Dell Technologies Inc. -> Dell Technologies Inc.)
R2 DDVDataCollector; C:\Program Files\Dell\DellDataVault\DDVDataCollector.exe [3750944 2020-10-26] (Dell Technologies Inc. -> Dell Technologies Inc.)
R2 DDVRulesProcessor; C:\Program Files\Dell\DellDataVault\DDVRulesProcessor.exe [507936 2020-10-26] (Dell Technologies Inc. -> Dell Technologies Inc.)
R2 Dell Digital Delivery Services; C:\Program Files (x86)\Dell Digital Delivery Services\Dell.D3.WinSvc.exe [48832 2020-11-19] (Dell Inc -> )
R2 Dell Hardware Support; C:\Program Files\Dell\SupportAssistAgent\PCDr\SupportAssist\6.0.7240.285\DSAPI.exe [985584 2021-01-12] (PC-Doctor, Inc. -> PC-Doctor, Inc.)
R2 Dell SupportAssist Remediation; C:\Program Files\Dell\SARemediation\agent\DellSupportAssistRemedationService.exe [19128 2021-01-29] (Dell Inc -> Dell INC.)
S3 Dell.CommandPowerManager.Service; C:\Windows\system32\dllhost.exe /Processid:{2243A241-1539-4C2B-8CEE-D49B70344539} [21312 2021-01-09] (Microsoft Windows -> Microsoft Corporation)
S3 Dell.CommandPowerManager.Service; C:\Windows\system32\dllhost.exe /Processid:{2243A241-1539-4C2B-8CEE-D49B70344539} [21312 2021-01-09] (Microsoft Windows -> Microsoft Corporation)
R2 DellClientManagementService; C:\Program Files (x86)\Dell\UpdateService\ServiceShell.exe [38592 2021-01-19] (Dell Inc -> )
R2 GoToAssist Remote Support Customer; C:\Program Files (x86)\GoToAssist Remote Support Customer\1692\g2ax_service.exe [615632 2021-01-17] (LogMeIn, Inc. -> LogMeIn, Inc.)
R2 Hamachi2Svc; C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe [3361736 2019-04-02] (LogMeIn, Inc. -> LogMeIn Inc.)
R2 hostcontrolsvc; C:\Windows\System32\bcmHostControlService.exe [832888 2020-10-14] (Broadcom Corporation -> Broadcom Corporation)
R2 hoststoragesvc; C:\Windows\System32\bcmHostStorageService.exe [169336 2020-10-14] (Broadcom Corporation -> Broadcom Corporation)
R2 HPPrintScanDoctorService; C:\Program Files\HPPrintScanDoctor\HPPrintScanDoctorService.exe [284808 2021-02-04] (HP Inc. -> HP Inc.)
R2 IntelContextService; C:\Program Files\Intel\Intel(R) User Awareness Service\UserAwarenessService.exe [146792 2020-01-24] (Intel Context Sensing SDK -> Intel Corp)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe [419248 2016-05-27] (LogMeIn, Inc. -> LogMeIn, Inc.)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [7456464 2021-01-08] (Malwarebytes Inc -> Malwarebytes)
R2 RtkAudioUniversalService; C:\Windows\System32\DriverStore\FileRepository\realtekservice.inf_amd64_c759ff49aef8a7cf\RtkAudUService64.exe [1217808 2020-11-25] (Realtek Semiconductor Corp. -> Realtek Semiconductor)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [5198064 2021-01-16] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 SupportAssistAgent; C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe [39432 2021-01-09] (Dell Inc -> Dell Inc.)
R2 ushupgradesvc; C:\Windows\System32\bcmUshUpgradeService.exe [293240 2020-10-14] (Broadcom Corporation -> )
R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2102.3-0\NisSrv.exe [2483624 2021-03-06] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2102.3-0\MsMpEng.exe [128392 2021-03-06] (Microsoft Windows Publisher -> Microsoft Corporation)
===================== Drivers (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 AppleKmdfFilter; C:\Windows\System32\drivers\AppleKmdfFilter.sys [20032 2020-10-09] (WDKTestCert build,132303256403278908 -> Apple Inc.)
S3 AppleLowerFilter; C:\Windows\System32\drivers\AppleLowerFilter.sys [35976 2020-10-09] (WDKTestCert build,132303256403278908 -> Apple Inc.)
S3 bcmnfcusb; C:\Windows\System32\drivers\bcmnfcusb.sys [50528 2020-10-14] (Broadcom Corporation -> Broadcom Corporation.)
R3 DBUtilDrv2; C:\Windows\System32\drivers\DBUtilDrv2.sys [24952 2021-02-09] (Microsoft Windows Hardware Compatibility Publisher -> )
R3 DDDriver; C:\Windows\System32\drivers\dddriver64Dcsa.sys [42376 2020-10-26] (Microsoft Windows Hardware Compatibility Publisher -> Dell Inc.)
R3 Hamachi; C:\Windows\system32\DRIVERS\Hamdrv.sys [45680 2019-04-02] (Microsoft Windows Hardware Compatibility Publisher -> LogMeIn Inc.)
S3 iaLPSS2_SPI_CNL; C:\Windows\System32\DriverStore\FileRepository\ialpss2_spi_cnl.inf_amd64_f9088e14bef268e6\iaLPSS2_SPI_CNL.sys [156936 2020-08-16] (Intel Corporation -> Intel Corporation)
S3 iaLPSS2_UART2_CNL; C:\Windows\System32\DriverStore\FileRepository\ialpss2_uart2_cnl.inf_amd64_df1115697e57a59a\iaLPSS2_UART2_CNL.sys [305928 2020-08-16] (Intel Corporation -> Intel Corporation)
R2 MBAMChameleon; C:\Windows\System32\Drivers\MbamChameleon.sys [220616 2021-02-16] (Malwarebytes Inc -> Malwarebytes)
S0 MbamElam; C:\Windows\System32\DRIVERS\MbamElam.sys [19912 2021-01-08] (Microsoft Windows Early Launch Anti-malware Publisher -> Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [248992 2021-02-16] (Malwarebytes Inc -> Malwarebytes)
R3 MpKsl95cf61f6; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{E930B111-030B-4808-935E-7882AC7486DC}\MpKslDrv.sys [90360 2021-03-15] (Microsoft Windows -> Microsoft Corporation)
S3 Netaapl; C:\Windows\System32\drivers\netaapl64.sys [32352 2017-11-28] (Microsoft Windows Hardware Compatibility Publisher -> Apple Inc.)
S3 tap0901; C:\Windows\System32\drivers\tap0901.sys [41400 2020-11-16] (McAfee, LLC. -> The OpenVPN Project)
S0 WdBoot; C:\Windows\System32\drivers\wd\WdBoot.sys [49544 2021-03-06] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\wd\WdFilter.sys [420088 2021-03-06] (Microsoft Windows -> Microsoft Corporation)
R3 WdNisDrv; C:\Windows\System32\drivers\wd\WdNisDrv.sys [72952 2021-03-06] (Microsoft Windows -> Microsoft Corporation)
R3 WiMan; C:\Windows\System32\DriverStore\FileRepository\wiman.inf_amd64_4b0336d95f188e47\WiMan\WiMan.sys [162136 2020-07-02] (Intel Wireless Driver -> )
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One month (created) (Whitelisted) =========
(If an entry is included in the fixlist, the file/folder will be moved.)
2021-03-15 18:50 - 2021-03-15 18:51 - 000025982 _____ C:\Users\Jen\Downloads\FRST.txt
2021-03-15 18:50 - 2021-03-15 18:50 - 000000000 ____D C:\FRST
2021-03-15 18:49 - 2021-03-15 18:49 - 002300928 _____ (Farbar) C:\Users\Jen\Downloads\FRST64.exe
2021-03-15 18:34 - 2021-03-15 18:34 - 000086679 _____ C:\Users\Jen\Downloads\All Lessons (3).xlsx
2021-03-15 15:04 - 2021-03-15 15:04 - 000202132 _____ C:\Users\Jen\Downloads\RCM Level 4 piano.pdf
2021-03-15 14:29 - 2021-03-15 14:29 - 007320970 _____ C:\Users\Jen\Downloads\Green_New_Deal_special_report_Feb_2021-lowres.pdf
2021-03-15 11:51 - 2021-03-15 11:51 - 000204473 _____ C:\Users\Jen\Downloads\RCM Mock Piano Level 5.pdf
2021-03-12 23:27 - 2021-03-12 23:27 - 000160222 _____ C:\Users\Jen\Downloads\Over the Rainbow - Eb Major - MN0051775.pdf
2021-03-12 23:27 - 2021-03-12 23:27 - 000160222 _____ C:\Users\Jen\Downloads\Over the Rainbow - Eb Major - MN0051775 (1).pdf
2021-03-08 19:31 - 2021-03-08 19:32 - 000000000 ____D C:\Users\Jen\AppData\Roaming\AnyDesk
2021-03-08 19:19 - 2021-03-08 19:19 - 000367746 _____ C:\Users\Jen\Downloads\ImagineARTS songs 2019-2020 Edits.pdf
2021-03-07 21:12 - 2021-03-07 21:13 - 000072939 _____ C:\Users\Jen\Downloads\image0.jpeg
2021-03-07 10:53 - 2021-03-07 10:53 - 000084995 _____ C:\Users\Jen\Downloads\All Lessons (2).xlsx
2021-03-06 12:23 - 2021-03-06 12:23 - 000013372 _____ C:\Users\Jen\Downloads\voice students.sp21.xlsx
2021-03-06 12:00 - 2021-03-06 12:00 - 000066445 _____ C:\Users\Jen\Downloads\Voice Competition 2021.pdf
2021-03-06 11:58 - 2021-03-06 11:58 - 000317101 _____ C:\Users\Jen\Downloads\Results-Mailer.pdf
2021-03-05 17:04 - 2021-03-05 17:04 - 000345568 _____ C:\Users\Jen\Downloads\FV prep p 7.pdf
2021-03-05 10:07 - 2021-03-05 10:07 - 000022627 _____ C:\Users\Jen\Downloads\ImagineARTS Schedule 2020-21 (1).xlsx
2021-03-02 18:10 - 2021-03-02 18:10 - 000132712 _____ C:\Users\Jen\Downloads\TipsForSuccessfulCompetition.pdf
2021-03-02 16:54 - 2021-03-02 16:54 - 000392422 _____ C:\Users\Jen\Downloads\Application for the Westerbeke Scholarship2021.pages
2021-03-01 21:42 - 2021-03-01 21:42 - 000084995 _____ C:\Users\Jen\Downloads\All Lessons (1).xlsx
2021-03-01 15:58 - 2021-03-01 15:58 - 000083288 _____ (Zoom Video Communications, Inc.) C:\Users\Jen\Downloads\Zoom_cm_f44iro45iMvuxZ9vvrZo4_msKFJ19Rdo0k96uSN0wGj6MiQRjadASuf+bQD@vudz9Or8SGTFhaCP_ka96237c298542a2f_.exe
2021-02-26 14:47 - 2021-02-26 14:47 - 000071634 _____ C:\Users\Jen\Downloads\WinnersProgram2020.pdf
2021-02-26 14:38 - 2021-02-26 14:38 - 000058743 _____ C:\Users\Jen\Downloads\JudgesInstructionsforOnlineProcess.pdf
2021-02-25 19:30 - 2021-02-25 19:30 - 000083288 _____ (Zoom Video Communications, Inc.) C:\Users\Jen\Downloads\Zoom_cm_fo42anktZ9vvrZo4_mTSWlRbrxsXT5MCwnlhh5jKivlxwYrbJI-g@6hgmfNKRzXQZAONO_k3427923208b22554_.exe
2021-02-25 14:24 - 2021-02-25 14:24 - 000000000 ____D C:\Users\Jen\AppData\Local\OneDrive
2021-02-23 21:24 - 2021-02-23 21:25 - 136087787 _____ C:\Users\Jen\Downloads\WIN_20210223_20_08_41_Pro.mp4
2021-02-21 15:56 - 2021-02-21 15:56 - 000083288 _____ (Zoom Video Communications, Inc.) C:\Users\Jen\Downloads\Zoom_cm_fo42anktZ9vvrZo4_mV9LoOFRDP-VDSPi3vGgSpHrYNT8ZuOmkmIlw@vVizh-SHhSvyPYWJ_k5b19df3059c56b5c_.exe
2021-02-20 19:18 - 2021-02-20 19:19 - 000084995 _____ C:\Users\Jen\Downloads\All Lessons.xlsx
2021-02-20 15:34 - 2021-02-20 15:34 - 000000000 ____D C:\Program Files\Microsoft Update Health Tools
2021-02-18 19:46 - 2021-02-18 19:46 - 000083288 _____ (Zoom Video Communications, Inc.) C:\Users\Jen\Downloads\Zoom_cm_fo42anktZ9vvrZo4_mx4+pAITc8a29Keflnr76MfRyy9967hmBrQ@oJbDNnmLsFaG-E4l_kc28fadca9d9979f5_.exe
2021-02-17 21:55 - 2021-02-17 21:56 - 009992531 _____ C:\Users\Jen\Downloads\eirv48n07-20210212 (2).pdf
2021-02-16 22:29 - 2021-02-16 22:29 - 000248992 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys
2021-02-16 22:29 - 2021-02-16 22:29 - 000220616 _____ (Malwarebytes) C:\Windows\system32\Drivers\MbamChameleon.sys
2021-02-16 19:51 - 2021-02-16 19:51 - 000083288 _____ (Zoom Video Communications, Inc.) C:\Users\Jen\Downloads\Zoom_cm_fo42anktZ9vvrZo4_mR72Y61rYFKZG1lTDVHcQJ2MIL7dA-KG7oQ@0W25Veu56fOTKizg_kb1d59834670f793b_.exe
2021-02-15 11:31 - 2021-02-15 11:31 - 009992531 _____ C:\Users\Jen\Downloads\eirv48n07-20210212.pdf
2021-02-15 11:31 - 2021-02-15 11:31 - 009992531 _____ C:\Users\Jen\Downloads\eirv48n07-20210212 (1).pdf
2021-02-14 16:57 - 2021-02-14 16:57 - 000000000 ____D C:\Users\Jen\AppData\Local\D3DSCache
==================== One month (modified) ==================
(If an entry is included in the fixlist, the file/folder will be moved.)
2021-03-15 18:48 - 2021-01-17 18:15 - 000000000 ____D C:\Users\Jen\AppData\Local\LogMeIn Hamachi
2021-03-15 18:48 - 2019-12-07 05:14 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2021-03-15 18:35 - 2021-01-07 20:04 - 000000000 ____D C:\Users\Jen\Desktop\IMAGINEaRTS
2021-03-15 18:35 - 2021-01-07 18:03 - 000000000 ____D C:\Users\Jen\AppData\Local\Packages
2021-03-15 18:01 - 2021-02-02 17:35 - 000002083 _____ C:\ProgramData\Desktop\HP Print and Scan Doctor.lnk
2021-03-15 16:53 - 2020-12-22 05:39 - 000000000 ____D C:\Windows\system32\SleepStudy
2021-03-15 11:59 - 2019-12-07 05:14 - 000000000 ___HD C:\Program Files\WindowsApps
2021-03-15 11:59 - 2019-12-07 05:14 - 000000000 ____D C:\Windows\AppReadiness
2021-03-15 11:56 - 2021-01-07 19:27 - 000000000 ____D C:\Users\Jen\AppData\Local\PlaceholderTileLogoFolder
2021-03-15 11:51 - 2021-01-07 20:05 - 000000000 ____D C:\Users\Jen\Desktop\RCM STUFF
2021-03-15 11:37 - 2021-01-07 19:45 - 000000000 ___RD C:\Users\Jen\iCloudDrive
2021-03-15 11:37 - 2021-01-07 18:04 - 000000000 ___RD C:\Users\Jen\OneDrive
2021-03-15 11:36 - 2021-01-07 18:03 - 000000000 __SHD C:\Users\Jen\IntelGraphicsProfiles
2021-03-14 22:18 - 2020-12-22 05:46 - 000795738 _____ C:\Windows\system32\PerfStringBackup.INI
2021-03-14 22:18 - 2019-12-07 05:13 - 000000000 ____D C:\Windows\INF
2021-03-14 22:14 - 2020-12-22 05:56 - 000002440 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
2021-03-14 22:13 - 2020-12-31 02:21 - 000000000 ____D C:\Program Files (x86)\Dell Digital Delivery Services
2021-03-13 15:07 - 2019-12-07 05:03 - 000000000 ____D C:\Windows\CbsTemp
2021-03-13 12:53 - 2021-01-08 14:27 - 000000000 ____D C:\Program Files (x86)\Microsoft Office
2021-03-13 12:40 - 2021-01-07 18:04 - 000003358 _____ C:\Windows\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-925457469-728721832-1435735986-1001
2021-03-13 12:40 - 2021-01-07 18:01 - 000002359 _____ C:\Users\Jen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2021-03-12 20:08 - 2021-01-08 16:18 - 000000000 ____D C:\Users\Jen\Documents\Zoom
2021-03-12 19:16 - 2019-12-07 05:14 - 000000000 ____D C:\Windows\ServiceState
2021-03-12 18:17 - 2021-01-07 18:03 - 000002350 _____ C:\Users\Jen\Desktop\Microsoft Edge.lnk
2021-03-12 13:56 - 2021-01-16 12:06 - 000002138 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2021-03-10 00:32 - 2021-01-11 21:01 - 000000000 ____D C:\Windows\system32\MRT
2021-03-10 00:30 - 2021-01-11 21:01 - 131005360 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2021-03-08 20:49 - 2020-12-31 02:14 - 000048741 _____ C:\Windows\system32\CVFirmwareUpgradeLog.txt
2021-03-08 20:49 - 2020-12-31 02:14 - 000000000 ____D C:\Intel
2021-03-08 20:49 - 2020-12-22 05:39 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2021-03-08 20:49 - 2020-12-22 05:38 - 000008192 ___SH C:\DumpStack.log.tmp
2021-03-08 20:48 - 2019-12-07 05:14 - 000000000 ____D C:\Windows\appcompat
2021-03-08 20:48 - 2019-12-07 05:03 - 000524288 _____ C:\Windows\system32\config\BBI
2021-03-08 20:44 - 2019-12-07 05:14 - 000000000 ____D C:\Windows\registration
2021-03-08 20:26 - 2021-01-07 18:01 - 000000000 ____D C:\Users\Jen
2021-03-08 08:55 - 2021-01-09 10:53 - 000000000 ____D C:\Users\Jen\AppData\Local\CrashDumps
2021-03-06 21:40 - 2019-12-07 05:14 - 000000000 ____D C:\Windows\LiveKernelReports
2021-03-06 11:59 - 2020-12-22 05:39 - 000000000 ____D C:\Windows\system32\Drivers\wd
2021-03-06 10:05 - 2021-01-07 19:21 - 000002249 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2021-03-06 10:05 - 2021-01-07 19:21 - 000002208 _____ C:\ProgramData\Desktop\Google Chrome.lnk
2021-03-04 18:36 - 2020-12-22 05:56 - 000003480 _____ C:\Windows\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
2021-03-04 18:36 - 2020-12-22 05:56 - 000003356 _____ C:\Windows\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore
2021-02-17 22:04 - 2021-02-04 11:57 - 000000000 ____D C:\Users\Jen\Desktop\Boston Reading Group
==================== SigCheck ============================
(There is no automatic fix for files that do not pass verification.)
==================== End of FRST.txt ========================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
(Adobe Inc. -> Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe <4>
(Adobe Inc. -> Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe <2>
(Apple Inc.) C:\Program Files\WindowsApps\AppleInc.iCloud_12.2.10.0_x86__nzyj5cx40ttqa\iCloud\ApplePhotoStreams.exe
(Apple Inc.) C:\Program Files\WindowsApps\AppleInc.iCloud_12.2.10.0_x86__nzyj5cx40ttqa\iCloud\APSDaemon.exe
(Apple Inc.) C:\Program Files\WindowsApps\AppleInc.iCloud_12.2.10.0_x86__nzyj5cx40ttqa\iCloud\iCloudDrive.exe
(Apple Inc.) C:\Program Files\WindowsApps\AppleInc.iCloud_12.2.10.0_x86__nzyj5cx40ttqa\iCloud\iCloudPhotos.exe
(Apple Inc.) C:\Program Files\WindowsApps\AppleInc.iCloud_12.2.10.0_x86__nzyj5cx40ttqa\iCloud\iCloudServices.exe
(Apple Inc.) C:\Program Files\WindowsApps\AppleInc.iCloud_12.2.10.0_x86__nzyj5cx40ttqa\iCloud\secd.exe
(Apple Inc.) C:\Program Files\WindowsApps\AppleInc.iTunes_12110.26.53016.0_x64__nzyj5cx40ttqa\AMDS64\AppleMobileDeviceProcess.exe
(Broadcom Corporation -> ) C:\Windows\System32\bcmUshUpgradeService.exe
(Broadcom Corporation -> Broadcom Corporation) C:\Windows\System32\bcmHostControlService.exe
(Broadcom Corporation -> Broadcom Corporation) C:\Windows\System32\bcmHostStorageService.exe
(Dell Inc -> ) C:\Program Files (x86)\Dell Digital Delivery Services\Dell.D3.WinSvc.exe
(Dell Inc -> ) C:\Program Files (x86)\Dell\UpdateService\ServiceShell.exe
(Dell Inc -> Dell INC.) C:\Program Files\Dell\SARemediation\agent\DellSupportAssistRemedationService.exe
(Dell Inc -> Dell Inc.) C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe
(Dell Inc) C:\Program Files\WindowsApps\DellInc.DellProximitySensor_3.0.3.0_neutral__htrsf667h5kn2\WALTrayApp\DellExpressSignIn.exe
(Dell Technologies Inc. -> Dell Technologies Inc.) C:\Program Files\Dell\DellDataVault\DDVCollectorSvcApi.exe
(Dell Technologies Inc. -> Dell Technologies Inc.) C:\Program Files\Dell\DellDataVault\DDVDataCollector.exe
(Dell Technologies Inc. -> Dell Technologies Inc.) C:\Program Files\Dell\DellDataVault\DDVRulesProcessor.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.36.72\GoogleCrashHandler.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.36.72\GoogleCrashHandler64.exe
(Google LLC -> Google LLC) C:\Program Files\Google\Chrome\Application\chrome.exe <47>
(HP Inc. -> HP Inc.) C:\Program Files\HPPrintScanDoctor\HPPrintScanDoctorService.exe
(HP Inc.) C:\Program Files\WindowsApps\AD2F1837.HPPrinterControl_122.3.838.0_x64__v10z8vjag6ke6\HP.Smart.exe
(Intel Context Sensing SDK -> Intel Corp) C:\Program Files\Intel\Intel(R) User Awareness Service\UserAwarenessHelper.exe
(Intel Context Sensing SDK -> Intel Corp) C:\Program Files\Intel\Intel(R) User Awareness Service\UserAwarenessService.exe
(Intel Corporation -> Intel Corporation) C:\Windows\System32\Intel\DPTF\dptf_helper.exe
(Intel Corporation -> Intel Corporation) C:\Windows\System32\Intel\DPTF\esif_uf.exe
(Intel(R) Embedded Subsystems and IP Blocks Group -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\dal.inf_amd64_0b214be229a13e84\jhi_service.exe
(Intel(R) Embedded Subsystems and IP Blocks Group -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\lms.inf_amd64_c0fd909ca6e7d672\LMS.exe
(Intel(R) pGFX 2020 -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_28efa2cb508b2ae9\igfxCUIService.exe
(Intel(R) pGFX 2020 -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_28efa2cb508b2ae9\igfxEM.exe
(Intel(R) pGFX 2020 -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igcc_dch.inf_amd64_70e7e4392a76adb3\OneApp.IGCC.WinService.exe
(Intel(R) pGFX 2020 -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_e0b6fab413a2f545\IntelCpHDCPSvc.exe
(Intel(R) pGFX 2020 -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_e0b6fab413a2f545\IntelCpHeciSvc.exe
(Intel(R) Rapid Storage Technology -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iastorac.inf_amd64_42f9d9bfb72d84cf\RstMwService.exe
(LogMeIn, Inc. -> LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(LogMeIn, Inc. -> LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe
(LogMeIn, Inc. -> LogMeIn, Inc.) C:\Program Files (x86)\GoToAssist Remote Support Customer\1692\g2ax_comm_customer.exe
(LogMeIn, Inc. -> LogMeIn, Inc.) C:\Program Files (x86)\GoToAssist Remote Support Customer\1692\g2ax_service.exe
(LogMeIn, Inc. -> LogMeIn, Inc.) C:\Program Files (x86)\GoToAssist Remote Support Customer\1692\g2ax_system_customer.exe
(LogMeIn, Inc. -> LogMeIn, Inc.) C:\Program Files (x86)\GoToAssist Remote Support Customer\1692\g2ax_user_customer.exe
(LogMeIn, Inc. -> LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
(Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE <2>
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Users\Jen\AppData\Local\Microsoft\OneDrive\21.030.0211.0002\FileCoAuth.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Users\Jen\AppData\Local\Microsoft\OneDrive\OneDrive.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2102.8653.0_x64__8wekyb3d8bbwe\Cortana.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2008.12711.0_x64__8wekyb3d8bbwe\LocalBridge.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.13801.20202.0_x64__8wekyb3d8bbwe\onenoteim.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsStore_12011.1001.1.0_x64__8wekyb3d8bbwe\WinStore.App.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.20122.11121.0_x64__8wekyb3d8bbwe\Music.UI.exe
(Microsoft Windows -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\splwow64.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe <3>
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MoUsoCoreWorker.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MusNotifyIcon.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\oobe\UserOOBEBroker.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\WWAHost.exe
(Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2102.3-0\MsMpEng.exe
(Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2102.3-0\NisSrv.exe
(PC-Doctor, Inc. -> PC-Doctor, Inc.) C:\Program Files\Dell\SupportAssistAgent\PCDr\SupportAssist\6.0.7240.285\DSAPI.exe
(Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Windows\System32\DriverStore\FileRepository\realtekservice.inf_amd64_c759ff49aef8a7cf\RtkAudUService64.exe <3>
(Skype Software Sarl -> Skype Technologies S.A.) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe <5>
(TBT_DCH_DRV_PROD -> Intel Corporation) C:\Windows\ThunderboltService.exe
(Waves Inc -> Waves Audio Ltd.) C:\Windows\System32\DriverStore\FileRepository\wavesapo8de.inf_amd64_9384fc4d30af89c3\WavesSvc64.exe
(Waves Inc -> Waves Audio Ltd.) C:\Windows\System32\DriverStore\FileRepository\wavesapo8de.inf_amd64_9384fc4d30af89c3\WavesSysSvc64.exe
==================== Registry (Whitelisted) ===================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [WavesSvc] => C:\Windows\System32\DriverStore\FileRepository\wavesapo8de.inf_amd64_9384fc4d30af89c3\WavesSvc64.exe [1645664 2020-04-24] (Waves Inc -> Waves Audio Ltd.)
HKLM\...\Run: [RtkAudUService] => C:\Windows\System32\DriverStore\FileRepository\realtekservice.inf_amd64_c759ff49aef8a7cf\RtkAudUService64.exe [1217808 2020-11-25] (Realtek Semiconductor Corp. -> Realtek Semiconductor)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [3951968 2019-07-09] (Logitech -> Logitech, Inc.)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [5890504 2019-04-02] (LogMeIn, Inc. -> LogMeIn Inc.)
HKU\S-1-5-21-925457469-728721832-1435735986-1001\...\Run: [Skype for Desktop] => C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe [91016584 2021-01-15] (Skype Software Sarl -> Skype Technologies S.A.)
HKU\S-1-5-21-925457469-728721832-1435735986-1001\...\Run: [com.squirrel.Teams.Teams] => C:\Users\Jen\AppData\Local\Microsoft\Teams\Update.exe [2452664 2021-01-11] (Microsoft 3rd Party Application Component -> Microsoft Corporation)
HKU\S-1-5-21-925457469-728721832-1435735986-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\FANTAS~1.SCR
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files\Google\Chrome\Application\89.0.4389.82\Installer\chrmstp.exe [2021-03-06] (Google LLC -> Google LLC)
==================== Scheduled Tasks (Whitelisted) ============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {09A9EAA5-9B4F-4FC8-81E8-EC91C9076D84} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2102.3-0\MpCmdRun.exe [566376 2021-03-06] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {26299D7B-3A25-49A6-B75F-CBD68061E5F4} - System32\Tasks\HP\HP Print Scan Doctor\Printer Health Monitor Logon => C:\Program Files\HPPrintScanDoctor\HPPrinterHealthMonitor.exe [35464 2021-02-04] (HP Inc. -> HP Inc.)
Task: {2888F2DA-EC64-4C0D-A9C9-D9FEC8F75833} - System32\Tasks\HP\HP Print Scan Doctor\Printer Health Monitor => C:\Program Files\HPPrintScanDoctor\HPPrinterHealthMonitor.exe [35464 2021-02-04] (HP Inc. -> HP Inc.)
Task: {29581299-103D-4D1D-8FC3-3EDE1450D120} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [4004296 2021-03-05] (Microsoft Corporation -> Microsoft Corporation)
Task: {49AA1E3C-D642-4A13-971F-D34BAE9293A5} - System32\Tasks\Microsoft\Office\Office Feature Updates => C:\Program Files (x86)\Microsoft Office\root\Office16\sdxhelper.exe [114048 2021-03-13] (Microsoft Corporation -> Microsoft Corporation)
Task: {634E4705-C3AA-4F58-B97C-72E5794F076F} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1557200 2021-01-25] (Adobe Inc. -> Adobe Inc.)
Task: {713548E3-75C7-46E5-9028-18B5057EB0C5} - System32\Tasks\Microsoft\Office\Office Feature Updates Logon => C:\Program Files (x86)\Microsoft Office\root\Office16\sdxhelper.exe [114048 2021-03-13] (Microsoft Corporation -> Microsoft Corporation)
Task: {8FD539AA-3EFB-45B6-8D02-343E932C131F} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [4004296 2021-03-05] (Microsoft Corporation -> Microsoft Corporation)
Task: {A17B87F5-5969-4915-8600-0524841F59E5} - System32\Tasks\Dell SupportAssistAgent AutoUpdate => C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssistInstaller.exe [1059336 2021-01-09] (Dell Inc -> Dell Inc.)
Task: {B6686BBE-7028-40C7-911E-D495D8C698D6} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2102.3-0\MpCmdRun.exe [566376 2021-03-06] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {C160355D-8957-4EB9-BDF4-8DF885F96F0F} - System32\Tasks\G2MUpdateTask-S-1-5-21-925457469-728721832-1435735986-1001 => C:\Users\Jen\AppData\Local\GoToMeeting\19228\g2mupdate.exe [31320 2021-01-28] (LogMeIn, Inc. -> LogMeIn, Inc.)
Task: {C70FD65E-9DAD-4BA7-BDE3-C8A7DB44AAD1} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [155592 2021-01-07] (Google LLC -> Google LLC)
Task: {D8C94690-81B2-447D-A451-1E9C812E7E36} - System32\Tasks\Microsoft\Office\Office Automatic Updates 2.0 => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [23079792 2021-03-05] (Microsoft Corporation -> Microsoft Corporation)
Task: {DBFBAF18-652D-4255-9A7C-B2A6909560B7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [155592 2021-01-07] (Google LLC -> Google LLC)
Task: {E689B95D-D987-4B61-AC5F-612D8DC70D1C} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [23079792 2021-03-05] (Microsoft Corporation -> Microsoft Corporation)
Task: {EF935D4C-8BA5-4356-BCFC-5A7FFF495392} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2102.3-0\MpCmdRun.exe [566376 2021-03-06] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {F2D0DEED-BB96-4439-9571-D4C50E2683DE} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2102.3-0\MpCmdRun.exe [566376 2021-03-06] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {FEB6F804-F986-4967-84A7-CEB90799A4E1} - System32\Tasks\G2MUploadTask-S-1-5-21-925457469-728721832-1435735986-1001 => C:\Users\Jen\AppData\Local\GoToMeeting\19228\g2mupload.exe [31320 2021-01-28] (LogMeIn, Inc. -> LogMeIn, Inc.)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-925457469-728721832-1435735986-1001.job => C:\Users\Jen\AppData\Local\GoToMeeting\19228\g2mupdate.exe
Task: C:\Windows\Tasks\G2MUploadTask-S-1-5-21-925457469-728721832-1435735986-1001.job => C:\Users\Jen\AppData\Local\GoToMeeting\19228\g2mupload.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 192.168.16.7
Tcpip\..\Interfaces\{69daf132-2a34-46b1-aa04-9839af0a8ee7}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{e574721b-b6ac-4801-8ee4-70036021a18d}: [DhcpNameServer] 172.20.10.1
Tcpip\..\Interfaces\{fbb3ae7f-1633-4dc7-9f62-ca445c68f177}: [DhcpNameServer] 192.168.16.7
Edge:
=======
Edge DefaultProfile: Default
Edge Profile: C:\Users\Jen\AppData\Local\Microsoft\Edge\User Data\Default [2021-03-15]
Edge HKLM-x32\...\Edge\Extension: [ihcjicgdanjaechkgeegckofjjedodee]
FireFox:
========
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2021-03-05] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2021-03-05] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2021-03-06] (Adobe Inc. -> Adobe Systems Inc.)
Chrome:
=======
CHR Profile: C:\Users\Jen\AppData\Local\Google\Chrome\User Data\Default [2021-03-15]
CHR Notifications: Default -> hxxps://app.slack.com; hxxps://www.facebook.com; hxxps://www.netflix.com; hxxps://www.usmagazine.com
CHR StartupUrls: Default -> "hxxp://www.gmail.com/"
CHR Extension: (Slides) - C:\Users\Jen\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2021-01-07]
CHR Extension: (Docs) - C:\Users\Jen\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2021-01-07]
CHR Extension: (Google Drive) - C:\Users\Jen\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2021-01-07]
CHR Extension: (YouTube) - C:\Users\Jen\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2021-01-07]
CHR Extension: (Sheets) - C:\Users\Jen\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2021-01-07]
CHR Extension: (Google Docs Offline) - C:\Users\Jen\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2021-03-15]
CHR Extension: (Malwarebytes Browser Guard) - C:\Users\Jen\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihcjicgdanjaechkgeegckofjjedodee [2021-03-15]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Jen\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2021-01-28]
CHR Extension: (Gmail) - C:\Users\Jen\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2021-01-07]
CHR Extension: (Chrome Media Router) - C:\Users\Jen\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2021-03-07]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]
CHR HKLM-x32\...\Chrome\Extension: [ihcjicgdanjaechkgeegckofjjedodee]
==================== Services (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AdobeARMservice; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [169672 2021-01-25] (Adobe Inc. -> Adobe Inc.)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [8988552 2021-03-05] (Microsoft Corporation -> Microsoft Corporation)
S3 dcpm-notify; C:\Program Files\Dell\CommandPowerManager\NotifyService.exe [315008 2020-08-18] (Dell Inc -> Dell Inc.)
R2 DDVCollectorSvcApi; C:\Program Files\Dell\DellDataVault\DDVCollectorSvcApi.exe [287776 2020-10-26] (Dell Technologies Inc. -> Dell Technologies Inc.)
R2 DDVDataCollector; C:\Program Files\Dell\DellDataVault\DDVDataCollector.exe [3750944 2020-10-26] (Dell Technologies Inc. -> Dell Technologies Inc.)
R2 DDVRulesProcessor; C:\Program Files\Dell\DellDataVault\DDVRulesProcessor.exe [507936 2020-10-26] (Dell Technologies Inc. -> Dell Technologies Inc.)
R2 Dell Digital Delivery Services; C:\Program Files (x86)\Dell Digital Delivery Services\Dell.D3.WinSvc.exe [48832 2020-11-19] (Dell Inc -> )
R2 Dell Hardware Support; C:\Program Files\Dell\SupportAssistAgent\PCDr\SupportAssist\6.0.7240.285\DSAPI.exe [985584 2021-01-12] (PC-Doctor, Inc. -> PC-Doctor, Inc.)
R2 Dell SupportAssist Remediation; C:\Program Files\Dell\SARemediation\agent\DellSupportAssistRemedationService.exe [19128 2021-01-29] (Dell Inc -> Dell INC.)
S3 Dell.CommandPowerManager.Service; C:\Windows\system32\dllhost.exe /Processid:{2243A241-1539-4C2B-8CEE-D49B70344539} [21312 2021-01-09] (Microsoft Windows -> Microsoft Corporation)
S3 Dell.CommandPowerManager.Service; C:\Windows\system32\dllhost.exe /Processid:{2243A241-1539-4C2B-8CEE-D49B70344539} [21312 2021-01-09] (Microsoft Windows -> Microsoft Corporation)
R2 DellClientManagementService; C:\Program Files (x86)\Dell\UpdateService\ServiceShell.exe [38592 2021-01-19] (Dell Inc -> )
R2 GoToAssist Remote Support Customer; C:\Program Files (x86)\GoToAssist Remote Support Customer\1692\g2ax_service.exe [615632 2021-01-17] (LogMeIn, Inc. -> LogMeIn, Inc.)
R2 Hamachi2Svc; C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe [3361736 2019-04-02] (LogMeIn, Inc. -> LogMeIn Inc.)
R2 hostcontrolsvc; C:\Windows\System32\bcmHostControlService.exe [832888 2020-10-14] (Broadcom Corporation -> Broadcom Corporation)
R2 hoststoragesvc; C:\Windows\System32\bcmHostStorageService.exe [169336 2020-10-14] (Broadcom Corporation -> Broadcom Corporation)
R2 HPPrintScanDoctorService; C:\Program Files\HPPrintScanDoctor\HPPrintScanDoctorService.exe [284808 2021-02-04] (HP Inc. -> HP Inc.)
R2 IntelContextService; C:\Program Files\Intel\Intel(R) User Awareness Service\UserAwarenessService.exe [146792 2020-01-24] (Intel Context Sensing SDK -> Intel Corp)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe [419248 2016-05-27] (LogMeIn, Inc. -> LogMeIn, Inc.)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [7456464 2021-01-08] (Malwarebytes Inc -> Malwarebytes)
R2 RtkAudioUniversalService; C:\Windows\System32\DriverStore\FileRepository\realtekservice.inf_amd64_c759ff49aef8a7cf\RtkAudUService64.exe [1217808 2020-11-25] (Realtek Semiconductor Corp. -> Realtek Semiconductor)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [5198064 2021-01-16] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 SupportAssistAgent; C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe [39432 2021-01-09] (Dell Inc -> Dell Inc.)
R2 ushupgradesvc; C:\Windows\System32\bcmUshUpgradeService.exe [293240 2020-10-14] (Broadcom Corporation -> )
R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2102.3-0\NisSrv.exe [2483624 2021-03-06] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2102.3-0\MsMpEng.exe [128392 2021-03-06] (Microsoft Windows Publisher -> Microsoft Corporation)
===================== Drivers (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 AppleKmdfFilter; C:\Windows\System32\drivers\AppleKmdfFilter.sys [20032 2020-10-09] (WDKTestCert build,132303256403278908 -> Apple Inc.)
S3 AppleLowerFilter; C:\Windows\System32\drivers\AppleLowerFilter.sys [35976 2020-10-09] (WDKTestCert build,132303256403278908 -> Apple Inc.)
S3 bcmnfcusb; C:\Windows\System32\drivers\bcmnfcusb.sys [50528 2020-10-14] (Broadcom Corporation -> Broadcom Corporation.)
R3 DBUtilDrv2; C:\Windows\System32\drivers\DBUtilDrv2.sys [24952 2021-02-09] (Microsoft Windows Hardware Compatibility Publisher -> )
R3 DDDriver; C:\Windows\System32\drivers\dddriver64Dcsa.sys [42376 2020-10-26] (Microsoft Windows Hardware Compatibility Publisher -> Dell Inc.)
R3 Hamachi; C:\Windows\system32\DRIVERS\Hamdrv.sys [45680 2019-04-02] (Microsoft Windows Hardware Compatibility Publisher -> LogMeIn Inc.)
S3 iaLPSS2_SPI_CNL; C:\Windows\System32\DriverStore\FileRepository\ialpss2_spi_cnl.inf_amd64_f9088e14bef268e6\iaLPSS2_SPI_CNL.sys [156936 2020-08-16] (Intel Corporation -> Intel Corporation)
S3 iaLPSS2_UART2_CNL; C:\Windows\System32\DriverStore\FileRepository\ialpss2_uart2_cnl.inf_amd64_df1115697e57a59a\iaLPSS2_UART2_CNL.sys [305928 2020-08-16] (Intel Corporation -> Intel Corporation)
R2 MBAMChameleon; C:\Windows\System32\Drivers\MbamChameleon.sys [220616 2021-02-16] (Malwarebytes Inc -> Malwarebytes)
S0 MbamElam; C:\Windows\System32\DRIVERS\MbamElam.sys [19912 2021-01-08] (Microsoft Windows Early Launch Anti-malware Publisher -> Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [248992 2021-02-16] (Malwarebytes Inc -> Malwarebytes)
R3 MpKsl95cf61f6; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{E930B111-030B-4808-935E-7882AC7486DC}\MpKslDrv.sys [90360 2021-03-15] (Microsoft Windows -> Microsoft Corporation)
S3 Netaapl; C:\Windows\System32\drivers\netaapl64.sys [32352 2017-11-28] (Microsoft Windows Hardware Compatibility Publisher -> Apple Inc.)
S3 tap0901; C:\Windows\System32\drivers\tap0901.sys [41400 2020-11-16] (McAfee, LLC. -> The OpenVPN Project)
S0 WdBoot; C:\Windows\System32\drivers\wd\WdBoot.sys [49544 2021-03-06] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\wd\WdFilter.sys [420088 2021-03-06] (Microsoft Windows -> Microsoft Corporation)
R3 WdNisDrv; C:\Windows\System32\drivers\wd\WdNisDrv.sys [72952 2021-03-06] (Microsoft Windows -> Microsoft Corporation)
R3 WiMan; C:\Windows\System32\DriverStore\FileRepository\wiman.inf_amd64_4b0336d95f188e47\WiMan\WiMan.sys [162136 2020-07-02] (Intel Wireless Driver -> )
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One month (created) (Whitelisted) =========
(If an entry is included in the fixlist, the file/folder will be moved.)
2021-03-15 18:50 - 2021-03-15 18:51 - 000025982 _____ C:\Users\Jen\Downloads\FRST.txt
2021-03-15 18:50 - 2021-03-15 18:50 - 000000000 ____D C:\FRST
2021-03-15 18:49 - 2021-03-15 18:49 - 002300928 _____ (Farbar) C:\Users\Jen\Downloads\FRST64.exe
2021-03-15 18:34 - 2021-03-15 18:34 - 000086679 _____ C:\Users\Jen\Downloads\All Lessons (3).xlsx
2021-03-15 15:04 - 2021-03-15 15:04 - 000202132 _____ C:\Users\Jen\Downloads\RCM Level 4 piano.pdf
2021-03-15 14:29 - 2021-03-15 14:29 - 007320970 _____ C:\Users\Jen\Downloads\Green_New_Deal_special_report_Feb_2021-lowres.pdf
2021-03-15 11:51 - 2021-03-15 11:51 - 000204473 _____ C:\Users\Jen\Downloads\RCM Mock Piano Level 5.pdf
2021-03-12 23:27 - 2021-03-12 23:27 - 000160222 _____ C:\Users\Jen\Downloads\Over the Rainbow - Eb Major - MN0051775.pdf
2021-03-12 23:27 - 2021-03-12 23:27 - 000160222 _____ C:\Users\Jen\Downloads\Over the Rainbow - Eb Major - MN0051775 (1).pdf
2021-03-08 19:31 - 2021-03-08 19:32 - 000000000 ____D C:\Users\Jen\AppData\Roaming\AnyDesk
2021-03-08 19:19 - 2021-03-08 19:19 - 000367746 _____ C:\Users\Jen\Downloads\ImagineARTS songs 2019-2020 Edits.pdf
2021-03-07 21:12 - 2021-03-07 21:13 - 000072939 _____ C:\Users\Jen\Downloads\image0.jpeg
2021-03-07 10:53 - 2021-03-07 10:53 - 000084995 _____ C:\Users\Jen\Downloads\All Lessons (2).xlsx
2021-03-06 12:23 - 2021-03-06 12:23 - 000013372 _____ C:\Users\Jen\Downloads\voice students.sp21.xlsx
2021-03-06 12:00 - 2021-03-06 12:00 - 000066445 _____ C:\Users\Jen\Downloads\Voice Competition 2021.pdf
2021-03-06 11:58 - 2021-03-06 11:58 - 000317101 _____ C:\Users\Jen\Downloads\Results-Mailer.pdf
2021-03-05 17:04 - 2021-03-05 17:04 - 000345568 _____ C:\Users\Jen\Downloads\FV prep p 7.pdf
2021-03-05 10:07 - 2021-03-05 10:07 - 000022627 _____ C:\Users\Jen\Downloads\ImagineARTS Schedule 2020-21 (1).xlsx
2021-03-02 18:10 - 2021-03-02 18:10 - 000132712 _____ C:\Users\Jen\Downloads\TipsForSuccessfulCompetition.pdf
2021-03-02 16:54 - 2021-03-02 16:54 - 000392422 _____ C:\Users\Jen\Downloads\Application for the Westerbeke Scholarship2021.pages
2021-03-01 21:42 - 2021-03-01 21:42 - 000084995 _____ C:\Users\Jen\Downloads\All Lessons (1).xlsx
2021-03-01 15:58 - 2021-03-01 15:58 - 000083288 _____ (Zoom Video Communications, Inc.) C:\Users\Jen\Downloads\Zoom_cm_f44iro45iMvuxZ9vvrZo4_msKFJ19Rdo0k96uSN0wGj6MiQRjadASuf+bQD@vudz9Or8SGTFhaCP_ka96237c298542a2f_.exe
2021-02-26 14:47 - 2021-02-26 14:47 - 000071634 _____ C:\Users\Jen\Downloads\WinnersProgram2020.pdf
2021-02-26 14:38 - 2021-02-26 14:38 - 000058743 _____ C:\Users\Jen\Downloads\JudgesInstructionsforOnlineProcess.pdf
2021-02-25 19:30 - 2021-02-25 19:30 - 000083288 _____ (Zoom Video Communications, Inc.) C:\Users\Jen\Downloads\Zoom_cm_fo42anktZ9vvrZo4_mTSWlRbrxsXT5MCwnlhh5jKivlxwYrbJI-g@6hgmfNKRzXQZAONO_k3427923208b22554_.exe
2021-02-25 14:24 - 2021-02-25 14:24 - 000000000 ____D C:\Users\Jen\AppData\Local\OneDrive
2021-02-23 21:24 - 2021-02-23 21:25 - 136087787 _____ C:\Users\Jen\Downloads\WIN_20210223_20_08_41_Pro.mp4
2021-02-21 15:56 - 2021-02-21 15:56 - 000083288 _____ (Zoom Video Communications, Inc.) C:\Users\Jen\Downloads\Zoom_cm_fo42anktZ9vvrZo4_mV9LoOFRDP-VDSPi3vGgSpHrYNT8ZuOmkmIlw@vVizh-SHhSvyPYWJ_k5b19df3059c56b5c_.exe
2021-02-20 19:18 - 2021-02-20 19:19 - 000084995 _____ C:\Users\Jen\Downloads\All Lessons.xlsx
2021-02-20 15:34 - 2021-02-20 15:34 - 000000000 ____D C:\Program Files\Microsoft Update Health Tools
2021-02-18 19:46 - 2021-02-18 19:46 - 000083288 _____ (Zoom Video Communications, Inc.) C:\Users\Jen\Downloads\Zoom_cm_fo42anktZ9vvrZo4_mx4+pAITc8a29Keflnr76MfRyy9967hmBrQ@oJbDNnmLsFaG-E4l_kc28fadca9d9979f5_.exe
2021-02-17 21:55 - 2021-02-17 21:56 - 009992531 _____ C:\Users\Jen\Downloads\eirv48n07-20210212 (2).pdf
2021-02-16 22:29 - 2021-02-16 22:29 - 000248992 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys
2021-02-16 22:29 - 2021-02-16 22:29 - 000220616 _____ (Malwarebytes) C:\Windows\system32\Drivers\MbamChameleon.sys
2021-02-16 19:51 - 2021-02-16 19:51 - 000083288 _____ (Zoom Video Communications, Inc.) C:\Users\Jen\Downloads\Zoom_cm_fo42anktZ9vvrZo4_mR72Y61rYFKZG1lTDVHcQJ2MIL7dA-KG7oQ@0W25Veu56fOTKizg_kb1d59834670f793b_.exe
2021-02-15 11:31 - 2021-02-15 11:31 - 009992531 _____ C:\Users\Jen\Downloads\eirv48n07-20210212.pdf
2021-02-15 11:31 - 2021-02-15 11:31 - 009992531 _____ C:\Users\Jen\Downloads\eirv48n07-20210212 (1).pdf
2021-02-14 16:57 - 2021-02-14 16:57 - 000000000 ____D C:\Users\Jen\AppData\Local\D3DSCache
==================== One month (modified) ==================
(If an entry is included in the fixlist, the file/folder will be moved.)
2021-03-15 18:48 - 2021-01-17 18:15 - 000000000 ____D C:\Users\Jen\AppData\Local\LogMeIn Hamachi
2021-03-15 18:48 - 2019-12-07 05:14 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2021-03-15 18:35 - 2021-01-07 20:04 - 000000000 ____D C:\Users\Jen\Desktop\IMAGINEaRTS
2021-03-15 18:35 - 2021-01-07 18:03 - 000000000 ____D C:\Users\Jen\AppData\Local\Packages
2021-03-15 18:01 - 2021-02-02 17:35 - 000002083 _____ C:\ProgramData\Desktop\HP Print and Scan Doctor.lnk
2021-03-15 16:53 - 2020-12-22 05:39 - 000000000 ____D C:\Windows\system32\SleepStudy
2021-03-15 11:59 - 2019-12-07 05:14 - 000000000 ___HD C:\Program Files\WindowsApps
2021-03-15 11:59 - 2019-12-07 05:14 - 000000000 ____D C:\Windows\AppReadiness
2021-03-15 11:56 - 2021-01-07 19:27 - 000000000 ____D C:\Users\Jen\AppData\Local\PlaceholderTileLogoFolder
2021-03-15 11:51 - 2021-01-07 20:05 - 000000000 ____D C:\Users\Jen\Desktop\RCM STUFF
2021-03-15 11:37 - 2021-01-07 19:45 - 000000000 ___RD C:\Users\Jen\iCloudDrive
2021-03-15 11:37 - 2021-01-07 18:04 - 000000000 ___RD C:\Users\Jen\OneDrive
2021-03-15 11:36 - 2021-01-07 18:03 - 000000000 __SHD C:\Users\Jen\IntelGraphicsProfiles
2021-03-14 22:18 - 2020-12-22 05:46 - 000795738 _____ C:\Windows\system32\PerfStringBackup.INI
2021-03-14 22:18 - 2019-12-07 05:13 - 000000000 ____D C:\Windows\INF
2021-03-14 22:14 - 2020-12-22 05:56 - 000002440 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
2021-03-14 22:13 - 2020-12-31 02:21 - 000000000 ____D C:\Program Files (x86)\Dell Digital Delivery Services
2021-03-13 15:07 - 2019-12-07 05:03 - 000000000 ____D C:\Windows\CbsTemp
2021-03-13 12:53 - 2021-01-08 14:27 - 000000000 ____D C:\Program Files (x86)\Microsoft Office
2021-03-13 12:40 - 2021-01-07 18:04 - 000003358 _____ C:\Windows\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-925457469-728721832-1435735986-1001
2021-03-13 12:40 - 2021-01-07 18:01 - 000002359 _____ C:\Users\Jen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2021-03-12 20:08 - 2021-01-08 16:18 - 000000000 ____D C:\Users\Jen\Documents\Zoom
2021-03-12 19:16 - 2019-12-07 05:14 - 000000000 ____D C:\Windows\ServiceState
2021-03-12 18:17 - 2021-01-07 18:03 - 000002350 _____ C:\Users\Jen\Desktop\Microsoft Edge.lnk
2021-03-12 13:56 - 2021-01-16 12:06 - 000002138 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2021-03-10 00:32 - 2021-01-11 21:01 - 000000000 ____D C:\Windows\system32\MRT
2021-03-10 00:30 - 2021-01-11 21:01 - 131005360 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2021-03-08 20:49 - 2020-12-31 02:14 - 000048741 _____ C:\Windows\system32\CVFirmwareUpgradeLog.txt
2021-03-08 20:49 - 2020-12-31 02:14 - 000000000 ____D C:\Intel
2021-03-08 20:49 - 2020-12-22 05:39 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2021-03-08 20:49 - 2020-12-22 05:38 - 000008192 ___SH C:\DumpStack.log.tmp
2021-03-08 20:48 - 2019-12-07 05:14 - 000000000 ____D C:\Windows\appcompat
2021-03-08 20:48 - 2019-12-07 05:03 - 000524288 _____ C:\Windows\system32\config\BBI
2021-03-08 20:44 - 2019-12-07 05:14 - 000000000 ____D C:\Windows\registration
2021-03-08 20:26 - 2021-01-07 18:01 - 000000000 ____D C:\Users\Jen
2021-03-08 08:55 - 2021-01-09 10:53 - 000000000 ____D C:\Users\Jen\AppData\Local\CrashDumps
2021-03-06 21:40 - 2019-12-07 05:14 - 000000000 ____D C:\Windows\LiveKernelReports
2021-03-06 11:59 - 2020-12-22 05:39 - 000000000 ____D C:\Windows\system32\Drivers\wd
2021-03-06 10:05 - 2021-01-07 19:21 - 000002249 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2021-03-06 10:05 - 2021-01-07 19:21 - 000002208 _____ C:\ProgramData\Desktop\Google Chrome.lnk
2021-03-04 18:36 - 2020-12-22 05:56 - 000003480 _____ C:\Windows\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
2021-03-04 18:36 - 2020-12-22 05:56 - 000003356 _____ C:\Windows\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore
2021-02-17 22:04 - 2021-02-04 11:57 - 000000000 ____D C:\Users\Jen\Desktop\Boston Reading Group
==================== SigCheck ============================
(There is no automatic fix for files that do not pass verification.)
==================== End of FRST.txt ========================
Last edited by a moderator:
- Status
Similar threads
