McAfee VirusScan Home Edition V10.0.27 NL 64 Bit
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 11.03.2019Ran by Pieter (administrator) on VECTORY3 (13-03-2019 12:49:16)Running from C:\Users\Pieter\DownloadsLoaded Profiles: Pieter (Available Profiles: Pieter & Christel)Platform: Windows 8.1 (Update) (X64) Language: English (United States)Default browser: FFBoot Mode: NormalTutorial for Farbar Recovery Scan Tool: -frst-tutorial-how-to-use-farbar-recovery-scan-tool/==================== Processes (Whitelisted) =================(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)(NVIDIA Corporation -> NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe(NVIDIA Corporation -> NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\rundll32.exe(Microsoft Windows -> Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe(AVAST Software s.r.o. -> AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe(Fengxia Cao -> ) C:\Program Files (x86)\Explorer\iedvutils.exe(IEC) [File not signed] C:\Program Files (x86)\BikaQRss\BikaQ.exe(Adobe Systems, Incorporated -> Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\alg.exe(Apple Inc. -> Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe(Atheros Commnucations) [File not signed] C:\Windows\System32\AdminService.exe(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe(Microsoft Corporation) [File not signed] C:\Program Files\Microsoft Kinect Drivers\Service\KinectManagementService.exe(Microsoft Corporation -> ) C:\Windows\System32\Kinect\KinectMonitor.exe(McAfee, Inc. -> McAfee, Inc.) C:\Program Files\McAfee\WebAdvisor\servicehost.exe(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe(PACE Anti-Piracy, Inc.) [File not signed] C:\Program Files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe(Microsoft Windows Publisher -> Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe(Dening Hu -> ) C:\Program Files (x86)\WinSaber\WinSaber.exe(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe(AVAST Software s.r.o. -> AVAST Software) C:\Program Files\AVAST Software\Avast\aswidsagent.exe(Microsoft Corporation -> ) C:\Windows\System32\Kinect\KinectService.exe(Microsoft Corporation -> ) C:\Windows\System32\Kinect\KStudioHostService.exe(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe(McAfee, Inc. -> McAfee, Inc.) C:\Program Files\McAfee\WebAdvisor\uihost.exe(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe(Intel Corporation - pGFX -> Intel Corporation) C:\Windows\System32\igfxtray.exe(Intel Corporation - pGFX -> Intel Corporation) C:\Windows\System32\igfxsrvc.exe(Intel Corporation - pGFX -> Intel Corporation) C:\Windows\System32\hkcmd.exe(Intel Corporation - pGFX -> Intel Corporation) C:\Windows\System32\igfxpers.exe() [File not signed] C:\Users\Pieter\AppData\Roaming\gplyra\gplyra.exe(AVAST Software s.r.o. -> AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe(Spotify AB -> Spotify Ltd) C:\Users\Pieter\AppData\Roaming\Spotify\Spotify.exe(Spotify AB -> Spotify Ltd) C:\Users\Pieter\AppData\Roaming\Spotify\Spotify.exe(Dassault Systemes SolidWorks Corp. -> Dassault Systèmes SolidWorks Corp.) C:\Program Files\SolidWorks Corp\SolidWorks\sldworks_fs.exe(Spotify AB -> Spotify Ltd) C:\Users\Pieter\AppData\Roaming\Spotify\Spotify.exe(Spotify AB -> Spotify Ltd) C:\Users\Pieter\AppData\Roaming\Spotify\Spotify.exe(hxxp://www.amule.org/) [File not signed] C:\Program Files (x86)\amuleC\ed2k.exe(Adobe Systems Incorporated -> Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe(Microsoft Windows -> Microsoft Corporation) C:\Windows\FileManager\PhotosApp.exe(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe(McAfee, Inc. -> McAfee, Inc.) C:\Program Files\McAfee\WebAdvisor\browserhost.exe(Luis Cobian, CobianSoft) [File not signed] C:\Program Files (x86)\Cobian Backup 11\Cobian.exe(Luis Cobian, CobianSoft) [File not signed] C:\Program Files (x86)\Cobian Backup 11\cbInterface.exe() [File not signed] C:\Users\Pieter\Desktop\RuneLite\RuneLite.exe==================== Registry (Whitelisted) ===========================(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2460488 2014-09-17] (NVIDIA Corporation -> NVIDIA Corporation)HKLM\...\Run: [ShadowPlay] => C:\WINDOWS\system32\nvspcap64.dll [2799784 2014-09-17] (NVIDIA Corporation PE Sign v2014 -> NVIDIA Corporation) [File not signed]HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated -> Adobe Systems Incorporated)HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation -> Microsoft Corporation)HKLM\...\Run: [gplyra] => C:\Users\Pieter\AppData\Roaming\gplyra\gplyra.exe [1556992 2016-08-08] () [File not signed] C:\Program Files\AVAST Software\Avast\AvLaunch.exe [259976 2019-02-19] (AVAST Software s.r.o. -> AVAST Software)HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated -> Adobe Systems Incorporated)HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Test Signing Certificate -> Adobe Systems Incorporated) [File not signed]HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exeHKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [259976 2019-02-19] (AVAST Software s.r.o. -> AVAST Software)HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction "E:\Steam\steam.exe" -silentHKU\S-1-5-21-3933355007-4045915060-2087936826-1001\...\Run: [Spotify] => C:\Users\Pieter\AppData\Roaming\Spotify\Spotify.exe [25610984 2019-03-12] (Spotify AB -> Spotify Ltd)HKU\S-1-5-21-3933355007-4045915060-2087936826-1001\...\MountPoints2: caa57964-9d69-11e4-bec5-0c54a52ae1a5 - "F:\AutoRun.exe"HKU\S-1-5-21-3933355007-4045915060-2087936826-1001\...\MountPoints2: caa579bf-9d69-11e4-bec5-0c54a52ae1a5 - "E:\AutoRun.exe"HKU\S-1-5-21-3933355007-4045915060-2087936826-1001\...\MountPoints2: caa57d47-9d69-11e4-bec5-0c54a52ae1a5 - "F:\AutoRun.exe"HKU\S-1-5-21-3933355007-4045915060-2087936826-1001\...\MountPoints2: caa57d62-9d69-11e4-bec5-0c54a52ae1a5 - "F:\AutoRun.exe"HKU\S-1-5-21-3933355007-4045915060-2087936826-1001\...\MountPoints2: caa57d9d-9d69-11e4-bec5-0c54a52ae1a5 - "E:\AutoRun.exe"HKU\S-1-5-18\...\Run: [PCSpeedUp] => C:\Program Files (x86)\PC Speed Up\PCSUNotifier.exe NVIDIA Corporation)AppInit_DLLs-x32: C:\WINDOWS\SysWOW64\nvinit.dll => C:\WINDOWS\SysWOW64\nvinit.dll [141336 2013-09-05] (NVIDIA CORPORATION -> NVIDIA Corporation)IFEO\GoogleUpdate.exe: [Debugger] 324095823984.exeIFEO\GoogleUpdaterService.exe: [Debugger] 8736459873644.exeIFEO\MRT.exe: [Debugger] C:\WINDOWS\TEMP\ouaE877.tmp\secondu71\Gubed.exe -Yrrehs==================== Internet (Whitelisted) ====================(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txtTcpip\Parameters: [DhcpNameServer] 192.168.1.254 9.9.9.9 213.75.63.75Tcpip\..\Interfaces\70878B66-5EC0-47F7-AEA7-740511912FD3: [DhcpNameServer] 192.168.1.254 9.9.9.9 213.75.63.75Internet Explorer:==================HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.amisites.com/?type=hp&ts=1480414862&z=bb4b1ed727c39dc692c65beg7z4b4e7z9gcz8b4q0c&from=archer1028&uid=KINGSTONXSV300S37A120G_50026B724203C009HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.amisites.com/?type=hp&ts=1480414862&z=bb4b1ed727c39dc692c65beg7z4b4e7z9gcz8b4q0c&from=archer1028&uid=KINGSTONXSV300S37A120G_50026B724203C009HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.mylucky123.com/search/?type=ds&ts=1476707592&z=13382ae4f07348e5d6c7b1egcz7m8qam1ecmdw0t9z&from=che0812&uid=KINGSTONXSV300S37A120G_50026B724203C009&q=searchTermsHKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.mylucky123.com/search/?type=ds&ts=1476707592&z=13382ae4f07348e5d6c7b1egcz7m8qam1ecmdw0t9z&from=che0812&uid=KINGSTONXSV300S37A120G_50026B724203C009&q=searchTermsHKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.amisites.com/?type=hp&ts=1480414862&z=bb4b1ed727c39dc692c65beg7z4b4e7z9gcz8b4q0c&from=archer1028&uid=KINGSTONXSV300S37A120G_50026B724203C009HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.amisites.com/?type=hp&ts=1480414862&z=bb4b1ed727c39dc692c65beg7z4b4e7z9gcz8b4q0c&from=archer1028&uid=KINGSTONXSV300S37A120G_50026B724203C009HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.mylucky123.com/search/?type=ds&ts=1476707592&z=13382ae4f07348e5d6c7b1egcz7m8qam1ecmdw0t9z&from=che0812&uid=KINGSTONXSV300S37A120G_50026B724203C009&q=searchTermsHKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.mylucky123.com/search/?type=ds&ts=1476707592&z=13382ae4f07348e5d6c7b1egcz7m8qam1ecmdw0t9z&from=che0812&uid=KINGSTONXSV300S37A120G_50026B724203C009&q=searchTermsHKU\S-1-5-21-3933355007-4045915060-2087936826-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.amisites.com/search/?type=ds&ts=1478837792&z=34142f22d02baec16ceb216g5z7mebbb6c9mcmdtez&from=che0812&uid=KINGSTONXSV300S37A120G_50026B724203C009&q=searchTermsHKU\S-1-5-21-3933355007-4045915060-2087936826-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.amisites.com/?type=hp&ts=1480414862&z=bb4b1ed727c39dc692c65beg7z4b4e7z9gcz8b4q0c&from=archer1028&uid=KINGSTONXSV300S37A120G_50026B724203C009HKU\S-1-5-21-3933355007-4045915060-2087936826-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.amisites.com/?type=hp&ts=1480414862&z=bb4b1ed727c39dc692c65beg7z4b4e7z9gcz8b4q0c&from=archer1028&uid=KINGSTONXSV300S37A120G_50026B724203C009HKU\S-1-5-21-3933355007-4045915060-2087936826-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.amisites.com/search/?type=ds&ts=1478837792&z=34142f22d02baec16ceb216g5z7mebbb6c9mcmdtez&from=che0812&uid=KINGSTONXSV300S37A120G_50026B724203C009&q=searchTermsSearchScopes: HKLM -> DefaultScope 33BB0A4E-99AF-4226-BDF6-49120163DE86 URL =SearchScopes: HKLM -> 33BB0A4E-99AF-4226-BDF6-49120163DE86 URL =SearchScopes: HKLM-x32 -> DefaultScope 33BB0A4E-99AF-4226-BDF6-49120163DE86 URL =SearchScopes: HKLM-x32 -> 33BB0A4E-99AF-4226-BDF6-49120163DE86 URL =SearchScopes: HKU\S-1-5-21-3933355007-4045915060-2087936826-1001 -> 33BB0A4E-99AF-4226-BDF6-49120163DE86 URL = hxxp://www.amisites.com/search/?type=ds&ts=1478837792&z=34142f22d02baec16ceb216g5z7mebbb6c9mcmdtez&from=che0812&uid=KINGSTONXSV300S37A120G_50026B724203C009&q=searchTermsBHO: Groove GFS Browser Helper -> 72853161-30C5-4D22-B7F9-0BBC1D38A37E -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-18] (Microsoft Corporation -> Microsoft Corporation)BHO: McAfee WebAdvisor -> B164E929-A1B6-4A06-B104-2CD0E90A88FF -> C:\Program Files\McAfee\WebAdvisor\x64\IEPlugin.dll [2019-02-19] (McAfee, Inc. -> McAfee, Inc.)BHO: Office Document Cache Handler -> B4F3A835-0E21-4959-BA22-42B3008E02FF -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation -> Microsoft Corporation)BHO-x32: Groove GFS Browser Helper -> 72853161-30C5-4D22-B7F9-0BBC1D38A37E -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-18] (Microsoft Corporation -> Microsoft Corporation)BHO-x32: McAfee WebAdvisor -> B164E929-A1B6-4A06-B104-2CD0E90A88FF -> C:\Program Files\McAfee\WebAdvisor\win32\IEPlugin.dll [2019-02-19] (McAfee, Inc. -> McAfee, Inc.)BHO-x32: Office Document Cache Handler -> B4F3A835-0E21-4959-BA22-42B3008E02FF -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation -> Microsoft Corporation)Handler: sacore - 5513F07E-936B-4E52-9B00-067394E91CC5 - c:\PROGRA2\mcafee\SITEAD1\mcieplg.dll No FileFireFox:========FF ProfilePath: C:\Users\Pieter\AppData\Roaming\Mozilla\Firefox\naweriweentcofise\Profiles\uma90i43.default\Profiles\uma90i43.default [not found] about:newtabFF Extension: (Adblock Plus Pop-up Addon) - C:\Users\Pieter\AppData\Roaming\Mozilla\Firefox\Profiles\uma90i43.default\Extensions\adblockpopups@jessehakanen.net.xpi [2016-05-03] [Legacy]FF Extension: (Firefox Hotfix) - C:\Users\Pieter\AppData\Roaming\Mozilla\Firefox\Profiles\uma90i43.default\Extensions\firefox-hotfix@mozilla.org.xpi [2016-09-04] [Legacy]FF Extension: (Avast SafePrice Comparison, deals, coupons) - C:\Users\Pieter\AppData\Roaming\Mozilla\Firefox\Profiles\uma90i43.default\Extensions\sp@avast.com.xpi [2019-03-13] [UpdateUrl:hxxps://firefoxext.avcdn.net/firefoxext/avast/sp/update.json]FF Extension: (Avast Online Security) - C:\Users\Pieter\AppData\Roaming\Mozilla\Firefox\Profiles\uma90i43.default\Extensions\wrc@avast.com.xpi [2019-03-13] [UpdateUrl:hxxps://firefoxext.avcdn.net/firefoxext/avast/aos/update.json]FF Extension: (Adblock Plus - free ad blocker) - C:\Users\Pieter\AppData\Roaming\Mozilla\Firefox\Profiles\uma90i43.default\Extensions\d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d.xpi [2019-03-13]FF SearchPlugin: C:\Users\Pieter\AppData\Roaming\Mozilla\Firefox\Profiles\uma90i43.default\searchplugins\amisites.xml [2016-11-29]FF SearchPlugin: C:\Users\Pieter\AppData\Roaming\Mozilla\Firefox\Profiles\uma90i43.default\searchplugins\google-avast.xml [2018-04-29]FF SearchPlugin: C:\Users\Pieter\AppData\Roaming\Mozilla\Firefox\Profiles\uma90i43.default\searchplugins\luck.xml [2017-05-11]FF SearchPlugin: C:\Users\Pieter\AppData\Roaming\Mozilla\Firefox\Profiles\uma90i43.default\searchplugins\mylucky123.xml [2016-10-17]FF SearchPlugin: C:\Users\Pieter\AppData\Roaming\Mozilla\Firefox\Profiles\uma90i43.default\searchplugins\nice.xml [2016-10-24]FF SearchPlugin: C:\Users\Pieter\AppData\Roaming\Mozilla\Firefox\Profiles\uma90i43.default\searchplugins\ourluckysites.xml [2017-05-12]FF SearchPlugin: C:\Users\Pieter\AppData\Roaming\Mozilla\Firefox\Profiles\uma90i43.default\searchplugins\startpageing123.xml [2017-03-29]FF ProfilePath: C:\Users\Pieter\AppData\Roaming\Firefox\Firefox\Profiles\wcqds2gb.default-1477000910605 [2017-06-24] about:homeFF Extension: (SimilarWeb) - C:\Users\Pieter\AppData\Roaming\Firefox\Firefox\Profiles\wcqds2gb.default-1477000910605\Extensions\@DA3566E2-F709-11E5-8E87-A604BC8E7F8B.xpi [2016-10-24] [Legacy] [not signed]FF Extension: (FF Adr) - C:\Users\Pieter\AppData\Roaming\Firefox\Firefox\Profiles\wcqds2gb.default-1477000910605\Extensions\@H99KV4DO-UCCF-9PFO-9ZLK-8RRP4FVOKD9O.xpi [2016-10-20] [not signed]FF SearchPlugin: C:\Users\Pieter\AppData\Roaming\Firefox\Firefox\Profiles\wcqds2gb.default-1477000910605\searchplugins\startsearch.xml [2017-04-07]FF HKLM\...\Firefox\Extensions: [4ED1F68A-5463-4931-9384-8FFF5ED91D92] - C:\Program Files\McAfee\WebAdvisor\e10ssaffplg.xpiFF Extension: (McAfee WebAdvisor) - C:\Program Files\McAfee\WebAdvisor\e10ssaffplg.xpi [2019-03-11]FF HKLM-x32\...\Firefox\Extensions: [arthurj8283@gmail.com] - C:\Users\Pieter\AppData\Roaming\Mozilla\Firefox\Profiles\uma90i43.default\extensions\arthurj8283@gmail.com => not foundFF HKLM-x32\...\Firefox\Extensions: [4ED1F68A-5463-4931-9384-8FFF5ED91D92] - C:\Program Files\McAfee\WebAdvisor\e10ssaffplg.xpiFF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_32_0_0_156.dll [2019-03-12] (Adobe Systems Incorporated -> )FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA1\MICROS4\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation -> Microsoft Corporation)FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_32_0_0_156.dll [2019-03-12] (Adobe Systems Incorporated -> )FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] (Microsoft Corporation -> Microsoft Corporation)FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA2\MICROS1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation -> Microsoft Corporation)FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA2\MICROS1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation -> Microsoft Corporation)FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2019-02-18] (Adobe Systems, Incorporated -> Adobe Systems Inc.)Chrome:=======CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - hxxp://clients2.google.com/service/update2/crxCHR HKU\S-1-5-21-3933355007-4045915060-2087936826-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crxCHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - hxxp://clients2.google.com/service/update2/crxCHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crxHKU\S-1-5-21-3933355007-4045915060-2087936826-1001\...\StartMenuInternet\ChromeHTML: -> C:\Program Files (x86)\Cupduck\Application\chrome.exe (Google Inc -> Google Inc.) AVAST Software)R1 aswHdsKe; C:\WINDOWS\System32\drivers\aswHdsKe.sys [249672 2019-02-19] (AVAST Software s.r.o. -> AVAST Software)R1 aswKbd; C:\WINDOWS\System32\drivers\aswKbd.sys [42288 2019-02-19] (AVAST Software s.r.o. -> AVAST Software)R2 aswMonFlt; C:\WINDOWS\System32\drivers\aswMonFlt.sys [167304 2019-02-19] (AVAST Software s.r.o. -> AVAST Software)R1 aswRdr; C:\WINDOWS\System32\drivers\aswRdr2.sys [112312 2019-02-19] (AVAST Software s.r.o. -> AVAST Software)R0 aswRvrt; C:\WINDOWS\System32\drivers\aswRvrt.sys [87944 2019-02-19] (AVAST Software s.r.o. -> AVAST Software)R1 aswSnx; C:\WINDOWS\System32\drivers\aswSnx.sys [1034432 2019-02-19] (AVAST Software s.r.o. -> AVAST Software)R1 aswSP; C:\WINDOWS\System32\drivers\aswSP.sys [474456 2019-02-19] (AVAST Software s.r.o. -> AVAST Software)R2 aswStm; C:\WINDOWS\System32\drivers\aswStm.sys [216784 2019-02-19] (AVAST Software s.r.o.