Yahoo keeps changing my search engine (Hijacked) (in Edge and Google)

Upload the logs to OneDrive or https://gofile.io/home then post the link.

Share OneDrive files and folders - Microsoft Support

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 19-12-2024 Ran by Willem (29-12-2024 18:50:11) Running from C:\Users\Willem\Downloads Microsoft Windows 11 Pro Version 24H2 26100.2605 (X64) (2024-12-13 18:35:48) Boot Mode: Normal ========================================================== ==================== Accounts: ============================= (If an entry is included in the fixlist, it will be removed.) Administrator (S-1-5-21-1385959988-334678158-2433523315-500 - Administrator - Disabled) DefaultAccount (S-1-5-21-1385959988-334678158-2433523315-503 - Limited - Disabled) Guest (S-1-5-21-1385959988-334678158-2433523315-501 - Limited - Disabled) k6nd (S-1-5-21-1385959988-334678158-2433523315-1004 - Limited - Disabled) k6ndv (S-1-5-21-1385959988-334678158-2433523315-1003 - Limited - Disabled) WDAGUtilityAccount (S-1-5-21-1385959988-334678158-2433523315-504 - Limited - Disabled) Willem (S-1-5-21-1385959988-334678158-2433523315-1002 - Administrator - Enabled) => C:\Users\Willem ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) AnyDesk (HKLM-x32...\AnyDesk) (Version: ad 8.1.0 - AnyDesk Software GmbH) Aplicaciones de Microsoft 365 para empresas - es-es (HKLM...\O365ProPlusRetail - es-es) (Version: 16.0.18227.20162 - Microsoft Corporation) Aplikacje Microsoft 365 dla przedsiębiorstw - pl-pl (HKLM...\O365ProPlusRetail - pl-pl) (Version: 16.0.18227.20162 - Microsoft Corporation) Aplikasi Microsoft 365 untuk perusahaan - id-id (HKLM...\O365ProPlusRetail - id-id) (Version: 16.0.18227.20162 - Microsoft Corporation) Dynamic Application Loader Host Interface Service (HKLM...{F06DA793-7F02-4C34-BF4E-1D28E9F96469}) (Version: 1.0.0.0 - Intel Corporation) Hidden Google Chrome (HKLM-x32...\Google Chrome) (Version: 131.0.6778.205 - Google LLC) Intel(R) Chipset Device Software (HKLM...{2EE411D3-03C6-4647-81F5-A3C13F25FDC5}) (Version: 10.1.18838.8284 - Intel Corporation) Hidden Intel(R) Chipset Device Software (HKLM-x32...{2d8d3782-0c02-4681-87f4-e004b3d4a8f6}) (Version: 10.1.18838.8284 - Intel(R) Corporation) Intel(R) HID Event Filter (HKLM-x32...\3FB06EEC-013D-4366-9918-71B97DFB84EB) (Version: 2.2.1.386 - Intel Corporation) Intel(R) Icls (HKLM...{AABE86DB-3230-4397-8C15-9EC1A0B03328}) (Version: 1.0.0.0 - Intel Corporation) Hidden Intel(R) LMS (HKLM...{4ECF4DC1-A866-4CA7-820B-BBEFDF4B1BEA}) (Version: 1.0.0.0 - Intel Corporation) Hidden Intel(R) Management Engine Components (HKLM...{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 2132.15.0.2411 - Intel Corporation) Intel(R) Management Engine Components (HKLM...{680BF900-AAFF-461B-B902-F9695B015A03}) (Version: 1.0.0.0 - Intel Corporation) Hidden Intel(R) Management Engine Driver (HKLM...{22B8B3F7-4ED6-44E0-A6C8-5FEB592E8113}) (Version: 1.0.0.0 - Intel Corporation) Hidden Intel(R) Serial IO (HKLM...{9FD91C5C-44AE-4D9D-85BE-AE52816B0294}) (Version: 30.100.2133.4 - Intel Corporation) Intel(R) Serial IO (HKLM...{E7758DD4-F856-465B-A8FB-01D6360E331C}) (Version: 30.100.2133.4 - Intel Corporation) Hidden Malwarebytes version 5.2.3.156 (HKLM...{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 5.2.3.156 - Malwarebytes) Microsoft 365 - en-us (HKLM...\O365HomePremRetail - en-us) (Version: 16.0.18227.20162 - Microsoft Corporation) Microsoft 365 Apps for Enterprise - de-de (HKLM...\O365ProPlusRetail - de-de) (Version: 16.0.18227.20162 - Microsoft Corporation) Microsoft 365 Apps for enterprise - en-gb (HKLM...\O365ProPlusRetail - en-gb) (Version: 16.0.18227.20162 - Microsoft Corporation) Microsoft 365 Apps for enterprise - en-us (HKLM...\O365ProPlusRetail - en-us) (Version: 16.0.18227.20162 - Microsoft Corporation) Microsoft 365 Apps for enterprise - fr-fr (HKLM...\O365ProPlusRetail - fr-fr) (Version: 16.0.18227.20162 - Microsoft Corporation) Microsoft 365 Apps for enterprise - it-it (HKLM...\O365ProPlusRetail - it-it) (Version: 16.0.18227.20162 - Microsoft Corporation) Microsoft 365 Apps for enterprise - ja-jp (HKLM...\O365ProPlusRetail - ja-jp) (Version: 16.0.18227.20162 - Microsoft Corporation) Microsoft 365 Apps for enterprise - th-th (HKLM...\O365ProPlusRetail - th-th) (Version: 16.0.18227.20162 - Microsoft Corporation) Microsoft 365 Apps para Grandes Empresas - pt-pt (HKLM...\O365ProPlusRetail - pt-pt) (Version: 16.0.18227.20162 - Microsoft Corporation) Microsoft 365-apps voor ondernemingen - nl-nl (HKLM...\O365ProPlusRetail - nl-nl) (Version: 16.0.18227.20162 - Microsoft Corporation) Microsoft Edge (HKLM-x32...\Microsoft Edge) (Version: 131.0.2903.112 - Microsoft Corporation) Microsoft Edge WebView2 Runtime (HKLM-x32...\Microsoft EdgeWebView) (Version: 131.0.2903.112 - Microsoft Corporation) Hidden Microsoft OneDrive (HKLM...\OneDriveSetup.exe) (Version: 24.226.1110.0004 - Microsoft Corporation) Microsoft Teams (HKU\S-1-5-21-1385959988-334678158-2433523315-1002...\Teams) (Version: 1.7.00.27757 - Microsoft Corporation) Microsoft Teams Meeting Add-in for Microsoft Office (HKLM...{A7AB73A3-CB10-4AA5-9D38-6AEFFBDE4C91}) (Version: 1.24.28402 - Microsoft) Microsoft Update Health Tools (HKLM...{C6FD611E-7EFE-488C-A0E0-974C09EF6473}) (Version: 5.72.0.0 - Microsoft Corporation) Office 16 Click-to-Run Extensibility Component (HKLM...{90160000-008C-0000-1000-0000000FF1CE}) (Version: 16.0.18227.20082 - Microsoft Corporation) Hidden Office 16 Click-to-Run Licensing Component (HKLM...{90160000-007E-0000-1000-0000000FF1CE}) (Version: 16.0.18227.20162 - Microsoft Corporation) Hidden Office 16 Click-to-Run Localization Component (HKLM...{90160000-008C-0407-1000-0000000FF1CE}) (Version: 16.0.18227.20082 - Microsoft Corporation) Hidden Office 16 Click-to-Run Localization Component (HKLM...{90160000-008C-040C-1000-0000000FF1CE}) (Version: 16.0.18227.20082 - Microsoft Corporation) Hidden Office 16 Click-to-Run Localization Component (HKLM...{90160000-008C-0410-1000-0000000FF1CE}) (Version: 16.0.18227.20082 - Microsoft Corporation) Hidden Office 16 Click-to-Run Localization Component (HKLM...{90160000-008C-0411-1000-0000000FF1CE}) (Version: 16.0.18227.20138 - Microsoft Corporation) Hidden Office 16 Click-to-Run Localization Component (HKLM...{90160000-008C-0413-1000-0000000FF1CE}) (Version: 16.0.18227.20082 - Microsoft Corporation) Hidden Office 16 Click-to-Run Localization Component (HKLM...{90160000-008C-0415-1000-0000000FF1CE}) (Version: 16.0.18227.20082 - Microsoft Corporation) Hidden Office 16 Click-to-Run Localization Component (HKLM...{90160000-008C-0419-1000-0000000FF1CE}) (Version: 16.0.18227.20082 - Microsoft Corporation) Hidden Office 16 Click-to-Run Localization Component (HKLM...{90160000-008C-0C0A-1000-0000000FF1CE}) (Version: 16.0.18227.20082 - Microsoft Corporation) Hidden PC App Store (HKU\S-1-5-21-1385959988-334678158-2433523315-1002...\PCAppStore) (Version: fa.2001g - Fast Corporation LTD) Realtek Audio Driver (HKLM-x32...{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.9346.1 - Realtek Semiconductor Corp.) REALTEK Bluetooth Filter Driver (HKLM-x32...{9D3D8C60-A5EF-4123-B2B9-172095903AD}) (Version: 1.8.1037.210709 - REALTEK Semiconductor Corp.) Realtek Card Reader (HKLM-x32...{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 10.0.18362.31250 - Realtek Semiconductor Corp.) Realtek PCI-E Wireless LAN Driver (HKLM-x32...\InstallShield_{70714FB7-4084-4202-A599-2D5935DECB67}) (Version: Drv_3.00.0035 - REALTEK Semiconductor Corp.) SD Cardreader Manager (HKLM...\RmCardreader) (Version: 1.02.20210604 - Generic, Inc.) Teams Machine-Wide Installer (HKLM-x32...{731F6BAA-A986-45A4-8936-7C3AAAAA760B}) (Version: 1.5.0.4689 - Microsoft Corporation) VLC media player (HKLM...\VLC media player) (Version: 3.0.20 - VideoLAN) WPS Office (12.2.0.18911) (HKLM-x32...\Kingsoft Office) (Version: 12.2.0.18911 - Kingsoft Corp.) WPS Office (12.2.0.19307) (HKU\S-1-5-21-1385959988-334678158-2433523315-1002...\Kingsoft Office) (Version: 12.2.0.19307 - Kingsoft Corp.) Приложения Microsoft 365 для предприятий - ru-ru (HKLM...\O365ProPlusRetail - ru-ru) (Version: 16.0.18227.20162 - Microsoft Corporation) Packages: ========= Amazon Landscapes PREMIUM -> C:\Program Files\WindowsApps\Microsoft.AmazonLandscapesPREMIUM_1.0.0.0_neutral__8wekyb3d8bbwe [2024-12-19] (Microsoft Corporation) AppUp.IntelGraphicsExperience -> C:\Program Files\WindowsApps\AppUp.IntelGraphicsExperience_1.100.5688.0_x64__8j3eq9eme6ctt [2024-11-10] (INTEL CORP) [Startup Task] iTunes -> C:\Program Files\WindowsApps\AppleInc.iTunes_12134.4.3008.0_x64__nzyj5cx40ttqa [2024-10-27] (Apple Inc.) [Startup Task] Microsoft Defender -> C:\Program Files\WindowsApps\Microsoft.6365217CE6EB4_102.2410.16002.0_x64__8wekyb3d8bbwe [2024-11-12] (Microsoft Corporation) [Startup Task] Microsoft Whiteboard -> C:\Program Files\WindowsApps\Microsoft.Whiteboard_54.20907.567.0_x64__8wekyb3d8bbwe [2024-10-17] (Microsoft Corporation) Microsoft.D3DMappingLayers -> C:\Program Files\WindowsApps\Microsoft.D3DMappingLayers_1.2409.2.0_x64__8wekyb3d8bbwe [2024-10-16] (Microsoft Corporation) Minecraft Education -> C:\Program Files\WindowsApps\Microsoft.MinecraftEducationEdition_1.21.600.0_x64__8wekyb3d8bbwe [2024-10-25] (Microsoft Studios) Realtek Audio Control -> C:\Program Files\WindowsApps\RealtekSemiconductorCorp.RealtekAudioControl_1.40.287.0_x64__dt26b99r8h8gj [2024-10-16] (Realtek Semiconductor Corp) Speedtest by Ookla -> C:\Program Files\WindowsApps\Ookla.SpeedtestbyOokla_1.18.194.0_x64__43tkc6nmykmb6 [2024-10-16] (Ookla) WinAppRuntime.Main.1.5 -> C:\Program Files\WindowsApps\MicrosoftCorporationII.WinAppRuntime.Main.1.5_5001.311.2039.0_x64__8wekyb3d8bbwe [2024-11-29] (Microsoft Corp.) WinAppRuntime.Singleton -> C:\Program Files\WindowsApps\MicrosoftCorporationII.WinAppRuntime.Singleton_6000.318.2304.0_x64__8wekyb3d8bbwe [2024-12-05] (Microsoft Corp.) Windows App Runtime DDLM 5001.311.2039.0-x6 -> C:\Program Files\WindowsApps\Microsoft.WinAppRuntime.DDLM.5001.311.2039.0-x6_5001.311.2039.0_x64__8wekyb3d8bbwe [2024-11-29] (Microsoft Corporation) Windows App Runtime DDLM 5001.311.2039.0-x8 -> C:\Program Files\WindowsApps\Microsoft.WinAppRuntime.DDLM.5001.311.2039.0-x8_5001.311.2039.0_x86__8wekyb3d8bbwe [2024-11-29] (Microsoft Corporation) wpsappext1 -> C:\Program Files (x86)\Kingsoft\WPS Office\12.2.0.19307\office6 [2024-12-08] (Kingsoft) wpsappext2 -> C:\Program Files (x86)\Kingsoft\WPS Office\12.2.0.19307\office6 [2024-12-08] (Kingsoft) wpsappext3 -> C:\Program Files (x86)\Kingsoft\WPS Office\12.2.0.19307\office6 [2024-12-08] (Kingsoft) ==================== Custom CLSID (Whitelisted): ============== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) CustomCLSID: HKU\S-1-5-21-1385959988-334678158-2433523315-1002_Classes\CLSID{19A6E644-14E6-4A60-B8D7-DD20610A871D}\InprocServer32 -> C:\Users\Willem\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.24.28402\x64\Microsoft.Teams.AddinLoader.dll (Microsoft Corporation -> Microsoft Corporation) CustomCLSID: HKU\S-1-5-21-1385959988-334678158-2433523315-1002_Classes\CLSID{28A80003-18FD-411D-B0A3-3C81F618E22B}\InprocServer32 -> C:\Program Files (x86)\Kingsoft\WPS Office\12.2.0.19307\office6\kwpsmenushellext64.dll (Zhuhai Kingsoft Office Software Co., Ltd. -> Zhuhai Kingsoft Office Software Co.,Ltd) CustomCLSID: HKU\S-1-5-21-1385959988-334678158-2433523315-1002_Classes\CLSID{7C360CF9-D475-44FC-8163-AD6C95CF5F5D}\InprocServer32 -> C:\Program Files (x86)\Kingsoft\WPS Office\12.2.0.19307\office6\kmso2pdfplugins64.dll (Zhuhai Kingsoft Office Software Co., Ltd. -> Zhuhai Kingsoft Office Software Co.,Ltd) ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Program Files\Microsoft OneDrive\24.226.1110.0004\FileSyncShell64.dll [2024-12-14] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Program Files\Microsoft OneDrive\24.226.1110.0004\FileSyncShell64.dll [2024-12-14] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Program Files\Microsoft OneDrive\24.226.1110.0004\FileSyncShell64.dll [2024-12-14] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Program Files\Microsoft OneDrive\24.226.1110.0004\FileSyncShell64.dll [2024-12-14] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Program Files\Microsoft OneDrive\24.226.1110.0004\FileSyncShell64.dll [2024-12-14] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => C:\Program Files\Microsoft OneDrive\24.226.1110.0004\FileSyncShell64.dll [2024-12-14] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => C:\Program Files\Microsoft OneDrive\24.226.1110.0004\FileSyncShell64.dll [2024-12-14] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Program Files\Microsoft OneDrive\24.226.1110.0004\FileSyncShell64.dll [2024-12-14] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Program Files\Microsoft OneDrive\24.226.1110.0004\FileSyncShell64.dll [2024-12-14] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Program Files\Microsoft OneDrive\24.226.1110.0004\FileSyncShell64.dll [2024-12-14] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Program Files\Microsoft OneDrive\24.226.1110.0004\FileSyncShell64.dll [2024-12-14] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Program Files\Microsoft OneDrive\24.226.1110.0004\FileSyncShell64.dll [2024-12-14] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => C:\Program Files\Microsoft OneDrive\24.226.1110.0004\FileSyncShell64.dll [2024-12-14] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => C:\Program Files\Microsoft OneDrive\24.226.1110.0004\FileSyncShell64.dll [2024-12-14] (Microsoft Corporation -> Microsoft Corporation) ContextMenuHandlers1: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Program Files\Microsoft OneDrive\24.226.1110.0004\FileSyncShell64.dll [2024-12-14] (Microsoft Corporation -> Microsoft Corporation) ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2024-12-15] (Malwarebytes Inc. -> Malwarebytes) ContextMenuHandlers4: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Program Files\Microsoft OneDrive\24.226.1110.0004\FileSyncShell64.dll [2024-12-14] (Microsoft Corporation -> Microsoft Corporation) ContextMenuHandlers5: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Program Files\Microsoft OneDrive\24.226.1110.0004\FileSyncShell64.dll [2024-12-14] (Microsoft Corporation -> Microsoft Corporation) ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2024-12-15] (Malwarebytes Inc. -> Malwarebytes) ContextMenuHandlers1_S-1-5-21-1385959988-334678158-2433523315-1002: [ kwpsshellext] -> {28A80003-18FD-411D-B0A3-3C81F618E22B} => C:\Program Files (x86)\Kingsoft\WPS Office\12.2.0.19307\office6\kwpsmenushellext64.dll [2024-12-08] (Zhuhai Kingsoft Office Software Co., Ltd. -> Zhuhai Kingsoft Office Software Co.,Ltd) ContextMenuHandlers4_S-1-5-21-1385959988-334678158-2433523315-1002: [ kwpsshellext] -> {28A80003-18FD-411D-B0A3-3C81F618E22B} => C:\Program Files (x86)\Kingsoft\WPS Office\12.2.0.19307\office6\kwpsmenushellext64.dll [2024-12-08] (Zhuhai Kingsoft Office Software Co., Ltd. -> Zhuhai Kingsoft Office Software Co.,Ltd) ==================== Codecs (Whitelisted) ==================== ==================== Shortcuts & WMI ======================== ==================== Loaded Modules (Whitelisted) ============= ==================== Alternate Data Streams (Whitelisted) ======== (If an entry is included in the fixlist, only the ADS will be removed.) AlternateDataStreams: C:\Users\Willem\Downloads\ChromeSetup.exe:MBAM.Zone.Identifier [384] AlternateDataStreams: C:\Users\Willem\Downloads\iTunes Installer.exe:MBAM.Zone.Identifier [63] ==================== Safe Mode (Whitelisted) ================== ==================== Association (Whitelisted) ================= ==================== Internet Explorer (Whitelisted) ============= BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\root\Office16\OCHelper.dll [2024-12-17] (Microsoft Corporation -> Microsoft Corporation) BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll [2024-12-17] (Microsoft Corporation -> Microsoft Corporation) BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\GROOVEEX.DLL [2024-12-17] (Microsoft Corporation -> Microsoft Corporation) Handler: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2024-12-17] (Microsoft Corporation -> Microsoft Corporation) Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2024-12-17] (Microsoft Corporation -> Microsoft Corporation) Handler: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2024-12-17] (Microsoft Corporation -> Microsoft Corporation) Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2024-12-17] (Microsoft Corporation -> Microsoft Corporation) Handler: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2024-12-17] (Microsoft Corporation -> Microsoft Corporation) Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2024-12-17] (Microsoft Corporation -> Microsoft Corporation) Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2024-12-17] (Microsoft Corporation -> Microsoft Corporation) Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2024-12-17] (Microsoft Corporation -> Microsoft Corporation) ==================== Hosts content: ========================= (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2022-05-07 00:24 - 2022-05-07 00:22 - 000000824 _____ C:\WINDOWS\system32\drivers\etc\hosts ==================== Other Areas =========================== (Currently there is no automatic fix for this section.) HKU\S-1-5-21-1385959988-334678158-2433523315-1002\Control Panel\Desktop\Wallpaper -> C:\Users\Willem\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper DNS Servers: 192.168.12.1 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) Windows Firewall is enabled. Network Binding: ============= Wi-Fi 2: Intel(R) Dual Band Wireless-AC 7265 -> Netwtw04.sys Bluetooth Network Connection 2: Bluetooth Device (Personal Area Network) #2 -> bthpan.sys ==================== MSCONFIG/TASK MANAGER disabled items == ==================== FirewallRules (Whitelisted) ================ (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) FirewallRules: [{BE6A84F3-0CF7-45E7-8FC8-562F69855186}] => (Allow) C:\Program Files (x86)\Kingsoft\WPS Office\12.2.0.19307\office6\wpspdf.exe (Zhuhai Kingsoft Office Software Co., Ltd. -> Zhuhai Kingsoft Office Software Co.,Ltd) FirewallRules: [{2FFE82A0-1CFC-43C9-8C4B-CEC6D3872A5A}] => (Allow) C:\Program Files (x86)\Kingsoft\WPS Office\12.2.0.19307\office6\et.exe (Zhuhai Kingsoft Office Software Co., Ltd. -> Zhuhai Kingsoft Office Software Co.,Ltd) FirewallRules: [{1E98A99C-3D44-4D18-9AD4-F16AE5138CBE}] => (Allow) C:\Program Files (x86)\Kingsoft\WPS Office\12.2.0.19307\office6\wpp.exe (Zhuhai Kingsoft Office Software Co., Ltd. -> Zhuhai Kingsoft Office Software Co.,Ltd) FirewallRules: [{E0B9F2AC-6F5F-40DC-A24E-5B7B5A9A2DFF}] => (Allow) C:\Program Files\WindowsApps\MSTeams_24295.605.3225.8804_x64__8wekyb3d8bbwe\ms-teams.exe (Microsoft Corporation -> Microsoft Corporation) FirewallRules: [{D131D101-0A5B-47A1-9571-9738E203E608}] => (Allow) C:\Program Files\WindowsApps\MSTeams_24295.605.3225.8804_x64__8wekyb3d8bbwe\ms-teams.exe (Microsoft Corporation -> Microsoft Corporation) FirewallRules: [{A8D5AEA1-B267-44B9-A627-EF933CF1A735}] => (Allow) C:\Program Files\WindowsApps\AppleInc.iTunes_12134.4.3008.0_x64__nzyj5cx40ttqa\AMDS64\AppleMobileDeviceProcess.exe (5BD5593D-A41B-4F89-884E-B4F3E0FBAA75 -> Apple Inc.) FirewallRules: [{A20DE2D5-2EED-4559-B4CE-BDB92F7B59A6}] => (Allow) C:\Program Files\WindowsApps\AppleInc.iTunes_12134.4.3008.0_x64__nzyj5cx40ttqa\AMDS64\AppleMobileDeviceProcess.exe (5BD5593D-A41B-4F89-884E-B4F3E0FBAA75 -> Apple Inc.) FirewallRules: [{B35279DA-45FD-4F76-90F1-93F979F8A2A7}] => (Allow) C:\Program Files\WindowsApps\AppleInc.iTunes_12134.4.3008.0_x64__nzyj5cx40ttqa\AMDS64\AppleMobileDeviceProcess.exe (5BD5593D-A41B-4F89-884E-B4F3E0FBAA75 -> Apple Inc.) FirewallRules: [{D0878E30-30D8-47A9-98EB-D6458B804CA3}] => (Allow) C:\Program Files\WindowsApps\AppleInc.iTunes_12134.4.3008.0_x64__nzyj5cx40ttqa\AMDS64\AppleMobileDeviceProcess.exe (5BD5593D-A41B-4F89-884E-B4F3E0FBAA75 -> Apple Inc.) FirewallRules: [{5DD75F0F-6A43-4996-8EF3-6F142EB2545A}] => (Allow) C:\Program Files\WindowsApps\AppleInc.iTunes_12134.4.3008.0_x64__nzyj5cx40ttqa\iTunes.exe (5BD5593D-A41B-4F89-884E-B4F3E0FBAA75 -> Apple Inc.) FirewallRules: [{3BA7C170-E967-443D-A0EF-ABFB0A1E5A9A}] => (Allow) C:\Program Files\WindowsApps\AppleInc.iTunes_12134.4.3008.0_x64__nzyj5cx40ttqa\iTunes.exe (5BD5593D-A41B-4F89-884E-B4F3E0FBAA75 -> Apple Inc.) FirewallRules: [{4FAE0D1A-3543-4978-BE8B-23327AE8E9C1}] => (Allow) C:\Program Files\WindowsApps\AppleInc.iTunes_12134.4.3008.0_x64__nzyj5cx40ttqa\iTunes.exe (5BD5593D-A41B-4F89-884E-B4F3E0FBAA75 -> Apple Inc.) FirewallRules: [{747B591C-48BF-4AC0-AE7F-92F2EF7A5DD7}] => (Allow) C:\Program Files\WindowsApps\AppleInc.iTunes_12134.4.3008.0_x64__nzyj5cx40ttqa\iTunes.exe (5BD5593D-A41B-4F89-884E-B4F3E0FBAA75 -> Apple Inc.) FirewallRules: [{9E84E6E0-531A-4168-ADF3-8418E7A92079}] => (Allow) C:\Program Files\WindowsApps\Microsoft.MinecraftEducationEdition_1.21.600.0_x64__8wekyb3d8bbwe\Minecraft.Windows.exe (Microsoft Corporation -> ) FirewallRules: [{DE51AD33-BF5B-4098-BB6A-2706CCA2925A}] => (Allow) C:\Program Files\WindowsApps\Microsoft.MinecraftEducationEdition_1.21.600.0_x64__8wekyb3d8bbwe\Minecraft.Windows.exe (Microsoft Corporation -> ) FirewallRules: [{EB51E497-2A72-44AD-B184-6EB61B1E474B}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\UcMapi.exe (Microsoft Corporation -> Microsoft Corporation) FirewallRules: [{D84CE69A-9F71-4ADE-81F4-85B571AD872B}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\Lync.exe (Microsoft Corporation -> Microsoft Corporation) FirewallRules: [{59005DCF-6810-4A19-B31C-ADA77E568B24}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\outlook.exe (Microsoft Corporation -> Microsoft Corporation) FirewallRules: [{09DA7ABE-BDD4-441C-9E0F-FF268130BB56}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\UcMapi.exe (Microsoft Corporation -> Microsoft Corporation) FirewallRules: [{039A4090-7C5C-4EB1-9D67-43E82E8D652D}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\Lync.exe (Microsoft Corporation -> Microsoft Corporation) FirewallRules: [{831EC8F8-DD70-4430-9A85-C9586663ED74}] => (Allow) C:\Program Files (x86)\Kingsoft\WPS Office\12.2.0.19307\office6\promecefpluginhost.exe (Zhuhai Kingsoft Office Software Co., Ltd. -> Zhuhai Kingsoft Office Software Co.,Ltd) FirewallRules: [{12ADF9CA-6FA2-46F6-9A64-9F658E3518CC}] => (Allow) C:\Program Files (x86)\Kingsoft\WPS Office\12.2.0.19307\office6\wpscloudsvr.exe (Zhuhai Kingsoft Office Software Co., Ltd. -> Zhuhai Kingsoft Office Software Co.,Ltd) FirewallRules: [{45A74264-0778-42C0-A0AE-B44E05ABFA6E}] => (Allow) C:\Program Files (x86)\Kingsoft\WPS Office\12.2.0.19307\office6\wps.exe (Zhuhai Kingsoft Office Software Co., Ltd. -> Zhuhai Kingsoft Office Software Co.,Ltd) FirewallRules: [{835F23AC-C9D1-4109-9631-7B6B55158332}] => (Allow) C:\Program Files (x86)\AnyDesk\AnyDesk.exe (AnyDesk Software GmbH -> AnyDesk Software GmbH) FirewallRules: [{F759E0D1-FEBF-4FE3-9A7B-421EF433E1FE}] => (Allow) C:\Program Files (x86)\AnyDesk\AnyDesk.exe (AnyDesk Software GmbH -> AnyDesk Software GmbH) FirewallRules: [{5F0BBF0A-7996-4738-83C3-40AA720A5359}] => (Allow) C:\Program Files\WindowsApps\MicrosoftTeams_24334.1103.3302.5694_x64__8wekyb3d8bbwe\msteams.exe (Microsoft Corporation -> Microsoft Corporation) FirewallRules: [{CAA9A330-71A3-4FB6-8F38-C12A05EE347C}] => (Allow) C:\Program Files\WindowsApps\MicrosoftTeams_24334.1103.3302.5694_x64__8wekyb3d8bbwe\msteams.exe (Microsoft Corporation -> Microsoft Corporation) FirewallRules: [{526CED94-5C16-45C1-8990-97A16B02FD81}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe (Google LLC -> Google LLC) FirewallRules: [{24EF3F78-3FAE-4967-B403-CD84EB24AF81}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.134.3202.0_x64__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.) FirewallRules: [{77B1FD8C-A298-44C4-A1FB-5E5C1F838080}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.134.3202.0_x64__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.) FirewallRules: [{3A72E872-8BAF-4D89-A650-53B2D5359903}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.134.3202.0_x64__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.) FirewallRules: [{BE0721AE-B8D1-437B-BD2E-E844B19744ED}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.134.3202.0_x64__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.) FirewallRules: [{AB1A0944-A8D0-4BA1-803A-C1F1A8CBE0B3}] => (Allow) C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.112\msedgewebview2.exe (Microsoft Corporation -> Microsoft Corporation) FirewallRules: [{14CF6FCC-BBBC-4EE7-915D-6843F37CD2E1}] => (Allow) C:\Program Files (x86)\AnyDesk\AnyDesk.exe (AnyDesk Software GmbH -> AnyDesk Software GmbH) FirewallRules: [{73323B79-F28F-412E-A7CC-2DB4BF9C81F9}] => (Allow) C:\Program Files (x86)\AnyDesk\AnyDesk.exe (AnyDesk Software GmbH -> AnyDesk Software GmbH) FirewallRules: [{728178FF-837F-43E0-B176-DF98E7326622}] => (Allow) C:\Program Files (x86)\AnyDesk\AnyDesk.exe (AnyDesk Software GmbH -> AnyDesk Software GmbH) FirewallRules: [{E25D8DE0-A9AD-4788-9811-31A77B56E298}] => (Allow) C:\Program Files (x86)\AnyDesk\AnyDesk.exe (AnyDesk Software GmbH -> AnyDesk Software GmbH) ==================== Restore Points ========================= 26-12-2024 19:40:02 Scheduled Checkpoint ==================== Faulty Device Manager Devices ============ ==================== Event log errors: ======================== Application errors: ================== Error: (12/13/2024 01:35:48 PM) (Source: Universal Print) (EventID: 1) (User: ) Description: Failed to GetUserSid. hr: 0x8001012d System errors: ============= Error: (12/29/2024 06:00:01 PM) (Source: Microsoft-Windows-TPM-WMI) (EventID: 1796) (User: NT AUTHORITY) Description: The Secure Boot update failed to update a Secure Boot variable with error (-2147020471 = Secure Boot is not enabled on this machine.). For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 Error: (12/29/2024 07:14:16 AM) (Source: Microsoft-Windows-TPM-WMI) (EventID: 1796) (User: NT AUTHORITY) Description: The Secure Boot update failed to update a Secure Boot variable with error (-2147020471 = Secure Boot is not enabled on this machine.). For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 Error: (12/29/2024 07:12:29 AM) (Source: Service Control Manager) (EventID: 7024) (User: ) Description: The Intel(R) Audio Service service terminated with the following service-specific error: The operation completed successfully. Error: (12/29/2024 07:11:46 AM) (Source: Microsoft-Windows-DeviceAssociationService) (EventID: 3503) (User: NT AUTHORITY) Description: Device Association Service detected an endpoint discovery failure. Error: (12/29/2024 07:11:46 AM) (Source: Microsoft-Windows-DeviceAssociationService) (EventID: 3503) (User: NT AUTHORITY) Description: Device Association Service detected an endpoint discovery failure. Error: (12/29/2024 07:11:46 AM) (Source: Microsoft-Windows-DeviceAssociationService) (EventID: 3503) (User: NT AUTHORITY) Description: Device Association Service detected an endpoint discovery failure. Error: (12/29/2024 07:11:46 AM) (Source: Microsoft-Windows-DeviceAssociationService) (EventID: 3503) (User: NT AUTHORITY) Description: Device Association Service detected an endpoint discovery failure. Error: (12/29/2024 07:11:46 AM) (Source: Microsoft-Windows-DeviceAssociationService) (EventID: 3503) (User: NT AUTHORITY) Description: Device Association Service detected an endpoint discovery failure. Windows Defender: ================ Date: 2024-12-28 14:09:32 Description: Microsoft Defender Antivirus scan has been stopped before completion. Scan Type: Antimalware Scan Parameters: Quick Scan Date: 2024-12-26 18:44:32 Description: Microsoft Defender Antivirus scan has been stopped before completion. Scan Type: Antimalware Scan Parameters: Quick Scan Date: 2024-12-24 09:10:11 Description: Microsoft Defender Antivirus scan has been stopped before completion. Scan Type: Antimalware Scan Parameters: Quick Scan Date: 2024-12-23 10:44:23 Description: Microsoft Defender Antivirus scan has been stopped before completion. Scan Type: Antimalware Scan Parameters: Quick Scan Date: 2024-12-21 08:53:34 Description: Microsoft Defender Antivirus scan has been stopped before completion. Scan Type: Antimalware Scan Parameters: Quick Scan  CodeIntegrity: =============== Date: 2024-12-29 07:12:27 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\DriverStore\FileRepository\intcoed.inf_amd64_8ed4e8058d2be5c7\AS\IAS\IntelSSTPreprocStreamer.dll because file hash co

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 19-12-2024 Ran by Willem (29-12-2024 18:50:11) Running from C:\Users\Willem\Downloads Microsoft Windows 11 Pro Version 24H2 26100.2605 (X64) (2024-12-13 18:35:48) Boot Mode: Normal ========================================================== ==================== Accounts: ============================= (If an entry is included in the fixlist, it will be removed.) Administrator (S-1-5-21-1385959988-334678158-2433523315-500 - Administrator - Disabled) DefaultAccount (S-1-5-21-1385959988-334678158-2433523315-503 - Limited - Disabled) Guest (S-1-5-21-1385959988-334678158-2433523315-501 - Limited - Disabled) k6nd (S-1-5-21-1385959988-334678158-2433523315-1004 - Limited - Disabled) k6ndv (S-1-5-21-1385959988-334678158-2433523315-1003 - Limited - Disabled) WDAGUtilityAccount (S-1-5-21-1385959988-334678158-2433523315-504 - Limited - Disabled) Willem (S-1-5-21-1385959988-334678158-2433523315-1002 - Administrator - Enabled) => C:\Users\Willem ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) AnyDesk (HKLM-x32...\AnyDesk) (Version: ad 8.1.0 - AnyDesk Software GmbH) Aplicaciones de Microsoft 365 para empresas - es-es (HKLM...\O365ProPlusRetail - es-es) (Version: 16.0.18227.20162 - Microsoft Corporation) Aplikacje Microsoft 365 dla przedsiębiorstw - pl-pl (HKLM...\O365ProPlusRetail - pl-pl) (Version: 16.0.18227.20162 - Microsoft Corporation) Aplikasi Microsoft 365 untuk perusahaan - id-id (HKLM...\O365ProPlusRetail - id-id) (Version: 16.0.18227.20162 - Microsoft Corporation) Dynamic Application Loader Host Interface Service (HKLM...{F06DA793-7F02-4C34-BF4E-1D28E9F96469}) (Version: 1.0.0.0 - Intel Corporation) Hidden Google Chrome (HKLM-x32...\Google Chrome) (Version: 131.0.6778.205 - Google LLC) Intel(R) Chipset Device Software (HKLM...{2EE411D3-03C6-4647-81F5-A3C13F25FDC5}) (Version: 10.1.18838.8284 - Intel Corporation) Hidden Intel(R) Chipset Device Software (HKLM-x32...{2d8d3782-0c02-4681-87f4-e004b3d4a8f6}) (Version: 10.1.18838.8284 - Intel(R) Corporation) Intel(R) HID Event Filter (HKLM-x32...\3FB06EEC-013D-4366-9918-71B97DFB84EB) (Version: 2.2.1.386 - Intel Corporation) Intel(R) Icls (HKLM...{AABE86DB-3230-4397-8C15-9EC1A0B03328}) (Version: 1.0.0.0 - Intel Corporation) Hidden Intel(R) LMS (HKLM...{4ECF4DC1-A866-4CA7-820B-BBEFDF4B1BEA}) (Version: 1.0.0.0 - Intel Corporation) Hidden Intel(R) Management Engine Components (HKLM...{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 2132.15.0.2411 - Intel Corporation) Intel(R) Management Engine Components (HKLM...{680BF900-AAFF-461B-B902-F9695B015A03}) (Version: 1.0.0.0 - Intel Corporation) Hidden Intel(R) Management Engine Driver (HKLM...{22B8B3F7-4ED6-44E0-A6C8-5FEB592E8113}) (Version: 1.0.0.0 - Intel Corporation) Hidden Intel(R) Serial IO (HKLM...{9FD91C5C-44AE-4D9D-85BE-AE52816B0294}) (Version: 30.100.2133.4 - Intel Corporation) Intel(R) Serial IO (HKLM...{E7758DD4-F856-465B-A8FB-01D6360E331C}) (Version: 30.100.2133.4 - Intel Corporation) Hidden Malwarebytes version 5.2.3.156 (HKLM...{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 5.2.3.156 - Malwarebytes) Microsoft 365 - en-us (HKLM...\O365HomePremRetail - en-us) (Version: 16.0.18227.20162 - Microsoft Corporation) Microsoft 365 Apps for Enterprise - de-de (HKLM...\O365ProPlusRetail - de-de) (Version: 16.0.18227.20162 - Microsoft Corporation) Microsoft 365 Apps for enterprise - en-gb (HKLM...\O365ProPlusRetail - en-gb) (Version: 16.0.18227.20162 - Microsoft Corporation) Microsoft 365 Apps for enterprise - en-us (HKLM...\O365ProPlusRetail - en-us) (Version: 16.0.18227.20162 - Microsoft Corporation) Microsoft 365 Apps for enterprise - fr-fr (HKLM...\O365ProPlusRetail - fr-fr) (Version: 16.0.18227.20162 - Microsoft Corporation) Microsoft 365 Apps for enterprise - it-it (HKLM...\O365ProPlusRetail - it-it) (Version: 16.0.18227.20162 - Microsoft Corporation) Microsoft 365 Apps for enterprise - ja-jp (HKLM...\O365ProPlusRetail - ja-jp) (Version: 16.0.18227.20162 - Microsoft Corporation) Microsoft 365 Apps for enterprise - th-th (HKLM...\O365ProPlusRetail - th-th) (Version: 16.0.18227.20162 - Microsoft Corporation) Microsoft 365 Apps para Grandes Empresas - pt-pt (HKLM...\O365ProPlusRetail - pt-pt) (Version: 16.0.18227.20162 - Microsoft Corporation) Microsoft 365-apps voor ondernemingen - nl-nl (HKLM...\O365ProPlusRetail - nl-nl) (Version: 16.0.18227.20162 - Microsoft Corporation) Microsoft Edge (HKLM-x32...\Microsoft Edge) (Version: 131.0.2903.112 - Microsoft Corporation) Microsoft Edge WebView2 Runtime (HKLM-x32...\Microsoft EdgeWebView) (Version: 131.0.2903.112 - Microsoft Corporation) Hidden Microsoft OneDrive (HKLM...\OneDriveSetup.exe) (Version: 24.226.1110.0004 - Microsoft Corporation) Microsoft Teams (HKU\S-1-5-21-1385959988-334678158-2433523315-1002...\Teams) (Version: 1.7.00.27757 - Microsoft Corporation) Microsoft Teams Meeting Add-in for Microsoft Office (HKLM...{A7AB73A3-CB10-4AA5-9D38-6AEFFBDE4C91}) (Version: 1.24.28402 - Microsoft) Microsoft Update Health Tools (HKLM...{C6FD611E-7EFE-488C-A0E0-974C09EF6473}) (Version: 5.72.0.0 - Microsoft Corporation) Office 16 Click-to-Run Extensibility Component (HKLM...{90160000-008C-0000-1000-0000000FF1CE}) (Version: 16.0.18227.20082 - Microsoft Corporation) Hidden Office 16 Click-to-Run Licensing Component (HKLM...{90160000-007E-0000-1000-0000000FF1CE}) (Version: 16.0.18227.20162 - Microsoft Corporation) Hidden Office 16 Click-to-Run Localization Component (HKLM...{90160000-008C-0407-1000-0000000FF1CE}) (Version: 16.0.18227.20082 - Microsoft Corporation) Hidden Office 16 Click-to-Run Localization Component (HKLM...{90160000-008C-040C-1000-0000000FF1CE}) (Version: 16.0.18227.20082 - Microsoft Corporation) Hidden Office 16 Click-to-Run Localization Component (HKLM...{90160000-008C-0410-1000-0000000FF1CE}) (Version: 16.0.18227.20082 - Microsoft Corporation) Hidden Office 16 Click-to-Run Localization Component (HKLM...{90160000-008C-0411-1000-0000000FF1CE}) (Version: 16.0.18227.20138 - Microsoft Corporation) Hidden Office 16 Click-to-Run Localization Component (HKLM...{90160000-008C-0413-1000-0000000FF1CE}) (Version: 16.0.18227.20082 - Microsoft Corporation) Hidden Office 16 Click-to-Run Localization Component (HKLM...{90160000-008C-0415-1000-0000000FF1CE}) (Version: 16.0.18227.20082 - Microsoft Corporation) Hidden Office 16 Click-to-Run Localization Component (HKLM...{90160000-008C-0419-1000-0000000FF1CE}) (Version: 16.0.18227.20082 - Microsoft Corporation) Hidden Office 16 Click-to-Run Localization Component (HKLM...{90160000-008C-0C0A-1000-0000000FF1CE}) (Version: 16.0.18227.20082 - Microsoft Corporation) Hidden PC App Store (HKU\S-1-5-21-1385959988-334678158-2433523315-1002...\PCAppStore) (Version: fa.2001g - Fast Corporation LTD) Realtek Audio Driver (HKLM-x32...{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.9346.1 - Realtek Semiconductor Corp.) REALTEK Bluetooth Filter Driver (HKLM-x32...{9D3D8C60-A5EF-4123-B2B9-172095903AD}) (Version: 1.8.1037.210709 - REALTEK Semiconductor Corp.) Realtek Card Reader (HKLM-x32...{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 10.0.18362.31250 - Realtek Semiconductor Corp.) Realtek PCI-E Wireless LAN Driver (HKLM-x32...\InstallShield_{70714FB7-4084-4202-A599-2D5935DECB67}) (Version: Drv_3.00.0035 - REALTEK Semiconductor Corp.) SD Cardreader Manager (HKLM...\RmCardreader) (Version: 1.02.20210604 - Generic, Inc.) Teams Machine-Wide Installer (HKLM-x32...{731F6BAA-A986-45A4-8936-7C3AAAAA760B}) (Version: 1.5.0.4689 - Microsoft Corporation) VLC media player (HKLM...\VLC media player) (Version: 3.0.20 - VideoLAN) WPS Office (12.2.0.18911) (HKLM-x32...\Kingsoft Office) (Version: 12.2.0.18911 - Kingsoft Corp.) WPS Office (12.2.0.19307) (HKU\S-1-5-21-1385959988-334678158-2433523315-1002...\Kingsoft Office) (Version: 12.2.0.19307 - Kingsoft Corp.) Приложения Microsoft 365 для предприятий - ru-ru (HKLM...\O365ProPlusRetail - ru-ru) (Version: 16.0.18227.20162 - Microsoft Corporation) Packages: ========= Amazon Landscapes PREMIUM -> C:\Program Files\WindowsApps\Microsoft.AmazonLandscapesPREMIUM_1.0.0.0_neutral__8wekyb3d8bbwe [2024-12-19] (Microsoft Corporation) AppUp.IntelGraphicsExperience -> C:\Program Files\WindowsApps\AppUp.IntelGraphicsExperience_1.100.5688.0_x64__8j3eq9eme6ctt [2024-11-10] (INTEL CORP) [Startup Task] iTunes -> C:\Program Files\WindowsApps\AppleInc.iTunes_12134.4.3008.0_x64__nzyj5cx40ttqa [2024-10-27] (Apple Inc.) [Startup Task] Microsoft Defender -> C:\Program Files\WindowsApps\Microsoft.6365217CE6EB4_102.2410.16002.0_x64__8wekyb3d8bbwe [2024-11-12] (Microsoft Corporation) [Startup Task] Microsoft Whiteboard -> C:\Program Files\WindowsApps\Microsoft.Whiteboard_54.20907.567.0_x64__8wekyb3d8bbwe [2024-10-17] (Microsoft Corporation) Microsoft.D3DMappingLayers -> C:\Program Files\WindowsApps\Microsoft.D3DMappingLayers_1.2409.2.0_x64__8wekyb3d8bbwe [2024-10-16] (Microsoft Corporation) Minecraft Education -> C:\Program Files\WindowsApps\Microsoft.MinecraftEducationEdition_1.21.600.0_x64__8wekyb3d8bbwe [2024-10-25] (Microsoft Studios) Realtek Audio Control -> C:\Program Files\WindowsApps\RealtekSemiconductorCorp.RealtekAudioControl_1.40.287.0_x64__dt26b99r8h8gj [2024-10-16] (Realtek Semiconductor Corp) Speedtest by Ookla -> C:\Program Files\WindowsApps\Ookla.SpeedtestbyOokla_1.18.194.0_x64__43tkc6nmykmb6 [2024-10-16] (Ookla) WinAppRuntime.Main.1.5 -> C:\Program Files\WindowsApps\MicrosoftCorporationII.WinAppRuntime.Main.1.5_5001.311.2039.0_x64__8wekyb3d8bbwe [2024-11-29] (Microsoft Corp.) WinAppRuntime.Singleton -> C:\Program Files\WindowsApps\MicrosoftCorporationII.WinAppRuntime.Singleton_6000.318.2304.0_x64__8wekyb3d8bbwe [2024-12-05] (Microsoft Corp.) Windows App Runtime DDLM 5001.311.2039.0-x6 -> C:\Program Files\WindowsApps\Microsoft.WinAppRuntime.DDLM.5001.311.2039.0-x6_5001.311.2039.0_x64__8wekyb3d8bbwe [2024-11-29] (Microsoft Corporation) Windows App Runtime DDLM 5001.311.2039.0-x8 -> C:\Program Files\WindowsApps\Microsoft.WinAppRuntime.DDLM.5001.311.2039.0-x8_5001.311.2039.0_x86__8wekyb3d8bbwe [2024-11-29] (Microsoft Corporation) wpsappext1 -> C:\Program Files (x86)\Kingsoft\WPS Office\12.2.0.19307\office6 [2024-12-08] (Kingsoft) wpsappext2 -> C:\Program Files (x86)\Kingsoft\WPS Office\12.2.0.19307\office6 [2024-12-08] (Kingsoft) wpsappext3 -> C:\Program Files (x86)\Kingsoft\WPS Office\12.2.0.19307\office6 [2024-12-08] (Kingsoft) ==================== Custom CLSID (Whitelisted): ============== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) CustomCLSID: HKU\S-1-5-21-1385959988-334678158-2433523315-1002_Classes\CLSID{19A6E644-14E6-4A60-B8D7-DD20610A871D}\InprocServer32 -> C:\Users\Willem\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.24.28402\x64\Microsoft.Teams.AddinLoader.dll (Microsoft Corporation -> Microsoft Corporation) CustomCLSID: HKU\S-1-5-21-1385959988-334678158-2433523315-1002_Classes\CLSID{28A80003-18FD-411D-B0A3-3C81F618E22B}\InprocServer32 -> C:\Program Files (x86)\Kingsoft\WPS Office\12.2.0.19307\office6\kwpsmenushellext64.dll (Zhuhai Kingsoft Office Software Co., Ltd. -> Zhuhai Kingsoft Office Software Co.,Ltd) CustomCLSID: HKU\S-1-5-21-1385959988-334678158-2433523315-1002_Classes\CLSID{7C360CF9-D475-44FC-8163-AD6C95CF5F5D}\InprocServer32 -> C:\Program Files (x86)\Kingsoft\WPS Office\12.2.0.19307\office6\kmso2pdfplugins64.dll (Zhuhai Kingsoft Office Software Co., Ltd. -> Zhuhai Kingsoft Office Software Co.,Ltd) ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Program Files\Microsoft OneDrive\24.226.1110.0004\FileSyncShell64.dll [2024-12-14] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Program Files\Microsoft OneDrive\24.226.1110.0004\FileSyncShell64.dll [2024-12-14] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Program Files\Microsoft OneDrive\24.226.1110.0004\FileSyncShell64.dll [2024-12-14] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Program Files\Microsoft OneDrive\24.226.1110.0004\FileSyncShell64.dll [2024-12-14] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Program Files\Microsoft OneDrive\24.226.1110.0004\FileSyncShell64.dll [2024-12-14] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => C:\Program Files\Microsoft OneDrive\24.226.1110.0004\FileSyncShell64.dll [2024-12-14] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => C:\Program Files\Microsoft OneDrive\24.226.1110.0004\FileSyncShell64.dll [2024-12-14] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Program Files\Microsoft OneDrive\24.226.1110.0004\FileSyncShell64.dll [2024-12-14] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Program Files\Microsoft OneDrive\24.226.1110.0004\FileSyncShell64.dll [2024-12-14] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Program Files\Microsoft OneDrive\24.226.1110.0004\FileSyncShell64.dll [2024-12-14] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Program Files\Microsoft OneDrive\24.226.1110.0004\FileSyncShell64.dll [2024-12-14] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Program Files\Microsoft OneDrive\24.226.1110.0004\FileSyncShell64.dll [2024-12-14] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => C:\Program Files\Microsoft OneDrive\24.226.1110.0004\FileSyncShell64.dll [2024-12-14] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => C:\Program Files\Microsoft OneDrive\24.226.1110.0004\FileSyncShell64.dll [2024-12-14] (Microsoft Corporation -> Microsoft Corporation) ContextMenuHandlers1: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Program Files\Microsoft OneDrive\24.226.1110.0004\FileSyncShell64.dll [2024-12-14] (Microsoft Corporation -> Microsoft Corporation) ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2024-12-15] (Malwarebytes Inc. -> Malwarebytes) ContextMenuHandlers4: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Program Files\Microsoft OneDrive\24.226.1110.0004\FileSyncShell64.dll [2024-12-14] (Microsoft Corporation -> Microsoft Corporation) ContextMenuHandlers5: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Program Files\Microsoft OneDrive\24.226.1110.0004\FileSyncShell64.dll [2024-12-14] (Microsoft Corporation -> Microsoft Corporation) ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2024-12-15] (Malwarebytes Inc. -> Malwarebytes) ContextMenuHandlers1_S-1-5-21-1385959988-334678158-2433523315-1002: [ kwpsshellext] -> {28A80003-18FD-411D-B0A3-3C81F618E22B} => C:\Program Files (x86)\Kingsoft\WPS Office\12.2.0.19307\office6\kwpsmenushellext64.dll [2024-12-08] (Zhuhai Kingsoft Office Software Co., Ltd. -> Zhuhai Kingsoft Office Software Co.,Ltd) ContextMenuHandlers4_S-1-5-21-1385959988-334678158-2433523315-1002: [ kwpsshellext] -> {28A80003-18FD-411D-B0A3-3C81F618E22B} => C:\Program Files (x86)\Kingsoft\WPS Office\12.2.0.19307\office6\kwpsmenushellext64.dll [2024-12-08] (Zhuhai Kingsoft Office Software Co., Ltd. -> Zhuhai Kingsoft Office Software Co.,Ltd) ==================== Codecs (Whitelisted) ==================== ==================== Shortcuts & WMI ======================== ==================== Loaded Modules (Whitelisted) ============= ==================== Alternate Data Streams (Whitelisted) ======== (If an entry is included in the fixlist, only the ADS will be removed.) AlternateDataStreams: C:\Users\Willem\Downloads\ChromeSetup.exe:MBAM.Zone.Identifier [384] AlternateDataStreams: C:\Users\Willem\Downloads\iTunes Installer.exe:MBAM.Zone.Identifier [63] ==================== Safe Mode (Whitelisted) ================== ==================== Association (Whitelisted) ================= ==================== Internet Explorer (Whitelisted) ============= BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\root\Office16\OCHelper.dll [2024-12-17] (Microsoft Corporation -> Microsoft Corporation) BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll [2024-12-17] (Microsoft Corporation -> Microsoft Corporation) BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\GROOVEEX.DLL [2024-12-17] (Microsoft Corporation -> Microsoft Corporation) Handler: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2024-12-17] (Microsoft Corporation -> Microsoft Corporation) Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2024-12-17] (Microsoft Corporation -> Microsoft Corporation) Handler: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2024-12-17] (Microsoft Corporation -> Microsoft Corporation) Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2024-12-17] (Microsoft Corporation -> Microsoft Corporation) Handler: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2024-12-17] (Microsoft Corporation -> Microsoft Corporation) Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2024-12-17] (Microsoft Corporation -> Microsoft Corporation) Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2024-12-17] (Microsoft Corporation -> Microsoft Corporation) Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2024-12-17] (Microsoft Corporation -> Microsoft Corporation) ==================== Hosts content: ========================= (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2022-05-07 00:24 - 2022-05-07 00:22 - 000000824 _____ C:\WINDOWS\system32\drivers\etc\hosts ==================== Other Areas =========================== (Currently there is no automatic fix for this section.) HKU\S-1-5-21-1385959988-334678158-2433523315-1002\Control Panel\Desktop\Wallpaper -> C:\Users\Willem\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper DNS Servers: 192.168.12.1 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) Windows Firewall is enabled. Network Binding: ============= Wi-Fi 2: Intel(R) Dual Band Wireless-AC 7265 -> Netwtw04.sys Bluetooth Network Connection 2: Bluetooth Device (Personal Area Network) #2 -> bthpan.sys ==================== MSCONFIG/TASK MANAGER disabled items == ==================== FirewallRules (Whitelisted) ================ (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) FirewallRules: [{BE6A84F3-0CF7-45E7-8FC8-562F69855186}] => (Allow) C:\Program Files (x86)\Kingsoft\WPS Office\12.2.0.19307\office6\wpspdf.exe (Zhuhai Kingsoft Office Software Co., Ltd. -> Zhuhai Kingsoft Office Software Co.,Ltd) FirewallRules: [{2FFE82A0-1CFC-43C9-8C4B-CEC6D3872A5A}] => (Allow) C:\Program Files (x86)\Kingsoft\WPS Office\12.2.0.19307\office6\et.exe (Zhuhai Kingsoft Office Software Co., Ltd. -> Zhuhai Kingsoft Office Software Co.,Ltd) FirewallRules: [{1E98A99C-3D44-4D18-9AD4-F16AE5138CBE}] => (Allow) C:\Program Files (x86)\Kingsoft\WPS Office\12.2.0.19307\office6\wpp.exe (Zhuhai Kingsoft Office Software Co., Ltd. -> Zhuhai Kingsoft Office Software Co.,Ltd) FirewallRules: [{E0B9F2AC-6F5F-40DC-A24E-5B7B5A9A2DFF}] => (Allow) C:\Program Files\WindowsApps\MSTeams_24295.605.3225.8804_x64__8wekyb3d8bbwe\ms-teams.exe (Microsoft Corporation -> Microsoft Corporation) FirewallRules: [{D131D101-0A5B-47A1-9571-9738E203E608}] => (Allow) C:\Program Files\WindowsApps\MSTeams_24295.605.3225.8804_x64__8wekyb3d8bbwe\ms-teams.exe (Microsoft Corporation -> Microsoft Corporation) FirewallRules: [{A8D5AEA1-B267-44B9-A627-EF933CF1A735}] => (Allow) C:\Program Files\WindowsApps\AppleInc.iTunes_12134.4.3008.0_x64__nzyj5cx40ttqa\AMDS64\AppleMobileDeviceProcess.exe (5BD5593D-A41B-4F89-884E-B4F3E0FBAA75 -> Apple Inc.) FirewallRules: [{A20DE2D5-2EED-4559-B4CE-BDB92F7B59A6}] => (Allow) C:\Program Files\WindowsApps\AppleInc.iTunes_12134.4.3008.0_x64__nzyj5cx40ttqa\AMDS64\AppleMobileDeviceProcess.exe (5BD5593D-A41B-4F89-884E-B4F3E0FBAA75 -> Apple Inc.) FirewallRules: [{B35279DA-45FD-4F76-90F1-93F979F8A2A7}] => (Allow) C:\Program Files\WindowsApps\AppleInc.iTunes_12134.4.3008.0_x64__nzyj5cx40ttqa\AMDS64\AppleMobileDeviceProcess.exe (5BD5593D-A41B-4F89-884E-B4F3E0FBAA75 -> Apple Inc.) FirewallRules: [{D0878E30-30D8-47A9-98EB-D6458B804CA3}] => (Allow) C:\Program Files\WindowsApps\AppleInc.iTunes_12134.4.3008.0_x64__nzyj5cx40ttqa\AMDS64\AppleMobileDeviceProcess.exe (5BD5593D-A41B-4F89-884E-B4F3E0FBAA75 -> Apple Inc.) FirewallRules: [{5DD75F0F-6A43-4996-8EF3-6F142EB2545A}] => (Allow) C:\Program Files\WindowsApps\AppleInc.iTunes_12134.4.3008.0_x64__nzyj5cx40ttqa\iTunes.exe (5BD5593D-A41B-4F89-884E-B4F3E0FBAA75 -> Apple Inc.) FirewallRules: [{3BA7C170-E967-443D-A0EF-ABFB0A1E5A9A}] => (Allow) C:\Program Files\WindowsApps\AppleInc.iTunes_12134.4.3008.0_x64__nzyj5cx40ttqa\iTunes.exe (5BD5593D-A41B-4F89-884E-B4F3E0FBAA75 -> Apple Inc.) FirewallRules: [{4FAE0D1A-3543-4978-BE8B-23327AE8E9C1}] => (Allow) C:\Program Files\WindowsApps\AppleInc.iTunes_12134.4.3008.0_x64__nzyj5cx40ttqa\iTunes.exe (5BD5593D-A41B-4F89-884E-B4F3E0FBAA75 -> Apple Inc.) FirewallRules: [{747B591C-48BF-4AC0-AE7F-92F2EF7A5DD7}] => (Allow) C:\Program Files\WindowsApps\AppleInc.iTunes_12134.4.3008.0_x64__nzyj5cx40ttqa\iTunes.exe (5BD5593D-A41B-4F89-884E-B4F3E0FBAA75 -> Apple Inc.) FirewallRules: [{9E84E6E0-531A-4168-ADF3-8418E7A92079}] => (Allow) C:\Program Files\WindowsApps\Microsoft.MinecraftEducationEdition_1.21.600.0_x64__8wekyb3d8bbwe\Minecraft.Windows.exe (Microsoft Corporation -> ) FirewallRules: [{DE51AD33-BF5B-4098-BB6A-2706CCA2925A}] => (Allow) C:\Program Files\WindowsApps\Microsoft.MinecraftEducationEdition_1.21.600.0_x64__8wekyb3d8bbwe\Minecraft.Windows.exe (Microsoft Corporation -> ) FirewallRules: [{EB51E497-2A72-44AD-B184-6EB61B1E474B}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\UcMapi.exe (Microsoft Corporation -> Microsoft Corporation) FirewallRules: [{D84CE69A-9F71-4ADE-81F4-85B571AD872B}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\Lync.exe (Microsoft Corporation -> Microsoft Corporation) FirewallRules: [{59005DCF-6810-4A19-B31C-ADA77E568B24}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\outlook.exe (Microsoft Corporation -> Microsoft Corporation) FirewallRules: [{09DA7ABE-BDD4-441C-9E0F-FF268130BB56}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\UcMapi.exe (Microsoft Corporation -> Microsoft Corporation) FirewallRules: [{039A4090-7C5C-4EB1-9D67-43E82E8D652D}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\Lync.exe (Microsoft Corporation -> Microsoft Corporation) FirewallRules: [{831EC8F8-DD70-4430-9A85-C9586663ED74}] => (Allow) C:\Program Files (x86)\Kingsoft\WPS Office\12.2.0.19307\office6\promecefpluginhost.exe (Zhuhai Kingsoft Office Software Co., Ltd. -> Zhuhai Kingsoft Office Software Co.,Ltd) FirewallRules: [{12ADF9CA-6FA2-46F6-9A64-9F658E3518CC}] => (Allow) C:\Program Files (x86)\Kingsoft\WPS Office\12.2.0.19307\office6\wpscloudsvr.exe (Zhuhai Kingsoft Office Software Co., Ltd. -> Zhuhai Kingsoft Office Software Co.,Ltd) FirewallRules: [{45A74264-0778-42C0-A0AE-B44E05ABFA6E}] => (Allow) C:\Program Files (x86)\Kingsoft\WPS Office\12.2.0.19307\office6\wps.exe (Zhuhai Kingsoft Office Software Co., Ltd. -> Zhuhai Kingsoft Office Software Co.,Ltd) FirewallRules: [{835F23AC-C9D1-4109-9631-7B6B55158332}] => (Allow) C:\Program Files (x86)\AnyDesk\AnyDesk.exe (AnyDesk Software GmbH -> AnyDesk Software GmbH) FirewallRules: [{F759E0D1-FEBF-4FE3-9A7B-421EF433E1FE}] => (Allow) C:\Program Files (x86)\AnyDesk\AnyDesk.exe (AnyDesk Software GmbH -> AnyDesk Software GmbH) FirewallRules: [{5F0BBF0A-7996-4738-83C3-40AA720A5359}] => (Allow) C:\Program Files\WindowsApps\MicrosoftTeams_24334.1103.3302.5694_x64__8wekyb3d8bbwe\msteams.exe (Microsoft Corporation -> Microsoft Corporation) FirewallRules: [{CAA9A330-71A3-4FB6-8F38-C12A05EE347C}] => (Allow) C:\Program Files\WindowsApps\MicrosoftTeams_24334.1103.3302.5694_x64__8wekyb3d8bbwe\msteams.exe (Microsoft Corporation -> Microsoft Corporation) FirewallRules: [{526CED94-5C16-45C1-8990-97A16B02FD81}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe (Google LLC -> Google LLC) FirewallRules: [{24EF3F78-3FAE-4967-B403-CD84EB24AF81}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.134.3202.0_x64__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.) FirewallRules: [{77B1FD8C-A298-44C4-A1FB-5E5C1F838080}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.134.3202.0_x64__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.) FirewallRules: [{3A72E872-8BAF-4D89-A650-53B2D5359903}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.134.3202.0_x64__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.) FirewallRules: [{BE0721AE-B8D1-437B-BD2E-E844B19744ED}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.134.3202.0_x64__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.) FirewallRules: [{AB1A0944-A8D0-4BA1-803A-C1F1A8CBE0B3}] => (Allow) C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.112\msedgewebview2.exe (Microsoft Corporation -> Microsoft Corporation) FirewallRules: [{14CF6FCC-BBBC-4EE7-915D-6843F37CD2E1}] => (Allow) C:\Program Files (x86)\AnyDesk\AnyDesk.exe (AnyDesk Software GmbH -> AnyDesk Software GmbH) FirewallRules: [{73323B79-F28F-412E-A7CC-2DB4BF9C81F9}] => (Allow) C:\Program Files (x86)\AnyDesk\AnyDesk.exe (AnyDesk Software GmbH -> AnyDesk Software GmbH) FirewallRules: [{728178FF-837F-43E0-B176-DF98E7326622}] => (Allow) C:\Program Files (x86)\AnyDesk\AnyDesk.exe (AnyDesk Software GmbH -> AnyDesk Software GmbH) FirewallRules: [{E25D8DE0-A9AD-4788-9811-31A77B56E298}] => (Allow) C:\Program Files (x86)\AnyDesk\AnyDesk.exe (AnyDesk Software GmbH -> AnyDesk Software GmbH) ==================== Restore Points ========================= 26-12-2024 19:40:02 Scheduled Checkpoint ==================== Faulty Device Manager Devices ============ ==================== Event log errors: ======================== Application errors: ================== Error: (12/13/2024 01:35:48 PM) (Source: Universal Print) (EventID: 1) (User: ) Description: Failed to GetUserSid. hr: 0x8001012d System errors: ============= Error: (12/29/2024 06:00:01 PM) (Source: Microsoft-Windows-TPM-WMI) (EventID: 1796) (User: NT AUTHORITY) Description: The Secure Boot update failed to update a Secure Boot variable with error (-2147020471 = Secure Boot is not enabled on this machine.). For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 Error: (12/29/2024 07:14:16 AM) (Source: Microsoft-Windows-TPM-WMI) (EventID: 1796) (User: NT AUTHORITY) Description: The Secure Boot update failed to update a Secure Boot variable with error (-2147020471 = Secure Boot is not enabled on this machine.). For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 Error: (12/29/2024 07:12:29 AM) (Source: Service Control Manager) (EventID: 7024) (User: ) Description: The Intel(R) Audio Service service terminated with the following service-specific error: The operation completed successfully. Error: (12/29/2024 07:11:46 AM) (Source: Microsoft-Windows-DeviceAssociationService) (EventID: 3503) (User: NT AUTHORITY) Description: Device Association Service detected an endpoint discovery failure. Error: (12/29/2024 07:11:46 AM) (Source: Microsoft-Windows-DeviceAssociationService) (EventID: 3503) (User: NT AUTHORITY) Description: Device Association Service detected an endpoint discovery failure. Error: (12/29/2024 07:11:46 AM) (Source: Microsoft-Windows-DeviceAssociationService) (EventID: 3503) (User: NT AUTHORITY) Description: Device Association Service detected an endpoint discovery failure. Error: (12/29/2024 07:11:46 AM) (Source: Microsoft-Windows-DeviceAssociationService) (EventID: 3503) (User: NT AUTHORITY) Description: Device Association Service detected an endpoint discovery failure. Error: (12/29/2024 07:11:46 AM) (Source: Microsoft-Windows-DeviceAssociationService) (EventID: 3503) (User: NT AUTHORITY) Description: Device Association Service detected an endpoint discovery failure. Windows Defender: ================ Date: 2024-12-28 14:09:32 Description: Microsoft Defender Antivirus scan has been stopped before completion. Scan Type: Antimalware Scan Parameters: Quick Scan Date: 2024-12-26 18:44:32 Description: Microsoft Defender Antivirus scan has been stopped before completion. Scan Type: Antimalware Scan Parameters: Quick Scan Date: 2024-12-24 09:10:11 Description: Microsoft Defender Antivirus scan has been stopped before completion. Scan Type: Antimalware Scan Parameters: Quick Scan Date: 2024-12-23 10:44:23 Description: Microsoft Defender Antivirus scan has been stopped before completion. Scan Type: Antimalware Scan Parameters: Quick Scan Date: 2024-12-21 08:53:34 Description: Microsoft Defender Antivirus scan has been stopped before completion. Scan Type: Antimalware Scan Parameters: Quick Scan  CodeIntegrity: =============== Date: 2024-12-29 07:12:27 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\DriverStore\FileRepository\intcoed.inf_amd64_8ed4e8058d2be5c7\AS\IAS\IntelSSTPreprocStreamer.dll because file hash co

Do you have physical access to the other computers?

If so, the logs (FRST.txt and Addition.txt) are generated in the same folder that FRST64.exe is run from.