Weird popup at start

Hello all, 

And thank you for this forum !

When I booted up my desktop PC tonight, I had this very weird popup from the start :

 210315-0001.jpg   168.54KB   1 downloads

First time I see this and isn't that suspicious ? I clicked on "No", and unplugged the comp from the internet. (I'm writing here from a macbook)

Maybe I hallucinated, but my mouse felt weird for some seconds right after (but it might be a wrong impression).

I've looked in my AppData/Local/Temp folder and don't find a trace of this 0c95b49928... folder

Is that some kind of windows thing or might that be a virus ? what should I do ?

(I ran a malwarebytes scan that found nothing).

Thanks in advance for your help !

Very strange and possible malware.

See and follow the advice given here https://www.bleepingcomputer.com/forums/t/746441/laptop-involved-in-phishing-scam/?p=5146731 for getting help to remove any malware on the PC.

Thank you for your reply ! just ran a FRST scan, here are the results :

Hi
 
Welcome
 
I'll be helping you with your computer.
 
Please read this post completely before beginning. If there's anything that you do not understand, please don't hesitate to ask before proceeding.
 
Please take note of the guidelines for this fix:

• Please note that I am a volunteer. I do have a family, a career, and other endeavors that may prevent immediate responses that meet your schedule. Do note that the differences in time zones could present a problem as well. Your patience and understanding will be greatly appreciated.
• First of all, the procedures we are about to perform are specific to your problem and should only be used on this specific computer.
• Do not make any changes to your computer that include installing/uninstalling programs, deleting files, modifying the registry, nor running scanners or tools of any kind unless specifically requested by me.
• Please read ALL instructions carefully and perform the steps fully and in the order they are written.
• If things appear to be better, let me know. Just because the symptoms no longer exist as before, does not mean that you are clean.
• Continue to read and follow my instructions until I tell you that your machine is clean.
• If you have any questions at all, please do not hesitate to ask before performing the task that I ask of you, and please wait for my reply before you proceed.
• Scanning with programs and reading the logs do take a fair amount of time. Again, your patience will be necessary.

Let's begin...

• Highlight the entire content of the quote box below.

Start:: 
CloseProcesses: 
AlternateDataStreams: C:\ProgramData\PACE:37077A0003115E71 [217] 
AlternateDataStreams: C:\Users\Baz\AppData\Local\Temp:$DATA​ [16] 
AlternateDataStreams: C:\Users\Baz\AppData\Local\Temp:com.affinity.designer.2 [320] 
HKLM-x32\...\Run: [] => [X] 
S3 VBAudioVACMME; \SystemRoot\system32\DRIVERS\vbaudio_cable64_win7.sys [X] 
S3 VBAudioVMVAIOMME; \SystemRoot\system32\DRIVERS\vbaudio_vmvaio64_win10.sys [X] 
FirewallRules: [{F36F2170-40D4-4E74-86E3-EA2D99A0F5E4}] => (Allow) C:\ProgramData\Blackmagic Design\DaVinci Resolve\Support\QtDecoder\QTDecoder.exe => No File 
GroupPolicy: Restriction ? <==== ATTENTION 
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION 
ShortcutTarget: Folding@home.lnk -> C:\Program Files (x86)\FAHClient\HideConsole.exe (No File) 
ShortcutTarget: Seer.lnk -> C:\Program Files (x86)\Seer\Seer.exe (No File) 
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [No File] 
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [No File] 
CustomCLSID: HKU\S-1-5-21-3592542235-2043277170-2684174653-1001_Classes\CLSID\{9486aaf1-0930-362a-962d-8e6908739c817}\InprocServer32 -> 0xF35379B41B74D30153D7911E07A7D301340000005D00000000000000 => No File 
ContextMenuHandlers1: [BB FlashBack 2] -> {A8065B9E-193F-4797-B62D-8F6321E7FCCB} =>  -> No File 
FirewallRules: [{5C5901B9-E2C1-4877-9E68-A05534627B62}] => (Block) %ProgramFiles%\Adobe\Adobe After Effects CC 2017\Support Files\AfterFX.exe => No File 
FirewallRules: [UDP Query User{C2B5A8EC-C74A-4D23-96B9-B38E9C260437}C:\programdata\battle.net\agent\agent.6160\agent.exe] => (Allow) C:\programdata\battle.net\agent\agent.6160\agent.exe => No File 
FirewallRules: [TCP Query User{D8F7456E-4C78-4C2F-9078-D14BC1A58BC3}C:\programdata\battle.net\agent\agent.6160\agent.exe] => (Allow) C:\programdata\battle.net\agent\agent.6160\agent.exe => No File 
FirewallRules: [UDP Query User{0C5431F3-DD17-4528-80CE-4E27AEDB28D5}C:\program files\maxon\cinema 4d r19\cinema 4d.exe] => (Allow) C:\program files\maxon\cinema 4d r19\cinema 4d.exe => No File 
FirewallRules: [TCP Query User{F2DE39FC-56E3-43D6-896F-797901C93AC9}C:\program files\maxon\cinema 4d r19\cinema 4d.exe] => (Allow) C:\program files\maxon\cinema 4d r19\cinema 4d.exe => No File 
FirewallRules: [UDP Query User{B43721BB-EDBE-4B16-A73C-8C3121818E85}C:\program files\blackmagic design\davinci resolve\fuscript.exe] => (Allow) C:\program files\blackmagic design\davinci resolve\fuscript.exe => No File 
FirewallRules: [TCP Query User{A9C74F60-B37F-4BB1-8BE9-8A65EC6EE887}C:\program files\blackmagic design\davinci resolve\fuscript.exe] => (Allow) C:\program files\blackmagic design\davinci resolve\fuscript.exe => No File 
FirewallRules: [UDP Query User{8C71496F-F360-4845-BF95-39843C82C1FF}F:\games\overwatch\overwatch.exe] => (Allow) F:\games\overwatch\overwatch.exe => No File 
FirewallRules: [TCP Query User{9F11093F-2F92-4898-B9B8-817F686D7567}F:\games\overwatch\overwatch.exe] => (Allow) F:\games\overwatch\overwatch.exe => No File 
FirewallRules: [UDP Query User{BF360A13-912C-4E8F-BAEB-A1F9F997B02A}C:\program files\storyboarder\storyboarder.exe] => (Allow) C:\program files\storyboarder\storyboarder.exe => No File 
FirewallRules: [TCP Query User{C2E6A262-EAA8-4A59-A05F-07B1F1C76547}C:\program files\storyboarder\storyboarder.exe] => (Allow) C:\program files\storyboarder\storyboarder.exe => No File 
FirewallRules: [UDP Query User{B4C6A289-73AC-445C-9308-BF4CA6219A22}F:\games\starcraft ii\versions\base62347\sc2_x64.exe] => (Allow) F:\games\starcraft ii\versions\base62347\sc2_x64.exe => No File 
FirewallRules: [TCP Query User{AD296CF4-42C3-44D5-B6FC-836D108D5353}F:\games\starcraft ii\versions\base62347\sc2_x64.exe] => (Allow) F:\games\starcraft ii\versions\base62347\sc2_x64.exe => No File 
FirewallRules: [UDP Query User{E17FD241-9BCD-4638-A6F2-ED3FB1136D17}F:\games\starcraft ii\versions\base60321\sc2_x64.exe] => (Allow) F:\games\starcraft ii\versions\base60321\sc2_x64.exe => No File 
FirewallRules: [TCP Query User{9FD1B9D4-6CAF-40DD-9D48-0F57271BC6D0}F:\games\starcraft ii\versions\base60321\sc2_x64.exe] => (Allow) F:\games\starcraft ii\versions\base60321\sc2_x64.exe => No File 
FirewallRules: [UDP Query User{83766D58-093C-47FD-AA45-773CCF5B9622}F:\games\warcraft iii 1.26 -iceblitz\war3.exe] => (Allow) F:\games\warcraft iii 1.26 -iceblitz\war3.exe => No File 
FirewallRules: [TCP Query User{C38D0AF9-EA8F-4FCD-8CA2-60B86380663D}F:\games\warcraft iii 1.26 -iceblitz\war3.exe] => (Allow) F:\games\warcraft iii 1.26 -iceblitz\war3.exe => No File 
FirewallRules: [UDP Query User{87C9DA71-E88A-48B4-959A-BE1859CAF6AA}F:\games\warcraft iii\war3.exe] => (Block) F:\games\warcraft iii\war3.exe => No File 
FirewallRules: [TCP Query User{D8E1716E-F904-429D-851F-D1CADF73FCB5}F:\games\warcraft iii\war3.exe] => (Block) F:\games\warcraft iii\war3.exe => No File 
FirewallRules: [UDP Query User{D79A9C75-4621-4B9F-8CBB-5DE8A9A1C67D}C:\program files\maxon\cinema 4d r19\cinema 4d.exe] => (Allow) C:\program files\maxon\cinema 4d r19\cinema 4d.exe => No File 
FirewallRules: [TCP Query User{C8978D17-E0CC-4E27-99B9-20E81133E92B}C:\program files\maxon\cinema 4d r19\cinema 4d.exe] => (Allow) C:\program files\maxon\cinema 4d r19\cinema 4d.exe => No File 
FirewallRules: [UDP Query User{0D7638D3-3CD2-497D-9719-9ACF75568A71}C:\program files\adobe\adobe premiere pro cc 2017\adobe premiere pro.exe] => (Allow) C:\program files\adobe\adobe premiere pro cc 2017\adobe premiere pro.exe => No File 
FirewallRules: [TCP Query User{D746E6C1-8B05-49BD-B3F5-988BA66C50B6}C:\program files\adobe\adobe premiere pro cc 2017\adobe premiere pro.exe] => (Allow) C:\program files\adobe\adobe premiere pro cc 2017\adobe premiere pro.exe => No File 
FirewallRules: [UDP Query User{0C2D6DEE-AC64-4708-9A59-701361A0AA84}C:\program files (x86)\origin games\battlefield 4\bf4.exe] => (Allow) C:\program files (x86)\origin games\battlefield 4\bf4.exe => No File 
FirewallRules: [TCP Query User{3B7C7AE4-AC1F-4CDB-B792-CB415A24DA18}C:\program files (x86)\origin games\battlefield 4\bf4.exe] => (Allow) C:\program files (x86)\origin games\battlefield 4\bf4.exe => No File 
FirewallRules: [TCP Query User{51097D24-D48D-4EF4-A98A-62DAF5B1534F}F:\games\diablo iii\x64\diablo iii64.exe] => (Block) F:\games\diablo iii\x64\diablo iii64.exe => No File 
FirewallRules: [UDP Query User{E0A7648A-E03F-4450-93C1-6F2103DA7FEA}F:\games\diablo iii\x64\diablo iii64.exe] => (Block) F:\games\diablo iii\x64\diablo iii64.exe => No File 
FirewallRules: [TCP Query User{20449519-E598-4276-A156-709FC35B088A}C:\program files (x86)\deluge\deluge.exe] => (Allow) C:\program files (x86)\deluge\deluge.exe => No File 
FirewallRules: [UDP Query User{B9E6B933-A119-4E4A-BB12-A3B5027181EE}C:\program files (x86)\deluge\deluge.exe] => (Allow) C:\program files (x86)\deluge\deluge.exe => No File 
FirewallRules: [TCP Query User{E228F32E-EC5A-4935-BF06-5A5F8408173B}C:\program files\adobe\adobe after effects cc 2017\support files\afterfx.exe] => (Block) C:\program files\adobe\adobe after effects cc 2017\support files\afterfx.exe => No File 
FirewallRules: [UDP Query User{4ACE5BE1-DE0B-44E6-90C9-B174B035EF86}C:\program files\adobe\adobe after effects cc 2017\support files\afterfx.exe] => (Block) C:\program files\adobe\adobe after effects cc 2017\support files\afterfx.exe => No File 
FirewallRules: [TCP Query User{A21B8199-E8BA-4E3B-A31B-8716812D4E5F}C:\program files\adobe\adobe dreamweaver cc 2017\node\node.exe] => (Allow) C:\program files\adobe\adobe dreamweaver cc 2017\node\node.exe => No File 
FirewallRules: [UDP Query User{76091A43-998F-45B1-B336-1EE575911726}C:\program files\adobe\adobe dreamweaver cc 2017\node\node.exe] => (Allow) C:\program files\adobe\adobe dreamweaver cc 2017\node\node.exe => No File 
FirewallRules: [TCP Query User{01F112FA-3829-4724-BB1D-6954BA162D82}C:\program files (x86)\macaw\macaw-node.exe] => (Allow) C:\program files (x86)\macaw\macaw-node.exe => No File 
FirewallRules: [UDP Query User{561ADD7D-C84C-4F3B-B925-0E81068E60B0}C:\program files (x86)\macaw\macaw-node.exe] => (Allow) C:\program files (x86)\macaw\macaw-node.exe => No File 
FirewallRules: [{45CA24E4-46FB-4EE5-84BD-27647932502D}] => (Allow) F:\Games\steamapps\common\Metro Last Light\MetroLL.exe => No File 
FirewallRules: [{70234B07-E9A6-47BD-9334-6DB425151D34}] => (Allow) F:\Games\steamapps\common\Metro Last Light\MetroLL.exe => No File 
FirewallRules: [TCP Query User{5B59CA90-D2B9-4AB6-B423-7FBE7511CAA9}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe => No File 
FirewallRules: [UDP Query User{99D92890-7175-44B0-9FCF-CEA6CCD1A58D}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe => No File 
FirewallRules: [TCP Query User{3304D14A-A327-479E-93A3-090CAD5A7628}C:\program files\adobe\adobe media encoder cc 2017\adobe media encoder.exe] => (Block) C:\program files\adobe\adobe media encoder cc 2017\adobe media encoder.exe => No File 
FirewallRules: [UDP Query User{F3DB0C67-DEBE-4468-BA91-B36633D62027}C:\program files\adobe\adobe media encoder cc 2017\adobe media encoder.exe] => (Block) C:\program files\adobe\adobe media encoder cc 2017\adobe media encoder.exe => No File 
FirewallRules: [TCP Query User{09B300E4-5D29-4C26-960E-96AE5ADDB5AE}F:\games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe] => (Allow) F:\games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe => No File 
FirewallRules: [UDP Query User{EFAC8A07-CA72-492E-A67F-300F7A10864D}F:\games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe] => (Allow) F:\games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe => No File 
FirewallRules: [TCP Query User{377CF757-ED7D-40BF-8D25-646C90532C70}F:\games\overwatch test\overwatch.exe] => (Allow) F:\games\overwatch test\overwatch.exe => No File 
FirewallRules: [UDP Query User{6A693612-C997-464A-BC95-1A10EC806D32}F:\games\overwatch test\overwatch.exe] => (Allow) F:\games\overwatch test\overwatch.exe => No File 
FirewallRules: [TCP Query User{335B8582-4DB5-4E8B-AF19-808768E428B3}F:\games\steamapps\common\deep rock galactic\fsd\binaries\win64\fsd-win64-shipping.exe] => (Allow) F:\games\steamapps\common\deep rock galactic\fsd\binaries\win64\fsd-win64-shipping.exe => No File 
FirewallRules: [UDP Query User{C0C51AFC-473C-4770-8E0A-BCCFD6AEA4D1}F:\games\steamapps\common\deep rock galactic\fsd\binaries\win64\fsd-win64-shipping.exe] => (Allow) F:\games\steamapps\common\deep rock galactic\fsd\binaries\win64\fsd-win64-shipping.exe => No File 
FirewallRules: [{D38F6496-C255-4633-9C33-EF6C869B2BE4}] => (Block) %ProgramFiles%\WorldCreator\Launcher.exe => No File 
FirewallRules: [{B8ABF9D4-4321-403B-BF83-E4886971FE5F}] => (Block) %ProgramFiles%\WorldCreator\WorldCreator.exe => No File 
FirewallRules: [{7024B102-71E6-4F5B-BF7D-4C6E40E089A9}] => (Block) %ProgramFiles%\WorldCreator\Launcher.exe => No File 
FirewallRules: [{367EEC03-12F3-4038-8A02-EFE441E478BB}] => (Block) %ProgramFiles%\WorldCreator\WorldCreator.exe => No File 
FirewallRules: [TCP Query User{D9B5FFEE-902C-422D-A263-718CFE911315}C:\program files\side effects software\houdini 16.5.571\bin\houdinifx.exe] => (Block) C:\program files\side effects software\houdini 16.5.571\bin\houdinifx.exe => No File 
FirewallRules: [UDP Query User{71DB030B-8FB0-4E11-B418-69CCE46A580F}C:\program files\side effects software\houdini 16.5.571\bin\houdinifx.exe] => (Block) C:\program files\side effects software\houdini 16.5.571\bin\houdinifx.exe => No File 
FirewallRules: [TCP Query User{1B7A7124-2E13-45C4-8F2A-C5BAD905557C}C:\program files\side effects software\houdini 16.5.571\bin\houdini.exe] => (Block) C:\program files\side effects software\houdini 16.5.571\bin\houdini.exe => No File 
FirewallRules: [UDP Query User{7BDB1ADF-A548-4408-AEAA-DB652B87A041}C:\program files\side effects software\houdini 16.5.571\bin\houdini.exe] => (Block) C:\program files\side effects software\houdini 16.5.571\bin\houdini.exe => No File 
FirewallRules: [TCP Query User{EE189DB4-D7D2-4F35-964D-93DCB23839FF}C:\program files\maxon\cinema 4d r20\cinema 4d.exe] => (Block) C:\program files\maxon\cinema 4d r20\cinema 4d.exe => No File 
FirewallRules: [UDP Query User{B27E4911-019F-4370-90D3-907C9178B0EF}C:\program files\maxon\cinema 4d r20\cinema 4d.exe] => (Block) C:\program files\maxon\cinema 4d r20\cinema 4d.exe => No File 
FirewallRules: [TCP Query User{24E2E991-08AA-4D3D-97E7-9AFA08058721}C:\program files\maxon\cinema 4d r20\cinema 4d.exe] => (Allow) C:\program files\maxon\cinema 4d r20\cinema 4d.exe => No File 
FirewallRules: [UDP Query User{AE838082-8DE0-4546-B158-786AAC192065}C:\program files\maxon\cinema 4d r20\cinema 4d.exe] => (Allow) C:\program files\maxon\cinema 4d r20\cinema 4d.exe => No File 
FirewallRules: [TCP Query User{7EBEF171-5C0C-46BA-BD63-CE31CF825447}C:\program files\adobe\adobe media encoder cc 2018\adobe media encoder.exe] => (Allow) C:\program files\adobe\adobe media encoder cc 2018\adobe media encoder.exe => No File 
FirewallRules: [UDP Query User{ACF9DC30-4616-4EF6-B139-9E6BD10D50C5}C:\program files\adobe\adobe media encoder cc 2018\adobe media encoder.exe] => (Allow) C:\program files\adobe\adobe media encoder cc 2018\adobe media encoder.exe => No File 
FirewallRules: [TCP Query User{298D4D93-FB99-4847-9117-7C12E5C69362}C:\program files\adobe\adobe after effects cc 2018\support files\afterfx.exe] => (Block) C:\program files\adobe\adobe after effects cc 2018\support files\afterfx.exe => No File 
FirewallRules: [UDP Query User{06325B7C-8054-43B4-BE03-2591D08FE484}C:\program files\adobe\adobe after effects cc 2018\support files\afterfx.exe] => (Block) C:\program files\adobe\adobe after effects cc 2018\support files\afterfx.exe => No File 
FirewallRules: [TCP Query User{FAD56084-9220-48D1-8C8B-431323ECEF5C}C:\program files (x86)\jamkazam\jamkazam.exe] => (Allow) C:\program files (x86)\jamkazam\jamkazam.exe => No File 
FirewallRules: [UDP Query User{AB10A9F7-1B84-47E3-B41A-589DD3EDAE9A}C:\program files (x86)\jamkazam\jamkazam.exe] => (Allow) C:\program files (x86)\jamkazam\jamkazam.exe => No File 
FirewallRules: [TCP Query User{0064E8D6-7A85-4004-9370-CB75BC030B93}C:\program files\adobe\adobe premiere pro cc 2018\adobe premiere pro.exe] => (Block) C:\program files\adobe\adobe premiere pro cc 2018\adobe premiere pro.exe => No File 
FirewallRules: [UDP Query User{E8C3D6C8-47A8-462B-B01E-738E9DC9D6B0}C:\program files\adobe\adobe premiere pro cc 2018\adobe premiere pro.exe] => (Block) C:\program files\adobe\adobe premiere pro cc 2018\adobe premiere pro.exe => No File 
FirewallRules: [TCP Query User{B34C8B8F-B870-4E7D-824D-34AAB5E0A98B}C:\xampp\mysql\bin\mysqld.exe] => (Allow) C:\xampp\mysql\bin\mysqld.exe => No File 
FirewallRules: [UDP Query User{66DAC450-C18A-4E6D-A81A-6B6F6B0EB9AC}C:\xampp\mysql\bin\mysqld.exe] => (Allow) C:\xampp\mysql\bin\mysqld.exe => No File 
FirewallRules: [TCP Query User{2A0028FF-BB4F-4BD4-B4F7-5930E47F4B75}C:\program files\allegorithmic\substance painter\substance painter.exe] => (Block) C:\program files\allegorithmic\substance painter\substance painter.exe => No File 
FirewallRules: [UDP Query User{DBA6F8F7-BA51-4469-B563-057824624B3B}C:\program files\allegorithmic\substance painter\substance painter.exe] => (Block) C:\program files\allegorithmic\substance painter\substance painter.exe => No File 
FirewallRules: [TCP Query User{D4B8F25E-EEE7-4A14-8189-6B8836BAD731}C:\users\baz\downloads\bin\ranchsync_server.exe] => (Allow) C:\users\baz\downloads\bin\ranchsync_server.exe => No File 
FirewallRules: [UDP Query User{6D3AFA54-0BFE-4F42-ADF6-4B070EDFB445}C:\users\baz\downloads\bin\ranchsync_server.exe] => (Allow) C:\users\baz\downloads\bin\ranchsync_server.exe => No File 
FirewallRules: [TCP Query User{D261B3AA-4F86-4A40-A9EA-38A86DADB7C7}C:\program files (x86)\overwatch\overwatch.exe] => (Allow) C:\program files (x86)\overwatch\overwatch.exe => No File 
FirewallRules: [UDP Query User{A89FE576-8BD5-4ADE-BA10-2B21D31286B0}C:\program files (x86)\overwatch\overwatch.exe] => (Allow) C:\program files (x86)\overwatch\overwatch.exe => No File 
FirewallRules: [TCP Query User{156F890F-155F-4BD6-9B37-851EE56071B7}C:\program files (x86)\overwatch\_retail_\overwatch.exe] => (Allow) C:\program files (x86)\overwatch\_retail_\overwatch.exe => No File 
FirewallRules: [UDP Query User{F92D406C-2A77-4140-BFB4-3B24C216BF03}C:\program files (x86)\overwatch\_retail_\overwatch.exe] => (Allow) C:\program files (x86)\overwatch\_retail_\overwatch.exe => No File 
FirewallRules: [TCP Query User{07018032-EE81-48AE-A0D4-9755587AE924}C:\program files\epic games\ue_4.22\engine\binaries\win64\ue4editor.exe] => (Allow) C:\program files\epic games\ue_4.22\engine\binaries\win64\ue4editor.exe => No File 
FirewallRules: [UDP Query User{49B5C48A-631E-41E7-92B5-38A5613A1F72}C:\program files\epic games\ue_4.22\engine\binaries\win64\ue4editor.exe] => (Allow) C:\program files\epic games\ue_4.22\engine\binaries\win64\ue4editor.exe => No File 
FirewallRules: [TCP Query User{FB5D3AC4-3A51-4858-BF0D-2B0D2C95BC81}C:\program files\epic games\ue_4.23\engine\binaries\win64\ue4editor.exe] => (Allow) C:\program files\epic games\ue_4.23\engine\binaries\win64\ue4editor.exe => No File 
FirewallRules: [UDP Query User{4A723D70-3F22-4A3C-AF0C-88C107F9DF12}C:\program files\epic games\ue_4.23\engine\binaries\win64\ue4editor.exe] => (Allow) C:\program files\epic games\ue_4.23\engine\binaries\win64\ue4editor.exe => No File 
FirewallRules: [TCP Query User{4F020FB2-5818-437F-9E26-9AEC84D07FD2}F:\games\lol\game\league of legends.exe] => (Allow) F:\games\lol\game\league of legends.exe => No File 
FirewallRules: [UDP Query User{8FBCD4CD-E8E2-4C03-B467-0F843E681C6B}F:\games\lol\game\league of legends.exe] => (Allow) F:\games\lol\game\league of legends.exe => No File 
FirewallRules: [TCP Query User{62060A05-CE81-4B6F-90AB-51A7073478E0}F:\games\destiny 2\destiny2.exe] => (Allow) F:\games\destiny 2\destiny2.exe => No File 
FirewallRules: [UDP Query User{7878092E-8459-4847-9C62-88A2811A75E1}F:\games\destiny 2\destiny2.exe] => (Allow) F:\games\destiny 2\destiny2.exe => No File 
FirewallRules: [TCP Query User{A47742C0-9589-41FE-8D2D-D106D8D5F209}F:\games\overwatch\_retail_\overwatch.exe] => (Allow) F:\games\overwatch\_retail_\overwatch.exe => No File 
FirewallRules: [UDP Query User{5FE35E7C-777D-48D9-ADB9-F0F393EF3A1B}F:\games\overwatch\_retail_\overwatch.exe] => (Allow) F:\games\overwatch\_retail_\overwatch.exe => No File 
FirewallRules: [TCP Query User{D790C7CC-C686-4246-AC72-58F719FC23FB}C:\users\baz\downloads\ranchsync2_win_2.2.8\bin\ranchsync_server.exe] => (Allow) C:\users\baz\downloads\ranchsync2_win_2.2.8\bin\ranchsync_server.exe => No File 
FirewallRules: [UDP Query User{0D16051A-EC5F-42FB-A6FF-CAA97DB49760}C:\users\baz\downloads\ranchsync2_win_2.2.8\bin\ranchsync_server.exe] => (Allow) C:\users\baz\downloads\ranchsync2_win_2.2.8\bin\ranchsync_server.exe => No File 
FirewallRules: [{C873AC69-5B8F-4674-BE66-B69483D8564D}] => (Allow) C:\Program Files\Unity Hub\Unity Hub.exe => No File 
FirewallRules: [TCP Query User{DAEBF279-DCDD-4359-A352-04F68058424D}C:\program files\unity hub\unity hub.exe] => (Allow) C:\program files\unity hub\unity hub.exe => No File 
FirewallRules: [UDP Query User{CC4DF210-B158-4BEC-A82F-65DDCE3DD4AC}C:\program files\unity hub\unity hub.exe] => (Allow) C:\program files\unity hub\unity hub.exe => No File 
FirewallRules: [TCP Query User{A0A3B613-52B7-4D92-AB98-E39D52FF1249}C:\program files\epic games\ue_4.23\engine\binaries\dotnet\swarmagent.exe] => (Allow) C:\program files\epic games\ue_4.23\engine\binaries\dotnet\swarmagent.exe => No File 
FirewallRules: [UDP Query User{05A02230-49BD-41CA-822D-FCBB294D995A}C:\program files\epic games\ue_4.23\engine\binaries\dotnet\swarmagent.exe] => (Allow) C:\program files\epic games\ue_4.23\engine\binaries\dotnet\swarmagent.exe => No File 
FirewallRules: [{7DD01ECC-4934-4919-A6BB-0D162DFDE63C}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe => No File 
FirewallRules: [{BED2A192-44FC-415D-A0E9-2A175E239624}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe => No File 
FirewallRules: [TCP Query User{C641B4F4-1F72-419E-BF3E-B4A6F60B8681}C:\program files\ue_4.24\engine\binaries\win64\ue4editor.exe] => (Allow) C:\program files\ue_4.24\engine\binaries\win64\ue4editor.exe => No File 
FirewallRules: [UDP Query User{AD4FF444-5D42-4E2D-B333-C25577B3F0A8}C:\program files\ue_4.24\engine\binaries\win64\ue4editor.exe] => (Allow) C:\program files\ue_4.24\engine\binaries\win64\ue4editor.exe => No File 
FirewallRules: [TCP Query User{DF6F6204-EFD2-45B6-8690-204CBAB1C7C4}C:\program files\ue_4.24\engine\binaries\win64\crashreportclienteditor.exe] => (Allow) C:\program files\ue_4.24\engine\binaries\win64\crashreportclienteditor.exe => No File 
FirewallRules: [UDP Query User{F14A0190-20FB-45B8-9472-A54802B85123}C:\program files\ue_4.24\engine\binaries\win64\crashreportclienteditor.exe] => (Allow) C:\program files\ue_4.24\engine\binaries\win64\crashreportclienteditor.exe => No File 
FirewallRules: [TCP Query User{46E88F88-6516-4C9B-AB13-53F0156737DB}C:\program files (x86)\eagle\eagle.exe] => (Allow) C:\program files (x86)\eagle\eagle.exe => No File 
FirewallRules: [UDP Query User{47D59F43-E260-43D3-8679-0184CAC45BF9}C:\program files (x86)\eagle\eagle.exe] => (Allow) C:\program files (x86)\eagle\eagle.exe => No File 
FirewallRules: [TCP Query User{503522F5-6197-4DBE-9D19-B622922EF4B9}C:\program files (x86)\eagle\drag_extension\dragextension.exe] => (Allow) C:\program files (x86)\eagle\drag_extension\dragextension.exe => No File 
FirewallRules: [UDP Query User{BD60A289-92C2-4BC9-AD77-F9C3CEA8FD8D}C:\program files (x86)\eagle\drag_extension\dragextension.exe] => (Allow) C:\program files (x86)\eagle\drag_extension\dragextension.exe => No File 
FirewallRules: [TCP Query User{149D8615-C2F5-4434-B8A4-23CEA43837D0}C:\program files\notch trial\notch_demo.exe] => (Allow) C:\program files\notch trial\notch_demo.exe => No File 
FirewallRules: [UDP Query User{C56C008D-CC60-4580-B4B5-E343A73CC79C}C:\program files\notch trial\notch_demo.exe] => (Allow) C:\program files\notch trial\notch_demo.exe => No File 
FirewallRules: [TCP Query User{A2DF62F0-C55D-4D8F-9328-F31A81C76A22}C:\program files (x86)\fahclient\fahclient.exe] => (Allow) C:\program files (x86)\fahclient\fahclient.exe => No File 
FirewallRules: [UDP Query User{BC626AE0-6FEF-48F8-928E-15CA3268904D}C:\program files (x86)\fahclient\fahclient.exe] => (Allow) C:\program files (x86)\fahclient\fahclient.exe => No File 
FirewallRules: [{6596120D-2431-4C32-ACCB-DE46E3CBAE56}] => (Allow) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe => No File 
FirewallRules: [{B5F4BF05-1DB6-4E14-B7E1-CCA75A86B333}] => (Allow) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe => No File 
FirewallRules: [TCP Query User{547EF1C8-508A-4C7F-A7F2-99614B3376DE}C:\program files\notch\notchapp.exe] => (Allow) C:\program files\notch\notchapp.exe => No File 
FirewallRules: [UDP Query User{02B7D964-6247-4C11-8A5A-5BC369F4D088}C:\program files\notch\notchapp.exe] => (Allow) C:\program files\notch\notchapp.exe => No File 
FirewallRules: [TCP Query User{DDD59DBB-F6F0-4671-BE35-E05F70C71BEC}F:\games\steamlibrary\steamapps\common\divinity original sin 2\defed\bin\eocapp.exe] => (Allow) F:\games\steamlibrary\steamapps\common\divinity original sin 2\defed\bin\eocapp.exe => No File 
FirewallRules: [UDP Query User{8A5DC686-8FFE-4407-A943-1568ED851884}F:\games\steamlibrary\steamapps\common\divinity original sin 2\defed\bin\eocapp.exe] => (Allow) F:\games\steamlibrary\steamapps\common\divinity original sin 2\defed\bin\eocapp.exe => No File 
FirewallRules: [{4978CF51-3506-4C3B-8B86-743A0A8C37C8}] => (Allow) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe => No File 
FirewallRules: [{61AFB30E-FD9B-4856-A790-6A893D243E06}] => (Allow) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe => No File 
FirewallRules: [TCP Query User{4B9FA57F-986C-4F49-9B39-65108A0BE6D3}F:\downloads\ranchsync2_win_3.0.6\bin\ranchsync_server.exe] => (Allow) F:\downloads\ranchsync2_win_3.0.6\bin\ranchsync_server.exe => No File 
FirewallRules: [UDP Query User{59ABE5C5-D4AB-4A68-AF4A-530FD00FC09B}F:\downloads\ranchsync2_win_3.0.6\bin\ranchsync_server.exe] => (Allow) F:\downloads\ranchsync2_win_3.0.6\bin\ranchsync_server.exe => No File 
FirewallRules: [TCP Query User{E8C70FCC-8475-46F7-9FCC-FBA4D503BB07}C:\program files\derivative\touchdesigner\bin\touchdesigner.exe] => (Allow) C:\program files\derivative\touchdesigner\bin\touchdesigner.exe => No File 
FirewallRules: [UDP Query User{FCD15E21-C510-4F48-8ABD-12DE805F19EE}C:\program files\derivative\touchdesigner\bin\touchdesigner.exe] => (Allow) C:\program files\derivative\touchdesigner\bin\touchdesigner.exe => No File 
FirewallRules: [TCP Query User{13D0B9A1-4D73-4A7F-AC81-C29B45AA0AFF}F:\downloads\oscmonitor\oscmonitor.exe] => (Allow) F:\downloads\oscmonitor\oscmonitor.exe => No File 
FirewallRules: [UDP Query User{6A6181A5-442B-49D0-8850-1E6E5A051097}F:\downloads\oscmonitor\oscmonitor.exe] => (Allow) F:\downloads\oscmonitor\oscmonitor.exe => No File 
FirewallRules: [TCP Query User{153B59B7-1CD0-432A-A41A-C802E87F7336}F:\downloads\oscdatamonitor-master (1)\oscdatamonitor-master\previous 2011 version applications\osc_data_monitor_windows\osc_data_monitor.exe] => (Allow) F:\downloads\oscdatamonitor-master (1)\oscdatamonitor-master\previous 2011 version applications\osc_data_monitor_windows\osc_data_monitor.exe => No File 
FirewallRules: [UDP Query User{E53E6466-3839-4016-AD43-9004C3D14F6F}F:\downloads\oscdatamonitor-master (1)\oscdatamonitor-master\previous 2011 version applications\osc_data_monitor_windows\osc_data_monitor.exe] => (Allow) F:\downloads\oscdatamonitor-master (1)\oscdatamonitor-master\previous 2011 version applications\osc_data_monitor_windows\osc_data_monitor.exe => No File 
FirewallRules: [TCP Query User{6616D779-ECF1-4DE3-BBD0-5D7F2F0151A1}C:\program files\derivative\touchdesigner\bin\touchplayer.exe] => (Allow) C:\program files\derivative\touchdesigner\bin\touchplayer.exe => No File 
FirewallRules: [UDP Query User{273772ED-0882-4716-87FB-EF06CA5FE7EC}C:\program files\derivative\touchdesigner\bin\touchplayer.exe] => (Allow) C:\program files\derivative\touchdesigner\bin\touchplayer.exe => No File 
FirewallRules: [TCP Query User{A5C7DA6C-C2FF-4AC4-B26B-1A2E411D6BB0}C:\users\baz\desktop\osc_data_monitor_windows\osc_data_monitor.exe] => (Allow) C:\users\baz\desktop\osc_data_monitor_windows\osc_data_monitor.exe => No File 
FirewallRules: [UDP Query User{17D98DA6-1A88-4AFA-A26C-11E23E72DAA2}C:\users\baz\desktop\osc_data_monitor_windows\osc_data_monitor.exe] => (Allow) C:\users\baz\desktop\osc_data_monitor_windows\osc_data_monitor.exe => No File 
FirewallRules: [TCP Query User{1DC8A068-2A8D-4D2F-9283-463390C885D7}F:\games\call of duty modern warfare\modernwarfare.exe] => (Allow) F:\games\call of duty modern warfare\modernwarfare.exe => No File 
FirewallRules: [UDP Query User{A1F688A1-D62F-427D-9FEB-3558A8B0F74C}F:\games\call of duty modern warfare\modernwarfare.exe] => (Allow) F:\games\call of duty modern warfare\modernwarfare.exe => No File 
FirewallRules: [TCP Query User{00429A07-0633-4B41-BC20-83E2699179DA}C:\program files\allegorithmic\substance designer\substance designer.exe] => (Allow) C:\program files\allegorithmic\substance designer\substance designer.exe => No File 
FirewallRules: [UDP Query User{434132B6-347D-481D-AE42-F7C184AE47C3}C:\program files\allegorithmic\substance designer\substance designer.exe] => (Allow) C:\program files\allegorithmic\substance designer\substance designer.exe => No File 
FirewallRules: [TCP Query User{9315194B-E9C4-4B2B-837E-05C16AEDC701}F:\games\remnantfromtheashes\remnant\binaries\win64\remnant-win64-shipping.exe] => (Allow) F:\games\remnantfromtheashes\remnant\binaries\win64\remnant-win64-shipping.exe => No File 
FirewallRules: [UDP Query User{004D6BD7-6DA6-44A0-AA1A-7B71BADA46B4}F:\games\remnantfromtheashes\remnant\binaries\win64\remnant-win64-shipping.exe] => (Allow) F:\games\remnantfromtheashes\remnant\binaries\win64\remnant-win64-shipping.exe => No File 
FirewallRules: [TCP Query User{6034D99F-DC3C-4431-BB7F-F617599FF230}F:\games\warehousedemo\base\binaries\win64\thps12demo.exe] => (Allow) F:\games\warehousedemo\base\binaries\win64\thps12demo.exe => No File 
FirewallRules: [UDP Query User{658BEF23-E129-4FB0-99F5-678B9AF7C757}F:\games\warehousedemo\base\binaries\win64\thps12demo.exe] => (Allow) F:\games\warehousedemo\base\binaries\win64\thps12demo.exe => No File 
FirewallRules: [TCP Query User{302D0401-068D-4E5C-8D1F-3675B71C7F81}F:\games\tonyhawksproskater\base\binaries\win64\thps12.exe] => (Allow) F:\games\tonyhawksproskater\base\binaries\win64\thps12.exe => No File 
FirewallRules: [UDP Query User{942B2E77-E2FA-4612-95C7-C4FBDC63213E}F:\games\tonyhawksproskater\base\binaries\win64\thps12.exe] => (Allow) F:\games\tonyhawksproskater\base\binaries\win64\thps12.exe => No File 
FirewallRules: [{FCCEF52C-C019-4A0C-8519-53DF13F88755}] => (Allow) C:\Program Files\Blackmagic Design\DaVinci Resolve\Resolve.exe => No File 
FirewallRules: [{BDB81CAF-3739-4C6F-84FA-E8C7483794FA}] => (Allow) C:\Program Files\Blackmagic Design\DaVinci Resolve\bmdpaneld.exe => No File 
FirewallRules: [{98AE1798-89B2-452C-9D2D-4A8302AE99F4}] => (Allow) C:\Program Files\Blackmagic Design\DaVinci Resolve\DaVinciPanelDaemon.exe => No File 
FirewallRules: [{1456491B-033F-47A8-8DA1-0017FDFF6B73}] => (Allow) C:\Program Files\Blackmagic Design\DaVinci Resolve\JLCooperPanelDaemon.exe => No File 
FirewallRules: [{D5FAFF77-7A08-4598-8FD7-4FED3CA8661A}] => (Allow) C:\Program Files\Blackmagic Design\DaVinci Resolve\EuphonixPanelDaemon.exe => No File 
FirewallRules: [{2465097F-5A41-4C4C-A2AB-311310572F0E}] => (Allow) C:\Program Files\Blackmagic Design\DaVinci Resolve\TangentPanelDaemon.exe => No File 
FirewallRules: [{C892172A-BBE8-423C-8666-78B547EDD339}] => (Allow) C:\Program Files\Blackmagic Design\DaVinci Resolve\ElementsPanelDaemon.exe => No File 
FirewallRules: [{ECF8B534-900D-470D-BFF5-6DC334389C78}] => (Allow) C:\Program Files\Blackmagic Design\DaVinci Resolve\OxygenPanelDaemon.exe => No File 
FirewallRules: [{E8460538-5AC1-47AE-A209-BC15F9E60FD3}] => (Allow) C:\Program Files\Blackmagic Design\DaVinci Resolve\DPDecoder.exe => No File 
FirewallRules: [{F36F2170-40D4-4E74-86E3-EA2D99A0F5E4}] => (Allow) C:\ProgramData\Blackmagic Design\DaVinci Resolve\Support\QtDecoder\QTDecoder.exe => No File 
FirewallRules: [TCP Query User{5BB39D51-0C72-4397-930C-5FBE7E2DD9E6}F:\downloads\ranchsync2_win_3.0.7\bin\ranchsync_server.exe] => (Allow) F:\downloads\ranchsync2_win_3.0.7\bin\ranchsync_server.exe => No File 
FirewallRules: [UDP Query User{4108E4B0-C336-4112-AA2C-9643A460A148}F:\downloads\ranchsync2_win_3.0.7\bin\ranchsync_server.exe] => (Allow) F:\downloads\ranchsync2_win_3.0.7\bin\ranchsync_server.exe => No File 
FirewallRules: [TCP Query User{A30297DC-7E09-42EE-A2B5-575CEF329898}C:\program files\imaginando\drc\drc.exe] => (Allow) C:\program files\imaginando\drc\drc.exe => No File 
FirewallRules: [UDP Query User{A7AF4E82-85FE-42F3-9330-AC2887AC2223}C:\program files\imaginando\drc\drc.exe] => (Allow) C:\program files\imaginando\drc\drc.exe => No File 
FirewallRules: [TCP Query User{E34D77A3-A451-4095-B5B9-81BADBAA8C55}C:\program files\blackmagic design\davinci resolve\vstscanner.exe] => (Allow) C:\program files\blackmagic design\davinci resolve\vstscanner.exe => No File 
FirewallRules: [UDP Query User{9E77A909-DA7A-468C-A34F-33BA95A0D044}C:\program files\blackmagic design\davinci resolve\vstscanner.exe] => (Allow) C:\program files\blackmagic design\davinci resolve\vstscanner.exe => No File 
FirewallRules: [{D06DF51A-A1A0-4D9B-A432-F51F7A9C579D}] => (Allow) C:\Users\Baz\AppData\Roaming\Zoom\bin\airhost.exe => No File 
FirewallRules: [{B5BD1840-AB29-4C28-893F-BAE9E1AF8CAF}] => (Allow) C:\Users\Baz\AppData\Roaming\Zoom\bin\airhost.exe => No File 
EMPTYTEMP: 
Folder: C:\Users\Baz\AppData\Local\Temp
End::

• Right click on the highlighted text and select Copy.
• Start FRST (FRST64) with Administrator privileges
• Press the Fix button. FRST will process the lines copied above from the clipboard.
• When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.

Please copy and paste its contents in your next reply.
 
Download AdwCleaner and save it to your desktop.

• Double click AdwCleaner.exe to run it.
• Click Scan Now ...
• When the scan has finished a Scan Results window will open.
• Click Cancel (at this point do not attempt to Quarantine anything that is found)
• Now click the Log Files tab ...
• Double click on the latest scan log (Scan logs have a [S0*] suffix, where * is replaced by a number, the latest scan will have the largest number)
• A Notepad file will open containing the results of the scan.

Please post the contents of the file in your next reply.
 
 

Thanks for your reply, will proceed with frst fix and adwcleaner.

But do I have a virus or malware and if so, which one and what does it do ?

Here are the logs :

Thanks for your reply, will proceed with frst fix and adwcleaner.

 

But do I have a virus or malware and if so, which one and what does it do ?

All I see are many orphaned entries. I did remove those and emptied the temp folders. No malware is present.

How is the computer doing?

Thanks for your reply ! I did the FRST fix and Adwcleaner found nothing.

I had a series of startups with internet on again. 

Globally everything seems fine, but right now on maybe the third startup with internet on, right after being onto desktop I notice 3-4 black windows appearing (like cmd ones) appearing and disappearing very shortly like 1/4 of a second.

By doing google searches it seems that it happened to other users too, and as far as I understand it can be a harmless windows startup bug thing or a malware.

Note that these day's i've also frequently had "this app is preventing shutdown" when shutting down, with no app name neither icon.

No weird behavior otherwise, no strange process running (except Antimalware Service Executable/Windows Defender Antivirus Service) which is hopefully normal.

I checked startup programs and mad an autorun.exe, found nothing weird.

It still worries me a bit, is there anything else I can do or some deepscan to check if there is something wrong ?

Thank you in advance

Some executable may trigger a Command window at startup.

Lets try ESET:

Thanks for your reply !

ESET found nothing. No strange behavior today. I think and hope these commande windows are related to scheduled tasks, and that my PC is starting to get old after 3 years and a half of installing various software. I will probably make a clean and fresh windows install soon.

Thanks a lot for your help !

You are welcome.