- Fix result of Farbar Recovery Scan Tool (x64) Version: 28-03-2026
- Ran by TG02-007 (30-03-2026 14:08:38) Run:1
- Running from C:\Users\TG02-007\Downloads
- Loaded Profiles: TG02-007 & SQLTELEMETRY$SQLEXPRESS & MSSQL$SQLEXPRESS
- Boot Mode: Normal
- ==============================================
- fixlist content:
- *****************
- Start::
- CreateRestorePoint:
- CloseProcesses:
- 2026-03-30 06:18 - 2026-03-30 06:18 - 000255400 _____ (360.cn) C:\ProgramData\StreamA32.exe
- 2026-03-29 09:37 - 2026-03-30 13:16 - 000000000 ____D C:\ProgramData\MgrMaintain
- 2026-03-29 09:37 - 2026-03-29 09:37 - 000000000 ____D C:\Users\TG02-007\AppData\Roaming\MgrMaintain
- S3 EAAntiCheat; system32\drivers\eaanticheat.sys [X]
- 2026-03-29 09:37 - 2026-03-30 08:34 - 000000000 ____D C:\Users\TG02-007\AppData\Roaming\Fofezayu
- 2026-03-29 09:37 - 2026-03-30 08:34 - 000000000 ____D C:\Users\TG02-007\gw.exe
- 2026-03-29 09:36 - 2026-03-29 09:36 - 000000000 ____D C:\WINDOWS\system32\Tasks\GoogleSystem
- 2026-03-29 09:32 - 2026-03-29 09:32 - 000000000 ____D C:\Users\TG02-007\AppData\Roaming\RenPy
- 2024-08-19 19:10 - 2024-12-03 15:31 - 000000000 _____ () C:\ProgramData\sldh.dat
- 2022-09-04 12:51 - 2022-09-04 12:51 - 000000024 _____ () C:\Users\TG02-007\AppData\Roaming\Microsoft\Update.txt
- 2024-12-09 09:59 - 2024-12-09 09:59 - 000000048 ____R () C:\Users\TG02-007\AppData\Local\6E5DB14CBCBF1802671DBC4CF4A16DE7
- 2025-11-15 05:56 - 2025-11-15 05:56 - 000000048 ____R () C:\Users\TG02-007\AppData\Local\7CFC0A8D2AB49DD279CC580FDB000897
- 2024-02-02 17:36 - 2024-02-02 17:36 - 000006366 ____H () C:\Users\TG02-007\AppData\Local\91477623837
- 2024-01-09 05:01 - 2024-01-09 05:01 - 000005374 ____H () C:\Users\TG02-007\AppData\Local\91887170374
- 2024-01-06 13:30 - 2024-01-06 13:30 - 000005534 ____H () C:\Users\TG02-007\AppData\Local\92056688834
- C:\ProgramData\MgrMaintain
- C:\ProgramData\Lupa
- 2026-03-27 07:43 - 2026-03-27 07:43 - 000000000 ____D C:\WINDOWS\system32\Tasks\Mozilla
- 2024-01-05 13:36 - 2024-01-06 00:10 - 000005350 ____H () C:\Users\TG02-007\AppData\Local\91547068486
- TeamViewer (HKLM\...\TeamViewer) (Version: 15.51.6 - TeamViewer)
- HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe (No File)
- HKLM-x32\...\Run: [STOVE] => C:\ProgramData\Smilegate\STOVE\STOVE.exe (No File)
- HKU\S-1-5-19\...\Run: [HPSEU_Host_Launcher] => C:\System.sav\util\HPSEU\HpseuHostLauncher.exe (No File)
- HKU\S-1-5-19\...\RunOnce: [OMENCC_InstallationBooster] => C:\system.sav\util\OMENCC_InstallationBooster.exe (No File)
- HKU\S-1-5-20\...\Run: [HPSEU_Host_Launcher] => C:\System.sav\util\HPSEU\HpseuHostLauncher.exe (No File)
- HKU\S-1-5-20\...\RunOnce: [OMENCC_InstallationBooster] => C:\system.sav\util\OMENCC_InstallationBooster.exe (No File)
- HKU\S-1-5-21-3061952332-3695074-208723314-1001\...\Run: [AF_uuid_514912] => ad9face8-89c5-4908-90f5-7ef275380aa0** *n*u*l*l*********‘·¸¾*ñ*—ProgramF (No File)
- HKU\S-1-5-21-3061952332-3695074-208723314-1001\...\Run: [AF_counter_514912] => 4 (No File)
- HKU\S-1-5-21-3061952332-3695074-208723314-1001\...\Run: [GalaxyClient] => [X]
- HKU\S-1-5-80-1985561900-798682989-2213159822-1904180398-3434236965\...\Run: [HPSEU_Host_Launcher] => C:\System.sav\util\HPSEU\HpseuHostLauncher.exe (No File)
- HKU\S-1-5-80-1985561900-798682989-2213159822-1904180398-3434236965\...\RunOnce: [OMENCC_InstallationBooster] => C:\system.sav\util\OMENCC_InstallationBooster.exe (No File)
- HKU\S-1-5-80-3880006512-4290199581-1648723128-3569869737-3631323133\...\Run: [HPSEU_Host_Launcher] => C:\System.sav\util\HPSEU\HpseuHostLauncher.exe (No File)
- HKU\S-1-5-80-3880006512-4290199581-1648723128-3569869737-3631323133\...\RunOnce: [OMENCC_InstallationBooster] => C:\system.sav\util\OMENCC_InstallationBooster.exe (No File)
- ShortcutTarget: RocketDock.lnk -> C:\Program Files (x86)\RocketDock\RocketDock.exe (No File)
- Task: {077BA067-7C15-40F0-B22E-C9DC2A54B4A2} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe (No File)
- Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe (No File)
- S3 XD Client Service; C:\Program Files (x86)\XD_GAME\public\service.exe [X]
- 2025-07-02 10:48 - 2025-07-02 10:48 - 000000024 _____ () C:\Users\TG02-007\AppData\Roaming\C23W6Vk43XTwu662.dat
- CustomCLSID: HKU\S-1-5-21-3061952332-3695074-208723314-1001_Classes\CLSID\{14100442-9664-1407-2647-000000000000}\localserver32 -> "C:\Users\TG02-007\AppData\Local\Wondershare\Wondershare NativePush\WsToastNotification.exe" -ToastActivated => No File
- CustomCLSID: HKU\S-1-5-21-3061952332-3695074-208723314-1001_Classes\CLSID\{4e6f7264-5650-4e00-0000-000000000000}\localserver32 -> "C:\Program Files\NordVPN\NordVPN.exe" -ToastActivated => No File
- AlternateDataStreams: C:\WINDOWS\tracing:? [16]
- AlternateDataStreams: C:\ProgramData\BstShm_5.21.580.1019_nxt:0BA5A0C5AF [7714]
- AlternateDataStreams: C:\ProgramData\BstShm_5.21.580.1019_nxt:BFA2474391 [7714]
- AlternateDataStreams: C:\ProgramData\mntemp:8EAD8B3507 [7714]
- AlternateDataStreams: C:\ProgramData\sldh.dat:136096DD5B [6002]
- AlternateDataStreams: C:\ProgramData\sldh.dat:AF7D5A4DE2 [6002]
- AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini:B1DA6C571C [7714]
- AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\McInst.exe:5333F5D8A9 [7714]
- AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\McInst.exe:9DCDB32EE1 [7714]
- AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access.lnk:A1B76439FE [7714]
- AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Amazon.com.lnk:35D20EBEE5 [6002]
- AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk:BE32D07BC5 [7714]
- AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel.lnk:B96E9B8455 [6002]
- AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox Private Browsing.lnk:C5112377E0 [6002]
- AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Documentation.lnk:92B3809DA8 [7714]
- AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LastPass.lnk:F32536EEBE [6002]
- AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneNote.lnk:60EC9648C0 [7714]
- AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook (classic).lnk:5465085A2F [6002]
- AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook (classic).lnk:BE800952D3 [6002]
- AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerPoint.lnk:1DC1525F34 [5154]
- AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Publisher.lnk:104946E0EA [3442]
- AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [10134]
- AlternateDataStreams: C:\Users\TG02-007\Dati applicazioni:86dabf594e68b7fb8ac56037576b6591 [394]
- AlternateDataStreams: C:\Users\TG02-007\Dati applicazioni:c15540c89c88cd704ccd25de5f07f873 [394]
- AlternateDataStreams: C:\Users\TG02-007\AppData\Roaming:86dabf594e68b7fb8ac56037576b6591 [394]
- AlternateDataStreams: C:\Users\TG02-007\AppData\Roaming:c15540c89c88cd704ccd25de5f07f873 [394]
- AlternateDataStreams: C:\Users\TG02-007\AppData\Local\Temp:$DATA [16]
- HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Restriction <==== ATTENTION
- HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Restriction <==== ATTENTION
- GroupPolicy-Firefox: Restriction <==== ATTENTION
- Task: {296F0E3E-E22E-4EAB-A10F-B898F2BAAD71} - \Microsoft\Windows\Setup\EM -> No File <==== ATTENTION
- Task: {1F38C9E5-6E48-496A-99EA-2929E14D8BCC} - System32\Tasks\SystemOptimizerTemp => C:\Users\TG02-007\AppData\Local\Temp\HP\SystemOptimizerTemp\SystemOptimizer.exe -update (No File) <==== ATTENTION
- 2026-03-29 09:38 - 2026-03-29 09:38 - 000000000 ____D C:\Users\TG02-007\AppData\Local\Yandex
- EmptyTemp:
- End::
- *****************
- Restore point was successfully created.
- Processes closed successfully.
- C:\ProgramData\StreamA32.exe => moved successfully
- "C:\ProgramData\MgrMaintain" Folder move:
- C:\ProgramData\MgrMaintain => moved successfully
- "C:\Users\TG02-007\AppData\Roaming\MgrMaintain" Folder move:
- C:\Users\TG02-007\AppData\Roaming\MgrMaintain => moved successfully
- HKLM\System\CurrentControlSet\Services\EAAntiCheat => removed successfully
- EAAntiCheat => service removed successfully
- "C:\Users\TG02-007\AppData\Roaming\Fofezayu" Folder move:
- C:\Users\TG02-007\AppData\Roaming\Fofezayu => moved successfully
- "C:\Users\TG02-007\gw.exe" Folder move:
- C:\Users\TG02-007\gw.exe => moved successfully
- "C:\WINDOWS\system32\Tasks\GoogleSystem" Folder move:
- C:\WINDOWS\system32\Tasks\GoogleSystem => moved successfully
- "C:\Users\TG02-007\AppData\Roaming\RenPy" Folder move:
- C:\Users\TG02-007\AppData\Roaming\RenPy => moved successfully
- C:\ProgramData\sldh.dat => moved successfully
- C:\Users\TG02-007\AppData\Roaming\Microsoft\Update.txt => moved successfully
- C:\Users\TG02-007\AppData\Local\6E5DB14CBCBF1802671DBC4CF4A16DE7 => moved successfully
- C:\Users\TG02-007\AppData\Local\7CFC0A8D2AB49DD279CC580FDB000897 => moved successfully
- C:\Users\TG02-007\AppData\Local\91477623837 => moved successfully
- C:\Users\TG02-007\AppData\Local\91887170374 => moved successfully
- C:\Users\TG02-007\AppData\Local\92056688834 => moved successfully
- "C:\ProgramData\MgrMaintain" => not found
- "C:\ProgramData\Lupa" Folder move:
- C:\ProgramData\Lupa => moved successfully
- "C:\WINDOWS\system32\Tasks\Mozilla" Folder move:
- C:\WINDOWS\system32\Tasks\Mozilla => moved successfully
- C:\Users\TG02-007\AppData\Local\91547068486 => moved successfully
- TeamViewer (HKLM\...\TeamViewer) (Version: 15.51.6 - TeamViewer) => Error: No automatic fix found for this entry.
- "HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\Wondershare Helper Compact.exe" => removed successfully
- "HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\STOVE" => removed successfully
- "HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run\\HPSEU_Host_Launcher" => removed successfully
- "HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\OMENCC_InstallationBooster" => removed successfully
- "HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run\\HPSEU_Host_Launcher" => removed successfully
- "HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\OMENCC_InstallationBooster" => removed successfully
- "HKU\S-1-5-21-3061952332-3695074-208723314-1001\Software\Microsoft\Windows\CurrentVersion\Run\\AF_uuid_514912" => removed successfully
- "HKU\S-1-5-21-3061952332-3695074-208723314-1001\Software\Microsoft\Windows\CurrentVersion\Run\\AF_counter_514912" => removed successfully
- "HKU\S-1-5-21-3061952332-3695074-208723314-1001\Software\Microsoft\Windows\CurrentVersion\Run\\GalaxyClient" => removed successfully
- "HKU\S-1-5-80-1985561900-798682989-2213159822-1904180398-3434236965\Software\Microsoft\Windows\CurrentVersion\Run\\HPSEU_Host_Launcher" => removed successfully
- "HKU\S-1-5-80-1985561900-798682989-2213159822-1904180398-3434236965\Software\Microsoft\Windows\CurrentVersion\RunOnce\\OMENCC_InstallationBooster" => removed successfully
- "HKU\S-1-5-80-3880006512-4290199581-1648723128-3569869737-3631323133\Software\Microsoft\Windows\CurrentVersion\Run\\HPSEU_Host_Launcher" => removed successfully
- "HKU\S-1-5-80-3880006512-4290199581-1648723128-3569869737-3631323133\Software\Microsoft\Windows\CurrentVersion\RunOnce\\OMENCC_InstallationBooster" => removed successfully
- "C:\Program Files (x86)\RocketDock\RocketDock.exe" => not found
- "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{077BA067-7C15-40F0-B22E-C9DC2A54B4A2}" => removed successfully
- "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{077BA067-7C15-40F0-B22E-C9DC2A54B4A2}" => removed successfully
- C:\WINDOWS\System32\Tasks\Microsoft\Windows\Location\Notifications => moved successfully
- "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Location\Notifications" => removed successfully
- "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F3E6E7ED-A196-4E44-8803-55FAB3AD4E29}" => removed successfully
- "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F3E6E7ED-A196-4E44-8803-55FAB3AD4E29}" => removed successfully
- C:\WINDOWS\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => moved successfully
- "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker" => removed successfully
- HKLM\System\CurrentControlSet\Services\XD Client Service => removed successfully
- XD Client Service => service removed successfully
- C:\Users\TG02-007\AppData\Roaming\C23W6Vk43XTwu662.dat => moved successfully
- HKU\S-1-5-21-3061952332-3695074-208723314-1001_Classes\CLSID\{14100442-9664-1407-2647-000000000000} => removed successfully
- HKU\S-1-5-21-3061952332-3695074-208723314-1001_Classes\CLSID\{4e6f7264-5650-4e00-0000-000000000000} => removed successfully
- C:\WINDOWS\tracing => ":?" ADS removed successfully
- C:\ProgramData\BstShm_5.21.580.1019_nxt => ":0BA5A0C5AF" ADS removed successfully
- C:\ProgramData\BstShm_5.21.580.1019_nxt => ":BFA2474391" ADS removed successfully
- C:\ProgramData\mntemp => ":8EAD8B3507" ADS removed successfully
- "C:\ProgramData\sldh.dat" => ":136096DD5B" ADS not found.
- "C:\ProgramData\sldh.dat" => ":AF7D5A4DE2" ADS not found.
- C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini => ":B1DA6C571C" ADS removed successfully
- C:\ProgramData\Microsoft\Windows\Start Menu\McInst.exe => ":5333F5D8A9" ADS removed successfully
- C:\ProgramData\Microsoft\Windows\Start Menu\McInst.exe => ":9DCDB32EE1" ADS removed successfully
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access.lnk => ":A1B76439FE" ADS removed successfully
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Amazon.com.lnk => ":35D20EBEE5" ADS removed successfully
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk => ":BE32D07BC5" ADS removed successfully
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel.lnk => ":B96E9B8455" ADS removed successfully
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox Private Browsing.lnk => ":C5112377E0" ADS removed successfully
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Documentation.lnk => ":92B3809DA8" ADS removed successfully
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LastPass.lnk => ":F32536EEBE" ADS removed successfully
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneNote.lnk => ":60EC9648C0" ADS removed successfully
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook (classic).lnk => ":5465085A2F" ADS removed successfully
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook (classic).lnk => ":BE800952D3" ADS removed successfully
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerPoint.lnk => ":1DC1525F34" ADS removed successfully
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Publisher.lnk => ":104946E0EA" ADS removed successfully
- C:\Users\Public\Shared Files => ":VersionCache" ADS removed successfully
- C:\Users\TG02-007\Dati applicazioni => ":86dabf594e68b7fb8ac56037576b6591" ADS removed successfully
- C:\Users\TG02-007\Dati applicazioni => ":c15540c89c88cd704ccd25de5f07f873" ADS removed successfully
- "C:\Users\TG02-007\AppData\Roaming" => ":86dabf594e68b7fb8ac56037576b6591" ADS not found.
- "C:\Users\TG02-007\AppData\Roaming" => ":c15540c89c88cd704ccd25de5f07f873" ADS not found.
- C:\Users\TG02-007\AppData\Local\Temp => ":$DATA" ADS removed successfully
- HKLM\SOFTWARE\Microsoft\Windows Defender\\"DisableAntiSpyware"="0" => value restored successfully
- HKLM\SOFTWARE\Microsoft\Windows Defender\\"DisableAntiVirus"="0" => value restored successfully
- C:\Program Files\Mozilla Firefox\distribution\policies.json => moved successfully
- "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{296F0E3E-E22E-4EAB-A10F-B898F2BAAD71}" => removed successfully
- "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{296F0E3E-E22E-4EAB-A10F-B898F2BAAD71}" => removed successfully
- "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\EM" => not found
- "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{1F38C9E5-6E48-496A-99EA-2929E14D8BCC}" => removed successfully
- "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1F38C9E5-6E48-496A-99EA-2929E14D8BCC}" => removed successfully
- C:\WINDOWS\System32\Tasks\SystemOptimizerTemp => moved successfully
- "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SystemOptimizerTemp" => removed successfully
- "C:\Users\TG02-007\AppData\Local\Yandex" Folder move:
- C:\Users\TG02-007\AppData\Local\Yandex => moved successfully
- =========== EmptyTemp: ==========
- FlushDNS => completed
- BITS transfer queue => 1310720 B
- DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 99790075 B
- Java, Discord, Steam htmlcache, WinHttpAutoProxySvc/winhttp *.cache => 940515882 B
- Windows/system/drivers => 79217853 B
- Edge => 51192192 B
- Firefox => 3058213678 B
- Opera => 0 B
- Local\Temp, Local\*.tmp, LocalLow\Temp, Roaming\Temp, Roaming\*.tmp , IE cache, history, cookies, recent:
- Default => 0 B
- ProgramData => 0 B
- Public => 0 B
- systemprofile => 0 B
- systemprofile32 => 1166225 B
- LocalService => 73818 B
- NetworkService => 72000 B
- TG02-007 => 304278859 B
- SQLTELEMETRY$SQLEXPRESS => 0 B
- MSSQL$SQLEXPRESS => 0 B
- RecycleBin => 0 B
- EmptyTemp: => 4.2 GB temporary data Removed.
- ================================
- The system needed a reboot.
- ==== End of Fixlog 14:10:44 ====
