Publicité
Publicité
Format du document : text/plain
Prévisualisation
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 03.02.2024 01
Ran by twist (04-02-2024 11:39:20)
Running from C:\Users\twist\Desktop
Microsoft Windows 11 Pro Version 22H2 22621.525 (X64) (2024-02-04 00:27:42)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
(If an entry is included in the fixlist, it will be removed.)
Administrator (S-1-5-21-1367221443-249768293-1022394803-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1367221443-249768293-1022394803-503 - Limited - Disabled)
Guest (S-1-5-21-1367221443-249768293-1022394803-501 - Limited - Disabled)
twist (S-1-5-21-1367221443-249768293-1022394803-1001 - Administrator - Enabled) => C:\Users\twist
WDAGUtilityAccount (S-1-5-21-1367221443-249768293-1022394803-504 - Limited - Disabled)
_ashbackup_ (S-1-5-21-1367221443-249768293-1022394803-1003 - Administrator - Enabled) => C:\Users\_ashbackup_
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
AMD Catalyst Control Center (HKLM-x32\...\WUCCCApp) (Version: 1.00.0000 - AMD)
Catalyst Control Center - Branding (HKLM-x32\...\{11087D24-567D-7D88-69C6-D7A08B5F4C47}) (Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
MEmu (HKLM-x32\...\MEmu) (Version: 9.0.9.3 - Microvirt Software Technology Co., Ltd.)
Microsoft Edge (HKLM-x32\...\Microsoft Edge) (Version: 121.0.2277.98 - Microsoft Corporation)
Microsoft Edge WebView2 Runtime (HKLM-x32\...\Microsoft EdgeWebView) (Version: 121.0.2277.98 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1367221443-249768293-1022394803-1001\...\OneDriveSetup.exe) (Version: 24.010.0114.0003 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (HKLM\...\{AC53FC8B-EE18-3F9C-9B59-60937D0B182C}) (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (HKLM\...\{A2CB1ACB-94A2-32BA-A15E-7D80319F7589}) (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (HKLM-x32\...\{FDB30193-FDA0-3DAA-ACCA-A75EEFE53607}) (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (HKLM-x32\...\{2F73A7B2-E50E-39A6-9ABC-EF89E4C62E36}) (Version: 11.0.50727 - Microsoft Corporation) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7004 - Realtek Semiconductor Corp.)
Packages:
=========
Solitaire & Casual Games -> C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.18.11020.0_x64__8wekyb3d8bbwe [2024-02-04] (Microsoft Studios) [MS Ad]
==================== Custom CLSID (Whitelisted): ==============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
ContextMenuHandlers5: [ACE] -> {5E2121EE-0300-11D4-8D3B-444553540000} => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\atiacm64.dll [2015-08-21] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.)
==================== Codecs (Whitelisted) ====================
==================== Shortcuts & WMI ========================
(The entries could be listed to be restored or removed.)
ShortcutWithArgument: C:\Users\twist\Desktop\Pre_Scan_Donate.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxps://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=S3AQ8V3XRWWYN
==================== Loaded Modules (Whitelisted) =============
2024-02-04 10:02 - 2017-06-14 07:13 - 000768512 _____ (The curl library, hxxps://curl.haxx.se/) [File not signed] C:\Program Files\Microvirt\MEmuHyperv\libcurl.dll
2024-02-04 10:01 - 2023-05-10 10:25 - 000418304 _____ (The curl library, hxxps://curl.se/) [File not signed] C:\Program Files\Microvirt\MEmu\libcurl.dll
2024-02-04 10:02 - 2017-05-25 14:20 - 002887168 _____ (The OpenSSL Project, hxxp://www.openssl.org/) [File not signed] C:\Program Files\Microvirt\MEmuHyperv\libcrypto-1_1-x64.dll
2024-02-04 10:02 - 2017-05-25 14:20 - 000479744 _____ (The OpenSSL Project, hxxp://www.openssl.org/) [File not signed] C:\Program Files\Microvirt\MEmuHyperv\libssl-1_1-x64.dll
2024-02-04 10:01 - 2023-05-10 10:25 - 002159104 _____ (The OpenSSL Project, hxxps://www.openssl.org/) [File not signed] C:\Program Files\Microvirt\MEmu\libcrypto-1_1.dll
2024-02-04 10:01 - 2023-05-10 10:25 - 000499712 _____ (The OpenSSL Project, hxxps://www.openssl.org/) [File not signed] C:\Program Files\Microvirt\MEmu\libssl-1_1.dll
==================== Alternate Data Streams (Whitelisted) ========
==================== Safe Mode (Whitelisted) ==================
==================== Association (Whitelisted) =================
==================== Internet Explorer (Whitelisted) ==========
==================== Hosts content: =========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2022-05-07 06:24 - 2022-05-07 06:22 - 000000824 _____ C:\WINDOWS\system32\drivers\etc\hosts
==================== Other Areas ===========================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1367221443-249768293-1022394803-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\Windows\img0.jpg
HKU\S-1-5-21-1367221443-249768293-1022394803-1003\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Windows\img0.jpg
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
==================== FirewallRules (Whitelisted) ================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{F1897140-E243-4BBE-914C-9B95A67D1057}] => (Allow) C:\Program Files\WindowsApps\microsoftteams_23335.242.2641.4129_x64__8wekyb3d8bbwe\msteams.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{C85FFA7A-7848-43ED-B044-55EEBE6451D7}] => (Allow) C:\Program Files\WindowsApps\microsoftteams_23335.242.2641.4129_x64__8wekyb3d8bbwe\msteams.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{A53ED4E7-A3F0-472B-8823-2302F6073B8A}] => (Allow) C:\Program Files (x86)\Microsoft\EdgeWebView\Application\121.0.2277.98\msedgewebview2.exe (Microsoft Corporation -> Microsoft Corporation)
==================== Restore Points =========================
04-02-2024 02:53:08 Scheduled Checkpoint
==================== Faulty Device Manager Devices ============
Name: USB Mass Storage Device
Description: USB Mass Storage Device
Class Guid: {36fc9e60-c465-11cf-8056-444553540000}
Manufacturer: Compatible USB storage device
Service: USBSTOR
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Name: Unknown USB Device (Device Descriptor Request Failed)
Description: Unknown USB Device (Device Descriptor Request Failed)
Class Guid: {36fc9e60-c465-11cf-8056-444553540000}
Manufacturer: (Standard USB Host Controller)
Service:
Problem: : Windows has stopped this device because it has reported problems. (Code 43)
Resolution: One of the drivers controlling the device notified the operating system that the device failed in some manner. For more information about how to diagnose the problem, see the hardware documentation.
Name: TRANSCODER
Description: TRANSCODER
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Event log errors: ========================
Application errors:
==================
Error: (02/04/2024 10:52:26 AM) (Source: Application Error) (EventID: 1000) (User: CHUCHOTIS)
Description: Faulting application name: Widgets.exe, version: 424.1301.2520.0, time stamp: 0x65aae99e
Faulting module name: Widgets.exe, version: 424.1301.2520.0, time stamp: 0x65aae99e
Exception code: 0xc0000409
Fault offset: 0x000000000007351a
Faulting process id: 0x0x6f0
Faulting application start time: 0x0x1da574da123b30b
Faulting application path: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_424.1301.40.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe
Faulting module path: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_424.1301.40.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe
Report Id: 97d1c0a9-9be5-4e19-8aed-d2d798fdd60b
Faulting package full name: MicrosoftWindows.Client.WebExperience_424.1301.40.0_x64__cw5n1h2txyewy
Faulting package-relative application ID: Widgets
Error: (02/04/2024 09:30:48 AM) (Source: Microsoft-Windows-AppModel-State) (EventID: 13) (User: CHUCHOTIS)
Description: C:\Users\twist\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfigMicrosoftTeams_8wekyb3d8bbwe-2147024894
Error: (02/04/2024 01:29:57 AM) (Source: Microsoft-Windows-Defrag) (EventID: 264) (User: )
Description: The storage optimizer couldn't complete defragmentation on \\?\Volume{8e9211e9-c086-11ee-a495-806e6f6e6963}\ because: Volumes cannot be optimized due to file system type not supported. (0x8900002F)
Error: (02/04/2024 12:41:47 AM) (Source: SecurityCenter) (EventID: 16) (User: )
Description: Error while updating Windows Defender status to SECURITY_PRODUCT_STATE_ON.
Error: (02/04/2024 12:19:13 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: Failed to create restore point (Process = C:\AMD\WU-CCC2\ccc2_install\VC12RTx64\vcredist_x64.exe /q /norestart; Description = Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727; Error = 0x80042302).
Error: (02/04/2024 12:19:13 AM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x80070422, The service cannot be started, either because it is disabled or because it has no enabled devices associated with it..
Operation:
Instantiating VSS server
Error: (02/04/2024 12:19:13 AM) (Source: VSS) (EventID: 13) (User: )
Description: Volume Shadow Copy Service information: The COM Server with CLSID {e579ab5f-1cc4-44b4-bed9-de0991ff0623} and name IVssCoordinatorEx2 cannot be started. [0x80070422, The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.]
Operation:
Instantiating VSS server
Error: (02/04/2024 12:18:54 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: Failed to create restore point (Process = C:\AMD\WU-CCC2\ccc2_install\VC12RTx86\vcredist_x86.exe /q /norestart; Description = Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727; Error = 0x80042302).
System errors:
=============
Error: (02/04/2024 10:59:04 AM) (Source: DCOM) (EventID: 10010) (User: CHUCHOTIS)
Description: The server {8CFC164F-4BE5-4FDD-94E9-E2AF73ED4A19} did not register with DCOM within the required timeout.
Error: (02/04/2024 10:36:07 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Modules Installer service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
Error: (02/04/2024 10:36:07 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The NPSMSvc_10fd5e5 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 3000 milliseconds: Restart the service.
Error: (02/04/2024 10:36:07 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Udk User Service_10fd5e5 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 3000 milliseconds: Restart the service.
Error: (02/04/2024 10:36:03 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Security Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
Error: (02/04/2024 10:36:03 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The User Data Access_10fd5e5 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.
Error: (02/04/2024 10:36:03 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The User Data Storage_10fd5e5 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.
Error: (02/04/2024 10:36:03 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Contact Data_10fd5e5 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.
Windows Defender:
================
Date: 2024-02-04 11:41:59
Description:
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=Rogue:Win32/PrivacyCenter&threatid=140760&enterprise=0
Name: Rogue:Win32/PrivacyCenter
Severity: Severe
Category: Trojan
Path: file:_C:\Users\twist\Downloads\pre-scan_V9_18.10.19.1.exe; process:_pid:4544,ProcessStart:133515129183614727
Detection Origin: Local machine
Detection Type: Concrete
Detection Source: System
Process Name: C:\Users\twist\Downloads\pre-scan_V9_18.10.19.1.exe
Security intelligence Version: AV: 1.403.3133.0, AS: 1.403.3133.0, NIS: 0.0.0.0
Engine Version: AM: 1.1.23110.2, NIS: 0.0.0.0
Date: 2024-02-04 10:35:18
Description:
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=Rogue:Win32/PrivacyCenter&threatid=140760&enterprise=0
Name: Rogue:Win32/PrivacyCenter
Severity: Severe
Category: Trojan
Path: file:_C:\Users\twist\Downloads\pre-scan_V9_18.10.19.1.exe
Detection Origin: Local machine
Detection Type: Concrete
Detection Source: System
Process Name: Unknown
Security intelligence Version: AV: 1.403.3133.0, AS: 1.403.3133.0, NIS: 0.0.0.0
Engine Version: AM: 1.1.23110.2, NIS: 0.0.0.0
Date: 2024-02-04 10:31:07
Description:
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=Rogue:Win32/PrivacyCenter&threatid=140760&enterprise=0
Name: Rogue:Win32/PrivacyCenter
Severity: Severe
Category: Trojan
Path: file:_C:\Users\twist\Downloads\pre-scan_V9_18.10.19.1.exe; webfile:_C:\Users\twist\Downloads\pre-scan_V9_18.10.19.1.exe|https://download.toolslib.net/download/file/68/2185?s=96MAqGUcLOWW2IFRRI0UkCV9e0j8R8ea|pid:9600,ProcessStart:133515126321795871
Detection Origin: Internet
Detection Type: Concrete
Detection Source: Downloads and attachments
Process Name: C:\Windows\explorer.exe
Security intelligence Version: AV: 1.403.3133.0, AS: 1.403.3133.0, NIS: 1.403.3133.0
Engine Version: AM: 1.1.23110.2, NIS: 1.1.23110.2
Date: 2024-02-04 10:31:03
Description:
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=Rogue:Win32/PrivacyCenter&threatid=140760&enterprise=0
Name: Rogue:Win32/PrivacyCenter
Severity: Severe
Category: Trojan
Path: file:_C:\Users\twist\Downloads\pre-scan_V9_18.10.19.1.exe; webfile:_C:\Users\twist\Downloads\pre-scan_V9_18.10.19.1.exe|https://download.toolslib.net/download/file/68/2185?s=96MAqGUcLOWW2IFRRI0UkCV9e0j8R8ea|pid:9600,ProcessStart:133515126321795871
Detection Origin: Internet
Detection Type: Concrete
Detection Source: Downloads and attachments
Process Name: Unknown
Security intelligence Version: AV: 1.403.3133.0, AS: 1.403.3133.0, NIS: 1.403.3133.0
Engine Version: AM: 1.1.23110.2, NIS: 1.1.23110.2
==================== Memory info ===========================
BIOS: AMI 8.17 01/25/2013
Motherboard: Hewlett-Packard 2AE3
Processor: AMD E1-1200 APU with Radeon(tm) HD Graphics
Percentage of memory in use: 83%
Total physical RAM: 3659.75 MB
Available physical RAM: 611.43 MB
Total Virtual: 5067.75 MB
Available Virtual: 1339.84 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:1862.5 GB) (Free:1772.47 GB) (Model: WDC WD20PURZ-85AKKY0 ATA Device) NTFS
Drive d: (AD-AWARE) (Removable) (Total:12.91 GB) (Free:4.96 GB) FAT32
Drive e: () (Removable) (Total:0 GB) (Free:0 GB)
Drive g: () (Removable) (Total:0 GB) (Free:0 GB)
Drive h: (Roxio Game Capture HD Pro) (CDROM) (Total:0.47 GB) (Free:0 GB) UDF
Drive i: () (Removable) (Total:0 GB) (Free:0 GB)
Drive j: (comodo resc) (Removable) (Total:0 GB) (Free:0 GB) exFAT
Drive k: (raspbian sifatal suga 2x) (Removable) (Total:3.68 GB) (Free:3.63 GB) NTFS
Drive l: (anti-ORLRem) (Removable) (Total:3.81 GB) (Free:3.78 GB) NTFS
Drive m: () (Removable) (Total:0 GB) (Free:0 GB)
Drive o: (power2go) (Removable) (Total:29.3 GB) (Free:26.88 GB) NTFS
Drive p: () (Removable) (Total:0 GB) (Free:0 GB)
Drive q: (POWER2GO) (Removable) (Total:14.63 GB) (Free:14.63 GB) FAT32
Drive r: () (Removable) (Total:0 GB) (Free:0 GB)
Drive s: () (Removable) (Total:0 GB) (Free:0 GB)
Drive t: () (Removable) (Total:0 GB) (Free:0 GB)
Drive u: (XUBUNTU 22_) (Removable) (Total:29.28 GB) (Free:26.44 GB) FAT32
\\?\Volume{89eef5a7-cf07-4c71-ac17-9898803de88c}\ (Recovery) (Fixed) (Total:0.29 GB) (Free:0.28 GB) NTFS
\\?\Volume{831d9722-2ad9-41d9-be92-6062dccb2975}\ () (Fixed) (Total:0.09 GB) (Free:0.06 GB) FAT32
\\?\Volume{6600f89c-5b6d-4ca0-a1ee-0f4fbb977adc}\ (OS X INSTAL) (Removable) (Total:0.19 GB) (Free:0.19 GB) FAT32
\\?\Volume{3fc62f18-accd-4f6f-9f41-2d09a09a8c6a}\ (ESP) (Removable) (Total:0 GB) (Free:0 GB) FAT
\\?\Volume{372b690f-268b-42e5-8c26-66db91e7557c}\ (ESP) (Removable) (Total:0 GB) (Free:0 GB) FAT
==================== MBR & Partition Table ====================
==========================================================
Disk: 0 (Protective MBR) (Size: 1863 GB) (Disk ID: 00000000)
Partition: GPT.
==========================================================
Disk: 1 (Size: 29.8 GB) (Disk ID: 83AB8A00)
==========================================================
Disk: 2 (Size: 30 GB) (Disk ID: 25C8BCC2)
Partition 1: (Active) - (Size=30 GB) - (Type=42)
Partition 2: (Not Active) - (Size=76 MB) - (Type=42)
==========================================================
Disk: 3 (Size: 29.3 GB) (Disk ID: 1344C9E8)
Partition 1: (Active) - (Size=669.3 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=32 KB) - (Type=EA)
Partition 00: (Not Active) - (Size=0) - (Type=00) ATTENTION ===> 0 byte partition bootkit.
Partition 00: (Not Active) - (Size=0) - (Type=00) ATTENTION ===> 0 byte partition bootkit.
==========================================================
Disk: 4 (Size: 14.6 GB) (Disk ID: 0905820A)
Partition: GPT.
==========================================================
Disk: 6 (Protective MBR) (Size: 29.3 GB) (Disk ID: 00000000)
Partition: GPT.
==========================================================
Disk: 7 (Protective MBR) (Size: 14.6 GB) (Disk ID: 00000000)
Partition: GPT.
==========================================================
Disk: 8 (Size: 7.5 GB) (Disk ID: B1681215)
Partition 1: (Active) - (Size=2272 KB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=3.7 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=3.8 GB) - (Type=07 NTFS)
==========================================================
Disk: 11 (MBR Code: Windows 7/8/10) (Size: 29.3 GB) (Disk ID: 7B96E8F8)
Partition 1: (Active) - (Size=29.3 GB) - (Type=07 NTFS)
Could not read MBR for disk 12.
==========================================================
Disk: 13 (Size: 14.6 GB) (Disk ID: 500A0DFF)
No partition Table on disk 13.
==========================================================
Disk: 14 (Protective MBR) (Size: 28.9 GB) (Disk ID: 00000000)
Partition: GPT.
==========================================================
Disk: 15 (MBR Code: Windows 7/8/10) (Size: 250 GB) (Disk ID: 69737369)
Partition 1: (Not Active) - (Size=250 GB) - (Type=04)
==========================================================
Disk: 16 (Size: 29.3 GB) (Disk ID: 057A90F2)
Partition 1: (Active) - (Size=29.3 GB) - (Type=FAT32)
==================== End of Addition.txt =======================
Ran by twist (04-02-2024 11:39:20)
Running from C:\Users\twist\Desktop
Microsoft Windows 11 Pro Version 22H2 22621.525 (X64) (2024-02-04 00:27:42)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
(If an entry is included in the fixlist, it will be removed.)
Administrator (S-1-5-21-1367221443-249768293-1022394803-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1367221443-249768293-1022394803-503 - Limited - Disabled)
Guest (S-1-5-21-1367221443-249768293-1022394803-501 - Limited - Disabled)
twist (S-1-5-21-1367221443-249768293-1022394803-1001 - Administrator - Enabled) => C:\Users\twist
WDAGUtilityAccount (S-1-5-21-1367221443-249768293-1022394803-504 - Limited - Disabled)
_ashbackup_ (S-1-5-21-1367221443-249768293-1022394803-1003 - Administrator - Enabled) => C:\Users\_ashbackup_
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
AMD Catalyst Control Center (HKLM-x32\...\WUCCCApp) (Version: 1.00.0000 - AMD)
Catalyst Control Center - Branding (HKLM-x32\...\{11087D24-567D-7D88-69C6-D7A08B5F4C47}) (Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
MEmu (HKLM-x32\...\MEmu) (Version: 9.0.9.3 - Microvirt Software Technology Co., Ltd.)
Microsoft Edge (HKLM-x32\...\Microsoft Edge) (Version: 121.0.2277.98 - Microsoft Corporation)
Microsoft Edge WebView2 Runtime (HKLM-x32\...\Microsoft EdgeWebView) (Version: 121.0.2277.98 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1367221443-249768293-1022394803-1001\...\OneDriveSetup.exe) (Version: 24.010.0114.0003 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (HKLM\...\{AC53FC8B-EE18-3F9C-9B59-60937D0B182C}) (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (HKLM\...\{A2CB1ACB-94A2-32BA-A15E-7D80319F7589}) (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (HKLM-x32\...\{FDB30193-FDA0-3DAA-ACCA-A75EEFE53607}) (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (HKLM-x32\...\{2F73A7B2-E50E-39A6-9ABC-EF89E4C62E36}) (Version: 11.0.50727 - Microsoft Corporation) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7004 - Realtek Semiconductor Corp.)
Packages:
=========
Solitaire & Casual Games -> C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.18.11020.0_x64__8wekyb3d8bbwe [2024-02-04] (Microsoft Studios) [MS Ad]
==================== Custom CLSID (Whitelisted): ==============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
ContextMenuHandlers5: [ACE] -> {5E2121EE-0300-11D4-8D3B-444553540000} => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\atiacm64.dll [2015-08-21] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.)
==================== Codecs (Whitelisted) ====================
==================== Shortcuts & WMI ========================
(The entries could be listed to be restored or removed.)
ShortcutWithArgument: C:\Users\twist\Desktop\Pre_Scan_Donate.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxps://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=S3AQ8V3XRWWYN
==================== Loaded Modules (Whitelisted) =============
2024-02-04 10:02 - 2017-06-14 07:13 - 000768512 _____ (The curl library, hxxps://curl.haxx.se/) [File not signed] C:\Program Files\Microvirt\MEmuHyperv\libcurl.dll
2024-02-04 10:01 - 2023-05-10 10:25 - 000418304 _____ (The curl library, hxxps://curl.se/) [File not signed] C:\Program Files\Microvirt\MEmu\libcurl.dll
2024-02-04 10:02 - 2017-05-25 14:20 - 002887168 _____ (The OpenSSL Project, hxxp://www.openssl.org/) [File not signed] C:\Program Files\Microvirt\MEmuHyperv\libcrypto-1_1-x64.dll
2024-02-04 10:02 - 2017-05-25 14:20 - 000479744 _____ (The OpenSSL Project, hxxp://www.openssl.org/) [File not signed] C:\Program Files\Microvirt\MEmuHyperv\libssl-1_1-x64.dll
2024-02-04 10:01 - 2023-05-10 10:25 - 002159104 _____ (The OpenSSL Project, hxxps://www.openssl.org/) [File not signed] C:\Program Files\Microvirt\MEmu\libcrypto-1_1.dll
2024-02-04 10:01 - 2023-05-10 10:25 - 000499712 _____ (The OpenSSL Project, hxxps://www.openssl.org/) [File not signed] C:\Program Files\Microvirt\MEmu\libssl-1_1.dll
==================== Alternate Data Streams (Whitelisted) ========
==================== Safe Mode (Whitelisted) ==================
==================== Association (Whitelisted) =================
==================== Internet Explorer (Whitelisted) ==========
==================== Hosts content: =========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2022-05-07 06:24 - 2022-05-07 06:22 - 000000824 _____ C:\WINDOWS\system32\drivers\etc\hosts
==================== Other Areas ===========================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1367221443-249768293-1022394803-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\Windows\img0.jpg
HKU\S-1-5-21-1367221443-249768293-1022394803-1003\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Windows\img0.jpg
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
==================== FirewallRules (Whitelisted) ================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{F1897140-E243-4BBE-914C-9B95A67D1057}] => (Allow) C:\Program Files\WindowsApps\microsoftteams_23335.242.2641.4129_x64__8wekyb3d8bbwe\msteams.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{C85FFA7A-7848-43ED-B044-55EEBE6451D7}] => (Allow) C:\Program Files\WindowsApps\microsoftteams_23335.242.2641.4129_x64__8wekyb3d8bbwe\msteams.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{A53ED4E7-A3F0-472B-8823-2302F6073B8A}] => (Allow) C:\Program Files (x86)\Microsoft\EdgeWebView\Application\121.0.2277.98\msedgewebview2.exe (Microsoft Corporation -> Microsoft Corporation)
==================== Restore Points =========================
04-02-2024 02:53:08 Scheduled Checkpoint
==================== Faulty Device Manager Devices ============
Name: USB Mass Storage Device
Description: USB Mass Storage Device
Class Guid: {36fc9e60-c465-11cf-8056-444553540000}
Manufacturer: Compatible USB storage device
Service: USBSTOR
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Name: Unknown USB Device (Device Descriptor Request Failed)
Description: Unknown USB Device (Device Descriptor Request Failed)
Class Guid: {36fc9e60-c465-11cf-8056-444553540000}
Manufacturer: (Standard USB Host Controller)
Service:
Problem: : Windows has stopped this device because it has reported problems. (Code 43)
Resolution: One of the drivers controlling the device notified the operating system that the device failed in some manner. For more information about how to diagnose the problem, see the hardware documentation.
Name: TRANSCODER
Description: TRANSCODER
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Event log errors: ========================
Application errors:
==================
Error: (02/04/2024 10:52:26 AM) (Source: Application Error) (EventID: 1000) (User: CHUCHOTIS)
Description: Faulting application name: Widgets.exe, version: 424.1301.2520.0, time stamp: 0x65aae99e
Faulting module name: Widgets.exe, version: 424.1301.2520.0, time stamp: 0x65aae99e
Exception code: 0xc0000409
Fault offset: 0x000000000007351a
Faulting process id: 0x0x6f0
Faulting application start time: 0x0x1da574da123b30b
Faulting application path: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_424.1301.40.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe
Faulting module path: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_424.1301.40.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe
Report Id: 97d1c0a9-9be5-4e19-8aed-d2d798fdd60b
Faulting package full name: MicrosoftWindows.Client.WebExperience_424.1301.40.0_x64__cw5n1h2txyewy
Faulting package-relative application ID: Widgets
Error: (02/04/2024 09:30:48 AM) (Source: Microsoft-Windows-AppModel-State) (EventID: 13) (User: CHUCHOTIS)
Description: C:\Users\twist\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfigMicrosoftTeams_8wekyb3d8bbwe-2147024894
Error: (02/04/2024 01:29:57 AM) (Source: Microsoft-Windows-Defrag) (EventID: 264) (User: )
Description: The storage optimizer couldn't complete defragmentation on \\?\Volume{8e9211e9-c086-11ee-a495-806e6f6e6963}\ because: Volumes cannot be optimized due to file system type not supported. (0x8900002F)
Error: (02/04/2024 12:41:47 AM) (Source: SecurityCenter) (EventID: 16) (User: )
Description: Error while updating Windows Defender status to SECURITY_PRODUCT_STATE_ON.
Error: (02/04/2024 12:19:13 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: Failed to create restore point (Process = C:\AMD\WU-CCC2\ccc2_install\VC12RTx64\vcredist_x64.exe /q /norestart; Description = Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727; Error = 0x80042302).
Error: (02/04/2024 12:19:13 AM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x80070422, The service cannot be started, either because it is disabled or because it has no enabled devices associated with it..
Operation:
Instantiating VSS server
Error: (02/04/2024 12:19:13 AM) (Source: VSS) (EventID: 13) (User: )
Description: Volume Shadow Copy Service information: The COM Server with CLSID {e579ab5f-1cc4-44b4-bed9-de0991ff0623} and name IVssCoordinatorEx2 cannot be started. [0x80070422, The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.]
Operation:
Instantiating VSS server
Error: (02/04/2024 12:18:54 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: Failed to create restore point (Process = C:\AMD\WU-CCC2\ccc2_install\VC12RTx86\vcredist_x86.exe /q /norestart; Description = Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727; Error = 0x80042302).
System errors:
=============
Error: (02/04/2024 10:59:04 AM) (Source: DCOM) (EventID: 10010) (User: CHUCHOTIS)
Description: The server {8CFC164F-4BE5-4FDD-94E9-E2AF73ED4A19} did not register with DCOM within the required timeout.
Error: (02/04/2024 10:36:07 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Modules Installer service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
Error: (02/04/2024 10:36:07 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The NPSMSvc_10fd5e5 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 3000 milliseconds: Restart the service.
Error: (02/04/2024 10:36:07 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Udk User Service_10fd5e5 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 3000 milliseconds: Restart the service.
Error: (02/04/2024 10:36:03 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Security Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
Error: (02/04/2024 10:36:03 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The User Data Access_10fd5e5 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.
Error: (02/04/2024 10:36:03 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The User Data Storage_10fd5e5 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.
Error: (02/04/2024 10:36:03 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Contact Data_10fd5e5 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.
Windows Defender:
================
Date: 2024-02-04 11:41:59
Description:
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=Rogue:Win32/PrivacyCenter&threatid=140760&enterprise=0
Name: Rogue:Win32/PrivacyCenter
Severity: Severe
Category: Trojan
Path: file:_C:\Users\twist\Downloads\pre-scan_V9_18.10.19.1.exe; process:_pid:4544,ProcessStart:133515129183614727
Detection Origin: Local machine
Detection Type: Concrete
Detection Source: System
Process Name: C:\Users\twist\Downloads\pre-scan_V9_18.10.19.1.exe
Security intelligence Version: AV: 1.403.3133.0, AS: 1.403.3133.0, NIS: 0.0.0.0
Engine Version: AM: 1.1.23110.2, NIS: 0.0.0.0
Date: 2024-02-04 10:35:18
Description:
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=Rogue:Win32/PrivacyCenter&threatid=140760&enterprise=0
Name: Rogue:Win32/PrivacyCenter
Severity: Severe
Category: Trojan
Path: file:_C:\Users\twist\Downloads\pre-scan_V9_18.10.19.1.exe
Detection Origin: Local machine
Detection Type: Concrete
Detection Source: System
Process Name: Unknown
Security intelligence Version: AV: 1.403.3133.0, AS: 1.403.3133.0, NIS: 0.0.0.0
Engine Version: AM: 1.1.23110.2, NIS: 0.0.0.0
Date: 2024-02-04 10:31:07
Description:
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=Rogue:Win32/PrivacyCenter&threatid=140760&enterprise=0
Name: Rogue:Win32/PrivacyCenter
Severity: Severe
Category: Trojan
Path: file:_C:\Users\twist\Downloads\pre-scan_V9_18.10.19.1.exe; webfile:_C:\Users\twist\Downloads\pre-scan_V9_18.10.19.1.exe|https://download.toolslib.net/download/file/68/2185?s=96MAqGUcLOWW2IFRRI0UkCV9e0j8R8ea|pid:9600,ProcessStart:133515126321795871
Detection Origin: Internet
Detection Type: Concrete
Detection Source: Downloads and attachments
Process Name: C:\Windows\explorer.exe
Security intelligence Version: AV: 1.403.3133.0, AS: 1.403.3133.0, NIS: 1.403.3133.0
Engine Version: AM: 1.1.23110.2, NIS: 1.1.23110.2
Date: 2024-02-04 10:31:03
Description:
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=Rogue:Win32/PrivacyCenter&threatid=140760&enterprise=0
Name: Rogue:Win32/PrivacyCenter
Severity: Severe
Category: Trojan
Path: file:_C:\Users\twist\Downloads\pre-scan_V9_18.10.19.1.exe; webfile:_C:\Users\twist\Downloads\pre-scan_V9_18.10.19.1.exe|https://download.toolslib.net/download/file/68/2185?s=96MAqGUcLOWW2IFRRI0UkCV9e0j8R8ea|pid:9600,ProcessStart:133515126321795871
Detection Origin: Internet
Detection Type: Concrete
Detection Source: Downloads and attachments
Process Name: Unknown
Security intelligence Version: AV: 1.403.3133.0, AS: 1.403.3133.0, NIS: 1.403.3133.0
Engine Version: AM: 1.1.23110.2, NIS: 1.1.23110.2
==================== Memory info ===========================
BIOS: AMI 8.17 01/25/2013
Motherboard: Hewlett-Packard 2AE3
Processor: AMD E1-1200 APU with Radeon(tm) HD Graphics
Percentage of memory in use: 83%
Total physical RAM: 3659.75 MB
Available physical RAM: 611.43 MB
Total Virtual: 5067.75 MB
Available Virtual: 1339.84 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:1862.5 GB) (Free:1772.47 GB) (Model: WDC WD20PURZ-85AKKY0 ATA Device) NTFS
Drive d: (AD-AWARE) (Removable) (Total:12.91 GB) (Free:4.96 GB) FAT32
Drive e: () (Removable) (Total:0 GB) (Free:0 GB)
Drive g: () (Removable) (Total:0 GB) (Free:0 GB)
Drive h: (Roxio Game Capture HD Pro) (CDROM) (Total:0.47 GB) (Free:0 GB) UDF
Drive i: () (Removable) (Total:0 GB) (Free:0 GB)
Drive j: (comodo resc) (Removable) (Total:0 GB) (Free:0 GB) exFAT
Drive k: (raspbian sifatal suga 2x) (Removable) (Total:3.68 GB) (Free:3.63 GB) NTFS
Drive l: (anti-ORLRem) (Removable) (Total:3.81 GB) (Free:3.78 GB) NTFS
Drive m: () (Removable) (Total:0 GB) (Free:0 GB)
Drive o: (power2go) (Removable) (Total:29.3 GB) (Free:26.88 GB) NTFS
Drive p: () (Removable) (Total:0 GB) (Free:0 GB)
Drive q: (POWER2GO) (Removable) (Total:14.63 GB) (Free:14.63 GB) FAT32
Drive r: () (Removable) (Total:0 GB) (Free:0 GB)
Drive s: () (Removable) (Total:0 GB) (Free:0 GB)
Drive t: () (Removable) (Total:0 GB) (Free:0 GB)
Drive u: (XUBUNTU 22_) (Removable) (Total:29.28 GB) (Free:26.44 GB) FAT32
\\?\Volume{89eef5a7-cf07-4c71-ac17-9898803de88c}\ (Recovery) (Fixed) (Total:0.29 GB) (Free:0.28 GB) NTFS
\\?\Volume{831d9722-2ad9-41d9-be92-6062dccb2975}\ () (Fixed) (Total:0.09 GB) (Free:0.06 GB) FAT32
\\?\Volume{6600f89c-5b6d-4ca0-a1ee-0f4fbb977adc}\ (OS X INSTAL) (Removable) (Total:0.19 GB) (Free:0.19 GB) FAT32
\\?\Volume{3fc62f18-accd-4f6f-9f41-2d09a09a8c6a}\ (ESP) (Removable) (Total:0 GB) (Free:0 GB) FAT
\\?\Volume{372b690f-268b-42e5-8c26-66db91e7557c}\ (ESP) (Removable) (Total:0 GB) (Free:0 GB) FAT
==================== MBR & Partition Table ====================
==========================================================
Disk: 0 (Protective MBR) (Size: 1863 GB) (Disk ID: 00000000)
Partition: GPT.
==========================================================
Disk: 1 (Size: 29.8 GB) (Disk ID: 83AB8A00)
==========================================================
Disk: 2 (Size: 30 GB) (Disk ID: 25C8BCC2)
Partition 1: (Active) - (Size=30 GB) - (Type=42)
Partition 2: (Not Active) - (Size=76 MB) - (Type=42)
==========================================================
Disk: 3 (Size: 29.3 GB) (Disk ID: 1344C9E8)
Partition 1: (Active) - (Size=669.3 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=32 KB) - (Type=EA)
Partition 00: (Not Active) - (Size=0) - (Type=00) ATTENTION ===> 0 byte partition bootkit.
Partition 00: (Not Active) - (Size=0) - (Type=00) ATTENTION ===> 0 byte partition bootkit.
==========================================================
Disk: 4 (Size: 14.6 GB) (Disk ID: 0905820A)
Partition: GPT.
==========================================================
Disk: 6 (Protective MBR) (Size: 29.3 GB) (Disk ID: 00000000)
Partition: GPT.
==========================================================
Disk: 7 (Protective MBR) (Size: 14.6 GB) (Disk ID: 00000000)
Partition: GPT.
==========================================================
Disk: 8 (Size: 7.5 GB) (Disk ID: B1681215)
Partition 1: (Active) - (Size=2272 KB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=3.7 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=3.8 GB) - (Type=07 NTFS)
==========================================================
Disk: 11 (MBR Code: Windows 7/8/10) (Size: 29.3 GB) (Disk ID: 7B96E8F8)
Partition 1: (Active) - (Size=29.3 GB) - (Type=07 NTFS)
Could not read MBR for disk 12.
==========================================================
Disk: 13 (Size: 14.6 GB) (Disk ID: 500A0DFF)
No partition Table on disk 13.
==========================================================
Disk: 14 (Protective MBR) (Size: 28.9 GB) (Disk ID: 00000000)
Partition: GPT.
==========================================================
Disk: 15 (MBR Code: Windows 7/8/10) (Size: 250 GB) (Disk ID: 69737369)
Partition 1: (Not Active) - (Size=250 GB) - (Type=04)
==========================================================
Disk: 16 (Size: 29.3 GB) (Disk ID: 057A90F2)
Partition 1: (Active) - (Size=29.3 GB) - (Type=FAT32)
==================== End of Addition.txt =======================