Publicité
Publicité
Format du document : text/plain
Prévisualisation
Additional scan result of Farbar Recovery Scan Tool (x64) Version:27-04-2016
Ran by hamidalani (2016-04-30 16:51:28)
Running from C:\Users\hamidalani\Desktop
Windows 8.1 Pro (X64) (2016-04-04 19:38:46)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-2490970796-2538201055-388478953-500 - Administrator - Disabled)
Guest (S-1-5-21-2490970796-2538201055-388478953-501 - Limited - Disabled)
hamidalani (S-1-5-21-2490970796-2538201055-388478953-1001 - Administrator - Enabled) => C:\Users\hamidalani
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: ESET Smart Security 9.0.375.1 (Disabled - Up to date) {19259FAE-8396-A113-46DB-15B0E7DFA289}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: ESET Smart Security 9.0.375.1 (Disabled - Up to date) {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834}
FW: جدار الحماية الشخصي ESET (Enabled) {211E1E8B-C9F9-A04B-6D84-BC85190CE5F2}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
AMD Catalyst Install Manager (HKLM\...\{66AFB595-BC05-2913-7696-6D58F9B733E1}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
Ant Download Manager version 0.3.4.beta (HKLM-x32\...\{754CB6A3-3FE2-40DA-9FE5-2864909BD1CC}_is1) (Version: 0.3.4.beta - AntGROUP, Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.07 - Piriform)
Driver Booster 2.1 (HKLM-x32\...\Driver Booster_is1) (Version: 2.1 - IObit)
Driver Talent (HKLM-x32\...\{29FE44D7-BC89-4188-8B0E-F6BA073C15A5}_is1) (Version: 6.4.42.136 - OSToto Co., Ltd.)
ESET Smart Security (HKLM\...\{90174CED-A8D5-44AF-A0DC-F42DCB348BE5}) (Version: 9.0.375.1 - ESET, spol. s r.o.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 49.0.2623.112 - Google Inc.)
Google Update Helper (x32 Version: 1.3.29.5 - Google Inc.) Hidden
HP 3D DriveGuard (HKLM\...\{54CE68A8-4F2D-4328-B1F7-D6C720405F7F}) (Version: 4.2.9.1 - Hewlett-Packard Company)
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6498.0 - IDT)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.4276 - Intel Corporation)
Malwarebytes Anti-Malware النسخة 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Mediatek Bluetooth (HKLM\...\{16BCAEDC-C115-1729-07C4-7A0091C699A6}) (Version: 11.0.749.0 - Mediatek)
Microsoft Office Professional Plus 2016 - ar-sa (HKLM\...\ProPlusRetail - ar-sa) (Version: 16.0.4266.1003 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-2490970796-2538201055-388478953-1001\...\OneDriveSetup.exe) (Version: 17.3.6386.0412 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Office 16 Click-to-Run Extensibility Component (Version: 16.0.4266.1003 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (Version: 16.0.4266.1003 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (Version: 16.0.4266.1003 - Microsoft Corporation) Hidden
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 10.0.10586.29092 - Realtek Semiconduct Corp.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.10.12 - Synaptics Incorporated)
USB Video Device (HKLM-x32\...\{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}) (Version: 6.2.9200.10253 - Realtek Semiconductor Corp.)
Viber (HKU\S-1-5-21-2490970796-2538201055-388478953-1001\...\{6ac8839e-3aad-46d0-b1ae-484a26d68bab}) (Version: 5.9.0.115 - Viber Media Inc.)
Viber (x32 Version: 5.9.0.115 - Viber Media Inc.) Hidden
WinRAR 5.00 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.00.0 - win.rar GmbH)
ZHPFix 2015 (HKLM-x32\...\ZHPFix_is1) (Version: 2015 - Nicolas Coolman)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-2490970796-2538201055-388478953-1001_Classes\CLSID\{162C6FB5-44D3-435B-903D-E613FA093FB5}\InprocServer32 -> C:\Users\hamidalani\AppData\Local\Microsoft\OneDrive\17.3.6386.0412\amd64\FileCoAuthLib64.dll ()
CustomCLSID: HKU\S-1-5-21-2490970796-2538201055-388478953-1001_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\hamidalani\AppData\Local\Microsoft\OneDrive\17.3.6386.0412\FileCoAuth.exe (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2490970796-2538201055-388478953-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {028A832E-EB73-4004-BE61-C53FFBB47013} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-04-05] (Google Inc.)
Task: {0D8A891D-890C-4808-84D8-2F436AB14653} - \Microsoft\Windows\Application Experience\AitAgent -> No File <==== ATTENTION
Task: {1274336E-AB06-46B6-A48C-0671C5557CC6} - \Microsoft\Windows\TaskScheduler\Maintenance Configurator -> No File <==== ATTENTION
Task: {1687544D-7247-4F5A-965A-A6E920E55278} - \Microsoft\Windows\TaskScheduler\Manual Maintenance -> No File <==== ATTENTION
Task: {2CFD82DE-E835-4A60-B45A-79C500500988} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-04-05] (Google Inc.)
Task: {3C039675-149D-4F98-90FA-5DD59310F38B} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-06-01] (Piriform Ltd)
Task: {538C64B8-8DF4-4631-A44A-61A15DB66579} - System32\Tasks\Synaptics TouchPad Enhancements => Program Files\Synaptics\SynTP\SynTPEnh.exe
Task: {60CC66B6-5DDB-4650-A1FD-0FF58887568B} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files\Microsoft Office\root\Office16\msoia.exe [2016-04-29] (Microsoft Corporation)
Task: {6F02587F-8A2B-4552-97F6-DEEF229E335B} - \Microsoft\Windows\TaskScheduler\Idle Maintenance -> No File <==== ATTENTION
Task: {7FBA6235-1C21-4B05-B956-132EB0215B54} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2015-08-16] (Microsoft Corporation)
Task: {B7533644-AFA2-4CCB-A8D8-EA404836967C} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files\Microsoft Office\root\Office16\msoia.exe [2016-04-29] (Microsoft Corporation)
Task: {B7992938-01F1-4F40-A0EC-0D23D2F0F152} - \Microsoft\Windows\TaskScheduler\Regular Maintenance -> No File <==== ATTENTION
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - \Microsoft\Windows\SettingSync\BackupTask -> No File <==== ATTENTION
Task: {F35DAC6F-E90C-4ECC-A8A9-73E11B5610C5} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2015-08-16] (Microsoft Corporation)
Task: {FCF959F2-FDE7-4215-B57F-F37FAF6874B4} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-2490970796-2538201055-388478953-1001 => C:\Users\hamidalani\AppData\Local\Microsoft\OneDrive\OneDrive.exe [2016-04-29] (Microsoft Corporation)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
==================== Loaded Modules (Whitelisted) ==============
2016-04-29 00:20 - 2015-08-16 00:21 - 00162880 _____ () C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ApiClient.dll
2016-04-29 08:40 - 2016-04-29 08:40 - 00959176 _____ () C:\Users\hamidalani\AppData\Local\Microsoft\OneDrive\17.3.6386.0412\amd64\ClientTelemetry.dll
2016-04-05 21:06 - 2013-02-27 18:48 - 00212480 _____ () E:\Embratoria_G3\ES.exe
2016-04-05 00:51 - 2016-03-09 11:35 - 00147216 _____ () c:\program files (x86)\ostotosoft\drivertalent\ldrvsvc.dll
2016-04-05 00:51 - 2016-03-09 11:35 - 00186640 _____ () c:\program files (x86)\ostotosoft\drivertalent\CrashCatch.dll
2016-04-05 00:51 - 2016-03-09 11:35 - 00254824 _____ () c:\program files (x86)\ostotosoft\drivertalent\updater\checkupdate.dll
2016-04-05 00:51 - 2016-03-09 11:35 - 00165088 _____ () c:\program files (x86)\ostotosoft\drivertalent\substat.dll
2016-04-05 00:51 - 2016-03-09 11:35 - 00103776 _____ () c:\program files (x86)\ostotosoft\drivertalent\dstudp.dll
2016-04-05 00:51 - 2016-03-09 11:35 - 00117088 _____ () c:\program files (x86)\ostotosoft\drivertalent\udp.dll
2016-04-29 23:07 - 2016-04-30 15:34 - 00003584 _____ () C:\Users\hamidalani\AppData\Local\Temp\dateinj01.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 15:25 - 2016-04-20 14:05 - 00000826 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-2490970796-2538201055-388478953-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\hamidalani\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
HKLM\...\StartupApproved\Run: => "HotKeysCmds"
HKLM\...\StartupApproved\Run: => "SysTrayApp"
HKLM\...\StartupApproved\Run: => "IgfxTray"
HKLM\...\StartupApproved\Run: => "Persistence"
HKLM\...\StartupApproved\Run: => "RtsCM"
HKLM\...\StartupApproved\Run32: => "PWRISOVM.EXE"
HKLM\...\StartupApproved\Run32: => "StartCCC"
HKLM\...\StartupApproved\Run32: => "Raptr"
HKU\S-1-5-21-2490970796-2538201055-388478953-1001\...\StartupApproved\Run: => "AntDM"
HKU\S-1-5-21-2490970796-2538201055-388478953-1001\...\StartupApproved\Run: => "antMR"
HKU\S-1-5-21-2490970796-2538201055-388478953-1001\...\StartupApproved\Run: => "CCleaner Monitoring"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [TCP Query User{1B74AB7F-2F24-458B-B7CA-E746C8283136}C:\program files (x86)\ostotosoft\drivertalent\drivertalent.exe] => (Block) C:\program files (x86)\ostotosoft\drivertalent\drivertalent.exe
FirewallRules: [UDP Query User{314515D8-858A-4715-ACF9-FD6963988915}C:\program files (x86)\ostotosoft\drivertalent\drivertalent.exe] => (Block) C:\program files (x86)\ostotosoft\drivertalent\drivertalent.exe
FirewallRules: [{A331DC6C-AE6E-4C8C-B1A7-C69D27A4EB05}] => (Allow) C:\Program Files (x86)\OSTotoSoft\DriverTalent\DriverTalent.exe
FirewallRules: [{87DA18B3-2383-46ED-A589-C513236CE510}] => (Allow) C:\Program Files (x86)\OSTotoSoft\DriverTalent\download\MiniThunderPlatform.exe
FirewallRules: [{42E325BD-121E-4D5E-872A-2D739A234106}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{EF2DBA35-5090-4397-A073-7A6EA9FCFF1A}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{E9DD2CD0-9B94-462D-95F5-FAF5836EC59B}E:\embratoria_g3\es.exe] => (Allow) E:\embratoria_g3\es.exe
FirewallRules: [UDP Query User{5D3AA921-4631-4F32-A8B9-73D16997D4DD}E:\embratoria_g3\es.exe] => (Allow) E:\embratoria_g3\es.exe
FirewallRules: [{E0995A20-7056-4108-93D8-A8AE2329DDCD}] => (Allow) C:\Program Files (x86)\MEmu\MEmu.exe
FirewallRules: [{A4E438A0-CFBC-4679-8BEF-C5F11D7590F8}] => (Allow) C:\Program Files (x86)\MEmu\MEmu.exe
FirewallRules: [{B9B5E427-7527-4DFC-83E5-B1F41C261786}] => (Allow) C:\Program Files (x86)\OSTotoSoft\DriverTalent\DTLService.exe
FirewallRules: [{E159FF56-1CE1-4BB6-9442-CBCAB5027EA3}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{83DF851D-F102-4F26-B20B-5AE2F3FEAED2}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{03102637-8857-4103-BC3F-275BD08968FB}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{DB1E1FAB-7A27-47B4-A1F6-115BDA15664E}] => (Allow) C:\Users\hamidalani\AppData\Local\Microsoft\OneDrive\OneDrive.exe
FirewallRules: [{909F7DB9-F340-4258-9829-C5AD12E80F93}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\outlook.exe
FirewallRules: [{2126E0B1-22CC-431C-B4B8-53CFD103CBF3}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{3ABAAB84-C512-47FE-85B6-3E35A957DCF0}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{6C816A59-DB07-46EB-9687-744EC83C1225}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{D328E055-2BBD-49E8-9D1C-1D451660C994}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\UcMapi.exe
==================== Restore Points =========================
29-04-2016 00:55:02 Windows Update
29-04-2016 17:12:04 JRT Pre-Junkware Removal
29-04-2016 17:43:29 JRT Pre-Junkware Removal
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (04/29/2016 08:41:01 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start
Error: (04/29/2016 05:56:43 PM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT AUTHORITY)
Description: There was an error with the Windows Location Provider database
Error: (04/29/2016 05:47:13 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start
Error: (04/29/2016 05:35:43 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start
Error: (04/29/2016 03:38:40 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: اسم التطبيق الذي يحتوي على أخطاء: Viber.exe، الإصدار: 6.0.1.5، الطابع الزمني: 0x570e42ce
اسم الوحدة النمطية التي تحتوي على أخطاء: Qt5Gui.dll، الإصدار: 5.5.1.0، الطابع الزمني: 0x56ec1889
رمز الاستثناء: 0xc0000005
إزاحة الخطأ: 0x0004cb7b
معرّف العملية التي تحتوي على أخطاء: 0x1090
وقت بدء تشغيل التطبيق الذي يحتوي على أخطاء: 0xViber.exe0
مسار التطبيق الذي يحتوي على أخطاء: Viber.exe1
مسار الوحدة النمطية التي تحتوي على أخطاء: Viber.exe2
معرف التقرير: Viber.exe3
الاسم الكامل للحزمة التي تحتوي على أخطاء: Viber.exe4
معرف التطبيق المرتبط بالحزمة التي تحتوي على أخطاء: Viber.exe5
Error: (04/29/2016 12:59:47 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: hamid)
Description: فشل تنشيط التطبيق Microsoft.BingNews_8wekyb3d8bbwe!AppexNews مع حدوث الخطأ: -2147024894 راجع سجل Microsoft-Windows-TWinUI/Operational للحصول على معلومات إضافية.
Error: (04/29/2016 12:59:45 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: hamid)
Description: فشل تنشيط التطبيق Microsoft.BingNews_8wekyb3d8bbwe!AppexNews مع حدوث الخطأ: -2147024894 راجع سجل Microsoft-Windows-TWinUI/Operational للحصول على معلومات إضافية.
Error: (04/29/2016 12:40:57 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: hamid)
Description: فشل تنشيط التطبيق Microsoft.BingNews_8wekyb3d8bbwe!AppexNews مع حدوث الخطأ: -2147024894 راجع سجل Microsoft-Windows-TWinUI/Operational للحصول على معلومات إضافية.
Error: (04/29/2016 12:28:00 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: hamid)
Description: فشل تنشيط التطبيق Microsoft.BingNews_8wekyb3d8bbwe!AppexNews مع حدوث الخطأ: -2147024894 راجع سجل Microsoft-Windows-TWinUI/Operational للحصول على معلومات إضافية.
Error: (04/29/2016 12:20:58 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: hamid)
Description: فشل تنشيط التطبيق Microsoft.BingNews_8wekyb3d8bbwe!AppexNews مع حدوث الخطأ: -2147024894 راجع سجل Microsoft-Windows-TWinUI/Operational للحصول على معلومات إضافية.
System errors:
=============
Error: (04/30/2016 09:40:24 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)UnavailableUnavailable
Error: (04/30/2016 09:16:31 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: فشل التثبيت: فشل Windows في تثبيت التحديث التالي بسبب الخطأ 0x80070003: Microsoft.BingFoodAndDrink.
Error: (04/30/2016 09:16:25 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: فشل التثبيت: فشل Windows في تثبيت التحديث التالي بسبب الخطأ 0x80070003: Microsoft.BingHealthAndFitness.
Error: (04/30/2016 09:16:25 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: فشل التثبيت: فشل Windows في تثبيت التحديث التالي بسبب الخطأ 0x80070003: Microsoft.WindowsScan.
Error: (04/30/2016 09:16:18 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: فشل التثبيت: فشل Windows في تثبيت التحديث التالي بسبب الخطأ 0x80070003: Microsoft.BingTravel.
Error: (04/30/2016 09:16:18 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: فشل التثبيت: فشل Windows في تثبيت التحديث التالي بسبب الخطأ 0x80070003: Microsoft.BingFoodAndDrink.
Error: (04/30/2016 09:16:08 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: فشل التثبيت: فشل Windows في تثبيت التحديث التالي بسبب الخطأ 0x80070003: Microsoft.WindowsReadingList.
Error: (04/30/2016 09:16:08 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: فشل التثبيت: فشل Windows في تثبيت التحديث التالي بسبب الخطأ 0x80070003: Microsoft.Reader.
Error: (04/30/2016 12:39:26 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: تم تعليق الخدمة Device Setup Manager عند بدء التشغيل.
Error: (04/29/2016 08:52:48 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: فشل التثبيت: فشل Windows في تثبيت التحديث التالي بسبب الخطأ 0x80070003: Microsoft.BingFoodAndDrink.
CodeIntegrity:
===================================
Date: 2016-04-09 18:20:24.251
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\SRSLabs\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\sluapo64.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-04-09 18:03:03.984
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\SRSLabs\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\sluapo64.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-04-06 17:21:31.017
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\SRSLabs\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\sluapo64.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-04-06 17:21:07.894
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\SRSLabs\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\sluapo64.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-04-06 17:21:02.787
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\SRSLabs\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\sluapo64.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-04-06 17:06:10.486
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\SRSLabs\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\sluapo64.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-04-06 16:46:05.825
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\SRSLabs\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\sluapo64.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-04-06 16:45:47.856
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\SRSLabs\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\sluapo64.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-04-06 16:45:42.755
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\SRSLabs\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\sluapo64.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-04-06 16:43:26.919
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\SRSLabs\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\sluapo64.dll because the set of per-page image hashes could not be found on the system.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-3230M CPU @ 2.60GHz
Percentage of memory in use: 37%
Total physical RAM: 3994.36 MB
Available physical RAM: 2501.16 MB
Total Virtual: 8090.36 MB
Available Virtual: 6550.99 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:117.09 GB) (Free:77.89 GB) NTFS
Drive d: (Local Disk) (Fixed) (Total:0.1 GB) (Free:0.08 GB) NTFS
Drive e: () (Fixed) (Total:179.31 GB) (Free:177.87 GB) NTFS
Drive h: (Local Disk) (Fixed) (Total:148.08 GB) (Free:80.36 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive k: (حامد) (Fixed) (Total:21.19 GB) (Free:15.05 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: C499E06A)
Partition 1: (Not Active) - (Size=101 MB) - (Type=42)
Partition 2: (Not Active) - (Size=117.1 GB) - (Type=42)
Partition 3: (Not Active) - (Size=117.2 GB) - (Type=42)
Partition 4: (Active) - (Size=148.1 GB) - (Type=42)
==================== End of Addition.txt ============================
Ran by hamidalani (2016-04-30 16:51:28)
Running from C:\Users\hamidalani\Desktop
Windows 8.1 Pro (X64) (2016-04-04 19:38:46)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-2490970796-2538201055-388478953-500 - Administrator - Disabled)
Guest (S-1-5-21-2490970796-2538201055-388478953-501 - Limited - Disabled)
hamidalani (S-1-5-21-2490970796-2538201055-388478953-1001 - Administrator - Enabled) => C:\Users\hamidalani
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: ESET Smart Security 9.0.375.1 (Disabled - Up to date) {19259FAE-8396-A113-46DB-15B0E7DFA289}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: ESET Smart Security 9.0.375.1 (Disabled - Up to date) {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834}
FW: جدار الحماية الشخصي ESET (Enabled) {211E1E8B-C9F9-A04B-6D84-BC85190CE5F2}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
AMD Catalyst Install Manager (HKLM\...\{66AFB595-BC05-2913-7696-6D58F9B733E1}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
Ant Download Manager version 0.3.4.beta (HKLM-x32\...\{754CB6A3-3FE2-40DA-9FE5-2864909BD1CC}_is1) (Version: 0.3.4.beta - AntGROUP, Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.07 - Piriform)
Driver Booster 2.1 (HKLM-x32\...\Driver Booster_is1) (Version: 2.1 - IObit)
Driver Talent (HKLM-x32\...\{29FE44D7-BC89-4188-8B0E-F6BA073C15A5}_is1) (Version: 6.4.42.136 - OSToto Co., Ltd.)
ESET Smart Security (HKLM\...\{90174CED-A8D5-44AF-A0DC-F42DCB348BE5}) (Version: 9.0.375.1 - ESET, spol. s r.o.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 49.0.2623.112 - Google Inc.)
Google Update Helper (x32 Version: 1.3.29.5 - Google Inc.) Hidden
HP 3D DriveGuard (HKLM\...\{54CE68A8-4F2D-4328-B1F7-D6C720405F7F}) (Version: 4.2.9.1 - Hewlett-Packard Company)
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6498.0 - IDT)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.4276 - Intel Corporation)
Malwarebytes Anti-Malware النسخة 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Mediatek Bluetooth (HKLM\...\{16BCAEDC-C115-1729-07C4-7A0091C699A6}) (Version: 11.0.749.0 - Mediatek)
Microsoft Office Professional Plus 2016 - ar-sa (HKLM\...\ProPlusRetail - ar-sa) (Version: 16.0.4266.1003 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-2490970796-2538201055-388478953-1001\...\OneDriveSetup.exe) (Version: 17.3.6386.0412 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Office 16 Click-to-Run Extensibility Component (Version: 16.0.4266.1003 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (Version: 16.0.4266.1003 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (Version: 16.0.4266.1003 - Microsoft Corporation) Hidden
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 10.0.10586.29092 - Realtek Semiconduct Corp.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.10.12 - Synaptics Incorporated)
USB Video Device (HKLM-x32\...\{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}) (Version: 6.2.9200.10253 - Realtek Semiconductor Corp.)
Viber (HKU\S-1-5-21-2490970796-2538201055-388478953-1001\...\{6ac8839e-3aad-46d0-b1ae-484a26d68bab}) (Version: 5.9.0.115 - Viber Media Inc.)
Viber (x32 Version: 5.9.0.115 - Viber Media Inc.) Hidden
WinRAR 5.00 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.00.0 - win.rar GmbH)
ZHPFix 2015 (HKLM-x32\...\ZHPFix_is1) (Version: 2015 - Nicolas Coolman)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-2490970796-2538201055-388478953-1001_Classes\CLSID\{162C6FB5-44D3-435B-903D-E613FA093FB5}\InprocServer32 -> C:\Users\hamidalani\AppData\Local\Microsoft\OneDrive\17.3.6386.0412\amd64\FileCoAuthLib64.dll ()
CustomCLSID: HKU\S-1-5-21-2490970796-2538201055-388478953-1001_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\hamidalani\AppData\Local\Microsoft\OneDrive\17.3.6386.0412\FileCoAuth.exe (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2490970796-2538201055-388478953-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {028A832E-EB73-4004-BE61-C53FFBB47013} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-04-05] (Google Inc.)
Task: {0D8A891D-890C-4808-84D8-2F436AB14653} - \Microsoft\Windows\Application Experience\AitAgent -> No File <==== ATTENTION
Task: {1274336E-AB06-46B6-A48C-0671C5557CC6} - \Microsoft\Windows\TaskScheduler\Maintenance Configurator -> No File <==== ATTENTION
Task: {1687544D-7247-4F5A-965A-A6E920E55278} - \Microsoft\Windows\TaskScheduler\Manual Maintenance -> No File <==== ATTENTION
Task: {2CFD82DE-E835-4A60-B45A-79C500500988} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-04-05] (Google Inc.)
Task: {3C039675-149D-4F98-90FA-5DD59310F38B} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-06-01] (Piriform Ltd)
Task: {538C64B8-8DF4-4631-A44A-61A15DB66579} - System32\Tasks\Synaptics TouchPad Enhancements => Program Files\Synaptics\SynTP\SynTPEnh.exe
Task: {60CC66B6-5DDB-4650-A1FD-0FF58887568B} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files\Microsoft Office\root\Office16\msoia.exe [2016-04-29] (Microsoft Corporation)
Task: {6F02587F-8A2B-4552-97F6-DEEF229E335B} - \Microsoft\Windows\TaskScheduler\Idle Maintenance -> No File <==== ATTENTION
Task: {7FBA6235-1C21-4B05-B956-132EB0215B54} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2015-08-16] (Microsoft Corporation)
Task: {B7533644-AFA2-4CCB-A8D8-EA404836967C} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files\Microsoft Office\root\Office16\msoia.exe [2016-04-29] (Microsoft Corporation)
Task: {B7992938-01F1-4F40-A0EC-0D23D2F0F152} - \Microsoft\Windows\TaskScheduler\Regular Maintenance -> No File <==== ATTENTION
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - \Microsoft\Windows\SettingSync\BackupTask -> No File <==== ATTENTION
Task: {F35DAC6F-E90C-4ECC-A8A9-73E11B5610C5} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2015-08-16] (Microsoft Corporation)
Task: {FCF959F2-FDE7-4215-B57F-F37FAF6874B4} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-2490970796-2538201055-388478953-1001 => C:\Users\hamidalani\AppData\Local\Microsoft\OneDrive\OneDrive.exe [2016-04-29] (Microsoft Corporation)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
==================== Loaded Modules (Whitelisted) ==============
2016-04-29 00:20 - 2015-08-16 00:21 - 00162880 _____ () C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ApiClient.dll
2016-04-29 08:40 - 2016-04-29 08:40 - 00959176 _____ () C:\Users\hamidalani\AppData\Local\Microsoft\OneDrive\17.3.6386.0412\amd64\ClientTelemetry.dll
2016-04-05 21:06 - 2013-02-27 18:48 - 00212480 _____ () E:\Embratoria_G3\ES.exe
2016-04-05 00:51 - 2016-03-09 11:35 - 00147216 _____ () c:\program files (x86)\ostotosoft\drivertalent\ldrvsvc.dll
2016-04-05 00:51 - 2016-03-09 11:35 - 00186640 _____ () c:\program files (x86)\ostotosoft\drivertalent\CrashCatch.dll
2016-04-05 00:51 - 2016-03-09 11:35 - 00254824 _____ () c:\program files (x86)\ostotosoft\drivertalent\updater\checkupdate.dll
2016-04-05 00:51 - 2016-03-09 11:35 - 00165088 _____ () c:\program files (x86)\ostotosoft\drivertalent\substat.dll
2016-04-05 00:51 - 2016-03-09 11:35 - 00103776 _____ () c:\program files (x86)\ostotosoft\drivertalent\dstudp.dll
2016-04-05 00:51 - 2016-03-09 11:35 - 00117088 _____ () c:\program files (x86)\ostotosoft\drivertalent\udp.dll
2016-04-29 23:07 - 2016-04-30 15:34 - 00003584 _____ () C:\Users\hamidalani\AppData\Local\Temp\dateinj01.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 15:25 - 2016-04-20 14:05 - 00000826 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-2490970796-2538201055-388478953-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\hamidalani\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
HKLM\...\StartupApproved\Run: => "HotKeysCmds"
HKLM\...\StartupApproved\Run: => "SysTrayApp"
HKLM\...\StartupApproved\Run: => "IgfxTray"
HKLM\...\StartupApproved\Run: => "Persistence"
HKLM\...\StartupApproved\Run: => "RtsCM"
HKLM\...\StartupApproved\Run32: => "PWRISOVM.EXE"
HKLM\...\StartupApproved\Run32: => "StartCCC"
HKLM\...\StartupApproved\Run32: => "Raptr"
HKU\S-1-5-21-2490970796-2538201055-388478953-1001\...\StartupApproved\Run: => "AntDM"
HKU\S-1-5-21-2490970796-2538201055-388478953-1001\...\StartupApproved\Run: => "antMR"
HKU\S-1-5-21-2490970796-2538201055-388478953-1001\...\StartupApproved\Run: => "CCleaner Monitoring"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [TCP Query User{1B74AB7F-2F24-458B-B7CA-E746C8283136}C:\program files (x86)\ostotosoft\drivertalent\drivertalent.exe] => (Block) C:\program files (x86)\ostotosoft\drivertalent\drivertalent.exe
FirewallRules: [UDP Query User{314515D8-858A-4715-ACF9-FD6963988915}C:\program files (x86)\ostotosoft\drivertalent\drivertalent.exe] => (Block) C:\program files (x86)\ostotosoft\drivertalent\drivertalent.exe
FirewallRules: [{A331DC6C-AE6E-4C8C-B1A7-C69D27A4EB05}] => (Allow) C:\Program Files (x86)\OSTotoSoft\DriverTalent\DriverTalent.exe
FirewallRules: [{87DA18B3-2383-46ED-A589-C513236CE510}] => (Allow) C:\Program Files (x86)\OSTotoSoft\DriverTalent\download\MiniThunderPlatform.exe
FirewallRules: [{42E325BD-121E-4D5E-872A-2D739A234106}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{EF2DBA35-5090-4397-A073-7A6EA9FCFF1A}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{E9DD2CD0-9B94-462D-95F5-FAF5836EC59B}E:\embratoria_g3\es.exe] => (Allow) E:\embratoria_g3\es.exe
FirewallRules: [UDP Query User{5D3AA921-4631-4F32-A8B9-73D16997D4DD}E:\embratoria_g3\es.exe] => (Allow) E:\embratoria_g3\es.exe
FirewallRules: [{E0995A20-7056-4108-93D8-A8AE2329DDCD}] => (Allow) C:\Program Files (x86)\MEmu\MEmu.exe
FirewallRules: [{A4E438A0-CFBC-4679-8BEF-C5F11D7590F8}] => (Allow) C:\Program Files (x86)\MEmu\MEmu.exe
FirewallRules: [{B9B5E427-7527-4DFC-83E5-B1F41C261786}] => (Allow) C:\Program Files (x86)\OSTotoSoft\DriverTalent\DTLService.exe
FirewallRules: [{E159FF56-1CE1-4BB6-9442-CBCAB5027EA3}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{83DF851D-F102-4F26-B20B-5AE2F3FEAED2}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{03102637-8857-4103-BC3F-275BD08968FB}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{DB1E1FAB-7A27-47B4-A1F6-115BDA15664E}] => (Allow) C:\Users\hamidalani\AppData\Local\Microsoft\OneDrive\OneDrive.exe
FirewallRules: [{909F7DB9-F340-4258-9829-C5AD12E80F93}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\outlook.exe
FirewallRules: [{2126E0B1-22CC-431C-B4B8-53CFD103CBF3}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{3ABAAB84-C512-47FE-85B6-3E35A957DCF0}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{6C816A59-DB07-46EB-9687-744EC83C1225}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{D328E055-2BBD-49E8-9D1C-1D451660C994}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\UcMapi.exe
==================== Restore Points =========================
29-04-2016 00:55:02 Windows Update
29-04-2016 17:12:04 JRT Pre-Junkware Removal
29-04-2016 17:43:29 JRT Pre-Junkware Removal
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (04/29/2016 08:41:01 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start
Error: (04/29/2016 05:56:43 PM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT AUTHORITY)
Description: There was an error with the Windows Location Provider database
Error: (04/29/2016 05:47:13 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start
Error: (04/29/2016 05:35:43 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start
Error: (04/29/2016 03:38:40 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: اسم التطبيق الذي يحتوي على أخطاء: Viber.exe، الإصدار: 6.0.1.5، الطابع الزمني: 0x570e42ce
اسم الوحدة النمطية التي تحتوي على أخطاء: Qt5Gui.dll، الإصدار: 5.5.1.0، الطابع الزمني: 0x56ec1889
رمز الاستثناء: 0xc0000005
إزاحة الخطأ: 0x0004cb7b
معرّف العملية التي تحتوي على أخطاء: 0x1090
وقت بدء تشغيل التطبيق الذي يحتوي على أخطاء: 0xViber.exe0
مسار التطبيق الذي يحتوي على أخطاء: Viber.exe1
مسار الوحدة النمطية التي تحتوي على أخطاء: Viber.exe2
معرف التقرير: Viber.exe3
الاسم الكامل للحزمة التي تحتوي على أخطاء: Viber.exe4
معرف التطبيق المرتبط بالحزمة التي تحتوي على أخطاء: Viber.exe5
Error: (04/29/2016 12:59:47 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: hamid)
Description: فشل تنشيط التطبيق Microsoft.BingNews_8wekyb3d8bbwe!AppexNews مع حدوث الخطأ: -2147024894 راجع سجل Microsoft-Windows-TWinUI/Operational للحصول على معلومات إضافية.
Error: (04/29/2016 12:59:45 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: hamid)
Description: فشل تنشيط التطبيق Microsoft.BingNews_8wekyb3d8bbwe!AppexNews مع حدوث الخطأ: -2147024894 راجع سجل Microsoft-Windows-TWinUI/Operational للحصول على معلومات إضافية.
Error: (04/29/2016 12:40:57 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: hamid)
Description: فشل تنشيط التطبيق Microsoft.BingNews_8wekyb3d8bbwe!AppexNews مع حدوث الخطأ: -2147024894 راجع سجل Microsoft-Windows-TWinUI/Operational للحصول على معلومات إضافية.
Error: (04/29/2016 12:28:00 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: hamid)
Description: فشل تنشيط التطبيق Microsoft.BingNews_8wekyb3d8bbwe!AppexNews مع حدوث الخطأ: -2147024894 راجع سجل Microsoft-Windows-TWinUI/Operational للحصول على معلومات إضافية.
Error: (04/29/2016 12:20:58 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: hamid)
Description: فشل تنشيط التطبيق Microsoft.BingNews_8wekyb3d8bbwe!AppexNews مع حدوث الخطأ: -2147024894 راجع سجل Microsoft-Windows-TWinUI/Operational للحصول على معلومات إضافية.
System errors:
=============
Error: (04/30/2016 09:40:24 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)UnavailableUnavailable
Error: (04/30/2016 09:16:31 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: فشل التثبيت: فشل Windows في تثبيت التحديث التالي بسبب الخطأ 0x80070003: Microsoft.BingFoodAndDrink.
Error: (04/30/2016 09:16:25 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: فشل التثبيت: فشل Windows في تثبيت التحديث التالي بسبب الخطأ 0x80070003: Microsoft.BingHealthAndFitness.
Error: (04/30/2016 09:16:25 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: فشل التثبيت: فشل Windows في تثبيت التحديث التالي بسبب الخطأ 0x80070003: Microsoft.WindowsScan.
Error: (04/30/2016 09:16:18 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: فشل التثبيت: فشل Windows في تثبيت التحديث التالي بسبب الخطأ 0x80070003: Microsoft.BingTravel.
Error: (04/30/2016 09:16:18 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: فشل التثبيت: فشل Windows في تثبيت التحديث التالي بسبب الخطأ 0x80070003: Microsoft.BingFoodAndDrink.
Error: (04/30/2016 09:16:08 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: فشل التثبيت: فشل Windows في تثبيت التحديث التالي بسبب الخطأ 0x80070003: Microsoft.WindowsReadingList.
Error: (04/30/2016 09:16:08 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: فشل التثبيت: فشل Windows في تثبيت التحديث التالي بسبب الخطأ 0x80070003: Microsoft.Reader.
Error: (04/30/2016 12:39:26 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: تم تعليق الخدمة Device Setup Manager عند بدء التشغيل.
Error: (04/29/2016 08:52:48 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: فشل التثبيت: فشل Windows في تثبيت التحديث التالي بسبب الخطأ 0x80070003: Microsoft.BingFoodAndDrink.
CodeIntegrity:
===================================
Date: 2016-04-09 18:20:24.251
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\SRSLabs\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\sluapo64.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-04-09 18:03:03.984
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\SRSLabs\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\sluapo64.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-04-06 17:21:31.017
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\SRSLabs\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\sluapo64.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-04-06 17:21:07.894
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\SRSLabs\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\sluapo64.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-04-06 17:21:02.787
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\SRSLabs\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\sluapo64.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-04-06 17:06:10.486
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\SRSLabs\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\sluapo64.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-04-06 16:46:05.825
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\SRSLabs\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\sluapo64.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-04-06 16:45:47.856
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\SRSLabs\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\sluapo64.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-04-06 16:45:42.755
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\SRSLabs\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\sluapo64.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-04-06 16:43:26.919
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\SRSLabs\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\sluapo64.dll because the set of per-page image hashes could not be found on the system.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-3230M CPU @ 2.60GHz
Percentage of memory in use: 37%
Total physical RAM: 3994.36 MB
Available physical RAM: 2501.16 MB
Total Virtual: 8090.36 MB
Available Virtual: 6550.99 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:117.09 GB) (Free:77.89 GB) NTFS
Drive d: (Local Disk) (Fixed) (Total:0.1 GB) (Free:0.08 GB) NTFS
Drive e: () (Fixed) (Total:179.31 GB) (Free:177.87 GB) NTFS
Drive h: (Local Disk) (Fixed) (Total:148.08 GB) (Free:80.36 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive k: (حامد) (Fixed) (Total:21.19 GB) (Free:15.05 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: C499E06A)
Partition 1: (Not Active) - (Size=101 MB) - (Type=42)
Partition 2: (Not Active) - (Size=117.1 GB) - (Type=42)
Partition 3: (Not Active) - (Size=117.2 GB) - (Type=42)
Partition 4: (Active) - (Size=148.1 GB) - (Type=42)
==================== End of Addition.txt ============================