Publicité
Publicité
Format du document : text/plain
Prévisualisation
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-07-2016
Ran by mohamed (2016-07-20 11:31:14)
Running from C:\Users\mohamed\Desktop
Windows 10 Pro Version 1511 (X64) (2015-12-27 11:47:40)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-3544706222-1499703263-3937389962-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-3544706222-1499703263-3937389962-503 - Limited - Disabled)
Guest (S-1-5-21-3544706222-1499703263-3937389962-501 - Limited - Enabled)
HomeGroupUser$ (S-1-5-21-3544706222-1499703263-3937389962-1002 - Limited - Enabled)
moha (S-1-5-21-3544706222-1499703263-3937389962-1003 - Limited - Enabled)
mohamed (S-1-5-21-3544706222-1499703263-3937389962-1000 - Administrator - Enabled) => C:\Users\mohamed
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: ESET Smart Security 9.0.318.24 (Enabled - Up to date) {19259FAE-8396-A113-46DB-15B0E7DFA289}
AV: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: ESET Smart Security 9.0.381.2 (Enabled - Up to date) {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834}
FW: جدار الحماية الشخصي ESET (Enabled) {211E1E8B-C9F9-A04B-6D84-BC85190CE5F2}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
µTorrent (HKLM-x32\...\uTorrent) (Version: 2.2.1 - )
Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.017.20050 - Adobe Systems Incorporated)
Adobe Flash Player 22 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 22.0.0.192 - Adobe Systems Incorporated)
Adobe Flash Player 22 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 22.0.0.192 - Adobe Systems Incorporated)
CCleaner (HKLM\...\CCleaner) (Version: 5.19 - Piriform)
Dell System Detect (HKU\S-1-5-21-3544706222-1499703263-3937389962-1000\...\58d94f3ce2c27db0) (Version: 6.12.0.1 - Dell)
Dell WLAN and Bluetooth Client Installation (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Dell Inc.)
DriversCloud.com (64 bits) (HKLM\...\{54F822C5-B093-46D2-B52C-E120EF2AE90F}) (Version: 8.0.3.0 - Cybelsoft)
ESET Smart Security (HKLM\...\{BE1D36A7-0315-4B19-878F-ECCC9E4B05ED}) (Version: 9.0.318.24 - ESET, spol. s r.o.)
FILERECOVERY Professional (HKLM-x32\...\{CB45A1BD-9BEF-4C48-AD52-DEB7E9BB6DF5}_is1) (Version: 5.5.4.6 - LC Technology International, Inc.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 51.0.2704.103 - Google Inc.)
Google Update Helper (x32 Version: 1.3.30.3 - Google Inc.) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 20.19.15.4331 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 14.8.0.1042 - Intel Corporation)
Internet Download Manager (HKLM-x32\...\Internet Download Manager) (Version: - Tonec Inc.)
Java 8 Update 91 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218091F0}) (Version: 8.0.910.15 - Oracle Corporation)
K-Lite Mega Codec Pack 10.9.0 (HKLM-x32\...\KLiteCodecPack_is1) (Version: 10.9.0 - )
Malwarebytes Anti-Malware النسخة 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
MEGAsync (HKLM-x32\...\MEGAsync) (Version: - Mega Limited)
Metric Collection SDK 35 (x32 Version: 1.2.0010.00 - Lenovo Group Limited) Hidden
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{F2508213-9989-4E85-A078-72BE483917EF}) (Version: 3.5.88.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)
Microsoft Office Word Viewer 2003 (HKLM-x32\...\{90850401-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50428.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
NVIDIA 3D Vision Driver 361.91 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 361.91 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.9.1.22 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.9.1.22 - NVIDIA Corporation)
NVIDIA Graphics Driver 361.91 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 361.91 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.15.0428 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.15.0428 - NVIDIA Corporation)
OpenAL (HKLM-x32\...\OpenAL) (Version: - )
Opera Stable 38.0.2220.41 (HKLM-x32\...\Opera 38.0.2220.41) (Version: 38.0.2220.41 - Opera Software)
PowerISO (HKLM-x32\...\PowerISO) (Version: 6.6 - Power Software Ltd)
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 10.0.1.5 - Qualcomm Atheros)
Quickset64 (HKLM\...\{87CF757E-C1F1-4D22-865C-00C6950B5258}) (Version: 11.1.18 - Dell Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.6.1001.2015 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7544 - Realtek Semiconductor Corp.)
Recover My Files (HKLM-x32\...\Recover My Files v5_is1) (Version: 5.1.0.1824 - GetData Pty Ltd)
Shahid TV 2.00 (HKLM-x32\...\Shahid TV 2.00) (Version: 2.00 - Shahid TV)
SHAREit (HKLM-x32\...\SHAREit_is1) (Version: 2.5.1.1 - Lenovo Group Limited)
SHIELD Streaming (Version: 4.1.0260 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 2.9.1.22 - NVIDIA Corporation) Hidden
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.1 - VideoLAN)
Vodafone Mobile Broadband (HKLM-x32\...\{6C29152D-3FF9-43B2-84E4-9B35FC0BF5C2}) (Version: 10.3.403.44552 - Vodafone)
Vodafone Wi-Fi (HKLM-x32\...\{4C897612-87C1-4084-88B3-A9505DC17A77}) (Version: 2.0.1.44883 - Vodafone)
Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
WinRAR 5.20 beta 2 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.20.2 - win.rar GmbH)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-3544706222-1499703263-3937389962-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\mohamed\AppData\Local\Microsoft\OneDrive\17.3.6281.1202_1\FileCoAuth.exe (Microsoft Corporation)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {09BF1781-847D-4BF8-967D-6BA33BF34E80} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe
Task: {19E0A45B-DC30-47E7-8E2F-720E7608C52B} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\Windows\ehome\ehPrivJob.exe
Task: {1CECC9CE-952D-4A21-94F6-78B9FDE97577} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-11-12] (Google Inc.)
Task: {1FE4A6DA-C120-4557-AA96-B34E93B17E06} - System32\Tasks\{42DB7962-04E9-45FD-9929-A8179A2E9736} => Iexplore.exe hxxp://ui.skype.com/ui/0/6.22.64.106/en/abandoninstall?page=tsMain
Task: {25552A6A-05FF-4702-996A-DD8DFF66A76A} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {2BECFC78-946B-4EE3-87FE-7D1BC9D0A409} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\Windows\ehome\ehPrivJob.exe
Task: {37D2D8FD-82DE-451C-A4D3-FF9D86C0D185} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_22_0_0_192_pepper.exe [2016-07-12] (Adobe Systems Incorporated)
Task: {3C387A8E-30C6-489F-AB03-279381C74C7F} - System32\Tasks\{017DDE17-8C84-4841-8ED2-FBC17DAA7F3C} => pcalua.exe -a C:\Users\mohamed\Downloads\Programs\vcredist_x64.exe -d C:\Users\mohamed\AppData\Roaming\IDM
Task: {3E01BCEB-9E5E-490F-BE30-B90228009A47} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 35 => C:\Program Files (x86)\Lenovo\Customer Feedback Program 35\Lenovo.TVT.CustomerFeedback.Agent35.exe [2015-07-06] (Lenovo)
Task: {408953D3-9297-4D80-8C58-BDD5D0CCC9B9} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\Windows\ehome\ehPrivJob.exe
Task: {40AA78BC-0DAF-4A7F-9DBA-0E86A1440393} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\Windows\ehome\mcupdate.exe
Task: {452B8DE2-076A-4A08-9E85-82D965D18C57} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {46C61F86-66FC-4B02-B21F-13BEADE0BF68} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\Windows\ehome\ehPrivJob.exe
Task: {4B16429B-C102-4B4B-8853-69993B7691CB} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\Windows\ehome\mcupdate.exe
Task: {58250B29-B0F4-4CB8-B3B9-554AC94EBA2E} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\Windows\ehome\ehPrivJob.exe
Task: {585CF962-ED90-4A3C-8090-27E67C3EF127} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\Windows\ehome\MCUpdate.exe
Task: {6A5B818B-7D5D-4ED5-B55E-995D96860FDB} - System32\Tasks\Opera scheduled Autoupdate 1461700807 => C:\Program Files (x86)\Opera\launcher.exe [2016-07-01] (Opera Software)
Task: {73435EA6-8925-42E6-B116-30FE4B75782C} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\Windows\ehome\ehPrivJob.exe
Task: {75D47FBF-9FF9-45E2-885B-B44CB4AA8D8C} - System32\Tasks\{8D1D4D9D-A815-4E0B-97C2-1E0676A160E6} => pcalua.exe -a "D:\New folder (3)\ShamelaLibrary348\shamela\bin\viewer.exe" -d C:\Users\mohamed\Downloads\Compressed\9059 -c C:\Users\mohamed\DOWNLO~1\COMPRE~1\9059\81F6~1.BOK
Task: {7ABC8A5A-3919-4D69-83D9-C205D75B08E0} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {7DF2F139-939E-4C63-A788-037FC9EC83F1} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\Windows\ehome\ehrec.exe
Task: {7F55B00D-7C81-4D2E-BC1A-EB56F1E30865} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-11-12] (Google Inc.)
Task: {863BCA54-50D5-408A-AD48-B2E1F77E2636} - System32\Tasks\{762F3ED3-9E11-4910-BF90-6D4B5728F18E} => pcalua.exe -a "C:\Users\mohamed\Downloads\Compressed\Soundwrite2_2\برنامج تفريغ الأشرطة\setup.exe" -d "C:\Users\mohamed\Downloads\Compressed\Soundwrite2_2\برنامج تفريغ الأشرطة"
Task: {8A28CD2B-5EB5-4F6B-8A40-C34BB8E3601E} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {93533CF2-0881-4857-8165-CD3A630493A0} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-06-25] (Adobe Systems Incorporated)
Task: {979004C2-D5AD-45CA-95FB-0F2E0C08F23F} - System32\Tasks\RtHDVBg_PushButton => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2015-08-04] (Realtek Semiconductor)
Task: {9C98C6EC-F685-4697-AAEB-CCA0FF6166CB} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\Windows\ehome\ehrec.exe
Task: {9FD058E3-1958-4D76-A95D-70094D679CC0} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\Windows\ehome\ehPrivJob.exe
Task: {AA712BA0-E0C7-48DF-9045-8CB16A87CF38} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\Windows\ehome\ehPrivJob.exe
Task: {ABFE486D-2536-4AF1-B730-F8EEAB345D98} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\Windows\ehome\ehPrivJob.exe
Task: {AC92FB3F-C999-437A-8B40-B0E38641C386} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\Windows\ehome\ehPrivJob.exe
Task: {AF49C919-4E78-437F-8661-65DD544D5284} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\Windows\ehome\ehPrivJob.exe
Task: {BE3A21CC-78BB-45FF-9941-8AA8678EB300} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2016-07-17] (Microsoft Corporation)
Task: {BF94D314-8D62-4B80-8AE5-C078FFC48C43} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2016-06-10] (Piriform Ltd)
Task: {CFA7F1F1-FE57-4F66-BB10-EB8CADD6ED94} - System32\Tasks\{741FBC96-D247-4BE3-AE89-8DE7A1F47F96} => pcalua.exe -a C:\Users\mohamed\Downloads\Programs\DellSystemDetectLauncher.exe -d C:\Users\mohamed\AppData\Roaming\IDM
Task: {D852DCB7-EC37-462A-BE53-EF71F1FBEDDA} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\Windows\ehome\ehPrivJob.exe
Task: {D857079F-4320-4EF4-8FF7-33E1B463884F} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\Windows\ehome\ehPrivJob.exe
Task: {E166595A-5BD5-40B8-89D0-0E77E2B4A2B3} - System32\Tasks\{5C7AACE6-2CC1-4429-B315-0CA714A028C6} => pcalua.exe -a "C:\Users\mohamed\Downloads\Compressed\013\برنامج تفريغ الأشرطة\برنامج تفريغ الأشرطة الإصدار الثاني.exe" -d "C:\Users\mohamed\Downloads\Compressed\013\برنامج تفريغ الأشرطة"
Task: {FA6B4797-77E8-4695-BA9D-8649F517C1D7} - System32\Tasks\{19CE17E5-7E37-48D4-9ECD-7B7ABE71A747} => pcalua.exe -a C:\Users\mohamed\AppData\Local\Temp\jre-8u66-windows-au.exe -d C:\Windows\SysWOW64 -c /installmethod=jau FAMILYUPGRADE=1
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_22_0_0_192_pepper.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
==================== Loaded Modules (Whitelisted) ==============
2015-12-27 19:01 - 2016-01-12 07:43 - 00291264 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamBase.dll
2015-10-30 10:18 - 2015-10-30 10:18 - 00185856 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2015-12-27 17:05 - 2016-02-09 08:29 - 00133056 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2016-07-17 09:03 - 2016-07-01 07:48 - 02656408 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2015-07-18 01:35 - 2015-12-19 02:08 - 00402344 _____ () C:\WINDOWS\system32\igfxTray.exe
2016-07-17 09:03 - 2016-07-01 07:48 - 02656408 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2014-05-01 17:13 - 2014-05-01 17:13 - 00470016 _____ () C:\ProgramData\MEGAsync\ShellExtX64.dll
2015-12-27 23:40 - 2015-12-07 07:14 - 00093696 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Windows.UI.Shell.SharedUtilities.dll
2016-07-17 09:09 - 2016-07-01 06:48 - 00472064 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2016-07-17 09:03 - 2016-07-01 06:27 - 07992832 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2016-07-17 09:03 - 2016-07-01 06:21 - 00591360 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2016-07-17 09:03 - 2016-07-01 06:22 - 02483200 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2016-07-17 09:04 - 2016-07-01 06:24 - 04089856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2016-04-19 12:18 - 2016-04-19 12:19 - 00144384 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
2015-12-27 19:01 - 2016-01-12 07:43 - 00018880 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
2016-04-19 12:18 - 2016-04-19 12:19 - 00141312 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeBackgroundTasks.dll
2016-04-19 12:18 - 2016-04-19 12:19 - 22284800 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkyWrap.dll
2014-05-01 17:15 - 2014-05-01 17:15 - 00463360 _____ () C:\ProgramData\MEGAsync\ShellExtX32.dll
2016-06-18 01:17 - 2016-06-15 12:15 - 01745560 _____ () C:\Program Files (x86)\Google\Chrome\Application\51.0.2704.103\libglesv2.dll
2016-06-18 01:17 - 2016-06-15 12:15 - 00091288 _____ () C:\Program Files (x86)\Google\Chrome\Application\51.0.2704.103\libegl.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 05:34 - 2016-07-18 21:41 - 00000027 ____A C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-3544706222-1499703263-3937389962-1000\Control Panel\Desktop\\Wallpaper -> c:\windows\web\wallpaper\windows\img0.jpg
DNS Servers: 163.121.128.134 - 163.121.128.135
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
HKLM\...\StartupApproved\Run32: => "VodafoneMobileWiFi"
HKLM\...\StartupApproved\Run32: => "MobileBroadband"
HKLM\...\StartupApproved\Run32: => "PWRISOVM.EXE"
HKLM\...\StartupApproved\Run32: => "VmbNotifier"
HKU\S-1-5-21-3544706222-1499703263-3937389962-1000\...\StartupApproved\StartupFolder: => "MEGAsync.lnk"
HKU\S-1-5-21-3544706222-1499703263-3937389962-1000\...\StartupApproved\Run: => "CCleaner Monitoring"
HKU\S-1-5-21-3544706222-1499703263-3937389962-1000\...\StartupApproved\Run: => "Google Update"
HKU\S-1-5-21-3544706222-1499703263-3937389962-1000\...\StartupApproved\Run: => "IDMan"
HKU\S-1-5-21-3544706222-1499703263-3937389962-1000\...\StartupApproved\Run: => "OneDrive"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{2D8010F0-54D9-4863-AA2F-97BB92652D0F}] => (Allow) C:\Program Files (x86)\uTorrent\uTorrent.exe
FirewallRules: [{43598C89-4BEE-4218-892B-487E330BD158}] => (Allow) C:\Program Files (x86)\uTorrent\uTorrent.exe
FirewallRules: [{BA0B547E-C95E-4588-88BA-7949BBA85CD0}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.0.16794.227\QQPCPatch.exe
FirewallRules: [{F649CD28-1439-43AB-A8E8-326B59026E64}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{CF9E95AA-0E3B-40DA-BC27-DE6DE868FE15}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{4ADF6C99-18C5-43AF-8A02-7C6D9BC40B7A}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
FirewallRules: [{248DC939-0809-422F-9BB8-B3866D00DE14}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{2ADF99E5-8C58-4104-A370-4FEA0E7D5277}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{144B64A4-91B2-48E5-AEFB-102588C11B43}] => (Allow) C:\Program Files\DriversCloud.com\MCDetection.exe
FirewallRules: [{5F82B62E-DEDC-4D42-94C5-E37390E406C1}] => (Allow) C:\Program Files\DriversCloud.com\MCDetection.exe
FirewallRules: [{47E03132-BFE1-4595-B29C-55FFAB33E26B}] => (Allow) C:\Program Files\DriversCloud.com\MCDetection.exe
FirewallRules: [{7F7D1692-E594-41F6-BF7B-5BC762E8E8F7}] => (Allow) C:\Program Files\DriversCloud.com\MCDetection.exe
FirewallRules: [{B6BF66BD-8426-4C59-80F1-4E2F04EE36C8}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{9E3FCF93-5001-41FC-A14F-2BD049E08A76}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{FDA01956-99E5-461D-B956-11D54DFF916F}] => (Allow) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
FirewallRules: [{9B0B523B-BD9C-4D74-BA58-6EE721585539}] => (Allow) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
FirewallRules: [{6D4B4DA6-200F-4507-AF77-43AF4ADDE899}] => (Allow) C:\Program Files (x86)\Lenovo\SHAREit\SHAREit.exe
FirewallRules: [{DEDDD5AE-A1D3-4039-9666-CF739FCC7923}] => (Allow) C:\Program Files (x86)\Lenovo\SHAREit\SHAREit.exe
FirewallRules: [{A4E53908-329C-4916-81D9-6BF371EC8825}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{13346F72-3515-4FC3-9290-F76244C5A6B7}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Restore Points =========================
01-07-2016 04:20:49 Scheduled Checkpoint
04-07-2016 22:10:15 Removed Apple Application Support (32-bit)
06-07-2016 23:36:48 Installed PlayReady PC Runtime amd64
15-07-2016 17:35:37 Scheduled Checkpoint
18-07-2016 00:34:20 JRT Pre-Junkware Removal
==================== Faulty Device Manager Devices =============
Name: Intel(R) Management Engine Interface
Description: Intel(R) Management Engine Interface
Class Guid: {4d36e97d-e325-11ce-bfc1-08002be10318}
Manufacturer: Intel
Service: MEIx64
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (07/19/2016 06:13:29 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: igfxHK.exe, version: 6.15.10.4331, time stamp: 0x564cc83e
Faulting module name: igfxHK.exe, version: 6.15.10.4331, time stamp: 0x564cc83e
Exception code: 0xc0000409
Fault offset: 0x0000000000015953
Faulting process id: 0x9f4
Faulting application start time: 0xigfxHK.exe0
Faulting application path: igfxHK.exe1
Faulting module path: igfxHK.exe2
Report Id: igfxHK.exe3
Faulting package full name: igfxHK.exe4
Faulting package-relative application ID: igfxHK.exe5
Error: (07/19/2016 11:33:25 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: igfxHK.exe, version: 6.15.10.4331, time stamp: 0x564cc83e
Faulting module name: igfxHK.exe, version: 6.15.10.4331, time stamp: 0x564cc83e
Exception code: 0xc0000409
Fault offset: 0x0000000000015953
Faulting process id: 0x1cac
Faulting application start time: 0xigfxHK.exe0
Faulting application path: igfxHK.exe1
Faulting module path: igfxHK.exe2
Report Id: igfxHK.exe3
Faulting package full name: igfxHK.exe4
Faulting package-relative application ID: igfxHK.exe5
Error: (07/19/2016 01:07:12 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\System32\bitsperf.dll8
Error: (07/18/2016 09:44:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: igfxHK.exe, version: 6.15.10.4331, time stamp: 0x564cc83e
Faulting module name: igfxHK.exe, version: 6.15.10.4331, time stamp: 0x564cc83e
Exception code: 0xc0000409
Fault offset: 0x0000000000015953
Faulting process id: 0x14dc
Faulting application start time: 0xigfxHK.exe0
Faulting application path: igfxHK.exe1
Faulting module path: igfxHK.exe2
Report Id: igfxHK.exe3
Faulting package full name: igfxHK.exe4
Faulting package-relative application ID: igfxHK.exe5
Error: (07/18/2016 06:36:08 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2484) (User: MOHAMED-PC)
Description: Package Microsoft.Windows.ShellExperienceHost_10.0.10586.0_neutral_neutral_cw5n1h2txyewy+App was terminated because it took too long to suspend.
Error: (07/18/2016 05:33:17 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: igfxHK.exe, version: 6.15.10.4331, time stamp: 0x564cc83e
Faulting module name: igfxHK.exe, version: 6.15.10.4331, time stamp: 0x564cc83e
Exception code: 0xc0000409
Fault offset: 0x0000000000015953
Faulting process id: 0x3d4
Faulting application start time: 0xigfxHK.exe0
Faulting application path: igfxHK.exe1
Faulting module path: igfxHK.exe2
Report Id: igfxHK.exe3
Faulting package full name: igfxHK.exe4
Faulting package-relative application ID: igfxHK.exe5
Error: (07/18/2016 12:34:44 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.
System Error:
Access is denied.
.
Error: (07/17/2016 08:47:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: igfxHK.exe, version: 6.15.10.4331, time stamp: 0x564cc83e
Faulting module name: igfxHK.exe, version: 6.15.10.4331, time stamp: 0x564cc83e
Exception code: 0xc0000409
Fault offset: 0x0000000000015953
Faulting process id: 0x4bc
Faulting application start time: 0xigfxHK.exe0
Faulting application path: igfxHK.exe1
Faulting module path: igfxHK.exe2
Report Id: igfxHK.exe3
Faulting package full name: igfxHK.exe4
Faulting package-relative application ID: igfxHK.exe5
Error: (07/17/2016 05:18:42 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: igfxHK.exe, version: 6.15.10.4331, time stamp: 0x564cc83e
Faulting module name: igfxHK.exe, version: 6.15.10.4331, time stamp: 0x564cc83e
Exception code: 0xc0000409
Fault offset: 0x0000000000015953
Faulting process id: 0xdfc
Faulting application start time: 0xigfxHK.exe0
Faulting application path: igfxHK.exe1
Faulting module path: igfxHK.exe2
Report Id: igfxHK.exe3
Faulting package full name: igfxHK.exe4
Faulting package-relative application ID: igfxHK.exe5
Error: (07/17/2016 08:36:16 AM) (Source: Microsoft-Windows-AppModel-State) (EventID: 10) (User: MOHAMED-PC)
Description: microsoft.windows.authhost.a_8wekyb3d8bbwe3
System errors:
=============
Error: (07/20/2016 11:06:13 AM) (Source: DCOM) (EventID: 10016) (User: MOHAMED-PC)
Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}mohamed-PCmohamedS-1-5-21-3544706222-1499703263-3937389962-1000LocalHost (Using LRPC)VodafoneGroupServices.VodafoneMobileBroadband_1.1.6.0_neutral__cx08jceyq9bcpS-1-15-2-1305384512-1191984967-2616396577-1885267767-665475324-2053634176-2749423153
Error: (07/20/2016 11:06:13 AM) (Source: DCOM) (EventID: 10016) (User: MOHAMED-PC)
Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}mohamed-PCmohamedS-1-5-21-3544706222-1499703263-3937389962-1000LocalHost (Using LRPC)VodafoneGroupServices.VodafoneMobileBroadband_1.1.6.0_neutral__cx08jceyq9bcpS-1-15-2-1305384512-1191984967-2616396577-1885267767-665475324-2053634176-2749423153
Error: (07/20/2016 11:06:11 AM) (Source: DCOM) (EventID: 10016) (User: MOHAMED-PC)
Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}mohamed-PCmohamedS-1-5-21-3544706222-1499703263-3937389962-1000LocalHost (Using LRPC)VodafoneGroupServices.VodafoneMobileBroadband_1.1.6.0_neutral__cx08jceyq9bcpS-1-15-2-1305384512-1191984967-2616396577-1885267767-665475324-2053634176-2749423153
Error: (07/20/2016 11:06:11 AM) (Source: DCOM) (EventID: 10016) (User: MOHAMED-PC)
Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}mohamed-PCmohamedS-1-5-21-3544706222-1499703263-3937389962-1000LocalHost (Using LRPC)VodafoneGroupServices.VodafoneMobileBroadband_1.1.6.0_neutral__cx08jceyq9bcpS-1-15-2-1305384512-1191984967-2616396577-1885267767-665475324-2053634176-2749423153
Error: (07/20/2016 07:51:20 AM) (Source: DCOM) (EventID: 10016) (User: MOHAMED-PC)
Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}mohamed-PCmohamedS-1-5-21-3544706222-1499703263-3937389962-1000LocalHost (Using LRPC)VodafoneGroupServices.VodafoneMobileBroadband_1.1.6.0_neutral__cx08jceyq9bcpS-1-15-2-1305384512-1191984967-2616396577-1885267767-665475324-2053634176-2749423153
Error: (07/20/2016 07:51:20 AM) (Source: DCOM) (EventID: 10016) (User: MOHAMED-PC)
Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}mohamed-PCmohamedS-1-5-21-3544706222-1499703263-3937389962-1000LocalHost (Using LRPC)VodafoneGroupServices.VodafoneMobileBroadband_1.1.6.0_neutral__cx08jceyq9bcpS-1-15-2-1305384512-1191984967-2616396577-1885267767-665475324-2053634176-2749423153
Error: (07/20/2016 07:51:19 AM) (Source: DCOM) (EventID: 10016) (User: MOHAMED-PC)
Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}mohamed-PCmohamedS-1-5-21-3544706222-1499703263-3937389962-1000LocalHost (Using LRPC)VodafoneGroupServices.VodafoneMobileBroadband_1.1.6.0_neutral__cx08jceyq9bcpS-1-15-2-1305384512-1191984967-2616396577-1885267767-665475324-2053634176-2749423153
Error: (07/20/2016 07:51:19 AM) (Source: DCOM) (EventID: 10016) (User: MOHAMED-PC)
Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}mohamed-PCmohamedS-1-5-21-3544706222-1499703263-3937389962-1000LocalHost (Using LRPC)VodafoneGroupServices.VodafoneMobileBroadband_1.1.6.0_neutral__cx08jceyq9bcpS-1-15-2-1305384512-1191984967-2616396577-1885267767-665475324-2053634176-2749423153
Error: (07/20/2016 07:51:17 AM) (Source: DCOM) (EventID: 10016) (User: MOHAMED-PC)
Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}mohamed-PCmohamedS-1-5-21-3544706222-1499703263-3937389962-1000LocalHost (Using LRPC)VodafoneGroupServices.VodafoneMobileBroadband_1.1.6.0_neutral__cx08jceyq9bcpS-1-15-2-1305384512-1191984967-2616396577-1885267767-665475324-2053634176-2749423153
Error: (07/20/2016 07:51:17 AM) (Source: DCOM) (EventID: 10016) (User: MOHAMED-PC)
Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}mohamed-PCmohamedS-1-5-21-3544706222-1499703263-3937389962-1000LocalHost (Using LRPC)VodafoneGroupServices.VodafoneMobileBroadband_1.1.6.0_neutral__cx08jceyq9bcpS-1-15-2-1305384512-1191984967-2616396577-1885267767-665475324-2053634176-2749423153
CodeIntegrity:
===================================
Date: 2016-07-17 20:38:45.189
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-07-14 15:54:43.962
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-07-14 15:54:43.929
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-07-14 15:54:43.893
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-07-14 15:54:43.854
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-07-14 15:54:43.789
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-07-14 15:54:43.588
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-07-14 15:54:43.489
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-07-14 15:54:43.350
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-07-14 15:54:42.895
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i7-4510U CPU @ 2.00GHz
Percentage of memory in use: 33%
Total physical RAM: 8095.83 MB
Available physical RAM: 5397.75 MB
Total Virtual: 16287.83 MB
Available Virtual: 13373.42 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:146.14 GB) (Free:32.53 GB) NTFS
Drive d: (Local Disk) (Fixed) (Total:390.62 GB) (Free:142.34 GB) NTFS
Drive e: () (Fixed) (Total:394.4 GB) (Free:223.63 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 60046E65)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=146.1 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=390.6 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=394.4 GB) - (Type=07 NTFS)
==================== End of Addition.txt ============================
Ran by mohamed (2016-07-20 11:31:14)
Running from C:\Users\mohamed\Desktop
Windows 10 Pro Version 1511 (X64) (2015-12-27 11:47:40)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-3544706222-1499703263-3937389962-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-3544706222-1499703263-3937389962-503 - Limited - Disabled)
Guest (S-1-5-21-3544706222-1499703263-3937389962-501 - Limited - Enabled)
HomeGroupUser$ (S-1-5-21-3544706222-1499703263-3937389962-1002 - Limited - Enabled)
moha (S-1-5-21-3544706222-1499703263-3937389962-1003 - Limited - Enabled)
mohamed (S-1-5-21-3544706222-1499703263-3937389962-1000 - Administrator - Enabled) => C:\Users\mohamed
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: ESET Smart Security 9.0.318.24 (Enabled - Up to date) {19259FAE-8396-A113-46DB-15B0E7DFA289}
AV: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: ESET Smart Security 9.0.381.2 (Enabled - Up to date) {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834}
FW: جدار الحماية الشخصي ESET (Enabled) {211E1E8B-C9F9-A04B-6D84-BC85190CE5F2}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
µTorrent (HKLM-x32\...\uTorrent) (Version: 2.2.1 - )
Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.017.20050 - Adobe Systems Incorporated)
Adobe Flash Player 22 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 22.0.0.192 - Adobe Systems Incorporated)
Adobe Flash Player 22 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 22.0.0.192 - Adobe Systems Incorporated)
CCleaner (HKLM\...\CCleaner) (Version: 5.19 - Piriform)
Dell System Detect (HKU\S-1-5-21-3544706222-1499703263-3937389962-1000\...\58d94f3ce2c27db0) (Version: 6.12.0.1 - Dell)
Dell WLAN and Bluetooth Client Installation (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Dell Inc.)
DriversCloud.com (64 bits) (HKLM\...\{54F822C5-B093-46D2-B52C-E120EF2AE90F}) (Version: 8.0.3.0 - Cybelsoft)
ESET Smart Security (HKLM\...\{BE1D36A7-0315-4B19-878F-ECCC9E4B05ED}) (Version: 9.0.318.24 - ESET, spol. s r.o.)
FILERECOVERY Professional (HKLM-x32\...\{CB45A1BD-9BEF-4C48-AD52-DEB7E9BB6DF5}_is1) (Version: 5.5.4.6 - LC Technology International, Inc.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 51.0.2704.103 - Google Inc.)
Google Update Helper (x32 Version: 1.3.30.3 - Google Inc.) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 20.19.15.4331 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 14.8.0.1042 - Intel Corporation)
Internet Download Manager (HKLM-x32\...\Internet Download Manager) (Version: - Tonec Inc.)
Java 8 Update 91 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218091F0}) (Version: 8.0.910.15 - Oracle Corporation)
K-Lite Mega Codec Pack 10.9.0 (HKLM-x32\...\KLiteCodecPack_is1) (Version: 10.9.0 - )
Malwarebytes Anti-Malware النسخة 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
MEGAsync (HKLM-x32\...\MEGAsync) (Version: - Mega Limited)
Metric Collection SDK 35 (x32 Version: 1.2.0010.00 - Lenovo Group Limited) Hidden
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{F2508213-9989-4E85-A078-72BE483917EF}) (Version: 3.5.88.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)
Microsoft Office Word Viewer 2003 (HKLM-x32\...\{90850401-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50428.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
NVIDIA 3D Vision Driver 361.91 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 361.91 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.9.1.22 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.9.1.22 - NVIDIA Corporation)
NVIDIA Graphics Driver 361.91 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 361.91 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.15.0428 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.15.0428 - NVIDIA Corporation)
OpenAL (HKLM-x32\...\OpenAL) (Version: - )
Opera Stable 38.0.2220.41 (HKLM-x32\...\Opera 38.0.2220.41) (Version: 38.0.2220.41 - Opera Software)
PowerISO (HKLM-x32\...\PowerISO) (Version: 6.6 - Power Software Ltd)
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 10.0.1.5 - Qualcomm Atheros)
Quickset64 (HKLM\...\{87CF757E-C1F1-4D22-865C-00C6950B5258}) (Version: 11.1.18 - Dell Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.6.1001.2015 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7544 - Realtek Semiconductor Corp.)
Recover My Files (HKLM-x32\...\Recover My Files v5_is1) (Version: 5.1.0.1824 - GetData Pty Ltd)
Shahid TV 2.00 (HKLM-x32\...\Shahid TV 2.00) (Version: 2.00 - Shahid TV)
SHAREit (HKLM-x32\...\SHAREit_is1) (Version: 2.5.1.1 - Lenovo Group Limited)
SHIELD Streaming (Version: 4.1.0260 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 2.9.1.22 - NVIDIA Corporation) Hidden
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.1 - VideoLAN)
Vodafone Mobile Broadband (HKLM-x32\...\{6C29152D-3FF9-43B2-84E4-9B35FC0BF5C2}) (Version: 10.3.403.44552 - Vodafone)
Vodafone Wi-Fi (HKLM-x32\...\{4C897612-87C1-4084-88B3-A9505DC17A77}) (Version: 2.0.1.44883 - Vodafone)
Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
WinRAR 5.20 beta 2 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.20.2 - win.rar GmbH)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-3544706222-1499703263-3937389962-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\mohamed\AppData\Local\Microsoft\OneDrive\17.3.6281.1202_1\FileCoAuth.exe (Microsoft Corporation)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {09BF1781-847D-4BF8-967D-6BA33BF34E80} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe
Task: {19E0A45B-DC30-47E7-8E2F-720E7608C52B} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\Windows\ehome\ehPrivJob.exe
Task: {1CECC9CE-952D-4A21-94F6-78B9FDE97577} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-11-12] (Google Inc.)
Task: {1FE4A6DA-C120-4557-AA96-B34E93B17E06} - System32\Tasks\{42DB7962-04E9-45FD-9929-A8179A2E9736} => Iexplore.exe hxxp://ui.skype.com/ui/0/6.22.64.106/en/abandoninstall?page=tsMain
Task: {25552A6A-05FF-4702-996A-DD8DFF66A76A} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {2BECFC78-946B-4EE3-87FE-7D1BC9D0A409} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\Windows\ehome\ehPrivJob.exe
Task: {37D2D8FD-82DE-451C-A4D3-FF9D86C0D185} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_22_0_0_192_pepper.exe [2016-07-12] (Adobe Systems Incorporated)
Task: {3C387A8E-30C6-489F-AB03-279381C74C7F} - System32\Tasks\{017DDE17-8C84-4841-8ED2-FBC17DAA7F3C} => pcalua.exe -a C:\Users\mohamed\Downloads\Programs\vcredist_x64.exe -d C:\Users\mohamed\AppData\Roaming\IDM
Task: {3E01BCEB-9E5E-490F-BE30-B90228009A47} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 35 => C:\Program Files (x86)\Lenovo\Customer Feedback Program 35\Lenovo.TVT.CustomerFeedback.Agent35.exe [2015-07-06] (Lenovo)
Task: {408953D3-9297-4D80-8C58-BDD5D0CCC9B9} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\Windows\ehome\ehPrivJob.exe
Task: {40AA78BC-0DAF-4A7F-9DBA-0E86A1440393} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\Windows\ehome\mcupdate.exe
Task: {452B8DE2-076A-4A08-9E85-82D965D18C57} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {46C61F86-66FC-4B02-B21F-13BEADE0BF68} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\Windows\ehome\ehPrivJob.exe
Task: {4B16429B-C102-4B4B-8853-69993B7691CB} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\Windows\ehome\mcupdate.exe
Task: {58250B29-B0F4-4CB8-B3B9-554AC94EBA2E} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\Windows\ehome\ehPrivJob.exe
Task: {585CF962-ED90-4A3C-8090-27E67C3EF127} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\Windows\ehome\MCUpdate.exe
Task: {6A5B818B-7D5D-4ED5-B55E-995D96860FDB} - System32\Tasks\Opera scheduled Autoupdate 1461700807 => C:\Program Files (x86)\Opera\launcher.exe [2016-07-01] (Opera Software)
Task: {73435EA6-8925-42E6-B116-30FE4B75782C} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\Windows\ehome\ehPrivJob.exe
Task: {75D47FBF-9FF9-45E2-885B-B44CB4AA8D8C} - System32\Tasks\{8D1D4D9D-A815-4E0B-97C2-1E0676A160E6} => pcalua.exe -a "D:\New folder (3)\ShamelaLibrary348\shamela\bin\viewer.exe" -d C:\Users\mohamed\Downloads\Compressed\9059 -c C:\Users\mohamed\DOWNLO~1\COMPRE~1\9059\81F6~1.BOK
Task: {7ABC8A5A-3919-4D69-83D9-C205D75B08E0} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {7DF2F139-939E-4C63-A788-037FC9EC83F1} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\Windows\ehome\ehrec.exe
Task: {7F55B00D-7C81-4D2E-BC1A-EB56F1E30865} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-11-12] (Google Inc.)
Task: {863BCA54-50D5-408A-AD48-B2E1F77E2636} - System32\Tasks\{762F3ED3-9E11-4910-BF90-6D4B5728F18E} => pcalua.exe -a "C:\Users\mohamed\Downloads\Compressed\Soundwrite2_2\برنامج تفريغ الأشرطة\setup.exe" -d "C:\Users\mohamed\Downloads\Compressed\Soundwrite2_2\برنامج تفريغ الأشرطة"
Task: {8A28CD2B-5EB5-4F6B-8A40-C34BB8E3601E} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {93533CF2-0881-4857-8165-CD3A630493A0} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-06-25] (Adobe Systems Incorporated)
Task: {979004C2-D5AD-45CA-95FB-0F2E0C08F23F} - System32\Tasks\RtHDVBg_PushButton => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2015-08-04] (Realtek Semiconductor)
Task: {9C98C6EC-F685-4697-AAEB-CCA0FF6166CB} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\Windows\ehome\ehrec.exe
Task: {9FD058E3-1958-4D76-A95D-70094D679CC0} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\Windows\ehome\ehPrivJob.exe
Task: {AA712BA0-E0C7-48DF-9045-8CB16A87CF38} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\Windows\ehome\ehPrivJob.exe
Task: {ABFE486D-2536-4AF1-B730-F8EEAB345D98} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\Windows\ehome\ehPrivJob.exe
Task: {AC92FB3F-C999-437A-8B40-B0E38641C386} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\Windows\ehome\ehPrivJob.exe
Task: {AF49C919-4E78-437F-8661-65DD544D5284} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\Windows\ehome\ehPrivJob.exe
Task: {BE3A21CC-78BB-45FF-9941-8AA8678EB300} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2016-07-17] (Microsoft Corporation)
Task: {BF94D314-8D62-4B80-8AE5-C078FFC48C43} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2016-06-10] (Piriform Ltd)
Task: {CFA7F1F1-FE57-4F66-BB10-EB8CADD6ED94} - System32\Tasks\{741FBC96-D247-4BE3-AE89-8DE7A1F47F96} => pcalua.exe -a C:\Users\mohamed\Downloads\Programs\DellSystemDetectLauncher.exe -d C:\Users\mohamed\AppData\Roaming\IDM
Task: {D852DCB7-EC37-462A-BE53-EF71F1FBEDDA} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\Windows\ehome\ehPrivJob.exe
Task: {D857079F-4320-4EF4-8FF7-33E1B463884F} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\Windows\ehome\ehPrivJob.exe
Task: {E166595A-5BD5-40B8-89D0-0E77E2B4A2B3} - System32\Tasks\{5C7AACE6-2CC1-4429-B315-0CA714A028C6} => pcalua.exe -a "C:\Users\mohamed\Downloads\Compressed\013\برنامج تفريغ الأشرطة\برنامج تفريغ الأشرطة الإصدار الثاني.exe" -d "C:\Users\mohamed\Downloads\Compressed\013\برنامج تفريغ الأشرطة"
Task: {FA6B4797-77E8-4695-BA9D-8649F517C1D7} - System32\Tasks\{19CE17E5-7E37-48D4-9ECD-7B7ABE71A747} => pcalua.exe -a C:\Users\mohamed\AppData\Local\Temp\jre-8u66-windows-au.exe -d C:\Windows\SysWOW64 -c /installmethod=jau FAMILYUPGRADE=1
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_22_0_0_192_pepper.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
==================== Loaded Modules (Whitelisted) ==============
2015-12-27 19:01 - 2016-01-12 07:43 - 00291264 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamBase.dll
2015-10-30 10:18 - 2015-10-30 10:18 - 00185856 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2015-12-27 17:05 - 2016-02-09 08:29 - 00133056 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2016-07-17 09:03 - 2016-07-01 07:48 - 02656408 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2015-07-18 01:35 - 2015-12-19 02:08 - 00402344 _____ () C:\WINDOWS\system32\igfxTray.exe
2016-07-17 09:03 - 2016-07-01 07:48 - 02656408 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2014-05-01 17:13 - 2014-05-01 17:13 - 00470016 _____ () C:\ProgramData\MEGAsync\ShellExtX64.dll
2015-12-27 23:40 - 2015-12-07 07:14 - 00093696 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Windows.UI.Shell.SharedUtilities.dll
2016-07-17 09:09 - 2016-07-01 06:48 - 00472064 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2016-07-17 09:03 - 2016-07-01 06:27 - 07992832 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2016-07-17 09:03 - 2016-07-01 06:21 - 00591360 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2016-07-17 09:03 - 2016-07-01 06:22 - 02483200 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2016-07-17 09:04 - 2016-07-01 06:24 - 04089856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2016-04-19 12:18 - 2016-04-19 12:19 - 00144384 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
2015-12-27 19:01 - 2016-01-12 07:43 - 00018880 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
2016-04-19 12:18 - 2016-04-19 12:19 - 00141312 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeBackgroundTasks.dll
2016-04-19 12:18 - 2016-04-19 12:19 - 22284800 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkyWrap.dll
2014-05-01 17:15 - 2014-05-01 17:15 - 00463360 _____ () C:\ProgramData\MEGAsync\ShellExtX32.dll
2016-06-18 01:17 - 2016-06-15 12:15 - 01745560 _____ () C:\Program Files (x86)\Google\Chrome\Application\51.0.2704.103\libglesv2.dll
2016-06-18 01:17 - 2016-06-15 12:15 - 00091288 _____ () C:\Program Files (x86)\Google\Chrome\Application\51.0.2704.103\libegl.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 05:34 - 2016-07-18 21:41 - 00000027 ____A C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-3544706222-1499703263-3937389962-1000\Control Panel\Desktop\\Wallpaper -> c:\windows\web\wallpaper\windows\img0.jpg
DNS Servers: 163.121.128.134 - 163.121.128.135
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
HKLM\...\StartupApproved\Run32: => "VodafoneMobileWiFi"
HKLM\...\StartupApproved\Run32: => "MobileBroadband"
HKLM\...\StartupApproved\Run32: => "PWRISOVM.EXE"
HKLM\...\StartupApproved\Run32: => "VmbNotifier"
HKU\S-1-5-21-3544706222-1499703263-3937389962-1000\...\StartupApproved\StartupFolder: => "MEGAsync.lnk"
HKU\S-1-5-21-3544706222-1499703263-3937389962-1000\...\StartupApproved\Run: => "CCleaner Monitoring"
HKU\S-1-5-21-3544706222-1499703263-3937389962-1000\...\StartupApproved\Run: => "Google Update"
HKU\S-1-5-21-3544706222-1499703263-3937389962-1000\...\StartupApproved\Run: => "IDMan"
HKU\S-1-5-21-3544706222-1499703263-3937389962-1000\...\StartupApproved\Run: => "OneDrive"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{2D8010F0-54D9-4863-AA2F-97BB92652D0F}] => (Allow) C:\Program Files (x86)\uTorrent\uTorrent.exe
FirewallRules: [{43598C89-4BEE-4218-892B-487E330BD158}] => (Allow) C:\Program Files (x86)\uTorrent\uTorrent.exe
FirewallRules: [{BA0B547E-C95E-4588-88BA-7949BBA85CD0}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.0.16794.227\QQPCPatch.exe
FirewallRules: [{F649CD28-1439-43AB-A8E8-326B59026E64}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{CF9E95AA-0E3B-40DA-BC27-DE6DE868FE15}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{4ADF6C99-18C5-43AF-8A02-7C6D9BC40B7A}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
FirewallRules: [{248DC939-0809-422F-9BB8-B3866D00DE14}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{2ADF99E5-8C58-4104-A370-4FEA0E7D5277}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{144B64A4-91B2-48E5-AEFB-102588C11B43}] => (Allow) C:\Program Files\DriversCloud.com\MCDetection.exe
FirewallRules: [{5F82B62E-DEDC-4D42-94C5-E37390E406C1}] => (Allow) C:\Program Files\DriversCloud.com\MCDetection.exe
FirewallRules: [{47E03132-BFE1-4595-B29C-55FFAB33E26B}] => (Allow) C:\Program Files\DriversCloud.com\MCDetection.exe
FirewallRules: [{7F7D1692-E594-41F6-BF7B-5BC762E8E8F7}] => (Allow) C:\Program Files\DriversCloud.com\MCDetection.exe
FirewallRules: [{B6BF66BD-8426-4C59-80F1-4E2F04EE36C8}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{9E3FCF93-5001-41FC-A14F-2BD049E08A76}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{FDA01956-99E5-461D-B956-11D54DFF916F}] => (Allow) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
FirewallRules: [{9B0B523B-BD9C-4D74-BA58-6EE721585539}] => (Allow) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
FirewallRules: [{6D4B4DA6-200F-4507-AF77-43AF4ADDE899}] => (Allow) C:\Program Files (x86)\Lenovo\SHAREit\SHAREit.exe
FirewallRules: [{DEDDD5AE-A1D3-4039-9666-CF739FCC7923}] => (Allow) C:\Program Files (x86)\Lenovo\SHAREit\SHAREit.exe
FirewallRules: [{A4E53908-329C-4916-81D9-6BF371EC8825}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{13346F72-3515-4FC3-9290-F76244C5A6B7}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Restore Points =========================
01-07-2016 04:20:49 Scheduled Checkpoint
04-07-2016 22:10:15 Removed Apple Application Support (32-bit)
06-07-2016 23:36:48 Installed PlayReady PC Runtime amd64
15-07-2016 17:35:37 Scheduled Checkpoint
18-07-2016 00:34:20 JRT Pre-Junkware Removal
==================== Faulty Device Manager Devices =============
Name: Intel(R) Management Engine Interface
Description: Intel(R) Management Engine Interface
Class Guid: {4d36e97d-e325-11ce-bfc1-08002be10318}
Manufacturer: Intel
Service: MEIx64
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (07/19/2016 06:13:29 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: igfxHK.exe, version: 6.15.10.4331, time stamp: 0x564cc83e
Faulting module name: igfxHK.exe, version: 6.15.10.4331, time stamp: 0x564cc83e
Exception code: 0xc0000409
Fault offset: 0x0000000000015953
Faulting process id: 0x9f4
Faulting application start time: 0xigfxHK.exe0
Faulting application path: igfxHK.exe1
Faulting module path: igfxHK.exe2
Report Id: igfxHK.exe3
Faulting package full name: igfxHK.exe4
Faulting package-relative application ID: igfxHK.exe5
Error: (07/19/2016 11:33:25 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: igfxHK.exe, version: 6.15.10.4331, time stamp: 0x564cc83e
Faulting module name: igfxHK.exe, version: 6.15.10.4331, time stamp: 0x564cc83e
Exception code: 0xc0000409
Fault offset: 0x0000000000015953
Faulting process id: 0x1cac
Faulting application start time: 0xigfxHK.exe0
Faulting application path: igfxHK.exe1
Faulting module path: igfxHK.exe2
Report Id: igfxHK.exe3
Faulting package full name: igfxHK.exe4
Faulting package-relative application ID: igfxHK.exe5
Error: (07/19/2016 01:07:12 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\System32\bitsperf.dll8
Error: (07/18/2016 09:44:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: igfxHK.exe, version: 6.15.10.4331, time stamp: 0x564cc83e
Faulting module name: igfxHK.exe, version: 6.15.10.4331, time stamp: 0x564cc83e
Exception code: 0xc0000409
Fault offset: 0x0000000000015953
Faulting process id: 0x14dc
Faulting application start time: 0xigfxHK.exe0
Faulting application path: igfxHK.exe1
Faulting module path: igfxHK.exe2
Report Id: igfxHK.exe3
Faulting package full name: igfxHK.exe4
Faulting package-relative application ID: igfxHK.exe5
Error: (07/18/2016 06:36:08 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2484) (User: MOHAMED-PC)
Description: Package Microsoft.Windows.ShellExperienceHost_10.0.10586.0_neutral_neutral_cw5n1h2txyewy+App was terminated because it took too long to suspend.
Error: (07/18/2016 05:33:17 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: igfxHK.exe, version: 6.15.10.4331, time stamp: 0x564cc83e
Faulting module name: igfxHK.exe, version: 6.15.10.4331, time stamp: 0x564cc83e
Exception code: 0xc0000409
Fault offset: 0x0000000000015953
Faulting process id: 0x3d4
Faulting application start time: 0xigfxHK.exe0
Faulting application path: igfxHK.exe1
Faulting module path: igfxHK.exe2
Report Id: igfxHK.exe3
Faulting package full name: igfxHK.exe4
Faulting package-relative application ID: igfxHK.exe5
Error: (07/18/2016 12:34:44 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.
System Error:
Access is denied.
.
Error: (07/17/2016 08:47:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: igfxHK.exe, version: 6.15.10.4331, time stamp: 0x564cc83e
Faulting module name: igfxHK.exe, version: 6.15.10.4331, time stamp: 0x564cc83e
Exception code: 0xc0000409
Fault offset: 0x0000000000015953
Faulting process id: 0x4bc
Faulting application start time: 0xigfxHK.exe0
Faulting application path: igfxHK.exe1
Faulting module path: igfxHK.exe2
Report Id: igfxHK.exe3
Faulting package full name: igfxHK.exe4
Faulting package-relative application ID: igfxHK.exe5
Error: (07/17/2016 05:18:42 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: igfxHK.exe, version: 6.15.10.4331, time stamp: 0x564cc83e
Faulting module name: igfxHK.exe, version: 6.15.10.4331, time stamp: 0x564cc83e
Exception code: 0xc0000409
Fault offset: 0x0000000000015953
Faulting process id: 0xdfc
Faulting application start time: 0xigfxHK.exe0
Faulting application path: igfxHK.exe1
Faulting module path: igfxHK.exe2
Report Id: igfxHK.exe3
Faulting package full name: igfxHK.exe4
Faulting package-relative application ID: igfxHK.exe5
Error: (07/17/2016 08:36:16 AM) (Source: Microsoft-Windows-AppModel-State) (EventID: 10) (User: MOHAMED-PC)
Description: microsoft.windows.authhost.a_8wekyb3d8bbwe3
System errors:
=============
Error: (07/20/2016 11:06:13 AM) (Source: DCOM) (EventID: 10016) (User: MOHAMED-PC)
Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}mohamed-PCmohamedS-1-5-21-3544706222-1499703263-3937389962-1000LocalHost (Using LRPC)VodafoneGroupServices.VodafoneMobileBroadband_1.1.6.0_neutral__cx08jceyq9bcpS-1-15-2-1305384512-1191984967-2616396577-1885267767-665475324-2053634176-2749423153
Error: (07/20/2016 11:06:13 AM) (Source: DCOM) (EventID: 10016) (User: MOHAMED-PC)
Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}mohamed-PCmohamedS-1-5-21-3544706222-1499703263-3937389962-1000LocalHost (Using LRPC)VodafoneGroupServices.VodafoneMobileBroadband_1.1.6.0_neutral__cx08jceyq9bcpS-1-15-2-1305384512-1191984967-2616396577-1885267767-665475324-2053634176-2749423153
Error: (07/20/2016 11:06:11 AM) (Source: DCOM) (EventID: 10016) (User: MOHAMED-PC)
Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}mohamed-PCmohamedS-1-5-21-3544706222-1499703263-3937389962-1000LocalHost (Using LRPC)VodafoneGroupServices.VodafoneMobileBroadband_1.1.6.0_neutral__cx08jceyq9bcpS-1-15-2-1305384512-1191984967-2616396577-1885267767-665475324-2053634176-2749423153
Error: (07/20/2016 11:06:11 AM) (Source: DCOM) (EventID: 10016) (User: MOHAMED-PC)
Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}mohamed-PCmohamedS-1-5-21-3544706222-1499703263-3937389962-1000LocalHost (Using LRPC)VodafoneGroupServices.VodafoneMobileBroadband_1.1.6.0_neutral__cx08jceyq9bcpS-1-15-2-1305384512-1191984967-2616396577-1885267767-665475324-2053634176-2749423153
Error: (07/20/2016 07:51:20 AM) (Source: DCOM) (EventID: 10016) (User: MOHAMED-PC)
Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}mohamed-PCmohamedS-1-5-21-3544706222-1499703263-3937389962-1000LocalHost (Using LRPC)VodafoneGroupServices.VodafoneMobileBroadband_1.1.6.0_neutral__cx08jceyq9bcpS-1-15-2-1305384512-1191984967-2616396577-1885267767-665475324-2053634176-2749423153
Error: (07/20/2016 07:51:20 AM) (Source: DCOM) (EventID: 10016) (User: MOHAMED-PC)
Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}mohamed-PCmohamedS-1-5-21-3544706222-1499703263-3937389962-1000LocalHost (Using LRPC)VodafoneGroupServices.VodafoneMobileBroadband_1.1.6.0_neutral__cx08jceyq9bcpS-1-15-2-1305384512-1191984967-2616396577-1885267767-665475324-2053634176-2749423153
Error: (07/20/2016 07:51:19 AM) (Source: DCOM) (EventID: 10016) (User: MOHAMED-PC)
Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}mohamed-PCmohamedS-1-5-21-3544706222-1499703263-3937389962-1000LocalHost (Using LRPC)VodafoneGroupServices.VodafoneMobileBroadband_1.1.6.0_neutral__cx08jceyq9bcpS-1-15-2-1305384512-1191984967-2616396577-1885267767-665475324-2053634176-2749423153
Error: (07/20/2016 07:51:19 AM) (Source: DCOM) (EventID: 10016) (User: MOHAMED-PC)
Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}mohamed-PCmohamedS-1-5-21-3544706222-1499703263-3937389962-1000LocalHost (Using LRPC)VodafoneGroupServices.VodafoneMobileBroadband_1.1.6.0_neutral__cx08jceyq9bcpS-1-15-2-1305384512-1191984967-2616396577-1885267767-665475324-2053634176-2749423153
Error: (07/20/2016 07:51:17 AM) (Source: DCOM) (EventID: 10016) (User: MOHAMED-PC)
Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}mohamed-PCmohamedS-1-5-21-3544706222-1499703263-3937389962-1000LocalHost (Using LRPC)VodafoneGroupServices.VodafoneMobileBroadband_1.1.6.0_neutral__cx08jceyq9bcpS-1-15-2-1305384512-1191984967-2616396577-1885267767-665475324-2053634176-2749423153
Error: (07/20/2016 07:51:17 AM) (Source: DCOM) (EventID: 10016) (User: MOHAMED-PC)
Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}mohamed-PCmohamedS-1-5-21-3544706222-1499703263-3937389962-1000LocalHost (Using LRPC)VodafoneGroupServices.VodafoneMobileBroadband_1.1.6.0_neutral__cx08jceyq9bcpS-1-15-2-1305384512-1191984967-2616396577-1885267767-665475324-2053634176-2749423153
CodeIntegrity:
===================================
Date: 2016-07-17 20:38:45.189
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-07-14 15:54:43.962
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-07-14 15:54:43.929
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-07-14 15:54:43.893
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-07-14 15:54:43.854
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-07-14 15:54:43.789
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-07-14 15:54:43.588
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-07-14 15:54:43.489
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-07-14 15:54:43.350
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-07-14 15:54:42.895
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i7-4510U CPU @ 2.00GHz
Percentage of memory in use: 33%
Total physical RAM: 8095.83 MB
Available physical RAM: 5397.75 MB
Total Virtual: 16287.83 MB
Available Virtual: 13373.42 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:146.14 GB) (Free:32.53 GB) NTFS
Drive d: (Local Disk) (Fixed) (Total:390.62 GB) (Free:142.34 GB) NTFS
Drive e: () (Fixed) (Total:394.4 GB) (Free:223.63 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 60046E65)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=146.1 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=390.6 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=394.4 GB) - (Type=07 NTFS)
==================== End of Addition.txt ============================