Additional scan result of Farbar Recovery Scan Tool (x86) Version: 24-05-2017
Ran by hassan (27-05-2017 09:50:42)
Running from C:\Users\hassan\Desktop
Microsoft Windows 7 Ultimate Service Pack 1 (X86) (2017-05-10 14:15:35)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-1796275782-4292205373-2313263118-500 - Administrator - Disabled)
Guest (S-1-5-21-1796275782-4292205373-2313263118-501 - Limited - Disabled)
hassan (S-1-5-21-1796275782-4292205373-2313263118-1001 - Administrator - Enabled) => C:\Users\hassan
HomeGroupUser$ (S-1-5-21-1796275782-4292205373-2313263118-1002 - Limited - Enabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}
AV: ESET Smart Security (Enabled - Up to date) {EC1D6F37-E411-475A-DF50-12FF7FE4AC70}
AS: ESET Smart Security (Enabled - Up to date) {577C8ED3-C22B-48D4-E5E0-298D0463E6CD}
AS: Malwarebytes (Enabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: جدار الحماية الشخصي ESET (Enabled) {D426EE12-AE7E-4602-F40F-BBCA8137EB0B}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe AIR (HKLM\...\Adobe AIR) (Version: 25.0.0.134 - Adobe Systems Incorporated)
Adobe Flash Player 25 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 25.0.0.171 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.2 (HKLM\...\Adobe Shockwave Player) (Version: 12.2.8.198 - Adobe Systems, Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.29 - Piriform)
ESET Smart Security (HKLM\...\{F0947421-BAE4-4B7D-AE30-7FE45945845B}) (Version: 10.1.204.2 - ESET, spol. s r.o.)
f.lux (HKU\S-1-5-21-1796275782-4292205373-2313263118-1001\...\Flux) (Version: - )
FastStone Capture 8.5 (HKLM\...\FastStone Capture) (Version: 8.5 - FastStone Soft)
Google Chrome (HKLM\...\Google Chrome) (Version: 58.0.3029.110 - Google Inc‎.‎)
Google Update Helper (Version: 1.3.33.5 - Google Inc.) Hidden
Intel(R) Graphics Media Accelerator Driver (HKLM\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2869 - Intel Corporation)
Internet Download Manager (HKLM\...\IDM 6.28.9 Final) (Version: - )
Malwarebytes version 3.1.2.1733 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.1.2.1733 - Malwarebytes)
Microsoft .NET Framework 4.7 (HKLM\...\{2A842F3F-CE6D-3DFD-9ECB-9CC3C5150A67}) (Version: 4.7.02053 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50901.0 - Microsoft Corporation)
Mozilla Firefox 53.0.2 (x86 ar) (HKLM\...\Mozilla Firefox 53.0.2 (x86 ar)) (Version: 53.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 53.0.2 - Mozilla)
PlayReady PC Runtime x86 (HKLM\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)
PowerISO (HKLM\...\PowerISO) (Version: 6.8 - Power Software Ltd)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6526 - Realtek Semiconductor Corp.)
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
WinRAR 5.01 (32-bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
ZHPFix 2015 (HKLM\...\ZHPFix_is1) (Version: 2015 - Nicolas Coolman)
حزمة اللغة العربية لـ Microsoft .NET Framework 4.5 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1025) (Version: 4.5.50709 - Microsoft Corporation)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {977F0BEF-3E8D-4926-A71F-0DE79FE31BD2} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2017-04-11] (Piriform Ltd)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

WMI_ActiveScriptEventConsumer_ASEC: <===== ATTENTION

ShortcutWithArgument: C:\Users\hassan\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome (2).lnk -> C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) -> --load-extension="C:\Users\hassan\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk" hxxp://www.yeadesktop.com/
ShortcutWithArgument: C:\Users\hassan\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) -> --load-extension="C:\Users\hassan\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk" hxxp://www.yeadesktop.com/
ShortcutWithArgument: C:\Users\hassan\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\7eacadfa43776aec\Google Chrome.lnk -> C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=ChromeDefaultData2
ShortcutWithArgument: C:\Users\Public\Desktop\Google Chrome.lnk -> C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) -> --load-extension="C:\Users\hassan\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk" hxxp://www.yeadesktop.com/

==================== Loaded Modules (Whitelisted) ==============

2017-05-18 21:13 - 2017-05-09 16:38 - 01728456 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MwacLib.dll
2017-04-07 08:41 - 2017-04-07 08:41 - 00060632 _____ () C:\Program Files\CCleaner\branding.dll
2017-04-10 23:57 - 2017-04-10 23:57 - 00061440 _____ () C:\Program Files\CCleaner\lang\lang-1025.dll
2017-05-11 12:47 - 2017-05-09 09:12 - 02864984 _____ () C:\Program Files\Google\Chrome\Application\58.0.3029.110\libglesv2.dll
2017-05-11 12:47 - 2017-05-09 09:12 - 00087384 _____ () C:\Program Files\Google\Chrome\Application\58.0.3029.110\libegl.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:04 - 2017-05-19 00:25 - 00000176 __RSH C:\Windows\system32\Drivers\etc\hosts

127.0.0.1 telemetry.malwarebytes.com
127.0.0.1 skipittok.com
0.0.0.0 data.service.malwarebytes.org
0.0.0.0 keystone.mwbsys.com

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1796275782-4292205373-2313263118-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\hassan\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 8.8.8.8 - 8.8.4.4
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{F8A3D95B-B057-49AA-A4A0-B5B58C6CF3FF}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe
FirewallRules: [{0F6FD3EF-1EE3-4DB8-BB35-C2AC502CB770}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [{60A415CF-6946-47B8-ADE9-31C1A4A58A17}] => (Allow) C:\Users\hassan\Desktop\EmbratoriaG7\EmbratoriaG7\libs.exe
FirewallRules: [{A311B4C3-E9EB-4955-BFFA-B27077669FEE}] => (Allow) C:\Users\hassan\Desktop\EmbratoriaG7\EmbratoriaG7\libs.exe
FirewallRules: [{6AF22629-1E1F-4DC7-987C-20CD86347FD4}] => (Allow) LPort=5000
FirewallRules: [{37D789E4-9628-459D-9DB3-0AED60397DBB}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{F3DD6D08-79D7-42D4-9CC3-9079B8CB5A6B}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe

==================== Restore Points =========================

11-05-2017 15:24:58 DriverPack 17.7.48
11-05-2017 23:13:29 Removed DriversCloud.com
11-05-2017 23:49:51 Windows Defender Checkpoint
12-05-2017 08:08:38 Installed Microsoft .NET Framework 4.7
13-05-2017 22:24:23 Removed AlphaGo
15-05-2017 13:56:28 JRT Pre-Junkware Removal
17-05-2017 23:28:51 Restore Point Created by FRST

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: محول الاتصال النفقي لـ Microsoft Teredo
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (05/27/2017 09:25:07 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (05/26/2017 10:48:14 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (05/26/2017 02:12:32 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (05/26/2017 11:51:00 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (05/26/2017 10:36:27 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (05/26/2017 08:07:40 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: ‏‏اسم ‏‏التطبيق الذي يحتوي على أخطاء: gmer.exe، الإصدار: 2.2.19882.0، الطابع الزمني: 0x56e2cdca
اسم الوحدة النمطية التي تحتوي على أخطاء: gmer.exe، الإصدار: 2.2.19882.0، الطابع الزمني: 0x56e2cdca
رمز الاستثناء: 0xc0000409
إزاحة الخطأ: 0x00072d16
معرّف العملية التي تحتوي على خطأ: 0xd7c
وقت بدء تشغيل التطبيق الذي يحتوي على خطأ: 0x01d2d5ec9d3a6318
مسار التطبيق الذي يحتوي على خطأ: C:\Users\hassan\Desktop\gmer.exe
مسار الوحدة النمطية التي تحتوي على خطأ: C:\Users\hassan\Desktop\gmer.exe
معرف التقرير: 011d4106-41e2-11e7-8119-00e04c9dfb9d

Error: (05/26/2017 07:49:17 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (05/25/2017 11:32:57 PM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description: تعذّر تهيئة الفهرس.

التفاصيل:
‏‏دليل فهرس المحتوى تالف. (HRESULT : 0xc0041801) (0xc0041801)

Error: (05/25/2017 11:32:57 PM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: تعذّرت تهيئة التطبيق.

السياق: التطبيق Windows

التفاصيل:
‏‏دليل فهرس المحتوى تالف. (HRESULT : 0xc0041801) (0xc0041801)

Error: (05/25/2017 11:32:57 PM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: تعذّرت تهيئة كائن المجمّع.

السياق: Windows التطبيق، SystemIndex الكتالوج

التفاصيل:
‏‏دليل فهرس المحتوى تالف. (HRESULT : 0xc0041801) (0xc0041801)


System errors:
=============
Error: (05/26/2017 02:13:27 PM) (Source: WMPNetworkSvc) (EventID: 14332) (User: )
Description: ‏‏لم يتم بدء تشغيل الخدمة 'WMPNetworkSvc' بشكلٍ صحيح لأن CoCreateInstance(CLSID_UPnPDeviceFinder)‎ واجه الخطأ '0x80004005'. تحقق من تشغيل خدمة UPnPHost ومن تثبيت مكون UPnPHost لـ Windows بشكلٍ صحيح.

Error: (05/26/2017 11:50:17 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 11:48:46 on ‎26/‎05/‎2017 was unexpected.

Error: (05/25/2017 11:45:18 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: ‏‏تم الوصول إلى نهاية المهلة (30000 مللي ثانية) أثناء انتظار اتصال الخدمة Windows Error Reporting Service.

Error: (05/25/2017 11:32:59 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: ‏‏تم إنهاء الخدمة Windows Search بشكل غير متوقع. حدث هذا 1 مرة. سيتم اتخاذ الإجراء التصحيحي التالي في غضون 30000 مللي ثانية: أعد تشغيل الخدمة.

Error: (05/25/2017 11:32:59 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: ‏‏تم إنهاء خدمة Windows Search بسبب الخطأ الخاص بالخدمة %%-1073473535.


CodeIntegrity:
===================================
Date: 2017-05-16 14:29:30.255
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\ESET\ESET Security\Modules\em023_32\10213\em023_32.dll.raw because the set of per-page image hashes could not be found on the system.

Date: 2017-05-16 14:29:29.502
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\ESET\ESET Security\Modules\em023_32\10213\em023_32.dll.raw because the set of per-page image hashes could not be found on the system.

Date: 2017-05-16 14:29:28.155
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\ESET\ESET Security\Modules\em023_32\10213\em023_32.dll.raw because the set of per-page image hashes could not be found on the system.

Date: 2017-05-16 14:29:26.895
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\ESET\ESET Security\Modules\em023_32\10213\em023_32.dll.raw because the set of per-page image hashes could not be found on the system.

Date: 2017-05-16 14:29:25.788
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\ESET\ESET Security\Modules\em023_32\10213\em023_32.dll.raw because the set of per-page image hashes could not be found on the system.

Date: 2017-05-16 14:29:24.517
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\ESET\ESET Security\Modules\em023_32\10213\em023_32.dll.raw because the set of per-page image hashes could not be found on the system.

Date: 2017-05-16 14:29:21.246
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\ESET\ESET Security\Modules\em023_32\10203\em023_32.dll.raw because the set of per-page image hashes could not be found on the system.

Date: 2017-05-16 14:29:20.339
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\ESET\ESET Security\Modules\em023_32\10203\em023_32.dll.raw because the set of per-page image hashes could not be found on the system.

Date: 2017-05-16 14:29:19.619
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\ESET\ESET Security\Modules\em023_32\10203\em023_32.dll.raw because the set of per-page image hashes could not be found on the system.

Date: 2017-05-16 14:29:18.245
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\ESET\ESET Security\Modules\em023_32\10203\em023_32.dll.raw because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Processor: Intel(R) Pentium(R) 4 CPU 3.40GHz
Percentage of memory in use: 66%
Total physical RAM: 2012.49 MB
Available physical RAM: 669.55 MB
Total Virtual: 4024.98 MB
Available Virtual: 2387.76 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:107.32 GB) (Free:86.43 GB) NTFS
Drive d: () (Fixed) (Total:95.33 GB) (Free:48.88 GB) NTFS
Drive e: () (Fixed) (Total:95.33 GB) (Free:79.95 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 41B941B8)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=107.3 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=95.3 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=95.3 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================