Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-11-2016 Ran by Alan (08-11-2016 14:33:09) Running from C:\Users\Alan\Desktop Windows 7 Ultimate Service Pack 1 (X64) (2016-10-23 19:41:19) Boot Mode: Normal ========================================================== ==================== Accounts: ============================= Administrator (S-1-5-21-2446698714-1532358865-3364521796-500 - Administrator - Disabled) Alan (S-1-5-21-2446698714-1532358865-3364521796-1000 - Administrator - Enabled) => C:\Users\Alan Guest (S-1-5-21-2446698714-1532358865-3364521796-501 - Limited - Disabled) HomeGroupUser$ (S-1-5-21-2446698714-1532358865-3364521796-1002 - Limited - Enabled) ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Avast Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Avast Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736} ==================== Installed Programs ====================== (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) µTorrent (HKU\S-1-5-21-2446698714-1532358865-3364521796-1000\...\uTorrent) (Version: 3.4.9.42606 - BitTorrent Inc.) Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 3.9.1.335 - Adobe Systems Incorporated) Adobe Illustrator CC 2014 (HKLM-x32\...\{2B4B4082-8043-4646-8334-B0A29E641211}) (Version: 18.0 - Adobe Systems Incorporated) Adobe Muse CC 2015 (HKLM-x32\...\{7C54712F-A477-4E6A-AC81-7175494DD179}) (Version: 2015.0.0.597 - Adobe Systems Incorporated) Adobe Photoshop CC 2014 (HKLM-x32\...\{D7A4F897-B20A-42D0-862D-CB5F6DB7391D}) (Version: 15.0 - Adobe Systems Incorporated) Adobe Photoshop CC 2015 (HKLM-x32\...\{793C2BF7-A4FE-4608-91C9-9282C5801C21}) (Version: 16.0 - Adobe Systems Incorporated) Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 12.3.2280 - AVAST Software) Corel Graphics - Windows Shell Extension (HKLM\...\_{340C451C-F2FD-4309-B259-580FD5E44025}) (Version: 18.1.0.661 - Corel Corporation) Corel Graphics - Windows Shell Extension (Version: 18.1.661 - Corel Corporation) Hidden Corel Graphics - Windows Shell Extension 32 Bit Keys (Version: 18.1.661 - Corel Corporation) Hidden Corel Graphics - Windows Shell Extension 64 Bit (Version: 17.0.491 - Corel Corporation) Hidden Corel Update Manager (Version: 2.3.77 - Corel corporation) Hidden CorelDRAW Graphics Suite X7 - Capture (x32 Version: 17.0 - Corel Corporation) Hidden CorelDRAW Graphics Suite X7 - Common (x32 Version: 17.0 - Corel Corporation) Hidden CorelDRAW Graphics Suite X7 - Connect (x32 Version: 17.0 - Corel Corporation) Hidden CorelDRAW Graphics Suite X7 - Custom Data (x32 Version: 17.0 - Corel Corporation) Hidden CorelDRAW Graphics Suite X7 - Draw (x32 Version: 17.0 - Corel Corporation) Hidden CorelDRAW Graphics Suite X7 - EN (x32 Version: 17.0 - Corel Corporation) Hidden CorelDRAW Graphics Suite X7 - Filters (x32 Version: 17.0 - Corel Corporation) Hidden CorelDRAW Graphics Suite X7 - FontNav (x32 Version: 17.0 - Corel Corporation) Hidden CorelDRAW Graphics Suite X7 - IPM Content (x32 Version: 17.0 - Corel Corporation) Hidden CorelDRAW Graphics Suite X7 - IPM T (x32 Version: 17.0 - Corel Corporation) Hidden CorelDRAW Graphics Suite X7 - PHOTO-PAINT (x32 Version: 17.0 - Corel Corporation) Hidden CorelDRAW Graphics Suite X7 - Photozoom Plugin (x32 Version: 17.0 - Corel Corporation) Hidden CorelDRAW Graphics Suite X7 - Redist (x32 Version: 17.0 - Corel Corporation) Hidden CorelDRAW Graphics Suite X7 - Setup Files (x32 Version: 17.0 - Corel Corporation) Hidden CorelDRAW Graphics Suite X7 - VBA (x32 Version: 17.0 - Corel Corporation) Hidden CorelDRAW Graphics Suite X7 - VideoBrowser (x32 Version: 17.0 - Corel Corporation) Hidden CorelDRAW Graphics Suite X7 - Writing Tools (x32 Version: 17.0 - Corel Corporation) Hidden CorelDRAW Graphics Suite X7 (HKLM-x32\...\_{C5D9CECB-A66F-473F-B406-5C8C2DCA4DF0}) (Version: 17.0.0.491 - Corel Corporation) CorelDRAW Graphics Suite X7 (x32 Version: 17.0 - Corel Corporation) Hidden CorelDRAW Graphics Suite X8 - Capture (x64) (Version: 18.1 - Corel Corporation) Hidden CorelDRAW Graphics Suite X8 - Common (x64) (Version: 18.1 - Corel Corporation) Hidden CorelDRAW Graphics Suite X8 - Connect (x64) (Version: 18.1 - Corel Corporation) Hidden CorelDRAW Graphics Suite X8 - Custom Data (x64) (Version: 18.1 - Corel Corporation) Hidden CorelDRAW Graphics Suite X8 - Draw (x64) (Version: 18.1 - Corel Corporation) Hidden CorelDRAW Graphics Suite X8 - EN (x64) (Version: 18.1 - Corel Corporation) Hidden CorelDRAW Graphics Suite X8 - Filters (x64) (Version: 18.1 - Corel Corporation) Hidden CorelDRAW Graphics Suite X8 - Font Manager (x64) (Version: 18.1 - Corel Corporation) Hidden CorelDRAW Graphics Suite X8 - IPM Content (x64) (Version: 18.1 - Corel Corporation) Hidden CorelDRAW Graphics Suite X8 - IPM T (x64) (Version: 18.1 - Corel Corporation) Hidden CorelDRAW Graphics Suite X8 - PHOTO-PAINT (x64) (Version: 18.1 - Corel Corporation) Hidden CorelDRAW Graphics Suite X8 - Redist (x64) (Version: 18.1 - Corel Corporation) Hidden CorelDRAW Graphics Suite X8 - Setup Files (x64) (Version: 18.1 - Corel Corporation) Hidden CorelDRAW Graphics Suite X8 - VBA (x64) (Version: 18.1 - Corel Corporation) Hidden CorelDRAW Graphics Suite X8 - VideoBrowser (x64) (Version: 18.1 - Corel Corporation) Hidden CorelDRAW Graphics Suite X8 - Workspaces (x64) (Version: 18.1 - Corel Corporation) Hidden CorelDRAW Graphics Suite X8 - Writing Tools (x64) (Version: 18.1 - Corel Corporation) Hidden CorelDRAW Graphics Suite X8 (64-Bit) (HKLM\...\_{4B3FC55D-E999-4BEC-AF29-1091E574961F}) (Version: 18.1.0.661 - Corel Corporation) CorelDRAW Graphics Suite X8 (Version: 18.1 - Corel Corporation) Hidden FileZilla Client 3.22.1 (HKU\S-1-5-21-2446698714-1532358865-3364521796-1000\...\FileZilla Client) (Version: 3.22.1 - Tim Kosse) Ghostscript GPL 8.64 (Msi Setup) (HKLM-x32\...\_{06CD45E6-FF5E-4D8E-BC01-B276A90DADF2}) (Version: 8.64 - Corel Corporation) Ghostscript GPL 8.64 (Msi Setup) (x32 Version: 8.64 - Corel Corporation) Hidden Google Chrome (HKLM-x32\...\Google Chrome) (Version: 54.0.2840.71 - Google Inc.) Google Update Helper (x32 Version: 1.3.31.5 - Google Inc.) Hidden Intel(R) C++ Redistributables for Windows* on Intel(R) 64 (HKLM-x32\...\{D2437C5C-2D8C-40D2-8059-689AD7239FA3}) (Version: 11.1.048 - Intel Corporation) Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.4101 - Intel Corporation) Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation) Microsoft .NET Framework 4.6 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.6.00081 - Microsoft Corporation) Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4569.1506 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation) Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23918 (HKLM-x32\...\{dab68466-3a7d-41a8-a5cf-415e3ff8ef71}) (Version: 14.0.23918.0 - Microsoft Corporation) Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23918 (HKLM-x32\...\{2e085fd2-a3e4-4b39-8e10-6b8d35f55244}) (Version: 14.0.23918.0 - Microsoft Corporation) Microsoft Visual Studio Tools for Applications 2012 (HKLM-x32\...\{89ca2a32-2b52-4595-8dfd-6fe4757958d0}) (Version: 11.0.51108 - Microsoft Corporation) Microsoft Visual Studio Tools for Applications 2015 (HKLM-x32\...\{dd8b09df-3ef8-49f1-bd1a-65278435860b}) (Version: 14.0.23217 - Microsoft Corporation) Microsoft Windows Debugging Symbols (HKLM-x32\...\{0E8D886F-3205-4472-848E-990F400FF218}) (Version: 7601 - Microsoft) Microsoft Windows Debugging Symbols (HKLM-x32\...\{46EA439E-2D16-49B6-AA80-00DE992FE7CE}) (Version: 7601 - Microsoft) Microsoft Windows Debugging Symbols (HKLM-x32\...\{5CBDF0C2-6FD1-4A32-9A0A-143D9AB91CCE}) (Version: 7601 - Microsoft) Microsoft Windows Debugging Symbols (HKLM-x32\...\{68ADAEAA-DABD-45C1-9CC2-F995407549CD}) (Version: 7601 - Microsoft) Microsoft Windows Debugging Symbols (HKLM-x32\...\{8DD62FB6-083D-40B9-9D7D-48449FDDDED5}) (Version: 7601 - Microsoft) Microsoft Windows Debugging Symbols (HKLM-x32\...\{C6DB958A-50CC-481B-9ED8-3BAD236F7B49}) (Version: 7601 - Microsoft) Outils de vérification linguistique 2013 de Microsoft Office - Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden Pacote de Idiomas do Microsoft Visual Studio Tools for Applications 2012 x64 Hosting Support - PTB (Version: 11.0.51108 - Microsoft Corporation) Hidden Pacote de Idiomas do Microsoft Visual Studio Tools for Applications 2012 x86 Hosting Support - PTB (x32 Version: 11.0.51108 - Microsoft Corporation) Hidden Qualcomm Atheros Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.1.0.21 - Qualcomm Atheros Inc.) WinRAR 5.40 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.40.0 - win.rar GmbH) Языковой пакет для поддержки размещения набора средств Microsoft Visual Studio Tools для работы с приложениями 2012 (x64) - RUS (Version: 11.0.51108 - Microsoft Corporation) Hidden Языковой пакет для поддержки размещения набора средств Microsoft Visual Studio Tools для работы с приложениями 2012 (x86) - RUS (x32 Version: 11.0.51108 - Microsoft Corporation) Hidden ==================== Custom CLSID (Whitelisted): ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) CustomCLSID: HKU\S-1-5-21-2446698714-1532358865-3364521796-1000_Classes\CLSID\{e8c77137-e224-5791-b6e9-ff0305797a13}\InprocServer32 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems) ==================== Scheduled Tasks (Whitelisted) ============= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) Task: {1AC7ECAE-66C9-4D39-AE11-2E8EE7E27ECC} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2016-10-24] (AVAST Software) Task: {35BA94DB-CAB2-4036-ABEE-C5597AC8B0E7} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2016-10-24] (AVAST Software) Task: {490DE306-EC22-4751-8811-2AA175AEE176} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-10-24] (Google Inc.) Task: {62937837-7D19-42D3-B23E-3BC5295B1D9F} - System32\Tasks\AdobeAAMUpdater-1.0-Alan-PC-Alan => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2016-07-01] (Adobe Systems Incorporated) Task: {7057F221-AB05-4081-8722-CE73C401CB1F} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation) Task: {81D255EE-F7FD-4B21-95C3-057F9D5D371A} - System32\Tasks\Microsoft\Windows\Setup\EOSNotify => C:\Windows\system32\EOSNotify.exe [2016-06-25] (Microsoft Corporation) Task: {B5FB91CB-9583-4046-9B41-77AC1E4B1368} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation) Task: {DA07B364-7A1E-47CC-AFB6-27AF19EF9D6C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-10-24] (Google Inc.) Task: {DD375B47-AFED-4EDC-AF94-D1EC0DA93CC0} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation) Task: {F8533B30-73EA-45B8-AB0B-FD3D3011BD7C} - System32\Tasks\CorelUpdateHelperTaskCore => c:\Program Files (x86)\Corel\CUH\v2\CUH.exe [2016-10-17] (Corel Corporation) (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.) Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Shortcuts ============================= (The entries could be listed to be restored or removed.) ==================== Loaded Modules (Whitelisted) ============== 2016-10-25 09:57 - 2016-10-25 09:57 - 00491184 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll 2014-05-14 08:15 - 2014-05-14 08:15 - 08890536 _____ () C:\Program Files\Microsoft Office\Office15\1033\GrooveIntlResource.dll 2016-10-03 12:57 - 2016-10-03 12:57 - 00052400 _____ () C:\Program Files\FileZilla FTP Client\fzshellext_64.dll 2015-01-30 16:29 - 2015-01-30 16:29 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll 2016-10-25 09:57 - 2016-10-25 09:57 - 31723696 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe 2016-10-24 08:13 - 2016-10-20 06:56 - 02367080 _____ () C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.71\libglesv2.dll 2016-10-24 08:13 - 2016-10-20 06:56 - 00107112 _____ () C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.71\libegl.dll 2016-10-24 09:24 - 2016-10-24 09:24 - 00169064 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll 2016-11-07 16:22 - 2016-11-07 16:22 - 03130832 _____ () C:\Program Files\AVAST Software\Avast\defs\16110701\algo.dll 2016-10-24 09:24 - 2016-10-24 09:24 - 00482928 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll 2016-11-08 12:23 - 2016-11-08 12:23 - 03130832 _____ () C:\Program Files\AVAST Software\Avast\defs\16110800\algo.dll 2016-10-24 09:24 - 2016-10-24 09:24 - 48936448 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll 2016-10-25 10:51 - 2016-10-25 10:51 - 40523456 _____ () C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\CEF\libcef.dll 2016-10-03 12:57 - 2016-10-03 12:57 - 00048304 _____ () C:\Program Files\FileZilla FTP Client\fzshellext.dll 2016-10-12 01:08 - 2016-10-12 01:08 - 00118272 _____ () \\?\C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\js\node_modules\fs-ext\build\Release\fs-ext.node 2016-10-12 01:08 - 2016-10-12 01:08 - 00223232 _____ () \\?\C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\js\node_modules\node-vulcanjs\build\Release\VulcanJS.node 2016-10-12 01:08 - 2016-10-12 01:08 - 00117248 _____ () \\?\C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\js\node_modules\ref\build\Release\binding.node 2016-10-12 01:08 - 2016-10-12 01:08 - 00124928 _____ () \\?\C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\js\node_modules\ffi\build\Release\ffi_bindings.node 2016-10-25 10:49 - 2016-10-25 10:49 - 00109760 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\js\node_modules\node-ProxyResolver\build\Release\ProxyResolverWin7.dll 2016-10-12 01:08 - 2016-10-12 01:08 - 00166400 _____ () \\?\C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\js\node_modules\idle-gc\build\Release\idle-gc.node 2016-10-10 23:15 - 2016-10-10 23:15 - 00118272 _____ () \\?\C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\js\node_modules\fs-ext\build\Release\fs-ext.node 2016-10-10 23:15 - 2016-10-10 23:15 - 00117760 _____ () \\?\C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\js\node_modules\ref\build\Release\binding.node 2016-10-10 23:15 - 2016-10-10 23:15 - 00125440 _____ () \\?\C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\js\node_modules\ffi\build\Release\ffi_bindings.node 2016-10-10 23:17 - 2016-10-10 23:17 - 00223232 _____ () \\?\C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\js\node_modules\node-vulcanjs\build\Release\VulcanJS.node 2016-10-25 10:41 - 2016-10-25 10:41 - 00109760 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\js\node_modules\node-ProxyResolver\build\Release\ProxyResolverWin7.dll 2016-10-10 23:14 - 2016-10-10 23:14 - 00121856 _____ () \\?\C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\js\node_modules\bufferutil\build\Release\bufferutil.node 2016-10-10 23:14 - 2016-10-10 23:14 - 00166400 _____ () \\?\C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\js\node_modules\idle-gc\build\Release\idle-gc.node 2014-03-14 23:02 - 2014-03-14 23:02 - 00555888 _____ () c:\Program Files (x86)\Corel\CorelDRAW Graphics Suite X7\Draw\PsiClient.dll 2014-05-14 08:15 - 2014-05-14 08:15 - 08890536 _____ () C:\Program Files (x86)\Microsoft Office\Office15\1033\GrooveIntlResource.dll ==================== Alternate Data Streams (Whitelisted) ========= (If an entry is included in the fixlist, only the ADS will be removed.) ==================== Safe Mode (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) ==================== Association (Whitelisted) =============== (If an entry is included in the fixlist, the registry item will be restored to default or removed.) ==================== Internet Explorer trusted/restricted =============== (If an entry is included in the fixlist, it will be removed from the registry.) ==================== Hosts content: =============================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2009-07-14 00:34 - 2009-06-10 19:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-2446698714-1532358865-3364521796-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Alan\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg DNS Servers: 192.168.25.1 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) Windows Firewall is enabled. ==================== MSCONFIG/TASK MANAGER disabled items == ==================== FirewallRules (Whitelisted) =============== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) FirewallRules: [{493AE877-4D98-4844-8579-7723DB249B98}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe FirewallRules: [{8059BABA-098D-411B-87A6-27635CF5B811}] => (Allow) C:\Users\Alan\AppData\Roaming\uTorrent\uTorrent.exe FirewallRules: [{7B229385-BFC2-41E8-9C20-1969C3F155E7}] => (Allow) C:\Users\Alan\AppData\Roaming\uTorrent\uTorrent.exe FirewallRules: [{9F02687C-6159-4798-83CF-EA6D37B488F9}] => (Allow) C:\Users\Alan\AppData\Roaming\uTorrent\uTorrent.exe FirewallRules: [{2EEF3E45-E770-4ED9-9A63-D3CCE490094A}] => (Allow) C:\Users\Alan\AppData\Roaming\uTorrent\uTorrent.exe FirewallRules: [{4D0C9AFF-EA18-4ED2-83C9-2F4634276D43}] => (Allow) C:\Users\Alan\AppData\Roaming\uTorrent\uTorrent.exe FirewallRules: [{682527C5-38FF-46D6-B929-F7A94D09EE64}] => (Allow) C:\Users\Alan\AppData\Roaming\uTorrent\uTorrent.exe FirewallRules: [TCP Query User{450F390A-284F-42A9-B03C-2CFEE70D48F0}C:\program files\adobe\adobe muse cc 2015\muse.exe] => (Allow) C:\program files\adobe\adobe muse cc 2015\muse.exe FirewallRules: [UDP Query User{5B00BB3A-899A-4E6B-BA14-9B7FF649369E}C:\program files\adobe\adobe muse cc 2015\muse.exe] => (Allow) C:\program files\adobe\adobe muse cc 2015\muse.exe FirewallRules: [{2B31CB69-C5DB-486F-BD99-01E27DAF7C0B}] => (Block) c:\Program Files (x86)\Corel\CorelDRAW Graphics Suite X7\Programs\CorelDrw.exe FirewallRules: [{243130D0-1581-441D-B445-082166AC58E9}] => (Block) c:\Program Files\Corel\CorelDRAW Graphics Suite X8\Programs64\CorelDrw.exe FirewallRules: [{857D8884-85D0-4A0B-907C-C7089CC30F11}] => (Block) c:\Program Files\Corel\CorelDRAW Graphics Suite X8\Programs64\CorelPP.exe ==================== Restore Points ========================= 31-10-2016 10:45:27 Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23918 01-11-2016 14:27:26 Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23918 07-11-2016 17:54:01 Installed Microsoft Office Professional Plus 2013 07-11-2016 17:54:47 PROPLUS ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (11/08/2016 01:25:15 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: The program CorelDRW.exe version 17.0.0.491 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel. Process ID: 1560 Start Time: 01d239acc93b204e Termination Time: 102 Application Path: C:\Program Files (x86)\Corel\CorelDRAW Graphics Suite X7\Programs\CorelDRW.exe Report Id: 78b2b8ca-a5c7-11e6-bd93-eca86bbbc1c7 Error: (11/08/2016 08:49:59 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: ) Description: A problem prevented Customer Experience Improvement Program data from being sent to Microsoft, (Error 80004005). Error: (11/08/2016 08:40:25 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: CorelDRW.exe, version: 17.0.0.491, time stamp: 0x5323cfe6 Faulting module name: clr.dll, version: 4.6.81.0, time stamp: 0x5584e56f Exception code: 0x80131506 Fault offset: 0x002b0b92 Faulting process id: 0x11ec Faulting application start time: 0x01d239aa00b58e77 Faulting application path: C:\Program Files (x86)\Corel\CorelDRAW Graphics Suite X7\Programs\CorelDRW.exe Faulting module path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll Report Id: c14c1b6c-a59f-11e6-bd93-eca86bbbc1c7 Error: (11/08/2016 08:40:24 AM) (Source: .NET Runtime) (EventID: 1026) (User: ) Description: Application: CorelDRW.exe Framework Version: v4.0.30319 Description: The process was terminated due to an unhandled exception. Exception Info: exception code c0000005, exception address 7707E3FB Stack: Error: (11/07/2016 02:43:21 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: CorelDRW.exe, version: 17.0.0.491, time stamp: 0x5323cfe6 Faulting module name: CdrCore.dll, version: 17.0.0.491, time stamp: 0x5323d2d9 Exception code: 0xc0000005 Fault offset: 0x001087d5 Faulting process id: 0x11d8 Faulting application start time: 0x01d238f8d4ffadf5 Faulting application path: C:\Program Files (x86)\Corel\CorelDRAW Graphics Suite X7\Programs\CorelDRW.exe Faulting module path: C:\Program Files (x86)\Corel\CorelDRAW Graphics Suite X7\Programs\CdrCore.dll Report Id: 4a7e78fd-a509-11e6-abeb-eca86bbbc1c7 Error: (11/07/2016 02:43:21 PM) (Source: .NET Runtime) (EventID: 1026) (User: ) Description: Application: CorelDRW.exe Framework Version: v4.0.30319 Description: The process was terminated due to an unhandled exception. Exception Info: exception code c0000005, exception address 6CD887D5 Stack: Error: (11/07/2016 11:14:06 AM) (Source: Application Hang) (EventID: 1002) (User: ) Description: The program CorelDRW.exe version 17.0.0.491 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel. Process ID: d8c Start Time: 01d238e09f6e5f9d Termination Time: 20 Application Path: C:\Program Files (x86)\Corel\CorelDRAW Graphics Suite X7\Programs\CorelDRW.exe Report Id: 0a0b2456-a4ec-11e6-abeb-eca86bbbc1c7 Error: (11/04/2016 03:12:29 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: ) Description: A problem prevented Customer Experience Improvement Program data from being sent to Microsoft, (Error 80004005). Error: (11/04/2016 09:40:01 AM) (Source: Application Hang) (EventID: 1002) (User: ) Description: The program CorelDRW.exe version 17.0.0.491 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel. Process ID: b10 Start Time: 01d2368d7e92d485 Termination Time: 5874 Application Path: C:\Program Files (x86)\Corel\CorelDRAW Graphics Suite X7\Programs\CorelDRW.exe Report Id: 6175c561-a283-11e6-b81f-eca86bbbc1c7 Error: (11/04/2016 08:43:39 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: ) Description: A problem prevented Customer Experience Improvement Program data from being sent to Microsoft, (Error 80004005). System errors: ============= Error: (11/08/2016 11:19:47 AM) (Source: VDS Basic Provider) (EventID: 1) (User: ) Description: Unexpected failure. Error code: 490@01010004 Error: (11/08/2016 08:26:00 AM) (Source: Service Control Manager) (EventID: 7022) (User: ) Description: The Windows Update service hung on starting. Error: (11/07/2016 08:54:04 AM) (Source: DCOM) (EventID: 10016) (User: Alan-PC) Description: The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {9BA05972-F6A8-11CF-A442-00A0C90A8F39} and APPID {9BA05972-F6A8-11CF-A442-00A0C90A8F39} to the user Alan-PC\Alan SID (S-1-5-21-2446698714-1532358865-3364521796-1000) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool. Error: (11/04/2016 09:19:05 AM) (Source: EventLog) (EventID: 6008) (User: ) Description: The previous system shutdown at 09:17:27 on ‎04/‎11/‎2016 was unexpected. Error: (11/04/2016 08:28:44 AM) (Source: EventLog) (EventID: 6008) (User: ) Description: The previous system shutdown at 08:27:31 on ‎04/‎11/‎2016 was unexpected. Error: (11/01/2016 10:48:33 AM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: The Superfetch service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. Error: (11/01/2016 08:28:28 AM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY) Description: The following fatal alert was received: 70. Error: (10/31/2016 10:34:58 AM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: The Superfetch service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. Error: (10/28/2016 01:19:57 PM) (Source: BugCheck) (EventID: 1001) (User: ) Description: The computer has rebooted from a bugcheck. The bugcheck was: 0x0000004e (0x0000000000000099, 0x000000000007d8c0, 0x0000000000000002, 0x000000000007d8b4). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 102816-30108-01. Error: (10/28/2016 01:19:50 PM) (Source: EventLog) (EventID: 6008) (User: ) Description: The previous system shutdown at 13:18:39 on ‎28/‎10/‎2016 was unexpected. ==================== Memory info =========================== Processor: Intel(R) Core(TM) i3-2130 CPU @ 3.40GHz Percentage of memory in use: 62% Total physical RAM: 6017.66 MB Available physical RAM: 2232.64 MB Total Virtual: 12033.51 MB Available Virtual: 7982.38 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:450.2 GB) (Free:389.75 GB) NTFS Drive d: (Fotos Turini) (CDROM) (Total:1.64 GB) (Free:0 GB) UDF ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 56BEFE53) Partition 1: (Not Active) - (Size=450.2 GB) - (Type=07 NTFS) Partition 2: (Active) - (Size=15.6 GB) - (Type=07 NTFS) ==================== End of Addition.txt ============================