Publicité
Publicité
Format du document : text/plain
Prévisualisation
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-09-2016 02
Ran by DrSergiooW (25-09-2016 12:47:55)
Running from C:\Users\DrSergiooW\Desktop
Windows 7 Ultimate Service Pack 1 (X64) (2016-05-14 16:25:25)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-2269977139-798740666-968023483-500 - Administrator - Disabled)
DrSergiooW (S-1-5-21-2269977139-798740666-968023483-1000 - Administrator - Enabled) => C:\Users\DrSergiooW
Guest (S-1-5-21-2269977139-798740666-968023483-501 - Limited - Disabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Norton Internet Security (Disabled - Up to date) {53C7D717-52E2-B95E-FA61-6F32ECC805DB}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Norton Internet Security (Disabled - Up to date) {E8A636F3-74D8-B6D0-C0D1-5440974F4F66}
FW: Norton Internet Security (Enabled) {6BFC5632-188D-B806-D13E-C607121B42A0}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
µTorrent (HKU\S-1-5-21-2269977139-798740666-968023483-1000\...\uTorrent) (Version: 3.4.7.42330 - BitTorrent Inc.)
Baidu PC Faster (HKLM-x32\...\Baidu PC Faster 5.1.0.0) (Version: 5.1.3.126764 - Baidu, Inc.)
Elcomsoft Phone Password Breaker (HKLM-x32\...\{91E3CFF8-5A2F-4895-A6BE-6883A66C6CD8}) (Version: 3.00.106.2053 - Elcomsoft Co. Ltd.)
Flashtool (HKLM-x32\...\Flashtool) (Version: 0.9.18.4 - Androxyde)
Google Chrome (HKU\S-1-5-21-2269977139-798740666-968023483-1000\...\Google Chrome) (Version: 52.0.2743.116 - Google Inc.)
HP LaserJet Professional P1100-P1560-P1600 Series (HKLM\...\HP LaserJet Professional P1100-P1560-P1600 Series) (Version: - )
iFunbox (v3.0.3109.1352) (HKLM-x32\...\iFunbox_is1) (Version: v3.0.3109.1352 - iFunbox DevTeam)
Internet Download Manager (HKLM-x32\...\Internet Download Manager) (Version: - Tonek Inc.)
iTools 3 version 3.3.0.3 (HKLM-x32\...\{9AD3B3CA-16DF-4113-9178-89263F2E3820}_is1) (Version: 3.3.0.3 - Thinksky, Inc.)
K-Lite Codec Pack 12.1.0 Full (HKLM-x32\...\KLiteCodecPack_is1) (Version: 12.1.0 - KLCP)
Libyana Net (HKLM-x32\...\Libyana Net) (Version: 11.300.05.12.373 - Huawei Technologies Co.,Ltd)
Malwarebytes Anti-Malware النسخة 2.1.4.1018 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.4.1018 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 2010 Service Pack 1 (SP1) (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{7BC9B5EB-125A-4E9B-97E1-8D85B5E960B8}) (Version: - Microsoft)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.6029.1000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Mozilla Firefox 41.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 41.0 (x86 en-US)) (Version: 41.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 41.0 - Mozilla)
Norton Internet Security (HKLM-x32\...\NIS) (Version: 22.7.1.32 - Symantec Corporation)
Opera Stable 40.0.2308.62 (HKLM-x32\...\Opera 40.0.2308.62) (Version: 40.0.2308.62 - Opera Software)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7161 - Realtek Semiconductor Corp.)
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.51.0 - SAMSUNG Electronics Co., Ltd.)
SHAREit (HKLM-x32\...\SHAREit_is1) (Version: 3.5.0.1144 - Lenovo)
Snagit 12 (HKLM-x32\...\{bdac23f5-7943-42cf-ba56-4732fc20b6a7}) (Version: 12.0.0.1001 - TechSmith Corporation)
Tenorshare Reiboot (HKLM-x32\...\Tenorshare Reiboot) (Version: 3.1.0.6 - Tenorshare)
UltraISO Premium V9.33 (HKLM-x32\...\UltraISO_is1) (Version: - )
Viber (HKU\S-1-5-21-2269977139-798740666-968023483-1000\...\{6ac8839e-3aad-46d0-b1ae-484a26d68bab}) (Version: 5.9.0.115 - Viber Media Inc.)
Viber (x32 Version: 5.9.0.115 - Viber Media Inc.) Hidden
Windows 7 USB/DVD Download Tool (HKLM-x32\...\{CCF298AF-9CE1-4B26-B251-486E98A34789}) (Version: 1.0.30 - Microsoft Corporation)
WinRAR archiver (HKLM-x32\...\WinRAR archiver) (Version: - )
حزمة برامج تشغيل Windows - Hewlett-Packard Image (12/27/2006 8.0.0.0) (HKLM\...\F5E51FDA4F39B4D4F8A1DF9178FCF7947925E0F1) (Version: 12/27/2006 8.0.0.0 - Hewlett-Packard)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-2269977139-798740666-968023483-1000_Classes\CLSID\{590C4387-5EBD-4D46-8A84-CD0BA2EF2856}\InprocServer32 -> C:\Users\DrSergiooW\AppData\Local\Google\Update\1.3.30.3\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-2269977139-798740666-968023483-1000_Classes\CLSID\{59B55F04-DE14-4BB8-92FF-C4A22EF2E5F4}\InprocServer32 -> C:\Users\DrSergiooW\AppData\Local\Google\Update\1.3.31.5\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-2269977139-798740666-968023483-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\DrSergiooW\AppData\Local\Google\Update\1.3.31.5\psuser_64.dll (Google Inc.)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {2913218D-2ACE-46C5-9F93-5FEAD88CA128} - System32\Tasks\klcp_update => C:\Program Files (x86)\K-Lite Codec Pack\Tools\CodecTweakTool.exe [2016-04-18] ()
Task: {45201610-C68F-4BB5-9235-8E2BF3D525F7} - System32\Tasks\060184C3-9766-46a0-B258-F4518A0B2633 => Cscript.exe "C:\ProgramData\Duplicaterecord.js"
Task: {650C72AA-DE6F-46E0-8524-AF60C210EC83} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\22.7.1.32\SymErr.exe [2016-05-23] (Symantec Corporation)
Task: {66D89067-A3D8-4C8C-9B97-034CE84CAA86} - System32\Tasks\Remediation\AntimalwareMigrationTask => C:\Program Files\Common Files\AV\Norton Internet Security\Upgrade.exe [2016-08-16] (Symantec Corporation)
Task: {7102B086-954A-44C8-A844-CE7BE08DE9A5} - System32\Tasks\TechSmith Updater => C:\Program Files (x86)\Common Files\TechSmith Shared\Updater\TSCUpdClt.exe [2014-04-17] (TechSmith Corporation)
Task: {7D9F0D9E-F6BC-4F20-9E82-4BEC9B1BBF7C} - System32\Tasks\Opera scheduled Autoupdate 1463653832 => C:\Program Files (x86)\Opera\launcher.exe [2016-09-21] (Opera Software)
Task: {9F3E87D5-8F05-4CC9-A211-C6F9C03DFE57} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.)
Task: {A42F7B28-D561-4407-AF02-26A7B2C973A0} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\22.7.1.32\SymErr.exe [2016-05-23] (Symantec Corporation)
Task: {B397DB31-4F12-4166-9D00-BF5C6F6062D4} - System32\Tasks\Baidu PC Faster Update => C:\Program Files (x86)\PC Faster\5.1.0.0\Updater.exe
Task: {C7041376-FACA-4FD9-9C24-2601C0BFEB70} - System32\Tasks\Baidu PC Faster Service => C:\Program Files (x86)\PC Faster\5.1.0.0\PCFasterSvc.exe
Task: {D5DA6BFE-C91B-45D0-AC05-6E79774FBDA9} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2269977139-798740666-968023483-1000Core => C:\Users\DrSergiooW\AppData\Local\Google\Update\GoogleUpdate.exe [2016-08-24] (Google Inc.)
Task: {DF654658-E56B-4D8E-9F33-374F6442D0C8} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2269977139-798740666-968023483-1000UA => C:\Users\DrSergiooW\AppData\Local\Google\Update\GoogleUpdate.exe [2016-08-24] (Google Inc.)
Task: {F5740C9E-3CE4-4674-A05C-6B322103BF30} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\22.7.1.32\WSCStub.exe [2016-08-16] (Symantec Corporation)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2269977139-798740666-968023483-1000Core.job => C:\Users\DrSergiooW\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2269977139-798740666-968023483-1000UA.job => C:\Users\DrSergiooW\AppData\Local\Google\Update\GoogleUpdate.exe
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
==================== Loaded Modules (Whitelisted) ==============
2011-03-17 00:07 - 2011-03-17 00:07 - 04297568 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2016-05-14 19:47 - 2006-12-11 02:14 - 00043008 _____ () C:\Program Files (x86)\WinRAR\rarext64.dll
2016-05-14 19:34 - 2012-08-21 16:07 - 00288768 _____ () C:\Windows\System32\HP1100LM.DLL
2016-05-14 19:29 - 2012-09-18 15:27 - 00192512 _____ () C:\Windows\System32\zlhp1020.dll
2016-05-14 19:29 - 2012-09-18 15:27 - 00065024 _____ () C:\Windows\system32\spool\PRTPROCS\x64\pphp1020.dll
2016-05-14 19:35 - 2012-08-21 16:07 - 00074240 _____ () C:\Windows\system32\spool\PRTPROCS\x64\HP1100PP.DLL
2016-03-18 22:56 - 2016-03-18 22:56 - 00080184 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2016-03-18 22:56 - 2016-03-18 22:56 - 01040656 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2016-09-20 13:48 - 2016-09-13 17:46 - 00042064 _____ () C:\Users\DrSergiooW\AppData\Local\Viber\qrencode.dll
2016-09-20 13:48 - 2016-09-13 17:46 - 00016976 _____ () C:\Users\DrSergiooW\AppData\Local\Viber\libEGL.DLL
2016-09-20 13:48 - 2016-09-13 17:46 - 01652304 _____ () C:\Users\DrSergiooW\AppData\Local\Viber\libGLESv2.dll
2016-09-20 13:48 - 2016-09-13 17:47 - 00397904 _____ () C:\Users\DrSergiooW\AppData\Local\Viber\imageformats\qsvg.dll
2011-03-17 00:11 - 2011-03-17 00:11 - 04297568 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 05:34 - 2009-06-11 00:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-2269977139-798740666-968023483-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\DrSergiooW\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 8.8.8.8 - 8.8.4.4
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Snagit 12.lnk => C:\Windows\pss\Snagit 12.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^DrSergiooW^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^مراقبة تنبيهات الحبر - HP Deskjet 1510 series.lnk => C:\Windows\pss\مراقبة تنبيهات الحبر - HP Deskjet 1510 series.lnk.Startup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: BCSSync => "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
MSCONFIG\startupreg: HP Software Update => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: IDMan => C:\Program Files (x86)\Internet Download Manager\IDMan.exe /onboot
MSCONFIG\startupreg: iFunBox => C:\Program Files (x86)\i-Funbox DevTeam\iFunBox.exe /tray
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: RtHDVCpl => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: uTorrent => "C:\Users\DrSergiooW\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED
MSCONFIG\startupreg: Viber => "C:\Users\DrSergiooW\AppData\Local\Viber\Viber.exe" StartMinimized
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{E7D162EB-1893-452B-9A54-1577B4EF0FD9}] => (Allow) LPort=9100
FirewallRules: [{63DA1792-FFB7-4326-86CE-AA457598B440}] => (Allow) LPort=427
FirewallRules: [{EE66EF9F-0F59-45B2-9AB7-7D3C7DDBD849}] => (Allow) LPort=161
FirewallRules: [{D65A36BC-4787-4D1A-AF63-7B850CEB91E1}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{BE6BDD15-46C0-4A0C-B222-A525EA46F6D4}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{2A184AE1-8AC5-44FF-A017-2D8192EC8D3D}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{BEB57851-8CB2-462E-B474-B75437B8C6E3}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{9702B95D-E57A-4E1C-BF74-FEE13071B9E7}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{2DF56472-3C29-4B32-BE6D-166135116A1B}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{3C8A8CE8-9916-4CB9-A657-007093DFE8F1}] => (Allow) C:\Program Files (x86)\iTunes\iTunes.exe
FirewallRules: [{E56479A4-1E81-468A-A8EB-687B578C5C4D}] => (Allow) C:\Program Files (x86)\SHAREit\SHAREit\SHAREit.exe
FirewallRules: [{80316F46-AA34-40F5-94F4-70BDE6EA701F}] => (Allow) C:\Program Files (x86)\SHAREit\SHAREit\SHAREit.exe
FirewallRules: [{B9C2E147-4F6D-48E2-BB3D-5900E25C4186}] => (Allow) LPort=8298
FirewallRules: [{4F0F7749-3AF9-469C-B7FB-8092F7C6A165}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{50D25B41-FBA1-4BF8-B1B7-75DB487B6584}] => (Allow) C:\Users\DrSergiooW\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{643DAF13-E8C5-4840-BFAA-4F18D625BB0D}] => (Allow) C:\Users\DrSergiooW\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{98DAD955-EC98-423A-A65B-3620EDE48763}] => (Allow) C:\Program Files (x86)\PC Faster\5.1.0.0\WifiHotspot.exe
FirewallRules: [{69F6D671-5B58-411C-BE01-BB6E5D1C9EA3}] => (Allow) C:\Program Files (x86)\PC Faster\5.1.0.0\WifiHotspot.exe
==================== Restore Points =========================
09-08-2016 21:41:52 تثبيت حزمة برنامج تشغيل الأجهزة: NT Kernel Resources Network Service
28-08-2016 21:19:29 Installed Elcomsoft Phone Password Breaker
==================== Faulty Device Manager Devices =============
Name: USB Mass Storage Device
Description: USB Mass Storage Device
Class Guid: {36fc9e60-c465-11cf-8056-444553540000}
Manufacturer: جهاز تخزين USB المتوافق
Service: USBSTOR
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (09/25/2016 12:25:58 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Error: (09/24/2016 06:21:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: اسم التطبيق الذي يحتوي على أخطاء: svchost.exe_SysMain، الإصدار: 6.1.7600.16385، الطابع الزمني: 0x4a5bc3c1
اسم الوحدة النمطية التي تحتوي على أخطاء: sysmain.dll، الإصدار: 6.1.7601.17514، الطابع الزمني: 0x4ce7c9db
رمز الاستثناء: 0xc0000005
إزاحة الخطأ: 0x0000000000004e03
معرّف العملية التي تحتوي على خطأ: 0x5c4
وقت بدء تشغيل التطبيق الذي يحتوي على خطأ: 0x01d2167161a86b14
مسار التطبيق الذي يحتوي على خطأ: C:\Windows\system32\svchost.exe
مسار الوحدة النمطية التي تحتوي على خطأ: c:\windows\system32\sysmain.dll
معرف التقرير: 9d90bcfc-826a-11e6-acb1-50e5491abf23
Error: (09/24/2016 05:40:21 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Error: (09/24/2016 02:40:00 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Error: (09/24/2016 11:58:36 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Error: (09/22/2016 07:46:52 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Error: (09/22/2016 01:19:26 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Error: (09/22/2016 12:40:53 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Error: (09/21/2016 11:52:01 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Error: (09/21/2016 11:48:07 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: اسم التطبيق الذي يحتوي على أخطاء: plugin-container.exe، الإصدار: 41.0.0.5731، الطابع الزمني: 0x55f2546b
اسم الوحدة النمطية التي تحتوي على أخطاء: mozglue.dll، الإصدار: 41.0.0.5731، الطابع الزمني: 0x55f23e1e
رمز الاستثناء: 0x80000003
إزاحة الخطأ: 0x0000eedb
معرّف العملية التي تحتوي على خطأ: 0x102c
وقت بدء تشغيل التطبيق الذي يحتوي على خطأ: 0x01d213e4caf46642
مسار التطبيق الذي يحتوي على خطأ: C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
مسار الوحدة النمطية التي تحتوي على خطأ: C:\Program Files (x86)\Mozilla Firefox\mozglue.dll
معرف التقرير: 1dbc5a73-7fd8-11e6-af75-50e5491abf23
System errors:
=============
Error: (09/25/2016 12:24:20 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: فشل بدء تشغيل الخدمة Baidu PC Faster Service 5.1.0.0 بسبب الخطأ التالي:
يتعذر على النظام العثور على الملف المحدد.
Error: (09/25/2016 12:24:20 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 06:23:45 م on 23/12/37 was unexpected.
Error: (09/24/2016 06:21:52 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: تم إنهاء الخدمة Superfetch بشكل غير متوقع. حدث هذا 1 مرة. سيتم اتخاذ الإجراء التصحيحي التالي في غضون 60000 مللي ثانية: أعد تشغيل الخدمة.
Error: (09/24/2016 05:38:38 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: فشل بدء تشغيل الخدمة Baidu PC Faster Service 5.1.0.0 بسبب الخطأ التالي:
يتعذر على النظام العثور على الملف المحدد.
Error: (09/24/2016 02:38:21 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: فشل بدء تشغيل الخدمة Baidu PC Faster Service 5.1.0.0 بسبب الخطأ التالي:
يتعذر على النظام العثور على الملف المحدد.
Error: (09/24/2016 01:43:00 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: تم استلام التنبيه الهام التالي: 40.
Error: (09/24/2016 01:42:56 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: تم استلام التنبيه الهام التالي: 40.
Error: (09/24/2016 01:42:52 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: تم استلام التنبيه الهام التالي: 40.
Error: (09/24/2016 01:42:51 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: تم استلام التنبيه الهام التالي: 40.
Error: (09/24/2016 01:30:45 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: لقد تم حظر تحميل \??\C:\Windows\System32\drivers\TrueSight.sys نظراً لعدم التوافق مع هذا النظام. الرجاء الاتصال بمورّد البرنامج للحصول على إصدار متوافق من برنامج التشغيل.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i3-2120 CPU @ 3.30GHz
Percentage of memory in use: 24%
Total physical RAM: 8155.74 MB
Available physical RAM: 6184.93 MB
Total Virtual: 16309.66 MB
Available Virtual: 14055.87 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:210.21 GB) (Free:138.78 GB) NTFS
Drive d: (القرص المحلي) (Fixed) (Total:255.45 GB) (Free:154.04 GB) NTFS
Drive g: (Mobile Softwares) (Fixed) (Total:298.09 GB) (Free:154.57 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 0F8E0F8E)
Partition 1: (Not Active) - (Size=298.1 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 20F1FBA0)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=210.2 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=255.4 GB) - (Type=07 NTFS)
==================== End of Addition.txt ============================
Ran by DrSergiooW (25-09-2016 12:47:55)
Running from C:\Users\DrSergiooW\Desktop
Windows 7 Ultimate Service Pack 1 (X64) (2016-05-14 16:25:25)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-2269977139-798740666-968023483-500 - Administrator - Disabled)
DrSergiooW (S-1-5-21-2269977139-798740666-968023483-1000 - Administrator - Enabled) => C:\Users\DrSergiooW
Guest (S-1-5-21-2269977139-798740666-968023483-501 - Limited - Disabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Norton Internet Security (Disabled - Up to date) {53C7D717-52E2-B95E-FA61-6F32ECC805DB}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Norton Internet Security (Disabled - Up to date) {E8A636F3-74D8-B6D0-C0D1-5440974F4F66}
FW: Norton Internet Security (Enabled) {6BFC5632-188D-B806-D13E-C607121B42A0}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
µTorrent (HKU\S-1-5-21-2269977139-798740666-968023483-1000\...\uTorrent) (Version: 3.4.7.42330 - BitTorrent Inc.)
Baidu PC Faster (HKLM-x32\...\Baidu PC Faster 5.1.0.0) (Version: 5.1.3.126764 - Baidu, Inc.)
Elcomsoft Phone Password Breaker (HKLM-x32\...\{91E3CFF8-5A2F-4895-A6BE-6883A66C6CD8}) (Version: 3.00.106.2053 - Elcomsoft Co. Ltd.)
Flashtool (HKLM-x32\...\Flashtool) (Version: 0.9.18.4 - Androxyde)
Google Chrome (HKU\S-1-5-21-2269977139-798740666-968023483-1000\...\Google Chrome) (Version: 52.0.2743.116 - Google Inc.)
HP LaserJet Professional P1100-P1560-P1600 Series (HKLM\...\HP LaserJet Professional P1100-P1560-P1600 Series) (Version: - )
iFunbox (v3.0.3109.1352) (HKLM-x32\...\iFunbox_is1) (Version: v3.0.3109.1352 - iFunbox DevTeam)
Internet Download Manager (HKLM-x32\...\Internet Download Manager) (Version: - Tonek Inc.)
iTools 3 version 3.3.0.3 (HKLM-x32\...\{9AD3B3CA-16DF-4113-9178-89263F2E3820}_is1) (Version: 3.3.0.3 - Thinksky, Inc.)
K-Lite Codec Pack 12.1.0 Full (HKLM-x32\...\KLiteCodecPack_is1) (Version: 12.1.0 - KLCP)
Libyana Net (HKLM-x32\...\Libyana Net) (Version: 11.300.05.12.373 - Huawei Technologies Co.,Ltd)
Malwarebytes Anti-Malware النسخة 2.1.4.1018 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.4.1018 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 2010 Service Pack 1 (SP1) (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{7BC9B5EB-125A-4E9B-97E1-8D85B5E960B8}) (Version: - Microsoft)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.6029.1000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Mozilla Firefox 41.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 41.0 (x86 en-US)) (Version: 41.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 41.0 - Mozilla)
Norton Internet Security (HKLM-x32\...\NIS) (Version: 22.7.1.32 - Symantec Corporation)
Opera Stable 40.0.2308.62 (HKLM-x32\...\Opera 40.0.2308.62) (Version: 40.0.2308.62 - Opera Software)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7161 - Realtek Semiconductor Corp.)
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.51.0 - SAMSUNG Electronics Co., Ltd.)
SHAREit (HKLM-x32\...\SHAREit_is1) (Version: 3.5.0.1144 - Lenovo)
Snagit 12 (HKLM-x32\...\{bdac23f5-7943-42cf-ba56-4732fc20b6a7}) (Version: 12.0.0.1001 - TechSmith Corporation)
Tenorshare Reiboot (HKLM-x32\...\Tenorshare Reiboot) (Version: 3.1.0.6 - Tenorshare)
UltraISO Premium V9.33 (HKLM-x32\...\UltraISO_is1) (Version: - )
Viber (HKU\S-1-5-21-2269977139-798740666-968023483-1000\...\{6ac8839e-3aad-46d0-b1ae-484a26d68bab}) (Version: 5.9.0.115 - Viber Media Inc.)
Viber (x32 Version: 5.9.0.115 - Viber Media Inc.) Hidden
Windows 7 USB/DVD Download Tool (HKLM-x32\...\{CCF298AF-9CE1-4B26-B251-486E98A34789}) (Version: 1.0.30 - Microsoft Corporation)
WinRAR archiver (HKLM-x32\...\WinRAR archiver) (Version: - )
حزمة برامج تشغيل Windows - Hewlett-Packard Image (12/27/2006 8.0.0.0) (HKLM\...\F5E51FDA4F39B4D4F8A1DF9178FCF7947925E0F1) (Version: 12/27/2006 8.0.0.0 - Hewlett-Packard)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-2269977139-798740666-968023483-1000_Classes\CLSID\{590C4387-5EBD-4D46-8A84-CD0BA2EF2856}\InprocServer32 -> C:\Users\DrSergiooW\AppData\Local\Google\Update\1.3.30.3\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-2269977139-798740666-968023483-1000_Classes\CLSID\{59B55F04-DE14-4BB8-92FF-C4A22EF2E5F4}\InprocServer32 -> C:\Users\DrSergiooW\AppData\Local\Google\Update\1.3.31.5\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-2269977139-798740666-968023483-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\DrSergiooW\AppData\Local\Google\Update\1.3.31.5\psuser_64.dll (Google Inc.)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {2913218D-2ACE-46C5-9F93-5FEAD88CA128} - System32\Tasks\klcp_update => C:\Program Files (x86)\K-Lite Codec Pack\Tools\CodecTweakTool.exe [2016-04-18] ()
Task: {45201610-C68F-4BB5-9235-8E2BF3D525F7} - System32\Tasks\060184C3-9766-46a0-B258-F4518A0B2633 => Cscript.exe "C:\ProgramData\Duplicaterecord.js"
Task: {650C72AA-DE6F-46E0-8524-AF60C210EC83} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\22.7.1.32\SymErr.exe [2016-05-23] (Symantec Corporation)
Task: {66D89067-A3D8-4C8C-9B97-034CE84CAA86} - System32\Tasks\Remediation\AntimalwareMigrationTask => C:\Program Files\Common Files\AV\Norton Internet Security\Upgrade.exe [2016-08-16] (Symantec Corporation)
Task: {7102B086-954A-44C8-A844-CE7BE08DE9A5} - System32\Tasks\TechSmith Updater => C:\Program Files (x86)\Common Files\TechSmith Shared\Updater\TSCUpdClt.exe [2014-04-17] (TechSmith Corporation)
Task: {7D9F0D9E-F6BC-4F20-9E82-4BEC9B1BBF7C} - System32\Tasks\Opera scheduled Autoupdate 1463653832 => C:\Program Files (x86)\Opera\launcher.exe [2016-09-21] (Opera Software)
Task: {9F3E87D5-8F05-4CC9-A211-C6F9C03DFE57} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.)
Task: {A42F7B28-D561-4407-AF02-26A7B2C973A0} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\22.7.1.32\SymErr.exe [2016-05-23] (Symantec Corporation)
Task: {B397DB31-4F12-4166-9D00-BF5C6F6062D4} - System32\Tasks\Baidu PC Faster Update => C:\Program Files (x86)\PC Faster\5.1.0.0\Updater.exe
Task: {C7041376-FACA-4FD9-9C24-2601C0BFEB70} - System32\Tasks\Baidu PC Faster Service => C:\Program Files (x86)\PC Faster\5.1.0.0\PCFasterSvc.exe
Task: {D5DA6BFE-C91B-45D0-AC05-6E79774FBDA9} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2269977139-798740666-968023483-1000Core => C:\Users\DrSergiooW\AppData\Local\Google\Update\GoogleUpdate.exe [2016-08-24] (Google Inc.)
Task: {DF654658-E56B-4D8E-9F33-374F6442D0C8} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2269977139-798740666-968023483-1000UA => C:\Users\DrSergiooW\AppData\Local\Google\Update\GoogleUpdate.exe [2016-08-24] (Google Inc.)
Task: {F5740C9E-3CE4-4674-A05C-6B322103BF30} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\22.7.1.32\WSCStub.exe [2016-08-16] (Symantec Corporation)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2269977139-798740666-968023483-1000Core.job => C:\Users\DrSergiooW\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2269977139-798740666-968023483-1000UA.job => C:\Users\DrSergiooW\AppData\Local\Google\Update\GoogleUpdate.exe
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
==================== Loaded Modules (Whitelisted) ==============
2011-03-17 00:07 - 2011-03-17 00:07 - 04297568 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2016-05-14 19:47 - 2006-12-11 02:14 - 00043008 _____ () C:\Program Files (x86)\WinRAR\rarext64.dll
2016-05-14 19:34 - 2012-08-21 16:07 - 00288768 _____ () C:\Windows\System32\HP1100LM.DLL
2016-05-14 19:29 - 2012-09-18 15:27 - 00192512 _____ () C:\Windows\System32\zlhp1020.dll
2016-05-14 19:29 - 2012-09-18 15:27 - 00065024 _____ () C:\Windows\system32\spool\PRTPROCS\x64\pphp1020.dll
2016-05-14 19:35 - 2012-08-21 16:07 - 00074240 _____ () C:\Windows\system32\spool\PRTPROCS\x64\HP1100PP.DLL
2016-03-18 22:56 - 2016-03-18 22:56 - 00080184 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2016-03-18 22:56 - 2016-03-18 22:56 - 01040656 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2016-09-20 13:48 - 2016-09-13 17:46 - 00042064 _____ () C:\Users\DrSergiooW\AppData\Local\Viber\qrencode.dll
2016-09-20 13:48 - 2016-09-13 17:46 - 00016976 _____ () C:\Users\DrSergiooW\AppData\Local\Viber\libEGL.DLL
2016-09-20 13:48 - 2016-09-13 17:46 - 01652304 _____ () C:\Users\DrSergiooW\AppData\Local\Viber\libGLESv2.dll
2016-09-20 13:48 - 2016-09-13 17:47 - 00397904 _____ () C:\Users\DrSergiooW\AppData\Local\Viber\imageformats\qsvg.dll
2011-03-17 00:11 - 2011-03-17 00:11 - 04297568 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 05:34 - 2009-06-11 00:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-2269977139-798740666-968023483-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\DrSergiooW\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 8.8.8.8 - 8.8.4.4
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Snagit 12.lnk => C:\Windows\pss\Snagit 12.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^DrSergiooW^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^مراقبة تنبيهات الحبر - HP Deskjet 1510 series.lnk => C:\Windows\pss\مراقبة تنبيهات الحبر - HP Deskjet 1510 series.lnk.Startup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: BCSSync => "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
MSCONFIG\startupreg: HP Software Update => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: IDMan => C:\Program Files (x86)\Internet Download Manager\IDMan.exe /onboot
MSCONFIG\startupreg: iFunBox => C:\Program Files (x86)\i-Funbox DevTeam\iFunBox.exe /tray
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: RtHDVCpl => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: uTorrent => "C:\Users\DrSergiooW\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED
MSCONFIG\startupreg: Viber => "C:\Users\DrSergiooW\AppData\Local\Viber\Viber.exe" StartMinimized
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{E7D162EB-1893-452B-9A54-1577B4EF0FD9}] => (Allow) LPort=9100
FirewallRules: [{63DA1792-FFB7-4326-86CE-AA457598B440}] => (Allow) LPort=427
FirewallRules: [{EE66EF9F-0F59-45B2-9AB7-7D3C7DDBD849}] => (Allow) LPort=161
FirewallRules: [{D65A36BC-4787-4D1A-AF63-7B850CEB91E1}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{BE6BDD15-46C0-4A0C-B222-A525EA46F6D4}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{2A184AE1-8AC5-44FF-A017-2D8192EC8D3D}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{BEB57851-8CB2-462E-B474-B75437B8C6E3}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{9702B95D-E57A-4E1C-BF74-FEE13071B9E7}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{2DF56472-3C29-4B32-BE6D-166135116A1B}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{3C8A8CE8-9916-4CB9-A657-007093DFE8F1}] => (Allow) C:\Program Files (x86)\iTunes\iTunes.exe
FirewallRules: [{E56479A4-1E81-468A-A8EB-687B578C5C4D}] => (Allow) C:\Program Files (x86)\SHAREit\SHAREit\SHAREit.exe
FirewallRules: [{80316F46-AA34-40F5-94F4-70BDE6EA701F}] => (Allow) C:\Program Files (x86)\SHAREit\SHAREit\SHAREit.exe
FirewallRules: [{B9C2E147-4F6D-48E2-BB3D-5900E25C4186}] => (Allow) LPort=8298
FirewallRules: [{4F0F7749-3AF9-469C-B7FB-8092F7C6A165}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{50D25B41-FBA1-4BF8-B1B7-75DB487B6584}] => (Allow) C:\Users\DrSergiooW\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{643DAF13-E8C5-4840-BFAA-4F18D625BB0D}] => (Allow) C:\Users\DrSergiooW\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{98DAD955-EC98-423A-A65B-3620EDE48763}] => (Allow) C:\Program Files (x86)\PC Faster\5.1.0.0\WifiHotspot.exe
FirewallRules: [{69F6D671-5B58-411C-BE01-BB6E5D1C9EA3}] => (Allow) C:\Program Files (x86)\PC Faster\5.1.0.0\WifiHotspot.exe
==================== Restore Points =========================
09-08-2016 21:41:52 تثبيت حزمة برنامج تشغيل الأجهزة: NT Kernel Resources Network Service
28-08-2016 21:19:29 Installed Elcomsoft Phone Password Breaker
==================== Faulty Device Manager Devices =============
Name: USB Mass Storage Device
Description: USB Mass Storage Device
Class Guid: {36fc9e60-c465-11cf-8056-444553540000}
Manufacturer: جهاز تخزين USB المتوافق
Service: USBSTOR
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (09/25/2016 12:25:58 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Error: (09/24/2016 06:21:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: اسم التطبيق الذي يحتوي على أخطاء: svchost.exe_SysMain، الإصدار: 6.1.7600.16385، الطابع الزمني: 0x4a5bc3c1
اسم الوحدة النمطية التي تحتوي على أخطاء: sysmain.dll، الإصدار: 6.1.7601.17514، الطابع الزمني: 0x4ce7c9db
رمز الاستثناء: 0xc0000005
إزاحة الخطأ: 0x0000000000004e03
معرّف العملية التي تحتوي على خطأ: 0x5c4
وقت بدء تشغيل التطبيق الذي يحتوي على خطأ: 0x01d2167161a86b14
مسار التطبيق الذي يحتوي على خطأ: C:\Windows\system32\svchost.exe
مسار الوحدة النمطية التي تحتوي على خطأ: c:\windows\system32\sysmain.dll
معرف التقرير: 9d90bcfc-826a-11e6-acb1-50e5491abf23
Error: (09/24/2016 05:40:21 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Error: (09/24/2016 02:40:00 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Error: (09/24/2016 11:58:36 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Error: (09/22/2016 07:46:52 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Error: (09/22/2016 01:19:26 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Error: (09/22/2016 12:40:53 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Error: (09/21/2016 11:52:01 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Error: (09/21/2016 11:48:07 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: اسم التطبيق الذي يحتوي على أخطاء: plugin-container.exe، الإصدار: 41.0.0.5731، الطابع الزمني: 0x55f2546b
اسم الوحدة النمطية التي تحتوي على أخطاء: mozglue.dll، الإصدار: 41.0.0.5731، الطابع الزمني: 0x55f23e1e
رمز الاستثناء: 0x80000003
إزاحة الخطأ: 0x0000eedb
معرّف العملية التي تحتوي على خطأ: 0x102c
وقت بدء تشغيل التطبيق الذي يحتوي على خطأ: 0x01d213e4caf46642
مسار التطبيق الذي يحتوي على خطأ: C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
مسار الوحدة النمطية التي تحتوي على خطأ: C:\Program Files (x86)\Mozilla Firefox\mozglue.dll
معرف التقرير: 1dbc5a73-7fd8-11e6-af75-50e5491abf23
System errors:
=============
Error: (09/25/2016 12:24:20 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: فشل بدء تشغيل الخدمة Baidu PC Faster Service 5.1.0.0 بسبب الخطأ التالي:
يتعذر على النظام العثور على الملف المحدد.
Error: (09/25/2016 12:24:20 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 06:23:45 م on 23/12/37 was unexpected.
Error: (09/24/2016 06:21:52 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: تم إنهاء الخدمة Superfetch بشكل غير متوقع. حدث هذا 1 مرة. سيتم اتخاذ الإجراء التصحيحي التالي في غضون 60000 مللي ثانية: أعد تشغيل الخدمة.
Error: (09/24/2016 05:38:38 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: فشل بدء تشغيل الخدمة Baidu PC Faster Service 5.1.0.0 بسبب الخطأ التالي:
يتعذر على النظام العثور على الملف المحدد.
Error: (09/24/2016 02:38:21 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: فشل بدء تشغيل الخدمة Baidu PC Faster Service 5.1.0.0 بسبب الخطأ التالي:
يتعذر على النظام العثور على الملف المحدد.
Error: (09/24/2016 01:43:00 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: تم استلام التنبيه الهام التالي: 40.
Error: (09/24/2016 01:42:56 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: تم استلام التنبيه الهام التالي: 40.
Error: (09/24/2016 01:42:52 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: تم استلام التنبيه الهام التالي: 40.
Error: (09/24/2016 01:42:51 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: تم استلام التنبيه الهام التالي: 40.
Error: (09/24/2016 01:30:45 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: لقد تم حظر تحميل \??\C:\Windows\System32\drivers\TrueSight.sys نظراً لعدم التوافق مع هذا النظام. الرجاء الاتصال بمورّد البرنامج للحصول على إصدار متوافق من برنامج التشغيل.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i3-2120 CPU @ 3.30GHz
Percentage of memory in use: 24%
Total physical RAM: 8155.74 MB
Available physical RAM: 6184.93 MB
Total Virtual: 16309.66 MB
Available Virtual: 14055.87 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:210.21 GB) (Free:138.78 GB) NTFS
Drive d: (القرص المحلي) (Fixed) (Total:255.45 GB) (Free:154.04 GB) NTFS
Drive g: (Mobile Softwares) (Fixed) (Total:298.09 GB) (Free:154.57 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 0F8E0F8E)
Partition 1: (Not Active) - (Size=298.1 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 20F1FBA0)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=210.2 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=255.4 GB) - (Type=07 NTFS)
==================== End of Addition.txt ============================