Addition

Additional scan result of Farbar Recovery Scan Tool (x64) Version:05-03-2016 01
Ran by James (2016-03-31 12:50:21)

Running from C:\Users\James\Desktop
Windows 7 Home Premium Service Pack 1 (X64) (2016-03-06 14:07:27)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-2059866349-3918318577-506309803-500 - Administrator - Di
sabled)
Guest (S-1-5-21-2059866349-3918318577-506309803-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2059866349-3918318577-506309803-1002 - Limited - Enable
d)
James (S-1-5-21-2059866349-3918318577-506309803-1000 - Administrator - Enabled)
=> C:\Users\James
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: avast! Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD
8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF
46}
AS: avast! Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E7
36}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to un
hide them. The adware programs should be uninstalled manually.)
Torrent (HKU\S-1-5-21-2059866349-3918318577-506309803-1000\...\uTorrent) (Version
: 3.4.5.41865 - BitTorrent Inc.)
Torrent (HKU\S-1-5-21-2059866349-3918318577-506309803-1000-{ED1FC765-E35E-4C3D-BF
15-2C2B11260CE4}-0\...\uTorrent) (Version: 3.4.5.41865 - BitTorrent Inc.)
Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (V
ersion: 15.010.20060 - Adobe Systems Incorporated)
Adobe Flash Player 21 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version
: 21.0.0.182 - Adobe Systems Incorporated)
Alcor Micro USB Card Reader (HKLM-x32\...\AmUStor) (Version: 3.1.3042.60281 - Al
cor Micro Corp.)
Alcor Micro USB Card Reader (x32 Version: 3.1.3042.60281 - Alcor Micro Corp.) Hi
dden
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 11.1.2253 - AVAST Software)
Canon IJ Network Scanner Selector EX (HKLM-x32\...\Canon_IJ_Network_Scanner_Sele
ctor_EX) (Version: - Canon Inc. )
Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version: 3.1.0 Canon Inc.)
Canon IJ Scan Utility (HKLM-x32\...\Canon_IJ_Scan_Utility) (Version: - Canon Inc
. )
Canon MG3200 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_
Canon_MG3200_series) (Version: 1.01 - Canon Inc.)
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.54.28.50 - Conexant)
CutePDF Writer 3.1 (HKLM\...\CutePDF Writer Installation) (Version: 3.1 - Acro
Software Inc.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DocuNet Viewer (HKLM-x32\...\{CF7853D7-B522-4764-A15F-4F888DBC776C}) (Version: 2
.0 - Vistair)
Dolby Home Theater v4 (HKLM-x32\...\{B26438B4-BF51-49C3-9567-7F14A5E40CB9}) (Ver
sion: 7.2.7000.7 - Dolby Laboratories Inc)
eMule (HKLM-x32\...\eMule) (Version: - )
Energy Management (HKLM-x32\...\InstallShield_{D0956C11-0F60-43FE-99AD-524E83347
1BB}) (Version: 7.0.3.9 - Lenovo)
Energy Management (x32 Version: 7.0.3.9 - Lenovo) Hidden
Flickr Uploadr for Windows (HKU\S-1-5-21-2059866349-3918318577-506309803-1000\..
.\FlickrUploadrWindows) (Version: 1.0.1.292 - Flickr)
Flickr Uploadr for Windows (HKU\S-1-5-21-2059866349-3918318577-506309803-1000-{E
D1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\FlickrUploadrWindows) (Version: 1.0.1
.292 - Flickr)
Git version 2.6.3 (HKU\S-1-5-21-2059866349-3918318577-506309803-1000\...\Git_is1
) (Version: 2.6.3 - The Git Development Community)
Git version 2.6.3 (HKU\S-1-5-21-2059866349-3918318577-506309803-1000-{ED1FC765-E
35E-4C3D-BF15-2C2B11260CE4}-0\...\Git_is1) (Version: 2.6.3 - The Git Development
Community)
Git version 2.7.2 (HKLM\...\Git_is1) (Version: 2.7.2 - The Git Development Commu
nity)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 49.0.2623.87 - Google Inc.)
Google Drive (HKLM-x32\...\{895D0391-459F-4D45-B8DD-13F0DE70C66E}) (Version: 1.2
8.1549.1322 - Google, Inc.)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-0090
27A5CD4F}) (Version: 7.1.1821.1806 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.21.57 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.29.5 - Google Inc.) Hidden
Heroku Toolbelt 3.42.40 (HKLM-x32\...\Heroku Toolbelt_is1) (Version: 3.42.40 - H
eroku, Inc.)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E
4FC25798A}) (Version: 8.0.10.1464 - Intel Corporation)
Intel(R) OpenCL CPU Runtime (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}
) (Version: - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}
) (Version: 10.18.10.4276 - Intel Corporation)
Intel(R) Rapid Start Technology (HKLM-x32\...\3D073343-CEEB-4ce7-85AC-A69A7631B5
D6) (Version: 1.0.0.1021 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4
A49FC}) (Version: 11.1.0.1006 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E94029-9DF7-95650D040CF2}) (Version: 1.0.4.220 - Intel Corporation)
Intel(R) WiDi (HKLM-x32\...\{7FCB8D5D-9396-4D17-8CFA-349D6D49CD32}) (Version: 3.
0.13.0 - Intel Corporation)
Intel(R) Wireless Display (HKLM\...\{28EF7372-9087-4AC3-9B9F-D9751FCDF830}) (Ver
sion: - )
Intel(R) Wireless Music device driver (HKLM\...\{4169B8AC-D144-4E38-A9CA-637EA44
129ED}) (Version: 1.5.5323.0 - Intel Corporation)
Intel PROSet/Wireless WiFi Software (HKLM\...\{DF7756DD-656A-45C3-BA71-74673E8259
A9}) (Version: 15.00.0000.0642 - Intel Corporation)
Intelligent Touchpad (HKLM-x32\...\{FDB0A81A-1173-4B15-BEA4-89FEA0474F17}) (Vers
ion: 1.00.0108 - Lenovo)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hi
dden
Lenovo CAPOSD (HKLM-x32\...\InstallShield_{48F851E7-DD0C-4A35-AD7A-57878023E987}
) (Version: 1.0.0.7 - Lenovo)
Lenovo CAPOSD (x32 Version: 1.0.0.7 - Lenovo) Hidden
Lenovo EasyCamera (HKLM-x32\...\{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}) (Version
: 6.1.7600.142 - Realtek Semiconductor Corp.)
Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC17
7A7A4B42}) (Version: 7.0.0.3807 - CyberLink Corp.)
Lenovo OneKey Recovery (Version: 7.0.0.3807 - CyberLink Corp.) Hidden

Lenovo Smart Update (HKLM-x32\...\{29B7C0EB-A1E6-4BC3-8344-70EDE4F189F1}) (Versi
on: 1.0.29 - Lenovo Corporation)
Lenovo YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}
) (Version: 3.1.3728 - CyberLink Corp.)
Lenovo YouCam (x32 Version: 3.1.3728 - CyberLink Corp.) Hidden
LenovoDrv_x64 (HKLM\...\{83E68458-AF28-4CA4-8AFC-595A10307290}) (Version: 1.0.00
- Lenovo)
MagicDisc 2.7.106 (HKLM-x32\...\MagicDisc 2.7.106) (Version: - )
Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Mal
ware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.6.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132}
- 1033) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15
.0.4569.1506 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version
: 5.1.41212.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473
D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2
-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE
-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25
302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E
5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Nsd (HKLM-x32\...\{4677B88C-CE16-4CBB-A2CB-B76E9D456C7F}) (Version: 1.0.1.5 - Le
novo)
OpenSSH for Windows (remove only) (HKLM-x32\...\OpenSSH) (Version: - Michael Jo
hnson)
Oracle VM VirtualBox 5.0.16 (HKLM\...\{F2E958A1-9215-4C7D-9A2E-F0740B8CA5B7}) (V
ersion: 5.0.16 - Oracle Corporation)
Outils de vrification linguistique 2013 de Microsoft Office- Franais (Version: 15.0
.4569.1506 - Microsoft Corporation) Hidden
PeaZip 6.0.0 (HKLM-x32\...\{5A2BC38A-406C-4A5B-BF45-6991F9A05325}_is1) (Version:
6.0.0 - Giorgio Tani)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9.141.259 - Google, Inc.)
Port Forward Network Utilities (HKLM-x32\...\{88B1D36C-7B70-4C48-8D2F-AAB956ECF4
C3}) (Version: 2.0.20 - Portforward, LLC)
Private Internet Access Support Files (HKLM-x32\...\{7D72DAFF-DCB2-437B-BC22-4B2
ABF21462B}) (Version: 1.0.0.0 - Private Internet Access)
RailsInstaller 3.2.0 (HKU\S-1-5-21-2059866349-3918318577-506309803-1000\...\{613
C3EA5-1248-4E35-B61A-6D0B31BBC0DB}_is1) (Version: 3.2.0 - RailsInstaller Team)
RailsInstaller 3.2.0 (HKU\S-1-5-21-2059866349-3918318577-506309803-1000-{ED1FC76
5-E35E-4C3D-BF15-2C2B11260CE4}-0\...\{613C3EA5-1248-4E35-B61A-6D0B31BBC0DB}_is1)
(Version: 3.2.0 - RailsInstaller Team)
Realtek Ethernet Controller All-In-One Windows Driver (HKLM-x32\...\{F7E7F0CB-AA
41-4D5A-B6F2-8E6738EB063F}) (Version: 7.48.823.2011 - Realtek)
Ruby 2.1.7-p400 (HKU\S-1-5-21-2059866349-3918318577-506309803-1000\...\{64763A89
-6347-43AF-833F-3840615C62AE}_is1) (Version: 2.1.7-p400 - RubyInstaller Team)
Ruby 2.1.7-p400 (HKU\S-1-5-21-2059866349-3918318577-506309803-1000-{ED1FC765-E35
E-4C3D-BF15-2C2B11260CE4}-0\...\{64763A89-6347-43AF-833F-3840615C62AE}_is1) (Ver
sion: 2.1.7-p400 - RubyInstaller Team)
Ruby 2.2.4-p230-x64 (HKU\S-1-5-21-2059866349-3918318577-506309803-1000\...\{A98E
44F8-6401-400F-830E-B1A2919C22BD}_is1) (Version: 2.2.4-p230 - RubyInstaller Team
)
Ruby 2.2.4-p230-x64 (HKU\S-1-5-21-2059866349-3918318577-506309803-1000-{ED1FC765

-E35E-4C3D-BF15-2C2B11260CE4}-0\...\{A98E44F8-6401-400F-830E-B1A2919C22BD}_is1)
(Version: 2.2.4-p230 - RubyInstaller Team)
SafeZone Stable 1.48.2066.44 (x32 Version: 1.48.2066.44 - Avast Software) Hidden
Slack (HKU\S-1-5-21-2059866349-3918318577-506309803-1000\...\slack) (Version: 2.
0.2 - Slack Technologies)
Slack (HKU\S-1-5-21-2059866349-3918318577-506309803-1000-{ED1FC765-E35E-4C3D-BF1
5-2C2B11260CE4}-0\...\slack) (Version: 2.0.2 - Slack Technologies)
Sublime Text Build 3103 (HKLM\...\Sublime Text 3_is1) (Version: - Sublime HQ Pt
y Ltd)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.33.0 Synaptics Incorporated)
UserGuide (HKLM-x32\...\InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}) (V
ersion: 1.0.0.6 - Lenovo)
UserGuide (x32 Version: 1.0.0.6 - Lenovo) Hidden
Vagrant (HKLM-x32\...\{DBD58741-B374-4518-B0F7-8F33D09E3164}) (Version: 1.8.1 HashiCorp)
VeriFace (HKLM-x32\...\VeriFace) (Version: 4.0.1.1230 - Lenovo)
VLC media player (HKLM\...\VLC media player) (Version: 2.2.2 - VideoLAN)
Windows Driver Package - Lenovo (ACPIVPC) System (12/15/2011 7.1.0.1) (HKLM\...
\99841829BE839365AA67B2AD0E50D371F59F8A1E) (Version: 12/15/2011 7.1.0.1 - Lenovo
)
Windows Driver Package - Lenovo Corporation (LAD) System (01/13/2012 1.0.0.2) (
HKLM\...\5E61CDC4058A17FE9BE3046B1846F3118CD618B1) (Version: 01/13/2012 1.0.0.2
- Lenovo Corporation)
Windows Driver Package - OPTO ELECTRONICS CO.,LTD (optousb) Ports (06/02/2008 2
.0.5.5) (HKLM\...\245A139F08D3D69654D8822673D0B5EBFB63EF38) (Version: 06/02/2008
2.0.5.5 - OPTO ELECTRONICS CO.,LTD)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - M
icrosoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983
-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. T
he file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-2059866349-3918318577-506309803-1000-{ED1FC765-E35E-4C
3D-BF15-2C2B11260CE4}-0_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\loc
alserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
CustomCLSID: HKU\S-1-5-21-2059866349-3918318577-506309803-1000_Classes\CLSID\{82
0D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.
exe (Intel Corporation)
==================== Scheduled Tasks (Whitelisted) =============
Task: {052E4A3E-AADA-4FA6-9B34-6D7F98916A84} - System32\Tasks\Microsoft\Office\O
ffice 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Share
d\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)
Task: {0BC6939A-8162-4AE2-9A34-DA8942EE95C2} - System32\Tasks\MirageAgent => C:\
Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [2011-01-29] (CyberLink)
Task: {15FC8966-31E0-4938-A330-AAC7E5C3E44E} - System32\Tasks\Microsoft\Office\O
fficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe
[2014-01-23] (Microsoft Corporation)
Task: {3BB7AD0C-9440-4997-AAF6-E9B1ECF46A15} - System32\Tasks\avast! Emergency U
pdate => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2016-03-08] (A
VAST Software)
Task: {49939D6E-85FC-4F07-A152-3BCCB356DB6C} - System32\Tasks\Private Internet A
ccess Startup => C:\Program Files\pia_manager\pia_manager.exe [2016-03-26] ()
Task: {6A34B25D-619D-42F1-AE94-05090EF208E5} - System32\Tasks\Adobe Acrobat Upda
te Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [201512-14] (Adobe Systems Incorporated)
Task: {6B3BD1BC-46A2-434A-918C-237EC9D037A6} - System32\Tasks\Microsoft\Windows\
Media Center\ConfigureInternetTimeService
Task: {75E62446-AB8D-4799-8905-CAD47B1DFF3F} - System32\Tasks\Microsoft Office 1
5 Sync Maintenance for James-PC-James James-PC => C:\Program Files\Microsoft Off
ice\Office15\MsoSync.exe [2014-07-27] (Microsoft Corporation)
Task: {824DCB2D-51D5-46E9-A1E3-C9B2B402405C} - System32\Tasks\SafeZone scheduled
Autoupdate 1458756490 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe
[2016-02-01] (Avast Software)
Task: {84CED6F4-2A31-4865-BFFA-7E96E4AEE074} - System32\Tasks\Intel Rapid Start T
echnology Manager => C:\Program Files (x86)\Intel\irstrt\RapidStartConfig.exe [2
012-02-06] (Intel)
Task: {88D8FE30-F7C9-4619-A242-C1930F66F5F6} - System32\Tasks\AVAST Software\Ava
st settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.e
xe [2016-03-08] (AVAST Software)
Task: {92610F99-3FED-4739-971A-CC368C0CD017} - System32\Tasks\GoogleUpdateTaskMa
chineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-03-06]
(Google Inc.)
Task: {D31A1E88-1C74-4C5D-AC49-43D1881DCE6D} - System32\Tasks\GoogleUpdateTaskMa
chineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-03-06] (G
oogle Inc.)
Task: {DC7EAE3B-F96A-4893-A4E8-10C275CFB3F3} - System32\Tasks\Microsoft\Office\O
fficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.
exe [2014-01-23] (Microsoft Corporation)
(If an entry is included in the fixlist, the task (.job) file will be moved. The
file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)
\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\G
oogle\Update\GoogleUpdate.exe
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
Shortcut: C:\Users\James\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\R
uby 2.2.4-p230-x64\Interactive Ruby.lnk -> C:\Ruby22-x64\bin\irb.bat ()
uby 2.1.7-p400\Interactive Ruby.lnk -> C:\Program Files (x86)\Heroku\ruby-2.1.7\
bin\irb.bat ()
ailsInstaller\Interactive Ruby.lnk -> C:\RailsInstaller\Ruby2.2.0\bin\irb.bat ()
ShortcutWithArgument: C:\Users\James\AppData\Roaming\Microsoft\Windows\Start Men
u\Programs\Ruby 2.2.4-p230-x64\Start Command Prompt with Ruby.lnk -> C:\Windows\
System32\cmd.exe (Microsoft Corporation) -> /E:ON /K C:\Ruby22-x64\bin\setrbvars
.bat
u\Programs\Ruby 2.1.7-p400\Start Command Prompt with Ruby.lnk -> C:\Windows\Syst
em32\cmd.exe (Microsoft Corporation) -> /E:ON /K C:\Program Files (x86)\Heroku\r
uby-2.1.7\bin\setrbvars.bat
u\Programs\RailsInstaller\Command Prompt with Ruby and Rails.lnk -> C:\Windows\S
ystem32\cmd.exe (Microsoft Corporation) -> /E:ON /K C:\RailsInstaller\Ruby2.2.0\

setup_environment.bat C:\RailsInstaller
==================== Loaded Modules (Whitelisted) ==============
2014-10-15 00:27 - 2014-10-15 00:27 - 08897696 _____ () C:\Program Files\Microso
ft Office\Office15\1033\GrooveIntlResource.dll
2012-05-15 15:07 - 2012-05-15 15:07 - 01508192 _____ () C:\Windows\system32\IcnO
vrly.dll
2012-05-15 15:07 - 2012-05-15 15:07 - 00628064 _____ () C:\Windows\system32\Simp
leExt.dll
2008-12-20 11:20 - 2012-05-15 15:20 - 00054088 _____ () C:\Program Files (x86)\L
enovo\Energy Management\HookLib.dll
enovo\Energy Management\EMWpfUI.dll
enovo\Energy Management\kbdhook.dll
2012-05-15 15:05 - 2011-12-08 19:12 - 00291272 _____ () C:\Program Files\Lenovo\
Intelligent Touchpad\TouchZone.exe
2012-05-15 14:48 - 2010-10-26 05:40 - 00049056 _____ () C:\Program Files\Conexan
t\ForteConfig\fmapp.exe
2012-05-15 14:47 - 2012-04-16 08:17 - 00127320 _____ () C:\Program Files (x86)\I
ntel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
2009-07-14 00:50 - 2009-07-14 02:41 - 00162304 _____ () C:\Windows\system32\ntma
rta.dll
enovo\Lenovo Smart Update\HookDll.dll
enovo\Lenovo Smart Update\CommonTools.dll
enovo\Lenovo CAPOSD\QTKB.dll
2014-10-15 00:28 - 2014-10-15 00:28 - 08897696 _____ () C:\Program Files (x86)\M
icrosoft Office\Office15\1033\GrooveIntlResource.dll
2016-03-31 12:43 - 2016-03-31 12:43 - 00098816 _____ () C:\Users\James\AppData\L
ocal\Temp\_MEI35242\win32api.pyd
ocal\Temp\_MEI35242\pywintypes27.dll
ocal\Temp\_MEI35242\pythoncom27.dll
ocal\Temp\_MEI35242\win32com.shell.shell.pyd
ocal\Temp\_MEI35242\_hashlib.pyd
ocal\Temp\_MEI35242\wx._core_.pyd
ocal\Temp\_MEI35242\wx._gdi_.pyd
ocal\Temp\_MEI35242\wx._windows_.pyd
ocal\Temp\_MEI35242\wx._controls_.pyd
ocal\Temp\_MEI35242\wx._misc_.pyd
ocal\Temp\_MEI35242\pysqlite2._sqlite.pyd
ocal\Temp\_MEI35242\_ctypes.pyd
ocal\Temp\_MEI35242\win32file.pyd
ocal\Temp\_MEI35242\win32security.pyd
ocal\Temp\_MEI35242\hashobjs_ext.pyd
ocal\Temp\_MEI35242\thumbnails_ext.pyd
ocal\Temp\_MEI35242\usb_ext.pyd
ocal\Temp\_MEI35242\win32gui.pyd
ocal\Temp\_MEI35242\win32event.pyd
ocal\Temp\_MEI35242\_socket.pyd
ocal\Temp\_MEI35242\_ssl.pyd
ocal\Temp\_MEI35242\_elementtree.pyd
ocal\Temp\_MEI35242\pyexpat.pyd
ocal\Temp\_MEI35242\common.time34.pyd
ocal\Temp\_MEI35242\win32inet.pyd
ocal\Temp\_MEI35242\_psutil_windows.pyd
ocal\Temp\_MEI35242\windows._lib_cacheinvalidation.pyd
ocal\Temp\_MEI35242\win32crypt.pyd
ocal\Temp\_MEI35242\wx._html2.pyd
ocal\Temp\_MEI35242\_multiprocessing.pyd
ocal\Temp\_MEI35242\_yappi.pyd
ocal\Temp\_MEI35242\win32process.pyd
ocal\Temp\_MEI35242\unicodedata.pyd
ocal\Temp\_MEI35242\wx._animate.pyd
ocal\Temp\_MEI35242\wx._wizard.pyd
ocal\Temp\_MEI35242\win32pipe.pyd
ocal\Temp\_MEI35242\select.pyd
ocal\Temp\_MEI35242\win32pdh.pyd
ocal\Temp\_MEI35242\win32profile.pyd
ocal\Temp\_MEI35242\win32ts.pyd
2016-03-06 23:10 - 2016-03-06 23:10 - 00172544 _____ () C:\Windows\assembly\Nati
veImages_v2.0.50727_32\IsdiInterop\b4aed9b5bac22d4e9008e99e935fe2de\IsdiInterop.
ni.dll
ntel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
ntel\Intel(R) Management Engine Components\UNS\ACE.dll
==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
he "AlternateShell" will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to d
efault or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers
\etc\hosts
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-2059866349-3918318577-506309803-1000\Control Panel\Desktop\\Wallpap
er -> C:\Users\James\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpape
r.jpg
HKU\S-1-5-21-2059866349-3918318577-506309803-1000-{ED1FC765-E35E-4C3D-BF15-2C2B1
1260CE4}-0\Control Panel\Desktop\\Wallpaper -> C:\Users\James\AppData\Roaming\Mi
crosoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: Media is not connected to internet.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPrompt
BehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)
MpsSvc => Firewall Service is not running.
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== FirewallRules (Whitelisted) ===============
FirewallRules: [{5758CB33-3E84-48BD-8010-C9FBEBB74AB9}] => (Allow) C:\Program Fi
les\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{2DE165C3-7F32-4CD0-BC34-9EA9CE92FB0E}] => (Allow) C:\Program Fi
les (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{F5767B47-B10B-4B04-B47A-9ED4F23C6F0D}] => (Allow) LPort=2869

FirewallRules: [{E4DCE5D1-1686-40D5-B0BE-DA87E83A760A}] => (Allow) LPort=1900
FirewallRules: [{BEE8CB08-1C63-433E-AB81-43E58841D98C}] => (Allow) C:\Program Fi
les (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{2BC1F7F2-B561-4385-98DB-1FC63C94F1C9}] => (Allow) C:\Program Fi
les (x86)\Windows Live\Mesh\MOE.exe
FirewallRules: [{05E8C009-7B39-4E62-9CFD-9D35A98672D2}] => (Allow) C:\Program Fi
les\Common Files\mcafee\mcsvchost\McSvHost.exe
FirewallRules: [{E69ECD5D-D3D6-4E10-AC46-E21271855034}] => (Allow) C:\Program Fi
les\Common Files\mcafee\mcsvchost\McSvHost.exe
FirewallRules: [{2B7A8562-68B5-4EA5-BAEF-90859D6153D4}] => (Allow) C:\Program Fi
les (x86)\Intel Corporation\Intel WiDi\WiDiApp.exe
FirewallRules: [TCP Query User{C3A775A5-1488-4912-9674-268EF5CC454B}C:\program f
iles (x86)\emule\emule.exe] => (Block) C:\program files (x86)\emule\emule.exe
FirewallRules: [UDP Query User{367B220D-29E5-4450-AA91-0964760202D7}C:\program f
iles (x86)\emule\emule.exe] => (Block) C:\program files (x86)\emule\emule.exe
FirewallRules: [{42B9AFB7-898B-4BDC-BC7D-51636ACC13D6}] => (Allow) C:\Users\Jame
s\AppData\Local\Maelstrom\Application\chrome.native.torrent.exe
FirewallRules: [{89B3D3D4-2248-4CBC-B4F4-3F4FA28504B3}] => (Allow) C:\Users\Jame
s\AppData\Local\Maelstrom\Application\chrome.native.torrent.exe
FirewallRules: [{1D653198-0988-4062-9CE4-90BF13B60D45}] => (Allow) C:\Users\Jame
s\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{BE0E8FA5-8514-4057-BDF9-B1D3F41CDAD3}] => (Allow) C:\Users\Jame
FirewallRules: [{44B4F559-3FFF-4FF2-90BB-D11506456696}] => (Allow) C:\Users\Jame
FirewallRules: [{FA9EABDF-0CF2-4CCD-9A23-18C604214CB5}] => (Allow) C:\Users\Jame
FirewallRules: [{8A842A06-2FEF-4EDF-B5CC-E66AAC5D6939}] => (Allow) C:\Users\Jame
FirewallRules: [{65334F5A-7F92-4A1D-B33A-C3ECAF33E8D6}] => (Allow) C:\Users\Jame
FirewallRules: [{169951BB-E450-4D4F-B37B-33DE4499AAA6}] => (Allow) C:\Program Fi
les\Microsoft Office\Office15\lync.exe
FirewallRules: [{5AED1661-8511-4FE1-B3CB-1AEA5CA41159}] => (Allow) C:\Program Fi
les\Microsoft Office\Office15\lync.exe
FirewallRules: [{D687AC5B-8059-47B4-B3BE-4E75223CC831}] => (Allow) C:\Program Fi
les\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{B571F5EA-5A2A-48B3-8539-C535F2426C92}] => (Allow) C:\Program Fi
les\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{0B800B6A-8B75-40D5-8A2D-DF1197A2B4F2}] => (Allow) C:\Program Fi
les (x86)\Google\Chrome\Application\chrome.exe
==================== Restore Points =========================
Check "winmgmt" service or repair WMI.
==================== Faulty Device Manager Devices =============
Could not list Devices. Check "winmgmt" service or repair WMI.
==================== Event log errors: =========================
Application errors:
==================
Error: (03/31/2016 12:52:41 PM) (Source: Application Error) (EventID: 1000) (Use
r: )
Description: Faulting application name: TrustedInstaller.exe, version: 6.1.7601.
17514, time stamp: 0x4ce7989b

Faulting module name: wcp.dll, version: 6.1.7601.18766, time stamp: 0x54e4396d
Exception code: 0xc0000005
Fault offset: 0x00000000000b1c19
Faulting process id: 0x79c
Faulting application start time: 0xTrustedInstaller.exe0
Faulting application path: TrustedInstaller.exe1
Faulting module path: TrustedInstaller.exe2
Report Id: TrustedInstaller.exe3
r: )
Faulting process id: 0x654
r: )
r: )
Faulting process id: 0xb04
r: )
Faulting process id: 0xfa0

r: )
Faulting process id: 0x4d4
r: )
Faulting process id: 0xda8
r: )
Faulting process id: 0xc58
r: )
r: )

Faulting process id: 0xc08
System errors:
=============
Error: (03/31/2016 12:52:41 PM) (Source: Service Control Manager) (EventID: 7034
) (User: )
Description: The Windows Modules Installer service terminated unexpectedly. It
has done this 13 time(s).
) (User: )
Description: The Service Control Manager tried to take a corrective action (Rest
art the service) after the unexpected termination of the Windows Modules Install
er service, but this action failed with the following error:
%%1056
) (User: )
) (User: )
) (User: )
) (User: )
) (User: )
) (User: )
) (User: )
) (User: )

CodeIntegrity:
===================================
Date: 2016-03-31 12:45:21.152
Description: Windows is unable to verify the image integrity of the file \Devi
ce\HarddiskVolume3\Windows\System32\drivers\http.sys because file hash could not
be found on the system. A recent hardware or software change might have install
ed a file that is signed incorrectly or damaged, or that might be malicious soft
ware from an unknown source.
Date: 2016-03-31 12:45:21.011
Date: 2016-03-31 12:45:08.219
Date: 2016-03-31 12:45:08.126
Date: 2016-03-31 12:43:12.480
Date: 2016-03-31 12:43:12.371
Date: 2016-03-30 14:09:06.438
Date: 2016-03-30 14:09:06.313
Date: 2016-03-30 14:09:03.583

Date: 2016-03-30 14:09:03.490
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-3317U CPU @ 1.70GHz
Percentage of memory in use: 42%
Total physical RAM: 3957.07 MB
Available physical RAM: 2281.08 MB
Total Virtual: 7912.35 MB
Available Virtual: 6002.4 MB
==================== Drives ================================
Drive c: (Windows7_OS) (Fixed) (Total:420.56 GB) (Free:136.34 GB) NTFS ==>[syste
m with boot components (obtained from drive)]
Drive d: (LENOVO) (Fixed) (Total:25.47 GB) (Free:10.42 GB) NTFS
Drive e: (Office2013-PPVL-x64-Nov2014) (CDROM) (Total:2.22 GB) (Free:0 GB) UDF
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 8 GB) (Disk ID: 9A2B7625)
Partition 1: (Not Active) - (Size=8 GB) - (Type=84)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 9A2B7621)
Partition 1: (Active) - (Size=200 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=420.6 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=25.5 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=19.3 GB) - (Type=12)
==================== End of Addition.txt ============================

Addition

Загружено:

Сведения о документе

Авторское право

Доступные форматы

Поделиться этим документом

Поделиться или встроить документ

Параметры публикации

Этот документ был вам полезен?

Это неприемлемый материал?

Авторское право:

Доступные форматы

Addition

Загружено:

Авторское право:

Доступные форматы

Additional scan result of Farbar Recovery Scan Tool (x64) Version:05-03-2016 01

Ran by James (2016-03-31 12:50:21)

Lenovo OneKey Recovery (Version: 7.0.0.3807 - CyberLink Corp.) Hidden

Ruby 2.2.4-p230-x64 (HKU\S-1-5-21-2059866349-3918318577-506309803-1000-{ED1FC765

ystem32\cmd.exe (Microsoft Corporation) -> /E:ON /K C:\RailsInstaller\Ruby2.2.0\

==================== Alternate Data Streams (Whitelisted) =========

FirewallRules: [{F5767B47-B10B-4B04-B47A-9ED4F23C6F0D}] => (Allow) LPort=2869

17514, time stamp: 0x4ce7989b

Report Id: TrustedInstaller.exe3

Fault offset: 0x00000000000b1c19

has done this 5 time(s).

Date: 2016-03-30 14:09:03.583

Вам также может понравиться