API tools faq
paste
ShadiNachat

Addition

ShadiNachat
Dec 20th, 2015
133
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 46.20 KB | None | 0 0
raw download clone embed print report
  1. Additional scan result of Farbar Recovery Scan Tool (x64) Version:20-12-2015
  2. Ran by Shadi Nachat (2015-12-20 08:31:40)
  3. Running from C:\Users\Shadi Nachat\Desktop
  4. Windows 10 Home (X64) (2015-12-19 14:05:21)
  5. Boot Mode: Normal
  6. ==========================================================
  7.  
  8.  
  9. ==================== Accounts: =============================
  10.  
  11. Administrator (S-1-5-21-2493256202-1442530197-93608786-500 - Administrator - Disabled)
  12. DefaultAccount (S-1-5-21-2493256202-1442530197-93608786-503 - Limited - Disabled)
  13. Guest (S-1-5-21-2493256202-1442530197-93608786-501 - Limited - Disabled)
  14. Shadi Nachat (S-1-5-21-2493256202-1442530197-93608786-1001 - Administrator - Enabled) => C:\Users\Shadi Nachat
  15.  
  16. ==================== Security Center ========================
  17.  
  18. (If an entry is included in the fixlist, it will be removed.)
  19.  
  20. AV: ESET NOD32 Antivirus 9.0.349.0 (Enabled - Up to date) {19259FAE-8396-A113-46DB-15B0E7DFA289}
  21. AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
  22. AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
  23. AS: ESET NOD32 Antivirus 9.0.349.0 (Enabled - Up to date) {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834}
  24.  
  25. ==================== Installed Programs ======================
  26.  
  27. (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
  28.  
  29. Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 3.3.0.151 - Adobe Systems Incorporated)
  30. Adobe Illustrator CC 2015 (HKLM-x32\...\ILST_19_1_1) (Version: 19.1.1 - Adobe Systems Incorporated)
  31. Alcor Micro USB Card Reader Driver (HKLM-x32\...\AmUStor) (Version: 20.21.3317.03861 - Alcor Micro Corp.)
  32. Alcor Micro USB Card Reader Driver (x32 Version: 20.21.3317.03861 - Alcor Micro Corp.) Hidden
  33. Android SDK Tools (HKLM-x32\...\Android SDK Tools) (Version: 1.16 - Google Inc.)
  34. Android Studio (HKLM\...\Android Studio) (Version: 1.0 - Google Inc.)
  35. Application Insights Tools for Visual Studio 2015 (x32 Version: 3.3 - Microsoft Corporation) Hidden
  36. Azure AD Authentication Connected Service (x32 Version: 14.0.23107 - Microsoft Corporation) Hidden
  37. AzureTools.Notifications (x32 Version: 2.7.30611.1601 - Microsoft Corporation) Hidden
  38. Better ListView 3.15.0 (HKLM-x32\...\Better ListView_is1) (Version: 3.15.0 - Libor Tinka, ComponentOwl.com)
  39. Blend for Visual Studio SDK for .NET 4.5 (x32 Version: 3.0.40218.0 - Microsoft Corporation) Hidden
  40. BlueStacks App Player (HKLM-x32\...\BlueStacks App Player) (Version: 0.9.30.9239 - BlueStack Systems, Inc.)
  41. BlueStacks Notification Center (HKLM-x32\...\{3792811C-832F-4392-B44A-24092901EDDC}) (Version: 0.9.30.9239 - BlueStack Systems, Inc.)
  42. chmProcessor (HKLM-x32\...\{03EB9CC9-D8B5-42EC-B98C-F3C57BCA7847}) (Version: 1.7.2 - ToniBSoft)
  43. CodeLite (HKLM-x32\...\CodeLite_is1) (Version: 8.1.0 - Eran Ifrah)
  44. Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version: - Valve)
  45. DisableMSDefender (Version: 1.0.0 - Hewlett-Packard Company) Hidden
  46. Dotfuscator and Analytics Community Edition 5.18.1 (x32 Version: 5.18.1.2898 - PreEmptive Solutions) Hidden
  47. Epic Games Launcher (HKLM\...\{CB510119-C58D-4443-BD87-59B2D951F019}) (Version: 1.1.31.0 - Epic Games, Inc.)
  48. ESET NOD32 Antivirus (HKLM\...\{39609CFB-57C5-4879-9C76-8BE895969C5B}) (Version: 9.0.349.0 - ESET, spol. s r.o.)
  49. FileZilla Client 3.14.1 (HKLM-x32\...\FileZilla Client) (Version: 3.14.1 - Tim Kosse)
  50. Foxit PhantomPDF (HKLM-x32\...\{00CD7D62-056A-4F0F-9143-44522D44E6DD}) (Version: 6.0.32.507 - Foxit Corporation)
  51. Genymotion version 2.5.3 (HKLM\...\{6D180286-D4DF-40EF-9227-923B9C07C08A}_is1) (Version: 2.5.3 - Genymobile)
  52. Google Chrome (HKLM-x32\...\Google Chrome) (Version: 47.0.2526.106 - Google Inc.)
  53. Google Update Helper (x32 Version: 1.3.29.1 - Google Inc.) Hidden
  54. Gtk# for .Net 2.12.26 (HKLM-x32\...\{BC25B808-A11C-4C9F-9C0A-6682E47AAB83}) (Version: 2.12.26 - Xamarin, Inc.)
  55. Gyazo 3.1.6 (HKLM-x32\...\{6DB8C365-E719-4BA5-9594-10DFC244D3FD}_is1) (Version: - Nota Inc.)
  56. Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
  57. HP Documentation (HKLM-x32\...\{4B4EDB7B-4F54-4B86-8A4A-E1C5803CA374}) (Version: 1.2.0.0 - Hewlett-Packard)
  58. HP Registration Service (HKLM\...\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.7745.4851 - Hewlett-Packard)
  59. HP SimplePass (HKLM-x32\...\InstallShield_{314FAD12-F785-4471-BCE8-AB506642B9A1}) (Version: 8.01.11 - Hewlett-Packard)
  60. HP Support Assistant (HKLM-x32\...\{79C54A05-F146-4EA0-8A70-D4EFE6181E52}) (Version: 8.1.40.3 - Hewlett-Packard Company)
  61. HP Support Information (HKLM-x32\...\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 13.00.0000 - Hewlett-Packard)
  62. HP Support Solutions Framework (HKLM-x32\...\{55065080-504F-43BB-BE00-36B80D7D39A5}) (Version: 12.0.30.219 - Hewlett-Packard Company)
  63. Icecream Screen Recorder version 2.72 (HKLM-x32\...\{7ADEC622-3230-4C9A-9DCE-9BD462B74095}_is1) (Version: 2.72 - Icecream Apps)
  64. Inst5675 (Version: 8.01.11 - Softex Inc.) Hidden
  65. Inst5676 (Version: 8.01.11 - Softex Inc.) Hidden
  66. Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.4276 - Intel Corporation)
  67. Intel(R) Trusted Execution Engine (HKLM\...\{176E2755-0A17-42C6-88E2-192AB2131278}) (Version: 1.0.0.1064 - Intel Corporation)
  68. Java 7 Update 71 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217071FF}) (Version: 7.0.710 - Oracle)
  69. Java 7 Update 79 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417079FF}) (Version: 7.0.790 - Oracle)
  70. Java 8 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218051F0}) (Version: 8.0.510 - Oracle Corporation)
  71. Java SE Development Kit 7 Update 71 (HKLM-x32\...\{32A3A4F4-B792-11D6-A78A-00B0D0170710}) (Version: 1.7.0.710 - Oracle)
  72. Java SE Development Kit 7 Update 79 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0170790}) (Version: 1.7.0.790 - Oracle)
  73. join.me (HKU\S-1-5-21-2493256202-1442530197-93608786-1001\...\JoinMe) (Version: 2.9.0.1558 - LogMeIn, Inc.)
  74. join.me.launcher (x32 Version: 1.0.622.0 - LogMeIn, Inc.) Hidden
  75. KeyScrambler (HKLM-x32\...\KeyScrambler) (Version: 3.8.2.0 - QFX Software Corporation)
  76. LoiLo Game Recorder (HKLM\...\{89E4163C-BD19-45A9-BCEB-980741786799}_is1) (Version: 1.1.0.1 - LoiLo inc.)
  77. Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
  78. MEGAsync (HKLM-x32\...\MEGAsync) (Version: - Mega Limited)
  79. Microsoft .NET Framework 4.5 Multi-Targeting Pack (HKLM-x32\...\{56E962F0-4FB0-3C67-88DB-9EAA6EEFC493}) (Version: 4.5.50710 - Microsoft Corporation)
  80. Microsoft .NET Framework 4.5.1 Multi-Targeting Pack (ENU) (HKLM-x32\...\{D3517C62-68A5-37CF-92F7-93C029A89681}) (Version: 4.5.50932 - Microsoft Corporation)
  81. Microsoft .NET Framework 4.5.1 Multi-Targeting Pack (HKLM-x32\...\{6A0C6700-EA93-372C-8871-DCCF13D160A4}) (Version: 4.5.50932 - Microsoft Corporation)
  82. Microsoft .NET Framework 4.5.1 SDK (HKLM-x32\...\{19A5926D-66E1-46FC-854D-163AA10A52D3}) (Version: 4.5.51641 - Microsoft Corporation)
  83. Microsoft .NET Framework 4.5.2 Multi-Targeting Pack (ENU) (HKLM-x32\...\{290FC320-2F5A-329E-8840-C4193BD7A9EE}) (Version: 4.5.51209 - Microsoft Corporation)
  84. Microsoft .NET Framework 4.5.2 Multi-Targeting Pack (HKLM-x32\...\{B941AFB4-8851-33A1-9E72-0C33D463C41C}) (Version: 4.5.51209 - Microsoft Corporation)
  85. Microsoft .NET Framework 4.6 SDK (HKLM-x32\...\{B5915D37-0637-4A26-A3AA-C5DC9F856370}) (Version: 4.6.00081 - Microsoft Corporation)
  86. Microsoft .NET Framework 4.6 Targeting Pack (ENU) (HKLM-x32\...\{3D3CEBE6-40EA-4C48-97FD-73828281AB4A}) (Version: 4.6.00081 - Microsoft Corporation)
  87. Microsoft .NET Framework 4.6 Targeting Pack (HKLM-x32\...\{2CC6A4A7-AAC2-46C9-9DBB-3727B5954F65}) (Version: 4.6.00081 - Microsoft Corporation)
  88. Microsoft Help Viewer 2.2 (HKLM-x32\...\Microsoft Help Viewer 2.2) (Version: 2.2.23107 - Microsoft Corporation)
  89. Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4569.1506 - Microsoft Corporation)
  90. Microsoft SQL Server 2014 Management Objects (HKLM-x32\...\{2774595F-BC2A-4B12-A25B-0C37A37049B0}) (Version: 12.0.2000.8 - Microsoft Corporation)
  91. Microsoft SQL Server 2014 Management Objects (x64) (HKLM\...\{1F9EB3B6-AED7-4AA7-B8F1-8E314B74B2A5}) (Version: 12.0.2000.8 - Microsoft Corporation)
  92. Microsoft SQL Server 2014 Transact-SQL ScriptDom (HKLM\...\{020CDFE0-C127-4047-B571-37C82396B662}) (Version: 12.0.2000.8 - Microsoft Corporation)
  93. Microsoft SQL Server 2014 T-SQL Language Service (HKLM-x32\...\{47D08E7A-92A1-489B-B0BF-415516497BCE}) (Version: 12.0.2000.8 - Microsoft Corporation)
  94. Microsoft SQL Server Compact 4.0 SP1 x64 ENU (HKLM\...\{78909610-D229-459C-A936-25D92283D3FD}) (Version: 4.0.8876.1 - Microsoft Corporation)
  95. Microsoft System CLR Types for SQL Server 2014 (HKLM\...\{68BA34E8-9B9D-4A74-83F0-7D366B532D75}) (Version: 12.0.2402.11 - Microsoft Corporation)
  96. Microsoft System CLR Types for SQL Server 2014 (HKLM-x32\...\{718FFB65-F6E4-4D62-861F-ED10ED32C936}) (Version: 12.0.2402.11 - Microsoft Corporation)
  97. Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
  98. Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
  99. Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
  100. Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
  101. Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
  102. Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
  103. Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
  104. Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
  105. Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
  106. Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
  107. Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
  108. Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
  109. Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
  110. Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
  111. Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
  112. Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23026 (HKLM-x32\...\{e46eca4f-393b-40df-9f49-076faf788d83}) (Version: 14.0.23026.0 - Microsoft Corporation)
  113. Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23026 (HKLM-x32\...\{74d0e5db-b326-4dae-a6b2-445b9de1836e}) (Version: 14.0.23026.0 - Microsoft Corporation)
  114. Microsoft Visual Studio Community 2015 (HKLM-x32\...\{50b32652-69d2-4b93-9316-edcd12067b8b}) (Version: 14.0.23107.10 - Microsoft Corporation)
  115. Minecraft (HKLM-x32\...\{1C16BCA3-EBC1-49F6-8623-8FBFB9CCC872}) (Version: 1.0.3.0 - Mojang)
  116. Mozilla Firefox 43.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 43.0.1 (x86 en-US)) (Version: 43.0.1 - Mozilla)
  117. Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 43.0.1.5828 - Mozilla)
  118. Multi-Device Hybrid Apps using C# - Templates - ENU (x32 Version: 14.0.23107 - Microsoft Corporation) Hidden
  119. NetBeans IDE 8.1 Beta (HKLM\...\nbi-nb-base-8.1.0.0.201508041349) (Version: 8.1 Beta - NetBeans.org)
  120. Nmap 5.51 (HKLM-x32\...\Nmap) (Version: - )
  121. Node.js (HKLM-x32\...\{69735668-F8BC-4E9A-839A-4006FDFDD5AC}) (Version: 0.12.2 - Joyent, Inc. and other Node contributors)
  122. Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.7.9.2 - Notepad++ Team)
  123. OpenVPN 2.3.7-I602 (HKLM\...\OpenVPN) (Version: 2.3.7-I602 - )
  124. Oracle VM VirtualBox 5.0.10 (HKLM\...\{F6E922CF-068D-4AFC-8DBF-4636B84AF0A5}) (Version: 5.0.10 - Oracle Corporation)
  125. Parallels 2X RDP-64 bit (HKLM\...\{E91CBFF1-B868-4DC0-9220-E6462D20E329}) (Version: 14.1.3444 - Parallels 2X Software Ltd.)
  126. Pidgin (HKLM-x32\...\Pidgin) (Version: 2.10.11 - )
  127. pidgin-otr 4.0.0-1 (HKLM-x32\...\pidgin-otr) (Version: 4.0.0-1 - Cypherpunks CA)
  128. PreEmptive Analytics Visual Studio Components (x32 Version: 1.2.5134.1 - PreEmptive Solutions) Hidden
  129. Process Hacker 2.36 (r6153) (HKLM\...\Process_Hacker2_is1) (Version: 2.36.0.6153 - wj32)
  130. Proxifier version 3.28 (HKLM-x32\...\Proxifier_is1) (Version: 3.28 - Initex)
  131. puush (HKLM-x32\...\{C3592426-531E-4110-911D-BFECE2CE284B}) (Version: 1.0.0.0 - Dean Herbert)
  132. Python 2.7.10 (HKLM-x32\...\{E2B51919-207A-43EB-AE78-733F9C6797C2}) (Version: 2.7.10150 - Python Software Foundation)
  133. Python 3.4.3 (HKLM-x32\...\{CCD588A7-8D55-49F1-A30C-47FAB40889ED}) (Version: 3.4.16490 - Python Software Foundation)
  134. Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.30164 - Realtek Semiconductor Corp.)
  135. Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7535 - Realtek Semiconductor Corp.)
  136. REALTEK Wireless LAN Driver (HKLM-x32\...\{A5107464-AA9B-4177-8129-5FF2F42DD322}) (Version: 1.00.13.1216 - REALTEK Semiconductor Corp.)
  137. Recordit version 0.2 (HKLM-x32\...\{F41ECB1B-8749-4F80-8335-B0A68A8F76EF}_is1) (Version: 0.2 - Freshout)
  138. Recovery Manager (x32 Version: 5.5.0.7316 - CyberLink Corp.) Hidden
  139. Resource Hacker Version 4.2.5 (HKLM-x32\...\ResourceHacker_is1) (Version: - )
  140. Roslyn Language Services - x86 (x32 Version: 14.0.23107 - Microsoft Corporation) Hidden
  141. Sandboxie 5.06 (64-bit) (HKLM\...\Sandboxie) (Version: 5.06 - Sandboxie Holdings, LLC)
  142. Skype Web Plugin (HKLM-x32\...\{A5A8F96E-B1D7-451A-8DE7-2A6A9BA26443}) (Version: 7.3.0.501 - Skype Technologies S.A.)
  143. Skype™ 7.7 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.7.102 - Skype Technologies S.A.)
  144. Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
  145. TAP-Windows 9.21.1 (HKLM\...\TAP-Windows) (Version: 9.21.1 - )
  146. TDM-GCC (HKLM-x32\...\TDM-GCC) (Version: 1.1309.0 - TDM)
  147. Team Explorer for Microsoft Visual Studio 2015 (x32 Version: 14.0.23102 - Microsoft Corporation) Hidden
  148. TeamSpeak 3 Client (HKU\S-1-5-21-2493256202-1442530197-93608786-1001\...\TeamSpeak 3 Client) (Version: 3.0.18 - TeamSpeak Systems GmbH)
  149. TeamViewer 11 (HKLM-x32\...\TeamViewer) (Version: 11.0.53254 - TeamViewer)
  150. Test Tools for Microsoft Visual Studio 2015 (x32 Version: 14.0.23107 - Microsoft Corporation) Hidden
  151. Update for (KB2504637) (HKLM-x32\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}.KB2504637) (Version: 1 - Microsoft Corporation)
  152. VMware Player (HKLM\...\{49CDE7BF-ED37-4753-A02D-AE23F8CD9FF7}) (Version: 12.0.1 - VMware, Inc.)
  153. Vuze (HKLM-x32\...\8461-7759-5462-8226) (Version: 5.6.1.2 - Azureus Software, Inc.)
  154. WCF Data Services 5.6.4 Runtime (x32 Version: 5.6.62175.4 - Microsoft Corporation) Hidden
  155. WCF Data Services Tools for Microsoft Visual Studio 2015 (x32 Version: 5.6.62175.4 - Microsoft Corporation) Hidden
  156. WinHTTrack Website Copier 3.48-21 (x64) (HKLM\...\WinHTTrack Website Copier_is1) (Version: 3.48.21 - HTTrack)
  157. WinPcap 4.1.2 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2001 - CACE Technologies)
  158. WinRAR 4.20 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
  159. Wireshark 1.99.8 (64-bit) (HKLM-x32\...\Wireshark) (Version: 1.99.8 - The Wireshark developer community, hxxps://www.wireshark.org)
  160. Xamarin (HKLM-x32\...\{9D5E4FC0-7E1B-4934-8504-C0958FA73EA5}) (Version: 3.11.837.0 - Xamarin)
  161. Xamarin Studio 5.9.5 (HKLM-x32\...\{C0110ACF-7868-4116-9BE3-BDE193655215}) (Version: 5.9.5.10 - Xamarin)
  162. Xamarin Universal Installer (HKLM-x32\...\{7712af8a-6ddd-4800-8e70-8396be7ff273}) (Version: 3.5.0.0 - Xamarin, Inc)
  163. XAMPP (HKLM-x32\...\xampp) (Version: 5.5.27-1 - Bitnami)
  164.  
  165. ==================== Custom CLSID (Whitelisted): ==========================
  166.  
  167. (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
  168.  
  169. CustomCLSID: HKU\S-1-5-21-2493256202-1442530197-93608786-1001_Classes\CLSID\{0E270DAA-1BE6-48F2-AC49-292F8CC3EDD3}\InprocServer32 -> %%systemroot%%\system32\shell32.dll => No File
  170. CustomCLSID: HKU\S-1-5-21-2493256202-1442530197-93608786-1001_Classes\CLSID\{20BEBD18-11D0-4470-AAE1-F34B9E8D9761}\InprocServer32 -> C:\Users\Shadi Nachat\AppData\Local\SkypePlugin\7.3.0.501\GatewayActiveX-x64.dll (Skype Technologies S.A.)
  171. CustomCLSID: HKU\S-1-5-21-2493256202-1442530197-93608786-1001_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\Shadi Nachat\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\FileCoAuth.exe (Microsoft Corporation)
  172. CustomCLSID: HKU\S-1-5-21-2493256202-1442530197-93608786-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)
  173. CustomCLSID: HKU\S-1-5-21-2493256202-1442530197-93608786-1001_Classes\CLSID\{B5322578-1624-4C26-BB8C-E366FFB9314F}\localserver32 -> C:\Users\Shadi Nachat\AppData\Local\SkypePlugin\7.3.0.501\GatewayVersion-x64.exe (Skype Technologies S.A.)
  174. CustomCLSID: HKU\S-1-5-21-2493256202-1442530197-93608786-1001_Classes\CLSID\{e8c77137-e224-5791-b6e9-ff0305797a13}\InprocServer32 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)
  175.  
  176. ==================== Restore Points =========================
  177.  
  178. 19-12-2015 16:03:15 Removed Python 2.7.10
  179.  
  180. ==================== Hosts content: ==========================
  181.  
  182. (If needed Hosts: directive could be included in the fixlist to reset Hosts.)
  183.  
  184. 2015-12-17 14:11 - 2015-12-18 17:18 - 00000085 ____A C:\WINDOWS\system32\Drivers\etc\hosts
  185.  
  186. 127.0.0.1 jotti.org
  187. 127.0.0.1 viruschef.com
  188. 127.0.0.1 donotdistribute.com
  189.  
  190. ==================== Scheduled Tasks (Whitelisted) =============
  191.  
  192. (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
  193.  
  194. Task: {0AE1E272-A2FF-4ADD-B32A-FB9C6DA5239B} - System32\Tasks\{63F3D199-73DA-4277-BBB4-D2017E4CFD29} => Chrome.exe hxxp://ui.skype.com/ui/0/7.10.0.101/en/abandoninstall?page=tsProgressBar
  195. Task: {19F6F0C2-2826-4785-957E-64A1B7DD690F} - System32\Tasks\{9F78F060-BD75-4F35-8AF1-E879DEE22246} => Chrome.exe hxxp://www.skype.com/go/downloading?source=lightinstaller&ver=7.11.0.102&LastError=12007
  196. Task: {1E668035-D317-404D-A06F-1F7FA8579CC9} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
  197. Task: {3452CA6A-E17C-46CA-85B9-522782243992} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
  198. Task: {3DC7F828-BC75-4328-84A1-6895E2DC5A08} - System32\Tasks\[email protected] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2015-09-04] (Adobe Systems Incorporated)
  199. Task: {3EEF52CA-16F5-4548-8A60-6CBA1B6A8629} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2015-09-28] (Hewlett-Packard Company)
  200. Task: {42F70A23-20BD-4D82-9D50-0014A59D010B} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
  201. Task: {4A00AD7B-4CAE-48E1-A66C-0162AB39661F} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
  202. Task: {52349F53-53CB-402B-AC1F-6BBA5A4C63BD} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
  203. Task: {66342871-5FCF-4352-87BD-CFBE2DA55499} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2015-09-27] (Hewlett-Packard)
  204. Task: {6B3AD3A4-D36C-4D82-A8F0-561429ACBE21} - System32\Tasks\Hewlett-Packard\HP Active Health\HP Active Health Scan (HPSA) => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2015-11-04] (Hewlett-Packard)
  205. Task: {737BD953-51D9-4428-B1C6-0B9119BF1DC5} - System32\Tasks\GyazoUpdateTaskMachine => C:\Program Files (x86)\Gyazo\GyazoUpdate.exe [2015-08-19] ()
  206. Task: {7496ADE7-D9AA-44D1-AE55-D74B77DA8E98} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
  207. Task: {7BD99BA7-2E57-4792-B013-709AE87C00CC} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
  208. Task: {8391B92E-0E4C-4ADD-A21A-DC5B77A22C49} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-07-06] (Google Inc.)
  209. Task: {8831984B-857F-443D-A79E-23CD17BF54E3} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
  210. Task: {88775745-0471-48D8-87EA-7A0742A4993F} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Active Health Launcher => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2015-11-04] (Hewlett-Packard)
  211. Task: {907C8FD4-8831-484D-B226-5D5C6E7A0CF9} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
  212. Task: {93A0EE19-1604-4D5C-8162-B9B6FC7CA0B0} - \CCleanerSkipUAC -> No File <==== ATTENTION
  213. Task: {A6CB17B6-FC8C-4291-BA96-0357E3A6DE4C} - System32\Tasks\HPCeeScheduleForShadi Nachat => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2015-06-16] (Hewlett-Packard)
  214. Task: {AAE61F1B-C66E-460B-9360-E6CE69266724} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
  215. Task: {E18E98A5-6705-4542-925B-4FE2E3A2A155} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-12-10] (Microsoft Corporation)
  216. Task: {E5F54E44-EEB8-4E0E-A6FB-F29D43C7E0A2} - System32\Tasks\GyazoUpdateTaskMachineDaily => C:\Program Files (x86)\Gyazo\GyazoUpdate.exe [2015-08-19] ()
  217. Task: {FADF05DB-79B2-421B-8D20-F39C3C737B8B} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
  218. Task: {FDFEC1E9-C62C-448A-99C9-843EF850D737} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2015-09-28] (Hewlett-Packard Company)
  219. Task: {FF06C278-7289-4867-9617-5D638EC902BF} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-07-06] (Google Inc.)
  220.  
  221. (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
  222.  
  223. Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  224. Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  225. Task: C:\WINDOWS\Tasks\HPCeeScheduleForShadi Nachat.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
  226.  
  227. ==================== Shortcuts =============================
  228.  
  229. (The entries could be listed to be restored or removed.)
  230.  
  231. ShortcutWithArgument: C:\Users\Shadi Nachat\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js command prompt.lnk -> C:\Windows\SysWOW64\cmd.exe (Microsoft Corporation) -> /k "C:\Program Files (x86)\nodejs\nodevars.bat"
  232.  
  233. ==================== Loaded Modules (Whitelisted) ==============
  234.  
  235. 2015-10-29 23:18 - 2015-10-29 23:18 - 00185856 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
  236. 2014-03-28 12:31 - 2014-03-28 12:31 - 02110464 _____ () C:\Program Files\Hewlett-Packard\SimplePass\autheng.dll
  237. 2014-03-28 12:27 - 2014-03-28 12:27 - 00021504 _____ () C:\Program Files\Hewlett-Packard\SimplePass\cryptodll.dll
  238. 2014-03-28 12:27 - 2014-03-28 12:27 - 00035328 _____ () C:\Program Files\Hewlett-Packard\SimplePass\ssplogon.dll
  239. 2014-03-28 12:27 - 2014-03-28 12:27 - 00055296 _____ () C:\Program Files\Hewlett-Packard\SimplePass\RandomPass.dll
  240. 2014-03-28 12:48 - 2014-03-28 12:48 - 00367504 _____ () C:\Program Files\Hewlett-Packard\SimplePass\mstrpwd.dll
  241. 2014-03-28 12:48 - 2014-03-28 12:48 - 00712080 _____ () C:\Program Files\Hewlett-Packard\SimplePass\GraphicalPwd.dll
  242. 2015-12-19 05:04 - 2015-12-19 05:04 - 02653816 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
  243. 2015-12-19 05:04 - 2015-12-19 05:04 - 02653816 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
  244. 2015-09-11 19:02 - 2015-09-11 19:02 - 00803488 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll
  245. 2014-05-01 06:13 - 2014-05-01 06:13 - 00470016 _____ () C:\Users\Shadi Nachat\AppData\Local\MEGAsync\ShellExtX64.dll
  246. 2015-04-15 12:13 - 2015-04-15 12:13 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
  247. 2015-12-19 05:04 - 2015-12-19 05:04 - 00591360 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
  248. 2015-12-19 05:04 - 2015-12-19 05:04 - 02483200 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
  249. 2015-12-19 08:22 - 2015-12-19 08:25 - 00144384 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.12.15004.0_x86__8wekyb3d8bbwe\SkypeHost.exe
  250. 2015-12-19 05:04 - 2015-12-19 05:04 - 00093696 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Windows.UI.Shell.SharedUtilities.dll
  251. 2015-12-19 05:04 - 2015-12-19 05:04 - 00472064 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
  252. 2015-12-19 05:04 - 2015-12-19 05:04 - 07992832 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
  253. 2015-12-19 05:04 - 2015-12-19 05:04 - 04089856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
  254. 2014-03-28 12:36 - 2014-03-28 12:36 - 00065024 _____ () C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe
  255. 2015-12-19 05:04 - 2015-12-19 05:04 - 03081568 _____ () C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\ContentDeliveryManager.Background.dll
  256. 2015-12-19 05:04 - 2015-12-19 05:04 - 02394976 _____ () C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\ContentManagementSDK.dll
  257. 2015-10-18 18:33 - 2015-10-18 18:33 - 01301696 _____ () C:\Program Files (x86)\VMware\VMware Player\libxml2.dll
  258. 2014-05-01 06:15 - 2014-05-01 06:15 - 00463360 _____ () C:\Users\Shadi Nachat\AppData\Local\MEGAsync\ShellExtX32.dll
  259. 2015-12-19 08:22 - 2015-12-19 08:25 - 00141312 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.12.15004.0_x86__8wekyb3d8bbwe\SkypeBackgroundTasks.dll
  260. 2015-12-19 08:22 - 2015-12-19 08:25 - 21845504 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.12.15004.0_x86__8wekyb3d8bbwe\SkyWrap.dll
  261. 2015-10-16 02:02 - 2015-10-16 02:02 - 00039384 _____ () C:\Program Files\FileZilla FTP Client\fzshellext.dll
  262. 2015-12-16 16:04 - 2015-12-10 19:54 - 01583432 _____ () C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.106\libglesv2.dll
  263. 2015-12-16 16:04 - 2015-12-10 19:54 - 00081224 _____ () C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.106\libegl.dll
  264.  
  265. ==================== Alternate Data Streams (Whitelisted) =========
  266.  
  267. (If an entry is included in the fixlist, only the ADS will be removed.)
  268.  
  269.  
  270. ==================== Safe Mode (Whitelisted) ===================
  271.  
  272. (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
  273.  
  274.  
  275. ==================== EXE Association (Whitelisted) ===============
  276.  
  277. (If an entry is included in the fixlist, the registry item will be restored to default or removed.)
  278.  
  279.  
  280. ==================== Internet Explorer trusted/restricted ===============
  281.  
  282. (If an entry is included in the fixlist, it will be removed from the registry.)
  283.  
  284.  
  285. ==================== Other Areas ============================
  286.  
  287. (Currently there is no automatic fix for this section.)
  288.  
  289. HKU\S-1-5-21-2493256202-1442530197-93608786-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Shadi Nachat\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\1957_wallpaper_3840x2160_4k_ultrahd.jpg
  290. DNS Servers: 8.8.8.8 - 8.8.4.4
  291. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
  292. Windows Firewall is disabled.
  293.  
  294. ==================== MSCONFIG/TASK MANAGER disabled items ==
  295.  
  296. (Currently there is no automatic fix for this section.)
  297.  
  298. MSCONFIG\Services: Steam Client Service => 3
  299. MSCONFIG\Services: TeamViewer => 2
  300. HKLM\...\StartupApproved\Run32: => "Adobe Creative Cloud"
  301. HKLM\...\StartupApproved\Run32: => "BlueStacks Agent"
  302. HKLM\...\StartupApproved\Run32: => "AdobeAAMUpdater-1.0"
  303. HKU\S-1-5-21-2493256202-1442530197-93608786-1001\...\StartupApproved\Run: => "Skype"
  304. HKU\S-1-5-21-2493256202-1442530197-93608786-1001\...\StartupApproved\Run: => "OneDrive"
  305. HKU\S-1-5-21-2493256202-1442530197-93608786-1001\...\StartupApproved\Run: => "Steam"
  306. HKU\S-1-5-21-2493256202-1442530197-93608786-1001\...\StartupApproved\Run: => "join.me.launcher"
  307. HKU\S-1-5-21-2493256202-1442530197-93608786-1001\...\StartupApproved\Run: => "ManyCam"
  308. HKU\S-1-5-21-2493256202-1442530197-93608786-1001\...\StartupApproved\Run: => "Uninstall C:\Users\Shadi Nachat\AppData\Local\Microsoft\OneDrive\17.3.5907.0716\amd64"
  309. HKU\S-1-5-21-2493256202-1442530197-93608786-1001\...\StartupApproved\Run: => "Uninstall C:\Users\Shadi Nachat\AppData\Local\Microsoft\OneDrive\17.3.5892.0626\amd64"
  310. HKU\S-1-5-21-2493256202-1442530197-93608786-1001\...\StartupApproved\Run: => "Uninstall C:\Users\Shadi Nachat\AppData\Local\Microsoft\OneDrive\17.3.5930.0814\amd64"
  311. HKU\S-1-5-21-2493256202-1442530197-93608786-1001\...\StartupApproved\Run: => "puush"
  312.  
  313. ==================== FirewallRules (Whitelisted) ===============
  314.  
  315. (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
  316.  
  317. FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
  318. FirewallRules: [{8A17E872-899A-4F0B-9AAA-AC37C45070F2}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  319. FirewallRules: [{55D1595C-C33E-42E6-85A7-5CCE1A3FC2FC}] => (Allow) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
  320. FirewallRules: [{8E1B8515-98BB-45A9-808D-5DE859E0EF1D}] => (Allow) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
  321. FirewallRules: [{4D5DD46B-95C7-46DF-AE63-CBB95713D5A3}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
  322. FirewallRules: [{81EDAEE0-1D1B-4B18-9195-CAFD2B91B0AF}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
  323. FirewallRules: [{DCDE8A89-930E-48E5-B631-DA8E96B5AA24}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPDeviceDetection3.exe
  324. FirewallRules: [{F1F270F7-C30D-41F3-AEAC-7BB7ADA46914}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
  325. FirewallRules: [{CF9F0D8B-EE5B-446D-A956-C4F904CD10F5}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
  326. FirewallRules: [{4BD2EAFB-5111-4ABD-9331-54A882370281}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
  327. FirewallRules: [{B0A6EBD7-4717-41BB-AE41-F260378D720D}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
  328. FirewallRules: [{46B31DF6-E6CF-4B9F-A799-FF0E112898F0}] => (Allow) C:\Program Files\2X\Client\\TSClient.exe
  329. FirewallRules: [{057B25E5-1761-423A-8CEF-F7525CDABEB8}] => (Allow) C:\Program Files\2X\Client\\APPServerClient.exe
  330. FirewallRules: [{23332AE7-5506-4330-A5D0-A0ADFDA4E62A}] => (Allow) LPort=50005
  331. FirewallRules: [{1B1B0CFC-7B4D-4380-B0B1-4932F92CA0D1}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
  332. FirewallRules: [{932AD9B4-273F-4216-80C8-1701E9B42C2E}] => (Allow) LPort=2486
  333. FirewallRules: [{6C14151B-A56D-4334-ABB5-0AD8B9432DE2}] => (Allow) LPort=1973
  334. FirewallRules: [{30B62072-25BE-4755-A0AA-FCC5B808017F}] => (Block) C:\users\shadi nachat\documents\everything\rats\ll\luminosity131.exe
  335. FirewallRules: [{6D794E04-43B8-401B-9E9B-EBB4386DB3B7}] => (Block) C:\users\shadi nachat\documents\everything\rats\ll\luminosity131.exe
  336. FirewallRules: [UDP Query User{5EACB5C3-5748-445D-AC72-A11C1C361135}C:\users\shadi nachat\documents\everything\rats\ll\luminosity131.exe] => (Allow) C:\users\shadi nachat\documents\everything\rats\ll\luminosity131.exe
  337. FirewallRules: [TCP Query User{521A5487-894D-4881-A658-B415F74CF957}C:\users\shadi nachat\documents\everything\rats\ll\luminosity131.exe] => (Allow) C:\users\shadi nachat\documents\everything\rats\ll\luminosity131.exe
  338. FirewallRules: [{A49E0141-BE50-468C-A1A6-12C6A830D5F0}] => (Block) C:\netcat\nc.exe
  339. FirewallRules: [{CEE9B146-286F-491B-A723-4812D6285F84}] => (Block) C:\netcat\nc.exe
  340. FirewallRules: [UDP Query User{DEF31C56-86DB-4A3F-9691-1753ED0D2EA4}C:\netcat\nc.exe] => (Allow) C:\netcat\nc.exe
  341. FirewallRules: [TCP Query User{79FA004D-826A-4179-89C0-F7DA61CE93C5}C:\netcat\nc.exe] => (Allow) C:\netcat\nc.exe
  342. FirewallRules: [UDP Query User{9E680C7B-26F1-414B-9789-D062AA3F117A}C:\program files\java\jdk1.7.0_79\bin\java.exe] => (Allow) C:\program files\java\jdk1.7.0_79\bin\java.exe
  343. FirewallRules: [TCP Query User{C66A0A6A-E5B3-4051-BD7D-1F10ABEE9D0C}C:\program files\java\jdk1.7.0_79\bin\java.exe] => (Allow) C:\program files\java\jdk1.7.0_79\bin\java.exe
  344. FirewallRules: [UDP Query User{FAAC7AA6-2E01-45F2-9131-D4A3A1922D58}C:\program files\android\android studio\bin\studio64.exe] => (Allow) C:\program files\android\android studio\bin\studio64.exe
  345. FirewallRules: [TCP Query User{1843E466-CBD8-4C07-9009-F5E30CDEFC84}C:\program files\android\android studio\bin\studio64.exe] => (Allow) C:\program files\android\android studio\bin\studio64.exe
  346. FirewallRules: [UDP Query User{CC7B71E0-87E6-4C1F-934F-7F7620E412D4}C:\users\shadi nachat\documents\everything\rats\c++ baylon\babylon rat.exe] => (Allow) C:\users\shadi nachat\documents\everything\rats\c++ baylon\babylon rat.exe
  347. FirewallRules: [TCP Query User{106B9FF3-EA21-46C6-AD1F-DF196F064168}C:\users\shadi nachat\documents\everything\rats\c++ baylon\babylon rat.exe] => (Allow) C:\users\shadi nachat\documents\everything\rats\c++ baylon\babylon rat.exe
  348. FirewallRules: [{B317EF13-307F-459F-87EB-E5BAB0C53FED}] => (Block) C:\users\shadi nachat\documents\everything\rats\baylon\babylon rat.exe
  349. FirewallRules: [{135D4428-47C5-467D-9799-8CDC3E9B8051}] => (Block) C:\users\shadi nachat\documents\everything\rats\baylon\babylon rat.exe
  350. FirewallRules: [UDP Query User{28ECF33B-4E0A-4008-A1D9-593E244D3FEA}C:\users\shadi nachat\documents\everything\rats\baylon\babylon rat.exe] => (Allow) C:\users\shadi nachat\documents\everything\rats\baylon\babylon rat.exe
  351. FirewallRules: [TCP Query User{0C10E0EB-E56C-441E-9836-234606948C79}C:\users\shadi nachat\documents\everything\rats\baylon\babylon rat.exe] => (Allow) C:\users\shadi nachat\documents\everything\rats\baylon\babylon rat.exe
  352. FirewallRules: [UDP Query User{D33C3EEC-4E9A-40F6-8B30-D28810703D5E}C:\xampp\mysql\bin\mysqld.exe] => (Allow) C:\xampp\mysql\bin\mysqld.exe
  353. FirewallRules: [TCP Query User{8D904CFD-2B7C-479F-AE63-61C99C88E236}C:\xampp\mysql\bin\mysqld.exe] => (Allow) C:\xampp\mysql\bin\mysqld.exe
  354. FirewallRules: [UDP Query User{AA73E297-7DB1-4A8E-BB8E-E30E1B53549F}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
  355. FirewallRules: [TCP Query User{96DC6A18-AC0F-40C5-9B2E-E2A0E68877C1}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
  356. FirewallRules: [UDP Query User{54EE84E5-A649-4C08-9571-2EE6A1D71C6F}C:\users\shadi nachat\documents\everything\rats\im3\imminent monitor 3.exe] => (Allow) C:\users\shadi nachat\documents\everything\rats\im3\imminent monitor 3.exe
  357. FirewallRules: [TCP Query User{8E9E69DC-06A7-4071-928D-BCA076475CF4}C:\users\shadi nachat\documents\everything\rats\im3\imminent monitor 3.exe] => (Allow) C:\users\shadi nachat\documents\everything\rats\im3\imminent monitor 3.exe
  358. FirewallRules: [{88EF66F8-DFBD-4AE0-A16B-63825DA04BCA}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
  359. FirewallRules: [{82AF742D-235F-4AE5-B760-5B49A2690993}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
  360. FirewallRules: [{6C239BFA-6676-47B3-A6E2-E028F443B8F9}] => (Allow) C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\devenv.exe
  361. FirewallRules: [{CDC717B7-4038-4473-85CD-FAA282F560D3}] => (Allow) C:\Program Files (x86)\Xamarin\Bonjour\mDNSResponder.exe
  362. FirewallRules: [{0A7AC745-618A-49A4-9F64-557F7DCEA1D2}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
  363. FirewallRules: [{EF080327-F2F5-4499-82AA-7551B317A72F}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
  364. FirewallRules: [TCP Query User{AFEB3455-C5C8-41EE-85E6-CE11C5E0AE24}C:\users\shadi nachat\documents\everything\rats\nanocore\nanocore.exe] => (Allow) C:\users\shadi nachat\documents\everything\rats\nanocore\nanocore.exe
  365. FirewallRules: [UDP Query User{51D13E72-B12D-403D-989E-2136CDE4552D}C:\users\shadi nachat\documents\everything\rats\nanocore\nanocore.exe] => (Allow) C:\users\shadi nachat\documents\everything\rats\nanocore\nanocore.exe
  366. FirewallRules: [{1AF0386B-A2D0-44B2-918C-591AD78F9F2F}] => (Block) C:\users\shadi nachat\documents\everything\rats\nanocore\nanocore.exe
  367. FirewallRules: [{2E2F8207-5D12-4E38-ABEC-237EC1DD390F}] => (Block) C:\users\shadi nachat\documents\everything\rats\nanocore\nanocore.exe
  368. FirewallRules: [TCP Query User{A4A5373D-5E44-4138-B2F6-E6E22E169749}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
  369. FirewallRules: [UDP Query User{D27DCECF-C509-4B97-B294-FCAF295E9473}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
  370. FirewallRules: [{D83AEA1E-FE64-4C72-AB21-1865FC052E1F}] => (Allow) C:\Program Files (x86)\Vuze\Azureus.exe
  371. FirewallRules: [{524F8EF1-39BB-4F1F-8222-87E638D494A4}] => (Allow) C:\Program Files (x86)\Vuze\Azureus.exe
  372. FirewallRules: [TCP Query User{09908FC7-4196-49A7-BB1E-83D67158F0C6}C:\program files (x86)\vuze\azureus.exe] => (Block) C:\program files (x86)\vuze\azureus.exe
  373. FirewallRules: [UDP Query User{FC371C23-96BC-4D8F-A120-548B01240AC6}C:\program files (x86)\vuze\azureus.exe] => (Block) C:\program files (x86)\vuze\azureus.exe
  374. FirewallRules: [TCP Query User{14107696-F029-4346-825D-F2D8CBB138C1}C:\users\shadi nachat\appdata\local\skypeplugin\7.3.0.501\pluginhost.exe] => (Allow) C:\users\shadi nachat\appdata\local\skypeplugin\7.3.0.501\pluginhost.exe
  375. FirewallRules: [UDP Query User{DCF73F43-4C07-41DD-AD1C-F96672BD7314}C:\users\shadi nachat\appdata\local\skypeplugin\7.3.0.501\pluginhost.exe] => (Allow) C:\users\shadi nachat\appdata\local\skypeplugin\7.3.0.501\pluginhost.exe
  376. FirewallRules: [TCP Query User{4B9D3F77-9269-4CF1-B4B0-F3CF3FC40824}C:\program files (x86)\java\jre1.8.0_51\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_51\bin\javaw.exe
  377. FirewallRules: [UDP Query User{684FC32C-A8CB-485B-9471-3A4A9183AF7A}C:\program files (x86)\java\jre1.8.0_51\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_51\bin\javaw.exe
  378. FirewallRules: [{2CDADBA4-163A-4D1C-A5A8-2BB20B0EECB1}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
  379. FirewallRules: [{87A8D6BB-6E1A-4FEF-A277-A52C905B06C3}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
  380. FirewallRules: [{42E9579F-6B85-4D2A-996B-7866BFA28A28}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
  381. FirewallRules: [{E4BDBBEB-969B-4C37-A7B4-1AD92C761978}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
  382.  
  383. ==================== Faulty Device Manager Devices =============
  384.  
  385.  
  386. ==================== Event log errors: =========================
  387.  
  388. Application errors:
  389. ==================
  390. Error: (12/20/2015 08:25:06 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SHADI)
  391. Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2147023113 See the Microsoft-Windows-TWinUI/Operational log for additional information.
  392.  
  393. Error: (12/20/2015 08:25:04 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SHADI)
  394. Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information.
  395.  
  396. Error: (12/19/2015 04:03:27 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
  397. Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
  398.  
  399. Details:
  400. AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.
  401.  
  402. System Error:
  403. Access is denied.
  404. .
  405.  
  406. Error: (12/19/2015 10:29:13 AM) (Source: Perflib) (EventID: 1008) (User: )
  407. Description: WmiApRplC:\WINDOWS\system32\wbem\wmiaprpl.dll4
  408.  
  409. Error: (12/19/2015 10:29:13 AM) (Source: Perflib) (EventID: 1018) (User: )
  410. Description: VMware
  411.  
  412. Error: (12/19/2015 10:29:13 AM) (Source: Perflib) (EventID: 1022) (User: )
  413. Description: VMware4
  414.  
  415. Error: (12/19/2015 10:29:13 AM) (Source: Perflib) (EventID: 1023) (User: )
  416. Description: rdyboost4
  417.  
  418. Error: (12/19/2015 10:29:11 AM) (Source: PerfNet) (EventID: 2004) (User: )
  419. Description:
  420.  
  421. Error: (12/19/2015 10:29:10 AM) (Source: Perflib) (EventID: 1008) (User: )
  422. Description: LsaC:\Windows\System32\Secur32.dll4
  423.  
  424. Error: (12/19/2015 10:29:10 AM) (Source: Perflib) (EventID: 1018) (User: )
  425. Description: ASP.NET_64_2.0.50727
  426.  
  427.  
  428. System errors:
  429. =============
  430. Error: (12/20/2015 08:26:16 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
  431. Description: The BstHdDrv service failed to start due to the following error:
  432. %%2
  433.  
  434. Error: (12/20/2015 08:25:04 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
  435. Description: The User Data Access_1b57d37 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.
  436.  
  437. Error: (12/20/2015 08:25:04 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
  438. Description: The User Data Storage_1b57d37 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.
  439.  
  440. Error: (12/20/2015 08:25:04 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
  441. Description: The Contact Data_1b57d37 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.
  442.  
  443. Error: (12/20/2015 08:25:04 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
  444. Description: The Sync Host_1b57d37 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.
  445.  
  446. Error: (12/20/2015 08:25:04 AM) (Source: DCOM) (EventID: 10010) (User: SHADI)
  447. Description: CortanaUI.AppXd4tad4d57t4wtdbnnmb8v2xtzym8c1n8.mca
  448.  
  449. Error: (12/20/2015 08:25:03 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
  450. Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)UnavailableUnavailable
  451.  
  452. Error: (12/20/2015 07:50:42 AM) (Source: DCOM) (EventID: 10010) (User: NT AUTHORITY)
  453. Description: {F3B4E234-7A68-4E43-B813-E4BA55A065F6}
  454.  
  455. Error: (12/19/2015 04:34:37 PM) (Source: Schannel) (EventID: 4102) (User: NT AUTHORITY)
  456. Description: A fatal error occurred when attempting to access the TLS server credential private key. The error code returned from the cryptographic module is 0x8009030d. The internal error state is 10001.
  457.  
  458. Error: (12/19/2015 04:34:33 PM) (Source: Schannel) (EventID: 4102) (User: NT AUTHORITY)
  459. Description: A fatal error occurred when attempting to access the TLS server credential private key. The error code returned from the cryptographic module is 0x8009030d. The internal error state is 10001.
  460.  
  461.  
  462. CodeIntegrity:
  463. ===================================
  464. Date: 2015-12-19 16:50:07.064
  465. Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\KeyScrambler\x64\KeyScramblerIE.dll that did not meet the Store signing level requirements.
  466.  
  467. Date: 2015-12-19 16:50:07.052
  468. Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\KeyScrambler\x64\KeyScramblerIE.dll that did not meet the Store signing level requirements.
  469.  
  470. Date: 2015-12-19 05:54:04.556
  471. Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
  472.  
  473. Date: 2015-12-19 05:43:56.592
  474. Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
  475.  
  476. Date: 2015-12-19 05:13:01.473
  477. Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
  478.  
  479.  
  480. ==================== Memory info ===========================
  481.  
  482. Processor: Intel(R) Pentium(R) CPU J2900 @ 2.41GHz
  483. Percentage of memory in use: 33%
  484. Total physical RAM: 8072.81 MB
  485. Available physical RAM: 5377.64 MB
  486. Total Virtual: 8472.81 MB
  487. Available Virtual: 5781.73 MB
  488.  
  489. ==================== Drives ================================
  490.  
  491. Drive c: (Windows) (Fixed) (Total:914.05 GB) (Free:710.09 GB) NTFS ==>[system with boot components (obtained from drive)]
  492. Drive d: (Recovery Image) (Fixed) (Total:15.55 GB) (Free:1.96 GB) NTFS ==>[system with boot components (obtained from drive)]
  493.  
  494. ==================== MBR & Partition Table ==================
  495.  
  496. ========================================================
  497. Disk: 0 (Size: 931.5 GB) (Disk ID: 67C0F6FA)
  498.  
  499. Partition: GPT.
  500.  
  501. ==================== End of Addition.txt ============================
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!