Additional scan result of Farbar Recovery Scan Tool (x64) Version: 08-05-2017 Ran by fundowic (14-05-2017 11:50:08) Running from C:\Users\fundowic\Desktop\FRST Windows 7 Enterprise Service Pack 1 (X64) (2016-03-09 14:33:37) Boot Mode: Normal ========================================================== ==================== Accounts: ============================= Guest (S-1-5-21-2644034118-1358276528-2457853829-501 - Limited - Disabled) roostar (S-1-5-21-2644034118-1358276528-2457853829-500 - Administrator - Enabled) ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) ==================== Installed Programs ====================== (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) Acrobat XI Pro (Version: 1.2.0000 - Adobe Systems Incorporated) Hidden Adobe Acrobat XI Pro (HKLM-x32\...\{23D3F585-AE29-4670-8E3E-64A0EFB29240}) (Version: 11.0 - Adobe Systems Incorporated) Adobe Reader XI (11.0.20) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.20 - Adobe Systems Incorporated) Adobe Shockwave Player 12.1 (HKLM-x32\...\{07C5D2FF-2AA8-46D1-B9E8-BACCD34C8E01}) (Version: 12.1.4.154 - Adobe Systems, Inc) ArcGIS 10.1 for Desktop (HKLM-x32\...\ArcGIS 10.1 for Desktop) (Version: 10.1.3035 - Environmental Systems Research Institute, Inc.) ArcGIS 10.1 for Desktop (x32 Version: 10.1.3035 - Environmental Systems Research Institute, Inc.) Hidden CDBurnerXP (64 bit) (HKLM\...\{785E0636-7EB7-4D40-A1D1-F85902378E98}) (Version: 4.5.4.5143 - Canneverbe Limited) Configuration Manager Client (Version: 5.00.8412.1000 - Microsoft Corporation) Hidden Dell Touchpad (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 8.1206.101.112 - ALPS ELECTRIC CO., LTD.) ET GeoWizards 11.1 for ArcGIS 10.1 (HKLM-x32\...\{2F314F78-689D-4380-A969-594C40988DCD}) (Version: 11.1 - ET SpatialTechniques) FileZilla Client 3.9.0.6 (HKLM-x32\...\FileZilla Client) (Version: 3.9.0.6 - Tim Kosse) FME Desktop 2015.0 (Build 15250 - win64) (HKLM\...\{3F7D7AFE-73C3-1014-B276-6DE295802905}) (Version: 7.4.15250 - Safe Software Inc.) FreeMouseAutoClicker 3.8 (HKLM-x32\...\{292F00C5-25EF-4FBE-9873-13EF1F69DEED}_is1) (Version: - Advanced Mouse Auto Clicker ltd.) Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3977 - Intel Corporation) Internet Explorer 11 (x32 Version: 11.0 - Microsoft Corporation) Hidden IObit Malware Fighter 5 (HKLM-x32\...\IObit Malware Fighter_is1) (Version: 5.0 - IObit) IObit Uninstaller (HKLM-x32\...\IObitUninstall) (Version: 6.3.0.18 - IObit) Java 8 Update 111 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180111F0}) (Version: 8.0.1110.14 - Oracle Corporation) Java 8 Update 73 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218073F0}) (Version: 8.0.730.2 - Oracle Corporation) Java SE Development Kit 8 Update 74 (HKLM-x32\...\{32A3A4F4-B792-11D6-A78A-00B0D0180740}) (Version: 8.0.740.2 - Oracle Corporation) K-Lite Codec Pack 12.6.5 Full (HKLM-x32\...\KLiteCodecPack_is1) (Version: 12.6.5 - KLCP) Local Administrator Password Solution (HKLM\...\{EA8CB806-C109-4700-96B4-F1F268E5036C}) (Version: 6.2.0.0 - Microsoft Corporation) McAfee Agent (HKLM\...\{3B644EA1-30AB-42A9-8A80-750854073723}) (Version: 5.0.4.449 - McAfee, Inc.) McAfee VirusScan Enterprise (HKLM-x32\...\{CE15D1B6-19B6-4D4D-8F43-CF5D2C3356FF}) (Version: 8.8.06000 - McAfee, Inc.) MDOP MBAM (HKLM\...\{1B0FF767-2365-4E2B-91D1-93D442944055}) (Version: 2.5.0244.0 - Microsoft Corporation) Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation) Microsoft Lync 2013 (HKLM-x32\...\Office15.LYNC) (Version: 15.0.4569.1506 - Microsoft Corporation) Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50901.0 - Microsoft Corporation) Microsoft SQL Server 2008 Native Client (HKLM\...\{BBDE8A3D-64A2-43A6-95F3-C27B87DF7AC1}) (Version: 10.1.2531.0 - Microsoft Corporation) Microsoft SQL Server 2012 Native Client (HKLM\...\{D411E9C9-CE62-4DBF-9D92-4CB22B750ED5}) (Version: 11.1.3000.0 - Microsoft Corporation) Microsoft System CLR Types for SQL Server 2012 (x64) (HKLM\...\{F1949145-EB64-4DE7-9D81-E6D27937146C}) (Version: 11.0.2100.60 - Microsoft Corporation) Microsoft Visio Viewer 2013 (HKLM-x32\...\{95150000-0052-0409-0000-0000000FF1CE}) (Version: 15.0.4420.1017 - Microsoft Corporation) Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation) Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation) Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation) MKS Integrity Client 2009 (HKLM-x32\...\MKS Integrity Client 2009) (Version: 4.10.0.0 - MKS Inc.) MKS Toolkit 9.2 for MKS Integrity (HKLM\...\{09FE637A-1D0C-4D77-90E0-12302F0B707C}) (Version: 9.2.0200 - Mortice Kern Systems) MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation) NapiProjekt (2.2.0.2399) (HKLM-x32\...\NapiProjekt_is1) (Version: - ) Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.9.1 - Notepad++ Team) Oracle Data Provider for .NET Help (HKLM-x32\...\{6AA003BF-73E5-4911-ADB7-71DD5674DDD4}) (Version: 11.2.010 - Oracle Corporation) Outils de vérification linguistique 2013 de Microsoft Office - Français (x32 Version: 15.0.4569.1506 - Microsoft Corporation) Hidden pgAdmin III 1.18 (HKLM-x32\...\{B83C2BA8-F874-45F8-8E4A-07808A38D52C}) (Version: 1.18 - The pgAdmin Development Team) PostGIS 2.1.8, PgRouting 2.0 for PostgreSQL x64 9.4 (remove only) (HKLM\...\PostGIS 2.1 bundle for PostgreSQL x64 9.4) (Version: - ) PostgreSQL 9.4 (HKLM\...\PostgreSQL 9.4) (Version: 9.4 - PostgreSQL Global Development Group) Pulse Secure (Version: 5.2.977 - Pulse Secure, LLC) Hidden Pulse Secure 5.2 (HKLM-x32\...\Pulse Secure 5.2) (Version: 5.2.977 - Pulse Secure, LLC) Pulse Secure Host Checker (HKU\S-1-5-21-202387345-4201324245-3709672714-20981\...\PulseSecure_Host_Checker) (Version: 8.1.4.37683 - Pulse Secure, LLC) Pulse Secure Setup Client (HKU\.DEFAULT\...\Pulse_Setup_Client) (Version: 8.2.1.227 - Pulse Secure, LLC) Pulse Secure Setup Client (HKU\S-1-5-21-202387345-4201324245-3709672714-20981\...\Juniper_Setup_Client) (Version: 8.1.4.60331 - Pulse Secure, LLC) Pulse Secure Setup Client (HKU\S-1-5-21-202387345-4201324245-3709672714-20981\...\Pulse_Setup_Client) (Version: 8.2.6.977 - Pulse Secure, LLC) Pulse Secure Setup Client 64-bit Activex Control (HKLM\...\Pulse_Setup_Client Activex Control) (Version: 2.1.1.1 - Pulse Secure, LLC) Pulse Secure Setup Client Activex Control (HKLM-x32\...\Pulse_Setup_Client Activex Control) (Version: 2.1.1.1 - Pulse Secure, LLC) QGIS Valmiera 2.2.0 Valmiera (HKLM\...\QGIS Valmiera) (Version: - QGIS Development Team) Realtek Audio COM Components (HKLM-x32\...\{2355B503-9B11-4449-861D-1C1748B26320}) (Version: 1.0.2 - Realtek Semiconductor Corp.) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6049 - Realtek Semiconductor Corp.) Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft) Skype Click to Call (HKLM-x32\...\{873F8E7C-10E6-449F-BD7E-5FBA7C8E1C9B}) (Version: 8.5.0.9167 - Microsoft Corporation) Skype™ 7.24 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.24.104 - Skype Technologies S.A.) SQLTools 1.5 (remove only) (HKLM-x32\...\SQLTools 1.5) (Version: - ) Update for Skype for Business 2015 (KB3039776) 32-Bit Edition (HKLM-x32\...\{90150000-012B-0409-0000-0000000FF1CE}_Office15.LYNC_{9F6B3627-AF9E-40A5-AAD5-3497C4327616}) (Version: - Microsoft) VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.4 - VideoLAN) WinRAR 5.31 (64-bitowy) (HKLM\...\WinRAR archiver) (Version: 5.31.0 - win.rar GmbH) ==================== Custom CLSID (Whitelisted): ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== Scheduled Tasks (Whitelisted) ============= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) Task: {2330A2DE-4599-432B-AA3C-CB7531700AA5} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => %ProgramFiles%\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe Task: {2F14FB51-E155-4663-BBC8-5E0B4A581FC7} - System32\Tasks\Microsoft\Configuration Manager\Configuration Manager Idle Detection Task: {6114BBEC-0A8E-40A6-9FA1-4D823D65A607} - System32\Tasks\klcp_update => C:\Program Files (x86)\K-Lite Codec Pack\Tools\CodecTweakTool.exe [2016-12-01] () Task: {6EF6BE9C-B851-4B18-B479-D931DAC9B5B8} - System32\Tasks\RtHDVBg_PushButton => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2014-12-22] (Realtek Semiconductor) Task: {724E4AA6-351E-40A2-A1F6-FBB42637E702} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2017-02-02] (Adobe Systems Incorporated) Task: {AA671A1D-6F7F-41B6-B36C-C4FB3996D1C5} - System32\Tasks\Microsoft\Configuration Manager\Configuration Manager Health Evaluation => C:\WINDOWS\CCM\ccmeval.exe [2016-06-20] (Microsoft Corporation) Task: {EE21E73B-0A1F-4069-B655-DC7B874B3B2E} - System32\Tasks\Microsoft\Configuration Manager\Configuration Manager Client Upgrade Task => C:\WINDOWS\ccmsetup\ccmsetup.exe [2016-12-16] (Microsoft Corporation) (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.) ==================== Shortcuts ============================= (The entries could be listed to be restored or removed.) ==================== Loaded Modules (Whitelisted) ============== 2011-06-21 08:42 - 2011-06-21 08:42 - 00034304 _____ () C:\WINDOWS\System32\sst3cl6.dll 2017-01-05 03:44 - 2017-01-05 03:44 - 00546640 _____ () C:\Program Files\McAfee\Agent\sqlite.dll 2017-01-05 03:44 - 2017-01-05 03:44 - 00020816 _____ () C:\Program Files\McAfee\Agent\trex.dll 2017-01-05 03:30 - 2017-01-05 03:30 - 00144208 _____ () C:\Program Files\McAfee\Agent\libuv.dll 2017-01-05 03:43 - 2017-01-05 03:43 - 00051024 _____ () C:\Program Files\McAfee\Agent\MXML.dll 2017-01-05 03:45 - 2017-01-05 03:45 - 00112976 _____ () C:\Program Files\McAfee\Agent\zlib.dll 2017-01-05 03:30 - 2017-01-05 03:30 - 00026448 _____ () C:\Program Files\McAfee\Agent\libini.dll 2016-03-14 09:31 - 2015-12-07 01:31 - 00179200 _____ () C:\Program Files\PostgreSQL\9.4\bin\LIBPQ.dll 2016-03-14 09:32 - 2014-05-08 08:18 - 02197504 _____ () C:\Program Files\PostgreSQL\9.4\bin\libxml2.dll 2016-06-14 13:38 - 2016-06-14 13:38 - 08909504 _____ () C:\Program Files\Microsoft Office\Office15\1033\GrooveIntlResource.dll 2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF 2010-10-20 16:23 - 2010-10-20 16:23 - 08801632 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll 2014-12-22 20:00 - 2014-12-22 20:00 - 00456808 _____ () C:\WINDOWS\system32\igfxTray.exe 2016-11-30 04:23 - 2016-11-30 04:23 - 03209176 _____ () C:\Program Files (x86)\Common Files\Pulse Secure\JamUI\Pulse.exe 2016-11-30 04:59 - 2016-11-30 04:59 - 00391128 _____ () C:\Program Files (x86)\Common Files\Pulse Secure\JUNS\dsIpc.dll 2016-11-30 04:35 - 2016-11-30 04:35 - 00366552 _____ () C:\Program Files (x86)\Common Files\Pulse Secure\Connection Manager\ConnectionManagerService.dll 2016-11-30 03:38 - 2016-11-30 03:38 - 00055256 _____ () C:\Program Files (x86)\Common Files\Pulse Secure\JUNS\dsOpenSSL.dll 2016-11-30 04:33 - 2016-11-30 04:33 - 00243672 _____ () C:\Program Files (x86)\Common Files\Pulse Secure\ConnectionStore\ConnectionStoreService.dll 2016-11-30 04:47 - 2016-11-30 04:47 - 00235480 _____ () C:\Program Files (x86)\Common Files\Pulse Secure\Integration\IntegrationAccessMethod.dll 2016-11-30 04:37 - 2016-11-30 04:37 - 00489432 _____ () C:\Program Files (x86)\Common Files\Pulse Secure\eapService\eapService.dll 2016-11-30 04:38 - 2016-11-30 04:38 - 00219096 _____ () C:\Program Files (x86)\Common Files\Pulse Secure\8021xAccessMethod\8021xAccessMethod.dll 2016-11-30 04:24 - 2016-11-30 04:24 - 00251864 _____ () C:\Program Files (x86)\Common Files\Pulse Secure\JamUI\uiModelService.dll 2016-11-30 04:24 - 2016-11-30 04:24 - 00020440 _____ () C:\Program Files (x86)\Common Files\Pulse Secure\JamUI\uiModelServicePS.dll 2016-11-30 04:25 - 2016-11-30 04:25 - 00063448 _____ () C:\Program Files (x86)\Common Files\Pulse Secure\JamUI\uiPlugin.dll 2016-11-30 04:25 - 2016-11-30 04:25 - 00026584 _____ () C:\Program Files (x86)\Common Files\Pulse Secure\JamUI\uiPromptPluginPS.dll 2016-11-30 04:34 - 2016-11-30 04:34 - 00017880 _____ () C:\Program Files (x86)\Common Files\Pulse Secure\ConnectionStore\ConnectionStoreServicePS.dll 2017-01-05 03:44 - 2017-01-05 03:44 - 00423248 _____ () C:\Program Files\McAfee\Agent\x86\sqlite.dll 2017-01-05 03:44 - 2017-01-05 03:44 - 00019792 _____ () C:\Program Files\McAfee\Agent\x86\trex.dll 2017-01-05 03:30 - 2017-01-05 03:30 - 00132944 _____ () C:\Program Files\McAfee\Agent\x86\libuv.dll 2017-01-05 03:43 - 2017-01-05 03:43 - 00041296 _____ () C:\Program Files\McAfee\Agent\x86\MXML.dll 2017-01-05 03:29 - 2017-01-05 03:29 - 00021840 _____ () C:\Program Files\McAfee\Agent\x86\libini.dll 2014-10-22 15:01 - 2014-10-22 15:01 - 01754296 _____ () C:\Program Files (x86)\Microsoft Office\Office15\tmpod.dll 2014-01-23 08:55 - 2014-01-23 08:55 - 00022696 _____ () C:\Program Files (x86)\Microsoft Office\Office15\lynchtmlconvpxy.dll 2017-05-12 20:02 - 2016-12-12 16:52 - 00442144 _____ () C:\Program Files (x86)\IObit\IObit Malware Fighter\madExcept_.bpl 2017-05-12 20:02 - 2016-12-12 16:52 - 00210720 _____ () C:\Program Files (x86)\IObit\IObit Malware Fighter\madBasic_.bpl 2017-05-12 20:02 - 2016-12-12 16:52 - 00059680 _____ () C:\Program Files (x86)\IObit\IObit Malware Fighter\madDisAsm_.bpl 2017-05-12 20:02 - 2016-08-10 17:13 - 00899872 _____ () C:\Program Files (x86)\IObit\IObit Malware Fighter\webres.dll 2017-05-12 20:02 - 2016-12-12 16:52 - 00631584 _____ () C:\Program Files (x86)\IObit\IObit Malware Fighter\ProductStatistics.dll ==================== Alternate Data Streams (Whitelisted) ========= (If an entry is included in the fixlist, only the ADS will be removed.) ==================== Safe Mode (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\IMFservice => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeaack => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeaack.sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeavfk => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeavfk.sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfemms => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeplk => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeplk.sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfetdi2k => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfetdi2k.sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver" ==================== Association (Whitelisted) =============== (If an entry is included in the fixlist, the registry item will be restored to default or removed.) ==================== Internet Explorer trusted/restricted =============== (If an entry is included in the fixlist, it will be removed from the registry.) IE trusted site: HKU\S-1-5-21-202387345-4201324245-3709672714-20981\...\*.assets-yammer.com -> hxxps://*.assets-yammer.com IE trusted site: HKU\S-1-5-21-202387345-4201324245-3709672714-20981\...\*.hpe.com -> *.hpe.com IE trusted site: HKU\S-1-5-21-202387345-4201324245-3709672714-20981\...\*.live.com -> hxxps://*.live.com IE trusted site: HKU\S-1-5-21-202387345-4201324245-3709672714-20981\...\*.microsoftonline.com -> hxxps://*.microsoftonline.com IE trusted site: HKU\S-1-5-21-202387345-4201324245-3709672714-20981\...\*.office.com -> hxxps://*.office.com IE trusted site: HKU\S-1-5-21-202387345-4201324245-3709672714-20981\...\*.office365.com -> hxxps://*.office365.com IE trusted site: HKU\S-1-5-21-202387345-4201324245-3709672714-20981\...\*.onenote.com -> hxxps://*.onenote.com IE trusted site: HKU\S-1-5-21-202387345-4201324245-3709672714-20981\...\*.outlook.com -> hxxps://*.outlook.com IE trusted site: HKU\S-1-5-21-202387345-4201324245-3709672714-20981\...\*.sharepoint.com -> hxxps://*.sharepoint.com IE trusted site: HKU\S-1-5-21-202387345-4201324245-3709672714-20981\...\*.sway.com -> hxxps://*.sway.com IE trusted site: HKU\S-1-5-21-202387345-4201324245-3709672714-20981\...\*.windows.net -> hxxps://*.windows.net IE trusted site: HKU\S-1-5-21-202387345-4201324245-3709672714-20981\...\*.yammer.com -> hxxps://*.yammer.com IE trusted site: HKU\S-1-5-21-202387345-4201324245-3709672714-20981\...\samsungsetup.com -> hxxp://www.samsungsetup.com IE trusted site: HKU\S-1-5-21-202387345-4201324245-3709672714-20981\...\sharepoint.com -> hxxps://tomtomgroup.sharepoint.com IE trusted site: HKU\S-1-5-21-202387345-4201324245-3709672714-20981\...\tomtom.com -> *.lbs.tomtom.com ==================== Hosts content: =============================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2009-07-14 04:34 - 2017-04-21 14:20 - 00000824 _____ C:\WINDOWS\system32\Drivers\etc\hosts ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-202387345-4201324245-3709672714-20981\Control Panel\Desktop\\Wallpaper -> DNS Servers: Media is not connected to internet. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0) MpsSvc => Firewall Service is not running. ==================== MSCONFIG/TASK MANAGER disabled items == ==================== FirewallRules (Whitelisted) =============== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe FirewallRules: [{532CD997-DE8D-444F-9BFE-B02962E54EE3}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office15\lync.exe FirewallRules: [{63839EF0-A083-49FA-990A-1776DE950030}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office15\lync.exe FirewallRules: [{F99FEA11-8853-4F75-AE88-2363D0C83466}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office15\UcMapi.exe FirewallRules: [{253E92CC-D275-43A7-80A0-2F77AD186FE4}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office15\UcMapi.exe FirewallRules: [{C23CDE2C-50FE-427D-B1DB-1E7152BF7CB8}] => (Allow) C:\Program Files\McAfee\Agent\macmnsvc.exe FirewallRules: [{4B4C43FF-98AE-4816-8132-846131222078}] => (Allow) C:\Program Files\McAfee\Agent\macmnsvc.exe FirewallRules: [{89B5A374-9C1E-4F62-8E17-6B02007AB68B}] => (Allow) C:\Program Files\McAfee\Agent\macmnsvc.exe FirewallRules: [{D8758289-A7C6-4537-B654-854BE8858953}] => (Allow) C:\Program Files\McAfee\Agent\macmnsvc.exe FirewallRules: [{6C373D18-AF9A-4995-9C2D-0308E59A7210}] => (Allow) C:\Program Files\FME\fme.exe FirewallRules: [{40B809DF-BF6A-43B7-8B0D-BFC3D0B35C98}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office15\lync.exe FirewallRules: [{643A456C-255E-4A30-96C7-956BA12DE96D}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office15\lync.exe FirewallRules: [{BB05169F-61BB-41A4-876E-1DDE8EE21DB5}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office15\UcMapi.exe FirewallRules: [{D549951A-E57F-4524-9D17-BCD1EA4F5FCD}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office15\UcMapi.exe FirewallRules: [{DF088BD1-BC32-42BB-9CDF-D746139DDE89}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe FirewallRules: [{F973054C-211E-407B-B3A9-7FDBEE4CD742}] => (Allow) C:\WINDOWS\CCM\RemCtrl\CmRcService.exe FirewallRules: [{05D39ECE-CA55-41F4-9B60-62798E7CA85B}] => (Allow) C:\Program Files (x86)\NapiProjekt\napisy.exe FirewallRules: [{2EC47BAB-C4F6-48E2-8BCF-48B8B5059A96}] => (Allow) C:\Program Files (x86)\NapiProjekt\napisy.exe FirewallRules: [{FCB8248E-0465-4F6C-B529-1C058DFC245D}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Restore Points ========================= Could not list restore points Check "winmgmt" service or repair WMI. ==================== Faulty Device Manager Devices ============= Could not list Devices. Check "winmgmt" service or repair WMI. ==================== Event log errors: ========================= Application errors: ================== Error: (05/14/2017 11:39:46 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: IMF.exe, version: 5.0.2.3804, time stamp: 0x58ec4e16 Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000 Exception code: 0xc0000005 Fault offset: 0x00000000 Faulting process id: 0x12b0 Faulting application start time: 0x01d2cc95d19db0da Faulting application path: C:\Program Files (x86)\IObit\IObit Malware Fighter\IMF.exe Faulting module path: unknown Report Id: 43f18162-3889-11e7-9b53-185e0faf7b8d Error: (05/14/2017 11:37:54 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: RAVBg64.exe, version: 1.0.0.207, time stamp: 0x54043c6f Faulting module name: RAVBg64.exe, version: 1.0.0.207, time stamp: 0x54043c6f Exception code: 0xc0000005 Fault offset: 0x000000000002a12a Faulting process id: 0xd30 Faulting application start time: 0x01d2cc95bb530bdb Faulting application path: C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe Faulting module path: C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe Report Id: 00db0183-3889-11e7-9b53-185e0faf7b8d Error: (05/14/2017 11:37:15 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: RAVBg64.exe, version: 1.0.0.207, time stamp: 0x54043c6f Faulting module name: RAVBg64.exe, version: 1.0.0.207, time stamp: 0x54043c6f Exception code: 0xc0000005 Fault offset: 0x000000000002a12a Faulting process id: 0x58c Faulting application start time: 0x01d2cc95a2bba013 Faulting application path: C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe Faulting module path: C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe Report Id: e986a4f3-3888-11e7-9b53-185e0faf7b8d Error: (05/14/2017 11:35:39 AM) (Source: VSS) (EventID: 8194) (User: ) Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied. . This is often caused by incorrect security settings in either the writer or requestor process. Operation: Gathering Writer Data Context: Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220} Writer Name: System Writer Writer Instance ID: {89cbce5c-5794-4bef-8c4b-7a84b1d76b7e} Error: (05/14/2017 11:34:34 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: RAVBg64.exe, version: 1.0.0.207, time stamp: 0x54043c6f Faulting module name: RAVBg64.exe, version: 1.0.0.207, time stamp: 0x54043c6f Exception code: 0xc0000005 Fault offset: 0x000000000002a12a Faulting process id: 0xff0 Faulting application start time: 0x01d2cc9548ca10b9 Faulting application path: C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe Faulting module path: C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe Report Id: 89b55bd9-3888-11e7-ba1d-185e0faf7b8d Error: (05/14/2017 11:33:51 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: RAVBg64.exe, version: 1.0.0.207, time stamp: 0x54043c6f Faulting module name: RAVBg64.exe, version: 1.0.0.207, time stamp: 0x54043c6f Exception code: 0xc0000005 Fault offset: 0x000000000002a12a Faulting process id: 0x58c Faulting application start time: 0x01d2cc95292fd762 Faulting application path: C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe Faulting module path: C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe Report Id: 70508dcd-3888-11e7-ba1d-185e0faf7b8d Error: (05/14/2017 11:32:33 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: PulseSecureService.exe, version: 5.2.6.977, time stamp: 0x583ec339 Faulting module name: ntdll.dll, version: 6.1.7601.23543, time stamp: 0x57d2f8a2 Exception code: 0xc0000005 Fault offset: 0x00033b18 Faulting process id: 0x1100 Faulting application start time: 0x01d2cc950354f471 Faulting application path: C:\Program Files (x86)\Common Files\Pulse Secure\JUNS\PulseSecureService.exe Faulting module path: C:\WINDOWS\SysWOW64\ntdll.dll Report Id: 4167da7d-3888-11e7-83cc-185e0faf7b8d Error: (05/14/2017 11:32:32 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: PulseSecureService.exe, version: 5.2.6.977, time stamp: 0x583ec339 Faulting module name: ntdll.dll, version: 6.1.7601.23543, time stamp: 0x57d2f8a2 Exception code: 0xc0000005 Fault offset: 0x000329e3 Faulting process id: 0x1154 Faulting application start time: 0x01d2cc9501bb87c2 Faulting application path: C:\Program Files (x86)\Common Files\Pulse Secure\JUNS\PulseSecureService.exe Faulting module path: C:\WINDOWS\SysWOW64\ntdll.dll Report Id: 40d1e3cc-3888-11e7-83cc-185e0faf7b8d Error: (05/13/2017 06:20:31 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: IMF.exe, version: 5.0.2.3804, time stamp: 0x58ec4e16 Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000 Exception code: 0xc0000005 Fault offset: 0x00000000 Faulting process id: 0x584 Faulting application start time: 0x01d2cc049d75aad8 Faulting application path: C:\Program Files (x86)\IObit\IObit Malware Fighter\IMF.exe Faulting module path: unknown Report Id: 155a4a51-37f8-11e7-83cc-185e0faf7b8d Error: (05/13/2017 06:18:36 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: RAVBg64.exe, version: 1.0.0.207, time stamp: 0x54043c6f Faulting module name: RAVBg64.exe, version: 1.0.0.207, time stamp: 0x54043c6f Exception code: 0xc0000005 Fault offset: 0x000000000002a12a Faulting process id: 0xfdc Faulting application start time: 0x01d2cc048fad10f4 Faulting application path: C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe Faulting module path: C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe Report Id: d0db029b-37f7-11e7-83cc-185e0faf7b8d System errors: ============= Error: (05/14/2017 11:49:45 AM) (Source: Service Control Manager) (EventID: 7003) (User: ) Description: The Network Connections service depends the following service: NSI. This service might not be installed. Error: (05/14/2017 11:49:27 AM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service does not exist or has been marked for deletion. Error: (05/14/2017 11:49:27 AM) (Source: Service Control Manager) (EventID: 7003) (User: ) Description: The Network Location Awareness service depends the following service: NSI. This service might not be installed. Error: (05/14/2017 11:49:25 AM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service does not exist or has been marked for deletion. Error: (05/14/2017 11:49:25 AM) (Source: Service Control Manager) (EventID: 7003) (User: ) Description: The Network Location Awareness service depends the following service: NSI. This service might not be installed. Error: (05/14/2017 11:49:25 AM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service does not exist or has been marked for deletion. Error: (05/14/2017 11:49:25 AM) (Source: Service Control Manager) (EventID: 7003) (User: ) Description: The Network Location Awareness service depends the following service: NSI. This service might not be installed. Error: (05/14/2017 11:49:15 AM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service does not exist or has been marked for deletion. Error: (05/14/2017 11:49:15 AM) (Source: Service Control Manager) (EventID: 7003) (User: ) Description: The Network Location Awareness service depends the following service: NSI. This service might not be installed. Error: (05/14/2017 11:49:15 AM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service does not exist or has been marked for deletion. CodeIntegrity: =================================== Date: 2017-05-14 11:38:54.360 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\SensorsApi.dll because the set of per-page image hashes could not be found on the system. Date: 2017-05-14 11:35:18.823 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\SensorsApi.dll because the set of per-page image hashes could not be found on the system. Date: 2017-05-13 18:19:25.503 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\SensorsApi.dll because the set of per-page image hashes could not be found on the system. Date: 2017-05-12 23:04:00.209 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\SensorsApi.dll because the set of per-page image hashes could not be found on the system. Date: 2017-05-12 22:49:27.306 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\SensorsApi.dll because the set of per-page image hashes could not be found on the system. Date: 2017-05-12 22:29:26.960 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\SensorsApi.dll because the set of per-page image hashes could not be found on the system. Date: 2017-05-12 22:09:59.997 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\SensorsApi.dll because the set of per-page image hashes could not be found on the system. Date: 2017-05-12 21:22:19.278 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\SensorsApi.dll because the set of per-page image hashes could not be found on the system. Date: 2017-05-12 20:02:45.125 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\SensorsApi.dll because the set of per-page image hashes could not be found on the system. Date: 2017-05-12 19:54:58.456 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\SensorsApi.dll because the set of per-page image hashes could not be found on the system. ==================== Memory info =========================== Processor: Intel(R) Core(TM) i5-5300U CPU @ 2.30GHz Percentage of memory in use: 22% Total physical RAM: 8064.22 MB Available physical RAM: 6283.24 MB Total Virtual: 16126.62 MB Available Virtual: 13973.81 MB ==================== Drives ================================ Drive c: (Windows) (Fixed) (Total:465.42 GB) (Free:358.85 GB) NTFS Drive d: (System Reserved) (Fixed) (Total:0.34 GB) (Free:0.15 GB) NTFS ==>[system with boot components (obtained from drive)] Drive e: () (Removable) (Total:7.45 GB) (Free:7.16 GB) FAT32 ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 7641D761) Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=465.4 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (Size: 7.5 GB) (Disk ID: 00000000) Partition: GPT. ==================== End of Addition.txt ============================