[farnaz_im]

Hi. A virus that its name is "sedoparking" or "park.js" infected my computer and I need help to destroy it. help me please! :

[Advertisements]

Hi again. I attached the true file ! sorry

 

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 26-12-2017
Ran by farnaz (31-12-2017 11:56:05)
Running from C:\Users\farnaz\Desktop
Microsoft Windows 7 Home Premium  Service Pack 1 (X86) (2013-12-02 04:45:46)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3413881090-1058124947-865584590-500 - Administrator - Disabled)
farnaz (S-1-5-21-3413881090-1058124947-865584590-1000 - Administrator - Enabled) => C:\Users\farnaz
Guest (S-1-5-21-3413881090-1058124947-865584590-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3413881090-1058124947-865584590-1002 - Limited - Enabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)


==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Acrobat.com (HKLM\...\{77DCDCE3-2DED-62F3-8154-05E745472D07}) (Version: 0.0.0 - Adobe Systems Incorporated) Hidden
Acrobat.com (HKLM\...\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.1.377 - Adobe Systems Incorporated)
Adobe AIR (HKLM\...\Adobe AIR) (Version: 1.0.4990 - Adobe Systems Inc.)
Adobe Flash Player 12 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 12.0.0.70 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 12.0.0.70 - Adobe Systems Incorporated)
Adobe Photoshop CS (HKLM\...\{EFB21DE7-8C19-4A88-BB28-A766E16493BC}) (Version: CS - Adobe Systems, Inc.)
Adobe Photoshop CS6 (HKLM\...\{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}) (Version: 13.0 - Adobe Systems Incorporated)
Adobe Reader 9 (HKLM\...\{AC76BA86-7AD7-1033-7B44-A90000000001}) (Version: 9.0.0 - Adobe Systems Incorporated)
Adobe Shockwave Player + Authorware Web Player (HKLM\...\Adobe Shockwave Player + Authorware Web Player) (Version: v12.0.3.133 - Adobe Systems, Inc.)
Advertising Center (HKLM\...\{b2ec4a38-b545-4a00-8214-13fe0e915e6d}) (Version: 0.0.0.2 - Nero AG) Hidden
Alien Shooter (HKLM\...\Alien Shooter_is1) (Version:  - )
BurnAware Free 6.4 (HKLM\...\BurnAware Free) (Version: 6.4 - Burnaware Technologies)
CCleaner (HKLM\...\CCleaner) (Version: 2.33 - Piriform)
COWON Media Center - jetAudio Plus VX (HKLM\...\{DF8195AF-8E6F-4487-A0EE-196F7E3F4B8A}) (Version: 8.0.6 - COWON)
Error Repair Professional 3.8.8 (HKLM\...\Error Repair Professional_is1) (Version:  - www.error-repair-pro.com)
FlashGet3.7 (HKLM\...\FlashGet3.7) (Version: 3.7.0.1220 - hxxp://www.FlashGet.com)
Flashtool (HKLM\...\Flashtool) (Version: 0.9.18.2 - Androxyde)
Free PS Convert driver 8.15 (HKLM\...\Free PS Convert driver_is1) (Version:  - )
GOM Player (HKLM\...\GOM Player) (Version: 2.3.6.5260 - Gretech Corporation)
Google Earth Pro (HKLM\...\{ECF2E224-42F5-4E50-B58E-94CA70E85697}) (Version: 7.3.0.3832 - Google)
Google Update Helper (HKLM\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.7 - Google Inc.) Hidden
Google Update Helper (HKLM\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.25.11 - Google Inc.) Hidden
ImagXpress (HKLM\...\{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}) (Version: 7.0.74.0 - Nero AG) Hidden
Java 7 Update 25 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.250 - Oracle)
K-Lite Mega Codec Pack 10.0.5 (HKLM\...\KLiteCodecPack_is1) (Version: 10.0.5 - )
KMPlayer (remove only) (HKLM\...\The KMPlayer) (Version: 4.1.5.8 - PandoraTV)
Lagarith Lossless Codec (1.3.27) (HKLM\...\{F59AC46C-10C3-4023-882C-4212A92283B3}_is1) (Version:  - )
Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM\...\{90110409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.7969.0 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.4734.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM\...\{01db25f3-1b76-4d97-88c8-1c90634d88fb}) (Version: 11.0.60610.1 - Корпорация Майкрософт)
Mozilla Firefox 57.0.3 (x86 en-US) (HKLM\...\Mozilla Firefox 57.0.3 (x86 en-US)) (Version: 57.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 57.0.3 - Mozilla)
Nero 9 Essentials (HKLM\...\{4b20cce0-45a3-435b-8ad0-0f3f8578d67d}) (Version:  - Nero AG)
Opera 10.00 (HKLM\...\{FC66E05E-8D39-47A6-8D07-759F33727EB0}) (Version: 10.00 - Opera Software ASA)
PDF Settings CS6 (HKLM\...\{BFEAAE77-BD7F-4534-B286-9C5CB4697EB1}) (Version: 11.0 - Adobe Systems Incorporated) Hidden
PhotoFiltre (HKLM\...\PhotoFiltre) (Version:  - )
QuickTime (HKLM\...\{3868A8EE-5051-4DB0-8DF6-4F4B8A98D083}) (Version: 7.0.3 - Apple Computer, Inc.) Hidden
QuickTime (HKLM\...\InstallShield_{3868A8EE-5051-4DB0-8DF6-4F4B8A98D083}) (Version: 7.0.3 - Apple Computer, Inc.)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6971 - Realtek Semiconductor Corp.)
SAM CoDeC Pack (HKLM\...\SAM CoDeC Pack) (Version: 5.20 - www.SamLab.ws)
Sheed A.V. (HKLM\...\{B7E86DAB-0341-4403-B0F0-2EB7834F5ADC}) (Version: 2.0 - SheedSoft Co.) Hidden
Sheed A.V. (HKLM\...\Sheed A.V.) (Version: 2.0 - SheedSoft Co.)
Skype Click to Call (HKLM\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 8.1.0.9134 - Microsoft Corporation)
Telegram Desktop version 1.2.6 (HKU\S-1-5-21-3413881090-1058124947-865584590-1000\...\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1) (Version: 1.2.6 - Telegram Messenger LLP)
Tweaking.com - Windows Repair (All in One) (HKLM\...\Tweaking.com - Windows Repair (All in One)) (Version: 1.4.3 - Tweaking.com)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Ut Video Codec Suite (HKLM\...\utvideo_is1) (Version: 13.1.0 - UMEZAWA Takeshi)
win-procesce 1.00 (HKLM\...\win-procesce 1.00) (Version: 1.00 - win-procesce)
WinRAR archiver (HKLM\...\WinRAR archiver) (Version:  - )
Xvid MPEG-4 Video Codec (HKLM\...\Xvid_is1) (Version:  - )
ZirYab 4 (HKLM\...\ZirYab 4) (Version: 4 - abasi.org)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-3413881090-1058124947-865584590-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\farnaz\AppData\Local\Google\Update\1.3.25.5\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-3413881090-1058124947-865584590-1000_Classes\CLSID\{1423F872-3F7F-4E57-B621-8B1A9D49B448}\InprocServer32 -> C:\Users\farnaz\AppData\Local\Google\Update\1.3.27.5\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-3413881090-1058124947-865584590-1000_Classes\CLSID\{144DF3B2-2402-47AE-9583-5A045929A8D4}\InprocServer32 -> C:\Users\farnaz\AppData\Local\Google\Update\1.3.33.5\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-3413881090-1058124947-865584590-1000_Classes\CLSID\{590C4387-5EBD-4D46-8A84-CD0BA2EF2856}\InprocServer32 -> C:\Users\farnaz\AppData\Local\Google\Update\1.3.30.3\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-3413881090-1058124947-865584590-1000_Classes\CLSID\{59B55F04-DE14-4BB8-92FF-C4A22EF2E5F4}\InprocServer32 -> C:\Users\farnaz\AppData\Local\Google\Update\1.3.31.5\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-3413881090-1058124947-865584590-1000_Classes\CLSID\{5C8C2A98-6133-4EBA-BBCC-34D9EA01FC2E}\InprocServer32 -> C:\Users\farnaz\AppData\Local\Google\Update\1.3.28.1\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-3413881090-1058124947-865584590-1000_Classes\CLSID\{793EE463-1304-471C-ADF1-68C2FFB01247}\InprocServer32 -> C:\Users\farnaz\AppData\Local\Google\Update\1.3.29.5\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-3413881090-1058124947-865584590-1000_Classes\CLSID\{8C46158B-D978-483C-A312-16EE5013BE04}\InprocServer32 -> C:\Users\farnaz\AppData\Local\Google\Update\1.3.33.3\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-3413881090-1058124947-865584590-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\farnaz\AppData\Local\Google\Update\1.3.24.15\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-3413881090-1058124947-865584590-1000_Classes\CLSID\{A45426FB-E444-42B2-AA56-419F8FBEEC61}\InprocServer32 -> C:\Users\farnaz\AppData\Local\Google\Update\1.3.22.3\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-3413881090-1058124947-865584590-1000_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Users\farnaz\AppData\Local\Google\Update\1.3.26.9\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-3413881090-1058124947-865584590-1000_Classes\CLSID\{CB492AF1-2CEF-4E58-BE47-471C77D0C8BA}\InprocServer32 -> C:\Users\farnaz\AppData\Local\Google\Update\1.3.32.7\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-3413881090-1058124947-865584590-1000_Classes\CLSID\{CC182BE1-84CE-4A57-B85C-FD4BBDF78CB2}\InprocServer32 -> C:\Users\farnaz\AppData\Local\Google\Update\1.3.29.1\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-3413881090-1058124947-865584590-1000_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\farnaz\AppData\Local\Google\Update\1.3.25.11\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-3413881090-1058124947-865584590-1000_Classes\CLSID\{D1EDC4F5-7F4D-4B12-906A-614ECF66DDAF}\InprocServer32 -> C:\Users\farnaz\AppData\Local\Google\Update\1.3.28.15\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-3413881090-1058124947-865584590-1000_Classes\CLSID\{EB06378B-ABB6-4B3C-9B40-D488DD8A6E93}\InprocServer32 -> C:\Users\farnaz\AppData\Local\Google\Update\1.3.22.5\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-3413881090-1058124947-865584590-1000_Classes\CLSID\{FB994D36-B312-46CE-A40B-CF63980641F9}\InprocServer32 -> C:\Users\farnaz\AppData\Local\Google\Update\1.3.21.111\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-3413881090-1058124947-865584590-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\farnaz\AppData\Local\Google\Update\1.3.24.7\psuser.dll => No File
ContextMenuHandlers1: [Cover Designer] -> {73FCA462-9BD5-4065-A73F-A8E5F6904EF7} => C:\Program Files\Nero\Nero 9\Nero CoverDesigner\CoverEdExtension.dll [2009-03-04] (Nero AG)
ContextMenuHandlers1: [SheedShlExt] -> {F289930E-697C-432A-8C13-08DB3BAD1A62} => C:\Program Files\Sheed AntiVirus\SheedShlExt.dll [2013-12-11] (SheedSoft Ltd.)
ContextMenuHandlers1: [WinRAR] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2005-10-08] ()
ContextMenuHandlers3: [jetAudio] -> {8D1636FD-CA49-4B4E-90E4-0A20E03A15E8} => C:\Program Files\JetAudio\JetFlExt.dll [2010-07-03] (JetAudio)
ContextMenuHandlers4: [WinRAR] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2005-10-08] ()
ContextMenuHandlers6: [jetAudio] -> {8D1636FD-CA49-4B4E-90E4-0A20E03A15E8} => C:\Program Files\JetAudio\JetFlExt.dll [2010-07-03] (JetAudio)
ContextMenuHandlers6: [SheedShlExt] -> {F289930E-697C-432A-8C13-08DB3BAD1A62} => C:\Program Files\Sheed AntiVirus\SheedShlExt.dll [2013-12-11] (SheedSoft Ltd.)
ContextMenuHandlers6: [WinRAR] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2005-10-08] ()

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {30A1C5EC-73E1-48FD-845C-17E6F78BC5E1} - System32\Tasks\{1229C064-6A7B-4151-AEF5-BEE9841F7419} => C:\Windows\system32\pcalua.exe -a "G:\Adobe Photoshop CS5 ME\Setup.exe" -d "G:\Adobe Photoshop CS5 ME"
Task: {47DC60CB-2743-48A6-BE8A-90D9C247501B} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-09-15] (Google Inc.)
Task: {7ACCC71F-7B40-410B-BC8C-D6CF1DCBEBA4} - System32\Tasks\{5BF14980-7265-4642-B063-D0748DDAA690} => "c:\users\farnaz\appdata\local\google\chrome\application\chrome.exe" hxxp://www.skype.com/go/downloading?source=lightinstaller&ver=5.8.64.154&LastError=404
Task: {AC72B8C4-7DBE-47A5-8F99-DDE9A28FDD52} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-02] (Adobe Systems Incorporated)
Task: {C43D50F7-070E-42FE-A591-83CD1C71EBA5} - System32\Tasks\{0797935C-E9C8-4D56-AA93-9471ACF01EF7} => C:\Windows\system32\pcalua.exe -a "E:\pell mell\Games\Alien Shooter v1.2\Setup 2.exe" -d "E:\pell mell\Games\Alien Shooter v1.2"
Task: {DCFF1718-65CA-41FF-B365-75CBF3BA5162} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-09-15] (Google Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


==================== Loaded Modules (Whitelisted) ==============

2010-01-10 06:48 - 2010-01-10 06:48 - 004254560 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2010-01-21 12:04 - 2010-01-21 12:04 - 008793952 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2013-12-02 08:23 - 2005-10-08 02:35 - 000125440 _____ () C:\Program Files\WinRAR\rarext.dll
2014-11-07 22:21 - 2014-11-07 22:21 - 001490432 _____ () C:\Users\farnaz\AppData\Local\Temp\IXP000.TMP\NSCPUC~1.EXE
2014-11-07 22:21 - 2014-11-07 22:21 - 001490432 _____ () C:\Users\farnaz\AppData\Local\Temp\IXP001.TMP\NSCPUC~1.EXE

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)


==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\.DEFAULT\...\localhost -> localhost
IE trusted site: HKU\.DEFAULT\...\webcompanion.com -> hxxp://webcompanion.com
IE trusted site: HKU\S-1-5-21-3413881090-1058124947-865584590-1000\...\localhost -> localhost
IE trusted site: HKU\S-1-5-21-3413881090-1058124947-865584590-1000\...\webcompanion.com -> hxxp://webcompanion.com

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 05:34 - 2017-04-25 11:26 - 000005294 ____N C:\Windows\system32\Drivers\etc\hosts

127.0.0.1 tonec.com
127.0.0.1 www.tonec.com
127.0.0.1 registeridm.com
127.0.0.1 www.registeridm.com
127.0.0.1 secure.registeridm.com
127.0.0.1 internetdownloadmanager.com
127.0.0.1 www.internetdownloadmanager.com
127.0.0.1 secure.internetdownloadmanager.com
127.0.0.1 mirror.internetdownloadmanager.com
127.0.0.1 mirror2.internetdownloadmanager.com
127.0.0.1 mirror3.internetdownloadmanager.com
127.0.0.1 lm.licenses.adobe.com
127.0.0.1 192.150.14.69
127.0.0.1 192.150.18.101
127.0.0.1 192.150.18.108
127.0.0.1 192.150.22.40
127.0.0.1 192.150.8.100
127.0.0.1 192.150.8.118
127.0.0.1 209-34-83-73.ood.opsource.net
127.0.0.1 3dns-1.adobe.com
127.0.0.1 3dns-2.adobe.com
127.0.0.1 3dns-2.adobe.com
127.0.0.1 3dns-3.adobe.com
127.0.0.1 3dns-3.adobe.com
127.0.0.1 3dns-4.adobe.com
127.0.0.1 3dns.adobe.com
127.0.0.1 activate-sea.adobe.com
127.0.0.1 activate-sea.adobe.com
127.0.0.1 activate-sjc0.adobe.com
127.0.0.1 activate-sjc0.adobe.com

There are 114 more lines.


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3413881090-1058124947-865584590-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\farnaz\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 217.218.155.155 - 8.8.8.8
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: gupdate => 2
MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: IDriverT => 3
MSCONFIG\Services: MozillaMaintenance => 3
MSCONFIG\Services: Nero BackItUp Scheduler 4.0 => 2
MSCONFIG\Services: STI Simulator => 2
MSCONFIG\Services: SwitchBoard => 3
MSCONFIG\startupreg: ntuser => wscript.exe //B "C:\Users\farnaz\ntuser.vbe"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [TCP Query User{58E3528F-7A56-4E26-B854-2573B7F62D13}D:\peida shode ha az recovery\desk top\freegate\fg742p.exe] => (Allow) D:\peida shode ha az recovery\desk top\freegate\fg742p.exe
FirewallRules: [UDP Query User{5930ED19-9883-4384-97FF-3EB8673D6379}D:\peida shode ha az recovery\desk top\freegate\fg742p.exe] => (Allow) D:\peida shode ha az recovery\desk top\freegate\fg742p.exe
FirewallRules: [TCP Query User{AA38A340-CD9D-42AE-A106-15E645AC108A}C:\users\farnaz\desktop\freegate\fg742p.exe] => (Allow) C:\users\farnaz\desktop\freegate\fg742p.exe
FirewallRules: [UDP Query User{76453897-7B9E-4B8D-9C21-265C920F6D04}C:\users\farnaz\desktop\freegate\fg742p.exe] => (Allow) C:\users\farnaz\desktop\freegate\fg742p.exe
FirewallRules: [{55F457AF-AF7E-438C-9040-451E95A29CBA}] => (Allow) C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
FirewallRules: [{AAF0389B-FD6B-4834-A611-B64353592FC4}] => (Allow) C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
FirewallRules: [TCP Query User{94043372-7D83-4BD2-87BC-0A007B717BB1}C:\program files\flashget network\flashget 3\flashget3.exe] => (Allow) C:\program files\flashget network\flashget 3\flashget3.exe
FirewallRules: [UDP Query User{6840819D-8987-4C71-91F0-1D8166980641}C:\program files\flashget network\flashget 3\flashget3.exe] => (Allow) C:\program files\flashget network\flashget 3\flashget3.exe
FirewallRules: [TCP Query User{C2EB27BC-9751-432A-ACCF-F54855DB7537}C:\program files\flashget network\flashget 3\flashget3.exe] => (Block) C:\program files\flashget network\flashget 3\flashget3.exe
FirewallRules: [UDP Query User{D60ABEE4-EA5D-4346-AF9B-B8D81CEFDDC8}C:\program files\flashget network\flashget 3\flashget3.exe] => (Block) C:\program files\flashget network\flashget 3\flashget3.exe
FirewallRules: [TCP Query User{06BF8A97-4D28-439B-8D4A-E349DBF17414}C:\users\farnaz\appdata\local\temp\mmbplayer\pdf_edit.exe] => (Allow) C:\users\farnaz\appdata\local\temp\mmbplayer\pdf_edit.exe
FirewallRules: [UDP Query User{2018F3B7-3778-4912-9E00-8796470BBB09}C:\users\farnaz\appdata\local\temp\mmbplayer\pdf_edit.exe] => (Allow) C:\users\farnaz\appdata\local\temp\mmbplayer\pdf_edit.exe
FirewallRules: [{C7AFE0C8-995A-4E61-A3C9-7B33154F7447}] => (Allow) C:\Program Files\WebFreer\webfreer.exe
FirewallRules: [{059CB9CD-78F8-42A7-A3A4-2140FC6633D5}] => (Allow) C:\Program Files\WebFreer\webfreer.exe
FirewallRules: [TCP Query User{C37B83F7-E633-418F-A1F4-C6C0E01AA41B}C:\users\farnaz\desktop\freegate\fg750p.exe] => (Allow) C:\users\farnaz\desktop\freegate\fg750p.exe
FirewallRules: [UDP Query User{B166B76C-CB93-4AC5-874A-1BC266B788B2}C:\users\farnaz\desktop\freegate\fg750p.exe] => (Allow) C:\users\farnaz\desktop\freegate\fg750p.exe
FirewallRules: [TCP Query User{500FE702-F181-4BC8-AF92-14F0620E0460}C:\users\farnaz\desktop\freegate\fg752p.exe] => (Block) C:\users\farnaz\desktop\freegate\fg752p.exe
FirewallRules: [UDP Query User{3D094366-5B76-4FB2-8420-6BECE03D8F0E}C:\users\farnaz\desktop\freegate\fg752p.exe] => (Block) C:\users\farnaz\desktop\freegate\fg752p.exe
FirewallRules: [TCP Query User{C8CA14B4-8745-4822-8E77-7D51C6ABC3F1}C:\users\farnaz\desktop\freegate\fg754p.exe] => (Allow) C:\users\farnaz\desktop\freegate\fg754p.exe
FirewallRules: [UDP Query User{0F8D1CF4-4585-45A2-8DEF-2D9DABCF1FA8}C:\users\farnaz\desktop\freegate\fg754p.exe] => (Allow) C:\users\farnaz\desktop\freegate\fg754p.exe
FirewallRules: [TCP Query User{CC2CE8D7-6F85-412D-9EAD-A64EEA6B5620}C:\users\farnaz\desktop\freegate\fg755p.exe] => (Allow) C:\users\farnaz\desktop\freegate\fg755p.exe
FirewallRules: [UDP Query User{B85D8ED8-A987-4ADB-BBB1-7F3A1750C811}C:\users\farnaz\desktop\freegate\fg755p.exe] => (Allow) C:\users\farnaz\desktop\freegate\fg755p.exe
FirewallRules: [TCP Query User{E4E610D6-37A7-416A-9474-B1A4799353F1}C:\users\farnaz\desktop\freegate\fg756p.exe] => (Block) C:\users\farnaz\desktop\freegate\fg756p.exe
FirewallRules: [UDP Query User{FE9FD1D8-B567-47AB-A5DC-D57987D0CF5F}C:\users\farnaz\desktop\freegate\fg756p.exe] => (Block) C:\users\farnaz\desktop\freegate\fg756p.exe
FirewallRules: [{579FDE0B-32ED-4C07-8FB5-569560A5E4AB}] => (Allow) C:\Program Files\WebFreer\webfreer.exe
FirewallRules: [{8B09922C-C0DA-4FE2-9809-44E763E15477}] => (Allow) C:\Program Files\WebFreer\webfreer.exe
FirewallRules: [{0F4170EC-1570-4F96-8D9E-659DDC3BE47D}] => (Allow) C:\Program Files\CyberLink\PowerDVD10\PowerDVD Cinema\PowerDVDCinema10.exe
FirewallRules: [{953B9332-3F0E-4AEC-A42A-9AFA75ABAF17}] => (Allow) C:\Program Files\CyberLink\PowerDVD10\PowerDVD9.EXE
FirewallRules: [{1155FA61-3989-4BA9-8DC5-155211397EEB}] => (Block) %SystemRoot%\System32\wscript.exe
FirewallRules: [{18A70BB9-F56A-41C4-B3A9-0CEAA9EA60A2}] => (Allow) C:\Users\farnaz\taskhost.exe
FirewallRules: [{AE345D5E-7BC2-46AD-A90B-76B509E2DE77}] => (Allow) C:\Users\farnaz\taskhost.exe
FirewallRules: [{CB8CB0F8-A93E-49FB-BA19-4A57D23B3FAB}] => (Allow) C:\Users\farnaz\taskhost.exe
FirewallRules: [{D0F8193A-EFAA-4157-908B-788B81D50B8F}] => (Allow) C:\Users\farnaz\taskhost.exe
FirewallRules: [{94DA2677-A7A5-4050-9073-89456DB30D6D}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{EE49A7B6-96B9-4BA4-969A-3CD40A568627}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
StandardProfile\AuthorizedApplications: [C:\Program Files\FlashGet Network\FlashGet 3\FlashGet3.exe] => Enabled:Flashget3
StandardProfile\AuthorizedApplications: [C:\Windows\system32\winlogon.exe] => enabled:@shell32.dll,-1

==================== Restore Points =========================

31-12-2017 11:04:50 Tweaking.com - Windows Repair

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (12/30/2017 08:03:58 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005, Access is denied.
.
This is often caused by incorrect security settings in either the writer or requestor process.


Operation:
   Gathering Writer Data

Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {462bb363-5f9a-4896-bedb-736869605e9a}

Error: (12/30/2017 07:50:54 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program Explorer.EXE version 6.1.7601.17514 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 840

Start Time: 01d38187607c9880

Termination Time: 15

Application Path: C:\Windows\Explorer.EXE

Report Id:

Error: (12/30/2017 05:44:15 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "c:\flashtool\FlashTool64.exe".
Dependent Assembly Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (12/30/2017 05:43:52 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: Activation context generation failed for "C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll".Error in manifest or policy file "C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" on line 3.
The value "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" of attribute "version" in element "assemblyIdentity" is invalid.

Error: (12/30/2017 05:02:35 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (12/30/2017 04:43:10 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (12/30/2017 04:36:51 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (12/30/2017 02:53:23 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (12/30/2017 02:37:49 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (12/29/2017 07:09:11 PM) (Source: MsiInstaller) (EventID: 11714) (User: NT AUTHORITY)
Description: Product: Skype Click to Call -- Error 1714. The older version of Skype Click to Call cannot be removed. Contact your technical support group. System Error 1612.


System errors:
=============
Error: (12/31/2017 11:11:12 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Peer Networking Grouping service depends on the Peer Name Resolution Protocol service which failed to start because of the following error:
%%-2140993535

Error: (12/31/2017 11:11:12 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Peer Name Resolution Protocol service terminated with the following error:
%%-2140993535

Error: (12/31/2017 11:11:12 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Peer Networking Grouping service depends on the Peer Name Resolution Protocol service which failed to start because of the following error:
%%-2140993535

Error: (12/31/2017 11:11:12 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Peer Name Resolution Protocol service terminated with the following error:
%%-2140993535

Error: (12/31/2017 11:11:12 AM) (Source: PNRPSvc) (EventID: 102) (User: )
Description: The Peer Name Resolution Protocol cloud did not start because the creation of the default identity failed with error code: 0x80630801.

Error: (12/31/2017 11:11:12 AM) (Source: PNRPSvc) (EventID: 102) (User: )
Description: The Peer Name Resolution Protocol cloud did not start because the creation of the default identity failed with error code: 0x80630801.

Error: (12/31/2017 11:11:02 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Peer Name Resolution Protocol service terminated with the following error:
%%-2140993535

Error: (12/31/2017 11:11:02 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Peer Networking Grouping service depends on the Peer Name Resolution Protocol service which failed to start because of the following error:
%%-2140993535

Error: (12/31/2017 11:11:02 AM) (Source: PNRPSvc) (EventID: 102) (User: )
Description: The Peer Name Resolution Protocol cloud did not start because the creation of the default identity failed with error code: 0x80630801.

Error: (12/31/2017 11:08:49 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Peer Networking Grouping service depends on the Peer Name Resolution Protocol service which failed to start because of the following error:
%%-2140993535


==================== Memory info ===========================

Processor: Pentium® Dual-Core CPU E5700 @ 3.00GHz
Percentage of memory in use: 46%
Total physical RAM: 3071.3 MB
Available physical RAM: 1654.81 MB
Total Virtual: 6140.89 MB
Available Virtual: 3997.92 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:39.06 GB) (Free:2.55 GB) NTFS ==>[drive with boot components (obtained from BCD)]
Drive d: () (Fixed) (Total:146.48 GB) (Free:22.11 GB) NTFS
Drive e: () (Fixed) (Total:146.48 GB) (Free:19.67 GB) NTFS
Drive f: () (Fixed) (Total:133.73 GB) (Free:4.45 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 01460146)
Partition 1: (Active) - (Size=39.1 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=426.7 GB) - (Type=OF Extended)

==================== End of Addition.txt ============================

Attached Files

•  Addition.txt   31.02KB   162 downloads

[farnaz_im]

Hi again. I attached the true file ! sorry

 

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 26-12-2017
Ran by farnaz (31-12-2017 11:56:05)
Running from C:\Users\farnaz\Desktop
Microsoft Windows 7 Home Premium  Service Pack 1 (X86) (2013-12-02 04:45:46)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3413881090-1058124947-865584590-500 - Administrator - Disabled)
farnaz (S-1-5-21-3413881090-1058124947-865584590-1000 - Administrator - Enabled) => C:\Users\farnaz
Guest (S-1-5-21-3413881090-1058124947-865584590-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3413881090-1058124947-865584590-1002 - Limited - Enabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)


==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Acrobat.com (HKLM\...\{77DCDCE3-2DED-62F3-8154-05E745472D07}) (Version: 0.0.0 - Adobe Systems Incorporated) Hidden
Acrobat.com (HKLM\...\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.1.377 - Adobe Systems Incorporated)
Adobe AIR (HKLM\...\Adobe AIR) (Version: 1.0.4990 - Adobe Systems Inc.)
Adobe Flash Player 12 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 12.0.0.70 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 12.0.0.70 - Adobe Systems Incorporated)
Adobe Photoshop CS (HKLM\...\{EFB21DE7-8C19-4A88-BB28-A766E16493BC}) (Version: CS - Adobe Systems, Inc.)
Adobe Photoshop CS6 (HKLM\...\{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}) (Version: 13.0 - Adobe Systems Incorporated)
Adobe Reader 9 (HKLM\...\{AC76BA86-7AD7-1033-7B44-A90000000001}) (Version: 9.0.0 - Adobe Systems Incorporated)
Adobe Shockwave Player + Authorware Web Player (HKLM\...\Adobe Shockwave Player + Authorware Web Player) (Version: v12.0.3.133 - Adobe Systems, Inc.)
Advertising Center (HKLM\...\{b2ec4a38-b545-4a00-8214-13fe0e915e6d}) (Version: 0.0.0.2 - Nero AG) Hidden
Alien Shooter (HKLM\...\Alien Shooter_is1) (Version:  - )
BurnAware Free 6.4 (HKLM\...\BurnAware Free) (Version: 6.4 - Burnaware Technologies)
CCleaner (HKLM\...\CCleaner) (Version: 2.33 - Piriform)
COWON Media Center - jetAudio Plus VX (HKLM\...\{DF8195AF-8E6F-4487-A0EE-196F7E3F4B8A}) (Version: 8.0.6 - COWON)
Error Repair Professional 3.8.8 (HKLM\...\Error Repair Professional_is1) (Version:  - www.error-repair-pro.com)
FlashGet3.7 (HKLM\...\FlashGet3.7) (Version: 3.7.0.1220 - hxxp://www.FlashGet.com)
Flashtool (HKLM\...\Flashtool) (Version: 0.9.18.2 - Androxyde)
Free PS Convert driver 8.15 (HKLM\...\Free PS Convert driver_is1) (Version:  - )
GOM Player (HKLM\...\GOM Player) (Version: 2.3.6.5260 - Gretech Corporation)
Google Earth Pro (HKLM\...\{ECF2E224-42F5-4E50-B58E-94CA70E85697}) (Version: 7.3.0.3832 - Google)
Google Update Helper (HKLM\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.7 - Google Inc.) Hidden
Google Update Helper (HKLM\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.25.11 - Google Inc.) Hidden
ImagXpress (HKLM\...\{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}) (Version: 7.0.74.0 - Nero AG) Hidden
Java 7 Update 25 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.250 - Oracle)
K-Lite Mega Codec Pack 10.0.5 (HKLM\...\KLiteCodecPack_is1) (Version: 10.0.5 - )
KMPlayer (remove only) (HKLM\...\The KMPlayer) (Version: 4.1.5.8 - PandoraTV)
Lagarith Lossless Codec (1.3.27) (HKLM\...\{F59AC46C-10C3-4023-882C-4212A92283B3}_is1) (Version:  - )
Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM\...\{90110409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.7969.0 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.4734.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM\...\{01db25f3-1b76-4d97-88c8-1c90634d88fb}) (Version: 11.0.60610.1 - Корпорация Майкрософт)
Mozilla Firefox 57.0.3 (x86 en-US) (HKLM\...\Mozilla Firefox 57.0.3 (x86 en-US)) (Version: 57.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 57.0.3 - Mozilla)
Nero 9 Essentials (HKLM\...\{4b20cce0-45a3-435b-8ad0-0f3f8578d67d}) (Version:  - Nero AG)
Opera 10.00 (HKLM\...\{FC66E05E-8D39-47A6-8D07-759F33727EB0}) (Version: 10.00 - Opera Software ASA)
PDF Settings CS6 (HKLM\...\{BFEAAE77-BD7F-4534-B286-9C5CB4697EB1}) (Version: 11.0 - Adobe Systems Incorporated) Hidden
PhotoFiltre (HKLM\...\PhotoFiltre) (Version:  - )
QuickTime (HKLM\...\{3868A8EE-5051-4DB0-8DF6-4F4B8A98D083}) (Version: 7.0.3 - Apple Computer, Inc.) Hidden
QuickTime (HKLM\...\InstallShield_{3868A8EE-5051-4DB0-8DF6-4F4B8A98D083}) (Version: 7.0.3 - Apple Computer, Inc.)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6971 - Realtek Semiconductor Corp.)
SAM CoDeC Pack (HKLM\...\SAM CoDeC Pack) (Version: 5.20 - www.SamLab.ws)
Sheed A.V. (HKLM\...\{B7E86DAB-0341-4403-B0F0-2EB7834F5ADC}) (Version: 2.0 - SheedSoft Co.) Hidden
Sheed A.V. (HKLM\...\Sheed A.V.) (Version: 2.0 - SheedSoft Co.)
Skype Click to Call (HKLM\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 8.1.0.9134 - Microsoft Corporation)
Telegram Desktop version 1.2.6 (HKU\S-1-5-21-3413881090-1058124947-865584590-1000\...\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1) (Version: 1.2.6 - Telegram Messenger LLP)
Tweaking.com - Windows Repair (All in One) (HKLM\...\Tweaking.com - Windows Repair (All in One)) (Version: 1.4.3 - Tweaking.com)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Ut Video Codec Suite (HKLM\...\utvideo_is1) (Version: 13.1.0 - UMEZAWA Takeshi)
win-procesce 1.00 (HKLM\...\win-procesce 1.00) (Version: 1.00 - win-procesce)
WinRAR archiver (HKLM\...\WinRAR archiver) (Version:  - )
Xvid MPEG-4 Video Codec (HKLM\...\Xvid_is1) (Version:  - )
ZirYab 4 (HKLM\...\ZirYab 4) (Version: 4 - abasi.org)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-3413881090-1058124947-865584590-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\farnaz\AppData\Local\Google\Update\1.3.25.5\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-3413881090-1058124947-865584590-1000_Classes\CLSID\{1423F872-3F7F-4E57-B621-8B1A9D49B448}\InprocServer32 -> C:\Users\farnaz\AppData\Local\Google\Update\1.3.27.5\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-3413881090-1058124947-865584590-1000_Classes\CLSID\{144DF3B2-2402-47AE-9583-5A045929A8D4}\InprocServer32 -> C:\Users\farnaz\AppData\Local\Google\Update\1.3.33.5\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-3413881090-1058124947-865584590-1000_Classes\CLSID\{590C4387-5EBD-4D46-8A84-CD0BA2EF2856}\InprocServer32 -> C:\Users\farnaz\AppData\Local\Google\Update\1.3.30.3\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-3413881090-1058124947-865584590-1000_Classes\CLSID\{59B55F04-DE14-4BB8-92FF-C4A22EF2E5F4}\InprocServer32 -> C:\Users\farnaz\AppData\Local\Google\Update\1.3.31.5\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-3413881090-1058124947-865584590-1000_Classes\CLSID\{5C8C2A98-6133-4EBA-BBCC-34D9EA01FC2E}\InprocServer32 -> C:\Users\farnaz\AppData\Local\Google\Update\1.3.28.1\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-3413881090-1058124947-865584590-1000_Classes\CLSID\{793EE463-1304-471C-ADF1-68C2FFB01247}\InprocServer32 -> C:\Users\farnaz\AppData\Local\Google\Update\1.3.29.5\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-3413881090-1058124947-865584590-1000_Classes\CLSID\{8C46158B-D978-483C-A312-16EE5013BE04}\InprocServer32 -> C:\Users\farnaz\AppData\Local\Google\Update\1.3.33.3\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-3413881090-1058124947-865584590-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\farnaz\AppData\Local\Google\Update\1.3.24.15\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-3413881090-1058124947-865584590-1000_Classes\CLSID\{A45426FB-E444-42B2-AA56-419F8FBEEC61}\InprocServer32 -> C:\Users\farnaz\AppData\Local\Google\Update\1.3.22.3\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-3413881090-1058124947-865584590-1000_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Users\farnaz\AppData\Local\Google\Update\1.3.26.9\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-3413881090-1058124947-865584590-1000_Classes\CLSID\{CB492AF1-2CEF-4E58-BE47-471C77D0C8BA}\InprocServer32 -> C:\Users\farnaz\AppData\Local\Google\Update\1.3.32.7\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-3413881090-1058124947-865584590-1000_Classes\CLSID\{CC182BE1-84CE-4A57-B85C-FD4BBDF78CB2}\InprocServer32 -> C:\Users\farnaz\AppData\Local\Google\Update\1.3.29.1\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-3413881090-1058124947-865584590-1000_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\farnaz\AppData\Local\Google\Update\1.3.25.11\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-3413881090-1058124947-865584590-1000_Classes\CLSID\{D1EDC4F5-7F4D-4B12-906A-614ECF66DDAF}\InprocServer32 -> C:\Users\farnaz\AppData\Local\Google\Update\1.3.28.15\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-3413881090-1058124947-865584590-1000_Classes\CLSID\{EB06378B-ABB6-4B3C-9B40-D488DD8A6E93}\InprocServer32 -> C:\Users\farnaz\AppData\Local\Google\Update\1.3.22.5\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-3413881090-1058124947-865584590-1000_Classes\CLSID\{FB994D36-B312-46CE-A40B-CF63980641F9}\InprocServer32 -> C:\Users\farnaz\AppData\Local\Google\Update\1.3.21.111\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-3413881090-1058124947-865584590-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\farnaz\AppData\Local\Google\Update\1.3.24.7\psuser.dll => No File
ContextMenuHandlers1: [Cover Designer] -> {73FCA462-9BD5-4065-A73F-A8E5F6904EF7} => C:\Program Files\Nero\Nero 9\Nero CoverDesigner\CoverEdExtension.dll [2009-03-04] (Nero AG)
ContextMenuHandlers1: [SheedShlExt] -> {F289930E-697C-432A-8C13-08DB3BAD1A62} => C:\Program Files\Sheed AntiVirus\SheedShlExt.dll [2013-12-11] (SheedSoft Ltd.)
ContextMenuHandlers1: [WinRAR] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2005-10-08] ()
ContextMenuHandlers3: [jetAudio] -> {8D1636FD-CA49-4B4E-90E4-0A20E03A15E8} => C:\Program Files\JetAudio\JetFlExt.dll [2010-07-03] (JetAudio)
ContextMenuHandlers4: [WinRAR] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2005-10-08] ()
ContextMenuHandlers6: [jetAudio] -> {8D1636FD-CA49-4B4E-90E4-0A20E03A15E8} => C:\Program Files\JetAudio\JetFlExt.dll [2010-07-03] (JetAudio)
ContextMenuHandlers6: [SheedShlExt] -> {F289930E-697C-432A-8C13-08DB3BAD1A62} => C:\Program Files\Sheed AntiVirus\SheedShlExt.dll [2013-12-11] (SheedSoft Ltd.)
ContextMenuHandlers6: [WinRAR] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2005-10-08] ()

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {30A1C5EC-73E1-48FD-845C-17E6F78BC5E1} - System32\Tasks\{1229C064-6A7B-4151-AEF5-BEE9841F7419} => C:\Windows\system32\pcalua.exe -a "G:\Adobe Photoshop CS5 ME\Setup.exe" -d "G:\Adobe Photoshop CS5 ME"
Task: {47DC60CB-2743-48A6-BE8A-90D9C247501B} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-09-15] (Google Inc.)
Task: {7ACCC71F-7B40-410B-BC8C-D6CF1DCBEBA4} - System32\Tasks\{5BF14980-7265-4642-B063-D0748DDAA690} => "c:\users\farnaz\appdata\local\google\chrome\application\chrome.exe" hxxp://www.skype.com/go/downloading?source=lightinstaller&ver=5.8.64.154&LastError=404
Task: {AC72B8C4-7DBE-47A5-8F99-DDE9A28FDD52} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-02] (Adobe Systems Incorporated)
Task: {C43D50F7-070E-42FE-A591-83CD1C71EBA5} - System32\Tasks\{0797935C-E9C8-4D56-AA93-9471ACF01EF7} => C:\Windows\system32\pcalua.exe -a "E:\pell mell\Games\Alien Shooter v1.2\Setup 2.exe" -d "E:\pell mell\Games\Alien Shooter v1.2"
Task: {DCFF1718-65CA-41FF-B365-75CBF3BA5162} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-09-15] (Google Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


==================== Loaded Modules (Whitelisted) ==============

2010-01-10 06:48 - 2010-01-10 06:48 - 004254560 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2010-01-21 12:04 - 2010-01-21 12:04 - 008793952 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2013-12-02 08:23 - 2005-10-08 02:35 - 000125440 _____ () C:\Program Files\WinRAR\rarext.dll
2014-11-07 22:21 - 2014-11-07 22:21 - 001490432 _____ () C:\Users\farnaz\AppData\Local\Temp\IXP000.TMP\NSCPUC~1.EXE
2014-11-07 22:21 - 2014-11-07 22:21 - 001490432 _____ () C:\Users\farnaz\AppData\Local\Temp\IXP001.TMP\NSCPUC~1.EXE

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)


==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\.DEFAULT\...\localhost -> localhost
IE trusted site: HKU\.DEFAULT\...\webcompanion.com -> hxxp://webcompanion.com
IE trusted site: HKU\S-1-5-21-3413881090-1058124947-865584590-1000\...\localhost -> localhost
IE trusted site: HKU\S-1-5-21-3413881090-1058124947-865584590-1000\...\webcompanion.com -> hxxp://webcompanion.com

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 05:34 - 2017-04-25 11:26 - 000005294 ____N C:\Windows\system32\Drivers\etc\hosts

127.0.0.1 tonec.com
127.0.0.1 www.tonec.com
127.0.0.1 registeridm.com
127.0.0.1 www.registeridm.com
127.0.0.1 secure.registeridm.com
127.0.0.1 internetdownloadmanager.com
127.0.0.1 www.internetdownloadmanager.com
127.0.0.1 secure.internetdownloadmanager.com
127.0.0.1 mirror.internetdownloadmanager.com
127.0.0.1 mirror2.internetdownloadmanager.com
127.0.0.1 mirror3.internetdownloadmanager.com
127.0.0.1 lm.licenses.adobe.com
127.0.0.1 192.150.14.69
127.0.0.1 192.150.18.101
127.0.0.1 192.150.18.108
127.0.0.1 192.150.22.40
127.0.0.1 192.150.8.100
127.0.0.1 192.150.8.118
127.0.0.1 209-34-83-73.ood.opsource.net
127.0.0.1 3dns-1.adobe.com
127.0.0.1 3dns-2.adobe.com
127.0.0.1 3dns-2.adobe.com
127.0.0.1 3dns-3.adobe.com
127.0.0.1 3dns-3.adobe.com
127.0.0.1 3dns-4.adobe.com
127.0.0.1 3dns.adobe.com
127.0.0.1 activate-sea.adobe.com
127.0.0.1 activate-sea.adobe.com
127.0.0.1 activate-sjc0.adobe.com
127.0.0.1 activate-sjc0.adobe.com

There are 114 more lines.


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3413881090-1058124947-865584590-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\farnaz\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 217.218.155.155 - 8.8.8.8
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: gupdate => 2
MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: IDriverT => 3
MSCONFIG\Services: MozillaMaintenance => 3
MSCONFIG\Services: Nero BackItUp Scheduler 4.0 => 2
MSCONFIG\Services: STI Simulator => 2
MSCONFIG\Services: SwitchBoard => 3
MSCONFIG\startupreg: ntuser => wscript.exe //B "C:\Users\farnaz\ntuser.vbe"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [TCP Query User{58E3528F-7A56-4E26-B854-2573B7F62D13}D:\peida shode ha az recovery\desk top\freegate\fg742p.exe] => (Allow) D:\peida shode ha az recovery\desk top\freegate\fg742p.exe
FirewallRules: [UDP Query User{5930ED19-9883-4384-97FF-3EB8673D6379}D:\peida shode ha az recovery\desk top\freegate\fg742p.exe] => (Allow) D:\peida shode ha az recovery\desk top\freegate\fg742p.exe
FirewallRules: [TCP Query User{AA38A340-CD9D-42AE-A106-15E645AC108A}C:\users\farnaz\desktop\freegate\fg742p.exe] => (Allow) C:\users\farnaz\desktop\freegate\fg742p.exe
FirewallRules: [UDP Query User{76453897-7B9E-4B8D-9C21-265C920F6D04}C:\users\farnaz\desktop\freegate\fg742p.exe] => (Allow) C:\users\farnaz\desktop\freegate\fg742p.exe
FirewallRules: [{55F457AF-AF7E-438C-9040-451E95A29CBA}] => (Allow) C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
FirewallRules: [{AAF0389B-FD6B-4834-A611-B64353592FC4}] => (Allow) C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
FirewallRules: [TCP Query User{94043372-7D83-4BD2-87BC-0A007B717BB1}C:\program files\flashget network\flashget 3\flashget3.exe] => (Allow) C:\program files\flashget network\flashget 3\flashget3.exe
FirewallRules: [UDP Query User{6840819D-8987-4C71-91F0-1D8166980641}C:\program files\flashget network\flashget 3\flashget3.exe] => (Allow) C:\program files\flashget network\flashget 3\flashget3.exe
FirewallRules: [TCP Query User{C2EB27BC-9751-432A-ACCF-F54855DB7537}C:\program files\flashget network\flashget 3\flashget3.exe] => (Block) C:\program files\flashget network\flashget 3\flashget3.exe
FirewallRules: [UDP Query User{D60ABEE4-EA5D-4346-AF9B-B8D81CEFDDC8}C:\program files\flashget network\flashget 3\flashget3.exe] => (Block) C:\program files\flashget network\flashget 3\flashget3.exe
FirewallRules: [TCP Query User{06BF8A97-4D28-439B-8D4A-E349DBF17414}C:\users\farnaz\appdata\local\temp\mmbplayer\pdf_edit.exe] => (Allow) C:\users\farnaz\appdata\local\temp\mmbplayer\pdf_edit.exe
FirewallRules: [UDP Query User{2018F3B7-3778-4912-9E00-8796470BBB09}C:\users\farnaz\appdata\local\temp\mmbplayer\pdf_edit.exe] => (Allow) C:\users\farnaz\appdata\local\temp\mmbplayer\pdf_edit.exe
FirewallRules: [{C7AFE0C8-995A-4E61-A3C9-7B33154F7447}] => (Allow) C:\Program Files\WebFreer\webfreer.exe
FirewallRules: [{059CB9CD-78F8-42A7-A3A4-2140FC6633D5}] => (Allow) C:\Program Files\WebFreer\webfreer.exe
FirewallRules: [TCP Query User{C37B83F7-E633-418F-A1F4-C6C0E01AA41B}C:\users\farnaz\desktop\freegate\fg750p.exe] => (Allow) C:\users\farnaz\desktop\freegate\fg750p.exe
FirewallRules: [UDP Query User{B166B76C-CB93-4AC5-874A-1BC266B788B2}C:\users\farnaz\desktop\freegate\fg750p.exe] => (Allow) C:\users\farnaz\desktop\freegate\fg750p.exe
FirewallRules: [TCP Query User{500FE702-F181-4BC8-AF92-14F0620E0460}C:\users\farnaz\desktop\freegate\fg752p.exe] => (Block) C:\users\farnaz\desktop\freegate\fg752p.exe
FirewallRules: [UDP Query User{3D094366-5B76-4FB2-8420-6BECE03D8F0E}C:\users\farnaz\desktop\freegate\fg752p.exe] => (Block) C:\users\farnaz\desktop\freegate\fg752p.exe
FirewallRules: [TCP Query User{C8CA14B4-8745-4822-8E77-7D51C6ABC3F1}C:\users\farnaz\desktop\freegate\fg754p.exe] => (Allow) C:\users\farnaz\desktop\freegate\fg754p.exe
FirewallRules: [UDP Query User{0F8D1CF4-4585-45A2-8DEF-2D9DABCF1FA8}C:\users\farnaz\desktop\freegate\fg754p.exe] => (Allow) C:\users\farnaz\desktop\freegate\fg754p.exe
FirewallRules: [TCP Query User{CC2CE8D7-6F85-412D-9EAD-A64EEA6B5620}C:\users\farnaz\desktop\freegate\fg755p.exe] => (Allow) C:\users\farnaz\desktop\freegate\fg755p.exe
FirewallRules: [UDP Query User{B85D8ED8-A987-4ADB-BBB1-7F3A1750C811}C:\users\farnaz\desktop\freegate\fg755p.exe] => (Allow) C:\users\farnaz\desktop\freegate\fg755p.exe
FirewallRules: [TCP Query User{E4E610D6-37A7-416A-9474-B1A4799353F1}C:\users\farnaz\desktop\freegate\fg756p.exe] => (Block) C:\users\farnaz\desktop\freegate\fg756p.exe
FirewallRules: [UDP Query User{FE9FD1D8-B567-47AB-A5DC-D57987D0CF5F}C:\users\farnaz\desktop\freegate\fg756p.exe] => (Block) C:\users\farnaz\desktop\freegate\fg756p.exe
FirewallRules: [{579FDE0B-32ED-4C07-8FB5-569560A5E4AB}] => (Allow) C:\Program Files\WebFreer\webfreer.exe
FirewallRules: [{8B09922C-C0DA-4FE2-9809-44E763E15477}] => (Allow) C:\Program Files\WebFreer\webfreer.exe
FirewallRules: [{0F4170EC-1570-4F96-8D9E-659DDC3BE47D}] => (Allow) C:\Program Files\CyberLink\PowerDVD10\PowerDVD Cinema\PowerDVDCinema10.exe
FirewallRules: [{953B9332-3F0E-4AEC-A42A-9AFA75ABAF17}] => (Allow) C:\Program Files\CyberLink\PowerDVD10\PowerDVD9.EXE
FirewallRules: [{1155FA61-3989-4BA9-8DC5-155211397EEB}] => (Block) %SystemRoot%\System32\wscript.exe
FirewallRules: [{18A70BB9-F56A-41C4-B3A9-0CEAA9EA60A2}] => (Allow) C:\Users\farnaz\taskhost.exe
FirewallRules: [{AE345D5E-7BC2-46AD-A90B-76B509E2DE77}] => (Allow) C:\Users\farnaz\taskhost.exe
FirewallRules: [{CB8CB0F8-A93E-49FB-BA19-4A57D23B3FAB}] => (Allow) C:\Users\farnaz\taskhost.exe
FirewallRules: [{D0F8193A-EFAA-4157-908B-788B81D50B8F}] => (Allow) C:\Users\farnaz\taskhost.exe
FirewallRules: [{94DA2677-A7A5-4050-9073-89456DB30D6D}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{EE49A7B6-96B9-4BA4-969A-3CD40A568627}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
StandardProfile\AuthorizedApplications: [C:\Program Files\FlashGet Network\FlashGet 3\FlashGet3.exe] => Enabled:Flashget3
StandardProfile\AuthorizedApplications: [C:\Windows\system32\winlogon.exe] => enabled:@shell32.dll,-1

==================== Restore Points =========================

31-12-2017 11:04:50 Tweaking.com - Windows Repair

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (12/30/2017 08:03:58 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005, Access is denied.
.
This is often caused by incorrect security settings in either the writer or requestor process.


Operation:
   Gathering Writer Data

Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {462bb363-5f9a-4896-bedb-736869605e9a}

Error: (12/30/2017 07:50:54 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program Explorer.EXE version 6.1.7601.17514 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 840

Start Time: 01d38187607c9880

Termination Time: 15

Application Path: C:\Windows\Explorer.EXE

Report Id:

Error: (12/30/2017 05:44:15 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "c:\flashtool\FlashTool64.exe".
Dependent Assembly Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (12/30/2017 05:43:52 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: Activation context generation failed for "C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll".Error in manifest or policy file "C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" on line 3.
The value "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" of attribute "version" in element "assemblyIdentity" is invalid.

Error: (12/30/2017 05:02:35 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (12/30/2017 04:43:10 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (12/30/2017 04:36:51 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (12/30/2017 02:53:23 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (12/30/2017 02:37:49 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (12/29/2017 07:09:11 PM) (Source: MsiInstaller) (EventID: 11714) (User: NT AUTHORITY)
Description: Product: Skype Click to Call -- Error 1714. The older version of Skype Click to Call cannot be removed. Contact your technical support group. System Error 1612.


System errors:
=============
Error: (12/31/2017 11:11:12 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Peer Networking Grouping service depends on the Peer Name Resolution Protocol service which failed to start because of the following error:
%%-2140993535

Error: (12/31/2017 11:11:12 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Peer Name Resolution Protocol service terminated with the following error:
%%-2140993535

Error: (12/31/2017 11:11:12 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Peer Networking Grouping service depends on the Peer Name Resolution Protocol service which failed to start because of the following error:
%%-2140993535

Error: (12/31/2017 11:11:12 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Peer Name Resolution Protocol service terminated with the following error:
%%-2140993535

Error: (12/31/2017 11:11:12 AM) (Source: PNRPSvc) (EventID: 102) (User: )
Description: The Peer Name Resolution Protocol cloud did not start because the creation of the default identity failed with error code: 0x80630801.

Error: (12/31/2017 11:11:12 AM) (Source: PNRPSvc) (EventID: 102) (User: )
Description: The Peer Name Resolution Protocol cloud did not start because the creation of the default identity failed with error code: 0x80630801.

Error: (12/31/2017 11:11:02 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Peer Name Resolution Protocol service terminated with the following error:
%%-2140993535

Error: (12/31/2017 11:11:02 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Peer Networking Grouping service depends on the Peer Name Resolution Protocol service which failed to start because of the following error:
%%-2140993535

Error: (12/31/2017 11:11:02 AM) (Source: PNRPSvc) (EventID: 102) (User: )
Description: The Peer Name Resolution Protocol cloud did not start because the creation of the default identity failed with error code: 0x80630801.

Error: (12/31/2017 11:08:49 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Peer Networking Grouping service depends on the Peer Name Resolution Protocol service which failed to start because of the following error:
%%-2140993535


==================== Memory info ===========================

Processor: Pentium® Dual-Core CPU E5700 @ 3.00GHz
Percentage of memory in use: 46%
Total physical RAM: 3071.3 MB
Available physical RAM: 1654.81 MB
Total Virtual: 6140.89 MB
Available Virtual: 3997.92 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:39.06 GB) (Free:2.55 GB) NTFS ==>[drive with boot components (obtained from BCD)]
Drive d: () (Fixed) (Total:146.48 GB) (Free:22.11 GB) NTFS
Drive e: () (Fixed) (Total:146.48 GB) (Free:19.67 GB) NTFS
Drive f: () (Fixed) (Total:133.73 GB) (Free:4.45 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 01460146)
Partition 1: (Active) - (Size=39.1 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=426.7 GB) - (Type=OF Extended)

==================== End of Addition.txt ============================

Attached Files

•  Addition.txt   31.02KB   162 downloads