Addition

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 05-02-2017
Ran by boissei (08-02-2017 00:19:28)

Running from C:\Users\boissei\Downloads
Windows 10 Education Version 1607 (X64) (2017-01-14 17:47:41)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-3546805371-3866020912-3027837689-500 - Administrator -

Disabled)
boissei (S-1-5-21-3546805371-3866020912-3027837689-1001 - Administrator - Enabled)
=> C:\Users\boissei
DefaultAccount (S-1-5-21-3546805371-3866020912-3027837689-503 - Limited - Disabled)
defaultuser0 (S-1-5-21-3546805371-3866020912-3027837689-1000 - Limited - Disabled)
=> C:\Users\defaultuser0
Guest (S-1-5-21-3546805371-3866020912-3027837689-501 - Limited - Disabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to
unhide them. The adware programs should be uninstalled manually.)
Torrent (HKU\S-1-5-21-3546805371-3866020912-3027837689-1001\...\uTorrent)
(Version: 3.4.9.43295 - BitTorrent Inc.)
ACA & MEP 2016 Object Enabler (Version: 7.8.41.0 - Autodesk) Hidden
ACAD Private (Version: 20.1.49.0 - Autodesk) Hidden
ACADE Private (Version: 13.0.50.0 - Autodesk) Hidden
Ace Stream Media 3.1.15 (HKU\S-1-5-21-3546805371-3866020912-3027837689-
1001\...\AceStream) (Version: 3.1.15 - Ace Stream Media) <==== ATTENTION
Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100})
(Version: 15.023.20056 - Adobe Systems Incorporated)
Adobe Flash Player 24 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version:
24.0.0.194 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKU\S-1-5-21-3546805371-3866020912-3027837689-
1001\...\Akamai) (Version: - Akamai Technologies, Inc)
Ansel (Version: 378.49 - NVIDIA Corporation) Hidden
Asmedia USB Host Controller Driver (HKLM-x32\...\{E4FB0B39-C991-4EE7-95DD-
1A1A7857D33D}) (Version: 1.16.29.1 - Asmedia Technology)
AutoCAD 2016 - English (Version: 20.1.49.0 - Autodesk) Hidden
AutoCAD 2016 (Version: 20.1.107.0 - Autodesk) Hidden
AutoCAD 2016 Language Pack - English (Version: 20.1.49.0 - Autodesk) Hidden
AutoCAD Electrical 2016 - English (Version: 13.0.50.0 - Autodesk) Hidden
AutoCAD Electrical 2016 (Version: 13.0.50.0 - Autodesk) Hidden
AutoCAD Electrical 2016 Content Language Pack - English (Version: 13.0.50.0 -
Autodesk) Hidden
AutoCAD Electrical 2016 Content Pack (Version: 13.0.50.0 - Autodesk) Hidden
AutoCAD Electrical 2016 Language Pack - English (Version: 13.0.50.0 - Autodesk)
Hidden
Autodesk Advanced Material Library Image Library 2016 (HKLM-x32\...\{94AD53E7-493B-
4291-8714-7A3B761D2783}) (Version: 6.3.0.15 - Autodesk)
Autodesk App Manager 2016 (HKLM-x32\...\{4ECF9E00-2978-46AF-BD80-455EFEAB7A93})
(Version: 2.0.0 - Autodesk)
Autodesk Application Manager (HKLM-x32\...\Autodesk Application Manager) (Version:
5.0.142.14 - Autodesk)
Autodesk AutoCAD 2016 - English (HKLM\...\AutoCAD 2016 - English) (Version:
20.1.49.0 - Autodesk)
Autodesk AutoCAD 2016 SP 1 (HKLM\...\AutoCAD 2016 SP1) (Version: 20.1.107.0 -
Autodesk)
Autodesk AutoCAD Electrical 2016 - English (HKLM\...\AutoCAD Electrical 2016 -
English) (Version: 13.0.50.0 - Autodesk)
Autodesk AutoCAD Electrical Mobile Data (HKLM-x32\...\{C9019AAA-2C7A-4845-A168-
6306A51BB606}) (Version: 1.1.0 - Autodesk)
Autodesk AutoCAD Performance Feedback Tool 1.2.4 (HKLM-x32\...\{4E20873D-BC20-495C-
AFD9-B18877B7F9BB}) (Version: 1.2.4.0 - Autodesk)
Autodesk BIM 360 Glue AutoCAD 2016 Add-in 64 bit (HKLM\...\{4BEE127E-95C4-434D-
ABAC-65155192BB24}) (Version: 4.35.1742 - Autodesk)
Autodesk Content Service (HKLM\...\Autodesk Content Service) (Version: 3.2.0.0 -
Autodesk)
Autodesk Content Service (Version: 3.2.0.0 - Autodesk) Hidden
Autodesk Content Service Language Pack (Version: 3.2.0.0 - Autodesk) Hidden
Autodesk Featured Apps 2016 (HKLM-x32\...\{D42F37CD-9AF9-4435-A474-B387C5BB6B47})
Autodesk Material Library 2016 (HKLM-x32\...\{29A7D6EC-63C2-42FD-8143-
5812ABD2923F}) (Version: 6.3.0.15 - Autodesk)
Autodesk Material Library Base Resolution Image Library 2016 (HKLM-x32\...\
{6B4CFC6E-ECB0-47FE-95D3-65C680ED0687}) (Version: 6.3.0.15 - Autodesk)
BatteryCare 0.9.26.0 (HKLM-x32\...\{C6A6036D-FBD0-4324-BEAA-C0845257160C}_is1)
(Version: 0.9.26.0 - Filipe Loureno)
CPUID HWMonitor 1.30 (HKLM\...\CPUID HWMonitor_is1) (Version: - )
Dropbox (HKLM-x32\...\Dropbox) (Version: 19.4.12 - Dropbox, Inc.)
Dropbox Update Helper (x32 Version: 1.3.65.1 - Dropbox, Inc.) Hidden
Intel(R) Chipset Device Software (x32 Version: 10.1.1.13 - Intel(R) Corporation)
Hidden
Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-
8DE5E91F3700}) (Version: 11.0.0.1173 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA})
(Version: 21.20.16.4534 - Intel Corporation)
Intel Security Assist (HKLM-x32\...\{4B230374-6475-4A73-BA6E-41015E9C5013})
(Version: 1.0.0.532 - Intel Corporation)
MATLAB R2016a (HKLM\...\Matlab R2016a) (Version: 9.0 - MathWorks)
Microsoft Access database engine 2010 (English) (HKLM\...\{90140000-00D1-0409-1000-
0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version:
14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-
6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-
C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-
F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\
{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft
Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\
{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft
Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-
B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\
{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft
Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\
{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft
Corporation)
{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft
Corporation)
{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft
Corporation)
{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft
Corporation)
{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft
Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft
Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft
Corporation)
NVIDIA 3D Vision Driver 378.49 (HKLM\...\{B2FE1952-0186-46C3-BAEC-
A80AA35AC5B8}_Display.3DVision) (Version: 378.49 - NVIDIA Corporation)
NVIDIA GeForce Experience 3.3.0.95 (HKLM\...\{B2FE1952-0186-46C3-BAEC-
A80AA35AC5B8}_Display.GFExperience) (Version: 3.3.0.95 - NVIDIA Corporation)
NVIDIA Graphics Driver 378.49 (HKLM\...\{B2FE1952-0186-46C3-BAEC-
A80AA35AC5B8}_Display.Driver) (Version: 378.49 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.16.0318 (HKLM\...\{B2FE1952-0186-46C3-BAEC-
A80AA35AC5B8}_Display.PhysX) (Version: 9.16.0318 - NVIDIA Corporation)
NvNodejs (Version: 3.3.0.95 - NVIDIA Corporation) Hidden
NvTelemetry (Version: 2.3.5.0 - NVIDIA Corporation) Hidden
NvvHci (Version: 2.02.0.5 - NVIDIA Corporation) Hidden
Opera Stable 42.0.2393.517 (HKLM-x32\...\Opera 42.0.2393.517) (Version:
42.0.2393.517 - Opera Software)
OSD (HKLM-x32\...\{445FFA4E-70A8-493B-9A8C-D095244D03BE}_is1) (Version: 1.04.06 -
OEM)
PowerISO (HKLM-x32\...\PowerISO) (Version: 6.7 - Power Software Ltd)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-
958108FE7DBC}) (Version: 6.0.1.7811 - Realtek Semiconductor Corp.)
Sentinel HASP Run-time (HKLM-x32\...\{2A414CBE-CDF3-48C6-A91B-D3D4522F8EB5})
(Version: 5.10.1.17163 - SafeNet Inc.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\
{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{A3364707-2F53-4C83-8F68-
C9877A9080C7}) (Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version: -
Microsoft) Hidden
SHIELD Streaming (Version: 7.1.0351 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 3.3.0.95 - NVIDIA Corporation) Hidden
SketchUp Import 2016 (HKLM-x32\...\{C769FB7C-1F55-4B31-9A2A-21CEC50F4F92})
Skype 7.31 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version:
7.31.104 - Skype Technologies S.A.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 19.2.5.0 -
Synaptics Incorporated)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.4 - VideoLAN)
Vulkan Run Time Libraries 1.0.37.0 (HKLM\...\VulkanRT1.0.37.0) (Version: 1.0.37.0 -
LunarG, Inc.)
WinRAR 5.40 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.40.0 - win.rar GmbH)
==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The
file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-3546805371-3866020912-3027837689-1001_Classes\CLSID\
{0B628DE4-07AD-4284-81CA-5B439F67C5E6}\localserver32 -> C:\Program
Files\Autodesk\AutoCAD 2016\acad.exe (Autodesk, Inc.)
{149DD748-EA85-45A6-93C5-AC50D0260C98}\localserver32 -> C:\Program
{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 ->
C:\Users\boissei\AppData\Local\Microsoft\OneDrive\17.3.6743.1212\amd64\FileSyncShel
l64.dll => No Fil (the data entry has 1 more characters).
{5370C727-1451-4700-A960-77630950AF6D}\localserver32 -> C:\Program
{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 ->
{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 ->
{E2C40589-DE61-11ce-BAE0-0020AF6D7005}\InprocServer32 -> C:\Program
Files\Autodesk\AutoCAD 2016\en-US\acadficn.dll (Autodesk, Inc.)
{FE186CB0-BEDC-11D5-9B1D-0050DA438716}\localserver32 -> "C:\Program
Files\EPLAN\Platform\2.6.3\Bin\Eplan.exe" => No File
==================== Scheduled Tasks (Whitelisted) =============
Task: {148ABE22-145E-478B-B34C-46C188D978B8} -
System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} =>
C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [2017-01-20]
(NVIDIA Corporation)
Task: {24D5AB01-67DF-44D5-9DC8-0BCA0B53B6F3} - System32\Tasks\UCBrowserUpdater =>
C:\Program Files (x86)\UCBrowser\Application\update_task.exe <==== ATTENTION
Task: {2B313D79-0395-41B9-B17B-55C067611E4D} -
System32\Tasks\UCBrowserSecureUpdater => C:\Program Files
(x86)\UCBrowser\Security\uclauncher.exe <==== ATTENTION
Task: {319202E9-26A2-4179-90C8-45BF2AAF9EB8} -
System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} =>
C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-01-20]
Task: {32925F65-0336-4AC8-9D25-6C91E58CD0AC} -
System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program
Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-01-20] (NVIDIA
Corporation)
Task: {409AA618-65D9-4A08-BDB6-EB179BC64171} - System32\Tasks\{2E3EC426-50F0-4094-
A505-DBB460E8C926} => pcalua.exe -a
"C:\Users\boissei\Downloads\EPLANElectricP82.6.3.10395\EPLAN Electric P8
2.6.3.10395\Install\setup.exe" -d
"C:\Users\boissei\Downloads\EPLANElectricP82.6.3.10395\EPLAN Electric P8
2.6.3.10395\Install"
Task: {52B4F9B6-FA25-44CB-8AEC-27A8CBDF45B3} -
System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files
(x86)\Dropbox\Update\DropboxUpdate.exe [2017-02-02] (Dropbox, Inc.)
Task: {6AAB3F56-D2C6-42E6-AE0D-F86ADB09969D} - System32\Tasks\Adobe Flash Player
Updater => C:\Windows\SysWoW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-
01-16] (Adobe Systems Incorporated)
Task: {86F0DA8D-135E-470F-8360-234D053857A8} - System32\Tasks\Thuckwiwse => /i
hxxp://d2buh1bf1g584w.cloudfront.net/msi/rel.php?
u=HitachiXHTS542525K9SA00_080604BB6F00WDJDH7AGX&v=201727 /q
Task: {894E88A2-E594-47F4-BAFD-1BC0ABBBD144} - System32\Tasks\Adobe Flash Player
PPAPI Notifier =>
C:\Windows\SysWoW64\Macromed\Flash\FlashUtil32_24_0_0_194_pepper.exe [2017-01-16]
(Adobe Systems Incorporated)
Task: {918154F4-49CC-4C68-8022-1384F7D87FB6} - System32\Tasks\BatteryCareAuto =>
C:\Program Files (x86)\BatteryCare\BatteryCare.exe [2015-10-25] (Filipe Loureno)
Task: {B0F244E4-6E5B-49AF-9B02-74C09FFCC7BA} - System32\Tasks\NvTmMon_{B2FE1952-
0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update
Core\NvTmMon.exe [2017-01-20] (NVIDIA Corporation)
Task: {B72AC71F-7485-4CFD-ADBC-56DB43DDA016} -
System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program
Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe [2017-01-20] (NVIDIA
Corporation)
Task: {BF625441-8643-4036-9EA8-EB94B402B69E} -
System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files
(x86)\Dropbox\Update\DropboxUpdate.exe [2017-02-02] (Dropbox, Inc.)
Task: {D8A3FE2E-9513-4554-AA84-AD54E2AE74B0} - System32\Tasks\Adobe Acrobat Update
Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-12-19]
(Adobe Systems Incorporated)
Task: {DE1D4D98-C2AF-4C15-843D-A0F4B4D9701E} -
System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} =>
C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-01-20]
Task: {E45BEA6B-72F5-448C-9D8E-827E0CB7AA7C} - System32\Tasks\NvTmRep_{B2FE1952-
0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update
Core\NvTmRep.exe [2017-01-20] (NVIDIA Corporation)
Task: {F1D177C2-6537-4E2F-A750-767A7CD26A7A} - System32\Tasks\Opera scheduled
Autoupdate 1484524274 => C:\Program Files (x86)\Opera\launcher.exe [2017-01-26]
(Opera Software)
Task: {FCB2658B-4315-4722-A000-02CBFCF96229} - System32\Tasks\UCBrowserUpdaterCore
=> C:\Program Files (x86)\UCBrowser\Application\update_task.exe <==== ATTENTION
(If an entry is included in the fixlist, the task (.job) file will be moved. The
file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player PPAPI Notifier.job =>

C:\Windows\SysWoW64\Macromed\Flash\FlashUtil32_24_0_0_194_pepper.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job =>
C:\Windows\SysWoW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\CreateExplorerShellUnelevatedTask.job =>
C:\Windows\explorer.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files
(x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files
(x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\UCBrowserUpdater.job => C:\Program Files
(x86)\UCBrowser\Application\update_task.exe <==== ATTENTION
Task: C:\Windows\Tasks\UCBrowserUpdaterCore.job => C:\Program Files
(x86)\UCBrowser\Application\update_task.exe <==== ATTENTION
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
WMI_ActiveScriptEventConsumer_ASEC: <===== ATTENTION
==================== Loaded Modules (Whitelisted) ==============
2015-05-19 09:11 - 2015-05-19 09:11 - 00007680 _____ () C:\Program Files

(x86)\Intel\Intel(R) Security Assist\isaHelperService.exe
2017-01-16 02:19 - 2017-01-20 20:39 - 04489152 _____ () C:\Program Files\NVIDIA
Corporation\NvContainer\Poco.dll
Corporation\NvContainer\libprotobuf.dll
2017-01-16 01:29 - 2014-05-22 11:09 - 00009728 _____ () C:\Program Files
(x86)\OEM\OSD\OSDSrv.exe
2016-07-16 13:42 - 2016-07-16 13:42 - 00231424 _____ ()
C:\Windows\SYSTEM32\ism32k.dll
2017-01-16 14:39 - 2016-12-09 12:29 - 02681200 _____ ()
C:\Windows\System32\CoreUIComponents.dll
Corporation\Display\NvSmartMax64.dll
2017-01-16 14:39 - 2016-12-09 12:29 - 02681200 _____ ()
C:\Windows\system32\CoreUIComponents.dll
2017-01-16 14:39 - 2016-12-09 12:29 - 02681200 _____ ()
C:\Windows\SYSTEM32\CoreUIComponents.dll
2017-01-16 14:41 - 2016-09-07 06:56 - 00134656 _____ ()
C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2017-01-16 14:41 - 2016-12-21 09:09 - 00474112 _____ ()
C:\Windows\ShellExperiences\QuickActions.dll
2017-01-16 14:39 - 2016-12-21 08:54 - 09760768 _____ ()
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-01-16 14:39 - 2016-12-21 08:48 - 01401856 _____ ()
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-01-16 14:39 - 2016-12-21 08:48 - 00757248 _____ ()
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2017-01-16 14:39 - 2016-12-21 08:48 - 02424320 _____ ()
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTas
k.dll
2017-01-16 14:39 - 2016-12-21 08:53 - 04853760 _____ ()
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2017-01-16 12:00 - 2014-03-22 14:08 - 00252928 _____ () C:\Program Files
(x86)\BatteryCare\OpenHardwareMonitorLib.dll
2017-02-06 13:32 - 2016-02-24 06:47 - 00110664 _____ () C:\Program Files
(x86)\Common Files\Autodesk Shared\AppManager\R1\qjson0.dll
2017-02-06 13:32 - 2016-02-24 06:48 - 00062024 _____ () C:\Program Files
(x86)\Common Files\Autodesk Shared\AppManager\R1\QtSolutions_Service-head.dll
2017-01-16 02:19 - 2017-01-20 20:39 - 00018880 _____ () C:\Program Files
(x86)\NVIDIA Corporation\Update Core\detoured.dll
2017-01-16 02:19 - 2017-01-20 20:39 - 03774400 _____ () C:\Program Files
(x86)\NVIDIA Corporation\NvContainer\Poco.dll
2017-01-16 02:19 - 2017-01-20 20:39 - 00900032 _____ () C:\Program Files
(x86)\NVIDIA Corporation\NvContainer\libprotobuf.dll
2017-01-16 02:19 - 2017-01-20 20:38 - 64245184 _____ () C:\Program Files
(x86)\NVIDIA Corporation\NVIDIA GeForce Experience\libcef.dll
2017-01-16 02:19 - 2017-01-20 15:36 - 00338488 _____ () \\?\C:\Program Files
(x86)\NVIDIA Corporation\NvNode\NVAccountAPINode.node
2017-01-16 02:19 - 2017-01-20 15:36 - 00254008 _____ () \\?\C:\Program Files
(x86)\NVIDIA Corporation\NvNode\DriverInstall.node
2017-01-16 02:19 - 2017-01-20 15:36 - 02808888 _____ () \\?\C:\Program Files
(x86)\NVIDIA Corporation\NvNode\Downloader.node
2017-01-16 02:19 - 2017-01-20 15:36 - 00384568 _____ () \\?\C:\Program Files
(x86)\NVIDIA Corporation\NvNode\NvGameShareAPINode.node
2017-01-16 02:19 - 2017-01-20 15:36 - 00537656 _____ () \\?\C:\Program Files
(x86)\NVIDIA Corporation\NvNode\NvSpCapsAPINode.node
2017-01-16 02:19 - 2017-01-20 15:36 - 00468024 _____ () \\?\C:\Program Files
(x86)\NVIDIA Corporation\NvNode\NvGalleryAPINode.node
2017-01-16 02:19 - 2017-01-20 15:36 - 01066552 _____ () \\?\C:\Program Files
(x86)\NVIDIA Corporation\NvNode\NvCameraAPINode.node
2017-01-26 13:22 - 2017-01-20 15:36 - 01014840 _____ () \\?\C:\Program Files
(x86)\NVIDIA Corporation\NvNode\NvSDKAPINode.node
2015-10-16 06:14 - 2015-10-16 06:14 - 01243936 _____ () C:\Program Files
(x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2017-02-07 17:23 - 2017-02-07 17:23 - 00226304 ____H () C:\Program Files
(x86)\Skype\ReferenceAssembliesSkype.dll
2017-01-27 22:48 - 2017-01-27 22:47 - 68771416 _____ () C:\Program Files
(x86)\Opera\42.0.2393.517\opera.dll
2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files
(x86)\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2010-10-20 15:45 - 2010-10-20 15:45 - 08801120 _____ () C:\Program Files
(x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2017-01-27 22:48 - 2017-01-27 22:47 - 01895000 _____ () C:\Program Files
(x86)\Opera\42.0.2393.517\libglesv2.dll
2017-01-27 22:48 - 2017-01-27 22:47 - 00087128 _____ () C:\Program Files
(x86)\Opera\42.0.2393.517\libegl.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\Windows\system32\drivers:ucdrv-x64.sys [23652]

AlternateDataStreams: C:\Windows\system32\drivers:x64 [1479458]
AlternateDataStreams: C:\Windows\system32\drivers:x86 [1205026]
==================== Safe Mode (Whitelisted) ===================
"AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to
default or removed.)
HKU\S-1-5-21-3546805371-3866020912-3027837689-1001\Software\Classes\.scr:
AutoCADScriptFile => C:\Windows\system32\notepad.exe "%1"
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2016-07-16 13:47 - 2016-07-16 13:45 - 00000824 ____A

C:\Windows\system32\Drivers\etc\hosts
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-3546805371-3866020912-3027837689-1001\Control Panel\Desktop\\Wallpaper
-> C:\Windows\web\wallpaper\Windows\img0.jpg
DNS Servers: 192.168.1.254
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System =>
(ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
==================== FirewallRules (Whitelisted) ===============
FirewallRules: [vm-monitoring-nb-session] => LPort=139

FirewallRules: [{0248E926-A3A3-40CC-84CD-95ACEBA368E0}] => C:\Program Files\NVIDIA
Corporation\NvContainer\NvContainer.exe
FirewallRules: [{1600018E-D5D5-404F-9033-214468875192}] => C:\Program Files\NVIDIA
Corporation\NvContainer\NvContainer.exe
FirewallRules: [{DA09F915-E2D9-4731-B5F7-99013CEABB92}] => C:\Program Files\NVIDIA
Corporation\NvStreamSrv\NvStreamUserAgent.exe
FirewallRules: [{3E681429-B3BB-4777-B5A8-D0C387F757C3}] => C:\Program Files\NVIDIA
Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{0421A037-DE5A-4FF7-835C-B992819CF803}] => C:\Program Files\NVIDIA
Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{D6372C7A-DA4B-44D9-AC84-2222371EC062}] =>
C:\Users\boissei\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{79388F41-7BD6-4D90-9566-C610F5D81EC6}] =>
FirewallRules: [{1CF71D23-CF3C-4FFF-8D30-60097C58217F}] =>
FirewallRules: [{C8ACB2E4-34D1-4CC7-9DD8-4F0C1CF04577}] =>
FirewallRules: [{0EFA0FDF-71BF-47F9-B784-6E9C3D273F37}] =>
FirewallRules: [{1DF7F24A-8CF9-4CF4-AAA1-5F2F4F2F5531}] =>
FirewallRules: [{648F5A06-874C-47FD-8904-ABEA9C4608F7}] => C:\Program Files
(x86)\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{61645A1E-F31B-4E33-98E9-570F0D681A8F}C:\program
files\eplan\platform\2.6.3\bin\eplan.exe] => C:\program
files\eplan\platform\2.6.3\bin\eplan.exe
FirewallRules: [UDP Query User{EB68FA0C-2138-42DE-B8CE-63A3C7DFB036}C:\program
files\eplan\platform\2.6.3\bin\eplan.exe] => C:\program
files\eplan\platform\2.6.3\bin\eplan.exe
FirewallRules: [{4F68C039-9AF2-4B6E-B6A3-1B40060B513A}] => C:\Program Files
(x86)\Opera\42.0.2393.137\opera.exe
FirewallRules: [{7AFB2D10-68C0-4FDD-A085-74505E8EABD6}] => C:\Program Files
(x86)\Opera\42.0.2393.517\opera.exe
FirewallRules: [TCP Query User{F602311C-DF82-4B97-B352-739CF5CB9679}C:\program
files\matlab\r2016a\bin\win64\matlab.exe] => C:\program
files\matlab\r2016a\bin\win64\matlab.exe
FirewallRules: [UDP Query User{DB58DB44-C369-480B-9909-2CF72B44EA98}C:\program
files\matlab\r2016a\bin\win64\matlab.exe] => C:\program
files\matlab\r2016a\bin\win64\matlab.exe
FirewallRules: [{1B16515B-6548-4FF6-A55E-CBDAD08D85C1}] => C:\Program Files
(x86)\Dropbox\Client\Dropbox.exe
FirewallRules: [{B3723A79-F8C1-4957-B280-C4D9376F1266}] =>
C:\Users\boissei\AppData\Roaming\ACEStream\engine\ace_engine.exe
FirewallRules: [{22887A74-5977-4D25-8AEC-96E44143829D}] =>
C:\Users\boissei\AppData\Roaming\ACEStream\engine\ace_engine.exe
FirewallRules: [TCP Query User{E6251D4D-D349-4294-A3D0-
9E4DD3C2DF8F}C:\users\boissei\appdata\local\akamai\netsession_win.exe] =>
C:\users\boissei\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{9495ECBD-C0FD-436B-B9C1-
0F9312F5CDBD}C:\users\boissei\appdata\local\akamai\netsession_win.exe] =>
C:\users\boissei\appdata\local\akamai\netsession_win.exe
FirewallRules: [{1B51AD3D-E876-496C-891E-75CA1123403C}] => LPort=58222
FirewallRules: [{D7338C56-0D77-40C4-BDE7-19EA50508526}] => LPort=5000
FirewallRules: [{0D638500-E3A9-4B65-A467-8A67DD946CF4}] => LPort=50248
FirewallRules: [{55A32D64-84DD-40AD-99C5-0EADBF0AC706}] => C:\Program Files
(x86)\UCBrowser\Application\UCBrowser.exe
FirewallRules: [{6BACF731-C975-4214-97EF-AE95A3DDCC7E}] => C:\Program Files
(x86)\UCBrowser\Application\UCBrowser.exe
FirewallRules: [TCP Query User{52D977CC-543B-490B-B6C4-
CAADB9A04898}C:\windows\kmsemulator.exe] => C:\windows\kmsemulator.exe
FirewallRules: [UDP Query User{4EFDE1EF-D781-476A-A0A8-
3ACE35901D91}C:\windows\kmsemulator.exe] => C:\windows\kmsemulator.exe
==================== Restore Points =========================
27-01-2017 12:14:14 Windows Update

30-01-2017 19:26:37 Installed Microsoft Visual C++ 2005 Redistributable (x64)
06-02-2017 13:13:20 Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030
07-02-2017 16:03:29 Removed Microsoft Office Professional Plus 2010
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (02/08/2017 12:19:40 AM) (Source: Application Error) (EventID: 1000)
(User: )
Description: Faulting application name: Connect.Service.ContentService.exe,
version: 20.1.49.0, time stamp: 0x54d43c57
Faulting module name: KERNELBASE.dll, version: 10.0.14393.479, time stamp:
0x582588e6
Exception code: 0xe0434352
Fault offset: 0x0000000000017788
Faulting process id: 0x2380
Faulting application start time: 0x01d2819046206e34
Faulting application path: C:\Program Files\Autodesk\Content
Service\Connect.Service.ContentService.exe
Faulting module path: C:\Windows\System32\KERNELBASE.dll
Report Id: f515a6ed-6145-44c2-a4d4-c685aa731d09
Faulting package full name:
Faulting package-relative application ID:
Error: (02/08/2017 12:19:40 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: Connect.Service.ContentService.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.AccessViolationException
at System.Data.SqlServerCe.Accessor.set_Value_STRING(System.String)
at System.Data.SqlServerCe.Accessor.set_Value(System.Object)
at System.Data.SqlServerCe.SqlCeCommand.FillParameterDataBindings()
at
System.Data.SqlServerCe.SqlCeCommand.ExecuteCommand(System.Data.CommandBehavior,
System.String, System.Data.SqlServerCe.ResultSetOptions)
at System.Data.SqlServerCe.SqlCeCommand.ExecuteReader()
at Connect.Utilities.SqlCEUtil.TableExists(System.String, System.String)
at Connect.MetaStore.ApplicationParameter..cctor()
Exception Info: System.TypeInitializationException

at Connect.MetaStore.ApplicationParameter.GetParameterValue(System.String)
at Connect.MetaStore.DatabaseVersion.VersionSchemaExists()
at Connect.MetaStore.DatabaseVersion.Validate()
at Connect.MetaStore.MetaStorage.Initialize()
at Connect.IVault.IVault.OnStart(System.String[])
at System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(System.Object)
at
System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext,
System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext,
at
System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.Exe
cuteWorkItem()
at System.Threading.ThreadPoolWorkQueue.Dispatch()

(User: )
0x582588e6
Fault offset: 0x0000000000017788
Faulting application start time: 0x01d281903fc7c952
Report Id: f3eec71a-98e8-4956-a925-abbe8fa68a29
at

at
at
cuteWorkItem()

(User: )
0x582588e6
Fault offset: 0x0000000000017788
Faulting application start time: 0x01d281903965612a
Report Id: b2722c18-53d3-49f7-8b36-c089cdb649c0
at

at
at
cuteWorkItem()

(User: )
0x582588e6
Fault offset: 0x0000000000017788
Faulting application start time: 0x01d28190330a5605
Report Id: 49545363-9735-4bb0-9d8e-b230956bd039
at

at
at
cuteWorkItem()

(User: )
0x582588e6
Fault offset: 0x0000000000017788
Faulting process id: 0x1e20
Faulting application start time: 0x01d281902cae2957
Report Id: 9e893979-2272-4a47-a499-d13a7b041ef3
at

at
at
cuteWorkItem()
System errors:
=============
Error: (02/08/2017 12:19:40 AM) (Source: Service Control Manager) (EventID: 7031)
(User: )
Description: The Autodesk Content Service service terminated unexpectedly. It has
done this 112 time(s). The following corrective action will be taken in 10000
milliseconds: Restart the service.
(User: )
(User: )
(User: )
(User: )
(User: )
(User: )
(User: )
(User: )
(User: )
CodeIntegrity:
===================================
Date: 2017-02-07 13:52:12.939
Description: Code Integrity determined that a process
(\Device\HarddiskVolume9\Program Files\Windows Defender\MsMpEng.exe) attempted to
load
\Device\HarddiskVolume9\Windows\System32\DriverStore\FileRepository\nvtfi.inf_amd64
_d16a48d1053da7e2\nvinitx.dll that did not meet the Custom 3 / Antimalware signing
level requirements.
Date: 2017-01-27 12:14:11.733

load
_14524190d6bf7c17\nvinitx.dll that did not meet the Custom 3 / Antimalware signing
level requirements.
Date: 2017-01-17 14:56:34.703

load
level requirements.
Date: 2017-01-16 15:01:17.859

load
level requirements.
Date: 2017-01-16 12:44:01.153

load
level requirements.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz

Percentage of memory in use: 39%
Total physical RAM: 8110.58 MB
Available physical RAM: 4890.32 MB
Total Virtual: 9390.58 MB
Available Virtual: 5734.61 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:237.92 GB) (Free:171.45 GB) NTFS

Drive d: ( ) (Fixed) (Total:9.76 GB) (Free:3.48 GB) NTFS
Drive e: () (Fixed) (Total:110.05 GB) (Free:34.99 GB) NTFS ==>[system with boot
components (obtained from drive)]
Drive f: () (Fixed) (Total:99.34 GB) (Free:11.46 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 238.5 GB) (Disk ID: 00000000)
Partition: GPT.
==================== End of Addition.txt ============================

Addition

Diunggah oleh

Informasi Dokumen

Hak Cipta

Format Tersedia

Bagikan dokumen Ini

Bagikan atau Tanam Dokumen

Opsi Berbagi

Apakah menurut Anda dokumen ini bermanfaat?

Apakah konten ini tidak pantas?

Hak Cipta:

Format Tersedia

Addition

Diunggah oleh

Hak Cipta:

Format Tersedia

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 05-02-2017

Ran by boissei (08-02-2017 00:19:28)

==================== Accounts: =============================

Administrator (S-1-5-21-3546805371-3866020912-3027837689-500 - Administrator -

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

==================== Custom CLSID (Whitelisted): ==========================

==================== Scheduled Tasks (Whitelisted) =============

Task: C:\Windows\Tasks\Adobe Flash Player PPAPI Notifier.job =>

(The entries could be listed to be restored or removed.)

WMI_ActiveScriptEventConsumer_ASEC: <===== ATTENTION

==================== Loaded Modules (Whitelisted) ==============

2015-05-19 09:11 - 2015-05-19 09:11 - 00007680 _____ () C:\Program Files

==================== Alternate Data Streams (Whitelisted) =========

AlternateDataStreams: C:\Windows\system32\drivers:ucdrv-x64.sys [23652]

==================== Safe Mode (Whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"

==================== Association (Whitelisted) ===============

==================== Internet Explorer trusted/restricted ===============

==================== Hosts content: ===============================

2016-07-16 13:47 - 2016-07-16 13:45 - 00000824 ____A

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

==================== MSCONFIG/TASK MANAGER disabled items ==

==================== FirewallRules (Whitelisted) ===============

FirewallRules: [vm-monitoring-nb-session] => LPort=139

==================== Restore Points =========================

27-01-2017 12:14:14 Windows Update

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Exception Info: System.TypeInitializationException

Error: (02/08/2017 12:19:29 AM) (Source: Application Error) (EventID: 1000)

Exception Info: System.TypeInitializationException

Error: (02/08/2017 12:19:18 AM) (Source: Application Error) (EventID: 1000)

Exception Info: System.TypeInitializationException

Error: (02/08/2017 12:19:08 AM) (Source: Application Error) (EventID: 1000)

Exception Info: System.TypeInitializationException

Error: (02/08/2017 12:18:57 AM) (Source: Application Error) (EventID: 1000)

Exception Info: System.TypeInitializationException

Date: 2017-01-27 12:14:11.733

Date: 2017-01-17 14:56:34.703

Date: 2017-01-16 15:01:17.859

Date: 2017-01-16 12:44:01.153

==================== Memory info ===========================

Processor: Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz

==================== Drives ================================

Drive c: () (Fixed) (Total:237.92 GB) (Free:171.45 GB) NTFS

==================== End of Addition.txt ============================

Anda mungkin juga menyukai