Additional scan result of Farbar Recovery Scan Tool (x64) Version: 05-06-2017
Ran by Oli (06-06-2017 21:51:12)
Running from C:\Users\Oli\Desktop\FRST
Windows 8.1 (Update) (X64) (2017-02-19 01:21:36)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-2083115291-1334581206-888238541-500 - Administrator - Disabled)
Guest (S-1-5-21-2083115291-1334581206-888238541-501 - Limited - Disabled)
Oli (S-1-5-21-2083115291-1334581206-888238541-1001 - Administrator - Enabled) => C:\Users\Oli

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Antivirus (Enabled - Up to date) {B3F630BD-538D-1B4A-14FA-14B63235278F}
AV: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Antivirus (Enabled - Up to date) {0897D159-75B7-14C4-2E4A-2FC449B26D32}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

ALLPlayer Remote Control (HKLM-x32\...\{146BDBDD-ACD9-4B04-A286-C27471841E8E}_is1) (Version: 1.4 - ALLPlayer Group, Ltd.)
ALLPlayer V7.X (HKLM-x32\...\ALLPlayer_is1) (Version:  - ALLPlayer Group, Ltd.)
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.26.48 - Avira Operations GmbH & Co. KG)
Avira Connect (HKLM-x32\...\{b9b31169-be62-4b82-9e65-d47c99299ba1}) (Version: 1.2.88.24864 - Avira Operations GmbH & Co. KG)
Avira Connect (x32 Version: 1.2.88.24864 - Avira Operations GmbH & Co. KG) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3308 - Intel Corporation)
KMPlayer (remove only) (HKLM-x32\...\The KMPlayer) (Version: 4.1.5.8 - PandoraTV)
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Mozilla Firefox 53.0.3 (x86 pl) (HKLM-x32\...\Mozilla Firefox 53.0.3 (x86 pl)) (Version: 53.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 53.0.3.6347 - Mozilla)
NapiProjekt (2.2.0.2399) (HKLM-x32\...\NapiProjekt_is1) (Version:  - )
NVIDIA Graphics Driver 376.54 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 376.54 - NVIDIA Corporation)
OpenOffice 4.1.3 (HKLM-x32\...\{4D71C348-C964-442D-B2DB-5160E46FB664}) (Version: 4.13.9783 - Apache Software Foundation)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 10.0.10586.27055 - Realtek Semiconduct Corp.)
Secenacas version 2.0 (HKLM-x32\...\Secenacas_is1) (Version: 2.0 - )
Spotify (HKU\S-1-5-21-2083115291-1334581206-888238541-1001\...\Spotify) (Version: 1.0.54.1079.g3809528e - Spotify AB)
Vulkan Run Time Libraries 1.0.26.0 (HKLM\...\VulkanRT1.0.26.0) (Version: 1.0.26.0 - LunarG, Inc.)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2017-02-19 03:46 - 2016-12-29 15:16 - 00134712 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2013-10-01 14:02 - 2013-10-01 14:02 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 _____ C:\WINDOWS\system32\Drivers\etc\hosts


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2083115291-1334581206-888238541-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Oli\AppData\Roaming\Microsoft\Windows Photo Viewer\Windows Photo Viewer Wallpaper.jpg
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{5D1D79D5-FD0F-44C4-A123-AD2515EDEC09}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{7C987BAE-9C96-4653-B9AA-10D1D0B533EE}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{0A805563-5C9E-4BD9-B67D-EEEDC884160D}C:\users\oli\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\oli\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{1A102E1D-A58B-43FB-A1A6-267BEA9F3685}C:\users\oli\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\oli\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{C3605C5D-6709-41F7-AE1B-273141B622B3}C:\program files (x86)\allplayer remote\allplayerremotecontrol.exe] => (Allow) C:\program files (x86)\allplayer remote\allplayerremotecontrol.exe
FirewallRules: [UDP Query User{442E5221-4E29-47ED-9DD2-B2376C0F5C85}C:\program files (x86)\allplayer remote\allplayerremotecontrol.exe] => (Allow) C:\program files (x86)\allplayer remote\allplayerremotecontrol.exe
FirewallRules: [{400F5D65-01B0-4381-9204-99E580466023}] => (Block) C:\program files (x86)\allplayer remote\allplayerremotecontrol.exe
FirewallRules: [{A7F55D01-F0D7-40A1-B598-8F00CC8A675E}] => (Block) C:\program files (x86)\allplayer remote\allplayerremotecontrol.exe
FirewallRules: [{9844F484-B5D5-4B04-B1EA-8EB1978D870F}] => (Allow) C:\Program Files (x86)\NapiProjekt\napisy.exe
FirewallRules: [{DAAC8F95-0FC5-459B-AB7A-D10C524D6C71}] => (Allow) C:\Program Files (x86)\NapiProjekt\napisy.exe

==================== Restore Points =========================

06-05-2017 11:15:19 Windows Update
10-05-2017 18:18:25 Windows Update
12-05-2017 18:42:07 SPTD setup V1.89
22-05-2017 17:43:53 Scheduled Checkpoint
23-05-2017 16:53:31 Restore Point Created by FRST
06-06-2017 21:19:08 Restore Point Created by FRST

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (06/06/2017 09:19:08 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005, Access is denied.
.
This is often caused by incorrect security settings in either the writer or requestor process.


Operation:
   Gathering Writer Data

Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {95a7de6c-aa79-4c6c-a7b0-af7a3a2d5189}

Error: (05/23/2017 04:53:31 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005, Access is denied.
.
This is often caused by incorrect security settings in either the writer or requestor process.


Operation:
   Gathering Writer Data

Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {8e8ce271-ea18-41ec-a7f3-5a7f1da8c4ff}

Error: (05/12/2017 06:42:06 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005, Access is denied.
.
This is often caused by incorrect security settings in either the writer or requestor process.


Operation:
   Gathering Writer Data

Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {7364841b-8bb3-4524-a28d-1aba2abc667c}

Error: (05/11/2017 09:58:30 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: bugreport.exe, version: 6.10.449.30619, time stamp: 0x57426dfa
Faulting module name: ntdll.dll, version: 6.3.9600.18233, time stamp: 0x56bb4e1d
Exception code: 0xc0000022
Fault offset: 0x0009d3c2
Faulting process id: 0xb54
Faulting application start time: 0x01d2ca90f49229a0
Faulting application path: C:\Program Files (x86)\Elex-tech\YAC\bugreport.exe
Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll
Report Id: 345019f6-3684-11e7-825f-6c71d982d1b2
Faulting package full name: 
Faulting package-relative application ID:

Error: (05/11/2017 07:12:20 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mrt.exe, version: 5.47.13703.0, time stamp: 0x58dec9f9
Faulting module name: combase.dll, version: 6.3.9600.18202, time stamp: 0x569e6ee3
Exception code: 0xc0000005
Fault offset: 0x000000000003a02f
Faulting process id: 0xbd4
Faulting application start time: 0x01d2ca79b2bcba32
Faulting application path: C:\WINDOWS\system32\mrt.exe
Faulting module path: C:\WINDOWS\SYSTEM32\combase.dll
Report Id: fda4794e-366c-11e7-825f-6c71d982d1b2
Faulting package full name: 
Faulting package-relative application ID:

Error: (04/21/2017 05:23:22 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: WINWORD.EXE, version: 12.0.4518.1014, time stamp: 0x45428028
Faulting module name: oart.dll, version: 12.0.4518.1014, time stamp: 0x454283f8
Exception code: 0xc0000005
Fault offset: 0x008319ef
Faulting process id: 0x350
Faulting application start time: 0x01d2ba92061df853
Faulting application path: C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE
Faulting module path: C:\Program Files (x86)\Microsoft Office\Office12\oart.dll
Report Id: 7480c135-26a6-11e7-825e-6c71d982d1b2
Faulting package full name: 
Faulting package-relative application ID:

Error: (04/13/2017 06:11:47 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: MRT.exe, version: 5.47.13703.0, time stamp: 0x58dec9f9
Faulting module name: combase.dll, version: 6.3.9600.18202, time stamp: 0x569e6ee3
Exception code: 0xc0000005
Fault offset: 0x000000000003a02f
Faulting process id: 0xcb0
Faulting application start time: 0x01d2b470725a52f6
Faulting application path: C:\WINDOWS\system32\MRT.exe
Faulting module path: C:\WINDOWS\SYSTEM32\combase.dll
Report Id: e496bee8-2063-11e7-825c-6c71d982d1b2
Faulting package full name: 
Faulting package-relative application ID:

Error: (04/13/2017 06:11:39 PM) (Source: Perflib) (EventID: 1017) (User: )
Description: Disabled performance counter data collection from the "Outlook" service because the performance counter library for that service has generated one or more errors. The errors that forced this action have been written to the application event log. Correct the errors before enabling the performance counters for this service.

Error: (04/13/2017 06:11:39 PM) (Source: Perflib) (EventID: 1021) (User: )
Description: Windows cannot open the 32-bit extensible counter DLL Outlook in a 64-bit environment. Contact the file vendor to obtain a 64-bit version. Alternatively, you can open the 32-bit extensible counter DLL by using the 32-bit version of Performance Monitor. To use this tool, open the Windows folder, open the Syswow64 folder, and then start Perfmon.exe.

Error: (04/06/2017 06:15:58 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: oliwia)
Description: Activation of app Microsoft.Reader_8wekyb3d8bbwe!Microsoft.Reader failed with error: -2147023170 See the Microsoft-Windows-TWinUI/Operational log for additional information.


System errors:
=============
Error: (06/06/2017 09:42:54 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Superfetch service terminated with the following error: 
The service has not been started.

Error: (06/06/2017 09:31:56 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: The ScRegSetValueExW call failed for FailureActions with the following error: 
Access is denied.

Error: (06/06/2017 09:27:11 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Search service, but this action failed with the following error: 
An instance of the service is already running.

Error: (06/06/2017 09:26:41 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Search service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 30000 milliseconds: Restart the service.

Error: (06/06/2017 09:26:40 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The SSSvc service terminated unexpectedly.  It has done this 1 time(s).

Error: (06/06/2017 09:26:40 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The NVIDIA Display Container LS service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service.

Error: (06/06/2017 09:26:40 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Print Spooler service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.

Error: (06/06/2017 09:20:35 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The YAC Service service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion.

Error: (06/06/2017 09:20:35 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the YAC Service service to connect.

Error: (06/06/2017 09:19:36 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Search service, but this action failed with the following error: 
An instance of the service is already running.


CodeIntegrity:
===================================
  Date: 2017-05-11 21:56:42.957
  Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume1\Program Files (x86)\Elex-tech\YAC\iSafeSrvMon64.dll that did not meet the Windows signing level requirements.

  Date: 2017-05-11 19:22:28.953
  Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume1\Program Files (x86)\Elex-tech\YAC\iSafeSrvMon64.dll that did not meet the Windows signing level requirements.

  Date: 2017-05-08 15:40:15.541
  Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-04-20 00:30:29.275
  Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-04-17 13:52:20.934
  Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-02-19 04:44:40.271
  Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume1\Windows\System32\cssguard64.dll that did not meet the Windows signing level requirements.

  Date: 2017-02-19 04:44:40.209
  Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume1\Windows\System32\iseguard64.dll that did not meet the Windows signing level requirements.

  Date: 2017-02-19 04:44:36.568
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\cssguard64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2017-02-19 04:44:36.537
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\iseguard64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2017-02-19 04:43:42.058
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\cssguard64.dll because the set of per-page image hashes could not be found on the system.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i3-3217U CPU @ 1.80GHz
Percentage of memory in use: 34%
Total physical RAM: 3981.68 MB
Available physical RAM: 2603.55 MB
Total Virtual: 4749.68 MB
Available Virtual: 3072.53 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:100.08 GB) (Free:62.95 GB) NTFS ==>[drive with boot components (obtained from BCD)]
Drive e: (DATA) (Fixed) (Total:365.68 GB) (Free:365.5 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 6A9158E2)
Partition 1: (Active) - (Size=100.1 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=365.7 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================