Additional scan result of Farbar Recovery Scan Tool (x64) Version: 26-12-2014 Ran by Rafi at 2014-12-26 16:25:08 Running from C:\Users\Rafi\Downloads Boot Mode: Normal ========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Kingsoft Antivirus System Defense (Enabled - Up to date) {B6A51389-A795-5AC9-13BA-F569D73F3FE8} AS: Kingsoft Antivirus System Defense (Enabled - Up to date) {0DC4F26D-81AF-5547-290A-CE1BACB87555} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.235 - Adobe Systems Incorporated) Adobe Reader XI (11.0.10) - Polish (HKLM-x32\...\{AC76BA86-7AD7-1045-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated) AIMP3 (HKLM-x32\...\AIMP3) (Version: v3.55.1355, 14.07.2014 - AIMP DevTeam) Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version: - Valve) CWK (Czasowy Wyłącznik Komputera) (HKLM-x32\...\CWK) (Version: 2.52.3.43 - Damian Pasternak) Euro Truck Simulator 2 (HKLM-x32\...\Steam App 227300) (Version: - SCS Software) Far Cry 4 (HKLM-x32\...\RmFyQ3J5NA==_is1) (Version: 1 - ) Far Cry® 3 (HKLM-x32\...\Steam App 220240) (Version: - Ubisoft Montreal, Massive Entertainment, and Ubisoft Shanghai) Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.95 - Google Inc.) Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden Grand Theft Auto IV (HKLM-x32\...\Steam App 12210) (Version: - Rockstar North) GRID 2 (HKLM-x32\...\Steam App 44350) (Version: - Codemasters Racing) Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation) JDownloader 0.9 (HKLM-x32\...\5513-1208-7298-9440) (Version: 0.9 - AppWork GmbH) Kingsoft Antivirus 2012 (HKLM-x32\...\Kingsoft Internet Security) (Version: 2012.5.7 - Kingsoft Internet Security) Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation) Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.4763.1000 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation) Mozilla Firefox 34.0.5 (x86 pl) (HKLM-x32\...\Mozilla Firefox 34.0.5 (x86 pl)) (Version: 34.0.5 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 34.0.5 - Mozilla) Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.7 - Notepad++ Team) NVIDIA 3D Vision Controller Driver 344.75 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 344.75 - NVIDIA Corporation) NVIDIA 3D Vision Driver 344.75 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 344.75 - NVIDIA Corporation) NVIDIA Graphics Driver 344.75 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 344.75 - NVIDIA Corporation) NVIDIA HD Audio Driver 1.3.32.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.32.1 - NVIDIA Corporation) NVIDIA PhysX System Software 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation) PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7246 - Realtek Semiconductor Corp.) Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation) TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH) Uplay (HKLM-x32\...\Uplay) (Version: 4.9 - Ubisoft) VLC media player (HKLM\...\VLC media player) (Version: 2.2.0-rc1 - VideoLAN) WinRAR 5.20 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) ==================== Restore Points ========================= 19-12-2014 18:50:51 Installed Microsoft Office Professional Plus 2010 19-12-2014 19:09:37 Configured Microsoft Office Professional Plus 2010 20-12-2014 01:36:24 Windows Update 23-12-2014 09:27:45 Windows Update 26-12-2014 10:40:08 Windows Update ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {01EA1E0F-51D4-4471-BEFD-04CB1BD48B25} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated) Task: {03C5C337-0FE7-45C8-81A1-5BD9BEEF2CA8} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-12-16] (Google Inc.) Task: {3712834E-393A-4DD6-83A8-FBC2C818284C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-12-16] (Google Inc.) Task: {3A69526F-DC5E-45E2-83F7-3E7ED8C180C2} - System32\Tasks\{3FE045E5-B605-452C-A1DE-85DAA3B5AA66} => pcalua.exe -a C:\Users\Rafi\Downloads\Win7_Win8_Win81_R275.exe -d C:\Users\Rafi\Downloads Task: {3B5B0126-6378-40B0-BD4C-A658A9D1E3B0} - System32\Tasks\{C700DCAC-4C97-49E7-A46F-599A6768B088} => pcalua.exe -a C:\Users\Rafi\Downloads\newwwrar.exe -d C:\Users\Rafi\Downloads Task: {6DA6CDCD-27AC-4D2E-ABCC-213A67571872} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc Task: {7E6A2C5B-7FE7-4601-84DA-7F5CAE9EB3E4} - System32\Tasks\{5D736346-7DEE-429C-8017-45342FE43AEE} => pcalua.exe -a C:\Users\Rafi\Downloads\64bit_Win7_Win8_Win81_R275.exe -d C:\Users\Rafi\Downloads Task: {B504C20B-9D5E-48B5-8627-A44D03F802A8} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-16] (Adobe Systems Incorporated) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============= 2011-06-22 06:48 - 2011-06-22 06:48 - 00034304 _____ () C:\Windows\System32\ssp7ml6.dll 2014-12-19 19:34 - 2014-12-19 19:34 - 00008192 _____ () C:\Windows\SysWOW64\srvany.exe 2014-12-19 19:34 - 2014-12-19 19:34 - 00151552 _____ () C:\Windows\KMService.exe 2014-12-18 16:26 - 2014-12-18 16:26 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe 2014-12-16 21:46 - 2014-11-12 22:56 - 00118080 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll 2010-01-30 02:40 - 2010-01-30 02:40 - 04254560 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF 2014-12-16 21:04 - 2014-12-06 02:50 - 01077064 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\libglesv2.dll 2014-12-16 21:04 - 2014-12-06 02:50 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\libegl.dll 2014-12-16 21:04 - 2014-12-06 02:50 - 09009480 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\pdf.dll 2014-12-16 21:04 - 2014-12-06 02:50 - 01677128 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\ffmpegsumo.dll 2014-12-16 21:04 - 2014-12-06 02:50 - 14913352 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\PepperFlash\pepflashplayer.dll ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) ==================== EXE Association (whitelisted) ============= (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== MSCONFIG/TASK MANAGER disabled items ========= (Currently there is no automatic fix for this section.) ========================= Accounts: ========================== Administrator (S-1-5-21-1621882094-2468969928-2882805610-500 - Administrator - Disabled) Guest (S-1-5-21-1621882094-2468969928-2882805610-501 - Limited - Disabled) HomeGroupUser$ (S-1-5-21-1621882094-2468969928-2882805610-1002 - Limited - Enabled) Rafi (S-1-5-21-1621882094-2468969928-2882805610-1001 - Administrator - Enabled) => C:\Users\Rafi ==================== Faulty Device Manager Devices ============= Name: Teredo Tunneling Pseudo-Interface Description: Microsoft Teredo Tunneling Adapter Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318} Manufacturer: Microsoft Service: tunnel Problem: : This device cannot start. (Code10) Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device. On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard. ==================== Event log errors: ========================= Application errors: ================== Error: (12/19/2014 06:54:49 PM) (Source: SideBySide) (EventID: 33) (User: ) Description: Activation context generation failed for "Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.08"1". Dependent Assembly Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.08" could not be found. Please use sxstrace.exe for detailed diagnosis. Error: (12/19/2014 11:12:26 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: PnkBstrA.exe, version: 0.0.0.0, time stamp: 0x4eefa440 Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000 Exception code: 0xc0000005 Fault offset: 0x74e071fc Faulting process id: 0x6f8 Faulting application start time: 0xPnkBstrA.exe0 Faulting application path: PnkBstrA.exe1 Faulting module path: PnkBstrA.exe2 Report Id: PnkBstrA.exe3 Error: (12/19/2014 11:12:26 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: armsvc.exe, version: 1.7.0.0, time stamp: 0x505b79b6 Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000 Exception code: 0xc0000005 Fault offset: 0x74e071fc Faulting process id: 0x670 Faulting application start time: 0xarmsvc.exe0 Faulting application path: armsvc.exe1 Faulting module path: armsvc.exe2 Report Id: armsvc.exe3 Error: (12/19/2014 11:12:23 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: kxescore.exe, version: 2012.5.28.34, time stamp: 0x4fc34cb0 Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000 Exception code: 0xc0000005 Fault offset: 0x74e071fc Faulting process id: 0x4e8 Faulting application start time: 0xkxescore.exe0 Faulting application path: kxescore.exe1 Faulting module path: kxescore.exe2 Report Id: kxescore.exe3 Error: (12/19/2014 11:12:21 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: nvSCPAPISvr.exe, version: 7.17.13.4475, time stamp: 0x5463c608 Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000 Exception code: 0xc0000005 Fault offset: 0x74e071fc Faulting process id: 0x35c Faulting application start time: 0xnvSCPAPISvr.exe0 Faulting application path: nvSCPAPISvr.exe1 Faulting module path: nvSCPAPISvr.exe2 Report Id: nvSCPAPISvr.exe3 Error: (12/18/2014 00:18:00 PM) (Source: ESENT) (EventID: 215) (User: ) Description: WinMail (2936) WindowsMail0: The backup has been stopped because it was halted by the client or the connection with the client failed. Error: (12/18/2014 00:17:57 PM) (Source: ESENT) (EventID: 215) (User: ) Description: WinMail (2512) WindowsMail0: The backup has been stopped because it was halted by the client or the connection with the client failed. Error: (12/18/2014 00:14:43 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: kxescore.exe, version: 2012.5.28.34, time stamp: 0x4fc34cb0 Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000 Exception code: 0xc0000005 Fault offset: 0x74ee6cc4 Faulting process id: 0x4e0 Faulting application start time: 0xkxescore.exe0 Faulting application path: kxescore.exe1 Faulting module path: kxescore.exe2 Report Id: kxescore.exe3 Error: (12/18/2014 00:14:41 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: nvSCPAPISvr.exe, version: 7.17.13.4475, time stamp: 0x5463c608 Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000 Exception code: 0xc0000005 Fault offset: 0x74ee6cc4 Faulting process id: 0x358 Faulting application start time: 0xnvSCPAPISvr.exe0 Faulting application path: nvSCPAPISvr.exe1 Faulting module path: nvSCPAPISvr.exe2 Report Id: nvSCPAPISvr.exe3 Error: (12/18/2014 00:14:11 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 257) (User: ) Description: The Cryptographic Services service failed to initialize the Catalog Database. The ESENT error was: -107. System errors: ============= Error: (12/25/2014 11:35:18 AM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: The Update Hold Page service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service. Error: (12/25/2014 11:35:18 AM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: The Util Hold Page service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service. Error: (12/25/2014 11:35:18 AM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: The Windows Media Player Network Sharing Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service. Error: (12/25/2014 11:35:18 AM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service. Error: (12/25/2014 11:35:18 AM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: The PnkBstrA service terminated unexpectedly. It has done this 1 time(s). Error: (12/25/2014 11:35:18 AM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: The KMService service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. Error: (12/25/2014 11:35:18 AM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: The Adobe Acrobat Update Service service terminated unexpectedly. It has done this 1 time(s). Error: (12/25/2014 11:35:18 AM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: The Print Spooler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. Error: (12/25/2014 11:35:18 AM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: The NVIDIA Stereoscopic 3D Driver Service service terminated unexpectedly. It has done this 1 time(s). Error: (12/25/2014 11:35:18 AM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: The NVIDIA Display Driver Service service terminated unexpectedly. It has done this 1 time(s). Microsoft Office Sessions: ========================= Error: (12/19/2014 06:54:49 PM) (Source: SideBySide) (EventID: 33) (User: ) Description: Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.08"C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL Error: (12/19/2014 11:12:26 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: PnkBstrA.exe0.0.0.04eefa440unknown0.0.0.000000000c000000574e071fc6f801d01b73c921f820C:\Windows\SysWOW64\PnkBstrA.exeunknown87b7fa00-8767-11e4-92b2-1c6f65bcce08 Error: (12/19/2014 11:12:26 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: armsvc.exe1.7.0.0505b79b6unknown0.0.0.000000000c000000574e071fc67001d01b73c85ec760C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exeunknown87a4ef00-8767-11e4-92b2-1c6f65bcce08 Error: (12/19/2014 11:12:23 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: kxescore.exe2012.5.28.344fc34cb0unknown0.0.0.000000000c000000574e071fc4e801d01b73c7d97a60c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exeunknown85e0a9c0-8767-11e4-92b2-1c6f65bcce08 Error: (12/19/2014 11:12:21 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: nvSCPAPISvr.exe7.17.13.44755463c608unknown0.0.0.000000000c000000574e071fc35c01d01b73c35960e0C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exeunknown84d60fc0-8767-11e4-92b2-1c6f65bcce08 Error: (12/18/2014 00:18:00 PM) (Source: ESENT) (EventID: 215) (User: ) Description: WinMail2936WindowsMail0: Error: (12/18/2014 00:17:57 PM) (Source: ESENT) (EventID: 215) (User: ) Description: WinMail2512WindowsMail0: Error: (12/18/2014 00:14:43 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: kxescore.exe2012.5.28.344fc34cb0unknown0.0.0.000000000c000000574ee6cc44e001d01ab33e8d9a40c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exeunknown109295e0-86a7-11e4-ab38-1c6f65bcce08 Error: (12/18/2014 00:14:41 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: nvSCPAPISvr.exe7.17.13.44755463c608unknown0.0.0.000000000c000000574ee6cc435801d01ab33a4dc5e0C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exeunknown0f644740-86a7-11e4-ab38-1c6f65bcce08 Error: (12/18/2014 00:14:11 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 257) (User: ) Description: -107 ==================== Memory info =========================== Processor: AMD Phenom(tm) II X4 955 Processor Percentage of memory in use: 48% Total physical RAM: 4094.46 MB Available physical RAM: 2103.91 MB Total Pagefile: 8187.11 MB Available Pagefile: 5685.55 MB Total Virtual: 8192 MB Available Virtual: 8191.81 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:233.97 GB) (Free:192.33 GB) NTFS ==>[Drive with boot components (obtained from BCD)] Drive d: () (Fixed) (Total:697.44 GB) (Free:551.47 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 06DD4D9F) Partition 1: (Not Active) - (Size=100 MB) - (Type=17) Partition 2: (Active) - (Size=234 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=697.4 GB) - (Type=07 NTFS) ==================== End Of Log ============================