Additional scan result of Farbar Recovery Scan Tool (x64) Version: 14.11.2018
Ran by User (15-11-2018 23:24:59)
Running from C:\Users\User\Desktop
Windows 10 Home Single Language Version 1803 17134.407 (X64) (2018-11-14 00:22:32)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

DefaultAccount (S-1-5-21-1628818066-1325795789-4263782481-503 - Limited - Disabled)
User (S-1-5-21-1628818066-1325795789-4263782481-1000 - Administrator - Enabled) => C:\Users\User
WDAGUtilityAccount (S-1-5-21-1628818066-1325795789-4263782481-504 - Limited - Disabled)
Администратор (S-1-5-21-1628818066-1325795789-4263782481-500 - Administrator - Disabled)
Гость (S-1-5-21-1628818066-1325795789-4263782481-501 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-1628818066-1325795789-4263782481-1000\...\uTorrent) (Version: 3.5.4.44632 - BitTorrent Inc.)
Adobe Flash Player 31 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 31.0.0.148 - Adobe Systems Incorporated)
Canon LBP6020 (HKLM\...\Canon LBP6020) (Version:  - )
Discord (HKU\S-1-5-21-1628818066-1325795789-4263782481-1000\...\Discord) (Version: 0.0.301 - Discord Inc.)
DisplayDriverAnalyzer (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_DisplayDriverAnalyzer) (Version: 391.35 - NVIDIA Corporation) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 70.0.3538.102 - Google Inc.)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.17 - Google Inc.) Hidden
Microsoft Office стандартный 2016 (HKLM\...\Office16.STANDARD) (Version: 16.0.4266.1001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable - x64 8.0.61000 (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable - x86 8.0.61001 (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 Redistributable - x64 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 Redistributable - x86 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{a2199617-3609-410f-a8e8-e8806c73545b}) (Version: 11.0.61030.0 - Корпорация Майкрософт)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}) (Version: 11.0.61030.0 - Корпорация Майкрософт)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40660 (HKLM-x32\...\{0513c9cf-7191-45a7-ace9-ecdad03c93a4}) (Version: 12.0.40660.0 - Корпорация Майкрософт)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.40660 (HKLM-x32\...\{10dc8dbf-d3d7-4e23-be07-120fe5c66b78}) (Version: 12.0.40660.0 - Корпорация Майкрософт)
Microsoft Visual C++ 2017 Redistributable (x64) - 14.10.25017 (HKLM-x32\...\{d3ea57b6-46d6-4824-a20f-6b8213001903}) (Version: 14.10.25017.0 - Корпорация Майкрософт)
Microsoft Visual C++ 2017 Redistributable (x86) - 14.10.25017 (HKLM-x32\...\{e89464af-e7f0-4ed3-bf43-f1a5986113db}) (Version: 14.10.25017.0 - Корпорация Майкрософт)
MSI Afterburner 4.5.0 (HKLM-x32\...\Afterburner) (Version: 4.5.0 - MSI Co., LTD)
NVIDIA Системное программное обеспечение PhysX 9.17.0524 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.17.0524 - NVIDIA Corporation)
Ozone NEON Mouse Driver (HKLM-x32\...\{B62CC42A-D1D9-4E91-BEDE-8614DE2AD943}) (Version:  - )
Remove Empty Directories version 2.2 (HKLM-x32\...\{06F25DC8-71E2-44E2-805A-F15E15B51C74}_is1) (Version: 2.2 - Jonas John)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Update for Windows 10 for x64-based Systems (KB4023057) (HKLM\...\{91684B6D-153D-4C12-B6B1-59F7496BE44A}) (Version: 2.50.0.0 - Microsoft Corporation)
UpdateAssistant (HKLM\...\{52C1DD03-104E-4AC6-9DC6-21D585721ED1}) (Version: 1.19.0.0 - Microsoft Corporation) Hidden
Vulkan Run Time Libraries 1.0.65.1 (HKLM\...\VulkanRT1.0.65.1) (Version: 1.0.65.1 - LunarG, Inc.) Hidden
Windows Setup Remediations (x64) (KB4023057) (HKLM\...\{5534e02f-0f5d-40dd-ba92-bea38d22384d}.sdb) (Version:  - )
WinRAR 5.60 (64-разрядная) (HKLM\...\WinRAR archiver) (Version: 5.60.0 - win.rar GmbH)
Засоби перевірки правопису Microsoft Office 2016 – українська (HKLM\...\{90160000-001F-0422-1000-0000000FF1CE}) (Version: 16.0.4266.1001 - Microsoft Corporation) Hidden
Панель управления NVIDIA 391.35 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel) (Version: 391.35 - NVIDIA Corporation) Hidden
Помощник по обновлению до Windows 10 (HKLM-x32\...\{D5C69738-B486-402E-85AC-2456D98A64E4}) (Version: 1.4.9200.22532 - Microsoft Corporation)
Средства проверки правописания Microsoft Office 2016 — русский (HKLM\...\{90160000-001F-0419-1000-0000000FF1CE}) (Version: 16.0.4266.1001 - Microsoft Corporation) Hidden

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1628818066-1325795789-4263782481-1000_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 -> C:\Users\User\AppData\Local\Microsoft\OneDrive\18.131.0701.0007\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-1628818066-1325795789-4263782481-1000_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 -> C:\Users\User\AppData\Local\Microsoft\OneDrive\18.131.0701.0007\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-1628818066-1325795789-4263782481-1000_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 -> C:\Users\User\AppData\Local\Microsoft\OneDrive\18.131.0701.0007\amd64\FileSyncShell64.dll => No File
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} =>  -> No File
ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2018-06-24] (Alexander Roshal)
ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2018-06-24] (Alexander Roshal)
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\WINDOWS\system32\nvshext.dll [2018-03-24] (NVIDIA Corporation)
ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2018-06-24] (Alexander Roshal)
ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2018-06-24] (Alexander Roshal)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {01567A2D-802C-4B03-9BFD-27B566EC7D2A} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files\Microsoft Office\Office16\msoia.exe [2015-07-31] (Microsoft Corporation)
Task: {1C0C2444-FD1B-41CC-9A0E-A53D032085F5} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2018-11-14] (Adobe Systems Incorporated)
Task: {38CF89BD-48F2-416E-BF77-35730B2EE9CE} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2018-09-05] (Google Inc.)
Task: {41496B07-0067-40C3-8C32-E59887DDBA6E} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_31_0_0_148_pepper.exe [2018-11-14] (Adobe Systems Incorporated)
Task: {65B85F6F-35B3-4459-A179-28255D5B7B25} - System32\Tasks\Microsoft\Windows\HelloFace\FODCleanupTask => C:\WINDOWS\System32\WinBioPlugIns\FaceFodUninstaller.exe [2018-04-12] ()
Task: {9470FF1E-A6CF-4019-BF16-F3814B997F92} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2018-09-05] (Google Inc.)
Task: {A5B45F9E-D46B-485E-AC05-21CB982E809F} - System32\Tasks\OneDrive Standalone Update Task v2 => C:\Users\User\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
Task: {AC44BC91-8CC9-4F96-834D-FBA058C5443D} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office16\OLicenseHeartbeat.exe [2015-07-31] (Microsoft Corporation)
Task: {D96B1918-E08A-482C-89CC-68177EF76E90} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files\Microsoft Office\Office16\msoia.exe [2015-07-31] (Microsoft Corporation)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


Shortcut: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\Новости в последней версии.lnk -> C:\Program Files\WinRAR\WhatsNew.txt () <==== Cyrillic
Shortcut: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\Руководство по консольной версии RAR.lnk -> C:\Program Files\WinRAR\Rar.txt () <==== Cyrillic
Shortcut: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\Справка WinRAR.lnk -> C:\Program Files\WinRAR\WinRAR.chm () <==== Cyrillic
Shortcut: C:\Users\User\AppData\Roaming\Microsoft\Windows\SendTo\Передача файлов через Bluetooth.LNK -> C:\Windows\System32\fsquirt.exe (Microsoft Corporation) <==== Cyrillic
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneDrive для бизнеса.lnk -> C:\Windows\Installer\{90160000-0012-0000-1000-0000000FF1CE}\grv_icons.exe () <==== Cyrillic

ShortcutWithArgument: C:\Users\User\AppData\Roaming\Microsoft\Windows\SendTo\Получатель факса.lnk -> C:\Windows\System32\WFS.exe (Microsoft Corporation) -> /SendTo <==== Cyrillic

==================== Loaded Modules (Whitelisted) ==============

2018-09-05 22:38 - 2018-03-24 04:19 - 000544192 _____ () C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\LocalSystem\DisplayDriverAnalyzer\_DisplayDriverCrashAnalyzer64.dll
2018-09-05 22:37 - 2018-03-24 02:02 - 000135136 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2018-04-12 02:34 - 2018-04-12 02:34 - 000491744 _____ () C:\Windows\System32\InputHost.dll
2018-04-12 02:34 - 2018-04-12 02:34 - 000472064 _____ () C:\Windows\ShellExperiences\TileControl.dll
2018-04-12 02:34 - 2018-04-12 02:34 - 002759168 _____ () C:\Windows\ShellComponents\TaskFlowUI.dll
2018-11-14 16:26 - 2018-11-01 09:55 - 002185216 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2018-11-14 03:45 - 2018-11-14 03:45 - 000183808 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.34.81.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe
2018-11-14 03:45 - 2018-11-14 03:45 - 000009216 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.34.81.0_x64__kzf8qxf38zg5c\ImagePipelineNative.dll
2018-11-14 03:45 - 2018-11-14 03:45 - 000060416 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.34.81.0_x64__kzf8qxf38zg5c\ChakraBridge.dll
2018-11-14 03:44 - 2018-11-14 03:45 - 000478720 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
2018-11-14 03:44 - 2018-11-14 03:45 - 066031104 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\Microsoft.Photos.dll
2018-11-14 03:44 - 2018-11-14 03:45 - 000010752 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\RenderingPlugin.dll
2018-09-05 23:45 - 2018-09-05 23:46 - 002523136 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\UnityEngineDelegates.dll
2018-11-14 03:44 - 2018-11-14 03:45 - 003715072 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\MediaEngineCSWrapper.dll
2018-11-14 03:44 - 2018-11-14 03:45 - 000036352 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\WinMLWrapper.UWP.dll
2018-09-05 23:45 - 2018-09-05 23:46 - 002280960 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\opencv_core320.dll
2018-09-05 23:45 - 2018-09-05 23:46 - 002480640 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\opencv_imgproc320.dll
2018-09-05 23:45 - 2018-09-05 23:46 - 002283008 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\TrackingDLLUWP.dll
2018-11-14 03:44 - 2018-11-14 03:45 - 014097920 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\PhotosApp.Windows.dll
2018-11-14 03:44 - 2018-11-14 03:44 - 003569152 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\MediaEngine.dll
2018-11-14 03:44 - 2018-11-14 03:45 - 002863616 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\AppCore.Windows.dll
2018-09-05 23:45 - 2018-09-05 23:46 - 000973312 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\RuntimeConfiguration.dll
2018-09-05 23:45 - 2018-09-05 23:46 - 004584960 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll
2018-11-14 03:44 - 2018-11-14 03:45 - 000146432 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\SKU.dll
2018-11-14 03:45 - 2018-11-14 11:02 - 035118592 _____ () C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.18082.13811.0_x64__8wekyb3d8bbwe\Video.UI.exe
2018-11-14 03:45 - 2018-11-14 11:02 - 000290816 _____ () C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.18082.13811.0_x64__8wekyb3d8bbwe\SharedUI.dll
2018-11-14 03:45 - 2018-11-14 11:02 - 005987328 _____ () C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.18082.13811.0_x64__8wekyb3d8bbwe\EntCommon.dll
2018-09-05 23:34 - 2018-09-05 23:34 - 003553704 _____ () C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.18082.13811.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll
2018-11-14 03:45 - 2018-11-14 11:02 - 009064448 _____ () C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.18082.13811.0_x64__8wekyb3d8bbwe\EntPlat.dll
2018-11-11 22:52 - 2018-11-09 01:14 - 005020504 _____ () C:\Program Files (x86)\Google\Chrome\Application\70.0.3538.102\libglesv2.dll
2018-11-11 22:52 - 2018-11-09 01:14 - 000116056 _____ () C:\Program Files (x86)\Google\Chrome\Application\70.0.3538.102\libegl.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2017-03-19 00:03 - 2017-03-19 00:01 - 000000824 _____ C:\WINDOWS\system32\Drivers\etc\hosts


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1628818066-1325795789-4263782481-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\User\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppBackground\28Pij9j.jpg
DNS Servers: 85.21.192.5 - 213.234.192.7
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: )
Windows Firewall is disabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

If an entry is included in the fixlist, it will be removed.

MSCONFIG\Services: gupdate => 2
MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: Steam Client Service => 3
HKLM\...\StartupApproved\Run: => "SecurityHealth"
HKLM\...\StartupApproved\Run: => "CNAP2 Launcher"
HKLM\...\StartupApproved\Run32: => "Ozone NEON Mouse"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{AC772F44-7F20-4689-A1E5-53211634FE25}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{ED7AA22F-409F-48F0-924C-5624B85BD881}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{01A243C6-EE6D-405A-A8E1-ED79A53EC1CF}] => (Allow) LPort=1688
FirewallRules: [{FD38415F-5862-460C-9A62-355756CDE866}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Call of Duty Modern Warfare 3\iw5mp.exe
FirewallRules: [{B08D5F02-3854-4DAA-AB10-F2BDA3B8CAA2}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Call of Duty Modern Warfare 3\iw5mp.exe
FirewallRules: [{7113D9B8-C46C-4048-8FCB-5939F9B0EA1E}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
FirewallRules: [{BD830312-FAD4-4F8D-96B0-5415740CA92E}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
FirewallRules: [{748C838F-C04E-4A2B-AC63-8A72F3B923F8}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Path of Exile\PathOfExileSteam.exe
FirewallRules: [{94DE982D-626E-4F09-9266-AFDA1C170001}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Path of Exile\PathOfExileSteam.exe
FirewallRules: [{4D845440-A814-44AD-8C10-D68ECF9D2943}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{29121DD2-F7BE-4D38-80D0-010921C39D13}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{97D7D3AD-49DA-4FB4-8E7D-357C1DD53EBC}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Restore Points =========================

14-11-2018 03:26:25 Revo Uninstaller Pro's restore point - Malwarebytes, версия 3.6.1.2711

==================== Faulty Device Manager Devices =============

Name: Realtek PCIe GbE Family Controller
Description: Realtek PCIe GbE Family Controller
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Realtek
Service: rt640x64
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (11/15/2018 10:49:30 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: Сбой активации лицензий (slui.exe) со следующим кодом ошибки:
hr=0x8007007B
Аргументы командной строки:
RuleId=502ff3ba-669a-4674-bbb1-601f34a3b968;Action=AutoActivateSilent;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=cd918a57-a41b-4c82-8dce-1a538e221a83;NotificationInterval=1440;Trigger=TimerEvent

Error: (11/15/2018 08:49:13 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: Сбой активации лицензий (slui.exe) со следующим кодом ошибки:
hr=0x8007007B
Аргументы командной строки:
RuleId=502ff3ba-669a-4674-bbb1-601f34a3b968;Action=AutoActivateSilent;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=cd918a57-a41b-4c82-8dce-1a538e221a83;NotificationInterval=1440;Trigger=TimerEvent

Error: (11/15/2018 06:49:29 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: Сбой активации лицензий (slui.exe) со следующим кодом ошибки:
hr=0x8007007B
Аргументы командной строки:
RuleId=502ff3ba-669a-4674-bbb1-601f34a3b968;Action=AutoActivateSilent;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=cd918a57-a41b-4c82-8dce-1a538e221a83;NotificationInterval=1440;Trigger=TimerEvent

Error: (11/15/2018 04:49:33 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: Сбой активации лицензий (slui.exe) со следующим кодом ошибки:
hr=0x8007007B
Аргументы командной строки:
RuleId=502ff3ba-669a-4674-bbb1-601f34a3b968;Action=AutoActivateSilent;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=cd918a57-a41b-4c82-8dce-1a538e221a83;NotificationInterval=1440;Trigger=TimerEvent

Error: (11/15/2018 02:50:03 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: Сбой активации лицензий (slui.exe) со следующим кодом ошибки:
hr=0x8007232B
Аргументы командной строки:
RuleId=502ff3ba-669a-4674-bbb1-601f34a3b968;Action=AutoActivateSilent;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=cd918a57-a41b-4c82-8dce-1a538e221a83;NotificationInterval=1440;Trigger=NetworkAvailable

Error: (11/15/2018 02:50:03 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: Сбой активации лицензий (slui.exe) со следующим кодом ошибки:
hr=0x8007232B
Аргументы командной строки:
RuleId=502ff3ba-669a-4674-bbb1-601f34a3b968;Action=AutoActivateSilent;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=cd918a57-a41b-4c82-8dce-1a538e221a83;NotificationInterval=1440;Trigger=UserLogon;SessionId=2

Error: (11/15/2018 02:49:53 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: Сбой активации лицензий (slui.exe) со следующим кодом ошибки:
hr=0x8007232B
Аргументы командной строки:
RuleId=502ff3ba-669a-4674-bbb1-601f34a3b968;Action=AutoActivateSilent;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=cd918a57-a41b-4c82-8dce-1a538e221a83;NotificationInterval=1440;Trigger=TimerEvent

Error: (11/15/2018 03:28:06 AM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: Сбой активации лицензий (slui.exe) со следующим кодом ошибки:
hr=0x8007007B
Аргументы командной строки:
RuleId=502ff3ba-669a-4674-bbb1-601f34a3b968;Action=AutoActivateSilent;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=cd918a57-a41b-4c82-8dce-1a538e221a83;NotificationInterval=1440;Trigger=TimerEvent


System errors:
=============
Error: (11/15/2018 11:04:38 PM) (Source: DCOM) (EventID: 10016) (User: WIN-83GCSB4C2RU)
Description: Параметры разрешений для конкретного приложения не дают разрешения Локально Активация для приложения COM-сервера с CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 и APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 пользователю WIN-83GCSB4C2RU\User с ИД безопасности (S-1-5-21-1628818066-1325795789-4263782481-1000) и адресом LocalHost (с использованием LRPC), выполняемого в контейнере приложения Недоступно с ИД безопасности (Недоступно). Это разрешение безопасности можно изменить с помощью средства администрирования служб компонентов.

Error: (11/15/2018 10:49:38 PM) (Source: DCOM) (EventID: 10016) (User: WIN-83GCSB4C2RU)
Description: Параметры разрешений для конкретного приложения не дают разрешения Локально Активация для приложения COM-сервера с CLSID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 и APPID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 пользователю WIN-83GCSB4C2RU\User с ИД безопасности (S-1-5-21-1628818066-1325795789-4263782481-1000) и адресом LocalHost (с использованием LRPC), выполняемого в контейнере приложения Microsoft.Windows.ContentDeliveryManager_10.0.17134.1_neutral_neutral_cw5n1h2txyewy с ИД безопасности (S-1-15-2-350187224-1905355452-1037786396-3028148496-2624191407-3283318427-1255436723). Это разрешение безопасности можно изменить с помощью средства администрирования служб компонентов.

Error: (11/15/2018 10:14:25 PM) (Source: DCOM) (EventID: 10016) (User: WIN-83GCSB4C2RU)
Description: Параметры разрешений для конкретного приложения не дают разрешения Локально Активация для приложения COM-сервера с CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 и APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 пользователю WIN-83GCSB4C2RU\User с ИД безопасности (S-1-5-21-1628818066-1325795789-4263782481-1000) и адресом LocalHost (с использованием LRPC), выполняемого в контейнере приложения Недоступно с ИД безопасности (Недоступно). Это разрешение безопасности можно изменить с помощью средства администрирования служб компонентов.

Error: (11/15/2018 09:48:37 PM) (Source: DCOM) (EventID: 10016) (User: WIN-83GCSB4C2RU)
Description: Параметры разрешений для конкретного приложения не дают разрешения Локально Активация для приложения COM-сервера с CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 и APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 пользователю WIN-83GCSB4C2RU\User с ИД безопасности (S-1-5-21-1628818066-1325795789-4263782481-1000) и адресом LocalHost (с использованием LRPC), выполняемого в контейнере приложения Недоступно с ИД безопасности (Недоступно). Это разрешение безопасности можно изменить с помощью средства администрирования служб компонентов.

Error: (11/15/2018 09:25:39 PM) (Source: DCOM) (EventID: 10016) (User: WIN-83GCSB4C2RU)
Description: Параметры разрешений для конкретного приложения не дают разрешения Локально Активация для приложения COM-сервера с CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 и APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 пользователю WIN-83GCSB4C2RU\User с ИД безопасности (S-1-5-21-1628818066-1325795789-4263782481-1000) и адресом LocalHost (с использованием LRPC), выполняемого в контейнере приложения Недоступно с ИД безопасности (Недоступно). Это разрешение безопасности можно изменить с помощью средства администрирования служб компонентов.

Error: (11/15/2018 09:17:06 PM) (Source: DCOM) (EventID: 10016) (User: WIN-83GCSB4C2RU)
Description: Параметры разрешений для конкретного приложения не дают разрешения Локально Активация для приложения COM-сервера с CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 и APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 пользователю WIN-83GCSB4C2RU\User с ИД безопасности (S-1-5-21-1628818066-1325795789-4263782481-1000) и адресом LocalHost (с использованием LRPC), выполняемого в контейнере приложения Недоступно с ИД безопасности (Недоступно). Это разрешение безопасности можно изменить с помощью средства администрирования служб компонентов.

Error: (11/15/2018 09:10:18 PM) (Source: DCOM) (EventID: 10016) (User: WIN-83GCSB4C2RU)
Description: Параметры разрешений для конкретного приложения не дают разрешения Локально Активация для приложения COM-сервера с CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 и APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 пользователю WIN-83GCSB4C2RU\User с ИД безопасности (S-1-5-21-1628818066-1325795789-4263782481-1000) и адресом LocalHost (с использованием LRPC), выполняемого в контейнере приложения Недоступно с ИД безопасности (Недоступно). Это разрешение безопасности можно изменить с помощью средства администрирования служб компонентов.

Error: (11/15/2018 09:08:06 PM) (Source: DCOM) (EventID: 10016) (User: WIN-83GCSB4C2RU)
Description: Параметры разрешений для конкретного приложения не дают разрешения Локально Активация для приложения COM-сервера с CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 и APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 пользователю WIN-83GCSB4C2RU\User с ИД безопасности (S-1-5-21-1628818066-1325795789-4263782481-1000) и адресом LocalHost (с использованием LRPC), выполняемого в контейнере приложения Недоступно с ИД безопасности (Недоступно). Это разрешение безопасности можно изменить с помощью средства администрирования служб компонентов.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5 CPU 760 @ 2.80GHz
Percentage of memory in use: 28%
Total physical RAM: 6135.49 MB
Available physical RAM: 4407.42 MB
Total Virtual: 7479.49 MB
Available Virtual: 5391.89 MB

==================== Drives ================================

Drive c: (Windows 10) (Fixed) (Total:222.22 GB) (Free:124.6 GB) NTFS

\\?\Volume{af2f7b7e-0000-0000-0000-100000000000}\ () (Fixed) (Total:0.49 GB) (Free:0.46 GB) NTFS
\\?\Volume{af2f7b7e-0000-0000-0000-50ad37000000}\ () (Fixed) (Total:0.86 GB) (Free:0.34 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7/8/10) (Size: 223.6 GB) (Disk ID: AF2F7B7E)
Partition 1: (Active) - (Size=500 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=222.2 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=881 MB) - (Type=27)

==================== End of Addition.txt ============================