cjoint

Publicité


Publicité

Commentaire : lien vers fichier OTL.txt

Format du document : text/plain

Prévisualisation

ÿþOTL logfile created on: 08/11/2015 12:44:47 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Robert labeyrie\Desktop
Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.17801)
Locale: 0000040c | Country: France | Language: FRA | Date Format: dd/MM/yyyy

3,17 Gb Total Physical Memory | 1,47 Gb Available Physical Memory | 46,47% Memory free
6,34 Gb Paging File | 4,25 Gb Available in Paging File | 67,01% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 78,12 Gb Total Space | 22,00 Gb Free Space | 28,16% Space Free | Partition Type: NTFS
Drive D: | 620,51 Gb Total Space | 558,01 Gb Free Space | 89,93% Space Free | Partition Type: NTFS

Computer Name: PC-ROBERT | User Name: Robert labeyrie | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

[color=#E56717]========== Processes (SafeList) ==========[/color]

PRC - [2015/11/08 12:42:23 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Robert labeyrie\Desktop\OTL.exe
PRC - [2015/11/06 19:32:56 | 006,133,520 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\avastui.exe
PRC - [2015/10/28 18:49:06 | 000,082,128 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2015/10/23 18:05:53 | 001,488,464 | ---- | M] (MyBrowser 1.0.2V23.10) -- C:\Program Files\MyBrowser 1.0.2V23.10\dd4980bd-153f-4240-8239-5cb2cd9905c2-1-6.exe
PRC - [2015/09/30 18:46:27 | 000,445,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\GWX\GWX.exe
PRC - [2015/09/19 09:54:29 | 000,146,600 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2015/09/19 09:52:55 | 003,219,136 | ---- | M] (Avast Software) -- C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
PRC - [2015/07/09 02:26:02 | 000,173,088 | ---- | M] () -- C:\Users\Robert labeyrie\AppData\Roaming\NetService\netservice.exe
PRC - [2014/10/10 15:03:38 | 001,771,560 | ---- | M] (pdfforge GmbH) -- C:\Program Files\PDF Architect 2\ws.exe
PRC - [2014/10/10 15:03:38 | 001,451,048 | ---- | M] (pdfforge GmbH) -- C:\Program Files\PDF Architect 2\PDF Architect 2.exe
PRC - [2014/10/10 15:03:38 | 000,738,856 | ---- | M] (pdfforge GmbH) -- C:\Program Files\PDF Architect 2\creator-ws.exe
PRC - [2014/06/18 09:46:34 | 000,149,728 | ---- | M] (Orange) -- C:\Program Files\Orange\ma Livebox\maLivebox.exe
PRC - [2013/11/04 15:37:10 | 000,476,056 | ---- | M] () -- C:\Program Files\Orange\Orange Installer\OrangeInstaller.exe
PRC - [2013/08/30 13:32:52 | 000,884,744 | ---- | M] (Orange) -- C:\Program Files\Orange\MailNotifier\MailNotifier.exe
PRC - [2012/11/23 03:48:41 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2012/04/06 03:16:24 | 000,451,072 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe
PRC - [2012/04/06 03:15:50 | 000,217,600 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe
PRC - [2012/04/05 20:55:10 | 000,049,664 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MMLoadDrv.exe
PRC - [2011/02/25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010/11/04 10:44:06 | 001,872,296 | ---- | M] (Gigabyte Technology CO.) -- C:\Program Files\GIGABYTE\SMART6\Recovery\RPMDaemon.exe
PRC - [2010/10/05 20:04:12 | 002,655,768 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2010/10/05 20:04:08 | 000,325,656 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2010/04/22 14:05:26 | 001,011,712 | ---- | M] (Gigabyte Technology CO., LTD.) -- C:\Program Files\GIGABYTE\Smart6\Timelock\AlarmClock.exe
PRC - [2009/10/13 15:39:46 | 000,114,688 | ---- | M] (Gigabyte Technology CO., LTD.) -- C:\Program Files\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe
PRC - [2009/10/07 01:47:34 | 000,154,136 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe


[color=#E56717]========== Modules (No Company Name) ==========[/color]

MOD - [2015/09/19 09:55:00 | 040,539,648 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\libcef.dll
MOD - [2015/09/19 09:54:42 | 000,103,376 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\log.dll
MOD - [2015/09/19 09:54:42 | 000,103,376 | ---- | M] () -- C:\PROGRA~1\AVASTS~1\Avast\log.dll
MOD - [2015/09/19 09:54:34 | 000,123,976 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
MOD - [2015/09/19 09:54:34 | 000,123,976 | ---- | M] () -- C:\PROGRA~1\AVASTS~1\Avast\JsonRpcServer.dll
MOD - [2015/09/12 17:25:13 | 000,240,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\2eae78c0fde912140b92ff0a6c14eb17\WindowsFormsIntegration.ni.dll
MOD - [2015/09/10 22:27:00 | 014,340,096 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\96d744857eeaf0f2445213d08032e5cc\PresentationFramework.ni.dll
MOD - [2015/09/10 22:20:13 | 012,255,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\9c4c2749b3cc38c602b59ee4fd68a8b4\PresentationCore.ni.dll
MOD - [2015/09/10 21:35:06 | 012,438,016 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\09e9b52418dba5729ace249cf0487675\System.Windows.Forms.ni.dll
MOD - [2015/09/10 21:14:01 | 011,923,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\38234ab6b7aa0762a54e27862d8bbdfe\System.Web.ni.dll
MOD - [2015/09/10 21:02:25 | 001,593,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\82ecf48db57ddf66f74fca17b0f99453\System.Drawing.ni.dll
MOD - [2015/08/16 10:01:40 | 000,368,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\3d4521ea040737939f831af5a10cd6ad\PresentationFramework.Aero.ni.dll
MOD - [2015/08/16 10:01:17 | 000,060,928 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\ee2055e3e0410c1e34f588b8c1711e77\UIAutomationProvider.ni.dll
MOD - [2015/08/16 10:00:18 | 003,348,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\a6265e4a24c4f8361d84fc84f10e9736\WindowsBase.ni.dll
MOD - [2015/05/14 18:25:47 | 002,297,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\63e9d5c341d64a753cde97f5a3d65c71\System.Core.ni.dll
MOD - [2015/05/14 17:32:09 | 000,978,432 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\007fc007edc388d9806dff94ee04f129\System.Configuration.ni.dll
MOD - [2015/04/17 08:06:13 | 000,774,144 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\0967cf5c31691f38d013263304d2dacb\System.Runtime.Remoting.ni.dll
MOD - [2014/10/19 12:05:35 | 005,467,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d49908aa93a23c84847b1f8b1b667860\System.Xml.ni.dll
MOD - [2014/10/19 12:05:02 | 007,991,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\908ba9e296e92b4e14bdc2437edac603\System.ni.dll
MOD - [2014/10/10 14:27:48 | 000,194,048 | ---- | M] () -- C:\Program Files\PDF Architect 2\libidn.dll
MOD - [2014/10/10 13:43:28 | 001,133,640 | ---- | M] () -- C:\Program Files\PDF Architect 2\plugins\resources\ocr\bin\idrskrn15.dll
MOD - [2014/10/10 13:43:28 | 000,439,368 | ---- | M] () -- C:\Program Files\PDF Architect 2\plugins\resources\ocr\bin\idrsprepro15.dll
MOD - [2014/10/10 13:43:28 | 000,417,864 | ---- | M] () -- C:\Program Files\PDF Architect 2\plugins\resources\ocr\bin\idrstiff15.dll
MOD - [2014/10/10 13:43:28 | 000,272,968 | ---- | M] () -- C:\Program Files\PDF Architect 2\plugins\resources\ocr\bin\idrsjpeg15.dll
MOD - [2014/10/10 13:43:28 | 000,116,296 | ---- | M] () -- C:\Program Files\PDF Architect 2\plugins\resources\ocr\bin\idrszlib15.dll
MOD - [2014/10/10 13:43:28 | 000,101,448 | ---- | M] () -- C:\Program Files\PDF Architect 2\plugins\resources\ocr\bin\idrspng15.dll
MOD - [2014/10/10 13:43:28 | 000,028,232 | ---- | M] () -- C:\Program Files\PDF Architect 2\plugins\resources\ocr\bin\idrsjbig215.dll
MOD - [2014/09/15 09:54:54 | 011,497,984 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\38bf604432e1a30c954b2ee40d6a2d1c\mscorlib.ni.dll
MOD - [2013/11/04 15:37:10 | 000,476,056 | ---- | M] () -- C:\Program Files\Orange\Orange Installer\OrangeInstaller.exe
MOD - [2013/10/05 18:17:26 | 001,000,974 | ---- | M] () -- C:\Program Files\Orange\Orange Installer\libstdc++-6.dll
MOD - [2013/09/05 00:14:10 | 004,300,456 | ---- | M] () -- C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf
MOD - [2013/08/30 12:39:48 | 007,388,672 | ---- | M] () -- C:\Program Files\Orange\MailNotifier\QtGui4.dll
MOD - [2013/08/30 12:39:48 | 002,010,624 | ---- | M] () -- C:\Program Files\Orange\MailNotifier\QtCore4.dll
MOD - [2013/08/30 12:39:48 | 000,877,056 | ---- | M] () -- C:\Program Files\Orange\MailNotifier\QtNetwork4.dll
MOD - [2013/08/30 12:39:48 | 000,337,408 | ---- | M] () -- C:\Program Files\Orange\MailNotifier\QtXml4.dll
MOD - [2013/08/30 12:39:48 | 000,241,664 | ---- | M] () -- C:\Program Files\Orange\MailNotifier\phonon4.dll
MOD - [2013/08/30 12:39:48 | 000,184,320 | ---- | M] () -- C:\Program Files\Orange\MailNotifier\ProxyDetection.dll
MOD - [2013/08/30 12:39:48 | 000,178,176 | ---- | M] () -- C:\Program Files\Orange\MailNotifier\phonon_backend\phonon_ds94.dll
MOD - [2013/08/30 12:39:48 | 000,022,016 | ---- | M] () -- C:\Program Files\Orange\MailNotifier\imageformats\qgif4.dll
MOD - [2013/08/30 09:01:00 | 002,601,840 | ---- | M] () -- C:\Program Files\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x86.dll
MOD - [2012/11/16 09:37:22 | 000,118,784 | ---- | M] () -- C:\Program Files\Orange\Orange Installer\libgcc_s_dw2-1.dll
MOD - [2012/10/26 13:18:55 | 000,131,072 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\SHDocVw\1.1.0.0__1b4e890f49261012\SHDocVw.dll
MOD - [2012/10/26 13:18:55 | 000,009,728 | ---- | M] () -- C:\Windows\assembly\GAC_32\GBHO\1.0.0.0__709f1911357dc329\GBHO.dll
MOD - [2012/04/05 21:00:20 | 000,369,152 | ---- | M] () -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
MOD - [2011/06/10 03:36:34 | 000,094,208 | ---- | M] () -- C:\Windows\System32\IccLibDll.dll
MOD - [2011/01/13 09:00:00 | 003,668,992 | ---- | M] () -- C:\Program Files\K-Lite Codec Pack\ffdshow\ffdshow.ax
MOD - [2010/11/13 00:35:41 | 000,430,080 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_fr_b77a5c561934e089\System.Windows.Forms.resources.dll
MOD - [2010/11/13 00:35:38 | 000,311,296 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_fr_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010/11/04 17:00:12 | 000,212,992 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.resources\2.0.0.0_fr_b77a5c561934e089\System.resources.dll
MOD - [2009/07/14 09:39:17 | 000,245,760 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\PresentationFramework.resources\3.0.0.0_fr_31bf3856ad364e35\PresentationFramework.resources.dll
MOD - [2009/07/14 09:39:17 | 000,110,592 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\PresentationCore.resources\3.0.0.0_fr_31bf3856ad364e35\PresentationCore.resources.dll
MOD - [2006/06/22 00:00:00 | 000,126,464 | ---- | M] () -- C:\Program Files\WinRAR\rarext.dll


[color=#E56717]========== Services (SafeList) ==========[/color]

SRV - File not found [Auto | Stopped] -- C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)
SRV - [2015/11/05 11:05:51 | 000,147,624 | ---- | M] (Mozilla Foundation) [Disabled | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2015/10/28 18:49:06 | 000,082,128 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2015/10/23 18:05:42 | 000,068,608 | ---- | M] (globalUpdate) [On_Demand | Stopped] -- C:\Program Files\globalUpdate\Update\globalupdate.exe -- (globalUpdatem)
SRV - [2015/10/23 18:05:42 | 000,068,608 | ---- | M] (globalUpdate) [Auto | Stopped] -- C:\Program Files\globalUpdate\Update\globalupdate.exe -- (globalUpdate)
SRV - [2015/10/17 17:48:26 | 000,269,000 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2015/10/17 09:09:57 | 000,169,632 | ---- | M] (TODO: <lQøS T>) [Disabled | Stopped] -- C:\Program Files\SFK\SSFK.exe -- (SSFK)
SRV - [2015/10/15 08:31:24 | 000,266,752 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\00000000-1444898247-0000-0000-902B34327BF3\knsaCCBC.tmpfs -- (somyfifo)
SRV - [2015/09/19 09:54:29 | 000,146,600 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2015/09/19 09:52:55 | 003,219,136 | ---- | M] (Avast Software) [On_Demand | Running] -- C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe -- (AvastVBoxSvc)
SRV - [2015/07/22 18:53:34 | 000,937,984 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\diagtrack.dll -- (DiagTrack)
SRV - [2015/07/09 02:26:02 | 000,173,088 | ---- | M] () [Auto | Running] -- C:\Users\Robert labeyrie\AppData\Roaming\NetService\netservice.exe -- (NetTcpHandler)
SRV - [2015/06/08 14:42:20 | 000,730,648 | ---- | M] (Orange SA) [Auto | Stopped] -- C:\Program Files\Orange\OrangeUpdate\Service\OUCore.exe -- (Orange update Core Service)
SRV - [2015/04/21 16:58:44 | 000,102,912 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\IEEtwCollector.exe -- (IEEtwCollectorService)
SRV - [2015/01/02 19:45:12 | 000,315,488 | R--- | M] (Skype Technologies) [Disabled | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2014/10/10 15:03:38 | 001,771,560 | ---- | M] (pdfforge GmbH) [On_Demand | Running] -- C:\Program Files\PDF Architect 2\ws.exe -- (PDF Architect 2)
SRV - [2014/10/10 15:03:38 | 000,861,736 | ---- | M] (pdfforge GmbH) [On_Demand | Stopped] -- C:\Program Files\PDF Architect 2\crash-handler-ws.exe -- (pdfforge CrashHandler)
SRV - [2014/10/10 15:03:38 | 000,738,856 | ---- | M] (pdfforge GmbH) [Auto | Running] -- C:\Program Files\PDF Architect 2\creator-ws.exe -- (PDF Architect 2 Creator)
SRV - [2014/03/18 15:10:02 | 001,970,544 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\Orange\ma Livebox\dedicarz\DedicarzService.exe -- (Dedicarz Service)
SRV - [2013/12/19 00:41:02 | 030,814,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)
SRV - [2013/05/27 05:57:27 | 000,680,960 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2012/10/26 15:21:09 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2012/04/06 03:15:50 | 000,217,600 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2011/08/22 14:26:10 | 000,057,344 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\GIGABYTE\EnergySaver2\des2svr.exe -- (DES2 Service)
SRV - [2010/10/05 20:04:12 | 002,655,768 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2010/10/05 20:04:08 | 000,325,656 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2010/04/06 15:30:38 | 000,031,272 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\System32\AppleChargerSrv.exe -- (AppleChargerSrv)
SRV - [2010/02/19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2009/10/13 15:39:46 | 000,114,688 | ---- | M] (Gigabyte Technology CO., LTD.) [Auto | Running] -- C:\Program Files\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe -- (Smart TimeLock)
SRV - [2009/10/07 01:47:34 | 000,154,136 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)
SRV - [2009/07/14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)


[color=#E56717]========== Driver Services (SafeList) ==========[/color]

DRV - File not found [Kernel | System | Stopped] -- system32\drivers\wwfd_vt_1_10_0_24.sys -- (wwfd_vt_1_10_0_24)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\rdvgkmd.sys -- (VGPU)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\tsusbhub.sys -- (tsusbhub)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\synth3dvsc.sys -- (Synth3dVsc)
DRV - File not found [Kernel | System | Stopped] -- system32\drivers\swsedrvr_vt_1_10_0_25.sys -- (swsedrvr_vt_1_10_0_25)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\rt73.sys -- (RT73)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\NPF.sys -- (NPF)
DRV - File not found [Kernel | System | Stopped] -- system32\drivers\innfd_1_10_0_14.sys -- (innfd_1_10_0_14)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\ROBERT~1\AppData\Local\Temp\cpuz134\cpuz134_x32.sys -- (cpuz134)
DRV - File not found [Kernel | Auto | Stopped] -- -- (adfs)
DRV - [2015/11/08 11:44:58 | 000,017,488 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\gdrv.sys -- (gdrv)
DRV - [2015/11/06 19:33:55 | 000,435,464 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswsp.sys -- (aswSP)
DRV - [2015/11/06 19:33:43 | 000,794,952 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswsnx.sys -- (aswSnx)
DRV - [2015/11/06 15:12:45 | 000,056,480 | ---- | M] (Cherimoya Ltd) [Kernel | System | Running] -- C:\Windows\System32\drivers\cherimoya.sys -- (cherimoya)
DRV - [2015/09/19 09:55:06 | 000,208,664 | ---- | M] (AVAST Software) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\aswVmm.sys -- (aswVmm)
DRV - [2015/09/19 09:55:06 | 000,115,640 | ---- | M] (AVAST Software) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\aswStm.sys -- (aswStm)
DRV - [2015/09/19 09:55:05 | 000,081,728 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr2.sys -- (aswRdr)
DRV - [2015/09/19 09:55:05 | 000,076,000 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2015/09/19 09:55:05 | 000,049,776 | ---- | M] (AVAST Software) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\aswRvrt.sys -- (aswRvrt)
DRV - [2015/09/19 09:55:05 | 000,024,016 | ---- | M] (AVAST Software) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\aswHwid.sys -- (aswHwid)
DRV - [2015/09/19 09:53:24 | 000,107,984 | ---- | M] (AVAST Software) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\ngvss.sys -- (ngvss)
DRV - [2015/09/19 09:52:55 | 000,220,752 | ---- | M] (Avast Software) [Kernel | Auto | Running] -- C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys -- (VBoxAswDrv)
DRV - [2015/06/11 18:15:04 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV - [2013/02/18 19:38:04 | 000,013,824 | ---- | M] (Scott) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\USBDrv.sys -- (usbUDisc)
DRV - [2012/10/26 13:25:37 | 000,024,944 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\GVTDrv.sys -- (GVTDrv)
DRV - [2012/04/06 06:21:10 | 009,334,784 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag)
DRV - [2012/04/06 02:10:22 | 000,275,968 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap)
DRV - [2011/07/29 04:40:00 | 000,064,256 | ---- | M] (Etron Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\EtronXHCI.sys -- (EtronXHCI)
DRV - [2011/07/29 04:40:00 | 000,044,928 | ---- | M] (Etron Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\EtronHub3.sys -- (EtronHub3)
DRV - [2011/07/06 11:12:48 | 000,328,552 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RtHDMIV.sys -- (RTHDMIAzAudService)
DRV - [2011/01/10 17:16:16 | 000,018,544 | ---- | M] () [Kernel | System | Running] -- C:\Windows\System32\drivers\AppleCharger.sys -- (AppleCharger)
DRV - [2010/11/20 03:30:16 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010/11/20 03:30:16 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010/11/20 03:30:16 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010/11/20 01:24:42 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 01:24:42 | 000,027,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV - [2010/11/20 00:59:46 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010/11/20 00:14:46 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010/11/20 00:14:42 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010/10/14 18:27:18 | 000,269,824 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntcDAud.sys -- (IntcDAud)
DRV - [2010/09/21 08:59:02 | 000,041,088 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HECI.sys -- (MEI)
DRV - [2009/10/07 01:46:36 | 000,025,752 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LVPr2Mon.sys -- (LVPr2Mon)
DRV - [2009/07/13 23:02:53 | 000,545,792 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\netr73.sys -- (netr73)
DRV - [2009/07/13 23:02:52 | 000,043,008 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtnicxp.sys -- (RTL8023xp)
DRV - [2008/07/26 15:26:22 | 000,041,752 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2008/07/26 15:25:48 | 000,627,864 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lvrs.sys -- (LVRS)
DRV - [2008/07/26 15:22:34 | 002,570,520 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LV302V32.SYS -- (PID_PEPI)
DRV - [2008/07/26 15:22:22 | 000,013,848 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lv302af.sys -- (pepifilter)
DRV - [2006/11/28 21:46:22 | 000,028,224 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PCAMp50.sys -- (PCAMp50)
DRV - [2006/11/28 21:46:20 | 000,027,072 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PCASp50.sys -- (PCASp50)
DRV - [2005/09/23 22:18:32 | 000,171,520 | ---- | M] (Pinnacle Systems GmbH) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\MarvinBus.sys -- (MarvinBus)


[color=#E56717]========== Standard Registry (SafeList) ==========[/color]


[color=#E56717]========== Internet Explorer ==========[/color]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sweet-page.com/web/?type=ds&ts=1428500525&from=corfr&uid=WDCXWD7500AADS-11M2B1_WD-WCAV5442982829828&q={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = https://www.google.com/?trackid=sp-006
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.sweet-page.com/web/?type=ds&ts=1428500525&from=corfr&uid=WDCXWD7500AADS-11M2B1_WD-WCAV5442982829828&q={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKLM\..\URLSearchHook: {cfcb809c-3a22-4616-a916-6c007bd9d920} - No CLSID value found
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=INMODF&PC=IN05
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{124F8CF5-E7CF-4D55-A380-40A247AA12F7}: "URL" = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=1130&systemid=1&apn_dtid=IME001&apn_ptnrs=AGE&o=APN10653&apn_uid=7590239348574902&q={searchTerms}
IE - HKLM\..\SearchScopes\{75b4241f-171e-44a3-bf44-23613b6e3e03}: "URL" = http://search.tb.ask.com/search/GGmain.jhtml?p2=^AYY^xdm073^YYA^fr&si=flvrunner&ptb=A711907B-4359-41C0-B290-80D1844AFCBD&ind=2014032116&n=780bb0f4&psa=&st=sb&searchfor={searchTerms}
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2002}: "URL" = http://dts.search.ask.com/sr?src=ieb&gct=ds&appid=702&systemid=2&v=a11465-158&apn_uid=2459072304404521&apn_dtid=IME002&o=APN10641&apn_ptnrs=AG2&q={searchTerms}
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD21}: "URL" = http://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=irmsd103&cd=2XzuyEtN2Y1L1QzuzytDtB0BtAyEtAtByB0B0FtA0E0B0C0DtN0D0Tzu0CyCyByDtN1L2XzutBtFtBtFzztFtCtByEyBtN1L1Czu1L1C1H1B1QtCtDtA&cr=1669727208&ir=
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=563&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=1455181384784578&q={searchTerms}
IE - HKLM\..\SearchScopes\{9CB96984-43C3-4D44-90EF-01466EFCF7BB}: "URL" = https://fr.search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms}
IE - HKLM\..\SearchScopes\{E9410C70-B6AE-41FF-AB71-32F4B279EA5F}: "URL" = https://www.google.com/search?trackid=sp-006&q={searchTerms}
IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?src=6&q={searchTerms}&crg=3.1010000.10015


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\SOFTWARE\Microsoft\Internet Explorer\Main,bProtector Start Page = http://www.delta-search.com/?affID=119556&tt=260213_yold&babsrc=HP_ss&mntrId=5883ebcd000000000000902b34327bf3
IE - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
IE - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.bing.com/search?q={searchTerms}&FORM=INMODF&PC=IN05
IE - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.bing.com/search?q={searchTerms}&FORM=INMODF&PC=IN05
IE - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/
IE - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://fr.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = fr-FR
IE - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 06 EF 26 6F C2 B9 CD 01 [binary data]
IE - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.bing.com/search?q={searchTerms}&FORM=INMODF&PC=IN05
IE - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.bing.com/search?q={searchTerms}&FORM=INMODF&PC=IN05
IE - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\..\URLSearchHook: {4d687bc7-7f1a-472c-bf8e-9af6d7b17ac8} - No CLSID value found
IE - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\..\SearchScopes,bProtectorDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
IE - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR
IE - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://www.max-start.com/?q={searchTerms}&babsrc=SP_ss_mib2&mntrId=588300E022101024&affID=127850&tsp=5220
IE - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\..\SearchScopes\{124F8CF5-E7CF-4D55-A380-40A247AA12F7}: "URL" = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=1130&systemid=1&apn_dtid=IME001&apn_ptnrs=AGE&o=APN10653&apn_uid=7590239348574902&q={searchTerms}
IE - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\..\SearchScopes\{2582C93B-6707-4807-802D-308ABC9336FC}: "URL" = http://fr.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=IEBDSV
IE - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\..\SearchScopes\{58439092-6DA1-4472-BD14-CDD7315E1177}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3241952
IE - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\..\SearchScopes\{75b4241f-171e-44a3-bf44-23613b6e3e03}: "URL" = http://search.tb.ask.com/search/GGmain.jhtml?p2=^AYY^xdm073^YYA^fr&si=flvrunner&ptb=A711907B-4359-41C0-B290-80D1844AFCBD&ind=2014032116&n=780bb0f4&psa=&st=sb&searchfor={searchTerms}
IE - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\..\SearchScopes\{814C76CB-2623-43F4-AAD0-58A0E5190A20}: "URL" = http://r.orange.fr/r?ref=O_OI_hook_openSearchIE&url=http%3A//rws.search.ke.voila.fr/RW/S/opensearch_orange?rdata={searchTerms}
IE - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2002}: "URL" = http://dts.search.ask.com/sr?src=ieb&gct=ds&appid=702&systemid=2&v=a11465-158&apn_uid=2459072304404521&apn_dtid=IME002&o=APN10641&apn_ptnrs=AG2&q={searchTerms}
IE - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD21}: "URL" = http://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=irmsd103&cd=2XzuyEtN2Y1L1QzuzytDtB0BtAyEtAtByB0B0FtA0E0B0C0DtN0D0Tzu0CyCyByDtN1L2XzutBtFtBtFzztFtCtByEyBtN1L1Czu1L1C1H1B1QtCtDtA&cr=1669727208&ir=
IE - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=563&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=1455181384784578&q={searchTerms}
IE - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\..\SearchScopes\{9CB96984-43C3-4D44-90EF-01466EFCF7BB}: "URL" = https://fr.search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms}
IE - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\..\SearchScopes\{A78CFCF7-B72D-4f49-9CE8-DB6550BC14DF}: "URL" = http://www.google.com/cse?cx=partner-pub-3794288947762788%3A7941509802&ie=UTF-8&sa=Search&siteurl=www.google.com%2Fcse%2Fhome%3Fcx%3Dpartner-pub-3794288947762788%3A7941509802&q={searchTerms}
IE - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = http://mystart.incredimail.com//?search={searchTerms}&loc=search_box&a=19enhlgjsx9
IE - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\..\SearchScopes\{E3AFA49B-B3AB-4189-8C27-984DF0189582}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02
IE - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\..\SearchScopes\{E9410C70-B6AE-41FF-AB71-32F4B279EA5F}: "URL" = https://www.google.com/search?trackid=sp-006&q={searchTerms}
IE - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?src=6&q={searchTerms}&crg=3.1010000.10015
IE - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

[color=#E56717]========== FireFox ==========[/color]

FF - prefs.js..browser.search.countryCode: "FR"
FF - prefs.js..browser.search.region: "FR"
FF - prefs.js..browser.startup.homepage: "www.google.fr"
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:42.0


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_19_0_0_226.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Allin1Convert_8h.com/Plugin: File not found
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=11.45.2: C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=11.45.2: C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@MapsGalaxy_39.com/Plugin: File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@staging.google.com/globalUpdate Update;version=10: C:\Program Files\globalUpdate\Update\1.3.25.0\npglobalupdateUpdate4.dll (globalUpdate)
FF - HKLM\Software\MozillaPlugins\@staging.google.com/globalUpdate Update;version=4: C:\Program Files\globalUpdate\Update\1.3.25.0\npglobalupdateUpdate4.dll (globalUpdate)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe Systems)
FF - HKLM\Software\MozillaPlugins\adobe.com/AdobeExManDetect: C:\Program Files\Adobe\Adobe Extension Manager CS6\npAdobeExManDetectX86.dll (Adobe Systems)
FF - HKLM\Software\MozillaPlugins\PDF Architect 2: C:\Program Files\PDF Architect 2\np-previewer.dll (pdfforge GmbH)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2015/09/19 09:53:53 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\39ffxtbr@MapsGalaxy_39.com: C:\Program Files\MapsGalaxy_39\bar\1.bin
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\istart_ffnt@gmail.com: C:\Users\Robert labeyrie\AppData\Roaming\Mozilla\Firefox\Profiles\o0cjyhz1.default\extensions\istart_ffnt@gmail.com
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{093FCDFC-98E8-4492-aDC7-D137E8B768C7}: C:\Program Files\shopperz061120151321\Firefox\{093FCDFC-98E8-4492-aDC7-D137E8B768C7}.xpi
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 42.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 42.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2015/10/27 10:50:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Robert labeyrie\AppData\Roaming\mozilla\Extensions
[2015/11/03 09:08:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Robert labeyrie\AppData\Roaming\mozilla\Firefox\Profiles\ejt0z2wu.default\extensions
[2015/04/19 14:34:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Robert labeyrie\AppData\Roaming\mozilla\Firefox\Profiles\o0cjyhz1.default\extensions
[2015/04/19 14:34:07 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Robert labeyrie\AppData\Roaming\mozilla\Firefox\Profiles\o0cjyhz1.default\extensions\{249d74a3-bd19-4657-b6ce-e62f480a20de}
[2015/04/19 14:34:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Robert labeyrie\AppData\Roaming\mozilla\Firefox\Profiles\o0cjyhz1.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}
[2015/11/05 11:05:45 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\browser\extensions
[2015/11/05 11:05:52 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

O1 HOSTS File: ([2012/10/26 13:32:16 | 000,001,106 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 genuine.microsoft.com
O1 - Hosts: 127.0.0.1 mpa.one.microsoft.com
O1 - Hosts: 127.0.0.1 sa.windows.com
O1 - Hosts: 127.0.0.1 se.windows.com
O1 - Hosts: 127.0.0.1 ie.search.msn.com
O1 - Hosts: 127.0.0.1 wustat.windows.com
O1 - Hosts: 127.0.0.1 wutrack.windows.com
O1 - Hosts: 127.0.0.1 catalog.microsoft.com
O1 - Hosts: 127.0.0.1 sls.microsoft.com
O2 - BHO: (no name) - {71c1d63a-c944-428a-a5bd-ba513190e5d2} - No CLSID value found.
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (no name) - {970c55b4-c79e-4c62-9bfa-76439b68969f} - No CLSID value found.
O2 - BHO: (no name) - {a4c2fb10-84c3-44eb-9f9e-860fa1d9a797} - No CLSID value found.
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (no name) - {cfcb809c-3a22-4616-a916-6c007bd9d920} - No CLSID value found.
O2 - BHO: (no name) - {d4be399f-cfdf-462f-b234-2e3a62cff5a8} - No CLSID value found.
O2 - BHO: (no name) - {da104fa1-3714-4056-8f42-d7fb74fd43dc} - No CLSID value found.
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (no name) - {EEE6C35C-6118-11DC-9C72-001320C79847} - No CLSID value found.
O2 - BHO: (no name) - {fbcbc43a-dca9-4192-a4c8-b57fd0f77d4d} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {cd1a63ba-a08c-431b-9a34-f240aadc728d} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {cfcb809c-3a22-4616-a916-6c007bd9d920} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {d4be399f-cfdf-462f-b234-2e3a62cff5a8} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {EEE6C35B-6118-11DC-9C72-001320C79847} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\..\Toolbar\WebBrowser: (no name) - {249D74A3-BD19-4657-B6CE-E62F480A20DE} - No CLSID value found.
O3 - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\..\Toolbar\WebBrowser: (no name) - {CD1A63BA-A08C-431B-9A34-F240AADC728D} - No CLSID value found.
O3 - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\..\Toolbar\WebBrowser: (no name) - {CFCB809C-3A22-4616-A916-6C007BD9D920} - No CLSID value found.
O4 - HKLM..\Run: [AvastUI.exe] C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [gmsd_fr_005010116] File not found
O4 - HKLM..\Run: [gmsd_fr_005010117] File not found
O4 - HKLM..\Run: [gmsd_fr_005010119] File not found
O4 - HKLM..\Run: [gmsd_fr_005010122] File not found
O4 - HKLM..\Run: [gmsd_fr_005010123] File not found
O4 - HKLM..\Run: [gmsd_fr_005010126] File not found
O4 - HKLM..\Run: [gmsd_fr_005010134] File not found
O4 - HKLM..\Run: [gmsd_fr_005010135] File not found
O4 - HKLM..\Run: [gmsd_fr_005010137] File not found
O4 - HKLM..\Run: [gmsd_fr_448] File not found
O4 - HKLM..\Run: [mpck_fr_15] File not found
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup File not found
O4 - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000..\Run: [MailNotifier] C:\Program Files\Orange\MailNotifier\MailNotifier.exe (Orange)
O4 - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000..\Run: [Orange Installer] C:\Program Files\Orange\Orange Installer\OrangeInstaller.exe ()
O4 - HKLM..\RunOnce: [RPMKickstart] C:\Program Files\GIGABYTE\SMART6\Recovery\RPMKickstart.exe (Gigabyte Technology CO., LTD.)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SoftwareSASGeneration = 1
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\SearchScopes present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\SearchScopes present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\SearchScopes present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\SearchScopes present
O7 - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\Software\Policies\Microsoft\Internet Explorer\SearchScopes present
O8 - Extra context menu item: Accéder au portail Orange - C:\Users\Robert labeyrie\AppData\Roaming\Orange\OrangeInside\src\orange_html\orange.html ()
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Envoyer par SMS Orange le texte sélectionné - C:\Users\Robert labeyrie\AppData\Roaming\Orange\OrangeInside\src\sendsmsselectedtext_html\sendsmsselectedtext.html ()
O8 - Extra context menu item: Rechercher le texte sélectionné - C:\Users\Robert labeyrie\AppData\Roaming\Orange\OrangeInside\src\selectedsearch_html\selectedsearch.html ()
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\..Trusted Domains: mappy.com ([]http in Trusted sites)
O15 - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\..Trusted Domains: voila.fr ([rw.search.ke] http in Trusted sites)
O15 - HKU\S-1-5-21-4283344945-4003681302-3884085246-1000\..Trusted Domains: weborama.fr ([orange] http in Trusted sites)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{37EBCEA7-7D8E-484B-9D02-380596A81DEA}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4BC243F2-BB51-4CB1-BE7F-C57622FC5064}: DhcpNameServer = 192.168.1.1 192.168.1.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O27 - HKLM IFEO\bitguard.exe: Debugger - C:\Windows\System32\tasklist.exe (Microsoft Corporation)
O27 - HKLM IFEO\bprotect.exe: Debugger - C:\Windows\System32\tasklist.exe (Microsoft Corporation)
O27 - HKLM IFEO\bpsvc.exe: Debugger - C:\Windows\System32\tasklist.exe (Microsoft Corporation)
O27 - HKLM IFEO\browsemngr.exe: Debugger - C:\Windows\System32\tasklist.exe (Microsoft Corporation)
O27 - HKLM IFEO\browserdefender.exe: Debugger - C:\Windows\System32\tasklist.exe (Microsoft Corporation)
O27 - HKLM IFEO\browsermngr.exe: Debugger - C:\Windows\System32\tasklist.exe (Microsoft Corporation)
O27 - HKLM IFEO\browserprotect.exe: Debugger - C:\Windows\System32\tasklist.exe (Microsoft Corporation)
O27 - HKLM IFEO\browsersafeguard.exe: Debugger - C:\Windows\System32\tasklist.exe (Microsoft Corporation)
O27 - HKLM IFEO\bundlesweetimsetup.exe: Debugger - C:\Windows\System32\tasklist.exe (Microsoft Corporation)
O27 - HKLM IFEO\cltmngsvc.exe: Debugger - C:\Windows\System32\tasklist.exe (Microsoft Corporation)
O27 - HKLM IFEO\delta babylon.exe: Debugger - C:\Windows\System32\tasklist.exe (Microsoft Corporation)
O27 - HKLM IFEO\delta tb.exe: Debugger - C:\Windows\System32\tasklist.exe (Microsoft Corporation)
O27 - HKLM IFEO\delta2.exe: Debugger - C:\Windows\System32\tasklist.exe (Microsoft Corporation)
O27 - HKLM IFEO\deltainstaller.exe: Debugger - C:\Windows\System32\tasklist.exe (Microsoft Corporation)
O27 - HKLM IFEO\deltasetup.exe: Debugger - C:\Windows\System32\tasklist.exe (Microsoft Corporation)
O27 - HKLM IFEO\deltatb.exe: Debugger - C:\Windows\System32\tasklist.exe (Microsoft Corporation)
O27 - HKLM IFEO\deltatb_2501-c733154b.exe: Debugger - C:\Windows\System32\tasklist.exe (Microsoft Corporation)
O27 - HKLM IFEO\dprotectsvc.exe: Debugger - C:\Windows\System32\tasklist.exe (Microsoft Corporation)
O27 - HKLM IFEO\iminentsetup.exe: Debugger - C:\Windows\System32\tasklist.exe (Microsoft Corporation)
O27 - HKLM IFEO\protectedsearch.exe: Debugger - C:\Windows\System32\tasklist.exe (Microsoft Corporation)
O27 - HKLM IFEO\rjatydimofu.exe: Debugger - C:\Windows\System32\tasklist.exe (Microsoft Corporation)
O27 - HKLM IFEO\searchprotection.exe: Debugger - C:\Windows\System32\tasklist.exe (Microsoft Corporation)
O27 - HKLM IFEO\searchprotector.exe: Debugger - C:\Windows\System32\tasklist.exe (Microsoft Corporation)
O27 - HKLM IFEO\snapdo.exe: Debugger - C:\Windows\System32\tasklist.exe (Microsoft Corporation)
O27 - HKLM IFEO\stinst32.exe: Debugger - C:\Windows\System32\tasklist.exe (Microsoft Corporation)
O27 - HKLM IFEO\stinst64.exe: Debugger - C:\Windows\System32\tasklist.exe (Microsoft Corporation)
O27 - HKLM IFEO\sweetimsetup.exe: Debugger - C:\Windows\System32\tasklist.exe (Microsoft Corporation)
O27 - HKLM IFEO\tbdelta.exetoolbar783881609.exe: Debugger - C:\Windows\System32\tasklist.exe (Microsoft Corporation)
O27 - HKLM IFEO\utiljumpflip.exe: Debugger - C:\Windows\System32\tasklist.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{90919520-1f62-11e2-9821-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{90919520-1f62-11e2-9821-806e6f6e6963}\Shell\AutoRun\command - "" = E:\.\Autorun.exe
O33 - MountPoints2\{f06139da-82e1-11e5-b94c-00e022101024}\Shell - "" = AutoRun
O33 - MountPoints2\{f06139da-82e1-11e5-b94c-00e022101024}\Shell\AutoRun\command - "" = J:\iStudio.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O36 - AppCertDlls: x64 - (c:\program files\music toolbar\datamngr\x64\apcrtldr.dll) - File not found
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

MsConfig - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^FAH.lnk - - File not found
MsConfig - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WinZip Preloader.lnk - - File not found
MsConfig - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WinZip Quick Pick.lnk - - File not found
MsConfig - StartUpFolder: C:^Users^Robert labeyrie^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^crossbrowse.lnk - - File not found
MsConfig - StartUpFolder: C:^Users^Robert labeyrie^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^SmartWeb.lnk - - File not found
MsConfig - StartUpReg: [b]3D BubbleSound[/b] - hkey= - key= - File not found
MsConfig - StartUpReg: [b]Adobe Photo Downloader[/b] - hkey= - key= - C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.4\apdproxy.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: [b]AdobeAAMUpdater-1.0[/b] - hkey= - key= - C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: [b]AdobeCS6ServiceManager[/b] - hkey= - key= - C:\Program Files\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: [b]BCSSync[/b] - hkey= - key= - C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
MsConfig - StartUpReg: [b]BearShare[/b] - hkey= - key= - File not found
MsConfig - StartUpReg: [b]CrashService[/b] - hkey= - key= - File not found
MsConfig - StartUpReg: [b]Family Tree Builder Update[/b] - hkey= - key= - C:\Program Files\MyHeritage\Bin\FTBCheckUpdates.exe (MyHeritage)
MsConfig - StartUpReg: [b]IncrediMail[/b] - hkey= - key= - File not found
MsConfig - StartUpReg: [b]Infigo[/b] - hkey= - key= - File not found
MsConfig - StartUpReg: [b]LogitechQuickCamRibbon[/b] - hkey= - key= - C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
MsConfig - StartUpReg: [b]PremierDownloadManager AppIntegrator 32-bit[/b] - hkey= - key= - File not found
MsConfig - StartUpReg: [b]PremierDownloadManager EPM Support[/b] - hkey= - key= - File not found
MsConfig - StartUpReg: [b]Selection Tools[/b] - hkey= - key= - File not found
MsConfig - StartUpReg: [b]Skype[/b] - hkey= - key= - C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)
MsConfig - StartUpReg: [b]SmartWeb[/b] - hkey= - key= - File not found
MsConfig - StartUpReg: [b]SpaceSoundPro[/b] - hkey= - key= - File not found
MsConfig - StartUpReg: [b]SwitchBoard[/b] - hkey= - key= - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: [b]USBToolTip[/b] - hkey= - key= - C:\PROGRA~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe (Pinnacle Systems GmbH)
MsConfig - StartUpReg: [b]WindApp[/b] - hkey= - key= - File not found
MsConfig - State: "startup" - 2
MsConfig - State: "services" - 2

Drivers32: msacm.ac3acm - C:\Windows\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\Windows\System32\lameACM.acm (http://www.mp3dev.org/)
Drivers32: MSVideo - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll ()
Drivers32: VIDC.I420 - C:\Windows\System32\lvcodec2.dll (Logitech Inc.)
Drivers32: vidc.iv41 - C:\Windows\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\Windows\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.LAGS - C:\Windows\System32\lagarith.dll ( )
Drivers32: vidc.mjpg - pvmjpg30.dll File not found
Drivers32: VIDC.VP70 - C:\Windows\System32\vp7vfw.dll (On2.com)
Drivers32: VIDC.XVID - C:\Windows\System32\xvidvfw.dll ()
Drivers32: VIDC.YV12 - C:\Windows\System32\yv12vfw.dll (www.helixcommunity.org)


CREATERESTOREPOINT
Restore point Set: OTL Restore Point

[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]

[2015/11/08 12:42:23 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Robert labeyrie\Desktop\OTL.exe
[2015/11/08 12:28:10 | 000,000,000 | ---D | C] -- C:\Users\Robert labeyrie\AppData\Roaming\ZHP
[2015/11/08 10:05:21 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2015/11/06 16:13:39 | 000,000,000 | -H-D | C] -- C:\6eb840fc
[2015/11/06 16:13:39 | 000,000,000 | -H-D | C] -- C:\600ed6bc
[2015/11/06 15:23:36 | 000,000,000 | ---D | C] -- C:\ProgramData\MovieDeaConfig
[2015/11/06 15:13:27 | 000,000,000 | ---D | C] -- C:\Windows\System32\uru
[2015/11/06 15:13:24 | 000,000,000 | ---D | C] -- C:\Users\Robert labeyrie\AppData\Roaming\ortmp
[2015/11/06 15:13:23 | 000,000,000 | ---D | C] -- C:\Users\Robert labeyrie\AppData\Local\Tempfolder
[2015/11/06 12:24:24 | 000,056,480 | ---- | C] (Cherimoya Ltd) -- C:\Windows\System32\drivers\cherimoya.sys
[2015/11/05 11:05:45 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2015/11/05 10:21:03 | 000,000,000 | ---D | C] -- C:\Users\Robert labeyrie\AppData\Local\DailyWiki
[2015/11/04 12:29:33 | 000,000,000 | ---D | C] -- C:\Program Files\Samsung
[2015/11/04 12:29:33 | 000,000,000 | ---D | C] -- C:\Users\Robert labeyrie\AppData\Roaming\Intelli-studio
[2015/11/04 12:26:48 | 000,000,000 | ---D | C] -- C:\Users\Robert labeyrie\AppData\Local\gmsd_fr_005010135
[2015/11/04 12:26:48 | 000,000,000 | ---D | C] -- C:\Program Files\gmsd_fr_005010135
[2015/11/04 12:25:34 | 000,000,000 | ---D | C] -- C:\Users\Robert labeyrie\AppData\Roaming\cpuminer
[2015/11/04 11:51:58 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2015/11/03 09:35:53 | 000,000,000 | ---D | C] -- C:\Users\Robert labeyrie\AppData\Local\ComBroadcaster
[2015/11/03 09:04:22 | 000,000,000 | ---D | C] -- C:\ProgramData\PlayGemConfig
[2015/10/27 10:49:40 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service
[2015/10/23 18:05:36 | 000,000,000 | ---D | C] -- C:\Program Files\MyBrowser 1.0.2V23.10
[2015/10/23 18:03:52 | 000,000,000 | ---D | C] -- C:\Users\Robert labeyrie\AppData\Local\Crossbrowse
[2015/10/23 16:11:43 | 000,000,000 | ---D | C] -- C:\Users\Robert labeyrie\AppData\Local\5D36C0F3-7F12-4328-8CC3-507919804019
[2015/10/23 15:57:22 | 000,000,000 | ---D | C] -- C:\Program Files\SpaceSondPro_v53.5498
[2015/10/23 15:57:22 | 000,000,000 | ---D | C] -- C:\Program Files\SpaceSondPro
[2015/10/20 08:25:48 | 000,000,000 | -H-D | C] -- C:\$Windows.~BT
[2015/10/19 09:18:17 | 000,000,000 | ---D | C] -- C:\Users\Robert labeyrie\AppData\Local\D409C5DA-826-4543-9220-1F65A67B4446
[2015/10/18 09:36:57 | 000,000,000 | ---D | C] -- C:\Users\Robert labeyrie\AppData\Local\Opera Software
[2015/10/18 09:36:56 | 000,000,000 | ---D | C] -- C:\Users\Robert labeyrie\AppData\Roaming\Opera Software
[2015/10/18 09:25:35 | 000,000,000 | ---D | C] -- C:\Program Files\Opera
[2015/10/17 09:15:55 | 000,000,000 | ---D | C] -- C:\Program Files\Exploremedia
[2015/10/17 09:10:02 | 000,000,000 | ---D | C] -- C:\Program Files\SFK
[2015/10/17 09:09:57 | 000,000,000 | ---D | C] -- C:\ProgramData\9WdsManPro9
[2015/10/17 09:09:55 | 000,000,000 | ---D | C] -- C:\Users\Robert labeyrie\AppData\Roaming\mystartsearch
[2015/10/16 13:18:36 | 000,000,000 | ---D | C] -- C:\Program Files\predm
[2015/10/16 09:38:26 | 000,000,000 | ---D | C] -- C:\Program Files\Feed Notifier
[2015/10/15 09:49:09 | 000,000,000 | ---D | C] -- C:\Users\Robert labeyrie\AppData\Local\gmsd_fr_005010111
[2015/10/15 09:49:09 | 000,000,000 | ---D | C] -- C:\Program Files\gmsd_fr_005010111
[2015/10/15 09:48:30 | 000,000,000 | ---D | C] -- C:\ProgramData\pWdsManProp
[2015/10/15 09:48:13 | 000,000,000 | ---D | C] -- C:\Users\Robert labeyrie\AppData\Roaming\RunDir
[2015/10/15 09:48:12 | 000,000,000 | ---D | C] -- C:\Users\Robert labeyrie\AppData\Roaming\NetService
[2015/10/15 09:48:08 | 000,000,000 | ---D | C] -- C:\Users\Robert labeyrie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\jogotempo
[2015/10/15 09:37:29 | 000,000,000 | ---D | C] -- C:\Users\Robert labeyrie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ASPackage
[2015/10/15 09:37:27 | 000,000,000 | ---D | C] -- C:\Users\Robert labeyrie\AppData\Roaming\ASPackage
[2015/10/15 09:37:27 | 000,000,000 | ---D | C] -- C:\Program Files\00000000-1444898247-0000-0000-902B34327BF3
[2015/10/15 09:36:37 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Guid
[2015/10/15 09:36:18 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Baidu
[2015/10/15 09:36:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MYBESTOFFERSTODAY
[2015/10/15 09:35:58 | 000,000,000 | ---D | C] -- C:\Users\Robert labeyrie\AppData\Local\mbot_fr_014010113
[2015/10/15 09:35:58 | 000,000,000 | ---D | C] -- C:\Program Files\mbot_fr_014010113
[2015/10/15 09:34:27 | 000,000,000 | ---D | C] -- C:\Users\Robert labeyrie\AppData\Local\BoBrowser
[2015/10/15 08:52:34 | 001,120,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\appraiser.dll
[2015/10/15 08:52:34 | 000,999,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\aeinv.dll
[2015/10/15 08:52:34 | 000,615,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\generaltel.dll
[2015/10/15 08:52:34 | 000,587,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\invagent.dll
[2015/10/15 08:52:34 | 000,423,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\devinv.dll
[2015/10/15 08:52:34 | 000,062,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\acmigration.dll
[2015/10/15 08:52:34 | 000,023,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\CompatTelRunner.exe
[2015/10/14 14:28:44 | 000,000,000 | ---D | C] -- C:\Users\Robert labeyrie\AppData\Local\TuneUp Software
[2015/10/14 14:21:41 | 000,000,000 | ---D | C] -- C:\Users\Robert labeyrie\AppData\Local\FreemakeVideoConverter
[2015/10/14 14:21:06 | 000,000,000 | ---D | C] -- C:\Users\Robert labeyrie\Documents\Freemake
[2015/10/14 14:21:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Freemake
[2015/10/14 14:20:48 | 000,000,000 | ---D | C] -- C:\Users\Robert labeyrie\AppData\Roaming\RPEng
[2015/10/14 14:20:48 | 000,000,000 | ---D | C] -- C:\Program Files\Freemake
[2015/10/14 14:03:57 | 000,901,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ucrtbase.dll
[2015/10/14 14:03:57 | 000,066,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-crt-private-l1-1-0.dll
[2015/10/14 14:03:57 | 000,022,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-crt-math-l1-1-0.dll
[2015/10/14 14:03:57 | 000,019,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-crt-multibyte-l1-1-0.dll
[2015/10/14 14:03:57 | 000,017,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-crt-string-l1-1-0.dll
[2015/10/14 14:03:57 | 000,017,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-crt-stdio-l1-1-0.dll
[2015/10/14 14:03:57 | 000,016,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-crt-runtime-l1-1-0.dll
[2015/10/14 14:03:57 | 000,015,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-crt-convert-l1-1-0.dll
[2015/10/14 14:03:57 | 000,014,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-crt-time-l1-1-0.dll
[2015/10/14 14:03:57 | 000,014,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-localization-l1-2-0.dll
[2015/10/14 14:03:57 | 000,013,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-crt-filesystem-l1-1-0.dll
[2015/10/14 14:03:57 | 000,012,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-crt-process-l1-1-0.dll
[2015/10/14 14:03:57 | 000,012,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-crt-heap-l1-1-0.dll
[2015/10/14 14:03:57 | 000,012,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-crt-conio-l1-1-0.dll
[2015/10/14 14:03:57 | 000,012,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-crt-utility-l1-1-0.dll
[2015/10/14 14:03:57 | 000,012,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-crt-locale-l1-1-0.dll
[2015/10/14 14:03:57 | 000,012,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-crt-environment-l1-1-0.dll
[2015/10/14 14:03:57 | 000,012,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-synch-l1-2-0.dll
[2015/10/14 14:03:57 | 000,012,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-processthreads-l1-1-1.dll
[2015/10/14 14:03:57 | 000,011,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-eventing-provider-l1-1-0.dll
[2015/10/14 14:03:57 | 000,011,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-xstate-l2-1-0.dll
[2015/10/14 14:03:57 | 000,011,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-timezone-l1-1-0.dll
[2015/10/14 14:03:57 | 000,011,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-file-l2-1-0.dll
[2015/10/14 14:03:57 | 000,011,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-file-l1-2-0.dll
[2015/10/14 14:03:53 | 003,990,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2015/10/14 14:03:53 | 003,936,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2015/10/14 14:03:53 | 000,400,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\srcore.dll
[2015/10/14 14:03:53 | 000,262,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rstrui.exe
[2015/10/14 14:03:52 | 000,221,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncrypt.dll
[2015/10/14 14:03:52 | 000,050,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\auditpol.exe
[2015/10/14 14:03:52 | 000,038,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\csrsrv.dll
[2015/10/14 14:03:52 | 000,015,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sspisrv.dll
[2015/10/14 14:03:52 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\apisetschema.dll
[2015/10/14 14:03:51 | 000,686,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\adtschema.dll
[2015/10/14 14:03:51 | 000,146,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msaudite.dll
[2015/10/14 14:03:51 | 000,060,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msobjs.dll
[2015/10/14 14:03:39 | 001,498,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ExplorerFrame.dll
[2015/10/14 14:03:37 | 002,955,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wucltux.dll
[2015/10/14 14:03:37 | 000,566,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuapi.dll
[2015/10/14 14:03:37 | 000,174,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuwebv.dll
[2015/10/14 14:03:37 | 000,093,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wudriver.dll
[2015/10/14 14:03:37 | 000,073,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WinSetupUI.dll
[2015/10/14 14:03:37 | 000,035,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wups2.dll
[2015/10/14 14:03:37 | 000,035,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuapp.exe
[2015/10/14 14:03:37 | 000,030,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wups.dll
[2015/10/14 14:03:37 | 000,011,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wu.upgrade.ps.dll
[2015/10/14 14:03:30 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\appidpolicyconverter.exe
[2015/10/14 14:03:30 | 000,050,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\appidapi.dll
[2015/10/14 14:03:30 | 000,050,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\setbcdlocale.dll
[2015/10/14 14:03:30 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\appidcertstorecheck.exe
[2012/11/03 14:27:49 | 002,506,848 | ---- | C] (Microsoft Corporation) -- C:\Program Files\Installation_Messenger.exe
[2012/11/03 13:29:38 | 000,057,344 | ---- | C] (Microsoft Corporation) -- C:\Program Files\sol.exe
[3 C:\Users\Robert labeyrie\AppData\Local\*.tmp files -> C:\Users\Robert labeyrie\AppData\Local\*.tmp -> ]

[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]

[2015/11/08 12:42:23 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Robert labeyrie\Desktop\OTL.exe
[2015/11/08 12:37:29 | 000,020,880 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2015/11/08 12:37:29 | 000,020,880 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2015/11/08 12:24:00 | 000,000,318 | ---- | M] () -- C:\Windows\tasks\MySearchDial.job
[2015/11/08 12:22:00 | 000,004,508 | ---- | M] () -- C:\Windows\tasks\bfafa04e-e055-40fc-8beb-963f114c60df-4.job
[2015/11/08 12:22:00 | 000,003,488 | ---- | M] () -- C:\Windows\tasks\bfafa04e-e055-40fc-8beb-963f114c60df-1-7.job
[2015/11/08 12:22:00 | 000,002,460 | ---- | M] () -- C:\Windows\tasks\bfafa04e-e055-40fc-8beb-963f114c60df-5_user.job
[2015/11/08 12:22:00 | 000,002,460 | ---- | M] () -- C:\Windows\tasks\bfafa04e-e055-40fc-8beb-963f114c60df-5.job
[2015/11/08 12:22:00 | 000,002,126 | ---- | M] () -- C:\Windows\tasks\bfafa04e-e055-40fc-8beb-963f114c60df-10_user.job
[2015/11/08 12:17:00 | 000,001,002 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2015/11/08 12:05:00 | 000,003,146 | ---- | M] () -- C:\Windows\tasks\dd4980bd-153f-4240-8239-5cb2cd9905c2-1-6.job
[2015/11/08 12:05:00 | 000,002,120 | ---- | M] () -- C:\Windows\tasks\dd4980bd-153f-4240-8239-5cb2cd9905c2-10_user.job
[2015/11/08 11:54:01 | 000,747,644 | ---- | M] () -- C:\Windows\System32\perfh00C.dat
[2015/11/08 11:54:01 | 000,654,254 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2015/11/08 11:54:01 | 000,150,168 | ---- | M] () -- C:\Windows\System32\perfc00C.dat
[2015/11/08 11:54:01 | 000,122,126 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2015/11/08 11:44:58 | 000,017,488 | ---- | M] (Windows (R) 2000 DDK provider) -- C:\Windows\gdrv.sys
[2015/11/08 11:44:56 | 000,001,002 | ---- | M] () -- C:\Windows\tasks\globalUpdateUpdateTaskMachineCore.job
[2015/11/08 11:44:55 | 000,003,146 | ---- | M] () -- C:\Windows\tasks\dd4980bd-153f-4240-8239-5cb2cd9905c2-1-7.job
[2015/11/08 11:44:55 | 000,002,454 | ---- | M] () -- C:\Windows\tasks\dd4980bd-153f-4240-8239-5cb2cd9905c2-5_user.job
[2015/11/08 11:44:55 | 000,002,454 | ---- | M] () -- C:\Windows\tasks\dd4980bd-153f-4240-8239-5cb2cd9905c2-5.job
[2015/11/08 11:44:55 | 000,001,064 | ---- | M] () -- C:\Windows\tasks\Crossbrowse.job
[2015/11/08 11:44:48 | 000,000,268 | ---- | M] () -- C:\Windows\tasks\AutoKMS.job
[2015/11/08 11:44:41 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2015/11/08 11:44:38 | 2553,634,816 | -HS- | M] () -- C:\hiberfil.sys
[2015/11/08 09:18:14 | 000,001,006 | ---- | M] () -- C:\Windows\tasks\globalUpdateUpdateTaskMachineUA.job
[2015/11/07 19:37:10 | 000,000,349 | ---- | M] () -- C:\Users\Public\Documents\PCLECHAL.INI
[2015/11/06 19:33:55 | 000,435,464 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswsp.sys
[2015/11/06 19:33:43 | 000,794,952 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswsnx.sys
[2015/11/06 18:44:38 | 000,047,697 | ---- | M] () -- C:\HELP_DECRYPT.PNG
[2015/11/06 18:44:38 | 000,009,114 | ---- | M] () -- C:\HELP_DECRYPT.HTML
[2015/11/06 18:44:37 | 000,047,697 | ---- | M] () -- C:\Users\Robert labeyrie\HELP_DECRYPT.PNG
[2015/11/06 18:44:37 | 000,009,114 | ---- | M] () -- C:\Users\Robert labeyrie\HELP_DECRYPT.HTML
[2015/11/06 17:56:58 | 000,047,697 | ---- | M] () -- C:\Users\Robert labeyrie\Documents\HELP_DECRYPT.PNG
[2015/11/06 17:56:58 | 000,009,114 | ---- | M] () -- C:\Users\Robert labeyrie\Documents\HELP_DECRYPT.HTML
[2015/11/06 16:46:22 | 000,047,697 | ---- | M] () -- C:\Users\Robert labeyrie\AppData\Roaming\HELP_DECRYPT.PNG
[2015/11/06 16:46:22 | 000,009,114 | ---- | M] () -- C:\Users\Robert labeyrie\AppData\Roaming\HELP_DECRYPT.HTML
[2015/11/06 16:38:29 | 000,047,697 | ---- | M] () -- C:\Users\Robert labeyrie\AppData\Local\HELP_DECRYPT.PNG
[2015/11/06 16:38:29 | 000,009,114 | ---- | M] () -- C:\Users\Robert labeyrie\AppData\Local\HELP_DECRYPT.HTML
[2015/11/06 16:27:23 | 000,047,697 | ---- | M] () -- C:\Users\Public\Documents\HELP_DECRYPT.PNG
[2015/11/06 16:27:23 | 000,009,114 | ---- | M] () -- C:\Users\Public\Documents\HELP_DECRYPT.HTML
[2015/11/06 16:16:43 | 000,047,697 | ---- | M] () -- C:\ProgramData\HELP_DECRYPT.PNG
[2015/11/06 16:16:43 | 000,009,114 | ---- | M] () -- C:\ProgramData\HELP_DECRYPT.HTML
[2015/11/06 15:12:45 | 000,056,480 | ---- | M] (Cherimoya Ltd) -- C:\Windows\System32\drivers\cherimoya.sys
[2015/11/04 12:00:04 | 000,001,127 | ---- | M] () -- C:\Users\Robert labeyrie\Desktop\Mozilla Firefox.lnk
[2015/10/26 21:19:04 | 000,303,792 | ---- | M] () -- C:\Users\Robert labeyrie\Desktop\LABEYRIE Facture cuisine.pdf
[2015/10/24 09:05:00 | 000,000,004 | ---- | M] () -- C:\Windows\System32\029B560A371F4E00AB32838EBC01B9E7
[2015/10/23 18:04:04 | 000,002,372 | ---- | M] () -- C:\Users\Robert labeyrie\Application Data\Microsoft\Internet Explorer\Quick Launch\Crossbrowse.lnk
[2015/10/23 15:58:20 | 000,000,888 | ---- | M] () -- C:\task.vbs
[2015/10/23 15:57:23 | 000,000,008 | ---- | M] () -- C:\END
[2015/10/17 17:48:26 | 000,780,488 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2015/10/17 17:48:26 | 000,142,536 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2015/10/17 09:09:57 | 000,000,102 | ---- | M] () -- C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
[2015/10/15 13:22:01 | 000,003,152 | ---- | M] () -- C:\Windows\tasks\bfafa04e-e055-40fc-8beb-963f114c60df-1-6.job
[2015/10/14 16:34:32 | 000,008,192 | ---- | M] () -- C:\Users\Robert labeyrie\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[3 C:\Users\Robert labeyrie\AppData\Local\*.tmp files -> C:\Users\Robert labeyrie\AppData\Local\*.tmp -> ]

[color=#E56717]========== Files Created - No Company Name ==========[/color]

[2015/11/06 18:44:38 | 000,047,697 | ---- | C] () -- C:\HELP_DECRYPT.PNG
[2015/11/06 18:44:38 | 000,009,114 | ---- | C] () -- C:\HELP_DECRYPT.HTML
[2015/11/06 18:44:37 | 000,047,697 | ---- | C] () -- C:\Users\Robert labeyrie\HELP_DECRYPT.PNG
[2015/11/06 18:44:37 | 000,009,114 | ---- | C] () -- C:\Users\Robert labeyrie\HELP_DECRYPT.HTML
[2015/11/06 17:56:58 | 000,047,697 | ---- | C] () -- C:\Users\Robert labeyrie\Documents\HELP_DECRYPT.PNG
[2015/11/06 17:56:58 | 000,009,114 | ---- | C] () -- C:\Users\Robert labeyrie\Documents\HELP_DECRYPT.HTML
[2015/11/06 16:46:22 | 000,047,697 | ---- | C] () -- C:\Users\Robert labeyrie\AppData\Roaming\HELP_DECRYPT.PNG
[2015/11/06 16:46:22 | 000,009,114 | ---- | C] () -- C:\Users\Robert labeyrie\AppData\Roaming\HELP_DECRYPT.HTML
[2015/11/06 16:38:29 | 000,047,697 | ---- | C] () -- C:\Users\Robert labeyrie\AppData\Local\HELP_DECRYPT.PNG
[2015/11/06 16:38:29 | 000,009,114 | ---- | C] () -- C:\Users\Robert labeyrie\AppData\Local\HELP_DECRYPT.HTML
[2015/11/06 16:27:23 | 000,047,697 | ---- | C] () -- C:\Users\Public\Documents\HELP_DECRYPT.PNG
[2015/11/06 16:27:23 | 000,009,114 | ---- | C] () -- C:\Users\Public\Documents\HELP_DECRYPT.HTML
[2015/11/06 16:16:43 | 000,047,697 | ---- | C] () -- C:\ProgramData\HELP_DECRYPT.PNG
[2015/11/06 16:16:43 | 000,009,114 | ---- | C] () -- C:\ProgramData\HELP_DECRYPT.HTML
[2015/11/04 12:00:04 | 000,001,127 | ---- | C] () -- C:\Users\Robert labeyrie\Desktop\Mozilla Firefox.lnk
[2015/10/27 10:49:48 | 000,001,127 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2015/10/26 21:11:56 | 000,303,792 | ---- | C] () -- C:\Users\Robert labeyrie\Desktop\LABEYRIE Facture cuisine.pdf
[2015/10/23 18:06:07 | 000,002,454 | ---- | C] () -- C:\Windows\tasks\dd4980bd-153f-4240-8239-5cb2cd9905c2-5_user.job
[2015/10/23 18:06:05 | 000,002,454 | ---- | C] () -- C:\Windows\tasks\dd4980bd-153f-4240-8239-5cb2cd9905c2-5.job
[2015/10/23 18:05:47 | 000,003,146 | ---- | C] () -- C:\Windows\tasks\dd4980bd-153f-4240-8239-5cb2cd9905c2-1-6.job
[2015/10/23 18:05:44 | 000,003,146 | ---- | C] () -- C:\Windows\tasks\dd4980bd-153f-4240-8239-5cb2cd9905c2-1-7.job
[2015/10/23 18:05:37 | 000,002,120 | ---- | C] () -- C:\Windows\tasks\dd4980bd-153f-4240-8239-5cb2cd9905c2-10_user.job
[2015/10/23 18:03:50 | 000,001,064 | ---- | C] () -- C:\Windows\tasks\Crossbrowse.job
[2015/10/23 18:03:44 | 000,002,372 | ---- | C] () -- C:\Users\Robert labeyrie\Application Data\Microsoft\Internet Explorer\Quick Launch\Crossbrowse.lnk
[2015/10/23 14:22:26 | 000,001,006 | ---- | C] () -- C:\Windows\tasks\globalUpdateUpdateTaskMachineUA.job
[2015/10/23 14:22:20 | 000,001,002 | ---- | C] () -- C:\Windows\tasks\globalUpdateUpdateTaskMachineCore.job
[2015/10/17 09:10:35 | 000,000,888 | ---- | C] () -- C:\task.vbs
[2015/10/15 09:48:30 | 000,000,102 | ---- | C] () -- C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
[2015/04/08 14:35:35 | 000,000,165 | ---- | C] () -- C:\Windows\Reimage.ini
[2014/07/20 11:49:46 | 000,568,896 | ---- | C] () -- C:\Windows\System32\new_OrangeInstaller.exe
[2014/05/21 17:51:02 | 000,001,456 | ---- | C] () -- C:\Users\Robert labeyrie\AppData\Local\Adobe Enregistrer pour le Web 13.0 Prefs
[2013/11/06 10:23:57 | 000,351,124 | ---- | C] () -- C:\Users\Robert labeyrie\AppData\Local\mysearchdial-speeddial.crx
[2013/01/03 11:50:03 | 000,008,192 | ---- | C] () -- C:\Users\Robert labeyrie\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/11/03 11:59:54 | 001,563,724 | ---- | C] () -- C:\Program Files\icarbonsetup.exe

[color=#E56717]========== ZeroAccess Check ==========[/color]

[2009/07/14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2015/08/06 18:44:51 | 012,875,776 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 03:19:04 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009/07/14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[color=#E56717]========== LOP Check ==========[/color]

[2015/11/06 16:16:53 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\AVAST Software
[2015/11/06 16:16:53 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\AVAST Software
[2015/11/06 16:50:01 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\.minecraft
[2015/04/24 16:09:05 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\00000000-1429439044-0000-0000-902B34327BF3
[2015/10/16 09:36:17 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\00000000-1429443070-0000-0000-902B34327BF3
[2015/11/06 16:54:56 | 000,000,000 | -HSD | M] -- C:\Users\Robert labeyrie\AppData\Roaming\AnyProtectEx
[2012/12/17 18:13:48 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\APP_NAME_NON_STRING
[2014/03/22 11:49:29 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\ArchiFacile
[2015/10/15 17:31:51 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\ASPackage
[2015/11/06 16:43:16 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\AVAST Software
[2015/11/06 16:44:23 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\Babylon
[2015/11/06 16:45:32 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
[2015/11/04 12:25:34 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\cpuminer
[2014/03/25 11:16:25 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\eTeks
[2015/11/06 16:57:27 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\fr.orange.assistancelivebox
[2015/11/06 16:57:13 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\Infigo
[2015/09/11 18:40:12 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\java
[2012/11/04 12:48:16 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\Leadertech
[2013/01/21 13:07:13 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\LiveCAD3
[2013/02/26 15:49:39 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\MusicNet
[2015/11/06 16:55:27 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\MyHeritage
[2013/11/06 10:28:44 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\mysearchdial
[2015/10/17 09:09:55 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\mystartsearch
[2015/10/15 09:48:14 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\NetService
[2014/03/25 11:06:04 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\OpenCandy
[2015/10/18 09:54:17 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\Opera Software
[2015/11/06 16:45:04 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\Orange
[2015/11/06 15:13:24 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\ortmp
[2013/02/15 11:43:28 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\PCCUStubInstaller
[2012/10/31 18:55:38 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\PDAppFlex
[2012/12/17 18:22:51 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\PDF Architect
[2015/04/27 07:57:28 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\PDF Architect 2
[2015/04/13 13:53:30 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\PDF Architect 3
[2012/12/07 09:47:31 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\PDF Pro 10
[2015/04/21 10:47:40 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\pdfforge
[2015/02/26 10:50:30 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\PDManager
[2014/05/21 19:16:37 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\PhotoFiltre
[2015/10/14 14:20:51 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\RPEng
[2015/10/15 17:35:29 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\RunDir
[2012/11/03 12:05:16 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\SolSuite
[2015/04/19 14:37:10 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\Splashtop
[2013/10/17 10:34:17 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2015/04/19 12:44:12 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\Store
[2014/02/14 09:53:05 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\Systweak
[2013/05/06 09:32:42 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\The Complete Genealogy Reporter - FTB
[2014/03/25 11:09:46 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\TuneUp Software
[2015/04/19 12:45:08 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\WTools
[2015/04/08 14:44:53 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\YCanPDF
[2015/11/08 12:40:10 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\ZHP

[color=#E56717]========== Custom Scans ==========[/color]

[color=#A23BEC]< MD5 for: EXPLORER.EXE >[/color]
[2011/02/26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe
[2009/07/14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe
[2011/02/26 06:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_525b5180f3f95373\explorer.exe
[2011/02/26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_51a3a583dafd0cef\explorer.exe
[2010/11/20 03:17:10 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe
[2011/02/25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\explorer.exe
[2011/02/25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe

[color=#A23BEC]< MD5 for: SERVICES.EXE >[/color]
[2015/04/13 04:19:24 | 000,259,072 | ---- | M] (Microsoft Corporation) MD5=0780A42DBD7D9969F9BF4A19AA4285B5 -- C:\Windows\System32\services.exe
[2015/04/13 04:19:24 | 000,259,072 | ---- | M] (Microsoft Corporation) MD5=0780A42DBD7D9969F9BF4A19AA4285B5 -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7601.18829_none_d1614ac32b8ec5cf\services.exe
[2009/07/14 02:14:36 | 000,259,072 | ---- | M] (Microsoft Corporation) MD5=5F1B6A9C35D3D5CA72D6D6FDEF9747D6 -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\services.exe
[2015/04/11 04:53:55 | 000,259,072 | ---- | M] (Microsoft Corporation) MD5=97981140500E86E5BBAD7B76BA890146 -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7601.23033_none_d1d9ee0844ba1cc2\services.exe

[color=#A23BEC]< MD5 for: USERINIT.EXE >[/color]
[2010/11/20 03:17:50 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe
[2010/11/20 03:17:50 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/07/14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

[color=#A23BEC]< MD5 for: WININIT.EXE >[/color]
[2009/07/14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe
[2009/07/14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

[color=#A23BEC]< MD5 for: WINLOGON.EXE >[/color]
[2014/07/16 03:56:14 | 000,304,640 | ---- | M] (Microsoft Corporation) MD5=4F37B93C14AEE313BEC52A23AFB15C2E -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.22750_none_7224b2134c7555fa\winlogon.exe
[2014/07/17 02:39:27 | 000,304,128 | ---- | M] (Microsoft Corporation) MD5=52449FD429D6053B78AE564DEF303870 -- C:\Windows\System32\winlogon.exe
[2014/07/17 02:39:27 | 000,304,128 | ---- | M] (Microsoft Corporation) MD5=52449FD429D6053B78AE564DEF303870 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.18540_none_71a5e34e334f9d18\winlogon.exe
[2010/11/20 03:17:56 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2009/07/14 02:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
[2014/03/04 10:17:02 | 000,304,128 | ---- | M] (Microsoft Corporation) MD5=998507B046BA314CE8245364C686FA67 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.18409_none_71da23b23327143c\winlogon.exe
[2014/03/04 11:39:02 | 000,304,640 | ---- | M] (Microsoft Corporation) MD5=D53972F87D850CD2EB4B29B60CAFDD77 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.22616_none_7255f1994c4f8119\winlogon.exe

[color=#A23BEC]< %SYSTEMDRIVE%\*.exe >[/color]

[color=#A23BEC]< %ALLUSERSPROFILE%\Application Data\*. >[/color]

[color=#A23BEC]< %ALLUSERSPROFILE%\Application Data\*.exe /s >[/color]

[color=#A23BEC]< %APPDATA%\*. >[/color]
[2015/11/06 16:50:01 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\.minecraft
[2015/04/24 16:09:05 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\00000000-1429439044-0000-0000-902B34327BF3
[2015/10/16 09:36:17 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\00000000-1429443070-0000-0000-902B34327BF3
[2015/11/06 16:44:01 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\Adobe
[2015/11/06 16:54:56 | 000,000,000 | -HSD | M] -- C:\Users\Robert labeyrie\AppData\Roaming\AnyProtectEx
[2012/12/17 18:13:48 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\APP_NAME_NON_STRING
[2014/03/22 11:49:29 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\ArchiFacile
[2015/10/15 17:31:51 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\ASPackage
[2012/10/26 13:32:02 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\ATI
[2015/11/06 16:43:16 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\AVAST Software
[2015/11/06 16:44:23 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\Babylon
[2015/11/06 16:45:32 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
[2015/11/04 12:25:34 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\cpuminer
[2013/08/24 18:27:59 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\dvdcss
[2014/03/25 11:16:25 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\eTeks
[2015/11/06 16:57:27 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\fr.orange.assistancelivebox
[2013/01/21 14:12:55 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\Google
[2012/10/26 12:59:11 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\Identities
[2015/11/06 16:57:13 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\Infigo
[2012/10/26 13:14:25 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\InstallShield
[2015/11/06 16:45:10 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\Intelli-studio
[2015/09/11 18:40:12 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\java
[2012/11/04 12:48:16 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\Leadertech
[2013/01/21 13:07:13 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\LiveCAD3
[2012/10/30 19:42:40 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\Macromedia
[2009/07/14 10:00:32 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\Media Center Programs
[2015/11/06 16:43:27 | 000,000,000 | --SD | M] -- C:\Users\Robert labeyrie\AppData\Roaming\Microsoft
[2015/11/06 16:43:46 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\Mozilla
[2013/02/26 15:49:39 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\MusicNet
[2015/11/06 16:55:27 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\MyHeritage
[2013/11/06 10:28:44 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\mysearchdial
[2015/10/17 09:09:55 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\mystartsearch
[2015/10/15 09:48:14 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\NetService
[2015/04/19 11:25:49 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\Nosibay
[2014/03/25 11:06:04 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\OpenCandy
[2015/10/18 09:54:17 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\Opera Software
[2015/11/06 16:45:04 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\Orange
[2015/11/06 15:13:24 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\ortmp
[2013/02/15 11:43:28 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\PCCUStubInstaller
[2012/10/31 18:55:38 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\PDAppFlex
[2012/12/17 18:22:51 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\PDF Architect
[2015/04/27 07:57:28 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\PDF Architect 2
[2015/04/13 13:53:30 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\PDF Architect 3
[2012/12/07 09:47:31 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\PDF Pro 10
[2015/04/21 10:47:40 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\pdfforge
[2015/02/26 10:50:30 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\PDManager
[2014/05/21 19:16:37 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\PhotoFiltre
[2015/10/14 14:20:51 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\RPEng
[2015/10/15 17:35:29 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\RunDir
[2015/11/06 16:47:23 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\Skype
[2012/11/03 12:05:16 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\SolSuite
[2015/04/19 14:37:10 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\Splashtop
[2013/10/17 10:34:17 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2015/04/19 12:44:12 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\Store
[2014/02/14 09:53:05 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\Systweak
[2013/05/06 09:32:42 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\The Complete Genealogy Reporter - FTB
[2014/03/25 11:09:46 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\TuneUp Software
[2014/07/10 19:01:13 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\vlc
[2015/04/19 12:45:08 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\WTools
[2015/04/08 14:44:53 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\YCanPDF
[2015/11/08 12:40:10 | 000,000,000 | ---D | M] -- C:\Users\Robert labeyrie\AppData\Roaming\ZHP

[color=#A23BEC]< %APPDATA%\*.exe /s >[/color]
[2015/04/19 11:24:05 | 000,081,884 | ---- | M] ( ) -- C:\Users\Robert labeyrie\AppData\Roaming\00000000-1429439044-0000-0000-902B34327BF3\Uninstall.exe
[1 C:\Users\Robert labeyrie\AppData\Roaming\00000000-1429439044-0000-0000-902B34327BF3\*.tmp files -> C:\Users\Robert labeyrie\AppData\Roaming\00000000-1429439044-0000-0000-902B34327BF3\*.tmp -> ]
[2015/04/19 12:31:10 | 000,081,884 | ---- | M] ( ) -- C:\Users\Robert labeyrie\AppData\Roaming\00000000-1429443070-0000-0000-902B34327BF3\Uninstall.exe
[1 C:\Users\Robert labeyrie\AppData\Roaming\00000000-1429443070-0000-0000-902B34327BF3\*.tmp files -> C:\Users\Robert labeyrie\AppData\Roaming\00000000-1429443070-0000-0000-902B34327BF3\*.tmp -> ]
[2015/05/24 09:07:15 | 000,054,432 | ---- | M] (Adobe Systems Inc.) -- C:\Users\Robert labeyrie\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2013/01/02 22:40:57 | 000,029,926 | R--- | M] () -- C:\Users\Robert labeyrie\AppData\Roaming\Microsoft\Installer\{6DE721A5-5E89-4D74-994C-652BB3C0672E}\ARPPRODUCTICON.exe
[2013/04/23 22:02:14 | 000,113,696 | ---- | M] () -- C:\Users\Robert labeyrie\AppData\Roaming\MyHeritage\Bin\Convert\Convertor.exe
[2013/04/23 22:02:14 | 000,113,696 | ---- | M] () -- C:\Users\Robert labeyrie\AppData\Roaming\MyHeritage\Bin\Convert\ConvertorFDB.exe
[2013/04/23 22:02:18 | 000,047,120 | ---- | M] () -- C:\Users\Robert labeyrie\AppData\Roaming\MyHeritage\Bin\Convert\depcheck.exe
[2013/04/23 21:06:14 | 000,110,592 | ---- | M] () -- C:\Users\Robert labeyrie\AppData\Roaming\MyHeritage\Bin\Convert\gbtest.exe
[2013/04/23 21:05:56 | 000,058,896 | ---- | M] () -- C:\Users\Robert labeyrie\AppData\Roaming\MyHeritage\Bin\Detect\Detect.exe
[2015/07/09 02:26:02 | 000,173,088 | ---- | M] () -- C:\Users\Robert labeyrie\AppData\Roaming\NetService\netservice.exe
[2015/07/09 02:25:51 | 000,114,720 | ---- | M] () -- C:\Users\Robert labeyrie\AppData\Roaming\NetService\sc.exe
[2013/09/18 02:07:26 | 033,026,984 | ---- | M] (TuneUp Software) -- C:\Users\Robert labeyrie\AppData\Roaming\OpenCandy\AAFAACA20CE04CE1987EF7A5893E0B11\Trial-14.0.1000.93_fr-FR_1004731_FR.exe
[2014/03/11 14:53:28 | 000,568,896 | ---- | M] () -- C:\Users\Robert labeyrie\AppData\Roaming\Orange\OrangeInside\OrangeInstall.exe
[2014/07/20 13:13:30 | 000,192,536 | ---- | M] () -- C:\Users\Robert labeyrie\AppData\Roaming\Orange\OrangeInside\uninstall.exe
[2014/06/10 09:45:10 | 001,553,560 | ---- | M] (Orange) -- C:\Users\Robert labeyrie\AppData\Roaming\Orange\OrangeInside\one\OrangeInside.exe
[2015/11/06 14:56:06 | 000,233,832 | ---- | M] () -- C:\Users\Robert labeyrie\AppData\Roaming\ortmp\uninstaller.exe
[2012/10/10 14:29:02 | 000,828,376 | ---- | M] (Symantec Corporation) -- C:\Users\Robert labeyrie\AppData\Roaming\PCCUStubInstaller\SymcPCCUInstaller.exe
[2015/10/14 14:20:53 | 000,299,048 | ---- | M] () -- C:\Users\Robert labeyrie\AppData\Roaming\RPEng\6F1EB2DE63464902A054261DD87BC7ED\setup.exe
[2015/10/14 14:24:07 | 028,633,912 | ---- | M] (TuneUp Software) -- C:\Users\Robert labeyrie\AppData\Roaming\RPEng\76C65B285004415E9BB321A8CDD35604\TUU2014-FR-1day-AID1006172.exe
[2015/10/14 14:21:26 | 000,299,096 | ---- | M] () -- C:\Users\Robert labeyrie\AppData\Roaming\RPEng\F8E2DFC7159B4E6FA96891DAB643F4AD\setup.exe
[2015/07/21 08:59:54 | 000,297,240 | ---- | M] () -- C:\Users\Robert labeyrie\AppData\Roaming\RunDir\autoupdate.exe
[2015/07/21 10:06:36 | 000,265,160 | ---- | M] () -- C:\Users\Robert labeyrie\AppData\Roaming\RunDir\execute.exe
[2015/07/21 08:59:54 | 000,297,240 | ---- | M] () -- C:\Users\Robert labeyrie\AppData\Roaming\RunDir\temp\autoupdate.exe
[2015/07/21 10:06:36 | 000,265,160 | ---- | M] () -- C:\Users\Robert labeyrie\AppData\Roaming\RunDir\temp\execute.exe
[2014/01/21 17:25:12 | 000,644,552 | ---- | M] (Systweak Software ) -- C:\Users\Robert labeyrie\AppData\Roaming\Systweak\ssd\SSDPTstub.exe
[2015/11/08 12:27:18 | 001,965,568 | ---- | M] () -- C:\Users\Robert labeyrie\AppData\Roaming\ZHP\ZHPDiag3.exe

[color=#A23BEC]< %systemroot%\*. /mp /s >[/color]

[color=#A23BEC]< %systemroot%\system32\*.dll /lockedfiles >[/color]
[2012/04/06 03:16:52 | 000,442,368 | ---- | M] (Advanced Micro Devices, Inc.)[b] Unable to obtain MD5[/b] -- C:\Windows\system32\ATIDEMGX.dll
[2012/04/06 02:34:04 | 006,203,392 | ---- | M] (Advanced Micro Devices, Inc. )[b] Unable to obtain MD5[/b] -- C:\Windows\system32\atiumdag.dll

[color=#A23BEC]< %systemroot%\syswow64\*.dll /lockedfiles >[/color]

[color=#A23BEC]< %systemroot%\Tasks\*.job /lockedfiles >[/color]

[color=#A23BEC]< %systemroot%\system32\drivers\*.sys /lockedfiles >[/color]

[color=#A23BEC]< %systemroot%\syswow64\drivers\*.sys /lockedfiles >[/color]

[color=#A23BEC]< hklm\software\clients\startmenuinternet|command /rs >[/color]
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\HideIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /HideShortcuts [2015/11/05 11:05:51 | 000,916,744 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ShowIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /ShowShortcuts [2015/11/05 11:05:51 | 000,916,744 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ReinstallCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal [2015/11/05 11:05:51 | 000,916,744 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\open\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" [2015/11/05 11:05:51 | 000,392,872 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\properties\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -preferences [2015/11/05 11:05:51 | 000,392,872 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\safemode\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode [2015/11/05 11:05:51 | 000,392,872 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\Windows\System32\ie4uinit.exe" -show [2015/04/21 16:26:01 | 000,685,568 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\Windows\System32\ie4uinit.exe" -reinstall [2015/04/21 16:26:01 | 000,685,568 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\Windows\System32\ie4uinit.exe" -hide [2015/04/21 16:26:01 | 000,685,568 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2015/04/22 02:48:29 | 000,815,304 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: C:\Program Files\Internet Explorer\iexplore.exe http://www.sweet-page.com/?type=sc&ts=1428500525&from=corfr&uid=WDCXWD7500AADS-11M2B1_WD-WCAV5442982829828 [2015/04/22 02:48:29 | 000,815,304 | ---- | M] (Microsoft Corporation)

[color=#A23BEC]< hklm\software\clients\startmenuinternet|command /64 /rs >[/color]
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\HideIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /HideShortcuts [2015/11/05 11:05:51 | 000,916,744 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ShowIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /ShowShortcuts [2015/11/05 11:05:51 | 000,916,744 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ReinstallCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal [2015/11/05 11:05:51 | 000,916,744 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\open\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" [2015/11/05 11:05:51 | 000,392,872 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\properties\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -preferences [2015/11/05 11:05:51 | 000,392,872 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\safemode\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode [2015/11/05 11:05:51 | 000,392,872 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\Windows\System32\ie4uinit.exe" -show [2015/04/21 16:26:01 | 000,685,568 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\Windows\System32\ie4uinit.exe" -reinstall [2015/04/21 16:26:01 | 000,685,568 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\Windows\System32\ie4uinit.exe" -hide [2015/04/21 16:26:01 | 000,685,568 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2015/04/22 02:48:29 | 000,815,304 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: C:\Program Files\Internet Explorer\iexplore.exe http://www.sweet-page.com/?type=sc&ts=1428500525&from=corfr&uid=WDCXWD7500AADS-11M2B1_WD-WCAV5442982829828 [2015/04/22 02:48:29 | 000,815,304 | ---- | M] (Microsoft Corporation)

< End of report >

Publicité


Signaler le contenu de ce document

Publicité