Publicité
Publicité
Format du document : text/plain
Prévisualisation
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 14-09-2017 01
Ran by Adrian (administrator) on ADRIAN-PC (15-09-2017 10:46:32)
Running from C:\Users\Adrian\Desktop
Loaded Profiles: Adrian (Available Profiles: Adrian & Guest)
Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Dell Inc.) C:\Program Files\Dell\DW WLAN Card\WLTRYSVC.EXE
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Dell Inc.) C:\Program Files\Dell\DW WLAN Card\BCMWLTRY.EXE
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Dell Inc.) C:\Program Files\Dell\DW WLAN Card\WLTRAY.EXE
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Disc Soft Ltd) C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ====================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6846096 2012-11-19] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1253520 2012-11-19] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2796272 2013-11-22] (Synaptics Incorporated)
HKLM\...\Run: [Broadcom Wireless Manager UI] => C:\Program Files\Dell\DW WLAN Card\WLTRAY.exe [8921600 2014-07-23] (Dell Inc.)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-30] (Intel Corporation)
HKLM\...\Run: [QuickSet] => C:\Program Files\Dell\QuickSet\QuickSet.exe [5762408 2013-03-05] (Dell Inc.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292088 2013-02-23] (Intel Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2016-12-12] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\ScCertProp: wlnotify.dll [X]
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8551848 2015-10-19] (Piriform Ltd)
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\Run: [DAEMON Tools Lite Automount] => C:\Program Files\DAEMON Tools Lite\DTAgent.exe [4179288 2015-11-30] (Disc Soft Ltd)
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\Run: [HideMyIPSh] => "C:\Program Files (x86)\Hide My IP 6\HideMyIP.exe" /sh
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7963552 2017-07-12] (SUPERAntiSpyware)
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\Run: [TomTomHOME.exe] => "C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe"
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\Run: [MyDriveConnect.exe] => C:\Program Files (x86)\MyDrive Connect\TomTom MyDrive Connect.exe -startwithoutDA
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {4fe6a65d-9be5-11e5-b871-ecf4bb0c7e4f} - E:\autorun.exe
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {5c2ccd63-3cd8-11e4-be48-f82fa8dc94ee} - E:\AutoRun.exe
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {671b4005-fdf6-11e6-b49a-ecf4bb0c7e4f} - E:\Startme.exe
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {6ee1dae3-3cb5-11e4-a984-f82fa8dc94ee} - E:\AutoRun.exe
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {6ee1daf3-3cb5-11e4-a984-f82fa8dc94ee} - E:\AutoRun.exe
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {89376eda-793e-11e4-8c8b-f82fa8dc94ee} - E:\AutoRun.exe
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {9623956b-3b59-11e4-9af1-f82fa8dc94ee} - E:\AutoRun.exe
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {abf5f654-731c-11e4-8cb8-f82fa8dc94ee} - E:\unlock.exe autoplay=true
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {c17db7f3-ef63-11e4-9037-ecf4bb0c7e4f} - E:\autorun.exe
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {d4ae93aa-ae22-11e5-897c-ecf4bb0c7e4f} - F:\autorun.exe
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {e5909313-f7c6-11e4-aa6e-ecf4bb0c7e4f} - E:\Startme.exe
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {fafbe510-26ac-11e4-88ef-f82fa8dc94ee} - E:\LG_PC_Programs.exe
Lsa: [Notification Packages] scecli C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
ShellExecuteHooks: No Name - {5F51FFFE-7463-4220-B711-E5B9ACB8EDFE} - C:\Users\Adrian\AppData\Roaming\tmp546.dat [1952256 2017-08-25] ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2016-06-10]
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{12AA26AC-4392-403A-9A14-02CD4B939AC0}: [DhcpNameServer] 192.168.2.1
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = www.bing.com
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\Software\Microsoft\Internet Explorer\Main,Start Page =
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\ssv.dll [2017-03-14] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-03-14] (Oracle Corporation)
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
FireFox:
========
FF ProfilePath: C:\Users\Adrian\AppData\Roaming\TomTom\HOME\Profiles\urd9ga9k.default [2017-06-01]
FF ProfilePath: C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\xe3igf5m.default-1485454395780 [2017-09-15]
FF Extension: (Parental Control: Porn Blocker) - C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\xe3igf5m.default-1485454395780\Extensions\@parental-control-porn-blocker.xpi [2017-09-15]
FF Extension: (Save Images) - C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\xe3igf5m.default-1485454395780\Extensions\LDSI_plashcor@gmail.com.xpi [2017-09-15]
FF Extension: (Video DownloadHelper) - C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\xe3igf5m.default-1485454395780\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2017-07-06]
FF Extension: (Flash and Video Download) - C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\xe3igf5m.default-1485454395780\Extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a} [2017-09-06]
FF Extension: (Photon onboarding) - C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\xe3igf5m.default-1485454395780\features\{da3034fa-9d27-42b4-a93f-b692313764ed}\onboarding@mozilla.org.xpi [2017-09-13]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_27_0_0_130.dll [2017-09-13] ()
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll [2014-07-25] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_27_0_0_130.dll [2017-09-13] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.121.2 -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll [2017-03-14] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.121.2 -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\plugin2\npjp2.dll [2017-03-14] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll [2014-07-25] (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-08-01] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2016-12-23] (Adobe Systems Inc.)
Chrome:
=======
CHR Profile: C:\Users\Adrian\AppData\Local\Google\Chrome\User Data\Default [2017-09-14]
CHR Extension: (Skype) - C:\Users\Adrian\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2017-09-11]
CHR Extension: (Paiements via le Chrome Web Store) - C:\Users\Adrian\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-09-11]
CHR Extension: (Chrome Media Router) - C:\Users\Adrian\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-09-11]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2015-10-12]
Opera:
=======
OPR Extension: (Adult Blocker) - C:\Users\Adrian\AppData\Roaming\Opera Software\Opera Stable\Extensions\neopaobcplailacdmjplehdnhhdacocl [2016-11-03]
OPR Extension: (Adblock Plus) - C:\Users\Adrian\AppData\Roaming\Opera Software\Opera Stable\Extensions\oidhhegpmlfpoeialbgcdocjalghfpkp [2017-01-16]
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [173472 2017-01-31] (SUPERAntiSpyware.com)
R3 Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe [1368408 2015-11-30] (Disc Soft Ltd)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-30] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201872 2012-11-23] (Realtek Semiconductor)
R2 wltrysvc; C:\Program Files\Dell\DW WLAN Card\bcmwltry.exe [6170624 2014-07-23] (Dell Inc.) [File not signed]
R2 wtmkussrv; C:\Windows\SysWow64\wtmkussrv.dll [473384 2016-03-18] ()
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [31920 2014-04-09] (Wondershare)
S3 atrfiltr; C:\Windows\System32\DRIVERS\atrfiltr.sys [16224 2014-09-11] (Windows (R) Win 7 DDK provider)
S3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [170200 2014-07-23] (Broadcom Corporation.)
S3 cxbu0x64; C:\Windows\System32\DRIVERS\cxbu0x64.sys [191224 2014-05-14] (HID Global Corporation)
R3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [30264 2015-12-06] (Disc Soft Ltd)
R3 dtliteusbbus; C:\Windows\System32\DRIVERS\dtliteusbbus.sys [46392 2015-12-06] (Disc Soft Ltd)
R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [44744 2015-05-08] (AnchorFree Inc.)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-08-30] (Intel Corporation)
S3 jakstaVA; C:\Windows\System32\DRIVERS\jaksta_va.sys [103816 2014-12-09] (e2eSoft)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-06-18] (Malwarebytes Corporation)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-13] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S4 secdrv; C:\Windows\SysWow64\Drivers\secdrv.sys [11973 2016-12-28] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [File not signed]
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [31472 2013-11-22] (Synaptics Incorporated)
R3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42064 2016-05-27] (Anchorfree Inc.)
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()
R1 wtmksyssrv; C:\Windows\system32\drivers\wtmhdnkernel.sys [226856 2016-03-18] ()
S3 EsgScanner; system32\DRIVERS\EsgScanner.sys [X]
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [X]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S1 LanmaMaster; \??\C:\Windows\system32\drivers\lanmamaster.sys [X] <==== ATTENTION
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-09-15 10:46 - 2017-09-15 10:46 - 000000000 ____D C:\Users\Adrian\Desktop\FRST-OlderVersion
2017-09-14 21:10 - 2017-09-14 21:10 - 000002220 _____ C:\Users\Public\Desktop\L'Entraineur - Saison 97-98.lnk
2017-09-14 21:10 - 2017-09-14 21:10 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\Abandonware-France
2017-09-14 21:10 - 2017-09-14 21:10 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Abandonware-France
2017-09-14 21:07 - 2017-09-14 21:08 - 074189696 _____ (Abandonware-France ) C:\Users\Adrian\Downloads\setup-01693-L_Entraineur97_98-Dosbox.exe
2017-09-14 21:05 - 2017-09-14 21:05 - 001448809 _____ (DOSBox Team) C:\Users\Adrian\Downloads\DOSBox0.74-win32-installer.exe
2017-09-14 21:05 - 2017-09-14 21:05 - 000001882 _____ C:\Users\Public\Desktop\DOSBox 0.74.lnk
2017-09-14 21:05 - 2017-09-14 21:05 - 000000000 ____D C:\Program Files (x86)\DOSBox-0.74
2017-09-14 21:02 - 2017-09-14 21:02 - 012183769 _____ C:\Users\Adrian\Downloads\championshipman9697_dos_win.7z
2017-09-14 20:41 - 2017-09-14 20:59 - 000012192 _____ C:\Users\Adrian\Desktop\nestopia.cfg
2017-09-14 20:41 - 2017-09-14 20:41 - 000000000 ____D C:\Users\Adrian\Desktop\states
2017-09-14 20:41 - 2017-09-14 20:41 - 000000000 ____D C:\Users\Adrian\Desktop\scripts
2017-09-14 20:41 - 2017-09-14 20:41 - 000000000 ____D C:\Users\Adrian\Desktop\screenshots
2017-09-14 20:41 - 2017-09-14 20:41 - 000000000 ____D C:\Users\Adrian\Desktop\save
2017-09-14 20:41 - 2017-09-14 20:41 - 000000000 ____D C:\Users\Adrian\Desktop\samples
2017-09-14 20:41 - 2017-09-14 20:41 - 000000000 ____D C:\Users\Adrian\Desktop\ips
2017-09-14 20:41 - 2010-01-25 19:10 - 001009933 _____ C:\Users\Adrian\Desktop\Nes_Nestopia.zip
2017-09-14 20:41 - 2010-01-25 18:33 - 000228825 _____ C:\Users\Adrian\Desktop\Nes_Super_Mario_Bros_3.zip
2017-09-14 20:41 - 2006-07-07 14:16 - 000000540 _____ C:\Users\Adrian\Desktop\Lisez moi.txt
2017-09-14 20:41 - 2006-07-07 14:15 - 000000000 ____D C:\Users\Adrian\Desktop\language
2017-09-14 20:41 - 2006-07-07 14:01 - 001540608 _____ C:\Users\Adrian\Desktop\nestopia.exe
2017-09-14 20:41 - 2006-07-06 13:46 - 000041106 _____ C:\Users\Adrian\Desktop\changelog.txt
2017-09-14 20:41 - 2006-07-06 12:59 - 000092259 _____ C:\Users\Adrian\Desktop\readme.html
2017-09-14 20:41 - 2006-06-22 19:56 - 000015402 _____ C:\Users\Adrian\Desktop\copying.txt
2017-09-14 20:41 - 2006-05-25 16:52 - 000162304 _____ C:\Users\Adrian\Desktop\unrar.dll
2017-09-14 20:41 - 2006-05-14 06:25 - 000169984 _____ C:\Users\Adrian\Desktop\7zxa.dll
2017-09-14 20:41 - 2005-09-13 23:14 - 000032256 _____ C:\Users\Adrian\Desktop\kailleraclient.dll
2017-09-14 18:53 - 2017-09-14 18:59 - 000000000 ____D C:\Users\Adrian\Downloads\Latte E Miele
2017-09-14 18:52 - 2017-09-14 18:52 - 000000000 ____D C:\Users\Adrian\Downloads\Ibis
2017-09-14 18:50 - 2017-09-14 18:50 - 000000000 ____D C:\Users\Adrian\Downloads\Hunka Munka
2017-09-14 18:47 - 2017-09-14 18:47 - 000000000 ____D C:\Users\Adrian\Downloads\Finisterre
2017-09-14 18:19 - 2017-09-14 18:19 - 000000000 ____D C:\Users\Public\Documents\XMUpdate
2017-09-14 18:09 - 2017-09-14 18:09 - 008182736 _____ (Malwarebytes) C:\Users\Adrian\Desktop\adwcleaner_7.0.2.1.exe
2017-09-14 10:40 - 2017-09-14 10:40 - 002869632 _____ C:\Users\Adrian\Desktop\zhpcleaner_2017.8.31.148 (1).exe
2017-09-14 02:23 - 2017-09-14 02:23 - 000000000 ____D C:\Users\Adrian\Downloads\mbid-0ebb7bc0-933d-431f-9a91-7c4644c674ee
2017-09-13 20:30 - 2017-09-13 20:58 - 000029321 _____ C:\Users\Adrian\Desktop\Addition.txt
2017-09-13 20:24 - 2017-09-15 10:55 - 000017053 _____ C:\Users\Adrian\Desktop\FRST.txt
2017-09-13 20:24 - 2017-09-15 10:46 - 000000000 ____D C:\FRST
2017-09-13 20:23 - 2017-09-15 10:46 - 002398208 _____ (Farbar) C:\Users\Adrian\Desktop\FRST64.exe
2017-09-11 10:27 - 2017-09-11 10:27 - 000000000 ____D C:\Users\Adrian\Downloads\OMD
2017-09-09 14:26 - 2017-09-09 14:26 - 000197017 _____ C:\Users\Adrian\Downloads\1991_Catfish_Rising.pdf
2017-09-09 13:16 - 2017-09-09 13:16 - 000000114 _____ C:\Users\Adrian\Documents\Boston.txt
2017-09-09 11:34 - 2017-09-09 11:35 - 000000000 ____D C:\Users\Adrian\Downloads\Stone Of A Bitch
2017-09-09 11:33 - 2017-09-11 13:43 - 000000000 ____D C:\Users\Adrian\Downloads\Daisy Driver
2017-09-09 11:32 - 2017-09-09 11:44 - 418696037 _____ C:\Users\Adrian\Downloads\OMD.zip
2017-09-09 11:22 - 2017-09-09 11:23 - 000000000 ____D C:\Users\Adrian\Downloads\Stömb
2017-09-09 10:59 - 2017-07-13 13:39 - 000000000 ____D C:\Users\Adrian\Downloads\L'Anima
2017-09-09 10:59 - 2016-03-31 17:39 - 000000000 ____D C:\Users\Adrian\Downloads\1988 - The tenement year [2007, Mercury, 9846251]
2017-09-09 10:55 - 2017-09-02 05:37 - 000000000 ____D C:\Users\Adrian\Downloads\Kaipa__Children_Of_The_Sounds
2017-09-09 10:26 - 2017-09-09 10:26 - 000004100 _____ C:\Users\Adrian\Desktop\AdwCleaner[S2].txt
2017-09-09 10:06 - 2017-09-09 10:06 - 008182736 _____ (Malwarebytes) C:\Users\Adrian\Downloads\adwcleaner_7.0.2.1.exe
2017-09-09 09:57 - 2017-09-09 09:57 - 000010902 _____ C:\Users\Adrian\Desktop\ZHPCleaner2.txt
2017-09-09 09:34 - 2017-09-14 18:03 - 000001822 _____ C:\Users\Adrian\Desktop\ZHPCleaner.txt
2017-09-08 09:16 - 2017-09-08 09:16 - 002869632 _____ C:\Users\Adrian\Downloads\zhpcleaner_2017.8.31.148.exe
2017-09-07 18:41 - 2017-09-07 18:41 - 000120381 _____ C:\Users\Adrian\Desktop\ZHPDiag.txt
2017-09-07 17:50 - 2017-09-07 17:50 - 002827136 _____ C:\Users\Adrian\Downloads\zhpdiag_2017.8.31.148 (1).exe
2017-09-07 14:06 - 2017-09-07 18:05 - 000000000 ____D C:\Users\Adrian\AppData\Local\ZHP
2017-09-07 14:03 - 2017-09-07 14:04 - 002875776 _____ C:\Users\Adrian\Downloads\ZHPCleaner.exe
2017-09-06 20:52 - 2017-09-09 09:21 - 000000000 ____D C:\ProgramData\DataCache
2017-09-06 20:28 - 2017-09-06 20:49 - 000000000 ____D C:\ProgramData\Cache
2017-09-06 20:28 - 2017-08-25 23:33 - 001952256 ___SH C:\Users\Adrian\AppData\Roaming\tmp546.dat
2017-09-06 20:28 - 2016-03-18 01:33 - 000473384 _____ C:\Windows\SysWOW64\wtmkussrv.dll
2017-09-06 20:27 - 2017-09-06 20:27 - 000140800 _____ C:\Users\Adrian\AppData\Local\installer.dat
2017-09-06 17:04 - 2017-09-09 10:26 - 000000912 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-09-06 17:04 - 2017-09-09 09:41 - 000000854 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2017-09-06 17:04 - 2017-09-06 17:04 - 000000000 ____D C:\Program Files\Mozilla Firefox
2017-09-06 17:04 - 2017-09-06 17:04 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-09-03 21:42 - 2017-09-03 21:52 - 000000000 ____D C:\Users\Adrian\Downloads\Pere Ubu - 1979 - New picnic time [1999, Cooking Vinyl, COOK CD 171]
2017-09-03 21:42 - 2017-09-03 21:52 - 000000000 ____D C:\Users\Adrian\Downloads\1981 - 390° of simulated stereo [Rough Trade, ROUGH CD 23] (VBR V0)
2017-09-03 21:42 - 2016-03-31 17:40 - 000000000 ____D C:\Users\Adrian\Downloads\1989 - Cloudland [Fontana, 838 237-2] (VBR V0)
2017-09-03 21:42 - 2016-03-31 17:39 - 000000000 ____D C:\Users\Adrian\Downloads\1982 - Song of the bailing man [1999, Cooking Vinyl, COOK CD 158]
2017-09-02 18:59 - 2017-09-02 19:00 - 000000000 ____D C:\Users\Adrian\Downloads\Martin Barre
2017-08-31 10:51 - 2017-08-31 10:51 - 000000000 ____D C:\Users\Adrian\Downloads\Martin Barre - Away With Words (2013) By Muro
2017-08-30 07:44 - 2017-08-30 07:44 - 000317056 _____ C:\Windows\system32\FNTCACHE.DAT
2017-08-29 22:40 - 2017-08-29 22:40 - 000070584 _____ C:\Users\Adrian\AppData\Local\GDIPFONTCACHEV1.DAT
2017-08-29 17:28 - 2017-09-14 02:15 - 1558282240 ____R C:\Users\Adrian\Downloads\Tony.Arzenta.1973.DVDRip.XviD.EN.ITA.MP3-KG.avi
2017-08-28 16:18 - 2017-08-28 16:18 - 000000000 ____D C:\Users\Adrian\.QtWebEngineProcess
2017-08-28 16:18 - 2017-08-28 16:18 - 000000000 ____D C:\Users\Adrian\.BitLord
2017-08-27 22:23 - 2017-08-27 22:24 - 000000000 ____D C:\Users\Adrian\Desktop\Charlélie Couture - Discographie
2017-08-26 20:06 - 2017-08-26 20:06 - 000000000 ____D C:\Users\Adrian\Desktop\Panini
2017-08-23 20:32 - 2017-08-23 20:34 - 106531253 _____ C:\Users\Adrian\Downloads\Le Grand Livre des idées reçues - Insolite et Grandes Enigmes.pdf
2017-08-22 22:07 - 2017-08-22 22:07 - 000192581 _____ C:\Users\Adrian\Downloads\video-1503428553.mp4
2017-08-20 19:34 - 2017-09-03 13:55 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hotspot Shield
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-09-15 10:15 - 2009-07-14 07:45 - 000025120 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-09-15 10:15 - 2009-07-14 07:45 - 000025120 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-09-15 10:03 - 2016-11-15 21:08 - 000000000 ____D C:\Users\Adrian\AppData\LocalLow\Mozilla
2017-09-15 10:00 - 2009-07-14 08:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2017-09-14 20:21 - 2009-07-14 08:13 - 000784286 _____ C:\Windows\system32\PerfStringBackup.INI
2017-09-14 20:21 - 2009-07-14 06:20 - 000000000 ____D C:\Windows\inf
2017-09-14 18:37 - 2014-07-23 20:49 - 000000000 ____D C:\Program Files (x86)\Google
2017-09-14 18:10 - 2016-06-04 14:37 - 000000000 ____D C:\AdwCleaner
2017-09-14 18:03 - 2015-08-16 21:19 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\ZHP
2017-09-14 10:48 - 2014-08-23 14:32 - 000000000 ____D C:\Users\Adrian\Documents\Chroniques
2017-09-14 02:38 - 2014-07-24 16:42 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\uTorrent
2017-09-14 02:23 - 2014-08-22 19:55 - 000000000 ____D C:\Users\Adrian\Downloads\Pas finis
2017-09-14 01:38 - 2017-02-03 20:54 - 000000000 ____D C:\Users\Adrian\Downloads\Films
2017-09-14 01:31 - 2014-07-24 17:31 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\vlc
2017-09-13 20:27 - 2016-06-26 10:18 - 000004312 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2017-09-13 20:27 - 2015-12-22 01:42 - 000803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-09-13 20:27 - 2015-12-22 01:42 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-09-13 20:27 - 2015-12-22 01:42 - 000004454 _____ C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier
2017-09-13 20:27 - 2014-07-24 13:24 - 000000000 ____D C:\Windows\SysWOW64\Macromed
2017-09-13 20:27 - 2014-07-24 13:24 - 000000000 ____D C:\Windows\system32\Macromed
2017-09-11 13:14 - 2014-08-01 15:32 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\Mp3tag
2017-09-10 13:46 - 2017-07-06 16:22 - 000000000 ____D C:\Users\Adrian\Documents\Depart' Aimant
2017-09-09 12:08 - 2014-07-30 10:34 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\FileZilla
2017-09-07 15:13 - 2016-06-05 17:10 - 000000832 _____ C:\Users\Adrian\Desktop\ZHPCleaner.lnk
2017-09-03 13:55 - 2017-04-15 09:35 - 000000000 ____D C:\ProgramData\Package Cache
2017-08-31 13:13 - 2017-08-06 19:25 - 000000000 ____D C:\Users\Adrian\Downloads\Correction
2017-08-31 13:13 - 2014-10-13 20:32 - 000000000 ____D C:\Users\Adrian\Downloads\Photos
2017-08-31 13:13 - 2014-10-13 20:31 - 000000000 ____D C:\Users\Adrian\Downloads\Installations
2017-08-31 10:52 - 2017-06-05 15:01 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2017-08-30 07:58 - 2017-04-14 11:33 - 000002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2017-08-29 18:18 - 2016-06-03 17:33 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\MPC-HC
2017-08-28 16:21 - 2014-08-04 19:47 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\Skype
2017-08-28 16:18 - 2014-07-23 19:30 - 000000000 ____D C:\Users\Adrian
2017-08-27 22:20 - 2014-07-24 14:39 - 000001030 _____ C:\Users\Public\Desktop\VLC media player.lnk
2017-08-27 20:53 - 2016-06-04 21:40 - 000000000 ____D C:\Users\Adrian\Desktop\Discographie Bernard Lavilliers - (28 cds) 1968-2003.www.zone-telechargement.com
2017-08-27 18:18 - 2015-04-30 22:03 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\DAEMON Tools Lite
2017-08-25 22:15 - 2014-07-30 10:34 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2017-08-25 22:15 - 2014-07-30 10:34 - 000000000 ____D C:\Program Files (x86)\FileZilla FTP Client
2017-08-25 06:50 - 2009-07-14 08:08 - 000032548 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2017-08-22 13:21 - 2016-08-19 22:21 - 000000000 ____D C:\Users\Adrian\Documents\My Travel Quest
2017-08-17 13:42 - 2014-12-06 11:00 - 000000000 ____D C:\Users\Adrian\Documents\Livre Jethro Tull
2017-08-16 19:16 - 2014-10-13 20:32 - 000000000 ____D C:\Users\Adrian\Downloads\Vidéos
==================== Files in the root of some directories =======
2017-09-06 20:28 - 2017-08-25 23:33 - 001952256 ___SH () C:\Users\Adrian\AppData\Roaming\tmp546.dat
2015-12-06 19:47 - 2017-08-06 13:32 - 000011264 _____ () C:\Users\Adrian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2017-09-06 20:27 - 2017-09-06 20:27 - 000140800 _____ () C:\Users\Adrian\AppData\Local\installer.dat
2016-07-17 10:44 - 2016-07-17 10:46 - 000002222 _____ () C:\Users\Adrian\AppData\Local\WiDiSetupLog.20160717.104454.txt
2016-07-17 10:55 - 2016-07-17 10:55 - 000011200 _____ () C:\Users\Adrian\AppData\Local\WiDiSetupLog.20160717.105514.txt
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-12-17 13:22
==================== End of FRST.txt ============================
Ran by Adrian (administrator) on ADRIAN-PC (15-09-2017 10:46:32)
Running from C:\Users\Adrian\Desktop
Loaded Profiles: Adrian (Available Profiles: Adrian & Guest)
Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Dell Inc.) C:\Program Files\Dell\DW WLAN Card\WLTRYSVC.EXE
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Dell Inc.) C:\Program Files\Dell\DW WLAN Card\BCMWLTRY.EXE
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Dell Inc.) C:\Program Files\Dell\DW WLAN Card\WLTRAY.EXE
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Disc Soft Ltd) C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ====================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6846096 2012-11-19] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1253520 2012-11-19] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2796272 2013-11-22] (Synaptics Incorporated)
HKLM\...\Run: [Broadcom Wireless Manager UI] => C:\Program Files\Dell\DW WLAN Card\WLTRAY.exe [8921600 2014-07-23] (Dell Inc.)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-30] (Intel Corporation)
HKLM\...\Run: [QuickSet] => C:\Program Files\Dell\QuickSet\QuickSet.exe [5762408 2013-03-05] (Dell Inc.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292088 2013-02-23] (Intel Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2016-12-12] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\ScCertProp: wlnotify.dll [X]
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8551848 2015-10-19] (Piriform Ltd)
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\Run: [DAEMON Tools Lite Automount] => C:\Program Files\DAEMON Tools Lite\DTAgent.exe [4179288 2015-11-30] (Disc Soft Ltd)
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\Run: [HideMyIPSh] => "C:\Program Files (x86)\Hide My IP 6\HideMyIP.exe" /sh
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7963552 2017-07-12] (SUPERAntiSpyware)
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\Run: [TomTomHOME.exe] => "C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe"
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\Run: [MyDriveConnect.exe] => C:\Program Files (x86)\MyDrive Connect\TomTom MyDrive Connect.exe -startwithoutDA
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {4fe6a65d-9be5-11e5-b871-ecf4bb0c7e4f} - E:\autorun.exe
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {5c2ccd63-3cd8-11e4-be48-f82fa8dc94ee} - E:\AutoRun.exe
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {671b4005-fdf6-11e6-b49a-ecf4bb0c7e4f} - E:\Startme.exe
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {6ee1dae3-3cb5-11e4-a984-f82fa8dc94ee} - E:\AutoRun.exe
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {6ee1daf3-3cb5-11e4-a984-f82fa8dc94ee} - E:\AutoRun.exe
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {89376eda-793e-11e4-8c8b-f82fa8dc94ee} - E:\AutoRun.exe
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {9623956b-3b59-11e4-9af1-f82fa8dc94ee} - E:\AutoRun.exe
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {abf5f654-731c-11e4-8cb8-f82fa8dc94ee} - E:\unlock.exe autoplay=true
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {c17db7f3-ef63-11e4-9037-ecf4bb0c7e4f} - E:\autorun.exe
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {d4ae93aa-ae22-11e5-897c-ecf4bb0c7e4f} - F:\autorun.exe
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {e5909313-f7c6-11e4-aa6e-ecf4bb0c7e4f} - E:\Startme.exe
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\...\MountPoints2: {fafbe510-26ac-11e4-88ef-f82fa8dc94ee} - E:\LG_PC_Programs.exe
Lsa: [Notification Packages] scecli C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
ShellExecuteHooks: No Name - {5F51FFFE-7463-4220-B711-E5B9ACB8EDFE} - C:\Users\Adrian\AppData\Roaming\tmp546.dat [1952256 2017-08-25] ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2016-06-10]
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{12AA26AC-4392-403A-9A14-02CD4B939AC0}: [DhcpNameServer] 192.168.2.1
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = www.bing.com
HKU\S-1-5-21-4055709356-1465872850-4113285666-1000\Software\Microsoft\Internet Explorer\Main,Start Page =
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\ssv.dll [2017-03-14] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-03-14] (Oracle Corporation)
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
FireFox:
========
FF ProfilePath: C:\Users\Adrian\AppData\Roaming\TomTom\HOME\Profiles\urd9ga9k.default [2017-06-01]
FF ProfilePath: C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\xe3igf5m.default-1485454395780 [2017-09-15]
FF Extension: (Parental Control: Porn Blocker) - C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\xe3igf5m.default-1485454395780\Extensions\@parental-control-porn-blocker.xpi [2017-09-15]
FF Extension: (Save Images) - C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\xe3igf5m.default-1485454395780\Extensions\LDSI_plashcor@gmail.com.xpi [2017-09-15]
FF Extension: (Video DownloadHelper) - C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\xe3igf5m.default-1485454395780\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2017-07-06]
FF Extension: (Flash and Video Download) - C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\xe3igf5m.default-1485454395780\Extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a} [2017-09-06]
FF Extension: (Photon onboarding) - C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\xe3igf5m.default-1485454395780\features\{da3034fa-9d27-42b4-a93f-b692313764ed}\onboarding@mozilla.org.xpi [2017-09-13]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_27_0_0_130.dll [2017-09-13] ()
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll [2014-07-25] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_27_0_0_130.dll [2017-09-13] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.121.2 -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll [2017-03-14] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.121.2 -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\plugin2\npjp2.dll [2017-03-14] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll [2014-07-25] (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-08-01] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2016-12-23] (Adobe Systems Inc.)
Chrome:
=======
CHR Profile: C:\Users\Adrian\AppData\Local\Google\Chrome\User Data\Default [2017-09-14]
CHR Extension: (Skype) - C:\Users\Adrian\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2017-09-11]
CHR Extension: (Paiements via le Chrome Web Store) - C:\Users\Adrian\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-09-11]
CHR Extension: (Chrome Media Router) - C:\Users\Adrian\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-09-11]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2015-10-12]
Opera:
=======
OPR Extension: (Adult Blocker) - C:\Users\Adrian\AppData\Roaming\Opera Software\Opera Stable\Extensions\neopaobcplailacdmjplehdnhhdacocl [2016-11-03]
OPR Extension: (Adblock Plus) - C:\Users\Adrian\AppData\Roaming\Opera Software\Opera Stable\Extensions\oidhhegpmlfpoeialbgcdocjalghfpkp [2017-01-16]
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [173472 2017-01-31] (SUPERAntiSpyware.com)
R3 Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe [1368408 2015-11-30] (Disc Soft Ltd)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-30] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201872 2012-11-23] (Realtek Semiconductor)
R2 wltrysvc; C:\Program Files\Dell\DW WLAN Card\bcmwltry.exe [6170624 2014-07-23] (Dell Inc.) [File not signed]
R2 wtmkussrv; C:\Windows\SysWow64\wtmkussrv.dll [473384 2016-03-18] ()
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [31920 2014-04-09] (Wondershare)
S3 atrfiltr; C:\Windows\System32\DRIVERS\atrfiltr.sys [16224 2014-09-11] (Windows (R) Win 7 DDK provider)
S3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [170200 2014-07-23] (Broadcom Corporation.)
S3 cxbu0x64; C:\Windows\System32\DRIVERS\cxbu0x64.sys [191224 2014-05-14] (HID Global Corporation)
R3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [30264 2015-12-06] (Disc Soft Ltd)
R3 dtliteusbbus; C:\Windows\System32\DRIVERS\dtliteusbbus.sys [46392 2015-12-06] (Disc Soft Ltd)
R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [44744 2015-05-08] (AnchorFree Inc.)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-08-30] (Intel Corporation)
S3 jakstaVA; C:\Windows\System32\DRIVERS\jaksta_va.sys [103816 2014-12-09] (e2eSoft)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-06-18] (Malwarebytes Corporation)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-13] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S4 secdrv; C:\Windows\SysWow64\Drivers\secdrv.sys [11973 2016-12-28] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [File not signed]
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [31472 2013-11-22] (Synaptics Incorporated)
R3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42064 2016-05-27] (Anchorfree Inc.)
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()
R1 wtmksyssrv; C:\Windows\system32\drivers\wtmhdnkernel.sys [226856 2016-03-18] ()
S3 EsgScanner; system32\DRIVERS\EsgScanner.sys [X]
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [X]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S1 LanmaMaster; \??\C:\Windows\system32\drivers\lanmamaster.sys [X] <==== ATTENTION
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-09-15 10:46 - 2017-09-15 10:46 - 000000000 ____D C:\Users\Adrian\Desktop\FRST-OlderVersion
2017-09-14 21:10 - 2017-09-14 21:10 - 000002220 _____ C:\Users\Public\Desktop\L'Entraineur - Saison 97-98.lnk
2017-09-14 21:10 - 2017-09-14 21:10 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\Abandonware-France
2017-09-14 21:10 - 2017-09-14 21:10 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Abandonware-France
2017-09-14 21:07 - 2017-09-14 21:08 - 074189696 _____ (Abandonware-France ) C:\Users\Adrian\Downloads\setup-01693-L_Entraineur97_98-Dosbox.exe
2017-09-14 21:05 - 2017-09-14 21:05 - 001448809 _____ (DOSBox Team) C:\Users\Adrian\Downloads\DOSBox0.74-win32-installer.exe
2017-09-14 21:05 - 2017-09-14 21:05 - 000001882 _____ C:\Users\Public\Desktop\DOSBox 0.74.lnk
2017-09-14 21:05 - 2017-09-14 21:05 - 000000000 ____D C:\Program Files (x86)\DOSBox-0.74
2017-09-14 21:02 - 2017-09-14 21:02 - 012183769 _____ C:\Users\Adrian\Downloads\championshipman9697_dos_win.7z
2017-09-14 20:41 - 2017-09-14 20:59 - 000012192 _____ C:\Users\Adrian\Desktop\nestopia.cfg
2017-09-14 20:41 - 2017-09-14 20:41 - 000000000 ____D C:\Users\Adrian\Desktop\states
2017-09-14 20:41 - 2017-09-14 20:41 - 000000000 ____D C:\Users\Adrian\Desktop\scripts
2017-09-14 20:41 - 2017-09-14 20:41 - 000000000 ____D C:\Users\Adrian\Desktop\screenshots
2017-09-14 20:41 - 2017-09-14 20:41 - 000000000 ____D C:\Users\Adrian\Desktop\save
2017-09-14 20:41 - 2017-09-14 20:41 - 000000000 ____D C:\Users\Adrian\Desktop\samples
2017-09-14 20:41 - 2017-09-14 20:41 - 000000000 ____D C:\Users\Adrian\Desktop\ips
2017-09-14 20:41 - 2010-01-25 19:10 - 001009933 _____ C:\Users\Adrian\Desktop\Nes_Nestopia.zip
2017-09-14 20:41 - 2010-01-25 18:33 - 000228825 _____ C:\Users\Adrian\Desktop\Nes_Super_Mario_Bros_3.zip
2017-09-14 20:41 - 2006-07-07 14:16 - 000000540 _____ C:\Users\Adrian\Desktop\Lisez moi.txt
2017-09-14 20:41 - 2006-07-07 14:15 - 000000000 ____D C:\Users\Adrian\Desktop\language
2017-09-14 20:41 - 2006-07-07 14:01 - 001540608 _____ C:\Users\Adrian\Desktop\nestopia.exe
2017-09-14 20:41 - 2006-07-06 13:46 - 000041106 _____ C:\Users\Adrian\Desktop\changelog.txt
2017-09-14 20:41 - 2006-07-06 12:59 - 000092259 _____ C:\Users\Adrian\Desktop\readme.html
2017-09-14 20:41 - 2006-06-22 19:56 - 000015402 _____ C:\Users\Adrian\Desktop\copying.txt
2017-09-14 20:41 - 2006-05-25 16:52 - 000162304 _____ C:\Users\Adrian\Desktop\unrar.dll
2017-09-14 20:41 - 2006-05-14 06:25 - 000169984 _____ C:\Users\Adrian\Desktop\7zxa.dll
2017-09-14 20:41 - 2005-09-13 23:14 - 000032256 _____ C:\Users\Adrian\Desktop\kailleraclient.dll
2017-09-14 18:53 - 2017-09-14 18:59 - 000000000 ____D C:\Users\Adrian\Downloads\Latte E Miele
2017-09-14 18:52 - 2017-09-14 18:52 - 000000000 ____D C:\Users\Adrian\Downloads\Ibis
2017-09-14 18:50 - 2017-09-14 18:50 - 000000000 ____D C:\Users\Adrian\Downloads\Hunka Munka
2017-09-14 18:47 - 2017-09-14 18:47 - 000000000 ____D C:\Users\Adrian\Downloads\Finisterre
2017-09-14 18:19 - 2017-09-14 18:19 - 000000000 ____D C:\Users\Public\Documents\XMUpdate
2017-09-14 18:09 - 2017-09-14 18:09 - 008182736 _____ (Malwarebytes) C:\Users\Adrian\Desktop\adwcleaner_7.0.2.1.exe
2017-09-14 10:40 - 2017-09-14 10:40 - 002869632 _____ C:\Users\Adrian\Desktop\zhpcleaner_2017.8.31.148 (1).exe
2017-09-14 02:23 - 2017-09-14 02:23 - 000000000 ____D C:\Users\Adrian\Downloads\mbid-0ebb7bc0-933d-431f-9a91-7c4644c674ee
2017-09-13 20:30 - 2017-09-13 20:58 - 000029321 _____ C:\Users\Adrian\Desktop\Addition.txt
2017-09-13 20:24 - 2017-09-15 10:55 - 000017053 _____ C:\Users\Adrian\Desktop\FRST.txt
2017-09-13 20:24 - 2017-09-15 10:46 - 000000000 ____D C:\FRST
2017-09-13 20:23 - 2017-09-15 10:46 - 002398208 _____ (Farbar) C:\Users\Adrian\Desktop\FRST64.exe
2017-09-11 10:27 - 2017-09-11 10:27 - 000000000 ____D C:\Users\Adrian\Downloads\OMD
2017-09-09 14:26 - 2017-09-09 14:26 - 000197017 _____ C:\Users\Adrian\Downloads\1991_Catfish_Rising.pdf
2017-09-09 13:16 - 2017-09-09 13:16 - 000000114 _____ C:\Users\Adrian\Documents\Boston.txt
2017-09-09 11:34 - 2017-09-09 11:35 - 000000000 ____D C:\Users\Adrian\Downloads\Stone Of A Bitch
2017-09-09 11:33 - 2017-09-11 13:43 - 000000000 ____D C:\Users\Adrian\Downloads\Daisy Driver
2017-09-09 11:32 - 2017-09-09 11:44 - 418696037 _____ C:\Users\Adrian\Downloads\OMD.zip
2017-09-09 11:22 - 2017-09-09 11:23 - 000000000 ____D C:\Users\Adrian\Downloads\Stömb
2017-09-09 10:59 - 2017-07-13 13:39 - 000000000 ____D C:\Users\Adrian\Downloads\L'Anima
2017-09-09 10:59 - 2016-03-31 17:39 - 000000000 ____D C:\Users\Adrian\Downloads\1988 - The tenement year [2007, Mercury, 9846251]
2017-09-09 10:55 - 2017-09-02 05:37 - 000000000 ____D C:\Users\Adrian\Downloads\Kaipa__Children_Of_The_Sounds
2017-09-09 10:26 - 2017-09-09 10:26 - 000004100 _____ C:\Users\Adrian\Desktop\AdwCleaner[S2].txt
2017-09-09 10:06 - 2017-09-09 10:06 - 008182736 _____ (Malwarebytes) C:\Users\Adrian\Downloads\adwcleaner_7.0.2.1.exe
2017-09-09 09:57 - 2017-09-09 09:57 - 000010902 _____ C:\Users\Adrian\Desktop\ZHPCleaner2.txt
2017-09-09 09:34 - 2017-09-14 18:03 - 000001822 _____ C:\Users\Adrian\Desktop\ZHPCleaner.txt
2017-09-08 09:16 - 2017-09-08 09:16 - 002869632 _____ C:\Users\Adrian\Downloads\zhpcleaner_2017.8.31.148.exe
2017-09-07 18:41 - 2017-09-07 18:41 - 000120381 _____ C:\Users\Adrian\Desktop\ZHPDiag.txt
2017-09-07 17:50 - 2017-09-07 17:50 - 002827136 _____ C:\Users\Adrian\Downloads\zhpdiag_2017.8.31.148 (1).exe
2017-09-07 14:06 - 2017-09-07 18:05 - 000000000 ____D C:\Users\Adrian\AppData\Local\ZHP
2017-09-07 14:03 - 2017-09-07 14:04 - 002875776 _____ C:\Users\Adrian\Downloads\ZHPCleaner.exe
2017-09-06 20:52 - 2017-09-09 09:21 - 000000000 ____D C:\ProgramData\DataCache
2017-09-06 20:28 - 2017-09-06 20:49 - 000000000 ____D C:\ProgramData\Cache
2017-09-06 20:28 - 2017-08-25 23:33 - 001952256 ___SH C:\Users\Adrian\AppData\Roaming\tmp546.dat
2017-09-06 20:28 - 2016-03-18 01:33 - 000473384 _____ C:\Windows\SysWOW64\wtmkussrv.dll
2017-09-06 20:27 - 2017-09-06 20:27 - 000140800 _____ C:\Users\Adrian\AppData\Local\installer.dat
2017-09-06 17:04 - 2017-09-09 10:26 - 000000912 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-09-06 17:04 - 2017-09-09 09:41 - 000000854 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2017-09-06 17:04 - 2017-09-06 17:04 - 000000000 ____D C:\Program Files\Mozilla Firefox
2017-09-06 17:04 - 2017-09-06 17:04 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-09-03 21:42 - 2017-09-03 21:52 - 000000000 ____D C:\Users\Adrian\Downloads\Pere Ubu - 1979 - New picnic time [1999, Cooking Vinyl, COOK CD 171]
2017-09-03 21:42 - 2017-09-03 21:52 - 000000000 ____D C:\Users\Adrian\Downloads\1981 - 390° of simulated stereo [Rough Trade, ROUGH CD 23] (VBR V0)
2017-09-03 21:42 - 2016-03-31 17:40 - 000000000 ____D C:\Users\Adrian\Downloads\1989 - Cloudland [Fontana, 838 237-2] (VBR V0)
2017-09-03 21:42 - 2016-03-31 17:39 - 000000000 ____D C:\Users\Adrian\Downloads\1982 - Song of the bailing man [1999, Cooking Vinyl, COOK CD 158]
2017-09-02 18:59 - 2017-09-02 19:00 - 000000000 ____D C:\Users\Adrian\Downloads\Martin Barre
2017-08-31 10:51 - 2017-08-31 10:51 - 000000000 ____D C:\Users\Adrian\Downloads\Martin Barre - Away With Words (2013) By Muro
2017-08-30 07:44 - 2017-08-30 07:44 - 000317056 _____ C:\Windows\system32\FNTCACHE.DAT
2017-08-29 22:40 - 2017-08-29 22:40 - 000070584 _____ C:\Users\Adrian\AppData\Local\GDIPFONTCACHEV1.DAT
2017-08-29 17:28 - 2017-09-14 02:15 - 1558282240 ____R C:\Users\Adrian\Downloads\Tony.Arzenta.1973.DVDRip.XviD.EN.ITA.MP3-KG.avi
2017-08-28 16:18 - 2017-08-28 16:18 - 000000000 ____D C:\Users\Adrian\.QtWebEngineProcess
2017-08-28 16:18 - 2017-08-28 16:18 - 000000000 ____D C:\Users\Adrian\.BitLord
2017-08-27 22:23 - 2017-08-27 22:24 - 000000000 ____D C:\Users\Adrian\Desktop\Charlélie Couture - Discographie
2017-08-26 20:06 - 2017-08-26 20:06 - 000000000 ____D C:\Users\Adrian\Desktop\Panini
2017-08-23 20:32 - 2017-08-23 20:34 - 106531253 _____ C:\Users\Adrian\Downloads\Le Grand Livre des idées reçues - Insolite et Grandes Enigmes.pdf
2017-08-22 22:07 - 2017-08-22 22:07 - 000192581 _____ C:\Users\Adrian\Downloads\video-1503428553.mp4
2017-08-20 19:34 - 2017-09-03 13:55 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hotspot Shield
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-09-15 10:15 - 2009-07-14 07:45 - 000025120 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-09-15 10:15 - 2009-07-14 07:45 - 000025120 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-09-15 10:03 - 2016-11-15 21:08 - 000000000 ____D C:\Users\Adrian\AppData\LocalLow\Mozilla
2017-09-15 10:00 - 2009-07-14 08:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2017-09-14 20:21 - 2009-07-14 08:13 - 000784286 _____ C:\Windows\system32\PerfStringBackup.INI
2017-09-14 20:21 - 2009-07-14 06:20 - 000000000 ____D C:\Windows\inf
2017-09-14 18:37 - 2014-07-23 20:49 - 000000000 ____D C:\Program Files (x86)\Google
2017-09-14 18:10 - 2016-06-04 14:37 - 000000000 ____D C:\AdwCleaner
2017-09-14 18:03 - 2015-08-16 21:19 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\ZHP
2017-09-14 10:48 - 2014-08-23 14:32 - 000000000 ____D C:\Users\Adrian\Documents\Chroniques
2017-09-14 02:38 - 2014-07-24 16:42 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\uTorrent
2017-09-14 02:23 - 2014-08-22 19:55 - 000000000 ____D C:\Users\Adrian\Downloads\Pas finis
2017-09-14 01:38 - 2017-02-03 20:54 - 000000000 ____D C:\Users\Adrian\Downloads\Films
2017-09-14 01:31 - 2014-07-24 17:31 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\vlc
2017-09-13 20:27 - 2016-06-26 10:18 - 000004312 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2017-09-13 20:27 - 2015-12-22 01:42 - 000803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-09-13 20:27 - 2015-12-22 01:42 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-09-13 20:27 - 2015-12-22 01:42 - 000004454 _____ C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier
2017-09-13 20:27 - 2014-07-24 13:24 - 000000000 ____D C:\Windows\SysWOW64\Macromed
2017-09-13 20:27 - 2014-07-24 13:24 - 000000000 ____D C:\Windows\system32\Macromed
2017-09-11 13:14 - 2014-08-01 15:32 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\Mp3tag
2017-09-10 13:46 - 2017-07-06 16:22 - 000000000 ____D C:\Users\Adrian\Documents\Depart' Aimant
2017-09-09 12:08 - 2014-07-30 10:34 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\FileZilla
2017-09-07 15:13 - 2016-06-05 17:10 - 000000832 _____ C:\Users\Adrian\Desktop\ZHPCleaner.lnk
2017-09-03 13:55 - 2017-04-15 09:35 - 000000000 ____D C:\ProgramData\Package Cache
2017-08-31 13:13 - 2017-08-06 19:25 - 000000000 ____D C:\Users\Adrian\Downloads\Correction
2017-08-31 13:13 - 2014-10-13 20:32 - 000000000 ____D C:\Users\Adrian\Downloads\Photos
2017-08-31 13:13 - 2014-10-13 20:31 - 000000000 ____D C:\Users\Adrian\Downloads\Installations
2017-08-31 10:52 - 2017-06-05 15:01 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2017-08-30 07:58 - 2017-04-14 11:33 - 000002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2017-08-29 18:18 - 2016-06-03 17:33 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\MPC-HC
2017-08-28 16:21 - 2014-08-04 19:47 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\Skype
2017-08-28 16:18 - 2014-07-23 19:30 - 000000000 ____D C:\Users\Adrian
2017-08-27 22:20 - 2014-07-24 14:39 - 000001030 _____ C:\Users\Public\Desktop\VLC media player.lnk
2017-08-27 20:53 - 2016-06-04 21:40 - 000000000 ____D C:\Users\Adrian\Desktop\Discographie Bernard Lavilliers - (28 cds) 1968-2003.www.zone-telechargement.com
2017-08-27 18:18 - 2015-04-30 22:03 - 000000000 ____D C:\Users\Adrian\AppData\Roaming\DAEMON Tools Lite
2017-08-25 22:15 - 2014-07-30 10:34 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2017-08-25 22:15 - 2014-07-30 10:34 - 000000000 ____D C:\Program Files (x86)\FileZilla FTP Client
2017-08-25 06:50 - 2009-07-14 08:08 - 000032548 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2017-08-22 13:21 - 2016-08-19 22:21 - 000000000 ____D C:\Users\Adrian\Documents\My Travel Quest
2017-08-17 13:42 - 2014-12-06 11:00 - 000000000 ____D C:\Users\Adrian\Documents\Livre Jethro Tull
2017-08-16 19:16 - 2014-10-13 20:32 - 000000000 ____D C:\Users\Adrian\Downloads\Vidéos
==================== Files in the root of some directories =======
2017-09-06 20:28 - 2017-08-25 23:33 - 001952256 ___SH () C:\Users\Adrian\AppData\Roaming\tmp546.dat
2015-12-06 19:47 - 2017-08-06 13:32 - 000011264 _____ () C:\Users\Adrian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2017-09-06 20:27 - 2017-09-06 20:27 - 000140800 _____ () C:\Users\Adrian\AppData\Local\installer.dat
2016-07-17 10:44 - 2016-07-17 10:46 - 000002222 _____ () C:\Users\Adrian\AppData\Local\WiDiSetupLog.20160717.104454.txt
2016-07-17 10:55 - 2016-07-17 10:55 - 000011200 _____ () C:\Users\Adrian\AppData\Local\WiDiSetupLog.20160717.105514.txt
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-12-17 13:22
==================== End of FRST.txt ============================