~ ZHPDiag v2015.12.16.186 By Nicolas Coolman (2015/12/16) ~ Run by MouiMou_2 (Administrator) (2015/12/17 18:15:20) ~ Web: http://www.nicolascoolman.fr ~ Facebook: https://www.facebook.com/nicolascoolman1 ~ State version: Version OK ~ Mode: Scan ~ Report: C:\Users\MouiMou_2\Desktop\ZHPDiag.txt ~ Report: C:\Users\MouiMou_2\AppData\Roaming\ZHP\ZHPDiag.txt ~ UAC: Activate ~ System startup: Normal (Normal boot) Windows 8.1 Pro, 64-bit (Build 9600) ---\\ Internet Browsers (3) - 0s GCIE: Google Chrome v47.0.2526.106 MFIE: Mozilla Firefox 38.0.5 (x86 en-US) v38.0.5 MSIE: Internet Explorer v11.0.9600.18125 ---\\ Windows Product Information (3) - 3s ~ Windows Server License Manager Script : OK ~ Licence Script File Génération : OK Windows Automatic Updates : OK ---\\ System protection software (4) - 4s ESET Smart Security v9.0.318.30 Malwarebytes Anti-Malware version 2.2.0.1024 Norton Security Scan v4.1.0.28 Windows Defender (Deactivate) ---\\ System optimization software (1) - 5s CCleaner v5.01 ---\\ Surveillance software (2) - 5s Adobe Flash Player 20 NPAPI Adobe Acrobat Reader DC ---\\ Information on the system (6) - 0s ~ Operating System: Intel64 Family 6 Model 58 Stepping 9, GenuineIntel ~ Operating System: 64-bit ~ Boot mode: Normal (Normal boot) Total RAM: 4066.664 MB (68% free) System Restore: Activé (Enable) System drive C: has 96 GB () free of 255 GB ---\\ Connection to the system mode (3) - 0s ~ Computer Name: MOUMOU ~ User Name: MouiMou_2 ~ Logged in as Administrator ---\\ Enumeration of the disk units (3) - 0s ~ Drive C: has 96 GB free of 255 GB (System) ~ Drive E: has 69 GB free of 112 GB ~ Drive F: has 87 GB free of 108 GB ---\\ State of the Windows Security Center (11) - 0s [HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiSpywareOverride: OK [HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusOverride: OK [HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallOverride: OK [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: OK [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN] CheckedValue: Modified [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] CheckedValue: OK [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: OK [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] Shell: OK [HKLM\SYSTEM\CurrentControlSet\Services\COMSysApp] Type: OK [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : OK ---\\ Search Generic System Files (24) - 1s [MD5.C10A66189DC8C090E7C84873EDCEBC88] - 28/01/2015 - (.Microsoft Corporation - Windows Explorer.) -- C:\Windows\Explorer.exe [2501368] =>.Microsoft Windows® [MD5.6C308D32AFA41D26CE2A0EA8F7B79565] - 29/10/2014 - (.Microsoft Corporation - Windows host process (Rundll32).) -- C:\Windows\System32\rundll32.exe [54784] © [MD5.EC302D06155F8E3C383750993FCB6B27] - 05/10/2015 - (.Microsoft Corporation - Windows Start-Up Application.) -- C:\Windows\System32\Wininit.exe [146432] © [MD5.E2C385B0D816AD37616BD4C4204D0633] - 08/11/2015 - (.Microsoft Corporation - Internet Extensions for Win32.) -- C:\Windows\System32\wininet.dll [2487808] © [MD5.3F8645885823692D93765817759BE21C] - 05/10/2015 - (.Microsoft Corporation - Windows Logon Application.) -- C:\Windows\System32\Winlogon.exe [572928] © [MD5.AFCAB4DC692CCE37E283B00E2D7B438F] - 18/03/2014 - (.Microsoft Corporation - Software Licensing Library.) -- C:\Windows\System32\sppcomapi.dll [447488] © [MD5.A5675939CF0F99B20B5A3CFCC3C1B46A] - 29/10/2014 - (.Microsoft Corporation - DNS Client API DLL.) -- C:\Windows\System32\dnsapi.dll [657920] © [MD5.BD9C7A068C46053F8747CEA73B5930AB] - 29/10/2014 - (.Microsoft Corporation - DNS Client API DLL.) -- C:\Windows\Syswow64\dnsapi.dll [498688] © [MD5.A460C3AF3755A2A79A3C8EFE72E147B5] - 13/10/2015 - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) -- C:\Windows\System32\drivers\AFD.sys [559616] © [MD5.74B14192CF79A72F7536B27CB8814FBD] - 22/08/2013 - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) -- C:\Windows\System32\drivers\atapi.sys [26464] =>.Microsoft Windows® [MD5.2FA6510E33F7DEFEC03658B74101A9B9] - 22/08/2013 - (.Microsoft Corporation - CD-ROM File System Driver.) -- C:\Windows\System32\drivers\Cdfs.sys [88576] © [MD5.C6796EA22B513E3457514D92DCDB1A3D] - 22/08/2013 - (.Microsoft Corporation - SCSI CD-ROM Driver.) -- C:\Windows\System32\drivers\Cdrom.sys [164352] © [MD5.A03F362C5557E238CBFA914689C77248] - 06/03/2014 - (.Microsoft Corporation - DFS Namespace Client Driver.) -- C:\Windows\System32\drivers\DfsC.sys [134144] © [MD5.D4B7ED39C7900384D9E5C1283F1E7926] - 24/07/2014 - (.Microsoft Corporation - High Definition Audio Bus Driver.) -- C:\Windows\System32\drivers\HDAudBus.sys [76800] © [MD5.49EE0AE9E5B64FFBBD06D55C4984B598] - 04/11/2014 - (.Microsoft Corporation - i8042 Port Driver.) -- C:\Windows\System32\drivers\i8042prt.sys [108544] © [MD5.B7342B3C58E91107F6E946A93D9D4EFD] - 18/03/2014 - (.Microsoft Corporation - IP Network Address Translator.) -- C:\Windows\System32\drivers\IpNat.sys [142848] © [MD5.89DE71940A0E7F5BA617AE08321EF5C3] - 10/10/2015 - (.Microsoft Corporation - Windows NT SMB Minirdr.) -- C:\Windows\System32\drivers\MRxSmb.sys [401408] © [MD5.0217532E19A748F0E5D569307363D5FD] - 22/08/2013 - (.Microsoft Corporation - MBT Transport driver.) -- C:\Windows\System32\drivers\netBT.sys [282624] © [MD5.7F68063A5A0461E02BC860CE0E6BFDDC] - 15/10/2014 - (.Microsoft Corporation - NT File System Driver.) -- C:\Windows\System32\drivers\ntfs.sys [2025792] =>.Microsoft Windows® [MD5.764B1121867B2D9B31C491668AC72B2B] - 22/08/2013 - (.Microsoft Corporation - Parallel Port Driver.) -- C:\Windows\System32\drivers\Parport.sys [94208] © [MD5.BBB6272B7F46C4640A8CDB8A70C3450F] - 22/08/2013 - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) -- C:\Windows\System32\drivers\Rasl2tp.sys [120832] © [MD5.680C1DAE268B6FB67FA21B389A8B79EF] - 18/03/2014 - (.Microsoft Corporation - Microsoft RDP Device redirector.) -- C:\Windows\System32\drivers\rdpdr.sys [195584] © [MD5.E0BD2D83875464FEEEB242CBA8B7E073] - 13/10/2015 - (.Microsoft Corporation - TDI Translation Driver.) -- C:\Windows\System32\drivers\tdx.sys [108032] © [MD5.64CA2B4A49A8EAF495E435623ECCE7DB] - 19/06/2014 - (.Microsoft Corporation - Volume Shadow Copy Driver.) -- C:\Windows\System32\drivers\volsnap.sys [310080] =>.Microsoft Windows® ---\\ Non Microsoft non disabled Windows Services (11) - 2s O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) . (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe =>.Adobe Systems, Incorporated® O23 - Service: Andrea RT Filters Service (AERTFilters) . (.Andrea Electronics Corporation - Andrea filters APO access service (64-bit).) - C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe =>.Andrea Electronics® O23 - Service: (AMD External Events Utility) . (.AMD - AMD External Events Service Module.) - C:\Windows\System32\atiesrxx.exe © O23 - Service: Cron Service (CronService) . (.Fork, Ltd. - Execution Service.) - C:\Windows\Prey\wpxsvc.exe O23 - Service: ESET Service (ekrn) . (.ESET - ESET Service.) - C:\Program Files\ESET\ESET Smart Security\ekrn.exe =>.ESET, spol. s r.o.® O23 - Service: خدمة Google Update (gupdate) (gupdate) . (.Google Inc. - Google Installer.) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe =>.Google Inc® O23 - Service: Intel(R) HD Graphics Control Panel Service (igfxCUIService1.0.0.0) . (.Intel Corporation - igfxCUIService Module.) - C:\Windows\System32\igfxCUIService.exe =>.Intel Corporation - pGFX® O23 - Service: Ma-Config Agent (MaConfigAgent) . (.CybelSoft - Service de détection matériel.) - C:\Program Files\ma-config.com\MaConfigAgent.exe =>.Cybelsoft® O23 - Service: (MBAMService) . (.Malwarebytes - Malwarebytes Anti-Malware.) - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe =>.Malwarebytes Corporation® O23 - Service: Realtek Audio Service (RtkAudioService) . (.Realtek Semiconductor - Realtek Audio Service.) - C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe =>.Realtek Semiconductor Corp® O23 - Service: Skype Updater (SkypeUpdate) . (.Skype Technologies - Skype Updater Service.) - C:\Program Files (x86)\Skype\Updater\Updater.exe =>.Skype Software Sarl® ---\\ Task Planned Automatically (26) - 4s [MD5.B89A82FB10E98F2FDF51FA82C7366DD3] [APT] [Adobe Acrobat Update Task] (.Adobe Systems Incorporated.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1067736] =>.Adobe Systems, Incorporated® [MD5.F54564025D2284AE498E51D7C139F971] [APT] [Adobe Flash Player Updater] (.Adobe Systems Incorporated.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [269504] =>.Adobe Systems Incorporated® [MD5.805210C8DB11D5799E7172923959BF98] [APT] [CCleanerSkipUAC] (.Piriform Ltd.) -- C:\Program Files\CCleaner\CCleaner.exe [5489944] =>.Piriform Ltd® [MD5.00000000000000000000000000000000] [APT] [Driver Booster SkipUAC (MouiMou)] (...) -- C:\Program Files (x86)\IObit\Driver Booster\DriverBooster.exe (.not file.) [0] [MD5.00000000000000000000000000000000] [APT] [Driver Booster SkipUAC (MouiMou0)] (...) -- C:\Program Files (x86)\IObit\Driver Booster\DriverBooster.exe (.not file.) [0] [MD5.00000000000000000000000000000000] [APT] [Driver Booster SkipUAC (MouiMou_2)] (...) -- C:\Program Files (x86)\IObit\Driver Booster\DriverBooster.exe (.not file.) [0] [MD5.55FBE6E4021BB042FAF23827523A8981] [APT] [gg_uac_daemon_MouiMou0] (.Copyright (C) 2013.) -- C:\Program Files (x86)\Garena Plus\ggdllhost.exe [55896] {4EEAD9745E9F68E71D871268ABF2041C} [MD5.55FBE6E4021BB042FAF23827523A8981] [APT] [gg_uac_daemon_MouiMou_2] (.Copyright (C) 2013.) -- C:\Program Files (x86)\Garena Plus\ggdllhost.exe [55896] {4EEAD9745E9F68E71D871268ABF2041C} [MD5.DD7423ABBE2913E70D50E9318AD57EE4] [APT] [GoogleUpdateTaskMachineCore] (.Google Inc..) -- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [144200] =>.Google Inc® [MD5.DD7423ABBE2913E70D50E9318AD57EE4] [APT] [GoogleUpdateTaskMachineUA] (.Google Inc..) -- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [144200] =>.Google Inc® [MD5.1E827B1C08007E18424315DDA4756279] [APT] [{28364D80-5DE0-4A09-8EA4-EC3F4B783C23}] (.Google Inc..) -- c:\program files (x86)\Google\Chrome\application\chrome.exe [741704] =>.Google Inc® [MD5.1E827B1C08007E18424315DDA4756279] [APT] [{8B17B58A-5126-48FD-9A29-FEA46C9B6436}] (.Google Inc..) -- c:\program files (x86)\Google\Chrome\application\chrome.exe [741704] =>.Google Inc® [MD5.1E827B1C08007E18424315DDA4756279] [APT] [{D5B27DC8-9C8B-4267-9944-16B7473F9964}] (.Google Inc..) -- c:\program files (x86)\Google\Chrome\application\chrome.exe [741704] =>.Google Inc® O39 - APT: Adobe Flash Player Updater - (.Adobe Systems Incorporated.) -- C:\Windows\Tasks\Adobe Flash Player Updater.job [830] © O39 - APT: GoogleUpdateTaskMachineCore - (.Google Inc..) -- C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job [860] © O39 - APT: GoogleUpdateTaskMachineUA - (.Google Inc..) -- C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job [864] © O39 - APT: Adobe Acrobat Update Task - (.Adobe Systems Incorporated.) -- C:\Windows\System32\Tasks\Adobe Acrobat Update Task [3886] © O39 - APT: Adobe Flash Player Updater - (.Adobe Systems Incorporated.) -- C:\Windows\System32\Tasks\Adobe Flash Player Updater [3718] © O39 - APT: CCleanerSkipUAC - (.Piriform Ltd.) -- C:\Windows\System32\Tasks\CCleanerSkipUAC [2780] © O39 - APT: Driver Booster SkipUAC (MouiMou) - (...) -- C:\Windows\System32\Tasks\Driver Booster SkipUAC (MouiMou) [2858] O39 - APT: Driver Booster SkipUAC (MouiMou0) - (...) -- C:\Windows\System32\Tasks\Driver Booster SkipUAC (MouiMou0) [2860] O39 - APT: Driver Booster SkipUAC (MouiMou_2) - (...) -- C:\Windows\System32\Tasks\Driver Booster SkipUAC (MouiMou_2) [2878] O39 - APT: gg_uac_daemon_MouiMou0 - (.Copyright (C) 2013.) -- C:\Windows\System32\Tasks\gg_uac_daemon_MouiMou0 [3496] O39 - APT: gg_uac_daemon_MouiMou_2 - (.Copyright (C) 2013.) -- C:\Windows\System32\Tasks\gg_uac_daemon_MouiMou_2 [3496] O39 - APT: GoogleUpdateTaskMachineCore - (.Google Inc..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore [3600] © O39 - APT: GoogleUpdateTaskMachineUA - (.Google Inc..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA [3836] © ---\\ Process running (11) - 2s [MD5.B85B5F067E29A94D598E3C35CC76EE2B] - (.AMD - AMD External Events Service Module.) -- C:\Windows\System32\atiesrxx.exe [239616] [PID.376] © [MD5.4ACAEA932EB9DA7F00722130AA2FBDB4] - (.AMD - AMD External Events Client Module.) -- C:\Windows\System32\atieclxx.exe [585216] [PID.1092] © [MD5.E0F25019195B8417F0F2BDA2D337EEE4] - (.Fork, Ltd. - Execution Service.) -- C:\Windows\Prey\wpxsvc.exe [611854] [PID.1708] [MD5.F00EA296DDA78FE0D3E830F680737664] - (.Fork, Ltd. - Light Event Monitor.) -- C:\Windows\Prey\versions\1.4.2\node_modules\triggers\bin\lightevt.exe [63336] [PID.2156] [MD5.55FBE6E4021BB042FAF23827523A8981] - (.Copyright (C) 2013 - Windows host process (Rundll32).) -- C:\Program Files (x86)\Garena Plus\ggdllhost.exe [55896] [PID.3092] {4EEAD9745E9F68E71D871268ABF2041C} [MD5.7788E12E0ABA690EC7466E6B600EF42E] - (.Tonec Inc. - Internet Download Manager (IDM).) -- C:\Program Files (x86)\Internet Download Manager\IDMan.exe [3907152] [PID.776] © [MD5.A98D23910862BE46A333D9EB1398C57E] - (.Brother Industries, Ltd. - ControlCenter Main Process.) -- C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe [505856] [PID.3708] © [MD5.0C0DD390CF53D506414AC2CAA68E7F34] - (.Brother Industries, Ltd. - Brother Help Application.) -- C:\Program Files (x86)\Brother\Brother Help\BrotherHelp.exe [2009088] [PID.3692] © [MD5.065818B8A2CD7F08D6DC8C598191548C] - (.Brother Industries, Ltd. - BrYNCSvc.) -- C:\Program Files (x86)\Browny02\BrYNSvc.exe [282112] [PID.3684] © [MD5.8EE66B490856B2823DF82BF1B747A738] - (.Brother Industries, Ltd. - ControlCenter UX System.) -- C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe [1448960] [PID.3916] © [MD5.633B6204CCEF51D1DF7293C23BBB35CF] - (.Copyright (C) 2015 Nicolas Coolman - ZHPDiag.) -- C:\Users\MouiMou_2\Downloads\ZHPDiag3.exe [2019328] [PID.4192] © ---\\ Google Chrome, Start,Search,Extensions (23) - 1s G0 - GCSP: Preferences [User Data\Default][HomePage] http://me-cdn.effectivemeasure.net G0 - GCSP: Preferences [User Data\Default][HomePage] http://s.effectivemeasure.net G0 - GCSP: Preferences [User Data\Default][HomePage] http://trophymanager.com G0 - GCSP: Preferences [User Data\Default][HomePage] http://www.google-analytics.com G0 - GCSP: Preferences [User Data\Default][HomePage] http://www.startimes.com G0 - GCSP: Preferences [User Data\Default][HomePage] http://accounts.google.com G0 - GCSP: Preferences [User Data\Default][HomePage] http://ssl.gstatic.com G0 - GCSP: Preferences [User Data\Default][HomePage] http://stats.g.doubleclick.net G0 - GCSP: Preferences [User Data\Default][HomePage] http://www.google.com G0 - GCSP: Preferences [User Data\Default][HomePage] http://www.google.dz G2 - GCE: Preference [User Data\Default] [aapocclcgogkmnckokdopfmhonfmgoek] Google Chrome manifest =>.Google Inc. G2 - GCE: Preference [User Data\Default] [aohghmighlieiainnegkcijnfilokake] Google Chrome manifest =>.Google Inc. G2 - GCE: Preference [User Data\Default] [apdfllckaahabafndbhieahigkjlhalf] Google Chrome manifest =>.Google Inc. G2 - GCE: Preference [User Data\Default] [blpcfgokakmgnkcojhhkbfbldkacnbeo] Google Chrome manifest =>.Google Inc. G2 - GCE: Preference [User Data\Default] [coobgpohoikkiipiblmjeljniedjpjpf] Google Chrome manifest =>.Google Inc. G2 - GCE: Preference [User Data\Default] [felcaaldnbdncclmgdcncolpebgiejap] Google Chrome manifest =>.Google Inc. G2 - GCE: Preference [User Data\Default] [ghbmnnjooekpmoecnnnilnnbdlolhkhi] __MSG_extName__ G2 - GCE: Preference [User Data\Default] [knkapnclbofjjgicpkfoagdjohlfjhpd] Little Alchemy G2 - GCE: Preference [User Data\Default] [kpiecbcckbofpmkkkdibbllpinceiihk] Google Chrome manifest =>.Google Inc. G2 - GCE: Preference [User Data\Default] [ngpampappnmepgilojfohadhhmbhlaek] IDM Integration Module G2 - GCE: Preference [User Data\Default] [nmmhkkegccagdldgiimedpiccmgmieda] Google Chrome manifest =>.Google Inc. G2 - GCE: Preference [User Data\Default] [omdakjcmkglenbhjadbccaookpfjihpa] TunnelBear VPN G2 - GCE: Preference [User Data\Default] [pjkljhegncpnkpknbcohdijeoejaedia] Google Chrome manifest =>.Google Inc. ---\\ Mozilla Firefox,Plugins,Start,Search,Extensions (9) - 2s P2 - EXT: (...) -- C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\amazondotcom.xml P2 - EXT: (...) -- C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\bing.xml P2 - EXT: (...) -- C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\ddg.xml P2 - EXT: (...) -- C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\eBay.xml P2 - EXT: (...) -- C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\google.xml P2 - EXT: (...) -- C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\twitter.xml P2 - EXT: (...) -- C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\wikipedia.xml P2 - EXT: (.Mozilla - Default.) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} © P2 - FPN: [HKLM] [@adobe.com/FlashPlayer] - (.Adobe Systems Incorporated.) -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_235.dll © ---\\ Internet Explorer Extensions, Start, Search (19) - 0s R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com R0 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com R0 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = www.google.com R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:noadd-ons R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:securityrisk R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Extensions Off Page = about:noadd-ons R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Security Risk Page = about:securityrisk R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} Orphean =>.Microsoft Internet Explorer R4 - HKLM\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter,EnabledV9 = 1 R4 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\PhishingFilter,EnabledV9 = 1 ---\\ Internet Explorer, Proxy Management (4) - 0s R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll ---\\ Line Analysis, IniFiles, Auto loading programs (3) - 0s F2 - REG:system.ini: UserInit=userinit.exe (.Microsoft Corporation.) © F2 - REG:system.ini: Shell=C:\Windows\explorer.exe (.Microsoft Corporation.) © F2 - REG:system.ini: VMApplet=C:\Windows\SysWOW64\SystemPropertiesPerformance.exe (.Microsoft Corporation.) © ---\\ Hosts file redirection (1) - 0s ~ Le fichier hôte est sain (The hosts file is clean) (21) ---\\ Browser Helper Object (BHO) (1) - 1s O2 - BHO: IDM Helper [64Bits] - {0055C089-8582-441B-A0BF-17B458C2A3A8} . (.Internet Download Manager, Tonec Inc. - IDM Browser Helper Object.) -- C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll =>.Tonec Inc.® ---\\ Auto loading programs from Registry and folders (17) - 2s O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] . (.Adobe Systems Incorporated - Adobe Updater Startup Utility.) -- C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe {680F632DF09C0A79D10CFBC36604CD2B} © O4 - HKCU\..\Run: [Speech Recognition] . (.Microsoft Corporation - Speech Recognition.) -- C:\Windows\Speech\Common\sapisvr.exe © O4 - HKCU\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe =>.Skype Software Sarl® O4 - HKCU\..\Run: [CCleaner Monitoring] . (.Piriform Ltd - CCleaner.) -- C:\Program Files\CCleaner\CCleaner64.exe =>.Piriform Ltd® O4 - HKCU\..\Run: [IDMan] . (.Tonec Inc. - Internet Download Manager (IDM).) -- C:\Program Files (x86)\Internet Download Manager\IDMan.exe © O4 - HKLM\..\Wow6432Node\Run: [ControlCenter4] . (.Brother Industries, Ltd. - ControlCenter Launcher.) -- C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe © O4 - HKLM\..\Wow6432Node\Run: [BrStsMon00] . (.Brother Industries, Ltd. - Status Monitor Application.) -- C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe © O4 - HKLM\..\Wow6432Node\Run: [BrHelp] . (.Brother Industries, Ltd. - Brother Help Application.) -- C:\Program Files (x86)\Brother\Brother Help\BrotherHelp.exe © O4 - HKLM\..\Wow6432Node\Run: [AdobeCEPServiceManager] . (.Adobe Systems Incorporated - Adobe CEP Service Manager.) -- C:\Program Files (x86)\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe =>.Adobe Systems Incorporated® O4 - HKUS\.DEFAULT\..\Run: [OKAYFREEDOM_Agent] C:\Program Files (x86)\OkayFreedom\OkayFreedomClient.exe (.not file.) O4 - HKUS\.DEFAULT\..\Run: [Steganos VPN Proxy Handler] C:\Program Files (x86)\OkayFreedom\OkayFreedomClient.exe (.not file.) O4 - HKUS\S-1-5-18\..\Run: [OKAYFREEDOM_Agent] C:\Program Files (x86)\OkayFreedom\OkayFreedomClient.exe (.not file.) O4 - HKUS\S-1-5-18\..\Run: [Steganos VPN Proxy Handler] C:\Program Files (x86)\OkayFreedom\OkayFreedomClient.exe (.not file.) O4 - HKUS\S-1-5-21-2231676356-680805681-2855567490-1002\..\Run: [Speech Recognition] . (.Microsoft Corporation - Speech Recognition.) -- C:\Windows\Speech\Common\sapisvr.exe © O4 - HKUS\S-1-5-21-2231676356-680805681-2855567490-1002\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe =>.Skype Software Sarl® O4 - HKUS\S-1-5-21-2231676356-680805681-2855567490-1002\..\Run: [CCleaner Monitoring] . (.Piriform Ltd - CCleaner.) -- C:\Program Files\CCleaner\CCleaner64.exe =>.Piriform Ltd® O4 - HKUS\S-1-5-21-2231676356-680805681-2855567490-1002\..\Run: [IDMan] . (.Tonec Inc. - Internet Download Manager (IDM).) -- C:\Program Files (x86)\Internet Download Manager\IDMan.exe © ---\\ Lop.com/Domain Hijackers (2) - 0s O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 198.153.192.50 198.153.194.50 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: DhcpNameServer = 198.153.192.50 198.153.194.50 ---\\ Extra protocols (23) - 1s O18 - Handler: about [64Bits] - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Microsoft (R) HTML Viewer.) -- C:\Windows\SysWOW64\mshtml.dll © O18 - Handler: cdl [64Bits] - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} . (.Microsoft Corporation - OLE32 Extensions for Win32.) -- C:\Windows\SysWOW64\urlmon.dll © O18 - Handler: dvd [64Bits] - {12D51199-0DB5-46FE-A120-47A3D7D937CC} . (.Microsoft Corporation - ActiveX control for streaming video.) -- C:\Windows\SysWOW64\MSVidCtl.dll © O18 - Handler: file [64Bits] - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - OLE32 Extensions for Win32.) -- C:\Windows\SysWOW64\urlmon.dll © O18 - Handler: ftp [64Bits] - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - OLE32 Extensions for Win32.) -- C:\Windows\SysWOW64\urlmon.dll © O18 - Handler: http [64Bits] - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - OLE32 Extensions for Win32.) -- C:\Windows\SysWOW64\urlmon.dll © O18 - Handler: https [64Bits] - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - OLE32 Extensions for Win32.) -- C:\Windows\SysWOW64\urlmon.dll © O18 - Handler: its [64Bits] - {9D148291-B9C8-11D0-A4CC-0000F80149F6} . (.Microsoft Corporation - Microsoft® InfoTech Storage System Library.) -- C:\Windows\SysWOW64\itss.dll © O18 - Handler: javascript [64Bits] - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Microsoft (R) HTML Viewer.) -- C:\Windows\SysWOW64\mshtml.dll © O18 - Handler: local [64Bits] - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - OLE32 Extensions for Win32.) -- C:\Windows\SysWOW64\urlmon.dll © O18 - Handler: mailto [64Bits] - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Microsoft (R) HTML Viewer.) -- C:\Windows\SysWOW64\mshtml.dll © O18 - Handler: mhtml [64Bits] - {05300401-BCBC-11d0-85E3-00C04FD85AB4} . (.Microsoft Corporation - Microsoft Internet Messaging API Resources.) -- C:\Windows\SysWOW64\inetcomm.dll © O18 - Handler: mk [64Bits] - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - OLE32 Extensions for Win32.) -- C:\Windows\SysWOW64\urlmon.dll © O18 - Handler: ms-help [64Bits] - {314111c7-a502-11d2-bbca-00c04f8ec294} . (.Microsoft Corporation - Microsoft® Help Data Services Module.) -- C:\Program Files (x86)\Common Files\Microsoft Shared\Help\hxds.dll =>.Microsoft Corporation® O18 - Handler: ms-its [64Bits] - {9D148291-B9C8-11D0-A4CC-0000F80149F6} . (.Microsoft Corporation - Microsoft® InfoTech Storage System Library.) -- C:\Windows\SysWOW64\itss.dll © O18 - Handler: mso-offdap11 [64Bits] - {32505114-5902-49B2-880A-1F7738E5A384} . (.Microsoft Corporation - Microsoft Office Web Components 2003.) -- C:\Program Files (x86)\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL =>.Microsoft Corporation® O18 - Handler: res [64Bits] - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Microsoft (R) HTML Viewer.) -- C:\Windows\SysWOW64\mshtml.dll © O18 - Handler: tv [64Bits] - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} . (.Microsoft Corporation - ActiveX control for streaming video.) -- C:\Windows\SysWOW64\MSVidCtl.dll © O18 - Handler: vbscript [64Bits] - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Microsoft (R) HTML Viewer.) -- C:\Windows\SysWOW64\mshtml.dll © O18 - Filter: application/octet-stream [64Bits] - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\SysWOW64\mscoree.dll © O18 - Filter: application/x-complus [64Bits] - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\SysWOW64\mscoree.dll © O18 - Filter: application/x-msdownload [64Bits] - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\SysWOW64\mscoree.dll © O18 - Filter: text/xml [64Bits] - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL =>.Microsoft Corporation® ---\\ Software installed (47) - 11s O42 - Logiciel: µTorrent - (.BitTorrent Inc..) [HKCU][64Bits] -- uTorrent O42 - Logiciel: Action! - (.Mirillis.) [HKLM][64Bits] -- {20793A28-F345-4B99-8347-C0949F0E04EC} © O42 - Logiciel: Adobe Acrobat Reader DC - (.Adobe Systems Incorporated.) [HKLM][64Bits] -- {AC76BA86-7AD7-1033-7B44-AC0F074E4100} © O42 - Logiciel: Adobe Flash Player 20 NPAPI - (.Adobe Systems Incorporated.) [HKLM][64Bits] -- Adobe Flash Player NPAPI =>.Adobe Systems Incorporated® O42 - Logiciel: Adobe Photoshop CC - (.Adobe Systems Incorporated.) [HKLM][64Bits] -- {2D99B50E-431D-4AA8-85C1-172A6F8BCF09} {680F632DF09C0A79D10CFBC36604CD2B} © O42 - Logiciel: Adobe Refresh Manager - (.Adobe Systems Incorporated.) [HKLM][64Bits] -- {AC76BA86-0804-1033-1959-001824161310} © O42 - Logiciel: Adobe Shockwave Player 12.1 - (.Adobe Systems, Inc..) [HKLM][64Bits] -- Adobe Shockwave Player © O42 - Logiciel: ALLConverter PRO 1.3 - (.ALLCinema, Inc..) [HKLM][64Bits] -- {9370105C-71BB-4FF9-A85B-36D79B95457A}_is1 O42 - Logiciel: Brother MFL-Pro Suite DCP-J152W - (.Brother Industries, Ltd..) [HKLM][64Bits] -- {B742757A-7658-4E09-A51A-085CF0F7F4D3} =>.Macrovision Corporation® O42 - Logiciel: C900 - (...) [HKLM][64Bits] -- {d1e17d14-cabc-4f6f-9f46-c7ecf813645e}.sdb O42 - Logiciel: CCleaner - (.Piriform.) [HKLM][64Bits] -- CCleaner =>.Piriform Ltd® O42 - Logiciel: EaseUS Data Recovery Wizard 8.5 - (.EaseUS.) [HKLM][64Bits] -- EaseUS Data Recovery Wizard 8.5_is1 =>.CHENGDU YIWO Tech Development Co., Ltd.® O42 - Logiciel: ESET Smart Security - (.ESET, spol. s r.o..) [HKLM][64Bits] -- {4C79F86A-A91F-42EC-A78E-B9CBC4D984F2} O42 - Logiciel: FormatFactory 3.5.0.0 - (.Format Factory.) [HKLM][64Bits] -- FormatFactory © O42 - Logiciel: Google Chrome - (.Google Inc‎.‎.) [HKLM][64Bits] -- Google Chrome =>.Google Inc® O42 - Logiciel: Google Update Helper - (.Google Inc..) [HKLM][64Bits] -- {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} © O42 - Logiciel: Google Update Helper - (.Google Inc..) [HKLM][64Bits] -- {A92DAB39-4E2C-4304-9AB6-BC44E68B55E2} © O42 - Logiciel: Intel(R) Processor Graphics - (.Intel Corporation.) [HKLM][64Bits] -- {F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA} =>.Intel Corporation - pGFX® O42 - Logiciel: Internet Download Manager - (.Tonec Inc..) [HKLM][64Bits] -- Internet Download Manager =>.Tonec Inc.® O42 - Logiciel: Java 8 Update 31 - (.Oracle Corporation.) [HKLM][64Bits] -- {26A24AE4-039D-4CA4-87B4-2F83218031F0} © O42 - Logiciel: Java 8 Update 40 - (.Oracle Corporation.) [HKLM][64Bits] -- {26A24AE4-039D-4CA4-87B4-2F83218040F0} © O42 - Logiciel: Java 8 Update 40 (64-bit) - (.Oracle Corporation.) [HKLM][64Bits] -- {26A24AE4-039D-4CA4-87B4-2F86418040F0} © O42 - Logiciel: Java Auto Updater - (.Oracle Corporation.) [HKLM][64Bits] -- {4A03706F-666A-4037-7777-5F2748764D10} © O42 - Logiciel: LenovoUsbDriver 1.0.12 - (.Lenovo.) [HKLM][64Bits] -- LenovoUsbDriver © O42 - Logiciel: Ma-Config.com (64 bits) - (.Cybelsoft.) [HKLM][64Bits] -- {97B0A315-547D-44DE-97FE-8D8C3FB2009A} © O42 - Logiciel: Malwarebytes Anti-Malware version 2.2.0.1024 - (.Malwarebytes.) [HKLM][64Bits] -- Malwarebytes Anti-Malware_is1 © O42 - Logiciel: Microsoft PowerPoint Viewer - (.Microsoft Corporation.) [HKLM][64Bits] -- {95140000-00AF-0409-0000-0000000FF1CE} © O42 - Logiciel: Mozilla Firefox 38.0.5 (x86 en-US) - (.Mozilla.) [HKLM][64Bits] -- Mozilla Firefox 38.0.5 (x86 en-US) =>.Mozilla Corporation® O42 - Logiciel: Mozilla Maintenance Service - (.Mozilla.) [HKLM][64Bits] -- MozillaMaintenanceService © O42 - Logiciel: MSVCRT Redists - (.Sony Creative Software Inc..) [HKLM][64Bits] -- {C2B8CBDE-5232-11E3-B494-F04DA23A5C58} © O42 - Logiciel: Norton Security Scan - (.Symantec Corporation.) [HKLM][64Bits] -- NSS {2BBAF83D7BEDD958309D62B93EE41074} © O42 - Logiciel: Notepad++ - (.Notepad++ Team.) [HKLM][64Bits] -- Notepad++ © O42 - Logiciel: PDF Settings CC - (.Adobe Systems Incorporated.) [HKLM][64Bits] -- {1FBAE18D-4DE4-47AA-83EC-D1B046F262DC} © O42 - Logiciel: Prey Anti-Theft - (.Prey, Inc..) [HKLM][64Bits] -- {33FC9AAE-BB7F-4865-84B0-15CBE555731D} O42 - Logiciel: Realtek High Definition Audio Driver - (.Realtek Semiconductor Corp..) [HKLM][64Bits] -- {F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC} =>.Realtek Semiconductor Corp® O42 - Logiciel: Recuva - (.Piriform.) [HKLM][64Bits] -- Recuva =>.Piriform Ltd® O42 - Logiciel: Skype™ 7.8 - (.Skype Technologies S.A..) [HKLM][64Bits] -- {6A0549A9-1B96-498C-ACBC-3943001FEB19} © O42 - Logiciel: swMSM - (.Adobe Systems, Inc.) [HKLM][64Bits] -- {612C34C7-5E90-47D8-9B5C-0F717DD82726} © O42 - Logiciel: System Requirements Lab - (.Husdawg, LLC.) [HKLM][64Bits] -- {0F659036-14C7-4622-9505-35A0DC93526A} © O42 - Logiciel: TeraCopy 2.3 - (.Code Sector.) [HKLM][64Bits] -- TeraCopy_is1 {71C5DF6381C2F42A65159FEE0540F57E} O42 - Logiciel: UltraISO Premium V9.33 - (...) [HKLM][64Bits] -- UltraISO_is1 O42 - Logiciel: Unity Web Player - (.Unity Technologies ApS.) [HKCU][64Bits] -- UnityWebPlayer © O42 - Logiciel: UsbFix - (.El Desaparecido - www.usbfix.net - www.sosvirus.net.) [HKLM][64Bits] -- Usbfix © O42 - Logiciel: Windows Driver Package - MediaTek Inc. (usbser) Ports (01/05/2012 2.0000.0 - (.MediaTek Inc..) [HKLM][64Bits] -- 49D9ABA9270C5BDFD7AE1BEB607D36B26BB90235 =>.Microsoft Windows® O42 - Logiciel: Windows Driver Package - MediaTek Inc. (usbser) Ports (12/24/2011 2.0000.0 - (.MediaTek Inc..) [HKLM][64Bits] -- D0E6296D177F42BB31C0200E49412003DB6C4633 =>.Microsoft Windows® O42 - Logiciel: WinRAR 5.21 بيتا 1 (32-بت) - (.win.rar GmbH.) [HKLM][64Bits] -- WinRAR archiver =>.win.rar GmbH® O42 - Logiciel: ZHPDiag 2015 - (.Nicolas Coolman.) [HKLM][64Bits] -- ZHPDiag_is1 © ---\\ HKCU & HKLM Software Keys (126) - 11s HKLM\SOFTWARE\Wow6432Node\Adobe HKLM\SOFTWARE\Wow6432Node\AdwCleaner HKLM\SOFTWARE\Wow6432Node\AppDataLow HKLM\SOFTWARE\Wow6432Node\ATI HKLM\SOFTWARE\Wow6432Node\AVAST Software HKLM\SOFTWARE\Wow6432Node\AviSynth HKLM\SOFTWARE\Wow6432Node\AVS4YOU HKLM\SOFTWARE\Wow6432Node\Big Fish Games HKLM\SOFTWARE\Wow6432Node\Brother HKLM\SOFTWARE\Wow6432Node\Brother Industries, Ltd. HKLM\SOFTWARE\Wow6432Node\CDDB HKLM\SOFTWARE\Wow6432Node\Dassault Systemes HKLM\SOFTWARE\Wow6432Node\EasyBoot Systems HKLM\SOFTWARE\Wow6432Node\Electronic Arts HKLM\SOFTWARE\Wow6432Node\ESET HKLM\SOFTWARE\Wow6432Node\Garena HKLM\SOFTWARE\Wow6432Node\GNU HKLM\SOFTWARE\Wow6432Node\Google HKLM\SOFTWARE\Wow6432Node\HaaliMkx HKLM\SOFTWARE\Wow6432Node\IM Providers HKLM\SOFTWARE\Wow6432Node\InstallShield HKLM\SOFTWARE\Wow6432Node\Intel HKLM\SOFTWARE\Wow6432Node\Internet Download Manager HKLM\SOFTWARE\Wow6432Node\IO3O HKLM\SOFTWARE\Wow6432Node\IObit HKLM\SOFTWARE\Wow6432Node\JavaSoft HKLM\SOFTWARE\Wow6432Node\JreMetrics HKLM\SOFTWARE\Wow6432Node\Khronos HKLM\SOFTWARE\Wow6432Node\Licenses HKLM\SOFTWARE\Wow6432Node\Macromedia HKLM\SOFTWARE\Wow6432Node\Macrovision HKLM\SOFTWARE\Wow6432Node\Malwarebytes' Anti-Malware HKLM\SOFTWARE\Wow6432Node\Mozilla HKLM\SOFTWARE\Wow6432Node\mozilla.org HKLM\SOFTWARE\Wow6432Node\MozillaPlugins HKLM\SOFTWARE\Wow6432Node\Multi Theft Auto: San Andreas All HKLM\SOFTWARE\Wow6432Node\Norton HKLM\SOFTWARE\Wow6432Node\Notepad++ HKLM\SOFTWARE\Wow6432Node\Nuance HKLM\SOFTWARE\Wow6432Node\ODBC HKLM\SOFTWARE\Wow6432Node\OpenVPN HKLM\SOFTWARE\Wow6432Node\Opera Software HKLM\SOFTWARE\Wow6432Node\Persits Software HKLM\SOFTWARE\Wow6432Node\Prey HKLM\SOFTWARE\Wow6432Node\Skype HKLM\SOFTWARE\Wow6432Node\SolidWorks HKLM\SOFTWARE\Wow6432Node\Sony Creative Software HKLM\SOFTWARE\Wow6432Node\SOSVirus HKLM\SOFTWARE\Wow6432Node\Steganos HKLM\SOFTWARE\Wow6432Node\Symantec HKLM\SOFTWARE\Wow6432Node\Volatile HKLM\SOFTWARE\Wow6432Node\WinRAR HKLM\SOFTWARE\Wow6432Node\RegisteredApplications HKCU\SOFTWARE\4shared HKCU\SOFTWARE\4shared Desktop HKCU\SOFTWARE\Adobe HKCU\SOFTWARE\ALLConverter PRO HKCU\SOFTWARE\AppDataLow HKCU\SOFTWARE\ATI HKCU\SOFTWARE\AVS4YOU HKCU\SOFTWARE\BitTorrent HKCU\SOFTWARE\Brother HKCU\SOFTWARE\Chromium HKCU\SOFTWARE\Code Sector HKCU\SOFTWARE\CodeGear HKCU\SOFTWARE\CoolROM HKCU\SOFTWARE\Dassault Systemes HKCU\SOFTWARE\DirectShow HKCU\SOFTWARE\DownloadManager HKCU\SOFTWARE\Drivers HKCU\SOFTWARE\EasyBoot Systems HKCU\SOFTWARE\eDrawings HKCU\SOFTWARE\ESET HKCU\SOFTWARE\FreeTime HKCU\SOFTWARE\fv HKCU\SOFTWARE\GaBi HKCU\SOFTWARE\GNU HKCU\SOFTWARE\Google HKCU\SOFTWARE\Haali HKCU\SOFTWARE\IE Tab HKCU\SOFTWARE\IM Providers HKCU\SOFTWARE\InstallPath HKCU\SOFTWARE\Intel HKCU\SOFTWARE\JavaSoft HKCU\SOFTWARE\Kiloo Games HKCU\SOFTWARE\Kuma Games HKCU\SOFTWARE\Licenses HKCU\SOFTWARE\Local AppWizard-Generated Applications HKCU\SOFTWARE\Macromedia HKCU\SOFTWARE\MCAFEE HKCU\SOFTWARE\MetaQuotes Software HKCU\SOFTWARE\Mirillis HKCU\SOFTWARE\Mozilla HKCU\SOFTWARE\MozillaPlugins HKCU\SOFTWARE\Netscape HKCU\SOFTWARE\ODBC HKCU\SOFTWARE\Opera Software HKCU\SOFTWARE\Piriform HKCU\SOFTWARE\QtProject HKCU\SOFTWARE\RegisteredApplications HKCU\SOFTWARE\Singular Inversions HKCU\SOFTWARE\Skype HKCU\SOFTWARE\SolidWorks HKCU\SOFTWARE\Sony Creative Software HKCU\SOFTWARE\srac HKCU\SOFTWARE\Steganos HKCU\SOFTWARE\System Requirements Lab HKCU\SOFTWARE\System32 HKCU\SOFTWARE\The Silicon Realms Toolworks HKCU\SOFTWARE\Trolltech HKCU\SOFTWARE\Unity HKCU\SOFTWARE\UsbFix HKCU\SOFTWARE\Vail Systems HKCU\SOFTWARE\Valve HKCU\SOFTWARE\VB and VBA Program Settings HKCU\SOFTWARE\Web Solution Mart HKCU\SOFTWARE\Win HKCU\SOFTWARE\WinRAR HKCU\SOFTWARE\WinRAR SFX HKCU\SOFTWARE\Wow6432Node HKCU\SOFTWARE\ZebHelpProcess Helper HKCU\SOFTWARE\AppDataLow\Software HKCU\SOFTWARE\AppDataLow\Software\Adobe HKCU\SOFTWARE\AppDataLow\Software\JavaSoft HKCU\SOFTWARE\AppDataLow\Software\Macromedia HKCU\SOFTWARE\AppDataLow\Software\Unity ---\\ Contents of the Common Files folders (237) - 10s O43 - CFD: 07/07/2015 - [] D -- C:\Program Files (x86)\Adobe O43 - CFD: 15/02/2015 - [] D -- C:\Program Files (x86)\ALLConverter PRO O43 - CFD: 19/09/2015 - [0] D -- C:\Program Files (x86)\AVS4YOU O43 - CFD: 07/02/2015 - [] D -- C:\Program Files (x86)\Brother O43 - CFD: 07/02/2015 - [] D -- C:\Program Files (x86)\Browny02 O43 - CFD: 15/12/2015 - [] D -- C:\Program Files (x86)\Common Files O43 - CFD: 07/02/2015 - [] D -- C:\Program Files (x86)\ControlCenter4 O43 - CFD: 05/07/2015 - [] D -- C:\Program Files (x86)\Counter-Strike 1.6 O43 - CFD: 29/03/2015 - [] D -- C:\Program Files (x86)\Desktop Typs O43 - CFD: 24/08/2015 - [] D -- C:\Program Files (x86)\Free Download Manager O43 - CFD: 27/01/2015 - [] D -- C:\Program Files (x86)\FreeTime O43 - CFD: 13/03/2015 - [] D -- C:\Program Files (x86)\Garena Plus O43 - CFD: 25/01/2015 - [] D -- C:\Program Files (x86)\Google O43 - CFD: 07/02/2015 - [] HD -- C:\Program Files (x86)\InstallShield Installation Information O43 - CFD: 25/01/2015 - [] D -- C:\Program Files (x86)\Intel O43 - CFD: 27/09/2015 - [] D -- C:\Program Files (x86)\Internet Download Manager O43 - CFD: 11/12/2015 - [] D -- C:\Program Files (x86)\Internet Explorer O43 - CFD: 22/02/2015 - [] D -- C:\Program Files (x86)\ITSecTeam O43 - CFD: 19/03/2015 - [] D -- C:\Program Files (x86)\Java O43 - CFD: 22/03/2015 - [] D -- C:\Program Files (x86)\Kuma Games BETA O43 - CFD: 07/11/2015 - [] D -- C:\Program Files (x86)\LenovoUsbDriver O43 - CFD: 30/05/2015 - [] D -- C:\Program Files (x86)\Linphone O43 - CFD: 15/12/2015 - [] D -- C:\Program Files (x86)\Malwarebytes Anti-Malware O43 - CFD: 04/12/2015 - [] D -- C:\Program Files (x86)\Microsoft Office O43 - CFD: 25/01/2015 - [] D -- C:\Program Files (x86)\Microsoft Visual Studio O43 - CFD: 25/01/2015 - [] D -- C:\Program Files (x86)\Microsoft Works O43 - CFD: 07/11/2015 - [] D -- C:\Program Files (x86)\Microsoft.NET O43 - CFD: 20/08/2015 - [0] D -- C:\Program Files (x86)\Mirillis O43 - CFD: 25/06/2015 - [] D -- C:\Program Files (x86)\Mozilla Firefox O43 - CFD: 25/06/2015 - [] D -- C:\Program Files (x86)\Mozilla Maintenance Service O43 - CFD: 11/03/2015 - [] D -- C:\Program Files (x86)\MSBuild O43 - CFD: 04/12/2015 - [] D -- C:\Program Files (x86)\MSECache O43 - CFD: 24/08/2015 - [] D -- C:\Program Files (x86)\MTA San Andreas 1.5 O43 - CFD: 26/03/2015 - [] D -- C:\Program Files (x86)\Norton Security Scan O43 - CFD: 26/03/2015 - [] D -- C:\Program Files (x86)\NortonInstaller O43 - CFD: 27/07/2015 - [] D -- C:\Program Files (x86)\Notepad++ O43 - CFD: 04/04/2015 - [] D -- C:\Program Files (x86)\Opera O43 - CFD: 04/04/2015 - [0] D -- C:\Program Files (x86)\R.G. Mechanics O43 - CFD: 11/03/2015 - [] D -- C:\Program Files (x86)\Reference Assemblies O43 - CFD: 24/08/2015 - [0] D -- C:\Program Files (x86)\Rockstar Games O43 - CFD: 24/08/2015 - [] RD -- C:\Program Files (x86)\Skype O43 - CFD: 12/04/2015 - [] D -- C:\Program Files (x86)\SystemRequirementsLab O43 - CFD: 15/04/2015 - [] D -- C:\Program Files (x86)\Temp O43 - CFD: 10/11/2015 - [] D -- C:\Program Files (x86)\UltraISO O43 - CFD: 14/08/2015 - [] D -- C:\Program Files (x86)\Windows Defender O43 - CFD: 25/04/2015 - [] D -- C:\Program Files (x86)\Windows Mail O43 - CFD: 25/04/2015 - [] D -- C:\Program Files (x86)\Windows Media Player O43 - CFD: 25/04/2015 - [] D -- C:\Program Files (x86)\Windows Multimedia Platform O43 - CFD: 22/08/2013 - [] D -- C:\Program Files (x86)\Windows NT O43 - CFD: 25/04/2015 - [] D -- C:\Program Files (x86)\Windows Photo Viewer O43 - CFD: 25/04/2015 - [] D -- C:\Program Files (x86)\Windows Portable Devices O43 - CFD: 22/08/2013 - [] SHD -- C:\Program Files (x86)\Windows Sidebar O43 - CFD: 22/08/2013 - [] D -- C:\Program Files (x86)\WindowsPowerShell O43 - CFD: 25/01/2015 - [] D -- C:\Program Files (x86)\WinRAR O43 - CFD: 04/04/2015 - [] D -- C:\Program Files (x86)\ZHPDiag O43 - CFD: 25/04/2015 - [] RD -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility O43 - CFD: 25/04/2015 - [] RD -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories O43 - CFD: 11/11/2015 - [] RD -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools O43 - CFD: 15/02/2015 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ALLConverter PRO O43 - CFD: 07/02/2015 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother O43 - CFD: 25/01/2015 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner O43 - CFD: 16/03/2015 - [0] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Counter-Strike 1.6 O43 - CFD: 05/09/2015 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EaseUS Data Recovery Wizard 8.5 O43 - CFD: 15/12/2015 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET O43 - CFD: 22/03/2015 - [0] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games O43 - CFD: 05/02/2015 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Garena O43 - CFD: 04/07/2015 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome O43 - CFD: 27/09/2015 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Download Manager O43 - CFD: 15/02/2015 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java O43 - CFD: 07/02/2015 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ma-config.com O43 - CFD: 22/08/2013 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance O43 - CFD: 15/12/2015 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware O43 - CFD: 25/01/2015 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office O43 - CFD: 07/11/2015 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Visual Studio 2005 O43 - CFD: 24/07/2015 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mirillis O43 - CFD: 26/03/2015 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Security Scan O43 - CFD: 27/07/2015 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++ O43 - CFD: 04/10/2015 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Recuva O43 - CFD: 21/08/2015 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype O43 - CFD: 15/12/2015 - [] RD -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp O43 - CFD: 25/04/2015 - [] RD -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools O43 - CFD: 18/03/2014 - [0] RHD -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tablet PC O43 - CFD: 25/01/2015 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeraCopy O43 - CFD: 10/11/2015 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UltraISO O43 - CFD: 25/01/2015 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR O43 - CFD: 04/04/2015 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP O43 - CFD: 07/07/2015 - [] D -- C:\ProgramData\Adobe O43 - CFD: 07/11/2015 - [] D -- C:\ProgramData\Apple O43 - CFD: 22/08/2013 - [0] SHD -- C:\ProgramData\Application Data O43 - CFD: 23/02/2015 - [] D -- C:\ProgramData\AVAST Software O43 - CFD: 08/08/2015 - [] D -- C:\ProgramData\AVS4YOU O43 - CFD: 27/01/2015 - [] D -- C:\ProgramData\Baidu O43 - CFD: 24/03/2015 - [] D -- C:\ProgramData\Big Fish O43 - CFD: 07/02/2015 - [] D -- C:\ProgramData\Brother O43 - CFD: 07/02/2015 - [] D -- C:\ProgramData\ControlCenter4 O43 - CFD: 08/11/2015 - [] D -- C:\ProgramData\DassaultSystemes O43 - CFD: 07/02/2015 - [] D -- C:\ProgramData\Dell O43 - CFD: 22/08/2013 - [0] SHD -- C:\ProgramData\Desktop O43 - CFD: 22/08/2013 - [0] SHD -- C:\ProgramData\Documents O43 - CFD: 15/12/2015 - [] D -- C:\ProgramData\ESET O43 - CFD: 25/02/2015 - [0] D -- C:\ProgramData\firebird O43 - CFD: 07/11/2015 - [] D -- C:\ProgramData\FLEXnet O43 - CFD: 11/07/2015 - [] D -- C:\ProgramData\FreeDownloadManager.ORG O43 - CFD: 17/03/2015 - [] D -- C:\ProgramData\GarenaMessenger O43 - CFD: 15/12/2015 - [] D -- C:\ProgramData\HitmanPro O43 - CFD: 25/01/2015 - [0] D -- C:\ProgramData\IDM O43 - CFD: 22/03/2015 - [0] D -- C:\ProgramData\Informer Technologies, Inc O43 - CFD: 25/01/2015 - [] D -- C:\ProgramData\InstallShield O43 - CFD: 25/01/2015 - [] D -- C:\ProgramData\IObit O43 - CFD: 06/02/2015 - [] D -- C:\ProgramData\iolo O43 - CFD: 12/12/2015 - [] D -- C:\ProgramData\KMSAutoS =>PUP.Optional.Windows O43 - CFD: 24/03/2015 - [0] D -- C:\ProgramData\KONAMI O43 - CFD: 18/03/2015 - [] D -- C:\ProgramData\Logs O43 - CFD: 07/02/2015 - [] D -- C:\ProgramData\ma-config.com O43 - CFD: 24/02/2015 - [] D -- C:\ProgramData\Malwarebytes O43 - CFD: 10/04/2015 - [] D -- C:\ProgramData\McAfee O43 - CFD: 13/04/2015 - [] D -- C:\ProgramData\MetaQuotes O43 - CFD: 10/02/2015 - [] SD -- C:\ProgramData\Microsoft O43 - CFD: 25/01/2015 - [] D -- C:\ProgramData\Microsoft Help O43 - CFD: 24/07/2015 - [] D -- C:\ProgramData\Mirillis O43 - CFD: 22/03/2015 - [] D -- C:\ProgramData\Mozilla O43 - CFD: 24/08/2015 - [] AD -- C:\ProgramData\MTA San Andreas All O43 - CFD: 26/03/2015 - [] D -- C:\ProgramData\Norton O43 - CFD: 26/03/2015 - [] D -- C:\ProgramData\NortonInstaller O43 - CFD: 15/02/2015 - [] D -- C:\ProgramData\Oracle O43 - CFD: 27/10/2015 - [] D -- C:\ProgramData\Origin O43 - CFD: 07/11/2015 - [] D -- C:\ProgramData\Package Cache O43 - CFD: 25/02/2015 - [] D -- C:\ProgramData\PassMark O43 - CFD: 23/07/2015 - [] D -- C:\ProgramData\ProductData O43 - CFD: 23/03/2015 - [0] D -- C:\ProgramData\regid.1986-12.com.adobe O43 - CFD: 25/04/2015 - [] D -- C:\ProgramData\regid.1991-06.com.microsoft O43 - CFD: 21/08/2015 - [] D -- C:\ProgramData\Skype O43 - CFD: 15/12/2015 - [0] D -- C:\ProgramData\Sony O43 - CFD: 12/07/2015 - [] D -- C:\ProgramData\SP_FT_Logs O43 - CFD: 07/11/2015 - [] D -- C:\ProgramData\SP_MDT_Logs O43 - CFD: 22/08/2013 - [0] SHD -- C:\ProgramData\Start Menu O43 - CFD: 15/02/2015 - [] D -- C:\ProgramData\Sun O43 - CFD: 12/04/2015 - [] D -- C:\ProgramData\SystemRequirementsLab O43 - CFD: 19/03/2015 - [] AD -- C:\ProgramData\TEMP O43 - CFD: 22/08/2013 - [0] SHD -- C:\ProgramData\Templates O43 - CFD: 07/07/2015 - [] D -- C:\Program Files (x86)\Common Files\Adobe O43 - CFD: 19/09/2015 - [] D -- C:\Program Files (x86)\Common Files\AVSMedia O43 - CFD: 25/01/2015 - [] D -- C:\Program Files (x86)\Common Files\DESIGNER O43 - CFD: 10/11/2015 - [] D -- C:\Program Files (x86)\Common Files\EZB Systems O43 - CFD: 25/01/2015 - [] D -- C:\Program Files (x86)\Common Files\Intel O43 - CFD: 19/03/2015 - [] D -- C:\Program Files (x86)\Common Files\Java O43 - CFD: 04/12/2015 - [] D -- C:\Program Files (x86)\Common Files\Microsoft Shared O43 - CFD: 22/08/2013 - [] D -- C:\Program Files (x86)\Common Files\Services O43 - CFD: 21/08/2015 - [] D -- C:\Program Files (x86)\Common Files\Skype O43 - CFD: 15/12/2015 - [0] D -- C:\Program Files (x86)\Common Files\SOLIDWORKS Shared O43 - CFD: 24/08/2015 - [] D -- C:\Program Files (x86)\Common Files\Steganos O43 - CFD: 25/04/2015 - [] D -- C:\Program Files (x86)\Common Files\System O43 - CFD: 19/03/2015 - [] D -- C:\Users\MouiMou_2\AppData\Roaming\.huntedcowcache O43 - CFD: 07/07/2015 - [] D -- C:\Users\MouiMou_2\AppData\Roaming\Adobe O43 - CFD: 08/08/2015 - [] D -- C:\Users\MouiMou_2\AppData\Roaming\AVS4YOU O43 - CFD: 14/02/2015 - [] RD -- C:\Users\MouiMou_2\AppData\Roaming\Brother O43 - CFD: 07/02/2015 - [] D -- C:\Users\MouiMou_2\AppData\Roaming\ControlCenter4 O43 - CFD: 07/11/2015 - [0] D -- C:\Users\MouiMou_2\AppData\Roaming\DassaultSystemes O43 - CFD: 17/12/2015 - [] D -- C:\Users\MouiMou_2\AppData\Roaming\DMCache O43 - CFD: 08/11/2015 - [0] D -- C:\Users\MouiMou_2\AppData\Roaming\EDrawings O43 - CFD: 14/03/2015 - [] D -- C:\Users\MouiMou_2\AppData\Roaming\FaceGen O43 - CFD: 17/03/2015 - [] D -- C:\Users\MouiMou_2\AppData\Roaming\GarenaPlus O43 - CFD: 25/04/2015 - [] D -- C:\Users\MouiMou_2\AppData\Roaming\Identities O43 - CFD: 24/11/2015 - [] D -- C:\Users\MouiMou_2\AppData\Roaming\IDM O43 - CFD: 07/02/2015 - [] D -- C:\Users\MouiMou_2\AppData\Roaming\InstallShield O43 - CFD: 31/01/2015 - [] D -- C:\Users\MouiMou_2\AppData\Roaming\IObit O43 - CFD: 20/03/2015 - [] D -- C:\Users\MouiMou_2\AppData\Roaming\Kuma Games O43 - CFD: 30/05/2015 - [] D -- C:\Users\MouiMou_2\AppData\Roaming\Linphone O43 - CFD: 28/01/2015 - [] D -- C:\Users\MouiMou_2\AppData\Roaming\Macromedia O43 - CFD: 13/04/2015 - [] D -- C:\Users\MouiMou_2\AppData\Roaming\MetaQuotes O43 - CFD: 16/12/2015 - [] SD -- C:\Users\MouiMou_2\AppData\Roaming\Microsoft O43 - CFD: 24/07/2015 - [] D -- C:\Users\MouiMou_2\AppData\Roaming\Mirillis O43 - CFD: 22/03/2015 - [] D -- C:\Users\MouiMou_2\AppData\Roaming\Mozilla O43 - CFD: 27/07/2015 - [] D -- C:\Users\MouiMou_2\AppData\Roaming\Notepad++ O43 - CFD: 04/04/2015 - [0] D -- C:\Users\MouiMou_2\AppData\Roaming\Opera Software O43 - CFD: 09/05/2015 - [] D -- C:\Users\MouiMou_2\AppData\Roaming\Origin O43 - CFD: 08/08/2015 - [0] D -- C:\Users\MouiMou_2\AppData\Roaming\Publish Providers O43 - CFD: 03/02/2015 - [] D -- C:\Users\MouiMou_2\AppData\Roaming\Rovio O43 - CFD: 11/11/2015 - [] D -- C:\Users\MouiMou_2\AppData\Roaming\Skype O43 - CFD: 07/11/2015 - [] D -- C:\Users\MouiMou_2\AppData\Roaming\SOLIDWORKS O43 - CFD: 19/09/2015 - [] D -- C:\Users\MouiMou_2\AppData\Roaming\Sony O43 - CFD: 05/03/2015 - [] D -- C:\Users\MouiMou_2\AppData\Roaming\Spiritsoft O43 - CFD: 24/08/2015 - [] D -- C:\Users\MouiMou_2\AppData\Roaming\Steganos O43 - CFD: 15/04/2015 - [] D -- C:\Users\MouiMou_2\AppData\Roaming\Steganos Updates O43 - CFD: 24/08/2015 - [] D -- C:\Users\MouiMou_2\AppData\Roaming\Steganos VPN O43 - CFD: 26/01/2015 - [] D -- C:\Users\MouiMou_2\AppData\Roaming\TeraCopy O43 - CFD: 28/01/2015 - [] D -- C:\Users\MouiMou_2\AppData\Roaming\Unity O43 - CFD: 15/12/2015 - [] D -- C:\Users\MouiMou_2\AppData\Roaming\uTorrent O43 - CFD: 27/01/2015 - [] D -- C:\Users\MouiMou_2\AppData\Roaming\WinRAR O43 - CFD: 17/12/2015 - [] D -- C:\Users\MouiMou_2\AppData\Roaming\ZHP O43 - CFD: 07/07/2015 - [] D -- C:\Users\MouiMou_2\AppData\Local\Adobe O43 - CFD: 20/03/2015 - [] D -- C:\Users\MouiMou_2\AppData\Local\Akamai O43 - CFD: 15/02/2015 - [] D -- C:\Users\MouiMou_2\AppData\Local\ALLConverter O43 - CFD: 26/01/2015 - [0] SHD -- C:\Users\MouiMou_2\AppData\Local\Application Data O43 - CFD: 13/02/2015 - [] D -- C:\Users\MouiMou_2\AppData\Local\Big Fish O43 - CFD: 17/07/2015 - [] D -- C:\Users\MouiMou_2\AppData\Local\CEF O43 - CFD: 17/12/2015 - [] D -- C:\Users\MouiMou_2\AppData\Local\CrashDumps O43 - CFD: 07/11/2015 - [0] D -- C:\Users\MouiMou_2\AppData\Local\DassaultSystemes O43 - CFD: 04/12/2015 - [] D -- C:\Users\MouiMou_2\AppData\Local\Diagnostics O43 - CFD: 20/03/2015 - [] D -- C:\Users\MouiMou_2\AppData\Local\Downloaded Installations O43 - CFD: 05/06/2015 - [0] D -- C:\Users\MouiMou_2\AppData\Local\ElevatedDiagnostics O43 - CFD: 28/01/2015 - [0] SHD -- C:\Users\MouiMou_2\AppData\Local\EmieBrowserModeList O43 - CFD: 26/01/2015 - [0] SHD -- C:\Users\MouiMou_2\AppData\Local\EmieSiteList O43 - CFD: 26/01/2015 - [0] SHD -- C:\Users\MouiMou_2\AppData\Local\EmieUserList O43 - CFD: 15/12/2015 - [] D -- C:\Users\MouiMou_2\AppData\Local\ESET O43 - CFD: 31/07/2015 - [] D -- C:\Users\MouiMou_2\AppData\Local\Google O43 - CFD: 01/06/2015 - [] D -- C:\Users\MouiMou_2\AppData\Local\GWX O43 - CFD: 26/01/2015 - [0] SHD -- C:\Users\MouiMou_2\AppData\Local\History O43 - CFD: 13/04/2015 - [] D -- C:\Users\MouiMou_2\AppData\Local\IE Tab O43 - CFD: 06/02/2015 - [] D -- C:\Users\MouiMou_2\AppData\Local\iolo O43 - CFD: 10/04/2015 - [] D -- C:\Users\MouiMou_2\AppData\Local\Macromedia O43 - CFD: 13/06/2015 - [] D -- C:\Users\MouiMou_2\AppData\Local\Messenger O43 - CFD: 04/10/2015 - [] D -- C:\Users\MouiMou_2\AppData\Local\Microsoft O43 - CFD: 12/02/2015 - [] D -- C:\Users\MouiMou_2\AppData\Local\Microsoft Help O43 - CFD: 24/07/2015 - [] D -- C:\Users\MouiMou_2\AppData\Local\Mirillis O43 - CFD: 22/03/2015 - [] D -- C:\Users\MouiMou_2\AppData\Local\Mozilla O43 - CFD: 04/04/2015 - [0] D -- C:\Users\MouiMou_2\AppData\Local\Opera Software O43 - CFD: 10/08/2015 - [] D -- C:\Users\MouiMou_2\AppData\Local\Packages O43 - CFD: 20/02/2015 - [] D -- C:\Users\MouiMou_2\AppData\Local\Programs O43 - CFD: 12/03/2015 - [] D -- C:\Users\MouiMou_2\AppData\Local\Skype O43 - CFD: 07/11/2015 - [] D -- C:\Users\MouiMou_2\AppData\Local\SolidWorks O43 - CFD: 15/12/2015 - [] D -- C:\Users\MouiMou_2\AppData\Local\Sony O43 - CFD: 17/12/2015 - [] D -- C:\Users\MouiMou_2\AppData\Local\Temp O43 - CFD: 26/01/2015 - [0] SHD -- C:\Users\MouiMou_2\AppData\Local\Temporary Internet Files O43 - CFD: 26/11/2015 - [] D -- C:\Users\MouiMou_2\AppData\Local\TempSWBackupDirectory O43 - CFD: 28/04/2015 - [] D -- C:\Users\MouiMou_2\AppData\Local\Unity O43 - CFD: 07/11/2015 - [] D -- C:\Users\MouiMou_2\AppData\Local\VirtualStore O43 - CFD: 18/03/2014 - [] RD -- C:\Users\MouiMou_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility O43 - CFD: 22/08/2013 - [] RD -- C:\Users\MouiMou_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories O43 - CFD: 14/10/2015 - [] RD -- C:\Users\MouiMou_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools O43 - CFD: 05/03/2015 - [] D -- C:\Users\MouiMou_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome O43 - CFD: 27/09/2015 - [] D -- C:\Users\MouiMou_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Download Manager O43 - CFD: 22/08/2013 - [] D -- C:\Users\MouiMou_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance O43 - CFD: 27/07/2015 - [0] D -- C:\Users\MouiMou_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Notepad++ O43 - CFD: 15/12/2015 - [] RD -- C:\Users\MouiMou_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup O43 - CFD: 18/03/2014 - [] RD -- C:\Users\MouiMou_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools O43 - CFD: 05/03/2015 - [] D -- C:\Users\MouiMou_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\‏تطبيقات Chrome ---\\ System Drivers List (68) - 12s O58 - SDL:2015/02/27 09:43:41 A . (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Windows\System32\drivers\1B3057A4.sys [129752] =>.Malwarebytes Corporation® O58 - SDL:2013/08/22 13:43:41 A . (.LSI - LSI 3ware SCSI Storport Driver.) -- C:\Windows\System32\drivers\3ware.sys [108896] =>.Microsoft Windows® O58 - SDL:2015/03/02 10:50:05 A . (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Windows\System32\drivers\7DFC758A.sys [129752] =>.Malwarebytes Corporation® O58 - SDL:2015/02/27 16:23:37 A . (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Windows\System32\drivers\7FA00A64.sys [129752] =>.Malwarebytes Corporation® O58 - SDL:2013/08/22 13:43:41 A . (.PMC-Sierra - PMC-Sierra Storport Driver For SPC8x6G SAS.) -- C:\Windows\System32\drivers\adp80xx.sys [782176] =>.Microsoft Windows® O58 - SDL:2013/12/15 10:22:28 A . (.Advanced Micro Devices, Inc. - AMD PCI Root Bus Lower Filter.) -- C:\Windows\System32\drivers\amdkmpfd.sys [36096] =>.Advanced Micro Devices, Inc.® O58 - SDL:2013/08/22 13:43:41 A . (.Advanced Micro Devices - AHCI 1.3 Device Driver.) -- C:\Windows\System32\drivers\amdsata.sys [79200] =>.Microsoft Windows® O58 - SDL:2013/08/22 13:43:41 A . (.AMD Technologies Inc. - AMD Technology AHCI Compatible Controller D.) -- C:\Windows\System32\drivers\amdsbs.sys [259424] =>.Microsoft Windows® O58 - SDL:2013/08/22 13:43:40 A . (.Advanced Micro Devices - Storage Filter Driver.) -- C:\Windows\System32\drivers\amdxata.sys [25952] =>.Microsoft Windows® O58 - SDL:2010/04/29 06:55:42 A . (.Google Inc - ADB Interface.) -- C:\Windows\System32\drivers\androidusb.sys [32768] © O58 - SDL:2013/08/22 13:43:41 A . (.PMC-Sierra, Inc. - Adaptec SAS RAID WS03 Driver.) -- C:\Windows\System32\drivers\arcsas.sys [114016] =>.Microsoft Windows® O58 - SDL:2013/06/18 15:45:02 A . (.Qualcomm Atheros Communications, Inc. - Qualcomm Atheros Extensible Wireless LAN de.) -- C:\Windows\System32\drivers\athw8x.sys [3680256] © O58 - SDL:2015/01/25 20:55:00 A . (.Qualcomm Atheros Communications, Inc. - Qualcomm Atheros Extensible Wireless LAN de.) -- C:\Windows\System32\drivers\athwbx.sys [3893248] © O58 - SDL:2013/12/15 10:23:04 A . (.Advanced Micro Devices, Inc. - ATI Radeon Kernel Mode Driver.) -- C:\Windows\System32\drivers\atikmdag.sys [13203456] © O58 - SDL:2013/12/15 10:23:06 A . (.Advanced Micro Devices, Inc. - AMD multi-vendor Miniport Driver.) -- C:\Windows\System32\drivers\atikmpag.sys [624128] © O58 - SDL:2013/08/13 00:25:46 A . (.Windows (R) Win 7 DDK provider - BCM Function 2 Device Driver.) -- C:\Windows\System32\drivers\bcmfn2.sys [17624] =>.Broadcom Corporation® O58 - SDL:2015/01/25 20:55:45 A . (.Qualcomm Atheros - Qualcomm Atheros BtFilter Driver.) -- C:\Windows\System32\drivers\btfilter.sys [599240] =>.Qualcomm Atheros® O58 - SDL:2013/08/22 13:43:41 A . (.Broadcom Corporation - Broadcom NetXtreme II GigE VBD.) -- C:\Windows\System32\drivers\bxvbda.sys [531296] =>.Microsoft Windows® O58 - SDL:2015/11/06 11:33:20 A . (.ESET - Amon monitor.) -- C:\Windows\System32\drivers\eamonm.sys [264040] =>.ESET, spol. s r.o.® O58 - SDL:2015/09/23 08:30:22 A . (.ESET - ESET ELAM driver.) -- C:\Windows\System32\drivers\eelam.sys [14976] =>.Microsoft Windows Early Launch Anti-malware Publisher® O58 - SDL:2015/11/06 11:33:20 A . (.ESET - ESET Helper driver.) -- C:\Windows\System32\drivers\ehdrv.sys [186784] =>.ESET, spol. s r.o.® O58 - SDL:2015/10/07 05:16:32 A . (.ESET - ESET OPP Keyboard Filter.) -- C:\Windows\System32\drivers\ekbdflt.sys [142976] =>.ESET, spol. s r.o.® O58 - SDL:2015/11/06 11:33:20 A . (.ESET - ESET Personal Firewall driver.) -- C:\Windows\System32\drivers\epfw.sys [206312] =>.ESET, spol. s r.o.® O58 - SDL:2015/11/06 11:33:20 A . (.ESET - Epfw NDIS LightWeight Filter.) -- C:\Windows\System32\drivers\EpfwLWF.sys [52872] =>.ESET, spol. s r.o.® O58 - SDL:2015/11/06 11:33:20 A . (.ESET - ESET Personal Firewall driver.) -- C:\Windows\System32\drivers\epfwwfp.sys [69840] =>.ESET, spol. s r.o.® O58 - SDL:2013/08/22 13:43:45 A . (.Broadcom Corporation - Broadcom NetXtreme II 10 GigE VBD.) -- C:\Windows\System32\drivers\evbda.sys [3357024] =>.Microsoft Windows® O58 - SDL:2012/07/17 18:12:08 A . (.Intel Corporation - Intel(R) Management Engine Interface.) -- C:\Windows\System32\drivers\HECIx64.sys [62784] =>.Intel Corporation® O58 - SDL:2013/08/22 13:43:45 A . (.Hewlett-Packard Company - Smart Array SAS/SATA Controller Media Drive.) -- C:\Windows\System32\drivers\HpSAMD.sys [64352] =>.Microsoft Windows® O58 - SDL:2013/07/30 19:47:35 A . (.Intel Corporation - Intel(R) Serial IO GPIO Controller Driver.) -- C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568] =>.Intel Corporation - Software and Firmware Products® O58 - SDL:2013/07/25 20:05:39 A . (.Intel Corporation - Intel(R) Serial IO I2C Controller Driver.) -- C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320] =>.Intel Corporation - Software and Firmware Products® O58 - SDL:2013/08/10 01:39:30 A . (.Intel Corporation - Intel Rapid Storage Technology driver (inbo.) -- C:\Windows\System32\drivers\iaStorAV.sys [651248] =>.Intel Corporation - Intel® Rapid Storage Technology® O58 - SDL:2013/08/22 13:43:45 A . (.Intel Corporation - Intel Matrix Storage Manager driver - x64.) -- C:\Windows\System32\drivers\iaStorV.sys [412000] =>.Microsoft Windows® O58 - SDL:2015/06/12 03:00:58 A . (.Tonec Inc. - Internet Download Manager WFP Driver.) -- C:\Windows\System32\drivers\idmwfp.sys [197616] =>.Tonec Inc.® O58 - SDL:2014/10/01 19:54:16 A . (.Intel Corporation - Intel Graphics Kernel Mode Driver.) -- C:\Windows\System32\drivers\igdkmd64.sys [3828152] =>.Intel Corporation - pGFX® O58 - SDL:2014/08/01 21:18:33 A . (.Intel Corporation - Intel® WiDi Solution.) -- C:\Windows\System32\drivers\intelaud.sys [38296] =>.Intel Wireless Display® O58 - SDL:2014/08/01 21:18:33 A . (.Intel Corporation - Intel® WiDi Solution.) -- C:\Windows\System32\drivers\iwdbus.sys [27032] =>.Intel Wireless Display® O58 - SDL:2013/08/22 13:43:44 A . (.LSI Corporation - LSI Fusion-MPT SAS Driver (StorPort).) -- C:\Windows\System32\drivers\lsi_sas.sys [109408] =>.Microsoft Windows® O58 - SDL:2013/08/22 13:43:45 A . (.LSI Corporation - LSI SAS Gen2 Driver (StorPort).) -- C:\Windows\System32\drivers\lsi_sas2.sys [93536] =>.Microsoft Windows® O58 - SDL:2013/08/22 13:43:44 A . (.LSI Corporation - LSI SAS Gen3 Driver (StorPort).) -- C:\Windows\System32\drivers\lsi_sas3.sys [81760] =>.Microsoft Windows® O58 - SDL:2013/08/22 13:43:45 A . (.LSI Corporation - LSI SSS PCIe/Flash Driver (StorPort).) -- C:\Windows\System32\drivers\lsi_sss.sys [82784] =>.Microsoft Windows® O58 - SDL:2015/10/05 09:50:06 A . (.Malwarebytes - Malwarebytes Anti-Malware.) -- C:\Windows\System32\drivers\mbam.sys [25816] =>.Malwarebytes Corporation® O58 - SDL:2015/10/05 09:50:10 A . (.Malwarebytes - Malwarebytes Chameleon Protection Driver.) -- C:\Windows\System32\drivers\mbamchameleon.sys [109272] =>.Malwarebytes Corporation® O58 - SDL:2015/12/15 19:55:01 A . (.Malwarebytes - Malwarebytes Anti-Malware.) -- C:\Windows\System32\drivers\MBAMSwissArmy.sys [192216] =>.Malwarebytes Corporation® O58 - SDL:2013/08/22 13:43:45 A . (.LSI Corporation - MEGASAS RAID Controller Driver for Windows.) -- C:\Windows\System32\drivers\megasas.sys [56672] =>.Microsoft Windows® O58 - SDL:2013/08/22 13:43:45 A . (.LSI Corporation, Inc. - LSI MegaRAID Software RAID Driver.) -- C:\Windows\System32\drivers\megasr.sys [575840] =>.Microsoft Windows® O58 - SDL:2013/08/22 13:43:49 A . (.Marvell Semiconductor, Inc. - Marvell Flash Controller Driver.) -- C:\Windows\System32\drivers\mvumis.sys [63840] =>.Microsoft Windows® O58 - SDL:2015/10/05 09:50:22 A . (.Malwarebytes Corporation - Malwarebytes Web Access Control.) -- C:\Windows\System32\drivers\mwac.sys [64216] =>.Malwarebytes Corporation® O58 - SDL:2013/08/22 13:43:31 A . (.NVIDIA Corporation - NVIDIA® nForce(TM) RAID Driver.) -- C:\Windows\System32\drivers\nvraid.sys [150368] =>.Microsoft Windows® O58 - SDL:2013/08/22 13:43:32 A . (.NVIDIA Corporation - NVIDIA® nForce(TM) Sata Performance Driver.) -- C:\Windows\System32\drivers\nvstor.sys [168288] =>.Microsoft Windows® O58 - SDL:2013/06/18 15:46:17 A . (.Realtek - Realtek 8101E/8168/8169 NDIS 6.30 64-bit Dr.) -- C:\Windows\System32\drivers\Rt630x64.sys [591360] © O58 - SDL:2015/01/25 21:09:33 A . (.Realtek Semiconductor Corp. - Realtek(r) High Definition Audio Function D.) -- C:\Windows\System32\drivers\RTKVHD64.sys [4263128] =>.Realtek Semiconductor Corp® O58 - SDL:2015/01/25 20:55:59 A . (.Realtek Semiconductor Corp. - Realtek USB Mass Storage Driver for 2K/XP/V.) -- C:\Windows\System32\drivers\RtsUVStor.sys [332504] =>.Realtek Semiconductor Corp® O58 - SDL:2013/08/22 16:35:09 A . (.Macrovision Corporation, Macrovision Europe Limited, - Macrovision SECURITY Driver.) -- C:\Windows\System32\drivers\secdrv.sys [23040] © O58 - SDL:2013/08/22 13:43:31 A . (.Silicon Integrated Systems Corp. - SiS RAID Stor Miniport Driver.) -- C:\Windows\System32\drivers\sisraid2.sys [44896] =>.Microsoft Windows® O58 - SDL:2013/08/22 13:43:32 A . (.Silicon Integrated Systems - SiS AHCI Stor-Miniport Driver.) -- C:\Windows\System32\drivers\sisraid4.sys [81760] =>.Microsoft Windows® O58 - SDL:2014/01/22 08:52:10 A . (.DEVGURU Co., LTD.(www.devguru.co.kr) - SAMSUNG USB Composite Device Driver (MSS Ve.) -- C:\Windows\System32\drivers\ssudbus.sys [108800] =>.DEVGURU CO LTD® O58 - SDL:2014/01/22 08:52:10 A . (.DEVGURU Co., LTD.(www.devguru.co.kr) - SAMSUNG Android Modem Device Driver (MSS Ve.) -- C:\Windows\System32\drivers\ssudmdm.sys [206080] =>.DEVGURU CO LTD® O58 - SDL:2013/08/22 13:43:32 A . (.Promise Technology, Inc. - Promise SuperTrak EX Series Driver for Wind.) -- C:\Windows\System32\drivers\stexstor.sys [31072] =>.Microsoft Windows® O58 - SDL:2013/08/22 09:40:24 A . (.The OpenVPN Project - TAP-Windows Virtual Network Driver.) -- C:\Windows\System32\drivers\tap0901.sys [40664] =>.OpenVPN Technologies, Inc.® O58 - SDL:2012/07/15 06:18:16 A . (.The OpenVPN Project - TAP-Win32 Virtual Network Driver.) -- C:\Windows\System32\drivers\tapoas.sys [30720] © O58 - SDL:2015/03/17 15:30:49 A . (.Intel Corporation - Intel(R) Management Engine Interface.) -- C:\Windows\System32\drivers\TeeDriverx64.sys [129312] =>.Intel Corporation - Embedded Subsystems and IP Blocks Group® O58 - SDL:2012/07/20 12:40:52 A . (.Hajo Krabbenhöft - Personal Voice Changer Driver.) -- C:\Windows\System32\drivers\tenCapture.sys [23736] {0E701C8C223C339FA3C0FCB1AEF5E4A7} O58 - SDL:2013/08/22 13:43:34 A . (.VIA Technologies, Inc. - VIA Generic PCI IDE Bus Driver.) -- C:\Windows\System32\drivers\viaide.sys [19808] =>.Microsoft Windows® O58 - SDL:2013/08/22 13:43:34 A . (.VIA Technologies Inc.,Ltd - VIA RAID DRIVER FOR AMD-X86-64.) -- C:\Windows\System32\drivers\vsmraid.sys [168800] =>.Microsoft Windows® O58 - SDL:2013/08/22 13:43:34 A . (.VIA Corporation - VIA StorX RAID Controller Driver.) -- C:\Windows\System32\drivers\VSTXRAID.SYS [305504] =>.Microsoft Windows® O58 - SDL:2008/07/14 01:16:34 A . (.ZTE Incorporated - USB Modem/Serial Device Driver.) -- C:\Windows\System32\drivers\ZTEusbmdm6k.sys [150656] © O58 - SDL:2008/07/14 01:16:34 A . (.ZTE Incorporated - USB Modem/Serial Device Driver.) -- C:\Windows\System32\drivers\ZTEusbnmea.sys [150656] © O58 - SDL:2008/07/14 01:16:34 A . (.ZTE Incorporated - USB Modem/Serial Device Driver.) -- C:\Windows\System32\drivers\ZTEusbser6k.sys [150656] © ---\\ Last modified or created user files (2) - 32s O61 - LFC: 2015/12/17 18:12:51 A . (..) -- C:\Users\MouiMou_2\Documents\FIFA 13\instance0\replay0.bin [1073741824] O61 - LFC: 2015/12/15 15:15:32 A . (..) -- C:\Users\MouiMou_2\AppData\Local\Adobe\Acrobat\DC\UserCache.bin [220475] ---\\ File Associations Shell Spawning (10) - 1s O67 - Shell Spawning: <.bat> [HKLM\..\open\Command] (...) -- "%1" %* O67 - Shell Spawning: <.cpl> [HKLM\..\cplopen\Command] (.Microsoft Corporation - Windows Control Panel.) -- C:\Windows\System32\control.exe © O67 - Shell Spawning: <.cmd> [HKLM\..\open\Command] (...) -- "%1" %* O67 - Shell Spawning: <.com> [HKLM\..\open\Command] (...) -- "%1" %* O67 - Shell Spawning: <.evt> [HKLM\..\open\Command] (.Microsoft Corporation - Event Viewer Snapin Launcher.) -- C:\Windows\System32\eventvwr.exe © O67 - Shell Spawning: <.exe> [HKLM\..\open\Command] (...) -- "%1" %* O67 - Shell Spawning: <.html> [HKLM\..\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe =>.Microsoft Corporation® O67 - Shell Spawning: <.js> [HKLM\..\open\Command] (.Microsoft Corporation - Microsoft ® Windows Based Script Host.) -- C:\Windows\System32\wscript.exe © O67 - Shell Spawning: <.reg> [HKLM\..\open\Command] (.Microsoft Corporation - Registry Editor.) -- C:\Windows\regedit.exe © O67 - Shell Spawning: <.scr> [HKLM\..\open\Command] (...) -- "%1" /S ---\\ Start Menu Internet (12) - 0s O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe © O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe © O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (...) -- iexplore.exe O68 - StartMenuInternet: [HKLM\..\InstallInfo\ShowIconsCommand] (.Mozilla Corporation - Firefox Helper.) -- C:\Program Files (x86)\Mozilla Firefox\uninstall\helper.exe © O68 - StartMenuInternet: [HKLM\..\InstallInfo\ShowIconsCommand] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe © O68 - StartMenuInternet: [HKLM\..\InstallInfo\ShowIconsCommand] (.Microsoft Corporation - IE Per-User Initialization Utility.) -- C:\Windows\System32\ie4uinit.exe © O68 - StartMenuInternet: [HKLM\..\InstallInfo\ReinstallCommand] (.Mozilla Corporation - Firefox Helper.) -- C:\Program Files (x86)\Mozilla Firefox\uninstall\helper.exe © O68 - StartMenuInternet: [HKLM\..\InstallInfo\ReinstallCommand] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe © O68 - StartMenuInternet: [HKLM\..\InstallInfo\ReinstallCommand] (.Microsoft Corporation - IE Per-User Initialization Utility.) -- C:\Windows\System32\ie4uinit.exe © O68 - StartMenuInternet: [HKLM\..\InstallInfo\HideIconsCommand] (.Mozilla Corporation - Firefox Helper.) -- C:\Program Files (x86)\Mozilla Firefox\uninstall\helper.exe © O68 - StartMenuInternet: [HKLM\..\InstallInfo\HideIconsCommand] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe © O68 - StartMenuInternet: [HKLM\..\InstallInfo\HideIconsCommand] (.Microsoft Corporation - IE Per-User Initialization Utility.) -- C:\Windows\System32\ie4uinit.exe © ---\\ Search Browser Infection (4) - 5s O69 - SBI: prefs.js [MouiMou_2 - pni6wsbx.default] user_pref("browser.search.searchengine.desc", "this is my first firefox searchEngine"); =>PUP.Optional.SearchEngine O69 - SBI: prefs.js [MouiMou_2 - pni6wsbx.default] user_pref("browser.search.searchengine.ptid", "wpc"); =>PUP.Optional.SearchEngine O69 - SBI: prefs.js [MouiMou_2 - pni6wsbx.default] user_pref("browser.search.searchengine.uid", "ST500LM012XHN-M500MBB_S2X1J90CC64492C64492"); =>PUP.Optional.SearchEngine O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} [DefaultScope] - (Bing) - http://www.bing.com/ ---\\ Crack & Keygen Files (2) - 43s O82 - LFC: 2015/03/11 14:50:37 A . (...) -- C:\Users\MouiMou_2\Downloads\Havij-v1.16-Pro-Portable-Cracked-by-Service-Manual-AoRE-Team-.7z [10299241] =>.Crack,Keygen O82 - LFC: 2015/02/22 22:56:45 A . (...) -- C:\Users\MouiMou_2\Downloads\Compressed\Havij 1.17 Pro Cracked by Đř.ώăĐăђ.rar [10299241] =>.Crack,Keygen ---\\ Search Svchost Services (36) - 1s O83 - Search Svchost Services: AeLookupSvc (AeLookupSvc) . (.Microsoft Corporation - Application Experience Service.) -- C:\Windows\System32\aelupsvc.dll [214528] © O83 - Search Svchost Services: CertPropSvc (CertPropSvc) . (.Microsoft Corporation - Microsoft Smartcard Certificate Propagation.) -- C:\Windows\System32\certprop.dll [156160] © O83 - Search Svchost Services: SCPolicySvc (SCPolicySvc) . (.Microsoft Corporation - Microsoft Smartcard Certificate Propagation.) -- C:\Windows\System32\certprop.dll [156160] © O83 - Search Svchost Services: lanmanserver (lanmanserver) . (.Microsoft Corporation - Server Service DLL.) -- C:\Windows\system32\srvsvc.dll [329216] © O83 - Search Svchost Services: gpsvc (gpsvc) . (.Microsoft Corporation - Group Policy Client.) -- C:\Windows\System32\gpsvc.dll [1360896] © O83 - Search Svchost Services: IKEEXT (IKEEXT) . (.Microsoft Corporation - IKE extension.) -- C:\Windows\System32\ikeext.dll [1083904] © O83 - Search Svchost Services: iphlpsvc (iphlpsvc) . (.Microsoft Corporation - Service that offers IPv6 connectivity over.) -- C:\Windows\System32\iphlpsvc.dll [926208] © O83 - Search Svchost Services: seclogon (seclogon) . (.Microsoft Corporation - Secondary Logon Service DLL.) -- C:\Windows\system32\seclogon.dll [31744] © O83 - Search Svchost Services: AppInfo (AppInfo) . (.Microsoft Corporation - Application Information Service.) -- C:\Windows\System32\appinfo.dll [110080] © O83 - Search Svchost Services: msiscsi (msiscsi) . (.Microsoft Corporation - iSCSI Discovery service.) -- C:\Windows\system32\iscsiexe.dll [151040] © O83 - Search Svchost Services: EapHost (EapHost) . (.Microsoft Corporation - Microsoft EAPHost service.) -- C:\Windows\System32\eapsvc.dll [110592] © O83 - Search Svchost Services: schedule (schedule) . (.Microsoft Corporation - Task Scheduler Service.) -- C:\Windows\system32\schedsvc.dll [1265152] © O83 - Search Svchost Services: winmgmt (winmgmt) . (.Microsoft Corporation - WMI.) -- C:\Windows\system32\wbem\WMIsvc.dll [230400] © O83 - Search Svchost Services: MMCSS (MMCSS) . (.Microsoft Corporation - Multimedia Class Scheduler Service.) -- C:\Windows\system32\mmcss.dll [71168] © O83 - Search Svchost Services: browser (browser) . (.Microsoft Corporation - Computer Browser Service DLL.) -- C:\Windows\System32\browser.dll [135168] © O83 - Search Svchost Services: ProfSvc (ProfSvc) . (.Microsoft Corporation - ProfSvc.) -- C:\Windows\system32\profsvc.dll [228864] © O83 - Search Svchost Services: SessionEnv (SessionEnv) . (.Microsoft Corporation - Remote Desktop Configuration service.) -- C:\Windows\System32\SessEnv.dll [339968] © O83 - Search Svchost Services: wercplsupport (wercplsupport) . (.Microsoft Corporation - Problem Reports and Solutions.) -- C:\Windows\System32\wercplsupport.dll [84992] © O83 - Search Svchost Services: hkmsvc (hkmsvc) . (.Microsoft Corporation - Key Management Service.) -- C:\Windows\system32\kmsvc.dll [101376] © O83 - Search Svchost Services: BDESVC (BDESVC) . (.Microsoft Corporation - BDE Service.) -- C:\Windows\System32\bdesvc.dll [348672] © O83 - Search Svchost Services: lfsvc (lfsvc) . (.Microsoft Corporation - Windows Location Framework Service.) -- C:\Windows\System32\GeofenceMonitorService.dll [522240] © O83 - Search Svchost Services: wlidsvc (wlidsvc) . (.Microsoft Corporation - Microsoft® Account Service.) -- C:\Windows\system32\wlidsvc.dll [1639424] © O83 - Search Svchost Services: Themes (Themes) . (.Microsoft Corporation - Windows Shell Theme Service Dll.) -- C:\Windows\system32\themeservice.dll [59392] © O83 - Search Svchost Services: DsmSvc (DsmSvc) . (.Microsoft Corporation - Device Setup Manager.) -- C:\Windows\System32\DeviceSetupManager.dll [206848] © O83 - Search Svchost Services: NcaSvc (NcaSvc) . (.Microsoft Corporation - Microsoft Network Connectivity Assistant Se.) -- C:\Windows\System32\ncasvc.dll [166400] © O83 - Search Svchost Services: Rasauto (Rasauto) . (.Microsoft Corporation - Remote Access AutoDial Manager.) -- C:\Windows\System32\rasauto.dll [102912] © O83 - Search Svchost Services: Rasman (Rasman) . (.Microsoft Corporation - Remote Access Connection Manager.) -- C:\Windows\System32\rasmans.dll [542208] © O83 - Search Svchost Services: Remoteaccess (Remoteaccess) . (.Microsoft Corporation - Dynamic Interface Manager.) -- C:\Windows\System32\mprdim.dll [226816] © O83 - Search Svchost Services: SENS (SENS) . (.Microsoft Corporation - System Event Notification Service (SENS).) -- C:\Windows\System32\sens.dll [73728] © O83 - Search Svchost Services: Sharedaccess (Sharedaccess) . (.Microsoft Corporation - Microsoft NAT Helper Components.) -- C:\Windows\System32\ipnathlp.dll [452608] © O83 - Search Svchost Services: Tapisrv (Tapisrv) . (.Microsoft Corporation - Microsoft® Windows(TM) Telephony Server.) -- C:\Windows\System32\tapisrv.dll [313344] © O83 - Search Svchost Services: wuauserv (wuauserv) . (.Microsoft Corporation - Windows Update Agent.) -- C:\Windows\system32\wuaueng.dll [3706880] © O83 - Search Svchost Services: BITS (BITS) . (.Microsoft Corporation - Background Intelligent Transfer Service.) -- C:\Windows\System32\qmgr.dll [933376] © O83 - Search Svchost Services: ShellHWDetection (ShellHWDetection) . (.Microsoft Corporation - Windows Shell Services Dll.) -- C:\Windows\System32\shsvcs.dll [640000] © O83 - Search Svchost Services: AppMgmt (AppMgmt) . (.Microsoft Corporation - Software installation Service.) -- C:\Windows\System32\appmgmts.dll [187904] © O83 - Search Svchost Services: MsKeyboardFilter (MsKeyboardFilter) . (.Microsoft Corporation - SvcHost Service for Microsoft Keyboard Filt.) -- C:\Windows\System32\KeyboardFilterSvc.dll [92992] =>.Microsoft Windows® ---\\ Firewall Active Exception List (11) - 3s O87 - FAEL: "{A77FC3F1-4B52-4110-B87C-1C603EECC29E}" [In-None-P17-TRUE] .(.Copyright (C) 2013 - Windows host process (Rundll32).) -- C:\Program Files (x86)\Garena Plus\ggdllhost.exe {4EEAD9745E9F68E71D871268ABF2041C} O87 - FAEL: "{5D3523F2-6A5A-4818-9E87-D316EC5E7334}" [In-None-P6-TRUE] .(...) -- C:\Program Files (x86)\Kuma Games BETA\Kuma2.exe O87 - FAEL: "{32B9D961-F640-4601-BB9B-4677F6EDE4F8}" [In-None-P17-TRUE] .(...) -- C:\Program Files (x86)\Kuma Games BETA\Kuma2.exe O87 - FAEL: "TCP Query User{BCC4E3B3-446E-43B2-A090-41858631FDCC}C:\users\mouimou_2\appdata\roaming\utorrent\updates\3.4.5_41202.exe" [In-None-P6-TRUE] .(...) -- C:\users\mouimou_2\appdata\roaming\utorrent\updates\3.4.5_41202.exe (.not file.) O87 - FAEL: "UDP Query User{A5620231-482E-42D3-ADBD-FEC101704133}C:\users\mouimou_2\appdata\roaming\utorrent\updates\3.4.5_41202.exe" [In-None-P17-TRUE] .(...) -- C:\users\mouimou_2\appdata\roaming\utorrent\updates\3.4.5_41202.exe (.not file.) O87 - FAEL: "{CB7539E5-DEA9-43D1-98EB-AE1C6A2739EF}" [In-None-P6-TRUE] .(...) -- C:\Program Files\Bonjour\mDNSResponder.exe (.not file.) O87 - FAEL: "{3A2C736D-1DE5-4057-AAE3-FBD709FA92A9}" [In-None-P17-TRUE] .(...) -- C:\Program Files\Bonjour\mDNSResponder.exe (.not file.) O87 - FAEL: "{8C6CA7DC-30FC-4644-9ADF-3A88A3EC2E3E}" [In-None-P6-TRUE] .(...) -- C:\Program Files (x86)\Bonjour\mDNSResponder.exe (.not file.) O87 - FAEL: "{0E947312-4712-4BAA-9053-945A9502867E}" [In-None-P17-TRUE] .(...) -- C:\Program Files (x86)\Bonjour\mDNSResponder.exe (.not file.) O87 - FAEL: "TCP Query User{BEEA30B8-6049-4453-94C9-388F51F70C34}C:\users\mouimou_2\appdata\roaming\utorrent\updates\3.4.5_41372.exe" [In-None-P6-TRUE] .(...) -- C:\users\mouimou_2\appdata\roaming\utorrent\updates\3.4.5_41372.exe (.not file.) O87 - FAEL: "UDP Query User{E1A4EAC7-284D-4FF0-9A4E-DD064C018D71}C:\users\mouimou_2\appdata\roaming\utorrent\updates\3.4.5_41372.exe" [In-None-P17-TRUE] .(...) -- C:\users\mouimou_2\appdata\roaming\utorrent\updates\3.4.5_41372.exe (.not file.) ---\\ Services not Microsoft (SR=Run, SS=Stop) (17) - 16s SR - Auto [28/10/2015] [ 82128] Adobe Acrobat Update Service (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe =>.Adobe Systems, Incorporated® SS - Demand [08/12/2015] [ 269504] Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe =>.Adobe Systems Incorporated® SR - Auto [25/01/2015] [ 98208] Andrea RT Filters Service (AERTFilters) . (.Andrea Electronics Corporation.) - C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe =>.Andrea Electronics® SR - Auto [15/12/2013] [ 239616] (AMD External Events Utility) . (.AMD.) - C:\Windows\System32\atiesrxx.exe © SR - Demand [26/10/2012] [ 282112] BrYNSvc (BrYNSvc) . (.Brother Industries, Ltd..) - C:\Program Files (x86)\Browny02\BrYNSvc.exe © SS - Demand [01/10/2014] [ 281488] Intel(R) Content Protection HECI Service (cphs) . (.Intel Corporation.) - C:\Windows\SysWOW64\IntelCpHeciSvc.exe =>.Intel Corporation - pGFX® SR - Auto [03/04/2015] [ 611854] Cron Service (CronService) . (.Fork, Ltd..) - C:\Windows\Prey\wpxsvc.exe SR - Auto [09/10/2015] [ 2505472] ESET Service (ekrn) . (.ESET.) - C:\Program Files\ESET\ESET Smart Security\ekrn.exe =>.ESET, spol. s r.o.® SS - Auto [30/08/2015] [ 144200] خدمة Google Update (gupdate) (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe =>.Google Inc® SS - Demand [30/08/2015] [ 144200] خدمة Google Update (gupdatem) (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe =>.Google Inc® SR - Auto [01/10/2014] [ 319376] Intel(R) HD Graphics Control Panel Service (igfxCUIService1.0.0.0) . (.Intel Corporation.) - C:\Windows\System32\igfxCUIService.exe © SR - Auto [15/10/2014] [ 2820424] Ma-Config Agent (MaConfigAgent) . (.CybelSoft.) - C:\Program Files\ma-config.com\MaConfigAgent.exe =>.Cybelsoft® SS - Auto [05/10/2015] [ 1135416] (MBAMService) . (.Malwarebytes.) - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe =>.Malwarebytes Corporation® SS - Demand [19/06/2015] [ 148080] Mozilla Maintenance Service (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe =>.Mozilla Corporation® SR - Auto [25/01/2015] [ 292568] Realtek Audio Service (RtkAudioService) . (.Realtek Semiconductor.) - C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe =>.Realtek Semiconductor Corp® SS - Auto [09/07/2015] [ 327296] Skype Updater (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe =>.Skype Software Sarl® ---\\ Additional Scan (O88) (1) - 0s C:\ProgramData\KMSAutoS =>PUP.Optional.Windows ---\\ Summary of the elements found (2) - 0s http://www.nicolascoolman.fr/?p=4664 =>PUP.Optional.Windows http://www.nicolascoolman.fr/?p=4664 =>PUP.Optional.SearchEngine ~ End of the scan, 21628 items in 175 seconds (822)(2)