Résultats d'analyse de Farbar Recovery Scan Tool (FRST) (x64) Version:25-05-2016 01 Exécuté par toshiba (administrateur) sur TOSH (27-05-2016 22:01:12) Exécuté depuis C:\Users\toshiba\Downloads Profils chargés: toshiba (Profils disponibles: toshiba) Platform: Windows 8.1 (Update) (X64) Langue: Français (France) Internet Explorer Version 11 (Navigateur par défaut: Chrome) Mode d'amorçage: Normal Tutoriel pour Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processus (Avec liste blanche) ================= (Si un élément est inclus dans le fichier fixlist.txt, le processus sera arrêté. Le fichier ne sera pas déplacé.) (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe () C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.10.767.8917\AdAwareService.exe (TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe (Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe () C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe (SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.10.767.8917\AdAwareTray.exe (Intel Corporation) C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe (Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe (Microsoft Corporation) C:\Windows\System32\SkyDrive.exe (Just Develop It) C:\Program Files (x86)\MyPC Backup\BackupStack.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Registre (Avec liste blanche) =========================== (Si un élément est inclus dans le fichier fixlist.txt, l'élément de Registre sera restauré à la valeur par défaut ou supprimé. Le fichier ne sera pas déplacé.) HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2565544 2012-10-31] () HKLM\...\Run: [TODDMain] => C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-04] () HKLM\...\Run: [TecoResident] => C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-13] (TOSHIBA Corporation) HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation) HKLM\...\Run: [SRS Premium Sound HD] => C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2172816 2012-10-22] (SRS Labs, Inc.) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2774256 2013-08-28] (Synaptics Incorporated) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13261456 2012-12-10] (Realtek Semiconductor) HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176952 2016-05-11] (Apple Inc.) HKLM\...\Run: [] => [X] HKLM\...\Run: [AdAwareTray] => C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.10.767.8917\AdAwareTray.exe [9581280 2016-01-28] () HKLM-x32\...\Run: [Intel AppUp(R) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [156000 2012-12-18] (Intel Corporation) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-08-08] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [TPUReg] => C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [7152640 2012-12-05] (Pegatron Corporation) HKLM-x32\...\Run: [mbot_fr_193] => [X] HKLM-x32\...\Run: [Boxore Client] => C:\Program Files (x86)\Boxore\Boxore Client\boxore.exe [1551872 2015-03-20] (Boxore OU) HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [7400576 2016-05-12] (AVAST Software) HKLM-x32\...\RunOnce: [Kabekol] => C:\WINDOWS\SysWOW64\wscript.exe /E:vbscript /B "C:\Users\toshiba\AppData\Local\607642~1\Saloh.dat" HKU\S-1-5-21-67368778-3054950882-2857564751-1001\...\Run: [Facebook Update] => C:\Users\toshiba\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2014-08-06] (Facebook Inc.) HKU\S-1-5-21-67368778-3054950882-2857564751-1001\...\Run: [BingSvc] => C:\Users\toshiba\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2015-04-07] (© 2015 Microsoft Corporation) HKU\S-1-5-21-67368778-3054950882-2857564751-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8721624 2016-05-13] (Piriform Ltd) HKU\S-1-5-21-67368778-3054950882-2857564751-1001\...\Run: [GoogleChromeAutoLaunch_D18D0183B87375739810C4CFB570E98B] => C:\Users\toshiba\AppData\Local\Chromium\Application\chrome.exe [667136 2015-08-11] (The Chromium Authors) ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2016-05-06] (AVAST Software) Startup: C:\Users\toshiba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMVU.lnk [2016-02-11] ShortcutTarget: IMVU.lnk -> C:\Users\toshiba\AppData\Roaming\IMVUClient\IMVUQualityAgent.exe (Pas de fichier) Startup: C:\Users\toshiba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk [2014-06-13] ShortcutTarget: MyPC Backup.lnk -> C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe (MyPCBackup.com) CHR HKU\S-1-5-21-67368778-3054950882-2857564751-1001\SOFTWARE\Policies\Google: Restriction <======= ATTENTION ==================== Internet (Avec liste blanche) ==================== (Si un élément est inclus dans le fichier fixlist.txt, s'il s'agit d'un élément du Registre, il sera supprimé ou restauré à la valeur par défaut.) Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 Tcpip\..\Interfaces\{845FD4DF-DD94-41B1-B340-EB7ADE64AFC2}: [DhcpNameServer] 192.168.1.254 Tcpip\..\Interfaces\{DD939B2C-8CD9-4800-820B-2B844FB52FEF}: [DhcpNameServer] 192.168.0.254 Internet Explorer: ================== HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = HKU\S-1-5-21-67368778-3054950882-2857564751-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxps://www.google.com/?trackid=sp-006 HKU\S-1-5-21-67368778-3054950882-2857564751-1001\Software\Microsoft\Internet Explorer\Main,Start Default_Page_URL = hxxp://search.certified-toolbar.com?si=77302&st=home&tid=18195&ver=6.4&ts=1403548245556&tguid=77302-18195-1403548245556-D67D6675BB449E825EEAB984FAA2D7D0 HKU\S-1-5-21-67368778-3054950882-2857564751-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.fr/ SearchScopes: HKLM -> DefaultScope la valeur est absente SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM -> {1b31c9d2-7135-442b-bb93-7c002172adc6} URL = hxxps://fr.search.yahoo.com/yhs/search?hspart=elm&hsimp=yhs-001&type=hdr_s_16_07_orgnl¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dfr%26pa%3DHodor%26cd%3D2XzuyEtN2Y1L1QzuyB0CtDyDtDyBtDyDzytCzztCtB0E0AyEtN0D0Tzu0StCyDtCtBtN1L2XzutAtFtCyBtFzytFtCtN1L1Czu1M1Q1CtBtBtFtCtFtCtN1L1G1B1V1N2Y1L1Qzu2StDyCyB0EtDtA0ByDtGtCtA0AzztGtBtAyCyBtGtAyDyCtCtG0EyDtC0BtD0D0E0B0Ezyzz0C2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0FtDzy0AtBtD0E0BtG0CzzzztBtGyEyB0DtCtG0B0BtAyBtGyBtDtAtByDyBzyzy0DtA0EtA2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCyEyBtB%26cr%3D230091025%26a%3Dhdr_s_16_07_orgnl%26os_ver%3D6.3%26os%3DWindows%2B8.1&p={searchTerms} SearchScopes: HKLM -> {2E00D31D-D171-423D-836D-1A4D7EA7F1A9} URL = SearchScopes: HKLM -> {31090377-0740-419E-BEFC-A56E50500D5B} URL = SearchScopes: HKLM -> {522B6E20-CB79-4707-9A5A-8010A6FFBED2} URL = hxxp://speedial.com/results.php?f=4&q={searchTerms}&a=spd_tele_14_24_ch&cd=2XzuyEtN2Y1L1QzuyB0CtDyDtDyBtDyDzytCzztCtB0E0AyEtN0D0Tzu0SzzzyyDtN1L2XzutBtFtBtCtFyEtFtDtN1L1CzutCyEtBzytDyD1V1QtN1L1G1B1V1N2Y1L1Qzu2StCtD0A0F0AyCyBtBtGyCtC0BtBtG0F0DtCyBtGyCyEyByEtGyE0AyBtA0F0BtCtDyEyEzztC2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyB0F0A0BzytC0D0AtG0CtD0DyDtGtAzzyDtBtGzy0Fzy0AtGtAtAtB0BtC0DtAtCyCtD0EtC2Q&cr=137271662&ir= SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms} SearchScopes: HKLM-x32 -> {2de06457-88b8-4989-9288-5fe9c2584ab8} URL = hxxps://www.wolframalpha.com/input/?i={searchTerms}&trackid=sp-005 SearchScopes: HKLM-x32 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01 SearchScopes: HKLM-x32 -> {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxps://fr.search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms} SearchScopes: HKLM-x32 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.certified-toolbar.com?si=77302&st=bs&tid=18195&ver=6.4&ts=1403548245556&tguid=77302-18195-1403548245556-D67D6675BB449E825EEAB984FAA2D7D0&q={searchTerms} SearchScopes: HKU\S-1-5-21-67368778-3054950882-2857564751-1001 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://fr.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=hdr_s_15_36_orgnl¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dfr%26pa%3DHodor%26cd%3D2XzuyEtN2Y1L1QzuyB0CtDyDtDyBtDyDzytCzztCtB0E0AyEtN0D0Tzu0StCtAtAzztN1L2XzutAtFtCtBtFyDtFyBtN1L1Czu1M1Q1CtCtCtN1L1G1B1V1N2Y1L1Qzu2S0CyEtDtD0B0C0BtAtGyByE0FtAtGyEyBzytCtG0ByB0CyEtGtD0D0C0F0EtAtA0B0F0A0FyC2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0FtDzy0AtBtD0E0BtG0CzzzztBtGyEyB0DtCtG0B0BtAyBtGyBtDtAtByDyBzyzy0DtA0EtA2QtN0A0LzuyE%26cr%3D2074743978%26a%3Dhdr_s_15_36_orgnl%26os%3DWindows%2B8.1&p={searchTerms} SearchScopes: HKU\S-1-5-21-67368778-3054950882-2857564751-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms} SearchScopes: HKU\S-1-5-21-67368778-3054950882-2857564751-1001 -> {1b31c9d2-7135-442b-bb93-7c002172adc6} URL = hxxps://fr.search.yahoo.com/yhs/search?hspart=elm&hsimp=yhs-001&type=hdr_s_16_07_orgnl¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dfr%26pa%3DHodor%26cd%3D2XzuyEtN2Y1L1QzuyB0CtDyDtDyBtDyDzytCzztCtB0E0AyEtN0D0Tzu0StCyDtCtBtN1L2XzutAtFtCyBtFzytFtCtN1L1Czu1M1Q1CtBtBtFtCtFtCtN1L1G1B1V1N2Y1L1Qzu2StDyCyB0EtDtA0ByDtGtCtA0AzztGtBtAyCyBtGtAyDyCtCtG0EyDtC0BtD0D0E0B0Ezyzz0C2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0FtDzy0AtBtD0E0BtG0CzzzztBtGyEyB0DtCtG0B0BtAyBtGyBtDtAtByDyBzyzy0DtA0EtA2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCyEyBtB%26cr%3D230091025%26a%3Dhdr_s_16_07_orgnl%26os_ver%3D6.3%26os%3DWindows%2B8.1&p={searchTerms} SearchScopes: HKU\S-1-5-21-67368778-3054950882-2857564751-1001 -> {2de06457-88b8-4989-9288-5fe9c2584ab8} URL = hxxps://www.wolframalpha.com/input/?i={searchTerms}&trackid=sp-005 SearchScopes: HKU\S-1-5-21-67368778-3054950882-2857564751-1001 -> {2E00D31D-D171-423D-836D-1A4D7EA7F1A9} URL = hxxp://www.mystart.com/results.php?gen=ms&pr=vmn&id=mystarttb&v=5_4&ent=ch_5127&q={searchTerms} SearchScopes: HKU\S-1-5-21-67368778-3054950882-2857564751-1001 -> {31090377-0740-419E-BEFC-A56E50500D5B} URL = hxxps://fr.search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms} SearchScopes: HKU\S-1-5-21-67368778-3054950882-2857564751-1001 -> {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} URL = hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_cmi_14_43_ch&cd=2XzuyEtN2Y1L1QzuyB0CtDyDtDyBtDyDzytCzztCtB0E0AyEtN0D0Tzu0StCtDtAtDtN1L2XzutAtFyDtFtCtFyEtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StAyE0Bzz0A0ByByDtGzz0FyD0FtG0FtDyCyEtG0ByDtByEtGyE0Azz0D0B0EtB0AzzyE0A0C2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyDtAtCtDtCyDzz0BtG0DtD0E0FtGyEtA0AtAtGzzyE0ByBtGtC0Czzzz0D0D0CyCzzyE0A0C2Q&cr=1784868693&ir= SearchScopes: HKU\S-1-5-21-67368778-3054950882-2857564751-1001 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_tele_14_37_ch&cd=2XzuyEtN2Y1L1QzuyB0CtDyDtDyBtDyDzytCzztCtB0E0AyEtN0D0Tzu0SzyzzzztN1L2XzutAtFtBtFtCtFyDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StAtAzztAtAyC0FtDtG0DtB0DyBtGzy0A0F0DtGzztCzztDtGtBtB0D0CtC0E0A0EtAyBtB0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyDtAtCtDtCyDzz0BtG0DtD0E0FtGyEtA0AtAtGzzyE0ByBtGtC0Czzzz0D0D0CyCzzyE0A0C2Q&cr=92629545&ir= SearchScopes: HKU\S-1-5-21-67368778-3054950882-2857564751-1001 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.certified-toolbar.com?si=77302&st=bs&tid=18195&ver=6.4&ts=1403548245556&tguid=77302-18195-1403548245556-D67D6675BB449E825EEAB984FAA2D7D0&q={searchTerms} SearchScopes: HKU\S-1-5-21-67368778-3054950882-2857564751-1001 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://fr.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=hdr_s_15_36_orgnl¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dfr%26pa%3DHodor%26cd%3D2XzuyEtN2Y1L1QzuyB0CtDyDtDyBtDyDzytCzztCtB0E0AyEtN0D0Tzu0StCtAtAzztN1L2XzutAtFtCtBtFyDtFyBtN1L1Czu1M1Q1CtCtCtN1L1G1B1V1N2Y1L1Qzu2S0CyEtDtD0B0C0BtAtGyByE0FtAtGyEyBzytCtG0ByB0CyEtGtD0D0C0F0EtAtA0B0F0A0FyC2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0FtDzy0AtBtD0E0BtG0CzzzztBtGyEyB0DtCtG0B0BtAyBtGyBtDtAtByDyBzyzy0DtA0EtA2QtN0A0LzuyE%26cr%3D2074743978%26a%3Dhdr_s_15_36_orgnl%26os%3DWindows%2B8.1&p={searchTerms} BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2016-05-06] (AVAST Software) BHO-x32: Pas de nom -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> Pas de fichier BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-05-06] (AVAST Software) BHO-x32: Pas de nom -> {EFA7A511-B491-4312-BB35-4586B99E45ED} -> Pas de fichier Toolbar: HKU\S-1-5-21-67368778-3054950882-2857564751-1001 -> Pas de nom - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - Pas de fichier StartMenuInternet: IEXPLORE.EXE - iexplore.exe FireFox: ======== FF ProfilePath: C:\Users\toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\ytnimh2h.default FF SearchEngineOrder.3: Bing FF SelectedSearchEngine: Bing FF Homepage: hxxp://search.zonealarm.com/?src=hp&tbid=HFA5&Lan=FR&gu=1e94cdf12e2e4b4fa17a7bdb0b169f6a&tu=10G9y00KS4D33N0&sku=&tstsId=&ver=& FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation) FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-12-18] () FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-06] (Intel Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation) FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL [2015-04-10] (Nero AG) FF Plugin-x32: @staging.google.com/globalUpdate Update;version=10 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll [Pas de fichier] FF Plugin-x32: @staging.google.com/globalUpdate Update;version=4 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll [Pas de fichier] FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.) FF Plugin-x32: @tools.Software.com/Software Update;version=3 -> C:\Program Files (x86)\Software\Update\1.3.25.0\npSoftwareUpdate3.dll [2014-06-23] (The Software Group) FF Plugin-x32: @tools.Software.com/Software Update;version=9 -> C:\Program Files (x86)\Software\Update\1.3.25.0\npSoftwareUpdate3.dll [2014-06-23] (The Software Group) FF Plugin HKU\S-1-5-21-67368778-3054950882-2857564751-1001: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\toshiba\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [2014-07-24] (Skype Limited) FF user.js: detected! => C:\Users\toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\ytnimh2h.default\user.js [2015-06-22] FF SearchPlugin: C:\Users\toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\ytnimh2h.default\searchplugins\zonealarm.xml [2015-06-22] FF Extension: Yahoo! Toolbar - C:\Users\toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\ytnimh2h.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2015-05-25] [non signé] FF Extension: Bing Search - C:\Users\toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\ytnimh2h.default\Extensions\bingsearch.full@microsoft.com [2015-05-27] [non signé] FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-05-06] FF HKLM\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF FF Extension: Avast SafePrice - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2016-05-06] FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF HKLM-x32\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF Chrome: ======= CHR HomePage: Default -> hxxps://fr.search.yahoo.com/yhs/web?hspart=elm&hsimp=yhs-001&type=hdr_s_16_07_orgnl¶m1=1¶m2=f%3D1%26b%3DChrome%26cc%3Dfr%26pa%3DHodor%26cd%3D2XzuyEtN2Y1L1QzuyB0CtDyDtDyBtDyDzytCzztCtB0E0AyEtN0D0Tzu0StCyDtCtBtN1L2XzutAtFtCyBtFzytFtCtN1L1Czu1M1Q1CtBtBtFtCtFtCtN1L1G1B1V1N2Y1L1Qzu2StDyCyB0EtDtA0ByDtGtCtA0AzztGtBtAyCyBtGtAyDyCtCtG0EyDtC0BtD0D0E0B0Ezyzz0C2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0FtDzy0AtBtD0E0BtG0CzzzztBtGyEyB0DtCtG0B0BtAyBtGyBtDtAtByDyBzyzy0DtA0EtA2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCyEyBtB%26cr%3D230091025%26a%3Dhdr_s_16_07_orgnl%26os_ver%3D6.3%26os%3DWindows%2B8.1 CHR StartupUrls: Default -> "hxxps://fr.search.yahoo.com/yhs/web?hspart=elm&hsimp=yhs-001&type=hdr_s_16_07_orgnl¶m1=1¶m2=f%3D7%26b%3DChrome%26cc%3Dfr%26pa%3DHodor%26cd%3D2XzuyEtN2Y1L1QzuyB0CtDyDtDyBtDyDzytCzztCtB0E0AyEtN0D0Tzu0StCyDtCtBtN1L2XzutAtFtCyBtFzytFtCtN1L1Czu1M1Q1CtBtBtFtCtFtCtN1L1G1B1V1N2Y1L1Qzu2StDyCyB0EtDtA0ByDtGtCtA0AzztGtBtAyCyBtGtAyDyCtCtG0EyDtC0BtD0D0E0B0Ezyzz0C2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0FtDzy0AtBtD0E0BtG0CzzzztBtGyEyB0DtCtG0B0BtAyBtGyBtDtAtByDyBzyzy0DtA0EtA2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCyEyBtB%26cr%3D230091025%26a%3Dhdr_s_16_07_orgnl%26os_ver%3D6.3%26os%3DWindows%2B8.1","hxxp://www.google.fr/" CHR Profile: C:\Users\toshiba\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (BestY NewTab) - C:\Users\toshiba\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajcmdlkeklfmbjffnlofgfkjcnpfckab [2016-02-21] CHR Extension: (Спасение кошелька. Скидки, акции) - C:\Users\toshiba\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajkpabnkbikkjbepogphndbjiejnecjg [2016-02-14] CHR Extension: (Google Docs hors connexion) - C:\Users\toshiba\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-16] CHR Extension: (Paiements via le Chrome Web Store) - C:\Users\toshiba\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-03] CHR HKLM\...\Chrome\Extension: [ajcmdlkeklfmbjffnlofgfkjcnpfckab] - hxxps://clients2.google.com/service/update2/crx CHR HKLM\...\Chrome\Extension: [bakijjialdiiboeaknfpmflphhmljfkd] - hxxps://clients2.google.com/service/update2/crx CHR HKLM\...\Chrome\Extension: [pfkfdlcdbajamklbneflfbcmfgddmpae] - hxxps://clients2.google.com/service/update2/crx CHR HKU\S-1-5-21-67368778-3054950882-2857564751-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [ajcmdlkeklfmbjffnlofgfkjcnpfckab] - hxxps://clients2.google.com/service/update2/crx CHR HKU\S-1-5-21-67368778-3054950882-2857564751-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [pfkfdlcdbajamklbneflfbcmfgddmpae] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [ajcmdlkeklfmbjffnlofgfkjcnpfckab] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [dghncoeocefmhkhiphdgikkamjeglbfh] - C:\Program Files (x86)\mystarttb\chrome-newtab-search.crx CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2016-05-06] CHR HKLM-x32\...\Chrome\Extension: [pfkfdlcdbajamklbneflfbcmfgddmpae] - hxxps://clients2.google.com/service/update2/crx ==================== Services (Avec liste blanche) ======================== (Si un élément est inclus dans le fichier fixlist.txt, il sera supprimé du Registre. Le fichier ne sera pas déplacé, sauf s'il est inscrit séparément.) R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-03-02] (Apple Inc.) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [243296 2016-05-06] (AVAST Software) R2 BackupStack; C:\Program Files (x86)\MyPC Backup\BackupStack.exe [36936 2014-09-18] (Just Develop It) <==== ATTENTION R2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-13] () [Fichier non signé] R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation) R2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.10.767.8917\AdAwareService.exe [712432 2016-01-28] () R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201872 2012-12-10] (Realtek Semiconductor) S2 Software_update; C:\Program Files (x86)\Software\Update\SoftwareUpdate.exe [119408 2014-06-23] (The Software Group) S3 Software_update_m; C:\Program Files (x86)\Software\Update\SoftwareUpdate.exe [119408 2014-06-23] (The Software Group) R3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [118856 2015-12-01] (Toshiba Europe GmbH) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation) ===================== Pilotes (Avec liste blanche) ========================== (Si un élément est inclus dans le fichier fixlist.txt, il sera supprimé du Registre. Le fichier ne sera pas déplacé, sauf s'il est inscrit séparément.) R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [37656 2016-05-06] (AVAST Software) R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [37144 2016-05-06] (AVAST Software) R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [107792 2016-05-06] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [103064 2016-05-06] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [74544 2016-05-06] (AVAST Software) R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1070904 2016-05-06] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [465792 2016-05-06] (AVAST Software) R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [166432 2016-05-06] (AVAST Software) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [287528 2016-05-06] (AVAST Software) R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [98472 2012-07-17] (Advanced Micro Devices) S4 cdfs; C:\Windows\System32\DRIVERS\cdfs.sys [88576 2013-08-22] (Microsoft Corporation) [Fichier non signé] S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation) R2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-11] (PEGATRON) R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [2946264 2013-10-21] (Realtek Semiconductor Corporation ) R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [31032 2012-11-29] (Synaptics Incorporated) S3 ssudserd; C:\Windows\system32\DRIVERS\ssudserd.sys [206080 2014-01-22] (DEVGURU Co., LTD.(www.devguru.co.kr)) R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [32624 2013-08-19] (Windows (R) Win 7 DDK provider) S3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [452040 2015-12-09] (BitDefender S.R.L.) S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation) S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation) S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation) S3 NdisVirtualBus; \SystemRoot\System32\drivers\NdisVirtualBus.sys [X] S3 NdisWan; \SystemRoot\system32\DRIVERS\ndiswan.sys [X] S3 NdisWanLegacy; \SystemRoot\system32\DRIVERS\ndiswan.sys [X] ==================== NetSvcs (Avec liste blanche) =================== (Si un élément est inclus dans le fichier fixlist.txt, il sera supprimé du Registre. Le fichier ne sera pas déplacé, sauf s'il est inscrit séparément.) ==================== Un mois - Créés - fichiers et dossiers ======== (Si un élément est inclus dans le fichier fixlist.txt, le fichier/dossier sera déplacé.) 2016-05-27 22:01 - 2016-05-27 22:02 - 00027679 _____ C:\Users\toshiba\Downloads\FRST.txt 2016-05-27 22:00 - 2016-05-27 22:01 - 00000000 ____D C:\FRST 2016-05-27 22:00 - 2016-05-27 22:00 - 00001194 _____ C:\Users\toshiba\Desktop\FRST64.exe - Raccourci.lnk 2016-05-27 21:59 - 2016-05-27 22:00 - 02383360 _____ (Farbar) C:\Users\toshiba\Downloads\FRST64.exe 2016-05-26 22:11 - 2016-05-26 22:11 - 00281432 _____ C:\WINDOWS\Minidump\052616-567875-01.dmp 2016-05-26 22:08 - 2016-05-26 22:08 - 649030298 _____ C:\WINDOWS\MEMORY.DMP 2016-05-26 21:23 - 2016-05-26 21:23 - 00000000 ____D C:\Users\toshiba\AppData\Roaming\Lavasoft 2016-05-26 21:02 - 2016-05-27 17:27 - 00002323 _____ C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk 2016-05-26 21:02 - 2016-05-26 21:02 - 00000000 ____D C:\Users\toshiba\AppData\Roaming\LavasoftStatistics 2016-05-26 21:02 - 2016-05-26 21:02 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft 2016-05-26 20:57 - 2016-05-26 20:57 - 00000000 ____D C:\Program Files\Lavasoft 2016-05-26 20:54 - 2016-05-26 20:54 - 00000000 ____D C:\Program Files\Common Files\Lavasoft 2016-05-26 20:52 - 2016-05-26 20:52 - 02085168 _____ C:\Users\toshiba\Downloads\Adaware_Installer.exe 2016-05-26 20:52 - 2016-05-26 20:52 - 00000000 ____D C:\ProgramData\Lavasoft 2016-05-26 20:51 - 2016-05-26 20:51 - 02085168 _____ C:\Users\toshiba\Downloads\Non confirmé 915885.crdownload 2016-05-26 17:58 - 2016-05-26 17:59 - 06893688 _____ (Piriform Ltd) C:\Users\toshiba\Downloads\ccsetup518.exe 2016-05-20 21:04 - 2016-05-20 21:04 - 00000000 __SHD C:\found.012 2016-05-20 20:37 - 2016-05-20 20:37 - 00000000 __SHD C:\found.011 2016-05-20 20:37 - 2016-05-20 20:37 - 00000000 __SHD C:\found.010 2016-05-19 18:48 - 2016-05-20 17:51 - 00000000 ____D C:\Users\toshiba\AppData\Local\{25AA13F6-0102-7F4E-6C9A-5AA648F2A63E} 2016-05-17 16:34 - 2016-05-17 16:34 - 00001736 _____ C:\Users\Public\Desktop\iTunes.lnk 2016-05-17 16:34 - 2016-05-17 16:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes 2016-05-17 16:33 - 2016-05-17 16:34 - 00000000 ____D C:\Program Files\iTunes 2016-05-17 16:33 - 2016-05-17 16:33 - 00000000 ____D C:\Program Files\iPod 2016-05-17 16:33 - 2016-05-17 16:33 - 00000000 ____D C:\Program Files (x86)\iTunes 2016-05-16 19:40 - 2016-05-16 19:40 - 00004526 _____ C:\Users\toshiba\Desktop\cc_20160516_193958.reg 2016-05-11 16:54 - 2016-04-11 08:21 - 00074584 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volmgr.sys 2016-05-11 16:54 - 2016-03-31 08:50 - 01307328 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll 2016-05-11 16:54 - 2016-03-31 05:40 - 00747520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll 2016-05-11 16:53 - 2016-04-22 22:54 - 25816576 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2016-05-11 16:53 - 2016-04-22 22:15 - 00571904 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll 2016-05-11 16:53 - 2016-04-22 22:14 - 02893312 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll 2016-05-11 16:53 - 2016-04-22 22:08 - 06052864 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll 2016-05-11 16:53 - 2016-04-22 22:06 - 20349952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2016-05-11 16:53 - 2016-04-22 22:00 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll 2016-05-11 16:53 - 2016-04-22 21:35 - 00497152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll 2016-05-11 16:53 - 2016-04-22 21:29 - 02285568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll 2016-05-11 16:53 - 2016-04-22 21:24 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll 2016-05-11 16:53 - 2016-04-22 21:23 - 00663552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll 2016-05-11 16:53 - 2016-04-22 21:19 - 15414784 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2016-05-11 16:53 - 2016-04-22 21:17 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll 2016-05-11 16:53 - 2016-04-22 21:14 - 00806400 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll 2016-05-11 16:53 - 2016-04-22 21:14 - 00725504 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe 2016-05-11 16:53 - 2016-04-22 21:14 - 00379392 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll 2016-05-11 16:53 - 2016-04-22 21:12 - 02131968 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl 2016-05-11 16:53 - 2016-04-22 20:58 - 04611072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll 2016-05-11 16:53 - 2016-04-22 20:58 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll 2016-05-11 16:53 - 2016-04-22 20:54 - 13811200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2016-05-11 16:53 - 2016-04-22 20:53 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll 2016-05-11 16:53 - 2016-04-22 20:52 - 02596864 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll 2016-05-11 16:53 - 2016-04-22 20:52 - 00693248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll 2016-05-11 16:53 - 2016-04-22 20:52 - 00330752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll 2016-05-11 16:53 - 2016-04-22 20:51 - 02056192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl 2016-05-11 16:53 - 2016-04-22 20:40 - 01547264 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll 2016-05-11 16:53 - 2016-04-22 20:29 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll 2016-05-11 16:53 - 2016-04-22 20:27 - 02121216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll 2016-05-11 16:53 - 2016-04-22 20:24 - 01311744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll 2016-05-11 16:53 - 2016-04-22 20:23 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll 2016-05-11 16:49 - 2016-04-10 06:21 - 01763376 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll 2016-05-11 16:49 - 2016-04-10 06:21 - 01489088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll 2016-05-11 16:49 - 2016-04-09 23:58 - 00534016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll 2016-05-11 16:49 - 2016-04-09 23:50 - 00375296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll 2016-05-11 16:49 - 2016-04-06 23:13 - 00561960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys 2016-05-11 16:49 - 2016-04-06 23:13 - 00137976 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncrypt.dll 2016-05-11 16:49 - 2016-04-06 20:20 - 00201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys 2016-05-11 16:49 - 2016-04-06 20:19 - 00401920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb.sys 2016-05-11 16:49 - 2016-04-06 20:19 - 00284672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb10.sys 2016-05-11 16:49 - 2016-04-06 19:49 - 00120384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncrypt.dll 2016-05-11 16:49 - 2016-04-06 19:40 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll 2016-05-11 16:49 - 2016-04-06 18:57 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll 2016-05-11 16:49 - 2016-04-06 18:52 - 00432128 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll 2016-05-11 16:49 - 2016-04-06 18:20 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll 2016-05-11 16:49 - 2016-04-06 17:48 - 00357888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll 2016-05-11 16:49 - 2016-03-29 03:42 - 07446368 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe 2016-05-11 16:49 - 2016-02-11 22:17 - 01737088 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll 2016-05-11 16:49 - 2016-02-11 22:16 - 01501488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll 2016-05-11 16:41 - 2016-04-10 09:48 - 00738096 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10level9.dll 2016-05-11 16:41 - 2016-04-10 09:48 - 00613624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10level9.dll 2016-05-11 16:41 - 2016-04-10 06:14 - 01380600 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll 2016-05-11 16:41 - 2016-04-10 00:07 - 01097728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll 2016-05-11 16:38 - 2016-04-10 07:37 - 01549144 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys 2016-05-11 16:38 - 2016-04-10 01:29 - 04169216 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys 2016-05-07 12:19 - 2016-05-07 12:19 - 00350936 _____ (Spotify Ltd) C:\Users\toshiba\Downloads\SpotifySetup (2).exe 2016-05-06 07:03 - 2016-05-06 07:03 - 00001909 _____ C:\Users\Public\Desktop\Avast Antivirus Gratuit.lnk 2016-05-06 07:03 - 2016-05-06 07:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software 2016-05-06 07:01 - 2016-05-06 07:01 - 00398152 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe 2016-05-06 07:00 - 2016-05-06 07:00 - 00052184 _____ (AVAST Software) C:\WINDOWS\avastSS.scr 2016-05-05 07:58 - 2016-05-05 07:58 - 00000000 ___HD C:\Users\toshiba\AppData\Local\6076429f75ae0f22 2016-05-02 08:03 - 2016-05-02 08:03 - 00000000 ____D C:\Users\toshiba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chromium 2016-05-02 07:58 - 2016-05-06 08:58 - 00000000 ____D C:\Users\toshiba\AppData\Local\{9A70AC2C-BED8-C094-D340-E57CF72819E4} 2016-05-02 07:58 - 2016-05-02 07:58 - 00002508 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HowToRemove.html.lnk 2016-04-30 20:04 - 2016-04-30 20:04 - 00350936 _____ (Spotify Ltd) C:\Users\toshiba\Downloads\SpotifySetup (1).exe 2016-04-30 20:03 - 2016-04-30 20:03 - 00350936 _____ (Spotify Ltd) C:\Users\toshiba\Downloads\SpotifySetup.exe ==================== Un mois - Modifiés - fichiers et dossiers ======== (Si un élément est inclus dans le fichier fixlist.txt, le fichier/dossier sera déplacé.) 2016-05-27 21:48 - 2014-10-26 19:48 - 00000310 _____ C:\WINDOWS\Tasks\WSE_Astromenda.job 2016-05-27 21:35 - 2014-06-23 20:30 - 00000930 _____ C:\WINDOWS\Tasks\SoftwareUpdateTaskMachineUA.job 2016-05-27 21:12 - 2016-02-19 09:02 - 00001086 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job 2016-05-27 20:35 - 2014-06-23 20:30 - 00000926 _____ C:\WINDOWS\Tasks\SoftwareUpdateTaskMachineCore.job 2016-05-27 19:38 - 2014-08-06 16:33 - 00000946 _____ C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-67368778-3054950882-2857564751-1001UA.job 2016-05-27 18:14 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\AppReadiness 2016-05-27 18:02 - 2014-06-10 17:28 - 00000000 ____D C:\Users\toshiba\AppData\Local\Packages 2016-05-27 17:54 - 2014-06-10 17:34 - 00003596 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-67368778-3054950882-2857564751-1001 2016-05-27 17:36 - 2014-10-27 21:04 - 00003928 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{1C5FC3F5-004E-4209-AC5C-D2945234FACC} 2016-05-27 17:29 - 2016-03-30 21:32 - 00000000 ___RD C:\Users\toshiba\OneDrive 2016-05-27 17:28 - 2016-02-19 09:02 - 00001082 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job 2016-05-27 17:26 - 2013-08-22 16:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT 2016-05-26 22:46 - 2013-08-22 15:25 - 00524288 ___SH C:\WINDOWS\system32\config\BBI 2016-05-26 22:35 - 2013-08-22 17:36 - 00000000 ___HD C:\Program Files\WindowsApps 2016-05-26 22:20 - 2014-06-10 16:22 - 00000000 ____D C:\Program Files (x86)\TOSHIBA Games 2016-05-26 22:20 - 2014-06-10 16:21 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games 2016-05-26 22:20 - 2014-06-10 16:21 - 00000000 ____D C:\Program Files (x86)\WildGames 2016-05-26 22:19 - 2014-06-30 19:15 - 00000000 ____D C:\Users\toshiba\AppData\Roaming\WildTangent 2016-05-26 22:19 - 2014-06-10 16:21 - 00000000 ____D C:\ProgramData\WildTangent 2016-05-26 22:17 - 2016-02-19 11:00 - 00004182 _____ C:\WINDOWS\System32\Tasks\avast! Emergency Update 2016-05-26 22:11 - 2015-05-24 09:04 - 00000000 ____D C:\WINDOWS\Minidump 2016-05-26 22:08 - 2014-10-17 13:54 - 00000000 ____D C:\Users\toshiba 2016-05-26 19:56 - 2012-07-26 09:59 - 00000000 ____D C:\WINDOWS\CbsTemp 2016-05-26 19:53 - 2015-04-04 14:50 - 00000000 ___SD C:\WINDOWS\SysWOW64\GWX 2016-05-26 19:53 - 2015-04-04 14:50 - 00000000 ___SD C:\WINDOWS\system32\GWX 2016-05-26 18:00 - 2015-08-30 09:29 - 00000805 _____ C:\Users\Public\Desktop\CCleaner.lnk 2016-05-21 17:25 - 2014-07-28 15:06 - 00000000 ____D C:\Users\toshiba\AppData\Roaming\Skype 2016-05-21 17:25 - 2014-07-28 15:05 - 00000000 ____D C:\ProgramData\Skype 2016-05-20 17:59 - 2013-08-22 15:36 - 00000000 ____D C:\WINDOWS\Inf 2016-05-19 18:52 - 2015-08-31 16:53 - 00000000 ____D C:\Users\toshiba\AppData\Local\Chromium 2016-05-19 18:48 - 2014-06-13 18:31 - 00000384 _____ C:\Users\toshiba\AppData\Roaming\WB.CFG 2016-05-17 16:33 - 2014-09-13 19:37 - 00000000 ____D C:\Program Files\Common Files\Apple 2016-05-12 21:31 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\rescache 2016-05-12 20:27 - 2014-12-14 08:51 - 00000000 ____D C:\WINDOWS\system32\appraiser 2016-05-12 16:53 - 2016-02-19 09:06 - 00002224 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk 2016-05-12 16:53 - 2016-02-19 09:06 - 00002212 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2016-05-12 16:09 - 2013-08-22 16:44 - 00362680 _____ C:\WINDOWS\system32\FNTCACHE.DAT 2016-05-11 22:08 - 2014-10-23 06:37 - 00829944 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2016-05-11 22:08 - 2014-10-23 06:37 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl 2016-05-11 18:08 - 2014-09-24 17:03 - 00000000 ____D C:\Program Files\Windows Journal 2016-05-11 18:08 - 2014-06-13 19:49 - 00000000 ____D C:\WINDOWS\system32\MRT 2016-05-11 18:00 - 2014-06-13 19:49 - 139319312 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2016-05-11 17:07 - 2016-02-19 09:02 - 00004058 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA 2016-05-11 17:07 - 2016-02-19 09:02 - 00003822 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore 2016-05-11 16:37 - 2016-03-28 07:40 - 01663184 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi 2016-05-11 16:37 - 2016-03-28 07:40 - 01523208 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe 2016-05-11 16:37 - 2016-03-28 07:40 - 01490120 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi 2016-05-11 16:37 - 2016-03-28 07:40 - 01358952 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe 2016-05-11 16:37 - 2016-03-28 07:40 - 00246784 _____ (Microsoft Corporation) C:\WINDOWS\system32\microsoft-windows-system-events.dll 2016-05-06 18:25 - 2016-02-13 16:22 - 00000000 ___HD C:\$WINDOWS.~BT 2016-05-06 17:39 - 2014-10-17 14:42 - 00000000 ___DC C:\WINDOWS\Panther 2016-05-06 07:06 - 2016-03-23 17:17 - 00003908 _____ C:\WINDOWS\System32\Tasks\SafeZone scheduled Autoupdate 1458746221 2016-05-06 07:06 - 2016-03-23 17:17 - 00001024 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast SafeZone Browser.lnk 2016-05-06 07:01 - 2016-02-19 11:00 - 00465792 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys 2016-05-06 07:01 - 2016-02-19 11:00 - 00287528 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswVmm.sys 2016-05-06 07:01 - 2016-02-19 11:00 - 00166432 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswStm.sys 2016-05-06 07:01 - 2016-02-19 11:00 - 00107792 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys 2016-05-06 07:01 - 2016-02-19 11:00 - 00103064 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys 2016-05-06 07:01 - 2016-02-19 11:00 - 00074544 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRvrt.sys 2016-05-06 07:01 - 2016-02-19 11:00 - 00037656 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswHwid.sys 2016-05-06 07:00 - 2016-03-23 17:16 - 00037144 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswKbd.sys 2016-05-06 07:00 - 2016-02-19 11:00 - 01070904 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSnx.sys 2016-05-03 08:17 - 2016-03-22 20:38 - 00000000 ___RD C:\Program Files (x86)\Skype 2016-05-02 07:58 - 2015-08-31 16:49 - 00000290 __RSH C:\ProgramData\ntuser.pol ==================== Fichiers à la racine de certains dossiers ======= 2014-06-23 20:26 - 2014-06-23 20:27 - 0001285 _____ () C:\Users\toshiba\AppData\Roaming\Bubble Dock.boostrap.log 2014-06-23 20:26 - 2014-06-23 20:27 - 0013117 _____ () C:\Users\toshiba\AppData\Roaming\Bubble Dock.installation.log 2016-02-21 08:48 - 2016-02-21 08:48 - 2590738 _____ () C:\Users\toshiba\AppData\Roaming\sb218.dat 2016-02-03 19:48 - 2016-02-03 19:48 - 2654739 _____ () C:\Users\toshiba\AppData\Roaming\sb984.dat 2014-06-13 18:31 - 2016-05-19 18:48 - 0000384 _____ () C:\Users\toshiba\AppData\Roaming\WB.CFG 2014-12-02 17:48 - 2015-05-25 06:48 - 0000001 _____ () C:\Users\toshiba\AppData\Local\DSI.DAT 2014-12-02 17:48 - 2014-12-02 17:48 - 0022528 _____ () C:\Users\toshiba\AppData\Local\dsisetup11193319372.exe 2014-12-17 18:48 - 2014-12-17 18:48 - 0022528 _____ () C:\Users\toshiba\AppData\Local\dsisetup2949738902.exe 2015-03-27 20:00 - 2015-03-27 20:00 - 0000017 _____ () C:\Users\toshiba\AppData\Local\resmon.resmoncfg 2015-05-24 12:29 - 2015-05-24 12:29 - 0000000 _____ () C:\Users\toshiba\AppData\Local\{303A24AE-9A6B-4B99-9CED-65E72EE122F9} 2015-05-24 12:29 - 2015-05-24 12:29 - 0000000 _____ () C:\Users\toshiba\AppData\Local\{99E43D60-D81A-4642-A307-0A15C70133E4} Fichiers à déplacer ou supprimer: ==================== C:\Users\toshiba\setup.exe Certains fichiers dans TEMP: ==================== C:\Users\ADMINI~1\AppData\Local\Temp\PresentationCore.dll C:\Users\ADMINI~1\AppData\Local\Temp\PresentationFramework.dll C:\Users\ADMINI~1\AppData\Local\Temp\ReachFramework.dll C:\Users\ADMINI~1\AppData\Local\Temp\UIAutomationProvider.dll C:\Users\ADMINI~1\AppData\Local\Temp\UIAutomationTypes.dll C:\Users\ADMINI~1\AppData\Local\Temp\WindowsBase.dll C:\Users\ADMINI~1\AppData\Local\Temp\WindowsFormsIntegration.dll C:\Users\toshiba\AppData\Local\Temp\SpotifyUninstall.exe ==================== Bamital & volsnap ================= (Il n'y a pas de correction automatique pour les fichiers qui ne satisfont pas à la vérification.) C:\WINDOWS\system32\winlogon.exe => Le fichier est signé numériquement C:\WINDOWS\system32\wininit.exe => Le fichier est signé numériquement C:\WINDOWS\explorer.exe => Le fichier est signé numériquement C:\WINDOWS\SysWOW64\explorer.exe => Le fichier est signé numériquement C:\WINDOWS\system32\svchost.exe => Le fichier est signé numériquement C:\WINDOWS\SysWOW64\svchost.exe => Le fichier est signé numériquement C:\WINDOWS\system32\services.exe => Le fichier est signé numériquement C:\WINDOWS\system32\User32.dll => Le fichier est signé numériquement C:\WINDOWS\SysWOW64\User32.dll => Le fichier est signé numériquement C:\WINDOWS\system32\userinit.exe => Le fichier est signé numériquement C:\WINDOWS\SysWOW64\userinit.exe => Le fichier est signé numériquement C:\WINDOWS\system32\rpcss.dll => Le fichier est signé numériquement C:\WINDOWS\system32\dnsapi.dll => Le fichier est signé numériquement C:\WINDOWS\SysWOW64\dnsapi.dll => Le fichier est signé numériquement C:\WINDOWS\system32\Drivers\volsnap.sys => Le fichier est signé numériquement LastRegBack: 2016-05-27 18:02 ==================== Fin de FRST.txt ============================