--------------- QuickDiag | g3n-h@ckm@n | V3_24.06.17.1 --------------- ----- XP | Vista | 7 | 8 | 8.1 | 10 - 32/64 bits ----- - Start 24/06/2017 16:27:42 Updated 24/06/2017 | 13.30 (GMT) by g3n-h@ckm@n Contact : http://www.sosvirus.net/ Time Zone : (UTC+01:00) Bruxelles, Copenhague, Madrid, Paris [Sylvain (Administrator)] - [SYLVAIN-PC] (S-1-5-21-1977720525-337058645-3963175332-1000) System: Microsoft Windows 7 Édition Intégrale - Service Pack 1 - (6.1.7601) - BuildType: Multiprocessor Free - OSLanguage: 1036 (040c) -> () System: AutoReboot: True - DebugFilePath: %SystemRoot%\MEMORY.DMP - KernelDumpOnly: False - OverwriteExistingDebugFile: True - WriteDebugInfo: True - WriteToSystemLog: True Boot : Microsoft Windows 7 Édition Intégrale |C:\Windows|\Device\Harddisk0\Partition2 Boot : Normal boot PC: H55M-S2 - Gigabyte Technology Co., Ltd. - IdNumber: - UUID: 00000000-0000-0000-0000-1C6F654DA78A Processor : X64 - 3199 Mhz - Intel(R) Core(TM) i5 CPU 650 @ 3.20GHz Award Modular BIOS v6.00PG - n|US|iso8859-1 - Award Software International, Inc. - S/N: - F4 - GBT - 42302e31 CoreTemp : ? Celsius ----------| Quick ---------- | SoundDevice NVIDIA High Definition Audio - Status: OK - Manufacturer: NVIDIA - PNPDeviceID: HDAUDIO\FUNC_01&VEN_10DE&DEV_0012&SUBSYS_10DE0101&REV_1001\5&2F81C93B&0&0001 NVIDIA High Definition Audio - Status: OK - Manufacturer: NVIDIA - PNPDeviceID: HDAUDIO\FUNC_01&VEN_10DE&DEV_0012&SUBSYS_10DE0101&REV_1001\5&2F81C93B&0&0101 NVIDIA High Definition Audio - Status: OK - Manufacturer: NVIDIA - PNPDeviceID: HDAUDIO\FUNC_01&VEN_10DE&DEV_0012&SUBSYS_10DE0101&REV_1001\5&2F81C93B&0&0201 NVIDIA High Definition Audio - Status: OK - Manufacturer: NVIDIA - PNPDeviceID: HDAUDIO\FUNC_01&VEN_10DE&DEV_0012&SUBSYS_10DE0101&REV_1001\5&2F81C93B&0&0301 Realtek High Definition Audio - Status: OK - Manufacturer: Realtek - PNPDeviceID: HDAUDIO\FUNC_01&VEN_10EC&DEV_0887&SUBSYS_1458A002&REV_1003\4&35A89E12&0&0201 NVIDIA Virtual Audio Device (Wave Extensible) (WDM) - Status: OK - Manufacturer: NVIDIA - PNPDeviceID: ROOT\UNNAMED_DEVICE\0000 ---------- | Video NVIDIA GeForce GTX 460 - Resolution: 1920x1080 - Colors: 4294967296 - RefreshRate: 60 - 32 Bits Per Pixel - DeviceID: VideoController1 - Drivers: nvd3dumx.dll,nvwgf2umx.dll,nvwgf2umx.dll,nvd3dum,nvwgf2um,nvwgf2um - PNPDeviceID: PCI\VEN_10DE&DEV_0E22&SUBSYS_086510DE&REV_A1\4&25EF8B73&0&0008 - AdapterCompatibility: NVIDIA - RAM: 1073741824 Inegrated Video Chipset DeviceName: NVIDIA GeForce GTX 460 - DriverVersion: 9.18.13.5012 - SpecificationVersion: 1025 ---------- | Codecs c:\windows\system32\lvcod64.dll - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 475672 - Manufacturer: Logitech Inc. - Status: OK c:\windows\system32\msrle32.dll - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 16384 - Manufacturer: Microsoft Corporation - Status: OK c:\windows\system32\msvidc32.dll - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 38912 - Manufacturer: Microsoft Corporation - Status: OK c:\windows\system32\iyuv_32.dll - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 54272 - Manufacturer: Microsoft Corporation - Status: OK c:\windows\system32\msadp32.acm - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 24064 - Manufacturer: Microsoft Corporation - Status: OK c:\windows\system32\msyuv.dll - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 25600 - Manufacturer: Microsoft Corporation - Status: OK c:\windows\system32\msgsm32.acm - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 29184 - Manufacturer: Microsoft Corporation - Status: OK c:\windows\system32\msg711.acm - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 14848 - Manufacturer: Microsoft Corporation - Status: OK c:\windows\system32\imaadp32.acm - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 22016 - Manufacturer: Microsoft Corporation - Status: OK c:\windows\system32\tsbyuv.dll - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 14848 - Manufacturer: Microsoft Corporation - Status: OK c:\windows\system32\l3codeca.acm - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 81408 - Manufacturer: Fraunhofer Institut Integrierte Schaltungen IIS - Status: OK c:\windows\system32\frapsv64.dll - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 71680 - Manufacturer: Beepa P/L - Status: OK ---------- | CPU CPU #1 value:12 % CPU #2 value:62 % CPU #3 value:25 % CPU #4 value:0 % Total Overall CPU Usage value:25 % ---------- | Network Realtek PCIe GBE Family Controller : SENT:0 bytes/sec / RECVD:0 bytes/sec TRENDnet Wireless N PC Card_PCI Adapter : SENT:0 bytes/sec / RECVD:0 bytes/sec Microsoft Virtual WiFi Miniport Adapter : SENT:0 bytes/sec / RECVD:0 bytes/sec Overall -> SEND Maxium:25 bytes/sec, / RECEIVE Maximum:0 bytes/sec WAN Miniport (SSTP) - - Microsoft - Status: - PnPID : ROOT\MS_SSTPMINIPORT\0000 WAN Miniport (IKEv2) - - Microsoft - Status: - PnPID : ROOT\MS_AGILEVPNMINIPORT\0000 WAN Miniport (L2TP) - - Microsoft - Status: - PnPID : ROOT\MS_L2TPMINIPORT\0000 WAN Miniport (PPTP) - - Microsoft - Status: - PnPID : ROOT\MS_PPTPMINIPORT\0000 WAN Miniport (PPPOE) - - Microsoft - Status: - PnPID : ROOT\MS_PPPOEMINIPORT\0000 WAN Miniport (IPv6) - - Microsoft - Status: - PnPID : ROOT\MS_NDISWANIPV6\0000 WAN Miniport (Network Monitor) - - Microsoft - Status: - PnPID : ROOT\MS_NDISWANBH\0000 Realtek PCIe GBE Family Controller - Ethernet 802.3 - Realtek - Status: - PnPID : PCI\VEN_10EC&DEV_8168&SUBSYS_E0001458&REV_06\4&906ED74&0&00E5 WAN Miniport (IP) - - Microsoft - Status: - PnPID : ROOT\MS_NDISWANIP\0000 Apple Mobile Device Ethernet - - - Status: - PnPID : RAS Async Adapter - - - Status: - PnPID : Microsoft Teredo Tunneling Adapter - - Microsoft - Status: - PnPID : ROOT\*TEREDO\0000 TRENDnet Wireless N PC Card/PCI Adapter - Ethernet 802.3 - Realtek Semiconductor Corp. - Status: - PnPID : PCI\VEN_10EC&DEV_8190&SUBSYS_819010EC&REV_00\4&F52DBAB&0&10F0 Microsoft Virtual WiFi Miniport Adapter - Ethernet 802.3 - Microsoft - Status: - PnPID : {5D624F94-8850-40C3-A3FA-A4FD2080BAF3}\VWIFIMP\5&2DCFC333&0&01 ---------- | Memory RAM = Total (MB) : 4055 | Free (MB) : 1972 Pagefile = Total (MB) : 8107 | Free (MB) : 5716 Virtual = Total (MB) : 4194 | Free (MB) : 4012 Physical Memory 0 : Capacity: 2147483648 - A0 - Posit.: 0 - Manufacturer: - PartNumber: - S/N: Physical Memory 2 : Capacity: 2147483648 - A2 - Posit.: 0 - Manufacturer: - PartNumber: - S/N: ---------- | SID Users Administrateur : [S-1-5-21-1977720525-337058645-3963175332-500] HomeGroupUser$ : [S-1-5-21-1977720525-337058645-3963175332-1002] Invité : [S-1-5-21-1977720525-337058645-3963175332-501] Sylvain : [S-1-5-21-1977720525-337058645-3963175332-1000] Administrateurs : [S-1-5-32-544] Duplicateurs : [S-1-5-32-552] IIS_IUSRS : [S-1-5-32-568] Invités : [S-1-5-32-546] Lecteurs des journaux d’événements : [S-1-5-32-573] Opérateurs de chiffrement : [S-1-5-32-569] Opérateurs de configuration réseau : [S-1-5-32-556] Opérateurs de sauvegarde : [S-1-5-32-551] Utilisateurs : [S-1-5-32-545] Utilisateurs avec pouvoir : [S-1-5-32-547] Utilisateurs de l’Analyseur de performances : [S-1-5-32-558] Utilisateurs du Bureau à distance : [S-1-5-32-555] Utilisateurs du journal de performances : [S-1-5-32-559] Utilisateurs du modèle COM distribué : [S-1-5-32-562] HomeUsers : [S-1-5-21-1977720525-337058645-3963175332-1001] ---------- | SystemAccounts Name: Tout le monde - SID: S-1-1-0 - SIDType: 5 - Status: OK Name: LOCAL - SID: S-1-2-0 - SIDType: 5 - Status: OK Name: CREATEUR PROPRIETAIRE - SID: S-1-3-0 - SIDType: 5 - Status: OK Name: GROUPE CREATEUR - SID: S-1-3-1 - SIDType: 5 - Status: OK Name: CREATOR OWNER SERVER - SID: S-1-3-2 - SIDType: 5 - Status: OK Name: CREATOR GROUP SERVER - SID: S-1-3-3 - SIDType: 5 - Status: OK Name: DROITS DU PROPRIÉTAIRE - SID: S-1-3-4 - SIDType: 5 - Status: OK Name: LIGNE - SID: S-1-5-1 - SIDType: 5 - Status: OK Name: RESEAU - SID: S-1-5-2 - SIDType: 5 - Status: OK Name: TACHE - SID: S-1-5-3 - SIDType: 5 - Status: OK Name: INTERACTIF - SID: S-1-5-4 - SIDType: 5 - Status: OK Name: SERVICE - SID: S-1-5-6 - SIDType: 5 - Status: OK Name: ANONYMOUS LOGON - SID: S-1-5-7 - SIDType: 5 - Status: OK Name: Proxy - SID: S-1-5-8 - SIDType: 5 - Status: OK Name: Système - SID: S-1-5-18 - SIDType: 5 - Status: OK Name: ENTERPRISE DOMAIN CONTROLLERS - SID: S-1-5-9 - SIDType: 5 - Status: OK Name: SELF - SID: S-1-5-10 - SIDType: 5 - Status: OK Name: Utilisateurs authentifiés - SID: S-1-5-11 - SIDType: 5 - Status: OK Name: RESTRICTED - SID: S-1-5-12 - SIDType: 5 - Status: OK Name: UTILISATEUR TERMINAL SERVER - SID: S-1-5-13 - SIDType: 5 - Status: OK Name: REMOTE INTERACTIVE LOGON - SID: S-1-5-14 - SIDType: 5 - Status: OK Name: IUSR - SID: S-1-5-17 - SIDType: 5 - Status: OK Name: SERVICE LOCAL - SID: S-1-5-19 - SIDType: 5 - Status: OK Name: SERVICE RÉSEAU - SID: S-1-5-20 - SIDType: 5 - Status: OK Name: BUILTIN - SID: S-1-5-32 - SIDType: 3 - Status: OK ---------- | Drives C:\ -> [Fixed] | [Partition Système et Software] | Total : 387.54 Go | Free : 289.18 Go -> NTFS [ATA] E:\ -> [Fixed] | [Partition Documents] | Total : 78.12 Go | Free : 62.95 Go -> NTFS [ATA] Disk Usage Information [1 total Physical Disks] Physical Drive #0 [C:, E:] : Read:0 bytes/sec, Written:15,716 bytes/sec Max Read:0 bytes/sec, Max Write:15,716 bytes/sec Overall - Read Maximum:0 bytes/sec, Write Maximum:15,716 bytes/sec DeviceID: \\.\PHYSICALDRIVE0 - Status: OK - IDE - Fixed hard disk media - 3 Part. - PnPID : IDE\DISKST3500418AS_____________________________CC46____\5&2CA5C2&0&0.0.0 ---------- | Windows updates Last detection : 2016-09-06 16:35:01 Downloaded last ones : 2016-12-15 11:25:39 Installed last ones : 2016-12-15 22:36:57 Next search : 2017-06-24 12:42:57 Test 1 : Windows Is Activated ---------- | Browsers IE : 11.0.9600.18450 (© Microsoft Corporation. Tous droits réservés.) GC : 58.0.3029.110 (Copyright 2016 Google Inc.) Default : "C:\Program Files\Internet Explorer\iexplore.exe" "" ---------- | FlashPlayer ---------- | Security AV : avast! Antivirus Enabled AS : avast! Antivirus Enabled AM : Malwarebytes' Anti-Malware ( 1.0.2.929) [Update : 04/09/2014 14:22:12] FW : WINDOWS Firewall WMI : OK WU: Windows Update Service [Auto(2)] = Running AS: Windows Defender [Auto(2)] = Running WMI: Windows Management Instrumentation [Auto(2)] = Running ---------- | Running processes 376 | [Owner : Système | Parent : 4(System) | 1.22 Mo] - (.Microsoft Corporation - Gestionnaire de sessions Windows.) - (6.1.7601.23539) = C:\Windows\System32\smss.exe [15/12/2016 13:24:06] CPU Usage:0 % 556 | [Owner : Système | Parent : 548() | 4.75 Mo] - (.Microsoft Corporation - Processus d’exécution client-serveur.) - (6.1.7600.16385) = C:\Windows\System32\csrss.exe [14/07/2009 01:19:49] CPU Usage:0 % 596 | [Owner : Système | Parent : 548() | 4.66 Mo] - (.Microsoft Corporation - Application de démarrage de Windows.) - (6.1.7600.16385) = C:\Windows\System32\wininit.exe [14/07/2009 01:52:37] CPU Usage:0 % 620 | [Owner : Système | Parent : 608(svchost.exe) | 14.84 Mo] - (.Microsoft Corporation - Processus d’exécution client-serveur.) - (6.1.7600.16385) = C:\Windows\System32\csrss.exe [14/07/2009 01:19:49] CPU Usage:0 % 664 | [Owner : Système | Parent : 608(svchost.exe) | 7.74 Mo] - (.Microsoft Corporation - Application d’ouverture de session Windows.) - (6.1.7601.18540) = C:\Windows\System32\winlogon.exe [15/10/2014 09:56:08] CPU Usage:0 % 712 | [Owner : Système | Parent : 596(wininit.exe) | 10.98 Mo] - (.Microsoft Corporation - Applications Services et Contrôleur.) - (6.1.7601.18829) = C:\Windows\System32\services.exe [13/05/2015 09:27:17] CPU Usage:0 % 720 | [Owner : Système | Parent : 596(wininit.exe) | 14.37 Mo] - (.Microsoft Corporation - Local Security Authority Process.) - (6.1.7601.23539) = C:\Windows\System32\lsass.exe [15/12/2016 13:24:06] CPU Usage:0 % 728 | [Owner : Système | Parent : 596(wininit.exe) | 4.49 Mo] - (.Microsoft Corporation - Service du gestionnaire de session locale.) - (6.1.7601.17514) = C:\Windows\System32\lsm.exe [17/01/2011 22:14:56] CPU Usage:0 % 824 | [Owner : Système | Parent : 712(services.exe) | 10.13 Mo] - (.Microsoft Corporation - Processus hôte pour les services Windows.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [14/07/2009 01:31:13] CPU Usage:0 % 912 | [Owner : Système | Parent : 712(services.exe) | 7.9 Mo] - (.NVIDIA Corporation - NVIDIA Driver Helper Service, Version 350.12.) - (8.17.13.5012) = C:\Windows\System32\nvvsvc.exe [21/12/2010 19:08:02] CPU Usage:0 % 936 | [Owner : Système | Parent : 712(services.exe) | 5.91 Mo] - (.NVIDIA Corporation - Stereo Vision Control Panel API Server.) - (7.17.13.5012) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [23/04/2015 17:41:50] CPU Usage:0 % 980 | [Owner : SERVICE RÉSEAU | Parent : 712(services.exe) | 8.56 Mo] - (.Microsoft Corporation - Processus hôte pour les services Windows.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [14/07/2009 01:31:13] CPU Usage:0 % 292 | [Owner : SERVICE LOCAL | Parent : 712(services.exe) | 19.21 Mo] - (.Microsoft Corporation - Processus hôte pour les services Windows.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [14/07/2009 01:31:13] CPU Usage:0 % 508 | [Owner : Système | Parent : 712(services.exe) | 164.64 Mo] - (.Microsoft Corporation - Processus hôte pour les services Windows.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [14/07/2009 01:31:13] CPU Usage:0 % 484 | [Owner : SERVICE LOCAL | Parent : 712(services.exe) | 12.97 Mo] - (.Microsoft Corporation - Processus hôte pour les services Windows.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [14/07/2009 01:31:13] CPU Usage:0 % 608 | [Owner : Système | Parent : 712(services.exe) | 169.9 Mo] - (.Microsoft Corporation - Processus hôte pour les services Windows.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [14/07/2009 01:31:13] CPU Usage:23 % 1196 | [Owner : SERVICE RÉSEAU | Parent : 712(services.exe) | 17.26 Mo] - (.Microsoft Corporation - Processus hôte pour les services Windows.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [14/07/2009 01:31:13] CPU Usage:0 % 1288 | [Owner : Système | Parent : 712(services.exe) | 41.85 Mo] - (.AVAST Software - avast! Service.) - (12.1.3076.0) = C:\Program Files\AVAST Software\Avast\AvastSvc.exe [12/07/2016 10:56:58] CPU Usage:0 % 1320 | [Owner : Système | Parent : 912(nvvsvc.exe) | 21.92 Mo] - (.NVIDIA Corporation - NVIDIA User Experience Driver Component.) - (8.17.13.5012) = C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe [21/12/2010 19:07:44] CPU Usage:0 % 1328 | [Owner : Système | Parent : 912(nvvsvc.exe) | 13.3 Mo] - (.NVIDIA Corporation - NVIDIA Driver Helper Service, Version 350.12.) - (8.17.13.5012) = C:\Windows\System32\nvvsvc.exe [21/12/2010 19:08:02] CPU Usage:0 % 1628 | [Owner : Sylvain | Parent : 508(svchost.exe) | 8.83 Mo] - (.Microsoft Corporation - Gestionnaire de fenêtres du Bureau.) - (6.1.7600.16385) = C:\Windows\System32\dwm.exe [14/07/2009 01:37:38] CPU Usage:0 % 1644 | [Owner : Sylvain | Parent : 1616() | 69.14 Mo] - (.Microsoft Corporation - Explorateur Windows.) - (6.1.7601.23418) = C:\Windows\explorer.exe [15/06/2016 16:59:54] CPU Usage:0 % 1692 | [Owner : Système | Parent : 608(svchost.exe) | 5.76 Mo] - (.Microsoft Corporation - Moteur du Planificateur de tâches.) - (6.1.7601.17514) = C:\Windows\System32\taskeng.exe [17/01/2011 22:16:05] CPU Usage:0 % 1716 | [Owner : Système | Parent : 712(services.exe) | 13.5 Mo] - (.Microsoft Corporation - Application sous-système spouleur.) - (6.1.7601.17777) = C:\Windows\System32\spoolsv.exe [20/08/2012 17:09:31] CPU Usage:0 % 1736 | [Owner : Sylvain | Parent : 712(services.exe) | 11.48 Mo] - (.Microsoft Corporation - Processus hôte pour Tâches Windows.) - (6.1.7601.18010) = C:\Windows\System32\taskhost.exe [09/01/2013 10:28:27] CPU Usage:0 % 1840 | [Owner : SERVICE LOCAL | Parent : 712(services.exe) | 16.85 Mo] - (.Microsoft Corporation - Processus hôte pour les services Windows.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [14/07/2009 01:31:13] CPU Usage:0 % 1984 | [Owner : Système | Parent : 712(services.exe) | 4.12 Mo] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) - (1.824.22.5037) = C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [25/04/2017 09:12:12] CPU Usage:0 % 2012 | [Owner : Système | Parent : 712(services.exe) | 9.55 Mo] - (.Microsoft Corporation - Processus hôte pour les services Windows.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [14/07/2009 01:31:13] CPU Usage:0 % 2044 | [Owner : Système | Parent : 712(services.exe) | 4.06 Mo] - (.Flexera Software LLC - Activation Licensing Service.) - (11.11.0.0) = C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [18/03/2011 21:15:58] CPU Usage:0 % 1488 | [Owner : Système | Parent : 712(services.exe) | 5.68 Mo] - (.Intel Corporation - Local Manageability Service.) - (6.0.0.1184) = C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [26/02/2011 20:23:45] CPU Usage:0 % 2096 | [Owner : Système | Parent : 712(services.exe) | 4.99 Mo] - (.Nalpeiron Ltd. - This service enables products that use the Nalpeiron Licensing System.) - (6.1.6.0) = C:\Windows\SysWOW64\nlssrv32.exe [08/12/2009 21:10:24] CPU Usage:0 % 2156 | [Owner : Système | Parent : 712(services.exe) | 5.9 Mo] - (.NVIDIA Corporation - NVIDIA Network Service.) - (2.0.2.28) = C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [29/10/2014 13:42:30] CPU Usage:0 % 2204 | [Owner : Système | Parent : 712(services.exe) | 10.34 Mo] - (.NVIDIA Corporation - NVIDIA Streamer Service.) - (3.1.1000.0) = C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [29/10/2014 13:43:26] CPU Usage:0 % 2304 | [Owner : Sylvain | Parent : 1644(explorer.exe) | 14.86 Mo] - (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) - (1.0.0.501) = C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [26/02/2011 20:24:17] CPU Usage:0 % 2348 | [Owner : Sylvain | Parent : 1644(explorer.exe) | 10.53 Mo] - (.DT Soft Ltd - DAEMON Tools Lite.) - (4.40.2.131) = C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [20/01/2011 11:20:12] CPU Usage:0 % 2408 | [Owner : Sylvain | Parent : 1644(explorer.exe) | 16.02 Mo] - (.- WlanCU MFC Application.) - (1.24.124.50) = C:\Program Files\TRENDnet\TEW-641PC_TEW-643PI\WlanCU.exe [09/05/2012 21:52:59] CPU Usage:0 % 2576 | [Owner : Sylvain | Parent : 1320(NvXDSync.exe) | 12.88 Mo] - (.NVIDIA Corporation - NVIDIA Settings.) - (7.17.13.5012) = C:\Program Files\NVIDIA Corporation\Display\nvtray.exe [21/12/2010 19:07:58] CPU Usage:0 % 2624 | [Owner : SERVICE RÉSEAU | Parent : 2204(nvstreamsvc.exe) | 13.05 Mo] - (.NVIDIA Corporation - NVIDIA Streamer Service.) - (3.1.1000.0) = C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [29/10/2014 13:43:26] CPU Usage:0 % 2632 | [Owner : Système | Parent : 2204(nvstreamsvc.exe) | 14.29 Mo] - (.NVIDIA Corporation - NVIDIA Streamer Service.) - (3.1.1000.0) = C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [29/10/2014 13:43:26] CPU Usage:0 % 2644 | [Owner : Système | Parent : 620(csrss.exe) | 4.72 Mo] - (.Microsoft Corporation - Hôte de la fenêtre de la console.) - (6.1.7601.23539) = C:\Windows\System32\conhost.exe [15/12/2016 13:24:06] CPU Usage:0 % 2652 | [Owner : SERVICE RÉSEAU | Parent : 556(csrss.exe) | 3.09 Mo] - (.Microsoft Corporation - Hôte de la fenêtre de la console.) - (6.1.7601.23539) = C:\Windows\System32\conhost.exe [15/12/2016 13:24:06] CPU Usage:0 % 2800 | [Owner : Sylvain | Parent : 2384() | 25.59 Mo] - (.AVAST Software - avast! Antivirus.) - (12.1.3076.11) = C:\Program Files\AVAST Software\Avast\avastui.exe [09/08/2016 10:42:23] CPU Usage:0 % 2820 | [Owner : Sylvain | Parent : 2384() | 5.5 Mo] - (.M-Audio, a brand of inMusic Brands, Inc. - M-Audio ProFire Tray Application.) - (5.10.0.5084) = C:\Windows\SysWOW64\MAFWDITray.exe [03/06/2013 18:17:36] CPU Usage:0 % 2840 | [Owner : Sylvain | Parent : 2576(nvtray.exe) | 25.19 Mo] - (.NVIDIA Corporation - NVIDIA GeForce Experience Backend.) - (16.13.56.0) = C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [29/10/2014 13:43:19] CPU Usage:0 % 2864 | [Owner : Sylvain | Parent : 2384() | 25.67 Mo] - (.Safer-Networking Ltd. - Spybot - Search & Destroy tray access.) - (2.6.46.129) = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [23/06/2017 22:31:02] CPU Usage:0 % 3204 | [Owner : Système | Parent : 712(services.exe) | 14.57 Mo] - (.Safer-Networking Ltd. - Spybot-S&D 2 Background update service.) - (2.6.46.77) = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [23/06/2017 22:31:08] CPU Usage:0 % 3264 | [Owner : SERVICE LOCAL | Parent : 712(services.exe) | 6.44 Mo] - (.Microsoft Corporation - Processus hôte pour les services Windows.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [14/07/2009 01:31:13] CPU Usage:0 % 3296 | [Owner : Système | Parent : 712(services.exe) | 7.5 Mo] - (.- WlanSvc Application.) - (1.0.0.4) = C:\Program Files\TRENDnet\TEW-641PC_TEW-643PI\WlanWpsSvc.exe [09/05/2012 21:52:59] CPU Usage:0 % 3448 | [Owner : Système | Parent : 712(services.exe) | 10.39 Mo] - (.Safer-Networking Ltd. - Windows Security Center integration..) - (2.6.46.3) = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [23/06/2017 22:31:11] CPU Usage:0 % 3792 | [Owner : SERVICE RÉSEAU | Parent : 824(svchost.exe) | 13.3 Mo] - (.Microsoft Corporation - WMI Provider Host.) - (6.1.7601.17514) = C:\Windows\System32\wbem\WmiPrvSE.exe [17/01/2011 22:15:43] CPU Usage:0 % 4692 | [Owner : Sylvain | Parent : 824(svchost.exe) | 6.25 Mo] - (.Microsoft Corporation - Sink to receive asynchronous callbacks for WMI client application.) - (6.1.7600.16385) = C:\Windows\System32\wbem\unsecapp.exe [14/07/2009 01:47:12] CPU Usage:0 % 4792 | [Owner : Système | Parent : 712(services.exe) | 15.36 Mo] - (.Microsoft Corporation - Indexeur Microsoft Windows Search.) - (7.0.7601.17610) = C:\Windows\System32\SearchIndexer.exe [27/08/2011 20:28:47] CPU Usage:0 % 4988 | [Owner : SERVICE RÉSEAU | Parent : 712(services.exe) | 6.08 Mo] - (.Microsoft Corporation - Processus hôte pour les services Windows.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [14/07/2009 01:31:13] CPU Usage:0 % 2620 | [Owner : SERVICE LOCAL | Parent : 712(services.exe) | 9.97 Mo] - (.Microsoft Corporation - Processus hôte pour les services Windows.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [14/07/2009 01:31:13] CPU Usage:0 % 3892 | [Owner : Système | Parent : 712(services.exe) | 11.72 Mo] - (.Intel Corporation - User Notification Service.) - (6.0.0.1184) = C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [26/02/2011 20:23:46] CPU Usage:0 % 1548 | [Owner : Système | Parent : 712(services.exe) | 35.93 Mo] - (.Microsoft Corporation - Processus hôte pour les services Windows.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [14/07/2009 01:31:13] CPU Usage:0 % 1356 | [Owner : SERVICE RÉSEAU | Parent : 712(services.exe) | 6.99 Mo] - (.Microsoft Corporation - Service Partage réseau du Lecteur Windows Media.) - (12.0.7601.17514) = C:\Program Files\Windows Media Player\wmpnetwk.exe [17/01/2011 22:17:37] CPU Usage:0 % 4876 | [Owner : Sylvain | Parent : 1644(explorer.exe) | 120.19 Mo] - (.Google Inc. - Google Chrome.) - (58.0.3029.110) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [05/09/2014 16:51:37] CPU Usage:0 % 4508 | [Owner : Sylvain | Parent : 4876(chrome.exe) | 6.1 Mo] - (.Google Inc. - Google Chrome.) - (58.0.3029.110) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [05/09/2014 16:51:37] CPU Usage:0 % 2640 | [Owner : Sylvain | Parent : 4876(chrome.exe) | 7.22 Mo] - (.Google Inc. - Google Chrome.) - (58.0.3029.110) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [05/09/2014 16:51:37] CPU Usage:0 % 5012 | [Owner : Sylvain | Parent : 4876(chrome.exe) | 92.5 Mo] - (.Google Inc. - Google Chrome.) - (58.0.3029.110) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [05/09/2014 16:51:37] CPU Usage:9 % 4872 | [Owner : Sylvain | Parent : 4876(chrome.exe) | 188.67 Mo] - (.Google Inc. - Google Chrome.) - (58.0.3029.110) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [05/09/2014 16:51:37] CPU Usage:0 % 3968 | [Owner : Sylvain | Parent : 4876(chrome.exe) | 65.09 Mo] - (.Google Inc. - Google Chrome.) - (58.0.3029.110) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [05/09/2014 16:51:37] CPU Usage:0 % 3352 | [Owner : Sylvain | Parent : 4876(chrome.exe) | 74.36 Mo] - (.Google Inc. - Google Chrome.) - (58.0.3029.110) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [05/09/2014 16:51:37] CPU Usage:0 % 4592 | [Owner : Sylvain | Parent : 4876(chrome.exe) | 102.72 Mo] - (.Google Inc. - Google Chrome.) - (58.0.3029.110) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [05/09/2014 16:51:37] CPU Usage:0 % 4420 | [Owner : SERVICE LOCAL | Parent : 292(svchost.exe) | ?????] - (.Microsoft Corporation - Isolation graphique de périphérique audio Windows.) - (6.1.7601.18741) = C:\Windows\System32\audiodg.exe [11/03/2015 09:59:20] CPU Usage:0 % 1856 | [Owner : Sylvain | Parent : 1644(explorer.exe) | 36.13 Mo] - (.SosVirus - QuickDiag.) - (24.6.17.1) = C:\Users\Sylvain\Downloads\QuickDiag.exe [24/06/2017 16:26:29] CPU Usage:0 % 1136 | [Owner : Système | Parent : 824(svchost.exe) | 6.58 Mo] - (.Microsoft Corporation - WMI Provider Host.) - (6.1.7601.17514) = C:\Windows\System32\wbem\WmiPrvSE.exe [17/01/2011 22:15:43] CPU Usage:0 % 536 | [Owner : SERVICE RÉSEAU | Parent : 824(svchost.exe) | 7.35 Mo] - (.Microsoft Corporation - WMI Provider Host.) - (6.1.7601.17514) = C:\Windows\SysWOW64\wbem\WmiPrvSE.exe [17/01/2011 22:16:05] CPU Usage:0 % 2736 | [Owner : SERVICE RÉSEAU | Parent : 712(services.exe) | 11.8 Mo] - (.Microsoft Corporation - Service de la plateforme de protection logicielle Microsoft.) - (6.1.7601.17514) = C:\Windows\System32\sppsvc.exe [17/01/2011 22:15:05] CPU Usage:0 % ---------- | MD5 [MD5.9DA3B83F80E205B6C601EEE1312FD0A0] - [15/06/2016 16:59:54] - (.© Microsoft Corporation. Tous droits réservés. - Explorateur Windows.) - [3155.5 Ko] - (6.1.7601.23418) : C:\Windows\Explorer.exe [MD5.5746BD7E255DD6A8AFA06F7C42C1BA41] - [17/01/2011 22:15:00] - (.© Microsoft Corporation. Tous droits réservés. - Interpréteur de commandes Windows.) - [337 Ko] - (6.1.7601.17514) : C:\Windows\System32\cmd.exe [MD5.60C2862B4BF0FD9F582EF344C2B1EC72] - [14/07/2009 01:19:49] - (.© Microsoft Corporation. Tous droits réservés. - Processus d’exécution client-serveur.) - [7.5 Ko] - (6.1.7600.16385) : C:\Windows\System32\csrss.exe [MD5.A8EDB86FC2A4D6D1285E4C70384AC35A] - [14/07/2009 01:59:17] - (.© Microsoft Corporation. - COM Surrogate.) - [9.5 Ko] - (6.1.7600.16385) : C:\Windows\System32\dllhost.exe [MD5.C9805CDE0B275E7554F9023497169B9B] - [15/12/2016 13:24:07] - (.© Microsoft Corporation. Tous droits réservés. - DLL du client API BASE Windows NT.) - [1136 Ko] - (6.1.7601.23539) : C:\Windows\System32\Kernel32.dll [MD5.07932D7BA536B0BB58306A156A9AFC31] - [15/12/2016 13:24:06] - (.© Microsoft Corporation. - Local Security Authority Process.) - [30 Ko] - (6.1.7601.23539) : C:\Windows\System32\lsass.exe [MD5.622C96AFB07BB82C8650B47172137AC4] - [13/04/2016 10:46:10] - (.© Microsoft Corporation. - Distributed COM Services.) - [499.5 Ko] - (6.1.7601.19143) : C:\Windows\System32\rpcss.dll [MD5.DD81D91FF3B0763C392422865C9AC12E] - [14/07/2009 01:57:20] - (.© Microsoft Corporation. Tous droits réservés. - Processus hôte Windows (Rundll32).) - [44.5 Ko] - (6.1.7600.16385) : C:\Windows\System32\rundll32.exe [MD5.71C85477DF9347FE8E7BC55768473FCA] - [13/05/2015 09:27:17] - (.© Microsoft Corporation. Tous droits réservés. - Applications Services et Contrôleur.) - [321 Ko] - (6.1.7601.18829) : C:\Windows\System32\services.exe [MD5.C78655BC80301D76ED4FEF1C1EA40A7D] - [14/07/2009 01:31:13] - (.© Microsoft Corporation. Tous droits réservés. - Processus hôte pour les services Windows.) - [26.5 Ko] - (6.1.7600.16385) : C:\Windows\System32\svchost.exe [MD5.8F4B991E7837E8E0F90C856659456652] - [15/12/2016 13:20:38] - (.© Microsoft Corporation. Tous droits réservés. - DLL client de l’API uilisateur de Windows multi-utilisateurs.) - [985.5 Ko] - (6.1.7601.23528) : C:\Windows\System32\user32.dll [MD5.BAFE84E637BF7388C96EF48D4D3FDD53] - [17/01/2011 22:16:12] - (.© Microsoft Corporation. Tous droits réservés. - Application d’ouverture de session Userinit.) - [30 Ko] - (6.1.7601.17514) : C:\Windows\System32\userinit.exe [MD5.94355C28C1970635A31B3FE52EB7CEBA] - [14/07/2009 01:52:37] - (.© Microsoft Corporation. Tous droits réservés. - Application de démarrage de Windows.) - [126 Ko] - (6.1.7600.16385) : C:\Windows\System32\Wininit.exe [MD5.8CEBD9D0A0A879CDE9F36F4383B7CAEA] - [15/10/2014 09:56:08] - (.© Microsoft Corporation. Tous droits réservés. - Application d’ouverture de session Windows.) - [444.5 Ko] - (6.1.7601.18540) : C:\Windows\System32\Winlogon.exe [MD5.9A4A1EEE802BF2F878EE8EAB407B21B7] - [11/11/2015 12:25:32] - (.© Microsoft Corporation. Tous droits réservés. - Ancillary Function Driver for WinSock.) - [486 Ko] - (6.1.7601.19031) : C:\Windows\System32\Drivers\afd.sys [MD5.02062C0B390B7729EDC9E69C680A6F3C] - [14/07/2009 01:19:47] - (.© Microsoft Corporation. - ATAPI IDE Miniport Driver.) - [23.56 Ko] - (6.1.7600.16385) : C:\Windows\System32\Drivers\atapi.sys [MD5.059F00DEF82BF41E433B7ED465847726] - [06/10/2013 19:39:12] - (.© Microsoft Corporation. - ATAPI Driver Extension.) - [151.94 Ko] - (6.1.7601.18231) : C:\Windows\System32\Drivers\ataport.sys [MD5.B8BD2BB284668C84865658C77574381A] - [14/07/2009 01:19:47] - (.© Microsoft Corporation. - CD-ROM File System Driver.) - [90 Ko] - (6.1.7600.16385) : C:\Windows\System32\Drivers\cdfs.sys [MD5.F036CE71586E93D94DAB220D7BDF4416] - [17/01/2011 22:14:40] - (.© Microsoft Corporation. - SCSI CD-ROM Driver.) - [144 Ko] - (6.1.7601.17514) : C:\Windows\System32\Drivers\cdrom.sys [MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - [17/01/2011 22:16:16] - (.© Microsoft Corporation. - DFS Namespace Client Driver.) - [100 Ko] - (6.1.7601.17514) : C:\Windows\System32\Drivers\dfsc.sys [MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - [17/01/2011 22:14:39] - (.© Microsoft Corporation. - High Definition Audio Bus Driver.) - [119.5 Ko] - (6.1.7601.17514) : C:\Windows\System32\Drivers\hdaudbus.sys [MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - [14/07/2009 01:19:58] - (.© Microsoft Corporation. Tous droits réservés. - Pilote de port i8042.) - [103 Ko] - (6.1.7600.16385) : C:\Windows\System32\Drivers\i8042prt.sys [MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - [14/07/2009 02:10:03] - (.© Microsoft Corporation. - IP Network Address Translator.) - [113.5 Ko] - (6.1.7600.16385) : C:\Windows\System32\Drivers\ipnat.sys [MD5.341C65D6D4E9AB705258AC83511F7ADD] - [15/12/2016 13:24:06] - (.© Microsoft Corporation. - Windows NT SMB Minirdr.) - [156 Ko] - (6.1.7601.23539) : C:\Windows\System32\Drivers\mrxsmb.sys [MD5.F7309F42555F8AAB7144A51A1F2585B0] - [11/11/2015 12:25:24] - (.© Microsoft Corporation. Tous droits réservés. - Pilote NDIS 6.20.) - [928.44 Ko] - (6.1.7601.19030) : C:\Windows\System32\Drivers\ndis.sys [MD5.E47D571FEC2C76E867935109AB2A770C] - [15/06/2016 17:00:09] - (.© Microsoft Corporation. - MBT Transport driver.) - [256 Ko] - (6.1.7601.23451) : C:\Windows\System32\Drivers\netbt.sys [MD5.47B2D0B31BDC3EBE6090228E2BA3764D] - [09/03/2016 11:54:44] - (.© Microsoft Corporation. Tous droits réservés. - Pilote du système de fichiers NT.) - [1644.94 Ko] - (6.1.7601.19116) : C:\Windows\System32\Drivers\ntfs.sys [MD5.0086431C29C35BE1DBC43F52CC273887] - [14/07/2009 02:00:41] - (.© Microsoft Corporation. Tous droits réservés. - Pilote de port parallèle.) - [95 Ko] - (6.1.7600.16385) : C:\Windows\System32\Drivers\parport.sys [MD5.471815800AE33E6F1C32FB1B97C490CA] - [17/01/2011 22:16:17] - (.© Microsoft Corporation. - RAS L2TP mini-port/call-manager driver.) - [126.5 Ko] - (6.1.7601.17514) : C:\Windows\System32\Drivers\rasl2tp.sys [MD5.1B6163C503398B23FF8B939C67747683] - [17/01/2011 22:17:40] - (.© Microsoft Corporation. - Microsoft RDP Device redirector.) - [162 Ko] - (6.1.7601.17514) : C:\Windows\System32\Drivers\rdpdr.sys [MD5.548260A7B8654E024DC30BF8A7C5BAA4] - [14/07/2009 02:09:09] - (.© Microsoft Corporation. - SMB Transport driver.) - [91 Ko] - (6.1.7600.16385) : C:\Windows\System32\Drivers\smb.sys [MD5.B2875D7ABB82867DC3AA03D991940201] - [15/12/2016 13:20:37] - (.© Microsoft Corporation. Tous droits réservés. - Pilote TCP/IP.) - [1851.73 Ko] - (6.1.7601.23496) : C:\Windows\System32\Drivers\tcpip.sys [MD5.AA77EB517D2F07A947294F260E3ACA83] - [11/11/2015 12:25:32] - (.© Microsoft Corporation. - TDI Translation Driver.) - [115.5 Ko] - (6.1.7601.19031) : C:\Windows\System32\Drivers\tdx.sys [MD5.0D08D2F3B3FF84E433346669B5E0F639] - [17/01/2011 22:14:40] - (.© Microsoft Corporation. Tous droits réservés. - Pilote de cliché instantané du volume.) - [288.88 Ko] - (6.1.7601.17514) : C:\Windows\System32\Drivers\volsnap.sys ---------- | Locked Applications ---------- | Explorer.exe component call (Microsoft Files Whitelisted) (.AVAST Software.-.avast! Shell Extension.) - (12.1.3076.0) -- C:\Program Files\AVAST Software\Avast\ashShA64.dll (.Autodesk, Inc..-.AutoCAD component.) - (19.1.18.0) -- C:\Windows\system32\AcSignIcon.dll (..-..) - (14.0.7109.5000) -- C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf (.Malwarebytes Corporation.-.Malwarebytes Anti-Malware.) - (3.0.6.0) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamext.dll (.Safer-Networking Ltd..-.Windows Explorer context menu integration.) - (2.6.46.0) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDECon64.dll (.Autodesk.-.AutoCAD Dwg common shell extension handler.) - (19.1.18.0) -- C:\Program Files\Common Files\Autodesk Shared\AcShellEx\AcShellExtension.dll ---------- | Svchost.exe component call (Microsoft Files Whitelisted) ---------- | ZeroAccess Check Zaccess : C:\Users\Sylvain\AppData\Local\Dropbox [HKLM\Software\Classes\CLSID\{1108BE51-F58A-4CDA-BB99-7A0227D11D5E}\InProcServer32] : %systemroot%\system32\wbem\fastprox.dll [HKLM\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] : %SystemRoot%\system32\shell32.dll [HKLM\Software\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] : %systemroot%\system32\wbem\fastprox.dll [HKLM\Software\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] : %systemroot%\system32\wbem\wbemess.dll [HKLM\Software\Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] : %SystemRoot%\system32\shell32.dll [HKLM\Software\WOW6432Node\Classes\CLSID\{1108BE51-F58A-4CDA-BB99-7A0227D11D5E}\InProcServer32] : %systemroot%\system32\wbem\fastprox.dll [HKLM\Software\WOW6432Node\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] : %SystemRoot%\system32\shell32.dll [HKLM\Software\WOW6432Node\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] : %systemroot%\system32\wbem\fastprox.dll [HKLM\Software\WOW6432Node\Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] : %SystemRoot%\system32\shell32.dll ---------- | Startings up Sidebar - (%ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun [HKU\S-1-5-19\SOFTWARE\...\Run]) - User: AUTORITE NT\SERVICE LOCAL Sidebar - (%ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun [HKU\S-1-5-20\SOFTWARE\...\Run]) - User: AUTORITE NT\SERVICE RÉSEAU DAEMON Tools Lite - ("C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun [HKU\S-1-5-21-1977720525-337058645-3963175332-1000\SOFTWARE\...\Run]) - User: Sylvain-PC\Sylvain Wireless Configuration Utility - (C:\PROGRA~1\TRENDnet\TEW-64~1\WlanCU.exe [Common Startup]) - User: Public RtHDVCpl - (C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [HKLM\SOFTWARE\...\Run]) - User: Public BCSSync - ("C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices [HKLM\SOFTWARE\...\Run]) - User: Public [HKU\S-1-5-21-1977720525-337058645-3963175332-1000\Software\Microsoft\Command Processor] "CompletionChar"=9 "DefaultColor"=0 "EnableExtensions"=1 "PathCompletionChar"=9 [HKU\S-1-5-21-1977720525-337058645-3963175332-1000\Software\Microsoft\Windows\CurrentVersion\Run] "DAEMON Tools Lite"="C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun [HKU\S-1-5-21-1977720525-337058645-3963175332-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "UserSelectedDefault"=1 "Run"= "Load"= "Device"=PDFCreator,winspool,Ne00: [HKLM\Software\Microsoft\Command Processor] "CompletionChar"=64 "DefaultColor"=0 "EnableExtensions"=1 "PathCompletionChar"=64 [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s "BCSSync"="C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "IconServiceLib"=IconCodecService.dll "DdeSendTimeout"=0 "DesktopHeapLogging"=1 "GDIProcessHandleQuota"=10000 "ShutdownWarningDialogTimeout"=4294967295 "USERNestedWindowLimit"=50 "USERPostMessageLimit"=10000 "USERProcessHandleQuota"=10000 ""=mnmsrvc "DeviceNotSelectedTimeout"=15 "Spooler"=yes "TransmissionRetryTimeout"=90 "AppInit_DLLs"= "LoadAppInit_DLLs"=0 [HKLM\Software\WOW6432Node\Microsoft\Command Processor] "CompletionChar"=64 "DefaultColor"=0 "EnableExtensions"=1 "PathCompletionChar"=64 [HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run] "AvastUI.exe"="C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui "kxesc"="c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe" -autorun "M-Audio Taskbar Icon"=C:\Windows\system32\MAFWDITray.exe "SDTray"="C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" [HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows] "IconServiceLib"=IconCodecService.dll "DdeSendTimeout"=0 "DesktopHeapLogging"=1 "GDIProcessHandleQuota"=10000 "ShutdownWarningDialogTimeout"=4294967295 "USERNestedWindowLimit"=50 "USERPostMessageLimit"=10000 "USERProcessHandleQuota"=10000 ""=mnmsrvc "DeviceNotSelectedTimeout"=15 "Spooler"=yes "TransmissionRetryTimeout"=90 "LoadAppInit_DLLs"=0 "AppInit_DLLs"= [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "WebCheck"={E6FB5E20-DE35-11CF-9C87-00AA005127ED} ---------- | Win.ini : ---------- | System.ini : ---------- | Tasks List Adobe Acrobat Update Task avast! Emergency Update CCleanerSkipUAC GoogleUpdateTaskMachineCore GoogleUpdateTaskMachineUA SafeZone scheduled Autoupdate 1468396191 {4D21073F-F9D2-48C0-BAA2-FD2B61D75935} {8F7BB595-E856-41C1-8D2E-F897D6C5D3CB} {ABB20271-B0C9-4437-874F-706654CF579B} ---------- | Startings up registry ¦ Folder [HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Adobe ARM] : "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\AdobeAAMUpdater-1.0] : "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\AdobeCS4ServiceManager] : "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin [HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\AdobeCS6ServiceManager] : "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin [HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Adobe_ID0EYTHM] : C:\PROGRA~2\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE [HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Autodesk Sync] : C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\BCSSync] : "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices [HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\DAEMON Tools Lite] : "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun [HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\DivXUpdate] : "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW [HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ISUSPM Startup] : C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup [HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Lexmark 6500 Series] : "C:\Program Files (x86) (x86)\Lexmark 6500 Series\fm3032.exe" /s [HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\lxdfamon] : "C:\Program Files (x86) (x86)\Lexmark 6500 Series\lxdfamon.exe" [HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\lxdfmon.exe] : "C:\Program Files (x86) (x86)\Lexmark 6500 Series\lxdfmon.exe" [HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\NvBackend] : "C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PCFIXTRAYRGKYT] : c:\pcfiXtraynllhp.lnk [13/05/2016 10:08:37] [HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\QuickTime Task] : "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ShadowPlay] : C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart [HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SwitchBoard] : C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe ---------- | Other keys [HKLM\System\CurrentControlSet\Control\SecurityProviders] "SecurityProviders"=credssp.dll [HKLM\System\CurrentControlSet\Control\Terminal Server] "RCDependentServices"=CertPropSvc SessionEnv "NotificationTimeOut"=0 "SnapshotMonitors"=1 "ProductVersion"=5.1 "AllowRemoteRPC"=0 "DelayConMgrTimeout"=0 "fDenyTSConnections"=1 "StartRCM"=0 "TSAdvertise"=0 "DeleteTempDirsOnExit"=1 "fSingleSessionPerUser"=1 "PerSessionTempDir"=0 "TSUserEnabled"=0 "InstanceID"=d3031456-c580-4a20-832e-8c472fd "RailShowallNotifyIcons"=1 "RDPVGCInstalled"=1 "fCredentialLessLogonSupported"=1 "fCredentialLessLogonSupportedTSS"=1 "fCredentialLessLogonSupportedKMRDP"=1 [HKLM\System\CurrentControlSet\Control\Session Manager] "CriticalSectionTimeout"=2592000 "GlobalFlag"=0 "HeapDeCommitFreeBlockThreshold"=0 "HeapDeCommitTotalFreeThreshold"=0 "HeapSegmentCommit"=0 "HeapSegmentReserve"=0 "ProcessorControl"=2 "ResourceTimeoutCount"=648000 "BootExecute"=autocheck autochk * sdnclean64.exe "ExcludeFromKnownDlls"= "ObjectDirectories"=\Windows \RPC Control "ProtectionMode"=1 "NumberOfInitialSessions"=2 "SetupExecute"= "AutoChkTimeOut"=5 [HKLM\System\CurrentControlSet\Control] "PreshutdownOrder"=wuauserv gpsvc trustedinstaller "WaitToKillServiceTimeout"=200 "CurrentUser"=USERNAME "BootDriverFlags"=0 "ServiceControlManagerExtension"=%systemroot%\system32\scext.dll "SystemStartOptions"= NOEXECUTE=OPTIN "SystemBootDevice"=multi(0)disk(0)rdisk(0)partition(2) "FirmwareBootDevice"=multi(0)disk(0)rdisk(0)partition(1) [HKLM\System\CurrentControlSet\Control\lsa] "auditbaseobjects"=0 "auditbasedirectories"=0 "crashonauditfail"=0 "fullprivilegeauditing"=0x00 "Bounds"=0x0030000000200000 "LimitBlankPasswordUse"=1 "NoLmHash"=1 "Notification Packages"=scecli "Security Packages"=kerberos msv1_0 schannel wdigest tspkg pku2u "Authentication Packages"=msv1_0 "LsaPid"=720 "SecureBoot"=1 "ProductType"=1 "disabledomaincreds"=0 "everyoneincludesanonymous"=0 "forceguest"=0 "restrictanonymous"=0 "restrictanonymoussam"=1 ---------- | .LNK with Arguments C:\pcfiXtraynllhp.lnk (/qqrepair /regrun) iles%\Tencent\QQPCMGR\Plugins\QQPCTRAY.exe c:\users\sylvain\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\startmenu\games.lnk - Encrypted: False - Target: C:\Windows\System32\cmd.exe - Args: (/c "start hxxp://socialgames.splashtop.com/gbsp/mb/?p=w") - Hidden: False - Status: OK ---------- | AppCertDlls ---------- | Dnsapi.dll C:\Windows\System32\dnsapi.dll -> OK : \drivers\etc\hosts C:\Windows\SysWOW64\dnsapi.dll -> OK : \drivers\etc\hosts ---------- | Policies | Registry [HKU\S-1-5-21-1977720525-337058645-3963175332-1000\Control Panel\Desktop] "ScreenSaveActive"=0 "ActiveWndTrackTimeout"=0 "BlockSendInputResets"=0 "CaretWidth"=1 "ClickLockTime"=1200 "CoolSwitchColumns"=7 "CoolSwitchRows"=3 "CursorBlinkRate"=530 "DockMoving"=1 "DragFromMaximize"=1 "DragFullWindows"=1 "DragHeight"=4 "DragWidth"=4 "FocusBorderHeight"=1 "FocusBorderWidth"=1 "FontSmoothing"=2 "FontSmoothingGamma"=0 "FontSmoothingOrientation"=1 "FontSmoothingType"=2 "ForegroundFlashCount"=7 "ForegroundLockTimeout"=1633108 "LeftOverlapChars"=3 "MenuShowDelay"=0 "PaintDesktopVersion"=0 "RightOverlapChars"=3 "SnapSizing"=1 "TileWallpaper"=0 "WallpaperOriginX"=0 "WallpaperOriginY"=0 "WallpaperStyle"=0 "WheelScrollChars"=3 "WheelScrollLines"=3 "WindowArrangementActive"=1 "UserPreferencesMask"=0x9E3E078012000000 "Wallpaper"=C:\Users\Sylvain\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg [26/02/2011 13:17:18] "Pattern Upgrade"=TRUE "WaitToKillAppTimeout"=200 "HungAppTimeout"=3000 "AutoEndTasks"=1 [HKU\S-1-5-21-1977720525-337058645-3963175332-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] ""= "NoDriveTypeAutoRun"=181 "NoLowDiskSpaceChecks"=1 [HKU\S-1-5-21-1977720525-337058645-3963175332-1000\Software\Microsoft\Windows\CurrentVersion\Explorer] "ExplorerStartupTraceRecorded"=1 "ShellState"=0x240000003028000000000000000000000000000001000000120000000000000022000000 "CleanShutdown"=0 "Browse For Folder Width"=505 "Browse For Folder Height"=346 "Reason Setting"=255 "link"=0x1E000000 "EnableAutoTray"=0 "DesktopProcess"=1 [HKU\S-1-5-21-1977720525-337058645-3963175332-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced] "Start_SearchFiles"=2 "ServerAdminUI"=0 "Hidden"=1 "ShowCompColor"=1 "HideFileExt"=0 "DontPrettyPath"=0 "ShowInfoTip"=1 "HideIcons"=0 "MapNetDrvBtn"=0 "WebView"=1 "Filter"=0 "SuperHidden"=0 "SeparateProcess"=0 "AutoCheckSelect"=0 "IconsOnly"=0 "ShowTypeOverlay"=1 "ListviewAlphaSelect"=0 "ListviewShadow"=1 "TaskbarAnimations"=0 "StartMenuInit"=4 "TaskbarSizeMove"=1 "DisablePreviewDesktop"=0 "TaskbarSmallIcons"=0 "TaskbarGlomLevel"=0 "Start_PowerButtonAction"=2 "ShowSuperHidden"=0 "NavPaneShowAllFolders"=1 ""=0 "ExtendedUIHoverTime"=0 "DesktopLivePreviewHoverTime"=0 "AlwaysShowMenus"=1 [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System] "ConsentPromptBehaviorAdmin"=5 "ConsentPromptBehaviorUser"=3 "EnableInstallerDetection"=1 "EnableSecureUIAPaths"=1 "EnableUIADesktopToggle"=0 "EnableVirtualization"=1 "PromptOnSecureDesktop"=1 "ValidateAdminCodeSignatures"=0 "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "scforceoption"=0 "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 "FilterAdministratorToken"=0 "EnableLUA"=1 "EnableSecureUIAPath"=1 "SoftwareSASGeneration"=1 [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoActiveDesktop"=1 "NoActiveDesktopChanges"=1 "ForceActiveDesktopOn"=0 "NoDriveTypeAutoRun"=221 [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop] "NoAddingComponents"=1 "NoComponents"=1 [HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel] "{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}"=1 "{20D04FE0-3AEA-1069-A2D8-08002B30309D}"=1 "{208D2C60-3AEA-1069-A2D7-08002B30309D}"=1 "{871C5380-42A0-1069-A2EA-08002B30309D}"=1 "{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}"=1 "{59031a47-3f72-44a7-89c5-5595fe6b30ee}"=1 "{031E4825-7B94-4dc3-B131-E946B44C8DD5}"=1 "{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}"=1 "{9343812e-1c37-4a49-a12e-4b2d810d956b}"=1 [HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu] "{871C5380-42A0-1069-A2EA-08002B30309D}.default"=0 "{9343812e-1c37-4a49-a12e-4b2d810d956b}"=1 [HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] "RegPath"=Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced "Text"=@shell32.dll,-30500 "Type"=radio "CheckedValue"=1 "ValueName"=Hidden "DefaultValue"=2 "HKeyRoot"=2147483649 "HelpID"=shell.hlp#51105 [HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer] "ListViewPopupControl"={8be9f5ea-e746-4e47-ad57-3fb191ca1eed} "BrowserCFCreator"={57f8510b-a5e2-41da-a8f0-8a5ae85dfffd} "GlobalFolderSettings"={EF8AD2D1-AE36-11D1-B2D2-006097DF8C11} "LVPopupSearchControl"={fccf70c8-f4d7-4d8b-8c17-cd6715e37fff} "FileOpenDialog"={DC1C5A9C-E88A-4dde-A5A1-60F82A20AEF7} "IconUnderline"=2 "GlobalAssocChangedCounter"=39 [HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced] "TaskbarSizeMove"=0 [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] "Application"=http://go.microsoft.com/fwlink/?LinkId=57426&Ext=%s [HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies\System] "ConsentPromptBehaviorAdmin"=5 "ConsentPromptBehaviorUser"=3 "EnableInstallerDetection"=1 "EnableSecureUIAPaths"=1 "EnableUIADesktopToggle"=0 "EnableVirtualization"=1 "PromptOnSecureDesktop"=1 "ValidateAdminCodeSignatures"=0 "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "scforceoption"=0 "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 "FilterAdministratorToken"=0 "EnableLUA"=1 "EnableSecureUIAPath"=1 "SoftwareSASGeneration"=1 [HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoActiveDesktop"=1 "NoActiveDesktopChanges"=1 "ForceActiveDesktopOn"=0 "NoDriveTypeAutoRun"=221 [HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop] "NoAddingComponents"=1 "NoComponents"=1 [HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel] "{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}"=1 "{20D04FE0-3AEA-1069-A2D8-08002B30309D}"=1 "{208D2C60-3AEA-1069-A2D7-08002B30309D}"=1 "{871C5380-42A0-1069-A2EA-08002B30309D}"=1 "{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}"=1 "{59031a47-3f72-44a7-89c5-5595fe6b30ee}"=1 "{031E4825-7B94-4dc3-B131-E946B44C8DD5}"=1 "{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}"=1 "{9343812e-1c37-4a49-a12e-4b2d810d956b}"=1 [HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu] "{871C5380-42A0-1069-A2EA-08002B30309D}.default"=0 "{9343812e-1c37-4a49-a12e-4b2d810d956b}"=1 [HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] "RegPath"=Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced "Text"=@shell32.dll,-30500 "Type"=radio "CheckedValue"=1 "ValueName"=Hidden "DefaultValue"=2 "HKeyRoot"=2147483649 "HelpID"=shell.hlp#51105 [HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer] "ListViewPopupControl"={8be9f5ea-e746-4e47-ad57-3fb191ca1eed} "BrowserCFCreator"={57f8510b-a5e2-41da-a8f0-8a5ae85dfffd} "GlobalFolderSettings"={EF8AD2D1-AE36-11D1-B2D2-006097DF8C11} "LVPopupSearchControl"={fccf70c8-f4d7-4d8b-8c17-cd6715e37fff} "FileOpenDialog"={DC1C5A9C-E88A-4dde-A5A1-60F82A20AEF7} "IconUnderline"=2 "GlobalAssocChangedCounter"=283 "Max Cached Icons"=2000 [HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Advanced] "TaskbarSizeMove"=0 [HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Associations] "Application"=http://go.microsoft.com/fwlink/?LinkId=57426&Ext=%s ---------- | Winlogon [HKU\S-1-5-21-1977720525-337058645-3963175332-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] "ExcludeProfileDirs"=AppData\Local;AppData\LocalLow;$Recycle.Bin "BuildNumber"=7601 "FirstLogon"=0 "ParseAutoexec"=1 [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] "ReportBootOk"=1 "Shell"=explorer.exe "PreCreateKnownFolders"={A520A1A4-1780-4FF6-BD18-167343C5AF16} "Userinit"=C:\Windows\system32\userinit.exe, "VMApplet"=SystemPropertiesPerformance.exe /pagefile "AutoRestartShell"=1 "Background"=0 0 0 "CachedLogonsCount"=10 "DebugServerCommand"=no "ForceUnlockLogon"=0 "LegalNoticeCaption"= "LegalNoticeText"= "PasswordExpiryWarning"=5 "PowerdownAfterShutdown"=0 "ShutdownWithoutLogon"=0 "WinStationsDisabled"=0 "DisableCAD"=1 "scremoveoption"=0 "ShutdownFlags"=43 [HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] "ReportBootOk"=1 "Shell"=explorer.exe "PreCreateKnownFolders"={A520A1A4-1780-4FF6-BD18-167343C5AF16} "DefaultDomainName"= "DefaultUserName"= "Userinit"=userinit.exe, "VMApplet"=SystemPropertiesPerformance.exe /pagefile "System"= "Taskman"= "AutoRestartShell"=1 ---------- | Associations [HKU\S-1-5-21-1977720525-337058645-3963175332-1000\Software\Classes\.scr] ""=AutoCADScriptFile [HKU\S-1-5-21-1977720525-337058645-3963175332-1000\Software\Classes\.url] ""=InternetShortcut [HKLM\Software\Classes\.exe] ""=exefile "Content Type"=application/x-msdownload [HKLM\Software\Classes\exefile\Shell\Open\Command] ""="%1" %* "IsolatedCommand"="%1" %* [HKLM\Software\Classes\.com] ""=comfile [HKLM\Software\Classes\comfile\Shell\Open\Command] ""="%1" %* [HKLM\Software\Classes\.reg] ""=regfile [HKLM\Software\Classes\regfile\Shell\Open\Command] ""=regedit.exe "%1" [HKLM\Software\Classes\.scr] ""=scrfile [HKLM\Software\Classes\scrfile\Shell\Open\Command] ""="%1" /S [HKLM\Software\Classes\.bat] ""=batfile [HKLM\Software\Classes\batfile\Shell\Open\Command] ""="%1" %* [HKLM\Software\Classes\.cmd] ""=cmdfile [HKLM\Software\Classes\cmdfile\Shell\Open\Command] ""="%1" %* [HKLM\Software\Classes\.pif] ""=piffile [HKLM\Software\Classes\piffile\Shell\Open\Command] ""="%1" %* [HKLM\Software\Classes\.inf] ""=inffile [HKLM\Software\Classes\inffile\Shell\Open\Command] ""=%SystemRoot%\system32\NOTEPAD.EXE %1 [HKLM\Software\Classes\.url] ""=InternetShortcut [HKLM\Software\Classes\.lnk] ""=lnkfile [HKLM\Software\Classes\.hta] "PerceivedType"=text ""=htafile "Content Type"=application/hta [HKLM\Software\Classes\htafile\Shell\Open\Command] ""=C:\Windows\SysWOW64\mshta.exe "%1" %* [HKLM\Software\Classes\InternetShortcut] "NeverShowExt"= "InfoTip"=prop:System.Link.TargetUrl;System.Rating;System.Link.Description;System.Link.Comment "EditFlags"=2 "FullDetails"=prop:System.Link.TargetUrl;System.Rating;System.Link.Description;System.Link.Comment "IsShortcut"= "FriendlyTypeName"=@C:\Windows\System32\ieframe.dll,-10046 "PreviewDetails"=prop:System.Link.TargetUrl;System.Rating;System.History.VisitCount;System.History.DateChanged;System.Link.DateVisited;System.Link.Description;System.Link.Comment [HKLM\Software\Classes\Application.Manifest] ""=Application Manifest "EditFlags"=65536 "BrowserFlags"=4096 "FriendlyTypeName"=@dfshim.dll,-200 [HKLM\Software\Classes\Application.Reference] "NeverShowExt"= ""=Application Reference "IsShortcut"= "EditFlags"=131072 "FriendlyTypeName"=@dfshim.dll,-201 [HKLM\Software\Classes\Folder] "ContentViewModeLayoutPatternForBrowse"=delta "ContentViewModeForBrowse"=prop:~System.ItemNameDisplay;~System.LayoutPattern.PlaceHolder;~System.LayoutPattern.PlaceHolder;~System.LayoutPattern.PlaceHolder;System.DateModified "ContentViewModeLayoutPatternForSearch"=alpha "ContentViewModeForSearch"=prop:~System.ItemNameDisplay;System.DateModified;~System.ItemFolderPathDisplay ""=Folder "EditFlags"=0xD2030000 "FullDetails"=prop:System.PropGroup.Description;System.ItemNameDisplay;System.ItemTypeText;System.Size "NoRecentDocs"= "ThumbnailCutoff"=0 "TileInfo"=prop:System.Title;System.ItemTypeText [HKLM\Software\WOW6432Node\Classes\.exe] ""=exefile "Content Type"=application/x-msdownload [HKLM\Software\WOW6432Node\Classes\exefile\Shell\Open\Command] ""="%1" %* "IsolatedCommand"="%1" %* [HKLM\Software\WOW6432Node\Classes\.com] ""=comfile [HKLM\Software\WOW6432Node\Classes\comfile\Shell\Open\Command] ""="%1" %* [HKLM\Software\WOW6432Node\Classes\.reg] ""=regfile [HKLM\Software\WOW6432Node\Classes\regfile\Shell\Open\Command] ""=regedit.exe "%1" [HKLM\Software\WOW6432Node\Classes\.scr] ""=scrfile [HKLM\Software\WOW6432Node\Classes\scrfile\Shell\Open\Command] ""="%1" /S [HKLM\Software\WOW6432Node\Classes\.bat] ""=batfile [HKLM\Software\WOW6432Node\Classes\batfile\Shell\Open\Command] ""="%1" %* [HKLM\Software\WOW6432Node\Classes\.cmd] ""=cmdfile [HKLM\Software\WOW6432Node\Classes\cmdfile\Shell\Open\Command] ""="%1" %* [HKLM\Software\WOW6432Node\Classes\.pif] ""=piffile [HKLM\Software\WOW6432Node\Classes\piffile\Shell\Open\Command] ""="%1" %* [HKLM\Software\WOW6432Node\Classes\.inf] ""=inffile [HKLM\Software\WOW6432Node\Classes\inffile\Shell\Open\Command] ""=%SystemRoot%\system32\NOTEPAD.EXE %1 [HKLM\Software\WOW6432Node\Classes\.url] ""=InternetShortcut [HKLM\Software\WOW6432Node\Classes\.lnk] ""=lnkfile [HKLM\Software\WOW6432Node\Classes\.hta] "PerceivedType"=text ""=htafile "Content Type"=application/hta [HKLM\Software\WOW6432Node\Classes\htafile\Shell\Open\Command] ""=C:\Windows\SysWOW64\mshta.exe "%1" %* [HKLM\Software\WOW6432Node\Classes\InternetShortcut] "NeverShowExt"= "InfoTip"=prop:System.Link.TargetUrl;System.Rating;System.Link.Description;System.Link.Comment "EditFlags"=2 "FullDetails"=prop:System.Link.TargetUrl;System.Rating;System.Link.Description;System.Link.Comment "IsShortcut"= "FriendlyTypeName"=@C:\Windows\System32\ieframe.dll,-10046 "PreviewDetails"=prop:System.Link.TargetUrl;System.Rating;System.History.VisitCount;System.History.DateChanged;System.Link.DateVisited;System.Link.Description;System.Link.Comment [HKLM\Software\WOW6432Node\Classes\Application.Manifest] ""=Application Manifest "EditFlags"=65536 "BrowserFlags"=4096 "FriendlyTypeName"=@dfshim.dll,-200 [HKLM\Software\WOW6432Node\Classes\Application.Reference] "NeverShowExt"= ""=Application Reference "IsShortcut"= "EditFlags"=131072 "FriendlyTypeName"=@dfshim.dll,-201 [HKLM\Software\WOW6432Node\Classes\Folder] "ContentViewModeLayoutPatternForBrowse"=delta "ContentViewModeForBrowse"=prop:~System.ItemNameDisplay;~System.LayoutPattern.PlaceHolder;~System.LayoutPattern.PlaceHolder;~System.LayoutPattern.PlaceHolder;System.DateModified "ContentViewModeLayoutPatternForSearch"=alpha "ContentViewModeForSearch"=prop:~System.ItemNameDisplay;System.DateModified;~System.ItemFolderPathDisplay ""=Folder "EditFlags"=0xD2030000 "FullDetails"=prop:System.PropGroup.Description;System.ItemNameDisplay;System.ItemTypeText;System.Size "NoRecentDocs"= "ThumbnailCutoff"=0 "TileInfo"=prop:System.Title;System.ItemTypeText [HKLM\Software\Clients\StartMenuInternet\Google Chrome\Shell\open\Command] ""="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" [HKLM\Software\Clients\StartMenuInternet\Google Chrome\InstallInfo] "ReinstallCommand"="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --make-default-browser [HKLM\Software\Clients\StartMenuInternet\IEXPLORE.EXE\Shell\open\Command] ""=C:\Program Files\Internet Explorer\iexplore.exe [15/12/2016 13:25:30] [HKLM\Software\Clients\StartMenuInternet\IEXPLORE.EXE\InstallInfo] "ReinstallCommand"="C:\Windows\System32\ie4uinit.exe" -reinstall [HKLM\Software\Clients\StartMenuInternet\SafeZoneStable\Shell\open\Command] ""="C:\Program Files\AVAST Software\SZBrowser\Launcher.exe" [HKLM\Software\Clients\StartMenuInternet\SafeZoneStable\InstallInfo] "ReinstallCommand"="C:\Program Files\AVAST Software\SZBrowser\Launcher.exe" --makedefaultbrowser [HKLM\Software\WOW6432Node\Clients\StartMenuInternet\Google Chrome\Shell\open\Command] ""="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" [HKLM\Software\WOW6432Node\Clients\StartMenuInternet\Google Chrome\InstallInfo] "ReinstallCommand"="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --make-default-browser [HKLM\Software\WOW6432Node\Clients\StartMenuInternet\IEXPLORE.EXE\Shell\open\Command] ""=C:\Program Files\Internet Explorer\iexplore.exe [15/12/2016 13:25:30] [HKLM\Software\WOW6432Node\Clients\StartMenuInternet\IEXPLORE.EXE\InstallInfo] "ReinstallCommand"="C:\Windows\System32\ie4uinit.exe" -reinstall [HKLM\Software\WOW6432Node\Clients\StartMenuInternet\SafeZoneStable\Shell\open\Command] ""="C:\Program Files\AVAST Software\SZBrowser\Launcher.exe" [HKLM\Software\WOW6432Node\Clients\StartMenuInternet\SafeZoneStable\InstallInfo] "ReinstallCommand"="C:\Program Files\AVAST Software\SZBrowser\Launcher.exe" --makedefaultbrowser ---------- | AppcompatFlags [HKU\S-1-5-21-1977720525-337058645-3963175332-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted] "SIGN.MEDIA=438031C setup.exe"=1 "C:\Users\Sylvain\Desktop\daemon-tools_daemon_tools_4.40.2.0131_francais_10729.exe"=1 "D:\NETWORK\RTL8111\W7\setup.exe"=1 "C:\Program Files (x86)\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\setup.exe"=33 "C:\Program Files (x86)\Realtek\NICDRV_8169\RTINSTALLER64.EXE"=1 "D:\AUDIO\REALTEK\Setup.exe"=1 "SIGN.MEDIA=3613918 Run.exe"=1 "SIGN.MEDIA=167A98F Setup.exe"=1 "C:\Users\Sylvain\Desktop\Win RAR 3.2 + Crack\wrar320.exe"=1 "C:\Program Files (x86)\WinRAR\WinRAR.exe"=1 "C:\Users\Sylvain\Desktop\vray\vray\[PC ENG ~ x32] VRay 1.5 SP3 ~ 3DS Max 2010\vray-adv-150SP3a-max2010-x86.exe"=8 "C:\Users\Sylvain\Desktop\VRay.v.1.5.RC5.x86.for.3ds.max.9\vray_adv_150R5_max90_x86.exe"=8 "C:\Program Files (x86)\Chaos Group\V-Ray\3dsmax R9 for x86\uninstall\wininstaller.exe"=33 "C:\Users\Sylvain\Desktop\3dsmax2010\setup.exe"=1 "C:\Users\Sylvain\Desktop\ADOBE PHOTOSHOP CS4\ADBEPHSPCS4_LS1\Adobe CS4\Setup.exe"=1 "C:\Users\Sylvain\Desktop\ADOBE PHOTOSHOP CS4\ADBEPHSPCS4_LS1\Adobe CS4\payloads\AdobeAIR1.0\AdobeAIRInstaller.exe"=1 "C:\Users\Sylvain\Desktop\ViveZ2\Viveza2.0\Viveza-ver2.000all.exe"=1 "C:\Users\Sylvain\Desktop\Nik.Software.Color.Efex.Pro.v3\CEP_3.0_Complete_Win_EN.exe"=1 "C:\Users\Sylvain\Desktop\winamp532_full.exe"=1 "C:\Users\Sylvain\Desktop\SketchUp Pro 7.1\GoogleSketchUpProWFR.exe"=1 "C:\Users\Sylvain\Downloads\avira_antivir_personal_free.exe"=1 "C:\Users\Sylvain\Downloads\FileZilla_3.4.0_win32-setup.exe"=1 "C:\Users\Sylvain\Downloads\setup-adsltv.exe"=1 "C:\Users\Sylvain\Downloads\DivXWebPlayerInstaller.exe"=1 "C:\Users\Sylvain\Downloads\malwarebytes-anti-malware_malwarebytes_anti-malware_1.50.1_francais_215092.exe"=1 "C:\Users\Sylvain\Downloads\vlc-1.1.9-win32.exe"=1 "C:\Users\Sylvain\Downloads\cg32v410.cmut (1).exe"=1 "C:\Users\Sylvain\Downloads\idman605.exe"=1 "SIGN.MEDIA=D3AB4262 autorun.exe"=1 "C:\Program Files (x86)\Internet Download Manager\Uninstall.exe"=1 "C:\Users\Sylvain\Downloads\vlc.exe"=1 "C:\Users\Sylvain\Downloads\vlc-1.1.11-win32.exe"=1 "SIGN.MEDIA=5E216E30 Autorun.exe"=1 "C:\Program Files (x86)\Cuisine Delinia\unins000.exe"=1 "C:\Users\Sylvain\Desktop\news 3d\ITOO_FOREST_PACK_PRO_V3.6.2_3DSMAX\ITOO_FOREST_PACK_PRO_V3.6.2_FOR_3DSMAX\ForestPackPro362.exe"=1 "C:\Users\Sylvain\Downloads\urban_park_VRay9.exe"=1 "C:\Program Files (x86)\Google\Google SketchUp 7\SketchUp.exe"=8 "C:\Users\Sylvain\AppData\Local\Temp\QuickTimeInstaller.exe"=1 "C:\Users\Sylvain\Downloads\CuteWriter.exe"=1 "C:\Users\Sylvain\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LP85GE83\install_flashplayer11x64ax_gtba_aih[1].exe"=1 "C:\Users\Sylvain\Downloads\spybotsd162.exe"=1 "C:\Users\Sylvain\Downloads\SkypeSetup.exe"=1 "C:\Users\Sylvain\AppData\Local\Temp\A1BE3496-BAB0-7891-A53C-42D40E5BEF73\Setup.exe"=1 "C:\Users\Sylvain\AppData\Local\Temp\MyBabylonTB.exe"=1 "C:\Users\Sylvain\Downloads\Setup_V17FR.exe"=1 "C:\Users\Sylvain\Downloads\7-zip_7-zip_9.20_francais_11161.exe"=1 "C:\Users\Sylvain\Downloads\chromeinstall-7u7.exe"=1 "C:\Users\Sylvain\AppData\Local\Temp\IS1668~1\BoxoreInstaller.exe"=1 "C:\Users\Sylvain\Downloads\avira_free_antivirus_fr.exe"=1 "C:\Users\Sylvain\Downloads\idman612.exe"=1 "C:\Users\Sylvain\Downloads\JDownloaderSetup.exe"=1 "C:\Users\Sylvain\Downloads\audacity-win-2.0.2.exe"=1 "C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\IDriver.exe"=1 "C:\Users\Sylvain\Downloads\ccsetup327.exe"=1 "C:\Users\Sylvain\Downloads\game.of.thrones.s01e01.french.bdrip.xvid-jmt.avi.exe"=1 "C:\Users\Sylvain\Downloads\reaper4581_x64-install.exe"=1 "C:\Users\Sylvain\Downloads\games\D_S_FR_23-04-13\D_S_FR_23-04-13.exe"=1 "SIGN.MEDIA=62D14D54 setup.exe"=1 "SIGN.MEDIA=52B4C00 setup.exe"=1 "C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay.exe"=32 "SIGN.MEDIA=5D66D7FB setup.exe"=1 "C:\Users\Sylvain\AppData\Local\Temp\MySearchDial.exe"=1 "C:\Users\Sylvain\AppData\Local\Temp\IS2125~1\7435860_stp\MegaBrowseSetup.exe"=1 "C:\Users\Sylvain\Downloads\install_reader11_fr_mssd_aaa_aih.exe"=1 "SIGN.MEDIA=71B567E6 setup.exe"=1 "SIGN.MEDIA=3775DD25 setup.exe"=1 "C:\Users\Sylvain\AppData\Local\Adobe\OOBE\PDApp\DECore\Setup.exe"=1 "C:\Users\Sylvain\Desktop\Master CS6\a recompresser\Adobe CS6\Set-up.exe"=1 "C:\Users\Sylvain\Downloads\Unlocker1.9.2 [1].exe"=1 "C:\Users\Sylvain\Downloads\Unlocker1.9.2.exe"=1 "C:\Users\Sylvain\Downloads\ZHPDiag2.exe"=1 "C:\Program Files (x86)\ZHPDiag\ZHPhep.exe"=1 "C:\Users\Sylvain\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9PQ6BKYQ\avast_free_antivirus_setup_online.exe"=1 "C:\Program Files (x86)\ZHPDiag\ZHPFix\ZHPhep.exe"=1 "C:\Users\Sylvain\Downloads\GoogleEarthSetup.exe"=1 "C:\Users\Sylvain\Downloads\GoogleEarthPluginSetup.exe"=1 "C:\Users\Sylvain\Downloads\camtasia.exe"=1 "C:\Users\Sylvain\Downloads\TrimbleSketchUpPro14.1.1282-FR\SketchUpPro14.1.1282-fr\SketchUpPro14.1.1282-fr.exe"=1 "SIGN.MEDIA=75F0F6 Setup.exe"=1 "H:\sylvain\_03 LOGICIELS\logiciels archis\Nik.Software.Color.Efex.Pro.v3\CEP_3.0_Complete_Win_EN.exe"=1 "C:\Users\Sylvain\Downloads\colfx4\colfx4\Setup\ColorEfexPro4_full_pl_win_all_4.000.exe"=1 "C:\Users\Sylvain\Downloads\setup.exe"=1 "SIGN.MEDIA=6888614B setup.exe"=1 "C:\Users\Sylvain\Downloads\344.48-desktop-win8-win7-winvista-64bit-international-whql.exe"=1 "C:\Users\Sylvain\AppData\Local\Temp\jre-8u25-windows-au.exe"=1 "C:\Users\Sylvain\Downloads\OCCTPT4.4.1.exe"=1 "C:\Users\Sylvain\Downloads\kodi-14.0-Helix_rc3.exe"=1 "H:\sylvain\_03 LOGICIELS\logiciels archis\ADOBE PHOTOSHOP CS4\ADBEPHSPCS4_LS1\Adobe CS4\Setup.exe"=1 "C:\Users\Sylvain\Downloads\nikcollection-latest.exe"=1 "C:\Users\Sylvain\Downloads\Thunderbird Setup 31.3.0.exe"=1 "SIGN.MEDIA=A078FF53 Setup.exe"=1 "C:\Program Files (x86)\Double Eleven\Frozen Synapse Prime\unins000.exe"=1 "C:\Program Files\Adobe\Adobe Photoshop CS4 (64 Bit)\Plug-ins\Nik Software\Color Efex Pro 3.0 Complete\Uninstall.exe"=1 "I:\sylvain\_03 LOGICIELS\logiciels archis\Nik.Software.Color.Efex.Pro.v3\CEP_3.0_Complete_Win_EN.exe"=1 "I:\sylvain\_03 LOGICIELS\logiciels archis\ViveZ2\Viveza2.0\Viveza-ver2.000all.exe"=1 "I:\sylvain\_03 LOGICIELS\lightroom 64x\Adobe.Photoshop.Lightroom.v5.3.Multilingual.x64.Incl.Keymaker-CORE\setup\setup64.exe"=1 "E:\Documents persos archives\_02 bibliothèques 2015\SGRVMPP210\SGRVMPP2\VMPP2_setup.exe"=1 "C:\Users\Sylvain\Desktop\Nik Software Complete Collection v1.0.0.7 Final Eng_Rus\NikCollection_1.0.0.7full.exe"=1 "E:\Documents persos archives\_02 bibliothèques 2015\3D ESSENTIAL 2015\SGRVMPP210\SGRVMPP2\VMPP2_setup.exe"=1 "C:\Users\Sylvain\Downloads\Autodesk_3ds_Max_2014\Autodesk_3ds_Max_2014_EFGJKS_Win_64bit_dlm.sfx.exe"=1 "C:\Users\Sylvain\Downloads\710_b042_multilanguage.exe"=1 "C:\Program Files\Autodesk\3ds Max 2014\3dsmax.exe"=512 "SIGN.MEDIA=B2AACD0E setup.exe"=1 "SIGN.MEDIA=B2AACD0E gfwlivesetup.exe"=1 "SIGN.MEDIA=EEBD4D98 setup.exe"=1 "C:\Users\Sylvain\Downloads\332.21-desktop-win8-win7-winvista-64bit-international-whql.exe"=1 "C:\Users\Sylvain\Downloads\320.18-desktop-win8-win7-winvista-64bit-english-whql.exe"=1 "SIGN.MEDIA=5C8BDFEB setup.exe"=1 "C:\Program Files (x86)\Helicopter 2015 Natural Disasters\redists\x264vfw_23_1659bm_23819.exe"=1 "SIGN.MEDIA=149C4B2 SetupRA.exe"=1 "C:\Users\Sylvain\Downloads\DropboxInstaller.exe"=1 "SIGN.MEDIA=59E85B43 setup.exe"=1 "C:\Users\Sylvain\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe"=1 "C:\Users\Sylvain\Downloads\DIALux_evo5.1.exe"=1 "C:\Users\Sylvain\Downloads\PPS5260_emea_19062012\setup.exe"=1 "C:\Users\Sylvain\AppData\Local\Temp\MSETUP4.EXE"=1 "C:\Users\Sylvain\AppData\Local\Temp\7zS1DDC.tmp\setup.exe"=1 "C:\Users\Sylvain\Downloads\fileassassin-setup-1.06.exe"=1 "C:\Users\Sylvain\AppData\Roaming\Tencent\QQMusicMMInstallCache\QQSetup5712.exe"=1 "C:\Program Files (x86)\Tencent\QQ\XDfJ\njqqoi.exe"=1 "C:\Program Files (x86)\Tencent\QQMusic\QQMusic1257.18.23.45\QQMusicUninst.exe"=33 "C:\Program Files (x86)\Tencent\QQMusic\QQMusic1257.18.23.45\Uninstall.exe"=1 "C:\Program Files (x86)\Tencent\QQBrowser\uninst.exe"=1 "C:\Program Files (x86)\Tencent\QQPhoneManager\QQPMUnInst.exe"=1 "C:\Users\Sylvain\Downloads\keyshot_w64_6.1.72.exe"=1 "C:\Users\Sylvain\Downloads\setupeosinfo.exe"=1 "SIGN.MEDIA=B9C9AC9E setup.exe"=1 "C:\Users\Sylvain\Downloads\ProFire_6_1_1\ProFire_6_1_1\Install M-Audio ProFire Series Windows 6.1.1.exe"=1 "C:\Users\Sylvain\Downloads\spybotsd-2.6.46.exe"=1 "C:\Users\Sylvain\Downloads\hwmonitor_1.31.exe"=1 "C:\Users\Sylvain\Downloads\SpeedFan_4_7942.exe"=1 [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted] "C:\Program Files\AVAST Software\SZBrowser\Launcher.exe"=32 ---------- | IFEO ---------- | Mountpoints2 [HKU\S-1-5-21-1977720525-337058645-3963175332-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Mountpoints2\{e476367e-41a0-11e0-94d7-98045fc9b27d}] : G:\setup.exe (AutoRun) ---------- | Windows [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\win.ini\Windows] "MouseSpeed"=#USR:Control Panel\Mouse "MouseThreshold1"=#USR:Control Panel\Mouse "MouseThreshold2"=#USR:Control Panel\Mouse "SwapMouseButtons"=#USR:Control Panel\Mouse "Beep"=#USR:Control Panel\Sound "DoubleClickSpeed"=#USR:Control Panel\Mouse "CoolSwitch"=USR:Control Panel\Desktop "DoubleClickHeight"=#USR:Control Panel\Mouse "DoubleClickWidth"=#USR:Control Panel\Mouse "DragFullWindows"=USR:Control Panel\Desktop "InitialKeyboardIndicators"=USR:Control Panel\Keyboard "LowPowerActive"=#USR:Control Panel\Desktop "LowPowerTimeOut"=#USR:Control Panel\Desktop "PowerOffActive"=#USR:Control Panel\Desktop "PowerOffTimeOut"=#USR:Control Panel\Desktop "ScreenSaveActive"=#USR:Control Panel\Desktop "ScreenSaveTimeOut"=#USR:Control Panel\Desktop "SnapToDefaultButton"=#USR:Control Panel\Mouse ""=USR:Software\Microsoft\Windows NT\CurrentVersion\Windows "Spooler"=#SYS:Microsoft\Windows NT\CurrentVersion\Windows "TRANSMISSIONRETRYTIMEOUT"=#SYS:MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS "DEFAULTSEPARATEVDM"=\\REGISTRY\\MACHINE\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\WOW "APPINIT_DLLS"=SYS:MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS "DEVICENOTSELECTEDTIMEOUT"=#SYS:MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS "SWAPDISK"=SYS:MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\system.ini\Boot] ""=SYS:Microsoft\Windows NT\CurrentVersion\WOW\boot "ScreenSaverActive"=USR:Control Panel\Desktop "ScreenSaverIsSecure"=USR:Control Panel\Desktop "SCRNSAVE.EXE"=USR:Control Panel\Desktop "Shell"=SYS:Microsoft\Windows NT\CurrentVersion\Winlogon [HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\IniFileMapping\win.ini\Windows] "MouseSpeed"=#USR:Control Panel\Mouse "MouseThreshold1"=#USR:Control Panel\Mouse "MouseThreshold2"=#USR:Control Panel\Mouse "SwapMouseButtons"=#USR:Control Panel\Mouse "Beep"=#USR:Control Panel\Sound "DoubleClickSpeed"=#USR:Control Panel\Mouse "CoolSwitch"=USR:Control Panel\Desktop "DoubleClickHeight"=#USR:Control Panel\Mouse "DoubleClickWidth"=#USR:Control Panel\Mouse "DragFullWindows"=USR:Control Panel\Desktop "InitialKeyboardIndicators"=USR:Control Panel\Keyboard "LowPowerActive"=#USR:Control Panel\Desktop "LowPowerTimeOut"=#USR:Control Panel\Desktop "PowerOffActive"=#USR:Control Panel\Desktop "PowerOffTimeOut"=#USR:Control Panel\Desktop "ScreenSaveActive"=#USR:Control Panel\Desktop "ScreenSaveTimeOut"=#USR:Control Panel\Desktop "SnapToDefaultButton"=#USR:Control Panel\Mouse "TRANSMISSIONRETRYTIMEOUT"=#SYS:MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS "DEFAULTSEPARATEVDM"=\\REGISTRY\\MACHINE\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\WOW "APPINIT_DLLS"=SYS:MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS "DEVICENOTSELECTEDTIMEOUT"=#SYS:MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS "SWAPDISK"=SYS:MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS [HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\IniFileMapping\system.ini\Boot] ""=SYS:Microsoft\Windows NT\CurrentVersion\WOW\boot "ScreenSaverActive"=USR:Control Panel\Desktop "ScreenSaverIsSecure"=USR:Control Panel\Desktop "SCRNSAVE.EXE"=USR:Control Panel\Desktop "Shell"=SYS:Microsoft\Windows NT\CurrentVersion\Winlogon [HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems] "windows"=%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 ---------- | Security center [HKLM\SOFTWARE\Microsoft\Security Center] "cval"=1 [HKLM\SOFTWARE\Microsoft\Security Center\svc] "VistaSp1"=128920218544262440 "AntiVirusOverride"=0 "AntiSpywareOverride"=0 "FirewallOverride"=0 [HKLM\SOFTWARE\Microsoft\Windows Defender] "DisableAntiSpyware"=0 "DisableRoutinelyTakingAction"=1 "ProductStatus"=0 "InstallTime"=0xCAF856D0A5D5CB01 [HKLM\Software\WOW6432Node\Microsoft\Windows Defender] "DisableAntiSpyware"=0 "DisableRoutinelyTakingAction"=1 [HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall"=1 [HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall"=1 [HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "EnableFirewall"=1 ---------- | Safeboot [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppMgmt] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Base] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Boot Bus Extender] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Boot file system] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CryptSvc] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\DcomLaunch] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\EFS] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\EventLog] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\File system] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Filter] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HelpSvc] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Netlogon] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PCI Configuration] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PlugPlay] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PNP Filter] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Power] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Primary disk] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RpcEptMapper] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RpcSs] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SCSI Class] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sermouse.sys] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\System Bus Extender] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vga.sys] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vmms] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinMgmt] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{36FC9E60-C465-11CF-8056-444553540000}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E965-E325-11CE-BFC1-08002BE10318}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E969-E325-11CE-BFC1-08002BE10318}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E977-E325-11CE-BFC1-08002BE10318}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97B-E325-11CE-BFC1-08002BE10318}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E980-E325-11CE-BFC1-08002BE10318}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AFD] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AppInfo] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AppMgmt] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Base] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\BFE] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Boot Bus Extender] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Boot file system] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\bowser] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Browser] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CryptSvc] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\DcomLaunch] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\dfsc] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Dhcp] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\DnsCache] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Dot3Svc] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Eaphost] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\EFS] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\EventLog] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\File system] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Filter] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\HelpSvc] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\IKEEXT] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ipnat.sys] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\KeyIso] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\LanmanServer] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\LanmanWorkstation] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\LmHosts] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Messenger] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MPSDrv] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MPSSvc] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mrxsmb] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mrxsmb10] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mrxsmb20] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NativeWifiP] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NDIS] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NDIS Wrapper] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ndiscap] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Ndisuio] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetBIOS] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetBIOSGroup] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetBT] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetDDEGroup] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Netlogon] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetMan] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\netprofm] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Network] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetworkProvider] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NlaSvc] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Nsi] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\nsiproxy.sys] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NTDS] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PCI Configuration] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PlugPlay] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PNP Filter] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PNP_TDI] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PolicyAgent] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Power] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Primary disk] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ProfSvc] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\rdbss] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\rdpencdd.sys] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\rdsessmgr] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\RpcEptMapper] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\RpcSs] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\sacsvr] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SCardSvr] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SCSI Class] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\sermouse.sys] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SharedAccess] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Streams Drivers] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SWPRV] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\System Bus Extender] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\TabletInputService] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\TBS] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Tcpip] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\TDI] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\TrustedInstaller] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\VaultSvc] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\VDS] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vga.sys] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vgasave.sys] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vmms] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\volmgr.sys] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\volmgrx.sys] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinMgmt] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wlansvc] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WudfPf] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WudfRd] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WudfSvc] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WudfUsbccidDriver] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{36FC9E60-C465-11CF-8056-444553540000}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E965-E325-11CE-BFC1-08002BE10318}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E969-E325-11CE-BFC1-08002BE10318}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E96A-E325-11CE-BFC1-08002BE10318}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E96B-E325-11CE-BFC1-08002BE10318}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E96F-E325-11CE-BFC1-08002BE10318}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E973-E325-11CE-BFC1-08002BE10318}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E974-E325-11CE-BFC1-08002BE10318}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E975-E325-11CE-BFC1-08002BE10318}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E977-E325-11CE-BFC1-08002BE10318}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E97B-E325-11CE-BFC1-08002BE10318}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E97D-E325-11CE-BFC1-08002BE10318}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E980-E325-11CE-BFC1-08002BE10318}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{50DD5230-BA8A-11D1-BF5D-0000F805F530}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{71A27CDD-812A-11D0-BEC7-08002BE2092F}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}] [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}] ---------- | Winsock (Whitelist) ---------- | Hosts 127.0.0.1 www.happy-digital.com ---------- | Ping Envoi d'une requ?te 'ping' sur google.com [172.217.22.142] avec 32 octets de donn?es?: R?ponse de 172.217.22.142?: octets=32 temps=25 ms TTL=54 R?ponse de 172.217.22.142?: octets=32 temps=36 ms TTL=54 R?ponse de 172.217.22.142?: octets=32 temps=27 ms TTL=54 R?ponse de 172.217.22.142?: octets=32 temps=25 ms TTL=54 Statistiques Ping pour 172.217.22.142: Paquets?: envoy?s = 4, re?us = 4, perdus = 0 (perte 0%), Dur?e approximative des boucles en millisecondes : Minimum = 25ms, Maximum = 36ms, Moyenne = 28ms ---------- | @ [HKU\S-1-5-21-1977720525-337058645-3963175332-1000\Software\Microsoft\Internet Explorer\Main] "Disable Script Debugger"=yes "Anchor Underline"=yes "Cache_Update_Frequency"=Once_Per_Session "Display Inline Images"=yes "Do404Search"=0x01000000 "Local Page"=C:\Windows\SysWOW64\blank.htm "Save_Session_History_On_Exit"=no "Show_FullURL"=no "Show_StatusBar"=yes "Show_ToolBar"=yes "Show_URLinStatusBar"=yes "Show_URLToolBar"=yes "Use_DlgBox_Colors"=yes "Search Page"=www.google.com "XMLHTTP"=1 "NoUpdateCheck"=1 "UseClearType"=no "Enable Browser Extensions"=yes "Play_Background_Sounds"=yes "Play_Animations"=yes "Start Page"=http://go.microsoft.com/fwlink/p/?LinkId=619797&pc=UE12&ocid=UE12DHP "CompatibilityFlags"=0 "FullScreen"=no "Window_Placement"=0x2C0000000200000003000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF8A03000017000000800700003B030000 "IE8RunOnceLastShown"=1 "IE8RunOnceLastShown_TIMESTAMP"=0x3195AAAF7812CE01 "IE8TourShown"=1 "IE8TourShownTime"=0x5CFA7B66AFD5CB01 "NotifyDownloadComplete"=no "Start Page Redirect Cache_TIMESTAMP"=0x086245D1B704CC01 "Start Page Redirect Cache AcceptLangs"=fr "Check_Associations"=No "Use FormSuggest"=no "AlwaysShowMenus"=1 "Use Custom Search URL"=0 "DisableScriptDebuggerIE"=yes "OperationalData"=5 "IconCache"=nh4u7f8 "IE10RunOncePerInstallCompleted"=1 "IE10RunOnceCompletionTime"=0x5149B726F2F5CE01 "IE10TourShown"=1 "IE10TourShownTime"=0x726DBE26F2F5CE01 "ImageStoreRandomFolder"=iju1zhy "DoNotTrack"=1 "ApplicationTileImmersiveActivation"=1 "AssociationActivationMode"=0 "Search Bar"=www.google.com "Use Search Asst"=yes "Isolation"=PMIL "Isolation64Bit"=0 "Move System Caret"=no "PlaySounds"=0 "Expand Alt Text"=no "UseSWRender"=0 "Enable AutoImageResize"=yes "EnableAlternativeCodec"=yes "Show image placeholders"=0 "GotoIntranetSiteForSingleWordEntry"=0 "UseThemes"=1 "Friendly http errors"=yes "Error Dlg Displayed On Every Error"=no "NscSingleExpand"=0 "SmoothScroll"=1 "DOMStorage"=1 "MixedContentBlockImages"=0 "DownloadWindowPlacement"=0x2C0000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5002000005010000D0040000E5020000 "DefSpellLang"=fr-FR "Start Default_Page_URL"=http://www.google.com/ "Default_Search_URL"=http://go.microsoft.com/fwlink/?LinkId=54896 "Default_Page_URL"=http://go.microsoft.com/fwlink/?LinkId=69157 "CustomizeSearch"=http://www.google.com/ "StatusBarWeb"=1 "Start Page_TIMESTAMP"=0xDB25D83DC3EAD201 "SyncHomePage Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy"= [HKU\S-1-5-21-1977720525-337058645-3963175332-1000\Software\Microsoft\Internet Explorer\Search] "Default_Search_URL"=www.google.com "SearchAssistant"=www.google.com "Search Bar"=http://www.google.com/ "Start Page"=http://www.google.com/ "Start Default_Page_URL"=http://www.google.com/ "Local Page"=C:\Windows\SysWOW64\blank.htm "Search Page"=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch "Default_Page_URL"=http://go.microsoft.com/fwlink/?LinkId=69157 "CustomizeSearch"=http://www.google.com/ [HKU\S-1-5-21-1977720525-337058645-3963175332-1000\Software\Microsoft\Internet Explorer\SearchURL] "Default"=www.google.com [HKU\S-1-5-21-1977720525-337058645-3963175332-1000\Software\Microsoft\Internet Explorer\AboutURLs] "Tabs"=http://www.google.com/ [HKU\S-1-5-21-1977720525-337058645-3963175332-1000\Software\Microsoft\Windows\CurrentVersion\Internet settings] "IE5_UA_Backup_Flag"=5.0 "User Agent"=Mozilla/4.0 (compatible; MSIE; Win32) "EmailName"=User@ "PrivDiscUiShown"=1 "EnableHttp1_1"=1 "WarnOnIntranet"=1 "MimeExclusionListForCache"=multipart/mixed multipart/x-mixed-replace multipart/x-byteranges "AutoConfigProxy"=wininet.dll "UseSchannelDirectly"=0x01000000 "WarnOnPost"=0x01000000 "UrlEncoding"=0 "SecureProtocols"=2688 "PrivacyAdvanced"=0 "ZonesSecurityUpgrade"=0xB6383C760FF4CE01 "DisableCachingOfSSLPages"=0 "WarnonZoneCrossing"=0 "CertificateRevocation"=1 "EnableNegotiate"=1 "MigrateProxy"=1 "ProxyEnable"=0 "ProxyOverride"=*.local "GlobalUserOffline"=0 "EnableAutodial"=0 "NoNetAutodial"=0 "ReceiveTimeout"=600000 "DisableIDNPrompt"=0 "EnablePunycode"=1 "ShowPunycode"=0 "ProxyHttp1.1"=1 "EnforceP3PValidity"=0 "WarnOnPostRedirect"=1 "WarnonBadCertRecving"=1 "ServerInfoTimeOut"=0 "DnsCacheTimeout"=0 "DnsCacheEnabled"=0 "MaxConnectionsPerServer"=10 "MaxConnectionsPer1_0Server"=10 [HKLM\Software\Microsoft\Internet Explorer\Main] "AutoHide"=yes "Security Risk Page"=about:SecurityRisk "Extensions Off Page"=about:NoAdd-ons "Default_Search_URL"=http://go.microsoft.com/fwlink/?LinkId=54896 "Default_Page_URL"=http://go.microsoft.com/fwlink/p/?LinkId=255141 "Anchor_Visitation_Horizon"=0x01000000 "Cache_Percent_of_Disk"=0x0A000000 "Placeholder_Width"=0x1A000000 "Placeholder_Height"=0x1A000000 "Default_Secondary_Page_URL"= "Use_Async_DNS"=yes "Start Page"=http://www.google.com "Local Page"=C:\Windows\SysWOW64\blank.htm "Search Page"=http://go.microsoft.com/fwlink/?LinkId=54896 "Delete_Temp_Files_On_Exit"=yes "Enable_Disk_Cache"=yes "ApplicationTileImmersiveActivation"=1 "AssociationActivationMode"=0 "x86AppPath"=C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE "Search Bar"=http://www.google.com/ "Start Default_Page_URL"=http://www.google.com/ "CustomizeSearch"=http://www.google.com/ [HKLM\Software\Microsoft\Internet Explorer\Search] "SearchAssistant"=http://www.google.com/ "Search Bar"=http://www.google.com/ "Start Page"=http://www.google.com/ "Start Default_Page_URL"=http://www.google.com/ "Local Page"=C:\Windows\SysWOW64\blank.htm "Search Page"=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch "Default_Search_URL"=http://go.microsoft.com/fwlink/?LinkId=54896 "Default_Page_URL"=http://go.microsoft.com/fwlink/?LinkId=69157 "CustomizeSearch"=http://www.google.com/ [HKLM\Software\Microsoft\Internet Explorer\SearchURL] "Default"=http://www.google.com/ [HKLM\Software\Microsoft\Internet Explorer\AboutURLs] "blank"=res://mshtml.dll/blank.htm "NoAdd-onsInfo"=res://ieframe.dll/noaddoninfo.htm "InPrivate"=res://ieframe.dll/inprivate_win7.htm "NavigationFailure"=res://ieframe.dll/navcancl.htm "NoAdd-ons"=res://ieframe.dll/noaddon.htm "Home"=270 "PostNotCached"=res://ieframe.dll/repost.htm "DesktopItemNavigationFailure"=res://ieframe.dll/navcancl.htm "NavigationCanceled"=res://ieframe.dll/navcancl.htm "SecurityRisk"=res://ieframe.dll/securityatrisk.htm "Tabs"=http://www.google.com/ "Compat"=res://mshtml.dll/compat.htm [HKLM\Software\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix] ""=http:// [HKLM\Software\Microsoft\Windows\CurrentVersion\URL\Prefixes] "mosaic"=http:// "www"=http:// "home"=http:// "ftp"=ftp:// [HKLM\Software\Microsoft\Windows\CurrentVersion\Internet settings] "EnablePunycode"=1 "CodeBaseSearchPath"=CODEBASE "WarnOnIntranet"=1 "MinorVersion"=0 "ActiveXCache"=C:\Windows\Downloaded Program Files [HKLM\Software\WOW6432Node\Microsoft\Internet Explorer\Main] "AutoHide"=yes "Security Risk Page"=about:SecurityRisk "Extensions Off Page"=about:NoAdd-ons "Default_Search_URL"=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch "Default_Page_URL"=http://go.microsoft.com/fwlink/p/?LinkId=255141 "Anchor_Visitation_Horizon"=0x01000000 "Cache_Percent_of_Disk"=0x0A000000 "Placeholder_Width"=0x1A000000 "Placeholder_Height"=0x1A000000 "Default_Secondary_Page_URL"= "Use_Async_DNS"=yes "Start Page"= "Local Page"=C:\Windows\SysWOW64\blank.htm "Search Page"=http://go.microsoft.com/fwlink/?LinkId=54896 "Delete_Temp_Files_On_Exit"=yes "Enable_Disk_Cache"=yes "Check_Associations"=yes "ApplicationTileImmersiveActivation"=1 "AssociationActivationMode"=0 "x86AppPath"=C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE "Search Bar"=http://www.google.com/ "Start Default_Page_URL"=http://www.google.com/ "CustomizeSearch"=http://www.google.com/ [HKLM\Software\WOW6432Node\Microsoft\Internet Explorer\Search] "SearchAssistant"=http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm "Search Bar"=http://www.google.com/ "Start Page"=http://www.google.com/ "Start Default_Page_URL"=http://www.google.com/ "Local Page"=C:\Windows\SysWOW64\blank.htm "Search Page"=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch "Default_Search_URL"=http://go.microsoft.com/fwlink/?LinkId=54896 "Default_Page_URL"=http://go.microsoft.com/fwlink/?LinkId=69157 "CustomizeSearch"=http://www.google.com/ [HKLM\Software\WOW6432Node\Microsoft\Internet Explorer\SearchURL] "Default"=www.google.com [HKLM\Software\WOW6432Node\Microsoft\Internet Explorer\AboutURLs] "blank"=res://mshtml.dll/blank.htm "NoAdd-onsInfo"=res://ieframe.dll/noaddoninfo.htm "InPrivate"=res://ieframe.dll/inprivate_win7.htm "NavigationFailure"=res://ieframe.dll/navcancl.htm "NoAdd-ons"=res://ieframe.dll/noaddon.htm "Home"=270 "PostNotCached"=res://ieframe.dll/repost.htm "DesktopItemNavigationFailure"=res://ieframe.dll/navcancl.htm "NavigationCanceled"=res://ieframe.dll/navcancl.htm "SecurityRisk"=res://ieframe.dll/securityatrisk.htm "Tabs"=http://www.google.com/ "Compat"=res://mshtml.dll/compat.htm [HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix] ""=http:// [HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\URL\Prefixes] "mosaic"=http:// "www"=http:// "home"=http:// "ftp"=ftp:// [HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet settings] "EnablePunycode"=1 "CodeBaseSearchPath"=CODEBASE "WarnOnIntranet"=1 "MinorVersion"=0 "ActiveXCache"=C:\Windows\Downloaded Program Files ---------- | Proxy [HKLM\System\CurrentControlSet\Services\NLASVC\Parameters\Internet\Manualproxies] ---------- | reparsepoint ---------- | Detection of offsets ---------- | Notify [HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SDWinLogon] : SDWinLogon.dll ---------- | Execution FileExts [HKU\S-1-5-21-1977720525-337058645-3963175332-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.apk] "Progid"=TencentAndroidAssistant [HKU\S-1-5-21-1977720525-337058645-3963175332-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi] "DivX.AAR.backup"=Windows Media Player "Progid"=divx_avi_file [HKU\S-1-5-21-1977720525-337058645-3963175332-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.div] "Progid"=divx_div_file [HKU\S-1-5-21-1977720525-337058645-3963175332-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.divx] "Progid"=divx_divx_file [HKU\S-1-5-21-1977720525-337058645-3963175332-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kml] "Application"=googleearth.exe [HKU\S-1-5-21-1977720525-337058645-3963175332-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kmz] "Application"=googleearth.exe [HKU\S-1-5-21-1977720525-337058645-3963175332-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mkv] "Progid"=divx_mkv_file [HKU\S-1-5-21-1977720525-337058645-3963175332-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.qt] "Progid"=divx_qt_file [HKU\S-1-5-21-1977720525-337058645-3963175332-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tix] "Progid"=divx_tix_file [HKU\S-1-5-21-1977720525-337058645-3963175332-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vob] "Progid"=divx_vob_file ---------- | SIOI | SEH | URLSH [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\"DropboxExt1"] - {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} -- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\"DropboxExt2"] - {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} -- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\"DropboxExt3"] - {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} -- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\"DropboxExt4"] - {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} -- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\"DropboxExt5"] - {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} -- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\"DropboxExt6"] - {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} -- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\"DropboxExt7"] - {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} -- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\"DropboxExt8"] - {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} -- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00avast] - {472083B0-C522-11CF-8763-00608CC02F24} -- C:\Program Files\AVAST Software\Avast\ashShA64.dll [12/07/2016 10:59:30] [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\AutoCAD Digital Signatures Icon Overlay Handler] - {36A21736-36C2-4C11-8ACB-D4136F2B57BD} -- C:\Windows\system32\AcSignIcon.dll [08/02/2013 11:08:43] [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\EnhancedStorageShell] - {D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D} -- %SystemRoot%\system32\EhStorShell.dll [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 1 (GFS Unread Stub)] - {99FD978C-D287-4F50-827F-B2C658EDA8E7} -- C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL [19/12/2013 00:44:34] [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2 (GFS Stub)] - {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} -- C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL [19/12/2013 00:44:34] [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)] - {920E6DB1-9907-4370-B3A0-BAFC03D81399} -- C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL [19/12/2013 00:44:34] [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 3 (GFS Folder)] - {16F3DD56-1AF5-4347-846D-7C10C4192619} -- C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL [19/12/2013 00:44:34] [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 4 (GFS Unread Mark)] - {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} -- C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL [19/12/2013 00:44:34] [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Offline Files] - {4E77131D-3629-431c-9818-C5679DC83E81} -- %SystemRoot%\System32\cscui.dll [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\SharingPrivate] - {08244EE6-92F0-47f2-9FC9-929BAA2E7235} -- %SystemRoot%\system32\ntshrui.dll [HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\EnhancedStorageShell] - {D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D} -- %SystemRoot%\system32\EhStorShell.dll [HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 1 (GFS Unread Stub)] - {99FD978C-D287-4F50-827F-B2C658EDA8E7} -- C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [19/12/2013 00:41:02] [HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2 (GFS Stub)] - {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} -- C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [19/12/2013 00:41:02] [HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)] - {920E6DB1-9907-4370-B3A0-BAFC03D81399} -- C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [19/12/2013 00:41:02] [HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 3 (GFS Folder)] - {16F3DD56-1AF5-4347-846D-7C10C4192619} -- C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [19/12/2013 00:41:02] [HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 4 (GFS Unread Mark)] - {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} -- C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [19/12/2013 00:41:02] [HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\SharingPrivate] - {08244EE6-92F0-47f2-9FC9-929BAA2E7235} -- %SystemRoot%\system32\ntshrui.dll [HKU\S-1-5-21-1977720525-337058645-3963175332-1000\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks] "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"= [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=Groove GFS Stub Execution Hook [HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=Groove GFS Stub Execution Hook ---------- | Toolbar [HKU\S-1-5-21-1977720525-337058645-3963175332-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "Locked"=1 "ShowDiscussionButton"=Yes [HKU\S-1-5-21-1977720525-337058645-3963175332-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser] "ITBar7Layout"=0x13000000000000000000000020000000100000000000000001000000000700005E01000006000000490100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000039358347C5D025419FA80819E2EAAC930000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 "{47833539-D0C5-4125-9FA8-0819E2EAAC93}"=0x39358347C5D025419FA80819E2EAAC93 "ITBar7Height"=0 "ITBar7Height64"=0 [HKU\S-1-5-21-1977720525-337058645-3963175332-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes] "DownloadRetries"=5 "Version"=4 "KnownProvidersUpgradeTime"=0x123CF829F2F5CE01 "UpgradeTime"=0xB57F7489DB7DD001 "DoNotAskAgain"=yahoo.com "DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A} "DefaultPackCorrection"=1 "DefaultPackNTCorrection"=1 [HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes] "DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A} [HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes] "DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A} ---------- | Extensions [HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}] : (&Envoyer à OneNote) - [] [HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}] : (Notes &liées OneNote) - [] [HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}] : (&Envoyer à OneNote) - [] [HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}] : (Notes &liées OneNote) - [] ---------- | SearchScopes [HKU\S-1-5-21-1977720525-337058645-3963175332-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}] - (Bing) - http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC : [HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}] - (@ieframe.dll,-12512) - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC : [HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}] - (@ieframe.dll,-12512) - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC : ---------- | Browser Helper Objects [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}] -> (Groove GFS Browser Helper) : C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [19/12/2013 00:41:02] [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] -> (Java(tm) Plug-In SSV Helper) : [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}] -> (avast! Online Security) : C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [12/07/2016 10:55:14] [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}] -> (Office Document Cache Handler) : C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL [06/03/2013 07:37:48] [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] -> (Java(tm) Plug-In 2 SSV Helper) : [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] -> (Aide pour le lien d'Adobe PDF Reader) : C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [23/09/2012 20:43:36] [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{326E768D-4182-46FD-9C16-1449A49795F4}] -> (DivX Plus Web Player HTML5