Publicité
Publicité
Format du document : text/plain
Prévisualisation
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:13-07-2015
Ran by enna (administrator) on ENNA-PC on 14-07-2015 16:37:13
Running from C:\Users\enna\Downloads
Loaded Profiles: enna (Available Profiles: enna)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Français (France)
Internet Explorer Version 11 (Default browser not detected!)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avast Software s.r.o.) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe
(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Windows\PLFSetI.exe
(Google Inc.) C:\Users\enna\AppData\Local\Google\Chrome\Application\chrome.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Google Inc.) C:\Users\enna\AppData\Local\Google\Chrome\Application\chrome.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Google Inc.) C:\Users\enna\AppData\Local\Google\Chrome\Application\chrome.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Avast Software s.r.o.) C:\Program Files\Alwil Software\Avast5\avastui.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Google Inc.) C:\Users\enna\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\enna\AppData\Local\Google\Chrome\Application\chrome.exe
(Avast Software s.r.o.) C:\Program Files\Alwil Software\Avast5\AvastEmUpdate.exe
(Microsoft Corporation) C:\Windows\System32\sdclt.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9636896 2009-12-01] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-18] (Synaptics Incorporated)
HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2009-12-19] ()
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1100368 2009-11-02] (Dritek System Inc.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [5515496 2015-05-12] (Avast Software s.r.o.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2015-04-10] (Oracle Corporation)
HKU\S-1-5-21-1043922925-1157543147-587559754-1001\...\Run: [Google Update] => C:\Users\enna\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2014-05-20] (Google Inc.)
HKU\S-1-5-21-1043922925-1157543147-587559754-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7404312 2015-01-20] (Piriform Ltd)
HKU\S-1-5-21-1043922925-1157543147-587559754-1001\...\Run: [GoogleChromeAutoLaunch_74AE521A6B9F77ECE435135995B71239] => C:\Users\enna\AppData\Local\Google\Chrome\Application\chrome.exe [813896 2015-07-07] (Google Inc.)
HKU\S-1-5-21-1043922925-1157543147-587559754-1001\...\MountPoints2: {85bd73f5-9587-11e0-80a4-00262d6a23fe} - F:\iStudio.exe
HKU\S-1-5-21-1043922925-1157543147-587559754-1001\...\MountPoints2: {b6afa696-b624-11e1-b744-00262d6a23fe} - "G:\WD SmartWare.exe" autoplay=true
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Alwil Software\Avast5\ashShA64.dll [2015-04-26] (Avast Software s.r.o.)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\psdprotect.dll [2009-09-11] (Egis Technology Inc.)
ShellIconOverlayIdentifiers-x32: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\psdprotect.dll [2009-09-11] (Egis Technology Inc.)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKU\S-1-5-21-1043922925-1157543147-587559754-1001\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.mystartsearch.com/web/?type=ds&ts=1431499137&z=4669f4d18ff03de238e72d2g4zac1gfz0t0tfgeg4t&from=cor&uid=WDCXWD5000BEVT-22ZAT0_WD-WX40A995582755827&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.mystartsearch.com/web/?type=ds&ts=1431499137&z=4669f4d18ff03de238e72d2g4zac1gfz0t0tfgeg4t&from=cor&uid=WDCXWD5000BEVT-22ZAT0_WD-WX40A995582755827&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.mystartsearch.com/web/?type=ds&ts=1431499137&z=4669f4d18ff03de238e72d2g4zac1gfz0t0tfgeg4t&from=cor&uid=WDCXWD5000BEVT-22ZAT0_WD-WX40A995582755827&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.mystartsearch.com/web/?type=ds&ts=1431499137&z=4669f4d18ff03de238e72d2g4zac1gfz0t0tfgeg4t&from=cor&uid=WDCXWD5000BEVT-22ZAT0_WD-WX40A995582755827&q={searchTerms}
HKU\S-1-5-21-1043922925-1157543147-587559754-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://free.fr/
HKU\S-1-5-21-1043922925-1157543147-587559754-1001\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
URLSearchHook: HKLM-x32 - (No Name) - {f4e6547e-325b-403c-a3bb-ad29ed37a92f} - No File
URLSearchHook: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 - (No Name) - {00000000-6E41-4FD3-8538-502F5495E5FC} - No File
URLSearchHook: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 - (No Name) - {f4e6547e-325b-403c-a3bb-ad29ed37a92f} - No File
SearchScopes: HKLM -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://fr.yhs4.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_clu_15_20¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dfr%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0CyEtCyB0F0EtDtCtA0C0A0DtC0CyCyCtN0D0Tzu0StCtBtByBtN1L2XzutAtFtCtDtFyCtFtCtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2SyC0Ezz0EyE0B0BzytGyC0ByEyCtG0EzzyEtDtGzzzz0F0DtGtDtDzyyCtB0DyCyBtA0BtAtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0B0C0CtAyB0CtB0AtG0AyDyEyBtGyEtC0BzytG0BtC0C0DtGzztD0FtBtByByBtBzytA0ByC2QtN0A0LzuyEtN1B2Z1V1T1S1NzuyByDyB%26cr%3D1702982389%26a%3Dwncy_clu_15_20%26os%3DWindows 7 Home Premium&p={searchTerms}
SearchScopes: HKLM-x32 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKLM-x32 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKLM-x32 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2769726
SearchScopes: HKLM-x32 -> {EEE6C360-6118-11DC-9C72-001320C79847} URL = http://search.sweetim.com/search.asp?src=6&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://fr.yhs4.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_clu_15_20¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dfr%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0CyEtCyB0F0EtDtCtA0C0A0DtC0CyCyCtN0D0Tzu0StCtBtByBtN1L2XzutAtFtCtDtFyCtFtCtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2SyC0Ezz0EyE0B0BzytGyC0ByEyCtG0EzzyEtDtGzzzz0F0DtGtDtDzyyCtB0DyCyBtA0BtAtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0B0C0CtAyB0CtB0AtG0AyDyEyBtGyEtC0BzytG0BtC0C0DtGzztD0FtBtByByBtBzytA0ByC2QtN0A0LzuyEtN1B2Z1V1T1S1NzuyByDyB%26cr%3D1702982389%26a%3Dwncy_clu_15_20%26os%3DWindows 7 Home Premium&p={searchTerms}
SearchScopes: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> 49F02F04E95C454C8B51099DFA836076 URL =
SearchScopes: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> {0633EE93-1111-472f-A0FF-E1416B8B2EAA} URL = http://www.pucuy.com/google?q={searchTerms}&sa=Search&cx=partner-pub-3546861938806019:fn51rv5o9ne&cof=FORID%3A10&ie=UTF-8&hl=fr
SearchScopes: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=2B323DA1-E26C-459A-9F72-33FE0C091A41&apn_sauid=9B1702B8-286B-40E8-AC38-B2BD35B9DC19
SearchScopes: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> {2f23ab71-4ac6-41f2-a955-ea576e553146} URL =
SearchScopes: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> {57716D74-024B-40D7-B48C-04DF238DBCEA} URL = https://fr.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=994519&p={searchTerms}
SearchScopes: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://fr.yhs4.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_clu_15_20¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dfr%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0CyEtCyB0F0EtDtCtA0C0A0DtC0CyCyCtN0D0Tzu0StCtBtByBtN1L2XzutAtFtCtDtFyCtFtCtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2SyC0Ezz0EyE0B0BzytGyC0ByEyCtG0EzzyEtDtGzzzz0F0DtGtDtDzyyCtB0DyCyBtA0BtAtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0B0C0CtAyB0CtB0AtG0AyDyEyBtGyEtC0BzytG0BtC0C0DtGzztD0FtBtByByBtBzytA0ByC2QtN0A0LzuyEtN1B2Z1V1T1S1NzuyByDyB%26cr%3D1702982389%26a%3Dwncy_clu_15_20%26os%3DWindows 7 Home Premium&p={searchTerms}
SearchScopes: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2769726
SearchScopes: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> {b41306c6-96d0-442a-bcc4-b0f621e82ce9} URL = http://www.fissa.com/fr/results/?s=b&c=1008164009&suid=EjfQDcmYb&d=6&pid=30&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> {EEE6C360-6118-11DC-9C72-001320C79847} URL = http://search.sweetim.com/search.asp?src=6&q={searchTerms}
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll [2015-04-26] (Avast Software s.r.o.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: No Name -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> No File
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2015-06-02] (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll [2015-04-26] (Avast Software s.r.o.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Ask Toolbar -> {D4027C7F-154A-4066-A1AD-4243D8127440} -> No File
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2015-06-02] (Oracle Corporation)
BHO-x32: No Name -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> No File
BHO-x32: No Name -> {f439aa7e-a2a0-4635-99a2-164180e848ca} -> No File
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM-x32 - No Name - {f4e6547e-325b-403c-a3bb-ad29ed37a92f} - No File
Toolbar: HKLM-x32 - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
Toolbar: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> No Name - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - No File
Toolbar: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
Toolbar: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> No Name - {472734EA-242A-422B-ADF8-83D1E48CC825} - No File
Toolbar: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> No Name - {F4E6547E-325B-403C-A3BB-AD29ED37A92F} - No File
Toolbar: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> No Name - {30F9B915-B755-4826-820B-08FBA6BD249D} - No File
Toolbar: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> No Name - {EEE6C35B-6118-11DC-9C72-001320C79847} - No File
Toolbar: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> No Name - {977AE9CC-AF83-45E8-9E03-E2798216E2D5} - No File
DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} http://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - No File
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.0.254
Tcpip\..\Interfaces\{A0128201-9DF2-4A06-8B45-1A897AD9E7C4}: [DhcpNameServer] 192.168.0.254
Tcpip\..\Interfaces\{BF223E5F-D318-4AEC-8FA2-8DD3ECDFFB2A}: [DhcpNameServer] 192.168.0.254
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
FireFox:
========
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
FF Plugin-x32: @java.com/DTPlugin,version=10.80.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2015-06-02] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.80.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2015-06-02] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-04-17] (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2013-07-31] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2013-09-26] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1043922925-1157543147-587559754-1001: @tools.google.com/Google Update;version=3 -> C:\Users\enna\AppData\Local\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-21] (Google Inc.)
FF Plugin HKU\S-1-5-21-1043922925-1157543147-587559754-1001: @tools.google.com/Google Update;version=9 -> C:\Users\enna\AppData\Local\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-21] (Google Inc.)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Alwil Software\Avast5\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-02-28]
Chrome:
=======
CHR Profile: C:\Users\enna\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\enna\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-02-26]
CHR Extension: (YouTube) - C:\Users\enna\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-02-26]
CHR Extension: (Google Search) - C:\Users\enna\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-02-26]
CHR Extension: (Avast Online Security) - C:\Users\enna\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2013-05-30]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\enna\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-19]
CHR Extension: (iLivid) - C:\Users\enna\AppData\Local\Google\Chrome\User Data\Default\Extensions\nafaimnnclfjfedmmabolbppcngeolgf [2015-06-15]
CHR Extension: (Google Wallet) - C:\Users\enna\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-15]
CHR Extension: (Gmail) - C:\Users\enna\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-02-26]
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\Alwil Software\Avast5\WebRep\Chrome\aswwebrepchrome-sp.crx [2014-08-19]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\Alwil Software\Avast5\WebRep\Chrome\aswWebRepChrome.crx [2015-04-26]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [343336 2015-04-26] (Avast Software s.r.o.)
S3 Boonty Games; C:\Program Files (x86)\Common Files\BOONTY Shared\Service\Boonty.exe [69120 2011-02-09] (BOONTY) [File not signed]
R2 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-11] (Egis Technology Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-04-26] ()
R1 aswKbd; C:\Windows\System32\Drivers\aswKbd.sys [28504 2012-03-07] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [89944 2015-04-26] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-04-26] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-04-26] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-04-26] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-06-27] (Avast Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [137288 2015-04-26] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [272248 2015-04-26] ()
R3 hidshim; C:\Windows\System32\DRIVERS\hidshim.sys [6656 2009-07-21] (Windows (R) Win 7 DDK provider)
R3 nuvotonhidgeneric; C:\Windows\System32\DRIVERS\nuvotonhidgeneric.sys [25088 2009-07-21] (Nuvoton Technology Corporation)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [52736 2012-07-09] (Apple, Inc.) [File not signed]
S3 RSUSBSTOR; System32\Drivers\RtsUStor.sys [X]
S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [X]
S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-14 16:37 - 2015-07-14 16:43 - 00021447 _____ C:\Users\enna\Downloads\FRST.txt
2015-07-14 16:35 - 2015-07-14 16:37 - 00000000 ___DC C:\FRST
2015-07-14 16:34 - 2015-07-14 16:35 - 02133504 _____ (Farbar) C:\Users\enna\Downloads\FRST64.exe
2015-07-13 17:50 - 2015-07-13 17:50 - 00067319 _____ C:\Users\enna\Downloads\Trailer.Park.Boys.The.Movie.2006.FRENCH.1080p.BluRay.x264-DOUCHEBAGS.mkv.torrent
2015-07-13 17:45 - 2015-07-13 15:20 - 733937669 _____ C:\Users\enna\Desktop\Pourquoi.Jai.Pas.Mange.Mon.Pere.2015.FRENCH.DVDRiP.XViD-AViTECH - Copie.avi
2015-07-13 16:56 - 2015-07-13 16:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-07-13 16:55 - 2015-06-27 12:45 - 00442264 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\asw7DCC.tmp
2015-07-13 16:55 - 2015-04-26 09:27 - 00364472 _____ (Avast Software s.r.o.) C:\Windows\system32\aswBoot.exe
2015-07-13 16:55 - 2015-04-26 09:27 - 00272248 _____ C:\Windows\system32\Drivers\asw7F72.tmp
2015-07-13 16:55 - 2015-04-26 09:27 - 00137288 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\asw80BA.tmp
2015-07-13 16:55 - 2015-04-26 09:27 - 00093528 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\asw783C.tmp
2015-07-13 16:55 - 2015-04-26 09:27 - 00089944 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\asw7B4A.tmp
2015-07-13 16:55 - 2015-04-26 09:27 - 00065736 _____ C:\Windows\system32\Drivers\asw7C83.tmp
2015-07-13 16:55 - 2015-04-26 09:27 - 00029168 _____ C:\Windows\system32\Drivers\asw79C3.tmp
2015-07-13 16:55 - 2015-04-26 09:26 - 01047320 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\asw7261.tmp
2015-07-13 16:14 - 2015-07-13 16:49 - 00000000 ____D C:\Users\enna\Desktop\ratio
2015-07-13 10:20 - 2015-07-13 10:20 - 00202227 _____ C:\Users\enna\Downloads\ratiomaster-1.9.1 (1).zip
2015-07-13 09:00 - 2015-07-13 16:49 - 00000000 ____D C:\Users\enna\AppData\Roaming\dvdcss
2015-07-13 08:37 - 2015-07-13 08:37 - 00000000 ____D C:\Users\enna\Desktop\Still.Alice.2014.NTSC.MULTi.DVDR-ALBOY
2015-07-13 08:26 - 2015-07-13 08:26 - 00000000 ____D C:\Users\enna\Desktop\diversion 2015 NTSC MULTi DVDR-hamidvd
2015-07-09 17:56 - 2015-07-09 17:56 - 00000000 ____D C:\Users\enna\AppData\Roaming\Opera Software
2015-07-09 17:56 - 2015-07-09 17:56 - 00000000 ____D C:\Users\enna\AppData\Local\Opera Software
2015-07-09 17:54 - 2015-07-14 16:29 - 00000276 _____ C:\Windows\Tasks\PC-Mechanic Subscription.job
2015-07-09 17:54 - 2015-07-14 16:29 - 00000270 _____ C:\Windows\Tasks\PC-Mechanic Startup.job
2015-07-09 17:54 - 2015-07-14 16:25 - 00000276 _____ C:\Windows\Tasks\PC-Mechanic Maintenance.job
2015-07-09 17:54 - 2015-07-13 16:49 - 00000000 ____D C:\Users\enna\AppData\Roaming\Uniblue
2015-07-09 17:54 - 2015-07-13 16:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uniblue
2015-07-09 17:54 - 2015-07-13 16:49 - 00000000 ____D C:\Program Files (x86)\Uniblue
2015-07-09 17:54 - 2015-07-09 17:58 - 00000000 ____D C:\Program Files (x86)\Opera
2015-07-09 17:54 - 2015-07-09 17:54 - 00003210 _____ C:\Windows\System32\Tasks\PC-Mechanic Maintenance
2015-07-09 17:54 - 2015-07-09 17:54 - 00002564 _____ C:\Windows\System32\Tasks\PC-Mechanic Subscription
2015-07-09 17:54 - 2015-07-09 17:54 - 00002498 _____ C:\Windows\System32\Tasks\PC-Mechanic Startup
2015-07-09 17:52 - 2015-07-13 16:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WajIEn
2015-07-09 17:52 - 2015-07-13 16:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2015-07-09 17:52 - 2015-07-09 17:52 - 00001245 _____ C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk
2015-07-09 17:52 - 2015-07-09 17:52 - 00001177 _____ C:\Users\Public\Desktop\Free YouTube Download.lnk
2015-07-09 17:51 - 2015-07-09 17:51 - 00000000 ____D C:\Users\enna\AppData\Roaming\RPEng
2015-07-09 17:51 - 2015-07-09 17:51 - 00000000 ____D C:\Program Files (x86)\FreeCodecPack
2015-07-09 17:49 - 2015-07-09 17:53 - 00000000 ____D C:\Users\enna\AppData\Roaming\DVDVideoSoft
2015-07-09 17:48 - 2015-07-09 17:49 - 34800832 _____ (DVDVideoSoft Ltd. ) C:\Users\enna\Downloads\FreeYouTubeDownload-3.2.59.616.exe
2015-07-09 17:44 - 2015-07-09 17:46 - 06260480 _____ (DVDVideoSoft Ltd. ) C:\Users\enna\Downloads\FreeYouTubeDownload.exe
2015-07-09 17:21 - 2015-07-09 17:22 - 00384384 _____ C:\Users\enna\Downloads\SaveFromNetHelper-Web-ce2cc77c13.exe
2015-06-29 08:27 - 2015-06-29 08:27 - 00000000 ____D C:\Program Files\Common Files\DESIGNER
2015-06-19 08:13 - 2015-06-19 08:13 - 00000000 ____D C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform
2015-06-19 08:11 - 2015-06-19 08:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SharePoint
2015-06-19 08:11 - 2015-06-19 08:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2015-06-19 08:09 - 2015-06-19 08:09 - 00000000 ____D C:\Program Files\Microsoft Synchronization Services
2015-06-19 08:09 - 2015-06-19 08:09 - 00000000 ____D C:\Program Files\Microsoft Sync Framework
2015-06-19 08:09 - 2015-06-19 08:09 - 00000000 ____D C:\Program Files\Microsoft SQL Server Compact Edition
2015-06-19 08:04 - 2015-06-19 08:04 - 00000000 ____D C:\Program Files\Microsoft Analysis Services
2015-06-19 08:04 - 2015-06-19 08:04 - 00000000 ____D C:\Program Files (x86)\Microsoft Analysis Services
2015-06-19 08:02 - 2015-06-19 08:02 - 00000000 _RHDC C:\MSOCache
2015-06-18 17:54 - 2015-06-25 17:23 - 00003754 _____ C:\Windows\PFRO.log
2015-06-14 17:01 - 2015-07-10 17:23 - 00000000 ____D C:\Users\enna\Desktop\films LOLO
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-14 16:43 - 2009-12-19 00:26 - 01085514 _____ C:\Windows\WindowsUpdate.log
2015-07-14 16:42 - 2014-05-20 17:33 - 00001074 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1043922925-1157543147-587559754-1001UA.job
2015-07-14 16:38 - 2009-07-14 06:45 - 00025840 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-07-14 16:38 - 2009-07-14 06:45 - 00025840 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-07-14 16:29 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-14 16:28 - 2015-05-13 14:50 - 00002348 _____ C:\Windows\setupact.log
2015-07-14 08:45 - 2013-06-22 09:40 - 00000000 ____D C:\Users\enna\AppData\Roaming\Azureus
2015-07-14 08:42 - 2014-05-20 17:33 - 00001022 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1043922925-1157543147-587559754-1001Core.job
2015-07-13 17:14 - 2010-07-22 18:52 - 00000000 ____D C:\Users\enna
2015-07-13 17:13 - 2015-04-06 12:32 - 00000000 ___SD C:\Windows\system32\GWX
2015-07-13 17:13 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2015-07-13 16:55 - 2012-07-06 12:12 - 00003926 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2015-07-13 16:49 - 2013-11-29 18:55 - 00000000 ____D C:\Users\enna\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-07-13 16:49 - 2011-01-30 18:33 - 00000000 ____D C:\Users\enna\AppData\Roaming\vlc
2015-07-12 08:53 - 2012-05-07 17:37 - 00000000 ____D C:\ProgramData\Meridian93
2015-07-12 08:52 - 2010-11-28 16:02 - 00000000 ____D C:\Users\enna\AppData\Roaming\Meridian93
2015-07-09 17:51 - 2012-12-24 09:49 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-06-29 16:51 - 2009-10-29 07:45 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-06-29 08:18 - 2009-07-14 04:34 - 00000510 _____ C:\Windows\win.ini
2015-06-27 17:20 - 2012-06-08 13:11 - 00000000 ____D C:\Users\enna\AppData\Roaming\Mad Head Games
2015-06-27 17:20 - 2009-12-19 00:33 - 00000000 ____D C:\ProgramData\Temp
2015-06-27 16:36 - 2009-12-19 09:19 - 00747910 _____ C:\Windows\system32\perfh00C.dat
2015-06-27 16:36 - 2009-12-19 09:19 - 00150402 _____ C:\Windows\system32\perfc00C.dat
2015-06-27 16:36 - 2009-07-14 07:13 - 01669656 _____ C:\Windows\system32\PerfStringBackup.INI
2015-06-27 12:45 - 2010-09-18 19:16 - 00442264 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSP.sys
2015-06-25 17:53 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\System
2015-06-25 17:27 - 2014-06-29 11:33 - 00039424 ___SH C:\Users\enna\Documents\Thumbs.db
2015-06-25 17:23 - 2009-07-14 06:45 - 00418432 _____ C:\Windows\system32\FNTCACHE.DAT
2015-06-23 13:30 - 2010-07-23 05:55 - 00300704 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-06-19 08:48 - 2010-07-22 18:52 - 00111272 _____ C:\Users\enna\AppData\Local\GDIPFONTCACHEV1.DAT
2015-06-19 08:10 - 2009-10-28 20:00 - 00000000 ____D C:\Windows\ShellNew
2015-06-19 08:10 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2015-06-19 08:09 - 2009-10-29 07:46 - 00000000 ____D C:\Program Files\Microsoft Office
2015-06-19 08:09 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\MSBuild
2015-06-19 07:36 - 2013-06-22 09:40 - 00001758 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vuze.lnk
2015-06-19 07:36 - 2013-06-22 09:40 - 00000000 ____D C:\Program Files\Vuze
2015-06-16 16:20 - 2010-11-18 17:18 - 00000000 ____D C:\Users\enna\AppData\Roaming\EleFun Games
2015-06-16 11:28 - 2009-07-14 07:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2015-06-14 17:04 - 2013-11-11 17:23 - 00159232 ___SH C:\Users\enna\Desktop\Thumbs.db
==================== Files in the root of some directories =======
2009-10-29 07:58 - 2009-02-10 21:23 - 0192484 _____ () C:\Program Files (x86)\Common Files\Acer GameZone online.ico
2014-07-14 18:38 - 2014-07-14 18:46 - 0001286 _____ () C:\Users\enna\AppData\Roaming\Bubble Dock.boostrap.log
2014-07-14 18:42 - 2014-07-14 18:46 - 0009027 _____ () C:\Users\enna\AppData\Roaming\Bubble Dock.installation.log
2006-01-01 00:53 - 2012-02-20 08:59 - 0200095 ____H () C:\Users\enna\AppData\Roaming\ennalog.dat
2010-10-16 10:51 - 2010-10-16 14:59 - 0000523 _____ () C:\Users\enna\AppData\Roaming\prefsdb.dat
2010-07-23 16:23 - 2012-04-09 14:59 - 0000176 _____ () C:\Users\enna\AppData\Roaming\wklnhst.dat
2013-11-29 18:04 - 2013-11-29 18:04 - 0351124 _____ () C:\Users\enna\AppData\Local\mysearchdial-speeddial.crx
2013-11-30 11:40 - 2013-11-30 11:40 - 0000057 _____ () C:\ProgramData\Ament.ini
2009-12-19 00:33 - 2009-12-19 00:38 - 0007817 _____ () C:\ProgramData\ArcadeDeluxe3.log
2010-09-06 12:45 - 2010-12-23 12:47 - 0003404 _____ () C:\ProgramData\dscrane_save.log
2009-10-29 07:58 - 2009-07-18 03:57 - 0036136 _____ (Oberon Media) C:\ProgramData\FullRemove.exe
2011-11-07 19:24 - 2012-02-08 19:17 - 0008159 _____ () C:\ProgramData\log.txt
2011-11-07 19:45 - 2012-02-08 19:17 - 0000230 _____ () C:\ProgramData\settings.xml
Some files in TEMP:
====================
C:\Users\enna\AppData\Local\Temp\i4jdel0.exe
C:\Users\enna\AppData\Local\Temp\i4jdel1.exe
C:\Users\enna\AppData\Local\Temp\tmp29DD.exe
C:\Users\enna\AppData\Local\Temp\Uni000.exe
C:\Users\enna\AppData\Local\Temp\y-d4xlqn.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-07-13 09:37
==================== End of log ============================
Ran by enna (administrator) on ENNA-PC on 14-07-2015 16:37:13
Running from C:\Users\enna\Downloads
Loaded Profiles: enna (Available Profiles: enna)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Français (France)
Internet Explorer Version 11 (Default browser not detected!)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avast Software s.r.o.) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe
(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Windows\PLFSetI.exe
(Google Inc.) C:\Users\enna\AppData\Local\Google\Chrome\Application\chrome.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Google Inc.) C:\Users\enna\AppData\Local\Google\Chrome\Application\chrome.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Google Inc.) C:\Users\enna\AppData\Local\Google\Chrome\Application\chrome.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Avast Software s.r.o.) C:\Program Files\Alwil Software\Avast5\avastui.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Google Inc.) C:\Users\enna\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\enna\AppData\Local\Google\Chrome\Application\chrome.exe
(Avast Software s.r.o.) C:\Program Files\Alwil Software\Avast5\AvastEmUpdate.exe
(Microsoft Corporation) C:\Windows\System32\sdclt.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9636896 2009-12-01] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-18] (Synaptics Incorporated)
HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2009-12-19] ()
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1100368 2009-11-02] (Dritek System Inc.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [5515496 2015-05-12] (Avast Software s.r.o.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2015-04-10] (Oracle Corporation)
HKU\S-1-5-21-1043922925-1157543147-587559754-1001\...\Run: [Google Update] => C:\Users\enna\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2014-05-20] (Google Inc.)
HKU\S-1-5-21-1043922925-1157543147-587559754-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7404312 2015-01-20] (Piriform Ltd)
HKU\S-1-5-21-1043922925-1157543147-587559754-1001\...\Run: [GoogleChromeAutoLaunch_74AE521A6B9F77ECE435135995B71239] => C:\Users\enna\AppData\Local\Google\Chrome\Application\chrome.exe [813896 2015-07-07] (Google Inc.)
HKU\S-1-5-21-1043922925-1157543147-587559754-1001\...\MountPoints2: {85bd73f5-9587-11e0-80a4-00262d6a23fe} - F:\iStudio.exe
HKU\S-1-5-21-1043922925-1157543147-587559754-1001\...\MountPoints2: {b6afa696-b624-11e1-b744-00262d6a23fe} - "G:\WD SmartWare.exe" autoplay=true
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Alwil Software\Avast5\ashShA64.dll [2015-04-26] (Avast Software s.r.o.)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\psdprotect.dll [2009-09-11] (Egis Technology Inc.)
ShellIconOverlayIdentifiers-x32: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\psdprotect.dll [2009-09-11] (Egis Technology Inc.)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKU\S-1-5-21-1043922925-1157543147-587559754-1001\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.mystartsearch.com/web/?type=ds&ts=1431499137&z=4669f4d18ff03de238e72d2g4zac1gfz0t0tfgeg4t&from=cor&uid=WDCXWD5000BEVT-22ZAT0_WD-WX40A995582755827&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.mystartsearch.com/web/?type=ds&ts=1431499137&z=4669f4d18ff03de238e72d2g4zac1gfz0t0tfgeg4t&from=cor&uid=WDCXWD5000BEVT-22ZAT0_WD-WX40A995582755827&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.mystartsearch.com/web/?type=ds&ts=1431499137&z=4669f4d18ff03de238e72d2g4zac1gfz0t0tfgeg4t&from=cor&uid=WDCXWD5000BEVT-22ZAT0_WD-WX40A995582755827&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.mystartsearch.com/web/?type=ds&ts=1431499137&z=4669f4d18ff03de238e72d2g4zac1gfz0t0tfgeg4t&from=cor&uid=WDCXWD5000BEVT-22ZAT0_WD-WX40A995582755827&q={searchTerms}
HKU\S-1-5-21-1043922925-1157543147-587559754-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://free.fr/
HKU\S-1-5-21-1043922925-1157543147-587559754-1001\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
URLSearchHook: HKLM-x32 - (No Name) - {f4e6547e-325b-403c-a3bb-ad29ed37a92f} - No File
URLSearchHook: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 - (No Name) - {00000000-6E41-4FD3-8538-502F5495E5FC} - No File
URLSearchHook: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 - (No Name) - {f4e6547e-325b-403c-a3bb-ad29ed37a92f} - No File
SearchScopes: HKLM -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://fr.yhs4.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_clu_15_20¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dfr%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0CyEtCyB0F0EtDtCtA0C0A0DtC0CyCyCtN0D0Tzu0StCtBtByBtN1L2XzutAtFtCtDtFyCtFtCtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2SyC0Ezz0EyE0B0BzytGyC0ByEyCtG0EzzyEtDtGzzzz0F0DtGtDtDzyyCtB0DyCyBtA0BtAtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0B0C0CtAyB0CtB0AtG0AyDyEyBtGyEtC0BzytG0BtC0C0DtGzztD0FtBtByByBtBzytA0ByC2QtN0A0LzuyEtN1B2Z1V1T1S1NzuyByDyB%26cr%3D1702982389%26a%3Dwncy_clu_15_20%26os%3DWindows 7 Home Premium&p={searchTerms}
SearchScopes: HKLM-x32 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKLM-x32 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKLM-x32 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2769726
SearchScopes: HKLM-x32 -> {EEE6C360-6118-11DC-9C72-001320C79847} URL = http://search.sweetim.com/search.asp?src=6&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://fr.yhs4.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_clu_15_20¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dfr%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0CyEtCyB0F0EtDtCtA0C0A0DtC0CyCyCtN0D0Tzu0StCtBtByBtN1L2XzutAtFtCtDtFyCtFtCtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2SyC0Ezz0EyE0B0BzytGyC0ByEyCtG0EzzyEtDtGzzzz0F0DtGtDtDzyyCtB0DyCyBtA0BtAtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0B0C0CtAyB0CtB0AtG0AyDyEyBtGyEtC0BzytG0BtC0C0DtGzztD0FtBtByByBtBzytA0ByC2QtN0A0LzuyEtN1B2Z1V1T1S1NzuyByDyB%26cr%3D1702982389%26a%3Dwncy_clu_15_20%26os%3DWindows 7 Home Premium&p={searchTerms}
SearchScopes: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> 49F02F04E95C454C8B51099DFA836076 URL =
SearchScopes: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> {0633EE93-1111-472f-A0FF-E1416B8B2EAA} URL = http://www.pucuy.com/google?q={searchTerms}&sa=Search&cx=partner-pub-3546861938806019:fn51rv5o9ne&cof=FORID%3A10&ie=UTF-8&hl=fr
SearchScopes: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=2B323DA1-E26C-459A-9F72-33FE0C091A41&apn_sauid=9B1702B8-286B-40E8-AC38-B2BD35B9DC19
SearchScopes: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> {2f23ab71-4ac6-41f2-a955-ea576e553146} URL =
SearchScopes: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> {57716D74-024B-40D7-B48C-04DF238DBCEA} URL = https://fr.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=994519&p={searchTerms}
SearchScopes: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://fr.yhs4.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_clu_15_20¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dfr%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0CyEtCyB0F0EtDtCtA0C0A0DtC0CyCyCtN0D0Tzu0StCtBtByBtN1L2XzutAtFtCtDtFyCtFtCtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2SyC0Ezz0EyE0B0BzytGyC0ByEyCtG0EzzyEtDtGzzzz0F0DtGtDtDzyyCtB0DyCyBtA0BtAtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0B0C0CtAyB0CtB0AtG0AyDyEyBtGyEtC0BzytG0BtC0C0DtGzztD0FtBtByByBtBzytA0ByC2QtN0A0LzuyEtN1B2Z1V1T1S1NzuyByDyB%26cr%3D1702982389%26a%3Dwncy_clu_15_20%26os%3DWindows 7 Home Premium&p={searchTerms}
SearchScopes: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2769726
SearchScopes: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> {b41306c6-96d0-442a-bcc4-b0f621e82ce9} URL = http://www.fissa.com/fr/results/?s=b&c=1008164009&suid=EjfQDcmYb&d=6&pid=30&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> {EEE6C360-6118-11DC-9C72-001320C79847} URL = http://search.sweetim.com/search.asp?src=6&q={searchTerms}
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll [2015-04-26] (Avast Software s.r.o.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: No Name -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> No File
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2015-06-02] (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll [2015-04-26] (Avast Software s.r.o.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Ask Toolbar -> {D4027C7F-154A-4066-A1AD-4243D8127440} -> No File
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2015-06-02] (Oracle Corporation)
BHO-x32: No Name -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> No File
BHO-x32: No Name -> {f439aa7e-a2a0-4635-99a2-164180e848ca} -> No File
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM-x32 - No Name - {f4e6547e-325b-403c-a3bb-ad29ed37a92f} - No File
Toolbar: HKLM-x32 - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
Toolbar: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> No Name - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - No File
Toolbar: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
Toolbar: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> No Name - {472734EA-242A-422B-ADF8-83D1E48CC825} - No File
Toolbar: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> No Name - {F4E6547E-325B-403C-A3BB-AD29ED37A92F} - No File
Toolbar: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> No Name - {30F9B915-B755-4826-820B-08FBA6BD249D} - No File
Toolbar: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> No Name - {EEE6C35B-6118-11DC-9C72-001320C79847} - No File
Toolbar: HKU\S-1-5-21-1043922925-1157543147-587559754-1001 -> No Name - {977AE9CC-AF83-45E8-9E03-E2798216E2D5} - No File
DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} http://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - No File
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.0.254
Tcpip\..\Interfaces\{A0128201-9DF2-4A06-8B45-1A897AD9E7C4}: [DhcpNameServer] 192.168.0.254
Tcpip\..\Interfaces\{BF223E5F-D318-4AEC-8FA2-8DD3ECDFFB2A}: [DhcpNameServer] 192.168.0.254
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
FireFox:
========
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
FF Plugin-x32: @java.com/DTPlugin,version=10.80.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2015-06-02] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.80.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2015-06-02] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-04-17] (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2013-07-31] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2013-09-26] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1043922925-1157543147-587559754-1001: @tools.google.com/Google Update;version=3 -> C:\Users\enna\AppData\Local\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-21] (Google Inc.)
FF Plugin HKU\S-1-5-21-1043922925-1157543147-587559754-1001: @tools.google.com/Google Update;version=9 -> C:\Users\enna\AppData\Local\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-21] (Google Inc.)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Alwil Software\Avast5\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-02-28]
Chrome:
=======
CHR Profile: C:\Users\enna\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\enna\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-02-26]
CHR Extension: (YouTube) - C:\Users\enna\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-02-26]
CHR Extension: (Google Search) - C:\Users\enna\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-02-26]
CHR Extension: (Avast Online Security) - C:\Users\enna\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2013-05-30]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\enna\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-19]
CHR Extension: (iLivid) - C:\Users\enna\AppData\Local\Google\Chrome\User Data\Default\Extensions\nafaimnnclfjfedmmabolbppcngeolgf [2015-06-15]
CHR Extension: (Google Wallet) - C:\Users\enna\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-15]
CHR Extension: (Gmail) - C:\Users\enna\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-02-26]
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\Alwil Software\Avast5\WebRep\Chrome\aswwebrepchrome-sp.crx [2014-08-19]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\Alwil Software\Avast5\WebRep\Chrome\aswWebRepChrome.crx [2015-04-26]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [343336 2015-04-26] (Avast Software s.r.o.)
S3 Boonty Games; C:\Program Files (x86)\Common Files\BOONTY Shared\Service\Boonty.exe [69120 2011-02-09] (BOONTY) [File not signed]
R2 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-11] (Egis Technology Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-04-26] ()
R1 aswKbd; C:\Windows\System32\Drivers\aswKbd.sys [28504 2012-03-07] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [89944 2015-04-26] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-04-26] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-04-26] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-04-26] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-06-27] (Avast Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [137288 2015-04-26] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [272248 2015-04-26] ()
R3 hidshim; C:\Windows\System32\DRIVERS\hidshim.sys [6656 2009-07-21] (Windows (R) Win 7 DDK provider)
R3 nuvotonhidgeneric; C:\Windows\System32\DRIVERS\nuvotonhidgeneric.sys [25088 2009-07-21] (Nuvoton Technology Corporation)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [52736 2012-07-09] (Apple, Inc.) [File not signed]
S3 RSUSBSTOR; System32\Drivers\RtsUStor.sys [X]
S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [X]
S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-14 16:37 - 2015-07-14 16:43 - 00021447 _____ C:\Users\enna\Downloads\FRST.txt
2015-07-14 16:35 - 2015-07-14 16:37 - 00000000 ___DC C:\FRST
2015-07-14 16:34 - 2015-07-14 16:35 - 02133504 _____ (Farbar) C:\Users\enna\Downloads\FRST64.exe
2015-07-13 17:50 - 2015-07-13 17:50 - 00067319 _____ C:\Users\enna\Downloads\Trailer.Park.Boys.The.Movie.2006.FRENCH.1080p.BluRay.x264-DOUCHEBAGS.mkv.torrent
2015-07-13 17:45 - 2015-07-13 15:20 - 733937669 _____ C:\Users\enna\Desktop\Pourquoi.Jai.Pas.Mange.Mon.Pere.2015.FRENCH.DVDRiP.XViD-AViTECH - Copie.avi
2015-07-13 16:56 - 2015-07-13 16:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-07-13 16:55 - 2015-06-27 12:45 - 00442264 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\asw7DCC.tmp
2015-07-13 16:55 - 2015-04-26 09:27 - 00364472 _____ (Avast Software s.r.o.) C:\Windows\system32\aswBoot.exe
2015-07-13 16:55 - 2015-04-26 09:27 - 00272248 _____ C:\Windows\system32\Drivers\asw7F72.tmp
2015-07-13 16:55 - 2015-04-26 09:27 - 00137288 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\asw80BA.tmp
2015-07-13 16:55 - 2015-04-26 09:27 - 00093528 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\asw783C.tmp
2015-07-13 16:55 - 2015-04-26 09:27 - 00089944 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\asw7B4A.tmp
2015-07-13 16:55 - 2015-04-26 09:27 - 00065736 _____ C:\Windows\system32\Drivers\asw7C83.tmp
2015-07-13 16:55 - 2015-04-26 09:27 - 00029168 _____ C:\Windows\system32\Drivers\asw79C3.tmp
2015-07-13 16:55 - 2015-04-26 09:26 - 01047320 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\asw7261.tmp
2015-07-13 16:14 - 2015-07-13 16:49 - 00000000 ____D C:\Users\enna\Desktop\ratio
2015-07-13 10:20 - 2015-07-13 10:20 - 00202227 _____ C:\Users\enna\Downloads\ratiomaster-1.9.1 (1).zip
2015-07-13 09:00 - 2015-07-13 16:49 - 00000000 ____D C:\Users\enna\AppData\Roaming\dvdcss
2015-07-13 08:37 - 2015-07-13 08:37 - 00000000 ____D C:\Users\enna\Desktop\Still.Alice.2014.NTSC.MULTi.DVDR-ALBOY
2015-07-13 08:26 - 2015-07-13 08:26 - 00000000 ____D C:\Users\enna\Desktop\diversion 2015 NTSC MULTi DVDR-hamidvd
2015-07-09 17:56 - 2015-07-09 17:56 - 00000000 ____D C:\Users\enna\AppData\Roaming\Opera Software
2015-07-09 17:56 - 2015-07-09 17:56 - 00000000 ____D C:\Users\enna\AppData\Local\Opera Software
2015-07-09 17:54 - 2015-07-14 16:29 - 00000276 _____ C:\Windows\Tasks\PC-Mechanic Subscription.job
2015-07-09 17:54 - 2015-07-14 16:29 - 00000270 _____ C:\Windows\Tasks\PC-Mechanic Startup.job
2015-07-09 17:54 - 2015-07-14 16:25 - 00000276 _____ C:\Windows\Tasks\PC-Mechanic Maintenance.job
2015-07-09 17:54 - 2015-07-13 16:49 - 00000000 ____D C:\Users\enna\AppData\Roaming\Uniblue
2015-07-09 17:54 - 2015-07-13 16:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uniblue
2015-07-09 17:54 - 2015-07-13 16:49 - 00000000 ____D C:\Program Files (x86)\Uniblue
2015-07-09 17:54 - 2015-07-09 17:58 - 00000000 ____D C:\Program Files (x86)\Opera
2015-07-09 17:54 - 2015-07-09 17:54 - 00003210 _____ C:\Windows\System32\Tasks\PC-Mechanic Maintenance
2015-07-09 17:54 - 2015-07-09 17:54 - 00002564 _____ C:\Windows\System32\Tasks\PC-Mechanic Subscription
2015-07-09 17:54 - 2015-07-09 17:54 - 00002498 _____ C:\Windows\System32\Tasks\PC-Mechanic Startup
2015-07-09 17:52 - 2015-07-13 16:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WajIEn
2015-07-09 17:52 - 2015-07-13 16:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2015-07-09 17:52 - 2015-07-09 17:52 - 00001245 _____ C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk
2015-07-09 17:52 - 2015-07-09 17:52 - 00001177 _____ C:\Users\Public\Desktop\Free YouTube Download.lnk
2015-07-09 17:51 - 2015-07-09 17:51 - 00000000 ____D C:\Users\enna\AppData\Roaming\RPEng
2015-07-09 17:51 - 2015-07-09 17:51 - 00000000 ____D C:\Program Files (x86)\FreeCodecPack
2015-07-09 17:49 - 2015-07-09 17:53 - 00000000 ____D C:\Users\enna\AppData\Roaming\DVDVideoSoft
2015-07-09 17:48 - 2015-07-09 17:49 - 34800832 _____ (DVDVideoSoft Ltd. ) C:\Users\enna\Downloads\FreeYouTubeDownload-3.2.59.616.exe
2015-07-09 17:44 - 2015-07-09 17:46 - 06260480 _____ (DVDVideoSoft Ltd. ) C:\Users\enna\Downloads\FreeYouTubeDownload.exe
2015-07-09 17:21 - 2015-07-09 17:22 - 00384384 _____ C:\Users\enna\Downloads\SaveFromNetHelper-Web-ce2cc77c13.exe
2015-06-29 08:27 - 2015-06-29 08:27 - 00000000 ____D C:\Program Files\Common Files\DESIGNER
2015-06-19 08:13 - 2015-06-19 08:13 - 00000000 ____D C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform
2015-06-19 08:11 - 2015-06-19 08:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SharePoint
2015-06-19 08:11 - 2015-06-19 08:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2015-06-19 08:09 - 2015-06-19 08:09 - 00000000 ____D C:\Program Files\Microsoft Synchronization Services
2015-06-19 08:09 - 2015-06-19 08:09 - 00000000 ____D C:\Program Files\Microsoft Sync Framework
2015-06-19 08:09 - 2015-06-19 08:09 - 00000000 ____D C:\Program Files\Microsoft SQL Server Compact Edition
2015-06-19 08:04 - 2015-06-19 08:04 - 00000000 ____D C:\Program Files\Microsoft Analysis Services
2015-06-19 08:04 - 2015-06-19 08:04 - 00000000 ____D C:\Program Files (x86)\Microsoft Analysis Services
2015-06-19 08:02 - 2015-06-19 08:02 - 00000000 _RHDC C:\MSOCache
2015-06-18 17:54 - 2015-06-25 17:23 - 00003754 _____ C:\Windows\PFRO.log
2015-06-14 17:01 - 2015-07-10 17:23 - 00000000 ____D C:\Users\enna\Desktop\films LOLO
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-14 16:43 - 2009-12-19 00:26 - 01085514 _____ C:\Windows\WindowsUpdate.log
2015-07-14 16:42 - 2014-05-20 17:33 - 00001074 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1043922925-1157543147-587559754-1001UA.job
2015-07-14 16:38 - 2009-07-14 06:45 - 00025840 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-07-14 16:38 - 2009-07-14 06:45 - 00025840 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-07-14 16:29 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-14 16:28 - 2015-05-13 14:50 - 00002348 _____ C:\Windows\setupact.log
2015-07-14 08:45 - 2013-06-22 09:40 - 00000000 ____D C:\Users\enna\AppData\Roaming\Azureus
2015-07-14 08:42 - 2014-05-20 17:33 - 00001022 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1043922925-1157543147-587559754-1001Core.job
2015-07-13 17:14 - 2010-07-22 18:52 - 00000000 ____D C:\Users\enna
2015-07-13 17:13 - 2015-04-06 12:32 - 00000000 ___SD C:\Windows\system32\GWX
2015-07-13 17:13 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2015-07-13 16:55 - 2012-07-06 12:12 - 00003926 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2015-07-13 16:49 - 2013-11-29 18:55 - 00000000 ____D C:\Users\enna\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-07-13 16:49 - 2011-01-30 18:33 - 00000000 ____D C:\Users\enna\AppData\Roaming\vlc
2015-07-12 08:53 - 2012-05-07 17:37 - 00000000 ____D C:\ProgramData\Meridian93
2015-07-12 08:52 - 2010-11-28 16:02 - 00000000 ____D C:\Users\enna\AppData\Roaming\Meridian93
2015-07-09 17:51 - 2012-12-24 09:49 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-06-29 16:51 - 2009-10-29 07:45 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-06-29 08:18 - 2009-07-14 04:34 - 00000510 _____ C:\Windows\win.ini
2015-06-27 17:20 - 2012-06-08 13:11 - 00000000 ____D C:\Users\enna\AppData\Roaming\Mad Head Games
2015-06-27 17:20 - 2009-12-19 00:33 - 00000000 ____D C:\ProgramData\Temp
2015-06-27 16:36 - 2009-12-19 09:19 - 00747910 _____ C:\Windows\system32\perfh00C.dat
2015-06-27 16:36 - 2009-12-19 09:19 - 00150402 _____ C:\Windows\system32\perfc00C.dat
2015-06-27 16:36 - 2009-07-14 07:13 - 01669656 _____ C:\Windows\system32\PerfStringBackup.INI
2015-06-27 12:45 - 2010-09-18 19:16 - 00442264 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSP.sys
2015-06-25 17:53 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\System
2015-06-25 17:27 - 2014-06-29 11:33 - 00039424 ___SH C:\Users\enna\Documents\Thumbs.db
2015-06-25 17:23 - 2009-07-14 06:45 - 00418432 _____ C:\Windows\system32\FNTCACHE.DAT
2015-06-23 13:30 - 2010-07-23 05:55 - 00300704 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-06-19 08:48 - 2010-07-22 18:52 - 00111272 _____ C:\Users\enna\AppData\Local\GDIPFONTCACHEV1.DAT
2015-06-19 08:10 - 2009-10-28 20:00 - 00000000 ____D C:\Windows\ShellNew
2015-06-19 08:10 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2015-06-19 08:09 - 2009-10-29 07:46 - 00000000 ____D C:\Program Files\Microsoft Office
2015-06-19 08:09 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\MSBuild
2015-06-19 07:36 - 2013-06-22 09:40 - 00001758 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vuze.lnk
2015-06-19 07:36 - 2013-06-22 09:40 - 00000000 ____D C:\Program Files\Vuze
2015-06-16 16:20 - 2010-11-18 17:18 - 00000000 ____D C:\Users\enna\AppData\Roaming\EleFun Games
2015-06-16 11:28 - 2009-07-14 07:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2015-06-14 17:04 - 2013-11-11 17:23 - 00159232 ___SH C:\Users\enna\Desktop\Thumbs.db
==================== Files in the root of some directories =======
2009-10-29 07:58 - 2009-02-10 21:23 - 0192484 _____ () C:\Program Files (x86)\Common Files\Acer GameZone online.ico
2014-07-14 18:38 - 2014-07-14 18:46 - 0001286 _____ () C:\Users\enna\AppData\Roaming\Bubble Dock.boostrap.log
2014-07-14 18:42 - 2014-07-14 18:46 - 0009027 _____ () C:\Users\enna\AppData\Roaming\Bubble Dock.installation.log
2006-01-01 00:53 - 2012-02-20 08:59 - 0200095 ____H () C:\Users\enna\AppData\Roaming\ennalog.dat
2010-10-16 10:51 - 2010-10-16 14:59 - 0000523 _____ () C:\Users\enna\AppData\Roaming\prefsdb.dat
2010-07-23 16:23 - 2012-04-09 14:59 - 0000176 _____ () C:\Users\enna\AppData\Roaming\wklnhst.dat
2013-11-29 18:04 - 2013-11-29 18:04 - 0351124 _____ () C:\Users\enna\AppData\Local\mysearchdial-speeddial.crx
2013-11-30 11:40 - 2013-11-30 11:40 - 0000057 _____ () C:\ProgramData\Ament.ini
2009-12-19 00:33 - 2009-12-19 00:38 - 0007817 _____ () C:\ProgramData\ArcadeDeluxe3.log
2010-09-06 12:45 - 2010-12-23 12:47 - 0003404 _____ () C:\ProgramData\dscrane_save.log
2009-10-29 07:58 - 2009-07-18 03:57 - 0036136 _____ (Oberon Media) C:\ProgramData\FullRemove.exe
2011-11-07 19:24 - 2012-02-08 19:17 - 0008159 _____ () C:\ProgramData\log.txt
2011-11-07 19:45 - 2012-02-08 19:17 - 0000230 _____ () C:\ProgramData\settings.xml
Some files in TEMP:
====================
C:\Users\enna\AppData\Local\Temp\i4jdel0.exe
C:\Users\enna\AppData\Local\Temp\i4jdel1.exe
C:\Users\enna\AppData\Local\Temp\tmp29DD.exe
C:\Users\enna\AppData\Local\Temp\Uni000.exe
C:\Users\enna\AppData\Local\Temp\y-d4xlqn.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-07-13 09:37
==================== End of log ============================