cjoint

Publicité


Publicité

Format du document : text/plain

Prévisualisation

ÿþOTL logfile created on: 04/11/2016 18:42:38 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\francine\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy

1,75 Gb Total Physical Memory | 0,34 Gb Available Physical Memory | 19,35% Memory free
3,75 Gb Paging File | 1,50 Gb Available in Paging File | 40,11% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 152,42 Gb Total Space | 77,18 Gb Free Space | 50,64% Space Free | Partition Type: NTFS

Computer Name: PC-DE-FRANCINE | User Name: francine | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

[color=#E56717]========== Processes (SafeList) ==========[/color]

PRC - [2016/11/04 18:38:43 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\francine\Desktop\OTL.exe
PRC - [2016/10/19 20:00:32 | 000,509,384 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2016/10/13 15:45:22 | 004,149,312 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\Av\avgidsagent.exe
PRC - [2016/10/13 15:39:46 | 000,973,584 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\Av\avgcsrvx.exe
PRC - [2016/10/13 15:39:16 | 001,536,784 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\Av\avgnsx.exe
PRC - [2016/10/13 15:37:02 | 005,321,488 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\Av\avgui.exe
PRC - [2016/10/13 15:35:48 | 000,605,336 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\Av\avgwdsvcx.exe
PRC - [2016/10/13 15:35:36 | 000,812,304 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\Av\avgemcx.exe
PRC - [2016/10/13 15:35:00 | 001,029,392 | ---- | M] (AVG Technologies CZ, s.r.o.) -- c:\PROGRA~1\AVG\Av\avgrsx.exe
PRC - [2016/09/13 06:55:10 | 000,945,936 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\Framework\Common\avgsvcx.exe
PRC - [2016/09/13 06:55:02 | 001,510,160 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\Framework\Common\avguix.exe
PRC - [2015/12/22 00:11:28 | 000,491,688 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Thunderbird\thunderbird.exe
PRC - [2014/08/13 09:25:32 | 000,108,032 | ---- | M] (Freemake) -- C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe
PRC - [2009/04/11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/04/11 07:27:28 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
PRC - [2008/04/25 12:31:40 | 000,319,488 | ---- | M] () -- C:\Program Files\Acer\Empowering Technology\SysMonitor.exe
PRC - [2008/04/25 12:30:26 | 000,024,576 | ---- | M] () -- C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
PRC - [2008/03/04 22:38:34 | 000,500,784 | ---- | M] (Egis Incorporated) -- C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
PRC - [2008/01/29 11:51:52 | 004,911,104 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2007/02/04 12:02:14 | 000,079,400 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe


[color=#E56717]========== Modules (No Company Name) ==========[/color]

MOD - [2016/11/01 17:55:31 | 040,500,224 | ---- | M] () -- C:\Program Files\AVG\UiDll\2171\libcef.dll
MOD - [2016/05/12 05:41:59 | 012,435,456 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\a3b38be91af85ee2e958fbd0f8caaa76\System.Windows.Forms.ni.dll
MOD - [2016/05/12 05:41:48 | 001,593,856 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\f9c2795edd0e5e7e10885b9c4379ac26\System.Drawing.ni.dll
MOD - [2016/05/12 05:40:11 | 007,982,080 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\14a08a0f05665398dc5b56b4cba69b76\System.ni.dll
MOD - [2015/12/22 00:11:08 | 000,023,208 | ---- | M] () -- C:\Program Files\Mozilla Thunderbird\NSLDAPPR32V60.dll
MOD - [2015/12/22 00:11:06 | 000,153,768 | ---- | M] () -- C:\Program Files\Mozilla Thunderbird\NSLDAP32V60.dll
MOD - [2015/11/11 03:41:42 | 000,756,376 | ---- | M] () -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL
MOD - [2014/09/11 13:15:49 | 011,496,960 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\3444fbefcbd532181c499150ace644a4\mscorlib.ni.dll
MOD - [2008/04/25 12:31:40 | 000,319,488 | ---- | M] () -- C:\Program Files\Acer\Empowering Technology\SysMonitor.exe
MOD - [2008/03/09 15:01:08 | 000,159,744 | ---- | M] () -- C:\Windows\System32\atitmmxx.dll
MOD - [2004/01/24 23:00:00 | 000,120,832 | ---- | M] () -- C:\Program Files\WinRAR\rarext.dll


[color=#E56717]========== Services (SafeList) ==========[/color]

SRV - [2016/11/03 09:53:53 | 000,270,016 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2016/10/27 14:54:40 | 000,172,488 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2016/10/13 15:45:22 | 004,149,312 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\Av\avgidsagent.exe -- (AVGIDSAgent)
SRV - [2016/10/13 15:35:48 | 000,605,336 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\Av\avgwdsvcx.exe -- (avgwd)
SRV - [2016/09/13 06:55:10 | 000,945,936 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\Framework\Common\avgsvcx.exe -- (avgsvc)
SRV - [2014/08/13 09:25:32 | 000,108,032 | ---- | M] (Freemake) [Auto | Running] -- C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe -- (Freemake Improver)
SRV - [2008/04/25 12:30:26 | 000,024,576 | ---- | M] () [Auto | Running] -- C:\Program Files\Acer\Empowering Technology\Service\ETService.exe -- (ETService)
SRV - [2008/03/04 22:38:34 | 000,500,784 | ---- | M] (Egis Incorporated) [Auto | Running] -- C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe -- (eDataSecurity Service)
SRV - [2008/01/21 03:33:00 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)


[color=#E56717]========== Driver Services (SafeList) ==========[/color]

DRV - File not found [Kernel | Boot | Stopped] -- -- (UBHelper)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\NTIDrvr.sys -- (NTIDrvr)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\francine\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - [2016/10/09 14:55:11 | 000,170,200 | ---- | M] (Malwarebytes) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\MBAMSwissArmy.sys -- (MBAMSwissArmy)
DRV - [2016/09/26 18:19:18 | 000,197,376 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\System32\drivers\avgmfx86.sys -- (Avgmfx86)
DRV - [2016/09/22 14:44:06 | 000,257,792 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\System32\drivers\avgidsdriverx.sys -- (AVGIDSDriver)
DRV - [2016/09/20 16:53:22 | 000,218,880 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\System32\drivers\avgldx86.sys -- (Avgldx86)
DRV - [2016/07/27 15:29:08 | 000,231,680 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgtdix.sys -- (Avgtdix)
DRV - [2016/07/27 15:28:44 | 000,210,176 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\System32\drivers\avgidshx.sys -- (AVGIDSHX)
DRV - [2016/06/20 15:17:38 | 000,065,280 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\System32\drivers\avgunivx.sys -- (avgunivx)
DRV - [2016/06/01 13:16:40 | 000,047,360 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\System32\drivers\avgrkx86.sys -- (Avgrkx86)
DRV - [2016/05/13 07:43:30 | 000,134,912 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\System32\drivers\avgdiskx.sys -- (Avgdiskx)
DRV - [2016/02/16 16:20:38 | 000,287,008 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\System32\drivers\avglogx.sys -- (Avglogx)
DRV - [2015/11/20 09:05:14 | 000,031,664 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgidsshimx.sys -- (AVGIDSShim)
DRV - [2008/04/25 12:23:40 | 000,015,392 | ---- | M] (Acer, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\int15.sys -- (int15)
DRV - [2008/03/09 15:58:42 | 003,533,824 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2008/02/25 15:29:24 | 000,014,544 | ---- | M] (EnTech Taiwan) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\TVicPort.sys -- (tvicport)
DRV - [2008/02/25 15:29:24 | 000,006,080 | ---- | M] (Zeal SoftStudio) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\zntport.sys -- (zntport)
DRV - [2007/12/19 07:45:00 | 000,170,000 | ---- | M] (AMD Technologies Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\ahcix86s.sys -- (ahcix86s)
DRV - [2007/08/27 14:12:06 | 000,031,128 | ---- | M] (FreeBox SA) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\fbxusb32.sys -- (fbxusb)
DRV - [2006/10/30 04:23:12 | 000,007,680 | ---- | M] (ATI Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\AtiPcie.sys -- (AtiPcie)


[color=#E56717]========== Standard Registry (SafeList) ==========[/color]


[color=#E56717]========== Internet Explorer ==========[/color]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.fr.acer.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://fr.fr.acer.yahoo.com
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3629343305-3452528987-3318794603-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
IE - HKU\S-1-5-21-3629343305-3452528987-3318794603-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-3629343305-3452528987-3318794603-1000\..\SearchScopes,DefaultScope = {85A60A59-D3D8-468F-B598-FB4393789EF4}
IE - HKU\S-1-5-21-3629343305-3452528987-3318794603-1000\..\SearchScopes\{85A60A59-D3D8-468F-B598-FB4393789EF4}: "URL" = https://www.google.fr/search?q={searchTerms}
IE - HKU\S-1-5-21-3629343305-3452528987-3318794603-1000\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://fr.search.yahoo.com/search?p={searchTerms}&fr=chr-acer
IE - HKU\S-1-5-21-3629343305-3452528987-3318794603-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

[color=#E56717]========== FireFox ==========[/color]

FF - prefs.js..browser.search.countryCode: "FR"
FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.hiddenOneOffs: "Yahoo,Bing,Amazon.fr,eBay France"
FF - prefs.js..browser.search.region: "FR"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "about:home"
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:49.0.2
FF - prefs.js..keyword.URL: "https://www.google.com/search?q="
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_23_0_0_205.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.13.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.50428.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5: C:\ProgramData\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\quickprint@hp.com: C:\Program Files\Hewlett-Packard\SmartPrint\QPExtension [2015/04/17 17:11:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 49.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 49.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2016/09/30 19:02:20 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 38.5.0\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2016/09/28 13:20:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 38.5.0\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2016/10/18 16:02:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\francine\AppData\Roaming\mozilla\Extensions
[2010/08/31 10:22:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\francine\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2016/10/14 07:27:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\francine\AppData\Roaming\mozilla\Firefox\Profiles\9jney4kc.default-1476394000146\extensions
[2016/10/17 15:32:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\francine\AppData\Roaming\mozilla\Firefox\Profiles\ftxbH3Ki.default\extensions
[2016/10/17 15:32:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\francine\AppData\Roaming\mozilla\Firefox\Profiles\ftxbH3Ki.default\extensions\abs@avira.com
[2016/10/16 19:27:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\francine\AppData\Roaming\mozilla\Firefox\Profiles\z6nr9qrz.default-1472375335728\browser-extension-data
[2016/10/16 19:29:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\francine\AppData\Roaming\mozilla\Firefox\Profiles\z6nr9qrz.default-1472375335728\browser-extension-data\firefox@ghostery.com
[2016/11/03 15:33:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\francine\AppData\Roaming\mozilla\Firefox\Profiles\z6nr9qrz.default-1472375335728\extension-data
[2016/11/03 15:34:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\francine\AppData\Roaming\mozilla\Firefox\Profiles\z6nr9qrz.default-1472375335728\extensions
[2016/10/14 07:27:28 | 000,007,076 | ---- | M] () (No name found) -- C:\Users\francine\AppData\Roaming\mozilla\firefox\profiles\9jney4kc.default-1476394000146\features\{1bf76f2e-6032-4f25-97bd-e3d37d692b0d}\e10srollout@mozilla.org.xpi
[2016/10/28 12:37:30 | 000,005,389 | ---- | M] () (No name found) -- C:\Users\francine\AppData\Roaming\mozilla\firefox\profiles\z6nr9qrz.default-1472375335728\features\{971e51c8-38d1-41e8-a4cd-414cc60e2bd7}\asyncrendering@mozilla.org.xpi
[2016/10/24 10:00:58 | 000,003,027 | ---- | M] () -- C:\Users\francine\AppData\Roaming\mozilla\firefox\profiles\z6nr9qrz.default-1472375335728\searchplugins\google-lavasoft.xml
[2016/11/01 10:13:57 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\browser\extensions

[color=#E56717]========== Chrome ==========[/color]

CHR - default_search_provider: Google ()
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR - homepage: http://www.google.com

O1 HOSTS File: ([2006/09/18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.)
O3 - HKU\S-1-5-21-3629343305-3452528987-3318794603-1000\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acer Empowering Technology Monitor] C:\Program Files\Acer\Empowering Technology\SysMonitor.exe ()
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG_UI] C:\Program Files\AVG\Framework\Common\avguirnx.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [AvgUi] C:\Program Files\AVG\Framework\Common\avguirnx.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Setresolution] C:\ACER\Config\1440X900.CMD ()
O4 - HKLM..\Run: [WarReg_PopUp] C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe (Acer Incorporated)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-3629343305-3452528987-3318794603-1000..\Run: [tkkhh] rundll32 File not found
O8 - Extra context menu item: &Envoyer à OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000 File not found
O9 - Extra Button: HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files\Hewlett-Packard\SmartPrint\smartprintsetup.exe (Hewlett-Packard)
O9 - Extra 'Tools' menuitem : SmartPrint - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files\Hewlett-Packard\SmartPrint\smartprintsetup.exe (Hewlett-Packard)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-3629343305-3452528987-3318794603-1000\..Trusted Domains: localhost ([]* in Trusted sites)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.27.40.241 212.27.40.240
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{37745DC5-0243-46B0-BE5A-5ECCE988FB09}: DhcpNameServer = 212.27.40.241 212.27.40.240
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{597325EF-9901-4DEE-A5C7-C3AEA3E71DEF}: DhcpNameServer = 212.27.40.241 212.27.40.240
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\System32\Userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\francine\AppData\Roaming\Microsoft\Windows Photo Gallery\Papier peint de la Galerie de photos Windows.jpg
O24 - Desktop BackupWallPaper: C:\Users\francine\AppData\Roaming\Microsoft\Windows Photo Gallery\Papier peint de la Galerie de photos Windows.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{4a032651-c52a-11de-acec-001fe2041d79}\Shell\AutoRun\command - "" = J:\mostick.exe
O33 - MountPoints2\{9f536af0-09d5-11e5-8a22-001fe2041d79}\Shell - "" = AutoRun
O33 - MountPoints2\{9f536af0-09d5-11e5-8a22-001fe2041d79}\Shell\AutoRun\command - "" = D:\HTC_Sync_Manager_PC.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found


SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS - File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS - File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3911CF56-9EF2-39BA-846A-C27BD3CD0685} - .NET Framework
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4903D172-DCCB-392F-93A3-34CA9D47FE3D} - .NET Framework
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Dossiers Web
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C6BAF60B-6E91-453F-BFF9-D3789CFEFCDD} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Macromedia Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} -
ActiveX: >{7517B462-F531-4B95-A517-C86FDBB3DAD3} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

Drivers32: msacm.ac3acm - C:\Windows\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - lameACM.acm File not found
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.DIVX - C:\Windows\System32\divx.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll ()
Drivers32: VIDC.XVID - C:\Windows\System32\xvidvfw.dll ()
Drivers32: VIDC.YV12 - C:\Windows\System32\yv12vfw.dll (www.helixcommunity.org)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]

[2016/11/04 18:38:39 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\francine\Desktop\OTL.exe
[2016/11/02 18:16:26 | 000,000,000 | ---D | C] -- C:\Users\francine\AppData\Local\CrashDumps
[2016/11/01 18:16:28 | 000,000,000 | ---D | C] -- C:\Users\francine\AppData\Roaming\AVG
[2016/11/01 18:13:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
[2016/11/01 18:11:34 | 000,000,000 | -H-D | C] -- C:\$AVG
[2016/11/01 17:59:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Zen
[2016/11/01 17:57:07 | 000,000,000 | ---D | C] -- C:\Program Files\AVG
[2016/11/01 17:54:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Avg
[2016/11/01 17:54:32 | 000,000,000 | ---D | C] -- C:\Users\francine\AppData\Local\AvgSetupLog
[2016/11/01 17:54:32 | 000,000,000 | ---D | C] -- C:\Users\francine\AppData\Local\Avg
[2016/10/31 13:49:56 | 000,000,000 | ---D | C] -- C:\ProgramData\RogueKiller
[2016/10/31 12:55:06 | 002,286,392 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\francine\Desktop\GetSystemInfo5.0.exe
[2016/10/30 18:09:12 | 000,000,000 | -H-D | C] -- C:\Windows\PIF
[2016/10/28 17:08:16 | 005,201,280 | ---- | C] (Piriform Ltd) -- C:\Users\francine\Desktop\spsetup129(1).exe
[2016/10/25 13:47:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller
[2016/10/25 13:47:56 | 000,000,000 | ---D | C] -- C:\Program Files\VS Revo Group
[2016/10/24 16:43:45 | 000,000,000 | ---D | C] -- C:\Users\francine\AppData\Local\Temp
[2016/10/24 16:39:40 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch
[2016/10/24 14:18:32 | 001,453,048 | ---- | C] (RaMMicHaeL) -- C:\Users\francine\Desktop\unchecky_setup.exe
[2016/10/21 16:59:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Auslogics
[2016/10/21 16:59:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Auslogics
[2016/10/21 16:46:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP
[2016/10/21 16:45:00 | 003,521,617 | ---- | C] (Nicolas Coolman ) -- C:\Users\francine\Desktop\ZHPFix.exe
[2016/10/21 14:59:17 | 000,000,000 | ---D | C] -- C:\FRST
[2016/10/21 14:57:46 | 001,758,208 | ---- | C] (Farbar) -- C:\Users\francine\Desktop\FRST.exe
[2016/10/20 15:38:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2016/10/20 15:38:14 | 000,000,000 | ---D | C] -- C:\Users\francine\Desktop\Nouveau dossier (3)
[2016/10/19 16:44:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Speccy
[2016/10/19 16:44:51 | 000,000,000 | ---D | C] -- C:\Program Files\Speccy
[2016/10/18 17:22:49 | 000,000,000 | ---D | C] -- C:\Users\francine\AppData\Local\MFAData
[2016/10/18 17:22:49 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData
[2016/10/18 15:48:47 | 000,000,000 | ---D | C] -- C:\Program Files\ZHPFix
[2016/10/13 22:26:50 | 000,000,000 | ---D | C] -- C:\Users\francine\Desktop\Anciennes données de Firefox
[2016/10/12 12:28:39 | 000,000,000 | ---D | C] -- C:\Users\francine\AppData\Roaming\ZHP

[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]

[2016/11/04 19:18:22 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2016/11/04 19:18:21 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2016/11/04 18:38:43 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\francine\Desktop\OTL.exe
[2016/11/04 18:34:22 | 000,001,002 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2016/11/04 16:18:16 | 000,126,166 | ---- | M] () -- C:\Users\francine\Desktop\GetSystemInfo_PC-DE-FRANCINE_francine_2016_11_04_16_01_19.zip
[2016/11/04 15:18:40 | 000,000,000 | ---- | M] () -- C:\Windows\System32\LogConfigTemp.xml
[2016/11/04 15:18:18 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2016/11/04 15:18:12 | 1876,119,552 | -HS- | M] () -- C:\hiberfil.sys
[2016/11/04 15:12:38 | 000,079,848 | ---- | M] () -- C:\Users\francine\Desktop\cc_20161104_151215.reg
[2016/11/03 11:28:00 | 000,002,687 | ---- | M] () -- C:\Users\francine\Desktop\Word.lnk
[2016/11/03 09:53:52 | 000,796,352 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2016/11/03 09:53:52 | 000,142,528 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2016/11/02 10:08:39 | 000,722,238 | ---- | M] () -- C:\Windows\System32\perfh00C.dat
[2016/11/02 10:08:39 | 000,634,274 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2016/11/02 10:08:39 | 000,146,072 | ---- | M] () -- C:\Windows\System32\perfc00C.dat
[2016/11/02 10:08:39 | 000,119,840 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2016/11/01 17:59:45 | 000,000,735 | ---- | M] () -- C:\Users\Public\Desktop\AVG.lnk
[2016/11/01 11:23:58 | 001,758,208 | ---- | M] (Farbar) -- C:\Users\francine\Desktop\FRST.exe
[2016/11/01 10:14:02 | 000,000,874 | ---- | M] () -- C:\Users\francine\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2016/11/01 10:14:02 | 000,000,850 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2016/10/31 19:51:03 | 000,024,688 | ---- | M] () -- C:\Windows\System32\drivers\TrueSight.sys
[2016/10/31 13:43:26 | 020,945,992 | ---- | M] () -- C:\Users\francine\Desktop\RogueKiller.exe
[2016/10/31 13:11:47 | 000,158,224 | ---- | M] () -- C:\Users\francine\Desktop\GetSystemInfo_PC-DE-FRANCINE_francine_2016_10_31_12_59_36.zip
[2016/10/31 12:55:15 | 002,286,392 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\francine\Desktop\GetSystemInfo5.0.exe
[2016/10/30 15:17:47 | 000,157,184 | ---- | M] () -- C:\Users\francine\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2016/10/30 13:47:15 | 000,000,691 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2016/10/29 11:13:36 | 000,000,924 | ---- | M] () -- C:\Users\francine\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Thunderbird.lnk
[2016/10/29 11:13:36 | 000,000,900 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
[2016/10/28 17:11:16 | 000,000,780 | ---- | M] () -- C:\Users\Public\Desktop\Speccy.lnk
[2016/10/28 17:08:29 | 005,201,280 | ---- | M] (Piriform Ltd) -- C:\Users\francine\Desktop\spsetup129(1).exe
[2016/10/26 17:29:08 | 000,407,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
[2016/10/26 08:55:54 | 002,472,960 | ---- | M] () -- C:\Users\francine\Desktop\ZHPCleaner.exe
[2016/10/25 13:48:03 | 000,001,026 | ---- | M] () -- C:\Users\Public\Desktop\Revo Uninstaller.lnk
[2016/10/24 14:18:36 | 001,453,048 | ---- | M] (RaMMicHaeL) -- C:\Users\francine\Desktop\unchecky_setup.exe
[2016/10/21 16:46:27 | 000,001,638 | ---- | M] () -- C:\Users\Public\Desktop\ZHPFix.lnk
[2016/10/21 16:45:06 | 003,521,617 | ---- | M] (Nicolas Coolman ) -- C:\Users\francine\Desktop\ZHPFix.exe
[2016/10/20 18:20:30 | 000,007,168 | -H-- | M] () -- C:\Users\francine\photothumb.db
[2016/10/20 17:21:41 | 000,477,822 | ---- | M] () -- C:\Users\francine\Desktop\cc_20161020_182045.reg
[2016/10/20 11:32:18 | 002,418,176 | ---- | M] () -- C:\Users\francine\ZHPDiag3.exe
[2016/10/11 15:21:08 | 000,000,856 | ---- | M] () -- C:\Users\francine\AppData\Local\recently-used.xbel
[2016/10/09 16:52:06 | 000,745,254 | ---- | M] () -- C:\Users\francine\AppData\Local\census.cache
[2016/10/09 16:52:00 | 000,209,407 | ---- | M] () -- C:\Users\francine\AppData\Local\ars.cache
[2016/10/09 14:55:11 | 000,170,200 | ---- | M] (Malwarebytes) -- C:\Windows\System32\drivers\MBAMSwissArmy.sys

[color=#E56717]========== Files Created - No Company Name ==========[/color]

[2016/11/04 16:18:14 | 000,126,166 | ---- | C] () -- C:\Users\francine\Desktop\GetSystemInfo_PC-DE-FRANCINE_francine_2016_11_04_16_01_19.zip
[2016/11/04 15:12:19 | 000,079,848 | ---- | C] () -- C:\Users\francine\Desktop\cc_20161104_151215.reg
[2016/11/02 18:54:55 | 1876,119,552 | -HS- | C] () -- C:\hiberfil.sys
[2016/11/01 18:53:05 | 000,001,002 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2016/11/01 17:59:45 | 000,000,735 | ---- | C] () -- C:\Users\Public\Desktop\AVG.lnk
[2016/10/31 13:52:18 | 000,024,688 | ---- | C] () -- C:\Windows\System32\drivers\TrueSight.sys
[2016/10/31 13:43:23 | 020,945,992 | ---- | C] () -- C:\Users\francine\Desktop\RogueKiller.exe
[2016/10/31 13:11:45 | 000,158,224 | ---- | C] () -- C:\Users\francine\Desktop\GetSystemInfo_PC-DE-FRANCINE_francine_2016_10_31_12_59_36.zip
[2016/10/28 17:11:16 | 000,000,780 | ---- | C] () -- C:\Users\Public\Desktop\Speccy.lnk
[2016/10/26 08:55:49 | 002,472,960 | ---- | C] () -- C:\Users\francine\Desktop\ZHPCleaner.exe
[2016/10/25 13:48:03 | 000,001,026 | ---- | C] () -- C:\Users\Public\Desktop\Revo Uninstaller.lnk
[2016/10/21 16:46:27 | 000,001,638 | ---- | C] () -- C:\Users\Public\Desktop\ZHPFix.lnk
[2016/10/20 17:20:49 | 000,477,822 | ---- | C] () -- C:\Users\francine\Desktop\cc_20161020_182045.reg
[2016/10/20 17:09:57 | 000,000,691 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2016/10/20 11:32:18 | 002,418,176 | ---- | C] () -- C:\Users\francine\ZHPDiag3.exe
[2016/10/11 15:21:08 | 000,000,856 | ---- | C] () -- C:\Users\francine\AppData\Local\recently-used.xbel
[2016/08/24 14:13:47 | 001,223,210 | ---- | C] () -- C:\Users\francine\DSCF4387.JPG
[2015/08/27 13:42:22 | 000,000,128 | --S- | C] () -- C:\Users\francine\Autre lien vers Desktop
[2015/08/27 13:41:33 | 000,000,128 | --S- | C] () -- C:\Users\francine\Lien vers Desktop
[2013/12/26 10:51:54 | 000,004,416 | ---- | C] () -- C:\Users\francine\AppData\Roaming\CamStudio.cfg
[2013/12/26 10:51:54 | 000,000,408 | ---- | C] () -- C:\Users\francine\AppData\Roaming\CamShapes.ini
[2013/12/26 10:51:54 | 000,000,408 | ---- | C] () -- C:\Users\francine\AppData\Roaming\CamLayout.ini
[2013/12/26 10:51:54 | 000,000,081 | ---- | C] () -- C:\Users\francine\AppData\Roaming\Camdata.ini
[2013/07/01 09:28:03 | 000,000,005 | ---- | C] () -- C:\Users\francine\AppData\Roaming\WBPU-TTL.DAT
[2012/09/08 18:19:20 | 000,007,168 | -H-- | C] () -- C:\Users\francine\photothumb.db
[2012/07/08 13:51:10 | 000,000,057 | ---- | C] () -- C:\ProgramData\Ament.ini
[2012/01/06 14:00:06 | 000,745,254 | ---- | C] () -- C:\Users\francine\AppData\Local\census.cache
[2012/01/06 13:59:45 | 000,209,407 | ---- | C] () -- C:\Users\francine\AppData\Local\ars.cache
[2012/01/06 13:41:14 | 000,000,036 | ---- | C] () -- C:\Users\francine\AppData\Local\housecall.guid.cache
[2010/12/23 17:54:09 | 000,004,096 | -H-- | C] () -- C:\Users\francine\AppData\Local\keyfile3.drm
[2010/01/19 19:06:44 | 000,001,028 | ---- | C] () -- C:\Users\francine\AppData\Roaming\WavCodec.wff
[2009/04/23 08:44:49 | 000,000,680 | ---- | C] () -- C:\Users\francine\AppData\Local\d3d9caps.dat
[2009/02/06 14:46:26 | 000,079,693 | ---- | C] () -- C:\Users\francine\AppData\Roaming\UserTile.png
[2008/10/08 11:42:53 | 000,157,184 | ---- | C] () -- C:\Users\francine\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/10/08 10:53:54 | 000,000,780 | ---- | C] () -- C:\Users\francine\AppData\Roaming\wklnhst.dat

[color=#E56717]========== ZeroAccess Check ==========[/color]

[2006/11/02 13:51:16 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2015/07/29 01:46:08 | 011,588,096 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/04/11 07:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009/04/11 07:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[color=#E56717]========== LOP Check ==========[/color]

[2015/05/27 11:29:28 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\TuneUp Software
[2015/05/27 11:29:28 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\TuneUp Software
[2009/11/24 11:24:46 | 000,000,000 | -HSD | M] -- C:\Users\francine\AppData\Roaming\.#
[2009/11/25 21:32:22 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\Acer GameZone Console
[2016/10/30 09:58:44 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\Audacity
[2016/11/01 18:16:28 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\AVG
[2015/04/17 17:11:55 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\Canneverbe Limited
[2009/03/11 10:37:23 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\Canon
[2012/09/11 11:32:03 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\Cocoon Software
[2014/07/25 12:10:46 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\e-on software
[2008/11/13 11:47:20 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\eSobi
[2011/01/18 18:19:07 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\eTeks
[2008/11/09 19:39:22 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\FloodLightGames
[2013/04/18 11:45:30 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\GARMIN
[2013/09/13 11:26:21 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\gnupg
[2009/10/30 10:59:34 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\Mostick
[2016/10/16 19:29:05 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\mp3keyshifter
[2015/08/27 19:49:45 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\NCH Swift Sound
[2016/10/16 19:29:05 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\OpenAlchemist
[2015/04/17 17:10:58 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\OpenOffice
[2009/01/28 19:27:21 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\OpenOffice.org
[2010/11/16 09:05:25 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\PeerNetworking
[2016/10/16 19:29:05 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\PhotoFiltre
[2016/10/16 19:29:05 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\PhotoFiltre 7
[2016/10/30 13:56:26 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\PhotoScape
[2009/03/11 10:28:23 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\ScanSoft
[2013/10/02 09:18:48 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\SumatraPDF
[2008/10/08 10:54:05 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\Template
[2016/10/16 19:29:05 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\Thunderbird
[2015/04/16 09:26:40 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\TuneUp Software
[2012/07/11 09:23:02 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\Visan
[2016/11/03 22:03:01 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\ZHP
[2008/12/24 18:45:57 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\Zylom

[color=#E56717]========== Purity Check ==========[/color]



[color=#E56717]========== Custom Scans ==========[/color]

[color=#A23BEC]< MD5 for: AFD.SYS >[/color]
[2011/04/21 14:58:27 | 000,273,408 | ---- | M] (Microsoft Corporation) MD5=3911B972B55FEA0478476B2E777B29FA -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6002.18457_none_d99fb42e5bb59d9b\afd.sys
[2011/04/21 14:16:42 | 000,273,408 | ---- | M] (Microsoft Corporation) MD5=48EB99503533C27AC6135648E5474457 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6001.18639_none_d7d0e0cc5e7d461c\afd.sys
[2015/10/13 15:31:33 | 000,273,408 | ---- | M] (Microsoft Corporation) MD5=4A0978779958D8FE8F5849F452BCC812 -- C:\Windows\System32\drivers\afd.sys
[2015/10/13 15:31:33 | 000,273,408 | ---- | M] (Microsoft Corporation) MD5=4A0978779958D8FE8F5849F452BCC812 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6002.19513_none_d9c6ddd45b98df43\afd.sys
[2011/04/21 14:28:53 | 000,273,920 | ---- | M] (Microsoft Corporation) MD5=70EE0FC7A0F384DBD929A01384AEEB4B -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6002.22629_none_da4bc33774b91967\afd.sys
[2008/01/21 03:33:55 | 000,273,920 | ---- | M] (Microsoft Corporation) MD5=763E172A55177E478CB419F88FD0BA03 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6001.18000_none_d7e842925e6d1f50\afd.sys
[2015/10/13 15:24:04 | 000,273,920 | ---- | M] (Microsoft Corporation) MD5=994FE77F4BA72432A1FC03A17D177737 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6002.23823_none_da45ae7f74be954c\afd.sys
[2009/04/11 05:47:03 | 000,273,920 | ---- | M] (Microsoft Corporation) MD5=A201207363AA900ABF1A388468688570 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6002.18005_none_d9d3bb9e5b8eea9c\afd.sys
[2011/04/21 14:12:21 | 000,273,920 | ---- | M] (Microsoft Corporation) MD5=C8AF25017CECB75906A571AC70D2D306 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6001.22905_none_d876efff77862705\afd.sys
[2014/05/30 07:53:22 | 000,273,408 | ---- | M] (Microsoft Corporation) MD5=F5272A105F59A7B3B345D9D6D87DA7AD -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6002.19115_none_d9c8d6d05b971d55\afd.sys
[2014/05/30 10:51:58 | 000,273,920 | ---- | M] (Microsoft Corporation) MD5=FA44775936FBCECB679FB30351959757 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6002.23414_none_da51771d74b59e16\afd.sys

[color=#A23BEC]< MD5 for: EXPLORER.EXE >[/color]
[2008/10/29 07:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2008/10/29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008/10/30 04:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2009/04/11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe
[2009/04/11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2008/10/28 03:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2008/01/21 03:34:05 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe

[color=#A23BEC]< MD5 for: I8042PRT.SYS >[/color]
[2006/11/02 09:51:13 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=1060F1377F395A242E27719440ECE602 -- C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_93b1c41f\i8042prt.sys
[2006/11/02 09:51:13 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=1060F1377F395A242E27719440ECE602 -- C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_3dfa3917\i8042prt.sys
[2008/01/21 03:14:08 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=1C9EE072BAA3ABB460B91D7EE9152660 -- C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_a81145df\i8042prt.sys
[2008/01/21 03:14:08 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=1C9EE072BAA3ABB460B91D7EE9152660 -- C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_f4514c17\i8042prt.sys
[2008/01/21 03:14:08 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=1C9EE072BAA3ABB460B91D7EE9152660 -- C:\Windows\winsxs\x86_keyboard.inf_31bf3856ad364e35_6.0.6000.16609_none_957131ccdbca3f9c\i8042prt.sys
[2008/01/21 03:14:08 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=1C9EE072BAA3ABB460B91D7EE9152660 -- C:\Windows\winsxs\x86_msmouse.inf_31bf3856ad364e35_6.0.6000.16609_none_4c56cf70d52c8670\i8042prt.sys
[2008/01/21 03:32:45 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=22D56C8184586B7A1F6FA60BE5F5A2BD -- C:\Windows\System32\drivers\i8042prt.sys
[2008/01/21 03:32:49 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=22D56C8184586B7A1F6FA60BE5F5A2BD -- C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_da7e599e\i8042prt.sys
[2008/01/21 03:32:49 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=22D56C8184586B7A1F6FA60BE5F5A2BD -- C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_f55d5e51\i8042prt.sys
[2008/01/21 03:32:45 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=22D56C8184586B7A1F6FA60BE5F5A2BD -- C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_8b7c4328\i8042prt.sys
[2008/01/21 03:32:49 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=22D56C8184586B7A1F6FA60BE5F5A2BD -- C:\Windows\winsxs\x86_keyboard.inf_31bf3856ad364e35_6.0.6001.18000_none_974e6dd8d8f8ec7e\i8042prt.sys
[2008/01/21 03:32:49 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=22D56C8184586B7A1F6FA60BE5F5A2BD -- C:\Windows\winsxs\x86_keyboard.inf_31bf3856ad364e35_6.0.6002.18005_none_9939e6e4d61ab7ca\i8042prt.sys
[2008/01/21 03:32:45 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=22D56C8184586B7A1F6FA60BE5F5A2BD -- C:\Windows\winsxs\x86_msmouse.inf_31bf3856ad364e35_6.0.6001.18000_none_4e340b7cd25b3352\i8042prt.sys
[2008/01/21 03:14:07 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=BEA9838CD25D36BEBA3F94386A761D60 -- C:\Windows\winsxs\x86_keyboard.inf_31bf3856ad364e35_6.0.6000.20734_none_95d55d61f504b486\i8042prt.sys
[2008/01/21 03:14:08 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=BEA9838CD25D36BEBA3F94386A761D60 -- C:\Windows\winsxs\x86_msmouse.inf_31bf3856ad364e35_6.0.6000.20734_none_4cbafb05ee66fb5a\i8042prt.sys

[color=#A23BEC]< MD5 for: LSASS.EXE >[/color]
[2016/05/14 15:24:01 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=1989D4FFD919C306E35E6D1092FAA606 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.23974_none_a872e94373445065\lsass.exe
[2009/06/15 13:51:56 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=203D86EBD6D8E4C8501B222421E81506 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.22152_none_a886901f7335e2fc\lsass.exe
[2009/09/10 15:44:14 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=2D3AC5E7AC01E905F3ABD2D745FE3A9B -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.22223_none_a8a80213731ca5a7\lsass.exe
[2015/06/27 15:20:12 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=2DCDD1B84875C0D5404173EC3B00E454 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.23737_none_a8a1260573213258\lsass.exe
[2009/06/15 13:48:49 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=3978F3540329E16C0AC3BCF677E5669F -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.18051_none_a7fbf30a5a1929db\lsass.exe
[2015/04/30 15:19:51 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=474FDD99DB6012E21405AAEE8DA61546 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.23683_none_a867135b734d5b8a\lsass.exe
[2015/09/28 15:16:23 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=51A90F96C7CB9640DD945DE853D103A1 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.23814_none_a8b3c6e57313ab98\lsass.exe
[2009/02/13 08:26:04 | 000,007,680 | ---- | M] (Microsoft Corporation) MD5=59DE082968FDD257FFF0D209B9A5B460 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6000.16820_none_a44eb0105fb4d975\lsass.exe
[2012/06/01 23:37:38 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=613DEB66A91820F0A41915B40BB8833F -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.22869_none_a882cf8373379c5f\lsass.exe
[2009/06/15 14:03:38 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=6F1F23D3599EAE17734451936B7F17C6 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6001.22450_none_a69e1da376115b2a\lsass.exe
[2014/10/11 00:21:41 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=86C519D59C70327434641E862A70B52B -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.23521_none_a8a5f069731e840f\lsass.exe
[2016/03/18 16:34:46 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=9BB31D267F30609BF98140ED5814F15B -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.23936_none_a8a029877322134f\lsass.exe
[2015/01/15 06:17:50 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=A28A5386D01A5C6B085838624955EF3C -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.23594_none_a85d41d3735493ab\lsass.exe
[2011/11/16 15:12:25 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=A3E186B4B935905B829219502557314E -- C:\Windows\System32\lsass.exe
[2011/11/16 15:12:25 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=A3E186B4B935905B829219502557314E -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.18541_none_a806cc745a10ffad\lsass.exe
[2011/11/16 15:12:25 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=A3E186B4B935905B829219502557314E -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.18643_none_a808ceee5a0f2f82\lsass.exe
[2011/11/16 15:12:25 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=A3E186B4B935905B829219502557314E -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.19214_none_a82a209c59f61a0b\lsass.exe
[2011/11/16 15:12:25 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=A3E186B4B935905B829219502557314E -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.19284_none_a7de71285a2edda2\lsass.exe
[2011/11/16 15:12:25 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=A3E186B4B935905B829219502557314E -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.19431_none_a81183b25a090036\lsass.exe
[2011/11/16 15:12:25 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=A3E186B4B935905B829219502557314E -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.19503_none_a833f5f059eedc38\lsass.exe
[2011/11/16 15:12:25 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=A3E186B4B935905B829219502557314E -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.19623_none_a81e57fe59ff1141\lsass.exe
[2011/11/16 15:12:25 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=A3E186B4B935905B829219502557314E -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.19659_none_a803e9f65a11fd1e\lsass.exe
[2011/11/16 15:12:25 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=A3E186B4B935905B829219502557314E -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.19668_none_a7f819c05a1affb8\lsass.exe
[2016/07/09 15:23:42 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=A4AF8824688C9034F34AE90E219232EB -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.23984_none_a8681957734c6c56\lsass.exe
[2009/06/15 13:57:59 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=A911ECAC81F94ADEAFBE8E3F7873EDB0 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6001.18272_none_a600dfae5d0228c9\lsass.exe
[2015/03/06 03:16:32 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=ACAC4085ECDA9A35ED621936D67DB9D4 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.23640_none_a88f522d732f9fc1\lsass.exe
[2009/02/13 05:58:37 | 000,007,680 | ---- | M] (Microsoft Corporation) MD5=AFF8A58280863629CA4FFA9E0B259F1E -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6000.21010_none_a4e2f4e978ca9090\lsass.exe
[2009/06/15 13:59:08 | 000,007,680 | ---- | M] (Microsoft Corporation) MD5=BA9A67672E025078C77967731BCFC560 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6000.21067_none_a4b3e75378eccda6\lsass.exe
[2014/12/03 01:23:58 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=C4AA089041242987308AE2A7B30E910A -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.23555_none_a88981cd73333d3e\lsass.exe
[2009/06/15 14:10:12 | 000,007,680 | ---- | M] (Microsoft Corporation) MD5=C731B1FE449D4E9CEA358C9D55B69BE9 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6000.16870_none_a418a0745fdd652a\lsass.exe
[2009/09/09 12:09:38 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=CB7E838C140B4087B2DA323F2D4523C5 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6001.22518_none_a6d1618975e9b345\lsass.exe
[2009/09/10 15:47:51 | 000,007,680 | ---- | M] (Microsoft Corporation) MD5=D09A5DA84B7C9CA9B02EBCD7FAE41C8D -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6000.21125_none_a4dd285578ce285b\lsass.exe
[2008/01/21 03:33:54 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=DCF733788C7D088D814E5F80EB4B3E0F -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6001.18000_none_a64a8ac25ccb3836\lsass.exe
[2008/01/21 03:33:54 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=DCF733788C7D088D814E5F80EB4B3E0F -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6001.18215_none_a644c0145ccecd28\lsass.exe
[2008/01/21 03:33:54 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=DCF733788C7D088D814E5F80EB4B3E0F -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.18005_none_a83603ce59ed0382\lsass.exe
[2011/11/16 14:57:04 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=EBFAEB786C46B407930811F94F08877D -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.22742_none_a8916b6f732db5f5\lsass.exe
[2009/02/13 09:20:29 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=F4C62B07E5BF96F1FDCA9DB393ECED22 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6001.22376_none_a68e7da1761c2def\lsass.exe

[color=#A23BEC]< MD5 for: NETBT.SYS >[/color]
[2016/05/10 15:28:38 | 000,186,368 | ---- | M] (Microsoft Corporation) MD5=215FDC77E8D81CEEA3AF80B323B75486 -- C:\Windows\winsxs\x86_microsoft-windows-netbt_31bf3856ad364e35_6.0.6002.23970_none_628925bb0dc0da38\netbt.sys
[2008/01/21 03:34:49 | 000,184,320 | ---- | M] (Microsoft Corporation) MD5=7C5FEE5B1C5728507CD96FB4A13E7A02 -- C:\Windows\winsxs\x86_microsoft-windows-netbt_31bf3856ad364e35_6.0.6001.18000_none_6064c861f7442765\netbt.sys
[2016/05/10 15:28:34 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=BF84E55A9B3AD3CBAB4AAE3BE043E579 -- C:\Windows\System32\drivers\netbt.sys
[2016/05/10 15:28:34 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=BF84E55A9B3AD3CBAB4AAE3BE043E579 -- C:\Windows\winsxs\x86_microsoft-windows-netbt_31bf3856ad364e35_6.0.6002.19655_none_621a266df48e86f1\netbt.sys
[2009/04/11 05:45:37 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=ECD64230A59CBD93C85F1CD1CAB9F3F6 -- C:\Windows\winsxs\x86_microsoft-windows-netbt_31bf3856ad364e35_6.0.6002.18005_none_6250416df465f2b1\netbt.sys

[color=#A23BEC]< MD5 for: SVCHOST.EXE >[/color]
[2008/01/21 03:33:13 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF -- C:\Windows\System32\svchost.exe
[2008/01/21 03:33:13 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.0.6001.18000_none_b5bb59a1054dbde5\svchost.exe
[2016/03/10 13:07:16 | 000,960,480 | ---- | M] (MalwareBytes) MD5=F86A4139730504047F52CCFB8C47E9F5 -- C:\Program Files\Malwarebytes Anti-Malware\Chameleon\Windows\svchost.exe

[color=#A23BEC]< MD5 for: TCPIP.SYS >[/color]
[2008/04/26 09:08:16 | 000,891,448 | ---- | M] (Microsoft Corporation) MD5=01EC1E92595F839BEE70D439C46796E3 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22167_none_b36dd19b7fae39c7\tcpip.sys
[2013/05/08 04:40:36 | 000,914,792 | ---- | M] (Microsoft Corporation) MD5=078218D74C4EFC2CE7E4C6DF22A94F2F -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.23106_none_b59411ab7ca4df04\tcpip.sys
[2009/04/11 07:33:02 | 000,897,000 | ---- | M] (Microsoft Corporation) MD5=0E6B0885C3D5E4643ED2D043DE3433D8 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18005_none_b5098b5e63880c42\tcpip.sys
[2011/09/20 22:02:55 | 000,913,280 | ---- | M] (Microsoft Corporation) MD5=16731B631F28F63CD9F4CB60940E7DDD -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.22719_none_b58c64c97caa1c43\tcpip.sys
[2009/12/08 21:52:30 | 000,897,624 | ---- | M] (Microsoft Corporation) MD5=1ACBB7A47E78F4CC82D2EFFB72901528 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18377_none_b2d96a966698ad63\tcpip.sys
[2009/08/15 22:30:53 | 000,816,640 | ---- | M] (Microsoft Corporation) MD5=2512B4D1353370D6688B1AF1F5AFA1CF -- C:\Windows\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.21108_none_6030d425ab49af00\tcpip.sys
[2009/08/14 18:01:55 | 000,900,168 | ---- | M] (Microsoft Corporation) MD5=2608E71AAD54564647D4BB984E1925AA -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22497_none_b34d67897fc6850f\tcpip.sys
[2011/06/17 21:13:55 | 000,905,104 | ---- | M] (Microsoft Corporation) MD5=2756186E287139310997090797E0182B -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18484_none_b4b2134c63c9c70f\tcpip.sys
[2012/03/30 13:39:11 | 000,905,600 | ---- | M] (Microsoft Corporation) MD5=27D470DABC77BC60D0A3B0E4DEB6CB91 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18604_none_b50896786388e1d5\tcpip.sys
[2010/02/18 12:51:51 | 000,818,688 | ---- | M] (Microsoft Corporation) MD5=2C1F7005AA3B62721BFDB307BD5F5010 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.21226_none_6019359fab5bb15b\tcpip.sys
[2010/02/18 15:49:38 | 000,898,952 | ---- | M] (Microsoft Corporation) MD5=2EAE4500984C2F8DACFB977060300A15 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18427_none_b30f7c1866701ed5\tcpip.sys
[2009/08/14 15:24:47 | 000,813,568 | ---- | M] (Microsoft Corporation) MD5=300208927321066EA53761FDC98747C6 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.16908_none_5fa75f38922bdbf4\tcpip.sys
[2013/01/04 12:28:19 | 000,914,792 | ---- | M] (Microsoft Corporation) MD5=3535CD93F944C00F098E73E12EE7FEB6 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.23013_none_b5863efb7cafb1c9\tcpip.sys
[2009/12/08 21:15:00 | 000,907,832 | ---- | M] (Microsoft Corporation) MD5=46E6685F3E92AEC743773ADD4CD54F57 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.22283_none_b53aaa1b7ce8560d\tcpip.sys
[2010/02/18 15:07:16 | 000,904,576 | ---- | M] (Microsoft Corporation) MD5=48CBE6D53632D0067C2D6B20F90D84CA -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18209_none_b50d905263846bec\tcpip.sys
[2010/02/18 13:05:37 | 000,815,104 | ---- | M] (Microsoft Corporation) MD5=4A82FA8F0DF67AA354580C3FAAF8BDE3 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.17021_none_5f8a957c924295b7\tcpip.sys
[2013/05/08 05:37:21 | 000,905,576 | ---- | M] (Microsoft Corporation) MD5=548E198BAE21EFC21F8B5F0C1728AD27 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18835_none_b4e92aca63a0494d\tcpip.sys
[2009/12/08 21:37:09 | 000,900,696 | ---- | M] (Microsoft Corporation) MD5=5653230D480A9C54D169E1B080B72CF5 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22577_none_b36309477fb64a54\tcpip.sys
[2010/06/16 16:55:58 | 000,902,032 | ---- | M] (Microsoft Corporation) MD5=6216A954ED7045B62880A92D6C9B9FC7 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_b39feb737f8937a0\tcpip.sys
[2009/08/14 17:27:34 | 000,904,776 | ---- | M] (Microsoft Corporation) MD5=65877AA1B6A7CB797488E831698973E9 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18091_none_b4a43aea63d4a25f\tcpip.sys
[2011/06/17 21:13:55 | 000,913,296 | ---- | M] (Microsoft Corporation) MD5=6647FCE6FC4970DAAFE5C64C794513D3 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.22662_none_b54f51417cd8f970\tcpip.sys
[2010/06/16 17:39:32 | 000,912,776 | ---- | M] (Microsoft Corporation) MD5=6A10AFCE0B38371064BE41C1FBFD3C6B -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.22425_none_b57d8e037cb5db63\tcpip.sys
[2013/07/05 04:20:37 | 000,914,880 | ---- | M] (Microsoft Corporation) MD5=6D0D344F643E28B31262AC2682109A3C -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.23152_none_b55a00e77cd1055d\tcpip.sys
[2013/01/04 12:28:18 | 000,905,576 | ---- | M] (Microsoft Corporation) MD5=74E2D020C47BB2B2FCCBA29A518A7EB4 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18764_none_b4c7b8d663b986a2\tcpip.sys
[2010/06/16 16:59:54 | 000,898,952 | ---- | M] (Microsoft Corporation) MD5=782568AB6A43160A159B6215B70BCCE9 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18493_none_b2bfcb7c66ac7d10\tcpip.sys
[2011/09/20 22:02:55 | 000,905,088 | ---- | M] (Microsoft Corporation) MD5=814A1C66FBD4E1B310A517221F1456BF -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18519_none_b502c618638c7f52\tcpip.sys
[2008/04/26 09:26:49 | 000,891,448 | ---- | M] (Microsoft Corporation) MD5=82E266BEE5F0167E41C6ECFDD2A79C02 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18063_none_b2e033a8669434a1\tcpip.sys
[2009/12/08 18:58:13 | 000,813,568 | ---- | M] (Microsoft Corporation) MD5=8734BD051FFDCBF8425CF222141C3741 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.16973_none_5f56ae52926920d8\tcpip.sys
[2009/08/14 18:07:56 | 000,897,608 | ---- | M] (Microsoft Corporation) MD5=8A7AD2A214233F684242F289ED83EBC3 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18311_none_b3144862666d6db3\tcpip.sys
[2010/02/18 18:36:50 | 000,902,024 | ---- | M] (Microsoft Corporation) MD5=93A5655CD9CD2F080EF1CB71A3666215 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22636_none_b38d4a937f96be60\tcpip.sys
[2014/04/05 04:23:10 | 000,915,392 | ---- | M] (Microsoft Corporation) MD5=A4196D394207369E1431E8681B373312 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.23370_none_b54264477ce304df\tcpip.sys
[2010/06/16 17:04:57 | 000,905,088 | ---- | M] (Microsoft Corporation) MD5=A474879AFA4A596B3A531F3E69730DBF -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18272_none_b4baded863c37e22\tcpip.sys
[2014/04/05 03:42:27 | 000,905,664 | ---- | M] (Microsoft Corporation) MD5=C7B0746FCD576D7EEBA6A2530B0B2966 -- C:\Windows\System32\drivers\tcpip.sys
[2014/04/05 03:42:27 | 000,905,664 | ---- | M] (Microsoft Corporation) MD5=C7B0746FCD576D7EEBA6A2530B0B2966 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.19080_none_b4adf3c463cd86b8\tcpip.sys
[2009/12/08 18:45:32 | 000,816,640 | ---- | M] (Microsoft Corporation) MD5=CA3A5756672013A66BB9D547A5A62DCA -- C:\Windows\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.21175_none_5fe223d3ab852692\tcpip.sys
[2013/07/05 05:53:33 | 000,905,664 | ---- | M] (Microsoft Corporation) MD5=D18D53974FD715D50FC76F9FFE1C830D -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18880_none_b4ae19bc63cd564f\tcpip.sys
[2010/02/18 15:22:11 | 000,910,216 | ---- | M] (Microsoft Corporation) MD5=D9F5DD5BBC8348E8F8220CCBF14C022E -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.22341_none_b563eb1d7cc9b0c2\tcpip.sys
[2009/12/08 21:01:08 | 000,904,776 | ---- | M] (Microsoft Corporation) MD5=DA467E7619AE5F4588E6262C13C8940A -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18160_none_b4c3ac4a63bd325c\tcpip.sys
[2012/03/30 13:39:11 | 000,914,304 | ---- | M] (Microsoft Corporation) MD5=EE7E10BED85C312C1D5D30C435BDDA9F -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.22828_none_b58096797cb31c04\tcpip.sys
[2008/01/21 03:34:55 | 000,891,448 | ---- | M] (Microsoft Corporation) MD5=FC6E2835D667774D409C7C7021EAF9C4 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18000_none_b31e1252666640f6\tcpip.sys
[2009/08/14 17:33:50 | 000,905,784 | ---- | M] (Microsoft Corporation) MD5=FF71856BD4CD6D4367F9FD84BE79A874 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.22200_none_b58e289d7caa2a80\tcpip.sys

[color=#A23BEC]< MD5 for: USERINIT.EXE >[/color]
[2008/01/21 03:34:37 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008/01/21 03:34:37 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe

[color=#A23BEC]< MD5 for: VOLSNAP.SYS >[/color]
[2006/11/02 10:51:18 | 000,208,488 | ---- | M] (Microsoft Corporation) MD5=11EF6C1CAEF76B685233450A126125D6 -- C:\Windows\System32\DriverStore\FileRepository\volume.inf_9320b452\volsnap.sys
[2009/04/11 07:32:55 | 000,226,280 | ---- | M] (Microsoft Corporation) MD5=147281C01FCB1DF9252DE2A10D5E7093 -- C:\Windows\System32\DriverStore\FileRepository\volume.inf_1e6030e4\volsnap.sys
[2009/04/11 07:32:55 | 000,226,280 | ---- | M] (Microsoft Corporation) MD5=147281C01FCB1DF9252DE2A10D5E7093 -- C:\Windows\winsxs\x86_volume.inf_31bf3856ad364e35_6.0.6002.18005_none_17a2308cf936c619\volsnap.sys
[2012/08/21 12:47:42 | 000,225,664 | ---- | M] (Microsoft Corporation) MD5=559F1DB6586DE2EE8E25E172A0CA9A3C -- C:\Windows\winsxs\x86_volume.inf_31bf3856ad364e35_6.0.6002.22913_none_181f0c08125e385e\volsnap.sys
[2012/08/21 12:47:42 | 000,224,640 | ---- | M] (Microsoft Corporation) MD5=786DB5771F05EF300390399F626BF30A -- C:\Windows\System32\drivers\volsnap.sys
[2012/08/21 12:47:42 | 000,224,640 | ---- | M] (Microsoft Corporation) MD5=786DB5771F05EF300390399F626BF30A -- C:\Windows\System32\DriverStore\FileRepository\volume.inf_2abeaeba\volsnap.sys
[2012/08/21 12:47:42 | 000,224,640 | ---- | M] (Microsoft Corporation) MD5=786DB5771F05EF300390399F626BF30A -- C:\Windows\winsxs\x86_volume.inf_31bf3856ad364e35_6.0.6002.18679_none_175a8da4f96bddf6\volsnap.sys
[2008/01/21 03:32:47 | 000,227,896 | ---- | M] (Microsoft Corporation) MD5=D8B4A53DD2769F226B3EB374374987C9 -- C:\Windows\System32\DriverStore\FileRepository\volume.inf_f53a1785\volsnap.sys
[2008/01/21 03:32:47 | 000,227,896 | ---- | M] (Microsoft Corporation) MD5=D8B4A53DD2769F226B3EB374374987C9 -- C:\Windows\winsxs\x86_volume.inf_31bf3856ad364e35_6.0.6001.18000_none_15b6b780fc14facd\volsnap.sys

[color=#A23BEC]< MD5 for: WININIT.EXE >[/color]
[2008/01/21 03:33:13 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008/01/21 03:33:13 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe

[color=#A23BEC]< MD5 for: WINLOGON.EXE >[/color]
[2009/04/11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009/04/11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2008/01/21 03:34:38 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
[2016/03/10 13:07:16 | 000,960,480 | ---- | M] (MalwareBytes) MD5=F86A4139730504047F52CCFB8C47E9F5 -- C:\Program Files\Malwarebytes Anti-Malware\Chameleon\Windows\winlogon.exe

[color=#A23BEC]< %APPDATA%\*.exe /s >[/color]
[2008/04/02 13:35:18 | 007,945,216 | ---- | M] () -- C:\Users\francine\AppData\Roaming\Cocoon Software\QuickMediaConverter\bin\Hd\FFmpeg.exe
[2010/03/25 11:05:46 | 011,222,528 | ---- | M] () -- C:\Users\francine\AppData\Roaming\Cocoon Software\QuickMediaConverter\bin\Std\FFmpeg.exe
[2013/11/29 10:19:02 | 000,054,632 | ---- | M] (Adobe Systems Inc.) -- C:\Users\francine\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2009/04/14 17:03:32 | 000,086,576 | ---- | M] (Microsoft Corporation) -- C:\Users\francine\AppData\Roaming\Microsoft\Services Windows Live\Raccourci Galerie de Photos Windows Live.exe
[2009/04/14 17:03:26 | 000,132,672 | ---- | M] (Microsoft Corporation) -- C:\Users\francine\AppData\Roaming\Microsoft\Services Windows Live\Raccourci Windows Live Messenger.exe
[2016/10/03 12:29:29 | 034,122,240 | ---- | M] () -- C:\Users\francine\AppData\Roaming\Mozilla\Firefox\Profiles\z6nr9qrz.default-1472375335728\ffmpeg.exe
[2007/08/29 15:36:06 | 000,167,424 | ---- | M] () -- C:\Users\francine\AppData\Roaming\NCH Software\Components\aacdec\aacdec.exe
[2007/08/29 15:36:00 | 000,110,592 | ---- | M] () -- C:\Users\francine\AppData\Roaming\NCH Software\Components\mp3el\mp3enc.exe
[2007/08/29 14:36:02 | 000,074,240 | ---- | M] () -- C:\Users\francine\AppData\Roaming\NCH Software\Components\oggdec\oggdec.exe
[2015/08/27 19:49:36 | 000,096,928 | ---- | M] (NCH Software) -- C:\Users\francine\AppData\Roaming\NCH Swift Sound\Program Files\ToolBox\tbsetup_v1.13.exe
[2015/08/27 19:49:46 | 000,176,132 | ---- | M] (NCH Software) -- C:\Users\francine\AppData\Roaming\NCH Swift Sound\Program Files\ToolBox\toolbox.exe
[2015/08/27 19:49:46 | 000,176,132 | ---- | M] (NCH Software) -- C:\Users\francine\AppData\Roaming\NCH Swift Sound\Program Files\ToolBox\uninst.exe
[2016/10/26 08:55:54 | 002,472,960 | ---- | M] () -- C:\Users\francine\AppData\Roaming\ZHP\ZHPCleaner.exe
[2015/08/19 19:09:06 | 037,329,920 | ---- | M] () -- C:\Users\francine\AppData\Roaming\ZHP\Quarantine\Microsoft Office 2010 Toolkit.exe
[213 C:\Users\francine\AppData\Roaming\ZHP\Quarantine\*.tmp files -> C:\Users\francine\AppData\Roaming\ZHP\Quarantine\*.tmp -> ]
[2016/10/17 11:16:24 | 000,711,952 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Users\francine\AppData\Roaming\ZHP\Quarantine\AVG.DIR\Avg\Setup\avgntdumpx.exe
[2016/10/17 11:17:12 | 001,871,632 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Users\francine\AppData\Roaming\ZHP\Quarantine\AVG.DIR\Avg\Setup\avgsetupwrkx.exe
[2016/10/17 11:16:23 | 003,672,848 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Users\francine\AppData\Roaming\ZHP\Quarantine\AVG.DIR\Avg\Setup\avgsetupx.exe
[2016/10/17 11:18:34 | 000,032,016 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Users\francine\AppData\Roaming\ZHP\Quarantine\AVG.DIR\Avg\Setup\fmw\avgrdsttestx.exe

[color=#A23BEC]< %APPDATA%\Adobe\Update\*.* >[/color]

[color=#A23BEC]< %APPDATA%\Update\*.* >[/color]

[color=#A23BEC]< %APPDATA%\Microsoft\*.* >[/color]

[color=#A23BEC]< %ALLUSERSPROFILE%\Favorites\*.* >[/color]

[color=#A23BEC]< %ALLUSERSPROFILE%\*.* >[/color]
[2012/07/08 13:51:10 | 000,000,057 | ---- | M] () -- C:\ProgramData\Ament.ini

[color=#A23BEC]< %SYSTEMDRIVE%\*.* >[/color]
[2006/09/18 22:43:36 | 000,000,024 | ---- | M] () -- C:\autoexec.bat
[2009/04/11 07:36:36 | 000,333,257 | RHS- | M] () -- C:\bootmgr
[2006/09/18 22:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys
[2016/11/04 15:18:12 | 1876,119,552 | -HS- | M] () -- C:\hiberfil.sys
[2011/03/28 09:48:23 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2011/03/28 09:48:23 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2016/11/04 15:18:09 | 2191,994,880 | -HS- | M] () -- C:\pagefile.sys

[color=#A23BEC]< %PROGRAMFILES%\*.* >[/color]
[2008/01/21 03:57:01 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini

[color=#A23BEC]< %PROGRAMFILES%\Internet Explorer\*.* >[/color]
[2016/07/15 22:25:42 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\ExtExport.exe
[2008/01/21 03:33:45 | 000,069,632 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\hmmapi.dll
[2015/12/17 12:03:55 | 000,002,535 | ---- | M] () -- C:\Program Files\Internet Explorer\ie9props.propdesc
[2015/12/17 12:03:57 | 000,107,008 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iecleanup.exe
[2011/08/13 05:43:15 | 000,006,144 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iecompat.dll
[2015/12/17 12:03:56 | 000,307,200 | ---- | M] () -- C:\Program Files\Internet Explorer\iediagcmd.exe
[2016/07/15 22:26:13 | 000,678,912 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iedvtool.dll
[2016/07/15 22:25:45 | 000,474,624 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\ieinstal.exe
[2016/07/15 22:25:44 | 000,223,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\ielowutil.exe
[2016/07/15 22:25:33 | 000,195,072 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\ieproxy.dll
[2016/07/15 22:25:34 | 000,194,560 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\IEShims.dll
[2009/03/07 02:11:16 | 000,004,169 | ---- | M] () -- C:\Program Files\Internet Explorer\iessetup.ceb
[2006/11/02 10:46:05 | 000,016,384 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iessetup.dll
[2016/07/15 22:36:44 | 000,758,512 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iexplore.exe
[2016/07/15 22:25:54 | 000,388,096 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\jsdbgui.dll
[2016/07/15 22:25:49 | 000,104,448 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\jsdebuggeride.dll
[2015/12/17 12:03:45 | 000,049,664 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\JSProfilerCore.dll
[2015/12/17 12:03:40 | 000,149,504 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\jsprofilerui.dll
[2009/01/08 02:20:17 | 000,265,720 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\msdbg2.dll
[2015/12/17 12:03:50 | 000,301,056 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\networkinspection.dll
[2009/01/08 02:20:17 | 000,355,832 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\pdm.dll
[2016/07/15 22:36:44 | 000,149,744 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\sqmapi.dll

[color=#A23BEC]< %USERPROFILE%\*.* >[/color]
[2015/08/27 13:42:22 | 000,000,128 | --S- | M] () -- C:\Users\francine\Autre lien vers Desktop
[2016/08/21 13:54:58 | 001,223,210 | ---- | M] () -- C:\Users\francine\DSCF4387.JPG
[2015/08/27 13:41:33 | 000,000,128 | --S- | M] () -- C:\Users\francine\Lien vers Desktop
[2016/11/04 20:23:52 | 012,058,624 | -HS- | M] () -- C:\Users\francine\ntuser.dat
[2009/03/23 10:07:08 | 000,262,144 | -H-- | M] () -- C:\Users\francine\NTUSER.DAT.COPY.TMP.LOG1
[2008/11/23 12:07:14 | 000,000,000 | -H-- | M] () -- C:\Users\francine\NTUSER.DAT.COPY.TMP.LOG2
[2016/11/04 20:23:51 | 000,262,144 | -H-- | M] () -- C:\Users\francine\ntuser.dat.LOG1
[2015/12/27 08:41:56 | 000,262,144 | -H-- | M] () -- C:\Users\francine\ntuser.dat.LOG2
[2013/05/30 21:50:00 | 000,065,536 | -HS- | M] () -- C:\Users\francine\ntuser.dat{096e6000-62e1-11e2-a374-001fe2041d79}.TM.blf
[2013/05/30 21:50:00 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{096e6000-62e1-11e2-a374-001fe2041d79}.TMContainer00000000000000000001.regtrans-ms
[2013/01/21 00:22:50 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{096e6000-62e1-11e2-a374-001fe2041d79}.TMContainer00000000000000000002.regtrans-ms
[2011/10/13 08:58:31 | 000,065,536 | -HS- | M] () -- C:\Users\francine\ntuser.dat{11bd0c3c-5fea-11df-87a3-001fe2041d79}.TM.blf
[2011/10/13 08:58:31 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{11bd0c3c-5fea-11df-87a3-001fe2041d79}.TMContainer00000000000000000001.regtrans-ms
[2010/05/15 21:44:42 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{11bd0c3c-5fea-11df-87a3-001fe2041d79}.TMContainer00000000000000000002.regtrans-ms
[2013/10/15 17:24:36 | 000,065,536 | -HS- | M] () -- C:\Users\francine\ntuser.dat{15290c00-c9d0-11e2-8295-001fe2041d79}.TM.blf
[2013/10/15 17:24:36 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{15290c00-c9d0-11e2-8295-001fe2041d79}.TMContainer00000000000000000001.regtrans-ms
[2013/05/31 23:13:37 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{15290c00-c9d0-11e2-8295-001fe2041d79}.TMContainer00000000000000000002.regtrans-ms
[2010/04/06 11:59:17 | 000,065,536 | -HS- | M] () -- C:\Users\francine\ntuser.dat{1f1636f8-fd36-11de-beb2-001fe2041d79}.TM.blf
[2010/04/06 11:59:17 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{1f1636f8-fd36-11de-beb2-001fe2041d79}.TMContainer00000000000000000001.regtrans-ms
[2010/01/09 20:45:41 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{1f1636f8-fd36-11de-beb2-001fe2041d79}.TMContainer00000000000000000002.regtrans-ms
[2014/08/22 21:25:24 | 000,065,536 | -HS- | M] () -- C:\Users\francine\ntuser.dat{290c79e1-0505-11e4-9fc2-001fe2041d79}.TM.blf
[2014/08/22 21:25:24 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{290c79e1-0505-11e4-9fc2-001fe2041d79}.TMContainer00000000000000000001.regtrans-ms
[2014/07/06 22:29:55 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{290c79e1-0505-11e4-9fc2-001fe2041d79}.TMContainer00000000000000000002.regtrans-ms
[2009/11/07 22:05:52 | 000,065,536 | -HS- | M] () -- C:\Users\francine\ntuser.dat{7110689d-c220-11de-9f82-001fe2041d79}.TM.blf
[2009/11/07 22:05:52 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{7110689d-c220-11de-9f82-001fe2041d79}.TMContainer00000000000000000001.regtrans-ms
[2009/10/26 21:44:11 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{7110689d-c220-11de-9f82-001fe2041d79}.TMContainer00000000000000000002.regtrans-ms
[2009/10/26 18:15:37 | 000,065,536 | -HS- | M] () -- C:\Users\francine\ntuser.dat{71e56005-9f6b-11de-b2d4-001fe2041d79}.TM.blf
[2009/10/26 18:15:37 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{71e56005-9f6b-11de-b2d4-001fe2041d79}.TMContainer00000000000000000001.regtrans-ms
[2009/09/12 22:12:40 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{71e56005-9f6b-11de-b2d4-001fe2041d79}.TMContainer00000000000000000002.regtrans-ms
[2012/10/31 00:32:21 | 000,065,536 | -HS- | M] () -- C:\Users\francine\ntuser.dat{793398d4-f572-11e0-8e7b-001fe2041d79}.TM.blf
[2012/10/31 00:32:21 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{793398d4-f572-11e0-8e7b-001fe2041d79}.TMContainer00000000000000000001.regtrans-ms
[2011/10/13 22:14:55 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{793398d4-f572-11e0-8e7b-001fe2041d79}.TMContainer00000000000000000002.regtrans-ms
[2014/07/05 11:34:47 | 000,065,536 | -HS- | M] () -- C:\Users\francine\ntuser.dat{7aacb9df-35b4-11e3-9324-001fe2041d79}.TM.blf
[2014/07/05 11:34:47 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{7aacb9df-35b4-11e3-9324-001fe2041d79}.TMContainer00000000000000000001.regtrans-ms
[2013/10/15 22:05:35 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{7aacb9df-35b4-11e3-9324-001fe2041d79}.TMContainer00000000000000000002.regtrans-ms
[2009/11/27 10:28:27 | 000,065,536 | -HS- | M] () -- C:\Users\francine\ntuser.dat{7b3b9cdb-d851-11de-9355-001fe2041d79}.TM.blf
[2009/11/27 10:28:27 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{7b3b9cdb-d851-11de-9355-001fe2041d79}.TMContainer00000000000000000001.regtrans-ms
[2009/11/23 22:51:02 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{7b3b9cdb-d851-11de-9355-001fe2041d79}.TMContainer00000000000000000002.regtrans-ms
[2009/09/12 18:16:08 | 000,065,536 | -HS- | M] () -- C:\Users\francine\ntuser.dat{7c5a4f1b-9ab6-11de-b219-001fe2041d79}.TM.blf
[2009/09/12 18:16:08 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{7c5a4f1b-9ab6-11de-b219-001fe2041d79}.TMContainer00000000000000000001.regtrans-ms
[2009/09/06 08:28:30 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{7c5a4f1b-9ab6-11de-b219-001fe2041d79}.TMContainer00000000000000000002.regtrans-ms
[2010/05/14 23:17:39 | 000,065,536 | -HS- | M] () -- C:\Users\francine\ntuser.dat{7e6efce9-414a-11df-8102-001fe2041d79}.TM.blf
[2010/05/14 23:17:39 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{7e6efce9-414a-11df-8102-001fe2041d79}.TMContainer00000000000000000001.regtrans-ms
[2010/04/06 23:14:48 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{7e6efce9-414a-11df-8102-001fe2041d79}.TMContainer00000000000000000002.regtrans-ms
[2009/11/23 22:40:18 | 000,065,536 | -HS- | M] () -- C:\Users\francine\ntuser.dat{9ac4261a-cc41-11de-bfdb-001fe2041d79}.TM.blf
[2009/11/23 22:40:18 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{9ac4261a-cc41-11de-bfdb-001fe2041d79}.TMContainer00000000000000000001.regtrans-ms
[2009/11/09 01:02:56 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{9ac4261a-cc41-11de-bfdb-001fe2041d79}.TMContainer00000000000000000002.regtrans-ms
[2015/04/24 21:45:29 | 000,065,536 | -HS- | M] () -- C:\Users\francine\ntuser.dat{9caddf80-2a9a-11e4-8093-001fe2041d79}.TM.blf
[2015/04/24 21:45:29 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{9caddf80-2a9a-11e4-8093-001fe2041d79}.TMContainer00000000000000000001.regtrans-ms
[2014/08/23 21:48:28 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{9caddf80-2a9a-11e4-8093-001fe2041d79}.TMContainer00000000000000000002.regtrans-ms
[2013/01/19 23:17:53 | 000,065,536 | -HS- | M] () -- C:\Users\francine\ntuser.dat{ac980f1a-2331-11e2-a638-001fe2041d79}.TM.blf
[2013/01/19 23:17:53 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{ac980f1a-2331-11e2-a638-001fe2041d79}.TMContainer00000000000000000001.regtrans-ms
[2012/10/31 22:54:40 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{ac980f1a-2331-11e2-a638-001fe2041d79}.TMContainer00000000000000000002.regtrans-ms
[2009/11/22 19:29:43 | 000,065,536 | -HS- | M] () -- C:\Users\francine\ntuser.dat{aebb2873-d675-11de-9937-001fe2041d79}.TM.blf
[2009/11/22 19:29:43 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{aebb2873-d675-11de-9937-001fe2041d79}.TMContainer00000000000000000001.regtrans-ms
[2009/11/21 16:12:34 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{aebb2873-d675-11de-9937-001fe2041d79}.TMContainer00000000000000000002.regtrans-ms
[2010/01/09 16:51:27 | 000,065,536 | -HS- | M] () -- C:\Users\francine\ntuser.dat{ccdb5358-db36-11de-bf6c-001fe2041d79}.TM.blf
[2010/01/09 16:51:27 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{ccdb5358-db36-11de-bf6c-001fe2041d79}.TMContainer00000000000000000001.regtrans-ms
[2009/11/27 11:16:23 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{ccdb5358-db36-11de-bf6c-001fe2041d79}.TMContainer00000000000000000002.regtrans-ms
[2016/11/04 15:14:16 | 000,065,536 | -HS- | M] () -- C:\Users\francine\ntuser.dat{ce4444dd-eb1e-11e4-a148-001fe2041d79}.TM.blf
[2016/11/04 15:14:16 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{ce4444dd-eb1e-11e4-a148-001fe2041d79}.TMContainer00000000000000000001.regtrans-ms
[2015/04/25 21:30:31 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{ce4444dd-eb1e-11e4-a148-001fe2041d79}.TMContainer00000000000000000002.regtrans-ms
[2009/09/05 21:31:47 | 000,065,536 | -HS- | M] () -- C:\Users\francine\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TM.blf
[2009/09/05 21:31:47 | 000,524,288 | -HS- | M] () -- C:\Users\francine\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TMContainer00000000000000000001.regtrans-ms
[2008/10/08 18:33:49 | 000,524,288 | -HS- | M] () -- C:\Users\francine\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TMContainer00000000000000000002.regtrans-ms
[2008/10/08 10:20:48 | 000,000,020 | -HS- | M] () -- C:\Users\francine\ntuser.ini
[2016/10/20 18:20:30 | 000,007,168 | -H-- | M] () -- C:\Users\francine\photothumb.db
[2016/10/20 11:32:18 | 002,418,176 | ---- | M] () -- C:\Users\francine\ZHPDiag3.exe

[color=#A23BEC]< %Temp%\smtmp\1\*.* >[/color]

[color=#A23BEC]< %Temp%\smtmp\2\*.* >[/color]

[color=#A23BEC]< %Temp%\smtmp\3\*.* >[/color]

[color=#A23BEC]< %Temp%\smtmp\4\*.* >[/color]

[color=#A23BEC]< %USERPROFILE%\Local Settings\Temp\*.exe >[/color]

[color=#A23BEC]< %USERPROFILE%\Local Settings\Temp\*.dll >[/color]

[color=#A23BEC]< %USERPROFILE%\Application Data\*.exe >[/color]

[color=#A23BEC]< %systemroot%\system32\DBBK\*.* /s >[/color]

[color=#A23BEC]< %systemroot%\system32\config\systemprofile\*.* >[/color]
[2016/10/30 13:47:16 | 000,262,144 | ---- | M] () -- C:\Windows\system32\config\systemprofile\ntuser.dat
[2008/01/21 08:26:38 | 000,001,024 | -H-- | M] () -- C:\Windows\system32\config\systemprofile\ntuser.dat.LOG
[2016/10/30 13:47:15 | 000,262,144 | -H-- | M] () -- C:\Windows\system32\config\systemprofile\ntuser.dat.LOG1
[2006/11/02 13:40:55 | 000,000,000 | -H-- | M] () -- C:\Windows\system32\config\systemprofile\ntuser.dat.LOG2
[2016/10/30 13:47:15 | 000,065,536 | -HS- | M] () -- C:\Windows\system32\config\systemprofile\ntuser.dat{350e4ef8-c7c1-11dc-b86a-806e6f6e6963}.TM.blf
[2016/10/30 13:47:15 | 000,524,288 | -HS- | M] () -- C:\Windows\system32\config\systemprofile\ntuser.dat{350e4ef8-c7c1-11dc-b86a-806e6f6e6963}.TMContainer00000000000000000001.regtrans-ms
[2008/01/21 02:36:13 | 000,524,288 | -HS- | M] () -- C:\Windows\system32\config\systemprofile\ntuser.dat{350e4ef8-c7c1-11dc-b86a-806e6f6e6963}.TMContainer00000000000000000002.regtrans-ms

[color=#A23BEC]< %systemroot%\*. /mp /s >[/color]

[color=#A23BEC]< %systemroot%\*.exe /90 >[/color]

[color=#A23BEC]< %systemroot%\system32\*.dll /lockedfiles >[/color]

[color=#A23BEC]< %systemroot%\system32\*.dll /90 >[/color]

[color=#A23BEC]< %systemroot%\system32\drivers\*.sys /lockedfiles >[/color]

[color=#A23BEC]< %systemroot%\system32\drivers\*.sys /90 >[/color]
[2016/09/22 14:44:06 | 000,257,792 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\system32\drivers\avgidsdriverx.sys
[2016/09/20 16:53:22 | 000,218,880 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\system32\drivers\avgldx86.sys
[2016/09/26 18:19:18 | 000,197,376 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\system32\drivers\avgmfx86.sys
[2016/10/09 14:55:11 | 000,170,200 | ---- | M] (Malwarebytes) -- C:\Windows\system32\drivers\MBAMSwissArmy.sys
[2016/10/31 19:51:03 | 000,024,688 | ---- | M] () -- C:\Windows\system32\drivers\TrueSight.sys

[color=#A23BEC]< %systemroot%\system32\*.exe /90 >[/color]
[2016/11/03 09:53:52 | 000,796,352 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\system32\FlashPlayerApp.exe
[2016/10/26 17:29:08 | 000,407,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\MpSigStub.exe
[2016/09/05 19:48:55 | 144,884,648 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mrt.exe

[color=#A23BEC]< %systemroot%\system32\config\*.sav >[/color]
[2008/03/16 15:06:05 | 012,148,736 | ---- | M] () -- C:\Windows\system32\config\COMPONENTS.SAV
[2008/03/16 15:06:02 | 000,102,400 | ---- | M] () -- C:\Windows\system32\config\DEFAULT.SAV
[2008/03/16 15:06:06 | 000,020,480 | ---- | M] () -- C:\Windows\system32\config\SECURITY.SAV
[2008/03/16 15:06:12 | 016,576,512 | ---- | M] () -- C:\Windows\system32\config\SOFTWARE.SAV
[2008/03/16 15:06:14 | 006,606,848 | ---- | M] () -- C:\Windows\system32\config\SYSTEM.SAV

[color=#A23BEC]< %systemroot%\system32\spool\prtprocs\w32x86\*.* >[/color]
[2006/12/25 21:00:00 | 000,027,136 | ---- | M] (CANON INC.) -- C:\Windows\system32\spool\prtprocs\w32x86\CNMPD8R.DLL
[2006/12/25 21:00:00 | 000,069,632 | ---- | M] (CANON INC.) -- C:\Windows\system32\spool\prtprocs\w32x86\CNMPP8R.DLL
[2006/10/26 19:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\msonpppr.dll

[color=#A23BEC]< %systemroot%\Tasks\*.job /lockedfiles >[/color]

[color=#A23BEC]< %systemroot%\assembly\tmp\*.* /S /MD5 >[/color]

[color=#A23BEC]< %systemroot%\assembly\GAC_32\*.* /S /MD5 >[/color]
[2014/07/13 13:55:56 | 000,062,976 | ---- | M] () MD5=6BDC7DBB390872A2D975687F5FC29358 -- C:\Windows\assembly\GAC_32\cli_cppuhelper\1.0.23.0__ce2cb7e279207b9e\cli_cppuhelper.dll
[2014/05/08 00:41:59 | 000,069,120 | ---- | M] () MD5=081F0B876BB85888AE96B9A009D30ACB -- C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
[2014/05/08 00:42:03 | 000,072,192 | ---- | M] () MD5=D653F464A098D38CDD4642A0A08D0276 -- C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
[2009/04/11 07:31:17 | 000,507,904 | ---- | M] () MD5=F20BA0C9DCD43D7A1E8586D5919AA5E1 -- C:\Windows\assembly\GAC_32\Microsoft.Ink\6.0.0.0__31bf3856ad364e35\Microsoft.Ink.dll
[2006/11/02 10:47:01 | 000,077,824 | ---- | M] () MD5=7AAFBF522A988D2A093A4CEFBE5633FE -- C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\Microsoft.Interop.Security.AzRoles.dll
[2015/09/29 18:01:13 | 000,117,160 | ---- | M] () MD5=569124F95660007F8C470D00A96CBD7D -- C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Infopath.Client.Internal.Host.Interop.dll
[2014/06/26 23:17:19 | 000,163,840 | ---- | M] () MD5=63AD74E356E4A0CA57471E59138943DA -- C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll
[2015/09/27 13:18:38 | 000,367,400 | ---- | M] () MD5=6CAD87F2BE4A4BC31D3FD5C923741418 -- C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.InteropAdapter.dll
[2006/09/18 22:32:28 | 000,066,728 | ---- | M] () MD5=C01B81BB10AD14DBC5C4ECD350638096 -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\big5.nlp
[2006/09/18 22:32:28 | 000,082,172 | ---- | M] () MD5=EE1F60F8774D74BED8B13498F3FE737A -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\bopomofo.nlp
[2006/09/18 22:32:39 | 000,116,756 | ---- | M] () MD5=F6DFDA5A31162D848634504565F6D321 -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\ksc.nlp
[2014/07/03 23:17:38 | 004,550,656 | ---- | M] () MD5=A3CF1A31A420D239B92D04BA44F6B94E -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
[2006/09/18 22:32:52 | 000,059,342 | ---- | M] () MD5=DA5748A89E22A3932387E65694B25BBB -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normidna.nlp
[2006/09/18 22:32:52 | 000,045,794 | ---- | M] () MD5=3831A5E217D6FA828CCE1011DA26E677 -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfc.nlp
[2006/09/18 22:32:52 | 000,039,284 | ---- | M] () MD5=DBDE664E0BA4BACD0A6A04AE2232B205 -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfd.nlp
[2006/09/18 22:32:52 | 000,066,384 | ---- | M] () MD5=C9B88B759FE81D59CE8EBF5A0A8EB75A -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfkc.nlp
[2006/09/18 22:32:52 | 000,060,294 | ---- | M] () MD5=3CAB6AB66759FCDF73B61EE262C9ACF4 -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfkd.nlp
[2006/09/18 22:32:52 | 000,083,748 | ---- | M] () MD5=54144F43EDF5AA8F504A30E7C1D1A7B5 -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\prc.nlp
[2006/09/18 22:32:52 | 000,083,748 | ---- | M] () MD5=901863C68E6523336CAC602FE9320ABC -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\prcp.nlp
[2006/09/18 22:32:53 | 000,262,148 | ---- | M] ()[b] Unable to obtain MD5[/b] -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
[2006/09/18 22:32:53 | 000,020,320 | ---- | M] ()[b] Unable to obtain MD5[/b] -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
[2006/09/18 22:33:03 | 000,028,288 | ---- | M] () MD5=09E420F90A329BDA68477FA4AF43CB28 -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\xjis.nlp
[2008/01/21 03:34:17 | 000,046,080 | ---- | M] () MD5=18A24D038910FB55AC04EDC30B95BEC3 -- C:\Windows\assembly\GAC_32\napcrypt\6.0.0.0__31bf3856ad364e35\NAPCRYPT.DLL
[2008/01/21 03:34:24 | 000,103,936 | ---- | M] () MD5=B621CEA9D376BB8E85D6F65807068281 -- C:\Windows\assembly\GAC_32\naphlpr\6.0.0.0__31bf3856ad364e35\NAPHLPR.DLL
[2014/07/13 13:56:02 | 000,000,382 | ---- | M] () MD5=7C5EE283EC0F3E6A81B37D5B29E89833 -- C:\Windows\assembly\GAC_32\policy.1.0.cli_cppuhelper\23.0.0.0__ce2cb7e279207b9e\cli_cppuhelper.config
[2014/07/13 13:56:02 | 000,003,072 | ---- | M] () MD5=926256CE4BB1DA2F93115A6DD1867D3F -- C:\Windows\assembly\GAC_32\policy.1.0.cli_cppuhelper\23.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_cppuhelper.dll
[2006/11/02 13:34:39 | 000,000,446 | ---- | M] () MD5=41D1BF747E31A9FE5B313795C341ED17 -- C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Ink\6.0.0.0__31bf3856ad364e35\Policy.1.0.Microsoft.Ink.config
[2006/11/02 13:34:39 | 000,005,632 | ---- | M] () MD5=F5941E3CF5909022C3AD6AC4D2804669 -- C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Ink\6.0.0.0__31bf3856ad364e35\Policy.1.0.Microsoft.Ink.dll
[2006/09/18 22:34:47 | 000,000,494 | ---- | M] () MD5=453626B1A59F62F9A141AC62F4E44E75 -- C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.0.6000.16386__31bf3856ad364e35\Microsoft.Interop.Security.AzRoles.config
[2006/11/02 10:47:07 | 000,005,632 | ---- | M] () MD5=F516E8DFA7E2538E03B383635840F698 -- C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.0.6000.16386__31bf3856ad364e35\Policy.1.0.Microsoft.Interop.Security.AzRoles.dll
[2006/09/18 22:34:47 | 000,000,494 | ---- | M] () MD5=453626B1A59F62F9A141AC62F4E44E75 -- C:\Windows\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.0.6000.16386__31bf3856ad364e35\Policy.1.2.Microsoft.Interop.Security.AzRoles.config
[2006/11/02 10:47:07 | 000,005,632 | ---- | M] () MD5=25BFE1285DED18CB7F5BFF465795E056 -- C:\Windows\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.0.6000.16386__31bf3856ad364e35\Policy.1.2.Microsoft.Interop.Security.AzRoles.dll
[2006/11/02 13:34:39 | 000,000,446 | ---- | M] () MD5=41D1BF747E31A9FE5B313795C341ED17 -- C:\Windows\assembly\GAC_32\Policy.1.7.Microsoft.Ink\6.0.0.0__31bf3856ad364e35\Policy.1.7.Microsoft.Ink.config
[2006/11/02 13:34:39 | 000,005,632 | ---- | M] () MD5=C057BC981DF01192671FDFDCCC200241 -- C:\Windows\assembly\GAC_32\Policy.1.7.Microsoft.Ink\6.0.0.0__31bf3856ad364e35\Policy.1.7.Microsoft.Ink.dll
[2016/03/17 16:02:09 | 004,222,976 | ---- | M] () MD5=6800C6316FF075EB50E366AFC393C421 -- C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationCore.dll
[2008/06/16 23:18:54 | 000,000,161 | ---- | M] () MD5=C0856EC51C8C75B8FDF02C1BBCFE7B93 -- C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe.config
[2016/03/17 16:02:10 | 001,736,864 | ---- | M] () MD5=DB38DF8C6B027C4308167BB3C9D30E4D -- C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\wpfgfx_v0300.dll
[2014/05/08 00:42:38 | 000,486,400 | ---- | M] () MD5=FC382069AF9560AB71679E0E1CB7B92B -- C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
[2016/05/24 14:10:49 | 002,958,848 | ---- | M] () MD5=6322180BCFBFB641E6937F7DA56B6675 -- C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
[2014/05/08 00:42:43 | 000,258,048 | ---- | M] () MD5=5F9FC2149F1E73434859B6BEC506738A -- C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
[2014/07/01 20:01:56 | 000,113,664 | ---- | M] () MD5=67BD46AB3313BE434667C679537044D7 -- C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
[2016/03/17 16:02:10 | 000,368,640 | ---- | M] () MD5=DDB8B729F92E0BCD92535ADE3AEE063E -- C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\System.Printing.dll
[2014/03/28 11:49:12 | 000,261,632 | ---- | M] () MD5=9CBDADD79847FA69BC798731F49AA44C -- C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
[2015/02/07 00:18:28 | 005,279,744 | ---- | M] () MD5=5DE593F4E508D1236CECCD1CA3E3641D -- C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll

[color=#A23BEC]< %systemroot%\assembly\GAC_64\*.* /S /MD5 >[/color]

[color=#A23BEC]< %windir%\ServiceProfiles\LocalService\AppData\Local\Temp\*.* >[/color]

[color=#A23BEC]< %windir%\ServiceProfiles\NetworkService\AppData\Local\Temp\*.* >[/color]

[color=#A23BEC]< %windir%\temp*.* >[/color]

[color=#A23BEC]< "%WinDir%\$NtUninstallKB*$." /30 >[/color]

[color=#A23BEC]< HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections >[/color]
"SavedLegacySettings" = 46 00 00 00 F5 35 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 90 A1 A1 70 64 DA D0 01 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 02 00 00 00 C0 A8 01 0B 00 00 00 00 00 00 00 00 0E 21 0D 1C 0D 1A 0E 02 0E 09 0D 1B 0D 17 0D 17 0D 1C 0D 1E 0D 21 0E 1A 0D 20 0D 19 0D 20 0D 1D 0E 0A 0E 0A 0E 09 0D 1A 0E 09 0D 1A 0E 09 0D 1C 0D 1F 0E 21 0D 20 0D 1F 07 4E 01 02 03 03 02 03 03 02 03 02 03 02 02 02 03 03 03 03 02 03 03 03 03 03 03 02 02 03 03 02 02 02 03 03 01 01 01 80 2B 06 82 80 3B 06 82 80 4B 06 82 80 5B 06 82 00 17 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 5D 00 56 10 00 00 56 10 00 00 B4 0D 60 DB 00 00 00 00 7B 38 42 46 33 33 41 42 33 2D 39 38 45 41 2D 34 44 43 42 2D 38 45 37 34 2D 32 31 35 41 37 45 33 38 33 39 45 35 7D 00 55 53 42 20 46 6C 61 73 68 20 44 72 69 76 65 00 00 44 69 73 71 75 65 20 61 6D 6F 76 69 62 6C 65 00 31 46 31 46 00 45 46 46 00 00 [Binary data over 200 bytes]
"DefaultConnectionSettings" = 46 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 90 A1 A1 70 64 DA D0 01 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 02 00 00 00 C0 A8 01 0B 00 00 00 00 00 00 00 00 0E 21 0D 1C 0D 1A 0E 02 0E 09 0D 1B 0D 17 0D 17 0D 1C 0D 1E 0D 21 0E 1A 0D 20 0D 19 0D 20 0D 1D 0E 0A 0E 0A 0E 09 0D 1A 0E 09 0D 1A 0E 09 0D 1C 0D 1F 0E 21 0D 20 0D 1F 07 4E 01 02 03 03 02 03 03 02 03 02 03 02 02 02 03 03 03 03 02 03 03 03 03 03 03 02 02 03 03 02 02 02 03 03 01 01 01 80 2B 06 82 80 3B 06 82 80 4B 06 82 80 5B 06 82 00 17 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 5D 00 56 10 00 00 56 10 00 00 B4 0D 60 DB 00 00 00 00 7B 38 42 46 33 33 41 42 33 2D 39 38 45 41 2D 34 44 43 42 2D 38 45 37 34 2D 32 31 35 41 37 45 33 38 33 39 45 35 7D 00 55 53 42 20 46 6C 61 73 68 20 44 72 69 76 65 00 00 44 69 73 71 75 65 20 61 6D 6F 76 69 62 6C 65 00 31 46 31 46 00 45 46 46 00 00 [Binary data over 200 bytes]

[color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >[/color]

[color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >[/color]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2016-09-06 19:15:08

[color=#A23BEC]< C:\Program Files\Common Files\ComObjects\*.* / >[/color]
Invalid Switch:

[color=#A23BEC]< %ALLUSERSPROFILE%\Application Data\*.exe /s >[/color]

[color=#A23BEC]< >[/color]
[2006/11/02 13:58:10 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT
[2006/11/02 13:58:10 | 000,032,502 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2016/11/01 18:53:05 | 000,001,002 | ---- | C] () -- C:\Windows\Tasks\Adobe Flash Player Updater.job

[color=#E56717]========== Files - Unicode (All) ==========[/color]
[2013/10/19 08:48:34 | 101,890,677 | ---- | M] ()(C:\Windows\System32\????) -- C:\Windows\System32\)lÁ\òš
[2013/10/19 08:48:34 | 101,890,677 | ---- | C] ()(C:\Windows\System32\????) -- C:\Windows\System32\)lÁ\òš
[2013/10/12 08:35:47 | 100,595,853 | ---- | M] ()(C:\Windows\System32\???1) -- C:\Windows\System32\¯˜z~\ò1
[2013/10/12 08:35:47 | 100,595,853 | ---- | C] ()(C:\Windows\System32\???1) -- C:\Windows\System32\¯˜z~\ò1

< End of report >

Publicité


Signaler le contenu de ce document

Publicité