Script ZHPFix
FirewallRaz
EmptyPrefetch
EmptyTemp



O39 - APT: Driver Booster SkipUAC (MouiiMou) - (...) -- C:\WINDOWS\System32\Tasks\Driver Booster SkipUAC (MouiiMou) [3050] (.Orphan.) =>.Superfluous.Orphan
O39 - APT: OneDrive Standalone Update Task - (...) -- C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task [2828] (.Orphan.) =>.Superfluous.Orphan
O39 - APT: OneDrive Standalone Update Task - (...) -- C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task v2 [3296] (.Orphan.) =>.Superfluous.Orphan
G0 - GCSP: Preferences [User Data\Default][HomePage] http://fb-s-b-a.akamaihd.net =>.Superfluous.AkamaiHD
G0 - GCSP: Preferences [User Data\Default][HomePage] http://fb-s-d-a.akamaihd.net =>.Superfluous.AkamaiHD
G0 - GCSP: Preferences [User Data\Default][HomePage] http://fbexternal-a.akamaihd.net =>.Superfluous.AkamaiHD
HKCU\SOFTWARE\undefined =>.Superfluous.Downloader
O43 - CFD: 03/04/2017 - [0] D -- C:\ProgramData\SWCUTemp
HKCU\SOFTWARE\csastats =>Adware.InstallCore
HKCU\SOFTWARE\ICSW1.23 =>Adware.InstallCore
HKCU\SOFTWARE\ProductSetup =>Adware.InstallCore

[MD5.00000000000000000000000000000000] [APT] [Driver Booster SkipUAC (MouiiMou)] (...) -- C:\Program Files (x86)\IObit\Driver Booster\4.2.0\DriverBooster.exe (.not file.) [0] (.Activate.) =>.Superfluous.Empty
[MD5.00000000000000000000000000000000] [APT] [OneDrive Standalone Update Task] (...) -- C:\Users\MouiiMou\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\OneDriveStandaloneUpdater.exe (.not file.) [0] (.Activate.) =>.Superfluous.Empty
O4 - HKLM\..\Run: [WAHELPER.EXE] C:\Program Files\WinArchiver\WAHELPER.EXE (.not file.)
O4 - HKLM\..\Wow6432Node\Run: [Wondershare Helper Compact.exe] C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe (.not file.)
G0 - GCSP: Preferences [User Data\Default][HomePage] http://coloredsand.us
G0 - GCSP: Preferences [User Data\Default][HomePage] http://event.shelljacket.us
G0 - GCSP: Preferences [User Data\Default][HomePage] http://s3-us-west-1.amazonaws.com
M0 - MFSP: prefs.js [MouiiMou - 1oibq7ls.default] http://10minutemail.com/
O4 - GS\Desktop [Administrator]: FICHE DE PAYE.lnk . (.aaaa - .) C:\Program Files (x86)\FICHE DE PAYE\FICHE DE PAYE.exe
O4 - GS\Desktop [Administrator]: Hein 4.4.1.lnk . (.Hero Hero - Hero Hero.) C:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\Hein.exe
O4 - GS\Desktop [Administrator]: Hein 4.5.lnk . (.Hero Hero - Hero Hero.) C:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\Hein.exe
O4 - GS\Desktop [Administrator]: Hein Recovery 1.7.lnk . (.Hero Hero - Hero Family.) C:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\Hein Recovery.exe
O4 - GS\Desktop [Administrator]: ???2 - ??????2 - Raccourci.lnk . (...) C:\Users\MouiiMou\Documents\?????? ???? ???1.docx
O4 - GS\Desktop [Guest]: FICHE DE PAYE.lnk . (.aaaa - .) C:\Program Files (x86)\FICHE DE PAYE\FICHE DE PAYE.exe
O4 - GS\Desktop [Guest]: Hein 4.4.1.lnk . (.Hero Hero - Hero Hero.) C:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\Hein.exe
O4 - GS\Desktop [Guest]: Hein 4.5.lnk . (.Hero Hero - Hero Hero.) C:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\Hein.exe
O4 - GS\Desktop [Guest]: Hein Recovery 1.7.lnk . (.Hero Hero - Hero Family.) C:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\Hein Recovery.exe
O4 - GS\Desktop [Guest]: ???2 - ??????2 - Raccourci.lnk . (...) C:\Users\MouiiMou\Documents\?????? ???? ???1.docx
O4 - GS\Desktop [MouiiMou]: FICHE DE PAYE.lnk . (.aaaa - .) C:\Program Files (x86)\FICHE DE PAYE\FICHE DE PAYE.exe
O4 - GS\Desktop [MouiiMou]: Hein 4.4.1.lnk . (.Hero Hero - Hero Hero.) C:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\Hein.exe
O4 - GS\Desktop [MouiiMou]: Hein 4.5.lnk . (.Hero Hero - Hero Hero.) C:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\Hein.exe
O4 - GS\Desktop [MouiiMou]: Hein Recovery 1.7.lnk . (.Hero Hero - Hero Family.) C:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\Hein Recovery.exe
O4 - GS\Desktop [MouiiMou]: ???2 - ??????2 - Raccourci.lnk . (...) C:\Users\MouiiMou\Documents\?????? ???? ???1.docx
O87 - FAEL: "UDP Query User{2DF260AF-0356-432E-A2F0-1CCE33D81F2D}C:\program files (x86)\counter-strike 1.6\hlds.exe" [In-None-P17-TRUE] .(...) -- C:\program files (x86)\counter-strike 1.6\hlds.exe (.not file.)
O87 - FAEL: "TCP Query User{E0A0F4C7-0479-4BBA-A806-72B613C06B9C}C:\program files (x86)\counter-strike 1.6\hlds.exe" [In-None-P6-TRUE] .(...) -- C:\program files (x86)\counter-strike 1.6\hlds.exe (.not file.)
O87 - FAEL: "UDP Query User{186A7C0B-9403-4CE3-8091-BCA079198139}C:\program files (x86)\counter-strike 1.6\hl.exe" [In-None-P17-TRUE] .(...) -- C:\program files (x86)\counter-strike 1.6\hl.exe (.not file.)
O87 - FAEL: "TCP Query User{472E2872-63BC-4CEA-AF8B-73B642E72E30}C:\program files (x86)\counter-strike 1.6\hl.exe" [In-None-P6-TRUE] .(...) -- C:\program files (x86)\counter-strike 1.6\hl.exe (.not file.)
O87 - FAEL: "{402BBED5-CDBB-4A72-9F3B-2B60BFFB3185}" [In-None-P17-TRUE] .(...) -- C:\Program Files\Pinnacle\Studio 19\programs\UMI.exe (.not file.)
O87 - FAEL: "{81CAAD6E-1125-4835-87F6-43271E1BEE79}" [In-None-P6-TRUE] .(...) -- C:\Program Files\Pinnacle\Studio 19\programs\UMI.exe (.not file.)
O87 - FAEL: "{B33C107A-6D60-4114-8905-1DC906DD5B5C}" [In-None-P17-TRUE] .(...) -- C:\Program Files\Pinnacle\Studio 19\programs\NGStudio.exe (.not file.)
O87 - FAEL: "{445543BE-5BE5-404F-8EDF-1B4F25F004EF}" [In-None-P6-TRUE] .(...) -- C:\Program Files\Pinnacle\Studio 19\programs\NGStudio.exe (.not file.)
O87 - FAEL: "{16FEBDEA-FC27-4DDF-9423-B26CEC3BBC63}" [In-None-P17-TRUE] .(...) -- C:\Program Files\Pinnacle\Studio 19\programs\RM.exe (.not file.)
O87 - FAEL: "{CD922091-7363-4603-94F7-CC4EFCA5D3F2}" [In-None-P6-TRUE] .(...) -- C:\Program Files\Pinnacle\Studio 19\programs\RM.exe (.not file.)
O87 - FAEL: "UDP Query User{F58581D6-FD14-4342-8D51-08A39F523FEA}C:\users\mouiimou\desktop\embratoria_g4\es.exe" [In-None-P17-TRUE] .(...) -- C:\users\mouiimou\desktop\embratoria_g4\es.exe (.not file.)
O87 - FAEL: "TCP Query User{D5242012-A229-457A-A9F6-F390C05D626E}C:\users\mouiimou\desktop\embratoria_g4\es.exe" [In-None-P6-TRUE] .(...) -- C:\users\mouiimou\desktop\embratoria_g4\es.exe (.not file.)
O87 - FAEL: "UDP Query User{C30AAE11-D6D5-4377-BD82-1D315ABC43AE}C:\users\mouiimou\downloads\programs\ogar-windows-9bec584.exe" [In-None-P17-TRUE] .(...) -- C:\users\mouiimou\downloads\programs\ogar-windows-9bec584.exe (.not file.)
O87 - FAEL: "TCP Query User{802DF038-799D-4377-84AF-A1FD7B265187}C:\users\mouiimou\downloads\programs\ogar-windows-9bec584.exe" [In-None-P6-TRUE] .(...) -- C:\users\mouiimou\downloads\programs\ogar-windows-9bec584.exe (.not file.)
O87 - FAEL: "TCP Query User{823D83BE-8C43-408E-827E-FB452801E2B9}C:\users\mouiimou\appdata\local\temp\rar$exa0.023\boot_file\boot.exe" [In-None-P6-TRUE] .(...) -- C:\users\mouiimou\appdata\local\temp\rar$exa0.023\boot_file\boot.exe (.not file.) =>.Temporary file not necessary
O87 - FAEL: "UDP Query User{43F005E5-4C83-45CE-BB66-E61F937E8755}C:\users\mouiimou\appdata\local\temp\rar$exa0.023\boot_file\boot.exe" [In-None-P17-TRUE] .(...) -- C:\users\mouiimou\appdata\local\temp\rar$exa0.023\boot_file\boot.exe (.not file.) =>.Temporary file not necessary
O87 - FAEL: "TCP Query User{63D04E50-55D2-4A21-A3ED-2A43AC82A969}C:\users\mouiimou\desktop\boot_file\boot.exe" [In-None-P6-TRUE] .(...) -- C:\users\mouiimou\desktop\boot_file\boot.exe (.not file.)
O87 - FAEL: "UDP Query User{58FE3FF9-E965-4266-8866-4B44D073AB8B}C:\users\mouiimou\desktop\boot_file\boot.exe" [In-None-P17-TRUE] .(...) -- C:\users\mouiimou\desktop\boot_file\boot.exe (.not file.)
O87 - FAEL: "{3C7B892D-F473-455B-A7BD-48E0D05FA800}" [In-None-P17-TRUE] .(...) -- C:\users\mouiimou\desktop\boot_file\boot.exe (.not file.)
O87 - FAEL: "{683BA4FB-590B-4BB9-B6AF-A8E5E60135FA}" [In-None-P6-TRUE] .(...) -- C:\users\mouiimou\desktop\boot_file\boot.exe (.not file.)
O87 - FAEL: "{4A96351F-FC06-4918-BFB0-83EB14792107}" [In-None-P6-TRUE] .(...) -- C:\Users\MouiiMou\Desktop\EmbratoriaG6\libs.exe (.not file.)
O87 - FAEL: "{F2F16E22-E417-41BE-B63E-19ED2E660FE8}" [In-None-P17-TRUE] .(...) -- C:\Users\MouiiMou\Desktop\EmbratoriaG6\libs.exe (.not file.)
O87 - FAEL: "{E30EC340-9140-49E8-A805-1BB74A22F139}" [In-None-P6-TRUE] .(...) -- C:\Users\MouiiMou\Desktop\EmbratoriaG6.5\libs.exe (.not file.)
O87 - FAEL: "{6025C32C-FC9B-4EDF-A061-88C762A5553A}" [In-None-P17-TRUE] .(...) -- C:\Users\MouiiMou\Desktop\EmbratoriaG6.5\libs.exe (.not file.)
O87 - FAEL: "{FAE86521-1186-4DEE-A6AA-C566A0717608}" [In-None-P6-TRUE] .(...) -- C:\Users\MouiiMou\Desktop\EmbratoriaG6.5\libs.exe (.not file.)
O87 - FAEL: "{5A26B30C-F08C-498A-B176-9473CC3166D0}" [In-None-P17-TRUE] .(...) -- C:\Users\MouiiMou\Desktop\EmbratoriaG6.5\libs.exe (.not file.)
O87 - FAEL: "{91F76881-F649-4C3D-8E05-4A9FB3C471BB}" [In-None-P6-TRUE] .(...) -- C:\Users\MouiiMou\Desktop\EmbratoriaG6.5.1\libs.exe (.not file.)
O87 - FAEL: "{F11832DF-766A-45DB-A817-C346ACBEC7ED}" [In-None-P17-TRUE] .(...) -- C:\Users\MouiiMou\Desktop\EmbratoriaG6.5.1\libs.exe (.not file.)
O87 - FAEL: "{027F6CB4-EE3A-4863-A4D2-E40E43CA01A3}" [In-None-P6-TRUE] .(...) -- C:\Users\MouiiMou\Desktop\EmbratoriaG6.5.1\libs.exe (.not file.)
O87 - FAEL: "{A99FC01E-7DE9-4CE3-9E0F-E2877EC60430}" [In-None-P17-TRUE] .(...) -- C:\Users\MouiiMou\Desktop\EmbratoriaG6.5.1\libs.exe (.not file.)