Publicité
Publicité
Format du document : text/plain
Prévisualisation
Résultats d'analyse de Farbar Recovery Scan Tool (FRST) (x64) Version: 08-05-2017
Exécuté par Lyes (administrateur) sur LYES-PC (13-05-2017 15:45:48)
Exécuté depuis C:\Users\Lyes\Desktop
Profils chargés: Lyes (Profils disponibles: UpdatusUser & Lyes & thelyes38)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Langue: Français (France)
Internet Explorer Version 11 (Navigateur par défaut: Chrome)
Mode d'amorçage: Normal
Tutoriel pour Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processus (Avec liste blanche) =================
(Si un élément est inclus dans le fichier fixlist.txt, le processus sera arrêté. Le fichier ne sera pas déplacé.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Kingsoft Corporation) C:\Program Files (x86)\cmcm\Clean Master\cmcore.exe
(Index Education) C:\Program Files (x86)\Index Education\Mise a jour automatique\ServiceMiseAJourIndex.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccsvchst.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccsvchst.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler64.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Valve Corporation) D:\Steam\Steam.exe
(Akamai Technologies, Inc.) C:\Users\Lyes\AppData\Local\Akamai\netsession_win.exe
(Ichrab) C:\Users\Lyes\AppData\Roaming\577830\569311.exe
(Ichrab) C:\Users\Lyes\AppData\Roaming\327632\398958.exe
(Ichrab) C:\Users\Lyes\AppData\Roaming\560942\420921.exe
(Ichrab) C:\Users\Lyes\AppData\Roaming\825115\15435.exe
(M%NQ) C:\Program Files\JRS3P32CTL\QUGPP6ZVN.exe
(Ichrab) C:\Users\Lyes\AppData\Roaming\613525\544815.exe
(Ichrab) C:\Users\Lyes\AppData\Roaming\889881\341778.exe
(M%NQ) C:\Program Files\9UQK2C0YPH\GYE62FWIJ.exe
(M%NQ) C:\Program Files\FXKMWHK7RN\SMR04GQ8Q.exe
(Ichrab) C:\Users\Lyes\AppData\Roaming\447566\739616.exe
(Ichrab) C:\Users\Lyes\AppData\Roaming\367970\629821.exe
(SteelSeries ApS) C:\Program Files\SteelSeries\SteelSeries Engine 3\SteelSeriesEngine3.exe
(Akamai Technologies, Inc.) C:\Users\Lyes\AppData\Local\Akamai\netsession_win.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Settings\MovieColorEnhancer.exe
(Samsung Electronics) C:\Program Files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Settings\SmartSetting.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Settings\dmhkcore.exe
(Valve Corporation) D:\Steam\bin\cef\cef.win7\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(SAMSUNG Electronics) C:\Program Files (x86)\Samsung\Easy Support Center\SSCKbdHk.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registre (Avec liste blanche) ====================
(Si un élément est inclus dans le fichier fixlist.txt, l'élément de Registre sera restauré à la valeur par défaut ou supprimé. Le fichier ne sera pas déplacé.)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [3146704 2017-05-09] (Malwarebytes)
HKLM-x32\...\Run: [cmsc] => c:\program files (x86)\cmcm\Clean Master\cmtray.exe [771912 2015-07-22] (Kingsoft Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [596504 2016-04-01] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [Steam] => D:\Steam\steam.exe [3019552 2017-04-26] (Valve Corporation)
HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Lyes\AppData\Local\Akamai\netsession_win.exe [4490200 2017-01-03] (Akamai Technologies, Inc.)
HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [24763] => C:\Users\Lyes\AppData\Roaming\577830\569311.exe [7680 2017-05-11] (Ichrab)
HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [390704] => C:\Users\Lyes\AppData\Roaming\327632\398958.exe [7680 2017-05-11] (Ichrab)
HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [691283] => C:\Users\Lyes\AppData\Roaming\560942\420921.exe [7680 2017-05-11] (Ichrab)
HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [195881] => C:\Users\Lyes\AppData\Roaming\825115\15435.exe [7680 2017-05-11] (Ichrab)
HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [A1ECBFFZRHWNVJ5] => C:\Program Files\JRS3P32CTL\QUGPP6ZVN.exe [1042432 2017-05-11] (M%NQ)
HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [F2TA2EH9ZDH3JJD] => "C:\Program Files (x86)\SpeeDownloader\5UPGL.exe" <===== ATTENTION
HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [YRFO2EOK76U17VS] => "C:\Program Files (x86)\SpeeDownloader\MUI1X.exe" <===== ATTENTION
HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [102045] => C:\Users\Lyes\AppData\Roaming\613525\544815.exe [7680 2017-05-11] (Ichrab)
HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [784505] => C:\Users\Lyes\AppData\Roaming\889881\341778.exe [7680 2017-05-11] (Ichrab)
HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [6QTJX30F7VO5D0N] => C:\Program Files\9UQK2C0YPH\GYE62FWIJ.exe [1042432 2017-05-11] (M%NQ)
HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [JY2J0QZZSTC8UN8] => C:\Program Files\FXKMWHK7RN\SMR04GQ8Q.exe [1042432 2017-05-11] (M%NQ)
HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [609948] => C:\Users\Lyes\AppData\Roaming\447566\739616.exe [7680 2017-05-11] (Ichrab)
HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [941335] => C:\Users\Lyes\AppData\Roaming\367970\629821.exe [7680 2017-05-11] (Ichrab)
HKU\S-1-5-18\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [50378880 2015-12-29] (Skype Technologies S.A.)
HKU\S-1-5-18\...\Run: [Norton Download Manager{NIS2250215-SHPD-FSD51083}] => C:\Users\Public\Downloads\Norton\{NIS2250215-SHPD-FSD51083}\FSDUI_Custom.exe [1110856 2015-08-23] (Symantec Corporation)
HKLM\...\Providers\b33ryqvq: C:\Program Files (x86)\Cikotherqitution Mapper\local64spl.dll [314880 2017-05-11] ()
ShellExecuteHooks: Pas de nom - {A891CC98-3172-11E7-A610-64006A5CFC23} - C:\Users\Lyes\AppData\Roaming\Vureingaretosy\Coreghatuvery.dll [149504 2017-05-11] ()
ShellIconOverlayIdentifiers-x32: [###MegaShellExtPending] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\Lyes\AppData\Local\MEGAsync\ShellExtX32.dll -> Pas de fichier
ShellIconOverlayIdentifiers-x32: [###MegaShellExtSynced] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\Lyes\AppData\Local\MEGAsync\ShellExtX32.dll -> Pas de fichier
ShellIconOverlayIdentifiers-x32: [###MegaShellExtSyncing] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\Lyes\AppData\Local\MEGAsync\ShellExtX32.dll -> Pas de fichier
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SteelSeries Engine 3.lnk [2016-03-28]
ShortcutTarget: SteelSeries Engine 3.lnk -> C:\Program Files\SteelSeries\SteelSeries Engine 3\SteelSeriesEngine3.exe (SteelSeries ApS)
Startup: C:\Users\thelyes38\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk [2013-06-05]
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
GroupPolicy: Restriction - Chrome <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
==================== Internet (Avec liste blanche) ====================
(Si un élément est inclus dans le fichier fixlist.txt, s'il s'agit d'un élément du Registre, il sera supprimé ou restauré à la valeur par défaut.)
Hosts: Il y a plus d'un élément dans hosts. Voir la section Hosts de Addition.txt
Tcpip\..\Interfaces\{7FF6CFDD-8D07-4C4E-802C-CB5243D83D73}: [DhcpNameServer] 192.168.0.254
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page =
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page =
HKU\S-1-5-21-785650546-1832744181-4140763645-1001\Software\Microsoft\Internet Explorer\Main,Start Page =
URLSearchHook: HKLM-x32 -> Par défaut = {FE69C007-C452-4d3e-86D2-1730DF8BC871}
URLSearchHook: HKLM-x32 - (Pas de nom) - {f8ffcec7-6050-4413-a8d3-0e89eefa07e9} - Pas de fichier
SearchScopes: HKLM -> DefaultScope {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL =
SearchScopes: HKLM -> {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-785650546-1832744181-4140763645-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-785650546-1832744181-4140763645-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-785650546-1832744181-4140763645-1001 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-785650546-1832744181-4140763645-1001 -> {A531D99C-5A22-449b-83DA-872725C6D0ED} URL = hxxp://search.alot.com/web?q={searchTerms}&pr=prov&client_id=6ABBFE9001CD74CF0006ACA3&install_time=2012-08-07T19:04:10Z&src_id=31273&camp_id=5335&tb_version=1.2.2000.2(B)
SearchScopes: HKU\S-1-5-21-785650546-1832744181-4140763645-1001 -> {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL =
BHO: seaoveInsuhop -> {1e84176e-8052-4d1a-a7b3-31ba95f47a07} -> C:\Program Files\seaoveInsuhop\rTxfuVxQFJTs3j.x64.dll => Pas de fichier
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_91\bin\ssv.dll [2016-05-22] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_91\bin\jp2ssv.dll [2016-05-22] (Oracle Corporation)
BHO-x32: seaoveInsuhop -> {1e84176e-8052-4d1a-a7b3-31ba95f47a07} -> C:\Program Files\seaoveInsuhop\rTxfuVxQFJTs3j.dll => Pas de fichier
BHO-x32: Symantec NCO BHO -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll [2012-06-07] (Symantec Corporation)
BHO-x32: Symantec Intrusion Prevention -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\IPS\IPSBHO.DLL [2011-03-31] (Symantec Corporation)
DPF: HKLM-x32 {E6F480FC-BD44-4CBA-B74A-89AF7842937D} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.5.1.0.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - Pas de fichier
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - Pas de fichier
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-03-21] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Handler: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Pas de fichier
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Pas de fichier
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
FireFox:
========
FF ProfilePath: C:\Users\Lyes\AppData\Roaming\Mozilla\Firefox\Profiles\px3zgbob.default-1462454426021 [2017-05-13]
FF user.js: detected! => C:\Users\Lyes\AppData\Roaming\Mozilla\Firefox\Profiles\px3zgbob.default-1462454426021\user.js [2016-11-23]
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\px3zgbob.default-1462454426021 -> initialpage123
FF Keyword.URL: Mozilla\Firefox\Profiles\px3zgbob.default-1462454426021 -> user_pref("keyword.URL", true);
FF SearchPlugin: C:\Users\Lyes\AppData\Roaming\Mozilla\Firefox\Profiles\px3zgbob.default-1462454426021\searchplugins\b33ryqvq.xml [2017-05-11]
FF Extension: (Skype Click to Call) - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-04-12] [non signé]
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\IPSFFPlgn
FF Extension: (Symantec Intrusion Prevention) - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\IPSFFPlgn [2017-05-13] [non signé]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\coFFPlgn_2011_7_13_2
FF Extension: (Norton Toolbar) - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\coFFPlgn_2011_7_13_2 [2017-05-13] [non signé]
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_25_0_0_171.dll [2017-05-09] ()
FF Plugin: @java.com/DTPlugin,version=11.91.2 -> C:\Program Files\Java\jre1.8.0_91\bin\dtplugin\npDeployJava1.dll [2016-05-22] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.91.2 -> C:\Program Files\Java\jre1.8.0_91\bin\plugin2\npjp2.dll [2016-05-22] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [Pas de fichier]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll [2014-02-14] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_25_0_0_171.dll [2017-05-09] ()
FF Plugin-x32: @java.com/DTPlugin,version=10.10.2 -> C:\windows\SysWOW64\npDeployJava1.dll [2012-12-26] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Pas de fichier]
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2011-04-05] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2017-03-28] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-785650546-1832744181-4140763645-1001: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Lyes\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [2014-07-24] (Skype Limited)
FF Plugin HKU\S-1-5-21-785650546-1832744181-4140763645-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Lyes\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-03-27] (Unity Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2017-03-28] (Adobe Systems Inc.)
StartMenuInternet: FIREFOX.EXE - firefox.exe
Chrome:
=======
CHR DefaultProfile: Default
CHR HomePage: Default -> hxxps://www.google.fr/
CHR StartupUrls: Default -> "hxxps://www.google.fr/"
CHR DefaultSearchURL: Default -> hxxp://srch.bar/{searchTerms}
CHR DefaultSuggestURL: Default -> hxxp://srch.bar/?s={searchTerms}
CHR Profile: C:\Users\Lyes\AppData\Local\Google\Chrome\User Data\Default [2017-05-13]
CHR Extension: (Angry Birds) - C:\Users\Lyes\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj [2015-01-23] [UpdateUrl: hxxps://epicunitscan.info/00service/update2/crx] <==== ATTENTION
CHR Extension: (Adblock Plus) - C:\Users\Lyes\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2017-03-21]
CHR Extension: (Session Buddy) - C:\Users\Lyes\AppData\Local\Google\Chrome\User Data\Default\Extensions\edacconmaakjimmfgnblocblbcdcpbko [2017-05-08]
CHR Extension: (Animal Crossing Music) - C:\Users\Lyes\AppData\Local\Google\Chrome\User Data\Default\Extensions\fcedlaimpcfgpnfdgjbmmfibkklpioop [2017-05-01]
CHR Extension: (YouTube Plus) - C:\Users\Lyes\AppData\Local\Google\Chrome\User Data\Default\Extensions\nkdalpbojfdilmiboaiedicdbigdabpb [2017-04-02]
CHR Extension: (Paiements via le Chrome Web Store) - C:\Users\Lyes\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-10]
CHR Extension: (Chrome Media Router) - C:\Users\Lyes\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-04-04]
CHR HKLM\...\Chrome\Extension: [ehlceeijggpdgfcefmipcmdelickjgfg] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-785650546-1832744181-4140763645-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [dbaonaocldpohelilahfhnkmjankmbcc] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-785650546-1832744181-4140763645-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [ehlceeijggpdgfcefmipcmdelickjgfg] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-785650546-1832744181-4140763645-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ehlceeijggpdgfcefmipcmdelickjgfg] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx
StartMenuInternet: Google Chrome.UPV2WNZYCMBHTGYPTYEAJRZXIY - C:\Users\Lyes\AppData\Local\Google\Chrome\Application\chrome.exe
==================== Services (Avec liste blanche) ====================
(Si un élément est inclus dans le fichier fixlist.txt, il sera supprimé du Registre. Le fichier ne sera pas déplacé, sauf s'il est inscrit séparément.)
S3 BRSptStub; C:\ProgramData\BitRaider\BRSptStub.exe [363208 2016-03-15] (BitRaider, LLC)
R2 cmcore; c:\program files (x86)\cmcm\Clean Master\cmcore.exe [315208 2015-07-22] (Kingsoft Corporation)
R2 MajIndexEducationService; C:\Program Files (x86)\Index Education\Mise a jour automatique\ServiceMiseAJourIndex.exe [3050984 2017-03-15] (Index Education)
S2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4470736 2017-05-09] (Malwarebytes)
R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe [130008 2011-04-17] (Symantec Corporation)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe [244904 2009-12-01] () [Fichier non signé]
R2 Themes; C:\windows\system32\themeservice.dll [44544 2015-03-29] (Microsoft Corporation) [Fichier non signé]
S3 iPod Service; "C:\Program Files\iPod\bin\iPodService.exe" [X]
S2 MBAMScheduler; "\mbamscheduler.exe" [X]
S3 McComponentHostService; "C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe" [X]
===================== Pilotes (Avec liste blanche) ======================
(Si un élément est inclus dans le fichier fixlist.txt, il sera supprimé du Registre. Le fichier ne sera pas déplacé, sauf s'il est inscrit séparément.)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20120928.001\BHDrvx64.sys [1385120 2012-09-01] (Symantec Corporation)
S3 BRDriver64_1_3_3_E02B25FC; C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver64.sys [78088 2016-03-16] (BitRaider)
S3 dtlitescsibus; C:\windows\System32\DRIVERS\dtlitescsibus.sys [30264 2017-05-08] (Disc Soft Ltd)
S3 dtliteusbbus; C:\windows\System32\DRIVERS\dtliteusbbus.sys [47672 2017-05-08] (Disc Soft Ltd)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2012-09-15] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [138912 2012-09-15] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20121005.002\IDSvia64.sys [513184 2012-09-01] (Symantec Corporation)
R3 ksapi64; C:\windows\system32\drivers\ksapi64.sys [56680 2015-05-06] (Kingsoft Corporation)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [43968 2017-05-13] (Malwarebytes)
S3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [84256 2017-05-13] (Malwarebytes)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20121005.018\ENG64.SYS [126112 2012-09-15] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20121005.018\EX64.SYS [2084000 2012-09-15] (Symantec Corporation)
S3 PVUSB; C:\windows\System32\DRIVERS\CESG64.sys [63808 2007-02-19] (CASIO COMPUTER CO.,LTD.)
S3 rtport; C:\windows\SysWOW64\drivers\rtport.sys [15144 2011-10-06] (Windows (R) 2003 DDK 3790 provider)
S3 Sftfs; C:\windows\System32\DRIVERS\Sftfswin7.sys [768680 2013-06-27] (Microsoft Corporation)
S3 Sftplay; C:\windows\System32\DRIVERS\Sftplaywin7.sys [273576 2013-06-27] (Microsoft Corporation)
S3 Sftredir; C:\windows\System32\DRIVERS\Sftredirwin7.sys [29352 2013-06-27] (Microsoft Corporation)
S3 Sftvol; C:\windows\System32\DRIVERS\Sftvolwin7.sys [23208 2013-06-27] (Microsoft Corporation)
R2 SGDrv; C:\windows\System32\DRIVERS\SGdrv64.sys [7680 2011-04-11] (Phoenix Technologies Ltd.)
S3 SRTSP; C:\windows\System32\Drivers\NISx64\1207020.003\SRTSP64.SYS [744568 2011-03-31] (Symantec Corporation)
R1 SRTSPX; C:\windows\system32\drivers\NISx64\1207020.003\SRTSPX64.SYS [40568 2011-03-31] (Symantec Corporation)
R3 ssdevfactory; C:\windows\System32\DRIVERS\ssdevfactory.sys [40576 2016-03-09] (SteelSeries ApS)
R0 SymDS; C:\windows\System32\drivers\NISx64\1207020.003\SYMDS64.SYS [450680 2011-01-27] (Symantec Corporation)
R0 SymEFA; C:\windows\System32\drivers\NISx64\1207020.003\SYMEFA64.SYS [912504 2011-03-15] (Symantec Corporation)
R3 SymEvent; C:\windows\system32\Drivers\SYMEVENT64x86.SYS [174200 2012-08-08] (Symantec Corporation)
R1 SymIRON; C:\windows\system32\drivers\NISx64\1207020.003\Ironx64.SYS [171128 2011-01-27] (Symantec Corporation)
R1 SymNetS; C:\windows\System32\Drivers\NISx64\1207020.003\SYMNETS.SYS [386168 2011-04-21] (Symantec Corporation)
S3 IntcAzAudAddService; system32\drivers\RTKVHD64.sys [X]
S3 WinRing0_1_2_0; \??\C:\Program Files (x86)\Razer\Razer Game Booster\Driver\WinRing0x64.sys [X]
==================== NetSvcs (Avec liste blanche) ===================
(Si un élément est inclus dans le fichier fixlist.txt, il sera supprimé du Registre. Le fichier ne sera pas déplacé, sauf s'il est inscrit séparément.)
==================== Un mois - Créés - fichiers et dossiers ========
(Si un élément est inclus dans le fichier fixlist.txt, le fichier/dossier sera déplacé.)
2017-05-13 15:45 - 2017-05-13 15:46 - 00025194 _____ C:\Users\Lyes\Desktop\FRST.txt
2017-05-13 15:45 - 2017-05-13 15:45 - 02429440 _____ (Farbar) C:\Users\Lyes\Desktop\FRST64.exe
2017-05-13 15:45 - 2017-05-13 15:45 - 00000000 ____D C:\FRST
2017-05-13 15:40 - 2017-05-13 15:40 - 00113592 _____ (Malwarebytes) C:\windows\system32\Drivers\farflt.sys
2017-05-13 15:40 - 2017-05-13 15:40 - 00001867 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-05-13 15:40 - 2017-05-13 15:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-05-13 15:40 - 2017-05-09 16:37 - 00077440 _____ C:\windows\system32\Drivers\mbae64.sys
2017-05-13 15:39 - 2017-05-13 15:39 - 00000000 ____D C:\Program Files\Malwarebytes
2017-05-13 15:36 - 2017-05-13 15:39 - 63035592 _____ (Malwarebytes ) C:\Users\Lyes\Downloads\mb3-setup-35891.35891-3.1.2.1733.exe
2017-05-13 15:31 - 2017-05-13 15:31 - 00046828 _____ C:\Users\Lyes\Desktop\ZHPCleaner.txt
2017-05-13 15:20 - 2017-05-13 15:20 - 00000828 _____ C:\Users\Lyes\Desktop\ZHPCleaner.lnk
2017-05-13 15:18 - 2017-05-13 15:20 - 02769920 _____ C:\Users\Lyes\Downloads\ZHPCleaner.exe
2017-05-13 14:41 - 2017-05-13 15:00 - 00252280 _____ C:\windows\ntbtlog.txt
2017-05-13 09:18 - 2017-05-13 09:18 - 00023045 _____ C:\Users\Lyes\Desktop\AdwCleaner[C2].txt
2017-05-13 09:01 - 2017-05-13 15:31 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\ZHP
2017-05-13 09:01 - 2017-05-13 15:20 - 00000000 ____D C:\Users\Lyes\AppData\Local\ZHP
2017-05-13 09:01 - 2017-05-13 09:38 - 00000818 _____ C:\Users\Lyes\Desktop\ZHPDiag.lnk
2017-05-13 09:01 - 2017-05-13 09:01 - 02726400 _____ C:\Users\Lyes\Downloads\ZHPDiag3.exe
2017-05-13 08:31 - 2017-05-13 08:32 - 04102600 _____ C:\Users\Lyes\Downloads\adwcleaner_6.046.exe
2017-05-12 21:30 - 2017-05-12 22:30 - 00000197 _____ C:\windows\registry.json
2017-05-11 20:01 - 2017-05-11 20:01 - 00000000 ____D C:\Users\Default\AppData\Local\AdvinstAnalytics
2017-05-11 20:01 - 2017-05-11 20:01 - 00000000 ____D C:\Users\Default User\AppData\Local\AdvinstAnalytics
2017-05-11 19:58 - 2017-05-11 19:58 - 00003672 _____ C:\windows\System32\Tasks\updater
2017-05-11 19:57 - 2017-05-11 19:57 - 00000062 _____ C:\windows\WeatherBuddy.INI
2017-05-11 19:57 - 2017-05-11 19:57 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\367970
2017-05-11 19:56 - 2017-05-11 19:56 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\447566
2017-05-11 19:49 - 2017-05-11 19:49 - 00000000 ____D C:\Users\thelyes38\AppData\Local\Samsung
2017-05-11 19:44 - 2017-05-11 19:44 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\656866
2017-05-11 19:39 - 2017-05-11 19:39 - 00140800 _____ C:\Users\Lyes\AppData\Local\installer.dat
2017-05-11 19:39 - 2017-05-11 19:39 - 00011568 _____ C:\Users\Lyes\AppData\Local\InstallationConfiguration.xml
2017-05-11 19:39 - 2017-05-11 19:39 - 00000000 ____D C:\Users\Lyes\AppData\Local\Arermoghtlertiied
2017-05-11 19:39 - 2017-05-11 19:39 - 00000000 ____D C:\Program Files\FXKMWHK7RN
2017-05-11 19:38 - 2017-05-11 19:39 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\889881
2017-05-11 19:38 - 2017-05-11 19:39 - 00000000 ____D C:\Program Files\9UQK2C0YPH
2017-05-11 19:38 - 2017-05-11 19:38 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\613525
2017-05-11 19:37 - 2017-05-11 19:38 - 00000000 ____D C:\Program Files\JRS3P32CTL
2017-05-11 19:37 - 2017-05-11 19:37 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\825115
2017-05-11 19:37 - 2017-05-11 19:37 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\560942
2017-05-11 19:36 - 2017-05-11 19:37 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\577830
2017-05-11 19:36 - 2017-05-11 19:37 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\327632
2017-05-11 19:34 - 2017-05-11 19:34 - 00000000 ____D C:\Users\Lyes\AppData\Local\CrashRpt
2017-05-11 19:33 - 2017-05-11 19:42 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\Vureingaretosy
2017-05-11 19:33 - 2017-05-11 19:40 - 00000000 ____D C:\Users\Lyes\AppData\Local\Aternapy
2017-05-11 19:33 - 2017-05-11 19:33 - 00006078 _____ C:\windows\System32\Tasks\Cikotherqitution Mapper
2017-05-11 19:33 - 2017-05-11 19:33 - 00000000 ____D C:\Program Files (x86)\Foqersyvidation
2017-05-11 19:33 - 2017-05-11 19:33 - 00000000 ____D C:\Program Files (x86)\Cikotherqitution Mapper
2017-05-10 16:09 - 2017-05-10 16:09 - 01249792 _____ C:\windows\739d99369c57c61ac92a1d88c801facf.exe
2017-05-10 16:09 - 2017-05-10 16:09 - 00051628 _____ C:\windows\uninstaller.dat
2017-05-08 12:14 - 2017-05-08 13:18 - 1474177024 ____R C:\Users\Lyes\Downloads\[nextorrent.net] Rogue.One.2016.TRUEFRENCH.BDRiP.XviD-GZR.avi
2017-05-08 12:13 - 2017-05-08 12:13 - 00029410 _____ C:\Users\Lyes\Downloads\Rogue One- A Star Wars Story TRUEFRENCH DVDRiP 2017.torrent
2017-05-08 08:58 - 2017-05-08 08:58 - 00000000 ____D C:\Users\Lyes\AppData\Local\Disc_Soft_Ltd
2017-05-08 08:55 - 2017-05-08 08:55 - 00000000 ____D C:\Users\Public\Documents\Daemon Tools Images
2017-05-08 08:52 - 2017-05-08 08:52 - 00047672 _____ (Disc Soft Ltd) C:\windows\system32\Drivers\dtliteusbbus.sys
2017-05-08 08:51 - 2017-05-08 08:51 - 00030264 _____ (Disc Soft Ltd) C:\windows\system32\Drivers\dtlitescsibus.sys
2017-05-07 21:54 - 2017-05-07 21:54 - 00019874 _____ C:\Users\Lyes\Desktop\tp sin question lyes.odt
2017-05-07 21:18 - 2017-05-07 21:24 - 58905574 _____ C:\Users\Lyes\Downloads\snapchat-10-7-5-0.apk
2017-05-07 17:38 - 2017-05-07 17:38 - 00034225 _____ C:\Users\Lyes\Downloads\Skyrim legendary edition.torrent
2017-05-07 17:32 - 2017-05-07 17:32 - 00000000 ____D C:\Users\Lyes\AppData\Local\Skyrim
2017-05-07 17:32 - 2017-05-07 17:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Razor 1911
2017-05-07 12:01 - 2017-05-07 12:01 - 00020544 _____ C:\Users\Lyes\Downloads\the-elder-scrolls-v-skyrim-pc.torrent
2017-05-01 11:20 - 2017-05-01 11:20 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\Sony Creative Software Inc
2017-05-01 11:15 - 2017-05-01 11:16 - 30299802 _____ C:\Users\Lyes\Downloads\Débat Présidentielle - Le Raptor Dissident.mp4
2017-04-30 19:08 - 2017-04-30 19:08 - 00001683 _____ C:\Users\Lyes\Desktop\MorphVOXPro - Raccourci.lnk
2017-04-30 19:07 - 2017-04-30 19:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Screaming Bee
2017-04-30 19:07 - 2017-04-30 19:07 - 00000000 ____D C:\Program Files (x86)\Screaming Bee
2017-04-30 14:49 - 2017-04-30 14:49 - 00000000 ____D C:\Users\Lyes\AppData\Local\PonyRPG
2017-04-27 18:59 - 2017-04-27 18:59 - 00400616 _____ C:\Users\Lyes\Downloads\Wario Land II (USA, Europe).zip
2017-04-27 18:51 - 2017-04-27 19:02 - 00000000 ____D C:\Users\Lyes\Desktop\vba
2017-04-27 18:50 - 2017-04-27 18:50 - 01359970 _____ C:\Users\Lyes\Downloads\visualboy-advance-1-8-0-en-win.zip
2017-04-27 18:50 - 2017-04-27 18:50 - 01359970 _____ C:\Users\Lyes\Desktop\visualboy-advance-1-8-0-en-win.zip
2017-04-26 20:37 - 2017-04-26 20:37 - 00016496 _____ C:\Users\Lyes\Downloads\6214216f7bd4b2e228a79b8711b18d4f_futurama-fry-meme-funny-fry-memes_236-252.jpeg
2017-04-26 17:31 - 2017-04-26 17:31 - 00223344 _____ C:\Users\Lyes\Downloads\RAPTOR VS YOUTUBE - Expliquez Moi Cette Merde #8 - YouTube.mp4.sfk
2017-04-26 17:28 - 2017-04-26 17:30 - 17900685 _____ C:\Users\Lyes\Downloads\RAPTOR VS YOUTUBE - Expliquez Moi Cette Merde #8 - YouTube.mp4
2017-04-15 21:07 - 2017-04-15 21:07 - 00000000 ____D C:\Users\Lyes\Documents\Wizards of the Coast
2017-04-15 19:35 - 2017-04-15 19:55 - 00000000 ____D C:\Users\Lyes\Documents\DAVAProject
2017-04-15 19:35 - 2017-04-15 19:35 - 00000202 _____ C:\Users\Lyes\Desktop\Magic Duels.url
2017-04-15 11:40 - 2017-04-15 11:41 - 03514528 _____ C:\Users\Lyes\Downloads\WHAT THE CUT 37 - TEMPLE CÉRÉMONIE ET COSMOS.mp3.sfk
2017-04-15 08:51 - 2017-04-15 08:57 - 01906144 _____ C:\Users\Lyes\Downloads\Joueur du Grenier - LES JEUX DE COMICS #2.mp4.sfk
==================== Un mois - Modifiés - fichiers et dossiers ========
(Si un élément est inclus dans le fichier fixlist.txt, le fichier/dossier sera déplacé.)
2017-05-13 15:40 - 2014-05-08 22:46 - 00251832 _____ (Malwarebytes) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2017-05-13 15:40 - 2014-05-08 22:45 - 00187320 _____ (Malwarebytes) C:\windows\system32\Drivers\mbamchameleon.sys
2017-05-13 15:40 - 2014-05-08 22:45 - 00084256 _____ (Malwarebytes) C:\windows\system32\Drivers\mwac.sys
2017-05-13 15:40 - 2013-01-28 00:30 - 00043968 _____ (Malwarebytes) C:\windows\system32\Drivers\mbam.sys
2017-05-13 15:39 - 2013-01-28 00:30 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-05-13 15:31 - 2012-08-29 15:27 - 00000000 ____D C:\Users\Lyes\AppData\Local\CrashDumps
2017-05-13 15:10 - 2012-08-23 20:06 - 00000000 ____D C:\windows\System32\Tasks\Symantec
2017-05-13 15:09 - 2009-07-14 06:45 - 00028848 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-05-13 15:09 - 2009-07-14 06:45 - 00028848 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-05-13 15:05 - 2015-08-23 22:36 - 00000000 ____D C:\windows\System32\Tasks\Remediation
2017-05-13 15:01 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2017-05-13 14:53 - 2013-03-18 18:27 - 00000000 ____D C:\Users\Lyes\AppData\Local\ElevatedDiagnostics
2017-05-13 13:58 - 2012-08-22 13:53 - 00000924 _____ C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-785650546-1832744181-4140763645-1001UA.job
2017-05-13 13:58 - 2012-08-22 13:53 - 00000902 _____ C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-785650546-1832744181-4140763645-1001Core.job
2017-05-13 11:44 - 2016-11-14 20:48 - 00001201 _____ C:\Users\Lyes\Desktop\nativelog.txt
2017-05-13 11:43 - 2014-01-14 15:28 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\.minecraft
2017-05-13 09:19 - 2015-06-07 08:39 - 00000000 ____D C:\AdwCleaner
2017-05-13 08:38 - 2015-01-15 20:14 - 00000000 ____D C:\windows\system32\log
2017-05-13 08:36 - 2015-04-06 16:24 - 00000000 ____D C:\Users\Lyes\AppData\LocalLow\Company
2017-05-12 22:08 - 2012-08-07 18:29 - 00000000 ____D C:\Users\Lyes
2017-05-12 20:01 - 2012-12-21 19:46 - 00000000 ____D C:\ProgramData\boost_interprocess
2017-05-12 18:56 - 2013-07-20 07:38 - 00000000 ____D C:\Program Files (x86)\NCH Software
2017-05-12 18:55 - 2015-05-10 16:59 - 00000919 _____ C:\Users\Lyes\AppData\Roaming\trace_FilterInstaller.txt
2017-05-12 18:55 - 2015-05-10 16:59 - 00000000 _____ C:\Users\Lyes\AppData\Roaming\trace_FilterInstaller.txt-CRT.txt
2017-05-12 18:12 - 2016-03-24 18:06 - 00002189 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-05-11 19:46 - 2013-05-04 02:35 - 00084816 _____ C:\Users\thelyes38\AppData\Local\GDIPFONTCACHEV1.DAT
2017-05-10 13:45 - 2015-03-28 08:51 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\vlc
2017-05-09 17:12 - 2017-02-14 18:13 - 05821944 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerInstaller.exe
2017-05-09 17:12 - 2013-05-24 23:05 - 00803320 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2017-05-09 17:12 - 2013-05-24 23:05 - 00144888 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-05-09 17:12 - 2013-05-24 23:05 - 00004484 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2017-05-09 17:12 - 2013-05-24 23:05 - 00000000 ____D C:\windows\system32\Macromed
2017-05-09 17:12 - 2011-08-13 06:31 - 00000000 ____D C:\windows\SysWOW64\Macromed
2017-05-08 18:50 - 2017-01-21 14:58 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\uTorrent
2017-05-08 12:20 - 2017-01-25 19:36 - 00000000 ____D C:\Users\Lyes\Desktop\ds sin
2017-05-08 08:55 - 2014-11-22 18:12 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\DAEMON Tools Lite
2017-05-08 08:52 - 2009-07-14 05:20 - 00000000 ____D C:\windows\inf
2017-05-08 08:50 - 2014-11-22 18:10 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite
2017-05-07 19:33 - 2011-08-13 06:37 - 00000000 ____D C:\ProgramData\Norton
2017-05-07 17:32 - 2017-04-08 09:02 - 00000000 ____D C:\Users\Lyes\Documents\My Games
2017-05-05 20:16 - 2014-12-28 22:59 - 00004476 _____ C:\windows\System32\Tasks\Adobe Acrobat Update Task
2017-05-05 20:04 - 2014-11-11 10:54 - 00000290 __RSH C:\ProgramData\ntuser.pol
2017-05-01 17:28 - 2016-11-26 19:30 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\discord
2017-05-01 09:22 - 2011-08-13 21:54 - 00748354 _____ C:\windows\system32\perfh00C.dat
2017-05-01 09:22 - 2011-08-13 21:54 - 00150588 _____ C:\windows\system32\perfc00C.dat
2017-05-01 09:22 - 2009-07-14 07:13 - 01671232 _____ C:\windows\system32\PerfStringBackup.INI
2017-04-30 19:10 - 2016-09-29 20:29 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\Audacity
2017-04-30 19:09 - 2016-11-06 11:49 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\Screaming Bee
2017-04-30 19:07 - 2015-10-04 16:41 - 00000000 ____D C:\ProgramData\Package Cache
2017-04-28 23:44 - 2009-07-14 07:08 - 00032496 _____ C:\windows\Tasks\SCHEDLGU.TXT
2017-04-28 09:30 - 2014-07-17 14:49 - 00003500 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA1cfa1bd8fea3151
2017-04-28 09:30 - 2014-07-17 14:49 - 00003372 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore1cfa1bd8f772282
2017-04-27 22:17 - 2015-09-25 20:04 - 00000000 ____D C:\Users\Lyes\Downloads\runtime
2017-04-17 11:12 - 2014-03-07 11:14 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2017-04-14 18:30 - 2014-08-11 22:17 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
==================== Fichiers à la racine de certains dossiers =======
2014-08-20 09:44 - 2014-08-20 09:44 - 6010880 _____ () C:\Program Files (x86)\GUT3CBE.tmp
2014-07-19 20:28 - 2014-07-20 00:44 - 6010880 _____ () C:\Program Files (x86)\GUT8B0B.tmp
2014-08-01 13:51 - 2014-08-02 23:37 - 6010880 _____ () C:\Program Files (x86)\GUTE6D6.tmp
2016-07-14 07:44 - 2016-07-14 07:44 - 2174976 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\Common Files\atimpenc.dll
2012-08-30 21:56 - 2012-08-30 21:56 - 0000006 _____ () C:\Program Files (x86)\Common Files\WPVersion.txt
2015-05-22 00:06 - 2015-12-28 09:24 - 0000024 _____ () C:\Users\Lyes\AppData\Roaming\appdataFr25.bin
2015-02-06 10:00 - 2015-05-21 23:56 - 0000020 _____ () C:\Users\Lyes\AppData\Roaming\appdataFr3.bin
2014-04-03 01:19 - 2014-04-03 01:19 - 0000036 _____ () C:\Users\Lyes\AppData\Roaming\DOK52P4Q3J.dat
2017-02-11 18:09 - 2017-02-12 16:00 - 0000101 _____ () C:\Users\Lyes\AppData\Roaming\infos.properties
2014-07-22 23:22 - 2014-07-22 23:22 - 0000036 _____ () C:\Users\Lyes\AppData\Roaming\SuYZkvrV.tmp
2015-05-10 16:59 - 2015-05-10 16:59 - 0001181 _____ () C:\Users\Lyes\AppData\Roaming\trace_FilterInstaller.1.txt
2015-05-10 16:59 - 2017-05-12 18:55 - 0000919 _____ () C:\Users\Lyes\AppData\Roaming\trace_FilterInstaller.txt
2015-05-10 16:59 - 2017-05-12 18:55 - 0000000 _____ () C:\Users\Lyes\AppData\Roaming\trace_FilterInstaller.txt-CRT.txt
2015-11-18 15:39 - 2015-11-18 15:39 - 0021028 _____ () C:\Users\Lyes\AppData\Roaming\UserTile.png
2017-01-11 14:03 - 2017-03-15 13:55 - 0000256 _____ () C:\Users\Lyes\AppData\Roaming\WB.CFG
2012-05-03 13:12 - 2012-05-03 13:12 - 0000532 _____ () C:\Users\Lyes\AppData\Local\datos.txt
2014-11-24 21:17 - 2014-11-24 21:17 - 0022528 _____ () C:\Users\Lyes\AppData\Local\dsisetup33579522.exe
2014-12-02 18:41 - 2014-12-02 18:41 - 0022528 _____ () C:\Users\Lyes\AppData\Local\dsisetup788083822.exe
2017-05-11 19:39 - 2017-05-11 19:39 - 0011568 _____ () C:\Users\Lyes\AppData\Local\InstallationConfiguration.xml
2017-05-11 19:39 - 2017-05-11 19:39 - 0140800 _____ () C:\Users\Lyes\AppData\Local\installer.dat
2014-02-05 22:08 - 2014-02-05 22:08 - 0193744 _____ () C:\Users\Lyes\AppData\Local\lateral1.bmp
2010-11-12 11:10 - 2010-11-12 11:10 - 0193744 _____ () C:\Users\Lyes\AppData\Local\lateral2.bmp
2014-02-05 22:10 - 2014-02-05 22:10 - 0195108 _____ () C:\Users\Lyes\AppData\Local\lateral3.bmp
2015-09-27 10:17 - 2015-09-27 10:17 - 0000955 _____ () C:\Users\Lyes\AppData\Local\recently-used.xbel
2014-02-05 23:50 - 2014-02-05 23:50 - 0043976 _____ () C:\Users\Lyes\AppData\Local\save_en.bmp
2014-02-05 23:49 - 2014-02-05 23:49 - 0043976 _____ () C:\Users\Lyes\AppData\Local\save_es.bmp
2016-03-11 18:51 - 2016-03-11 18:51 - 0000000 _____ () C:\Users\Lyes\AppData\Local\{56B1AC0F-FE36-4B88-B6CB-8D6AFC4AF003}
2016-03-05 23:28 - 2016-03-05 23:28 - 0000000 _____ () C:\Users\Lyes\AppData\Local\{C63BCE57-37D3-4E86-9FAF-A7DAFDF40B70}
2016-03-12 23:01 - 2016-03-12 23:01 - 0000000 _____ () C:\Users\Lyes\AppData\Local\{F0E0F900-0CFA-4A8A-8EA6-E3DB8F460924}
2012-08-08 17:34 - 2012-08-08 17:34 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2012-08-30 22:07 - 2012-08-30 22:07 - 0000097 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
2015-09-19 15:38 - 2015-09-19 15:38 - 0004105 _____ () C:\ProgramData\wmzddnmb.cix
2011-08-13 07:31 - 2011-08-13 07:32 - 0000109 _____ () C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log
2011-08-13 07:26 - 2011-08-13 07:26 - 0000113 _____ () C:\ProgramData\{34FBC7C4-CD31-4D93-A428-0E524EAC4586}.log
2011-08-13 07:29 - 2011-08-13 07:30 - 0000105 _____ () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
2011-08-13 07:26 - 2011-08-13 07:29 - 0000106 _____ () C:\ProgramData\{80E158EA-7181-40FE-A701-301CE6BE64AB}.log
2011-08-13 07:30 - 2011-08-13 07:31 - 0000110 _____ () C:\ProgramData\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}.log
Fichiers à déplacer ou supprimer:
====================
C:\Users\Lyes\update-walking-dead.bat
C:\Users\Lyes\worldpainter_1.2.5.exe
C:\Users\Lyes\worldpainter_1.4.0.exe
Certains fichiers dans TEMP:
====================
2017-05-11 19:37 - 2017-05-11 19:37 - 0524972 _____ (WeMonetize ) C:\Users\Lyes\AppData\Local\Temp\1X4TVSQ.exe
2017-05-11 19:37 - 2017-05-11 19:37 - 0524972 _____ (WeMonetize ) C:\Users\Lyes\AppData\Local\Temp\7INM3P0.exe
2017-05-11 19:56 - 2017-05-11 19:56 - 0363008 _____ (M%NQ) C:\Users\Lyes\AppData\Local\Temp\HWAAY9OG0XVN.exe
2017-05-10 13:05 - 2017-05-10 13:05 - 3190104 _____ (Lead IT) C:\Users\Lyes\AppData\Local\Temp\pdD3dFNr-prog.exe
2017-05-10 13:05 - 2017-05-10 13:05 - 0140872 _____ () C:\Users\Lyes\AppData\Local\Temp\pdD3dFNr-upd.exe
2017-05-10 13:05 - 2017-05-10 13:05 - 2988888 _____ (IT Genius) C:\Users\Lyes\AppData\Local\Temp\W3rlsPaZ-prog.exe
2013-06-26 04:19 - 2013-06-26 04:20 - 31668328 _____ (Skype Technologies S.A.) C:\Users\thelyes38\AppData\Local\Temp\SkypeSetup.exe
==================== Bamital & volsnap ======================
(Il n'y a pas de correction automatique pour les fichiers qui ne satisfont pas à la vérification.)
C:\windows\system32\winlogon.exe => Le fichier est signé numériquement
C:\windows\system32\wininit.exe => Le fichier est signé numériquement
C:\windows\SysWOW64\wininit.exe => Le fichier est signé numériquement
C:\windows\explorer.exe => Le fichier est signé numériquement
C:\windows\SysWOW64\explorer.exe => Le fichier est signé numériquement
C:\windows\system32\svchost.exe => Le fichier est signé numériquement
C:\windows\SysWOW64\svchost.exe => Le fichier est signé numériquement
C:\windows\system32\services.exe => Le fichier est signé numériquement
C:\windows\system32\User32.dll => Le fichier est signé numériquement
C:\windows\SysWOW64\User32.dll => Le fichier est signé numériquement
C:\windows\system32\userinit.exe => Le fichier est signé numériquement
C:\windows\SysWOW64\userinit.exe => Le fichier est signé numériquement
C:\windows\system32\rpcss.dll => Le fichier est signé numériquement
C:\windows\system32\dnsapi.dll => Le fichier est signé numériquement
C:\windows\SysWOW64\dnsapi.dll => Le fichier est signé numériquement
C:\windows\system32\Drivers\volsnap.sys => Le fichier est signé numériquement
testsigning: ==> 'testsigning' est activé. Rechercher un éventuel pilote non signé <===== ATTENTION
LastRegBack: 2017-05-03 00:00
==================== Fin de FRST.txt ============================
Exécuté par Lyes (administrateur) sur LYES-PC (13-05-2017 15:45:48)
Exécuté depuis C:\Users\Lyes\Desktop
Profils chargés: Lyes (Profils disponibles: UpdatusUser & Lyes & thelyes38)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Langue: Français (France)
Internet Explorer Version 11 (Navigateur par défaut: Chrome)
Mode d'amorçage: Normal
Tutoriel pour Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processus (Avec liste blanche) =================
(Si un élément est inclus dans le fichier fixlist.txt, le processus sera arrêté. Le fichier ne sera pas déplacé.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Kingsoft Corporation) C:\Program Files (x86)\cmcm\Clean Master\cmcore.exe
(Index Education) C:\Program Files (x86)\Index Education\Mise a jour automatique\ServiceMiseAJourIndex.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccsvchst.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccsvchst.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler64.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Valve Corporation) D:\Steam\Steam.exe
(Akamai Technologies, Inc.) C:\Users\Lyes\AppData\Local\Akamai\netsession_win.exe
(Ichrab) C:\Users\Lyes\AppData\Roaming\577830\569311.exe
(Ichrab) C:\Users\Lyes\AppData\Roaming\327632\398958.exe
(Ichrab) C:\Users\Lyes\AppData\Roaming\560942\420921.exe
(Ichrab) C:\Users\Lyes\AppData\Roaming\825115\15435.exe
(M%NQ) C:\Program Files\JRS3P32CTL\QUGPP6ZVN.exe
(Ichrab) C:\Users\Lyes\AppData\Roaming\613525\544815.exe
(Ichrab) C:\Users\Lyes\AppData\Roaming\889881\341778.exe
(M%NQ) C:\Program Files\9UQK2C0YPH\GYE62FWIJ.exe
(M%NQ) C:\Program Files\FXKMWHK7RN\SMR04GQ8Q.exe
(Ichrab) C:\Users\Lyes\AppData\Roaming\447566\739616.exe
(Ichrab) C:\Users\Lyes\AppData\Roaming\367970\629821.exe
(SteelSeries ApS) C:\Program Files\SteelSeries\SteelSeries Engine 3\SteelSeriesEngine3.exe
(Akamai Technologies, Inc.) C:\Users\Lyes\AppData\Local\Akamai\netsession_win.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Settings\MovieColorEnhancer.exe
(Samsung Electronics) C:\Program Files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Settings\SmartSetting.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Settings\dmhkcore.exe
(Valve Corporation) D:\Steam\bin\cef\cef.win7\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(SAMSUNG Electronics) C:\Program Files (x86)\Samsung\Easy Support Center\SSCKbdHk.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registre (Avec liste blanche) ====================
(Si un élément est inclus dans le fichier fixlist.txt, l'élément de Registre sera restauré à la valeur par défaut ou supprimé. Le fichier ne sera pas déplacé.)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [3146704 2017-05-09] (Malwarebytes)
HKLM-x32\...\Run: [cmsc] => c:\program files (x86)\cmcm\Clean Master\cmtray.exe [771912 2015-07-22] (Kingsoft Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [596504 2016-04-01] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [Steam] => D:\Steam\steam.exe [3019552 2017-04-26] (Valve Corporation)
HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Lyes\AppData\Local\Akamai\netsession_win.exe [4490200 2017-01-03] (Akamai Technologies, Inc.)
HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [24763] => C:\Users\Lyes\AppData\Roaming\577830\569311.exe [7680 2017-05-11] (Ichrab)
HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [390704] => C:\Users\Lyes\AppData\Roaming\327632\398958.exe [7680 2017-05-11] (Ichrab)
HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [691283] => C:\Users\Lyes\AppData\Roaming\560942\420921.exe [7680 2017-05-11] (Ichrab)
HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [195881] => C:\Users\Lyes\AppData\Roaming\825115\15435.exe [7680 2017-05-11] (Ichrab)
HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [A1ECBFFZRHWNVJ5] => C:\Program Files\JRS3P32CTL\QUGPP6ZVN.exe [1042432 2017-05-11] (M%NQ)
HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [F2TA2EH9ZDH3JJD] => "C:\Program Files (x86)\SpeeDownloader\5UPGL.exe" <===== ATTENTION
HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [YRFO2EOK76U17VS] => "C:\Program Files (x86)\SpeeDownloader\MUI1X.exe" <===== ATTENTION
HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [102045] => C:\Users\Lyes\AppData\Roaming\613525\544815.exe [7680 2017-05-11] (Ichrab)
HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [784505] => C:\Users\Lyes\AppData\Roaming\889881\341778.exe [7680 2017-05-11] (Ichrab)
HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [6QTJX30F7VO5D0N] => C:\Program Files\9UQK2C0YPH\GYE62FWIJ.exe [1042432 2017-05-11] (M%NQ)
HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [JY2J0QZZSTC8UN8] => C:\Program Files\FXKMWHK7RN\SMR04GQ8Q.exe [1042432 2017-05-11] (M%NQ)
HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [609948] => C:\Users\Lyes\AppData\Roaming\447566\739616.exe [7680 2017-05-11] (Ichrab)
HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [941335] => C:\Users\Lyes\AppData\Roaming\367970\629821.exe [7680 2017-05-11] (Ichrab)
HKU\S-1-5-18\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [50378880 2015-12-29] (Skype Technologies S.A.)
HKU\S-1-5-18\...\Run: [Norton Download Manager{NIS2250215-SHPD-FSD51083}] => C:\Users\Public\Downloads\Norton\{NIS2250215-SHPD-FSD51083}\FSDUI_Custom.exe [1110856 2015-08-23] (Symantec Corporation)
HKLM\...\Providers\b33ryqvq: C:\Program Files (x86)\Cikotherqitution Mapper\local64spl.dll [314880 2017-05-11] ()
ShellExecuteHooks: Pas de nom - {A891CC98-3172-11E7-A610-64006A5CFC23} - C:\Users\Lyes\AppData\Roaming\Vureingaretosy\Coreghatuvery.dll [149504 2017-05-11] ()
ShellIconOverlayIdentifiers-x32: [###MegaShellExtPending] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\Lyes\AppData\Local\MEGAsync\ShellExtX32.dll -> Pas de fichier
ShellIconOverlayIdentifiers-x32: [###MegaShellExtSynced] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\Lyes\AppData\Local\MEGAsync\ShellExtX32.dll -> Pas de fichier
ShellIconOverlayIdentifiers-x32: [###MegaShellExtSyncing] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\Lyes\AppData\Local\MEGAsync\ShellExtX32.dll -> Pas de fichier
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SteelSeries Engine 3.lnk [2016-03-28]
ShortcutTarget: SteelSeries Engine 3.lnk -> C:\Program Files\SteelSeries\SteelSeries Engine 3\SteelSeriesEngine3.exe (SteelSeries ApS)
Startup: C:\Users\thelyes38\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk [2013-06-05]
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
GroupPolicy: Restriction - Chrome <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
==================== Internet (Avec liste blanche) ====================
(Si un élément est inclus dans le fichier fixlist.txt, s'il s'agit d'un élément du Registre, il sera supprimé ou restauré à la valeur par défaut.)
Hosts: Il y a plus d'un élément dans hosts. Voir la section Hosts de Addition.txt
Tcpip\..\Interfaces\{7FF6CFDD-8D07-4C4E-802C-CB5243D83D73}: [DhcpNameServer] 192.168.0.254
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page =
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page =
HKU\S-1-5-21-785650546-1832744181-4140763645-1001\Software\Microsoft\Internet Explorer\Main,Start Page =
URLSearchHook: HKLM-x32 -> Par défaut = {FE69C007-C452-4d3e-86D2-1730DF8BC871}
URLSearchHook: HKLM-x32 - (Pas de nom) - {f8ffcec7-6050-4413-a8d3-0e89eefa07e9} - Pas de fichier
SearchScopes: HKLM -> DefaultScope {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL =
SearchScopes: HKLM -> {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-785650546-1832744181-4140763645-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-785650546-1832744181-4140763645-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-785650546-1832744181-4140763645-1001 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-785650546-1832744181-4140763645-1001 -> {A531D99C-5A22-449b-83DA-872725C6D0ED} URL = hxxp://search.alot.com/web?q={searchTerms}&pr=prov&client_id=6ABBFE9001CD74CF0006ACA3&install_time=2012-08-07T19:04:10Z&src_id=31273&camp_id=5335&tb_version=1.2.2000.2(B)
SearchScopes: HKU\S-1-5-21-785650546-1832744181-4140763645-1001 -> {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL =
BHO: seaoveInsuhop -> {1e84176e-8052-4d1a-a7b3-31ba95f47a07} -> C:\Program Files\seaoveInsuhop\rTxfuVxQFJTs3j.x64.dll => Pas de fichier
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_91\bin\ssv.dll [2016-05-22] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_91\bin\jp2ssv.dll [2016-05-22] (Oracle Corporation)
BHO-x32: seaoveInsuhop -> {1e84176e-8052-4d1a-a7b3-31ba95f47a07} -> C:\Program Files\seaoveInsuhop\rTxfuVxQFJTs3j.dll => Pas de fichier
BHO-x32: Symantec NCO BHO -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll [2012-06-07] (Symantec Corporation)
BHO-x32: Symantec Intrusion Prevention -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\IPS\IPSBHO.DLL [2011-03-31] (Symantec Corporation)
DPF: HKLM-x32 {E6F480FC-BD44-4CBA-B74A-89AF7842937D} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.5.1.0.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - Pas de fichier
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - Pas de fichier
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-03-21] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Handler: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Pas de fichier
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Pas de fichier
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
FireFox:
========
FF ProfilePath: C:\Users\Lyes\AppData\Roaming\Mozilla\Firefox\Profiles\px3zgbob.default-1462454426021 [2017-05-13]
FF user.js: detected! => C:\Users\Lyes\AppData\Roaming\Mozilla\Firefox\Profiles\px3zgbob.default-1462454426021\user.js [2016-11-23]
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\px3zgbob.default-1462454426021 -> initialpage123
FF Keyword.URL: Mozilla\Firefox\Profiles\px3zgbob.default-1462454426021 -> user_pref("keyword.URL", true);
FF SearchPlugin: C:\Users\Lyes\AppData\Roaming\Mozilla\Firefox\Profiles\px3zgbob.default-1462454426021\searchplugins\b33ryqvq.xml [2017-05-11]
FF Extension: (Skype Click to Call) - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-04-12] [non signé]
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\IPSFFPlgn
FF Extension: (Symantec Intrusion Prevention) - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\IPSFFPlgn [2017-05-13] [non signé]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\coFFPlgn_2011_7_13_2
FF Extension: (Norton Toolbar) - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\coFFPlgn_2011_7_13_2 [2017-05-13] [non signé]
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_25_0_0_171.dll [2017-05-09] ()
FF Plugin: @java.com/DTPlugin,version=11.91.2 -> C:\Program Files\Java\jre1.8.0_91\bin\dtplugin\npDeployJava1.dll [2016-05-22] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.91.2 -> C:\Program Files\Java\jre1.8.0_91\bin\plugin2\npjp2.dll [2016-05-22] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [Pas de fichier]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll [2014-02-14] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_25_0_0_171.dll [2017-05-09] ()
FF Plugin-x32: @java.com/DTPlugin,version=10.10.2 -> C:\windows\SysWOW64\npDeployJava1.dll [2012-12-26] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Pas de fichier]
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2011-04-05] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2017-03-28] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-785650546-1832744181-4140763645-1001: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Lyes\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [2014-07-24] (Skype Limited)
FF Plugin HKU\S-1-5-21-785650546-1832744181-4140763645-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Lyes\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-03-27] (Unity Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2017-03-28] (Adobe Systems Inc.)
StartMenuInternet: FIREFOX.EXE - firefox.exe
Chrome:
=======
CHR DefaultProfile: Default
CHR HomePage: Default -> hxxps://www.google.fr/
CHR StartupUrls: Default -> "hxxps://www.google.fr/"
CHR DefaultSearchURL: Default -> hxxp://srch.bar/{searchTerms}
CHR DefaultSuggestURL: Default -> hxxp://srch.bar/?s={searchTerms}
CHR Profile: C:\Users\Lyes\AppData\Local\Google\Chrome\User Data\Default [2017-05-13]
CHR Extension: (Angry Birds) - C:\Users\Lyes\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj [2015-01-23] [UpdateUrl: hxxps://epicunitscan.info/00service/update2/crx] <==== ATTENTION
CHR Extension: (Adblock Plus) - C:\Users\Lyes\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2017-03-21]
CHR Extension: (Session Buddy) - C:\Users\Lyes\AppData\Local\Google\Chrome\User Data\Default\Extensions\edacconmaakjimmfgnblocblbcdcpbko [2017-05-08]
CHR Extension: (Animal Crossing Music) - C:\Users\Lyes\AppData\Local\Google\Chrome\User Data\Default\Extensions\fcedlaimpcfgpnfdgjbmmfibkklpioop [2017-05-01]
CHR Extension: (YouTube Plus) - C:\Users\Lyes\AppData\Local\Google\Chrome\User Data\Default\Extensions\nkdalpbojfdilmiboaiedicdbigdabpb [2017-04-02]
CHR Extension: (Paiements via le Chrome Web Store) - C:\Users\Lyes\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-10]
CHR Extension: (Chrome Media Router) - C:\Users\Lyes\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-04-04]
CHR HKLM\...\Chrome\Extension: [ehlceeijggpdgfcefmipcmdelickjgfg] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-785650546-1832744181-4140763645-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [dbaonaocldpohelilahfhnkmjankmbcc] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-785650546-1832744181-4140763645-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [ehlceeijggpdgfcefmipcmdelickjgfg] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-785650546-1832744181-4140763645-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ehlceeijggpdgfcefmipcmdelickjgfg] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx
StartMenuInternet: Google Chrome.UPV2WNZYCMBHTGYPTYEAJRZXIY - C:\Users\Lyes\AppData\Local\Google\Chrome\Application\chrome.exe
==================== Services (Avec liste blanche) ====================
(Si un élément est inclus dans le fichier fixlist.txt, il sera supprimé du Registre. Le fichier ne sera pas déplacé, sauf s'il est inscrit séparément.)
S3 BRSptStub; C:\ProgramData\BitRaider\BRSptStub.exe [363208 2016-03-15] (BitRaider, LLC)
R2 cmcore; c:\program files (x86)\cmcm\Clean Master\cmcore.exe [315208 2015-07-22] (Kingsoft Corporation)
R2 MajIndexEducationService; C:\Program Files (x86)\Index Education\Mise a jour automatique\ServiceMiseAJourIndex.exe [3050984 2017-03-15] (Index Education)
S2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4470736 2017-05-09] (Malwarebytes)
R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe [130008 2011-04-17] (Symantec Corporation)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe [244904 2009-12-01] () [Fichier non signé]
R2 Themes; C:\windows\system32\themeservice.dll [44544 2015-03-29] (Microsoft Corporation) [Fichier non signé]
S3 iPod Service; "C:\Program Files\iPod\bin\iPodService.exe" [X]
S2 MBAMScheduler; "\mbamscheduler.exe" [X]
S3 McComponentHostService; "C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe" [X]
===================== Pilotes (Avec liste blanche) ======================
(Si un élément est inclus dans le fichier fixlist.txt, il sera supprimé du Registre. Le fichier ne sera pas déplacé, sauf s'il est inscrit séparément.)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20120928.001\BHDrvx64.sys [1385120 2012-09-01] (Symantec Corporation)
S3 BRDriver64_1_3_3_E02B25FC; C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver64.sys [78088 2016-03-16] (BitRaider)
S3 dtlitescsibus; C:\windows\System32\DRIVERS\dtlitescsibus.sys [30264 2017-05-08] (Disc Soft Ltd)
S3 dtliteusbbus; C:\windows\System32\DRIVERS\dtliteusbbus.sys [47672 2017-05-08] (Disc Soft Ltd)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2012-09-15] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [138912 2012-09-15] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20121005.002\IDSvia64.sys [513184 2012-09-01] (Symantec Corporation)
R3 ksapi64; C:\windows\system32\drivers\ksapi64.sys [56680 2015-05-06] (Kingsoft Corporation)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [43968 2017-05-13] (Malwarebytes)
S3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [84256 2017-05-13] (Malwarebytes)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20121005.018\ENG64.SYS [126112 2012-09-15] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20121005.018\EX64.SYS [2084000 2012-09-15] (Symantec Corporation)
S3 PVUSB; C:\windows\System32\DRIVERS\CESG64.sys [63808 2007-02-19] (CASIO COMPUTER CO.,LTD.)
S3 rtport; C:\windows\SysWOW64\drivers\rtport.sys [15144 2011-10-06] (Windows (R) 2003 DDK 3790 provider)
S3 Sftfs; C:\windows\System32\DRIVERS\Sftfswin7.sys [768680 2013-06-27] (Microsoft Corporation)
S3 Sftplay; C:\windows\System32\DRIVERS\Sftplaywin7.sys [273576 2013-06-27] (Microsoft Corporation)
S3 Sftredir; C:\windows\System32\DRIVERS\Sftredirwin7.sys [29352 2013-06-27] (Microsoft Corporation)
S3 Sftvol; C:\windows\System32\DRIVERS\Sftvolwin7.sys [23208 2013-06-27] (Microsoft Corporation)
R2 SGDrv; C:\windows\System32\DRIVERS\SGdrv64.sys [7680 2011-04-11] (Phoenix Technologies Ltd.)
S3 SRTSP; C:\windows\System32\Drivers\NISx64\1207020.003\SRTSP64.SYS [744568 2011-03-31] (Symantec Corporation)
R1 SRTSPX; C:\windows\system32\drivers\NISx64\1207020.003\SRTSPX64.SYS [40568 2011-03-31] (Symantec Corporation)
R3 ssdevfactory; C:\windows\System32\DRIVERS\ssdevfactory.sys [40576 2016-03-09] (SteelSeries ApS)
R0 SymDS; C:\windows\System32\drivers\NISx64\1207020.003\SYMDS64.SYS [450680 2011-01-27] (Symantec Corporation)
R0 SymEFA; C:\windows\System32\drivers\NISx64\1207020.003\SYMEFA64.SYS [912504 2011-03-15] (Symantec Corporation)
R3 SymEvent; C:\windows\system32\Drivers\SYMEVENT64x86.SYS [174200 2012-08-08] (Symantec Corporation)
R1 SymIRON; C:\windows\system32\drivers\NISx64\1207020.003\Ironx64.SYS [171128 2011-01-27] (Symantec Corporation)
R1 SymNetS; C:\windows\System32\Drivers\NISx64\1207020.003\SYMNETS.SYS [386168 2011-04-21] (Symantec Corporation)
S3 IntcAzAudAddService; system32\drivers\RTKVHD64.sys [X]
S3 WinRing0_1_2_0; \??\C:\Program Files (x86)\Razer\Razer Game Booster\Driver\WinRing0x64.sys [X]
==================== NetSvcs (Avec liste blanche) ===================
(Si un élément est inclus dans le fichier fixlist.txt, il sera supprimé du Registre. Le fichier ne sera pas déplacé, sauf s'il est inscrit séparément.)
==================== Un mois - Créés - fichiers et dossiers ========
(Si un élément est inclus dans le fichier fixlist.txt, le fichier/dossier sera déplacé.)
2017-05-13 15:45 - 2017-05-13 15:46 - 00025194 _____ C:\Users\Lyes\Desktop\FRST.txt
2017-05-13 15:45 - 2017-05-13 15:45 - 02429440 _____ (Farbar) C:\Users\Lyes\Desktop\FRST64.exe
2017-05-13 15:45 - 2017-05-13 15:45 - 00000000 ____D C:\FRST
2017-05-13 15:40 - 2017-05-13 15:40 - 00113592 _____ (Malwarebytes) C:\windows\system32\Drivers\farflt.sys
2017-05-13 15:40 - 2017-05-13 15:40 - 00001867 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-05-13 15:40 - 2017-05-13 15:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-05-13 15:40 - 2017-05-09 16:37 - 00077440 _____ C:\windows\system32\Drivers\mbae64.sys
2017-05-13 15:39 - 2017-05-13 15:39 - 00000000 ____D C:\Program Files\Malwarebytes
2017-05-13 15:36 - 2017-05-13 15:39 - 63035592 _____ (Malwarebytes ) C:\Users\Lyes\Downloads\mb3-setup-35891.35891-3.1.2.1733.exe
2017-05-13 15:31 - 2017-05-13 15:31 - 00046828 _____ C:\Users\Lyes\Desktop\ZHPCleaner.txt
2017-05-13 15:20 - 2017-05-13 15:20 - 00000828 _____ C:\Users\Lyes\Desktop\ZHPCleaner.lnk
2017-05-13 15:18 - 2017-05-13 15:20 - 02769920 _____ C:\Users\Lyes\Downloads\ZHPCleaner.exe
2017-05-13 14:41 - 2017-05-13 15:00 - 00252280 _____ C:\windows\ntbtlog.txt
2017-05-13 09:18 - 2017-05-13 09:18 - 00023045 _____ C:\Users\Lyes\Desktop\AdwCleaner[C2].txt
2017-05-13 09:01 - 2017-05-13 15:31 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\ZHP
2017-05-13 09:01 - 2017-05-13 15:20 - 00000000 ____D C:\Users\Lyes\AppData\Local\ZHP
2017-05-13 09:01 - 2017-05-13 09:38 - 00000818 _____ C:\Users\Lyes\Desktop\ZHPDiag.lnk
2017-05-13 09:01 - 2017-05-13 09:01 - 02726400 _____ C:\Users\Lyes\Downloads\ZHPDiag3.exe
2017-05-13 08:31 - 2017-05-13 08:32 - 04102600 _____ C:\Users\Lyes\Downloads\adwcleaner_6.046.exe
2017-05-12 21:30 - 2017-05-12 22:30 - 00000197 _____ C:\windows\registry.json
2017-05-11 20:01 - 2017-05-11 20:01 - 00000000 ____D C:\Users\Default\AppData\Local\AdvinstAnalytics
2017-05-11 20:01 - 2017-05-11 20:01 - 00000000 ____D C:\Users\Default User\AppData\Local\AdvinstAnalytics
2017-05-11 19:58 - 2017-05-11 19:58 - 00003672 _____ C:\windows\System32\Tasks\updater
2017-05-11 19:57 - 2017-05-11 19:57 - 00000062 _____ C:\windows\WeatherBuddy.INI
2017-05-11 19:57 - 2017-05-11 19:57 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\367970
2017-05-11 19:56 - 2017-05-11 19:56 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\447566
2017-05-11 19:49 - 2017-05-11 19:49 - 00000000 ____D C:\Users\thelyes38\AppData\Local\Samsung
2017-05-11 19:44 - 2017-05-11 19:44 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\656866
2017-05-11 19:39 - 2017-05-11 19:39 - 00140800 _____ C:\Users\Lyes\AppData\Local\installer.dat
2017-05-11 19:39 - 2017-05-11 19:39 - 00011568 _____ C:\Users\Lyes\AppData\Local\InstallationConfiguration.xml
2017-05-11 19:39 - 2017-05-11 19:39 - 00000000 ____D C:\Users\Lyes\AppData\Local\Arermoghtlertiied
2017-05-11 19:39 - 2017-05-11 19:39 - 00000000 ____D C:\Program Files\FXKMWHK7RN
2017-05-11 19:38 - 2017-05-11 19:39 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\889881
2017-05-11 19:38 - 2017-05-11 19:39 - 00000000 ____D C:\Program Files\9UQK2C0YPH
2017-05-11 19:38 - 2017-05-11 19:38 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\613525
2017-05-11 19:37 - 2017-05-11 19:38 - 00000000 ____D C:\Program Files\JRS3P32CTL
2017-05-11 19:37 - 2017-05-11 19:37 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\825115
2017-05-11 19:37 - 2017-05-11 19:37 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\560942
2017-05-11 19:36 - 2017-05-11 19:37 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\577830
2017-05-11 19:36 - 2017-05-11 19:37 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\327632
2017-05-11 19:34 - 2017-05-11 19:34 - 00000000 ____D C:\Users\Lyes\AppData\Local\CrashRpt
2017-05-11 19:33 - 2017-05-11 19:42 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\Vureingaretosy
2017-05-11 19:33 - 2017-05-11 19:40 - 00000000 ____D C:\Users\Lyes\AppData\Local\Aternapy
2017-05-11 19:33 - 2017-05-11 19:33 - 00006078 _____ C:\windows\System32\Tasks\Cikotherqitution Mapper
2017-05-11 19:33 - 2017-05-11 19:33 - 00000000 ____D C:\Program Files (x86)\Foqersyvidation
2017-05-11 19:33 - 2017-05-11 19:33 - 00000000 ____D C:\Program Files (x86)\Cikotherqitution Mapper
2017-05-10 16:09 - 2017-05-10 16:09 - 01249792 _____ C:\windows\739d99369c57c61ac92a1d88c801facf.exe
2017-05-10 16:09 - 2017-05-10 16:09 - 00051628 _____ C:\windows\uninstaller.dat
2017-05-08 12:14 - 2017-05-08 13:18 - 1474177024 ____R C:\Users\Lyes\Downloads\[nextorrent.net] Rogue.One.2016.TRUEFRENCH.BDRiP.XviD-GZR.avi
2017-05-08 12:13 - 2017-05-08 12:13 - 00029410 _____ C:\Users\Lyes\Downloads\Rogue One- A Star Wars Story TRUEFRENCH DVDRiP 2017.torrent
2017-05-08 08:58 - 2017-05-08 08:58 - 00000000 ____D C:\Users\Lyes\AppData\Local\Disc_Soft_Ltd
2017-05-08 08:55 - 2017-05-08 08:55 - 00000000 ____D C:\Users\Public\Documents\Daemon Tools Images
2017-05-08 08:52 - 2017-05-08 08:52 - 00047672 _____ (Disc Soft Ltd) C:\windows\system32\Drivers\dtliteusbbus.sys
2017-05-08 08:51 - 2017-05-08 08:51 - 00030264 _____ (Disc Soft Ltd) C:\windows\system32\Drivers\dtlitescsibus.sys
2017-05-07 21:54 - 2017-05-07 21:54 - 00019874 _____ C:\Users\Lyes\Desktop\tp sin question lyes.odt
2017-05-07 21:18 - 2017-05-07 21:24 - 58905574 _____ C:\Users\Lyes\Downloads\snapchat-10-7-5-0.apk
2017-05-07 17:38 - 2017-05-07 17:38 - 00034225 _____ C:\Users\Lyes\Downloads\Skyrim legendary edition.torrent
2017-05-07 17:32 - 2017-05-07 17:32 - 00000000 ____D C:\Users\Lyes\AppData\Local\Skyrim
2017-05-07 17:32 - 2017-05-07 17:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Razor 1911
2017-05-07 12:01 - 2017-05-07 12:01 - 00020544 _____ C:\Users\Lyes\Downloads\the-elder-scrolls-v-skyrim-pc.torrent
2017-05-01 11:20 - 2017-05-01 11:20 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\Sony Creative Software Inc
2017-05-01 11:15 - 2017-05-01 11:16 - 30299802 _____ C:\Users\Lyes\Downloads\Débat Présidentielle - Le Raptor Dissident.mp4
2017-04-30 19:08 - 2017-04-30 19:08 - 00001683 _____ C:\Users\Lyes\Desktop\MorphVOXPro - Raccourci.lnk
2017-04-30 19:07 - 2017-04-30 19:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Screaming Bee
2017-04-30 19:07 - 2017-04-30 19:07 - 00000000 ____D C:\Program Files (x86)\Screaming Bee
2017-04-30 14:49 - 2017-04-30 14:49 - 00000000 ____D C:\Users\Lyes\AppData\Local\PonyRPG
2017-04-27 18:59 - 2017-04-27 18:59 - 00400616 _____ C:\Users\Lyes\Downloads\Wario Land II (USA, Europe).zip
2017-04-27 18:51 - 2017-04-27 19:02 - 00000000 ____D C:\Users\Lyes\Desktop\vba
2017-04-27 18:50 - 2017-04-27 18:50 - 01359970 _____ C:\Users\Lyes\Downloads\visualboy-advance-1-8-0-en-win.zip
2017-04-27 18:50 - 2017-04-27 18:50 - 01359970 _____ C:\Users\Lyes\Desktop\visualboy-advance-1-8-0-en-win.zip
2017-04-26 20:37 - 2017-04-26 20:37 - 00016496 _____ C:\Users\Lyes\Downloads\6214216f7bd4b2e228a79b8711b18d4f_futurama-fry-meme-funny-fry-memes_236-252.jpeg
2017-04-26 17:31 - 2017-04-26 17:31 - 00223344 _____ C:\Users\Lyes\Downloads\RAPTOR VS YOUTUBE - Expliquez Moi Cette Merde #8 - YouTube.mp4.sfk
2017-04-26 17:28 - 2017-04-26 17:30 - 17900685 _____ C:\Users\Lyes\Downloads\RAPTOR VS YOUTUBE - Expliquez Moi Cette Merde #8 - YouTube.mp4
2017-04-15 21:07 - 2017-04-15 21:07 - 00000000 ____D C:\Users\Lyes\Documents\Wizards of the Coast
2017-04-15 19:35 - 2017-04-15 19:55 - 00000000 ____D C:\Users\Lyes\Documents\DAVAProject
2017-04-15 19:35 - 2017-04-15 19:35 - 00000202 _____ C:\Users\Lyes\Desktop\Magic Duels.url
2017-04-15 11:40 - 2017-04-15 11:41 - 03514528 _____ C:\Users\Lyes\Downloads\WHAT THE CUT 37 - TEMPLE CÉRÉMONIE ET COSMOS.mp3.sfk
2017-04-15 08:51 - 2017-04-15 08:57 - 01906144 _____ C:\Users\Lyes\Downloads\Joueur du Grenier - LES JEUX DE COMICS #2.mp4.sfk
==================== Un mois - Modifiés - fichiers et dossiers ========
(Si un élément est inclus dans le fichier fixlist.txt, le fichier/dossier sera déplacé.)
2017-05-13 15:40 - 2014-05-08 22:46 - 00251832 _____ (Malwarebytes) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2017-05-13 15:40 - 2014-05-08 22:45 - 00187320 _____ (Malwarebytes) C:\windows\system32\Drivers\mbamchameleon.sys
2017-05-13 15:40 - 2014-05-08 22:45 - 00084256 _____ (Malwarebytes) C:\windows\system32\Drivers\mwac.sys
2017-05-13 15:40 - 2013-01-28 00:30 - 00043968 _____ (Malwarebytes) C:\windows\system32\Drivers\mbam.sys
2017-05-13 15:39 - 2013-01-28 00:30 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-05-13 15:31 - 2012-08-29 15:27 - 00000000 ____D C:\Users\Lyes\AppData\Local\CrashDumps
2017-05-13 15:10 - 2012-08-23 20:06 - 00000000 ____D C:\windows\System32\Tasks\Symantec
2017-05-13 15:09 - 2009-07-14 06:45 - 00028848 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-05-13 15:09 - 2009-07-14 06:45 - 00028848 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-05-13 15:05 - 2015-08-23 22:36 - 00000000 ____D C:\windows\System32\Tasks\Remediation
2017-05-13 15:01 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2017-05-13 14:53 - 2013-03-18 18:27 - 00000000 ____D C:\Users\Lyes\AppData\Local\ElevatedDiagnostics
2017-05-13 13:58 - 2012-08-22 13:53 - 00000924 _____ C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-785650546-1832744181-4140763645-1001UA.job
2017-05-13 13:58 - 2012-08-22 13:53 - 00000902 _____ C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-785650546-1832744181-4140763645-1001Core.job
2017-05-13 11:44 - 2016-11-14 20:48 - 00001201 _____ C:\Users\Lyes\Desktop\nativelog.txt
2017-05-13 11:43 - 2014-01-14 15:28 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\.minecraft
2017-05-13 09:19 - 2015-06-07 08:39 - 00000000 ____D C:\AdwCleaner
2017-05-13 08:38 - 2015-01-15 20:14 - 00000000 ____D C:\windows\system32\log
2017-05-13 08:36 - 2015-04-06 16:24 - 00000000 ____D C:\Users\Lyes\AppData\LocalLow\Company
2017-05-12 22:08 - 2012-08-07 18:29 - 00000000 ____D C:\Users\Lyes
2017-05-12 20:01 - 2012-12-21 19:46 - 00000000 ____D C:\ProgramData\boost_interprocess
2017-05-12 18:56 - 2013-07-20 07:38 - 00000000 ____D C:\Program Files (x86)\NCH Software
2017-05-12 18:55 - 2015-05-10 16:59 - 00000919 _____ C:\Users\Lyes\AppData\Roaming\trace_FilterInstaller.txt
2017-05-12 18:55 - 2015-05-10 16:59 - 00000000 _____ C:\Users\Lyes\AppData\Roaming\trace_FilterInstaller.txt-CRT.txt
2017-05-12 18:12 - 2016-03-24 18:06 - 00002189 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-05-11 19:46 - 2013-05-04 02:35 - 00084816 _____ C:\Users\thelyes38\AppData\Local\GDIPFONTCACHEV1.DAT
2017-05-10 13:45 - 2015-03-28 08:51 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\vlc
2017-05-09 17:12 - 2017-02-14 18:13 - 05821944 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerInstaller.exe
2017-05-09 17:12 - 2013-05-24 23:05 - 00803320 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2017-05-09 17:12 - 2013-05-24 23:05 - 00144888 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-05-09 17:12 - 2013-05-24 23:05 - 00004484 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2017-05-09 17:12 - 2013-05-24 23:05 - 00000000 ____D C:\windows\system32\Macromed
2017-05-09 17:12 - 2011-08-13 06:31 - 00000000 ____D C:\windows\SysWOW64\Macromed
2017-05-08 18:50 - 2017-01-21 14:58 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\uTorrent
2017-05-08 12:20 - 2017-01-25 19:36 - 00000000 ____D C:\Users\Lyes\Desktop\ds sin
2017-05-08 08:55 - 2014-11-22 18:12 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\DAEMON Tools Lite
2017-05-08 08:52 - 2009-07-14 05:20 - 00000000 ____D C:\windows\inf
2017-05-08 08:50 - 2014-11-22 18:10 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite
2017-05-07 19:33 - 2011-08-13 06:37 - 00000000 ____D C:\ProgramData\Norton
2017-05-07 17:32 - 2017-04-08 09:02 - 00000000 ____D C:\Users\Lyes\Documents\My Games
2017-05-05 20:16 - 2014-12-28 22:59 - 00004476 _____ C:\windows\System32\Tasks\Adobe Acrobat Update Task
2017-05-05 20:04 - 2014-11-11 10:54 - 00000290 __RSH C:\ProgramData\ntuser.pol
2017-05-01 17:28 - 2016-11-26 19:30 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\discord
2017-05-01 09:22 - 2011-08-13 21:54 - 00748354 _____ C:\windows\system32\perfh00C.dat
2017-05-01 09:22 - 2011-08-13 21:54 - 00150588 _____ C:\windows\system32\perfc00C.dat
2017-05-01 09:22 - 2009-07-14 07:13 - 01671232 _____ C:\windows\system32\PerfStringBackup.INI
2017-04-30 19:10 - 2016-09-29 20:29 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\Audacity
2017-04-30 19:09 - 2016-11-06 11:49 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\Screaming Bee
2017-04-30 19:07 - 2015-10-04 16:41 - 00000000 ____D C:\ProgramData\Package Cache
2017-04-28 23:44 - 2009-07-14 07:08 - 00032496 _____ C:\windows\Tasks\SCHEDLGU.TXT
2017-04-28 09:30 - 2014-07-17 14:49 - 00003500 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA1cfa1bd8fea3151
2017-04-28 09:30 - 2014-07-17 14:49 - 00003372 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore1cfa1bd8f772282
2017-04-27 22:17 - 2015-09-25 20:04 - 00000000 ____D C:\Users\Lyes\Downloads\runtime
2017-04-17 11:12 - 2014-03-07 11:14 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2017-04-14 18:30 - 2014-08-11 22:17 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
==================== Fichiers à la racine de certains dossiers =======
2014-08-20 09:44 - 2014-08-20 09:44 - 6010880 _____ () C:\Program Files (x86)\GUT3CBE.tmp
2014-07-19 20:28 - 2014-07-20 00:44 - 6010880 _____ () C:\Program Files (x86)\GUT8B0B.tmp
2014-08-01 13:51 - 2014-08-02 23:37 - 6010880 _____ () C:\Program Files (x86)\GUTE6D6.tmp
2016-07-14 07:44 - 2016-07-14 07:44 - 2174976 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\Common Files\atimpenc.dll
2012-08-30 21:56 - 2012-08-30 21:56 - 0000006 _____ () C:\Program Files (x86)\Common Files\WPVersion.txt
2015-05-22 00:06 - 2015-12-28 09:24 - 0000024 _____ () C:\Users\Lyes\AppData\Roaming\appdataFr25.bin
2015-02-06 10:00 - 2015-05-21 23:56 - 0000020 _____ () C:\Users\Lyes\AppData\Roaming\appdataFr3.bin
2014-04-03 01:19 - 2014-04-03 01:19 - 0000036 _____ () C:\Users\Lyes\AppData\Roaming\DOK52P4Q3J.dat
2017-02-11 18:09 - 2017-02-12 16:00 - 0000101 _____ () C:\Users\Lyes\AppData\Roaming\infos.properties
2014-07-22 23:22 - 2014-07-22 23:22 - 0000036 _____ () C:\Users\Lyes\AppData\Roaming\SuYZkvrV.tmp
2015-05-10 16:59 - 2015-05-10 16:59 - 0001181 _____ () C:\Users\Lyes\AppData\Roaming\trace_FilterInstaller.1.txt
2015-05-10 16:59 - 2017-05-12 18:55 - 0000919 _____ () C:\Users\Lyes\AppData\Roaming\trace_FilterInstaller.txt
2015-05-10 16:59 - 2017-05-12 18:55 - 0000000 _____ () C:\Users\Lyes\AppData\Roaming\trace_FilterInstaller.txt-CRT.txt
2015-11-18 15:39 - 2015-11-18 15:39 - 0021028 _____ () C:\Users\Lyes\AppData\Roaming\UserTile.png
2017-01-11 14:03 - 2017-03-15 13:55 - 0000256 _____ () C:\Users\Lyes\AppData\Roaming\WB.CFG
2012-05-03 13:12 - 2012-05-03 13:12 - 0000532 _____ () C:\Users\Lyes\AppData\Local\datos.txt
2014-11-24 21:17 - 2014-11-24 21:17 - 0022528 _____ () C:\Users\Lyes\AppData\Local\dsisetup33579522.exe
2014-12-02 18:41 - 2014-12-02 18:41 - 0022528 _____ () C:\Users\Lyes\AppData\Local\dsisetup788083822.exe
2017-05-11 19:39 - 2017-05-11 19:39 - 0011568 _____ () C:\Users\Lyes\AppData\Local\InstallationConfiguration.xml
2017-05-11 19:39 - 2017-05-11 19:39 - 0140800 _____ () C:\Users\Lyes\AppData\Local\installer.dat
2014-02-05 22:08 - 2014-02-05 22:08 - 0193744 _____ () C:\Users\Lyes\AppData\Local\lateral1.bmp
2010-11-12 11:10 - 2010-11-12 11:10 - 0193744 _____ () C:\Users\Lyes\AppData\Local\lateral2.bmp
2014-02-05 22:10 - 2014-02-05 22:10 - 0195108 _____ () C:\Users\Lyes\AppData\Local\lateral3.bmp
2015-09-27 10:17 - 2015-09-27 10:17 - 0000955 _____ () C:\Users\Lyes\AppData\Local\recently-used.xbel
2014-02-05 23:50 - 2014-02-05 23:50 - 0043976 _____ () C:\Users\Lyes\AppData\Local\save_en.bmp
2014-02-05 23:49 - 2014-02-05 23:49 - 0043976 _____ () C:\Users\Lyes\AppData\Local\save_es.bmp
2016-03-11 18:51 - 2016-03-11 18:51 - 0000000 _____ () C:\Users\Lyes\AppData\Local\{56B1AC0F-FE36-4B88-B6CB-8D6AFC4AF003}
2016-03-05 23:28 - 2016-03-05 23:28 - 0000000 _____ () C:\Users\Lyes\AppData\Local\{C63BCE57-37D3-4E86-9FAF-A7DAFDF40B70}
2016-03-12 23:01 - 2016-03-12 23:01 - 0000000 _____ () C:\Users\Lyes\AppData\Local\{F0E0F900-0CFA-4A8A-8EA6-E3DB8F460924}
2012-08-08 17:34 - 2012-08-08 17:34 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2012-08-30 22:07 - 2012-08-30 22:07 - 0000097 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
2015-09-19 15:38 - 2015-09-19 15:38 - 0004105 _____ () C:\ProgramData\wmzddnmb.cix
2011-08-13 07:31 - 2011-08-13 07:32 - 0000109 _____ () C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log
2011-08-13 07:26 - 2011-08-13 07:26 - 0000113 _____ () C:\ProgramData\{34FBC7C4-CD31-4D93-A428-0E524EAC4586}.log
2011-08-13 07:29 - 2011-08-13 07:30 - 0000105 _____ () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
2011-08-13 07:26 - 2011-08-13 07:29 - 0000106 _____ () C:\ProgramData\{80E158EA-7181-40FE-A701-301CE6BE64AB}.log
2011-08-13 07:30 - 2011-08-13 07:31 - 0000110 _____ () C:\ProgramData\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}.log
Fichiers à déplacer ou supprimer:
====================
C:\Users\Lyes\update-walking-dead.bat
C:\Users\Lyes\worldpainter_1.2.5.exe
C:\Users\Lyes\worldpainter_1.4.0.exe
Certains fichiers dans TEMP:
====================
2017-05-11 19:37 - 2017-05-11 19:37 - 0524972 _____ (WeMonetize ) C:\Users\Lyes\AppData\Local\Temp\1X4TVSQ.exe
2017-05-11 19:37 - 2017-05-11 19:37 - 0524972 _____ (WeMonetize ) C:\Users\Lyes\AppData\Local\Temp\7INM3P0.exe
2017-05-11 19:56 - 2017-05-11 19:56 - 0363008 _____ (M%NQ) C:\Users\Lyes\AppData\Local\Temp\HWAAY9OG0XVN.exe
2017-05-10 13:05 - 2017-05-10 13:05 - 3190104 _____ (Lead IT) C:\Users\Lyes\AppData\Local\Temp\pdD3dFNr-prog.exe
2017-05-10 13:05 - 2017-05-10 13:05 - 0140872 _____ () C:\Users\Lyes\AppData\Local\Temp\pdD3dFNr-upd.exe
2017-05-10 13:05 - 2017-05-10 13:05 - 2988888 _____ (IT Genius) C:\Users\Lyes\AppData\Local\Temp\W3rlsPaZ-prog.exe
2013-06-26 04:19 - 2013-06-26 04:20 - 31668328 _____ (Skype Technologies S.A.) C:\Users\thelyes38\AppData\Local\Temp\SkypeSetup.exe
==================== Bamital & volsnap ======================
(Il n'y a pas de correction automatique pour les fichiers qui ne satisfont pas à la vérification.)
C:\windows\system32\winlogon.exe => Le fichier est signé numériquement
C:\windows\system32\wininit.exe => Le fichier est signé numériquement
C:\windows\SysWOW64\wininit.exe => Le fichier est signé numériquement
C:\windows\explorer.exe => Le fichier est signé numériquement
C:\windows\SysWOW64\explorer.exe => Le fichier est signé numériquement
C:\windows\system32\svchost.exe => Le fichier est signé numériquement
C:\windows\SysWOW64\svchost.exe => Le fichier est signé numériquement
C:\windows\system32\services.exe => Le fichier est signé numériquement
C:\windows\system32\User32.dll => Le fichier est signé numériquement
C:\windows\SysWOW64\User32.dll => Le fichier est signé numériquement
C:\windows\system32\userinit.exe => Le fichier est signé numériquement
C:\windows\SysWOW64\userinit.exe => Le fichier est signé numériquement
C:\windows\system32\rpcss.dll => Le fichier est signé numériquement
C:\windows\system32\dnsapi.dll => Le fichier est signé numériquement
C:\windows\SysWOW64\dnsapi.dll => Le fichier est signé numériquement
C:\windows\system32\Drivers\volsnap.sys => Le fichier est signé numériquement
testsigning: ==> 'testsigning' est activé. Rechercher un éventuel pilote non signé <===== ATTENTION
LastRegBack: 2017-05-03 00:00
==================== Fin de FRST.txt ============================