Publicité
Publicité
Format du document : text/plain
Prévisualisation
Résultats d'analyse de Farbar Recovery Scan Tool (FRST) (x64) Version: 15.07.2018
Exécuté par Dr Riadh ESSEFI (administrateur) sur DRESSEFI (17-07-2018 21:41:40)
Exécuté depuis C:\Users\ryadh\Desktop
Profils chargés: Dr Riadh ESSEFI & RANA (Profils disponibles: Dr Riadh ESSEFI & RANA)
Platform: Windows 10 Pro Version 1709 16299.431 (X64) Langue: Français (France)
Internet Explorer Version 11 (Navigateur par défaut: Edge)
Mode d'amorçage: Normal
Tutoriel pour Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processus (Avec liste blanche) =================
(Si un élément est inclus dans le fichier fixlist.txt, le processus sera arrêté. Le fichier ne sera pas déplacé.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe
(Dropbox, Inc.) C:\Windows\System32\DbxSvc.exe
(arvato digital services llc) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(CHENGDU YIWO Tech Development Co., Ltd) C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe
(McAfee, LLC.) C:\Program Files\TrueKey\McTkSchedulerService.exe
(DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe
(AVAST Software) C:\Program Files (x86)\AVAST Software\Avast Cleanup\TuneupSvc.exe
(Wondershare) C:\Program Files (x86)\Wondershare\WAF\2.4.3.236\WsAppService.exe
(McAfee, LLC.) C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
() C:\Program Files (x86)\EaseUS\Todo Backup\bin\TodoBackupService.exe
(Microsoft Corporation) C:\Windows\System32\vds.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Update\1.4.141.333\AvastBrowserCrashHandler.exe
(AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Update\1.4.141.333\AvastBrowserCrashHandler64.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1815.209.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\PeopleExperienceHost.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(AVAST Software) C:\Program Files (x86)\AVAST Software\Avast Cleanup\TuneupUI.exe
(Microsoft Corporation) C:\Windows\System32\SppExtComObj.Exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsStore_11805.1001.42.0_x64__8wekyb3d8bbwe\WinStore.App.exe
() C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.18052.11111.0_x64__8wekyb3d8bbwe\Music.UI.exe
(AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe
(AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Opera Software) C:\Program Files (x86)\Opera\53.0.2907.99\opera_autoupdate.exe
(Opera Software) C:\Program Files (x86)\Opera\53.0.2907.99\opera_autoupdate.exe
(Microsoft Corporation) C:\Windows\System32\SnippingTool.exe
==================== Registre (Avec liste blanche) ===========================
(Si un élément est inclus dans le fichier fixlist.txt, l'élément de Registre sera restauré à la valeur par défaut ou supprimé. Le fichier ne sera pas déplacé.)
HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [630168 2017-09-29] (Microsoft Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [1802424 2015-11-19] (NVIDIA Corporation)
HKLM\...\Run: [USB Safely Remove] => C:\Program Files (x86)\USB Safely Remove\USBSafelyRemove.exe [6519064 2016-10-16] (Crystal Rich Ltd)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [242904 2018-07-01] (AVAST Software)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [3242696 2015-10-07] (ELAN Microelectronics Corp.)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [3567928 2017-12-05] (Dropbox, Inc.)
HKLM-x32\...\Run: [VeriFaceManager] => C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe [3122528 2016-01-25] (Lenovo)
HKLM-x32\...\Run: [jswtrayutil] => C:\Program Files (x86)\Jumpstart\jswtrayutil.exe [528384 2008-09-26] (Atheros Communications, Inc.)
HKLM-x32\...\Run: [HPUsageTrackingLEDM] => "C:\Program Files (x86)\HP\HP UT LEDM\bin\hppusg.exe" "C:\Program Files (x86)\HP\HP UT LEDM\"
HKLM-x32\...\Run: [MagicPlusHelper] => C:\Program Files (x86)\MagicPlus\MagicPlus_helper.exe [2499208 2016-06-02] (Lenovo)
HKLM-x32\...\Run: [331BigDog] => C:\Program Files (x86)\USB Camera\VM331_STI.EXE [536576 2010-06-18] (Vimicro)
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
HKU\S-1-5-21-3434288234-2416881581-2136330683-1001\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [25638872 2018-04-23] (Google)
HKU\S-1-5-21-3434288234-2416881581-2136330683-1001\...\Run: [VideoDownloaderUltimate] => C:\ProgramData\VideoDownloaderUltimateWinApp\VideoDownloaderUltimate.exe [2615112 2016-09-23] (Link64 GmbH)
HKU\S-1-5-21-3434288234-2416881581-2136330683-1001\...\Run: [GoogleChromeAutoLaunch_454AC088E6840E6E5730B972F2F7217D] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [1588568 2018-06-22] (Google Inc.)
HKU\S-1-5-21-3434288234-2416881581-2136330683-1001\...\Run: [EPLTarget\P0000000000000000] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATII2E.EXE [283232 2015-01-14] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-3434288234-2416881581-2136330683-1001\...\Run: [EPLTarget\P0000000000000001] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATII2E.EXE [283232 2015-01-14] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-3434288234-2416881581-2136330683-1001\...\Run: [AvastBrowserAutoLaunch_2817B93609718EE76F7F81E0EC60E921] => C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe [1808264 2018-06-12] (AVAST Software)
HKU\S-1-5-21-3434288234-2416881581-2136330683-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-3434288234-2416881581-2136330683-1001\...\MountPoints2: {e68189e6-73e2-11e7-926c-70f3954d11e0} - "G:\Lenovo_Suite.exe"
HKU\S-1-5-21-3434288234-2416881581-2136330683-1005\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [25638872 2018-04-23] (Google)
HKU\S-1-5-21-3434288234-2416881581-2136330683-1005\...\Run: [VideoDownloaderUltimate] => C:\ProgramData\VideoDownloaderUltimateWinApp\VideoDownloaderUltimate.exe [2615112 2016-09-23] (Link64 GmbH)
HKU\S-1-5-21-3434288234-2416881581-2136330683-1005\...\Run: [GoogleChromeAutoLaunch_454AC088E6840E6E5730B972F2F7217D] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [1588568 2018-06-22] (Google Inc.)
HKU\S-1-5-21-3434288234-2416881581-2136330683-1005\...\Run: [EPLTarget\P0000000000000000] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATII2E.EXE [283232 2015-01-14] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-3434288234-2416881581-2136330683-1005\...\Run: [EPLTarget\P0000000000000001] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATII2E.EXE [283232 2015-01-14] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-3434288234-2416881581-2136330683-1005\...\Run: [AvastBrowserAutoLaunch_691D61FF1CE29C8BE2888E4A552A5ECD] => C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe [1808264 2018-06-12] (AVAST Software)
HKU\S-1-5-21-3434288234-2416881581-2136330683-1005\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
IFEO\appvlp.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\excel.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\groove.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\lync.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\msaccess.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\msoev.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\msotd.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\msoxmled.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\mspub.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\mysql.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\nvstview.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\ocpubmgr.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\onenote.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\onenotem.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\outlook.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\powerpnt.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\setlang.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\shareit.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\uninstall.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\winword.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
Lsa: [Notification Packages] scecli C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter "C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter"
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Avast Cleanup Premium.lnk [2017-11-21]
ShortcutTarget: Avast Cleanup Premium.lnk -> C:\Program Files (x86)\AVAST Software\Avast Cleanup\TuneupUI.exe (AVAST Software)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\BackupRemind.lnk [2017-03-07]
ShortcutTarget: BackupRemind.lnk -> C:\Program Files (x86)\Wondershare\Wondershare Dr.Fone for Android (CPC)\Addins\AndroidBackupRestore\BackupRemind.exe (Wondershare)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2017-12-02]
Startup: C:\Users\ryadh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Envoyer à OneNote.lnk [2018-02-28]
ShortcutTarget: Envoyer à OneNote.lnk -> C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE (Microsoft Corporation)
==================== Internet (Avec liste blanche) ====================
(Si un élément est inclus dans le fichier fixlist.txt, s'il s'agit d'un élément du Registre, il sera supprimé ou restauré à la valeur par défaut.)
HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings: [ProxySettingsPerUser] 0 <==== ATTENTION (Restriction - ProxySettings)
ProxyEnable: [HKLM] => Proxy est activé.
ProxyEnable: [HKLM-x32] => Proxy est activé.
ProxyServer: [HKLM] => http=127.0.0.1:8080;https=127.0.0.1:8080
ProxyServer: [HKLM-x32] => http=127.0.0.1:8080;https=127.0.0.1:8080
AutoConfigURL: [HKLM] => http=127.0.0.1:8080;https=127.0.0.1:8080
ProxyEnable: [.DEFAULT] => Proxy est activé.
ProxyServer: [.DEFAULT] => http=127.0.0.1:8080;https=127.0.0.1:8080
ProxyServer: [S-1-5-21-3434288234-2416881581-2136330683-1001] => http=127.0.0.1:8080;https=127.0.0.1:8080
ProxyServer: [S-1-5-21-3434288234-2416881581-2136330683-1005] => 172.21.192.4:3128
Tcpip\Parameters: [DhcpNameServer] 8.8.8.8 41.226.16.50
Tcpip\..\Interfaces\{2cd0401a-752d-4c7a-b86d-e1851879ed5e}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{a78e8345-c89e-4fae-bbec-4b57ea89caf7}: [DhcpNameServer] 8.8.8.8 41.226.16.50
Tcpip\..\Interfaces\{aab33f2a-9e36-4d7b-b17d-617ee373a65c}: [NameServer] 193.95.84.13,193.95.84.12
Tcpip\..\Interfaces\{dace1555-aca4-4e2c-88eb-3634fd06b7f8}: [DhcpNameServer] 192.168.42.129
ManualProxies: 1http=127.0.0.1:8080;https=127.0.0.1:8080
Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2018-06-21] (Microsoft Corporation)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2018-05-05] (Microsoft Corporation)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-05-30] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-05-30] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-05-30] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-05-30] (Microsoft Corporation)
Edge:
======
Edge Extension: (Pas de nom) -> EdgeExtension_MicrosoftOneNoteWebClipper_8wekyb3d8bbwe => C:\Program Files\WindowsApps\Microsoft.OneNoteWebClipper_3.8.0.0_neutral__8wekyb3d8bbwe [2018-06-21]
Edge Extension: (Translator For Microsoft Edge) -> MicrosoftTranslate_MicrosoftTranslatorforMicrosoftEdge_8wekyb3d8bbwe => C:\Program Files\WindowsApps\Microsoft.TranslatorforMicrosoftEdge_0.91.47.0_neutral__8wekyb3d8bbwe [2018-06-13]
FireFox:
========
FF DefaultProfile: u2wsyugm.default
FF DefaultProfile: drriyadhessefi1@gmail.com
FF ProfilePath: C:\Users\ryadh\AppData\Roaming\Mozilla\Firefox\Profiles\u2wsyugm.default [2018-07-01]
FF user.js: detected! => C:\Users\ryadh\AppData\Roaming\Mozilla\Firefox\Profiles\u2wsyugm.default\user.js [2017-10-02]
FF Extension: (Dashlane) - C:\Users\ryadh\AppData\Roaming\Mozilla\Firefox\Profiles\u2wsyugm.default\Extensions\jetpack-extension@dashlane.com.xpi [2018-03-01]
FF Extension: (Avast SafePrice) - C:\Users\ryadh\AppData\Roaming\Mozilla\Firefox\Profiles\u2wsyugm.default\Extensions\sp@avast.com.xpi [2018-03-01]
FF Extension: (Avast Online Security) - C:\Users\ryadh\AppData\Roaming\Mozilla\Firefox\Profiles\u2wsyugm.default\Extensions\wrc@avast.com.xpi [2018-07-01]
FF Extension: (Yamli for Firefox) - C:\Users\ryadh\AppData\Roaming\Mozilla\Firefox\Profiles\u2wsyugm.default\Extensions\yamlitoolbar@yamli.com.xpi [2016-12-08] [Legacy]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_27_0_0_187.dll [2017-12-02] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_27_0_0_187.dll [2017-12-02] ()
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2015-10-13] (Google, Inc.)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2018-03-30] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2018-03-17] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2016-11-14] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2016-11-14] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-19] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-19] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2018-02-22] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3434288234-2416881581-2136330683-1001: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 -> C:\Users\ryadh\AppData\Roaming\Visan\plugins\npRLSecurePluginLayer.dll [2011-05-13] (RocketLife, LLP)
Chrome:
=======
CHR HomePage: Default -> hxxps://www.facebook.com/
CHR StartupUrls: Default -> " hxxp://en.hao123.com/?tn=spark_inner_hp_01_hao123_gl&guid=f08fde911f9409b6313d30846fe22d55","hxxps://www.google.com/"
CHR Session Restore: Default -> est activé.
CHR Profile: C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default [2018-07-14]
CHR Extension: (Slides) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-10-18]
CHR Extension: (Torch - On Fire) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\akjpgliecbkphdlkdefgalgdlcmdfhip [2016-04-10]
CHR Extension: (Docs) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-18]
CHR Extension: (Google Drive) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-04-09]
CHR Extension: (YouTube) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-04-09]
CHR Extension: (Search by Image (by Google)) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\dajedkncpodkggklbegccjpmnglmnflm [2017-06-17]
CHR Extension: (Dropbox pour Gmail) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\dpdmhfocilnekecfjgimjdeckachfbec [2018-05-28]
CHR Extension: (Adobe Acrobat) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2017-03-14]
CHR Extension: (Video Downloader professional) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\elicpjhcidhpjomhibiffojpinpmmpil [2018-05-28]
CHR Extension: (Avast SafePrice) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2018-05-28]
CHR Extension: (Dashlane) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdjamakpfbbddfjaooikfcpapjohcfmg [2018-05-28]
CHR Extension: (Trevx - Music Downloader) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\fpmaepaboafhefdejcbiciklgjogoghf [2016-04-11]
CHR Extension: (Bureau à distance Google Chrome) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbchcmhmhahfdphkhkmpfmihenigjmpp [2018-01-07]
CHR Extension: (Google Docs hors connexion) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-04-09]
CHR Extension: (Guardio for Chrome) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjfpmkejnolcfklaaddjnckanhhgegla [2018-05-27]
CHR Extension: (Avast Online Security) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2018-05-28]
CHR Extension: (SoundCloud) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\ipebkipbeggmmkjjljenoblnfaenambp [2016-04-11]
CHR Extension: (Yamli) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\jhninijcbcniklnjbohdmoglogfjbglh [2016-04-10]
CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2016-04-09]
CHR Extension: (Paiements via le Chrome Web Store) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-04-10]
CHR Extension: (Gmail) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-04-09]
CHR Extension: (Chrome Media Router) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-05-28]
CHR HKU\S-1-5-21-3434288234-2416881581-2136330683-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx
Opera:
=======
OPR Extension: (Arabic Keyboard) - C:\Users\ryadh\AppData\Roaming\Opera Software\Opera Stable\Extensions\hlkecjkkdnolnelaaacobmbjbecanpkp [2016-12-23]
OPR Extension: (Download YouTube Videos as MP4) - C:\Users\ryadh\AppData\Roaming\Opera Software\Opera Stable\Extensions\maeombkgfpjdnjkhohbjachnnmpbipol [2017-02-15]
OPR Extension: (SaveFrom.net Helper) - C:\Users\ryadh\AppData\Roaming\Opera Software\Opera Stable\Extensions\npdpplbicnmpoigidfdjadamgfkilaak [2018-06-28]
==================== Services (Avec liste blanche) ====================
(Si un élément est inclus dans le fichier fixlist.txt, il sera supprimé du Registre. Le fichier ne sera pas déplacé, sauf s'il est inscrit séparément.)
R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe [7780400 2018-07-01] (AVAST Software)
S2 avast; C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [164984 2018-06-13] (AVAST Software)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [322464 2018-07-01] (AVAST Software)
R2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [435248 2018-07-01] (AVAST Software)
S3 avastm; C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [164984 2018-06-13] (AVAST Software)
R2 CleanupPSvc; C:\Program Files (x86)\AVAST Software\Avast Cleanup\TuneupSvc.exe [7650600 2018-02-04] (AVAST Software)
S4 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [8654504 2018-06-12] (Microsoft Corporation)
S4 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-01-26] (Dropbox, Inc.)
S4 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-01-26] (Dropbox, Inc.)
R2 DbxSvc; C:\WINDOWS\system32\DbxSvc.exe [51016 2017-12-05] (Dropbox, Inc.)
R2 EaseUS Agent; C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe [40080 2017-08-30] (CHENGDU YIWO Tech Development Co., Ltd)
R2 EpsonScanSvc; C:\WINDOWS\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation)
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [144072 2015-10-07] (ELAN Microelectronics Corp.)
S2 HP LaserJet Service; C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe [136704 2009-06-24] (HP) [Fichier non signé]
S4 IObitUnSvr; C:\Program Files (x86)\IObit\IObit Uninstaller\IUService.exe [360736 2016-10-28] (IObit)
S4 jswpbapi; C:\Program Files (x86)\Jumpstart\jswpbapi.exe [265216 2008-09-26] (Atheros Communications, Inc.) [Fichier non signé]
S4 jswpsapi; C:\Program Files (x86)\Jumpstart\jswpsapi.exe [954368 2008-09-26] (Atheros Communications, Inc.) [Fichier non signé]
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6541008 2018-05-09] (Malwarebytes)
S4 Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [239184 2014-02-15] ()
S4 MySQL_For_MedinTux; C:\Program Files (x86)\MySQL\MySQL_MedinTux\my.ini [8922 2016-12-27] () [Fichier non signé]
R2 PSI_SVC_2; C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe [277360 2014-04-30] (arvato digital services llc)
S4 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2013-03-01] (Riverbed Technology, Inc.)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [4329952 2017-11-26] (Microsoft Corporation)
R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe [754784 2016-07-22] (DEVGURU Co., LTD.)
R2 TrueKey; C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe [1000824 2018-05-14] (McAfee, LLC.)
R2 TrueKeyScheduler; C:\Program Files\TrueKey\McTkSchedulerService.exe [16928 2018-05-14] (McAfee, LLC.)
S4 TrueKeyServiceHelper; C:\Program Files\TrueKey\McAfee.TrueKey.ServiceHelper.exe [87760 2018-05-14] (McAfee, Inc.)
S4 USBSafelyRemoveService; C:\Program Files (x86)\USB Safely Remove\USBSRService.exe [1705752 2016-10-16] (Crystal Rich Ltd)
S4 uSHAREitSvc; C:\Program Files (x86)\SHAREit Technologies\SHAREit\SHAREit.Service.exe [33224 2017-09-11] (SHAREit Technologies Co.Ltd)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [355304 2017-09-29] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [105944 2017-09-29] (Microsoft Corporation)
R2 WsAppService; C:\Program Files (x86)\Wondershare\WAF\2.4.3.236\WsAppService.exe [495840 2018-01-26] (Wondershare)
S4 WsDrvInst; C:\Program Files (x86)\Wondershare\drfone\Library\DriverInstaller\DriverInstall.exe [120096 2018-01-16] (Wondershare)
===================== Pilotes (Avec liste blanche) ======================
(Si un élément est inclus dans le fichier fixlist.txt, il sera supprimé du Registre. Le fichier ne sera pas déplacé, sauf s'il est inscrit séparément.)
R1 aswArPot; C:\WINDOWS\System32\drivers\aswArPot.sys [197160 2018-07-01] (AVAST Software)
R1 aswbidsdriver; C:\WINDOWS\System32\drivers\aswbidsdrivera.sys [229392 2018-07-01] (AVAST Software)
R0 aswbidsh; C:\WINDOWS\System32\drivers\aswbidsha.sys [201328 2018-07-01] (AVAST Software)
R0 aswblog; C:\WINDOWS\System32\drivers\aswbloga.sys [346664 2018-07-01] (AVAST Software)
R0 aswbuniv; C:\WINDOWS\System32\drivers\aswbuniva.sys [59592 2018-07-01] (AVAST Software)
S3 aswElam; C:\WINDOWS\System32\drivers\aswElam.sys [15360 2018-07-01] (AVAST Software)
S3 aswHwid; C:\WINDOWS\System32\drivers\aswHwid.sys [46976 2018-07-01] (AVAST Software)
R2 aswMonFlt; C:\WINDOWS\System32\drivers\aswMonFlt.sys [159640 2018-07-01] (AVAST Software)
R1 aswNetSec; C:\WINDOWS\System32\drivers\aswNetSec.sys [647488 2018-07-01] (AVAST Software)
R1 aswRdr; C:\WINDOWS\System32\drivers\aswRdr2.sys [111872 2018-07-01] (AVAST Software)
R0 aswRvrt; C:\WINDOWS\System32\drivers\aswRvrt.sys [85968 2018-07-01] (AVAST Software)
R1 aswSnx; C:\WINDOWS\System32\drivers\aswSnx.sys [1027728 2018-07-01] (AVAST Software)
R1 aswSP; C:\WINDOWS\System32\drivers\aswSP.sys [463080 2018-07-01] (AVAST Software)
R2 aswStm; C:\WINDOWS\System32\drivers\aswStm.sys [211160 2018-07-01] (AVAST Software)
S3 aswTap; C:\WINDOWS\System32\drivers\aswTap.sys [53904 2017-02-09] (The OpenVPN Project)
R0 aswVmm; C:\WINDOWS\System32\drivers\aswVmm.sys [381584 2018-07-01] (AVAST Software)
S3 BstkDrv; C:\Program Files (x86)\BlueStacks\BstkDrv.sys [269408 2018-06-21] (Bluestack System Inc. )
S3 CH341SER_A64; C:\WINDOWS\System32\Drivers\CH341S64.SYS [58368 2011-11-05] (www.winchiphead.com)
R3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.)
R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [152688 2018-07-11] (Malwarebytes)
R0 EUBKMON; C:\WINDOWS\System32\drivers\EUBKMON.sys [62528 2018-01-03] ()
R1 HWiNFO32; C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [27552 2016-03-29] (REALiX(tm))
R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [191208 2018-07-11] (Malwarebytes)
R3 MBAMFarflt; C:\WINDOWS\System32\DRIVERS\farflt.sys [114920 2018-07-11] (Malwarebytes)
R3 MBAMProtection; C:\WINDOWS\system32\DRIVERS\mbam.sys [48360 2018-07-11] (Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [253664 2018-07-11] (Malwarebytes)
R3 MBAMWebProtection; C:\WINDOWS\system32\DRIVERS\mwac.sys [102632 2018-07-17] (Malwarebytes)
S3 mvusbews; C:\WINDOWS\System32\Drivers\mvusbews.sys [20480 2012-08-21] (Marvell Semiconductor, Inc.) [Fichier non signé]
S3 NPF; C:\WINDOWS\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [604160 2017-09-29] (Realtek )
S3 silabenm; C:\WINDOWS\system32\DRIVERS\silabenm.sys [27336 2011-10-14] (Silicon Laboratories) [Fichier non signé]
R3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [165504 2016-09-05] (Samsung Electronics Co., Ltd.)
S3 usbrndis6; C:\WINDOWS\System32\drivers\usb80236.sys [23040 2017-09-29] (Microsoft Corporation)
R3 vm331avs; C:\WINDOWS\System32\Drivers\vm331avs.sys [215168 2010-06-18] (Vimicro Corporation)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44608 2017-09-29] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [309144 2017-09-29] (Microsoft Corporation)
S3 wdm_usb; C:\WINDOWS\system32\DRIVERS\usb2ser.sys [159936 2016-08-16] (MBB)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [119192 2017-09-29] (Microsoft Corporation)
S3 BstHdDrv; \??\C:\Program Files (x86)\Bluestacks\HD-Hypervisor-amd64.sys [X]
==================== NetSvcs (Avec liste blanche) ===================
(Si un élément est inclus dans le fichier fixlist.txt, il sera supprimé du Registre. Le fichier ne sera pas déplacé, sauf s'il est inscrit séparément.)
==================== Un mois - Créés - fichiers et dossiers ========
(Si un élément est inclus dans le fichier fixlist.txt, le fichier/dossier sera déplacé.)
2018-07-17 21:37 - 2018-07-17 21:37 - 002412544 _____ (Farbar) C:\Users\ryadh\Desktop\FRST64.exe
2018-07-17 21:06 - 2018-07-17 21:06 - 000434095 _____ C:\Users\ryadh\Downloads\cir765 (1).pdf
2018-07-17 21:01 - 2018-07-17 21:01 - 000434095 _____ C:\Users\ryadh\Downloads\cir765.pdf
2018-07-17 20:54 - 2018-07-17 20:54 - 000000000 ____D C:\Users\ryadh\AppData\Local\TempOfficeC2R16BFFBF7-9436-40B5-A45F-FBEEB07C0132
2018-07-17 20:48 - 2018-07-17 20:48 - 000102632 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2018-07-14 23:16 - 2018-07-14 23:16 - 003179936 _____ C:\Users\ryadh\Downloads\cartesanitaire2015ressohum.pdf
2018-07-14 22:11 - 2018-07-14 22:11 - 001858294 _____ C:\Users\ryadh\Downloads\36973101_990852951076518_6813101635187769344_n.mp4
2018-07-14 22:10 - 2018-07-14 22:11 - 006803890 _____ C:\Users\ryadh\Downloads\30618408_2089448101278353_4089361946652164759_n.mp4
2018-07-14 20:42 - 2018-07-17 21:43 - 000031960 _____ C:\Users\ryadh\Desktop\FRST.txt
2018-07-14 20:42 - 2018-07-14 20:42 - 000081222 _____ C:\Users\ryadh\Desktop\Addition.txt
2018-07-14 20:34 - 2018-07-14 20:34 - 002412544 _____ (Farbar) C:\Users\ryadh\Desktop\FRST64 (1).exe
2018-07-11 23:53 - 2018-07-11 23:53 - 000114920 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
2018-07-11 23:53 - 2018-07-11 23:53 - 000048360 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2018-07-11 23:52 - 2018-07-11 23:52 - 000253664 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys
2018-07-11 23:50 - 2018-07-11 23:51 - 000742680 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2018-07-11 05:08 - 2018-07-11 05:08 - 000191208 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamChameleon.sys
2018-07-10 22:18 - 2018-07-10 22:18 - 000027181 _____ C:\Users\ryadh\Desktop\UsbFix_Report.txt
2018-07-10 22:05 - 2018-07-10 22:05 - 000001962 _____ C:\Users\ryadh\Desktop\UsbFix Anti-Malware.lnk
2018-07-09 01:08 - 2018-07-09 01:11 - 000002068 _____ C:\Users\ryadh\Desktop\Rkill.txt
2018-07-09 01:06 - 2018-07-09 01:08 - 000317024 _____ C:\TDSSKiller.3.1.0.17_09.07.2018_01.06.32_log.txt
2018-07-09 01:03 - 2018-07-09 01:03 - 004949824 _____ (AO Kaspersky Lab) C:\Users\ryadh\Downloads\tdsskiller.exe
2018-07-09 01:03 - 2018-07-09 01:03 - 001802704 _____ (Bleeping Computer, LLC) C:\Users\ryadh\Downloads\rkill.exe
2018-07-09 00:57 - 2018-07-17 21:41 - 000000000 ____D C:\FRST
2018-07-09 00:47 - 2018-07-09 00:47 - 005660124 _____ (Swearware) C:\Users\ryadh\Downloads\ComboFix.exe
2018-07-09 00:47 - 2018-07-09 00:47 - 002412544 _____ (Farbar) C:\Users\ryadh\Downloads\FRST64.exe
2018-07-08 23:04 - 2018-07-08 23:04 - 000000002 _____ C:\runcheck.txt
2018-07-08 23:04 - 2018-07-08 23:04 - 000000000 ____D C:\zoek_backup
2018-07-08 22:42 - 2018-07-11 05:07 - 000152688 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbae64.sys
2018-07-08 22:42 - 2018-07-08 22:42 - 000001920 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2018-07-08 22:42 - 2018-07-08 22:42 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2018-07-08 22:42 - 2018-07-08 22:42 - 000000000 ____D C:\Program Files\Malwarebytes
2018-07-08 22:41 - 2018-07-08 22:41 - 000000000 ____D C:\ProgramData\MB2Migration
2018-07-08 22:11 - 2018-07-08 22:12 - 073185120 _____ (Malwarebytes ) C:\Users\ryadh\Downloads\mb3-setup-consumer-3.5.1.2522-1.0.374-1.0.5819.exe
2018-07-08 22:09 - 2018-07-08 22:09 - 000516283 _____ C:\Users\ryadh\Downloads\cintrepair.zip
2018-07-08 22:07 - 2018-07-08 22:07 - 002038755 _____ C:\Users\ryadh\Downloads\zoek.exe
2018-07-08 21:52 - 2018-07-14 20:24 - 000004264 _____ C:\WINDOWS\System32\Tasks\Avast Emergency Update
2018-07-08 21:40 - 2018-07-08 21:44 - 000000000 ____D C:\AdwCleaner
2018-07-08 21:40 - 2018-07-08 21:40 - 007402192 _____ (Malwarebytes) C:\Users\ryadh\Downloads\adwcleaner_7.2.1.exe
2018-07-08 21:22 - 2018-07-08 21:23 - 007674244 _____ C:\Users\ryadh\Downloads\com-mod-pdf-converter-pdf-editor-v3-9-paid.30.apk
2018-07-07 02:04 - 2018-07-17 21:38 - 000004184 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{DE765ED8-87C6-44A7-A749-7EB05407EC32}
2018-07-06 00:57 - 2018-07-06 00:57 - 001028418 _____ C:\Users\ryadh\Downloads\cir080 (2).pdf
2018-07-06 00:56 - 2018-07-06 00:56 - 000338665 _____ C:\Users\ryadh\Downloads\cir763.pdf
2018-07-06 00:54 - 2018-07-06 00:54 - 001028418 _____ C:\Users\ryadh\Downloads\cir080 (1).pdf
2018-07-06 00:53 - 2018-07-06 00:53 - 001028418 _____ C:\Users\ryadh\Downloads\cir080.pdf
2018-07-06 00:51 - 2018-07-06 00:51 - 001230131 _____ C:\Users\ryadh\Downloads\guidepourlamiseenplacedeprocduresdepriseencharge.pdf
2018-07-05 23:58 - 2018-07-05 23:59 - 001130840 _____ (Google Inc.) C:\Users\ryadh\Downloads\ChromeSetup.exe
2018-07-05 23:57 - 2018-07-17 20:46 - 000000000 ____D C:\Users\ryadh\AppData\Local\CrashDumps
2018-07-03 22:12 - 2018-07-03 22:12 - 010220407 _____ C:\Users\ryadh\Downloads\com.pdfbuddies.pdfutilspro.57.apk
2018-07-03 22:01 - 2018-07-03 22:01 - 018828876 _____ C:\Users\ryadh\Downloads\PDF Converter_v1.0.18_apkpure.com.apk
2018-07-03 20:55 - 2018-07-03 20:56 - 014695053 _____ C:\Users\ryadh\Downloads\com.google.android.keep_5.0.251.04.70-182510470_minAPI21(x86)(nodpi)_apkmirror.com.apk
2018-07-01 17:40 - 2018-07-01 17:39 - 001027728 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSnx.sys
2018-07-01 17:40 - 2018-07-01 17:39 - 000647488 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswNetSec.sys
2018-07-01 17:40 - 2018-07-01 17:39 - 000463080 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys
2018-07-01 17:40 - 2018-07-01 17:39 - 000381584 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswVmm.sys
2018-07-01 17:40 - 2018-07-01 17:39 - 000378072 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2018-07-01 17:40 - 2018-07-01 17:39 - 000346664 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswbloga.sys
2018-07-01 17:40 - 2018-07-01 17:39 - 000229392 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswbidsdrivera.sys
2018-07-01 17:40 - 2018-07-01 17:39 - 000211160 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswStm.sys
2018-07-01 17:40 - 2018-07-01 17:39 - 000201328 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswbidsha.sys
2018-07-01 17:40 - 2018-07-01 17:39 - 000197160 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswArPot.sys
2018-07-01 17:40 - 2018-07-01 17:39 - 000159640 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys
2018-07-01 17:40 - 2018-07-01 17:39 - 000111872 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys
2018-07-01 17:40 - 2018-07-01 17:39 - 000085968 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRvrt.sys
2018-07-01 17:40 - 2018-07-01 17:39 - 000059592 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswbuniva.sys
2018-07-01 17:40 - 2018-07-01 17:39 - 000046976 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswHwid.sys
2018-07-01 17:40 - 2018-07-01 17:39 - 000015360 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswElam.sys
2018-07-01 16:27 - 2018-07-01 16:27 - 000000000 ____D C:\Users\ryadh\AppData\Roaming\BluestacksCN
2018-07-01 16:14 - 2018-07-01 16:14 - 000002243 _____ C:\Users\ryadh\Desktop\Ladybug.lnk
2018-07-01 15:42 - 2018-07-01 17:24 - 000002610 _____ C:\WINDOWS\System32\Tasks\BlueStacksHelper
2018-07-01 15:37 - 2018-07-01 15:37 - 000001523 _____ C:\Users\Public\Desktop\BlueStacks.lnk
2018-07-01 15:35 - 2018-07-01 15:37 - 000000000 ____D C:\ProgramData\BlueStacks
2018-07-01 15:35 - 2018-07-01 15:37 - 000000000 ____D C:\Program Files (x86)\BlueStacks
2018-07-01 14:47 - 2018-07-01 14:57 - 435618504 _____ (BlueStack Systems Inc.) C:\Users\RANA\Downloads\BlueStacks-Installer_BS3_native_cfa8eccf7fc5854234daf7782c26b77c.exe
2018-07-01 14:43 - 2018-07-01 14:43 - 000001576 _____ C:\Users\RANA\Desktop\Miracolous Lady Bug Dominoes.lnk
2018-07-01 12:27 - 2018-07-01 12:27 - 000000000 ____D C:\Users\RANA\AppData\Local\AVAST Software
2018-06-28 00:43 - 2018-06-28 00:43 - 001835983 _____ C:\Users\ryadh\Documents\Anémies mégaloblastiques macrocytaires - Hématologie et oncologie - Édition professionnelle du Manuel MSD.pdf
2018-06-28 00:38 - 2018-06-28 00:38 - 000164906 _____ C:\Users\ryadh\Downloads\leconimprim.pdf
2018-06-28 00:36 - 2018-06-28 00:36 - 000093673 _____ C:\Users\ryadh\Downloads\25-anemie-macrocytaire.pdf
2018-06-28 00:32 - 2018-06-28 00:32 - 000180601 _____ C:\Users\ryadh\Downloads\cours (7).pdf
2018-06-28 00:32 - 2018-06-28 00:32 - 000180601 _____ C:\Users\ryadh\Downloads\cours (6).pdf
2018-06-28 00:31 - 2018-06-28 00:31 - 000180601 _____ C:\Users\ryadh\Downloads\cours (5).pdf
2018-06-26 21:39 - 2018-06-26 21:39 - 003304593 _____ C:\Users\ryadh\Downloads\com.google.android.apps.adm_2.2.009-20000096_minAPI14(nodpi)_apkmirror.com.apk
2018-06-26 18:41 - 2018-06-26 18:41 - 000000000 ____D C:\Users\ryadh\AppData\Roaming\MobileBackupForeverIni
2018-06-23 23:55 - 2018-07-01 00:12 - 000003400 _____ C:\WINDOWS\System32\Tasks\Opera scheduled Autoupdate 1482436736
2018-06-23 23:55 - 2018-06-23 23:55 - 000001208 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Navigateur Opera.lnk
2018-06-23 09:26 - 2018-06-23 09:27 - 095532994 _____ C:\Users\ryadh\Downloads\10000000_264023624160653_2330693208952012800_n.mp4
2018-06-20 23:26 - 2018-06-20 23:26 - 000000000 ____H C:\Users\ryadh\AppData\Local\BIT4C76.tmp
2018-06-20 23:26 - 2018-06-20 23:26 - 000000000 ____H C:\Users\ryadh\AppData\Local\BIT49A6.tmp
2018-06-20 23:26 - 2018-06-20 23:26 - 000000000 _____ C:\Users\ryadh\AppData\Local\{B403ECF8-4784-4C42-B492-642B01932822}
2018-06-20 23:26 - 2018-06-20 23:26 - 000000000 _____ C:\Users\ryadh\AppData\Local\{90250354-75FE-406A-8F4D-98F90C7EA082}
2018-06-20 23:25 - 2018-06-20 23:25 - 000000000 ____H C:\Users\ryadh\AppData\Local\BITE134.tmp
2018-06-20 23:23 - 2018-06-20 23:25 - 000000000 _____ C:\Users\ryadh\AppData\Local\{BD2E2C39-9D5A-4FEC-BD02-8DD651A91454}
2018-06-20 22:54 - 2018-06-20 22:54 - 000004222 _____ C:\Users\ryadh\Downloads\ensignia (20).html
2018-06-20 22:53 - 2018-06-20 22:53 - 000004222 _____ C:\Users\ryadh\Downloads\ensignia (19).html
2018-06-20 21:52 - 2018-06-20 21:52 - 000004222 _____ C:\Users\ryadh\Downloads\ensignia (18).html
2018-06-19 23:42 - 2018-06-19 23:42 - 000004222 _____ C:\Users\ryadh\Downloads\ensignia (17).html
2018-06-19 23:39 - 2018-06-19 23:39 - 000004222 _____ C:\Users\ryadh\Downloads\ensignia (16).html
2018-06-19 21:27 - 2018-06-06 00:24 - 000835056 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2018-06-19 21:27 - 2018-06-06 00:24 - 000179704 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2018-06-18 21:20 - 2018-06-18 21:20 - 000004222 _____ C:\Users\ryadh\Downloads\ensignia (15).html
2018-06-18 18:49 - 2018-06-18 18:49 - 000004222 _____ C:\Users\ryadh\Downloads\ensignia (14).html
2018-06-17 09:52 - 2018-06-17 09:52 - 000464633 _____ C:\Users\ryadh\Documents\بالوثائق_ كل المعطيات المتعلقة بالجمعيات الدينية والخيرية والمتعددة الاختصاصات في تونس _ حقائق اون لاين Hakaekonline.pdf
==================== Un mois - Modifiés - fichiers et dossiers ========
(Si un élément est inclus dans le fichier fixlist.txt, le fichier/dossier sera déplacé.)
2018-07-17 20:43 - 2016-01-25 10:31 - 000000000 ____D C:\Users\ryadh\AppData\Roaming\vlc
2018-07-16 00:27 - 2018-01-30 10:54 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2018-07-15 14:36 - 2018-05-06 11:55 - 000000000 ____D C:\Users\ryadh\AppData\Roaming\Nero
2018-07-14 20:25 - 2018-01-30 10:59 - 000000000 ____D C:\Users\RANA
2018-07-11 23:59 - 2018-01-30 11:19 - 002597970 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2018-07-11 23:59 - 2017-09-30 15:39 - 001227476 _____ C:\WINDOWS\system32\perfh00C.dat
2018-07-11 23:59 - 2017-09-30 15:39 - 000272382 _____ C:\WINDOWS\system32\perfc00C.dat
2018-07-11 23:52 - 2018-01-30 10:59 - 000000000 ____D C:\Users\ryadh
2018-07-11 23:50 - 2018-01-30 11:25 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2018-07-11 23:50 - 2016-09-24 04:23 - 000000000 ____D C:\ProgramData\NVIDIA
2018-07-11 19:41 - 2017-09-29 14:44 - 000000000 ____D C:\WINDOWS\INF
2018-07-11 02:03 - 2017-03-21 18:18 - 000000000 ____D C:\Users\ryadh\Desktop\APPLICATION UTILES
2018-07-11 02:03 - 2016-01-24 20:05 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpico
2018-07-10 23:19 - 2018-04-25 20:31 - 000000517 _____ C:\WINDOWS\system32\Drivers\etc\hosts.ics
2018-07-10 22:26 - 2018-01-31 21:00 - 000000000 ____D C:\WINDOWS\Minidump
2018-07-10 22:26 - 2018-01-10 21:25 - 000000000 ___DC C:\WINDOWS\Panther
2018-07-10 22:26 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2018-07-10 22:26 - 2016-02-07 12:07 - 000000000 ____D C:\Users\ryadh\AppData\Roaming\HpUpdate
2018-07-10 22:24 - 2018-04-12 18:25 - 000000000 ___HD C:\$WINDOWS.~BT
2018-07-10 22:24 - 2016-02-19 22:07 - 000000000 ____D C:\Users\ryadh\AppData\Local\Microsoft Help
2018-07-10 22:13 - 2018-01-01 19:50 - 000000000 ____D C:\Program Files (x86)\UsbFix
2018-07-10 21:55 - 2016-07-16 12:47 - 000000000 ____D C:\WINDOWS\system32\Tasks_Migrated
2018-07-09 01:25 - 2017-09-29 09:45 - 001572864 _____ C:\WINDOWS\system32\config\BBI
2018-07-09 01:22 - 2017-09-07 22:04 - 000000000 _____ C:\WINDOWS\SysWOW64\last.dump
2018-07-09 01:12 - 2016-04-29 22:00 - 000000000 ____D C:\Program Files (x86)\Globalnet Connection Manager
2018-07-08 22:42 - 2016-04-09 18:57 - 000000000 ____D C:\ProgramData\Malwarebytes
2018-07-08 21:58 - 2018-06-13 00:22 - 000000000 ____D C:\Users\ryadh\AppData\Local\AVAST Software
2018-07-08 21:46 - 2016-03-28 21:38 - 000000000 ____D C:\ProgramData\IObit
2018-07-08 21:44 - 2016-08-15 15:51 - 000000000 ____D C:\Users\RANA\AppData\LocalLow\IObit
2018-07-08 21:44 - 2016-08-15 15:48 - 000000000 ____D C:\Users\RANA\AppData\Roaming\IObit
2018-07-08 21:44 - 2016-03-28 21:39 - 000000000 ____D C:\Users\ryadh\AppData\Roaming\IObit
2018-07-08 21:44 - 2016-03-28 21:39 - 000000000 ____D C:\Users\ryadh\AppData\LocalLow\IObit
2018-07-07 02:36 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\NDF
2018-07-07 02:34 - 2016-01-27 19:57 - 000000000 ____D C:\Users\ryadh\AppData\Local\ElevatedDiagnostics
2018-07-06 02:21 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\DeliveryOptimization
2018-07-01 17:40 - 2017-09-29 14:46 - 000000000 ___HD C:\WINDOWS\ELAMBKUP
2018-07-01 15:37 - 2016-10-05 22:28 - 000001523 _____ C:\ProgramData\Microsoft\Windows\Start Menu\BlueStacks.lnk
2018-07-01 15:37 - 2016-03-17 00:43 - 000000000 ____D C:\ProgramData\BlueStacksSetup
2018-07-01 15:36 - 2016-06-26 10:51 - 000000000 ____D C:\Users\ryadh\AppData\Local\Bluestacks
2018-07-01 13:54 - 2017-09-29 14:46 - 000000000 ___HD C:\Program Files\WindowsApps
2018-07-01 13:54 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\AppReadiness
2018-07-01 12:59 - 2018-01-30 11:00 - 000000000 ____D C:\Users\RANA\AppData\Local\Packages
2018-07-01 12:58 - 2018-01-30 17:06 - 000000000 ____D C:\Users\RANA\AppData\Local\PlaceholderTileLogoFolder
2018-07-01 12:28 - 2016-01-24 19:55 - 000000000 __RHD C:\Users\Public\AccountPictures
2018-07-01 12:27 - 2018-01-30 16:55 - 000000000 ___RD C:\Users\RANA\3D Objects
2018-07-01 00:12 - 2016-12-22 20:55 - 000000000 ____D C:\Program Files (x86)\Opera
2018-06-28 01:39 - 2016-03-28 21:43 - 000000000 ____D C:\ProgramData\ProductData
2018-06-26 23:42 - 2018-01-17 18:18 - 000002260 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2018-06-26 23:42 - 2016-04-09 19:57 - 000002301 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2018-06-26 19:40 - 2017-12-10 15:57 - 000000000 ____D C:\Users\ryadh\AppData\Roaming\WhatsApp
2018-06-26 18:35 - 2016-05-10 01:07 - 000000000 ____D C:\Users\ryadh\AppData\Roaming\Wondershare
2018-06-26 18:35 - 2016-05-10 01:07 - 000000000 ____D C:\Users\ryadh\AppData\Local\Wondershare
2018-06-26 18:35 - 2016-05-10 01:07 - 000000000 ____D C:\ProgramData\Wondershare
2018-06-25 23:30 - 2016-03-06 23:26 - 000000000 ____D C:\Users\ryadh\Desktop\RANA
2018-06-21 23:56 - 2017-09-29 14:46 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2018-06-21 23:52 - 2016-01-24 21:21 - 000000000 ____D C:\Program Files (x86)\Microsoft Office
2018-06-19 21:27 - 2017-09-29 14:37 - 000000000 ____D C:\WINDOWS\CbsTemp
2018-06-19 15:41 - 2018-01-30 11:01 - 000000000 ____D C:\Users\ryadh\AppData\Local\Packages
==================== Fichiers à la racine de certains dossiers =======
2018-06-20 23:26 - 2018-06-20 23:26 - 000000000 ____H () C:\Users\ryadh\AppData\Local\BIT49A6.tmp
2018-06-20 23:26 - 2018-06-20 23:26 - 000000000 ____H () C:\Users\ryadh\AppData\Local\BIT4C76.tmp
2018-06-20 23:25 - 2018-06-20 23:25 - 000000000 ____H () C:\Users\ryadh\AppData\Local\BITE134.tmp
2016-04-09 19:50 - 2016-04-09 20:10 - 000007617 _____ () C:\Users\ryadh\AppData\Local\Resmon.ResmonCfg
2017-06-04 23:51 - 2017-06-04 23:51 - 000000000 _____ () C:\Users\ryadh\AppData\Local\{4B8C4457-4197-4CA5-B94D-DE6EDC9C8CCC}
2018-06-20 23:26 - 2018-06-20 23:26 - 000000000 _____ () C:\Users\ryadh\AppData\Local\{90250354-75FE-406A-8F4D-98F90C7EA082}
2018-06-20 23:26 - 2018-06-20 23:26 - 000000000 _____ () C:\Users\ryadh\AppData\Local\{B403ECF8-4784-4C42-B492-642B01932822}
2018-06-20 23:23 - 2018-06-20 23:25 - 000000000 _____ () C:\Users\ryadh\AppData\Local\{BD2E2C39-9D5A-4FEC-BD02-8DD651A91454}
2018-04-01 09:59 - 2018-04-01 09:59 - 000000000 _____ () C:\Users\ryadh\AppData\Local\{DCEC3B32-8A84-4C47-9107-A6536C2179E9}
2017-05-12 21:01 - 2017-05-12 21:01 - 000000000 _____ () C:\Users\ryadh\AppData\Local\{E004665E-D294-4076-9ACA-320A48DDE836}
Certains fichiers dans TEMP:
====================
2018-03-18 14:32 - 2018-03-18 14:32 - 001857024 _____ (Opera Software) C:\Users\RANA\AppData\Local\Temp\Opera_installer_180318133222451.dll
2018-03-18 14:32 - 2018-03-18 14:32 - 001857024 _____ (Opera Software) C:\Users\RANA\AppData\Local\Temp\Opera_installer_180318133223483.dll
2018-03-23 19:22 - 2018-03-23 19:22 - 001857024 _____ (Opera Software) C:\Users\RANA\AppData\Local\Temp\Opera_installer_180323182258288.dll
2018-04-01 15:01 - 2018-04-01 15:01 - 001857024 _____ (Opera Software) C:\Users\RANA\AppData\Local\Temp\Opera_installer_180401140104406.dll
2018-07-15 14:48 - 2013-08-27 02:55 - 001042512 ____N (CANON INC.) C:\Users\ryadh\AppData\Local\Temp\MSETUP4.EXE
==================== Bamital & volsnap ======================
(Il n'y a pas de correction automatique pour les fichiers qui ne satisfont pas à la vérification.)
C:\WINDOWS\system32\winlogon.exe => Le fichier est signé numériquement
C:\WINDOWS\system32\wininit.exe => Le fichier est signé numériquement
C:\WINDOWS\explorer.exe => Le fichier est signé numériquement
C:\WINDOWS\SysWOW64\explorer.exe => Le fichier est signé numériquement
C:\WINDOWS\system32\svchost.exe => Le fichier est signé numériquement
C:\WINDOWS\SysWOW64\svchost.exe => Le fichier est signé numériquement
C:\WINDOWS\system32\services.exe => Le fichier est signé numériquement
C:\WINDOWS\system32\User32.dll => Le fichier est signé numériquement
C:\WINDOWS\SysWOW64\User32.dll => Le fichier est signé numériquement
C:\WINDOWS\system32\userinit.exe => Le fichier est signé numériquement
C:\WINDOWS\SysWOW64\userinit.exe => Le fichier est signé numériquement
C:\WINDOWS\system32\rpcss.dll => Le fichier est signé numériquement
C:\WINDOWS\system32\dnsapi.dll => Le fichier est signé numériquement
C:\WINDOWS\SysWOW64\dnsapi.dll => Le fichier est signé numériquement
C:\WINDOWS\system32\Drivers\volsnap.sys => Le fichier est signé numériquement
LastRegBack: 2018-02-19 23:27
==================== Fin de FRST.txt ============================
Exécuté par Dr Riadh ESSEFI (administrateur) sur DRESSEFI (17-07-2018 21:41:40)
Exécuté depuis C:\Users\ryadh\Desktop
Profils chargés: Dr Riadh ESSEFI & RANA (Profils disponibles: Dr Riadh ESSEFI & RANA)
Platform: Windows 10 Pro Version 1709 16299.431 (X64) Langue: Français (France)
Internet Explorer Version 11 (Navigateur par défaut: Edge)
Mode d'amorçage: Normal
Tutoriel pour Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processus (Avec liste blanche) =================
(Si un élément est inclus dans le fichier fixlist.txt, le processus sera arrêté. Le fichier ne sera pas déplacé.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe
(Dropbox, Inc.) C:\Windows\System32\DbxSvc.exe
(arvato digital services llc) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(CHENGDU YIWO Tech Development Co., Ltd) C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe
(McAfee, LLC.) C:\Program Files\TrueKey\McTkSchedulerService.exe
(DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe
(AVAST Software) C:\Program Files (x86)\AVAST Software\Avast Cleanup\TuneupSvc.exe
(Wondershare) C:\Program Files (x86)\Wondershare\WAF\2.4.3.236\WsAppService.exe
(McAfee, LLC.) C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
() C:\Program Files (x86)\EaseUS\Todo Backup\bin\TodoBackupService.exe
(Microsoft Corporation) C:\Windows\System32\vds.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Update\1.4.141.333\AvastBrowserCrashHandler.exe
(AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Update\1.4.141.333\AvastBrowserCrashHandler64.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1815.209.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\PeopleExperienceHost.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(AVAST Software) C:\Program Files (x86)\AVAST Software\Avast Cleanup\TuneupUI.exe
(Microsoft Corporation) C:\Windows\System32\SppExtComObj.Exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsStore_11805.1001.42.0_x64__8wekyb3d8bbwe\WinStore.App.exe
() C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.18052.11111.0_x64__8wekyb3d8bbwe\Music.UI.exe
(AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe
(AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Opera Software) C:\Program Files (x86)\Opera\53.0.2907.99\opera_autoupdate.exe
(Opera Software) C:\Program Files (x86)\Opera\53.0.2907.99\opera_autoupdate.exe
(Microsoft Corporation) C:\Windows\System32\SnippingTool.exe
==================== Registre (Avec liste blanche) ===========================
(Si un élément est inclus dans le fichier fixlist.txt, l'élément de Registre sera restauré à la valeur par défaut ou supprimé. Le fichier ne sera pas déplacé.)
HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [630168 2017-09-29] (Microsoft Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [1802424 2015-11-19] (NVIDIA Corporation)
HKLM\...\Run: [USB Safely Remove] => C:\Program Files (x86)\USB Safely Remove\USBSafelyRemove.exe [6519064 2016-10-16] (Crystal Rich Ltd)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [242904 2018-07-01] (AVAST Software)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [3242696 2015-10-07] (ELAN Microelectronics Corp.)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [3567928 2017-12-05] (Dropbox, Inc.)
HKLM-x32\...\Run: [VeriFaceManager] => C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe [3122528 2016-01-25] (Lenovo)
HKLM-x32\...\Run: [jswtrayutil] => C:\Program Files (x86)\Jumpstart\jswtrayutil.exe [528384 2008-09-26] (Atheros Communications, Inc.)
HKLM-x32\...\Run: [HPUsageTrackingLEDM] => "C:\Program Files (x86)\HP\HP UT LEDM\bin\hppusg.exe" "C:\Program Files (x86)\HP\HP UT LEDM\"
HKLM-x32\...\Run: [MagicPlusHelper] => C:\Program Files (x86)\MagicPlus\MagicPlus_helper.exe [2499208 2016-06-02] (Lenovo)
HKLM-x32\...\Run: [331BigDog] => C:\Program Files (x86)\USB Camera\VM331_STI.EXE [536576 2010-06-18] (Vimicro)
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
HKU\S-1-5-21-3434288234-2416881581-2136330683-1001\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [25638872 2018-04-23] (Google)
HKU\S-1-5-21-3434288234-2416881581-2136330683-1001\...\Run: [VideoDownloaderUltimate] => C:\ProgramData\VideoDownloaderUltimateWinApp\VideoDownloaderUltimate.exe [2615112 2016-09-23] (Link64 GmbH)
HKU\S-1-5-21-3434288234-2416881581-2136330683-1001\...\Run: [GoogleChromeAutoLaunch_454AC088E6840E6E5730B972F2F7217D] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [1588568 2018-06-22] (Google Inc.)
HKU\S-1-5-21-3434288234-2416881581-2136330683-1001\...\Run: [EPLTarget\P0000000000000000] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATII2E.EXE [283232 2015-01-14] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-3434288234-2416881581-2136330683-1001\...\Run: [EPLTarget\P0000000000000001] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATII2E.EXE [283232 2015-01-14] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-3434288234-2416881581-2136330683-1001\...\Run: [AvastBrowserAutoLaunch_2817B93609718EE76F7F81E0EC60E921] => C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe [1808264 2018-06-12] (AVAST Software)
HKU\S-1-5-21-3434288234-2416881581-2136330683-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-3434288234-2416881581-2136330683-1001\...\MountPoints2: {e68189e6-73e2-11e7-926c-70f3954d11e0} - "G:\Lenovo_Suite.exe"
HKU\S-1-5-21-3434288234-2416881581-2136330683-1005\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [25638872 2018-04-23] (Google)
HKU\S-1-5-21-3434288234-2416881581-2136330683-1005\...\Run: [VideoDownloaderUltimate] => C:\ProgramData\VideoDownloaderUltimateWinApp\VideoDownloaderUltimate.exe [2615112 2016-09-23] (Link64 GmbH)
HKU\S-1-5-21-3434288234-2416881581-2136330683-1005\...\Run: [GoogleChromeAutoLaunch_454AC088E6840E6E5730B972F2F7217D] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [1588568 2018-06-22] (Google Inc.)
HKU\S-1-5-21-3434288234-2416881581-2136330683-1005\...\Run: [EPLTarget\P0000000000000000] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATII2E.EXE [283232 2015-01-14] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-3434288234-2416881581-2136330683-1005\...\Run: [EPLTarget\P0000000000000001] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATII2E.EXE [283232 2015-01-14] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-3434288234-2416881581-2136330683-1005\...\Run: [AvastBrowserAutoLaunch_691D61FF1CE29C8BE2888E4A552A5ECD] => C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe [1808264 2018-06-12] (AVAST Software)
HKU\S-1-5-21-3434288234-2416881581-2136330683-1005\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
IFEO\appvlp.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\excel.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\groove.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\lync.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\msaccess.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\msoev.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\msotd.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\msoxmled.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\mspub.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\mysql.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\nvstview.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\ocpubmgr.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\onenote.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\onenotem.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\outlook.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\powerpnt.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\setlang.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\shareit.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\uninstall.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
IFEO\winword.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
Lsa: [Notification Packages] scecli C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter "C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter"
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Avast Cleanup Premium.lnk [2017-11-21]
ShortcutTarget: Avast Cleanup Premium.lnk -> C:\Program Files (x86)\AVAST Software\Avast Cleanup\TuneupUI.exe (AVAST Software)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\BackupRemind.lnk [2017-03-07]
ShortcutTarget: BackupRemind.lnk -> C:\Program Files (x86)\Wondershare\Wondershare Dr.Fone for Android (CPC)\Addins\AndroidBackupRestore\BackupRemind.exe (Wondershare)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2017-12-02]
Startup: C:\Users\ryadh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Envoyer à OneNote.lnk [2018-02-28]
ShortcutTarget: Envoyer à OneNote.lnk -> C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE (Microsoft Corporation)
==================== Internet (Avec liste blanche) ====================
(Si un élément est inclus dans le fichier fixlist.txt, s'il s'agit d'un élément du Registre, il sera supprimé ou restauré à la valeur par défaut.)
HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings: [ProxySettingsPerUser] 0 <==== ATTENTION (Restriction - ProxySettings)
ProxyEnable: [HKLM] => Proxy est activé.
ProxyEnable: [HKLM-x32] => Proxy est activé.
ProxyServer: [HKLM] => http=127.0.0.1:8080;https=127.0.0.1:8080
ProxyServer: [HKLM-x32] => http=127.0.0.1:8080;https=127.0.0.1:8080
AutoConfigURL: [HKLM] => http=127.0.0.1:8080;https=127.0.0.1:8080
ProxyEnable: [.DEFAULT] => Proxy est activé.
ProxyServer: [.DEFAULT] => http=127.0.0.1:8080;https=127.0.0.1:8080
ProxyServer: [S-1-5-21-3434288234-2416881581-2136330683-1001] => http=127.0.0.1:8080;https=127.0.0.1:8080
ProxyServer: [S-1-5-21-3434288234-2416881581-2136330683-1005] => 172.21.192.4:3128
Tcpip\Parameters: [DhcpNameServer] 8.8.8.8 41.226.16.50
Tcpip\..\Interfaces\{2cd0401a-752d-4c7a-b86d-e1851879ed5e}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{a78e8345-c89e-4fae-bbec-4b57ea89caf7}: [DhcpNameServer] 8.8.8.8 41.226.16.50
Tcpip\..\Interfaces\{aab33f2a-9e36-4d7b-b17d-617ee373a65c}: [NameServer] 193.95.84.13,193.95.84.12
Tcpip\..\Interfaces\{dace1555-aca4-4e2c-88eb-3634fd06b7f8}: [DhcpNameServer] 192.168.42.129
ManualProxies: 1http=127.0.0.1:8080;https=127.0.0.1:8080
Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2018-06-21] (Microsoft Corporation)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2018-05-05] (Microsoft Corporation)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-05-30] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-05-30] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-05-30] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-05-30] (Microsoft Corporation)
Edge:
======
Edge Extension: (Pas de nom) -> EdgeExtension_MicrosoftOneNoteWebClipper_8wekyb3d8bbwe => C:\Program Files\WindowsApps\Microsoft.OneNoteWebClipper_3.8.0.0_neutral__8wekyb3d8bbwe [2018-06-21]
Edge Extension: (Translator For Microsoft Edge) -> MicrosoftTranslate_MicrosoftTranslatorforMicrosoftEdge_8wekyb3d8bbwe => C:\Program Files\WindowsApps\Microsoft.TranslatorforMicrosoftEdge_0.91.47.0_neutral__8wekyb3d8bbwe [2018-06-13]
FireFox:
========
FF DefaultProfile: u2wsyugm.default
FF DefaultProfile: drriyadhessefi1@gmail.com
FF ProfilePath: C:\Users\ryadh\AppData\Roaming\Mozilla\Firefox\Profiles\u2wsyugm.default [2018-07-01]
FF user.js: detected! => C:\Users\ryadh\AppData\Roaming\Mozilla\Firefox\Profiles\u2wsyugm.default\user.js [2017-10-02]
FF Extension: (Dashlane) - C:\Users\ryadh\AppData\Roaming\Mozilla\Firefox\Profiles\u2wsyugm.default\Extensions\jetpack-extension@dashlane.com.xpi [2018-03-01]
FF Extension: (Avast SafePrice) - C:\Users\ryadh\AppData\Roaming\Mozilla\Firefox\Profiles\u2wsyugm.default\Extensions\sp@avast.com.xpi [2018-03-01]
FF Extension: (Avast Online Security) - C:\Users\ryadh\AppData\Roaming\Mozilla\Firefox\Profiles\u2wsyugm.default\Extensions\wrc@avast.com.xpi [2018-07-01]
FF Extension: (Yamli for Firefox) - C:\Users\ryadh\AppData\Roaming\Mozilla\Firefox\Profiles\u2wsyugm.default\Extensions\yamlitoolbar@yamli.com.xpi [2016-12-08] [Legacy]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_27_0_0_187.dll [2017-12-02] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_27_0_0_187.dll [2017-12-02] ()
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2015-10-13] (Google, Inc.)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2018-03-30] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2018-03-17] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2016-11-14] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2016-11-14] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-19] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-19] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2018-02-22] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3434288234-2416881581-2136330683-1001: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 -> C:\Users\ryadh\AppData\Roaming\Visan\plugins\npRLSecurePluginLayer.dll [2011-05-13] (RocketLife, LLP)
Chrome:
=======
CHR HomePage: Default -> hxxps://www.facebook.com/
CHR StartupUrls: Default -> " hxxp://en.hao123.com/?tn=spark_inner_hp_01_hao123_gl&guid=f08fde911f9409b6313d30846fe22d55","hxxps://www.google.com/"
CHR Session Restore: Default -> est activé.
CHR Profile: C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default [2018-07-14]
CHR Extension: (Slides) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-10-18]
CHR Extension: (Torch - On Fire) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\akjpgliecbkphdlkdefgalgdlcmdfhip [2016-04-10]
CHR Extension: (Docs) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-18]
CHR Extension: (Google Drive) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-04-09]
CHR Extension: (YouTube) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-04-09]
CHR Extension: (Search by Image (by Google)) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\dajedkncpodkggklbegccjpmnglmnflm [2017-06-17]
CHR Extension: (Dropbox pour Gmail) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\dpdmhfocilnekecfjgimjdeckachfbec [2018-05-28]
CHR Extension: (Adobe Acrobat) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2017-03-14]
CHR Extension: (Video Downloader professional) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\elicpjhcidhpjomhibiffojpinpmmpil [2018-05-28]
CHR Extension: (Avast SafePrice) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2018-05-28]
CHR Extension: (Dashlane) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdjamakpfbbddfjaooikfcpapjohcfmg [2018-05-28]
CHR Extension: (Trevx - Music Downloader) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\fpmaepaboafhefdejcbiciklgjogoghf [2016-04-11]
CHR Extension: (Bureau à distance Google Chrome) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbchcmhmhahfdphkhkmpfmihenigjmpp [2018-01-07]
CHR Extension: (Google Docs hors connexion) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-04-09]
CHR Extension: (Guardio for Chrome) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjfpmkejnolcfklaaddjnckanhhgegla [2018-05-27]
CHR Extension: (Avast Online Security) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2018-05-28]
CHR Extension: (SoundCloud) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\ipebkipbeggmmkjjljenoblnfaenambp [2016-04-11]
CHR Extension: (Yamli) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\jhninijcbcniklnjbohdmoglogfjbglh [2016-04-10]
CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2016-04-09]
CHR Extension: (Paiements via le Chrome Web Store) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-04-10]
CHR Extension: (Gmail) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-04-09]
CHR Extension: (Chrome Media Router) - C:\Users\ryadh\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-05-28]
CHR HKU\S-1-5-21-3434288234-2416881581-2136330683-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx
Opera:
=======
OPR Extension: (Arabic Keyboard) - C:\Users\ryadh\AppData\Roaming\Opera Software\Opera Stable\Extensions\hlkecjkkdnolnelaaacobmbjbecanpkp [2016-12-23]
OPR Extension: (Download YouTube Videos as MP4) - C:\Users\ryadh\AppData\Roaming\Opera Software\Opera Stable\Extensions\maeombkgfpjdnjkhohbjachnnmpbipol [2017-02-15]
OPR Extension: (SaveFrom.net Helper) - C:\Users\ryadh\AppData\Roaming\Opera Software\Opera Stable\Extensions\npdpplbicnmpoigidfdjadamgfkilaak [2018-06-28]
==================== Services (Avec liste blanche) ====================
(Si un élément est inclus dans le fichier fixlist.txt, il sera supprimé du Registre. Le fichier ne sera pas déplacé, sauf s'il est inscrit séparément.)
R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe [7780400 2018-07-01] (AVAST Software)
S2 avast; C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [164984 2018-06-13] (AVAST Software)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [322464 2018-07-01] (AVAST Software)
R2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [435248 2018-07-01] (AVAST Software)
S3 avastm; C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [164984 2018-06-13] (AVAST Software)
R2 CleanupPSvc; C:\Program Files (x86)\AVAST Software\Avast Cleanup\TuneupSvc.exe [7650600 2018-02-04] (AVAST Software)
S4 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [8654504 2018-06-12] (Microsoft Corporation)
S4 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-01-26] (Dropbox, Inc.)
S4 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-01-26] (Dropbox, Inc.)
R2 DbxSvc; C:\WINDOWS\system32\DbxSvc.exe [51016 2017-12-05] (Dropbox, Inc.)
R2 EaseUS Agent; C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe [40080 2017-08-30] (CHENGDU YIWO Tech Development Co., Ltd)
R2 EpsonScanSvc; C:\WINDOWS\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation)
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [144072 2015-10-07] (ELAN Microelectronics Corp.)
S2 HP LaserJet Service; C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe [136704 2009-06-24] (HP) [Fichier non signé]
S4 IObitUnSvr; C:\Program Files (x86)\IObit\IObit Uninstaller\IUService.exe [360736 2016-10-28] (IObit)
S4 jswpbapi; C:\Program Files (x86)\Jumpstart\jswpbapi.exe [265216 2008-09-26] (Atheros Communications, Inc.) [Fichier non signé]
S4 jswpsapi; C:\Program Files (x86)\Jumpstart\jswpsapi.exe [954368 2008-09-26] (Atheros Communications, Inc.) [Fichier non signé]
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6541008 2018-05-09] (Malwarebytes)
S4 Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [239184 2014-02-15] ()
S4 MySQL_For_MedinTux; C:\Program Files (x86)\MySQL\MySQL_MedinTux\my.ini [8922 2016-12-27] () [Fichier non signé]
R2 PSI_SVC_2; C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe [277360 2014-04-30] (arvato digital services llc)
S4 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2013-03-01] (Riverbed Technology, Inc.)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [4329952 2017-11-26] (Microsoft Corporation)
R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe [754784 2016-07-22] (DEVGURU Co., LTD.)
R2 TrueKey; C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe [1000824 2018-05-14] (McAfee, LLC.)
R2 TrueKeyScheduler; C:\Program Files\TrueKey\McTkSchedulerService.exe [16928 2018-05-14] (McAfee, LLC.)
S4 TrueKeyServiceHelper; C:\Program Files\TrueKey\McAfee.TrueKey.ServiceHelper.exe [87760 2018-05-14] (McAfee, Inc.)
S4 USBSafelyRemoveService; C:\Program Files (x86)\USB Safely Remove\USBSRService.exe [1705752 2016-10-16] (Crystal Rich Ltd)
S4 uSHAREitSvc; C:\Program Files (x86)\SHAREit Technologies\SHAREit\SHAREit.Service.exe [33224 2017-09-11] (SHAREit Technologies Co.Ltd)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [355304 2017-09-29] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [105944 2017-09-29] (Microsoft Corporation)
R2 WsAppService; C:\Program Files (x86)\Wondershare\WAF\2.4.3.236\WsAppService.exe [495840 2018-01-26] (Wondershare)
S4 WsDrvInst; C:\Program Files (x86)\Wondershare\drfone\Library\DriverInstaller\DriverInstall.exe [120096 2018-01-16] (Wondershare)
===================== Pilotes (Avec liste blanche) ======================
(Si un élément est inclus dans le fichier fixlist.txt, il sera supprimé du Registre. Le fichier ne sera pas déplacé, sauf s'il est inscrit séparément.)
R1 aswArPot; C:\WINDOWS\System32\drivers\aswArPot.sys [197160 2018-07-01] (AVAST Software)
R1 aswbidsdriver; C:\WINDOWS\System32\drivers\aswbidsdrivera.sys [229392 2018-07-01] (AVAST Software)
R0 aswbidsh; C:\WINDOWS\System32\drivers\aswbidsha.sys [201328 2018-07-01] (AVAST Software)
R0 aswblog; C:\WINDOWS\System32\drivers\aswbloga.sys [346664 2018-07-01] (AVAST Software)
R0 aswbuniv; C:\WINDOWS\System32\drivers\aswbuniva.sys [59592 2018-07-01] (AVAST Software)
S3 aswElam; C:\WINDOWS\System32\drivers\aswElam.sys [15360 2018-07-01] (AVAST Software)
S3 aswHwid; C:\WINDOWS\System32\drivers\aswHwid.sys [46976 2018-07-01] (AVAST Software)
R2 aswMonFlt; C:\WINDOWS\System32\drivers\aswMonFlt.sys [159640 2018-07-01] (AVAST Software)
R1 aswNetSec; C:\WINDOWS\System32\drivers\aswNetSec.sys [647488 2018-07-01] (AVAST Software)
R1 aswRdr; C:\WINDOWS\System32\drivers\aswRdr2.sys [111872 2018-07-01] (AVAST Software)
R0 aswRvrt; C:\WINDOWS\System32\drivers\aswRvrt.sys [85968 2018-07-01] (AVAST Software)
R1 aswSnx; C:\WINDOWS\System32\drivers\aswSnx.sys [1027728 2018-07-01] (AVAST Software)
R1 aswSP; C:\WINDOWS\System32\drivers\aswSP.sys [463080 2018-07-01] (AVAST Software)
R2 aswStm; C:\WINDOWS\System32\drivers\aswStm.sys [211160 2018-07-01] (AVAST Software)
S3 aswTap; C:\WINDOWS\System32\drivers\aswTap.sys [53904 2017-02-09] (The OpenVPN Project)
R0 aswVmm; C:\WINDOWS\System32\drivers\aswVmm.sys [381584 2018-07-01] (AVAST Software)
S3 BstkDrv; C:\Program Files (x86)\BlueStacks\BstkDrv.sys [269408 2018-06-21] (Bluestack System Inc. )
S3 CH341SER_A64; C:\WINDOWS\System32\Drivers\CH341S64.SYS [58368 2011-11-05] (www.winchiphead.com)
R3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.)
R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [152688 2018-07-11] (Malwarebytes)
R0 EUBKMON; C:\WINDOWS\System32\drivers\EUBKMON.sys [62528 2018-01-03] ()
R1 HWiNFO32; C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [27552 2016-03-29] (REALiX(tm))
R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [191208 2018-07-11] (Malwarebytes)
R3 MBAMFarflt; C:\WINDOWS\System32\DRIVERS\farflt.sys [114920 2018-07-11] (Malwarebytes)
R3 MBAMProtection; C:\WINDOWS\system32\DRIVERS\mbam.sys [48360 2018-07-11] (Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [253664 2018-07-11] (Malwarebytes)
R3 MBAMWebProtection; C:\WINDOWS\system32\DRIVERS\mwac.sys [102632 2018-07-17] (Malwarebytes)
S3 mvusbews; C:\WINDOWS\System32\Drivers\mvusbews.sys [20480 2012-08-21] (Marvell Semiconductor, Inc.) [Fichier non signé]
S3 NPF; C:\WINDOWS\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [604160 2017-09-29] (Realtek )
S3 silabenm; C:\WINDOWS\system32\DRIVERS\silabenm.sys [27336 2011-10-14] (Silicon Laboratories) [Fichier non signé]
R3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [165504 2016-09-05] (Samsung Electronics Co., Ltd.)
S3 usbrndis6; C:\WINDOWS\System32\drivers\usb80236.sys [23040 2017-09-29] (Microsoft Corporation)
R3 vm331avs; C:\WINDOWS\System32\Drivers\vm331avs.sys [215168 2010-06-18] (Vimicro Corporation)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44608 2017-09-29] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [309144 2017-09-29] (Microsoft Corporation)
S3 wdm_usb; C:\WINDOWS\system32\DRIVERS\usb2ser.sys [159936 2016-08-16] (MBB)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [119192 2017-09-29] (Microsoft Corporation)
S3 BstHdDrv; \??\C:\Program Files (x86)\Bluestacks\HD-Hypervisor-amd64.sys [X]
==================== NetSvcs (Avec liste blanche) ===================
(Si un élément est inclus dans le fichier fixlist.txt, il sera supprimé du Registre. Le fichier ne sera pas déplacé, sauf s'il est inscrit séparément.)
==================== Un mois - Créés - fichiers et dossiers ========
(Si un élément est inclus dans le fichier fixlist.txt, le fichier/dossier sera déplacé.)
2018-07-17 21:37 - 2018-07-17 21:37 - 002412544 _____ (Farbar) C:\Users\ryadh\Desktop\FRST64.exe
2018-07-17 21:06 - 2018-07-17 21:06 - 000434095 _____ C:\Users\ryadh\Downloads\cir765 (1).pdf
2018-07-17 21:01 - 2018-07-17 21:01 - 000434095 _____ C:\Users\ryadh\Downloads\cir765.pdf
2018-07-17 20:54 - 2018-07-17 20:54 - 000000000 ____D C:\Users\ryadh\AppData\Local\TempOfficeC2R16BFFBF7-9436-40B5-A45F-FBEEB07C0132
2018-07-17 20:48 - 2018-07-17 20:48 - 000102632 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2018-07-14 23:16 - 2018-07-14 23:16 - 003179936 _____ C:\Users\ryadh\Downloads\cartesanitaire2015ressohum.pdf
2018-07-14 22:11 - 2018-07-14 22:11 - 001858294 _____ C:\Users\ryadh\Downloads\36973101_990852951076518_6813101635187769344_n.mp4
2018-07-14 22:10 - 2018-07-14 22:11 - 006803890 _____ C:\Users\ryadh\Downloads\30618408_2089448101278353_4089361946652164759_n.mp4
2018-07-14 20:42 - 2018-07-17 21:43 - 000031960 _____ C:\Users\ryadh\Desktop\FRST.txt
2018-07-14 20:42 - 2018-07-14 20:42 - 000081222 _____ C:\Users\ryadh\Desktop\Addition.txt
2018-07-14 20:34 - 2018-07-14 20:34 - 002412544 _____ (Farbar) C:\Users\ryadh\Desktop\FRST64 (1).exe
2018-07-11 23:53 - 2018-07-11 23:53 - 000114920 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
2018-07-11 23:53 - 2018-07-11 23:53 - 000048360 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2018-07-11 23:52 - 2018-07-11 23:52 - 000253664 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys
2018-07-11 23:50 - 2018-07-11 23:51 - 000742680 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2018-07-11 05:08 - 2018-07-11 05:08 - 000191208 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamChameleon.sys
2018-07-10 22:18 - 2018-07-10 22:18 - 000027181 _____ C:\Users\ryadh\Desktop\UsbFix_Report.txt
2018-07-10 22:05 - 2018-07-10 22:05 - 000001962 _____ C:\Users\ryadh\Desktop\UsbFix Anti-Malware.lnk
2018-07-09 01:08 - 2018-07-09 01:11 - 000002068 _____ C:\Users\ryadh\Desktop\Rkill.txt
2018-07-09 01:06 - 2018-07-09 01:08 - 000317024 _____ C:\TDSSKiller.3.1.0.17_09.07.2018_01.06.32_log.txt
2018-07-09 01:03 - 2018-07-09 01:03 - 004949824 _____ (AO Kaspersky Lab) C:\Users\ryadh\Downloads\tdsskiller.exe
2018-07-09 01:03 - 2018-07-09 01:03 - 001802704 _____ (Bleeping Computer, LLC) C:\Users\ryadh\Downloads\rkill.exe
2018-07-09 00:57 - 2018-07-17 21:41 - 000000000 ____D C:\FRST
2018-07-09 00:47 - 2018-07-09 00:47 - 005660124 _____ (Swearware) C:\Users\ryadh\Downloads\ComboFix.exe
2018-07-09 00:47 - 2018-07-09 00:47 - 002412544 _____ (Farbar) C:\Users\ryadh\Downloads\FRST64.exe
2018-07-08 23:04 - 2018-07-08 23:04 - 000000002 _____ C:\runcheck.txt
2018-07-08 23:04 - 2018-07-08 23:04 - 000000000 ____D C:\zoek_backup
2018-07-08 22:42 - 2018-07-11 05:07 - 000152688 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbae64.sys
2018-07-08 22:42 - 2018-07-08 22:42 - 000001920 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2018-07-08 22:42 - 2018-07-08 22:42 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2018-07-08 22:42 - 2018-07-08 22:42 - 000000000 ____D C:\Program Files\Malwarebytes
2018-07-08 22:41 - 2018-07-08 22:41 - 000000000 ____D C:\ProgramData\MB2Migration
2018-07-08 22:11 - 2018-07-08 22:12 - 073185120 _____ (Malwarebytes ) C:\Users\ryadh\Downloads\mb3-setup-consumer-3.5.1.2522-1.0.374-1.0.5819.exe
2018-07-08 22:09 - 2018-07-08 22:09 - 000516283 _____ C:\Users\ryadh\Downloads\cintrepair.zip
2018-07-08 22:07 - 2018-07-08 22:07 - 002038755 _____ C:\Users\ryadh\Downloads\zoek.exe
2018-07-08 21:52 - 2018-07-14 20:24 - 000004264 _____ C:\WINDOWS\System32\Tasks\Avast Emergency Update
2018-07-08 21:40 - 2018-07-08 21:44 - 000000000 ____D C:\AdwCleaner
2018-07-08 21:40 - 2018-07-08 21:40 - 007402192 _____ (Malwarebytes) C:\Users\ryadh\Downloads\adwcleaner_7.2.1.exe
2018-07-08 21:22 - 2018-07-08 21:23 - 007674244 _____ C:\Users\ryadh\Downloads\com-mod-pdf-converter-pdf-editor-v3-9-paid.30.apk
2018-07-07 02:04 - 2018-07-17 21:38 - 000004184 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{DE765ED8-87C6-44A7-A749-7EB05407EC32}
2018-07-06 00:57 - 2018-07-06 00:57 - 001028418 _____ C:\Users\ryadh\Downloads\cir080 (2).pdf
2018-07-06 00:56 - 2018-07-06 00:56 - 000338665 _____ C:\Users\ryadh\Downloads\cir763.pdf
2018-07-06 00:54 - 2018-07-06 00:54 - 001028418 _____ C:\Users\ryadh\Downloads\cir080 (1).pdf
2018-07-06 00:53 - 2018-07-06 00:53 - 001028418 _____ C:\Users\ryadh\Downloads\cir080.pdf
2018-07-06 00:51 - 2018-07-06 00:51 - 001230131 _____ C:\Users\ryadh\Downloads\guidepourlamiseenplacedeprocduresdepriseencharge.pdf
2018-07-05 23:58 - 2018-07-05 23:59 - 001130840 _____ (Google Inc.) C:\Users\ryadh\Downloads\ChromeSetup.exe
2018-07-05 23:57 - 2018-07-17 20:46 - 000000000 ____D C:\Users\ryadh\AppData\Local\CrashDumps
2018-07-03 22:12 - 2018-07-03 22:12 - 010220407 _____ C:\Users\ryadh\Downloads\com.pdfbuddies.pdfutilspro.57.apk
2018-07-03 22:01 - 2018-07-03 22:01 - 018828876 _____ C:\Users\ryadh\Downloads\PDF Converter_v1.0.18_apkpure.com.apk
2018-07-03 20:55 - 2018-07-03 20:56 - 014695053 _____ C:\Users\ryadh\Downloads\com.google.android.keep_5.0.251.04.70-182510470_minAPI21(x86)(nodpi)_apkmirror.com.apk
2018-07-01 17:40 - 2018-07-01 17:39 - 001027728 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSnx.sys
2018-07-01 17:40 - 2018-07-01 17:39 - 000647488 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswNetSec.sys
2018-07-01 17:40 - 2018-07-01 17:39 - 000463080 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys
2018-07-01 17:40 - 2018-07-01 17:39 - 000381584 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswVmm.sys
2018-07-01 17:40 - 2018-07-01 17:39 - 000378072 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2018-07-01 17:40 - 2018-07-01 17:39 - 000346664 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswbloga.sys
2018-07-01 17:40 - 2018-07-01 17:39 - 000229392 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswbidsdrivera.sys
2018-07-01 17:40 - 2018-07-01 17:39 - 000211160 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswStm.sys
2018-07-01 17:40 - 2018-07-01 17:39 - 000201328 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswbidsha.sys
2018-07-01 17:40 - 2018-07-01 17:39 - 000197160 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswArPot.sys
2018-07-01 17:40 - 2018-07-01 17:39 - 000159640 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys
2018-07-01 17:40 - 2018-07-01 17:39 - 000111872 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys
2018-07-01 17:40 - 2018-07-01 17:39 - 000085968 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRvrt.sys
2018-07-01 17:40 - 2018-07-01 17:39 - 000059592 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswbuniva.sys
2018-07-01 17:40 - 2018-07-01 17:39 - 000046976 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswHwid.sys
2018-07-01 17:40 - 2018-07-01 17:39 - 000015360 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswElam.sys
2018-07-01 16:27 - 2018-07-01 16:27 - 000000000 ____D C:\Users\ryadh\AppData\Roaming\BluestacksCN
2018-07-01 16:14 - 2018-07-01 16:14 - 000002243 _____ C:\Users\ryadh\Desktop\Ladybug.lnk
2018-07-01 15:42 - 2018-07-01 17:24 - 000002610 _____ C:\WINDOWS\System32\Tasks\BlueStacksHelper
2018-07-01 15:37 - 2018-07-01 15:37 - 000001523 _____ C:\Users\Public\Desktop\BlueStacks.lnk
2018-07-01 15:35 - 2018-07-01 15:37 - 000000000 ____D C:\ProgramData\BlueStacks
2018-07-01 15:35 - 2018-07-01 15:37 - 000000000 ____D C:\Program Files (x86)\BlueStacks
2018-07-01 14:47 - 2018-07-01 14:57 - 435618504 _____ (BlueStack Systems Inc.) C:\Users\RANA\Downloads\BlueStacks-Installer_BS3_native_cfa8eccf7fc5854234daf7782c26b77c.exe
2018-07-01 14:43 - 2018-07-01 14:43 - 000001576 _____ C:\Users\RANA\Desktop\Miracolous Lady Bug Dominoes.lnk
2018-07-01 12:27 - 2018-07-01 12:27 - 000000000 ____D C:\Users\RANA\AppData\Local\AVAST Software
2018-06-28 00:43 - 2018-06-28 00:43 - 001835983 _____ C:\Users\ryadh\Documents\Anémies mégaloblastiques macrocytaires - Hématologie et oncologie - Édition professionnelle du Manuel MSD.pdf
2018-06-28 00:38 - 2018-06-28 00:38 - 000164906 _____ C:\Users\ryadh\Downloads\leconimprim.pdf
2018-06-28 00:36 - 2018-06-28 00:36 - 000093673 _____ C:\Users\ryadh\Downloads\25-anemie-macrocytaire.pdf
2018-06-28 00:32 - 2018-06-28 00:32 - 000180601 _____ C:\Users\ryadh\Downloads\cours (7).pdf
2018-06-28 00:32 - 2018-06-28 00:32 - 000180601 _____ C:\Users\ryadh\Downloads\cours (6).pdf
2018-06-28 00:31 - 2018-06-28 00:31 - 000180601 _____ C:\Users\ryadh\Downloads\cours (5).pdf
2018-06-26 21:39 - 2018-06-26 21:39 - 003304593 _____ C:\Users\ryadh\Downloads\com.google.android.apps.adm_2.2.009-20000096_minAPI14(nodpi)_apkmirror.com.apk
2018-06-26 18:41 - 2018-06-26 18:41 - 000000000 ____D C:\Users\ryadh\AppData\Roaming\MobileBackupForeverIni
2018-06-23 23:55 - 2018-07-01 00:12 - 000003400 _____ C:\WINDOWS\System32\Tasks\Opera scheduled Autoupdate 1482436736
2018-06-23 23:55 - 2018-06-23 23:55 - 000001208 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Navigateur Opera.lnk
2018-06-23 09:26 - 2018-06-23 09:27 - 095532994 _____ C:\Users\ryadh\Downloads\10000000_264023624160653_2330693208952012800_n.mp4
2018-06-20 23:26 - 2018-06-20 23:26 - 000000000 ____H C:\Users\ryadh\AppData\Local\BIT4C76.tmp
2018-06-20 23:26 - 2018-06-20 23:26 - 000000000 ____H C:\Users\ryadh\AppData\Local\BIT49A6.tmp
2018-06-20 23:26 - 2018-06-20 23:26 - 000000000 _____ C:\Users\ryadh\AppData\Local\{B403ECF8-4784-4C42-B492-642B01932822}
2018-06-20 23:26 - 2018-06-20 23:26 - 000000000 _____ C:\Users\ryadh\AppData\Local\{90250354-75FE-406A-8F4D-98F90C7EA082}
2018-06-20 23:25 - 2018-06-20 23:25 - 000000000 ____H C:\Users\ryadh\AppData\Local\BITE134.tmp
2018-06-20 23:23 - 2018-06-20 23:25 - 000000000 _____ C:\Users\ryadh\AppData\Local\{BD2E2C39-9D5A-4FEC-BD02-8DD651A91454}
2018-06-20 22:54 - 2018-06-20 22:54 - 000004222 _____ C:\Users\ryadh\Downloads\ensignia (20).html
2018-06-20 22:53 - 2018-06-20 22:53 - 000004222 _____ C:\Users\ryadh\Downloads\ensignia (19).html
2018-06-20 21:52 - 2018-06-20 21:52 - 000004222 _____ C:\Users\ryadh\Downloads\ensignia (18).html
2018-06-19 23:42 - 2018-06-19 23:42 - 000004222 _____ C:\Users\ryadh\Downloads\ensignia (17).html
2018-06-19 23:39 - 2018-06-19 23:39 - 000004222 _____ C:\Users\ryadh\Downloads\ensignia (16).html
2018-06-19 21:27 - 2018-06-06 00:24 - 000835056 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2018-06-19 21:27 - 2018-06-06 00:24 - 000179704 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2018-06-18 21:20 - 2018-06-18 21:20 - 000004222 _____ C:\Users\ryadh\Downloads\ensignia (15).html
2018-06-18 18:49 - 2018-06-18 18:49 - 000004222 _____ C:\Users\ryadh\Downloads\ensignia (14).html
2018-06-17 09:52 - 2018-06-17 09:52 - 000464633 _____ C:\Users\ryadh\Documents\بالوثائق_ كل المعطيات المتعلقة بالجمعيات الدينية والخيرية والمتعددة الاختصاصات في تونس _ حقائق اون لاين Hakaekonline.pdf
==================== Un mois - Modifiés - fichiers et dossiers ========
(Si un élément est inclus dans le fichier fixlist.txt, le fichier/dossier sera déplacé.)
2018-07-17 20:43 - 2016-01-25 10:31 - 000000000 ____D C:\Users\ryadh\AppData\Roaming\vlc
2018-07-16 00:27 - 2018-01-30 10:54 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2018-07-15 14:36 - 2018-05-06 11:55 - 000000000 ____D C:\Users\ryadh\AppData\Roaming\Nero
2018-07-14 20:25 - 2018-01-30 10:59 - 000000000 ____D C:\Users\RANA
2018-07-11 23:59 - 2018-01-30 11:19 - 002597970 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2018-07-11 23:59 - 2017-09-30 15:39 - 001227476 _____ C:\WINDOWS\system32\perfh00C.dat
2018-07-11 23:59 - 2017-09-30 15:39 - 000272382 _____ C:\WINDOWS\system32\perfc00C.dat
2018-07-11 23:52 - 2018-01-30 10:59 - 000000000 ____D C:\Users\ryadh
2018-07-11 23:50 - 2018-01-30 11:25 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2018-07-11 23:50 - 2016-09-24 04:23 - 000000000 ____D C:\ProgramData\NVIDIA
2018-07-11 19:41 - 2017-09-29 14:44 - 000000000 ____D C:\WINDOWS\INF
2018-07-11 02:03 - 2017-03-21 18:18 - 000000000 ____D C:\Users\ryadh\Desktop\APPLICATION UTILES
2018-07-11 02:03 - 2016-01-24 20:05 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpico
2018-07-10 23:19 - 2018-04-25 20:31 - 000000517 _____ C:\WINDOWS\system32\Drivers\etc\hosts.ics
2018-07-10 22:26 - 2018-01-31 21:00 - 000000000 ____D C:\WINDOWS\Minidump
2018-07-10 22:26 - 2018-01-10 21:25 - 000000000 ___DC C:\WINDOWS\Panther
2018-07-10 22:26 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2018-07-10 22:26 - 2016-02-07 12:07 - 000000000 ____D C:\Users\ryadh\AppData\Roaming\HpUpdate
2018-07-10 22:24 - 2018-04-12 18:25 - 000000000 ___HD C:\$WINDOWS.~BT
2018-07-10 22:24 - 2016-02-19 22:07 - 000000000 ____D C:\Users\ryadh\AppData\Local\Microsoft Help
2018-07-10 22:13 - 2018-01-01 19:50 - 000000000 ____D C:\Program Files (x86)\UsbFix
2018-07-10 21:55 - 2016-07-16 12:47 - 000000000 ____D C:\WINDOWS\system32\Tasks_Migrated
2018-07-09 01:25 - 2017-09-29 09:45 - 001572864 _____ C:\WINDOWS\system32\config\BBI
2018-07-09 01:22 - 2017-09-07 22:04 - 000000000 _____ C:\WINDOWS\SysWOW64\last.dump
2018-07-09 01:12 - 2016-04-29 22:00 - 000000000 ____D C:\Program Files (x86)\Globalnet Connection Manager
2018-07-08 22:42 - 2016-04-09 18:57 - 000000000 ____D C:\ProgramData\Malwarebytes
2018-07-08 21:58 - 2018-06-13 00:22 - 000000000 ____D C:\Users\ryadh\AppData\Local\AVAST Software
2018-07-08 21:46 - 2016-03-28 21:38 - 000000000 ____D C:\ProgramData\IObit
2018-07-08 21:44 - 2016-08-15 15:51 - 000000000 ____D C:\Users\RANA\AppData\LocalLow\IObit
2018-07-08 21:44 - 2016-08-15 15:48 - 000000000 ____D C:\Users\RANA\AppData\Roaming\IObit
2018-07-08 21:44 - 2016-03-28 21:39 - 000000000 ____D C:\Users\ryadh\AppData\Roaming\IObit
2018-07-08 21:44 - 2016-03-28 21:39 - 000000000 ____D C:\Users\ryadh\AppData\LocalLow\IObit
2018-07-07 02:36 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\NDF
2018-07-07 02:34 - 2016-01-27 19:57 - 000000000 ____D C:\Users\ryadh\AppData\Local\ElevatedDiagnostics
2018-07-06 02:21 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\DeliveryOptimization
2018-07-01 17:40 - 2017-09-29 14:46 - 000000000 ___HD C:\WINDOWS\ELAMBKUP
2018-07-01 15:37 - 2016-10-05 22:28 - 000001523 _____ C:\ProgramData\Microsoft\Windows\Start Menu\BlueStacks.lnk
2018-07-01 15:37 - 2016-03-17 00:43 - 000000000 ____D C:\ProgramData\BlueStacksSetup
2018-07-01 15:36 - 2016-06-26 10:51 - 000000000 ____D C:\Users\ryadh\AppData\Local\Bluestacks
2018-07-01 13:54 - 2017-09-29 14:46 - 000000000 ___HD C:\Program Files\WindowsApps
2018-07-01 13:54 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\AppReadiness
2018-07-01 12:59 - 2018-01-30 11:00 - 000000000 ____D C:\Users\RANA\AppData\Local\Packages
2018-07-01 12:58 - 2018-01-30 17:06 - 000000000 ____D C:\Users\RANA\AppData\Local\PlaceholderTileLogoFolder
2018-07-01 12:28 - 2016-01-24 19:55 - 000000000 __RHD C:\Users\Public\AccountPictures
2018-07-01 12:27 - 2018-01-30 16:55 - 000000000 ___RD C:\Users\RANA\3D Objects
2018-07-01 00:12 - 2016-12-22 20:55 - 000000000 ____D C:\Program Files (x86)\Opera
2018-06-28 01:39 - 2016-03-28 21:43 - 000000000 ____D C:\ProgramData\ProductData
2018-06-26 23:42 - 2018-01-17 18:18 - 000002260 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2018-06-26 23:42 - 2016-04-09 19:57 - 000002301 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2018-06-26 19:40 - 2017-12-10 15:57 - 000000000 ____D C:\Users\ryadh\AppData\Roaming\WhatsApp
2018-06-26 18:35 - 2016-05-10 01:07 - 000000000 ____D C:\Users\ryadh\AppData\Roaming\Wondershare
2018-06-26 18:35 - 2016-05-10 01:07 - 000000000 ____D C:\Users\ryadh\AppData\Local\Wondershare
2018-06-26 18:35 - 2016-05-10 01:07 - 000000000 ____D C:\ProgramData\Wondershare
2018-06-25 23:30 - 2016-03-06 23:26 - 000000000 ____D C:\Users\ryadh\Desktop\RANA
2018-06-21 23:56 - 2017-09-29 14:46 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2018-06-21 23:52 - 2016-01-24 21:21 - 000000000 ____D C:\Program Files (x86)\Microsoft Office
2018-06-19 21:27 - 2017-09-29 14:37 - 000000000 ____D C:\WINDOWS\CbsTemp
2018-06-19 15:41 - 2018-01-30 11:01 - 000000000 ____D C:\Users\ryadh\AppData\Local\Packages
==================== Fichiers à la racine de certains dossiers =======
2018-06-20 23:26 - 2018-06-20 23:26 - 000000000 ____H () C:\Users\ryadh\AppData\Local\BIT49A6.tmp
2018-06-20 23:26 - 2018-06-20 23:26 - 000000000 ____H () C:\Users\ryadh\AppData\Local\BIT4C76.tmp
2018-06-20 23:25 - 2018-06-20 23:25 - 000000000 ____H () C:\Users\ryadh\AppData\Local\BITE134.tmp
2016-04-09 19:50 - 2016-04-09 20:10 - 000007617 _____ () C:\Users\ryadh\AppData\Local\Resmon.ResmonCfg
2017-06-04 23:51 - 2017-06-04 23:51 - 000000000 _____ () C:\Users\ryadh\AppData\Local\{4B8C4457-4197-4CA5-B94D-DE6EDC9C8CCC}
2018-06-20 23:26 - 2018-06-20 23:26 - 000000000 _____ () C:\Users\ryadh\AppData\Local\{90250354-75FE-406A-8F4D-98F90C7EA082}
2018-06-20 23:26 - 2018-06-20 23:26 - 000000000 _____ () C:\Users\ryadh\AppData\Local\{B403ECF8-4784-4C42-B492-642B01932822}
2018-06-20 23:23 - 2018-06-20 23:25 - 000000000 _____ () C:\Users\ryadh\AppData\Local\{BD2E2C39-9D5A-4FEC-BD02-8DD651A91454}
2018-04-01 09:59 - 2018-04-01 09:59 - 000000000 _____ () C:\Users\ryadh\AppData\Local\{DCEC3B32-8A84-4C47-9107-A6536C2179E9}
2017-05-12 21:01 - 2017-05-12 21:01 - 000000000 _____ () C:\Users\ryadh\AppData\Local\{E004665E-D294-4076-9ACA-320A48DDE836}
Certains fichiers dans TEMP:
====================
2018-03-18 14:32 - 2018-03-18 14:32 - 001857024 _____ (Opera Software) C:\Users\RANA\AppData\Local\Temp\Opera_installer_180318133222451.dll
2018-03-18 14:32 - 2018-03-18 14:32 - 001857024 _____ (Opera Software) C:\Users\RANA\AppData\Local\Temp\Opera_installer_180318133223483.dll
2018-03-23 19:22 - 2018-03-23 19:22 - 001857024 _____ (Opera Software) C:\Users\RANA\AppData\Local\Temp\Opera_installer_180323182258288.dll
2018-04-01 15:01 - 2018-04-01 15:01 - 001857024 _____ (Opera Software) C:\Users\RANA\AppData\Local\Temp\Opera_installer_180401140104406.dll
2018-07-15 14:48 - 2013-08-27 02:55 - 001042512 ____N (CANON INC.) C:\Users\ryadh\AppData\Local\Temp\MSETUP4.EXE
==================== Bamital & volsnap ======================
(Il n'y a pas de correction automatique pour les fichiers qui ne satisfont pas à la vérification.)
C:\WINDOWS\system32\winlogon.exe => Le fichier est signé numériquement
C:\WINDOWS\system32\wininit.exe => Le fichier est signé numériquement
C:\WINDOWS\explorer.exe => Le fichier est signé numériquement
C:\WINDOWS\SysWOW64\explorer.exe => Le fichier est signé numériquement
C:\WINDOWS\system32\svchost.exe => Le fichier est signé numériquement
C:\WINDOWS\SysWOW64\svchost.exe => Le fichier est signé numériquement
C:\WINDOWS\system32\services.exe => Le fichier est signé numériquement
C:\WINDOWS\system32\User32.dll => Le fichier est signé numériquement
C:\WINDOWS\SysWOW64\User32.dll => Le fichier est signé numériquement
C:\WINDOWS\system32\userinit.exe => Le fichier est signé numériquement
C:\WINDOWS\SysWOW64\userinit.exe => Le fichier est signé numériquement
C:\WINDOWS\system32\rpcss.dll => Le fichier est signé numériquement
C:\WINDOWS\system32\dnsapi.dll => Le fichier est signé numériquement
C:\WINDOWS\SysWOW64\dnsapi.dll => Le fichier est signé numériquement
C:\WINDOWS\system32\Drivers\volsnap.sys => Le fichier est signé numériquement
LastRegBack: 2018-02-19 23:27
==================== Fin de FRST.txt ============================