OTL logfile created on: 04/11/2016 18:42:38 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\francine\Desktop Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy 1,75 Gb Total Physical Memory | 0,34 Gb Available Physical Memory | 19,35% Memory free 3,75 Gb Paging File | 1,50 Gb Available in Paging File | 40,11% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 152,42 Gb Total Space | 77,18 Gb Free Space | 50,64% Space Free | Partition Type: NTFS Computer Name: PC-DE-FRANCINE | User Name: francine | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2016/11/04 18:38:43 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\francine\Desktop\OTL.exe PRC - [2016/10/19 20:00:32 | 000,509,384 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2016/10/13 15:45:22 | 004,149,312 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\Av\avgidsagent.exe PRC - [2016/10/13 15:39:46 | 000,973,584 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\Av\avgcsrvx.exe PRC - [2016/10/13 15:39:16 | 001,536,784 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\Av\avgnsx.exe PRC - [2016/10/13 15:37:02 | 005,321,488 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\Av\avgui.exe PRC - [2016/10/13 15:35:48 | 000,605,336 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\Av\avgwdsvcx.exe PRC - [2016/10/13 15:35:36 | 000,812,304 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\Av\avgemcx.exe PRC - [2016/10/13 15:35:00 | 001,029,392 | ---- | M] (AVG Technologies CZ, s.r.o.) -- c:\PROGRA~1\AVG\Av\avgrsx.exe PRC - [2016/09/13 06:55:10 | 000,945,936 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\Framework\Common\avgsvcx.exe PRC - [2016/09/13 06:55:02 | 001,510,160 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\Framework\Common\avguix.exe PRC - [2015/12/22 00:11:28 | 000,491,688 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Thunderbird\thunderbird.exe PRC - [2014/08/13 09:25:32 | 000,108,032 | ---- | M] (Freemake) -- C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe PRC - [2009/04/11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2009/04/11 07:27:28 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe PRC - [2008/04/25 12:31:40 | 000,319,488 | ---- | M] () -- C:\Program Files\Acer\Empowering Technology\SysMonitor.exe PRC - [2008/04/25 12:30:26 | 000,024,576 | ---- | M] () -- C:\Program Files\Acer\Empowering Technology\Service\ETService.exe PRC - [2008/03/04 22:38:34 | 000,500,784 | ---- | M] (Egis Incorporated) -- C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe PRC - [2008/01/29 11:51:52 | 004,911,104 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe PRC - [2007/02/04 12:02:14 | 000,079,400 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe [color=#E56717]========== Modules (No Company Name) ==========[/color] MOD - [2016/11/01 17:55:31 | 040,500,224 | ---- | M] () -- C:\Program Files\AVG\UiDll\2171\libcef.dll MOD - [2016/05/12 05:41:59 | 012,435,456 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\a3b38be91af85ee2e958fbd0f8caaa76\System.Windows.Forms.ni.dll MOD - [2016/05/12 05:41:48 | 001,593,856 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\f9c2795edd0e5e7e10885b9c4379ac26\System.Drawing.ni.dll MOD - [2016/05/12 05:40:11 | 007,982,080 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\14a08a0f05665398dc5b56b4cba69b76\System.ni.dll MOD - [2015/12/22 00:11:08 | 000,023,208 | ---- | M] () -- C:\Program Files\Mozilla Thunderbird\NSLDAPPR32V60.dll MOD - [2015/12/22 00:11:06 | 000,153,768 | ---- | M] () -- C:\Program Files\Mozilla Thunderbird\NSLDAP32V60.dll MOD - [2015/11/11 03:41:42 | 000,756,376 | ---- | M] () -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL MOD - [2014/09/11 13:15:49 | 011,496,960 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\3444fbefcbd532181c499150ace644a4\mscorlib.ni.dll MOD - [2008/04/25 12:31:40 | 000,319,488 | ---- | M] () -- C:\Program Files\Acer\Empowering Technology\SysMonitor.exe MOD - [2008/03/09 15:01:08 | 000,159,744 | ---- | M] () -- C:\Windows\System32\atitmmxx.dll MOD - [2004/01/24 23:00:00 | 000,120,832 | ---- | M] () -- C:\Program Files\WinRAR\rarext.dll [color=#E56717]========== Services (SafeList) ==========[/color] SRV - [2016/11/03 09:53:53 | 000,270,016 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2016/10/27 14:54:40 | 000,172,488 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2016/10/13 15:45:22 | 004,149,312 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\Av\avgidsagent.exe -- (AVGIDSAgent) SRV - [2016/10/13 15:35:48 | 000,605,336 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\Av\avgwdsvcx.exe -- (avgwd) SRV - [2016/09/13 06:55:10 | 000,945,936 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\Framework\Common\avgsvcx.exe -- (avgsvc) SRV - [2014/08/13 09:25:32 | 000,108,032 | ---- | M] (Freemake) [Auto | Running] -- C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe -- (Freemake Improver) SRV - [2008/04/25 12:30:26 | 000,024,576 | ---- | M] () [Auto | Running] -- C:\Program Files\Acer\Empowering Technology\Service\ETService.exe -- (ETService) SRV - [2008/03/04 22:38:34 | 000,500,784 | ---- | M] (Egis Incorporated) [Auto | Running] -- C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe -- (eDataSecurity Service) SRV - [2008/01/21 03:33:00 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - File not found [Kernel | Boot | Stopped] -- -- (UBHelper) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\NTIDrvr.sys -- (NTIDrvr) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\francine\AppData\Local\Temp\catchme.sys -- (catchme) DRV - [2016/10/09 14:55:11 | 000,170,200 | ---- | M] (Malwarebytes) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\MBAMSwissArmy.sys -- (MBAMSwissArmy) DRV - [2016/09/26 18:19:18 | 000,197,376 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\System32\drivers\avgmfx86.sys -- (Avgmfx86) DRV - [2016/09/22 14:44:06 | 000,257,792 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\System32\drivers\avgidsdriverx.sys -- (AVGIDSDriver) DRV - [2016/09/20 16:53:22 | 000,218,880 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\System32\drivers\avgldx86.sys -- (Avgldx86) DRV - [2016/07/27 15:29:08 | 000,231,680 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgtdix.sys -- (Avgtdix) DRV - [2016/07/27 15:28:44 | 000,210,176 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\System32\drivers\avgidshx.sys -- (AVGIDSHX) DRV - [2016/06/20 15:17:38 | 000,065,280 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\System32\drivers\avgunivx.sys -- (avgunivx) DRV - [2016/06/01 13:16:40 | 000,047,360 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\System32\drivers\avgrkx86.sys -- (Avgrkx86) DRV - [2016/05/13 07:43:30 | 000,134,912 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\System32\drivers\avgdiskx.sys -- (Avgdiskx) DRV - [2016/02/16 16:20:38 | 000,287,008 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\System32\drivers\avglogx.sys -- (Avglogx) DRV - [2015/11/20 09:05:14 | 000,031,664 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgidsshimx.sys -- (AVGIDSShim) DRV - [2008/04/25 12:23:40 | 000,015,392 | ---- | M] (Acer, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\int15.sys -- (int15) DRV - [2008/03/09 15:58:42 | 003,533,824 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag) DRV - [2008/02/25 15:29:24 | 000,014,544 | ---- | M] (EnTech Taiwan) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\TVicPort.sys -- (tvicport) DRV - [2008/02/25 15:29:24 | 000,006,080 | ---- | M] (Zeal SoftStudio) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\zntport.sys -- (zntport) DRV - [2007/12/19 07:45:00 | 000,170,000 | ---- | M] (AMD Technologies Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\ahcix86s.sys -- (ahcix86s) DRV - [2007/08/27 14:12:06 | 000,031,128 | ---- | M] (FreeBox SA) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\fbxusb32.sys -- (fbxusb) DRV - [2006/10/30 04:23:12 | 000,007,680 | ---- | M] (ATI Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\AtiPcie.sys -- (AtiPcie) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.fr.acer.yahoo.com IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://fr.fr.acer.yahoo.com IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-3629343305-3452528987-3318794603-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ IE - HKU\S-1-5-21-3629343305-3452528987-3318794603-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKU\S-1-5-21-3629343305-3452528987-3318794603-1000\..\SearchScopes,DefaultScope = {85A60A59-D3D8-468F-B598-FB4393789EF4} IE - HKU\S-1-5-21-3629343305-3452528987-3318794603-1000\..\SearchScopes\{85A60A59-D3D8-468F-B598-FB4393789EF4}: "URL" = https://www.google.fr/search?q={searchTerms} IE - HKU\S-1-5-21-3629343305-3452528987-3318794603-1000\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://fr.search.yahoo.com/search?p={searchTerms}&fr=chr-acer IE - HKU\S-1-5-21-3629343305-3452528987-3318794603-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.search.countryCode: "FR" FF - prefs.js..browser.search.defaultenginename: "Google" FF - prefs.js..browser.search.hiddenOneOffs: "Yahoo,Bing,Amazon.fr,eBay France" FF - prefs.js..browser.search.region: "FR" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "about:home" FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:49.0.2 FF - prefs.js..keyword.URL: "https://www.google.com/search?q=" FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_23_0_0_205.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.13.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.50428.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google) FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found FF - HKLM\Software\MozillaPlugins\@rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5: C:\ProgramData\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\quickprint@hp.com: C:\Program Files\Hewlett-Packard\SmartPrint\QPExtension [2015/04/17 17:11:50 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 49.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 49.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2016/09/30 19:02:20 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 38.5.0\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2016/09/28 13:20:54 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 38.5.0\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2016/10/18 16:02:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\francine\AppData\Roaming\mozilla\Extensions [2010/08/31 10:22:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\francine\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2016/10/14 07:27:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\francine\AppData\Roaming\mozilla\Firefox\Profiles\9jney4kc.default-1476394000146\extensions [2016/10/17 15:32:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\francine\AppData\Roaming\mozilla\Firefox\Profiles\ftxbH3Ki.default\extensions [2016/10/17 15:32:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\francine\AppData\Roaming\mozilla\Firefox\Profiles\ftxbH3Ki.default\extensions\abs@avira.com [2016/10/16 19:27:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\francine\AppData\Roaming\mozilla\Firefox\Profiles\z6nr9qrz.default-1472375335728\browser-extension-data [2016/10/16 19:29:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\francine\AppData\Roaming\mozilla\Firefox\Profiles\z6nr9qrz.default-1472375335728\browser-extension-data\firefox@ghostery.com [2016/11/03 15:33:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\francine\AppData\Roaming\mozilla\Firefox\Profiles\z6nr9qrz.default-1472375335728\extension-data [2016/11/03 15:34:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\francine\AppData\Roaming\mozilla\Firefox\Profiles\z6nr9qrz.default-1472375335728\extensions [2016/10/14 07:27:28 | 000,007,076 | ---- | M] () (No name found) -- C:\Users\francine\AppData\Roaming\mozilla\firefox\profiles\9jney4kc.default-1476394000146\features\{1bf76f2e-6032-4f25-97bd-e3d37d692b0d}\e10srollout@mozilla.org.xpi [2016/10/28 12:37:30 | 000,005,389 | ---- | M] () (No name found) -- C:\Users\francine\AppData\Roaming\mozilla\firefox\profiles\z6nr9qrz.default-1472375335728\features\{971e51c8-38d1-41e8-a4cd-414cc60e2bd7}\asyncrendering@mozilla.org.xpi [2016/10/24 10:00:58 | 000,003,027 | ---- | M] () -- C:\Users\francine\AppData\Roaming\mozilla\firefox\profiles\z6nr9qrz.default-1472375335728\searchplugins\google-lavasoft.xml [2016/11/01 10:13:57 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\browser\extensions [color=#E56717]========== Chrome ==========[/color] CHR - default_search_provider: Google () CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms} CHR - homepage: http://www.google.com O1 HOSTS File: ([2006/09/18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.) O3 - HKU\S-1-5-21-3629343305-3452528987-3318794603-1000\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [Acer Empowering Technology Monitor] C:\Program Files\Acer\Empowering Technology\SysMonitor.exe () O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [AVG_UI] C:\Program Files\AVG\Framework\Common\avguirnx.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM..\Run: [AvgUi] C:\Program Files\AVG\Framework\Common\avguirnx.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [Setresolution] C:\ACER\Config\1440X900.CMD () O4 - HKLM..\Run: [WarReg_PopUp] C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe (Acer Incorporated) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-21-3629343305-3452528987-3318794603-1000..\Run: [tkkhh] rundll32 File not found O8 - Extra context menu item: &Envoyer à OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105 File not found O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000 File not found O9 - Extra Button: HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files\Hewlett-Packard\SmartPrint\smartprintsetup.exe (Hewlett-Packard) O9 - Extra 'Tools' menuitem : SmartPrint - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files\Hewlett-Packard\SmartPrint\smartprintsetup.exe (Hewlett-Packard) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL (Microsoft Corporation) O13 - gopher Prefix: missing O15 - HKU\S-1-5-21-3629343305-3452528987-3318794603-1000\..Trusted Domains: localhost ([]* in Trusted sites) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.27.40.241 212.27.40.240 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{37745DC5-0243-46B0-BE5A-5ECCE988FB09}: DhcpNameServer = 212.27.40.241 212.27.40.240 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{597325EF-9901-4DEE-A5C7-C3AEA3E71DEF}: DhcpNameServer = 212.27.40.241 212.27.40.240 O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\System32\Userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\francine\AppData\Roaming\Microsoft\Windows Photo Gallery\Papier peint de la Galerie de photos Windows.jpg O24 - Desktop BackupWallPaper: C:\Users\francine\AppData\Roaming\Microsoft\Windows Photo Gallery\Papier peint de la Galerie de photos Windows.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006/09/18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{4a032651-c52a-11de-acec-001fe2041d79}\Shell\AutoRun\command - "" = J:\mostick.exe O33 - MountPoints2\{9f536af0-09d5-11e5-8a22-001fe2041d79}\Shell - "" = AutoRun O33 - MountPoints2\{9f536af0-09d5-11e5-8a22-001fe2041d79}\Shell\AutoRun\command - "" = D:\HTC_Sync_Manager_PC.exe O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation) NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found SafeBootMin: AppMgmt - Service SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: NTDS - File not found SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation) SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: AppMgmt - Service SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: Messenger - Service SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: NTDS - File not found SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation) SafeBootNet: WudfUsbccidDriver - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0 ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3911CF56-9EF2-39BA-846A-C27BD3CD0685} - .NET Framework ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4903D172-DCCB-392F-93A3-34CA9D47FE3D} - .NET Framework ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Dossiers Web ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C6BAF60B-6E91-453F-BFF9-D3789CFEFCDD} - .NET Framework ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Macromedia Shockwave Flash ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - ActiveX: >{7517B462-F531-4B95-A517-C86FDBB3DAD3} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP Drivers32: msacm.ac3acm - C:\Windows\System32\ac3acm.acm (fccHandler) Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.lameacm - lameACM.acm File not found Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.) Drivers32: VIDC.DIVX - C:\Windows\System32\divx.dll (DivX, Inc.) Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll () Drivers32: VIDC.XVID - C:\Windows\System32\xvidvfw.dll () Drivers32: VIDC.YV12 - C:\Windows\System32\yv12vfw.dll (www.helixcommunity.org) CREATERESTOREPOINT Restore point Set: OTL Restore Point [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2016/11/04 18:38:39 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\francine\Desktop\OTL.exe [2016/11/02 18:16:26 | 000,000,000 | ---D | C] -- C:\Users\francine\AppData\Local\CrashDumps [2016/11/01 18:16:28 | 000,000,000 | ---D | C] -- C:\Users\francine\AppData\Roaming\AVG [2016/11/01 18:13:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG [2016/11/01 18:11:34 | 000,000,000 | -H-D | C] -- C:\$AVG [2016/11/01 17:59:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Zen [2016/11/01 17:57:07 | 000,000,000 | ---D | C] -- C:\Program Files\AVG [2016/11/01 17:54:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Avg [2016/11/01 17:54:32 | 000,000,000 | ---D | C] -- C:\Users\francine\AppData\Local\AvgSetupLog [2016/11/01 17:54:32 | 000,000,000 | ---D | C] -- C:\Users\francine\AppData\Local\Avg [2016/10/31 13:49:56 | 000,000,000 | ---D | C] -- C:\ProgramData\RogueKiller [2016/10/31 12:55:06 | 002,286,392 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\francine\Desktop\GetSystemInfo5.0.exe [2016/10/30 18:09:12 | 000,000,000 | -H-D | C] -- C:\Windows\PIF [2016/10/28 17:08:16 | 005,201,280 | ---- | C] (Piriform Ltd) -- C:\Users\francine\Desktop\spsetup129(1).exe [2016/10/25 13:47:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller [2016/10/25 13:47:56 | 000,000,000 | ---D | C] -- C:\Program Files\VS Revo Group [2016/10/24 16:43:45 | 000,000,000 | ---D | C] -- C:\Users\francine\AppData\Local\Temp [2016/10/24 16:39:40 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch [2016/10/24 14:18:32 | 001,453,048 | ---- | C] (RaMMicHaeL) -- C:\Users\francine\Desktop\unchecky_setup.exe [2016/10/21 16:59:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Auslogics [2016/10/21 16:59:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Auslogics [2016/10/21 16:46:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP [2016/10/21 16:45:00 | 003,521,617 | ---- | C] (Nicolas Coolman ) -- C:\Users\francine\Desktop\ZHPFix.exe [2016/10/21 14:59:17 | 000,000,000 | ---D | C] -- C:\FRST [2016/10/21 14:57:46 | 001,758,208 | ---- | C] (Farbar) -- C:\Users\francine\Desktop\FRST.exe [2016/10/20 15:38:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner [2016/10/20 15:38:14 | 000,000,000 | ---D | C] -- C:\Users\francine\Desktop\Nouveau dossier (3) [2016/10/19 16:44:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Speccy [2016/10/19 16:44:51 | 000,000,000 | ---D | C] -- C:\Program Files\Speccy [2016/10/18 17:22:49 | 000,000,000 | ---D | C] -- C:\Users\francine\AppData\Local\MFAData [2016/10/18 17:22:49 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData [2016/10/18 15:48:47 | 000,000,000 | ---D | C] -- C:\Program Files\ZHPFix [2016/10/13 22:26:50 | 000,000,000 | ---D | C] -- C:\Users\francine\Desktop\Anciennes données de Firefox [2016/10/12 12:28:39 | 000,000,000 | ---D | C] -- C:\Users\francine\AppData\Roaming\ZHP [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2016/11/04 19:18:22 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2016/11/04 19:18:21 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2016/11/04 18:38:43 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\francine\Desktop\OTL.exe [2016/11/04 18:34:22 | 000,001,002 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2016/11/04 16:18:16 | 000,126,166 | ---- | M] () -- C:\Users\francine\Desktop\GetSystemInfo_PC-DE-FRANCINE_francine_2016_11_04_16_01_19.zip [2016/11/04 15:18:40 | 000,000,000 | ---- | M] () -- C:\Windows\System32\LogConfigTemp.xml [2016/11/04 15:18:18 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2016/11/04 15:18:12 | 1876,119,552 | -HS- | M] () -- C:\hiberfil.sys [2016/11/04 15:12:38 | 000,079,848 | ---- | M] () -- C:\Users\francine\Desktop\cc_20161104_151215.reg [2016/11/03 11:28:00 | 000,002,687 | ---- | M] () -- C:\Users\francine\Desktop\Word.lnk [2016/11/03 09:53:52 | 000,796,352 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe [2016/11/03 09:53:52 | 000,142,528 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl [2016/11/02 10:08:39 | 000,722,238 | ---- | M] () -- C:\Windows\System32\perfh00C.dat [2016/11/02 10:08:39 | 000,634,274 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2016/11/02 10:08:39 | 000,146,072 | ---- | M] () -- C:\Windows\System32\perfc00C.dat [2016/11/02 10:08:39 | 000,119,840 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2016/11/01 17:59:45 | 000,000,735 | ---- | M] () -- C:\Users\Public\Desktop\AVG.lnk [2016/11/01 11:23:58 | 001,758,208 | ---- | M] (Farbar) -- C:\Users\francine\Desktop\FRST.exe [2016/11/01 10:14:02 | 000,000,874 | ---- | M] () -- C:\Users\francine\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk [2016/11/01 10:14:02 | 000,000,850 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2016/10/31 19:51:03 | 000,024,688 | ---- | M] () -- C:\Windows\System32\drivers\TrueSight.sys [2016/10/31 13:43:26 | 020,945,992 | ---- | M] () -- C:\Users\francine\Desktop\RogueKiller.exe [2016/10/31 13:11:47 | 000,158,224 | ---- | M] () -- C:\Users\francine\Desktop\GetSystemInfo_PC-DE-FRANCINE_francine_2016_10_31_12_59_36.zip [2016/10/31 12:55:15 | 002,286,392 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\francine\Desktop\GetSystemInfo5.0.exe [2016/10/30 15:17:47 | 000,157,184 | ---- | M] () -- C:\Users\francine\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2016/10/30 13:47:15 | 000,000,691 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk [2016/10/29 11:13:36 | 000,000,924 | ---- | M] () -- C:\Users\francine\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Thunderbird.lnk [2016/10/29 11:13:36 | 000,000,900 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Thunderbird.lnk [2016/10/28 17:11:16 | 000,000,780 | ---- | M] () -- C:\Users\Public\Desktop\Speccy.lnk [2016/10/28 17:08:29 | 005,201,280 | ---- | M] (Piriform Ltd) -- C:\Users\francine\Desktop\spsetup129(1).exe [2016/10/26 17:29:08 | 000,407,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe [2016/10/26 08:55:54 | 002,472,960 | ---- | M] () -- C:\Users\francine\Desktop\ZHPCleaner.exe [2016/10/25 13:48:03 | 000,001,026 | ---- | M] () -- C:\Users\Public\Desktop\Revo Uninstaller.lnk [2016/10/24 14:18:36 | 001,453,048 | ---- | M] (RaMMicHaeL) -- C:\Users\francine\Desktop\unchecky_setup.exe [2016/10/21 16:46:27 | 000,001,638 | ---- | M] () -- C:\Users\Public\Desktop\ZHPFix.lnk [2016/10/21 16:45:06 | 003,521,617 | ---- | M] (Nicolas Coolman ) -- C:\Users\francine\Desktop\ZHPFix.exe [2016/10/20 18:20:30 | 000,007,168 | -H-- | M] () -- C:\Users\francine\photothumb.db [2016/10/20 17:21:41 | 000,477,822 | ---- | M] () -- C:\Users\francine\Desktop\cc_20161020_182045.reg [2016/10/20 11:32:18 | 002,418,176 | ---- | M] () -- C:\Users\francine\ZHPDiag3.exe [2016/10/11 15:21:08 | 000,000,856 | ---- | M] () -- C:\Users\francine\AppData\Local\recently-used.xbel [2016/10/09 16:52:06 | 000,745,254 | ---- | M] () -- C:\Users\francine\AppData\Local\census.cache [2016/10/09 16:52:00 | 000,209,407 | ---- | M] () -- C:\Users\francine\AppData\Local\ars.cache [2016/10/09 14:55:11 | 000,170,200 | ---- | M] (Malwarebytes) -- C:\Windows\System32\drivers\MBAMSwissArmy.sys [color=#E56717]========== Files Created - No Company Name ==========[/color] [2016/11/04 16:18:14 | 000,126,166 | ---- | C] () -- C:\Users\francine\Desktop\GetSystemInfo_PC-DE-FRANCINE_francine_2016_11_04_16_01_19.zip [2016/11/04 15:12:19 | 000,079,848 | ---- | C] () -- C:\Users\francine\Desktop\cc_20161104_151215.reg [2016/11/02 18:54:55 | 1876,119,552 | -HS- | C] () -- C:\hiberfil.sys [2016/11/01 18:53:05 | 000,001,002 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2016/11/01 17:59:45 | 000,000,735 | ---- | C] () -- C:\Users\Public\Desktop\AVG.lnk [2016/10/31 13:52:18 | 000,024,688 | ---- | C] () -- C:\Windows\System32\drivers\TrueSight.sys [2016/10/31 13:43:23 | 020,945,992 | ---- | C] () -- C:\Users\francine\Desktop\RogueKiller.exe [2016/10/31 13:11:45 | 000,158,224 | ---- | C] () -- C:\Users\francine\Desktop\GetSystemInfo_PC-DE-FRANCINE_francine_2016_10_31_12_59_36.zip [2016/10/28 17:11:16 | 000,000,780 | ---- | C] () -- C:\Users\Public\Desktop\Speccy.lnk [2016/10/26 08:55:49 | 002,472,960 | ---- | C] () -- C:\Users\francine\Desktop\ZHPCleaner.exe [2016/10/25 13:48:03 | 000,001,026 | ---- | C] () -- C:\Users\Public\Desktop\Revo Uninstaller.lnk [2016/10/21 16:46:27 | 000,001,638 | ---- | C] () -- C:\Users\Public\Desktop\ZHPFix.lnk [2016/10/20 17:20:49 | 000,477,822 | ---- | C] () -- C:\Users\francine\Desktop\cc_20161020_182045.reg [2016/10/20 17:09:57 | 000,000,691 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk [2016/10/20 11:32:18 | 002,418,176 | ---- | C] () -- C:\Users\francine\ZHPDiag3.exe [2016/10/11 15:21:08 | 000,000,856 | ---- | C] () -- C:\Users\francine\AppData\Local\recently-used.xbel [2016/08/24 14:13:47 | 001,223,210 | ---- | C] () -- C:\Users\francine\DSCF4387.JPG [2015/08/27 13:42:22 | 000,000,128 | --S- | C] () -- C:\Users\francine\Autre lien vers Desktop [2015/08/27 13:41:33 | 000,000,128 | --S- | C] () -- C:\Users\francine\Lien vers Desktop [2013/12/26 10:51:54 | 000,004,416 | ---- | C] () -- C:\Users\francine\AppData\Roaming\CamStudio.cfg [2013/12/26 10:51:54 | 000,000,408 | ---- | C] () -- C:\Users\francine\AppData\Roaming\CamShapes.ini [2013/12/26 10:51:54 | 000,000,408 | ---- | C] () -- C:\Users\francine\AppData\Roaming\CamLayout.ini [2013/12/26 10:51:54 | 000,000,081 | ---- | C] () -- C:\Users\francine\AppData\Roaming\Camdata.ini [2013/07/01 09:28:03 | 000,000,005 | ---- | C] () -- C:\Users\francine\AppData\Roaming\WBPU-TTL.DAT [2012/09/08 18:19:20 | 000,007,168 | -H-- | C] () -- C:\Users\francine\photothumb.db [2012/07/08 13:51:10 | 000,000,057 | ---- | C] () -- C:\ProgramData\Ament.ini [2012/01/06 14:00:06 | 000,745,254 | ---- | C] () -- C:\Users\francine\AppData\Local\census.cache [2012/01/06 13:59:45 | 000,209,407 | ---- | C] () -- C:\Users\francine\AppData\Local\ars.cache [2012/01/06 13:41:14 | 000,000,036 | ---- | C] () -- C:\Users\francine\AppData\Local\housecall.guid.cache [2010/12/23 17:54:09 | 000,004,096 | -H-- | C] () -- C:\Users\francine\AppData\Local\keyfile3.drm [2010/01/19 19:06:44 | 000,001,028 | ---- | C] () -- C:\Users\francine\AppData\Roaming\WavCodec.wff [2009/04/23 08:44:49 | 000,000,680 | ---- | C] () -- C:\Users\francine\AppData\Local\d3d9caps.dat [2009/02/06 14:46:26 | 000,079,693 | ---- | C] () -- C:\Users\francine\AppData\Roaming\UserTile.png [2008/10/08 11:42:53 | 000,157,184 | ---- | C] () -- C:\Users\francine\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008/10/08 10:53:54 | 000,000,780 | ---- | C] () -- C:\Users\francine\AppData\Roaming\wklnhst.dat [color=#E56717]========== ZeroAccess Check ==========[/color] [2006/11/02 13:51:16 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2015/07/29 01:46:08 | 011,588,096 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2009/04/11 07:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009/04/11 07:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [color=#E56717]========== LOP Check ==========[/color] [2015/05/27 11:29:28 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\TuneUp Software [2015/05/27 11:29:28 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\TuneUp Software [2009/11/24 11:24:46 | 000,000,000 | -HSD | M] -- C:\Users\francine\AppData\Roaming\.# [2009/11/25 21:32:22 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\Acer GameZone Console [2016/10/30 09:58:44 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\Audacity [2016/11/01 18:16:28 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\AVG [2015/04/17 17:11:55 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\Canneverbe Limited [2009/03/11 10:37:23 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\Canon [2012/09/11 11:32:03 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\Cocoon Software [2014/07/25 12:10:46 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\e-on software [2008/11/13 11:47:20 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\eSobi [2011/01/18 18:19:07 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\eTeks [2008/11/09 19:39:22 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\FloodLightGames [2013/04/18 11:45:30 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\GARMIN [2013/09/13 11:26:21 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\gnupg [2009/10/30 10:59:34 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\Mostick [2016/10/16 19:29:05 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\mp3keyshifter [2015/08/27 19:49:45 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\NCH Swift Sound [2016/10/16 19:29:05 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\OpenAlchemist [2015/04/17 17:10:58 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\OpenOffice [2009/01/28 19:27:21 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\OpenOffice.org [2010/11/16 09:05:25 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\PeerNetworking [2016/10/16 19:29:05 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\PhotoFiltre [2016/10/16 19:29:05 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\PhotoFiltre 7 [2016/10/30 13:56:26 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\PhotoScape [2009/03/11 10:28:23 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\ScanSoft [2013/10/02 09:18:48 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\SumatraPDF [2008/10/08 10:54:05 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\Template [2016/10/16 19:29:05 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\Thunderbird [2015/04/16 09:26:40 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\TuneUp Software [2012/07/11 09:23:02 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\Visan [2016/11/03 22:03:01 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\ZHP [2008/12/24 18:45:57 | 000,000,000 | ---D | M] -- C:\Users\francine\AppData\Roaming\Zylom [color=#E56717]========== Purity Check ==========[/color] [color=#E56717]========== Custom Scans ==========[/color] [color=#A23BEC]< MD5 for: AFD.SYS >[/color] [2011/04/21 14:58:27 | 000,273,408 | ---- | M] (Microsoft Corporation) MD5=3911B972B55FEA0478476B2E777B29FA -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6002.18457_none_d99fb42e5bb59d9b\afd.sys [2011/04/21 14:16:42 | 000,273,408 | ---- | M] (Microsoft Corporation) MD5=48EB99503533C27AC6135648E5474457 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6001.18639_none_d7d0e0cc5e7d461c\afd.sys [2015/10/13 15:31:33 | 000,273,408 | ---- | M] (Microsoft Corporation) MD5=4A0978779958D8FE8F5849F452BCC812 -- C:\Windows\System32\drivers\afd.sys [2015/10/13 15:31:33 | 000,273,408 | ---- | M] (Microsoft Corporation) MD5=4A0978779958D8FE8F5849F452BCC812 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6002.19513_none_d9c6ddd45b98df43\afd.sys [2011/04/21 14:28:53 | 000,273,920 | ---- | M] (Microsoft Corporation) MD5=70EE0FC7A0F384DBD929A01384AEEB4B -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6002.22629_none_da4bc33774b91967\afd.sys [2008/01/21 03:33:55 | 000,273,920 | ---- | M] (Microsoft Corporation) MD5=763E172A55177E478CB419F88FD0BA03 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6001.18000_none_d7e842925e6d1f50\afd.sys [2015/10/13 15:24:04 | 000,273,920 | ---- | M] (Microsoft Corporation) MD5=994FE77F4BA72432A1FC03A17D177737 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6002.23823_none_da45ae7f74be954c\afd.sys [2009/04/11 05:47:03 | 000,273,920 | ---- | M] (Microsoft Corporation) MD5=A201207363AA900ABF1A388468688570 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6002.18005_none_d9d3bb9e5b8eea9c\afd.sys [2011/04/21 14:12:21 | 000,273,920 | ---- | M] (Microsoft Corporation) MD5=C8AF25017CECB75906A571AC70D2D306 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6001.22905_none_d876efff77862705\afd.sys [2014/05/30 07:53:22 | 000,273,408 | ---- | M] (Microsoft Corporation) MD5=F5272A105F59A7B3B345D9D6D87DA7AD -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6002.19115_none_d9c8d6d05b971d55\afd.sys [2014/05/30 10:51:58 | 000,273,920 | ---- | M] (Microsoft Corporation) MD5=FA44775936FBCECB679FB30351959757 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6002.23414_none_da51771d74b59e16\afd.sys [color=#A23BEC]< MD5 for: EXPLORER.EXE >[/color] [2008/10/29 07:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe [2008/10/29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe [2008/10/30 04:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe [2009/04/11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe [2009/04/11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe [2008/10/28 03:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe [2008/01/21 03:34:05 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe [color=#A23BEC]< MD5 for: I8042PRT.SYS >[/color] [2006/11/02 09:51:13 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=1060F1377F395A242E27719440ECE602 -- C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_93b1c41f\i8042prt.sys [2006/11/02 09:51:13 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=1060F1377F395A242E27719440ECE602 -- C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_3dfa3917\i8042prt.sys [2008/01/21 03:14:08 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=1C9EE072BAA3ABB460B91D7EE9152660 -- C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_a81145df\i8042prt.sys [2008/01/21 03:14:08 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=1C9EE072BAA3ABB460B91D7EE9152660 -- C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_f4514c17\i8042prt.sys [2008/01/21 03:14:08 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=1C9EE072BAA3ABB460B91D7EE9152660 -- C:\Windows\winsxs\x86_keyboard.inf_31bf3856ad364e35_6.0.6000.16609_none_957131ccdbca3f9c\i8042prt.sys [2008/01/21 03:14:08 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=1C9EE072BAA3ABB460B91D7EE9152660 -- C:\Windows\winsxs\x86_msmouse.inf_31bf3856ad364e35_6.0.6000.16609_none_4c56cf70d52c8670\i8042prt.sys [2008/01/21 03:32:45 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=22D56C8184586B7A1F6FA60BE5F5A2BD -- C:\Windows\System32\drivers\i8042prt.sys [2008/01/21 03:32:49 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=22D56C8184586B7A1F6FA60BE5F5A2BD -- C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_da7e599e\i8042prt.sys [2008/01/21 03:32:49 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=22D56C8184586B7A1F6FA60BE5F5A2BD -- C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_f55d5e51\i8042prt.sys [2008/01/21 03:32:45 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=22D56C8184586B7A1F6FA60BE5F5A2BD -- C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_8b7c4328\i8042prt.sys [2008/01/21 03:32:49 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=22D56C8184586B7A1F6FA60BE5F5A2BD -- C:\Windows\winsxs\x86_keyboard.inf_31bf3856ad364e35_6.0.6001.18000_none_974e6dd8d8f8ec7e\i8042prt.sys [2008/01/21 03:32:49 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=22D56C8184586B7A1F6FA60BE5F5A2BD -- C:\Windows\winsxs\x86_keyboard.inf_31bf3856ad364e35_6.0.6002.18005_none_9939e6e4d61ab7ca\i8042prt.sys [2008/01/21 03:32:45 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=22D56C8184586B7A1F6FA60BE5F5A2BD -- C:\Windows\winsxs\x86_msmouse.inf_31bf3856ad364e35_6.0.6001.18000_none_4e340b7cd25b3352\i8042prt.sys [2008/01/21 03:14:07 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=BEA9838CD25D36BEBA3F94386A761D60 -- C:\Windows\winsxs\x86_keyboard.inf_31bf3856ad364e35_6.0.6000.20734_none_95d55d61f504b486\i8042prt.sys [2008/01/21 03:14:08 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=BEA9838CD25D36BEBA3F94386A761D60 -- C:\Windows\winsxs\x86_msmouse.inf_31bf3856ad364e35_6.0.6000.20734_none_4cbafb05ee66fb5a\i8042prt.sys [color=#A23BEC]< MD5 for: LSASS.EXE >[/color] [2016/05/14 15:24:01 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=1989D4FFD919C306E35E6D1092FAA606 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.23974_none_a872e94373445065\lsass.exe [2009/06/15 13:51:56 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=203D86EBD6D8E4C8501B222421E81506 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.22152_none_a886901f7335e2fc\lsass.exe [2009/09/10 15:44:14 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=2D3AC5E7AC01E905F3ABD2D745FE3A9B -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.22223_none_a8a80213731ca5a7\lsass.exe [2015/06/27 15:20:12 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=2DCDD1B84875C0D5404173EC3B00E454 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.23737_none_a8a1260573213258\lsass.exe [2009/06/15 13:48:49 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=3978F3540329E16C0AC3BCF677E5669F -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.18051_none_a7fbf30a5a1929db\lsass.exe [2015/04/30 15:19:51 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=474FDD99DB6012E21405AAEE8DA61546 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.23683_none_a867135b734d5b8a\lsass.exe [2015/09/28 15:16:23 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=51A90F96C7CB9640DD945DE853D103A1 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.23814_none_a8b3c6e57313ab98\lsass.exe [2009/02/13 08:26:04 | 000,007,680 | ---- | M] (Microsoft Corporation) MD5=59DE082968FDD257FFF0D209B9A5B460 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6000.16820_none_a44eb0105fb4d975\lsass.exe [2012/06/01 23:37:38 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=613DEB66A91820F0A41915B40BB8833F -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.22869_none_a882cf8373379c5f\lsass.exe [2009/06/15 14:03:38 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=6F1F23D3599EAE17734451936B7F17C6 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6001.22450_none_a69e1da376115b2a\lsass.exe [2014/10/11 00:21:41 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=86C519D59C70327434641E862A70B52B -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.23521_none_a8a5f069731e840f\lsass.exe [2016/03/18 16:34:46 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=9BB31D267F30609BF98140ED5814F15B -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.23936_none_a8a029877322134f\lsass.exe [2015/01/15 06:17:50 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=A28A5386D01A5C6B085838624955EF3C -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.23594_none_a85d41d3735493ab\lsass.exe [2011/11/16 15:12:25 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=A3E186B4B935905B829219502557314E -- C:\Windows\System32\lsass.exe [2011/11/16 15:12:25 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=A3E186B4B935905B829219502557314E -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.18541_none_a806cc745a10ffad\lsass.exe [2011/11/16 15:12:25 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=A3E186B4B935905B829219502557314E -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.18643_none_a808ceee5a0f2f82\lsass.exe [2011/11/16 15:12:25 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=A3E186B4B935905B829219502557314E -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.19214_none_a82a209c59f61a0b\lsass.exe [2011/11/16 15:12:25 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=A3E186B4B935905B829219502557314E -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.19284_none_a7de71285a2edda2\lsass.exe [2011/11/16 15:12:25 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=A3E186B4B935905B829219502557314E -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.19431_none_a81183b25a090036\lsass.exe [2011/11/16 15:12:25 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=A3E186B4B935905B829219502557314E -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.19503_none_a833f5f059eedc38\lsass.exe [2011/11/16 15:12:25 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=A3E186B4B935905B829219502557314E -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.19623_none_a81e57fe59ff1141\lsass.exe [2011/11/16 15:12:25 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=A3E186B4B935905B829219502557314E -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.19659_none_a803e9f65a11fd1e\lsass.exe [2011/11/16 15:12:25 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=A3E186B4B935905B829219502557314E -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.19668_none_a7f819c05a1affb8\lsass.exe [2016/07/09 15:23:42 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=A4AF8824688C9034F34AE90E219232EB -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.23984_none_a8681957734c6c56\lsass.exe [2009/06/15 13:57:59 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=A911ECAC81F94ADEAFBE8E3F7873EDB0 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6001.18272_none_a600dfae5d0228c9\lsass.exe [2015/03/06 03:16:32 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=ACAC4085ECDA9A35ED621936D67DB9D4 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.23640_none_a88f522d732f9fc1\lsass.exe [2009/02/13 05:58:37 | 000,007,680 | ---- | M] (Microsoft Corporation) MD5=AFF8A58280863629CA4FFA9E0B259F1E -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6000.21010_none_a4e2f4e978ca9090\lsass.exe [2009/06/15 13:59:08 | 000,007,680 | ---- | M] (Microsoft Corporation) MD5=BA9A67672E025078C77967731BCFC560 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6000.21067_none_a4b3e75378eccda6\lsass.exe [2014/12/03 01:23:58 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=C4AA089041242987308AE2A7B30E910A -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.23555_none_a88981cd73333d3e\lsass.exe [2009/06/15 14:10:12 | 000,007,680 | ---- | M] (Microsoft Corporation) MD5=C731B1FE449D4E9CEA358C9D55B69BE9 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6000.16870_none_a418a0745fdd652a\lsass.exe [2009/09/09 12:09:38 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=CB7E838C140B4087B2DA323F2D4523C5 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6001.22518_none_a6d1618975e9b345\lsass.exe [2009/09/10 15:47:51 | 000,007,680 | ---- | M] (Microsoft Corporation) MD5=D09A5DA84B7C9CA9B02EBCD7FAE41C8D -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6000.21125_none_a4dd285578ce285b\lsass.exe [2008/01/21 03:33:54 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=DCF733788C7D088D814E5F80EB4B3E0F -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6001.18000_none_a64a8ac25ccb3836\lsass.exe [2008/01/21 03:33:54 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=DCF733788C7D088D814E5F80EB4B3E0F -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6001.18215_none_a644c0145ccecd28\lsass.exe [2008/01/21 03:33:54 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=DCF733788C7D088D814E5F80EB4B3E0F -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.18005_none_a83603ce59ed0382\lsass.exe [2011/11/16 14:57:04 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=EBFAEB786C46B407930811F94F08877D -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.22742_none_a8916b6f732db5f5\lsass.exe [2009/02/13 09:20:29 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=F4C62B07E5BF96F1FDCA9DB393ECED22 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6001.22376_none_a68e7da1761c2def\lsass.exe [color=#A23BEC]< MD5 for: NETBT.SYS >[/color] [2016/05/10 15:28:38 | 000,186,368 | ---- | M] (Microsoft Corporation) MD5=215FDC77E8D81CEEA3AF80B323B75486 -- C:\Windows\winsxs\x86_microsoft-windows-netbt_31bf3856ad364e35_6.0.6002.23970_none_628925bb0dc0da38\netbt.sys [2008/01/21 03:34:49 | 000,184,320 | ---- | M] (Microsoft Corporation) MD5=7C5FEE5B1C5728507CD96FB4A13E7A02 -- C:\Windows\winsxs\x86_microsoft-windows-netbt_31bf3856ad364e35_6.0.6001.18000_none_6064c861f7442765\netbt.sys [2016/05/10 15:28:34 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=BF84E55A9B3AD3CBAB4AAE3BE043E579 -- C:\Windows\System32\drivers\netbt.sys [2016/05/10 15:28:34 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=BF84E55A9B3AD3CBAB4AAE3BE043E579 -- C:\Windows\winsxs\x86_microsoft-windows-netbt_31bf3856ad364e35_6.0.6002.19655_none_621a266df48e86f1\netbt.sys [2009/04/11 05:45:37 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=ECD64230A59CBD93C85F1CD1CAB9F3F6 -- C:\Windows\winsxs\x86_microsoft-windows-netbt_31bf3856ad364e35_6.0.6002.18005_none_6250416df465f2b1\netbt.sys [color=#A23BEC]< MD5 for: SVCHOST.EXE >[/color] [2008/01/21 03:33:13 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF -- C:\Windows\System32\svchost.exe [2008/01/21 03:33:13 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.0.6001.18000_none_b5bb59a1054dbde5\svchost.exe [2016/03/10 13:07:16 | 000,960,480 | ---- | M] (MalwareBytes) MD5=F86A4139730504047F52CCFB8C47E9F5 -- C:\Program Files\Malwarebytes Anti-Malware\Chameleon\Windows\svchost.exe [color=#A23BEC]< MD5 for: TCPIP.SYS >[/color] [2008/04/26 09:08:16 | 000,891,448 | ---- | M] (Microsoft Corporation) MD5=01EC1E92595F839BEE70D439C46796E3 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22167_none_b36dd19b7fae39c7\tcpip.sys [2013/05/08 04:40:36 | 000,914,792 | ---- | M] (Microsoft Corporation) MD5=078218D74C4EFC2CE7E4C6DF22A94F2F -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.23106_none_b59411ab7ca4df04\tcpip.sys [2009/04/11 07:33:02 | 000,897,000 | ---- | M] (Microsoft Corporation) MD5=0E6B0885C3D5E4643ED2D043DE3433D8 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18005_none_b5098b5e63880c42\tcpip.sys [2011/09/20 22:02:55 | 000,913,280 | ---- | M] (Microsoft Corporation) MD5=16731B631F28F63CD9F4CB60940E7DDD -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.22719_none_b58c64c97caa1c43\tcpip.sys [2009/12/08 21:52:30 | 000,897,624 | ---- | M] (Microsoft Corporation) MD5=1ACBB7A47E78F4CC82D2EFFB72901528 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18377_none_b2d96a966698ad63\tcpip.sys [2009/08/15 22:30:53 | 000,816,640 | ---- | M] (Microsoft Corporation) MD5=2512B4D1353370D6688B1AF1F5AFA1CF -- C:\Windows\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.21108_none_6030d425ab49af00\tcpip.sys [2009/08/14 18:01:55 | 000,900,168 | ---- | M] (Microsoft Corporation) MD5=2608E71AAD54564647D4BB984E1925AA -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22497_none_b34d67897fc6850f\tcpip.sys [2011/06/17 21:13:55 | 000,905,104 | ---- | M] (Microsoft Corporation) MD5=2756186E287139310997090797E0182B -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18484_none_b4b2134c63c9c70f\tcpip.sys [2012/03/30 13:39:11 | 000,905,600 | ---- | M] (Microsoft Corporation) MD5=27D470DABC77BC60D0A3B0E4DEB6CB91 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18604_none_b50896786388e1d5\tcpip.sys [2010/02/18 12:51:51 | 000,818,688 | ---- | M] (Microsoft Corporation) MD5=2C1F7005AA3B62721BFDB307BD5F5010 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.21226_none_6019359fab5bb15b\tcpip.sys [2010/02/18 15:49:38 | 000,898,952 | ---- | M] (Microsoft Corporation) MD5=2EAE4500984C2F8DACFB977060300A15 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18427_none_b30f7c1866701ed5\tcpip.sys [2009/08/14 15:24:47 | 000,813,568 | ---- | M] (Microsoft Corporation) MD5=300208927321066EA53761FDC98747C6 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.16908_none_5fa75f38922bdbf4\tcpip.sys [2013/01/04 12:28:19 | 000,914,792 | ---- | M] (Microsoft Corporation) MD5=3535CD93F944C00F098E73E12EE7FEB6 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.23013_none_b5863efb7cafb1c9\tcpip.sys [2009/12/08 21:15:00 | 000,907,832 | ---- | M] (Microsoft Corporation) MD5=46E6685F3E92AEC743773ADD4CD54F57 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.22283_none_b53aaa1b7ce8560d\tcpip.sys [2010/02/18 15:07:16 | 000,904,576 | ---- | M] (Microsoft Corporation) MD5=48CBE6D53632D0067C2D6B20F90D84CA -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18209_none_b50d905263846bec\tcpip.sys [2010/02/18 13:05:37 | 000,815,104 | ---- | M] (Microsoft Corporation) MD5=4A82FA8F0DF67AA354580C3FAAF8BDE3 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.17021_none_5f8a957c924295b7\tcpip.sys [2013/05/08 05:37:21 | 000,905,576 | ---- | M] (Microsoft Corporation) MD5=548E198BAE21EFC21F8B5F0C1728AD27 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18835_none_b4e92aca63a0494d\tcpip.sys [2009/12/08 21:37:09 | 000,900,696 | ---- | M] (Microsoft Corporation) MD5=5653230D480A9C54D169E1B080B72CF5 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22577_none_b36309477fb64a54\tcpip.sys [2010/06/16 16:55:58 | 000,902,032 | ---- | M] (Microsoft Corporation) MD5=6216A954ED7045B62880A92D6C9B9FC7 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_b39feb737f8937a0\tcpip.sys [2009/08/14 17:27:34 | 000,904,776 | ---- | M] (Microsoft Corporation) MD5=65877AA1B6A7CB797488E831698973E9 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18091_none_b4a43aea63d4a25f\tcpip.sys [2011/06/17 21:13:55 | 000,913,296 | ---- | M] (Microsoft Corporation) MD5=6647FCE6FC4970DAAFE5C64C794513D3 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.22662_none_b54f51417cd8f970\tcpip.sys [2010/06/16 17:39:32 | 000,912,776 | ---- | M] (Microsoft Corporation) MD5=6A10AFCE0B38371064BE41C1FBFD3C6B -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.22425_none_b57d8e037cb5db63\tcpip.sys [2013/07/05 04:20:37 | 000,914,880 | ---- | M] (Microsoft Corporation) MD5=6D0D344F643E28B31262AC2682109A3C -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.23152_none_b55a00e77cd1055d\tcpip.sys [2013/01/04 12:28:18 | 000,905,576 | ---- | M] (Microsoft Corporation) MD5=74E2D020C47BB2B2FCCBA29A518A7EB4 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18764_none_b4c7b8d663b986a2\tcpip.sys [2010/06/16 16:59:54 | 000,898,952 | ---- | M] (Microsoft Corporation) MD5=782568AB6A43160A159B6215B70BCCE9 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18493_none_b2bfcb7c66ac7d10\tcpip.sys [2011/09/20 22:02:55 | 000,905,088 | ---- | M] (Microsoft Corporation) MD5=814A1C66FBD4E1B310A517221F1456BF -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18519_none_b502c618638c7f52\tcpip.sys [2008/04/26 09:26:49 | 000,891,448 | ---- | M] (Microsoft Corporation) MD5=82E266BEE5F0167E41C6ECFDD2A79C02 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18063_none_b2e033a8669434a1\tcpip.sys [2009/12/08 18:58:13 | 000,813,568 | ---- | M] (Microsoft Corporation) MD5=8734BD051FFDCBF8425CF222141C3741 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.16973_none_5f56ae52926920d8\tcpip.sys [2009/08/14 18:07:56 | 000,897,608 | ---- | M] (Microsoft Corporation) MD5=8A7AD2A214233F684242F289ED83EBC3 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18311_none_b3144862666d6db3\tcpip.sys [2010/02/18 18:36:50 | 000,902,024 | ---- | M] (Microsoft Corporation) MD5=93A5655CD9CD2F080EF1CB71A3666215 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22636_none_b38d4a937f96be60\tcpip.sys [2014/04/05 04:23:10 | 000,915,392 | ---- | M] (Microsoft Corporation) MD5=A4196D394207369E1431E8681B373312 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.23370_none_b54264477ce304df\tcpip.sys [2010/06/16 17:04:57 | 000,905,088 | ---- | M] (Microsoft Corporation) MD5=A474879AFA4A596B3A531F3E69730DBF -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18272_none_b4baded863c37e22\tcpip.sys [2014/04/05 03:42:27 | 000,905,664 | ---- | M] (Microsoft Corporation) MD5=C7B0746FCD576D7EEBA6A2530B0B2966 -- C:\Windows\System32\drivers\tcpip.sys [2014/04/05 03:42:27 | 000,905,664 | ---- | M] (Microsoft Corporation) MD5=C7B0746FCD576D7EEBA6A2530B0B2966 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.19080_none_b4adf3c463cd86b8\tcpip.sys [2009/12/08 18:45:32 | 000,816,640 | ---- | M] (Microsoft Corporation) MD5=CA3A5756672013A66BB9D547A5A62DCA -- C:\Windows\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.21175_none_5fe223d3ab852692\tcpip.sys [2013/07/05 05:53:33 | 000,905,664 | ---- | M] (Microsoft Corporation) MD5=D18D53974FD715D50FC76F9FFE1C830D -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18880_none_b4ae19bc63cd564f\tcpip.sys [2010/02/18 15:22:11 | 000,910,216 | ---- | M] (Microsoft Corporation) MD5=D9F5DD5BBC8348E8F8220CCBF14C022E -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.22341_none_b563eb1d7cc9b0c2\tcpip.sys [2009/12/08 21:01:08 | 000,904,776 | ---- | M] (Microsoft Corporation) MD5=DA467E7619AE5F4588E6262C13C8940A -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18160_none_b4c3ac4a63bd325c\tcpip.sys [2012/03/30 13:39:11 | 000,914,304 | ---- | M] (Microsoft Corporation) MD5=EE7E10BED85C312C1D5D30C435BDDA9F -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.22828_none_b58096797cb31c04\tcpip.sys [2008/01/21 03:34:55 | 000,891,448 | ---- | M] (Microsoft Corporation) MD5=FC6E2835D667774D409C7C7021EAF9C4 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18000_none_b31e1252666640f6\tcpip.sys [2009/08/14 17:33:50 | 000,905,784 | ---- | M] (Microsoft Corporation) MD5=FF71856BD4CD6D4367F9FD84BE79A874 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.22200_none_b58e289d7caa2a80\tcpip.sys [color=#A23BEC]< MD5 for: USERINIT.EXE >[/color] [2008/01/21 03:34:37 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe [2008/01/21 03:34:37 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe [color=#A23BEC]< MD5 for: VOLSNAP.SYS >[/color] [2006/11/02 10:51:18 | 000,208,488 | ---- | M] (Microsoft Corporation) MD5=11EF6C1CAEF76B685233450A126125D6 -- C:\Windows\System32\DriverStore\FileRepository\volume.inf_9320b452\volsnap.sys [2009/04/11 07:32:55 | 000,226,280 | ---- | M] (Microsoft Corporation) MD5=147281C01FCB1DF9252DE2A10D5E7093 -- C:\Windows\System32\DriverStore\FileRepository\volume.inf_1e6030e4\volsnap.sys [2009/04/11 07:32:55 | 000,226,280 | ---- | M] (Microsoft Corporation) MD5=147281C01FCB1DF9252DE2A10D5E7093 -- C:\Windows\winsxs\x86_volume.inf_31bf3856ad364e35_6.0.6002.18005_none_17a2308cf936c619\volsnap.sys [2012/08/21 12:47:42 | 000,225,664 | ---- | M] (Microsoft Corporation) MD5=559F1DB6586DE2EE8E25E172A0CA9A3C -- C:\Windows\winsxs\x86_volume.inf_31bf3856ad364e35_6.0.6002.22913_none_181f0c08125e385e\volsnap.sys [2012/08/21 12:47:42 | 000,224,640 | ---- | M] (Microsoft Corporation) MD5=786DB5771F05EF300390399F626BF30A -- C:\Windows\System32\drivers\volsnap.sys [2012/08/21 12:47:42 | 000,224,640 | ---- | M] (Microsoft Corporation) MD5=786DB5771F05EF300390399F626BF30A -- C:\Windows\System32\DriverStore\FileRepository\volume.inf_2abeaeba\volsnap.sys [2012/08/21 12:47:42 | 000,224,640 | ---- | M] (Microsoft Corporation) MD5=786DB5771F05EF300390399F626BF30A -- C:\Windows\winsxs\x86_volume.inf_31bf3856ad364e35_6.0.6002.18679_none_175a8da4f96bddf6\volsnap.sys [2008/01/21 03:32:47 | 000,227,896 | ---- | M] (Microsoft Corporation) MD5=D8B4A53DD2769F226B3EB374374987C9 -- C:\Windows\System32\DriverStore\FileRepository\volume.inf_f53a1785\volsnap.sys [2008/01/21 03:32:47 | 000,227,896 | ---- | M] (Microsoft Corporation) MD5=D8B4A53DD2769F226B3EB374374987C9 -- C:\Windows\winsxs\x86_volume.inf_31bf3856ad364e35_6.0.6001.18000_none_15b6b780fc14facd\volsnap.sys [color=#A23BEC]< MD5 for: WININIT.EXE >[/color] [2008/01/21 03:33:13 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe [2008/01/21 03:33:13 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe [color=#A23BEC]< MD5 for: WINLOGON.EXE >[/color] [2009/04/11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe [2009/04/11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe [2008/01/21 03:34:38 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe [2016/03/10 13:07:16 | 000,960,480 | ---- | M] (MalwareBytes) MD5=F86A4139730504047F52CCFB8C47E9F5 -- C:\Program Files\Malwarebytes Anti-Malware\Chameleon\Windows\winlogon.exe [color=#A23BEC]< %APPDATA%\*.exe /s >[/color] [2008/04/02 13:35:18 | 007,945,216 | ---- | M] () -- C:\Users\francine\AppData\Roaming\Cocoon Software\QuickMediaConverter\bin\Hd\FFmpeg.exe [2010/03/25 11:05:46 | 011,222,528 | ---- | M] () -- C:\Users\francine\AppData\Roaming\Cocoon Software\QuickMediaConverter\bin\Std\FFmpeg.exe [2013/11/29 10:19:02 | 000,054,632 | ---- | M] (Adobe Systems Inc.) -- C:\Users\francine\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe [2009/04/14 17:03:32 | 000,086,576 | ---- | M] (Microsoft Corporation) -- C:\Users\francine\AppData\Roaming\Microsoft\Services Windows Live\Raccourci Galerie de Photos Windows Live.exe [2009/04/14 17:03:26 | 000,132,672 | ---- | M] (Microsoft Corporation) -- C:\Users\francine\AppData\Roaming\Microsoft\Services Windows Live\Raccourci Windows Live Messenger.exe [2016/10/03 12:29:29 | 034,122,240 | ---- | M] () -- C:\Users\francine\AppData\Roaming\Mozilla\Firefox\Profiles\z6nr9qrz.default-1472375335728\ffmpeg.exe [2007/08/29 15:36:06 | 000,167,424 | ---- | M] () -- C:\Users\francine\AppData\Roaming\NCH Software\Components\aacdec\aacdec.exe [2007/08/29 15:36:00 | 000,110,592 | ---- | M] () -- C:\Users\francine\AppData\Roaming\NCH Software\Components\mp3el\mp3enc.exe [2007/08/29 14:36:02 | 000,074,240 | ---- | M] () -- C:\Users\francine\AppData\Roaming\NCH Software\Components\oggdec\oggdec.exe [2015/08/27 19:49:36 | 000,096,928 | ---- | M] (NCH Software) -- C:\Users\francine\AppData\Roaming\NCH Swift Sound\Program Files\ToolBox\tbsetup_v1.13.exe [2015/08/27 19:49:46 | 000,176,132 | ---- | M] (NCH Software) -- C:\Users\francine\AppData\Roaming\NCH Swift Sound\Program Files\ToolBox\toolbox.exe [2015/08/27 19:49:46 | 000,176,132 | ---- | M] (NCH Software) -- C:\Users\francine\AppData\Roaming\NCH Swift Sound\Program Files\ToolBox\uninst.exe [2016/10/26 08:55:54 | 002,472,960 | ---- | M] () -- C:\Users\francine\AppData\Roaming\ZHP\ZHPCleaner.exe [2015/08/19 19:09:06 | 037,329,920 | ---- | M] () -- C:\Users\francine\AppData\Roaming\ZHP\Quarantine\Microsoft Office 2010 Toolkit.exe [213 C:\Users\francine\AppData\Roaming\ZHP\Quarantine\*.tmp files -> C:\Users\francine\AppData\Roaming\ZHP\Quarantine\*.tmp -> ] [2016/10/17 11:16:24 | 000,711,952 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Users\francine\AppData\Roaming\ZHP\Quarantine\AVG.DIR\Avg\Setup\avgntdumpx.exe [2016/10/17 11:17:12 | 001,871,632 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Users\francine\AppData\Roaming\ZHP\Quarantine\AVG.DIR\Avg\Setup\avgsetupwrkx.exe [2016/10/17 11:16:23 | 003,672,848 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Users\francine\AppData\Roaming\ZHP\Quarantine\AVG.DIR\Avg\Setup\avgsetupx.exe [2016/10/17 11:18:34 | 000,032,016 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Users\francine\AppData\Roaming\ZHP\Quarantine\AVG.DIR\Avg\Setup\fmw\avgrdsttestx.exe [color=#A23BEC]< %APPDATA%\Adobe\Update\*.* >[/color] [color=#A23BEC]< %APPDATA%\Update\*.* >[/color] [color=#A23BEC]< %APPDATA%\Microsoft\*.* >[/color] [color=#A23BEC]< %ALLUSERSPROFILE%\Favorites\*.* >[/color] [color=#A23BEC]< %ALLUSERSPROFILE%\*.* >[/color] [2012/07/08 13:51:10 | 000,000,057 | ---- | M] () -- C:\ProgramData\Ament.ini [color=#A23BEC]< %SYSTEMDRIVE%\*.* >[/color] [2006/09/18 22:43:36 | 000,000,024 | ---- | M] () -- C:\autoexec.bat [2009/04/11 07:36:36 | 000,333,257 | RHS- | M] () -- C:\bootmgr [2006/09/18 22:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys [2016/11/04 15:18:12 | 1876,119,552 | -HS- | M] () -- C:\hiberfil.sys [2011/03/28 09:48:23 | 000,000,000 | RHS- | M] () -- C:\IO.SYS [2011/03/28 09:48:23 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS [2016/11/04 15:18:09 | 2191,994,880 | -HS- | M] () -- C:\pagefile.sys [color=#A23BEC]< %PROGRAMFILES%\*.* >[/color] [2008/01/21 03:57:01 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini [color=#A23BEC]< %PROGRAMFILES%\Internet Explorer\*.* >[/color] [2016/07/15 22:25:42 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\ExtExport.exe [2008/01/21 03:33:45 | 000,069,632 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\hmmapi.dll [2015/12/17 12:03:55 | 000,002,535 | ---- | M] () -- C:\Program Files\Internet Explorer\ie9props.propdesc [2015/12/17 12:03:57 | 000,107,008 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iecleanup.exe [2011/08/13 05:43:15 | 000,006,144 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iecompat.dll [2015/12/17 12:03:56 | 000,307,200 | ---- | M] () -- C:\Program Files\Internet Explorer\iediagcmd.exe [2016/07/15 22:26:13 | 000,678,912 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iedvtool.dll [2016/07/15 22:25:45 | 000,474,624 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\ieinstal.exe [2016/07/15 22:25:44 | 000,223,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\ielowutil.exe [2016/07/15 22:25:33 | 000,195,072 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\ieproxy.dll [2016/07/15 22:25:34 | 000,194,560 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\IEShims.dll [2009/03/07 02:11:16 | 000,004,169 | ---- | M] () -- C:\Program Files\Internet Explorer\iessetup.ceb [2006/11/02 10:46:05 | 000,016,384 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iessetup.dll [2016/07/15 22:36:44 | 000,758,512 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iexplore.exe [2016/07/15 22:25:54 | 000,388,096 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\jsdbgui.dll [2016/07/15 22:25:49 | 000,104,448 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\jsdebuggeride.dll [2015/12/17 12:03:45 | 000,049,664 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\JSProfilerCore.dll [2015/12/17 12:03:40 | 000,149,504 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\jsprofilerui.dll [2009/01/08 02:20:17 | 000,265,720 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\msdbg2.dll [2015/12/17 12:03:50 | 000,301,056 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\networkinspection.dll [2009/01/08 02:20:17 | 000,355,832 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\pdm.dll [2016/07/15 22:36:44 | 000,149,744 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\sqmapi.dll [color=#A23BEC]< %USERPROFILE%\*.* >[/color] [2015/08/27 13:42:22 | 000,000,128 | --S- | M] () -- C:\Users\francine\Autre lien vers Desktop [2016/08/21 13:54:58 | 001,223,210 | ---- | M] () -- C:\Users\francine\DSCF4387.JPG [2015/08/27 13:41:33 | 000,000,128 | --S- | M] () -- C:\Users\francine\Lien vers Desktop [2016/11/04 20:23:52 | 012,058,624 | -HS- | M] () -- C:\Users\francine\ntuser.dat [2009/03/23 10:07:08 | 000,262,144 | -H-- | M] () -- C:\Users\francine\NTUSER.DAT.COPY.TMP.LOG1 [2008/11/23 12:07:14 | 000,000,000 | -H-- | M] () -- C:\Users\francine\NTUSER.DAT.COPY.TMP.LOG2 [2016/11/04 20:23:51 | 000,262,144 | -H-- | M] () -- C:\Users\francine\ntuser.dat.LOG1 [2015/12/27 08:41:56 | 000,262,144 | -H-- | M] () -- C:\Users\francine\ntuser.dat.LOG2 [2013/05/30 21:50:00 | 000,065,536 | -HS- | M] () -- C:\Users\francine\ntuser.dat{096e6000-62e1-11e2-a374-001fe2041d79}.TM.blf [2013/05/30 21:50:00 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{096e6000-62e1-11e2-a374-001fe2041d79}.TMContainer00000000000000000001.regtrans-ms [2013/01/21 00:22:50 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{096e6000-62e1-11e2-a374-001fe2041d79}.TMContainer00000000000000000002.regtrans-ms [2011/10/13 08:58:31 | 000,065,536 | -HS- | M] () -- C:\Users\francine\ntuser.dat{11bd0c3c-5fea-11df-87a3-001fe2041d79}.TM.blf [2011/10/13 08:58:31 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{11bd0c3c-5fea-11df-87a3-001fe2041d79}.TMContainer00000000000000000001.regtrans-ms [2010/05/15 21:44:42 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{11bd0c3c-5fea-11df-87a3-001fe2041d79}.TMContainer00000000000000000002.regtrans-ms [2013/10/15 17:24:36 | 000,065,536 | -HS- | M] () -- C:\Users\francine\ntuser.dat{15290c00-c9d0-11e2-8295-001fe2041d79}.TM.blf [2013/10/15 17:24:36 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{15290c00-c9d0-11e2-8295-001fe2041d79}.TMContainer00000000000000000001.regtrans-ms [2013/05/31 23:13:37 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{15290c00-c9d0-11e2-8295-001fe2041d79}.TMContainer00000000000000000002.regtrans-ms [2010/04/06 11:59:17 | 000,065,536 | -HS- | M] () -- C:\Users\francine\ntuser.dat{1f1636f8-fd36-11de-beb2-001fe2041d79}.TM.blf [2010/04/06 11:59:17 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{1f1636f8-fd36-11de-beb2-001fe2041d79}.TMContainer00000000000000000001.regtrans-ms [2010/01/09 20:45:41 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{1f1636f8-fd36-11de-beb2-001fe2041d79}.TMContainer00000000000000000002.regtrans-ms [2014/08/22 21:25:24 | 000,065,536 | -HS- | M] () -- C:\Users\francine\ntuser.dat{290c79e1-0505-11e4-9fc2-001fe2041d79}.TM.blf [2014/08/22 21:25:24 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{290c79e1-0505-11e4-9fc2-001fe2041d79}.TMContainer00000000000000000001.regtrans-ms [2014/07/06 22:29:55 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{290c79e1-0505-11e4-9fc2-001fe2041d79}.TMContainer00000000000000000002.regtrans-ms [2009/11/07 22:05:52 | 000,065,536 | -HS- | M] () -- C:\Users\francine\ntuser.dat{7110689d-c220-11de-9f82-001fe2041d79}.TM.blf [2009/11/07 22:05:52 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{7110689d-c220-11de-9f82-001fe2041d79}.TMContainer00000000000000000001.regtrans-ms [2009/10/26 21:44:11 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{7110689d-c220-11de-9f82-001fe2041d79}.TMContainer00000000000000000002.regtrans-ms [2009/10/26 18:15:37 | 000,065,536 | -HS- | M] () -- C:\Users\francine\ntuser.dat{71e56005-9f6b-11de-b2d4-001fe2041d79}.TM.blf [2009/10/26 18:15:37 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{71e56005-9f6b-11de-b2d4-001fe2041d79}.TMContainer00000000000000000001.regtrans-ms [2009/09/12 22:12:40 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{71e56005-9f6b-11de-b2d4-001fe2041d79}.TMContainer00000000000000000002.regtrans-ms [2012/10/31 00:32:21 | 000,065,536 | -HS- | M] () -- C:\Users\francine\ntuser.dat{793398d4-f572-11e0-8e7b-001fe2041d79}.TM.blf [2012/10/31 00:32:21 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{793398d4-f572-11e0-8e7b-001fe2041d79}.TMContainer00000000000000000001.regtrans-ms [2011/10/13 22:14:55 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{793398d4-f572-11e0-8e7b-001fe2041d79}.TMContainer00000000000000000002.regtrans-ms [2014/07/05 11:34:47 | 000,065,536 | -HS- | M] () -- C:\Users\francine\ntuser.dat{7aacb9df-35b4-11e3-9324-001fe2041d79}.TM.blf [2014/07/05 11:34:47 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{7aacb9df-35b4-11e3-9324-001fe2041d79}.TMContainer00000000000000000001.regtrans-ms [2013/10/15 22:05:35 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{7aacb9df-35b4-11e3-9324-001fe2041d79}.TMContainer00000000000000000002.regtrans-ms [2009/11/27 10:28:27 | 000,065,536 | -HS- | M] () -- C:\Users\francine\ntuser.dat{7b3b9cdb-d851-11de-9355-001fe2041d79}.TM.blf [2009/11/27 10:28:27 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{7b3b9cdb-d851-11de-9355-001fe2041d79}.TMContainer00000000000000000001.regtrans-ms [2009/11/23 22:51:02 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{7b3b9cdb-d851-11de-9355-001fe2041d79}.TMContainer00000000000000000002.regtrans-ms [2009/09/12 18:16:08 | 000,065,536 | -HS- | M] () -- C:\Users\francine\ntuser.dat{7c5a4f1b-9ab6-11de-b219-001fe2041d79}.TM.blf [2009/09/12 18:16:08 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{7c5a4f1b-9ab6-11de-b219-001fe2041d79}.TMContainer00000000000000000001.regtrans-ms [2009/09/06 08:28:30 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{7c5a4f1b-9ab6-11de-b219-001fe2041d79}.TMContainer00000000000000000002.regtrans-ms [2010/05/14 23:17:39 | 000,065,536 | -HS- | M] () -- C:\Users\francine\ntuser.dat{7e6efce9-414a-11df-8102-001fe2041d79}.TM.blf [2010/05/14 23:17:39 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{7e6efce9-414a-11df-8102-001fe2041d79}.TMContainer00000000000000000001.regtrans-ms [2010/04/06 23:14:48 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{7e6efce9-414a-11df-8102-001fe2041d79}.TMContainer00000000000000000002.regtrans-ms [2009/11/23 22:40:18 | 000,065,536 | -HS- | M] () -- C:\Users\francine\ntuser.dat{9ac4261a-cc41-11de-bfdb-001fe2041d79}.TM.blf [2009/11/23 22:40:18 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{9ac4261a-cc41-11de-bfdb-001fe2041d79}.TMContainer00000000000000000001.regtrans-ms [2009/11/09 01:02:56 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{9ac4261a-cc41-11de-bfdb-001fe2041d79}.TMContainer00000000000000000002.regtrans-ms [2015/04/24 21:45:29 | 000,065,536 | -HS- | M] () -- C:\Users\francine\ntuser.dat{9caddf80-2a9a-11e4-8093-001fe2041d79}.TM.blf [2015/04/24 21:45:29 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{9caddf80-2a9a-11e4-8093-001fe2041d79}.TMContainer00000000000000000001.regtrans-ms [2014/08/23 21:48:28 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{9caddf80-2a9a-11e4-8093-001fe2041d79}.TMContainer00000000000000000002.regtrans-ms [2013/01/19 23:17:53 | 000,065,536 | -HS- | M] () -- C:\Users\francine\ntuser.dat{ac980f1a-2331-11e2-a638-001fe2041d79}.TM.blf [2013/01/19 23:17:53 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{ac980f1a-2331-11e2-a638-001fe2041d79}.TMContainer00000000000000000001.regtrans-ms [2012/10/31 22:54:40 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{ac980f1a-2331-11e2-a638-001fe2041d79}.TMContainer00000000000000000002.regtrans-ms [2009/11/22 19:29:43 | 000,065,536 | -HS- | M] () -- C:\Users\francine\ntuser.dat{aebb2873-d675-11de-9937-001fe2041d79}.TM.blf [2009/11/22 19:29:43 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{aebb2873-d675-11de-9937-001fe2041d79}.TMContainer00000000000000000001.regtrans-ms [2009/11/21 16:12:34 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{aebb2873-d675-11de-9937-001fe2041d79}.TMContainer00000000000000000002.regtrans-ms [2010/01/09 16:51:27 | 000,065,536 | -HS- | M] () -- C:\Users\francine\ntuser.dat{ccdb5358-db36-11de-bf6c-001fe2041d79}.TM.blf [2010/01/09 16:51:27 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{ccdb5358-db36-11de-bf6c-001fe2041d79}.TMContainer00000000000000000001.regtrans-ms [2009/11/27 11:16:23 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{ccdb5358-db36-11de-bf6c-001fe2041d79}.TMContainer00000000000000000002.regtrans-ms [2016/11/04 15:14:16 | 000,065,536 | -HS- | M] () -- C:\Users\francine\ntuser.dat{ce4444dd-eb1e-11e4-a148-001fe2041d79}.TM.blf [2016/11/04 15:14:16 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{ce4444dd-eb1e-11e4-a148-001fe2041d79}.TMContainer00000000000000000001.regtrans-ms [2015/04/25 21:30:31 | 000,524,288 | -HS- | M] () -- C:\Users\francine\ntuser.dat{ce4444dd-eb1e-11e4-a148-001fe2041d79}.TMContainer00000000000000000002.regtrans-ms [2009/09/05 21:31:47 | 000,065,536 | -HS- | M] () -- C:\Users\francine\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TM.blf [2009/09/05 21:31:47 | 000,524,288 | -HS- | M] () -- C:\Users\francine\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TMContainer00000000000000000001.regtrans-ms [2008/10/08 18:33:49 | 000,524,288 | -HS- | M] () -- C:\Users\francine\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TMContainer00000000000000000002.regtrans-ms [2008/10/08 10:20:48 | 000,000,020 | -HS- | M] () -- C:\Users\francine\ntuser.ini [2016/10/20 18:20:30 | 000,007,168 | -H-- | M] () -- C:\Users\francine\photothumb.db [2016/10/20 11:32:18 | 002,418,176 | ---- | M] () -- C:\Users\francine\ZHPDiag3.exe [color=#A23BEC]< %Temp%\smtmp\1\*.* >[/color] [color=#A23BEC]< %Temp%\smtmp\2\*.* >[/color] [color=#A23BEC]< %Temp%\smtmp\3\*.* >[/color] [color=#A23BEC]< %Temp%\smtmp\4\*.* >[/color] [color=#A23BEC]< %USERPROFILE%\Local Settings\Temp\*.exe >[/color] [color=#A23BEC]< %USERPROFILE%\Local Settings\Temp\*.dll >[/color] [color=#A23BEC]< %USERPROFILE%\Application Data\*.exe >[/color] [color=#A23BEC]< %systemroot%\system32\DBBK\*.* /s >[/color] [color=#A23BEC]< %systemroot%\system32\config\systemprofile\*.* >[/color] [2016/10/30 13:47:16 | 000,262,144 | ---- | M] () -- C:\Windows\system32\config\systemprofile\ntuser.dat [2008/01/21 08:26:38 | 000,001,024 | -H-- | M] () -- C:\Windows\system32\config\systemprofile\ntuser.dat.LOG [2016/10/30 13:47:15 | 000,262,144 | -H-- | M] () -- C:\Windows\system32\config\systemprofile\ntuser.dat.LOG1 [2006/11/02 13:40:55 | 000,000,000 | -H-- | M] () -- C:\Windows\system32\config\systemprofile\ntuser.dat.LOG2 [2016/10/30 13:47:15 | 000,065,536 | -HS- | M] () -- C:\Windows\system32\config\systemprofile\ntuser.dat{350e4ef8-c7c1-11dc-b86a-806e6f6e6963}.TM.blf [2016/10/30 13:47:15 | 000,524,288 | -HS- | M] () -- C:\Windows\system32\config\systemprofile\ntuser.dat{350e4ef8-c7c1-11dc-b86a-806e6f6e6963}.TMContainer00000000000000000001.regtrans-ms [2008/01/21 02:36:13 | 000,524,288 | -HS- | M] () -- C:\Windows\system32\config\systemprofile\ntuser.dat{350e4ef8-c7c1-11dc-b86a-806e6f6e6963}.TMContainer00000000000000000002.regtrans-ms [color=#A23BEC]< %systemroot%\*. /mp /s >[/color] [color=#A23BEC]< %systemroot%\*.exe /90 >[/color] [color=#A23BEC]< %systemroot%\system32\*.dll /lockedfiles >[/color] [color=#A23BEC]< %systemroot%\system32\*.dll /90 >[/color] [color=#A23BEC]< %systemroot%\system32\drivers\*.sys /lockedfiles >[/color] [color=#A23BEC]< %systemroot%\system32\drivers\*.sys /90 >[/color] [2016/09/22 14:44:06 | 000,257,792 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\system32\drivers\avgidsdriverx.sys [2016/09/20 16:53:22 | 000,218,880 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\system32\drivers\avgldx86.sys [2016/09/26 18:19:18 | 000,197,376 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\system32\drivers\avgmfx86.sys [2016/10/09 14:55:11 | 000,170,200 | ---- | M] (Malwarebytes) -- C:\Windows\system32\drivers\MBAMSwissArmy.sys [2016/10/31 19:51:03 | 000,024,688 | ---- | M] () -- C:\Windows\system32\drivers\TrueSight.sys [color=#A23BEC]< %systemroot%\system32\*.exe /90 >[/color] [2016/11/03 09:53:52 | 000,796,352 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\system32\FlashPlayerApp.exe [2016/10/26 17:29:08 | 000,407,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\MpSigStub.exe [2016/09/05 19:48:55 | 144,884,648 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mrt.exe [color=#A23BEC]< %systemroot%\system32\config\*.sav >[/color] [2008/03/16 15:06:05 | 012,148,736 | ---- | M] () -- C:\Windows\system32\config\COMPONENTS.SAV [2008/03/16 15:06:02 | 000,102,400 | ---- | M] () -- C:\Windows\system32\config\DEFAULT.SAV [2008/03/16 15:06:06 | 000,020,480 | ---- | M] () -- C:\Windows\system32\config\SECURITY.SAV [2008/03/16 15:06:12 | 016,576,512 | ---- | M] () -- C:\Windows\system32\config\SOFTWARE.SAV [2008/03/16 15:06:14 | 006,606,848 | ---- | M] () -- C:\Windows\system32\config\SYSTEM.SAV [color=#A23BEC]< %systemroot%\system32\spool\prtprocs\w32x86\*.* >[/color] [2006/12/25 21:00:00 | 000,027,136 | ---- | M] (CANON INC.) -- C:\Windows\system32\spool\prtprocs\w32x86\CNMPD8R.DLL [2006/12/25 21:00:00 | 000,069,632 | ---- | M] (CANON INC.) -- C:\Windows\system32\spool\prtprocs\w32x86\CNMPP8R.DLL [2006/10/26 19:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\msonpppr.dll [color=#A23BEC]< %systemroot%\Tasks\*.job /lockedfiles >[/color] [color=#A23BEC]< %systemroot%\assembly\tmp\*.* /S /MD5 >[/color] [color=#A23BEC]< %systemroot%\assembly\GAC_32\*.* /S /MD5 >[/color] [2014/07/13 13:55:56 | 000,062,976 | ---- | M] () MD5=6BDC7DBB390872A2D975687F5FC29358 -- C:\Windows\assembly\GAC_32\cli_cppuhelper\1.0.23.0__ce2cb7e279207b9e\cli_cppuhelper.dll [2014/05/08 00:41:59 | 000,069,120 | ---- | M] () MD5=081F0B876BB85888AE96B9A009D30ACB -- C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll [2014/05/08 00:42:03 | 000,072,192 | ---- | M] () MD5=D653F464A098D38CDD4642A0A08D0276 -- C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll [2009/04/11 07:31:17 | 000,507,904 | ---- | M] () MD5=F20BA0C9DCD43D7A1E8586D5919AA5E1 -- C:\Windows\assembly\GAC_32\Microsoft.Ink\6.0.0.0__31bf3856ad364e35\Microsoft.Ink.dll [2006/11/02 10:47:01 | 000,077,824 | ---- | M] () MD5=7AAFBF522A988D2A093A4CEFBE5633FE -- C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\Microsoft.Interop.Security.AzRoles.dll [2015/09/29 18:01:13 | 000,117,160 | ---- | M] () MD5=569124F95660007F8C470D00A96CBD7D -- C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Infopath.Client.Internal.Host.Interop.dll [2014/06/26 23:17:19 | 000,163,840 | ---- | M] () MD5=63AD74E356E4A0CA57471E59138943DA -- C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll [2015/09/27 13:18:38 | 000,367,400 | ---- | M] () MD5=6CAD87F2BE4A4BC31D3FD5C923741418 -- C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.InteropAdapter.dll [2006/09/18 22:32:28 | 000,066,728 | ---- | M] () MD5=C01B81BB10AD14DBC5C4ECD350638096 -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\big5.nlp [2006/09/18 22:32:28 | 000,082,172 | ---- | M] () MD5=EE1F60F8774D74BED8B13498F3FE737A -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\bopomofo.nlp [2006/09/18 22:32:39 | 000,116,756 | ---- | M] () MD5=F6DFDA5A31162D848634504565F6D321 -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\ksc.nlp [2014/07/03 23:17:38 | 004,550,656 | ---- | M] () MD5=A3CF1A31A420D239B92D04BA44F6B94E -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll [2006/09/18 22:32:52 | 000,059,342 | ---- | M] () MD5=DA5748A89E22A3932387E65694B25BBB -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normidna.nlp [2006/09/18 22:32:52 | 000,045,794 | ---- | M] () MD5=3831A5E217D6FA828CCE1011DA26E677 -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfc.nlp [2006/09/18 22:32:52 | 000,039,284 | ---- | M] () MD5=DBDE664E0BA4BACD0A6A04AE2232B205 -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfd.nlp [2006/09/18 22:32:52 | 000,066,384 | ---- | M] () MD5=C9B88B759FE81D59CE8EBF5A0A8EB75A -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfkc.nlp [2006/09/18 22:32:52 | 000,060,294 | ---- | M] () MD5=3CAB6AB66759FCDF73B61EE262C9ACF4 -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfkd.nlp [2006/09/18 22:32:52 | 000,083,748 | ---- | M] () MD5=54144F43EDF5AA8F504A30E7C1D1A7B5 -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\prc.nlp [2006/09/18 22:32:52 | 000,083,748 | ---- | M] () MD5=901863C68E6523336CAC602FE9320ABC -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\prcp.nlp [2006/09/18 22:32:53 | 000,262,148 | ---- | M] ()[b] Unable to obtain MD5[/b] -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp [2006/09/18 22:32:53 | 000,020,320 | ---- | M] ()[b] Unable to obtain MD5[/b] -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp [2006/09/18 22:33:03 | 000,028,288 | ---- | M] () MD5=09E420F90A329BDA68477FA4AF43CB28 -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\xjis.nlp [2008/01/21 03:34:17 | 000,046,080 | ---- | M] () MD5=18A24D038910FB55AC04EDC30B95BEC3 -- C:\Windows\assembly\GAC_32\napcrypt\6.0.0.0__31bf3856ad364e35\NAPCRYPT.DLL [2008/01/21 03:34:24 | 000,103,936 | ---- | M] () MD5=B621CEA9D376BB8E85D6F65807068281 -- C:\Windows\assembly\GAC_32\naphlpr\6.0.0.0__31bf3856ad364e35\NAPHLPR.DLL [2014/07/13 13:56:02 | 000,000,382 | ---- | M] () MD5=7C5EE283EC0F3E6A81B37D5B29E89833 -- C:\Windows\assembly\GAC_32\policy.1.0.cli_cppuhelper\23.0.0.0__ce2cb7e279207b9e\cli_cppuhelper.config [2014/07/13 13:56:02 | 000,003,072 | ---- | M] () MD5=926256CE4BB1DA2F93115A6DD1867D3F -- C:\Windows\assembly\GAC_32\policy.1.0.cli_cppuhelper\23.0.0.0__ce2cb7e279207b9e\policy.1.0.cli_cppuhelper.dll [2006/11/02 13:34:39 | 000,000,446 | ---- | M] () MD5=41D1BF747E31A9FE5B313795C341ED17 -- C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Ink\6.0.0.0__31bf3856ad364e35\Policy.1.0.Microsoft.Ink.config [2006/11/02 13:34:39 | 000,005,632 | ---- | M] () MD5=F5941E3CF5909022C3AD6AC4D2804669 -- C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Ink\6.0.0.0__31bf3856ad364e35\Policy.1.0.Microsoft.Ink.dll [2006/09/18 22:34:47 | 000,000,494 | ---- | M] () MD5=453626B1A59F62F9A141AC62F4E44E75 -- C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.0.6000.16386__31bf3856ad364e35\Microsoft.Interop.Security.AzRoles.config [2006/11/02 10:47:07 | 000,005,632 | ---- | M] () MD5=F516E8DFA7E2538E03B383635840F698 -- C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.0.6000.16386__31bf3856ad364e35\Policy.1.0.Microsoft.Interop.Security.AzRoles.dll [2006/09/18 22:34:47 | 000,000,494 | ---- | M] () MD5=453626B1A59F62F9A141AC62F4E44E75 -- C:\Windows\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.0.6000.16386__31bf3856ad364e35\Policy.1.2.Microsoft.Interop.Security.AzRoles.config [2006/11/02 10:47:07 | 000,005,632 | ---- | M] () MD5=25BFE1285DED18CB7F5BFF465795E056 -- C:\Windows\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.0.6000.16386__31bf3856ad364e35\Policy.1.2.Microsoft.Interop.Security.AzRoles.dll [2006/11/02 13:34:39 | 000,000,446 | ---- | M] () MD5=41D1BF747E31A9FE5B313795C341ED17 -- C:\Windows\assembly\GAC_32\Policy.1.7.Microsoft.Ink\6.0.0.0__31bf3856ad364e35\Policy.1.7.Microsoft.Ink.config [2006/11/02 13:34:39 | 000,005,632 | ---- | M] () MD5=C057BC981DF01192671FDFDCCC200241 -- C:\Windows\assembly\GAC_32\Policy.1.7.Microsoft.Ink\6.0.0.0__31bf3856ad364e35\Policy.1.7.Microsoft.Ink.dll [2016/03/17 16:02:09 | 004,222,976 | ---- | M] () MD5=6800C6316FF075EB50E366AFC393C421 -- C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationCore.dll [2008/06/16 23:18:54 | 000,000,161 | ---- | M] () MD5=C0856EC51C8C75B8FDF02C1BBCFE7B93 -- C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe.config [2016/03/17 16:02:10 | 001,736,864 | ---- | M] () MD5=DB38DF8C6B027C4308167BB3C9D30E4D -- C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\wpfgfx_v0300.dll [2014/05/08 00:42:38 | 000,486,400 | ---- | M] () MD5=FC382069AF9560AB71679E0E1CB7B92B -- C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll [2016/05/24 14:10:49 | 002,958,848 | ---- | M] () MD5=6322180BCFBFB641E6937F7DA56B6675 -- C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll [2014/05/08 00:42:43 | 000,258,048 | ---- | M] () MD5=5F9FC2149F1E73434859B6BEC506738A -- C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll [2014/07/01 20:01:56 | 000,113,664 | ---- | M] () MD5=67BD46AB3313BE434667C679537044D7 -- C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll [2016/03/17 16:02:10 | 000,368,640 | ---- | M] () MD5=DDB8B729F92E0BCD92535ADE3AEE063E -- C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\System.Printing.dll [2014/03/28 11:49:12 | 000,261,632 | ---- | M] () MD5=9CBDADD79847FA69BC798731F49AA44C -- C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll [2015/02/07 00:18:28 | 005,279,744 | ---- | M] () MD5=5DE593F4E508D1236CECCD1CA3E3641D -- C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll [color=#A23BEC]< %systemroot%\assembly\GAC_64\*.* /S /MD5 >[/color] [color=#A23BEC]< %windir%\ServiceProfiles\LocalService\AppData\Local\Temp\*.* >[/color] [color=#A23BEC]< %windir%\ServiceProfiles\NetworkService\AppData\Local\Temp\*.* >[/color] [color=#A23BEC]< %windir%\temp*.* >[/color] [color=#A23BEC]< "%WinDir%\$NtUninstallKB*$." /30 >[/color] [color=#A23BEC]< HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections >[/color] "SavedLegacySettings" = 46 00 00 00 F5 35 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 90 A1 A1 70 64 DA D0 01 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 02 00 00 00 C0 A8 01 0B 00 00 00 00 00 00 00 00 0E 21 0D 1C 0D 1A 0E 02 0E 09 0D 1B 0D 17 0D 17 0D 1C 0D 1E 0D 21 0E 1A 0D 20 0D 19 0D 20 0D 1D 0E 0A 0E 0A 0E 09 0D 1A 0E 09 0D 1A 0E 09 0D 1C 0D 1F 0E 21 0D 20 0D 1F 07 4E 01 02 03 03 02 03 03 02 03 02 03 02 02 02 03 03 03 03 02 03 03 03 03 03 03 02 02 03 03 02 02 02 03 03 01 01 01 80 2B 06 82 80 3B 06 82 80 4B 06 82 80 5B 06 82 00 17 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 5D 00 56 10 00 00 56 10 00 00 B4 0D 60 DB 00 00 00 00 7B 38 42 46 33 33 41 42 33 2D 39 38 45 41 2D 34 44 43 42 2D 38 45 37 34 2D 32 31 35 41 37 45 33 38 33 39 45 35 7D 00 55 53 42 20 46 6C 61 73 68 20 44 72 69 76 65 00 00 44 69 73 71 75 65 20 61 6D 6F 76 69 62 6C 65 00 31 46 31 46 00 45 46 46 00 00 [Binary data over 200 bytes] "DefaultConnectionSettings" = 46 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 90 A1 A1 70 64 DA D0 01 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 02 00 00 00 C0 A8 01 0B 00 00 00 00 00 00 00 00 0E 21 0D 1C 0D 1A 0E 02 0E 09 0D 1B 0D 17 0D 17 0D 1C 0D 1E 0D 21 0E 1A 0D 20 0D 19 0D 20 0D 1D 0E 0A 0E 0A 0E 09 0D 1A 0E 09 0D 1A 0E 09 0D 1C 0D 1F 0E 21 0D 20 0D 1F 07 4E 01 02 03 03 02 03 03 02 03 02 03 02 02 02 03 03 03 03 02 03 03 03 03 03 03 02 02 03 03 02 02 02 03 03 01 01 01 80 2B 06 82 80 3B 06 82 80 4B 06 82 80 5B 06 82 00 17 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 5D 00 56 10 00 00 56 10 00 00 B4 0D 60 DB 00 00 00 00 7B 38 42 46 33 33 41 42 33 2D 39 38 45 41 2D 34 44 43 42 2D 38 45 37 34 2D 32 31 35 41 37 45 33 38 33 39 45 35 7D 00 55 53 42 20 46 6C 61 73 68 20 44 72 69 76 65 00 00 44 69 73 71 75 65 20 61 6D 6F 76 69 62 6C 65 00 31 46 31 46 00 45 46 46 00 00 [Binary data over 200 bytes] [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >[/color] [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >[/color] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2016-09-06 19:15:08 [color=#A23BEC]< C:\Program Files\Common Files\ComObjects\*.* / >[/color] Invalid Switch: [color=#A23BEC]< %ALLUSERSPROFILE%\Application Data\*.exe /s >[/color] [color=#A23BEC]< >[/color] [2006/11/02 13:58:10 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT [2006/11/02 13:58:10 | 000,032,502 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2016/11/01 18:53:05 | 000,001,002 | ---- | C] () -- C:\Windows\Tasks\Adobe Flash Player Updater.job [color=#E56717]========== Files - Unicode (All) ==========[/color] [2013/10/19 08:48:34 | 101,890,677 | ---- | M] ()(C:\Windows\System32\????) -- C:\Windows\System32\氩᷁š [2013/10/19 08:48:34 | 101,890,677 | ---- | C] ()(C:\Windows\System32\????) -- C:\Windows\System32\氩᷁š [2013/10/12 08:35:47 | 100,595,853 | ---- | M] ()(C:\Windows\System32\???1) -- C:\Windows\System32\颯繺1 [2013/10/12 08:35:47 | 100,595,853 | ---- | C] ()(C:\Windows\System32\???1) -- C:\Windows\System32\颯繺1 < End of report >