Résultats d'analyse de Farbar Recovery Scan Tool (FRST) (x64) Version: 08-05-2017 Exécuté par Lyes (administrateur) sur LYES-PC (13-05-2017 15:45:48) Exécuté depuis C:\Users\Lyes\Desktop Profils chargés: Lyes (Profils disponibles: UpdatusUser & Lyes & thelyes38) Platform: Windows 7 Home Premium Service Pack 1 (X64) Langue: Français (France) Internet Explorer Version 11 (Navigateur par défaut: Chrome) Mode d'amorçage: Normal Tutoriel pour Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processus (Avec liste blanche) ================= (Si un élément est inclus dans le fichier fixlist.txt, le processus sera arrêté. Le fichier ne sera pas déplacé.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Kingsoft Corporation) C:\Program Files (x86)\cmcm\Clean Master\cmcore.exe (Index Education) C:\Program Files (x86)\Index Education\Mise a jour automatique\ServiceMiseAJourIndex.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccsvchst.exe () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccsvchst.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler64.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Valve Corporation) D:\Steam\Steam.exe (Akamai Technologies, Inc.) C:\Users\Lyes\AppData\Local\Akamai\netsession_win.exe (Ichrab) C:\Users\Lyes\AppData\Roaming\577830\569311.exe (Ichrab) C:\Users\Lyes\AppData\Roaming\327632\398958.exe (Ichrab) C:\Users\Lyes\AppData\Roaming\560942\420921.exe (Ichrab) C:\Users\Lyes\AppData\Roaming\825115\15435.exe (M%NQ) C:\Program Files\JRS3P32CTL\QUGPP6ZVN.exe (Ichrab) C:\Users\Lyes\AppData\Roaming\613525\544815.exe (Ichrab) C:\Users\Lyes\AppData\Roaming\889881\341778.exe (M%NQ) C:\Program Files\9UQK2C0YPH\GYE62FWIJ.exe (M%NQ) C:\Program Files\FXKMWHK7RN\SMR04GQ8Q.exe (Ichrab) C:\Users\Lyes\AppData\Roaming\447566\739616.exe (Ichrab) C:\Users\Lyes\AppData\Roaming\367970\629821.exe (SteelSeries ApS) C:\Program Files\SteelSeries\SteelSeries Engine 3\SteelSeriesEngine3.exe (Akamai Technologies, Inc.) C:\Users\Lyes\AppData\Local\Akamai\netsession_win.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Settings\MovieColorEnhancer.exe (Samsung Electronics) C:\Program Files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe (CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe (Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Settings\SmartSetting.exe (Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Settings\dmhkcore.exe (Valve Corporation) D:\Steam\bin\cef\cef.win7\steamwebhelper.exe (Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Intel Corporation) C:\Windows\System32\igfxext.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (SAMSUNG Electronics) C:\Program Files (x86)\Samsung\Easy Support Center\SSCKbdHk.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Registre (Avec liste blanche) ==================== (Si un élément est inclus dans le fichier fixlist.txt, l'élément de Registre sera restauré à la valeur par défaut ou supprimé. Le fichier ne sera pas déplacé.) HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [3146704 2017-05-09] (Malwarebytes) HKLM-x32\...\Run: [cmsc] => c:\program files (x86)\cmcm\Clean Master\cmtray.exe [771912 2015-07-22] (Kingsoft Corporation) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [596504 2016-04-01] (Oracle Corporation) Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [Steam] => D:\Steam\steam.exe [3019552 2017-04-26] (Valve Corporation) HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Lyes\AppData\Local\Akamai\netsession_win.exe [4490200 2017-01-03] (Akamai Technologies, Inc.) HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [24763] => C:\Users\Lyes\AppData\Roaming\577830\569311.exe [7680 2017-05-11] (Ichrab) HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [390704] => C:\Users\Lyes\AppData\Roaming\327632\398958.exe [7680 2017-05-11] (Ichrab) HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [691283] => C:\Users\Lyes\AppData\Roaming\560942\420921.exe [7680 2017-05-11] (Ichrab) HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [195881] => C:\Users\Lyes\AppData\Roaming\825115\15435.exe [7680 2017-05-11] (Ichrab) HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [A1ECBFFZRHWNVJ5] => C:\Program Files\JRS3P32CTL\QUGPP6ZVN.exe [1042432 2017-05-11] (M%NQ) HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [F2TA2EH9ZDH3JJD] => "C:\Program Files (x86)\SpeeDownloader\5UPGL.exe" <===== ATTENTION HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [YRFO2EOK76U17VS] => "C:\Program Files (x86)\SpeeDownloader\MUI1X.exe" <===== ATTENTION HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [102045] => C:\Users\Lyes\AppData\Roaming\613525\544815.exe [7680 2017-05-11] (Ichrab) HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [784505] => C:\Users\Lyes\AppData\Roaming\889881\341778.exe [7680 2017-05-11] (Ichrab) HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [6QTJX30F7VO5D0N] => C:\Program Files\9UQK2C0YPH\GYE62FWIJ.exe [1042432 2017-05-11] (M%NQ) HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [JY2J0QZZSTC8UN8] => C:\Program Files\FXKMWHK7RN\SMR04GQ8Q.exe [1042432 2017-05-11] (M%NQ) HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [609948] => C:\Users\Lyes\AppData\Roaming\447566\739616.exe [7680 2017-05-11] (Ichrab) HKU\S-1-5-21-785650546-1832744181-4140763645-1001\...\Run: [941335] => C:\Users\Lyes\AppData\Roaming\367970\629821.exe [7680 2017-05-11] (Ichrab) HKU\S-1-5-18\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [50378880 2015-12-29] (Skype Technologies S.A.) HKU\S-1-5-18\...\Run: [Norton Download Manager{NIS2250215-SHPD-FSD51083}] => C:\Users\Public\Downloads\Norton\{NIS2250215-SHPD-FSD51083}\FSDUI_Custom.exe [1110856 2015-08-23] (Symantec Corporation) HKLM\...\Providers\b33ryqvq: C:\Program Files (x86)\Cikotherqitution Mapper\local64spl.dll [314880 2017-05-11] () ShellExecuteHooks: Pas de nom - {A891CC98-3172-11E7-A610-64006A5CFC23} - C:\Users\Lyes\AppData\Roaming\Vureingaretosy\Coreghatuvery.dll [149504 2017-05-11] () ShellIconOverlayIdentifiers-x32: [###MegaShellExtPending] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\Lyes\AppData\Local\MEGAsync\ShellExtX32.dll -> Pas de fichier ShellIconOverlayIdentifiers-x32: [###MegaShellExtSynced] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\Lyes\AppData\Local\MEGAsync\ShellExtX32.dll -> Pas de fichier ShellIconOverlayIdentifiers-x32: [###MegaShellExtSyncing] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\Lyes\AppData\Local\MEGAsync\ShellExtX32.dll -> Pas de fichier Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SteelSeries Engine 3.lnk [2016-03-28] ShortcutTarget: SteelSeries Engine 3.lnk -> C:\Program Files\SteelSeries\SteelSeries Engine 3\SteelSeriesEngine3.exe (SteelSeries ApS) Startup: C:\Users\thelyes38\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk [2013-06-05] ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () GroupPolicy: Restriction - Chrome <======= ATTENTION CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION ==================== Internet (Avec liste blanche) ==================== (Si un élément est inclus dans le fichier fixlist.txt, s'il s'agit d'un élément du Registre, il sera supprimé ou restauré à la valeur par défaut.) Hosts: Il y a plus d'un élément dans hosts. Voir la section Hosts de Addition.txt Tcpip\..\Interfaces\{7FF6CFDD-8D07-4C4E-802C-CB5243D83D73}: [DhcpNameServer] 192.168.0.254 Internet Explorer: ================== HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = HKU\S-1-5-21-785650546-1832744181-4140763645-1001\Software\Microsoft\Internet Explorer\Main,Start Page = URLSearchHook: HKLM-x32 -> Par défaut = {FE69C007-C452-4d3e-86D2-1730DF8BC871} URLSearchHook: HKLM-x32 - (Pas de nom) - {f8ffcec7-6050-4413-a8d3-0e89eefa07e9} - Pas de fichier SearchScopes: HKLM -> DefaultScope {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = SearchScopes: HKLM -> {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL = SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-785650546-1832744181-4140763645-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-785650546-1832744181-4140763645-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-785650546-1832744181-4140763645-1001 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q={searchTerms}&src=IE-SearchBox SearchScopes: HKU\S-1-5-21-785650546-1832744181-4140763645-1001 -> {A531D99C-5A22-449b-83DA-872725C6D0ED} URL = hxxp://search.alot.com/web?q={searchTerms}&pr=prov&client_id=6ABBFE9001CD74CF0006ACA3&install_time=2012-08-07T19:04:10Z&src_id=31273&camp_id=5335&tb_version=1.2.2000.2(B) SearchScopes: HKU\S-1-5-21-785650546-1832744181-4140763645-1001 -> {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL = BHO: seaoveInsuhop -> {1e84176e-8052-4d1a-a7b3-31ba95f47a07} -> C:\Program Files\seaoveInsuhop\rTxfuVxQFJTs3j.x64.dll => Pas de fichier BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_91\bin\ssv.dll [2016-05-22] (Oracle Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_91\bin\jp2ssv.dll [2016-05-22] (Oracle Corporation) BHO-x32: seaoveInsuhop -> {1e84176e-8052-4d1a-a7b3-31ba95f47a07} -> C:\Program Files\seaoveInsuhop\rTxfuVxQFJTs3j.dll => Pas de fichier BHO-x32: Symantec NCO BHO -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll [2012-06-07] (Symantec Corporation) BHO-x32: Symantec Intrusion Prevention -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\IPS\IPSBHO.DLL [2011-03-31] (Symantec Corporation) DPF: HKLM-x32 {E6F480FC-BD44-4CBA-B74A-89AF7842937D} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.5.1.0.cab Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - Pas de fichier Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - Pas de fichier Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-03-21] (Microsoft Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies) Handler: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Pas de fichier Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Pas de fichier StartMenuInternet: IEXPLORE.EXE - iexplore.exe FireFox: ======== FF ProfilePath: C:\Users\Lyes\AppData\Roaming\Mozilla\Firefox\Profiles\px3zgbob.default-1462454426021 [2017-05-13] FF user.js: detected! => C:\Users\Lyes\AppData\Roaming\Mozilla\Firefox\Profiles\px3zgbob.default-1462454426021\user.js [2016-11-23] FF SelectedSearchEngine: Mozilla\Firefox\Profiles\px3zgbob.default-1462454426021 -> initialpage123 FF Keyword.URL: Mozilla\Firefox\Profiles\px3zgbob.default-1462454426021 -> user_pref("keyword.URL", true); FF SearchPlugin: C:\Users\Lyes\AppData\Roaming\Mozilla\Firefox\Profiles\px3zgbob.default-1462454426021\searchplugins\b33ryqvq.xml [2017-05-11] FF Extension: (Skype Click to Call) - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-04-12] [non signé] FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\IPSFFPlgn FF Extension: (Symantec Intrusion Prevention) - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\IPSFFPlgn [2017-05-13] [non signé] FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\coFFPlgn_2011_7_13_2 FF Extension: (Norton Toolbar) - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\coFFPlgn_2011_7_13_2 [2017-05-13] [non signé] FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_25_0_0_171.dll [2017-05-09] () FF Plugin: @java.com/DTPlugin,version=11.91.2 -> C:\Program Files\Java\jre1.8.0_91\bin\dtplugin\npDeployJava1.dll [2016-05-22] (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.91.2 -> C:\Program Files\Java\jre1.8.0_91\bin\plugin2\npjp2.dll [2016-05-22] (Oracle Corporation) FF Plugin: @microsoft.com/GENUINE -> disabled [Pas de fichier] FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll [2014-02-14] ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_25_0_0_171.dll [2017-05-09] () FF Plugin-x32: @java.com/DTPlugin,version=10.10.2 -> C:\windows\SysWOW64\npDeployJava1.dll [2012-12-26] (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Pas de fichier] FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2011-04-05] (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2017-03-28] (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-785650546-1832744181-4140763645-1001: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Lyes\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [2014-07-24] (Skype Limited) FF Plugin HKU\S-1-5-21-785650546-1832744181-4140763645-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Lyes\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-03-27] (Unity Technologies ApS) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2017-03-28] (Adobe Systems Inc.) StartMenuInternet: FIREFOX.EXE - firefox.exe Chrome: ======= CHR DefaultProfile: Default CHR HomePage: Default -> hxxps://www.google.fr/ CHR StartupUrls: Default -> "hxxps://www.google.fr/" CHR DefaultSearchURL: Default -> hxxp://srch.bar/{searchTerms} CHR DefaultSuggestURL: Default -> hxxp://srch.bar/?s={searchTerms} CHR Profile: C:\Users\Lyes\AppData\Local\Google\Chrome\User Data\Default [2017-05-13] CHR Extension: (Angry Birds) - C:\Users\Lyes\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj [2015-01-23] [UpdateUrl: hxxps://epicunitscan.info/00service/update2/crx] <==== ATTENTION CHR Extension: (Adblock Plus) - C:\Users\Lyes\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2017-03-21] CHR Extension: (Session Buddy) - C:\Users\Lyes\AppData\Local\Google\Chrome\User Data\Default\Extensions\edacconmaakjimmfgnblocblbcdcpbko [2017-05-08] CHR Extension: (Animal Crossing Music) - C:\Users\Lyes\AppData\Local\Google\Chrome\User Data\Default\Extensions\fcedlaimpcfgpnfdgjbmmfibkklpioop [2017-05-01] CHR Extension: (YouTube Plus) - C:\Users\Lyes\AppData\Local\Google\Chrome\User Data\Default\Extensions\nkdalpbojfdilmiboaiedicdbigdabpb [2017-04-02] CHR Extension: (Paiements via le Chrome Web Store) - C:\Users\Lyes\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-10] CHR Extension: (Chrome Media Router) - C:\Users\Lyes\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-04-04] CHR HKLM\...\Chrome\Extension: [ehlceeijggpdgfcefmipcmdelickjgfg] - hxxps://clients2.google.com/service/update2/crx CHR HKLM\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx CHR HKU\S-1-5-21-785650546-1832744181-4140763645-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [dbaonaocldpohelilahfhnkmjankmbcc] - hxxps://clients2.google.com/service/update2/crx CHR HKU\S-1-5-21-785650546-1832744181-4140763645-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [ehlceeijggpdgfcefmipcmdelickjgfg] - hxxps://clients2.google.com/service/update2/crx CHR HKU\S-1-5-21-785650546-1832744181-4140763645-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [ehlceeijggpdgfcefmipcmdelickjgfg] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx StartMenuInternet: Google Chrome.UPV2WNZYCMBHTGYPTYEAJRZXIY - C:\Users\Lyes\AppData\Local\Google\Chrome\Application\chrome.exe ==================== Services (Avec liste blanche) ==================== (Si un élément est inclus dans le fichier fixlist.txt, il sera supprimé du Registre. Le fichier ne sera pas déplacé, sauf s'il est inscrit séparément.) S3 BRSptStub; C:\ProgramData\BitRaider\BRSptStub.exe [363208 2016-03-15] (BitRaider, LLC) R2 cmcore; c:\program files (x86)\cmcm\Clean Master\cmcore.exe [315208 2015-07-22] (Kingsoft Corporation) R2 MajIndexEducationService; C:\Program Files (x86)\Index Education\Mise a jour automatique\ServiceMiseAJourIndex.exe [3050984 2017-03-15] (Index Education) S2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4470736 2017-05-09] (Malwarebytes) R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe [130008 2011-04-17] (Symantec Corporation) R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe [244904 2009-12-01] () [Fichier non signé] R2 Themes; C:\windows\system32\themeservice.dll [44544 2015-03-29] (Microsoft Corporation) [Fichier non signé] S3 iPod Service; "C:\Program Files\iPod\bin\iPodService.exe" [X] S2 MBAMScheduler; "\mbamscheduler.exe" [X] S3 McComponentHostService; "C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe" [X] ===================== Pilotes (Avec liste blanche) ====================== (Si un élément est inclus dans le fichier fixlist.txt, il sera supprimé du Registre. Le fichier ne sera pas déplacé, sauf s'il est inscrit séparément.) R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20120928.001\BHDrvx64.sys [1385120 2012-09-01] (Symantec Corporation) S3 BRDriver64_1_3_3_E02B25FC; C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver64.sys [78088 2016-03-16] (BitRaider) S3 dtlitescsibus; C:\windows\System32\DRIVERS\dtlitescsibus.sys [30264 2017-05-08] (Disc Soft Ltd) S3 dtliteusbbus; C:\windows\System32\DRIVERS\dtliteusbbus.sys [47672 2017-05-08] (Disc Soft Ltd) R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2012-09-15] (Symantec Corporation) R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [138912 2012-09-15] (Symantec Corporation) R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20121005.002\IDSvia64.sys [513184 2012-09-01] (Symantec Corporation) R3 ksapi64; C:\windows\system32\drivers\ksapi64.sys [56680 2015-05-06] (Kingsoft Corporation) R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [43968 2017-05-13] (Malwarebytes) S3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [84256 2017-05-13] (Malwarebytes) S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20121005.018\ENG64.SYS [126112 2012-09-15] (Symantec Corporation) S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20121005.018\EX64.SYS [2084000 2012-09-15] (Symantec Corporation) S3 PVUSB; C:\windows\System32\DRIVERS\CESG64.sys [63808 2007-02-19] (CASIO COMPUTER CO.,LTD.) S3 rtport; C:\windows\SysWOW64\drivers\rtport.sys [15144 2011-10-06] (Windows (R) 2003 DDK 3790 provider) S3 Sftfs; C:\windows\System32\DRIVERS\Sftfswin7.sys [768680 2013-06-27] (Microsoft Corporation) S3 Sftplay; C:\windows\System32\DRIVERS\Sftplaywin7.sys [273576 2013-06-27] (Microsoft Corporation) S3 Sftredir; C:\windows\System32\DRIVERS\Sftredirwin7.sys [29352 2013-06-27] (Microsoft Corporation) S3 Sftvol; C:\windows\System32\DRIVERS\Sftvolwin7.sys [23208 2013-06-27] (Microsoft Corporation) R2 SGDrv; C:\windows\System32\DRIVERS\SGdrv64.sys [7680 2011-04-11] (Phoenix Technologies Ltd.) S3 SRTSP; C:\windows\System32\Drivers\NISx64\1207020.003\SRTSP64.SYS [744568 2011-03-31] (Symantec Corporation) R1 SRTSPX; C:\windows\system32\drivers\NISx64\1207020.003\SRTSPX64.SYS [40568 2011-03-31] (Symantec Corporation) R3 ssdevfactory; C:\windows\System32\DRIVERS\ssdevfactory.sys [40576 2016-03-09] (SteelSeries ApS) R0 SymDS; C:\windows\System32\drivers\NISx64\1207020.003\SYMDS64.SYS [450680 2011-01-27] (Symantec Corporation) R0 SymEFA; C:\windows\System32\drivers\NISx64\1207020.003\SYMEFA64.SYS [912504 2011-03-15] (Symantec Corporation) R3 SymEvent; C:\windows\system32\Drivers\SYMEVENT64x86.SYS [174200 2012-08-08] (Symantec Corporation) R1 SymIRON; C:\windows\system32\drivers\NISx64\1207020.003\Ironx64.SYS [171128 2011-01-27] (Symantec Corporation) R1 SymNetS; C:\windows\System32\Drivers\NISx64\1207020.003\SYMNETS.SYS [386168 2011-04-21] (Symantec Corporation) S3 IntcAzAudAddService; system32\drivers\RTKVHD64.sys [X] S3 WinRing0_1_2_0; \??\C:\Program Files (x86)\Razer\Razer Game Booster\Driver\WinRing0x64.sys [X] ==================== NetSvcs (Avec liste blanche) =================== (Si un élément est inclus dans le fichier fixlist.txt, il sera supprimé du Registre. Le fichier ne sera pas déplacé, sauf s'il est inscrit séparément.) ==================== Un mois - Créés - fichiers et dossiers ======== (Si un élément est inclus dans le fichier fixlist.txt, le fichier/dossier sera déplacé.) 2017-05-13 15:45 - 2017-05-13 15:46 - 00025194 _____ C:\Users\Lyes\Desktop\FRST.txt 2017-05-13 15:45 - 2017-05-13 15:45 - 02429440 _____ (Farbar) C:\Users\Lyes\Desktop\FRST64.exe 2017-05-13 15:45 - 2017-05-13 15:45 - 00000000 ____D C:\FRST 2017-05-13 15:40 - 2017-05-13 15:40 - 00113592 _____ (Malwarebytes) C:\windows\system32\Drivers\farflt.sys 2017-05-13 15:40 - 2017-05-13 15:40 - 00001867 _____ C:\Users\Public\Desktop\Malwarebytes.lnk 2017-05-13 15:40 - 2017-05-13 15:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes 2017-05-13 15:40 - 2017-05-09 16:37 - 00077440 _____ C:\windows\system32\Drivers\mbae64.sys 2017-05-13 15:39 - 2017-05-13 15:39 - 00000000 ____D C:\Program Files\Malwarebytes 2017-05-13 15:36 - 2017-05-13 15:39 - 63035592 _____ (Malwarebytes ) C:\Users\Lyes\Downloads\mb3-setup-35891.35891-3.1.2.1733.exe 2017-05-13 15:31 - 2017-05-13 15:31 - 00046828 _____ C:\Users\Lyes\Desktop\ZHPCleaner.txt 2017-05-13 15:20 - 2017-05-13 15:20 - 00000828 _____ C:\Users\Lyes\Desktop\ZHPCleaner.lnk 2017-05-13 15:18 - 2017-05-13 15:20 - 02769920 _____ C:\Users\Lyes\Downloads\ZHPCleaner.exe 2017-05-13 14:41 - 2017-05-13 15:00 - 00252280 _____ C:\windows\ntbtlog.txt 2017-05-13 09:18 - 2017-05-13 09:18 - 00023045 _____ C:\Users\Lyes\Desktop\AdwCleaner[C2].txt 2017-05-13 09:01 - 2017-05-13 15:31 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\ZHP 2017-05-13 09:01 - 2017-05-13 15:20 - 00000000 ____D C:\Users\Lyes\AppData\Local\ZHP 2017-05-13 09:01 - 2017-05-13 09:38 - 00000818 _____ C:\Users\Lyes\Desktop\ZHPDiag.lnk 2017-05-13 09:01 - 2017-05-13 09:01 - 02726400 _____ C:\Users\Lyes\Downloads\ZHPDiag3.exe 2017-05-13 08:31 - 2017-05-13 08:32 - 04102600 _____ C:\Users\Lyes\Downloads\adwcleaner_6.046.exe 2017-05-12 21:30 - 2017-05-12 22:30 - 00000197 _____ C:\windows\registry.json 2017-05-11 20:01 - 2017-05-11 20:01 - 00000000 ____D C:\Users\Default\AppData\Local\AdvinstAnalytics 2017-05-11 20:01 - 2017-05-11 20:01 - 00000000 ____D C:\Users\Default User\AppData\Local\AdvinstAnalytics 2017-05-11 19:58 - 2017-05-11 19:58 - 00003672 _____ C:\windows\System32\Tasks\updater 2017-05-11 19:57 - 2017-05-11 19:57 - 00000062 _____ C:\windows\WeatherBuddy.INI 2017-05-11 19:57 - 2017-05-11 19:57 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\367970 2017-05-11 19:56 - 2017-05-11 19:56 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\447566 2017-05-11 19:49 - 2017-05-11 19:49 - 00000000 ____D C:\Users\thelyes38\AppData\Local\Samsung 2017-05-11 19:44 - 2017-05-11 19:44 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\656866 2017-05-11 19:39 - 2017-05-11 19:39 - 00140800 _____ C:\Users\Lyes\AppData\Local\installer.dat 2017-05-11 19:39 - 2017-05-11 19:39 - 00011568 _____ C:\Users\Lyes\AppData\Local\InstallationConfiguration.xml 2017-05-11 19:39 - 2017-05-11 19:39 - 00000000 ____D C:\Users\Lyes\AppData\Local\Arermoghtlertiied 2017-05-11 19:39 - 2017-05-11 19:39 - 00000000 ____D C:\Program Files\FXKMWHK7RN 2017-05-11 19:38 - 2017-05-11 19:39 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\889881 2017-05-11 19:38 - 2017-05-11 19:39 - 00000000 ____D C:\Program Files\9UQK2C0YPH 2017-05-11 19:38 - 2017-05-11 19:38 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\613525 2017-05-11 19:37 - 2017-05-11 19:38 - 00000000 ____D C:\Program Files\JRS3P32CTL 2017-05-11 19:37 - 2017-05-11 19:37 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\825115 2017-05-11 19:37 - 2017-05-11 19:37 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\560942 2017-05-11 19:36 - 2017-05-11 19:37 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\577830 2017-05-11 19:36 - 2017-05-11 19:37 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\327632 2017-05-11 19:34 - 2017-05-11 19:34 - 00000000 ____D C:\Users\Lyes\AppData\Local\CrashRpt 2017-05-11 19:33 - 2017-05-11 19:42 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\Vureingaretosy 2017-05-11 19:33 - 2017-05-11 19:40 - 00000000 ____D C:\Users\Lyes\AppData\Local\Aternapy 2017-05-11 19:33 - 2017-05-11 19:33 - 00006078 _____ C:\windows\System32\Tasks\Cikotherqitution Mapper 2017-05-11 19:33 - 2017-05-11 19:33 - 00000000 ____D C:\Program Files (x86)\Foqersyvidation 2017-05-11 19:33 - 2017-05-11 19:33 - 00000000 ____D C:\Program Files (x86)\Cikotherqitution Mapper 2017-05-10 16:09 - 2017-05-10 16:09 - 01249792 _____ C:\windows\739d99369c57c61ac92a1d88c801facf.exe 2017-05-10 16:09 - 2017-05-10 16:09 - 00051628 _____ C:\windows\uninstaller.dat 2017-05-08 12:14 - 2017-05-08 13:18 - 1474177024 ____R C:\Users\Lyes\Downloads\[nextorrent.net] Rogue.One.2016.TRUEFRENCH.BDRiP.XviD-GZR.avi 2017-05-08 12:13 - 2017-05-08 12:13 - 00029410 _____ C:\Users\Lyes\Downloads\Rogue One- A Star Wars Story TRUEFRENCH DVDRiP 2017.torrent 2017-05-08 08:58 - 2017-05-08 08:58 - 00000000 ____D C:\Users\Lyes\AppData\Local\Disc_Soft_Ltd 2017-05-08 08:55 - 2017-05-08 08:55 - 00000000 ____D C:\Users\Public\Documents\Daemon Tools Images 2017-05-08 08:52 - 2017-05-08 08:52 - 00047672 _____ (Disc Soft Ltd) C:\windows\system32\Drivers\dtliteusbbus.sys 2017-05-08 08:51 - 2017-05-08 08:51 - 00030264 _____ (Disc Soft Ltd) C:\windows\system32\Drivers\dtlitescsibus.sys 2017-05-07 21:54 - 2017-05-07 21:54 - 00019874 _____ C:\Users\Lyes\Desktop\tp sin question lyes.odt 2017-05-07 21:18 - 2017-05-07 21:24 - 58905574 _____ C:\Users\Lyes\Downloads\snapchat-10-7-5-0.apk 2017-05-07 17:38 - 2017-05-07 17:38 - 00034225 _____ C:\Users\Lyes\Downloads\Skyrim legendary edition.torrent 2017-05-07 17:32 - 2017-05-07 17:32 - 00000000 ____D C:\Users\Lyes\AppData\Local\Skyrim 2017-05-07 17:32 - 2017-05-07 17:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Razor 1911 2017-05-07 12:01 - 2017-05-07 12:01 - 00020544 _____ C:\Users\Lyes\Downloads\the-elder-scrolls-v-skyrim-pc.torrent 2017-05-01 11:20 - 2017-05-01 11:20 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\Sony Creative Software Inc 2017-05-01 11:15 - 2017-05-01 11:16 - 30299802 _____ C:\Users\Lyes\Downloads\Débat Présidentielle - Le Raptor Dissident.mp4 2017-04-30 19:08 - 2017-04-30 19:08 - 00001683 _____ C:\Users\Lyes\Desktop\MorphVOXPro - Raccourci.lnk 2017-04-30 19:07 - 2017-04-30 19:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Screaming Bee 2017-04-30 19:07 - 2017-04-30 19:07 - 00000000 ____D C:\Program Files (x86)\Screaming Bee 2017-04-30 14:49 - 2017-04-30 14:49 - 00000000 ____D C:\Users\Lyes\AppData\Local\PonyRPG 2017-04-27 18:59 - 2017-04-27 18:59 - 00400616 _____ C:\Users\Lyes\Downloads\Wario Land II (USA, Europe).zip 2017-04-27 18:51 - 2017-04-27 19:02 - 00000000 ____D C:\Users\Lyes\Desktop\vba 2017-04-27 18:50 - 2017-04-27 18:50 - 01359970 _____ C:\Users\Lyes\Downloads\visualboy-advance-1-8-0-en-win.zip 2017-04-27 18:50 - 2017-04-27 18:50 - 01359970 _____ C:\Users\Lyes\Desktop\visualboy-advance-1-8-0-en-win.zip 2017-04-26 20:37 - 2017-04-26 20:37 - 00016496 _____ C:\Users\Lyes\Downloads\6214216f7bd4b2e228a79b8711b18d4f_futurama-fry-meme-funny-fry-memes_236-252.jpeg 2017-04-26 17:31 - 2017-04-26 17:31 - 00223344 _____ C:\Users\Lyes\Downloads\RAPTOR VS YOUTUBE - Expliquez Moi Cette Merde #8 - YouTube.mp4.sfk 2017-04-26 17:28 - 2017-04-26 17:30 - 17900685 _____ C:\Users\Lyes\Downloads\RAPTOR VS YOUTUBE - Expliquez Moi Cette Merde #8 - YouTube.mp4 2017-04-15 21:07 - 2017-04-15 21:07 - 00000000 ____D C:\Users\Lyes\Documents\Wizards of the Coast 2017-04-15 19:35 - 2017-04-15 19:55 - 00000000 ____D C:\Users\Lyes\Documents\DAVAProject 2017-04-15 19:35 - 2017-04-15 19:35 - 00000202 _____ C:\Users\Lyes\Desktop\Magic Duels.url 2017-04-15 11:40 - 2017-04-15 11:41 - 03514528 _____ C:\Users\Lyes\Downloads\WHAT THE CUT 37 - TEMPLE CÉRÉMONIE ET COSMOS.mp3.sfk 2017-04-15 08:51 - 2017-04-15 08:57 - 01906144 _____ C:\Users\Lyes\Downloads\Joueur du Grenier - LES JEUX DE COMICS #2.mp4.sfk ==================== Un mois - Modifiés - fichiers et dossiers ======== (Si un élément est inclus dans le fichier fixlist.txt, le fichier/dossier sera déplacé.) 2017-05-13 15:40 - 2014-05-08 22:46 - 00251832 _____ (Malwarebytes) C:\windows\system32\Drivers\MBAMSwissArmy.sys 2017-05-13 15:40 - 2014-05-08 22:45 - 00187320 _____ (Malwarebytes) C:\windows\system32\Drivers\mbamchameleon.sys 2017-05-13 15:40 - 2014-05-08 22:45 - 00084256 _____ (Malwarebytes) C:\windows\system32\Drivers\mwac.sys 2017-05-13 15:40 - 2013-01-28 00:30 - 00043968 _____ (Malwarebytes) C:\windows\system32\Drivers\mbam.sys 2017-05-13 15:39 - 2013-01-28 00:30 - 00000000 ____D C:\ProgramData\Malwarebytes 2017-05-13 15:31 - 2012-08-29 15:27 - 00000000 ____D C:\Users\Lyes\AppData\Local\CrashDumps 2017-05-13 15:10 - 2012-08-23 20:06 - 00000000 ____D C:\windows\System32\Tasks\Symantec 2017-05-13 15:09 - 2009-07-14 06:45 - 00028848 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2017-05-13 15:09 - 2009-07-14 06:45 - 00028848 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2017-05-13 15:05 - 2015-08-23 22:36 - 00000000 ____D C:\windows\System32\Tasks\Remediation 2017-05-13 15:01 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT 2017-05-13 14:53 - 2013-03-18 18:27 - 00000000 ____D C:\Users\Lyes\AppData\Local\ElevatedDiagnostics 2017-05-13 13:58 - 2012-08-22 13:53 - 00000924 _____ C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-785650546-1832744181-4140763645-1001UA.job 2017-05-13 13:58 - 2012-08-22 13:53 - 00000902 _____ C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-785650546-1832744181-4140763645-1001Core.job 2017-05-13 11:44 - 2016-11-14 20:48 - 00001201 _____ C:\Users\Lyes\Desktop\nativelog.txt 2017-05-13 11:43 - 2014-01-14 15:28 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\.minecraft 2017-05-13 09:19 - 2015-06-07 08:39 - 00000000 ____D C:\AdwCleaner 2017-05-13 08:38 - 2015-01-15 20:14 - 00000000 ____D C:\windows\system32\log 2017-05-13 08:36 - 2015-04-06 16:24 - 00000000 ____D C:\Users\Lyes\AppData\LocalLow\Company 2017-05-12 22:08 - 2012-08-07 18:29 - 00000000 ____D C:\Users\Lyes 2017-05-12 20:01 - 2012-12-21 19:46 - 00000000 ____D C:\ProgramData\boost_interprocess 2017-05-12 18:56 - 2013-07-20 07:38 - 00000000 ____D C:\Program Files (x86)\NCH Software 2017-05-12 18:55 - 2015-05-10 16:59 - 00000919 _____ C:\Users\Lyes\AppData\Roaming\trace_FilterInstaller.txt 2017-05-12 18:55 - 2015-05-10 16:59 - 00000000 _____ C:\Users\Lyes\AppData\Roaming\trace_FilterInstaller.txt-CRT.txt 2017-05-12 18:12 - 2016-03-24 18:06 - 00002189 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk 2017-05-11 19:46 - 2013-05-04 02:35 - 00084816 _____ C:\Users\thelyes38\AppData\Local\GDIPFONTCACHEV1.DAT 2017-05-10 13:45 - 2015-03-28 08:51 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\vlc 2017-05-09 17:12 - 2017-02-14 18:13 - 05821944 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerInstaller.exe 2017-05-09 17:12 - 2013-05-24 23:05 - 00803320 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe 2017-05-09 17:12 - 2013-05-24 23:05 - 00144888 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl 2017-05-09 17:12 - 2013-05-24 23:05 - 00004484 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater 2017-05-09 17:12 - 2013-05-24 23:05 - 00000000 ____D C:\windows\system32\Macromed 2017-05-09 17:12 - 2011-08-13 06:31 - 00000000 ____D C:\windows\SysWOW64\Macromed 2017-05-08 18:50 - 2017-01-21 14:58 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\uTorrent 2017-05-08 12:20 - 2017-01-25 19:36 - 00000000 ____D C:\Users\Lyes\Desktop\ds sin 2017-05-08 08:55 - 2014-11-22 18:12 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\DAEMON Tools Lite 2017-05-08 08:52 - 2009-07-14 05:20 - 00000000 ____D C:\windows\inf 2017-05-08 08:50 - 2014-11-22 18:10 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite 2017-05-07 19:33 - 2011-08-13 06:37 - 00000000 ____D C:\ProgramData\Norton 2017-05-07 17:32 - 2017-04-08 09:02 - 00000000 ____D C:\Users\Lyes\Documents\My Games 2017-05-05 20:16 - 2014-12-28 22:59 - 00004476 _____ C:\windows\System32\Tasks\Adobe Acrobat Update Task 2017-05-05 20:04 - 2014-11-11 10:54 - 00000290 __RSH C:\ProgramData\ntuser.pol 2017-05-01 17:28 - 2016-11-26 19:30 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\discord 2017-05-01 09:22 - 2011-08-13 21:54 - 00748354 _____ C:\windows\system32\perfh00C.dat 2017-05-01 09:22 - 2011-08-13 21:54 - 00150588 _____ C:\windows\system32\perfc00C.dat 2017-05-01 09:22 - 2009-07-14 07:13 - 01671232 _____ C:\windows\system32\PerfStringBackup.INI 2017-04-30 19:10 - 2016-09-29 20:29 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\Audacity 2017-04-30 19:09 - 2016-11-06 11:49 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\Screaming Bee 2017-04-30 19:07 - 2015-10-04 16:41 - 00000000 ____D C:\ProgramData\Package Cache 2017-04-28 23:44 - 2009-07-14 07:08 - 00032496 _____ C:\windows\Tasks\SCHEDLGU.TXT 2017-04-28 09:30 - 2014-07-17 14:49 - 00003500 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA1cfa1bd8fea3151 2017-04-28 09:30 - 2014-07-17 14:49 - 00003372 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore1cfa1bd8f772282 2017-04-27 22:17 - 2015-09-25 20:04 - 00000000 ____D C:\Users\Lyes\Downloads\runtime 2017-04-17 11:12 - 2014-03-07 11:14 - 00000000 ____D C:\Users\Lyes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam 2017-04-14 18:30 - 2014-08-11 22:17 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk ==================== Fichiers à la racine de certains dossiers ======= 2014-08-20 09:44 - 2014-08-20 09:44 - 6010880 _____ () C:\Program Files (x86)\GUT3CBE.tmp 2014-07-19 20:28 - 2014-07-20 00:44 - 6010880 _____ () C:\Program Files (x86)\GUT8B0B.tmp 2014-08-01 13:51 - 2014-08-02 23:37 - 6010880 _____ () C:\Program Files (x86)\GUTE6D6.tmp 2016-07-14 07:44 - 2016-07-14 07:44 - 2174976 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\Common Files\atimpenc.dll 2012-08-30 21:56 - 2012-08-30 21:56 - 0000006 _____ () C:\Program Files (x86)\Common Files\WPVersion.txt 2015-05-22 00:06 - 2015-12-28 09:24 - 0000024 _____ () C:\Users\Lyes\AppData\Roaming\appdataFr25.bin 2015-02-06 10:00 - 2015-05-21 23:56 - 0000020 _____ () C:\Users\Lyes\AppData\Roaming\appdataFr3.bin 2014-04-03 01:19 - 2014-04-03 01:19 - 0000036 _____ () C:\Users\Lyes\AppData\Roaming\DOK52P4Q3J.dat 2017-02-11 18:09 - 2017-02-12 16:00 - 0000101 _____ () C:\Users\Lyes\AppData\Roaming\infos.properties 2014-07-22 23:22 - 2014-07-22 23:22 - 0000036 _____ () C:\Users\Lyes\AppData\Roaming\SuYZkvrV.tmp 2015-05-10 16:59 - 2015-05-10 16:59 - 0001181 _____ () C:\Users\Lyes\AppData\Roaming\trace_FilterInstaller.1.txt 2015-05-10 16:59 - 2017-05-12 18:55 - 0000919 _____ () C:\Users\Lyes\AppData\Roaming\trace_FilterInstaller.txt 2015-05-10 16:59 - 2017-05-12 18:55 - 0000000 _____ () C:\Users\Lyes\AppData\Roaming\trace_FilterInstaller.txt-CRT.txt 2015-11-18 15:39 - 2015-11-18 15:39 - 0021028 _____ () C:\Users\Lyes\AppData\Roaming\UserTile.png 2017-01-11 14:03 - 2017-03-15 13:55 - 0000256 _____ () C:\Users\Lyes\AppData\Roaming\WB.CFG 2012-05-03 13:12 - 2012-05-03 13:12 - 0000532 _____ () C:\Users\Lyes\AppData\Local\datos.txt 2014-11-24 21:17 - 2014-11-24 21:17 - 0022528 _____ () C:\Users\Lyes\AppData\Local\dsisetup33579522.exe 2014-12-02 18:41 - 2014-12-02 18:41 - 0022528 _____ () C:\Users\Lyes\AppData\Local\dsisetup788083822.exe 2017-05-11 19:39 - 2017-05-11 19:39 - 0011568 _____ () C:\Users\Lyes\AppData\Local\InstallationConfiguration.xml 2017-05-11 19:39 - 2017-05-11 19:39 - 0140800 _____ () C:\Users\Lyes\AppData\Local\installer.dat 2014-02-05 22:08 - 2014-02-05 22:08 - 0193744 _____ () C:\Users\Lyes\AppData\Local\lateral1.bmp 2010-11-12 11:10 - 2010-11-12 11:10 - 0193744 _____ () C:\Users\Lyes\AppData\Local\lateral2.bmp 2014-02-05 22:10 - 2014-02-05 22:10 - 0195108 _____ () C:\Users\Lyes\AppData\Local\lateral3.bmp 2015-09-27 10:17 - 2015-09-27 10:17 - 0000955 _____ () C:\Users\Lyes\AppData\Local\recently-used.xbel 2014-02-05 23:50 - 2014-02-05 23:50 - 0043976 _____ () C:\Users\Lyes\AppData\Local\save_en.bmp 2014-02-05 23:49 - 2014-02-05 23:49 - 0043976 _____ () C:\Users\Lyes\AppData\Local\save_es.bmp 2016-03-11 18:51 - 2016-03-11 18:51 - 0000000 _____ () C:\Users\Lyes\AppData\Local\{56B1AC0F-FE36-4B88-B6CB-8D6AFC4AF003} 2016-03-05 23:28 - 2016-03-05 23:28 - 0000000 _____ () C:\Users\Lyes\AppData\Local\{C63BCE57-37D3-4E86-9FAF-A7DAFDF40B70} 2016-03-12 23:01 - 2016-03-12 23:01 - 0000000 _____ () C:\Users\Lyes\AppData\Local\{F0E0F900-0CFA-4A8A-8EA6-E3DB8F460924} 2012-08-08 17:34 - 2012-08-08 17:34 - 0000056 ____H () C:\ProgramData\ezsidmv.dat 2012-08-30 22:07 - 2012-08-30 22:07 - 0000097 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc 2015-09-19 15:38 - 2015-09-19 15:38 - 0004105 _____ () C:\ProgramData\wmzddnmb.cix 2011-08-13 07:31 - 2011-08-13 07:32 - 0000109 _____ () C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log 2011-08-13 07:26 - 2011-08-13 07:26 - 0000113 _____ () C:\ProgramData\{34FBC7C4-CD31-4D93-A428-0E524EAC4586}.log 2011-08-13 07:29 - 2011-08-13 07:30 - 0000105 _____ () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log 2011-08-13 07:26 - 2011-08-13 07:29 - 0000106 _____ () C:\ProgramData\{80E158EA-7181-40FE-A701-301CE6BE64AB}.log 2011-08-13 07:30 - 2011-08-13 07:31 - 0000110 _____ () C:\ProgramData\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}.log Fichiers à déplacer ou supprimer: ==================== C:\Users\Lyes\update-walking-dead.bat C:\Users\Lyes\worldpainter_1.2.5.exe C:\Users\Lyes\worldpainter_1.4.0.exe Certains fichiers dans TEMP: ==================== 2017-05-11 19:37 - 2017-05-11 19:37 - 0524972 _____ (WeMonetize ) C:\Users\Lyes\AppData\Local\Temp\1X4TVSQ.exe 2017-05-11 19:37 - 2017-05-11 19:37 - 0524972 _____ (WeMonetize ) C:\Users\Lyes\AppData\Local\Temp\7INM3P0.exe 2017-05-11 19:56 - 2017-05-11 19:56 - 0363008 _____ (M%NQ) C:\Users\Lyes\AppData\Local\Temp\HWAAY9OG0XVN.exe 2017-05-10 13:05 - 2017-05-10 13:05 - 3190104 _____ (Lead IT) C:\Users\Lyes\AppData\Local\Temp\pdD3dFNr-prog.exe 2017-05-10 13:05 - 2017-05-10 13:05 - 0140872 _____ () C:\Users\Lyes\AppData\Local\Temp\pdD3dFNr-upd.exe 2017-05-10 13:05 - 2017-05-10 13:05 - 2988888 _____ (IT Genius) C:\Users\Lyes\AppData\Local\Temp\W3rlsPaZ-prog.exe 2013-06-26 04:19 - 2013-06-26 04:20 - 31668328 _____ (Skype Technologies S.A.) C:\Users\thelyes38\AppData\Local\Temp\SkypeSetup.exe ==================== Bamital & volsnap ====================== (Il n'y a pas de correction automatique pour les fichiers qui ne satisfont pas à la vérification.) C:\windows\system32\winlogon.exe => Le fichier est signé numériquement C:\windows\system32\wininit.exe => Le fichier est signé numériquement C:\windows\SysWOW64\wininit.exe => Le fichier est signé numériquement C:\windows\explorer.exe => Le fichier est signé numériquement C:\windows\SysWOW64\explorer.exe => Le fichier est signé numériquement C:\windows\system32\svchost.exe => Le fichier est signé numériquement C:\windows\SysWOW64\svchost.exe => Le fichier est signé numériquement C:\windows\system32\services.exe => Le fichier est signé numériquement C:\windows\system32\User32.dll => Le fichier est signé numériquement C:\windows\SysWOW64\User32.dll => Le fichier est signé numériquement C:\windows\system32\userinit.exe => Le fichier est signé numériquement C:\windows\SysWOW64\userinit.exe => Le fichier est signé numériquement C:\windows\system32\rpcss.dll => Le fichier est signé numériquement C:\windows\system32\dnsapi.dll => Le fichier est signé numériquement C:\windows\SysWOW64\dnsapi.dll => Le fichier est signé numériquement C:\windows\system32\Drivers\volsnap.sys => Le fichier est signé numériquement testsigning: ==> 'testsigning' est activé. Rechercher un éventuel pilote non signé <===== ATTENTION LastRegBack: 2017-05-03 00:00 ==================== Fin de FRST.txt ============================