OTL logfile created on: 8/6/2017 6:15:43 PM - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Zine\Downloads Starter Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.11.9600.18349) Locale: 00000409 | Country: France | Language: FRA | Date Format: dd/MM/yyyy 1.99 Gb Total Physical Memory | 0.56 Gb Available Physical Memory | 28.30% Memory free 3.98 Gb Paging File | 2.12 Gb Available in Paging File | 53.14% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files Drive C: | 142.95 Gb Total Space | 11.72 Gb Free Space | 8.20% Space Free | Partition Type: NTFS Drive G: | 139.85 Gb Total Space | 7.48 Gb Free Space | 5.35% Space Free | Partition Type: NTFS Computer Name: ZINE-HP | User Name: Zine | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - C:\Users\Zine\Downloads\OTL.exe (OldTimer Tools) PRC - C:\Program Files\Firefox\bin\FirefoxUpdate.exe () PRC - C:\Users\Zine\AppData\Local\background_fault\aswRD.exe (AVAST Software) PRC - C:\Program Files\Elex-tech\YAC\iSafeTray.exe (Elex do Brasil Participações Ltda) PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) PRC - C:\Program Files\Canrain\Application\chrome.exe (Google Inc.) PRC - C:\Program Files\amulell\ed2k.exe (http://www.amuleall.org/) PRC - C:\Program Files\Elex-tech\YAC\iSafeSvc.exe (Elex do Brasil Participações Ltda) PRC - C:\Program Files\Elex-tech\YAC\iSafeSvc2.exe (Elex do Brasil Participações Ltda) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Program Files\Microsoft Security Client\NisSrv.exe (Microsoft Corporation) PRC - C:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation) PRC - C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation) PRC - C:\Program Files\Nero\Update\NASvc.exe (Nero AG) PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation) PRC - C:\Program Files\winaero.com\Personalization Panel DWM Controller\persdwmsrv.exe (http://winaero.com/) PRC - C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation) PRC - C:\Program Files\Tahoe Design Software\HCALC\1.1\HCALC.exe (Tahoe Design Software) PRC - C:\Windows\System32\spool\drivers\w32x86\3\CNAP2LAK.EXE (CANON INC.) PRC - C:\Windows\System32\spool\drivers\w32x86\3\CNAP2RPK.EXE (CANON INC.) PRC - C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe (Broadcom Corporation.) PRC - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.) PRC - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.) PRC - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe ( Hewlett-Packard Development Company, L.P.) PRC - C:\Program Files\LSI SoftModem\agrsmsvc.exe (LSI Corporation) PRC - C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.) PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_b3d7bbbd6875f4bb\stacsv.exe (IDT, Inc.) PRC - C:\Program Files\PDF Complete\pdfsvc.exe (PDF Complete Inc) PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe (Intel Corporation) PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation) PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_b3d7bbbd6875f4bb\AEstSrv.exe (Andrea Electronics Corporation) PRC - C:\Program Files\Microsoft Encarta\Microsoft Encarta 2009 - Collection DVD\EDICT.EXE (Microsoft Corporation) PRC - C:\Windows\System32\spool\drivers\w32x86\3\CNAB8SWK.EXE (CANON INC.) PRC - C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.) PRC - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe (InterVideo) PRC - C:\Program Files\RCrawler\rcrawler.exe (4Developers LLC) [color=#E56717]========== Modules (No Company Name) ==========[/color] MOD - C:\Users\Zine\AppData\Local\background_fault\bf.dll () MOD - C:\Program Files\Canrain\Application\libglesv2.dll () MOD - C:\Program Files\Canrain\Application\libegl.dll () MOD - C:\Program Files\Elex-tech\YAC\zlib1.dll () MOD - C:\Program Files\Elex-tech\YAC\libpng.dll () MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Management\fdef4c991303c17ece877574f240249f\System.Management.ni.dll () MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\78c8b0ab8f27ddeddbc1fe89bd51b716\PresentationFramework.Classic.ni.dll () MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\77248929224228e8150eea45de075401\System.Runtime.Remoting.ni.dll () MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Data\8687e43ef23de4f9262530d943886112\System.Data.ni.dll () MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\066eb2adc7523ed93c98ecdf1abc50af\PresentationFramework.ni.dll () MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\c0f9cb97c68eb938bd0b36f7ee90e60f\System.Windows.Forms.ni.dll () MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6f4f738362752c5d3a2c9234d604784d\System.Drawing.ni.dll () MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\5582ea5a2f2d3c2e0ad6f50cf49efec8\PresentationCore.ni.dll () MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\b307bd80b0707bfa6ea87eb69a8e15eb\WindowsBase.ni.dll () MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ef4a32979d02a76972d22c8161778f10\System.Xml.ni.dll () MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\c8b82d8b2e7e18c7caf27b8017c6c615\System.Configuration.ni.dll () MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System\67c97ffbe01458a63ecb518c7444c1f1\System.ni.dll () MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationTypes\61bea915a98d92c2748dc18d5fc594a7\UIAutomationTypes.ni.dll () MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\38bf604432e1a30c954b2ee40d6a2d1c\mscorlib.ni.dll () MOD - C:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll () MOD - C:\windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_fr_b77a5c561934e089\mscorlib.resources.dll () MOD - C:\Program Files\WinRAR\rarext.dll () MOD - C:\Program Files\Common Files\LightScribe\QtGui4.dll () MOD - C:\Program Files\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll () MOD - C:\Program Files\Common Files\LightScribe\QtCore4.dll () MOD - C:\windows\assembly\GAC_MSIL\PresentationFramework.resources\3.0.0.0_fr_31bf3856ad364e35\PresentationFramework.resources.dll () MOD - C:\windows\assembly\GAC_MSIL\PresentationCore.resources\3.0.0.0_fr_31bf3856ad364e35\PresentationCore.resources.dll () MOD - C:\windows\assembly\GAC_MSIL\WindowsBase.resources\3.0.0.0_fr_31bf3856ad364e35\WindowsBase.resources.dll () MOD - C:\windows\assembly\GAC_MSIL\HP.ActiveSupportLibrary\2.0.0.1__01a974bc1760f423\HP.ActiveSupportLibrary.dll () MOD - C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll () MOD - C:\Program Files\Hewlett-Packard\HP Advisor\Pillars\PCAlerts\PCAlertsPillar.dll () MOD - C:\Program Files\Hewlett-Packard\HP Advisor\Pillars\ECenter\ECLibrary.dll () MOD - C:\Program Files\Hewlett-Packard\HP Advisor\MessagingServer.dll () MOD - C:\Program Files\Hewlett-Packard\HP Advisor\MessagingClients.dll () MOD - C:\Program Files\Hewlett-Packard\HP Advisor\RemotingClient.dll () MOD - C:\Program Files\Hewlett-Packard\HP Advisor\MessagingInterface.dll () MOD - C:\Program Files\Hewlett-Packard\HP Advisor\MessagingMessages.dll () MOD - C:\Program Files\Hewlett-Packard\HP Advisor\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.Logging.dll () MOD - C:\Program Files\Common Files\Microsoft Shared\Reference 2009\MSENCXML.DLL () MOD - C:\Program Files\Common Files\Microsoft Shared\Reference 2009\MSENCDAT.DLL () MOD - C:\Program Files\Common Files\Microsoft Shared\Reference 2009\ERSREGPR.DLL () MOD - C:\Program Files\Common Files\Microsoft Shared\Reference 2009\ENCCONT.DLL () MOD - C:\Program Files\Microsoft Encarta\Microsoft Encarta 2009 - Collection DVD\EDICTEIT.EBK () [color=#E56717]========== Services (SafeList) ==========[/color] SRV - (wiasvc) -- C:\ProgramData\Microsoft\Windows\Image\capCADF.tmp:ad File not found SRV - (iThemes5) -- rundll32 C:\Program Files\Common Files\Services\iThemes.dll,fnde_svr File not found SRV - (HPCurator Service) -- C:\Users\Zine\AppData\Roaming\HPCurator\HPCuratorSrv.exe File not found SRV - (terana) -- C:\Users\Zine\AppData\Local\terana\terana.dll (IntertSect Alliance Pty Ltd) SRV - (FirefoxU) -- C:\Program Files\Firefox\bin\FirefoxUpdate.exe () SRV - (WinSAPSvc) -- C:\Users\Zine\AppData\Roaming\WinSAPSvc\winSAP.dll () SRV - (BIT) -- C:\ProgramData\BIT\BIT.dll (TODO: <公司名>) SRV - (snare) -- C:\Users\Zine\AppData\Local\snare\Snare.dll (IntertSect Alliance Pty Ltd) SRV - (CSHMDR) -- C:\Users\Zine\AppData\Local\CSHMDR\Snare.dll (IntertSect Alliance Pty Ltd) SRV - (CWASRE) -- C:\Users\Zine\AppData\Local\CWASRE\Snare.dll (IntertSect Alliance Pty Ltd) SRV - (NPASRE) -- C:\Users\Zine\AppData\Local\NPASRE\Snare.dll (InterSect Alliance Pty Ltd) SRV - (VNASRE) -- C:\Users\Zine\AppData\Local\VNASRE\Snare.dll (InterSect Alliance Pty Ltd) SRV - (WindowsAppSvc) -- C:\ProgramData\Microsoft\Apps\common\helper.dll () SRV - (ANSARE) -- C:\Users\Zine\AppData\Local\ANSARE\Snare.dll (InterSect Alliance Pty Ltd) SRV - (Kitty) -- C:\Users\Zine\AppData\Local\Kitty\Kitty.dll (word) SRV - (AdobeARMservice) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (3DM) -- C:\Users\Zine\AppData\Local\3DM\Kitty.dll (kitty.exe) SRV - (SNARER) -- C:\Users\Zine\AppData\Local\SNARER\Snarer.dll (InterSect Alliance Pty Ltd) SRV - (WINSNARE) -- C:\Users\Zine\AppData\Roaming\WINSNARE\WinSnare.dll (InterSect Alliance Pty Ltd) SRV - (MVCSrv) -- C:\ProgramData\Package Cache\{0C8D9D70-FA5A-4CA9-763F-D8D93BC099B6}v10.1.14393.795\Installers\Universal_CRT_Tools_x86-x86_en-us.dll () SRV - (ed2kidle) -- C:\Program Files\amulell\ed2k.exe (http://www.amuleall.org/) SRV - (bilibili) -- C:\Program Files\bilibili\bilibili.dll () SRV - (GubedZL) -- C:\Program Files\Gubed\GubedZL.dll () SRV - (MSLN) -- C:\ProgramData\Microsoft\Phone Tools\CoreCon\12.0\3082\NonSDKAddonLangVer.dll () SRV - (iSafeService) -- C:\Program Files\Elex-tech\YAC\iSafeSvc.exe (Elex do Brasil Participações Ltda) SRV - (NovaPdfServer) -- C:\Program Files\Softland\novaPDF 8\Server\novapdfs.exe (Microsoft) SRV - (IEEtwCollectorService) -- C:\windows\System32\IEEtwCollector.exe (Microsoft Corporation) SRV - (NisSrv) -- C:\Program Files\Microsoft Security Client\NisSrv.exe (Microsoft Corporation) SRV - (MsMpSvc) -- C:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation) SRV - (MozillaMaintenance) -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (DiagTrack) -- C:\Windows\System32\diagtrack.dll (Microsoft Corporation) SRV - (NAUpdate) -- C:\Program Files\Nero\Update\NASvc.exe (Nero AG) SRV - (SkypeUpdate) -- C:\Program Files\Skype\Updater\Updater.exe (Skype Technologies) SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.) SRV - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation) SRV - (persdwmsrv) -- C:\Program Files\winaero.com\Personalization Panel DWM Controller\persdwmsrv.exe (http://winaero.com/) SRV - (BBSvc) -- C:\Program Files\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.) SRV - (BBUpdate) -- C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation) SRV - (btwdins) -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.) SRV - (AgereModemAudio) -- C:\Program Files\LSI SoftModem\agrsmsvc.exe (LSI Corporation) SRV - (STacSV) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_b3d7bbbd6875f4bb\stacsv.exe (IDT, Inc.) SRV - (pdfcDispatcher) -- C:\Program Files\PDF Complete\pdfsvc.exe (PDF Complete Inc) SRV - (IAANTMON) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe (Intel Corporation) SRV - (RoxMediaDB10) -- c:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe (Sonic Solutions) SRV - (AESTFilters) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_b3d7bbbd6875f4bb\AEstSrv.exe (Andrea Electronics Corporation) SRV - (PSI_SVC_2) -- C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.) SRV - (IviRegMgr) -- C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe (InterVideo) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - (iSafeKrnlBoot) -- system32\DRIVERS\iSafeKrnlBoot.sys File not found DRV - (iSafeKrnl) -- C:\Program Files\Elex-tech\YAC\iSafeKrnl.sys (Elex do Brasil Participações Ltda) DRV - (iSafeKrnlKit) -- C:\Program Files\Elex-tech\YAC\iSafeKrnlKit.sys (Elex do Brasil Participações Ltda) DRV - (iSafeKrnlMon) -- C:\Program Files\Elex-tech\YAC\iSafeKrnlMon.sys (Elex do Brasil Participações Ltda) DRV - (iSafeKrnlR3) -- C:\Program Files\Elex-tech\YAC\iSafeKrnlR3.sys (Elex do Brasil Participações Ltda) DRV - (iSafeNetFilter) -- C:\Windows\System32\drivers\iSafeNetFilter.sys (Elex do Brasil Participações Ltda) DRV - (TPM) -- C:\Windows\System32\drivers\tpm.sys (Microsoft Corporation) DRV - (NisDrv) -- C:\Windows\System32\drivers\NisDrvWFP.sys (Microsoft Corporation) DRV - (IDMWFP) -- C:\Windows\System32\drivers\idmwfp.sys (Tonec Inc.) DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation) DRV - (rtl8192se) -- C:\Windows\System32\drivers\rtl8192se.sys (Realtek Semiconductor Corporation ) DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (LSI Corporation) DRV - (yukonw7) -- C:\Windows\System32\drivers\yk62x86.sys (Marvell) DRV - (STHDA) -- C:\Windows\System32\drivers\stwrt.sys (IDT, Inc.) DRV - (vwifimp) -- C:\Windows\System32\drivers\vwifimp.sys (Microsoft Corporation) DRV - (netw5v32) -- C:\Windows\System32\drivers\netw5v32.sys (Intel Corporation) DRV - (SNP2UVC) -- C:\Windows\System32\drivers\snp2uvc.sys () DRV - (mfehidk) -- C:\Windows\System32\drivers\mfehidk.sys (McAfee, Inc.) DRV - (MfeAVFK) -- C:\Windows\System32\drivers\mfeavfk.sys (McAfee, Inc.) DRV - (mfetdik) -- C:\Windows\System32\drivers\mfetdik.sys (McAfee, Inc.) DRV - (MfeBOPK) -- C:\Windows\System32\drivers\mfebopk.sys (McAfee, Inc.) DRV - (MfeRKDK) -- C:\Windows\System32\drivers\mferkdk.sys (McAfee, Inc.) DRV - (HpqKbFiltr) -- C:\Windows\System32\drivers\HpqKbFiltr.sys (Hewlett-Packard Development Company, L.P.) DRV - (HBtnKey) -- C:\Windows\System32\drivers\CPQBttn.sys (Hewlett-Packard Development Company, L.P.) DRV - (regi) -- C:\Windows\System32\drivers\regi.sys (InterVideo) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.ourluckysites.com/?type=hp&ts=1491381396&z=b541eab1a3160446ca8a9e6g9z1t9g1c7bdg3c7t4q&from=che0812&uid=TOSHIBAXMK3256GSY_406CFECASXX406CFECAS IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.ourluckysites.com/search/?type=ds&ts=1491381396&z=b541eab1a3160446ca8a9e6g9z1t9g1c7bdg3c7t4q&from=che0812&uid=TOSHIBAXMK3256GSY_406CFECASXX406CFECAS&q={searchTerms} IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.ourluckysites.com/search/?type=ds&ts=1491381396&z=b541eab1a3160446ca8a9e6g9z1t9g1c7bdg3c7t4q&from=che0812&uid=TOSHIBAXMK3256GSY_406CFECASXX406CFECAS&q={searchTerms} IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.ourluckysites.com/?type=hp&ts=1491381396&z=b541eab1a3160446ca8a9e6g9z1t9g1c7bdg3c7t4q&from=che0812&uid=TOSHIBAXMK3256GSY_406CFECASXX406CFECAS IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKLM\..\SearchScopes\{767E9940-271C-46A7-92DA-88B33DD4D61F}: "URL" = http://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.ourluckysites.com/?type=hp&ts=1491381396&z=b541eab1a3160446ca8a9e6g9z1t9g1c7bdg3c7t4q&from=che0812&uid=TOSHIBAXMK3256GSY_406CFECASXX406CFECAS IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.ourluckysites.com/search/?type=ds&ts=1491381396&z=b541eab1a3160446ca8a9e6g9z1t9g1c7bdg3c7t4q&from=che0812&uid=TOSHIBAXMK3256GSY_406CFECASXX406CFECAS&q={searchTerms} IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.ourluckysites.com/search/?type=ds&ts=1491381396&z=b541eab1a3160446ca8a9e6g9z1t9g1c7bdg3c7t4q&from=che0812&uid=TOSHIBAXMK3256GSY_406CFECASXX406CFECAS&q={searchTerms} IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.ourluckysites.com/?type=hp&ts=1491381396&z=b541eab1a3160446ca8a9e6g9z1t9g1c7bdg3c7t4q&from=che0812&uid=TOSHIBAXMK3256GSY_406CFECASXX406CFECAS IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = IE - HKCU\..\SearchScopes,DefaultScope = {33BB0A4E-99AF-4226-BDF6-49120163DE86} IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKCU\..\SearchScopes\{767E9940-271C-46A7-92DA-88B33DD4D61F}: "URL" = http://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "AutoConfigURL" = http://unstops.info/wpad.dat?0f1c265bf0042a076cc038cee9ebcb4212282320 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.search.countryCode: "DZ" FF - prefs.js..browser.search.defaultenginename: "trotux" FF - prefs.js..browser.search.region: "DZ" FF - prefs.js..browser.search.searchengine.alias: "" FF - prefs.js..browser.search.searchengine.hp: "http://www.trotux.com/?z=b99bf1fa76790d40d34633dg5z8m5b2mfe4o1b1e4c&from=isr&uid=TOSHIBAXMK3256GSY_406CFECASXX406CFECAS&type=hp" FF - prefs.js..browser.search.searchengine.iconURL: "http://www.luckysearch123.com/favicon.ico?t=1" FF - prefs.js..browser.search.searchengine.name: "luck" FF - prefs.js..browser.search.searchengine.ref: "" FF - prefs.js..browser.search.searchengine.sp: "http://www.trotux.com/search/?from=isr&q={searchTerms}&type=sp&uid=TOSHIBAXMK3256GSY_406CFECASXX406CFECAS&z=b99bf1fa76790d40d34633dg5z8m5b2mfe4o1b1e4c" FF - prefs.js..browser.search.searchengine.ts: "1492672965" FF - prefs.js..browser.search.searchengine.type: "" FF - prefs.js..browser.search.searchengine.uid: "toshibaxmk3256gsy_406cfecasxx406cfecas" FF - prefs.js..browser.search.searchengine.url: "http://www.luckysearch123.com/search.php?type=ds&ts=1492672965&from=36600419&uid=toshibaxmk3256gsy_406cfecasxx406cfecas&z=c06e938a511edf77fac1f7dg0z1teo6q6m7q9w0m4z&q={searchTerms}" FF - prefs.js..browser.search.selectedEngine: "trotux" FF - prefs.js..browser.search.suggest.enabled: true FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "http://www.trotux.com/?z=b99bf1fa76790d40d34633dg5z8m5b2mfe4o1b1e4c&from=isr&uid=TOSHIBAXMK3256GSY_406CFECASXX406CFECAS&type=hp" FF - prefs.js..extensions.enabledAddons: %7Bd0bc04f1-2a66-420b-9131-69bba6dc379e%7D:1.0 FF - prefs.js..extensions.enabledAddons: paffxtbr%40www.filmfanatic2.com:7.18.7.8322 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:42.0 FF - user.js..browser.search.defaultenginename: "luck" FF - user.js..browser.search.order.1: "luck" FF - user.js..browser.search.searchengine.alias: "" FF - user.js..browser.search.searchengine.iconURL: "http://www.luckysearch123.com/favicon.ico?t=1" FF - user.js..browser.search.searchengine.name: "luck" FF - user.js..browser.search.searchengine.ref: "" FF - user.js..browser.search.searchengine.ts: "1492672965" FF - user.js..browser.search.searchengine.type: "" FF - user.js..browser.search.searchengine.uid: "toshibaxmk3256gsy_406cfecasxx406cfecas" FF - user.js..browser.search.searchengine.url: "http://www.luckysearch123.com/search.php?type=ds&ts=1492672965&from=36600419&uid=toshibaxmk3256gsy_406cfecasxx406cfecas&z=c06e938a511edf77fac1f7dg0z1teo6q6m7q9w0m4z&q={searchTerms}" FF - user.js..browser.search.selectedEngine: "luck" FF - user.js..browser.search.useDBForOrder: true FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\windows\system32\Adobe\Director\np32dsw_1214154.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=11.101.2: C:\Program Files\Java\jre1.8.0_101\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=11.101.2: C:\Program Files\Java\jre1.8.0_101\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Nero.com/KM: C:\PROGRA~1\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.33.5\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.33.5\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\arthurj8283@gmail.com: C:\Users\Zine\AppData\Roaming\Mozilla\Firefox\Profiles\mwdpsnac.default\extensions\arthurj8283@gmail.com [2017/04/20 09:22:47 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2017/07/17 14:33:33 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 42.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 42.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\mozilla_cc@internetdownloadmanager.com: C:\Users\Zine\AppData\Roaming\IDM\idmmzcc5 [2016/11/13 11:30:02 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2017/07/17 14:33:33 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\SeaMonkey\Extensions\\mozilla_cc2@internetdownloadmanager.com: C:\idmmzcc2.xpi FF - HKEY_CURRENT_USER\software\mozilla\SeaMonkey\Extensions\\mozilla_cc@internetdownloadmanager.com: C:\Users\Zine\AppData\Roaming\IDM\idmmzcc5 [2016/11/13 11:30:02 | 000,000,000 | ---D | M] [2014/11/24 10:26:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Zine\AppData\Roaming\mozilla\Extensions [2017/04/20 09:22:47 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Zine\AppData\Roaming\mozilla\Firefox\Profiles\mwdpsnac.default\extensions [2017/04/20 09:22:47 | 000,000,000 | ---D | M] (xRocket Toolbar) -- C:\Users\Zine\AppData\Roaming\mozilla\Firefox\Profiles\mwdpsnac.default\extensions\arthurj8283@gmail.com [2017/02/08 11:10:45 | 000,000,641 | ---- | M] () -- C:\Users\Zine\AppData\Roaming\mozilla\firefox\profiles\mwdpsnac.default\searchplugins\amisites.xml [2017/04/20 09:22:46 | 000,000,767 | ---- | M] () -- C:\Users\Zine\AppData\Roaming\mozilla\firefox\profiles\mwdpsnac.default\searchplugins\luck.xml [2016/11/09 16:47:02 | 000,000,608 | ---- | M] () -- C:\Users\Zine\AppData\Roaming\mozilla\firefox\profiles\mwdpsnac.default\searchplugins\mb2hx4ct.xml [2017/05/24 14:46:28 | 000,000,658 | ---- | M] () -- C:\Users\Zine\AppData\Roaming\mozilla\firefox\profiles\mwdpsnac.default\searchplugins\ourluckysites.xml [2017/03/15 13:10:13 | 000,000,666 | ---- | M] () -- C:\Users\Zine\AppData\Roaming\mozilla\firefox\profiles\mwdpsnac.default\searchplugins\startpageing123.xml File not found (No name found) -- C:\USERS\ZINE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\MWDPSNAC.DEFAULT\EXTENSIONS\{D0BC04F1-2A66-420B-9131-69BBA6DC379E} File not found (No name found) -- C:\USERS\ZINE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\MWDPSNAC.DEFAULT\EXTENSIONS\PAFFXTBR@WWW.FILMFANATIC2.COM O1 HOSTS File: ([2016/06/29 11:23:05 | 000,000,856 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 clients2.google.com O2 - BHO: (IDM integration (IDMIEHlprObj Class)) - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\IDMIECC.dll (Internet Download Manager, Tonec Inc.) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.8.0_101\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre1.8.0_101\bin\jp2ssv.dll (Oracle Corporation) O3 - HKLM\..\Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - No CLSID value found. O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found. O4 - HKLM..\Run: [CNAP2 Launcher] C:\Windows\System32\spool\drivers\w32x86\3\CNAP2LAK.EXE (CANON INC.) O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe (Intel Corporation) O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation) O4 - HKLM..\Run: [PDF Complete] C:\Program Files\PDF Complete\pdfsty.exe (PDF Complete Inc) O4 - HKLM..\Run: [Registry Crawler] C:\PROGRA~1\RCrawler\RCrawler.exe -TRAYONLY File not found O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.) O4 - HKCU..\Run: [background_fault] C:\Users\Zine\AppData\Local\background_fault\aswRD.exe (AVAST Software) O4 - HKCU..\Run: [CNAP2 Launcher] C:\Windows\System32\spool\drivers\w32x86\3\CNAP2LAK.EXE (CANON INC.) O4 - HKCU..\Run: [E09FXLRD_771097] C:\Program Files\Microsoft Encarta\Microsoft Encarta 2009 - Collection DVD\EDICT.EXE (Microsoft Corporation) O4 - HKCU..\Run: [IDMan] C:\Program Files\IDMan.exe (Tonec Inc.) O4 - HKLM..\RunOnceEx: [ContentMerger] c:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\ContentMerger10.exe (Sonic Solutions) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: TaskbarNoNotification = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdminꍠፉ劁 = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdminﲌ#狑ϧﱤ#暦 = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin꾟牌 = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin鴲앯犞 = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdminﱔ 섂ⷐﰬ 犐 = 0 O8 - Extra context menu item: E&xport to Microsoft Excel - res://c:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 File not found O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O8 - Extra context menu item: Envoyer l'&image au périphérique Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm () O8 - Extra context menu item: Free YouTube Download - C:\Program Files\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm () O8 - Extra context menu item: Télécharger avec IDM - C:\Program Files\IEExt.htm () O8 - Extra context menu item: Télécharger tous les liens avec Internet Download Manager - C:\Program Files\IEGetAll.htm () O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra Button: Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - Reg Error: Key error. File not found O9 - Extra 'Tools' menuitem : Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - Reg Error: Key error. File not found O13 - gopher Prefix: missing O15 - HKLM\..Trusted Domains: //about.htm/ ([]myui in Trusted sites) O15 - HKLM\..Trusted Domains: //Exclude.htm/ ([]myui in Trusted sites) O15 - HKLM\..Trusted Domains: //LanguageSelection.htm/ ([]myui in Trusted sites) O15 - HKLM\..Trusted Domains: //Message.htm/ ([]myui in Trusted sites) O15 - HKLM\..Trusted Domains: //MyAgttryCmd.htm/ ([]myui in Trusted sites) O15 - HKLM\..Trusted Domains: //MyAgttryNag.htm/ ([]myui in Trusted sites) O15 - HKLM\..Trusted Domains: //MyNotification.htm/ ([]myui in Trusted sites) O15 - HKLM\..Trusted Domains: //NOCLessUpdate.htm/ ([]myui in Trusted sites) O15 - HKLM\..Trusted Domains: //quarantine.htm/ ([]myui in Trusted sites) O15 - HKLM\..Trusted Domains: //ScanNow.htm/ ([]myui in Trusted sites) O15 - HKLM\..Trusted Domains: //strings.vbs/ ([]myui in Trusted sites) O15 - HKLM\..Trusted Domains: //Template.htm/ ([]myui in Trusted sites) O15 - HKLM\..Trusted Domains: //Update.htm/ ([]myui in Trusted sites) O15 - HKLM\..Trusted Domains: //VirFound.htm/ ([]myui in Trusted sites) O15 - HKLM\..Trusted Domains: mcafee.com ([*] http in Trusted sites) O15 - HKLM\..Trusted Domains: mcafee.com ([*] https in Trusted sites) O15 - HKLM\..Trusted Domains: mcafeeasap.com ([betavscan] http in Trusted sites) O15 - HKLM\..Trusted Domains: mcafeeasap.com ([betavscan] https in Trusted sites) O15 - HKLM\..Trusted Domains: mcafeeasap.com ([vs] http in Trusted sites) O15 - HKLM\..Trusted Domains: mcafeeasap.com ([vs] https in Trusted sites) O15 - HKLM\..Trusted Domains: mcafeeasap.com ([www] http in Trusted sites) O15 - HKLM\..Trusted Domains: mcafeeasap.com ([www] https in Trusted sites) O15 - HKCU\..Trusted Domains: localhost ([]* in Sites de confiance) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DB5B19D9-C08F-470F-B3AB-0FE2B2071869}: DhcpNameServer = 192.168.1.1 192.168.1.1 O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O27 - HKLM IFEO\GoogleUpdate.exe: Debugger - 324095823984.exe File not found O27 - HKLM IFEO\GoogleUpdaterService.exe: Debugger - 8736459873644.exe File not found O27 - HKLM IFEO\MRT.exe: Debugger - C:\windows\TEMP\oua7A60.tmp\secondu71\Gubed.exe -Yrrehs File not found O28 - HKLM ShellExecuteHooks: {B92BE6EE-9E96-11E6-B38B-64006A5CFC23} - C:\Users\Zine\AppData\Roaming\Labphdrertole\Verrosydretetain.dll File not found O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2014/11/19 10:52:26 | 000,000,000 | ---D | M] - C:\AUTOCAD -- [ NTFS ] O32 - AutoRun File - [2014/11/19 14:48:14 | 000,000,000 | ---D | M] - C:\autocad2011 -- [ NTFS ] O32 - AutoRun File - [2015/09/17 09:02:38 | 000,000,000 | ---D | M] - C:\Autodesk -- [ NTFS ] O32 - AutoRun File - [2016/02/29 20:14:26 | 000,000,000 | ---D | M] - C:\AUTOFLUID10 -- [ NTFS ] O33 - MountPoints2\{a44e7a0c-9110-11e4-bc2b-002713cd3d97}\Shell - "" = AutoRun O33 - MountPoints2\{a44e7a0c-9110-11e4-bc2b-002713cd3d97}\Shell\AutoRun\command - "" = D:\LGAutoRun.exe O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - C:\windows\System32\ias.dll (Microsoft Corporation) NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found SafeBootMin: AppMgmt - Service SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: MsMpSvc - C:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation) SafeBootMin: NTDS - File not found SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: TBS - Service SafeBootMin: vmms - Service SafeBootMin: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation) SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: AppMgmt - Service SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: Messenger - Service SafeBootNet: MsMpSvc - C:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation) SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: NTDS - File not found SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TBS - Service SafeBootNet: TDI - Driver Group SafeBootNet: vmms - Service SafeBootNet: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation) SafeBootNet: WudfUsbccidDriver - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices ActiveX: {07C1BADD-E3A7-8869-6BA3-BCC1784EDA80} - .NET Framework ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe" ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {30500C7C-2206-3DC6-9792-96E95A04669D} - .NET Framework ActiveX: {3911CF56-9EF2-39BA-846A-C27BD3CD0685} - .NET Framework ActiveX: {395B15B1-DADC-AED3-9289-F0475197B454} - Microsoft Windows Media Player ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4903D172-DCCB-392F-93A3-34CA9D47FE3D} - .NET Framework ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {4FF469F8-C18D-04FE-F8EC-6CB029774657} - Microsoft Windows Media Player 12.0 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {66C64F22-FC60-4E6C-A6B5-F0D580E680CE} - C:\windows\System32\ie4uinit.exe -EnableTLS ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {7D715857-A67C-4C2F-A929-038448584D63} - C:\windows\System32\ie4uinit.exe -DisableSSL3 ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\windows\System32\ie4uinit.exe -UserConfig ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files\Google\Chrome\Application\58.0.3029.96\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {9F67C87F-7A53-E056-6F74-45CEA2703E2B} - Themes Setup ActiveX: {C6BAF60B-6E91-453F-BFF9-D3789CFEFCDD} - .NET Framework ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player ActiveX: {D9EB3D96-1499-453C-4DED-D6D0C4FD78AA} - Internet Explorer ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: {FA8598F6-405E-9AA4-8730-7CCB3C749C74} - Internet Explorer ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: MSVideo8 - C:\windows\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: vidc.cvid - C:\windows\System32\iccvid.dll (Radius Inc.) Drivers32: vidc.x264 - C:\PROGRA~1\VCatcher\Drivers\x264vfw.dll File not found CREATERESTOREPOINT Restore point Set: OTL Restore Point PhysicalDisk0 MBR saved to C:\PhysicalMBR.bin [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2017/08/01 15:49:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Edraw Max 8.4 [2017/08/01 15:44:56 | 000,000,000 | ---D | C] -- C:\Program Files\Edraw Max 8.4 [2017/08/01 09:33:33 | 000,000,000 | ---D | C] -- C:\Users\Zine\AppData\Roaming\EurekaLog [2017/07/27 10:43:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AioFlo [2017/07/27 10:43:50 | 000,000,000 | ---D | C] -- C:\Program Files\AioFlo [2017/07/26 18:43:44 | 000,000,000 | ---D | C] -- C:\Users\Zine\AppData\Roaming\Canrain [2017/07/17 14:38:45 | 000,000,000 | ---D | C] -- C:\ProgramData\WEBREG [2017/07/17 14:38:44 | 000,000,000 | ---D | C] -- C:\Users\Zine\AppData\Roaming\HP [2017/07/17 14:34:09 | 000,000,000 | ---D | C] -- C:\Users\Zine\AppData\Roaming\HpUpdate [2017/07/17 14:33:01 | 000,000,000 | ---D | C] -- C:\ProgramData\HP Product Assistant [2017/07/17 14:29:50 | 000,125,440 | ---- | C] (Hewlett-Packard Company) -- C:\windows\System32\hpf3l02t.dll [2017/07/17 14:29:40 | 000,000,000 | ---D | C] -- C:\Program Files\HP [2017/07/17 14:27:52 | 000,000,000 | ---D | C] -- C:\ProgramData\HP [2017/07/17 14:27:48 | 000,454,504 | ---- | C] (Hewlett-Packard) -- C:\windows\System32\hpzids01.dll [2017/07/17 14:27:48 | 000,372,736 | ---- | C] (Hewlett Packard) -- C:\windows\System32\hppldcoi.dll [2016/11/13 11:30:02 | 000,460,824 | ---- | C] (Tonec Inc.) -- C:\Program Files\idmcchandler2_64.dll [2016/11/13 11:30:02 | 000,332,824 | ---- | C] (Tonec Inc.) -- C:\Program Files\idmcchandler2.dll [2015/02/22 11:18:05 | 000,179,736 | ---- | C] (Tonec Inc.) -- C:\Program Files\Uninstall.exe [2015/02/22 11:18:02 | 003,890,768 | ---- | C] (Tonec Inc.) -- C:\Program Files\IDMan.exe [2015/02/22 11:18:01 | 000,484,376 | ---- | C] (Internet Download Manager, Tonec Inc.) -- C:\Program Files\IDMIECC64.dll [2015/02/22 11:18:01 | 000,422,424 | ---- | C] (Internet Download Manager, Tonec Inc.) -- C:\Program Files\IDMIECC.dll [2015/02/22 11:18:01 | 000,288,744 | ---- | C] (Tonec Inc.) -- C:\Program Files\IDMNetMon64.dll [2015/02/22 11:18:01 | 000,216,632 | ---- | C] (Tonec Inc.) -- C:\Program Files\IDMNetMon.dll [2015/02/22 11:18:00 | 000,528,408 | ---- | C] (Internet Download Manager, Tonec Inc.) -- C:\Program Files\idmvconv.dll [2015/02/22 11:18:00 | 000,513,560 | ---- | C] (Tonec Inc.) -- C:\Program Files\IDMGrHlp.exe [2015/02/22 11:18:00 | 000,397,336 | ---- | C] (Tonec Inc.) -- C:\Program Files\idmindex.dll [2015/02/22 11:18:00 | 000,269,848 | ---- | C] (Tonec Inc.) -- C:\Program Files\IEMonitor.exe [2015/02/22 11:18:00 | 000,201,736 | ---- | C] (Tonec Inc.) -- C:\Program Files\idmtdi64.sys [2015/02/22 11:18:00 | 000,180,648 | ---- | C] (Tonec Inc.) -- C:\Program Files\idmwfp64.sys [2015/02/22 11:18:00 | 000,150,552 | ---- | C] (Tonec Inc.) -- C:\Program Files\downlWithIDM64.dll [2015/02/22 11:18:00 | 000,123,360 | ---- | C] (Tonec Inc.) -- C:\Program Files\idmtdi32.sys [2015/02/22 11:18:00 | 000,115,752 | ---- | C] (Tonec Inc.) -- C:\Program Files\idmwfp32.sys [2015/02/22 11:18:00 | 000,098,736 | ---- | C] (Tonec Inc.) -- C:\Program Files\idmbrbtn64.dll [2015/02/22 11:18:00 | 000,097,816 | ---- | C] (Tonec Inc.) -- C:\Program Files\downlWithIDM.dll [2015/02/22 11:18:00 | 000,090,648 | ---- | C] (Tonec Inc.) -- C:\Program Files\IDMGetAll64.dll [2015/02/22 11:18:00 | 000,086,352 | ---- | C] (Tonec Inc.) -- C:\Program Files\idmbrbtn.dll [2015/02/22 11:18:00 | 000,085,528 | ---- | C] (Tonec Inc.) -- C:\Program Files\idmfsa.dll [2015/02/22 11:18:00 | 000,069,144 | ---- | C] (Internet Download Manager, Tonec Inc.) -- C:\Program Files\idmBroker.exe [2015/02/22 11:18:00 | 000,067,608 | ---- | C] (Internet Download Manager, Tonec Inc.) -- C:\Program Files\IDMIntegrator64.exe [2015/02/22 11:18:00 | 000,056,856 | ---- | C] (Tonec Inc.) -- C:\Program Files\IDMGetAll.dll [2015/02/22 11:18:00 | 000,052,240 | ---- | C] (Tonec Inc.) -- C:\Program Files\IDMFType64.dll [2015/02/22 11:18:00 | 000,043,976 | ---- | C] (Tonec Inc.) -- C:\Program Files\idmftype.dll [2015/02/22 11:18:00 | 000,036,440 | ---- | C] (Tonec Inc.) -- C:\Program Files\idmmkb.dll [2015/02/22 11:18:00 | 000,032,280 | ---- | C] (Tonec Inc.) -- C:\Program Files\idmvs.dll [2015/02/22 11:18:00 | 000,025,112 | ---- | C] (Tonec Inc.) -- C:\Program Files\IDMShellExt64.dll [2015/02/22 11:18:00 | 000,023,008 | ---- | C] (Tonec Inc.) -- C:\Program Files\IDMShellExt.dll [2015/02/22 11:18:00 | 000,016,920 | ---- | C] (Internet Download Manager, Tonec Inc.) -- C:\Program Files\MediumILStart.exe [1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2017/08/06 18:26:53 | 000,004,028 | ---- | M] () -- C:\Users\Public\Documents\temp.dat [2017/08/06 18:24:12 | 000,000,512 | ---- | M] () -- C:\PhysicalMBR.bin [2017/08/06 18:16:23 | 000,000,000 | ---- | M] () -- C:\Users\Public\Documents\report.dat [2017/08/06 18:12:35 | 000,016,160 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2017/08/06 18:12:35 | 000,016,160 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2017/08/06 17:56:50 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat [2017/08/06 17:56:44 | 1603,772,416 | -HS- | M] () -- C:\hiberfil.sys [2017/08/01 15:49:30 | 000,001,041 | ---- | M] () -- C:\Users\Zine\Desktop\Edraw Max.lnk [2017/08/01 10:56:16 | 000,001,071 | ---- | M] () -- C:\Users\Zine\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk [2017/07/31 21:06:11 | 008,243,096 | ---- | M] () -- C:\windows\System32\perfh00C.dat [2017/07/31 21:06:11 | 007,436,092 | ---- | M] () -- C:\windows\System32\perfh009.dat [2017/07/31 21:06:11 | 004,285,974 | ---- | M] () -- C:\windows\System32\perfc00C.dat [2017/07/31 21:06:11 | 003,724,332 | ---- | M] () -- C:\windows\System32\perfc009.dat [2017/07/27 10:43:51 | 000,000,976 | ---- | M] () -- C:\Users\Public\Desktop\AioFlo.lnk [2017/07/18 08:46:06 | 001,085,296 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT [2017/07/17 14:38:38 | 000,243,596 | ---- | M] () -- C:\windows\hpwins25.dat [2017/07/17 14:32:55 | 000,001,274 | ---- | M] () -- C:\Users\Public\Desktop\HP Solution Center.lnk [2017/07/17 14:32:29 | 000,002,104 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk [1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2018/03/02 00:26:56 | 000,639,969 | ---- | C] () -- C:\Users\Zine\Desktop\Potager de cuisine.skp [2017/08/06 18:24:12 | 000,000,512 | ---- | C] () -- C:\PhysicalMBR.bin [2017/08/01 15:49:30 | 000,001,041 | ---- | C] () -- C:\Users\Zine\Desktop\Edraw Max.lnk [2017/07/27 10:43:51 | 000,000,976 | ---- | C] () -- C:\Users\Public\Desktop\AioFlo.lnk [2017/07/17 14:32:55 | 000,001,274 | ---- | C] () -- C:\Users\Public\Desktop\HP Solution Center.lnk [2017/07/17 14:32:29 | 000,002,104 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk [2017/07/17 14:28:17 | 000,243,596 | ---- | C] () -- C:\windows\hpwins25.dat [2017/07/17 14:28:17 | 000,000,530 | ---- | C] () -- C:\windows\hpwmdl25.dat [2017/05/28 12:00:20 | 000,000,017 | ---- | C] () -- C:\Users\Zine\AppData\Local\resmon.resmoncfg [2017/04/28 17:40:56 | 000,288,368 | ---- | C] () -- C:\windows\IRSETUP.EXE [2017/01/18 15:29:44 | 000,000,040 | ---- | C] () -- C:\Program Files\settings.dat [2017/01/18 15:29:44 | 000,000,000 | ---- | C] () -- C:\Program Files\metadata [2016/10/09 12:57:46 | 000,901,120 | ---- | C] () -- C:\windows\System32\ctocr32.dll [2016/10/09 12:57:46 | 000,053,248 | ---- | C] () -- C:\windows\System32\ctocrc32.dll [2016/07/09 01:01:36 | 000,015,668 | ---- | C] () -- C:\windows\LGO.Tool.OT3.INI [2016/07/09 01:01:18 | 000,009,667 | ---- | C] () -- C:\windows\LGO.Tool.Clm.Ini [2016/07/09 01:01:08 | 000,000,317 | ---- | C] () -- C:\windows\LGO.Tool.Lfx.INI [2016/07/09 01:01:08 | 000,000,215 | ---- | C] () -- C:\windows\LGO.Tool.INI [2016/07/09 01:00:56 | 000,000,786 | ---- | C] () -- C:\windows\LeicaOdbProfile.Ini [2016/07/09 01:00:56 | 000,000,317 | ---- | C] () -- C:\windows\SetupDb.Lfx.INI [2016/07/09 01:00:55 | 000,000,317 | ---- | C] () -- C:\windows\SetupCfg.Lfx.INI [2016/06/29 10:46:55 | 002,279,413 | ---- | C] () -- C:\Users\Zine\AppData\Roaming\HotHotity.bin [2016/06/29 10:46:27 | 000,126,464 | ---- | C] () -- C:\Users\Zine\AppData\Roaming\noah.dat [2016/06/29 10:46:27 | 000,018,432 | ---- | C] () -- C:\Users\Zine\AppData\Roaming\Main.dat [2016/06/29 10:46:26 | 006,870,016 | ---- | C] () -- C:\Users\Zine\AppData\Roaming\agent.dat [2016/06/29 10:46:26 | 001,761,214 | ---- | C] () -- C:\Users\Zine\AppData\Roaming\Bioex.tst [2016/06/29 10:46:26 | 000,069,024 | ---- | C] () -- C:\Users\Zine\AppData\Roaming\Config.xml [2016/06/29 10:46:15 | 000,956,416 | ---- | C] () -- C:\Users\Zine\AppData\Roaming\Bioex.exe [2016/06/29 10:46:05 | 000,126,464 | ---- | C] () -- C:\Users\Zine\AppData\Roaming\lobby.dat [2016/06/29 10:46:05 | 000,054,272 | ---- | C] () -- C:\Users\Zine\AppData\Roaming\ApplicationHosting.dat [2016/06/29 10:46:05 | 000,005,568 | ---- | C] () -- C:\Users\Zine\AppData\Roaming\md.xml [2016/06/29 10:46:04 | 000,956,416 | ---- | C] () -- C:\Users\Zine\AppData\Roaming\Ronwarm.exe [2016/06/29 10:46:04 | 000,072,704 | ---- | C] () -- C:\Users\Zine\AppData\Roaming\Ronwarm.tst [2016/06/29 10:45:48 | 000,848,437 | ---- | C] () -- C:\Users\Zine\AppData\Roaming\Quo-Hold.bin [2016/06/29 10:45:18 | 000,128,512 | ---- | C] () -- C:\Users\Zine\AppData\Roaming\Installer.dat [2016/06/29 10:45:18 | 000,018,288 | ---- | C] () -- C:\Users\Zine\AppData\Roaming\InstallationConfiguration.xml [2016/02/02 11:22:36 | 000,005,120 | ---- | C] () -- C:\Users\Zine\AppData\Roaming\GiftBag.db [2015/10/08 16:56:06 | 000,001,299 | ---- | C] () -- C:\Users\Zine\Free YouTube Download.lnk [2015/05/22 00:10:31 | 000,004,096 | -H-- | C] () -- C:\Users\Zine\AppData\Local\keyfile3.drm [2015/05/21 21:42:04 | 000,014,848 | ---- | C] () -- C:\Users\Zine\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2015/02/22 11:18:02 | 000,429,502 | ---- | C] () -- C:\Program Files\idmmzcc.xpi [2015/02/22 11:18:01 | 000,064,453 | ---- | C] () -- C:\Program Files\IDMGCExt.crx [2015/02/22 11:18:01 | 000,050,228 | ---- | C] () -- C:\Program Files\tutor.chm [2015/02/22 11:18:00 | 000,320,931 | ---- | C] () -- C:\Program Files\idman.chm [2015/02/22 11:18:00 | 000,184,167 | ---- | C] () -- C:\Program Files\IDMFType.dat [2015/02/22 11:18:00 | 000,132,285 | ---- | C] () -- C:\Program Files\grabber.chm [2015/02/22 11:18:00 | 000,045,478 | ---- | C] () -- C:\Program Files\scheduler.chm [2015/02/22 11:18:00 | 000,007,919 | ---- | C] () -- C:\Program Files\idmwfp.cat [2015/02/22 11:18:00 | 000,007,887 | ---- | C] () -- C:\Program Files\idmtdi.cat [2015/02/22 11:18:00 | 000,002,596 | ---- | C] () -- C:\Program Files\idmantypeinfo.tlb [2015/02/22 11:18:00 | 000,002,167 | ---- | C] () -- C:\Program Files\idmtdi.inf [2015/02/22 11:18:00 | 000,002,135 | ---- | C] () -- C:\Program Files\idmwfp.inf [2015/02/22 11:18:00 | 000,000,283 | ---- | C] () -- C:\Program Files\IEGetAll.htm [2015/02/22 11:18:00 | 000,000,279 | ---- | C] () -- C:\Program Files\IEGetVL2.htm [2015/02/22 11:18:00 | 000,000,278 | ---- | C] () -- C:\Program Files\IEGetVL.htm [2015/02/22 11:18:00 | 000,000,277 | ---- | C] () -- C:\Program Files\IEExt.htm [2014/11/15 12:17:59 | 000,002,672 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys [2014/11/15 12:17:59 | 000,000,008 | RHS- | C] () -- C:\ProgramData\B9A2B17BDE.sys [color=#E56717]========== ZeroAccess Check ==========[/color] [2009/07/14 06:42:31 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2016/04/09 08:54:53 | 012,881,408 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009/07/14 03:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [color=#E56717]========== Custom Scans ==========[/color] [color=#A23BEC]< %ALLUSERSPROFILE%\Application Data\*. >[/color] [color=#A23BEC]< %ALLUSERSPROFILE%\Application Data\*.exe /s >[/color] [color=#A23BEC]< %APPDATA%\*. >[/color] [2016/11/17 21:33:58 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\Adobe [2017/03/15 13:10:11 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\aMule [2017/08/05 13:21:10 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\Autodesk [2015/12/11 21:53:41 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\Bentley [2016/10/09 15:17:43 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\BitTorrent Maelstrom [2017/07/26 18:43:44 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\Canrain [2014/11/15 12:17:58 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\Corel [2015/09/23 12:58:03 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\CorelCAD [2015/10/07 16:05:57 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\CoSoSys [2017/05/17 10:32:08 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\DensiCal [2016/11/14 17:18:44 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\DMCache [2016/04/20 15:56:52 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\DVDVideoSoft [2016/10/23 17:39:53 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\DWGPDFConverter [2015/09/08 17:14:41 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\Easeware [2016/11/16 13:54:11 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\Elex-tech [2017/02/27 22:16:07 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\EPANET [2015/07/06 15:19:52 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\eTeks [2017/08/01 09:34:07 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\EurekaLog [2017/01/19 15:01:44 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\Firefox [2016/11/17 11:18:32 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\fjcfi [2015/11/11 15:39:04 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\Geomensura [2016/03/20 16:12:06 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\GHISLER [2015/03/12 15:56:17 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\Google [2014/11/16 10:43:32 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\Hewlett-Packard [2017/07/18 09:00:45 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\HP [2014/11/14 18:16:00 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\HP TCS [2014/11/14 17:56:40 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\hpqLog [2017/07/17 14:34:09 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\HpUpdate [2014/11/14 18:19:44 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\Identities [2016/11/13 16:18:46 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\IDM [2016/07/09 00:17:44 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\IGC [2014/11/14 18:05:53 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\InstallShield [2016/02/27 15:51:34 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\InterVideo [2017/04/28 17:50:18 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\IsolatedStorage [2017/07/31 22:52:44 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\Kyubey [2017/03/06 10:02:44 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\Labphdrertole [2016/11/14 16:43:45 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\Lenovo [2014/11/28 22:04:21 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\Macromedia [2017/02/24 20:42:40 | 000,000,000 | --SD | M] -- C:\Users\Zine\AppData\Roaming\Microsoft [2014/11/24 10:26:18 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\Mozilla [2014/11/30 14:07:59 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\MPC-HC [2016/11/09 12:26:39 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\Nero [2015/10/08 16:59:52 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\Opera Software [2015/02/06 13:32:18 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\PhiCalculator 3 [2016/11/09 16:47:02 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\Profiles [2015/12/23 19:49:06 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\Roxio [2015/12/20 21:31:46 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\SketchUp [2014/11/14 22:48:36 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\Skype [2016/12/04 23:10:26 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\Soft Solutions [2016/10/09 12:53:53 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\Softland [2015/11/11 18:54:11 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\Sun [2017/06/13 10:57:02 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\TCXConverter [2016/06/30 11:43:59 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\TDS [2016/10/26 15:48:17 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\Trimble Connect for SketchUp [2017/03/05 21:03:18 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\UltimateMapsDownloader [2017/04/15 11:33:22 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\URSoft [2017/08/05 18:07:38 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\uTorrent [2015/12/17 17:15:21 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\vlc [2016/04/14 15:23:02 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\VSX [2014/11/14 18:59:41 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\WinRAR [2017/05/31 13:57:34 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\WinSAPSvc [2017/03/01 17:08:23 | 000,000,000 | ---D | M] -- C:\Users\Zine\AppData\Roaming\WinSnare [color=#A23BEC]< %APPDATA%\*.exe /s >[/color] [2016/06/29 10:45:17 | 000,956,416 | ---- | M] () -- C:\Users\Zine\AppData\Roaming\Bioex.exe [2016/06/29 10:45:17 | 000,956,416 | ---- | M] () -- C:\Users\Zine\AppData\Roaming\Ronwarm.exe [2016/07/23 21:06:54 | 000,000,000 | ---- | M] () -- C:\Users\Zine\AppData\Roaming\DVDVideoSoft\FreeYTVDownloader.exe [2016/11/15 17:13:12 | 000,438,272 | ---- | M] () -- C:\Users\Zine\AppData\Roaming\fjcfi\UniKeyNT.exe [2016/11/15 17:13:12 | 000,393,216 | ---- | M] () -- C:\Users\Zine\AppData\Roaming\fjcfi\UvConverter.exe [2015/11/09 14:05:02 | 006,692,368 | ---- | M] (Tonec Inc.) -- C:\Users\Zine\AppData\Roaming\IDM\idmupdt.exe [2017/03/05 10:33:08 | 000,032,606 | R--- | M] () -- C:\Users\Zine\AppData\Roaming\Microsoft\Installer\{0F7B5011-72EC-493D-A7BF-546591047E8E}\_950E249C722BB1879A8293.exe [2017/03/15 13:10:11 | 000,032,606 | R--- | M] () -- C:\Users\Zine\AppData\Roaming\Microsoft\Installer\{13D7C2E9-08E7-4889-94FF-87E707184E53}\_9B2B26538957EA274EE23D.exe [2016/11/17 11:18:17 | 000,032,606 | R--- | M] () -- C:\Users\Zine\AppData\Roaming\Microsoft\Installer\{19539992-061C-4E8B-9053-07B175303AF4}\_DB2A8E7A54CF092C74796E.exe [2016/11/16 13:49:01 | 000,032,606 | R--- | M] () -- C:\Users\Zine\AppData\Roaming\Microsoft\Installer\{418DDAC3-E16C-47C2-B5FE-4FBCAB0E10D0}\_951C230AB0400AF8D55261.exe [2016/04/28 16:01:54 | 000,009,062 | R--- | M] () -- C:\Users\Zine\AppData\Roaming\Microsoft\Installer\{928BDF57-B11C-3917-8C21-7948439E49B4}\VB_PowerPacks_Display_Icon.EXE [2010/06/04 07:00:18 | 000,659,456 | ---- | M] (Benjamin Bentmann) -- C:\Users\Zine\AppData\Roaming\Soft Solutions\Image to OCR Converter\BeCyPDFMetaEdit.exe [2011/08/15 14:08:58 | 000,811,008 | ---- | M] () -- C:\Users\Zine\AppData\Roaming\Soft Solutions\Image to OCR Converter\pdfimages.exe [2011/08/15 14:08:58 | 001,486,848 | ---- | M] () -- C:\Users\Zine\AppData\Roaming\Soft Solutions\Image to OCR Converter\pdftoppm.exe [2017/07/03 09:26:56 | 002,146,496 | ---- | M] (BitTorrent Inc.) -- C:\Users\Zine\AppData\Roaming\uTorrent\uTorrent.exe [2016/10/09 15:54:47 | 002,375,360 | ---- | M] (BitTorrent Inc.) -- C:\Users\Zine\AppData\Roaming\uTorrent\updates\3.4.9_42606.exe [2017/05/14 14:54:55 | 002,144,448 | ---- | M] (BitTorrent Inc.) -- C:\Users\Zine\AppData\Roaming\uTorrent\updates\3.5.0_43580.exe [2017/05/23 12:11:00 | 001,980,608 | ---- | M] (BitTorrent Inc.) -- C:\Users\Zine\AppData\Roaming\uTorrent\updates\3.5.0_43804.exe [2017/07/03 09:26:56 | 002,146,496 | ---- | M] (BitTorrent Inc.) -- C:\Users\Zine\AppData\Roaming\uTorrent\updates\3.5.0_43916.exe [2017/05/14 14:54:18 | 000,387,072 | ---- | M] (BitTorrent Inc.) -- C:\Users\Zine\AppData\Roaming\uTorrent\updates\3.4.9_42606\utorrentie.exe [2017/05/16 09:18:23 | 000,396,992 | ---- | M] (BitTorrent Inc.) -- C:\Users\Zine\AppData\Roaming\uTorrent\updates\3.5.0_43580\utorrentie.exe [2017/05/24 14:39:41 | 000,396,992 | ---- | M] (BitTorrent Inc.) -- C:\Users\Zine\AppData\Roaming\uTorrent\updates\3.5.0_43804\utorrentie.exe [2017/07/04 14:39:41 | 000,396,992 | ---- | M] (BitTorrent Inc.) -- C:\Users\Zine\AppData\Roaming\uTorrent\updates\3.5.0_43916\utorrentie.exe [color=#A23BEC]< %temp%\*.exe /s >[/color] [2009/02/04 16:39:16 | 000,161,640 | ---- | M] (Autodesk, Inc.) -- C:\Users\Zine\AppData\Local\Temp\AcDeltree.exe [2015/02/24 16:51:41 | 000,297,672 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\CloudBackup4068.exe [2016/10/06 14:36:36 | 002,236,416 | ---- | M] (x) -- C:\Users\Zine\AppData\Local\Temp\cv.exe [2016/06/29 10:45:17 | 000,351,232 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\DACz5VgHHA.exe [2016/04/26 16:54:15 | 002,614,136 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\DefaultPack.EXE [2008/01/15 01:28:12 | 000,069,632 | ---- | M] (Hewlett-Packard Company) -- C:\Users\Zine\AppData\Local\Temp\HPQSi.exe [2015/11/11 20:26:15 | 000,028,077 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\i4jdel0.exe [2015/09/23 12:48:52 | 000,920,048 | ---- | M] (Internet Program ) -- C:\Users\Zine\AppData\Local\Temp\ICReinstall_CE CALC - Hydraulics Calculator.exe [2016/04/26 16:44:11 | 000,981,304 | ---- | M] (Software ) -- C:\Users\Zine\AppData\Local\Temp\ICReinstall_hair-pro-programas-gratis-net.exe [2017/08/05 15:35:01 | 000,989,477 | ---- | M] (Gapa ) -- C:\Users\Zine\AppData\Local\Temp\ICReinstall_keygen-step-2.exe [2016/07/03 11:00:12 | 000,987,784 | ---- | M] (Cugel ) -- C:\Users\Zine\AppData\Local\Temp\ICReinstall_VLCPlayerSetup_2166088480.exe [2017/01/18 14:26:53 | 026,967,248 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\inst12.exe [2016/03/24 13:00:00 | 000,880,128 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\Keygen 32 Bit.exe [2015/11/25 13:02:28 | 005,938,160 | ---- | M] (SaveFrom.net ) -- C:\Users\Zine\AppData\Local\Temp\MBSetup362.exe [2016/03/22 17:17:57 | 014,666,000 | ---- | M] ( ) -- C:\Users\Zine\AppData\Local\Temp\MBSetup_uvd-loader.exe [2017/04/05 09:50:57 | 067,133,440 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\mpam-568ba81c.exe [2017/05/09 10:25:22 | 007,307,264 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\mpam-8c508e81.exe [2017/05/17 09:16:22 | 103,505,920 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\mpam-e1d51d48.exe [2016/06/29 11:22:55 | 001,685,280 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\nonsoflympesv.ru_EU.exe [2016/06/29 10:45:24 | 000,321,024 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\sdf628.exe [2004/03/10 00:00:00 | 000,142,848 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\setup.exe [2016/06/29 11:22:43 | 000,393,472 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\trotux.exe [2015/10/08 16:54:27 | 038,812,584 | ---- | M] ( ) -- C:\Users\Zine\AppData\Local\Temp\VCatcherDistributionFile.exe [738 C:\Users\Zine\AppData\Local\Temp\*.tmp files -> C:\Users\Zine\AppData\Local\Temp\*.tmp -> ] [2013/10/07 22:02:14 | 001,207,296 | ---- | M] (Google) -- C:\Users\Zine\AppData\Local\Temp\._msige61\GoogleEarth.exe [2013/10/07 21:52:17 | 000,208,384 | ---- | M] (Google) -- C:\Users\Zine\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\googleearth.exe [2013/10/07 21:33:15 | 000,301,056 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\gpsbabel.exe [2013/10/07 21:52:17 | 000,208,384 | ---- | M] (Google) -- C:\Users\Zine\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\geplugin.exe [1998/07/30 18:40:48 | 000,306,688 | ---- | M] (InstallShield Software Corporation) -- C:\Users\Zine\AppData\Local\Temp\_ISTMP0.DIR\IsUninst.Exe [2015/09/17 09:03:45 | 000,472,768 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\{92A15E62-D4A5-4B36-8E6F-D1FBB150FF2F}\installer.exe [2017/03/31 14:35:24 | 000,114,176 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\1\Kyubey.exe [2017/03/31 14:35:24 | 000,151,256 | ---- | M] (yacdl.exe) -- C:\Users\Zine\AppData\Local\Temp\1\yacqq.exe [2017/04/21 15:56:52 | 000,114,688 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\10\CPK.exe [2017/03/31 14:35:24 | 000,322,264 | ---- | M] (yacdll.exe) -- C:\Users\Zine\AppData\Local\Temp\10\yacqq.exe [2017/03/31 14:35:24 | 000,152,280 | ---- | M] (yacdl.exe) -- C:\Users\Zine\AppData\Local\Temp\3\yacqq.exe [2017/03/31 14:35:24 | 000,131,640 | ---- | M] (Tencent Inc.) -- C:\Users\Zine\AppData\Local\Temp\5\QQBrowser.exe [2017/03/31 14:35:24 | 000,152,280 | ---- | M] (yacdl.exe) -- C:\Users\Zine\AppData\Local\Temp\5\yacqq.exe [2017/03/31 14:35:24 | 000,152,280 | ---- | M] (yacdl.exe) -- C:\Users\Zine\AppData\Local\Temp\6\yacqq.exe [2016/07/13 11:45:45 | 000,735,904 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7A9F558D-47AE-404E-8CFF-64A0D6AC78EC\tupherosailp.ru_EU.exe [2017/05/30 09:31:51 | 000,709,120 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7F692FAD-8177-4CC6-B929-6609074ED34A\icq.exe [2010/03/08 00:53:43 | 001,412,456 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\hpzsetup.exe [2010/03/08 00:53:43 | 001,227,624 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\HPZstub.exe [2010/03/08 00:56:05 | 001,139,048 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\Setup.exe [2010/02/04 06:44:11 | 000,789,504 | ---- | M] (TODO: ) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\BlockSysUserInstall.exe [2010/07/02 10:25:07 | 000,209,408 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\ConvAPIPlugin.exe [2010/03/18 11:03:51 | 000,232,960 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\DelNwPrinter.exe [2010/02/11 07:44:20 | 000,352,256 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\DeviceDisconnect.exe [2010/03/30 12:59:57 | 000,292,480 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\DOT4_Plugin.exe [2010/02/04 06:44:11 | 000,782,848 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\hpdot4chk.exe [2010/03/18 11:03:51 | 000,231,424 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\hpnwchk.exe [2010/03/15 09:28:38 | 000,784,896 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\hpprtchk.exe [2009/10/12 23:12:41 | 000,647,296 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\hpqbhp01.exe [2010/02/04 12:14:39 | 000,121,344 | ---- | M] (Hewlett-Packard Co.) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\hpqrrx08.exe [2010/02/04 11:27:18 | 000,233,472 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\hpwlpd01.exe [2010/02/04 06:44:11 | 000,790,528 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\hpxpschk.exe [2010/03/08 00:53:43 | 000,928,104 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\HPZarp01.exe [2010/03/08 00:53:43 | 000,974,184 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\HPZcdl01.exe [2010/03/08 00:53:43 | 002,047,848 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\HPZchk01.exe [2010/03/08 00:53:43 | 001,409,896 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\HPZdui01.exe [2010/03/08 01:47:27 | 002,050,408 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\HPZdui40.exe [2010/03/08 00:53:53 | 001,171,304 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\hpzfwx01.exe [2010/03/08 00:53:53 | 000,916,328 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\HPZgat01.exe [2010/03/08 00:53:53 | 001,713,000 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\HPZmsi01.exe [2010/03/08 00:53:53 | 000,942,952 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\HPZnop01.exe [2010/03/08 00:56:05 | 001,816,424 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\hpznui01.exe [2010/03/08 01:06:34 | 002,633,064 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\HPZnui40.exe [2010/03/08 00:53:53 | 000,939,880 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\HPZpnp01.exe [2010/03/08 01:47:27 | 001,390,440 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\HPZpnp40.exe [2010/03/08 00:53:53 | 000,961,384 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\HPZprl01.exe [2010/03/08 01:47:27 | 001,424,744 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\HPZprl40.exe [2010/03/08 00:54:03 | 001,123,688 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\HPZpsc01.exe [2010/03/08 00:54:03 | 001,055,592 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\HPZpsl01.exe [2010/03/08 00:54:04 | 000,964,456 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\HPZrcn01.exe [2010/03/08 00:54:04 | 001,721,704 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\HPZrcv01.exe [2010/03/08 00:54:04 | 004,190,056 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\HPZrein01.exe [2010/03/08 00:54:04 | 001,640,808 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\HPZscr01.exe [2010/03/08 01:47:27 | 002,413,416 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\HPZscr40.exe [2010/03/08 00:54:14 | 001,955,176 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\HPZshl01.exe [2010/03/08 01:47:27 | 002,617,192 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\HPZshl40.exe [2009/10/12 23:12:41 | 000,467,072 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\HPZSWP01.exe [2010/03/08 00:54:14 | 000,954,216 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\HPZtim01.exe [2010/03/08 00:54:14 | 000,920,936 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\HPZwis01.exe [2010/03/08 00:54:14 | 000,920,424 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\HPZwrp01.exe [2010/03/08 00:54:14 | 002,423,656 | ---- | M] (Hewlett-Packard) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\HPZwup01.exe [2010/02/10 05:26:47 | 000,709,120 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\TwainFix.exe [2007/08/13 09:20:12 | 000,545,280 | ---- | M] (Intel Corporation) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\usbready.exe [2006/07/20 17:18:14 | 000,534,528 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\dpinst_x32\DPInst.exe [2006/07/20 17:50:24 | 000,667,648 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\dpinst_x64\DPInst.exe [2010/05/04 19:46:42 | 000,353,112 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\msn\InstallManager_IP2_IP2.exe [2010/03/04 01:11:36 | 000,057,704 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\msn\QP_Launcher.exe [2010/03/19 14:07:00 | 000,138,600 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\msn\ToolbarInstallWrapper-win32.exe [2010/03/19 14:07:00 | 000,151,912 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\msn\ToolbarInstallWrapper-x64.exe [2010/05/04 19:46:42 | 000,315,240 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\msn\OEM\Packages\default\DefaultManagerSetup.exe [2010/05/04 19:46:42 | 000,684,408 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\msn\OEM\Packages\default\SearchEnhancementPackSetup.EXE [2010/05/04 19:56:41 | 004,938,616 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\msn\OEM\Packages\default\Silverlight.exe [2007/08/13 09:19:37 | 001,821,008 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\wis\Win2K_XP\instmsi.exe [2009/06/12 17:13:02 | 000,105,472 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\yahoo\YTBInstallWrapper-win32.exe [2009/06/12 17:13:02 | 000,106,496 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\yahoo\YTBInstallWrapper-x64.exe [2008/12/18 21:27:45 | 002,255,832 | ---- | M] (Yahoo! Inc.) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\yahoo\ytb_7.2.2.0_1.5.4_mail_bts_pub_uber_rev_setup_2008.11.25.01.exe [2009/01/08 22:06:35 | 000,050,304 | ---- | M] (Yahoo! Inc.) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\setup\yahoo\y_hp_intl_detect.exe [2010/02/04 11:37:24 | 000,774,144 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\CCC_Uninstaller.exe [2009/11/18 14:41:56 | 000,125,056 | ---- | M] (Hewlett-Packard Co.) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\hpqrrx08.exe [2010/02/04 11:58:13 | 002,003,176 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\WindowsInstaller-KB884016-v2-x86.exe [2010/02/04 11:58:13 | 000,163,240 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\chs\Q283787_W2K_SP3_x86.EXE [2010/02/04 11:58:13 | 000,348,960 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\chs\WindowsXP-KB822603-x86-CHS.exe [2010/02/04 11:58:13 | 000,162,216 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\cht\Q283787_W2K_SP3_x86.EXE [2010/02/04 11:58:13 | 000,349,472 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\cht\WindowsXP-KB822603-x86-CHT.exe [2010/02/04 11:58:13 | 000,132,512 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\csy\Q283787_w2k_sp3_x86.EXE [2010/02/04 11:58:13 | 000,351,520 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\csy\WindowsXP-KB822603-x86-CSY.exe [2010/02/04 11:58:13 | 000,131,488 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\dan\Q283787_w2k_sp3_x86.EXE [2010/02/04 11:58:13 | 000,351,008 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\dan\WindowsXP-KB822603-x86-DAN.exe [2010/02/04 11:58:13 | 000,163,240 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\deu\Q283787_W2K_sp3_x86.EXE [2010/02/04 11:58:13 | 000,352,032 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\deu\WindowsXP-KB822603-x86-DEU.exe [2010/02/04 11:58:13 | 000,385,024 | ---- | M] (Hewlett-Packard Co.) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\diagnostics\HPSysDig.exe [2010/02/04 11:58:13 | 000,143,264 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\ell\Q283787_w2k_sp3_x86.EXE [2010/02/04 11:58:13 | 000,353,568 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\ell\WindowsXP-KB822603-x86-ELL.exe [2010/02/04 11:58:13 | 000,103,664 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\enu\Q283787_W2K_SP3_x86.EXE [2010/02/04 11:58:13 | 000,349,472 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\enu\WindowsXP-KB822603-x86-ENU.exe [2010/02/04 11:58:13 | 000,149,920 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\esm\Q283787_w2k_sp3_x86.EXE [2010/02/04 11:58:13 | 000,149,920 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\esn\Q283787_w2k_sp3_x86.EXE [2010/02/04 11:58:13 | 000,352,032 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\esn\WindowsXP-KB822603-x86-ESN.exe [2010/02/04 11:58:13 | 000,130,464 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\fin\Q283787_w2k_sp3_x86.EXE [2010/02/04 11:58:13 | 000,351,520 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\fin\WindowsXP-KB822603-x86-FIN.exe [2010/02/04 11:58:13 | 000,135,584 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\fra\Q283787_w2k_sp3_x86.EXE [2010/02/04 11:58:13 | 000,352,032 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\fra\WindowsXP-KB822603-x86-FRA.exe [2010/02/04 11:58:13 | 000,138,144 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\hun\Q283787_w2k_sp3_x86.EXE [2010/02/04 11:58:13 | 000,352,544 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\hun\WindowsXP-KB822603-x86-HUN.exe [2010/02/04 11:58:13 | 000,136,608 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\ita\Q283787_w2k_sp3_x86.EXE [2010/02/04 11:58:13 | 000,351,520 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\ita\WindowsXP-KB822603-x86-ITA.exe [2010/02/04 11:58:13 | 000,162,728 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\jpn\Q283787_W2K_sp3_x86.EXE [2010/02/04 11:58:13 | 000,350,496 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\jpn\WindowsXP-KB822603-x86-JPN.exe [2010/02/04 11:58:13 | 000,162,728 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\kor\Q283787_W2K_SP3_x86.EXE [2010/02/04 11:58:13 | 000,349,472 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\kor\WindowsXP-KB822603-x86-KOR.exe [2010/02/04 11:58:13 | 000,134,048 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\nld\Q283787_W2K_SP3_x86.EXE [2010/02/04 11:58:13 | 000,352,032 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\nld\WindowsXP-KB822603-x86-NLD.exe [2010/02/04 11:58:13 | 000,142,240 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\nob\Q283787_w2k_sp3_x86.EXE [2010/02/04 11:58:13 | 000,351,008 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\nob\WindowsXP-KB822603-x86-NOR.exe [2010/02/04 11:58:13 | 000,132,512 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\plk\Q283787_w2k_sp3_x86.EXE [2010/02/04 11:58:13 | 000,352,544 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\plk\WindowsXP-KB822603-x86-PLK.exe [2010/02/04 11:58:13 | 000,137,120 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\ptb\Q283787_W2K_SP3_x86.EXE [2010/02/04 11:58:13 | 000,351,520 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\ptb\WindowsXP-KB822603-x86-PTB.exe [2010/02/04 11:58:13 | 000,135,584 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\rus\Q283787_w2k_sp3_x86.EXE [2010/02/04 11:58:13 | 000,352,032 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\rus\WindowsXP-KB822603-x86-RUS.exe [2010/02/04 11:58:13 | 000,136,608 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\sve\Q283787_w2k_sp3_x86.EXE [2010/02/04 11:58:13 | 000,351,008 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\sve\WindowsXP-KB822603-x86-SVE.exe [2010/02/04 11:58:13 | 000,136,096 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\trk\Q283787_w2k_sp3_x86.EXE [2010/02/04 11:58:13 | 000,351,520 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ccc\trk\WindowsXP-KB822603-x86-TRK.exe [2010/02/08 06:10:49 | 000,069,632 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\cfgedt\hpbcfgap.exe [2010/05/28 08:50:30 | 002,631,992 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\ndu\HPHNDU_3053.exe [2010/05/28 08:50:30 | 001,601,928 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\7zS590F\OJ7000vE809a_Full_14\util\pdu\HPPDU.exe [2017/04/21 15:56:52 | 000,114,688 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\8\CPK.exe [2017/03/31 14:35:24 | 000,322,264 | ---- | M] (yacdll.exe) -- C:\Users\Zine\AppData\Local\Temp\8\yacqq.exe [2016/11/09 16:46:23 | 000,433,576 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\814F8040-B819-420C-BC57-98991DF5AB02\isr_lj.exe [2017/05/09 16:40:16 | 001,419,576 | ---- | M] (AVAST Software) -- C:\Users\Zine\AppData\Local\Temp\9\aswRD.exe [2017/05/09 17:16:56 | 000,122,368 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\9\CPK.exe [2009/04/21 14:30:08 | 000,176,128 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\CarryItEasy\CleanUp.exe [2008/01/11 16:55:20 | 000,053,416 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\CarryItEasy\safeloginreg.exe [2014/06/06 17:14:58 | 000,060,696 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\CorelCAD VSTA\CorelCADInstaller.exe [2014/06/05 14:25:40 | 000,428,032 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\CorelCAD VSTA\Setup_Pre_English.exe [2014/06/05 14:24:40 | 041,083,384 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\CorelCAD VSTA\vsta20.exe [2016/10/06 10:05:46 | 006,971,088 | ---- | M] (一普明为(北京)信息技术有限公司) -- C:\Users\Zine\AppData\Local\Temp\dv1C42.tmp\p1579028448.exe [2016/10/06 10:05:46 | 006,971,088 | ---- | M] (一普明为(北京)信息技术有限公司) -- C:\Users\Zine\AppData\Local\Temp\dv1C42.tmp\pc32.exe [2016/10/06 10:05:48 | 009,534,160 | ---- | M] (一普明为(北京)信息技术有限公司) -- C:\Users\Zine\AppData\Local\Temp\dv1C42.tmp\pc64.exe [2015/11/03 20:23:16 | 000,028,077 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\e4j16DA.tmp_dir\i4jdel.exe [2015/11/11 18:14:22 | 000,028,077 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\e4j96CB.tmp_dir\i4jdel.exe [2015/11/03 20:06:27 | 000,028,077 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\e4jAF13.tmp_dir\i4jdel.exe [2016/11/09 16:46:53 | 000,638,776 | ---- | M] ("My Web Shield") -- C:\Users\Zine\AppData\Local\Temp\E6B047E9-2CE6-41A1-BA29-2D87BED76CB0\9b33448929168974fa305a0ec4a35bc9.exe [2016/06/29 10:45:51 | 000,414,777 | ---- | M] (TMRG, Inc. ) -- C:\Users\Zine\AppData\Local\Temp\f9626892-7a78-3199-abd2-97bbce96297b\Extracted\adv_109.exe [2017/03/03 09:42:18 | 000,131,640 | ---- | M] (Tencent Inc.) -- C:\Users\Zine\AppData\Local\Temp\hpC1CE.tmp\QQBrowser.exe [2017/04/20 05:35:56 | 000,096,256 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\hpD8D3.tmp\CPK.exe [2017/03/09 07:12:04 | 000,116,224 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\lgE2E6F.tmp\Kyubey.exe [2017/03/03 04:09:47 | 000,115,200 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\lgE81A.tmp\Kyubey.exe [2010/03/18 22:16:28 | 000,078,152 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Setup.exe [2010/03/18 21:58:36 | 000,096,088 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SetupUtility.exe [2015/04/13 17:19:06 | 000,298,096 | ---- | M] (Mozilla Foundation) -- C:\Users\Zine\AppData\Local\Temp\MozUpdater\bgupdate\updater.exe [2016/12/04 17:31:20 | 000,734,520 | ---- | M] (Nero AG ) -- C:\Users\Zine\AppData\Local\Temp\NeroInstallFiles\NERO20150918112449163\setup.exe [2016/12/04 17:31:31 | 000,517,976 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\NeroInstallFiles\NERO20150918112449163\ISSetupPrerequisites\direct3d10.1Extensions9.29.952.3111D3dcsx\DXSETUP.exe [2016/12/04 17:31:31 | 000,165,648 | ---- | M] (Nero AG) -- C:\Users\Zine\AppData\Local\Temp\NeroInstallFiles\NERO20150918112449163\ISSetupPrerequisites\direct3d10.1Extensions9.29.952.3111D3dcsx\PRQStarter-1.exe [2016/12/04 17:31:31 | 000,517,976 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\NeroInstallFiles\NERO20150918112449163\ISSetupPrerequisites\direct3d10.1Extensions9.29.952.3111D3dx10\DXSETUP.exe [2016/12/04 17:31:31 | 000,165,648 | ---- | M] (Nero AG) -- C:\Users\Zine\AppData\Local\Temp\NeroInstallFiles\NERO20150918112449163\ISSetupPrerequisites\direct3d10.1Extensions9.29.952.3111D3dx10\PRQStarter-1.exe [2016/12/04 17:31:31 | 000,517,976 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\NeroInstallFiles\NERO20150918112449163\ISSetupPrerequisites\direct3d10.1Extensions9.29.952.3111D3dx11\DXSETUP.exe [2016/12/04 17:31:31 | 000,165,648 | ---- | M] (Nero AG) -- C:\Users\Zine\AppData\Local\Temp\NeroInstallFiles\NERO20150918112449163\ISSetupPrerequisites\direct3d10.1Extensions9.29.952.3111D3dx11\PRQStarter-1.exe [2016/12/04 17:31:31 | 000,517,976 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\NeroInstallFiles\NERO20150918112449163\ISSetupPrerequisites\direct3d10.1Extensions9.29.952.3111D3dx9\DXSETUP.exe [2016/12/04 17:31:31 | 000,165,648 | ---- | M] (Nero AG) -- C:\Users\Zine\AppData\Local\Temp\NeroInstallFiles\NERO20150918112449163\ISSetupPrerequisites\direct3d10.1Extensions9.29.952.3111D3dx9\PRQStarter-1.exe [2016/12/04 17:31:31 | 000,517,976 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\NeroInstallFiles\NERO20150918112449163\ISSetupPrerequisites\direct3dHlslCompiler9.29.952.3111\DXSETUP.exe [2016/12/04 17:31:31 | 000,165,648 | ---- | M] (Nero AG) -- C:\Users\Zine\AppData\Local\Temp\NeroInstallFiles\NERO20150918112449163\ISSetupPrerequisites\direct3dHlslCompiler9.29.952.3111\PRQStarter-1.exe [2016/12/04 17:31:31 | 000,081,920 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\NeroInstallFiles\NERO20150918112449163\ISSetupPrerequisites\lightscribeSystemSoftware\LSDriveDetect.exe [2016/12/04 17:31:31 | 000,090,384 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\NeroInstallFiles\NERO20150918112449163\ISSetupPrerequisites\lightscribeSystemSoftware\LS_LAUNCHER.exe [2016/12/04 17:31:31 | 000,165,648 | ---- | M] (Nero AG) -- C:\Users\Zine\AppData\Local\Temp\NeroInstallFiles\NERO20150918112449163\ISSetupPrerequisites\lightscribeSystemSoftware\PRQStarter-1.exe [2016/12/04 17:31:30 | 000,165,648 | ---- | M] (Nero AG) -- C:\Users\Zine\AppData\Local\Temp\NeroInstallFiles\NERO20150918112449163\ISSetupPrerequisites\microsoftVcRedist2010Sp1X86\PRQStarter-1.exe [2016/12/04 17:31:30 | 004,995,416 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\NeroInstallFiles\NERO20150918112449163\ISSetupPrerequisites\microsoftVcRedist2010Sp1X86\vcredist_x86.exe [2016/12/04 17:31:30 | 002,067,280 | ---- | M] (Nero AG) -- C:\Users\Zine\AppData\Local\Temp\NeroInstallFiles\NERO20150918112449163\ISSetupPrerequisites\microsoftVcRedist2012X86\PRQStarter-1.exe [2016/12/04 17:31:30 | 006,554,576 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\NeroInstallFiles\NERO20150918112449163\ISSetupPrerequisites\microsoftVcRedist2012X86\vcredist_x86.exe [2016/12/04 17:31:29 | 000,165,648 | ---- | M] (Nero AG) -- C:\Users\Zine\AppData\Local\Temp\NeroInstallFiles\NERO20150918112449163\ISSetupPrerequisites\msi4.5ForWindows6.0X64\PRQStarter-1.exe [2016/12/04 17:31:28 | 000,165,648 | ---- | M] (Nero AG) -- C:\Users\Zine\AppData\Local\Temp\NeroInstallFiles\NERO20150918112449163\ISSetupPrerequisites\msi4.5ForWindows6.0X86\PRQStarter-1.exe [2016/12/04 17:31:27 | 000,165,648 | ---- | M] (Nero AG) -- C:\Users\Zine\AppData\Local\Temp\NeroInstallFiles\NERO20150918112449163\ISSetupPrerequisites\msi4.5ForWindowsxpX86\PRQStarter-1.exe [2016/12/04 17:31:26 | 002,094,928 | ---- | M] (Nero AG) -- C:\Users\Zine\AppData\Local\Temp\NeroInstallFiles\NERO20150918112449163\ISSetupPrerequisites\rebootValidator\PRQStarter-1.exe [2016/12/04 17:31:25 | 002,566,416 | ---- | M] (Nero AG) -- C:\Users\Zine\AppData\Local\Temp\NeroInstallFiles\NERO20150918112449163\ISSetupPrerequisites\systemRequirementValidator\NeroOSValidator.exe [2016/12/04 17:31:25 | 000,165,648 | ---- | M] (Nero AG) -- C:\Users\Zine\AppData\Local\Temp\NeroInstallFiles\NERO20150918112449163\ISSetupPrerequisites\systemRequirementValidator\PRQStarter-1.exe [2016/05/15 18:04:00 | 002,089,472 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\RarSFX0\LogicHandler.exe [2015/02/02 10:29:06 | 000,702,280 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\sketchup_install\setup.exe [2015/12/20 18:20:04 | 000,889,416 | ---- | M] (Microsoft Corporation) -- C:\Users\Zine\AppData\Local\Temp\VSDD6D1.tmp\DotNetFX40\dotNetFx40_Full_setup.exe [2010/08/08 20:11:54 | 000,740,304 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\VSDEA11.tmp\Hydraulics_setup.exe [2016/07/03 14:03:39 | 002,121,216 | ---- | M] () -- C:\Users\Zine\AppData\Local\Temp\WzE21D3.tmp\gcalc420.exe [color=#A23BEC]< %SYSTEMDRIVE%\*.exe >[/color] [2015/09/23 12:22:25 | 000,920,048 | ---- | M] (Internet Program ) -- C:\CE CALC - Hydraulics Calculator.exe [2015/02/04 12:05:42 | 000,016,920 | ---- | M] (Internet Download Manager, Tonec Inc.) -- C:\MediumILStart.exe [color=#A23BEC]< %systemroot%\*. /mp /s >[/color] [color=#A23BEC]< %systemroot%\system32\*.dll /lockedfiles >[/color] [color=#A23BEC]< %systemroot%\Tasks\*.job /lockedfiles >[/color] [color=#A23BEC]< %systemroot%\system32\drivers\*.sys /lockedfiles >[/color] [color=#A23BEC]< %systemroot%\System32\config\*.sav >[/color] [color=#A23BEC]< MD5 for: EXPLORER.EXE >[/color] [2009/10/06 08:06:36 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=00B0358734CAA32C39D181FE6916B178 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20542_none_523cdab8f40fe558\explorer.exe [2011/02/26 07:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe [2009/07/14 03:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe [2011/02/26 07:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_525b5180f3f95373\explorer.exe [2016/01/22 07:12:59 | 002,973,184 | ---- | M] (Microsoft Corporation) MD5=2A156D5EBF221EF2A6AE7CE452324DAC -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.19135_none_53a73c47d80e17a9\explorer.exe [2011/02/26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_51a3a583dafd0cef\explorer.exe [2016/04/09 07:44:07 | 002,973,184 | ---- | M] (Microsoft Corporation) MD5=3DA48EA028AD771C5B71727F0C3984E9 -- C:\Windows\explorer.exe [2016/04/09 07:44:07 | 002,973,184 | ---- | M] (Microsoft Corporation) MD5=3DA48EA028AD771C5B71727F0C3984E9 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.23418_none_54497d94f118c5e4\explorer.exe [2010/11/20 14:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe [2011/02/25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe [2016/01/22 08:07:00 | 002,973,696 | ---- | M] (Microsoft Corporation) MD5=CEA6C2000AEC6CAF3CD6F3F73848E40A -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.23338_none_5433dbd6f129009f\explorer.exe [2009/10/06 07:53:03 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=FC89FACA0473641CB625EDA9277D0885 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16434_none_51c00e6ddae85c4b\explorer.exe [color=#A23BEC]< MD5 for: WININIT.EXE >[/color] [2009/07/14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe [2009/07/14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe [color=#A23BEC]< MD5 for: WINLOGON.EXE >[/color] [2014/07/16 04:56:14 | 000,304,640 | ---- | M] (Microsoft Corporation) MD5=4F37B93C14AEE313BEC52A23AFB15C2E -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.22750_none_7224b2134c7555fa\winlogon.exe [2014/07/17 03:39:27 | 000,304,128 | ---- | M] (Microsoft Corporation) MD5=52449FD429D6053B78AE564DEF303870 -- C:\Windows\System32\winlogon.exe [2014/07/17 03:39:27 | 000,304,128 | ---- | M] (Microsoft Corporation) MD5=52449FD429D6053B78AE564DEF303870 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.18540_none_71a5e34e334f9d18\winlogon.exe [2010/11/20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe [2009/07/14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe [2014/03/04 11:17:02 | 000,304,128 | ---- | M] (Microsoft Corporation) MD5=998507B046BA314CE8245364C686FA67 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.18409_none_71da23b23327143c\winlogon.exe [2014/03/04 12:39:02 | 000,304,640 | ---- | M] (Microsoft Corporation) MD5=D53972F87D850CD2EB4B29B60CAFDD77 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.22616_none_7255f1994c4f8119\winlogon.exe [color=#A23BEC]< HKEY_LOCAL_MACHINE\SYSTEM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters /s >[/color] [color=#A23BEC]< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems /s >[/color] "Debug" = "" = mnmsrvc "Kmode" = \SystemRoot\System32\win32k.sys "Optional" = Posix [binary data] "Posix" = %SystemRoot%\system32\psxss.exe "Required" = DebugWindows [binary data] "Windows" = %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\CSRSS] "CsrSrvSharedSectionBase" = 2137980928 [color=#A23BEC]< nslookup http://www.google.fr /c >[/color] DNS request timed out. timeout was 2 seconds. Serveur : UnKnown Address: fe80::c605:28ff:fe25:8b8a DNS request timed out. timeout was 2 seconds. DNS request timed out. timeout was 2 seconds. DNS request timed out. timeout was 2 seconds. DNS request timed out. timeout was 2 seconds. [color=#A23BEC]< hklm\software\clients\startmenuinternet|command /rs >[/color] HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\HideIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /HideShortcuts HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ShowIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /ShowShortcuts HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ReinstallCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\\ReinstallCommand: "C:\Program Files\Fanlook\Application\chrome.exe" "-ReinstallCommand" [2017/05/09 10:12:16 | 000,976,216 | ---- | M] (Google Inc.) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\\HideIconsCommand: "C:\Program Files\Fanlook\Application\chrome.exe" "-HideIconsCommand" [2017/05/09 10:12:16 | 000,976,216 | ---- | M] (Google Inc.) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\\ShowIconsCommand: "C:\Program Files\Fanlook\Application\chrome.exe" "-ShowIconsCommand" [2017/05/09 10:12:16 | 000,976,216 | ---- | M] (Google Inc.) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\shell\open\command\\: "c:\program files\google\chrome\application\chrome.exe" [2017/05/02 02:12:00 | 000,976,216 | ---- | M] (Google Inc.) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\Windows\System32\ie4uinit.exe" -show [2016/05/20 23:09:32 | 000,689,664 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\Windows\System32\ie4uinit.exe" -reinstall [2016/05/20 23:09:32 | 000,689,664 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\Windows\System32\ie4uinit.exe" -hide [2016/05/20 23:09:32 | 000,689,664 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2016/05/24 00:54:22 | 000,815,312 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: "c:\program files\internet explorer\iexplore.exe" [2016/05/24 00:54:22 | 000,815,312 | ---- | M] (Microsoft Corporation) [color=#A23BEC]< hklm\software\clients\startmenuinternet|command /64 /rs >[/color] HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\HideIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /HideShortcuts HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ShowIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /ShowShortcuts HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ReinstallCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\\ReinstallCommand: "C:\Program Files\Fanlook\Application\chrome.exe" "-ReinstallCommand" [2017/05/09 10:12:16 | 000,976,216 | ---- | M] (Google Inc.) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\\HideIconsCommand: "C:\Program Files\Fanlook\Application\chrome.exe" "-HideIconsCommand" [2017/05/09 10:12:16 | 000,976,216 | ---- | M] (Google Inc.) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\\ShowIconsCommand: "C:\Program Files\Fanlook\Application\chrome.exe" "-ShowIconsCommand" [2017/05/09 10:12:16 | 000,976,216 | ---- | M] (Google Inc.) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\shell\open\command\\: "c:\program files\google\chrome\application\chrome.exe" [2017/05/02 02:12:00 | 000,976,216 | ---- | M] (Google Inc.) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\Windows\System32\ie4uinit.exe" -show [2016/05/20 23:09:32 | 000,689,664 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\Windows\System32\ie4uinit.exe" -reinstall [2016/05/20 23:09:32 | 000,689,664 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\Windows\System32\ie4uinit.exe" -hide [2016/05/20 23:09:32 | 000,689,664 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2016/05/24 00:54:22 | 000,815,312 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: "c:\program files\internet explorer\iexplore.exe" [2016/05/24 00:54:22 | 000,815,312 | ---- | M] (Microsoft Corporation) [color=#E56717]========== Alternate Data Streams ==========[/color] @Alternate Data Stream - 808 bytes -> C:\windows\System32\drivers\uyipjlbr.sys:changelist @Alternate Data Stream - 680 bytes -> C:\windows\System32\drivers\ahpxhmwg.sys:changelist @Alternate Data Stream - 578224 bytes -> C:\windows\System32\drivers:x86 @Alternate Data Stream - 34280 bytes -> C:\windows\System32\drivers:ucdrv-x86.sys @Alternate Data Stream - 340 bytes -> C:\windows\System32\drivers\rrgubzmx.sys:changelist @Alternate Data Stream - 169 bytes -> C:\ProgramData\TEMP:1CE11B51 @Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:E369BDA7 < End of report >