Script Zhpfix
O38 - TASK: {ACF488FF-4DD4-421B-9624-204206DC3943} [64Bits][\R@1n-KMS\Office14ProPlus] - (...) -- wmic  [0] 
C:\Windows\System32\Tasks\R@1n-KMS\Office14ProPlus - (...) -- wmic  [path OfficeSoftwareProtectionProduct where (ID="6f] 
O4 - HKLM\..\Wow6432Node\Run: [AvastUI.exe] . (. - .) -- C:\Program Files\AVAST Software\Avast\AvLaunch.exe (.Not File.)
C:\Windows\System32\Tasks\R@1n-KMS\Office14ProPlus
C:\Windows\KMS-R@1n.exe
C:\Windows\KMS-R@1nHook.exe
C:\Windows\Prefetch\KMS-R@1NHOOK.EXE-572109D9.pf
[HKLM\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\firewallRules]:{BBCF7E5C-5538-49B2-9CED-EC7EF3AD47E1}
[HKLM\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\firewallRules]:{349228E9-5816-460A-A1F7-E58C01E51342}
C:\Users\Marie\AppData\Local\Google\Chrome\User Data\Default\File System\000
C:\Users\Marie\AppData\Local\Google\Chrome\User Data\Default\File System\006
C:\Users\Marie\AppData\Local\Google\Chrome\User Data\Default\File System\007
EmptyPrefetch
Emptytemp
EmptyClsid