[dagp06]

Hi!

 

I've read on this forum that someone had the same issue as mine:

http://www.geekstogo...ast-at-startup/

 

Everytime my PC turns on, avast shows 2 or 3 alerts of malwares. One of them is:

 

 

URL: http:\\reddie.net/3131/SectionAppend_142243141942296.dll

Infection: URL:Mal

Process: C:\Windows\System32\svchost.exe

 

I would really appreciate your help with this! I ran ADW Cleaner, Malwarebytes followed by HitmanPro. Some files were deleted, but when my PC rebooted, avast kept alerting me.

 

Many thanks.

 

Dagp06

[Advertisements]

Hello dagp06, welcome to Geeks to Go Malware Removal forum!
 
My username is LiquidTension, but you can call me Adam. I will be assisting you with your malware-related problems.
If you would allow me to call you by your first name I would prefer that.  
 
======================================================
 
Please read through the points below to ensure this process moves as quickly and efficiently as possible.

• Ensure you read through my instructions thoroughly, and carry out each step in the order specified.
• Please do not run any tools or take any steps other than those I provide for you. Independent efforts may make matters worse, and will affect my ability in providing the best set of instructions for you.
• Please backup important files before proceeding with my instructions. Malware removal can be unpredictable at times.   
• If you come across any issues whilst following my instructions, please stop and inform me of the issue in as much detail as possible. Please do not hesitate to ask before proceeding.
• Topics are locked if no response is made after 4 days. Please inform me if you require additional time to complete my instructions.
• I will notify you when I believe your computer is free of malware. Please bear in mind, absence of symptoms does not necessarily correlate to absence of malware, so please wait until the "All Clean". 
• Ensure you are following this topic. Click  at the top of the page. 

======================================================
 
Please run the following diagnostic scans so I can ascertain the state of your computer.
 
STEP 1
 Farbar Recovery Scan Tool (FRST) Scan

• Please download Farbar Recovery Scan Tool (x32) or Farbar Recovery Scan Tool (x64) and save the file to your Desktop.
• Note: Download and run the version compatible with your system (32 or 64-bit). Download both if you're unsure; only one will run.
• Right-Click FRST.exe or FRST64.exe and select  Run as administrator to run the programme.
• Click Yes to the disclaimer.
• Ensure the Addition.txt box is checked.
• Click the Scan button and let the programme run.
• Upon completion, click OK, then OK on the Addition.txt pop up screen.
• Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply. 
   

STEP 2
 TDSSKiller Scan

• Please download TDSSKiller and save the file to your Desktop.
• Right-Click TDSSKiller.exe and select  Run as administrator to run the programme.
• Click Change parameters. Place a checkmark next to Detect TDLFS file system and Verify file digital signatures.
• ​Click Start Scan. Do not use the computer during the scan.
• If objects are found, change the action to skip.
• Click Continue and close the window.
• A log will be created and saved to the root directory (usually C:\). Attach (not copy/paste) the file in your next reply.
   

======================================================
 
STEP 3
 Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• FRST.txt
• Addition.txt
• TDSSKiller log (attached!)

[LiquidTension]

Hello dagp06, welcome to Geeks to Go Malware Removal forum!
 
My username is LiquidTension, but you can call me Adam. I will be assisting you with your malware-related problems.
If you would allow me to call you by your first name I would prefer that.  
 
======================================================
 
Please read through the points below to ensure this process moves as quickly and efficiently as possible.

• Ensure you read through my instructions thoroughly, and carry out each step in the order specified.
• Please do not run any tools or take any steps other than those I provide for you. Independent efforts may make matters worse, and will affect my ability in providing the best set of instructions for you.
• Please backup important files before proceeding with my instructions. Malware removal can be unpredictable at times.   
• If you come across any issues whilst following my instructions, please stop and inform me of the issue in as much detail as possible. Please do not hesitate to ask before proceeding.
• Topics are locked if no response is made after 4 days. Please inform me if you require additional time to complete my instructions.
• I will notify you when I believe your computer is free of malware. Please bear in mind, absence of symptoms does not necessarily correlate to absence of malware, so please wait until the "All Clean". 
• Ensure you are following this topic. Click  at the top of the page. 

======================================================
 
Please run the following diagnostic scans so I can ascertain the state of your computer.
 
STEP 1
 Farbar Recovery Scan Tool (FRST) Scan

• Please download Farbar Recovery Scan Tool (x32) or Farbar Recovery Scan Tool (x64) and save the file to your Desktop.
• Note: Download and run the version compatible with your system (32 or 64-bit). Download both if you're unsure; only one will run.
• Right-Click FRST.exe or FRST64.exe and select  Run as administrator to run the programme.
• Click Yes to the disclaimer.
• Ensure the Addition.txt box is checked.
• Click the Scan button and let the programme run.
• Upon completion, click OK, then OK on the Addition.txt pop up screen.
• Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply. 
   

STEP 2
 TDSSKiller Scan

• Please download TDSSKiller and save the file to your Desktop.
• Right-Click TDSSKiller.exe and select  Run as administrator to run the programme.
• Click Change parameters. Place a checkmark next to Detect TDLFS file system and Verify file digital signatures.
• ​Click Start Scan. Do not use the computer during the scan.
• If objects are found, change the action to skip.
• Click Continue and close the window.
• A log will be created and saved to the root directory (usually C:\). Attach (not copy/paste) the file in your next reply.
   

======================================================
 
STEP 3
 Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• FRST.txt
• Addition.txt
• TDSSKiller log (attached!)

[dagp06]

Hi Adam,
 
Thanks for your support. My name is Pascal.
 
Here are the logs you asked for: TDSSKiller's log is attached.
__________________________________________________________________________
FRST.txt
 
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-02-2015
Ran by Pascal (administrator) on DAGP06-TOUR-WIN on 16-02-2015 08:50:58
Running from C:\Users\Pascal\Desktop
Loaded Profiles: Pascal (Available profiles: Pascal)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Français (France)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Phone Tools\CoreCon\11.0\bin\IpOverUsbSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
() C:\Program Files\MySQL\MySQL Server 5.6\bin\mysqld.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
() C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler64.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Dropbox, Inc.) C:\Users\Pascal\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2585928 2015-01-16] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-01-30] (AVAST Software)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKU\S-1-5-21-2680848391-1775793970-1252864707-1000\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-13] (Microsoft Corporation)
HKU\S-1-5-21-2680848391-1775793970-1252864707-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7404312 2015-01-20] (Piriform Ltd)
Startup: C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Pascal\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Pascal\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Pascal\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Pascal\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Pascal\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Pascal\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Pascal\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Pascal\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2680848391-1775793970-1252864707-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:Tabs
HKU\S-1-5-21-2680848391-1775793970-1252864707-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://ca.msn.com/de....aspx?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Microsoft Web Test Recorder 12.0 Helper -> {432dd630-7e03-4c97-9d62-b99f52df4fc2} -> C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dll (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Programme d'assistance de Microsoft Web Test Recorder 10.0 -> {DDA57003-0068-4ed2-9D32-4D1EC707D94D} -> C:\Program Files (x86)\Microsoft Visual Studio 10.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\cp8jcokv.default
FF NetworkProxy: "autoconfig_url", "http://proxy.biblio.polymtl.ca/"
FF NetworkProxy: "type", 2
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin: adobe.com/AdobeExManDetect -> C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\Win64Plugin\npAdobeExManDetectX64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nexon.net/NxGame -> C:\ProgramData\NexonUS\NGM\npNxGameUS.dll (Nexon)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin-x32: adobe.com/AdobeExManDetect -> C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\npAdobeExManDetectX86.dll (Adobe Systems)
FF Extension: DownloadHelper - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\cp8jcokv.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2015-02-05]
FF Extension: Adblock Plus - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\cp8jcokv.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-09-27]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-09-26]

Chrome:
=======
CHR Profile: C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Profile 2
CHR Extension: (Docs) - C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-04]
CHR Extension: (Google Drive) - C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-02-04]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-02-04]
CHR Extension: (YouTube) - C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-02-04]
CHR Extension: (Recherche Google) - C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-02-04]
CHR Extension: (Gmail) - C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-02-04]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-11-17]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-11-17] (AVAST Software)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2014-11-17] (Avast Software)
S3 c2wts; C:\Program Files\Windows Identity Foundation\v3.5\c2wtshost.exe [15768 2010-02-02] (Microsoft Corporation)
S3 fussvc; C:\Program Files (x86)\Windows Kits\8.1\App Certification Kit\fussvc.exe [142336 2014-02-19] (Microsoft Corporation) [File not signed]
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148744 2015-01-16] (NVIDIA Corporation)
R2 IpOverUsbSvc; C:\Program Files (x86)\Common Files\Microsoft Shared\Phone Tools\CoreCon\11.0\bin\IpOverUsbSvc.exe [22768 2014-04-17] (Microsoft Corporation)
R2 MSSQL$SQLEXPRESS; c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [58387104 2014-07-12] (Microsoft Corporation)
R2 MySQL56; C:\Program Files\MySQL\MySQL Server 5.6\bin\mysqld.exe [13031424 2014-09-11] () [File not signed]
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1706312 2015-01-16] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21833544 2015-01-16] (NVIDIA Corporation)
S4 SQLAgent$SQLEXPRESS; c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [441504 2014-07-12] (Microsoft Corporation)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
S3 Te.Service; C:\Program Files (x86)\Windows Kits\8.1\Testing\Runtimes\TAEF\Wex.Services.exe [119808 2013-08-22] (Microsoft Corporation) [File not signed]
R2 VMwareHostd; C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe [14405200 2013-10-18] ()
S3 VsEtwService120; C:\Program Files\Microsoft Visual Studio 12.0\Common7\Packages\Debugger\Services\VsEtwService.exe [87736 2014-04-30] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-11-17] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2014-11-17] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-11-17] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-11-17] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2014-11-21] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2014-11-17] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2014-11-17] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2014-11-17] ()
S3 hitmanpro37; C:\Windows\system32\drivers\hitmanpro37.sys [43664 2015-02-15] ()
S3 MotioninJoyXFilter; C:\Windows\System32\DRIVERS\MijXfilt.sys [121416 2014-12-05] (MotioninJoy) [File not signed]
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19784 2015-01-16] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)
U4 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [271752 2014-11-17] (Avast Software)
R0 vsock; C:\Windows\System32\drivers\vsock.sys [73296 2013-10-08] (VMware, Inc.)
R2 vstor2-mntapi20-shared; C:\Windows\SysWow64\drivers\vstor2-mntapi20-shared.sys [33872 2013-02-22] (VMware, Inc.)
S3 cpuz138; \??\C:\Users\Pascal\AppData\Local\Temp\cpuz138\cpuz138_x64.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-16 08:50 - 2015-02-16 08:51 - 00017497 _____ () C:\Users\Pascal\Desktop\FRST.txt
2015-02-16 08:50 - 2015-02-16 08:51 - 00000000 ____D () C:\FRST
2015-02-16 08:50 - 2015-02-16 08:50 - 02085888 _____ (Farbar) C:\Users\Pascal\Desktop\FRST64.exe
2015-02-15 23:25 - 2015-02-15 23:25 - 00000376 _____ () C:\Windows\PFRO.log
2015-02-15 23:23 - 2015-02-15 23:23 - 00000798 _____ () C:\Windows\system32\.crusader
2015-02-15 23:15 - 2015-02-15 23:25 - 00043664 _____ () C:\Windows\system32\Drivers\hitmanpro37.sys
2015-02-15 23:15 - 2015-02-15 23:23 - 00000000 ____D () C:\ProgramData\HitmanPro
2015-02-15 22:38 - 2015-02-15 22:39 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-15 22:38 - 2015-02-15 22:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-02-15 22:38 - 2015-02-15 22:38 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-02-15 22:38 - 2015-02-15 22:38 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-02-15 22:38 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-02-15 22:38 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-02-15 22:38 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-02-15 20:48 - 2015-02-15 20:57 - 00220480 _____ () C:\Users\Pascal\Desktop\temp.psd
2015-02-15 20:02 - 2015-02-15 20:42 - 00000000 ____D () C:\AdwCleaner
2015-02-12 20:57 - 2015-01-22 23:42 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-02-12 20:57 - 2015-01-22 23:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-12 20:57 - 2015-01-22 22:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-02-12 20:57 - 2015-01-22 22:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-02-10 22:24 - 2015-02-03 22:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-02-10 22:24 - 2015-02-03 22:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-02-10 22:24 - 2015-02-03 22:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-02-10 22:24 - 2015-02-03 22:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-02-10 22:24 - 2015-02-03 22:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-02-10 22:24 - 2015-02-03 22:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-02-10 22:24 - 2015-02-03 22:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-02-10 22:24 - 2015-01-27 18:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2015-02-10 22:24 - 2015-01-14 00:47 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-10 22:24 - 2015-01-14 00:09 - 00342712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-02-10 22:24 - 2015-01-11 22:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-10 22:24 - 2015-01-11 22:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-02-10 22:24 - 2015-01-11 22:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-02-10 22:24 - 2015-01-11 21:49 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-02-10 22:24 - 2015-01-11 21:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-10 22:24 - 2015-01-11 21:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-10 22:24 - 2015-01-11 21:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-02-10 22:24 - 2015-01-11 21:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-02-10 22:24 - 2015-01-11 21:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-02-10 22:24 - 2015-01-11 21:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-02-10 22:24 - 2015-01-11 21:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-02-10 22:24 - 2015-01-11 21:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-02-10 22:24 - 2015-01-11 21:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-02-10 22:24 - 2015-01-11 21:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-02-10 22:24 - 2015-01-11 21:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-02-10 22:24 - 2015-01-11 21:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-02-10 22:24 - 2015-01-11 21:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-10 22:24 - 2015-01-11 21:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-02-10 22:24 - 2015-01-11 21:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-02-10 22:24 - 2015-01-11 21:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-02-10 22:24 - 2015-01-11 21:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-10 22:24 - 2015-01-11 21:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-02-10 22:24 - 2015-01-11 21:07 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-02-10 22:24 - 2015-01-11 21:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-02-10 22:24 - 2015-01-11 21:04 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-02-10 22:24 - 2015-01-11 21:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-02-10 22:24 - 2015-01-11 21:00 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-02-10 22:24 - 2015-01-11 20:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-02-10 22:24 - 2015-01-11 20:57 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-02-10 22:24 - 2015-01-11 20:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-02-10 22:24 - 2015-01-11 20:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-10 22:24 - 2015-01-11 20:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-10 22:24 - 2015-01-11 20:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-10 22:24 - 2015-01-11 20:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-02-10 22:24 - 2015-01-11 20:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-02-10 22:24 - 2015-01-11 20:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-10 22:24 - 2015-01-11 20:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-02-10 22:24 - 2015-01-11 20:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-02-10 22:24 - 2015-01-11 20:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-02-10 22:24 - 2015-01-11 20:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-02-10 22:24 - 2015-01-11 20:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-10 22:24 - 2015-01-11 20:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-02-10 22:24 - 2015-01-11 20:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-02-10 22:24 - 2015-01-11 20:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-02-10 22:24 - 2015-01-11 20:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-02-10 22:24 - 2015-01-11 20:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-10 22:24 - 2015-01-11 20:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-02-10 22:24 - 2015-01-11 20:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-02-10 22:24 - 2015-01-11 19:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-02-10 22:24 - 2015-01-11 19:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-02-10 22:24 - 2015-01-10 01:48 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-02-10 22:24 - 2015-01-10 01:48 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-02-10 22:24 - 2015-01-10 01:48 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-02-10 22:24 - 2015-01-10 01:48 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-02-10 22:24 - 2015-01-10 01:48 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-02-10 22:24 - 2015-01-10 01:48 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-02-10 22:24 - 2015-01-10 01:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-02-10 22:24 - 2015-01-10 01:27 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-02-10 22:24 - 2015-01-10 01:27 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-02-10 22:24 - 2015-01-10 01:27 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-02-10 22:24 - 2015-01-10 01:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-02-10 22:24 - 2015-01-10 01:27 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-02-10 22:24 - 2015-01-10 01:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-02-10 22:24 - 2015-01-10 01:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-02-10 22:21 - 2015-01-15 03:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-02-10 22:21 - 2015-01-15 03:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-02-10 22:21 - 2015-01-15 03:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-02-10 22:21 - 2015-01-15 03:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-02-10 22:21 - 2015-01-15 03:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-02-10 22:21 - 2015-01-15 03:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-02-10 22:21 - 2015-01-15 03:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-02-10 22:21 - 2015-01-15 03:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-02-10 22:21 - 2015-01-15 03:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-02-10 22:21 - 2015-01-15 03:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-02-10 22:21 - 2015-01-15 03:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-02-10 22:21 - 2015-01-15 02:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-02-10 22:21 - 2015-01-15 02:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-02-10 22:21 - 2015-01-15 02:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-02-10 22:21 - 2015-01-15 02:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-02-10 22:21 - 2015-01-15 02:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-02-10 22:21 - 2015-01-15 02:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-02-10 22:21 - 2015-01-14 23:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-02-10 22:21 - 2015-01-12 22:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-10 22:21 - 2015-01-12 21:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-02-10 22:21 - 2014-12-12 00:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-02-10 22:21 - 2014-12-12 00:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-02-10 22:21 - 2014-11-25 22:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-10 22:21 - 2014-11-25 22:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-10 22:20 - 2015-01-14 01:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-10 22:20 - 2015-01-14 01:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-02-10 22:20 - 2015-01-14 01:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-02-10 22:20 - 2015-01-14 01:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-02-10 22:20 - 2015-01-14 00:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-02-10 22:20 - 2015-01-14 00:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-02-10 22:20 - 2015-01-14 00:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-02-10 22:20 - 2015-01-08 21:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-10 22:20 - 2014-12-07 22:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-10 22:20 - 2014-12-07 21:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2015-02-05 20:59 - 2015-02-16 08:40 - 00002460 _____ () C:\Windows\setupact.log
2015-02-05 20:59 - 2015-02-05 20:59 - 00000000 _____ () C:\Windows\setuperr.log
2015-02-04 20:08 - 2015-02-04 20:08 - 00000000 ____D () C:\Users\Pascal\Documents\Favoris
2015-02-02 00:13 - 2015-02-02 00:13 - 00000000 ____D () C:\Users\Pascal\AppData\Roaming\NVIDIA
2015-02-02 00:07 - 2015-02-02 00:07 - 00000000 __SHD () C:\Users\Pascal\AppData\Local\EmieBrowserModeList
2015-01-30 22:43 - 2015-01-30 22:43 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-24 17:57 - 2015-02-16 08:39 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-01-24 17:57 - 2015-01-09 18:30 - 06860432 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2015-01-24 17:57 - 2015-01-09 18:30 - 03517256 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2015-01-24 17:57 - 2015-01-09 18:29 - 02558608 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2015-01-24 17:57 - 2015-01-09 18:29 - 00935056 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2015-01-24 17:57 - 2015-01-09 18:29 - 00385352 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2015-01-24 17:57 - 2015-01-09 18:29 - 00062608 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2015-01-24 17:57 - 2015-01-09 17:27 - 00621200 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2015-01-24 17:57 - 2015-01-09 14:47 - 04173527 _____ () C:\Windows\system32\nvcoproc.bin
2015-01-24 17:56 - 2015-01-10 03:07 - 00073872 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2015-01-24 17:56 - 2015-01-10 03:07 - 00060744 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2015-01-24 17:55 - 2015-01-12 23:15 - 01540240 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll
2015-01-24 17:55 - 2015-01-12 23:15 - 00195728 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2015-01-24 17:55 - 2015-01-12 23:15 - 00030536 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2015-01-24 17:55 - 2015-01-10 03:07 - 32102544 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2015-01-24 17:55 - 2015-01-10 03:07 - 25459856 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2015-01-24 17:55 - 2015-01-10 03:07 - 24765584 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2015-01-24 17:55 - 2015-01-10 03:07 - 20465296 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2015-01-24 17:55 - 2015-01-10 03:07 - 18566296 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2015-01-24 17:55 - 2015-01-10 03:07 - 17250776 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2015-01-24 17:55 - 2015-01-10 03:07 - 16009120 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2015-01-24 17:55 - 2015-01-10 03:07 - 14115944 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2015-01-24 17:55 - 2015-01-10 03:07 - 13295552 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2015-01-24 17:55 - 2015-01-10 03:07 - 13210248 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2015-01-24 17:55 - 2015-01-10 03:07 - 10774544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2015-01-24 17:55 - 2015-01-10 03:07 - 10714488 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2015-01-24 17:55 - 2015-01-10 03:07 - 10274448 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2015-01-24 17:55 - 2015-01-10 03:07 - 03607184 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2015-01-24 17:55 - 2015-01-10 03:07 - 03298816 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2015-01-24 17:55 - 2015-01-10 03:07 - 03245712 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2015-01-24 17:55 - 2015-01-10 03:07 - 02902456 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2015-01-24 17:55 - 2015-01-10 03:07 - 01895240 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434725.dll
2015-01-24 17:55 - 2015-01-10 03:07 - 01556808 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434725.dll
2015-01-24 17:55 - 2015-01-10 03:07 - 00994712 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2015-01-24 17:55 - 2015-01-10 03:07 - 00969360 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2015-01-24 17:55 - 2015-01-10 03:07 - 00942736 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2015-01-24 17:55 - 2015-01-10 03:07 - 00929424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2015-01-24 17:55 - 2015-01-10 03:07 - 00906384 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2015-01-24 17:55 - 2015-01-10 03:07 - 00877488 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2015-01-24 17:55 - 2015-01-10 03:07 - 00496456 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2015-01-24 17:55 - 2015-01-10 03:07 - 00399688 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2015-01-24 17:55 - 2015-01-10 03:07 - 00390472 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll
2015-01-24 17:55 - 2015-01-10 03:07 - 00353040 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2015-01-24 17:55 - 2015-01-10 03:07 - 00345744 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll
2015-01-24 17:55 - 2015-01-10 03:07 - 00305320 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2015-01-24 17:55 - 2015-01-10 03:07 - 00177624 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2015-01-24 17:55 - 2015-01-10 03:07 - 00164568 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2015-01-24 17:55 - 2015-01-10 03:07 - 00027441 _____ () C:\Windows\system32\nvinfo.pb
2015-01-24 17:48 - 2014-11-22 05:46 - 00038032 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2015-01-24 17:48 - 2014-11-22 05:46 - 00032400 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-16 08:50 - 2014-10-16 12:41 - 00000000 ____D () C:\Users\Pascal\AppData\Local\Adobe
2015-02-16 08:47 - 2009-07-13 23:45 - 00031904 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-16 08:47 - 2009-07-13 23:45 - 00031904 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-16 08:43 - 2014-09-23 13:57 - 01731847 _____ () C:\Windows\WindowsUpdate.log
2015-02-16 08:41 - 2014-09-27 06:03 - 00000000 ___RD () C:\Users\Pascal\Dropbox
2015-02-16 08:41 - 2014-09-27 06:02 - 00000000 ____D () C:\Users\Pascal\AppData\Roaming\Dropbox
2015-02-16 08:40 - 2014-10-30 08:58 - 00000442 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2015-02-16 08:40 - 2014-10-28 22:49 - 00000000 ____D () C:\ProgramData\VMware
2015-02-16 08:40 - 2014-09-26 23:09 - 00001066 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-16 08:39 - 2009-07-14 00:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-15 23:37 - 2014-09-26 23:09 - 00001070 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-15 20:57 - 2014-12-15 23:34 - 00000132 _____ () C:\Users\Pascal\AppData\Roaming\Adobe PNG Format CS6 Prefs
2015-02-15 19:57 - 2014-09-26 23:59 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-02-13 22:01 - 2011-04-12 04:16 - 00816780 _____ () C:\Windows\system32\perfh00C.dat
2015-02-13 22:01 - 2011-04-12 04:16 - 00176630 _____ () C:\Windows\system32\perfc00C.dat
2015-02-13 22:01 - 2009-07-14 00:13 - 01865286 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-13 21:20 - 2014-10-16 12:42 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-13 21:20 - 2014-10-16 12:42 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-13 00:09 - 2014-10-16 16:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-02-13 00:09 - 2014-10-16 16:21 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-12 23:07 - 2014-09-30 20:52 - 00000000 ___RD () C:\Users\Pascal\Documents\Programmes
2015-02-12 21:36 - 2014-09-27 06:02 - 00000000 ____D () C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-02-12 20:48 - 2009-07-13 23:45 - 05168768 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-12 20:45 - 2014-12-11 09:57 - 00000000 ____D () C:\Windows\system32\appraiser
2015-02-12 20:45 - 2014-09-27 03:17 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-02-12 20:45 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-02-10 22:43 - 2014-10-14 12:27 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-10 22:39 - 2014-09-27 12:46 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-10 22:35 - 2014-09-27 12:46 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-02-10 22:15 - 2014-10-16 16:34 - 00000000 ____D () C:\ProgramData\Oracle
2015-02-10 22:15 - 2014-10-16 16:34 - 00000000 ____D () C:\Program Files (x86)\Java
2015-02-10 22:14 - 2014-10-16 16:35 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-02-09 22:29 - 2014-10-13 23:02 - 00000000 ____D () C:\Program Files\CCleaner
2015-02-05 21:32 - 2014-09-26 23:09 - 00004066 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-05 21:32 - 2014-09-26 23:09 - 00003814 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-04 20:20 - 2014-11-06 11:14 - 00000000 ____D () C:\Users\Pascal\Documents\Livres
2015-02-04 20:14 - 2014-10-13 23:05 - 00000000 ____D () C:\Users\Pascal\Documents\Régistres Backup
2015-02-04 19:58 - 2014-10-14 13:07 - 00000000 ____D () C:\Users\Pascal\Documents\Visual Studio 2013
2015-02-02 10:28 - 2014-10-25 21:12 - 00000000 ____D () C:\Users\Pascal\AppData\Roaming\vlc
2015-02-02 09:59 - 2014-09-26 23:12 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-24 17:57 - 2014-09-26 23:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2015-01-24 17:57 - 2014-09-26 23:35 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2015-01-24 17:57 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\Help
2015-01-24 17:56 - 2014-09-26 23:41 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2015-01-24 17:56 - 2014-09-26 23:36 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2015-01-24 17:51 - 2014-10-16 18:13 - 00000000 ____D () C:\Users\Pascal\Documents\Visual Studio 2010

==================== Files in the root of some directories =======

2014-12-15 23:34 - 2015-02-15 20:57 - 0000132 _____ () C:\Users\Pascal\AppData\Roaming\Adobe PNG Format CS6 Prefs
2014-11-28 23:21 - 2014-11-28 23:21 - 0005045 _____ () C:\ProgramData\wmzddnmb.cix

Some content of TEMP:
====================
C:\Users\Pascal\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpmqt59a.dll
C:\Users\Pascal\AppData\Local\Temp\jre-8u31-windows-au.exe
C:\Users\Pascal\AppData\Local\Temp\Quarantine.exe
C:\Users\Pascal\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-04 19:52

==================== End Of Log ============================
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

__________________________________________________________________________
Addition.txt
 
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-02-2015
Ran by Pascal at 2015-02-16 08:51:35
Running from C:\Users\Pascal\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 Tools for .Net 3.5 - FRA Lang Pack (x32 Version: 3.11.50727 - Microsoft Corporation) Hidden
 Tools for .Net 3.5 (x32 Version: 3.11.50727 - Microsoft Corporation) Hidden
µTorrent (HKU\S-1-5-21-2680848391-1775793970-1252864707-1000\...\uTorrent) (Version: 3.4.2.34727 - BitTorrent Inc.)
4Videosoft MKV Video Converter (HKLM-x32\...\4Videosoft MKV Video Converter_is1) (Version:  - )
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 15.0.0.356 - Adobe Systems Incorporated)
Adobe Digital Editions 4.0 (HKLM-x32\...\Adobe Digital Editions 4.0) (Version: 4.0 - Adobe Systems Incorporated)
Adobe Dreamweaver CS6 (HKLM-x32\...\{A4ED5E53-7AA0-11E1-BF04-B2D4D4A5360E}) (Version: 12 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Help Manager (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 4.0.244 - Adobe Systems Incorporated)
Adobe Illustrator CS6 (HKLM-x32\...\{4869414E-7AEA-4C8E-BE1C-8D40977FD517}) (Version: 16.0 - Adobe Systems Incorporated)
Adobe Photoshop CS6 (HKLM-x32\...\{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}) (Version: 13.0 - Adobe Systems Incorporated)
Adobe Widget Browser (HKLM-x32\...\com.adobe.WidgetBrowser) (Version: 2.0 Build 348 - Adobe Systems Incorporated.)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.0.2208 - AVAST Software)
AzureTools.Notifications (x32 Version: 2.1.10731.1602 - Microsoft Corporation) Hidden
Behaviors SDK (Windows Phone) for Visual Studio 2013 (x32 Version: 12.0.50429.0 - Microsoft Corporation) Hidden
Behaviors SDK (Windows) for Visual Studio 2013 (x32 Version: 12.0.50429.0 - Microsoft Corporation) Hidden
Blend for Visual Studio 2013 (x32 Version: 12.0.41002.1 - Microsoft Corporation) Hidden
Blend for Visual Studio 2013 FRA resources (x32 Version: 12.0.41002.1 - Microsoft Corporation) Hidden
Blend for Visual Studio SDK for .NET 4.5 (x32 Version: 3.0.40218.0 - Microsoft Corporation) Hidden
Blend for Visual Studio SDK for Silverlight 5 (x32 Version: 3.0.40218.0 - Microsoft Corporation) Hidden
Build Tools - amd64 (Version: 12.0.30501 - Microsoft Corporation) Hidden
Build Tools - x86 (x32 Version: 12.0.30501 - Microsoft Corporation) Hidden
Build Tools Language Resources - amd64 (Version: 12.0.30501 - Microsoft Corporation) Hidden
Build Tools Language Resources - x86 (x32 Version: 12.0.30501 - Microsoft Corporation) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.02 - Piriform)
Complemento do Microsoft Report Viewer para Visual Studio 2013 (x32 Version: 11.1.3411.3 - Microsoft Corporation) Hidden
Complemento Microsoft Report Viewer para Visual Studio 2013 (x32 Version: 11.1.3411.3 - Microsoft Corporation) Hidden
Compon. agg. Microsoft Report Viewer per Visual Studio 2013 (x32 Version: 11.1.3411.3 - Microsoft Corporation) Hidden
Composants requis pour SSDT  (HKLM-x32\...\{D2B694C7-21FB-4E7C-B207-EBC1CB0EBA79}) (Version: 11.1.3000.0 - Microsoft Corporation)
Concepteur d'interface utilisateur XAML Microsoft Visual Studio 2013 - FRA (x32 Version: 12.0.30501 - Microsoft Corporation) Hidden
CPUID HWMonitor 1.26 (HKLM\...\CPUID HWMonitor_is1) (Version:  - )
Crystal Reports for Visual Studio (x32 Version: 12.51.0.240 - SAP) Hidden
DOSBox SVN-Daum version 20140127 (HKLM-x32\...\{AA388FA6-2142-4E89-B75E-C3315BA37171}_is1) (Version: 20140127 - )
Dotfuscator and Analytics Community Edition (x32 Version: 5.5.4954.46574 - PreEmptive Solutions) Hidden
Dotfuscator Software Services - Community Edition - FRA (HKLM-x32\...\{6F6D6F36-0B0A-4C88-AB1D-986046435A24}) (Version: 5.0.2300.0 - PreEmptive Solutions)
Dotfuscator Software Services - Community Edition (HKLM-x32\...\{41B31ABE-5A6E-498A-8F28-3BA3B8779A41}) (Version: 5.0.2300.0 - PreEmptive Solutions)
Dropbox (HKU\S-1-5-21-2680848391-1775793970-1252864707-1000\...\Dropbox) (Version: 3.2.6 - Dropbox, Inc.)
Entity Framework 6.1.0 Tools  for Visual Studio 2013 (HKLM-x32\...\{D4635FB4-434D-4663-A4C8-CFC00FA9D24E}) (Version: 12.0.30228.0 - Microsoft Corporation)
Finale PrintMusic 2014 (HKLM-x32\...\Finale PrintMusic 2014) (Version: 2014.0.820.0 - MakeMusic)
GDR 5520 pour SQL Server 2008 (KB2977321) (64-bit) (HKLM\...\KB2977321) (Version: 10.3.5520.0 - Microsoft Corporation)
Geeks3D FurMark 1.15.1.0 (HKLM-x32\...\{2397CAD4-2263-4CD0-96BE-E43A980B9C9A}_is1) (Version:  - Geeks3D)
Giana Sisters: Twisted Dreams (HKLM-x32\...\Steam App 223220) (Version:  - Black Forest Games)
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.111 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
IIS 8.0 Express (HKLM\...\{7BF61FA9-BDFB-4563-98AD-FCB0DA28CCC7}) (Version: 8.0.1557 - Microsoft Corporation)
IIS Express Application Compatibility Database for x64 (HKLM\...\{9f4f4a9b-eec5-4906-92fe-d1f43ccf5c8d}.sdb) (Version:  - )
IIS Express Application Compatibility Database for x86 (HKLM\...\{fdfba1f3-74ae-4255-9c10-a0f552b4610f}.sdb) (Version:  - )
Infra. app. couche Données Microsoft SQL Server 2012  (HKLM-x32\...\{597E8A49-EF77-469D-A722-4F871EFCF56E}) (Version: 11.1.2902.0 - Microsoft Corporation)
Infra. d'app. de la couche Données Microsoft SQL Server 2008 R2 (HKLM-x32\...\{B466A9C8-CF42-49E6-A211-A80A3AA272FC}) (Version: 10.50.1447.4 - Microsoft Corporation)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
LibreOffice 4.3.4.1 (HKLM-x32\...\{7D983A32-F645-48AB-8E38-4ACD234F40BC}) (Version: 4.3.4.1 - The Document Foundation)
LocalESPC (x32 Version: 8.59.29989 - Microsoft Corporation) Hidden
LocalESPC Dev12 (x32 Version: 8.100.25984 - Microsoft Corporation) Hidden
LocalESPCui for fr-fr Dev12 (x32 Version: 8.100.25984 - Microsoft) Hidden
Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Maple 13 (HKLM-x32\...\Maple 13) (Version: 13.0.0.0 - Maplesoft)
MapleStory (HKLM-x32\...\MapleStory) (Version:  - )
Memory Profiler (x32 Version: 12.0.30501 - Microsoft Corporation) Hidden
Metro 2033 (HKLM-x32\...\Steam App 43110) (Version:  - 4A Games)
Microsoft .NET Framework 4.5 Multi-Targeting Pack (HKLM-x32\...\{56E962F0-4FB0-3C67-88DB-9EAA6EEFC493}) (Version: 4.5.50710 - Microsoft Corporation)
Microsoft .NET Framework 4.5 SDK - Module linguistique FRA (HKLM-x32\...\{7F8B656F-3BAB-461C-9E3D-F288340406BD}) (Version: 4.5.50710 - Microsoft Corporation)
Microsoft .NET Framework 4.5 SDK (HKLM-x32\...\{4AE57014-05C4-4864-A13D-86517A7E1BA4}) (Version: 4.5.50710 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Français) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1036) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 Multi-Targeting Pack (Français) (HKLM-x32\...\{15A5D4D5-6435-322E-9435-C21252920944}) (Version: 4.5.50932 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 Multi-Targeting Pack (HKLM-x32\...\{6A0C6700-EA93-372C-8871-DCCF13D160A4}) (Version: 4.5.50932 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 SDK (Français) (HKLM-x32\...\{5F951DA6-8F50-4E55-B2A3-DCE78BF3D185}) (Version: 4.5.51641 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 SDK (HKLM-x32\...\{19A5926D-66E1-46FC-854D-163AA10A52D3}) (Version: 4.5.51641 - Microsoft Corporation)
Microsoft ASP.NET MVC 2 - FRA (HKLM-x32\...\{4EE72E74-53A6-4E82-905E-C2D19311287E}) (Version: 2.0.50331.0 - Microsoft Corporation)
Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools - FRA (HKLM-x32\...\{348CEF9D-95C7-4CA1-89ED-174900821CB4}) (Version: 2.0.50331.0 - Microsoft Corporation)
Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools (HKLM-x32\...\{40416836-56CC-4C0E-A6AF-5C34BADCE483}) (Version: 2.0.50217.0 - Microsoft Corporation)
Microsoft ASP.NET MVC 2 (HKLM-x32\...\{DD8FF2F3-0D97-4CF3-AF78-FA0E1B242244}) (Version: 2.0.60926.0 - Microsoft Corporation)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{8FB1B528-E260-451E-9B55-E9152F94B80B}) (Version: 3.2.3.0 - Microsoft Corporation)
Microsoft Help Viewer 1.0 (HKLM\...\Microsoft Help Viewer 1.0) (Version: 1.0.30319 - Microsoft Corporation)
Microsoft Help Viewer 2.1 (HKLM-x32\...\Microsoft Help Viewer 2.1) (Version: 2.1.21005 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.4734.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Silverlight 3 SDK - Français (HKLM-x32\...\{3FF37A38-3781-493E-8EBF-BB143C843796}) (Version: 3.0.40818.0 - Microsoft Corporation)
Microsoft Silverlight 5 SDK - FRA (HKLM-x32\...\{80125E8C-304D-4637-974A-2547049B0E24}) (Version: 5.0.61118.0 - Microsoft Corporation)
Microsoft SQL Server 2008 (64-bit) (HKLM\...\Microsoft SQL Server 10 Release) (Version:  - Microsoft Corporation)
Microsoft SQL Server 2008 Browser (HKLM-x32\...\{4401409D-25F1-4E85-8A3C-6BA6FFCFBFED}) (Version: 10.3.5500.0 - Microsoft Corporation)
Microsoft SQL Server 2008 Native Client (HKLM\...\{C53DEA03-3F2F-4CB7-895D-C4EE96571EA9}) (Version: 10.3.5500.0 - Microsoft Corporation)
Microsoft SQL Server 2008 R2 Data-Tier Application Project (HKLM-x32\...\{7AD4FE43-6F4E-4DD5-AE2E-02F367192BE0}) (Version: 10.50.1447.4 - Microsoft Corporation)
Microsoft SQL Server 2008 R2 Transact-SQL Language Service (HKLM-x32\...\{93074803-3F61-4595-AC67-FFC20B3BE06A}) (Version: 10.50.1447.4 - Microsoft Corporation)
Microsoft SQL Server 2008 Setup Support Files  (HKLM\...\{393CA5BF-0362-42FD-ABC2-BA9D22EF925E}) (Version: 10.3.5520.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Data-Tier App Framework  (x64) (HKLM\...\{DEE68917-ED9D-4F84-B3D8-5729BFE0F6CC}) (Version: 11.1.2902.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Express LocalDB  (HKLM\...\{FBC55C05-D047-492A-8CB8-C120E8C1581B}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Management Objects  (HKLM-x32\...\{3E8F3658-AB3F-4F1C-92DE-F66E76BE739B}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Management Objects (x64) (HKLM\...\{4A2E75DE-133F-4239-B6A4-90658ECFC22E}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Native Client  (HKLM\...\{A211308B-B367-46F9-93C3-E7037C32DAD5}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Transact-SQL ScriptDom  (HKLM\...\{45F57281-FF5D-4F60-B965-5FEA9E94AAB0}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 FRA (HKLM-x32\...\{AF6919D0-5691-4F35-9D65-54F981013514}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 x64 FRA (HKLM\...\{2906A05E-2D38-4B47-85A2-D3485E372C8F}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server Compact 4.0 SP1 x64 FRA (HKLM\...\{0D4447E0-A261-43A4-AEBC-F76E983901F0}) (Version: 4.0.8876.1 - Microsoft Corporation)
Microsoft SQL Server Data Tools - FRA (12.0.30919.1) (HKLM-x32\...\{ED7A9B80-2500-41F7-9305-DF0E75E87D86}) (Version: 12.0.30919.1 - Microsoft Corporation)
Microsoft SQL Server Data Tools Build Utilities - FRA (12.0.30919.1) (HKLM-x32\...\{8719228E-F3CA-4C6A-B060-E6DFEEA30AD3}) (Version: 12.0.30919.1 - Microsoft Corporation)
Microsoft SQL Server Database Publishing Wizard 1.4 (HKLM-x32\...\{ACE28263-76A4-4BF5-B6F4-8BD719595969}) (Version: 10.1.2512.8 - Microsoft Corporation)
Microsoft SQL Server System CLR Types (HKLM-x32\...\{BA8F11CD-E097-41EA-978B-8AA92C9257DF}) (Version: 10.50.1600.1 - Microsoft Corporation)
Microsoft SQL Server System CLR Types (x64) (HKLM\...\{219B85B1-DC23-4688-9A74-CA0B04CF8E06}) (Version: 10.50.1600.1 - Microsoft Corporation)
Microsoft SQL Server VSS Writer (HKLM\...\{4E99A992-BF07-48AE-B0C6-5500F54EA3DA}) (Version: 10.3.5500.0 - Microsoft Corporation)
Microsoft Sync Framework Runtime v1.0 SP1 (x64) fr (HKLM\...\{13BC74A0-C04A-4D91-8D5A-911DF4A7D6EE}) (Version: 1.0.3010.0 - Microsoft Corporation)
Microsoft Sync Framework SDK v1.0 SP1 fr (HKLM-x32\...\{32071917-189D-4C08-8F7F-F27520EE6680}) (Version: 1.0.3010.0 - Microsoft Corporation)
Microsoft Sync Framework Services v1.0 SP1 (x64) fr (HKLM\...\{9869DEA6-6162-4609-9301-6B3E95853016}) (Version: 1.0.3010.0 - Microsoft Corporation)
Microsoft Sync Services for ADO.NET v2.0 SP1 (x64) fr (HKLM\...\{1682F398-1A85-4560-B2CB-456D39E6BE50}) (Version: 2.0.3010.0 - Microsoft Corporation)
Microsoft System CLR Types pour SQL Server 2012 (x64) (HKLM\...\{F6DA7ACD-4377-477F-9422-6A7AB9E6DF1E}) (Version: 11.1.3366.16 - Microsoft Corporation)
Microsoft Visio Professionnel 2013 (HKLM-x32\...\Office15.VISPROR) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Designtime - 10.0.30319 (HKLM\...\{502F9B22-FE8E-339C-87FD-F04314534303}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Runtime - 10.0.30319 (HKLM\...\{94D70749-4281-39AC-AD90-B56A0E0A402E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Runtime - 10.0.30319 (HKLM-x32\...\{6A86554B-8928-30E4-A53C-D7337689134D}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual F# 2.0 Runtime (HKLM-x32\...\{729A3000-BC8A-3B74-BA5D-5068FE12D70C}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual Studio 2010 IntelliTrace Collection (x64) (HKLM\...\{36017FCC-F3CF-339C-8B70-165C27C16562}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010 Ultimate - Français (HKLM-x32\...\Microsoft Visual Studio 2010 Ultimate - FRA) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual Studio Macro Tools - FRA Language Pack (HKLM-x32\...\Microsoft Visual Studio Macro Tools - FRA Language Pack) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual Studio Macro Tools (HKLM-x32\...\Microsoft Visual Studio Macro Tools) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual Studio Ultimate 2013 (HKLM-x32\...\{14d2935a-f03b-4b48-a368-aa5b4be7e3be}) (Version: 12.0.30501 - Microsoft Corporation)
Microsoft Web Deploy 3.5 (HKLM\...\{3674F088-9B90-473A-AAC3-20A00D8D810C}) (Version: 3.1237.1762 - Microsoft Corporation)
Microsoft Web Platform Installer 5.0 (HKLM\...\{4D84C195-86F0-4B34-8FDE-4A17EB41306A}) (Version: 5.0.50430.0 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM-x32\...\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)
Microsoft XNA Game Studio 4.0 Refresh (HKLM-x32\...\XNA Game Studio 4.0) (Version: 4.0.30901.0 - Microsoft Corporation)
Microsoft XNA Game Studio Platform Tools (HKLM-x32\...\{89690B51-2E21-4E93-914E-F9CAC5B24A84}) (Version: 1.4.0.0 - Microsoft Corporation)
Mises à jour NVIDIA 17.12.8 (Version: 17.12.8 - NVIDIA Corporation) Hidden
Modèle de redirection de Python Tools (x32 Version: 1.1 - Microsoft Corporation) Hidden
Modèle objet Microsoft Team Foundation Server 2010 - Français (HKLM\...\Microsoft Team Foundation Server 2010 Object Model - FRA) (Version: 10.0.30319 - Microsoft Corporation)
Module linguistique de Dotfuscator and Analytics Community Edition (x32 Version: 5.5.4954.46574 - PreEmptive Solutions) Hidden
Module linguistique de la visionneuse d'aide Microsoft 1.0 - FRA (HKLM\...\Microsoft Help Viewer 1.0 Language Pack - FRA) (Version: 1.0.30319 - Microsoft Corporation)
Module linguistique de la visionneuse d'aide Microsoft 2.1 - FRA (HKLM-x32\...\Module linguistique de la visionneuse d'aide Microsoft 2.1 - FRA) (Version: 2.1.21005 - Microsoft Corporation)
Module linguistique de la visionneuse d'aide Microsoft 2.1 - FRA (x32 Version: 2.1.21005 - Microsoft Corporation) Hidden
Module linguistique de l'outil de création de plan conceptuel Microsoft Visual Studio Team Foundation Server 2013 (x64) - FRA (Version: 12.0.21005 - Microsoft Corporation) Hidden
Module linguistique des composants partagés Windows Azure pour Microsoft Visual Studio 2013 (FRA) - v1.1 (x32 Version: 1.1.20410.1601 - Microsoft Corporation) Hidden
Module linguistique des outils de développement Microsoft Office pour Visual Studio - FRA (x32 Version: 12.0.31105 - Microsoft Corporation) Hidden
Module linguistique du modèle objet Microsoft Team Foundation Server 2013 Update 2 (x64) - FRA (Version: 12.0.30501 - Microsoft Corporation) Hidden
Module linguistique Microsoft Visual F# 2.0 Runtime - FRA (HKLM-x32\...\{76B91CF8-2A5C-3BFD-B95B-D718D52088C4}) (Version: 10.0.30319 - Microsoft Corporation)
Module linguistique Microsoft Visual Studio 2010 Tools pour Office Runtime (x64) - FRA (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - FRA) (Version: 10.0.50903 - Microsoft Corporation)
Module linguistique Team Explorer pour Microsoft Visual Studio 2013 - FRA (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Module linguistique Windows Azure Mobile Services Tools pour Visual Studio - v1.1 (x32 Version: 1.1.20407.1601 - Microsoft Corporation) Hidden
Module Microsoft Report Viewer pour Visual Studio 2013 (x32 Version: 11.1.3411.3 - Microsoft Corporation) Hidden
MotioninJoy Gamepad tool 0.7.0000 (HKLM\...\{330DAC67-5B62-452A-A0E4-6B4A5923940F}_is1) (Version: 0.7.0000 - www.motioninjoy.com)
Movavi Video Converter 14 (HKLM-x32\...\Movavi Video Converter 14) (Version: 14.3.0 - Movavi)
Movavi Video Editor 4 (HKLM-x32\...\{95B7C0F4-7434-4DFB-B900-201BFC00C00B}) (Version: 4.00.000 - MOVAVI)
Mozilla Firefox 35.0.1 (x86 fr) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 fr)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 32.0.3 - Mozilla)
MusicBee 2.4 (HKLM-x32\...\MusicBee) (Version: 2.4 - Steven Mayall)
MySQL Connector C++ 1.1.4 (HKLM-x32\...\{DEF0D0C1-511C-4F89-BCF7-75F421DDE591}) (Version: 1.1.4 - Oracle and/or its affiliates)
MySQL Connector J (HKLM-x32\...\{9779CE68-28F8-4E19-A70C-48BEA184C656}) (Version: 5.1.33 - Oracle Corporation)
MySQL Connector Net 6.9.4 (HKLM-x32\...\{7FE04B43-4187-46F5-A9DE-9ECB5177B8C1}) (Version: 6.9.4 - Oracle)
MySQL Connector/C 6.1 (HKLM-x32\...\{97FEF94D-9E6D-4778-AFF1-77C53C933634}) (Version: 6.1.5 - Oracle Corporation)
MySQL Connector/ODBC 5.3 (HKLM-x32\...\{4C6A664C-DCA0-4CC6-8752-ED0850E3135A}) (Version: 5.3.4 - Oracle Corporation)
MySQL Documents 5.6 (HKLM-x32\...\{A28A3025-2B78-4E6F-AB69-F8886C920817}) (Version: 5.6.21 - Oracle Corporation)
MySQL Examples and Samples 5.6 (HKLM-x32\...\{9619274B-02D7-491C-A6A2-0FA915129985}) (Version: 5.6.21 - Oracle Corporation)
MySQL Fabric 1.5.2 & MySQL Utilities 1.5.2 (HKLM-x32\...\{268B25AC-15D9-4825-82AF-CADDF3B72E3E}) (Version: 1.5.2 - Oracle Corporation)
MySQL for Visual Studio 1.2.3 (HKLM-x32\...\{EF7630BF-DC4E-4493-9C0F-5B0A739390EF}) (Version: 1.2.3 - Oracle)
MySQL Installer - Community (HKLM-x32\...\{854E11AD-BE2D-4897-BA72-9C3A3DEA5798}) (Version: 1.4.2.0 - Oracle Corporation)
MySQL Notifier 1.1.6 (HKLM-x32\...\{CB76A6E9-B184-461D-A8BE-7D0D73199545}) (Version: 1.1.6 - Oracle)
MySQL Server 5.6 (HKLM\...\{73F1E510-FC76-4E6D-A020-472DBD0A3207}) (Version: 5.6.21 - Oracle Corporation)
MySQL Workbench 6.2 CE (HKLM\...\{916D6512-97A8-470D-AEC8-53A1654E74BF}) (Version: 6.2.3 - Oracle Corporation)
Nexon Game Manager (HKLM-x32\...\{EA2DB6E0-72C5-4ef9-A3A0-E6705F4A6A9E}) (Version:  - )
Nexon Launcher (HKLM-x32\...\Nexon Nexon Launcher) (Version: 1.1.1 - Nexon)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.6.9 - Notepad++ Team)
NVIDIA GeForce Experience 2.2.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.2.2 - NVIDIA Corporation)
NVIDIA Logiciel système PhysX 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
NVIDIA Pilote 3D Vision 347.25 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 347.25 - NVIDIA Corporation)
NVIDIA Pilote audio HD : 1.3.33.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.33.0 - NVIDIA Corporation)
NVIDIA Pilote du contrôleur 3D Vision 347.09 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 347.09 - NVIDIA Corporation)
NVIDIA Pilote graphique 347.25 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 347.25 - NVIDIA Corporation)
Objets de gestion Microsoft SQL Server 2008 R2 (HKLM-x32\...\{B01A7AFC-0356-43AF-A333-C65912AEA8DC}) (Version: 10.50.1447.4 - Microsoft Corporation)
Open XML SDK 2.5 for Microsoft Office (x32 Version: 2.5.5631 - Microsoft Corporation) Hidden
Outils de développement Microsoft Office pour Visual Studio 2013 - Mise à jour de novembre 2014 (HKLM-x32\...\{490dec84-b4c1-4b92-a379-3d6f7755d5f6}) (Version: 12.0.31105.0 - Microsoft Corporation)
Outils de développement Microsoft Office 2013 pour Microsoft Visual Studio (x64) - Module linguistique FRA (Version: 12.0.31105 - Microsoft Corporation) Hidden
Outils de diagnostic de Microsoft Visual Studio 2013 - FRA (x32 Version: 12.0.30501 - Microsoft Corporation) Hidden
Outils de vérification linguistique 2013 de Microsoft Office - Français (x32 Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Outils Microsoft Visual Studio 2010 ADO.NET Entity Framework (HKLM-x32\...\{3BA7E387-9401-3371-9464-5E224D243FC5}) (Version: 10.0.30319 - Microsoft Corporation)
Outils Windows Phone 8.1 pour Visual Studio Professional 2013 - FRA (x32 Version: 12.0.30501 - Microsoft Corporation) Hidden
Outils Windows Phone 8.1 pour Visual Studio 2013 - FRA (x32 Version: 12.0.30501 - Microsoft Corporation) Hidden
paint.net (HKLM\...\{19BD2C33-16A8-4ED1-B9EA-D9E35B21EC42}) (Version: 4.0.5 - dotPDN LLC)
Panneau de configuration NVIDIA 347.25 (Version: 347.25 - NVIDIA Corporation) Hidden
PDF Settings CS6 (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
PreEmptive Analytics Client French Language Pack (x32 Version: 1.2.3197.1 - PreEmptive Solutions) Hidden
PreEmptive Analytics Visual Studio Components (x32 Version: 1.2.3197.1 - PreEmptive Solutions) Hidden
RAR Password Unlocker 4.2.0.0 (HKLM-x32\...\{B789FA51-6A71-408F-92DE-EDE4A517B8F9}_is1) (Version:  - Password Unlocker Studio)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.67.1226.2012 - Realtek)
Ressources de Microsoft Visual Studio 2013 Shell (minimum) (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Ressources Devenv de Microsoft Visual Studio 2013 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Secure Download Manager (HKLM-x32\...\{60232A95-0B96-4BBB-9798-85A6AB6F8210}) (Version: 3.1.60 - Kivuto Solutions Inc.)
Service de langage T-SQL Microsoft SQL Server 2012  (HKLM-x32\...\{38222BAB-19A5-492E-838B-9EAD52E81C96}) (Version: 11.1.3000.0 - Microsoft Corporation)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 32-Bit Edition (HKLM-x32\...\{91150000-0051-0000-0000-0000000FF1CE}_Office15.VISPROR_{8D2E04ED-3350-4ECE-9D6E-3BC9A9A93A47}) (Version:  - Microsoft)
Service Pack 3 pour SQL Server 2008 (KB2546951) (64-bit) (HKLM\...\KB2546951) (Version: 10.3.5500.0 - Microsoft Corporation)
SharePoint Client Components (HKLM\...\{95150003-1163-0409-1000-0000000FF1CE}) (Version: 15.0.4641.1002 - Microsoft Corporation)
SharePoint Client Components (HKLM\...\{95160002-1163-0409-1000-0000000FF1CE}) (Version: 16.0.3104.1200 - Microsoft Corporation)
SHIELD Streaming (Version: 4.0.1000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 17.12.8 - NVIDIA Corporation) Hidden
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version:  - )
Sql Server Customer Experience Improvement Program (Version: 10.3.5500.0 - Microsoft Corporation) Hidden
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Surgeon Simulator (HKLM-x32\...\Steam App 233720) (Version:  - Bossa Studios)
System Requirements Lab Detection (HKLM-x32\...\{5C46E95F-9634-4966-8177-A0CD11D1E27A}) (Version: 2.1.1.0 - Husdawg, LLC)
Team Explorer for Microsoft Visual Studio 2013 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
The Swapper (HKLM-x32\...\Steam App 231160) (Version:  - Olli Harjola, Otto Hantula, Tom Jubert, Carlo Castellano)
Tomb Raider III: Adventures of Lara Croft (HKLM-x32\...\Steam App 225320) (Version:  - Core Design)
Tomb Raider: The Last Revelation (HKLM-x32\...\Steam App 224980) (Version:  - Core Design)
Torchlight II Demo (HKLM-x32\...\Steam App 219850) (Version:  - Runic Games)
Types CLR du système Microsoft pour SQL Server 2012 (HKLM-x32\...\{06E862CA-3920-4745-9C26-2DE51B50057E}) (Version: 11.1.3366.16 - Microsoft Corporation)
TypeScript Power Tool (x32 Version: 1.0.1.0 - Microsoft Corporation) Hidden
TypeScript Tools for Microsoft Visual Studio 2013 (x32 Version: 1.0.1.0 - Microsoft Corporation) Hidden
Update for  (KB2504637) (HKLM-x32\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}.KB2504637) (Version: 1 - Microsoft Corporation)
Uplay (HKLM-x32\...\Uplay) (Version: 4.7 - Ubisoft)
Utilitaires ligne de comm. Microsoft SQL Server 2012  (HKLM\...\{3835543E-37BA-4CE3-91BE-608DA8827675}) (Version: 11.1.3000.0 - Microsoft Corporation)
Version préparatoire de Microsoft Visual Studio 2013 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version: 5.4.7.0 - Elaborate Bytes)
Visual Studio 2010 Prerequisites - English (HKLM\...\{C3175CF2-1DDD-3740-9AF7-0226CA07C6A0}) (Version: 10.0.30319 - Microsoft Corporation)
Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 FRA (HKLM-x32\...\{D60023FA-3DF1-4537-93DD-13024CC4E366}) (Version: 4.0.8080.0 - Microsoft Corporation)
Visual Studio 2013 Update 2 (KB2829760) (HKLM-x32\...\{3c348532-c3bd-4bae-a928-7b555f8c808f}) (Version: 12.0.30501 - Microsoft Corporation)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
VMware Workstation (HKLM-x32\...\VMware_Workstation) (Version: 10.0.1 - VMware, Inc)
VMware Workstation (Version: 10.0.1 - VMware, Inc.) Hidden
VS Update core components (x32 Version: 12.0.30501 - Microsoft Corporation) Hidden
Watch_Dogs (HKLM-x32\...\Uplay Install 274) (Version:  - Ubisoft)
WCF Data Services 5.6.0 FRA Language Pack (x32 Version: 5.6.61587.0 - Microsoft Corporation) Hidden
WCF Data Services 5.6.0 Runtime (x32 Version: 5.6.61587.0 - Microsoft Corporation) Hidden
WCF Data Services Tools for Microsoft Visual Studio 2013 (x32 Version: 5.6.61587.0 - Microsoft Corporation) Hidden
WCF Data Services Tools for Microsoft Visual Studio 2013 FRA Language Pack (x32 Version: 5.6.61587.0 - Microsoft Corporation) Hidden
WCF RIA Services V1.0 SP2 (HKLM-x32\...\{5D8DD6A8-C4D7-4554-93F9-F1CC28C72600}) (Version: 4.1.62812.0 - Microsoft Corporation)
Web Deployment Tool (HKLM\...\{0F37D969-1260-419E-B308-EF7D29ABDE20}) (Version: 1.1.0618 - Microsoft Corporation)
WinRAR 4.00 (64-bit) (HKLM\...\WinRAR archiver) (Version: 4.00.0 - win.rar GmbH)
Workflow Manager Client 1.0 (Version: 2.0.40131.0 - Microsoft Corporation) Hidden
Workflow Manager Tools 1.0 for Visual Studio (Version: 2.0.40326.0 - Microsoft Corporation) Hidden
Надстройка Microsoft Report Viewer для Visual Studio 2013 (x32 Version: 11.1.3411.3 - Microsoft Corporation) Hidden
用于 Visual Studio 2013 的 Microsoft 报告查看器加载项 (x32 Version: 11.1.3411.3 - Microsoft Corporation) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2680848391-1775793970-1252864707-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Pascal\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2680848391-1775793970-1252864707-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Pascal\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2680848391-1775793970-1252864707-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Pascal\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2680848391-1775793970-1252864707-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Pascal\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2680848391-1775793970-1252864707-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Pascal\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2680848391-1775793970-1252864707-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Pascal\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2680848391-1775793970-1252864707-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Pascal\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2680848391-1775793970-1252864707-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Pascal\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2680848391-1775793970-1252864707-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Pascal\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2680848391-1775793970-1252864707-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Pascal\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)

==================== Restore Points  =========================

14-01-2015 16:41:54 Windows Update
14-01-2015 16:59:03 Windows Update
15-01-2015 23:30:30 Windows Update
19-01-2015 07:43:06 Windows Update
23-01-2015 21:13:21 Windows Update
30-01-2015 22:19:39 Windows Update
04-02-2015 17:09:26 Windows Update
10-02-2015 22:17:06 Windows Update
10-02-2015 22:33:13 Windows Update
13-02-2015 00:07:47 Windows Update
15-02-2015 23:21:49 Point de contrôle créé par HitmanPro
15-02-2015 23:23:00 Point de contrôle créé par HitmanPro

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 21:34 - 2009-06-10 16:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {1B145F78-3DFF-445F-BD9A-A102907DCD11} - System32\Tasks\{681F4960-AD6D-48B7-AD02-2A60399A7D64} => pcalua.exe -a C:\Users\Pascal\Documents\Programmes\Active_HDL\active_hdl\MSETUP.EXE -d C:\Users\Pascal\Documents\Programmes\Active_HDL\active_hdl
Task: {40553A1B-A250-46E4-B976-A3DFFA0BE4DE} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-11-17] (AVAST Software)
Task: {419E0C6B-DFF2-4A59-AAEB-711FD85C678F} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-01-20] (Piriform Ltd)
Task: {4540C754-1A24-42F5-B8A5-6B302ED221C9} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe
Task: {65DF0450-535D-46DE-A587-CDA842070022} - System32\Tasks\MySQL\Installer\ManifestUpdate => C:\Program Files (x86)\MySQL\MySQL Installer for Windows\MySQLInstallerConsole.exe [2014-09-18] (Oracle Corporation) <==== ATTENTION
Task: {93CC2953-A3A2-4461-B039-21FFF5B08395} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-22] (Microsoft Corporation)
Task: {945E3FE3-94AF-4BE5-B28B-E84C092BE98C} - System32\Tasks\MySQLNotifierTask => C:\Program Files (x86)\MySQL\MySQL Notifier 1.1\MySQLNotifier.exe [2014-09-03] (Oracle Corporation)
Task: {A07D647B-5F1E-4138-950B-73F0C25D3D70} - System32\Tasks\{1FA0DCB8-7ED2-489E-B753-2A5504C483FE} => pcalua.exe -a "C:\Users\Pascal\Documents\Programmes\CPU Stability Test\CPU_Stability_Test_6.0_Build_154_Finale.exe" -d "C:\Users\Pascal\Documents\Programmes\CPU Stability Test"
Task: {CC602CA7-2E53-41CD-8AB9-D8E5741D7603} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-22] (Microsoft Corporation)
Task: {D73ED341-BCB1-4DE6-9C6E-CCFBFBF4EC8C} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {D789D6BD-E4E6-4595-AF39-61DF7832EF82} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-09-26] (Google Inc.)
Task: {E26E6982-F26A-4CD7-ABC8-B9B430A9D959} - System32\Tasks\AdobeAAMUpdater-1.0-DAGP06-Tour-Win-Pascal => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-09-20] (Adobe Systems Incorporated)
Task: {F1C62C0A-2B54-449B-A5B3-D7F7AEA60B61} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-09-26] (Google Inc.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2015-01-24 17:57 - 2015-01-09 18:29 - 00117392 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-09-11 15:13 - 2014-09-11 15:13 - 13031424 _____ () C:\Program Files\MySQL\MySQL Server 5.6\bin\mysqld.exe
2013-10-18 11:10 - 2013-10-18 11:10 - 14405200 _____ () C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe
2014-11-17 18:52 - 2014-11-17 18:52 - 00388208 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxDDU.dll
2014-11-17 18:52 - 2014-11-17 18:52 - 05851328 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxRT.dll
2010-01-09 19:17 - 2010-01-09 19:17 - 04254560 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2010-01-21 00:40 - 2010-01-21 00:40 - 08794464 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2014-10-15 14:05 - 2011-03-02 11:40 - 00164864 _____ () C:\Program Files\WinRAR\rarext.dll
2014-05-12 04:49 - 2014-05-12 04:49 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
2015-01-20 21:06 - 2015-01-20 21:06 - 00061440 _____ () C:\Program Files\CCleaner\lang\lang-1036.dll
2015-02-15 19:57 - 2015-02-15 19:57 - 02911744 _____ () C:\Program Files\AVAST Software\Avast\defs\15021501\algo.dll
2014-11-17 18:52 - 2014-11-17 18:52 - 04495336 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\x86\VBoxRT-x86.dll
2015-02-16 08:40 - 2015-02-16 08:40 - 02911744 _____ () C:\Program Files\AVAST Software\Avast\defs\15021600\algo.dll
2013-10-18 11:46 - 2013-10-18 11:46 - 01260624 _____ () C:\Program Files (x86)\VMware\VMware Workstation\libxml2.dll
2014-11-17 18:52 - 2014-11-17 18:52 - 38562088 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2015-02-10 16:00 - 2015-02-10 16:00 - 00750080 _____ () C:\Users\Pascal\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-02-16 08:41 - 2015-02-16 08:41 - 00043008 _____ () c:\users\pascal\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpmqt59a.dll
2015-02-10 16:00 - 2015-02-10 16:00 - 00047616 _____ () C:\Users\Pascal\AppData\Roaming\Dropbox\bin\libEGL.dll
2015-02-10 16:00 - 2015-02-10 16:00 - 00865280 _____ () C:\Users\Pascal\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2015-02-10 16:00 - 2015-02-10 16:00 - 00200704 _____ () C:\Users\Pascal\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2015-01-30 22:43 - 2015-01-30 22:43 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2010-01-09 19:18 - 2010-01-09 19:18 - 04254560 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2010-01-21 00:34 - 2010-01-21 00:34 - 08793952 _____ () C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2680848391-1775793970-1252864707-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.0.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^Users^Pascal^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2010 Screen Clipper and Launcher.lnk => C:\Windows\pss\OneNote 2010 Screen Clipper and Launcher.lnk.Startup
MSCONFIG\startupreg: AdobeAAMUpdater-1.0 => "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
MSCONFIG\startupreg: AdobeBridge =>
MSCONFIG\startupreg: AdobeCS6ServiceManager => "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
MSCONFIG\startupreg: BCSSync => "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
MSCONFIG\startupreg: FlashPlayerUpdate => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_15_0_0_223_Plugin.exe -update plugin
MSCONFIG\startupreg: GoogleChromeAutoLaunch_1BB0B968DB2E1DD5640AAF2B69FD58ED => "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --no-startup-window
MSCONFIG\startupreg: MySQL Notifier => C:\Program Files (x86)\MySQL\MySQL Notifier 1.1\MySqlNotifier.exe
MSCONFIG\startupreg: VirtualCloneDrive => "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
MSCONFIG\startupreg: vmware-tray.exe => "C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe"

==================== Accounts: =============================

Administrateur (S-1-5-21-2680848391-1775793970-1252864707-500 - Administrator - Disabled)
HomeGroupUser$ (S-1-5-21-2680848391-1775793970-1252864707-1002 - Limited - Enabled)
Invité (S-1-5-21-2680848391-1775793970-1252864707-501 - Limited - Disabled)
Pascal (S-1-5-21-2680848391-1775793970-1252864707-1000 - Administrator - Enabled) => C:\Users\Pascal

==================== Faulty Device Manager Devices =============

Name: Contrôleur de bus USB
Description: Contrôleur de bus USB
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (02/16/2015 08:40:42 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/15/2015 11:26:29 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/15/2015 11:23:35 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Erreur du service de cliché instantané des volumes : erreur lors de l’appel de la routine RegSetValueExW(0x000002d0,SYSTEM\CurrentControlSet\Services\VSS\Diag\VssvcPublisher,0,REG_BINARY,0000000001C3EDA0.72). hr = 0x80070005, Accès refusé.
.

Error: (02/15/2015 11:23:35 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Erreur du service de cliché instantané des volumes : erreur lors de l’appel de la routine RegSetValueExW(0x000005e0,(null),0,REG_BINARY,0000000004DCE520.72). hr = 0x80070005, Accès refusé.
.


Opération :
   Événement BackupShutdown

Contexte :
   Contexte d’exécution: Writer
   ID de classe du rédacteur: {a6ad56c2-b509-4e6c-bb19-49d8f43532f0}
   Nom du rédacteur: WMI Writer
   ID d’instance du rédacteur: {2bdd12bc-3750-4d4d-99e6-0dfbca834e90}

Error: (02/15/2015 11:23:35 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Erreur du service de cliché instantané des volumes : erreur lors de l’appel de la routine RegSetValueExW(0x00000308,(null),0,REG_BINARY,00000000075CDEB0.72). hr = 0x80070005, Accès refusé.
.


Opération :
   Événement BackupShutdown

Contexte :
   Contexte d’exécution: Writer
   ID de classe du rédacteur: {e8132975-6f93-4464-a53e-1050253ae220}
   Nom du rédacteur: System Writer
   ID d’instance du rédacteur: {9ec4fe55-d3d5-45b4-8f79-acf7df2e2ed6}

Error: (02/15/2015 11:23:35 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Erreur du service de cliché instantané des volumes : erreur lors de l’appel de la routine RegSetValueExW(0x00000de0,(null),0,REG_BINARY,000000000873E4C0.72). hr = 0x80070005, Accès refusé.
.


Opération :
   Événement BackupShutdown

Contexte :
   Contexte d’exécution: Writer
   ID de classe du rédacteur: {cd3f2362-8bef-46c7-9181-d62844cdc0b2}
   Nom du rédacteur: MSSearch Service Writer
   ID d’instance du rédacteur: {34b64af2-645f-4cae-ad04-c1f9ea6d0e2c}

Error: (02/15/2015 11:23:35 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Erreur du service de cliché instantané des volumes : erreur lors de l’appel de la routine RegSetValueExW(0x00000208,(null),0,REG_BINARY,0000000001D8E9D0.72). hr = 0x80070005, Accès refusé.
.


Opération :
   Événement BackupShutdown

Contexte :
   Contexte d’exécution: Writer
   ID de classe du rédacteur: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
   Nom du rédacteur: Shadow Copy Optimization Writer
   ID d’instance du rédacteur: {a4266487-4f7a-4a39-9f82-84f447b13200}

Error: (02/15/2015 11:23:35 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Erreur du service de cliché instantané des volumes : erreur lors de l’appel de la routine RegSetValueExW(0x000001d8,(null),0,REG_BINARY,000000000168F380.72). hr = 0x80070005, Accès refusé.
.


Opération :
   Événement BackupShutdown

Contexte :
   Contexte d’exécution: Writer
   ID de classe du rédacteur: {542da469-d3e1-473c-9f4f-7847f01fc64f}
   Nom du rédacteur: COM+ REGDB Writer
   ID d’instance du rédacteur: {d3f1ec3f-234b-4981-ae51-c3a38975a358}

Error: (02/15/2015 11:23:35 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Erreur du service de cliché instantané des volumes : erreur lors de l’appel de la routine RegSetValueExW(0x000005e0,(null),0,REG_BINARY,0000000004DCE520.72). hr = 0x80070005, Accès refusé.
.


Opération :
   Événement BackupShutdown

Contexte :
   Contexte d’exécution: Writer
   ID de classe du rédacteur: {a6ad56c2-b509-4e6c-bb19-49d8f43532f0}
   Nom du rédacteur: WMI Writer
   ID d’instance du rédacteur: {2bdd12bc-3750-4d4d-99e6-0dfbca834e90}

Error: (02/15/2015 11:23:35 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Erreur du service de cliché instantané des volumes : erreur lors de l’appel de la routine RegSetValueExW(0x000001cc,(null),0,REG_BINARY,00000000019FECE0.72). hr = 0x80070005, Accès refusé.
.


Opération :
   Événement BackupShutdown

Contexte :
   Contexte d’exécution: Writer
   ID de classe du rédacteur: {afbab4a2-367d-4d15-a586-71dbb18f8485}
   Nom du rédacteur: Registry Writer
   ID d’instance du rédacteur: {0b823f60-c24d-4437-a637-96a74e1fc402}


System errors:
=============
Error: (02/16/2015 08:44:12 AM) (Source: ipnathlp) (EventID: 1233) (User: )
Description:

Error: (02/16/2015 08:40:41 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: L’appel ScRegSetValueExW a échoué pour Type avec l’erreur :
%%5

Error: (02/15/2015 11:41:42 PM) (Source: ipnathlp) (EventID: 1233) (User: )
Description:

Error: (02/15/2015 11:29:42 PM) (Source: ipnathlp) (EventID: 1233) (User: )
Description:

Error: (02/15/2015 11:26:29 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: L’appel ScRegSetValueExW a échoué pour Type avec l’erreur :
%%5

Error: (02/15/2015 11:25:33 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Le service HitmanPro 3.7 Crusader (Boot) s’est arrêté avec l’erreur service particulière %%0.

Error: (02/15/2015 10:51:37 PM) (Source: ipnathlp) (EventID: 1233) (User: )
Description:

Error: (02/15/2015 10:39:30 PM) (Source: ipnathlp) (EventID: 1233) (User: )
Description:

Error: (02/15/2015 10:01:48 PM) (Source: ipnathlp) (EventID: 1233) (User: )
Description:

Error: (02/15/2015 09:49:41 PM) (Source: ipnathlp) (EventID: 1233) (User: )
Description:


Microsoft Office Sessions:
=========================
Error: (02/16/2015 08:40:42 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/15/2015 11:26:29 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/15/2015 11:23:35 PM) (Source: VSS) (EventID: 8193) (User: )
Description: RegSetValueExW(0x000002d0,SYSTEM\CurrentControlSet\Services\VSS\Diag\VssvcPublisher,0,REG_BINARY,0000000001C3EDA0.72)0x80070005, Accès refusé.

Error: (02/15/2015 11:23:35 PM) (Source: VSS) (EventID: 8193) (User: )
Description: RegSetValueExW(0x000005e0,(null),0,REG_BINARY,0000000004DCE520.72)0x80070005, Accès refusé.


Opération :
   Événement BackupShutdown

Contexte :
   Contexte d’exécution: Writer
   ID de classe du rédacteur: {a6ad56c2-b509-4e6c-bb19-49d8f43532f0}
   Nom du rédacteur: WMI Writer
   ID d’instance du rédacteur: {2bdd12bc-3750-4d4d-99e6-0dfbca834e90}

Error: (02/15/2015 11:23:35 PM) (Source: VSS) (EventID: 8193) (User: )
Description: RegSetValueExW(0x00000308,(null),0,REG_BINARY,00000000075CDEB0.72)0x80070005, Accès refusé.


Opération :
   Événement BackupShutdown

Contexte :
   Contexte d’exécution: Writer
   ID de classe du rédacteur: {e8132975-6f93-4464-a53e-1050253ae220}
   Nom du rédacteur: System Writer
   ID d’instance du rédacteur: {9ec4fe55-d3d5-45b4-8f79-acf7df2e2ed6}

Error: (02/15/2015 11:23:35 PM) (Source: VSS) (EventID: 8193) (User: )
Description: RegSetValueExW(0x00000de0,(null),0,REG_BINARY,000000000873E4C0.72)0x80070005, Accès refusé.


Opération :
   Événement BackupShutdown

Contexte :
   Contexte d’exécution: Writer
   ID de classe du rédacteur: {cd3f2362-8bef-46c7-9181-d62844cdc0b2}
   Nom du rédacteur: MSSearch Service Writer
   ID d’instance du rédacteur: {34b64af2-645f-4cae-ad04-c1f9ea6d0e2c}

Error: (02/15/2015 11:23:35 PM) (Source: VSS) (EventID: 8193) (User: )
Description: RegSetValueExW(0x00000208,(null),0,REG_BINARY,0000000001D8E9D0.72)0x80070005, Accès refusé.


Opération :
   Événement BackupShutdown

Contexte :
   Contexte d’exécution: Writer
   ID de classe du rédacteur: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
   Nom du rédacteur: Shadow Copy Optimization Writer
   ID d’instance du rédacteur: {a4266487-4f7a-4a39-9f82-84f447b13200}

Error: (02/15/2015 11:23:35 PM) (Source: VSS) (EventID: 8193) (User: )
Description: RegSetValueExW(0x000001d8,(null),0,REG_BINARY,000000000168F380.72)0x80070005, Accès refusé.


Opération :
   Événement BackupShutdown

Contexte :
   Contexte d’exécution: Writer
   ID de classe du rédacteur: {542da469-d3e1-473c-9f4f-7847f01fc64f}
   Nom du rédacteur: COM+ REGDB Writer
   ID d’instance du rédacteur: {d3f1ec3f-234b-4981-ae51-c3a38975a358}

Error: (02/15/2015 11:23:35 PM) (Source: VSS) (EventID: 8193) (User: )
Description: RegSetValueExW(0x000005e0,(null),0,REG_BINARY,0000000004DCE520.72)0x80070005, Accès refusé.


Opération :
   Événement BackupShutdown

Contexte :
   Contexte d’exécution: Writer
   ID de classe du rédacteur: {a6ad56c2-b509-4e6c-bb19-49d8f43532f0}
   Nom du rédacteur: WMI Writer
   ID d’instance du rédacteur: {2bdd12bc-3750-4d4d-99e6-0dfbca834e90}

Error: (02/15/2015 11:23:35 PM) (Source: VSS) (EventID: 8193) (User: )
Description: RegSetValueExW(0x000001cc,(null),0,REG_BINARY,00000000019FECE0.72)0x80070005, Accès refusé.


Opération :
   Événement BackupShutdown

Contexte :
   Contexte d’exécution: Writer
   ID de classe du rédacteur: {afbab4a2-367d-4d15-a586-71dbb18f8485}
   Nom du rédacteur: Registry Writer
   ID d’instance du rédacteur: {0b823f60-c24d-4437-a637-96a74e1fc402}


CodeIntegrity Errors:
===================================
  Date: 2015-02-12 23:33:06.128
  Description: Le module d’intégrité du code ne peut pas vérifier l’intégrité image du fichier \Device\HarddiskVolume10\HitmanPro_x64.exe car le jeu de hachages d’images par page n’a pas été trouvé sur le système.

  Date: 2015-02-12 23:33:05.313
  Description: Le module d’intégrité du code ne peut pas vérifier l’intégrité image du fichier \Device\HarddiskVolume10\HitmanPro_x64.exe car le jeu de hachages d’images par page n’a pas été trouvé sur le système.

  Date: 2015-02-12 23:33:04.496
  Description: Le module d’intégrité du code ne peut pas vérifier l’intégrité image du fichier \Device\HarddiskVolume10\HitmanPro_x64.exe car le jeu de hachages d’images par page n’a pas été trouvé sur le système.

  Date: 2015-02-12 23:33:03.667
  Description: Le module d’intégrité du code ne peut pas vérifier l’intégrité image du fichier \Device\HarddiskVolume10\HitmanPro_x64.exe car le jeu de hachages d’images par page n’a pas été trouvé sur le système.

  Date: 2015-02-12 23:33:02.846
  Description: Le module d’intégrité du code ne peut pas vérifier l’intégrité image du fichier \Device\HarddiskVolume10\HitmanPro_x64.exe car le jeu de hachages d’images par page n’a pas été trouvé sur le système.

  Date: 2015-02-12 23:33:02.007
  Description: Le module d’intégrité du code ne peut pas vérifier l’intégrité image du fichier \Device\HarddiskVolume10\HitmanPro_x64.exe car le jeu de hachages d’images par page n’a pas été trouvé sur le système.

  Date: 2015-02-12 23:33:01.182
  Description: Le module d’intégrité du code ne peut pas vérifier l’intégrité image du fichier \Device\HarddiskVolume10\HitmanPro_x64.exe car le jeu de hachages d’images par page n’a pas été trouvé sur le système.

  Date: 2015-02-12 23:33:00.366
  Description: Le module d’intégrité du code ne peut pas vérifier l’intégrité image du fichier \Device\HarddiskVolume10\HitmanPro_x64.exe car le jeu de hachages d’images par page n’a pas été trouvé sur le système.

  Date: 2015-02-12 23:32:59.550
  Description: Le module d’intégrité du code ne peut pas vérifier l’intégrité image du fichier \Device\HarddiskVolume10\HitmanPro_x64.exe car le jeu de hachages d’images par page n’a pas été trouvé sur le système.

  Date: 2015-02-12 23:32:58.719
  Description: Le module d’intégrité du code ne peut pas vérifier l’intégrité image du fichier \Device\HarddiskVolume10\HitmanPro_x64.exe car le jeu de hachages d’images par page n’a pas été trouvé sur le système.


==================== Memory info ===========================

Processor: AMD FX™-8350 Eight-Core Processor
Percentage of memory in use: 34%
Total physical RAM: 8090.82 MB
Available physical RAM: 5316.01 MB
Total Pagefile: 16179.83 MB
Available Pagefile: 12851.88 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:1847.78 GB) (Free:1545.73 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 1863 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

==================== End Of Log ============================

Attached Files

•  TDSSKiller.3.0.0.44_16.02.2015_08.53.03_log.txt   207.19KB   212 downloads

[LiquidTension]

Hi Pascal,
 
Please consider the following, and proceed with the instructions below. 
 

P2P Warning

------------------------------

I see you have peer-to-peer (P2P) file sharing software installed on your computer (uTorrent). I advise you avoid P2P file sharing programmes; they are a security risk which can make your computer susceptible to malware. File sharing networks are thoroughly infested with malware - worms, backdoor Trojans, IRCBots, and rootkits propagate via P2P file sharing networks, gaming, and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install malware. The best way to reduce the risk of infection is to avoid these types of web sites and P2P programmes. Please read the following articles for more information.

• Risks of File-Sharing Technology
• P2P Software User Advisories
• More malware is traveling on P2P networks these days

Your P2P software can be removed by following the instructions below.

• Press the Windows Key  + r on your keyboard at the same time. Type appwiz.cpl and click OK.
• Search for the aforementioned programme(s), right-click and click Uninstall. Follow the prompts.

If you choose not to, please refrain from using the programme(s) during this process.

 
Did you set these proxy settings?

FF NetworkProxy: "autoconfig_url", "http://proxy.biblio.polymtl.ca/"
FF NetworkProxy: "type", 2

 
STEP 1
 Folder Options 

• Press the Windows Key  + r on your keyboard at the same time. Type Control Folders and click OK.
• Click View. Under Hidden files and folders: 
• Place a checkmark next to Show hidden files, folders and drives.
• Remove the checkmark next to Hide extensions for known file types.
• Remove the checkmark next to Hide protected operating system Files (Recommended).
• Click Apply followed by OK.
   

STEP 2
 VirusTotal Upload

• Please go to VirusTotal.com.
• Click Choose File and locate the following file:
  • C:\ProgramData\wmzddnmb.cix
• ​Click Scan it!.
• If you receive the following notification: File already analysed click Reanalyse.
• Once the file has been analyzed, copy the page URL at the top of the window and paste in your next reply. 

[dagp06]

Hi Adam,

 

Thanks for the info about P2P sharing, but I am aware of these risks. I don't use uTorrent often, I always download torrents with the most seeders and I read the comments about them to see if it's reliable. When I open it on uTorrent, I uncheck the files that I don't want to download from my torrent.

Anyways, I noticed my adware issue after a program download (I think it was Adobe Reader), but it wasn't from the Adobe website and even though I unchecked all the boxes, there must be one that I forgot because I had many unwanted program after that.

So I won't use uTorrent during this process.

 

About the proxys, I need the first one for school, but I don't remember about setting the second one.

 

Here's the link for the file you asked me to analyze:

https://www.virustot...sis/1424178017/

[LiquidTension]

Thanks for the information, Pascal.
Please do the following. 
 
STEP 1
 Farbar Recovery Scan Tool (FRST) Script

• Press the Windows Key  + r on your keyboard at the same time. Type Notepad and click OK.
• Copy the entire contents of the codebox below and paste into the Notepad document.
  

  start
  CreateRestorePoint:
  CMD: ipconfig /flushdns
  CMD: netsh int ipv4 reset
  CMD: netsh int ipv6 reset
  EmptyTemp:
  end

• Click File, Save As and type fixlist.txt as the File Name. 
• Important: The file must be saved in the same location as FRST64.exe. 

NOTICE: This script is intended for use on this particular machine. Do not use this script on any other machine; doing so may cause damage to your Operating System.

• Right-Click FRST64.exe and select  Run as administrator to run the programme.
• Click Fix.
• A log (Fixlog.txt) will open on your desktop. Copy the contents of the log and paste in your next reply.
   

STEP 2
 Junkware Removal Tool (JRT)

• Please download Junkware Removal Tool and save the file to your Desktop.
• Create a System Restore Point. For instructions, please refer to the following link (W7).
• Temporarily disable your anti-virus software. For instructions, please refer to the following link.
• Right-Click JRT.exe and select  Run as administrator to run the programme.
• Follow the prompts and allow the scan to run uninterrupted. 
• Upon completion, a log (JRT.txt) will open on your desktop.
• Re-enable your anti-virus software.
• Copy the contents of JRT.txt and paste in your next reply.
   

STEP 3
 AdwCleaner

• Please download AdwCleaner and save the file to your Desktop.
• Right-Click AdwCleaner.exe and select  Run as administrator to run the programme.
• Follow the prompts. 
• Click Scan. 
• Upon completion, click Report. A log (AdwCleaner[R0].txt) will open. Briefly check the log for anything you know to be legitimate. 
• Ensure anything you know to be legitimate does not have a checkmark, and click Clean. 
• Follow the prompts and allow your computer to reboot. 
• After rebooting, a log (AdwCleaner[S0].txt) will open. Copy the contents of the log and paste in your next reply.

-- File and folder backups are made for items removed using this tool. Should a legitimate file or folder be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the item. Please do not overly concern yourself with the contents of AdwCleaner[R0].txt.
 
======================================================

STEP 4
 Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• Fixlog.txt
• JRT.txt
• AdwCleaner[S0].txt

[dagp06]

Hey Adam, I had a problem at the JRT step.

 

First, I ran the FRST script succesfully, you'll find the log at the end of this post.

Then I created a restore point and temporarily disabled my anti-virus software, but JRT seems to be incompatible with 64-bit Windows Version. It prompts an error message in the middle of the scan. I took a screenshot of the prompt window and attached it to this post. It's in french, but I wanted you to see which file can't be executed as it is mentionned in the message box.

 

I didn't go any further. Tell me what to do from here!

 

Thanks.

_____________________________________________________________________

Fixlog.txt

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 15-02-2015
Ran by Pascal at 2015-02-17 19:17:17 Run:1
Running from C:\Users\Pascal\Desktop
Loaded Profiles: Pascal (Available profiles: Pascal)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
start
CreateRestorePoint:
CMD: ipconfig /flushdns
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
EmptyTemp:
end
*****************

Restore point was successfully created.

=========  ipconfig /flushdns =========


Configuration IP de Windows

Cache de r�solution DNS vid�.

========= End of CMD: =========


=========  netsh int ipv4 reset =========

R�initialisation de G�n�ral, OK�!
R�initialisation de Interface, OK�!
R�initialisation de Adresse unicast, OK�!
Red�marrez l'ordinateur pour terminer cette action.


========= End of CMD: =========


=========  netsh int ipv6 reset =========

R�initialisation de Interface, OK�!
Red�marrez l'ordinateur pour terminer cette action.


========= End of CMD: =========

EmptyTemp: => Removed 402.5 MB temporary data.


The system needed a reboot.

==== End of Fixlog 19:18:54 ====

Attached Thumbnails

• 

[LiquidTension]

Hi Pascal,

Please skip JRT and move on to AdwCleaner.

[dagp06]

Hi Adam,

 

ADW Cleaner didn't clean much, probably because I have run it not so long ago (by feb 5th). So I'll post the log anyways, and I'll post the log from Feb 5th under this one in case you'd want to take a look at it.

 

___________________________________________________________________________________

# AdwCleaner v4.110 - Rapport créé le 18/02/2015 à 08:20:18
# Mis à jour le 05/02/2015 par Xplode
# Base de données : 2015-02-14.2 [Serveur]
# Système d'exploitation : Windows 7 Professional Service Pack 1 (x64)
# Nom d'utilisateur : Pascal - DAGP06-TOUR-WIN
# Exécuté depuis : C:\Users\Pascal\Desktop\AdwCleaner.exe
# Option : Nettoyer

***** [ Services ] *****


***** [ Fichiers / Dossiers ] *****


***** [ Tâches planifiées ] *****


***** [ Raccourcis ] *****


***** [ Registre ] *****


***** [ Navigateurs ] *****

-\\ Internet Explorer v11.0.9600.17631


-\\ Mozilla Firefox v35.0.1 (x86 fr)


-\\ Google Chrome v40.0.2214.111


*************************

AdwCleaner[R0].txt - [1225 octets] - [15/02/2015 20:02:08]
AdwCleaner[R1].txt - [957 octets] - [18/02/2015 08:18:21]
AdwCleaner[S0].txt - [1255 octets] - [15/02/2015 20:42:24]
AdwCleaner[S1].txt - [881 octets] - [18/02/2015 08:20:18]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [940  octets] ##########
 

 

 

___________________________________________________________________________________

 

# AdwCleaner v4.110 - Rapport créé le 15/02/2015 à 20:42:24
# Mis à jour le 05/02/2015 par Xplode
# Base de données : 2015-02-14.2 [Serveur]
# Système d'exploitation : Windows 7 Professional Service Pack 1 (x64)
# Nom d'utilisateur : Pascal - DAGP06-TOUR-WIN
# Exécuté depuis : C:\Users\Pascal\Documents\Programmes\ADW Cleaner\adwcleaner_4.110.exe
# Option : Nettoyer

***** [ Services ] *****


***** [ Fichiers / Dossiers ] *****

Dossier Supprimé : C:\Users\Pascal\Documents\Optimizer Pro

***** [ Tâches planifiées ] *****


***** [ Raccourcis ] *****


***** [ Registre ] *****

Clé Supprimée : HKCU\Software\Softonic
Clé Supprimée : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Clé Supprimée : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Clé Supprimée : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}

***** [ Navigateurs ] *****

-\\ Internet Explorer v11.0.9600.17631


-\\ Mozilla Firefox v35.0.1 (x86 fr)


-\\ Google Chrome v40.0.2214.111


*************************

AdwCleaner[R0].txt - [1225 octets] - [15/02/2015 20:02:08]
AdwCleaner[S0].txt - [1114 octets] - [15/02/2015 20:42:24]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1174  octets] ##########
 

[LiquidTension]

Hello Pascal, 

 

Thank you for the logs. 

 

Is avast! still alerting you? 

 

STEP 1
 Malwarebytes Anti-Malware (MBAM)

• Open Malwarebytes Anti-Malware and click Update Now.
• Once updated, click the Settings tab, followed by Detection and Protection and tick Scan for rootkits.
• Click the Scan tab, ensure Threat Scan is checked and click Scan Now.
• Note: You may see the following message, "Could not load DDA driver". Click Yes, allow your PC to reboot and continue afterwards. 
• If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
• Upon completion of the scan (or after the reboot), click the History tab.
• Click Application Logs and double-click the Scan Log.
• Click Copy to Clipboard and paste the log in your next reply. 
   

STEP 2
 ESET Online Scan
Note: This scan may take a long time to complete. Please do not browse the Internet whilst your Anti-Virus is disabled.

• Please download ESET Online Scan and save the file to your Desktop.
• Temporarily disable your anti-virus software. For instructions, please refer to the following link.
• Double-click esetsmartinstaller_enu.exe to run the programme. 
• Agree to the EULA by placing a checkmark next to Yes, I accept the Terms of Use. Then click Start.
• Agree to the Terms of Use once more and click Start. Allow components to download.
• Place a checkmark next to Enable detection of potentially unwanted applications.
• Click Advanced settings. Place a checkmark next to:
  • Scan archives
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth technology
• Ensure Remove found threats is unchecked.
• Click Start.
• Wait for the scan to finish. Please be patient as this can take some time.
• Upon completion, click . If no threats were found, skip the next two bullet points. 
• Click  and save the file to your Desktop, naming it something such as "MyEsetScan".
• Push the Back button.
• Place a checkmark next to  and click .
• Re-enable your anti-virus software.
• Copy the contents of the log and paste in your next reply.
   

======================================================
 
STEP 3
 Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• MBAM Scan log
• ESET Online Scan log

[dagp06]

Hi Adam,

No, avast! hasn't alerted me the last few times I booted my pc.

I noticed at the end of the eset scan that avast! was already re-enabled, as I disabled it for an hour and the scan took a little more than three. I thought it would have taken less than an hour. Does it matter? Or did it only make the scan slower?

 

Thanks.

____________________________________________________________

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 2015-02-19
Scan Time: 08:30:23
Logfile:
Administrator: Yes

Version: 2.00.4.1028
Malware Database: v2015.02.19.05
Rootkit Database: v2015.02.03.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Pascal

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 426855
Time Elapsed: 12 min, 3 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)




_______________________________________________________________
MyEsetScan:

C:\Users\Pascal\Documents\Programmes\CCleaner\ccsetup419.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Users\Pascal\Documents\Programmes\CCleaner\ccsetup500.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Users\Pascal\Documents\Programmes\CCleaner\ccsetup501.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Users\Pascal\Documents\Programmes\CCleaner\ccsetup502.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application

 

[LiquidTension]

Hello, 
 

No, avast! hasn't alerted me the last few times I booted my pc.

Excellent. 
 

I noticed at the end of the eset scan that avast! was already re-enabled, as I disabled it for an hour and the scan took a little more than three. I thought it would have taken less than an hour. Does it matter? Or did it only make the scan slower?

ESET Online Scan is notorious for taking a long time to complete. The scan is very thorough. 
avast! re-enabling in the middle may have increased the scan time, but it's difficult to say. 
 
The items flagged by ESET are CCleaner installers. The reason for the detection is due to the bundled Google Toolbar inside the installer; not the actual programme itself. There's no harm in leaving these files on your hard drive, but they can be deleted if you wish. 
 
-----------
 
Lets now update your vulnerable software to reduce the risk of reinfection. 

STEP 1
 Update Outdated Software
Outdated software contain security risks that must be patched. Please download and install the latest version of the programmes below.

•  Adobe Air
•  Follow these instructions to check for and download the latest Windows Updates.
   

STEP 2
 Disable Java in Your Browser
Due to frequent exploits we recommend you disable Java in your browser.
For information on Java vulnerabilities, please read the following article (point #7).

• Click the  Windows Start Button  and type Java Control Panel (or javacpl) in the search bar. 
• Click on the Java Control Panel. Once opened, click the Security tab.
• Deselect the check box for Enable Java content in the browser. This will disable the Java plug-in in the browser. 
• Click Apply. When the  Windows User Account Control (UAC) appears, allow permissions to make the changes. 
• Click OK in the Java Plug-in confirmation window.
• Restart your browser(s) for changes to take effect.
• More information can be found here and here.
   

STEP 3
 Security Check

• Please download SecurityCheck and save the file to your Desktop.
• Double-click SecurityCheck.exe and follow the onscreen instructions inside the black box.
• A log (checkup.txt) will automatically open on your Desktop.
• Copy the contents of the log and paste in your next reply.
   

======================================================
 
STEP 4
 Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• checkup.txt
• How is your computer performing? Are there any outstanding issues?

[dagp06]

Hello Adam!

My computer seems fine. Not quicker nor slower than before. Except avast! not alerting me anymore, I didn't notice anything new.

I looked for updates and installed them with Windows Updates. I updated Adobe Air too.

I disabled Java from browsers, and here's the checkup.txt log:

 

___________________________________________________________________

checkup.txt

 

 Results of screen317's Security Check version 0.99.96  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:``````````````
 Windows Security Center service is not running! This report may not be accurate!
avast! Antivirus   
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:`````````
 Java 8 Update 31  
 Visual Studio Extensions for Windows Library for JavaScript
 Java version 32-bit out of Date!
  Java 64-bit 8 Update 31  
 Adobe Flash Player 16.0.0.305  
 Mozilla Firefox (35.0.1)
 Google Chrome (40.0.2214.111)
 Google Chrome (40.0.2214.115)
````````Process Check: objlist.exe by Laurent````````  
 AVAST Software Avast AvastSvc.exe  
 AVAST Software Avast avastui.exe  
 AVAST Software Avast ng vbox\AvastVBoxSVC.exe
 AVAST Software Avast ng ngservice.exe
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: =
````````````````````End of Log``````````````````````
 

[LiquidTension]

Hello, 
 
One item to address in your SecurityCheck log. 
Please do the following. 
 
 Farbar Service Scanner (FSS)

• Please download FSS and save the file to your Desktop.
• Right-Click FSS.exe and select  Run as administrator to run the programme.
• Ensure the following items are checked:
  • 
  • 
  • 
  • 
  • 
  • 
  • 
• Click .
• A log (FSS.txt) will be created on your Desktop. Copy the contents of the log and paste in your next reply.

[dagp06]

I forgot to mention that when I ran SecurityCheck, I had the same incompatibility message that I had with JRT (about 64-bit Windows), but I clicked ok and the scan went on anyways, The same message appeared with FSS (twice), but once again I clicked ok and it was (or seemed) fine.

 

Here's the log:

 

__________________________________________________________

FSS.txt

 

Farbar Service Scanner Version: 17-01-2015
Ran by Pascal (administrator) on 21-02-2015 at 19:03:52
Running from "C:\Users\Pascal\Desktop"
Microsoft Windows 7 Professionnel  Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Policy:
========================


Action Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
RpcSs Service is not running. Checking service configuration:
The start type of RpcSs service is OK.
The ImagePath of RpcSs service is OK.


Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcore.dll => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****