cjoint

Publicité


Publicité

Format du document : text/plain

Prévisualisation

ÿþOTL logfile created on: 01/04/2014 17:09:17 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Soraya&Boualem\Downloads
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy

3,00 Gb Total Physical Memory | 1,73 Gb Available Physical Memory | 57,83% Memory free
6,22 Gb Paging File | 4,79 Gb Available in Paging File | 76,91% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455,49 Gb Total Space | 10,71 Gb Free Space | 2,35% Space Free | Partition Type: NTFS
Drive D: | 10,27 Gb Total Space | 1,40 Gb Free Space | 13,62% Space Free | Partition Type: NTFS

Computer Name: PC-DE-SORAYA | User Name: Soraya&Boualem | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

[color=#E56717]========== Processes (SafeList) ==========[/color]

PRC - [2014/04/01 17:07:16 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Soraya&Boualem\Downloads\OTL.exe
PRC - [2014/03/14 19:57:29 | 001,863,560 | ---- | M] (Adobe Systems, Inc.) -- C:\WINDOWS\System32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe
PRC - [2013/10/01 16:38:04 | 000,274,840 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2013/09/03 15:53:50 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013/04/16 03:07:06 | 000,039,056 | ---- | M] () -- C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
PRC - [2013/04/07 13:39:08 | 000,195,840 | ---- | M] (NETGEAR) -- C:\Program Files\NETGEAR Genie\bin\NETGEARGenieDaemon.exe
PRC - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2013/04/04 14:50:32 | 000,532,040 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2011/07/21 12:20:40 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2011/04/21 07:55:54 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2011/04/21 07:55:37 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2009/01/14 23:08:51 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/07/12 17:36:12 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe


[color=#E56717]========== Modules (No Company Name) ==========[/color]

MOD - [2014/03/14 19:57:27 | 016,276,872 | ---- | M] () -- C:\WINDOWS\System32\Macromed\Flash\NPSWF32_12_0_0_77.dll
MOD - [2013/10/01 16:38:03 | 003,279,768 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2011/06/16 15:43:48 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\1ba19f8efcff8ad7f972aa38ab9a15f5\System.Runtime.Remoting.ni.dll
MOD - [2011/06/16 15:43:45 | 000,627,712 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\1c06ada12457242969cdc35d5af12b01\System.EnterpriseServices.ni.dll
MOD - [2011/06/16 15:43:45 | 000,280,064 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\1c06ada12457242969cdc35d5af12b01\System.EnterpriseServices.Wrapper.dll
MOD - [2011/06/16 15:43:44 | 000,627,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\fdbb4d76b37aada9010c49a6e09da067\System.Transactions.ni.dll
MOD - [2011/06/16 15:43:09 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\aa3e053d433c48e1e8c3f436b4de1ed3\System.Configuration.ni.dll
MOD - [2011/06/16 15:41:42 | 005,450,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\cfb60f99da570cc494e27e0e8ee747e2\System.Xml.ni.dll
MOD - [2011/06/16 15:41:22 | 012,430,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\381fb23cb39e1a61e13b8770eb9800ba\System.Windows.Forms.ni.dll
MOD - [2011/06/16 15:41:10 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\f1aa2385c0109f3059e0e6ba8b58ff68\System.Drawing.ni.dll
MOD - [2011/06/16 15:40:59 | 006,616,576 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\ca69ec9d6589d3526ee38212ef28e2bb\System.Data.ni.dll
MOD - [2011/06/16 15:40:50 | 000,368,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\6bebfe5b7776c84cb38efdb2a7c9d447\PresentationFramework.Aero.ni.dll
MOD - [2011/06/16 15:40:49 | 014,327,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\415ef2ec8cbd9f3368da6ade10beae26\PresentationFramework.ni.dll
MOD - [2011/06/16 15:40:26 | 012,216,320 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\c1498ba4652483d5adddd4c5d3927170\PresentationCore.ni.dll
MOD - [2011/06/16 15:40:08 | 003,313,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\29d729043903b7b4b2ea695db220d866\WindowsBase.ni.dll
MOD - [2011/06/16 15:40:04 | 007,950,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9dff86a62a525ec8dc827fe9f50298b7\System.ni.dll
MOD - [2011/06/16 15:39:27 | 011,490,816 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\0309936a8e1672d39b9cf14463ce69f9\mscorlib.ni.dll
MOD - [2008/11/25 01:34:49 | 001,736,528 | ---- | M] () -- C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\wpfgfx_v0300.dll
MOD - [2008/07/27 20:22:54 | 000,113,664 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
MOD - [2008/07/27 20:03:15 | 002,933,248 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
MOD - [2008/07/27 20:03:15 | 000,261,632 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
MOD - [2008/07/27 20:03:10 | 000,311,296 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_fr_b77a5c561934e089\mscorlib.resources.dll
MOD - [2008/07/11 21:39:10 | 000,245,760 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\PresentationFramework.resources\3.0.0.0_fr_31bf3856ad364e35\PresentationFramework.resources.dll
MOD - [2008/07/11 21:39:10 | 000,110,592 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\PresentationCore.resources\3.0.0.0_fr_31bf3856ad364e35\PresentationCore.resources.dll
MOD - [2008/07/11 21:39:10 | 000,090,112 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\WindowsBase.resources\3.0.0.0_fr_31bf3856ad364e35\WindowsBase.resources.dll
MOD - [2008/01/19 09:35:11 | 000,368,640 | ---- | M] () -- C:\WINDOWS\System32\msjetoledb40.dll
MOD - [2007/10/03 19:02:16 | 000,036,864 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\Content.XmlSerializers.dll
MOD - [2007/10/03 19:02:16 | 000,007,168 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\RemotingClient.dll
MOD - [2007/10/03 19:02:04 | 000,057,344 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\Pillars\PCAlerts\PCAlertsPillar.dll
MOD - [2007/10/03 19:01:44 | 000,036,864 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\MessagingClients.dll
MOD - [2007/10/03 19:01:36 | 000,040,960 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\MessagingServer.dll
MOD - [2007/10/03 19:01:36 | 000,028,672 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\MessagingMessages.dll
MOD - [2007/10/03 19:01:36 | 000,006,144 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\MessagingInterface.dll
MOD - [2007/09/15 00:04:02 | 000,159,744 | ---- | M] () -- C:\WINDOWS\System32\atitmmxx.dll


[color=#E56717]========== Services (SafeList) ==========[/color]

SRV - [2014/03/14 19:57:39 | 000,257,928 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013/10/23 09:15:08 | 000,172,192 | ---- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013/10/01 16:38:03 | 000,118,680 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013/09/03 15:53:50 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013/04/16 03:07:06 | 000,039,056 | ---- | M] () [Auto | Running] -- C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe -- (RealNetworks Downloader Resolver Service)
SRV - [2013/04/07 13:39:08 | 000,195,840 | ---- | M] (NETGEAR) [Auto | Running] -- C:\Program Files\NETGEAR Genie\bin\NETGEARGenieDaemon.exe -- (NETGEARGenieDaemon)
SRV - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2013/02/05 17:48:00 | 000,235,216 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe -- (McComponentHostService)
SRV - [2011/07/21 12:20:40 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/04/21 07:55:37 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010/02/05 05:16:20 | 000,419,224 | ---- | M] (CSR, plc) [Auto | Running] -- C:\WINDOWS\System32\HFGService.dll -- (HFGService)
SRV - [2008/01/19 09:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008/01/19 09:36:49 | 000,365,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2008/01/19 09:36:15 | 000,167,936 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\WindowsMobile\rapimgr.dll -- (RapiMgr)
SRV - [2007/07/12 17:36:12 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON)


[color=#E56717]========== Driver Services (SafeList) ==========[/color]

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2013/09/25 12:13:44 | 000,035,088 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\npf.sys -- (NPF)
DRV - [2013/04/04 14:50:32 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011/08/17 11:03:58 | 000,137,472 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\nmwcdnsu.sys -- (nmwcdnsu)
DRV - [2011/08/17 11:03:50 | 000,008,576 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\nmwcdnsuc.sys -- (nmwcdnsuc)
DRV - [2011/08/17 10:56:32 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2011/08/17 10:56:30 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2011/08/17 10:56:26 | 000,023,168 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2011/08/17 10:56:22 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2011/07/21 12:22:41 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011/07/21 12:22:40 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010/06/17 15:28:02 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010/02/05 05:16:10 | 000,066,952 | ---- | M] (CSR, plc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\bthav.sys -- (csr_a2dp)
DRV - [2010/02/05 05:16:10 | 000,028,048 | ---- | M] (CSR, plc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\BthAvrcp.sys -- (BthAvrcp)
DRV - [2010/02/05 05:16:08 | 000,048,024 | ---- | M] (CSR, plc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\BthAudioHF.sys -- (BthAudioHF)
DRV - [2009/09/29 09:11:22 | 000,012,160 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\lgbtport.sys -- (LgBttPort)
DRV - [2009/09/29 09:11:20 | 000,012,928 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\lgvmodem.sys -- (LGVMODEM)
DRV - [2009/09/29 09:11:20 | 000,010,496 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\lgbtbus.sys -- (lgbusenum)
DRV - [2008/11/19 18:09:10 | 000,024,832 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\lgusbmodem.sys -- (USBModem)
DRV - [2008/11/19 18:09:08 | 000,019,968 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\lgusbdiag.sys -- (UsbDiag)
DRV - [2008/11/19 18:09:08 | 000,013,056 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\lgusbbus.sys -- (usbbus)
DRV - [2008/02/13 12:34:50 | 012,067,328 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\snp2sxp.sys -- (SNP2STD)
DRV - [2008/01/19 07:53:22 | 000,031,616 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\winusb.sys -- (winusb)
DRV - [2007/09/15 00:16:22 | 003,151,872 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2007/08/03 12:44:00 | 000,091,648 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2007/03/25 22:08:08 | 000,697,344 | ---- | M] (D-Link Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\A3ABv.sys -- (A3AB)
DRV - [2006/11/02 09:30:52 | 000,467,456 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\athr.sys -- (athr)
DRV - [2006/07/24 16:05:00 | 000,005,632 | ---- | M] () [File_System | System | Running] -- C:\Windows\System32\drivers\StarOpen.sys -- (StarOpen)
DRV - [2005/12/12 19:27:00 | 000,019,072 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\PS2.sys -- (Ps2)
DRV - [2005/08/17 07:46:26 | 000,093,872 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\sscdmdm.sys -- (sscdmdm)
DRV - [2005/08/17 07:46:20 | 000,008,272 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\sscdmdfl.sys -- (sscdmdfl)
DRV - [2005/08/17 07:45:00 | 000,058,352 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\sscdbus.sys -- (sscdbus)


[color=#E56717]========== Standard Registry (SafeList) ==========[/color]


[color=#E56717]========== Internet Explorer ==========[/color]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_fr&c=81&bd=Pavilion&pf=desktop
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://www.plusnetwork.com/?sp=ctbar&q={searchTerms}&dp=MessengerPlus
IE - HKLM\..\SearchScopes\{157A9396-C2C3-4D32-91A9-F40C72601999}: "URL" = http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1156&query={searchTerms}&invocationType=tb50hpcndtie7-fr-fr
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2528058
IE - HKLM\..\SearchScopes\{C3EEE889-3F4B-4B32-A143-FD8188D4A4D1}: "URL" = http://fr.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913932
IE - HKLM\..\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}: "URL" = http://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg-chrome&type=yahoo_avg_hs2-tb-web_chrome_us&p={searchTerms}


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_fr&c=81&bd=Pavilion&pf=desktop
IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKU\.DEFAULT\..\SearchScopes\{157A9396-C2C3-4D32-91A9-F40C72601999}: "URL" = http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1156&query={searchTerms}&invocationType=tb50hpcndtie7-fr-fr
IE - HKU\.DEFAULT\..\SearchScopes\{4B8C28A7-A9BC-45F8-990D-21499EED643C}: "URL" = http://www.questscan.com/?prt=QUESTSCAN183&keywords={searchTerms}
IE - HKU\.DEFAULT\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKU\.DEFAULT\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2528058
IE - HKU\.DEFAULT\..\SearchScopes\{C3EEE889-3F4B-4B32-A143-FD8188D4A4D1}: "URL" = http://fr.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913932
IE - HKU\.DEFAULT\..\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}: "URL" = http://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg-chrome&type=yahoo_avg_hs2-tb-web_chrome_us&p={searchTerms}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_fr&c=81&bd=Pavilion&pf=desktop
IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKU\S-1-5-18\..\SearchScopes\{157A9396-C2C3-4D32-91A9-F40C72601999}: "URL" = http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1156&query={searchTerms}&invocationType=tb50hpcndtie7-fr-fr
IE - HKU\S-1-5-18\..\SearchScopes\{4B8C28A7-A9BC-45F8-990D-21499EED643C}: "URL" = http://www.questscan.com/?prt=QUESTSCAN183&keywords={searchTerms}
IE - HKU\S-1-5-18\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKU\S-1-5-18\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2528058
IE - HKU\S-1-5-18\..\SearchScopes\{C3EEE889-3F4B-4B32-A143-FD8188D4A4D1}: "URL" = http://fr.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913932
IE - HKU\S-1-5-18\..\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}: "URL" = http://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg-chrome&type=yahoo_avg_hs2-tb-web_chrome_us&p={searchTerms}
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1842019664-894896754-1257712989-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.bing.com/search?q={searchTerms}
IE - HKU\S-1-5-21-1842019664-894896754-1257712989-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.bing.com/search?q={searchTerms}
IE - HKU\S-1-5-21-1842019664-894896754-1257712989-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
IE - HKU\S-1-5-21-1842019664-894896754-1257712989-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-1842019664-894896754-1257712989-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.bing.com/search?q={searchTerms}
IE - HKU\S-1-5-21-1842019664-894896754-1257712989-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.bing.com/search?q={searchTerms}
IE - HKU\S-1-5-21-1842019664-894896754-1257712989-1000\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKU\S-1-5-21-1842019664-894896754-1257712989-1000\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://www.bing.com/search?q={searchTerms}
IE - HKU\S-1-5-21-1842019664-894896754-1257712989-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://www2.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=74F40022B0682A8A&affID=119676&tsp=5004
IE - HKU\S-1-5-21-1842019664-894896754-1257712989-1000\..\SearchScopes\{157A9396-C2C3-4D32-91A9-F40C72601999}: "URL" = http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1156&query={searchTerms}&invocationType=tb50hpcndtie7-fr-fr
IE - HKU\S-1-5-21-1842019664-894896754-1257712989-1000\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=FF&o=14594&src=crm&q={searchTerms}&locale=fr_FR&apn_ptnrs=^FV&apn_dtid=^YYYYYY^YY^FR&apn_uid=70468fce-e5fd-42a9-a1d9-b5d1503b8e7d&apn_sauid=0FB12555-C60F-466B-BC58-EADCCC710CE4
IE - HKU\S-1-5-21-1842019664-894896754-1257712989-1000\..\SearchScopes\{19F2B849-4ADE-4d4b-85F9-C31C643DBDE9}: "URL" = http://www.fastbrowsersearch.com/results/results.aspx?q={searchTerms}&c=web&s=DSP&v=19&tid={2F30D34D-215A-4407-8527-82884D634E82}
IE - HKU\S-1-5-21-1842019664-894896754-1257712989-1000\..\SearchScopes\{1F096B29-E9DA-4D64-8D63-936BE7762CC5}: "URL" = http://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=74f40ce60000000000000022b0682a8a&tlver=1.4.19.19&affID=17159
IE - HKU\S-1-5-21-1842019664-894896754-1257712989-1000\..\SearchScopes\{4327FABE-3C22-4689-8DBF-D226CF777FE9}: "URL" = http://plusnetwork.com/?sp=brw&q={searchTerms}
IE - HKU\S-1-5-21-1842019664-894896754-1257712989-1000\..\SearchScopes\{550f51ed-7625-4b6f-9e7b-3f0debb33cc0}: "URL" = http://www.wibeez.com/meteo?search&q={searchTerms}
IE - HKU\S-1-5-21-1842019664-894896754-1257712989-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GPEA_fr
IE - HKU\S-1-5-21-1842019664-894896754-1257712989-1000\..\SearchScopes\{9D5BD211-422C-4164-9298-BB4186A30F31}: "URL" = http://www.bing.com/search?q={searchTerms}&mkt=fr-FR&form=IE0003
IE - HKU\S-1-5-21-1842019664-894896754-1257712989-1000\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2528058
IE - HKU\S-1-5-21-1842019664-894896754-1257712989-1000\..\SearchScopes\{C3EEE889-3F4B-4B32-A143-FD8188D4A4D1}: "URL" = http://fr.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913932
IE - HKU\S-1-5-21-1842019664-894896754-1257712989-1000\..\SearchScopes\{CAB0006D-E3D0-4B94-AF85-46A0C8335EDD}: "URL" = http://mp3tubetoolbarsearch.com/?tmp=toolbar_Mp3Tube_results&prt=pinballtb01ie&Keywords={searchTerms}&clid=304ca5dff61c4d908ebf7060553baf00
IE - HKU\S-1-5-21-1842019664-894896754-1257712989-1000\..\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}: "URL" = http://search.avg.com/route/?d=4be6bbb7&v=6.10.6.4&i=23&tp=chrome&q={searchTerms}&lng={language}&iy=&ychte=us
IE - HKU\S-1-5-21-1842019664-894896754-1257712989-1000\..\SearchScopes\{E08A9998-D98F-476f-8F5C-37C80FE0A4DA}: "URL" = http://search.conduit.com/?SearchSource=10&ctid=CT2528058
IE - HKU\S-1-5-21-1842019664-894896754-1257712989-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1842019664-894896754-1257712989-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <-loopback>
IE - HKU\S-1-5-21-1842019664-894896754-1257712989-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:8888;https=127.0.0.1:8888

[color=#E56717]========== FireFox ==========[/color]

FF - prefs.js..browser.search.defaultenginename: "Conduit Search"
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "google.fr"
FF - prefs.js..extensions.enabledAddons: 7go%407go.com:3.0.0.0
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:24.0


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/McAfeeMssPlugin: C:\Program Files\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=16.0.2.32: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlchromebrowserrecordext;version=1.3.2: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlhtml5videoshim;version=1.3.2: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlpepperflashvideoshim;version=1.3.2: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=16.0.2.32: c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@realnetworks.com/npdlplugin;version=1: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@zylom.com/ZylomGamesPlayer: C:\Users\Soraya&Boualem\AppData\Roaming\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll (Zylom)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2014/03/31 00:49:35 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FCE04E1F-9378-4f39-96F6-5689A9159E45}: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\ [2014/03/31 00:49:35 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 24.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 24.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/11/01 14:50:24 | 000,000,000 | ---D | M]

[2012/12/09 00:11:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Soraya&Boualem\AppData\Roaming\Mozilla\Extensions
[2014/03/31 08:50:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Soraya&Boualem\AppData\Roaming\Mozilla\Firefox\Profiles\0pcxif8r.default\extensions
[2014/03/27 22:53:36 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Soraya&Boualem\AppData\Roaming\Mozilla\Firefox\Profiles\0pcxif8r.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}(312)
[2014/01/04 15:36:57 | 000,160,605 | ---- | M] () (No name found) -- C:\Users\Soraya&Boualem\AppData\Roaming\Mozilla\Firefox\Profiles\0pcxif8r.default\extensions\7go@7go.com.xpi
[2013/07/22 13:35:02 | 000,180,858 | ---- | M] () (No name found) -- C:\Users\Soraya&Boualem\AppData\Roaming\Mozilla\Firefox\Profiles\0pcxif8r.default\extensions\jid1-FCM5fDwCW5M3AQ@jetpack.xpi
[2013/06/17 13:47:58 | 000,006,511 | ---- | M] () -- C:\Users\Soraya&Boualem\AppData\Roaming\Mozilla\Firefox\Profiles\0pcxif8r.default\searchplugins\babylon.xml
[2014/03/27 22:57:23 | 000,001,030 | ---- | M] () -- C:\Users\Soraya&Boualem\AppData\Roaming\Mozilla\Firefox\Profiles\0pcxif8r.default\searchplugins\conduit-search.xml
[2013/06/17 13:48:22 | 000,001,294 | ---- | M] () -- C:\Users\Soraya&Boualem\AppData\Roaming\Mozilla\Firefox\Profiles\0pcxif8r.default\searchplugins\delta.xml
[2013/11/01 14:22:10 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\Extensions
[2013/11/01 14:22:10 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions
[2013/10/01 16:38:04 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2010/04/12 17:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2013/07/01 20:17:26 | 000,124,504 | ---- | M] (RealPlayer) -- C:\Program Files\mozilla firefox\plugins\nprpplugin.dll

[color=#E56717]========== Chrome ==========[/color]

CHR - default_search_provider: (Enabled)
CHR - default_search_provider: search_url = http://search.conduit.com/Results.aspx?gd=&ctid=CT3324790&octid=EB_ORIGINAL_CTID&ISID=M3B9EF523-9AB5-4D6E-8DBB-CAC926A5AED1&SearchSource=58&CUI=&UM=5&UP=&q={searchTerms}&SSPV=
CHR - default_search_provider: suggest_url = http://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms},
CHR - homepage: http://search.conduit.com/?gd=&ctid=CT3324790&octid=EB_ORIGINAL_CTID&ISID=M3B9EF523-9AB5-4D6E-8DBB-CAC926A5AED1&SearchSource=55&CUI=&UM=5&UP=&SSPV=
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\33.0.1750.154\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\33.0.1750.154\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\33.0.1750.154\pdf.dll
CHR - plugin: Skype Toolbars (Enabled) = C:\Users\Soraya&Boualem\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0\npSkypeChromePlugin.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java(TM) Platform SE 6 U20 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Microsoft Windows Media Player Firefox Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: Java Deployment Toolkit 6.0.200.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: DivX Player Netscape Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll
CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: RealPlayer Download Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprpplugin.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll
CHR - plugin: Windows Live Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: RealNetworks(tm) RealDownloader Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll
CHR - plugin: RealNetworks(tm) RealDownloader HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll
CHR - plugin: RealNetworks(tm) RealDownloader PepperFlashVideoShim Plug-In (32-bit) (Enabled) = C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll
CHR - plugin: RealDownloader Plugin (Enabled) = C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll
CHR - plugin: Zylom Plugin (Enabled) = C:\Users\Soraya&Boualem\AppData\Roaming\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_146.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: RealDownloader = C:\Users\Soraya&Boualem\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji\1.3.2_0\
CHR - Extension: Google Wallet = C:\Users\Soraya&Boualem\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\

O1 HOSTS File: ([2006/09/18 23:41:30 | 000,000,761 | ---- | M]) - C:\WINDOWS\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (MSS+ Identifier) - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
O2 - BHO: (RealNetworks Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (BrowserHelper Class) - {8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6} - C:\Program Files\SGPSA\SearchAssistant.dll File not found
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.9012.1008\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - No CLSID value found.
O3 - HKU\S-1-5-21-1842019664-894896754-1257712989-1000\..\Toolbar\WebBrowser: (no name) - {A84C9E75-CB32-4928-BAB6-25460A3B19B3} - No CLSID value found.
O3 - HKU\S-1-5-21-1842019664-894896754-1257712989-1000\..\Toolbar\WebBrowser: (no name) - {B9E20919-FA55-471F-989B-B107BF8DE785} - No CLSID value found.
O3 - HKU\S-1-5-21-1842019664-894896754-1257712989-1000\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKU\S-1-5-21-1842019664-894896754-1257712989-1000\..\Toolbar\WebBrowser: (no name) - {EEE6C35B-6118-11DC-9C72-001320C79847} - No CLSID value found.
O4 - HKLM..\Run: [FBSSA] C:\Program Files\SGPSA\ie3sh.exe File not found
O4 - HKLM..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe File not found
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1842019664-894896754-1257712989-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1842019664-894896754-1257712989-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = FF FF FF FF [binary data]
O7 - HKU\S-1-5-21-1842019664-894896754-1257712989-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 36
O8 - Extra context menu item: &Télécharger avec NetTransport - C:\Program Files\Xi\NetTransport 2\NTAddLink.html File not found
O8 - Extra context menu item: Ouvrir le fichier PDF dans Word (PDF Converter 3.0) - C:\Program Files\ScanSoft\OmniPage15.0\PDFConverter3\IEShellExt.dll (ScanSoft, Inc.)
O8 - Extra context menu item: Tout t&élécharger avec NetTransport - C:\Program Files\Xi\NetTransport 2\NTAddList.html File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKU\.DEFAULT\..Trusted Ranges: Range1 ([http] in Local intranet)
O15 - HKU\S-1-5-18\..Trusted Ranges: Range1 ([http] in Local intranet)
O15 - HKU\S-1-5-21-1842019664-894896754-1257712989-1000\..Trusted Ranges: Range1 ([http] in Local intranet)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab (QuickTime Object)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Reg Error: Key error.)
O16 - DPF: {50DC58D0-C870-4BE6-BC41-971ED2D5F022} http://www.super-messenger.fr/tab/HookWlmEx.cab (HookWlmEx Control)
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} http://express.foto.com/ImageUploader5.cab (Reg Error: Key error.)
O16 - DPF: {83A4D5A6-E2C1-4EDD-AD48-1A1C50BD06EF} http://www.photoweb.fr/telechargement/telechargement-photoweb-6.1.4.cab (Image Uploader Control)
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} http://fichiers.touslesdrivers.com/fichiers/hardwaredetection/hardwaredetection_3_1_1_0.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {B60CEFE7-2DD0-4B78-951A-509D951DB1F0} http://www.extrafilm.fr/ExtraFilmUploader6.cab (ExtraFilm Uploader Control)
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} http://game.zylom.com/activex/zylomgamesplayer.cab (Zylom Games Player)
O16 - DPF: {CAC677B6-4963-4305-9066-0BD135CD9233} https://asp.photoprintit.de/microsite/3462/defaults/activex/ips/IPSUploader4.cab (IPSUploader4 Control)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://files-mjf.jeuxvideo-flash.com/popcap/popcaploader_v10_fr.cab (PopCapLoader Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} http://gfx1.hotmail.com/mail/w4/m3/photouploadcontrol/VistaMSNPUpldfr-fr.cab (Windows Live Hotmail Photo Upload Tool)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E25508BF-6AB6-4470-91D1-A651A3B32E15}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F25CD6E3-0B97-4C5E-989A-99773D1F2902}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL File not found
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\WINDOWS\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Soraya&Boualem\AppData\Roaming\Microsoft\Windows Photo Gallery\Papier peint de la Galerie de photos Windows.jpg
O24 - Desktop BackupWallPaper: C:\Users\Soraya&Boualem\AppData\Roaming\Microsoft\Windows Photo Gallery\Papier peint de la Galerie de photos Windows.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/11/24 13:30:28 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2014/03/25 20:08:32 | 000,000,000 | RHSD | M] - D:\Autorun.inf -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

MsConfig - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk - C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe - (McAfee, Inc.)
MsConfig - StartUpFolder: C:^Users^Soraya&Boualem^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^DeliveryManager.lnk - C:\Users\Soraya&Boualem\AppData\Roaming\Delivery\DeliveryManager.EXE - (Immanens)
MsConfig - StartUpFolder: C:^Users^Soraya&Boualem^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 - Capture d'écran et lancement.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE - (Microsoft Corporation)
MsConfig - StartUpReg: [b]Adobe ARM[/b] - hkey= - key= - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: [b]Adobe Reader Speed Launcher[/b] - hkey= - key= - File not found
MsConfig - StartUpReg: [b]ALUAlert[/b] - hkey= - key= - File not found
MsConfig - StartUpReg: [b]APSDaemon[/b] - hkey= - key= - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
MsConfig - StartUpReg: [b]avgnt[/b] - hkey= - key= - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
MsConfig - StartUpReg: [b]ccApp[/b] - hkey= - key= - File not found
MsConfig - StartUpReg: [b]ehTray.exe[/b] - hkey= - key= - C:\WINDOWS\ehome\ehtray.exe (Microsoft Corporation)
MsConfig - StartUpReg: [b]FreeCall[/b] - hkey= - key= - File not found
MsConfig - StartUpReg: [b]fssui[/b] - hkey= - key= - C:\Program Files\Windows Live\Family Safety\fsui.exe (Microsoft Corporation)
MsConfig - StartUpReg: [b]hpsysdrv[/b] - hkey= - key= - c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
MsConfig - StartUpReg: [b]IAAnotif[/b] - hkey= - key= - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
MsConfig - StartUpReg: [b]iTunesHelper[/b] - hkey= - key= - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
MsConfig - StartUpReg: [b]Messenger (Yahoo!)[/b] - hkey= - key= - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
MsConfig - StartUpReg: [b]NETGEARGenie[/b] - hkey= - key= - C:\Program Files\NETGEAR Genie\bin\NETGEARGenie.exe ()
MsConfig - StartUpReg: [b]OpAgent[/b] - hkey= - key= - C:\Program Files\ScanSoft\OmniPage15.0\OpAgent.exe (ScanSoft, Inc.)
MsConfig - StartUpReg: [b]OpScheduler[/b] - hkey= - key= - File not found
MsConfig - StartUpReg: [b]Opware15[/b] - hkey= - key= - C:\Program Files\ScanSoft\OmniPage15.0\Opware15.exe (ScanSoft, Inc.)
MsConfig - StartUpReg: [b]OsdMaestro[/b] - hkey= - key= - C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe (OsdMaestro)
MsConfig - StartUpReg: [b]PDF3 Registry Controller[/b] - hkey= - key= - C:\Program Files\ScanSoft\OmniPage15.0\PDFConverter3\RegistryController.exe (ScanSoft, Inc.)
MsConfig - StartUpReg: [b]QuickTime Task[/b] - hkey= - key= - C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
MsConfig - StartUpReg: [b]rehsditf[/b] - hkey= - key= - File not found
MsConfig - StartUpReg: [b]RtHDVCpl[/b] - hkey= - key= - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
MsConfig - StartUpReg: [b]ScanSoft OmniPage 15.0-reminder[/b] - hkey= - key= - C:\Program Files\ScanSoft\OmniPage15.0\Ereg\ereg.exe ()
MsConfig - StartUpReg: [b]SmartVoip[/b] - hkey= - key= - File not found
MsConfig - StartUpReg: [b]snp2std[/b] - hkey= - key= - C:\Windows\vsnp2std.exe (Sonix)
MsConfig - StartUpReg: [b]SSBkgdUpdate[/b] - hkey= - key= - C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Scansoft, Inc.)
MsConfig - StartUpReg: [b]StartCCC[/b] - hkey= - key= - c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ()
MsConfig - StartUpReg: [b]SunJavaUpdateReg[/b] - hkey= - key= - File not found
MsConfig - StartUpReg: [b]SunJavaUpdateSched[/b] - hkey= - key= - C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
MsConfig - StartUpReg: [b]swg[/b] - hkey= - key= - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
MsConfig - StartUpReg: [b]Symantec PIF AlertEng[/b] - hkey= - key= - File not found
MsConfig - StartUpReg: [b]TkBellExe[/b] - hkey= - key= - c:\program files\real\realplayer\Update\realsched.exe (RealNetworks, Inc.)
MsConfig - StartUpReg: [b]tsnp2std[/b] - hkey= - key= - C:\Windows\tsnp2std.exe (SONIX)
MsConfig - StartUpReg: [b]VoipDiscount[/b] - hkey= - key= - File not found
MsConfig - StartUpReg: [b]VoipSoftClient[/b] - hkey= - key= - File not found
MsConfig - StartUpReg: [b]Voipwise[/b] - hkey= - key= - File not found
MsConfig - StartUpReg: [b]Windows Defender[/b] - hkey= - key= - File not found
MsConfig - StartUpReg: [b]Windows Mobile-based device management[/b] - hkey= - key= - File not found
MsConfig - StartUpReg: [b]wlm2011installer[/b] - hkey= - key= - File not found
MsConfig - StartUpReg: [b]WMPNSCFG[/b] - hkey= - key= - C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
MsConfig - StartUpReg: [b]WrtMon.exe[/b] - hkey= - key= - File not found
MsConfig - State: "startup" - 2

SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS - File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS - File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files\Google\Chrome\Application\33.0.1750.154\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C6BAF60B-6E91-453F-BFF9-D3789CFEFCDD} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - Reg Error: Value error.
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

Drivers32: msacm.l3acm - C:\WINDOWS\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.XVID - C:\Windows\System32\xvidvfw.dll ()

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

CREATERESTOREPOINT
Restore point Set: OTL Restore Point
PhysicalDisk0 MBR saved to C:\PhysicalMBR.bin

[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]

[2014/03/31 23:31:01 | 000,000,000 | ---D | C] -- C:\Users\Soraya&Boualem\Desktop\guide de l'AS
[2014/03/31 19:48:39 | 000,000,000 | ---D | C] -- C:\Users\Soraya&Boualem\Desktop\Captvtynew
[2014/03/31 00:54:00 | 000,000,000 | ---D | C] -- C:\Users\Soraya&Boualem\AppData\Local\SearchProtect
[2014/03/27 20:30:51 | 000,000,000 | ---D | C] -- C:\Users\Soraya&Boualem\AppData\Roaming\AVG2014
[2014/03/27 20:29:52 | 000,000,000 | ---D | C] -- C:\Users\Soraya&Boualem\AppData\Roaming\TuneUp Software
[2014/03/27 20:27:32 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG2014
[2014/03/27 20:19:54 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2014/03/27 20:19:54 | 000,000,000 | ---D | C] -- C:\Users\Soraya&Boualem\AppData\Local\MFAData
[2014/03/27 20:19:54 | 000,000,000 | ---D | C] -- C:\Users\Soraya&Boualem\AppData\Local\Avg2014
[2014/03/27 19:52:32 | 000,000,000 | ---D | C] -- C:\Program Files\SearchProtect
[2014/03/27 19:52:12 | 000,000,000 | ---D | C] -- C:\Program Files\MyPC Backup
[2014/03/25 19:44:47 | 000,000,000 | ---D | C] -- C:\UsbFix
[2014/03/24 23:17:26 | 000,000,000 | ---D | C] -- C:\Users\Soraya&Boualem\Desktop\Lasalle
[2014/03/24 19:06:56 | 000,000,000 | ---D | C] -- C:\Users\Soraya&Boualem\Doctor Web
[2014/03/24 18:55:11 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2014/03/23 20:27:30 | 000,000,000 | ---D | C] -- C:\found.001
[2014/03/23 15:35:58 | 000,000,000 | ---D | C] -- C:\Shortcut_Module
[2014/03/23 15:17:50 | 000,000,000 | ---D | C] -- C:\Program Files\ZHPDiag
[2014/03/23 15:17:50 | 000,000,000 | ---D | C] -- C:\Users\Soraya&Boualem\AppData\Roaming\ZHP
[2014/03/22 14:37:33 | 000,000,000 | ---D | C] -- C:\Users\Soraya&Boualem\AppData\Roaming\Solvusoft
[2014/03/22 14:37:26 | 000,000,000 | ---D | C] -- C:\Program Files\WinThruster
[2014/03/05 00:55:01 | 000,000,000 | ---D | C] -- C:\Users\Soraya&Boualem\Desktop\photos samia
[2012/12/09 00:02:36 | 019,532,264 | ---- | C] (Mozilla) -- C:\Users\Soraya&Boualem\Firefox Setup 17.0.1.exe
[2012/06/27 00:13:01 | 002,780,871 | ---- | C] ("PP © ") -- C:\Users\Soraya&Boualem\Coeur.lnk.exe
[2012/02/28 20:23:29 | 065,981,368 | ---- | C] (Online Media Technologies Ltd. ) -- C:\Users\Soraya&Boualem\AVSVideoConverter.exe
[2009/05/11 12:47:19 | 001,535,146 | ---- | C] (Macromedia, Inc.) -- C:\Users\Soraya&Boualem\reproduction.exe
[2009/03/13 13:24:34 | 001,161,576 | ---- | C] (Microsoft Corporation) -- C:\Users\Soraya&Boualem\wlsetup-custom.exe
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]

[2014/04/01 17:25:38 | 000,000,512 | ---- | M] () -- C:\PhysicalMBR.bin
[2014/04/01 17:21:00 | 000,001,056 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2014/04/01 16:57:00 | 000,001,002 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2014/04/01 15:51:47 | 000,717,514 | ---- | M] () -- C:\Windows\System32\perfh00C.dat
[2014/04/01 15:51:47 | 000,630,200 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2014/04/01 15:51:47 | 000,142,756 | ---- | M] () -- C:\Windows\System32\perfc00C.dat
[2014/04/01 15:51:47 | 000,116,964 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2014/04/01 15:45:39 | 000,001,052 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2014/04/01 15:45:35 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2014/04/01 15:45:35 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2014/04/01 15:45:29 | 000,000,288 | ---- | M] () -- C:\Windows\tasks\WinThruster_UPDATES.job
[2014/04/01 15:45:29 | 000,000,280 | ---- | M] () -- C:\Windows\tasks\WinThruster_DEFAULT.job
[2014/04/01 15:45:25 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2014/04/01 15:43:27 | 3220,480,000 | -HS- | M] () -- C:\hiberfil.sys
[2014/04/01 00:27:52 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2014/03/31 22:47:41 | 004,271,347 | ---- | M] () -- C:\Users\Soraya&Boualem\Desktop\feuille d'h mars2014.jpg
[2014/03/26 00:51:49 | 000,027,136 | ---- | M] () -- C:\Users\Soraya&Boualem\exo heures.dot
[2014/03/25 19:46:48 | 000,001,440 | ---- | M] () -- C:\Users\Soraya&Boualem\Desktop\UsbFix.lnk
[2014/03/25 19:38:10 | 000,300,955 | ---- | M] () -- C:\Users\Soraya&Boualem\AppData\Local\census.cache
[2014/03/25 19:37:44 | 000,240,802 | ---- | M] () -- C:\Users\Soraya&Boualem\AppData\Local\ars.cache
[2014/03/21 22:22:34 | 000,000,458 | -H-- | M] () -- C:\Windows\tasks\Norton Security Scan for Soraya&Boualem.job
[2014/03/21 01:41:02 | 000,116,224 | ---- | M] () -- C:\Users\Soraya&Boualem\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2014/03/15 20:56:36 | 000,745,861 | ---- | M] () -- C:\Users\Soraya&Boualem\Desktop\testspsychotechniques.pdf
[2014/03/15 20:52:28 | 000,745,861 | ---- | M] () -- C:\Users\Soraya&Boualem\Desktop\tests_psychotechniques.pdf
[2014/03/14 19:57:29 | 000,692,616 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2014/03/14 19:57:29 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

[color=#E56717]========== Files Created - No Company Name ==========[/color]

[2014/04/01 17:25:38 | 000,000,512 | ---- | C] () -- C:\PhysicalMBR.bin
[2014/03/31 22:47:39 | 004,271,347 | ---- | C] () -- C:\Users\Soraya&Boualem\Desktop\feuille d'h mars2014.jpg
[2014/03/31 21:08:35 | 000,000,288 | ---- | C] () -- C:\Windows\tasks\WinThruster_UPDATES.job
[2014/03/31 21:08:35 | 000,000,280 | ---- | C] () -- C:\Windows\tasks\WinThruster_DEFAULT.job
[2014/03/30 22:32:39 | 3220,480,000 | -HS- | C] () -- C:\hiberfil.sys
[2014/03/26 00:51:48 | 000,027,136 | ---- | C] () -- C:\Users\Soraya&Boualem\exo heures.dot
[2014/03/25 19:44:53 | 000,001,440 | ---- | C] () -- C:\Users\Soraya&Boualem\Desktop\UsbFix.lnk
[2014/03/25 19:38:10 | 000,300,955 | ---- | C] () -- C:\Users\Soraya&Boualem\AppData\Local\census.cache
[2014/03/25 19:37:44 | 000,240,802 | ---- | C] () -- C:\Users\Soraya&Boualem\AppData\Local\ars.cache
[2014/03/24 22:09:57 | 000,001,491 | ---- | C] () -- C:\Users\Soraya&Boualem\Desktop\convertbase
[2014/03/15 20:56:35 | 000,745,861 | ---- | C] () -- C:\Users\Soraya&Boualem\Desktop\testspsychotechniques.pdf
[2014/03/15 20:52:28 | 000,745,861 | ---- | C] () -- C:\Users\Soraya&Boualem\Desktop\tests_psychotechniques.pdf
[2014/02/01 13:37:52 | 004,010,823 | ---- | C] () -- C:\Users\Soraya&Boualem\janvier2014.jpg
[2014/01/08 12:38:01 | 004,163,164 | ---- | C] () -- C:\Users\Soraya&Boualem\feuille d'heures decembre 2013.jpg
[2014/01/07 00:28:28 | 000,000,358 | ---- | C] () -- C:\Users\Soraya&Boualem\Coeur.lnk
[2013/12/26 22:38:51 | 000,176,065 | ---- | C] () -- C:\Users\Soraya&Boualem\LA LANGUEpdf.pdf
[2013/12/22 20:24:52 | 000,000,756 | ---- | C] () -- C:\Users\Soraya&Boualem\L_oeil.lnk
[2013/12/06 13:49:58 | 000,001,058 | ---- | C] () -- C:\Users\Soraya&Boualem\PLANNING CEFIAC NINA.lnk
[2013/09/26 22:36:27 | 001,352,332 | ---- | C] () -- C:\Users\Soraya&Boualem\certif hebergsamia.jpg
[2013/09/09 18:15:31 | 000,052,506 | ---- | C] () -- C:\Users\Soraya&Boualem\ADPI Planning SEPT AS ORAL G6.xltm
[2013/06/09 22:48:50 | 000,028,998 | ---- | C] () -- C:\Users\Soraya&Boualem\Statut de la demande - TLScontact Centre TLScontact - Algérie, France.htm
[2013/03/27 09:01:00 | 000,081,868 | ---- | C] () -- C:\Users\Soraya&Boualem\ordonnance.jpg
[2013/03/19 23:13:16 | 000,000,000 | ---- | C] () -- C:\Users\Soraya&Boualem\AppData\Roaming\wklnhst.dat
[2013/03/07 13:55:40 | 000,278,196 | ---- | C] () -- C:\Users\Soraya&Boualem\photo.jpg
[2013/03/04 17:30:21 | 000,058,220 | ---- | C] () -- C:\Users\Soraya&Boualem\goutte.jpg
[2013/01/21 00:08:31 | 000,194,673 | ---- | C] () -- C:\Users\Soraya&Boualem\math4eme_puissances_corrigecours.pdf
[2012/12/22 05:49:41 | 000,049,877 | ---- | C] () -- C:\Users\Soraya&Boualem\feuilleheures.pdf
[2012/11/18 15:52:49 | 012,905,523 | ---- | C] () -- C:\Users\Soraya&Boualem\captvty-1.9.1.zip
[2012/10/20 16:22:02 | 043,855,812 | ---- | C] () -- C:\Users\Soraya&Boualem\FFSetup296.zip
[2012/10/06 10:29:13 | 007,880,562 | ---- | C] () -- C:\Users\Soraya&Boualem\setup_xrecode2_1.0.0.185_full.zip
[2012/10/02 10:12:12 | 000,039,822 | ---- | C] () -- C:\Users\Soraya&Boualem\trame Planning prévisionnel Soraya.pdf
[2012/10/01 20:21:28 | 000,091,449 | ---- | C] () -- C:\Users\Soraya&Boualem\CopyInvoice_MB_FR_330083923_SONYE_20558777.pdf
[2012/09/27 22:49:49 | 002,714,809 | ---- | C] () -- C:\Users\Soraya&Boualem\Conf_05_Prendre soin des autres en prenant soin de soi.pdf
[2012/09/11 23:06:42 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2012/07/16 10:40:15 | 000,743,810 | ---- | C] () -- C:\Users\Soraya&Boualem\echokarima.jpg
[2012/07/16 10:40:08 | 000,606,200 | ---- | C] () -- C:\Users\Soraya&Boualem\med_2.jpg
[2012/07/16 10:39:43 | 000,487,662 | ---- | C] () -- C:\Users\Soraya&Boualem\med_1karima.jpg
[2012/07/08 00:53:01 | 000,748,347 | ---- | C] () -- C:\Users\Soraya&Boualem\iTUNES STORE - CONDITIONS GENERALES.mht
[2012/07/06 23:54:07 | 013,995,574 | ---- | C] () -- C:\Users\Soraya&Boualem\ipad2_guide_de_lutilisateur.pdf
[2012/07/04 19:46:27 | 000,041,362 | ---- | C] () -- C:\Users\Soraya&Boualem\Attestation secuDroits.pdf
[2012/07/02 14:45:46 | 000,120,575 | ---- | C] () -- C:\Users\Soraya&Boualem\CanoScan Toolbox Ver5.0.1.pdf
[2012/06/27 23:38:03 | 000,001,781 | ---- | C] () -- C:\Users\Soraya&Boualem\Jeux et musique gratuits.lnk
[2012/06/27 23:38:03 | 000,001,163 | ---- | C] () -- C:\Users\Soraya&Boualem\RealPlayer SP.lnk
[2012/06/27 00:17:50 | 002,295,546 | ---- | C] () -- C:\Users\Soraya&Boualem\Pulmo.exe
[2012/06/20 22:11:16 | 009,431,205 | ---- | C] () -- C:\Users\Soraya&Boualem\devpt psychomo.pdf
[2012/06/11 17:10:47 | 000,249,251 | ---- | C] () -- C:\Users\Soraya&Boualem\app digestif2.jpg
[2012/06/11 17:06:07 | 000,267,150 | ---- | C] () -- C:\Users\Soraya&Boualem\app digestif.jpg
[2012/06/01 09:52:35 | 000,222,901 | ---- | C] () -- C:\Users\Soraya&Boualem\feuille d'heures mai12.jpg
[2012/05/26 21:59:13 | 000,846,975 | ---- | C] () -- C:\Users\Soraya&Boualem\dissier ANPEBrouillon_5005077418.pdf
[2012/05/14 18:17:41 | 000,347,997 | ---- | C] () -- C:\Users\Soraya&Boualem\Fiche-CAP-Petite_Enfance.pdf
[2012/05/14 18:17:36 | 000,413,796 | ---- | C] () -- C:\Users\Soraya&Boualem\Fiche-ATSEM.pdf
[2012/04/25 13:31:31 | 059,075,004 | ---- | C] () -- C:\Users\Soraya&Boualem\IL etait une fois a la vie - le coeur.flv
[2012/03/27 23:53:17 | 001,125,165 | ---- | C] () -- C:\Users\Soraya&Boualem\concoursdeboeck.pdf
[2012/03/04 18:02:49 | 000,045,538 | ---- | C] () -- C:\Users\Soraya&Boualem\puissances.pdf
[2012/03/02 00:24:28 | 000,193,668 | ---- | C] () -- C:\Users\Soraya&Boualem\feuilled'heure fevrier2012.jpg
[2012/03/02 00:11:02 | 000,049,409 | ---- | C] () -- C:\Users\Soraya&Boualem\PlanningSORAYAsoisycefiac.pdf
[2012/02/28 20:15:07 | 1292,519,167 | ---- | C] () -- C:\Users\Soraya&Boualem\Un bébé nommé désir - 21-02-2012.m2ts
[2012/02/07 15:39:35 | 000,207,993 | ---- | C] () -- C:\Users\Soraya&Boualem\damart3.jpg
[2012/02/07 15:37:43 | 000,337,461 | ---- | C] () -- C:\Users\Soraya&Boualem\damart2.jpg
[2012/02/07 15:36:31 | 000,278,938 | ---- | C] () -- C:\Users\Soraya&Boualem\damrt1.jpg
[2012/01/17 11:58:48 | 000,142,369 | ---- | C] () -- C:\Users\Soraya&Boualem\afzim.jpg
[2011/09/13 15:23:10 | 000,000,638 | ---- | C] () -- C:\Users\Soraya&Boualem\mes ronds maca.lnk
[2011/09/06 21:13:05 | 000,559,296 | ---- | C] () -- C:\Users\Soraya&Boualem\macarons.pdf
[2011/09/05 15:16:10 | 001,920,940 | ---- | C] () -- C:\Users\Soraya&Boualem\mla3youn.mp3
[2011/09/05 13:59:15 | 000,000,000 | ---- | C] () -- C:\ProgramData\0fef042e58e4ae1110321aa22efff2bb_c
[2011/09/05 01:14:34 | 008,595,616 | ---- | C] () -- C:\Users\Soraya&Boualem\momoh.zip
[2011/06/10 00:45:08 | 000,420,341 | ---- | C] () -- C:\Users\Soraya&Boualem\DSCN2857.JPG
[2011/06/10 00:45:08 | 000,412,197 | ---- | C] () -- C:\Users\Soraya&Boualem\DSCN2856.JPG
[2011/06/10 00:45:08 | 000,402,355 | ---- | C] () -- C:\Users\Soraya&Boualem\DSCN2858.JPG
[2011/06/10 00:45:08 | 000,385,187 | ---- | C] () -- C:\Users\Soraya&Boualem\DSCN2875.JPG
[2011/06/10 00:45:08 | 000,371,318 | ---- | C] () -- C:\Users\Soraya&Boualem\DSCN2837.JPG
[2011/06/10 00:45:08 | 000,363,856 | ---- | C] () -- C:\Users\Soraya&Boualem\DSCN2838.JPG
[2011/06/10 00:45:08 | 000,359,191 | ---- | C] () -- C:\Users\Soraya&Boualem\DSCN2883.JPG
[2011/06/10 00:45:08 | 000,353,978 | ---- | C] () -- C:\Users\Soraya&Boualem\DSCN2836.JPG
[2011/06/10 00:45:08 | 000,352,445 | ---- | C] () -- C:\Users\Soraya&Boualem\DSCN2865.JPG
[2011/05/16 00:01:49 | 000,208,728 | ---- | C] () -- C:\Users\Soraya&Boualem\assuied mediator.jpg
[2011/05/05 21:43:44 | 000,000,730 | ---- | C] () -- C:\Users\Soraya&Boualem\Motamo.lnk
[2011/04/30 13:14:46 | 000,214,959 | ---- | C] () -- C:\Users\Soraya&Boualem\feuille d'heuresAvril 2011.jpg
[2011/03/31 22:44:57 | 000,245,180 | ---- | C] () -- C:\Users\Soraya&Boualem\feuille d'heures mars 2011.jpg
[2011/03/04 19:38:03 | 000,205,174 | ---- | C] () -- C:\Users\Soraya&Boualem\lala et maya.jpg
[2011/03/04 19:38:03 | 000,071,286 | ---- | C] () -- C:\Users\Soraya&Boualem\lala.jpg
[2011/02/20 15:02:52 | 000,020,878 | ---- | C] () -- C:\Users\Soraya&Boualem\Certificat de Scolarité_LIDAE3_2010-2011_BENALLAOUA_ANISS.pdf
[2011/02/03 12:46:38 | 000,034,886 | ---- | C] () -- C:\Users\Soraya&Boualem\Planning prévisionnel prépa concours soraya.pdf
[2010/12/06 22:52:40 | 000,837,885 | ---- | C] () -- C:\Users\Soraya&Boualem\contratCEFIAC3.jpg
[2010/12/06 22:51:27 | 000,963,915 | ---- | C] () -- C:\Users\Soraya&Boualem\contratCEFIAC2.jpg
[2010/12/06 22:49:06 | 000,914,928 | ---- | C] () -- C:\Users\Soraya&Boualem\contratCEFIAC.jpg
[2010/12/06 21:41:41 | 001,250,346 | ---- | C] () -- C:\Users\Soraya&Boualem\heberg suite.jpg
[2010/12/06 21:12:37 | 002,325,534 | ---- | C] () -- C:\Users\Soraya&Boualem\heberg1couleur.jpg
[2010/12/06 21:11:30 | 002,691,749 | ---- | C] () -- C:\Users\Soraya&Boualem\heberg2 couleur.jpg
[2010/12/06 21:08:24 | 001,268,389 | ---- | C] () -- C:\Users\Soraya&Boualem\heberg2.jpg
[2010/12/06 21:05:05 | 003,027,290 | ---- | C] () -- C:\Users\Soraya&Boualem\heberg.jpg
[2010/12/02 23:11:30 | 000,187,239 | ---- | C] () -- C:\Users\Soraya&Boualem\medecin traitant.pdf
[2010/11/30 20:46:26 | 051,475,829 | ---- | C] () -- C:\Users\Soraya&Boualem\aid 2010.zip
[2010/11/20 21:02:42 | 003,346,445 | ---- | C] () -- C:\Users\Soraya&Boualem\oct2010.jpg
[2010/11/13 22:48:27 | 000,001,125 | ---- | C] () -- C:\Users\Soraya&Boualem\RealPlayer.lnk
[2010/11/08 20:55:43 | 005,501,511 | ---- | C] () -- C:\Users\Soraya&Boualem\culturegé2.jpg
[2010/11/08 20:52:30 | 006,639,534 | ---- | C] () -- C:\Users\Soraya&Boualem\prg culturegé.jpg
[2010/10/17 12:05:45 | 000,960,888 | ---- | C] () -- C:\Users\Soraya&Boualem\RAYEH.mp3
[2010/10/07 22:38:39 | 010,503,005 | ---- | C] () -- C:\Users\Soraya&Boualem\resumé nutrition.jpg
[2010/10/07 22:08:21 | 005,276,324 | ---- | C] () -- C:\Users\Soraya&Boualem\nutrition.jpg
[2010/10/07 22:05:16 | 005,892,248 | ---- | C] () -- C:\Users\Soraya&Boualem\nutr non enrgetiques.jpg
[2010/10/07 21:58:32 | 003,264,104 | ---- | C] () -- C:\Users\Soraya&Boualem\tableau nutri non energetiques.jpg
[2010/10/05 18:21:19 | 000,007,116 | ---- | C] () -- C:\Users\Soraya&Boualem\assedic.pdf
[2010/09/16 12:00:51 | 001,332,002 | ---- | C] () -- C:\Users\Soraya&Boualem\belfort 203.JPG
[2010/09/10 15:42:27 | 000,525,406 | ---- | C] () -- C:\Users\Soraya&Boualem\aniss.jpg
[2010/09/03 01:46:15 | 000,001,350 | ---- | C] () -- C:\Users\Soraya&Boualem\Norton Security Scan.lnk
[2010/08/17 15:01:32 | 001,591,469 | ---- | C] () -- C:\Users\Soraya&Boualem\congres fella2.jpg
[2010/08/17 14:59:54 | 001,344,653 | ---- | C] () -- C:\Users\Soraya&Boualem\congres Fella.jpg
[2010/08/17 14:57:39 | 000,264,041 | ---- | C] () -- C:\Users\Soraya&Boualem\cheque Fella.jpg
[2010/06/20 18:11:08 | 001,296,384 | ---- | C] () -- C:\Users\Soraya&Boualem\CONTE-DU-POT-CHINOIS(dum).pps
[2010/06/13 16:04:52 | 000,417,280 | ---- | C] () -- C:\Users\Soraya&Boualem\un_coeur_d-amour_-eb-2.pps
[2010/06/10 14:41:42 | 000,012,845 | ---- | C] () -- C:\Users\Soraya&Boualem\1 2 3.gif
[2010/06/02 23:07:01 | 000,916,353 | ---- | C] () -- C:\Users\Soraya&Boualem\feuille d'heures Mai2010.jpg
[2010/05/27 13:44:40 | 001,338,880 | ---- | C] () -- C:\Users\Soraya&Boualem\VOTEDTHEBESTEMAILOFTHISYEAR.pps
[2010/05/20 22:44:10 | 000,325,120 | ---- | C] () -- C:\Users\Soraya&Boualem\Enfant_avant1980.pps
[2010/05/19 16:17:38 | 014,153,698 | ---- | C] () -- C:\Users\Soraya&Boualem\Alexia.zip
[2010/05/15 19:47:19 | 000,000,000 | ---- | C] () -- C:\ProgramData\LauncherAccess.dt
[2010/05/13 15:10:59 | 000,000,000 | ---- | C] () -- C:\Users\Soraya&Boualem\AppData\Local\prvlcl.dat
[2010/05/06 17:52:26 | 000,001,889 | ---- | C] () -- C:\Users\Soraya&Boualem\Adobe Reader 8.lnk
[2010/04/28 17:22:18 | 000,190,682 | ---- | C] () -- C:\Users\Soraya&Boualem\Photo 146.jpg
[2010/04/28 16:58:58 | 002,786,816 | ---- | C] () -- C:\Users\Soraya&Boualem\invitation_barbecue.pps
[2010/04/09 21:18:53 | 000,000,036 | ---- | C] () -- C:\Users\Soraya&Boualem\AppData\Local\housecall.guid.cache
[2010/04/03 18:48:48 | 000,000,825 | ---- | C] () -- C:\Users\Soraya&Boualem\Lacigaleetlafourmi_10c.lnk
[2010/03/28 21:17:27 | 000,364,077 | ---- | C] () -- C:\Users\Soraya&Boualem\rib boualem.jpg
[2010/03/28 21:13:16 | 000,979,483 | ---- | C] () -- C:\Users\Soraya&Boualem\cefiacmars10.jpg
[2010/03/15 16:30:54 | 000,001,719 | ---- | C] () -- C:\Users\Soraya&Boualem\McAfee Security Scan Plus.lnk
[2010/02/15 20:48:30 | 000,001,936 | ---- | C] () -- C:\Users\Soraya&Boualem\Le Corps humain.lnk
[2009/12/14 21:11:14 | 000,319,251 | ---- | C] () -- C:\Users\Soraya&Boualem\AppData\Local\rehsditf_nav.dat
[2009/12/14 21:11:14 | 000,004,677 | ---- | C] () -- C:\Users\Soraya&Boualem\AppData\Local\rehsditf_navps.dat
[2009/12/14 21:11:14 | 000,003,503 | ---- | C] () -- C:\Users\Soraya&Boualem\AppData\Local\rehsditf.dat
[2009/12/02 19:24:32 | 001,171,968 | ---- | C] () -- C:\Users\Soraya&Boualem\feuille d'heuresNov2009.jpg
[2009/11/30 11:54:06 | 000,375,022 | ---- | C] () -- C:\Users\Soraya&Boualem\Referentiel_CAP_PE.pdf
[2009/11/18 08:46:12 | 000,787,843 | ---- | C] () -- C:\Users\Soraya&Boualem\alimentationpyramidepdf.pdf
[2009/11/15 00:32:21 | 000,035,288 | ---- | C] () -- C:\Users\Soraya&Boualem\Planning prévisionnel Prépa concours.pdf
[2009/11/11 19:04:17 | 001,114,495 | ---- | C] () -- C:\Users\Soraya&Boualem\CIRCULATION SANGUINE NORMALE DANS UNE ARTERE CORONAIRE - Vidéo Vulgaris Médical.flv
[2009/10/28 23:26:31 | 001,554,317 | ---- | C] () -- C:\Users\Soraya&Boualem\Maldedos.pdf
[2009/10/12 10:40:23 | 000,916,956 | ---- | C] () -- C:\Users\Soraya&Boualem\det-7.jpg
[2009/10/11 23:07:27 | 000,623,951 | ---- | C] () -- C:\Users\Soraya&Boualem\fiche_metier_as.pdf
[2009/10/11 23:05:08 | 000,604,072 | ---- | C] () -- C:\Users\Soraya&Boualem\fiche_metier_ap.pdf
[2009/09/29 13:32:38 | 000,105,584 | ---- | C] () -- C:\Users\Soraya&Boualem\3237395.jpg
[2009/09/29 13:15:56 | 000,052,177 | ---- | C] () -- C:\Users\Soraya&Boualem\Hadjeres mohamed.jpg
[2009/09/21 15:16:55 | 001,328,112 | ---- | C] () -- C:\Users\Soraya&Boualem\feuille d'heures 09.09.jpg
[2009/09/13 15:41:30 | 002,170,842 | ---- | C] () -- C:\Users\Soraya&Boualem\plannigCEFIAC.jpg
[2009/06/20 13:05:35 | 000,000,100 | ---- | C] () -- C:\Users\Soraya&Boualem\AppData\Local\ywgkm.bat
[2009/05/31 12:11:18 | 001,058,483 | ---- | C] () -- C:\Users\Soraya&Boualem\cefiac_Mai_09.jpg
[2009/05/31 12:07:28 | 001,150,458 | ---- | C] () -- C:\Users\Soraya&Boualem\cefiac.jpg
[2009/05/29 22:32:30 | 001,686,465 | ---- | C] () -- C:\Users\Soraya&Boualem\Gendarmerie_de_Mosta__l'indpendanc.pdf
[2009/05/28 00:24:15 | 001,136,285 | ---- | C] () -- C:\Users\Soraya&Boualem\sujet capenfance.pdf
[2009/05/11 16:39:24 | 000,005,044 | ---- | C] () -- C:\ProgramData\xqkcebzs.dik
[2009/04/19 18:40:49 | 000,077,708 | ---- | C] () -- C:\Users\Soraya&Boualem\REFERENTIEL_EFP.pdf
[2009/04/19 18:38:54 | 000,080,482 | ---- | C] () -- C:\Users\Soraya&Boualem\REF_ADV.pdf
[2009/04/19 18:36:36 | 000,083,955 | ---- | C] () -- C:\Users\Soraya&Boualem\referentiel GED.pdf
[2009/04/15 00:10:31 | 000,734,856 | ---- | C] () -- C:\Users\Soraya&Boualem\page2.jpg
[2009/04/14 23:51:20 | 000,486,988 | ---- | C] () -- C:\Users\Soraya&Boualem\test ged-efp.jpg
[2009/03/26 18:52:04 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009/03/16 00:32:27 | 002,613,400 | ---- | C] () -- C:\Users\Soraya&Boualem\danseuse.wmv
[2009/02/05 07:56:04 | 000,320,609 | ---- | C] () -- C:\Users\Soraya&Boualem\raluyTPT Sujets001.pdf
[2009/02/04 23:48:30 | 000,316,889 | ---- | C] () -- C:\Users\Soraya&Boualem\SolutionsJeMentraineAuxTestsPsychotechniques001.pdf
[2009/01/28 00:16:33 | 000,930,954 | ---- | C] () -- C:\Users\Soraya&Boualem\Test_de_Logique.pdf
[2009/01/19 23:13:52 | 000,116,224 | ---- | C] () -- C:\Users\Soraya&Boualem\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/01/18 21:55:26 | 000,000,290 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2009/01/14 23:33:33 | 000,001,356 | ---- | C] () -- C:\Users\Soraya&Boualem\AppData\Local\d3d9caps.dat
[1999/10/20 19:16:28 | 000,072,996 | ---- | C] () -- C:\Users\Soraya&Boualem\charte_personne_agee.rtf

[color=#E56717]========== ZeroAccess Check ==========[/color]

[2006/11/02 14:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2011/01/21 17:46:32 | 011,582,464 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/03/03 06:36:24 | 000,615,424 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2008/01/19 09:36:49 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[color=#E56717]========== LOP Check ==========[/color]

[2013/09/13 22:53:41 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Apowersoft
[2014/03/27 20:30:51 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\AVG2014
[2012/03/12 23:57:31 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Babylon
[2009/01/26 01:19:16 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Canon
[2014/03/23 19:49:59 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Delivery
[2012/09/10 00:19:35 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\go
[2014/03/23 19:49:59 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\gtk-2.0
[2014/03/23 19:49:59 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Icones
[2011/11/19 16:23:23 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\LG Electronics
[2009/02/28 00:48:25 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Mostick
[2009/01/20 22:55:31 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\muvee Technologies
[2012/07/30 12:19:52 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\NewSoft
[2013/09/15 22:01:06 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\PerformerSoft
[2009/01/18 21:52:21 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\ScanSoft
[2014/03/24 19:32:03 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\SmartVoip
[2011/09/05 14:10:14 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Software Informer
[2014/03/22 14:37:33 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Solvusoft
[2010/02/07 01:05:31 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Studio-Scrap2
[2013/03/19 23:13:18 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Template
[2014/03/27 20:29:52 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\TuneUp Software
[2009/04/11 18:12:16 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\VoipDiscount
[2009/03/18 16:33:24 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Voipwise
[2009/03/22 01:33:33 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\WildTangent
[2012/03/12 23:27:55 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Xi
[2014/03/23 19:50:03 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\xrecode2
[2014/03/24 23:25:43 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\ZHP
[2010/04/21 17:30:10 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Zylom
[2010/09/02 00:16:42 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\_dlytmp

[color=#E56717]========== Purity Check ==========[/color]



[color=#E56717]========== Custom Scans ==========[/color]

[color=#A23BEC]< %ALLUSERSPROFILE%\Application Data\*. >[/color]

[color=#A23BEC]< %ALLUSERSPROFILE%\Application Data\*.exe /s >[/color]

[color=#A23BEC]< %APPDATA%\*. >[/color]
[2012/10/06 23:21:48 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Adobe
[2013/09/13 22:53:41 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Apowersoft
[2012/07/08 00:54:36 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Apple Computer
[2009/01/22 22:30:19 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\ArcSoft
[2009/01/14 22:44:07 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\ATI
[2014/03/27 20:30:51 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\AVG2014
[2012/05/25 22:58:41 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Avira
[2009/05/11 17:06:36 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\AVS4YOU
[2012/03/12 23:57:31 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Babylon
[2009/01/26 01:19:16 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Canon
[2009/05/11 17:01:47 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\CyberLink
[2014/03/23 19:49:59 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Delivery
[2010/10/12 00:00:12 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\DivX
[2014/03/31 00:49:59 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\dvdcss
[2012/09/10 00:19:35 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\go
[2009/12/13 14:02:04 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Google
[2014/03/23 19:49:59 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\gtk-2.0
[2009/01/14 22:44:32 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Hewlett-Packard
[2014/03/23 19:49:59 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Icones
[2010/04/21 17:30:10 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Identities
[2009/02/28 01:25:06 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\InstallShield
[2011/11/19 16:23:23 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\LG Electronics
[2009/01/14 22:41:48 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Macromedia
[2011/09/30 18:08:39 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Malwarebytes
[2006/11/02 14:37:34 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Media Center Programs
[2013/09/30 17:31:39 | 000,000,000 | --SD | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Microsoft
[2009/02/28 00:48:25 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Mostick
[2012/12/09 00:11:32 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Mozilla
[2009/01/20 22:55:31 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\muvee Technologies
[2012/10/15 22:33:57 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\NCH Software
[2012/07/30 12:19:52 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\NewSoft
[2013/11/01 14:19:20 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Nosibay
[2013/09/15 22:01:06 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\PerformerSoft
[2013/01/06 18:15:51 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Real
[2014/03/31 00:49:25 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\RealNetworks
[2009/01/18 21:52:21 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\ScanSoft
[2014/03/24 19:33:08 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Skype
[2011/05/28 16:00:04 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\skypePM
[2014/03/24 19:32:03 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\SmartVoip
[2011/09/05 14:10:14 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Software Informer
[2014/03/22 14:37:33 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Solvusoft
[2010/02/07 01:05:31 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Studio-Scrap2
[2009/01/14 22:44:03 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Symantec
[2013/03/19 23:13:18 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Template
[2014/03/27 20:29:52 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\TuneUp Software
[2014/03/31 22:44:06 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\vlc
[2009/04/11 18:12:16 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\VoipDiscount
[2009/03/18 16:33:24 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Voipwise
[2009/03/22 01:33:33 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\WildTangent
[2011/04/25 22:27:46 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\WinRAR
[2012/03/12 23:27:55 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Xi
[2014/03/23 19:50:03 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\xrecode2
[2012/04/18 23:15:04 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Yahoo!
[2014/03/24 23:25:43 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\ZHP
[2010/04/21 17:30:10 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\Zylom
[2010/09/02 00:16:42 | 000,000,000 | ---D | M] -- C:\Users\Soraya&Boualem\AppData\Roaming\_dlytmp

[color=#A23BEC]< %APPDATA%\*.exe /s >[/color]
[2010/09/02 00:16:52 | 000,622,728 | ---- | M] (Immanens) -- C:\Users\Soraya&Boualem\AppData\Roaming\_dlytmp\1283379402\_launcher_DeliveryAutoInstall.exe
[2011/08/03 21:04:48 | 001,073,288 | ---- | M] (Immanens) -- C:\Users\Soraya&Boualem\AppData\Roaming\Delivery\DeliveryManager.EXE
[2011/09/06 10:25:16 | 002,371,720 | ---- | M] (Immanens) -- C:\Users\Soraya&Boualem\AppData\Roaming\Delivery\DeliveryReader.exe
[2011/08/03 21:04:59 | 000,286,720 | ---- | M] (Immanens) -- C:\Users\Soraya&Boualem\AppData\Roaming\Delivery\DeliveryRegisterExtension.exe
[2011/08/03 21:04:59 | 000,061,576 | ---- | M] ( ) -- C:\Users\Soraya&Boualem\AppData\Roaming\Delivery\DeliveryStart.exe
[2011/08/03 21:04:21 | 000,368,776 | ---- | M] (Immanens) -- C:\Users\Soraya&Boualem\AppData\Roaming\Delivery\DeliverySwitcher.EXE
[2010/09/02 00:16:58 | 000,104,320 | ---- | M] (Immanens) -- C:\Users\Soraya&Boualem\AppData\Roaming\Delivery\DeliveryWebAccess.exe
[2011/08/03 21:04:48 | 001,073,288 | ---- | M] (Immanens) -- C:\Users\Soraya&Boualem\AppData\Roaming\Delivery\NewDeliveryManager.exe
[2009/03/20 11:24:27 | 000,000,000 | R--- | M] () -- C:\Users\Soraya&Boualem\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
[2010/06/02 15:33:19 | 000,086,576 | ---- | M] (Microsoft Corporation) -- C:\Users\Soraya&Boualem\AppData\Roaming\Microsoft\Services Windows Live\Raccourci Galerie de Photos Windows Live.exe
[2010/06/02 15:33:19 | 000,132,672 | ---- | M] (Microsoft Corporation) -- C:\Users\Soraya&Boualem\AppData\Roaming\Microsoft\Services Windows Live\Raccourci Windows Live Messenger.exe
[2009/06/18 08:21:32 | 001,413,256 | R--- | M] () -- C:\Users\Soraya&Boualem\AppData\Roaming\Microsoft\Windows\Templates\J\USBAutoRun.exe
[2009/08/19 09:24:00 | 009,066,997 | R--- | M] (Macrovision Corporation) -- C:\Users\Soraya&Boualem\AppData\Roaming\Microsoft\Windows\Templates\J\tools\LGInternetKit_V3.2.0.1_Setup.exe
[2009/05/12 08:46:36 | 000,212,992 | R--- | M] () -- C:\Users\Soraya&Boualem\AppData\Roaming\Microsoft\Windows\Templates\J\tools\LGSetCDROMAutoRun.exe
[2008/02/13 08:07:36 | 000,393,216 | ---- | M] () -- C:\Users\Soraya&Boualem\AppData\Roaming\NCH Software\Components\aacenc3\aacenc3.exe
[2011/05/27 21:00:10 | 001,087,488 | ---- | M] () -- C:\Users\Soraya&Boualem\AppData\Roaming\NCH Software\Components\ffmpeg12\x264stub.exe
[2009/12/03 19:17:29 | 000,439,816 | ---- | M] (RealNetworks, Inc.) -- C:\Users\Soraya&Boualem\AppData\Roaming\Real\Update\setup3.09\setup.exe
[2010/03/13 22:10:18 | 000,443,912 | ---- | M] (RealNetworks, Inc.) -- C:\Users\Soraya&Boualem\AppData\Roaming\Real\Update\setup3.10\setup.exe
[2010/04/17 13:04:26 | 000,443,912 | ---- | M] (RealNetworks, Inc.) -- C:\Users\Soraya&Boualem\AppData\Roaming\Real\Update\setup3.11\setup.exe
[2012/12/22 02:27:46 | 000,449,176 | ---- | M] (RealNetworks, Inc.) -- C:\Users\Soraya&Boualem\AppData\Roaming\Real\Update\temp\~Upg0\rnupgagent.exe
[2013/03/19 19:55:28 | 000,448,592 | ---- | M] (RealNetworks, Inc.) -- C:\Users\Soraya&Boualem\AppData\Roaming\Real\Update\temp\~Upg1\rnupgagent.exe
[2013/03/29 20:43:09 | 000,448,592 | ---- | M] (RealNetworks, Inc.) -- C:\Users\Soraya&Boualem\AppData\Roaming\Real\Update\temp\~Upg2\rnupgagent.exe
[2013/06/17 09:59:29 | 000,468,560 | ---- | M] (RealNetworks, Inc.) -- C:\Users\Soraya&Boualem\AppData\Roaming\Real\Update\temp\~Upg3\rnupgagent.exe
[2013/07/01 15:48:16 | 000,468,560 | ---- | M] (RealNetworks, Inc.) -- C:\Users\Soraya&Boualem\AppData\Roaming\Real\Update\temp\~Upg4\rnupgagent.exe
[2013/08/30 10:01:25 | 000,469,072 | ---- | M] (RealNetworks, Inc.) -- C:\Users\Soraya&Boualem\AppData\Roaming\Real\Update\temp\~Upg5\rnupgagent.exe
[2013/06/17 09:59:29 | 000,468,560 | ---- | M] (RealNetworks, Inc.) -- C:\Users\Soraya&Boualem\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.50\agent\rnupgagent.exe
[2013/06/17 13:04:31 | 038,409,632 | ---- | M] (RealNetworks, Inc.) -- C:\Users\Soraya&Boualem\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.50\agent\stub_data\RealPlayer.exe
[2013/06/17 13:00:16 | 000,775,344 | ---- | M] (RealNetworks, Inc.) -- C:\Users\Soraya&Boualem\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.50\agent\stub_exe\RealPlayer.exe
[2013/08/30 10:01:25 | 000,469,072 | ---- | M] (RealNetworks, Inc.) -- C:\Users\Soraya&Boualem\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.60\agent\rnupgagent.exe

[color=#A23BEC]< %temp%\*.exe /s >[/color]
[2014/03/27 19:52:01 | 010,372,136 | ---- | M] () -- C:\Users\SORAYA~1\AppData\Local\Temp\BackupSetup.exe
[2014/03/27 19:52:11 | 004,216,840 | ---- | M] (Microsoft Corporation) -- C:\Users\SORAYA~1\AppData\Local\Temp\vcredist_x86.exe
[44 C:\Users\SORAYA~1\AppData\Local\Temp\*.tmp files -> C:\Users\SORAYA~1\AppData\Local\Temp\*.tmp -> ]
[2012/06/26 22:04:36 | 000,372,736 | ---- | M] (Macrovision Corporation) -- C:\Users\SORAYA~1\AppData\Local\Temp\{3FCC7867-431A-438E-B1B3-EDC1FADD6138}\setup.exe
[2014/03/24 19:06:45 | 002,665,008 | ---- | M] (Doctor Web, Ltd.) -- C:\Users\SORAYA~1\AppData\Local\Temp\44A3A78B-3AE42DA5-BF72A09A-73039AD2\jsarv75f.exe
[2014/03/24 19:06:50 | 006,186,240 | ---- | M] () -- C:\Users\SORAYA~1\AppData\Local\Temp\44A3A78B-3AE42DA5-BF72A09A-73039AD2\rr24vku4.exe
[2014/03/24 19:06:46 | 000,774,448 | ---- | M] (Doctor Web, Ltd.) -- C:\Users\SORAYA~1\AppData\Local\Temp\44A3A78B-3AE42DA5-BF72A09A-73039AD2\ttccwscv.exe
[2014/03/21 16:16:33 | 006,089,216 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Users\SORAYA~1\AppData\Local\Temp\7zS9C7D.tmp\avgmfapx.exe
[2013/08/21 00:03:40 | 000,626,736 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Users\SORAYA~1\AppData\Local\Temp\7zS9C7D.tmp\avgntdumpx.exe
[2013/08/20 23:52:06 | 000,016,944 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Users\SORAYA~1\AppData\Local\Temp\7zS9C7D.tmp\avgrdtesta.exe
[2013/08/21 00:14:34 | 000,015,920 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Users\SORAYA~1\AppData\Local\Temp\7zS9C7D.tmp\avgrdtestx.exe
[2013/08/21 00:14:12 | 000,287,792 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Users\SORAYA~1\AppData\Local\Temp\7zS9C7D.tmp\avgrunasx.exe
[2012/03/08 12:37:28 | 003,884,200 | ---- | M] (Ask) -- C:\Users\SORAYA~1\AppData\Local\Temp\AskToolbarTemp\ApnToolbarInstaller.exe
[2012/10/09 06:55:10 | 001,245,696 | ---- | M] () -- C:\Users\SORAYA~1\AppData\Local\Temp\captvty-1.8.10\Captvty.exe
[2011/11/29 22:50:38 | 000,393,216 | ---- | M] (Radioactive) -- C:\Users\SORAYA~1\AppData\Local\Temp\captvty-1.8.10\tools\asfbin.exe
[2012/03/22 21:38:50 | 000,674,816 | ---- | M] (cURL, http://curl.haxx.se/) -- C:\Users\SORAYA~1\AppData\Local\Temp\captvty-1.8.10\tools\curl.exe
[2011/04/06 22:03:38 | 000,030,208 | ---- | M] () -- C:\Users\SORAYA~1\AppData\Local\Temp\captvty-1.8.10\tools\flvextract.exe
[2012/02/09 11:40:36 | 006,460,430 | ---- | M] () -- C:\Users\SORAYA~1\AppData\Local\Temp\captvty-1.8.10\tools\mkvextract.exe
[2012/02/09 11:40:36 | 008,563,214 | ---- | M] () -- C:\Users\SORAYA~1\AppData\Local\Temp\captvty-1.8.10\tools\mkvmerge.exe
[2011/03/02 20:58:28 | 002,491,392 | ---- | M] () -- C:\Users\SORAYA~1\AppData\Local\Temp\captvty-1.8.10\tools\mp4box.exe
[2011/07/14 11:41:06 | 000,387,833 | ---- | M] () -- C:\Users\SORAYA~1\AppData\Local\Temp\captvty-1.8.10\tools\msdl.exe
[2011/07/27 08:37:56 | 000,395,299 | ---- | M] () -- C:\Users\SORAYA~1\AppData\Local\Temp\captvty-1.8.10\tools\rtmpdump.exe
[2012/12/23 17:07:41 | 001,841,896 | ---- | M] (Babylon Ltd.) -- C:\Users\SORAYA~1\AppData\Local\Temp\DCF34594-BAB0-7891-893A-D138EEBE2B99\Setup.exe
[2013/05/09 12:34:25 | 000,395,848 | ---- | M] (Babylon Ltd.) -- C:\Users\SORAYA~1\AppData\Local\Temp\DCF34594-BAB0-7891-893A-D138EEBE2B99\Latest\GUninstaller.exe
[2013/05/13 11:34:09 | 000,004,096 | ---- | M] () -- C:\Users\SORAYA~1\AppData\Local\Temp\DCF34594-BAB0-7891-893A-D138EEBE2B99\Latest\setup2.exe
[2013/08/28 15:22:53 | 000,340,464 | ---- | M] (Babylon Ltd.) -- C:\Users\SORAYA~1\AppData\Local\Temp\F727876B-BAB0-7891-BC15-19C6A009BFE0\Latest\GUninstaller.exe
[2014/03/25 18:50:57 | 002,423,744 | ---- | M] (Igor Pavlov) -- C:\Users\SORAYA~1\AppData\Local\Temp\HCBackup\hcpackage.exe
[1 C:\Users\SORAYA~1\AppData\Local\Temp\HCBackup\*.tmp files -> C:\Users\SORAYA~1\AppData\Local\Temp\HCBackup\*.tmp -> ]
[2010/09/29 10:51:40 | 000,192,512 | ---- | M] () -- C:\Users\SORAYA~1\AppData\Local\Temp\HouseCall\bspatch.exe
[1 C:\Users\SORAYA~1\AppData\Local\Temp\HouseCall\*.tmp files -> C:\Users\SORAYA~1\AppData\Local\Temp\HouseCall\*.tmp -> ]
[2013/02/16 21:14:54 | 004,940,360 | ---- | M] (Microsoft Corporation) -- C:\Users\SORAYA~1\AppData\Local\Temp\is1668783924\33574680_Setup.EXE
[2010/04/03 07:32:35 | 005,026,152 | ---- | M] (Microsoft Corporation) -- C:\Users\SORAYA~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\dotNetFx40LP_Full_x86fr.exe
[2010/03/18 22:16:28 | 000,078,152 | ---- | M] (Microsoft Corporation) -- C:\Users\SORAYA~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Setup.exe
[2010/03/18 21:58:36 | 000,096,088 | ---- | M] (Microsoft Corporation) -- C:\Users\SORAYA~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SetupUtility.exe
[2012/09/20 23:26:11 | 001,131,012 | ---- | M] (NCH Software) -- C:\Users\SORAYA~1\AppData\Local\Temp\nchuninst\uninst.exe
[2012/10/09 06:55:10 | 001,245,696 | ---- | M] () -- C:\Users\SORAYA~1\AppData\Local\Temp\Temp1_captvty-1.8.10.zip\Captvty.exe
[2012/09/22 17:13:30 | 001,235,968 | ---- | M] () -- C:\Users\SORAYA~1\AppData\Local\Temp\Temp1_captvty-1.8.9.zip\Captvty.exe
[2012/11/17 19:43:06 | 001,260,544 | ---- | M] () -- C:\Users\SORAYA~1\AppData\Local\Temp\Temp1_captvty-1.9.1.zip\Captvty.exe
[2012/10/12 18:13:53 | 007,962,360 | ---- | M] ( ) -- C:\Users\SORAYA~1\AppData\Local\Temp\Temp1_setup_xrecode2_1.0.0.185_full.zip\setup_xrecode2_1.0.0.185_full.exe
[2001/08/08 16:42:38 | 000,040,960 | ---- | M] () -- C:\Users\SORAYA~1\AppData\Local\Temp\vwpt\MtsAxInstaller.exe

[color=#A23BEC]< %SYSTEMDRIVE%\*.exe >[/color]

[color=#A23BEC]< %systemroot%\*. /mp /s >[/color]

[color=#A23BEC]< %systemroot%\system32\consrv.dll >[/color]

[color=#A23BEC]< %systemroot%\system32\*.dll /lockedfiles >[/color]
[1 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]

[color=#A23BEC]< %windir%\Tasks\*.job /lockedfiles >[/color]

[color=#A23BEC]< %systemroot%\system32\drivers\*.sys /lockedfiles >[/color]

[color=#A23BEC]< %systemroot%\System32\config\*.sav >[/color]
[2006/11/02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006/11/02 12:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV

[color=#A23BEC]< MD5 for: EXPLORER.EXE >[/color]
[2009/01/14 23:08:52 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\WINDOWS\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2009/01/14 23:08:51 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\WINDOWS\explorer.exe
[2009/01/14 23:08:51 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\WINDOWS\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2009/01/14 23:08:51 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\WINDOWS\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2009/01/14 23:20:31 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=6D06CD98D954FE87FB2DB8108793B399 -- C:\WINDOWS\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe
[2009/01/14 23:20:31 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=BD06F0BF753BC704B653C3A50F89D362 -- C:\WINDOWS\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe
[2009/04/11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\WINDOWS\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2009/01/14 23:08:52 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\WINDOWS\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2006/11/02 11:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- C:\WINDOWS\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe
[2008/01/19 09:33:10 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\WINDOWS\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe

[color=#A23BEC]< MD5 for: SERVICES.EXE >[/color]
[2008/01/19 09:33:28 | 000,279,040 | ---- | M] (Microsoft Corporation) MD5=2B336AB6286D6C81FA02CBAB914E3C6C -- C:\WINDOWS\System32\services.exe
[2008/01/19 09:33:28 | 000,279,040 | ---- | M] (Microsoft Corporation) MD5=2B336AB6286D6C81FA02CBAB914E3C6C -- C:\WINDOWS\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6001.18000_none_cf5fc067cd49010a\services.exe
[2006/11/02 11:45:40 | 000,279,552 | ---- | M] (Microsoft Corporation) MD5=329CF3C97CE4C19375C8ABCABAE258B0 -- C:\WINDOWS\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6000.16386_none_cd28fe6bd05df036\services.exe
[2009/04/11 08:27:59 | 000,279,552 | ---- | M] (Microsoft Corporation) MD5=D4E6D91C1349B7BFB3599A6ADA56851B -- C:\WINDOWS\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6002.18005_none_d14b3973ca6acc56\services.exe

[color=#A23BEC]< MD5 for: WININIT.EXE >[/color]
[2008/01/19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\WINDOWS\System32\wininit.exe
[2008/01/19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\WINDOWS\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
[2006/11/02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\WINDOWS\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe

[color=#A23BEC]< MD5 for: WINLOGON.EXE >[/color]
[2009/04/11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\WINDOWS\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2006/11/02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\WINDOWS\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2013/04/04 14:50:32 | 000,218,184 | ---- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008/01/19 09:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\WINDOWS\System32\winlogon.exe
[2008/01/19 09:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\WINDOWS\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

[color=#A23BEC]< HKEY_CLASSES_ROOT\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32 /s >[/color]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2008/01/19 09:36:49 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[color=#A23BEC]< HKEY_LOCAL_MACHINE\SYSTEM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters /s >[/color]

[color=#A23BEC]< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems /s >[/color]
"Debug" =
"" = mnmsrvc
"Kmode" = \SystemRoot\System32\win32k.sys
"Optional" = Posix [binary data]
"Posix" = %SystemRoot%\system32\psxss.exe
"Required" = DebugWindows [binary data]
"Windows" = %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\CSRSS]
"CsrSrvSharedSectionBase" = 2137980928

[color=#A23BEC]< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls /s >[/color]

[color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList /s >[/color]
"ProfilesDirectory" = %SystemDrive%\Users -- [2014/03/24 23:23:56 | 000,000,000 | ---D | M]
"Default" = %SystemDrive%\Users\Default -- [2009/02/28 21:46:00 | 000,000,000 | RH-D | M]
"Public" = %SystemDrive%\Users\Public -- [2014/03/23 19:49:32 | 000,000,000 | R--D | M]
"ProgramData" = %SystemDrive%\ProgramData -- [2014/03/27 20:27:32 | 000,000,000 | -H-D | M]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18]
"Flags" = 12
"State" = 0
"RefCount" = 1
"Sid" = 01 01 00 00 00 00 00 05 12 00 00 00 [binary data]
"ProfileImagePath" = %systemroot%\system32\config\systemprofile -- [2014/03/31 00:51:09 | 000,000,000 | ---D | M]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-19]
"ProfileImagePath" = %SystemRoot%\ServiceProfiles\LocalService -- [2014/03/31 00:51:10 | 000,000,000 | ---D | M]
"Flags" = 0
"State" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20]
"ProfileImagePath" = %SystemRoot%\ServiceProfiles\NetworkService -- [2014/03/31 00:51:11 | 000,000,000 | ---D | M]
"Flags" = 0
"State" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1842019664-894896754-1257712989-1000]
"ProfileImagePath" = C:\Users\Soraya&Boualem -- [2014/03/31 00:51:19 | 000,000,000 | ---D | M]
"Flags" = 0
"State" = 0
"Sid" = 01 05 00 00 00 00 00 05 15 00 00 00 50 FD CA 6D 72 0A 57 35 5D 2D F7 4A E8 03 00 00 [binary data]
"ProfileLoadTimeLow" = 0
"ProfileLoadTimeHigh" = 0
"RefCount" = 2
"RunLogonScriptSync" = 0

[color=#A23BEC]< HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor /s >[/color]
"CompletionChar" = 64
"DefaultColor" = 0
"EnableExtensions" = 1
"PathCompletionChar" = 64

[color=#A23BEC]< HKEY_CURRENT_USER\Software\Microsoft\Command Processor /s >[/color]
"CompletionChar" = 9
"DefaultColor" = 0
"EnableExtensions" = 1
"PathCompletionChar" = 9

[color=#A23BEC]< nslookup http://www.google.fr /c >[/color]
Serveur : UnKnown
Address: 192.168.1.1

[color=#A23BEC]< hklm\software\clients\startmenuinternet|command /rs >[/color]
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Beamrise.H3JSNZ7EICKBKDFR6UQN4R3DVU\InstallInfo\\ReinstallCommand: "C:\Users\Soraya&Boualem\AppData\Local\Beamrise\Application\beamrise.exe" --make-default-browser
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Beamrise.H3JSNZ7EICKBKDFR6UQN4R3DVU\InstallInfo\\HideIconsCommand: "C:\Users\Soraya&Boualem\AppData\Local\Beamrise\Application\beamrise.exe" --hide-icons
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Beamrise.H3JSNZ7EICKBKDFR6UQN4R3DVU\InstallInfo\\ShowIconsCommand: "C:\Users\Soraya&Boualem\AppData\Local\Beamrise\Application\beamrise.exe" --show-icons
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Beamrise.H3JSNZ7EICKBKDFR6UQN4R3DVU\shell\open\command\\: "C:\Users\Soraya&Boualem\AppData\Local\Beamrise\Application\beamrise.exe"
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\HideIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /HideShortcuts [2013/10/01 16:38:02 | 000,873,736 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ShowIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /ShowShortcuts [2013/10/01 16:38:02 | 000,873,736 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ReinstallCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal [2013/10/01 16:38:02 | 000,873,736 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\open\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" [2013/10/01 16:38:04 | 000,274,840 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\properties\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -preferences [2013/10/01 16:38:04 | 000,274,840 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\safemode\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode [2013/10/01 16:38:04 | 000,274,840 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\\ShowIconsCommand: "C:\Program Files\Google\Chrome\Application\chrome.exe" --show-icons [2014/03/15 02:50:42 | 000,859,976 | ---- | M] (Google Inc.)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\\HideIconsCommand: "C:\Program Files\Google\Chrome\Application\chrome.exe" --hide-icons [2014/03/15 02:50:42 | 000,859,976 | ---- | M] (Google Inc.)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\\ReinstallCommand: "C:\Program Files\Google\Chrome\Application\chrome.exe" --make-default-browser [2014/03/15 02:50:42 | 000,859,976 | ---- | M] (Google Inc.)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\shell\open\command\\: "C:\Program Files\Google\Chrome\Application\chrome.exe" [2014/03/15 02:50:42 | 000,859,976 | ---- | M] (Google Inc.)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\Windows\system32\ie4uinit.exe" -hide [2008/01/19 09:33:12 | 000,070,656 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\Windows\system32\ie4uinit.exe" -show [2008/01/19 09:33:12 | 000,070,656 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\Windows\system32\ie4uinit.exe" -reinstall [2008/01/19 09:33:12 | 000,070,656 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: C:\Program Files\Internet Explorer\iexplore.exe [2011/04/21 17:02:30 | 000,634,648 | ---- | M] (Microsoft Corporation)

[color=#A23BEC]< hklm\software\clients\startmenuinternet|command /64 /rs >[/color]
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Beamrise.H3JSNZ7EICKBKDFR6UQN4R3DVU\InstallInfo\\ReinstallCommand: "C:\Users\Soraya&Boualem\AppData\Local\Beamrise\Application\beamrise.exe" --make-default-browser
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Beamrise.H3JSNZ7EICKBKDFR6UQN4R3DVU\InstallInfo\\HideIconsCommand: "C:\Users\Soraya&Boualem\AppData\Local\Beamrise\Application\beamrise.exe" --hide-icons
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Beamrise.H3JSNZ7EICKBKDFR6UQN4R3DVU\InstallInfo\\ShowIconsCommand: "C:\Users\Soraya&Boualem\AppData\Local\Beamrise\Application\beamrise.exe" --show-icons
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Beamrise.H3JSNZ7EICKBKDFR6UQN4R3DVU\shell\open\command\\: "C:\Users\Soraya&Boualem\AppData\Local\Beamrise\Application\beamrise.exe"
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\HideIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /HideShortcuts [2013/10/01 16:38:02 | 000,873,736 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ShowIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /ShowShortcuts [2013/10/01 16:38:02 | 000,873,736 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ReinstallCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal [2013/10/01 16:38:02 | 000,873,736 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\open\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" [2013/10/01 16:38:04 | 000,274,840 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\properties\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -preferences [2013/10/01 16:38:04 | 000,274,840 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\safemode\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode [2013/10/01 16:38:04 | 000,274,840 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\\ShowIconsCommand: "C:\Program Files\Google\Chrome\Application\chrome.exe" --show-icons [2014/03/15 02:50:42 | 000,859,976 | ---- | M] (Google Inc.)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\\HideIconsCommand: "C:\Program Files\Google\Chrome\Application\chrome.exe" --hide-icons [2014/03/15 02:50:42 | 000,859,976 | ---- | M] (Google Inc.)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\\ReinstallCommand: "C:\Program Files\Google\Chrome\Application\chrome.exe" --make-default-browser [2014/03/15 02:50:42 | 000,859,976 | ---- | M] (Google Inc.)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\shell\open\command\\: "C:\Program Files\Google\Chrome\Application\chrome.exe" [2014/03/15 02:50:42 | 000,859,976 | ---- | M] (Google Inc.)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\Windows\system32\ie4uinit.exe" -hide [2008/01/19 09:33:12 | 000,070,656 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\Windows\system32\ie4uinit.exe" -show [2008/01/19 09:33:12 | 000,070,656 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\Windows\system32\ie4uinit.exe" -reinstall [2008/01/19 09:33:12 | 000,070,656 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: C:\Program Files\Internet Explorer\iexplore.exe [2011/04/21 17:02:30 | 000,634,648 | ---- | M] (Microsoft Corporation)

[color=#E56717]========== Files - Unicode (All) ==========[/color]
[2013/06/17 13:59:34 | 000,000,000 | ---D | M](C:\ProgramData\?K?K?????????????????????????) -- C:\ProgramData\EèPCèam Files\McAfee Security Scan\3.0.318\ftconfig.ini
[2013/06/17 13:59:34 | 000,000,000 | ---D | M](C:\ProgramData\?K?K?????????????????????????) -- C:\ProgramData\EèPCèam Files\McAfee Security Scan\3.0.318\ftconfig.ini
(C:\ProgramData\?K?K?????????????????????????) -- C:\ProgramData\EèPCèam Files\McAfee Security Scan\3.0.318\ftconfig.ini

[color=#E56717]========== Alternate Data Streams ==========[/color]

@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:8AD1F2E0
@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:D1B5B4F1

< End of report >

Publicité


Signaler le contenu de ce document

Publicité