Auteur Sujet: Ordinateur lent [Résolu] (Lu 32081 fois)

biccipeinture · « **le:** juin 09, 2016, 08:50:48 »

Bonjour. Mon ordinateur est long à ouvrir les pages internet ainsi que la boite mail orange.
Il s'allume très bien mais très long pour l'ouverture des pages.

Help !!! Merci

chantal11 · « **Réponse #1 le:** juin 09, 2016, 08:56:33 »

Bonjour,

Nous allons vérifier côté infections en établissant un rapport de diagnostic avec cet outil :

---------------------------------------------------------------------------------------------

FRST :

Télécharge la version FRST de Farbar, compatible avec ton système et enregistre le fichier sur ton Bureau <-- Important

Pour un système en 32 bits -> FRST
Pour un système en 64 bits -> FRST64
Comment savoir quelle version 32 bits ou 64 bits est exécutée sur mon système ?

Patiente le temps que ton navigateur te propose le téléchargement à enregistrer, sans cliquer nulle part, surtout pas sur les sponsors de la page.
Rappel : FRST doit être enregistré sur ton Bureau <-- Important
Ferme toutes les applications, y compris ton navigateur
Double-clique sur FRST.exe et clique sur Oui pour accepter le Disclaimer
/!\ Sous Vista, Windows 7 et 8, il faut lancer le fichier par clic-droit -> Exécuter en tant qu'administrateur
Sur le menu principal, clique sur Analyser et patiente le temps de l'analyse
Accepte le redémarrage du système si demandé
A la fin du scan, les rapports FRST.txt et Addition.txt sont créés. Poste ces rapports dans ta prochaine réponse.
Les rapports sont enregistrés au même emplacement que l'outil et sous C:\FRST\Logs

Sous Internet Explorer et Edge, le filtre SmartScreen peut déclencher une alerte. Cliquer sur Actions ou Informations complémentaires puis sur Exécuter quand même

---------------------------------------------------------------------------------------------

Sont attendus les rapports FRST.txt et Addition.txt

Tous les rapports doivent être hébergés sur ce site d'hébergement de fichiers et tu indiques les liens obtenus dans ta réponse -> Aide à l'utilisation

@+

biccipeinture · « **Réponse #2 le:** juillet 21, 2016, 11:27:22 »

Bonjour Chantal11

Voici les résultats du scan

Merci pour ton aide

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:06-08-2015
Ran by Bicci (administrator) on ACER (21-07-2016 11:18:44)
Running from C:\Users\Bicci\Desktop
Loaded Profiles: Bicci (Available Profiles: Bicci)
Platform: Windows 10 Home (X64) Language: Français (France)
Internet Explorer Version 11 (Default browser path: "C:\WINDOWS\system32\LaunchWinApp.exe" "%1")
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Remote Monitoring) C:\Program Files (x86)\Advanced Monitoring Agent\winagent.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Cloud Engines) C:\Program Files (x86)\B.cloud\dokanmnt.exe
(GFI Software Development Ltd.) C:\Program Files (x86)\Advanced Monitoring Agent\patchman\lnssatt.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\sihost.exe
(Microsoft Corporation) C:\Windows\System32\taskhostw.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_w32.exe
() C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_x64.exe
(Microsoft Corporation) C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe
(Cloud Engines, Inc.) C:\Program Files (x86)\B.cloud\ppbrowser.exe
(Microsoft Corporation) C:\Users\Bicci\AppData\Local\Microsoft\OneDrive\OneDrive.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Microsoft Corporation) C:\Windows\System32\fontdrvhost.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Microsoft Corporation) C:\Windows\System32\ApplicationFrameHost.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\PmmUpdate.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\EgisUpdate.exe
() C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.526.11220.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe
(Microsoft Corporation) C:\Windows\System32\SystemSettingsBroker.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12921488 2012-07-02] (Realtek Semiconductor)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-08-21] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [7139256 2016-03-24] (AVAST Software)
HKU\S-1-5-19\...\Run: [OneDriveSetup] => C:\Windows\SysWOW64\OneDriveSetup.exe [7805120 2015-10-30] (Microsoft Corporation)
HKU\S-1-5-20\...\Run: [OneDriveSetup] => C:\Windows\SysWOW64\OneDriveSetup.exe [7805120 2015-10-30] (Microsoft Corporation)
HKU\S-1-5-21-1759795422-2075537827-4017263716-1001\...\Run: [Pogoplug Backup] => C:\Program Files (x86)\B.cloud\ppbrowser.exe [13007360 2014-11-13] (Cloud Engines, Inc.)
HKU\S-1-5-21-1759795422-2075537827-4017263716-1001\...\Run: [OneDrive] => C:\Users\Bicci\AppData\Local\Microsoft\OneDrive\OneDrive.exe [554184 2016-05-31] (Microsoft Corporation)
Startup: C:\Users\Bicci\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk [2013-06-24]
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Bicci\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64\FileSyncShell64.dll [2016-05-31] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Users\Bicci\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64\FileSyncShell64.dll [2016-05-31] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Users\Bicci\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64\FileSyncShell64.dll [2016-05-31] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Bicci\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64\FileSyncShell64.dll [2016-05-31] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Bicci\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64\FileSyncShell64.dll [2016-05-31] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Bicci\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64\FileSyncShell64.dll [2016-05-31] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Bicci\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64\FileSyncShell64.dll [2016-05-31] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Bicci\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64\FileSyncShell64.dll [2016-05-31] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2016-02-15] (AVAST Software)
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Bicci\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\FileSyncShell.dll [2016-05-31] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Users\Bicci\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\FileSyncShell.dll [2016-05-31] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Users\Bicci\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\FileSyncShell.dll [2016-05-31] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Bicci\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\FileSyncShell.dll [2016-05-31] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Bicci\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\FileSyncShell.dll [2016-05-31] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Bicci\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\FileSyncShell.dll [2016-05-31] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Bicci\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\FileSyncShell.dll [2016-05-31] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Bicci\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\FileSyncShell.dll [2016-05-31] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm
HKU\S-1-5-21-1759795422-2075537827-4017263716-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
SearchScopes: HKLM-x32 -> DefaultScope value is missing
SearchScopes: HKU\S-1-5-21-1759795422-2075537827-4017263716-1001 -> {31090377-0740-419E-BEFC-A56E50500D5B} URL =
SearchScopes: HKU\S-1-5-21-1759795422-2075537827-4017263716-1001 -> {6D23FB4D-FB77-E788-1DB8-4B44FEF34EE5} URL =
SearchScopes: HKU\S-1-5-21-1759795422-2075537827-4017263716-1001 -> {BB37CFB2-A0AA-458E-A9A2-1842FEA89F0A} URL =
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2016-02-15] (AVAST Software)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-02-15] (AVAST Software)
Handler: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\System32\tbauth.dll [2016-05-31] (Microsoft Corporation)
Handler-x32: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll [2016-05-31] (Microsoft Corporation)
Hosts: 127.0.0.1 localhost
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{a5101a4b-cd83-4739-ad8c-eb655c9c9620}: [DhcpNameServer] 192.168.1.254

FireFox:
========
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-09-12] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-06-30] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1759795422-2075537827-4017263716-1001: @squareclock.com/SQ3DPlayer_Production_HBMV1 -> C:\Users\Bicci\AppData\Local\SquareClock.Production_HBMV1\NPSQ3D.dll [2016-02-23] (SquareClock SAS)
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-03-03]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF HKLM-x32\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF Extension: Avast SafePrice - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2015-11-29]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK

Chrome:
=======
CHR Profile: C:\Users\Bicci\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\Bicci\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-06-26]
CHR Extension: (YouTube) - C:\Users\Bicci\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-06-26]
CHR Extension: (Google Search) - C:\Users\Bicci\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-06-26]
CHR Extension: (Azov Sea Theme) - C:\Users\Bicci\AppData\Local\Google\Chrome\User Data\Default\Extensions\edlbggommlbjkfcfpclbcffgfkmkmega [2015-01-14]
CHR Extension: (Google Docs Offline) - C:\Users\Bicci\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-04]
CHR Extension: (Avast Online Security) - C:\Users\Bicci\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-11-30]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Bicci\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-08]
CHR Extension: (Gmail) - C:\Users\Bicci\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-06-26]
CHR HKU\S-1-5-21-1759795422-2075537827-4017263716-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [bakijjialdiiboeaknfpmflphhmljfkd] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2016-02-15]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Advanced Monitoring Agent; C:\Program Files (x86)\Advanced Monitoring Agent\winagent.exe [8490496 2015-08-03] (Remote Monitoring) [File not signed]
S3 AJRouter; C:\Windows\System32\AJRouter.dll [23040 2015-10-30] (Microsoft Corporation)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2015-08-21] (Advanced Micro Devices, Inc.) [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [237096 2016-02-15] (AVAST Software)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [326144 2015-10-30] (Microsoft Corporation)
R2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [2449552 2012-10-09] (Acer Incorporated)
S4 CDPSvc; C:\Windows\System32\CDPSvc.dll [287744 2015-10-30] (Microsoft Corporation)
S3 ClipSVC; C:\Windows\System32\ClipSVC.dll [625000 2016-05-31] (Microsoft Corporation)
R2 CoreMessagingRegistrar; C:\Windows\system32\coremessaging.dll [754664 2016-05-31] (Microsoft Corporation)
R2 CoreMessagingRegistrar; C:\Windows\SysWOW64\coremessaging.dll [461824 2016-05-31] (Microsoft Corporation)
S3 DcpSvc; C:\Windows\system32\dcpsvc.dll [186880 2015-10-30] (Microsoft Corporation)
S3 DevQueryBroker; C:\Windows\system32\DevQueryBroker.dll [34304 2015-10-30] (Microsoft Corporation)
S3 diagnosticshub.standardcollector.service; C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe [31744 2015-10-30] (Microsoft Corporation)
S3 DmEnrollmentSvc; C:\Windows\system32\Windows.Internal.Management.dll [278016 2016-05-28] (Microsoft Corporation)
S3 DmEnrollmentSvc; C:\Windows\SysWOW64\Windows.Internal.Management.dll [200192 2016-05-28] (Microsoft Corporation)
S3 dmwappushservice; C:\Windows\system32\dmwappushsvc.dll [57856 2015-10-30] (Microsoft Corporation)
R2 DokanCEMounter; C:\Program Files (x86)\B.cloud\dokanmnt.exe [115936 2014-11-13] (Cloud Engines)
R2 DoSvc; C:\Windows\system32\svchost.exe [43944 2015-10-30] (Microsoft Corporation)
R2 DoSvc; C:\Windows\SysWOW64\svchost.exe [37256 2015-10-30] (Microsoft Corporation)
S3 DsSvc; C:\Windows\System32\DsSvc.dll [145408 2016-05-31] (Microsoft Corporation)
S3 embeddedmode; C:\Windows\System32\embeddedmodesvc.dll [111616 2015-10-30] (Microsoft Corporation)
S3 EntAppSvc; C:\Windows\system32\EnterpriseAppMgmtSvc.dll [313856 2015-10-30] (Microsoft Corporation)
R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [658576 2012-08-23] (Acer Incorporated)
S2 Garmin Device Interaction Service; C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe [708616 2015-04-08] (Garmin Ltd. or its subsidiaries)
R2 gfi_lanss11_attservice; C:\Program Files (x86)\Advanced Monitoring Agent\patchman\lnssatt.exe [118640 2012-07-17] (GFI Software Development Ltd.)
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [28552 2016-04-26] (Hewlett-Packard Company)
R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe [2451456 2012-07-13] (Realsil Microelectronics Inc.) [File not signed]
S3 icssvc; C:\Windows\System32\tetheringservice.dll [163328 2016-05-28] (Microsoft Corporation)
R3 lfsvc; C:\Windows\System32\lfsvc.dll [27136 2015-10-30] (Microsoft Corporation)
R3 lfsvc; C:\Windows\SysWOW64\lfsvc.dll [22528 2015-10-30] (Microsoft Corporation)
R3 LicenseManager; C:\Windows\system32\LicenseManagerSvc.dll [22528 2015-10-30] (Microsoft Corporation)
S2 MapsBroker; C:\Windows\System32\moshost.dll [72704 2016-05-28] (Microsoft Corporation)
S3 MessagingService; C:\Windows\System32\MessagingService.dll [52736 2015-10-30] (Microsoft Corporation)
U3 MessagingService_29d04a; C:\WINDOWS\system32\svchost.exe [43944 2015-10-30] (Microsoft Corporation)
U3 MessagingService_29d04a; C:\WINDOWS\SysWOW64\svchost.exe [37256 2015-10-30] (Microsoft Corporation)
S3 MessagingService_540b8; C:\WINDOWS\system32\svchost.exe [43944 2015-10-30] (Microsoft Corporation)
S3 MessagingService_540b8; C:\WINDOWS\SysWOW64\svchost.exe [37256 2015-10-30] (Microsoft Corporation)
S3 NetSetupSvc; C:\Windows\System32\NetSetupSvc.dll [207360 2016-05-28] (Microsoft Corporation)
S3 NgcCtnrSvc; C:\Windows\System32\NgcCtnrSvc.dll [289792 2016-05-31] (Microsoft Corporation)
S3 NgcSvc; C:\Windows\system32\ngcsvc.dll [649216 2016-05-31] (Microsoft Corporation)
S2 OneSyncSvc; C:\Windows\System32\APHostService.dll [342016 2015-10-30] (Microsoft Corporation)
U2 OneSyncSvc_29d04a; C:\WINDOWS\system32\svchost.exe [43944 2015-10-30] (Microsoft Corporation)
U2 OneSyncSvc_29d04a; C:\WINDOWS\SysWOW64\svchost.exe [37256 2015-10-30] (Microsoft Corporation)
U2 OneSyncSvc_4633e; C:\Windows\system32\svchost.exe [43944 2015-10-30] (Microsoft Corporation)
U2 OneSyncSvc_4633e; C:\Windows\SysWOW64\svchost.exe [37256 2015-10-30] (Microsoft Corporation)
R2 OneSyncSvc_540b8; C:\WINDOWS\system32\svchost.exe [43944 2015-10-30] (Microsoft Corporation)
R2 OneSyncSvc_540b8; C:\WINDOWS\SysWOW64\svchost.exe [37256 2015-10-30] (Microsoft Corporation)
S3 PhoneSvc; C:\Windows\System32\PhoneService.dll [749056 2016-02-13] (Microsoft Corporation)
S3 PimIndexMaintenanceSvc; C:\Windows\System32\PimIndexMaintenance.dll [252928 2016-05-31] (Microsoft Corporation)
U3 PimIndexMaintenanceSvc_29d04a; C:\WINDOWS\system32\svchost.exe [43944 2015-10-30] (Microsoft Corporation)
U3 PimIndexMaintenanceSvc_29d04a; C:\WINDOWS\SysWOW64\svchost.exe [37256 2015-10-30] (Microsoft Corporation)
S3 PimIndexMaintenanceSvc_540b8; C:\WINDOWS\system32\svchost.exe [43944 2015-10-30] (Microsoft Corporation)
S3 PimIndexMaintenanceSvc_540b8; C:\WINDOWS\SysWOW64\svchost.exe [37256 2015-10-30] (Microsoft Corporation)
S3 RetailDemo; C:\Windows\system32\RDXService.dll [1073152 2016-05-28] (Microsoft Corporation)
S3 SensorDataService; C:\Windows\System32\SensorDataService.exe [1297408 2015-10-30] (Microsoft Corporation)
S3 SensorService; C:\Windows\system32\SensorService.dll [339968 2016-05-31] (Microsoft Corporation)
S3 SmsRouter; C:\Windows\system32\SmsRouterSvc.dll [591872 2016-05-31] (Microsoft Corporation)
R3 StateRepository; C:\Windows\system32\windows.staterepository.dll [2745856 2015-10-30] (Microsoft Corporation)
R3 StateRepository; C:\Windows\SysWOW64\windows.staterepository.dll [2179584 2015-10-30] (Microsoft Corporation)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5490448 2015-06-18] (TeamViewer GmbH)
S3 TieringEngineService; C:\Windows\system32\TieringEngineService.exe [290304 2015-10-30] (Microsoft Corporation)
R2 tiledatamodelsvc; C:\Windows\system32\tileobjserver.dll [503808 2016-05-28] (Microsoft Corporation)
S4 tzautoupdate; C:\Windows\system32\tzautoupdate.dll [87040 2016-05-31] (Microsoft Corporation)
S3 UnistoreSvc; C:\Windows\System32\unistore.dll [1224704 2016-05-31] (Microsoft Corporation)
S3 UnistoreSvc; C:\Windows\SysWOW64\unistore.dll [949248 2016-05-31] (Microsoft Corporation)
U3 UnistoreSvc_29d04a; C:\WINDOWS\System32\svchost.exe [43944 2015-10-30] (Microsoft Corporation)
U3 UnistoreSvc_29d04a; C:\WINDOWS\SysWOW64\svchost.exe [37256 2015-10-30] (Microsoft Corporation)
S3 UnistoreSvc_540b8; C:\WINDOWS\System32\svchost.exe [43944 2015-10-30] (Microsoft Corporation)
S3 UnistoreSvc_540b8; C:\WINDOWS\SysWOW64\svchost.exe [37256 2015-10-30] (Microsoft Corporation)
S3 UserDataSvc; C:\Windows\System32\userdataservice.dll [1490432 2016-05-31] (Microsoft Corporation)
U3 UserDataSvc_29d04a; C:\WINDOWS\system32\svchost.exe [43944 2015-10-30] (Microsoft Corporation)
U3 UserDataSvc_29d04a; C:\WINDOWS\SysWOW64\svchost.exe [37256 2015-10-30] (Microsoft Corporation)
S3 UserDataSvc_540b8; C:\WINDOWS\system32\svchost.exe [43944 2015-10-30] (Microsoft Corporation)
S3 UserDataSvc_540b8; C:\WINDOWS\SysWOW64\svchost.exe [37256 2015-10-30] (Microsoft Corporation)
R2 UserManager; C:\Windows\System32\usermgr.dll [912384 2016-02-13] (Microsoft Corporation)
R3 UsoSvc; C:\Windows\system32\usocore.dll [368640 2016-05-28] (Microsoft Corporation)
S3 vmicvmsession; C:\Windows\System32\ICSvc.dll [511488 2015-10-30] (Microsoft Corporation)
S3 WalletService; C:\Windows\system32\WalletService.dll [497664 2015-10-30] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364464 2015-10-30] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-10-30] (Microsoft Corporation)
S3 WpnService; C:\Windows\system32\WpnService.dll [49152 2015-10-30] (Microsoft Corporation)
S3 XblAuthManager; C:\Windows\System32\XblAuthManager.dll [948736 2016-05-31] (Microsoft Corporation)
S3 XblGameSave; C:\Windows\System32\XblGameSave.dll [1139712 2016-05-31] (Microsoft Corporation)
S3 XboxNetApiSvc; C:\Windows\system32\XboxNetApiSvc.dll [1035776 2016-02-13] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [37656 2016-02-15] (AVAST Software)
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [37144 2016-03-23] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [107792 2016-03-11] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [103064 2016-02-15] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [74544 2016-02-15] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1070904 2016-03-11] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [463744 2016-02-24] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [165344 2016-02-15] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [287016 2016-02-15] (AVAST Software)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWT6.sys [102912 2015-05-28] (Advanced Micro Devices)
S3 bcmfn; C:\Windows\System32\drivers\bcmfn.sys [9728 2015-10-30] (Windows (R) Win 7 DDK provider)
S3 buttonconverter; C:\Windows\System32\drivers\buttonconverter.sys [37376 2015-10-30] (Microsoft Corporation)
S3 CapImg; C:\Windows\System32\drivers\capimg.sys [117248 2016-02-13] (Microsoft Corporation)
S4 cnghwassist; C:\Windows\System32\DRIVERS\cnghwassist.sys [39264 2015-10-30] (Microsoft Corporation)
R3 CompositeBus; C:\Windows\System32\DriverStore\FileRepository\compositebus.inf_amd64_912dfdedc3d2f520\CompositeBus.sys [40448 2015-10-30] (Microsoft Corporation)
S3 dg_ssudbus; C:\Windows\system32\DRIVERS\ssudbus.sys [129152 2016-04-25] (Samsung Electronics Co., Ltd.)
R2 DokanCEDriver; C:\Program Files (x86)\B.cloud\xcefs.sys [72968 2014-11-13] (Cloud Engines)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3436896 2015-10-30] (QLogic Corporation)
R1 FileCrypt; C:\Windows\System32\drivers\filecrypt.sys [87552 2016-05-31] (Microsoft Corporation)
S3 genericusbfn; C:\Windows\System32\drivers\genericusbfn.sys [20992 2015-10-30] (Microsoft Corporation)
R1 GpuEnergyDrv; C:\Windows\System32\drivers\gpuenergydrv.sys [8192 2015-10-30] (Microsoft Corporation)
S3 hidinterrupt; C:\Windows\System32\drivers\hidinterrupt.sys [50016 2015-10-30] (Microsoft Corporation)
S3 iai2c; C:\Windows\System32\drivers\iai2c.sys [81408 2015-10-30] (Intel(R) Corporation)
S3 iaLPSS2i_I2C; C:\Windows\System32\drivers\iaLPSS2i_I2C.sys [165888 2015-10-30] (Intel Corporation)
S3 ibbus; C:\Windows\System32\drivers\ibbus.sys [424800 2015-10-30] (Mellanox)
S3 IoQos; C:\Windows\System32\drivers\ioqos.sys [26624 2015-10-30] (Microsoft Corporation)
S0 LSI_SAS2i; C:\Windows\System32\drivers\lsi_sas2i.sys [104800 2015-10-30] (LSI Corporation)
S0 LSI_SAS3i; C:\Windows\System32\drivers\lsi_sas3i.sys [99168 2015-10-30] (Avago Technologies)
S3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [192216 2016-05-27] (Malwarebytes)
S0 megasas; C:\Windows\System32\drivers\megasas.sys [59744 2015-10-30] (Avago Technologies)
S3 mlx4_bus; C:\Windows\System32\drivers\mlx4_bus.sys [705376 2015-10-30] (Mellanox)
R2 MMCSS; C:\Windows\system32\drivers\mmcss.sys [47616 2015-10-30] (Microsoft Corporation)
S3 ndfltr; C:\Windows\System32\drivers\ndfltr.sys [76128 2015-10-30] (Mellanox)
S3 netvsc; C:\Windows\System32\drivers\netvsc.sys [108032 2015-10-30] (Microsoft Corporation)
S0 percsas2i; C:\Windows\System32\drivers\percsas2i.sys [58208 2015-10-30] (LSI Corporation)
S0 percsas3i; C:\Windows\System32\drivers\percsas3i.sys [58720 2015-10-30] (Avago Technologies)
S3 ReFSv1; C:\Windows\System32\Drivers\ReFSv1.sys [930656 2015-10-30] (Microsoft Corporation)
R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [589824 2015-10-30] (Realtek )
S3 ssudmdm; C:\Windows\system32\DRIVERS\ssudmdm.sys [221824 2016-04-25] (Samsung Electronics Co., Ltd.)
S3 ssudserd; C:\Windows\system32\DRIVERS\ssudserd.sys [206080 2014-01-22] (DEVGURU Co., LTD.(www.devguru.co.kr))
R2 storqosflt; C:\Windows\System32\drivers\storqosflt.sys [78848 2015-10-30] (Microsoft Corporation)
S0 storufs; C:\Windows\System32\drivers\storufs.sys [34144 2015-10-30] (Microsoft Corporation)
S3 UcmCx0101; C:\Windows\System32\Drivers\UcmCx.sys [63488 2016-05-31] (Microsoft Corporation)
S3 UcmUcsi; C:\Windows\System32\drivers\UcmUcsi.sys [46592 2015-10-30] (Microsoft Corporation)
S3 UdeCx; C:\Windows\System32\drivers\udecx.sys [45056 2015-10-30] (Microsoft Corporation)
S3 Ufx01000; C:\Windows\System32\drivers\ufx01000.sys [258912 2016-05-28] (Microsoft Corporation)
S3 UfxChipidea; C:\Windows\System32\drivers\UfxChipidea.sys [94048 2015-10-30] (Microsoft Corporation)
S3 ufxsynopsys; C:\Windows\System32\drivers\ufxsynopsys.sys [131424 2016-05-31] (Microsoft Corporation)
S3 UrsChipidea; C:\Windows\System32\drivers\urschipidea.sys [28512 2015-10-30] (Microsoft Corporation)
S3 UrsCx01000; C:\Windows\System32\drivers\urscx01000.sys [57696 2015-10-30] (Microsoft Corporation)
S3 UrsSynopsys; C:\Windows\System32\drivers\urssynopsys.sys [27488 2015-10-30] (Microsoft Corporation)
S3 vhf; C:\Windows\System32\drivers\vhf.sys [31744 2015-10-30] (Microsoft Corporation)
S3 wdiwifi; C:\Windows\System32\DRIVERS\wdiwifi.sys [694784 2016-05-31] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)
R0 WindowsTrustedRT; C:\Windows\System32\drivers\WindowsTrustedRT.sys [106520 2015-10-30] (Microsoft Corporation)
R0 WindowsTrustedRTProxy; C:\Windows\System32\drivers\WindowsTrustedRTProxy.sys [17944 2015-10-30] (Microsoft Corporation)
S3 WinMad; C:\Windows\System32\drivers\winmad.sys [26976 2015-10-30] (Mellanox)
S3 WinVerbs; C:\Windows\System32\drivers\winverbs.sys [59232 2015-10-30] (Mellanox)
S3 xboxgip; C:\Windows\System32\drivers\xboxgip.sys [238592 2016-05-31] (Microsoft Corporation)
S3 xinputhid; C:\Windows\System32\drivers\xinputhid.sys [26112 2016-05-31] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

NETSVC: dosvc -> C:\Windows\system32\dosvc.dll (Microsoft Corporation)
NETSVC: DcpSvc -> C:\Windows\system32\dcpsvc.dll (Microsoft Corporation)
NETSVC: NetSetupSvc -> C:\Windows\System32\NetSetupSvc.dll (Microsoft Corporation)
NETSVC: RetailDemo -> C:\Windows\system32\RDXService.dll (Microsoft Corporation)
NETSVC: dmwappushservice -> C:\Windows\system32\dmwappushsvc.dll (Microsoft Corporation)
NETSVC: XboxNetApiSvc -> C:\Windows\system32\XboxNetApiSvc.dll (Microsoft Corporation)
NETSVC: UsoSvc -> C:\Windows\system32\usocore.dll (Microsoft Corporation)
NETSVC: XblGameSave -> C:\Windows\System32\XblGameSave.dll (Microsoft Corporation)
NETSVC: DmEnrollmentSvc -> C:\Windows\system32\Windows.Internal.Management.dll (Microsoft Corporation)
NETSVC: UserManager -> C:\Windows\System32\usermgr.dll (Microsoft Corporation)
NETSVC: XblAuthManager -> C:\Windows\System32\XblAuthManager.dll (Microsoft Corporation)
NETSVCx32: NetSetupSvc -> C:\Windows\SysWOW64\NetSetupSvc.dll ==> No File
NETSVCx32: UserManager -> C:\Windows\SysWOW64\usermgr.dll ==> No File

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-07-21 11:18 - 2016-07-21 11:19 - 00030415 _____ C:\Users\Bicci\Desktop\FRST.txt
2016-07-21 11:18 - 2016-07-21 11:18 - 00000000 ____D C:\FRST
2016-07-21 11:17 - 2016-07-21 11:18 - 02170368 _____ (Farbar) C:\Users\Bicci\Desktop\frst64.exe
2016-07-21 11:15 - 2016-07-21 11:15 - 00000000 _____ C:\Users\Bicci\Desktop\FRST64.exe.3chdvy5.partial
2016-07-21 11:14 - 2016-07-21 11:14 - 00000000 _____ C:\Users\Bicci\Desktop\FRST64.exe.twbjcl4.partial
2016-07-21 11:09 - 2016-07-21 11:09 - 01743872 _____ (Farbar) C:\Users\Bicci\Desktop\FRST.exe
2016-07-21 10:46 - 2016-07-21 10:46 - 00000778 _____ C:\WINDOWS\setupact.log
2016-07-21 10:46 - 2016-07-21 10:46 - 00000000 _____ C:\WINDOWS\setuperr.log
2016-07-21 07:48 - 2016-07-21 07:48 - 00002968 _____ C:\WINDOWS\PFRO.log
2016-07-20 18:28 - 2016-07-20 18:28 - 00000181 _____ C:\Users\Bicci\Downloads\(pas de nom de fichier)
2016-07-19 15:59 - 2016-07-19 15:59 - 00051200 _____ C:\Users\Bicci\Downloads\PG ARCIZANS des 18-07-16 -.xls
2016-07-18 14:19 - 2016-07-18 14:19 - 00330200 _____ C:\Users\Bicci\Downloads\Devis SBTP.jpeg
2016-07-18 07:54 - 2016-07-18 07:54 - 00080239 _____ C:\Users\Bicci\Downloads\=_UTF-8_B_NzU3MUJJQ0NJIEZhY3R1cmUgTsKwIDIwMTY=_= =_UTF-8_B_LTA3LTAwMDMzNyAxM18wN18yMDE2LnBkZg==_=
2016-07-12 08:00 - 2016-07-12 08:00 - 00051804 _____ C:\Users\Bicci\Downloads\=_UTF-8_B_Q1IgUsOpdW5pb24gTsKwMi5wZGY=_= (3)
2016-07-12 08:00 - 2016-07-12 08:00 - 00051804 _____ C:\Users\Bicci\Downloads\=_UTF-8_B_Q1IgUsOpdW5pb24gTsKwMi5wZGY=_= (2)
2016-07-12 08:00 - 2016-07-12 08:00 - 00051804 _____ C:\Users\Bicci\Downloads\=_UTF-8_B_Q1IgUsOpdW5pb24gTsKwMi5wZGY=_= (1)
2016-07-08 11:31 - 2016-07-08 11:31 - 00260287 _____ C:\Users\Bicci\Downloads\facture smbtp.jpeg
2016-07-07 16:21 - 2016-07-07 16:21 - 00051804 _____ C:\Users\Bicci\Downloads\=_UTF-8_B_Q1IgUsOpdW5pb24gTsKwMi5wZGY=_=
2016-07-06 14:48 - 2016-07-06 14:48 - 00976777 _____ C:\Users\Bicci\Downloads\=_UTF-8_B_MjAxNjA3MDUgU0FTIFZEUi1kZXZpcyA=_= =_UTF-8_B_cGFycXVldCBBMzEyIHZhbGlkw6kucGRm_=
2016-07-06 14:46 - 2016-07-06 14:46 - 00977819 _____ C:\Users\Bicci\Downloads\=_UTF-8_B_MjAxNjA3MDUgU0FTIFZEUi1kZXZpcyA=_= =_UTF-8_B_cGFycXVldCBBMzAzIHZhbGlkw6kucGRm_=
2016-07-06 14:33 - 2016-07-06 14:33 - 02168735 _____ C:\Users\Bicci\Downloads\peinture tonnelle Villelongue 2016.odt
2016-07-01 17:09 - 2016-07-21 11:18 - 00000275 _____ C:\WINDOWS\WindowsUpdate.log
2016-06-28 09:53 - 2016-06-28 09:53 - 00363496 _____ C:\Users\Bicci\Downloads\=_UTF-8_B_RGV2aXMgSGVsaW9zIGTDqWdhdCBkZXMgZWF1eC5qcGVn_=
2016-06-23 08:12 - 2016-06-23 08:12 - 00050310 _____ C:\Users\Bicci\Downloads\=_UTF-8_B_Q1IgUsOpdW5pb24gTsKwMS5wZGY=_=

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-07-21 11:01 - 2016-05-31 09:41 - 00000441 _____ C:\WINDOWS\BRWMARK.INI
2016-07-21 11:00 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\system32\sru
2016-07-21 10:59 - 2016-05-31 14:18 - 00000000 ____D C:\Users\Bicci\AppData\Local\Deployment
2016-07-21 10:59 - 2013-06-20 15:43 - 00000000 ____D C:\Program Files (x86)\Advanced Monitoring Agent
2016-07-21 10:48 - 2016-05-31 10:14 - 01848398 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-07-21 10:48 - 2016-02-13 14:49 - 00824258 _____ C:\WINDOWS\system32\perfh00C.dat
2016-07-21 10:48 - 2016-02-13 14:49 - 00155558 _____ C:\WINDOWS\system32\perfc00C.dat
2016-07-21 09:34 - 2015-10-30 09:11 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-07-21 09:33 - 2013-08-16 09:47 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-07-21 09:05 - 2013-06-27 08:07 - 00000000 ____D C:\ProgramData\Microsoft Help
2016-07-21 09:05 - 2013-06-24 09:14 - 144749672 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-07-21 08:50 - 2016-05-20 08:41 - 00003234 _____ C:\WINDOWS\System32\Tasks\HPCeeScheduleForBicci
2016-07-21 08:50 - 2016-05-20 08:41 - 00000342 _____ C:\WINDOWS\Tasks\HPCeeScheduleForBicci.job
2016-07-21 08:47 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\AppReadiness
2016-07-21 08:12 - 2015-12-02 19:42 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-07-21 08:12 - 2014-12-26 12:29 - 00004562 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2016-07-21 07:49 - 2016-05-31 09:47 - 00000000 ____D C:\Users\Bicci
2016-07-21 07:49 - 2013-06-26 08:02 - 00001082 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2016-07-21 07:48 - 2016-02-13 15:14 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-07-20 18:41 - 2015-10-30 08:28 - 00524288 ___SH C:\WINDOWS\system32\config\BBI
2016-07-20 11:22 - 2015-09-28 14:23 - 00000000 ____D C:\Users\Bicci\AppData\Local\Pogoplug
2016-07-19 08:53 - 2013-06-20 15:40 - 00000000 ____D C:\Users\Bicci\Documents\ENTREPRISE BICCI JEAN MICHEL
2016-07-18 08:14 - 2015-11-27 10:29 - 00069120 _____ C:\Users\Bicci\Desktop\calendrier-2016-mensuel.xls
2016-07-02 06:37 - 2015-10-30 09:26 - 00828408 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2016-07-02 06:37 - 2015-10-30 09:26 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2016-07-01 08:50 - 2016-03-22 09:48 - 00000052 _____ C:\WINDOWS\SysWOW64\DOErrors.log
2016-06-29 09:07 - 2013-10-31 15:14 - 00000000 ____D C:\Users\Bicci\Documents\Jean-Michel Perso
2016-06-27 13:47 - 2013-08-06 11:27 - 00099120 _____ C:\Users\Bicci\AppData\Local\GDIPFONTCACHEV1.DAT

==================== Files in the root of some directories =======

2013-12-19 09:42 - 2015-07-01 07:45 - 0000197 _____ () C:\Users\Bicci\AppData\Roaming\WB.CFG
2016-02-23 15:35 - 2016-02-23 15:35 - 0353118 _____ () C:\Users\Bicci\AppData\Local\SquareClock.Production_HBMV1Icon.ico
2013-09-03 15:58 - 2013-09-03 15:58 - 0000057 _____ () C:\ProgramData\Ament.ini

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2016-07-13 09:22

==================== End of log ============================

biccipeinture · « **Réponse #3 le:** juillet 21, 2016, 11:29:06 »

Additional scan result of Farbar Recovery Scan Tool (x64) Version:06-08-2015
Ran by Bicci (2016-07-21 11:21:05)
Running from C:\Users\Bicci\Desktop
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrateur (S-1-5-21-1759795422-2075537827-4017263716-500 - Administrator - Disabled)
Bicci (S-1-5-21-1759795422-2075537827-4017263716-1001 - Administrator - Enabled) => C:\Users\Bicci
DefaultAccount (S-1-5-21-1759795422-2075537827-4017263716-503 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1759795422-2075537827-4017263716-1003 - Limited - Enabled)
Invité (S-1-5-21-1759795422-2075537827-4017263716-501 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Acer Power Management (HKLM\...\{91F52DE4-B789-42B0-9311-A349F10E5479}) (Version: 7.00.3006 - Acer Incorporated)
Acer Recovery Management (HKLM\...\{07F2005A-8CAC-4A4B-83A2-DA98A722CA61}) (Version: 6.00.3012 - Acer Incorporated)
AcerCloud (HKLM-x32\...\{A5AD0B17-F34D-49BE-A157-C8B3D52ACD13}) (Version: 2.01.3124 - Acer Incorporated)
AcerCloud Docs (HKLM-x32\...\{CA4FE8B0-298C-4E5D-A486-F33B126D6A0A}) (Version: 1.00.3204 - Acer Incorporated)
Adobe Acrobat Reader DC - Français (HKLM-x32\...\{AC76BA86-7AD7-1036-7B44-AC0F074E4100}) (Version: 15.017.20050 - Adobe Systems Incorporated)
Advanced Monitoring Agent (HKLM-x32\...\Advanced Monitoring Agent_is1) (Version: - )
AMD Catalyst Control Center (HKLM-x32\...\WUCCCApp) (Version: 1.00.0000 - AMD)
AMD Catalyst Install Manager (HKLM\...\{19CB64EB-ACFE-681D-B571-A8A3398F1943}) (Version: 8.0.881.0 - Advanced Micro Devices, Inc.)
ANT Drivers Installer x64 (Version: 2.3.4 - Garmin Ltd or its subsidiaries) Hidden
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 11.1.2253 - AVAST Software)
B.cloud (HKLM\...\PogoplugBackup) (Version: 5.2.7.13 - Cloud Engines Inc.)
Batigest ENTREPRENEUR 7 (HKLM-x32\...\Batigest ENTREPRENEUR 7) (Version: - )
Ciel Gestion commerciale Evolution Réseau 14.1 (HKLM-x32\...\{B1195DEF-B456-41BB-B5BE-28EB71853EC5}) (Version: 138.00.1045 - Ciel)
clear.fi Media (HKLM-x32\...\{E9AF1707-3F3A-49E2-8345-4F2D629D0876}) (Version: 2.01.3108 - Acer Incorporated)
clear.fi Photo (HKLM-x32\...\{B5AD89F2-03D3-4206-8487-018298007DD0}) (Version: 2.01.3108 - Acer Incorporated)
clear.fi SDK - Video 2 (x32 Version: 2.1.1925 - CyberLink Corp.) Hidden
clear.fi SDK- Movie 2 (x32 Version: 2.1.2008 - CyberLink Corp.) Hidden
CyberLink MediaEspresso 6.5 (HKLM-x32\...\InstallShield_{E3739848-5329-48E3-8D28-5BBD6E8BE384}) (Version: 6.5.3318_45364 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
eBay Worldwide (HKLM-x32\...\{A694AF57-9891-4D62-824C-7E55A1361A14}) (Version: 2.3.0630 - OEM)
Elevated Installer (x32 Version: 4.0.15.0 - Garmin Ltd or its subsidiaries) Hidden
Galerie de photos (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Garmin Express (HKLM-x32\...\{50755d67-ae60-4e47-b3d6-ce44d01b5a95}) (Version: 4.0.15.0 - Garmin Ltd or its subsidiaries)
Garmin Express (x32 Version: 4.0.15.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin Express Tray (x32 Version: 4.0.15.0 - Garmin Ltd or its subsidiaries) Hidden
GFI LanGuard 11 Agent (x32 Version: 11.0.2012.0717 - GFI Software Ltd) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 51.0.2704.103 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.30.3 - Google Inc.) Hidden
GSview 5.0 (HKLM-x32\...\GSview 5.0) (Version: 5.0 - Ghostgum Software Pty Ltd)
HomeByMe (HKU\S-1-5-21-1759795422-2075537827-4017263716-1001\...\SquareClock_Production_HBMV1) (Version: - 3DVIA Dassault Systemes)
Hotkey Utility (HKLM-x32\...\{A6DC88AD-501A-44BC-884D-57435F972E2C}) (Version: 3.00.3004 - Acer Incorporated)
HP Support Assistant (HKLM-x32\...\{78E2C850-ADA6-420D-BA35-2F4A9BE733CC}) (Version: 8.2.8.25 - HP)
HP Support Solutions Framework (HKLM-x32\...\{C18278AC-049A-4F02-A97F-4FD7294CC4F5}) (Version: 12.4.18.7 - HP)
Identity Card (HKLM-x32\...\{3D9CB654-99AD-4301-89C6-0D12A790767C}) (Version: 2.00.3004 - Acer Incorporated)
Junk Mail filter update (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Live Updater (HKLM-x32\...\{EE26E302-876A-48D9-9058-3129E5B99999}) (Version: 2.00.3004 - Acer Incorporated)
Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Microsoft Access database engine 2010 (French) (HKLM-x32\...\{90140000-00D1-040C-0000-0000000FF1CE}) (Version: 14.0.6029.1000 - Microsoft Corporation)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4420.1017 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM-x32\...\{95140000-007A-0409-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM-x32\...\{95140000-007A-040C-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Office Professional Plus 2007 (HKLM-x32\...\PROPLUS) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Mise à jour Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-040C-0000-0000000FF1CE}_PROPLUS_{B761869A-B85C-40E2-994C-A1CE78AC8F2C}) (Version: - Microsoft)
Mise à jour Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-040C-0000-0000000FF1CE}_PROPLUS_{51EFB347-1F3D-4BAC-8B79-F056B904FE21}) (Version: - Microsoft)
Mise à jour Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-040C-0000-0000000FF1CE}_PROPLUS_{C3DCA38E-005E-41BA-A52A-7C3429F351C3}) (Version: - Microsoft)
Mise à jour Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-040C-0000-0000000FF1CE}_PROPLUS_{81536A04-DBFB-4DB3-978F-0F284590C223}) (Version: - Microsoft)
Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
MyWinLocker (Version: 4.0.14.35 - Egis Technology Inc.) Hidden
MyWinLocker 4 (x32 Version: 4.0.14.35 - Egis Technology Inc.) Hidden
MyWinLocker Suite (HKLM-x32\...\InstallShield_{17DF9714-60C9-43C9-A9C2-32BCAED44CBE}) (Version: 4.0.14.24 - Egis Technology Inc.)
MyWinLocker Suite (x32 Version: 4.0.14.24 - Egis Technology Inc.) Hidden
Nero 12 Essentials OEM.a01 (HKLM-x32\...\{9BF0D9FE-9893-4647-81B9-17B7BEA4E6FD}) (Version: 12.5.00000 - Nero AG)
Office Addin (HKLM-x32\...\{6D2BBE1D-E600-4695-BA37-0B0E605542CC}) (Version: 2.01.3202 - Acer)
OpenOffice.org 3.4.1 (HKLM-x32\...\{7DA1C06F-C913-46C7-8A0F-DA2CBA17EA1D}) (Version: 3.41.9593 - Apache Software Foundation)
Package de pilotes Windows - Dynastream Innovations, Inc. ANT LibUSB Drivers (04/11/2012 1.2.40.201) (HKLM\...\F9D2A789F9CFF8CEC36B544F53877C80F1F73C46) (Version: 04/11/2012 1.2.40.201 - Dynastream Innovations, Inc.)
Package de pilotes Windows - Silicon Labs Software (DSI_SiUSBXp_3_1) USB (02/06/2007 3.1) (HKLM\...\D1506E0025B5A3F9EB8270FE81C1EEDD9388B8A2) (Version: 02/06/2007 3.1 - Silicon Labs Software)
PhotoFiltre 7 (HKU\S-1-5-21-1759795422-2075537827-4017263716-1001\...\PhotoFiltre 7) (Version: - )
Prerequisite installer (x32 Version: 12.0.0002 - Nero AG) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.2.612.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6680 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.39030 - Realtek Semiconductor Corp.)
SafeZone Stable 1.48.2066.44 (x32 Version: 1.48.2066.44 - Avast Software) Hidden
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.15072.2 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.15072.2 - Samsung Electronics Co., Ltd.) Hidden
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Shredder (Version: 2.0.8.9 - Egis Technology Inc.) Hidden
Shredder (x32 Version: 2.0.8.9 - Egis Technology Inc.) Hidden
Spotify (HKLM-x32\...\Spotify) (Version: 0.8.4.99.ga249b5f1 - Spotify AB)
TeamViewer 10 Host (HKLM-x32\...\TeamViewer) (Version: 10.0.43879 - TeamViewer)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Visual Studio 2005 Tools pour Office Second Edition Runtime (HKLM-x32\...\Microsoft Visual Studio 2005 Tools for Office Runtime) (Version: - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime (HKLM-x32\...\Visual Studio Tools for the Office system 3.0 Runtime) (Version: - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime Service Pack 1 (KB949258) (HKLM-x32\...\{8FB53850-246A-3507-8ADE-0060093FFEA6}.KB949258) (Version: 1 - Microsoft Corporation)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)
WSE Rocket (HKLM-x32\...\WSE Rocket) (Version: - WSE Rocket) <==== ATTENTION

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1759795422-2075537827-4017263716-1001_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InprocServer32 -> C:\Windows\system32\shell32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1759795422-2075537827-4017263716-1001_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 -> C:\Users\Bicci\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1759795422-2075537827-4017263716-1001_Classes\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32 -> C:\Users\Bicci\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1759795422-2075537827-4017263716-1001_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\Bicci\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\FileCoAuth.exe (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1759795422-2075537827-4017263716-1001_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 -> C:\Users\Bicci\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1759795422-2075537827-4017263716-1001_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 -> C:\Users\Bicci\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1759795422-2075537827-4017263716-1001_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Bicci\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1759795422-2075537827-4017263716-1001_Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32 -> C:\Users\Bicci\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1759795422-2075537827-4017263716-1001_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Bicci\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1759795422-2075537827-4017263716-1001_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Bicci\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1759795422-2075537827-4017263716-1001_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Bicci\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1759795422-2075537827-4017263716-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Bicci\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points =========================

05-07-2016 09:10:09 Point de contrôle planifié
16-07-2016 12:16:24 Point de contrôle planifié
21-07-2016 08:50:55 Windows Update

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 15:25 - 2014-05-26 11:27 - 00000741 ____A C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 localhost

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0035F14D-C815-479B-B3BE-EC1FC882ADDF} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Maintenance Install => C:\Windows\system32\usoclient.exe [2015-10-30] (Microsoft Corporation)
Task: {064E6297-1CF8-447C-A437-2FF0C2A64F84} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent No Task File <==== ATTENTION
Task: {08629A58-75ED-46AA-8646-8C7015698215} - System32\Tasks\Microsoft\Windows\WindowsUpdate\sihboot => C:\Windows\System32\sihclient.exe [2015-10-30] (Microsoft Corporation)
Task: {09C80198-5498-4491-A61E-AFC0185DD3E9} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker_Display => C:\windows\system32\MusNotification.exe [2016-05-28] (Microsoft Corporation)
Task: {0C20E8DB-DCF0-4C48-B9B9-482E02BD9F1F} - System32\Tasks\Microsoft\Windows\Maps\MapsUpdateTask
Task: {181EF958-CF2C-45C1-BFE2-0048458E3EFC} - System32\Tasks\Microsoft\Windows\DeviceDirectoryClient\RegisterUserDevice
Task: {1F0B1B6D-6FB8-495E-8D1D-0B6BA27883EB} - System32\Tasks\Microsoft\Windows\LanguageComponentsInstaller\Uninstallation
Task: {2300B6D1-D409-499E-92DF-030662B73A6B} - System32\Tasks\Microsoft\Windows\DeviceDirectoryClient\RegisterDevicePeriodic6
Task: {2B939BC9-F0DB-495F-B471-C835696EDFBE} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime No Task File <==== ATTENTION
Task: {2CCA2563-023C-4159-8011-59C6C9E1973A} - System32\Tasks\Microsoft\Windows\CertificateServicesClient\KeyPreGenTask
Task: {317107BF-13F6-48B4-AA5A-BA0B03A02F4B} - System32\Tasks\Microsoft\Windows\ErrorDetails\EnableErrorDetailsUpdate
Task: {33046BDC-2974-457F-A198-055760713D46} - System32\Tasks\Microsoft\Windows\Storage Tiers Management\Storage Tiers Management Initialization
Task: {34E3CFF8-83D6-4D77-9F6F-B15989D1F166} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Policy Install => C:\Windows\system32\usoclient.exe [2015-10-30] (Microsoft Corporation)
Task: {3612EBBD-FF3B-4AB8-BD5F-3AA1A41415CC} - System32\Tasks\ALUAgent => C:\Program Files (x86)\Acer\Live Updater\liveupdater_agent.exe [2012-06-22] ()
Task: {3627755F-6629-4D94-850A-FBE43D28BEB8} - System32\Tasks\Microsoft\Windows\CertificateServicesClient\CryptoPolicyTask
Task: {3B3A48DF-1E5B-4F3D-BEE3-C9C459A1874A} - \Microsoft\Windows\Setup\gwx\launchtrayprocess No Task File <==== ATTENTION
Task: {4208A7BF-D622-476E-A1A3-F9EB2719ECD4} - System32\Tasks\Microsoft\Windows\Management\Provisioning\Logon => C:\Windows\system32\ProvTool.exe [2016-02-13] (Microsoft Corporation)
Task: {43BA2C27-895A-4DA2-A19B-6F9A97DBF603} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d No Task File <==== ATTENTION
Task: {45A1E736-EAAA-4735-ABBA-A9C5CF2BDAEF} - System32\Tasks\Microsoft\Windows\DeviceDirectoryClient\RegisterDevicePeriodic1
Task: {48E4EF46-2962-499E-B496-FD87DEFA9D4D} - System32\Tasks\Microsoft\Windows\Feedback\Siuf\DmClient => C:\Windows\system32\dmclient.exe [2015-10-30] (Microsoft Corporation)
Task: {4A879BC8-21BB-49FC-A889-EA5F87529E2B} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-06-25] (Adobe Systems Incorporated)
Task: {4A944005-EAD7-4E3D-A0CB-E36A03948234} - System32\Tasks\Microsoft\Windows\DeviceDirectoryClient\IntegrityCheck
Task: {4C5A8A03-2384-464F-AEAA-F58928D854D8} - System32\Tasks\Microsoft\Windows\DiskFootprint\Diagnostics => C:\Windows\system32\disksnapshot.exe [2015-10-30] (Microsoft Corporation)
Task: {4CBBD9B6-BB94-4497-A4C6-E9829D488C73} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime No Task File <==== ATTENTION
Task: {4D23C592-75EF-4815-99C7-17FFB98719B5} - System32\Tasks\DeviceDetector => C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe [2012-09-20] (CyberLink)
Task: {4E3CB8C2-8A0C-4570-A32E-7319C6E8E432} - System32\Tasks\Microsoft\Windows\DeviceDirectoryClient\RegisterDevicePeriodic24
Task: {4E4954A6-C22F-4537-87FE-9A696B7BF9C4} - System32\Tasks\Microsoft\Windows\Location\WindowsActionDialog => C:\Windows\System32\WindowsActionDialog.exe [2015-10-30] (Microsoft Corporation)
Task: {511CB694-F6BB-49BA-AC20-E2916B05BD90} - System32\Tasks\Microsoft\Windows\CertificateServicesClient\AikCertEnrollTask
Task: {5471E8D0-2BAD-4477-89F7-663737F68CF9} - System32\Tasks\EgisUpdate => C:\Program Files\EgisTec IPS\EgisUpdate.exe [2012-07-12] (Egis Technology Inc.)
Task: {5AEFFDD8-E3BD-4520-8125-5F4D6D5F9D91} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2016-02-18] (Hewlett-Packard Company)
Task: {5B4C02FF-5C7C-42FB-877E-4F57C6198A71} - System32\Tasks\Microsoft\Windows\Maps\MapsToastTask
Task: {62B2BC21-0D03-486F-81C9-67467928255D} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2016-02-15] (AVAST Software)
Task: {6510A17C-71E2-41C9-887C-375ACF991F16} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\BrowserChoice\browserchoice.exe
Task: {697E18DD-943C-470A-B9E3-6E5DDCB42D05} - System32\Tasks\Microsoft\Windows\DeviceDirectoryClient\RegisterDeviceSettingChange
Task: {6B696BCF-C866-41CA-B4E4-3D19FB1E9250} - System32\Tasks\Microsoft\Windows\SpacePort\SpaceManagerTask => C:\Windows\system32\SpaceMan.exe [2015-10-30] (Microsoft Corporation)
Task: {6FBB4238-2AD3-416F-99AA-F71FDCC42297} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\MusUx_LogonUpdateResults => C:\WINDOWS\system32\MusNotification.exe [2016-05-28] (Microsoft Corporation)
Task: {71E53243-3A2D-47EE-9DAB-6D71B2366657} - System32\Tasks\Microsoft\Windows\ErrorDetails\ErrorDetailsUpdate
Task: {7238E332-ED14-47DA-AF8D-F20EAA3227CD} - System32\Tasks\GarminUpdaterTask => C:\Program Files (x86)\Garmin\Express Self Updater\ExpressSelfUpdater.exe
Task: {7432072F-A823-432A-81EA-E50CADEED50B} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2016-07-21] (Microsoft Corporation)
Task: {7464E64D-F916-44C4-8B4D-8285C95325A1} - System32\Tasks\Microsoft\Windows\WCM\WiFiTask => C:\Windows\System32\WiFiTask.exe [2016-05-31] (Microsoft Corporation)
Task: {772AFF31-3C90-4A78-B141-5F6845885E82} - \Microsoft\Windows\Setup\GWXTriggers\OnIdle-5d No Task File <==== ATTENTION
Task: {7AE1BCAC-061D-4672-BACB-88BC74CE1D7A} - System32\Tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater => C:\Windows\system32\compattelrunner.exe [2016-05-28] (Microsoft Corporation)
Task: {7AFCCB5F-ADF2-4722-92F5-7F17DE3E9F2A} - System32\Tasks\Power Management => C:\Program Files\Acer\Acer Power Management\ePowerTray.exe [2012-08-23] (Acer Incorporated)
Task: {84E4A8CF-CE13-47C4-ABC1-BC5DD42C6C83} - System32\Tasks\Microsoft\Windows\TPM\Tpm-HASCertRetr
Task: {860F596C-A1D8-4651-B747-D134041D80AD} - System32\Tasks\Microsoft\Windows\DiskFootprint\StorageSense => Rundll32.exe %windir%\system32\StorageUsage.dll,GetStorageUsageInfo
Task: {90D79106-3D12-40AF-A9BA-231F2327770C} - System32\Tasks\Microsoft\Windows\DUSM\dusmtask => C:\Windows\System32\dusmtask.exe [2015-10-30] (Microsoft Corporation)
Task: {955E8D5B-0718-411A-9D8F-83454788272B} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Automatic App Update
Task: {97C59979-A63B-42AD-9C73-1065DBB6ECE5} - System32\Tasks\Hotkey Utility => C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe [2012-09-20] (Acer Incorporated)
Task: {9FFB29C5-38ED-47CB-B89B-EA84708EBA65} - System32\Tasks\Microsoft\Windows\ApplicationData\DsSvcCleanup => C:\Windows\system32\dstokenclean.exe [2015-10-30] (Microsoft Corporation)
Task: {A2976DB1-56C7-42DC-8D62-24EE7C89721B} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2016-06-08] (HP Inc.)
Task: {A38956FC-9478-414A-8516-26DC280846FD} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig No Task File <==== ATTENTION
Task: {A483A62A-BEE2-43EF-B43D-C4B6555D6F1E} - System32\Tasks\Microsoft\Windows\DeviceDirectoryClient\RegisterDeviceAccountChange
Task: {A549DAC2-CFDC-4597-AAD5-E7A2C0BEE227} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d No Task File <==== ATTENTION
Task: {A748C283-7359-48F0-8775-A5B8C7DE76BD} - System32\Tasks\PMMUpdate => C:\Program Files\EgisTec IPS\PMMUpdate.exe [2012-07-12] (Egis Technology Inc.)
Task: {AD1B19D3-DC74-4F3D-91F2-BA8CA4E71D94} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d No Task File <==== ATTENTION
Task: {C349BB67-3672-4975-AE02-517BAD9318EE} - System32\Tasks\Microsoft\Windows\WindowsUpdate\sih => C:\Windows\System32\sihclient.exe [2015-10-30] (Microsoft Corporation)
Task: {C5C1D8D8-8E2E-4F1C-B1EF-389146FF4388} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-31] (Google Inc.)
Task: {C881A742-1A15-4EAC-96B9-9C6EA38AC7FA} - System32\Tasks\Microsoft\Windows\DeviceDirectoryClient\RegisterDeviceConnectedToNetwork
Task: {CA4BE44E-107E-4B2D-91AF-FC3B077B02FC} - System32\Tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser => C:\Windows\system32\compattelrunner.exe [2016-05-28] (Microsoft Corporation)
Task: {CE15BC8E-E2E9-4689-BFFB-F38CF65C2CFD} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2016-05-04] (Hewlett-Packard)
Task: {D521FB53-67CD-4440-B757-05EDE64A7A05} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d No Task File <==== ATTENTION
Task: {D6671458-A487-4C59-83BC-CC399C9876CB} - System32\Tasks\ALU => C:\Program Files (x86)\Acer\Live Updater\updater.exe [2012-08-30] ()
Task: {D710CC16-2BDF-49DD-90AB-48FDFC3B32E1} - System32\Tasks\SafeZone scheduled Autoupdate 1458716592 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2016-02-01] (Avast Software)
Task: {D9256859-A94C-4063-88B0-701850D7B3D9} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Active Health Launcher => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2016-06-15] (HP Inc.)
Task: {DB458018-DEBA-4577-AB8B-EA1506110FB8} - System32\Tasks\Microsoft\Windows\Location\Notifications => C:\Windows\System32\LocationNotificationWindows.exe [2015-10-30] (Microsoft Corporation)
Task: {DE9EF05D-D131-41FC-87C9-ABF449872934} - System32\Tasks\Microsoft\Windows\LanguageComponentsInstaller\Installation
Task: {E03596C8-B2A4-4553-B379-B678F0EBCA95} - System32\Tasks\Microsoft\Windows\DeviceDirectoryClient\RegisterDeviceScreenOnOff
Task: {E20A31A9-A171-4BF6-9684-FAD12BBC76A4} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d No Task File <==== ATTENTION
Task: {E31C471E-4AA7-47F1-8EEC-E0088F8440AC} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker_ReadyToReboot => C:\windows\system32\MusNotification.exe [2016-05-28] (Microsoft Corporation)
Task: {E506F4C9-20BB-40AE-AD65-2304E5EF9B80} - System32\Tasks\Microsoft\Windows\Clip\License Validation => C:\Windows\system32\ClipUp.exe [2015-10-30] (Microsoft Corporation)
Task: {E5217668-D921-4907-8CE1-276EABA44515} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan => C:\Windows\system32\usoclient.exe [2015-10-30] (Microsoft Corporation)
Task: {EA5D5FA7-79F4-4BC8-8C91-CA1A24F86527} - System32\Tasks\Microsoft\Windows\AppID\EDP Policy Manager
Task: {EC562C9F-86C3-4983-B011-BB9F5F044476} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2016-02-18] (Hewlett-Packard Company)
Task: {EC59CC4E-A8CB-476D-8421-92558446E9A3} - System32\Tasks\Microsoft\Windows\Sysmain\ResPriStaticDbSync
Task: {EE344364-24D1-4042-B441-0352A097A5F2} - System32\Tasks\{56375FBA-84D3-4E24-84BF-4CB69F1C0960} => Chrome.exe http://ui.skype.com/ui/0/6.3.73.105.457/fr/abandoninstall?page=tsWLM
Task: {EFB2C913-BFA0-4FB9-8130-48BEE6BD1B12} - System32\Tasks\Microsoft\Windows\NlaSvc\WiFiTask => C:\Windows\System32\WiFiTask.exe [2016-05-31] (Microsoft Corporation)
Task: {F112FE03-994C-40A1-934D-3C10EC8CF36E} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Resume On Boot => C:\Windows\system32\usoclient.exe [2015-10-30] (Microsoft Corporation)
Task: {F120A436-C215-4927-87AA-934387AF5782} - System32\Tasks\Microsoft\Windows\License Manager\TempSignedLicenseExchange
Task: {F1B757C1-F2F5-497F-B6D0-85F17B21CF7A} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent No Task File <==== ATTENTION
Task: {F25F4F10-00A5-4DA6-BBC8-F88E05E2A8E8} - System32\Tasks\HPCeeScheduleForBicci => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2016-01-22] (Hewlett-Packard)
Task: {F5ADE95A-0DD5-4402-A6B6-A7BED6A9C751} - System32\Tasks\Hewlett-Packard\HP Active Health\HP Active Health Scan (HPSA) => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2016-06-15] (HP Inc.)
Task: {F63A2B2B-02A2-4C6E-9102-D31D93B658C3} - \Microsoft\Windows\Setup\GWXTriggers\Time-Weekend No Task File <==== ATTENTION
Task: {F67588D3-FA86-44D3-BE50-DD425109EDD4} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-31] (Google Inc.)
Task: {F775C69D-FE09-4105-8F98-5DC6D956FA4E} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Device-Join => C:\Windows\System32\dsregcmd.exe [2015-10-30] (Microsoft Corporation)
Task: {F9E1305C-FC0A-4DA2-A838-720FABC95091} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSFReport.exe [2016-05-09] (Hewlett-Packard)
Task: {FA625267-66E0-464A-AE95-8754007E78AD} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot => C:\WINDOWS\system32\MusNotification.exe [2016-05-28] (Microsoft Corporation)
Task: {FCE9B163-5366-4893-BEF1-08684B470E44} - \Microsoft\Windows\Setup\gwx\rundetector No Task File <==== ATTENTION
Task: {FD660BB4-9B7F-4EF0-A3F7-7C18FE57AB0F} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B No Task File <==== ATTENTION

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\HPCeeScheduleForBicci.job => 0x000A010058937A71D8A1354ABBA6C10BD45BEF0546002401000000003C000A00200000000014730F000000000013040002208021E007070004001500080032000000530100003C0043003A005C00500072006F006700720061006D002000460069006C00650073002000280078003800360029005C004800650077006C006500740074002D005000610063006B006100720064005C004800500020004300650065006D0065006E0074005C00480050004300450045002E0065007800650000001D00480050004300650065005300630068006500640075006C00650046006F00720042006900630063006900200028006E0075006C006C002900000000000B0041006300650072005C004200690063006300690000000000000008000000000000000000010030000000E0070700190000000000000008003200C0A80000680100000000000000000000010000000000000000000000

biccipeinture · « **Réponse #4 le:** juillet 21, 2016, 11:29:29 »

==================== Loaded Modules (Whitelisted) ==============

2015-10-30 09:18 - 2015-10-30 09:18 - 00185856 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-05-31 10:26 - 2016-05-31 10:26 - 02656952 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-05-31 10:26 - 2016-05-31 10:26 - 02656952 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2016-05-31 11:06 - 2016-05-31 11:06 - 00959168 _____ () C:\Users\Bicci\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64\ClientTelemetry.dll
2016-05-31 11:30 - 2016-05-31 11:30 - 00144384 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
2016-02-13 14:52 - 2016-02-13 14:52 - 00093696 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Windows.UI.Shell.SharedUtilities.dll
2016-05-31 10:27 - 2016-05-31 10:27 - 00472064 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2016-06-16 11:11 - 2016-05-28 05:59 - 07992832 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2016-06-16 11:11 - 2016-05-28 05:53 - 00591360 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2016-06-16 11:11 - 2016-05-28 05:54 - 02483200 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2016-06-16 11:11 - 2016-05-28 05:56 - 04089856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2015-08-21 22:09 - 2015-08-21 22:09 - 00102400 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2016-06-03 11:30 - 2016-06-03 11:31 - 00017920 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.526.11220.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
2016-06-03 11:30 - 2016-06-03 11:31 - 13105152 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.526.11220.0_x64__8wekyb3d8bbwe\Microsoft.Photos.dll
2016-06-03 11:30 - 2016-06-03 11:31 - 00680448 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.526.11220.0_x64__8wekyb3d8bbwe\Microsoft.DesignCore.dll
2016-05-31 11:24 - 2016-05-31 11:24 - 00291328 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.526.11220.0_x64__8wekyb3d8bbwe\StoreRatingPromotion.dll
2016-02-15 12:49 - 2016-02-15 12:49 - 00113496 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2016-02-15 12:49 - 2016-02-15 12:49 - 00133768 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2016-07-20 11:52 - 2016-07-20 11:52 - 03000832 _____ () C:\Program Files\AVAST Software\Avast\defs\16072000\algo.dll
2016-04-14 12:50 - 2016-04-14 12:50 - 00509344 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
2016-07-21 11:17 - 2016-07-21 11:17 - 03000832 _____ () C:\Program Files\AVAST Software\Avast\defs\16072100\algo.dll
2012-07-17 17:20 - 2012-07-17 17:20 - 00305520 _____ () C:\Program Files (x86)\Advanced Monitoring Agent\patchman\apistrings.dll
2012-07-17 17:24 - 2012-07-17 17:24 - 00159600 _____ () C:\Program Files (x86)\Advanced Monitoring Agent\patchman\modlop.dll
2012-07-23 14:32 - 2012-07-23 14:32 - 00099184 _____ () C:\Program Files (x86)\Advanced Monitoring Agent\patchman\httpserverattplugin.dll
2013-05-23 16:05 - 2013-05-23 16:05 - 02021240 _____ () C:\Program Files (x86)\Advanced Monitoring Agent\patchman\crmimodule.dll
2015-04-16 13:57 - 2015-04-16 13:57 - 00208496 _____ () C:\Program Files (x86)\Advanced Monitoring Agent\patchman\patchautodownload.dll
2013-01-21 14:05 - 2013-01-21 14:05 - 00183672 _____ () C:\Program Files (x86)\Advanced Monitoring Agent\patchman\scanmngsys.dll
2012-07-17 17:29 - 2012-07-17 17:29 - 00049520 _____ () C:\Program Files (x86)\Advanced Monitoring Agent\patchman\schedcompactdb.dll
2012-07-17 17:29 - 2012-07-17 17:29 - 00054640 _____ () C:\Program Files (x86)\Advanced Monitoring Agent\patchman\schedupdates.dll
2016-05-31 11:30 - 2016-05-31 11:30 - 00141312 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeBackgroundTasks.dll
2016-05-31 11:30 - 2016-05-31 11:30 - 22284800 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkyWrap.dll
2016-05-31 11:06 - 2016-05-31 11:06 - 00679624 _____ () C:\Users\Bicci\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\ClientTelemetry.dll
2012-08-10 16:51 - 2012-08-10 16:51 - 00985088 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
2016-02-15 12:49 - 2016-02-15 12:49 - 40539648 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Program Files\ATI Technologies:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Advanced Monitoring Agent:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\AMD APP:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\ATI Technologies:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\EgisTec MyWinLocker:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\EgisTec MyWinLockerSuite:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\EgisTec Shredder:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Garmin:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Malwarebytes Anti-Malware:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Microsoft Office:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Microsoft SQL Server Compact Edition:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Microsoft Visual Studio 8:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\MSBuild:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Nero:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\OpenOffice.org 3:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Spotify:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\TeamViewer:Win32App_1
AlternateDataStreams: C:\Program Files (x86)\Windows Live:Win32App_1
AlternateDataStreams: C:\Program Files\Common Files\microsoft shared:Win32App_1
AlternateDataStreams: C:\ProgramData\Nero:Win32App_1
AlternateDataStreams: C:\ProgramData\regid.1991-06.com.microsoft:Win32App_1
AlternateDataStreams: C:\Users\Bicci\OneDrive:ms-properties

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ahcache.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CoreMessagingRegistrar => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\iai2c.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SpbCx.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\StateRepository => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TileDataModelSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\uefi.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\UserManager => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{F2E7DD72-6468-4E36-B6F1-6488F42C1B52} => ""="Firmware"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Ahcache.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CoreMessagingRegistrar => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SpbCx.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\StateRepository => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\TileDataModelSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\uefi.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\UserManager => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{F2E7DD72-6468-4E36-B6F1-6488F42C1B52} => ""="Firmware"

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1759795422-2075537827-4017263716-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Bicci\Pictures\DSC01027.jpg
DNS Servers: 192.168.1.254
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 2) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{B423EDA5-EBF0-4B39-ADE6-5E7AD3D0AF7F}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{B568AC9C-3DD5-467D-BAFE-EBB834663965}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{BD8567A0-2BE5-49A6-9129-429575859F34}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{90F15D65-E878-4A58-8AC1-737ED767579B}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{5366E03F-CBCE-4423-85B7-935F7BD7289E}] => (Allow) C:\Program Files (x86)\Ciel\Serveur\WSRV.exe
FirewallRules: [{358DF384-AE6D-4F9B-ACD8-38DB5A609B5F}] => (Allow) C:\Program Files (x86)\Ciel\Serveur\WSRV.exe
FirewallRules: [{63AAA243-BFAC-4A1D-B1E9-B40749EDF5A3}] => (Allow) C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe
FirewallRules: [{A9125E66-E144-4F1E-AC44-DB6F4C952083}] => (Allow) C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe
FirewallRules: [{4B61F37D-E815-4A14-97E1-0663605934F8}] => (Allow) C:\Program Files (x86)\Spotify\spotify.exe
FirewallRules: [{235B7899-3746-4075-99E0-F174EC41069B}] => (Allow) C:\Program Files (x86)\Spotify\spotify.exe
FirewallRules: [{7233FB1A-2ED4-48EB-9912-F31A27743115}] => (Allow) C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe
FirewallRules: [{9059F1DC-FC36-4AB1-9E33-79E18AF61AD2}] => (Allow) C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe
FirewallRules: [{85CA49E2-2B52-4F74-AB79-167AD497E4E7}] => (Allow) C:\Program Files (x86)\Acer\clear.fi Media\DMCDaemon.exe
FirewallRules: [{C5F228FE-D9CA-4E1D-9DE7-D076C2EA504E}] => (Allow) C:\Program Files (x86)\Acer\clear.fi Media\DMCDaemon.exe
FirewallRules: [{06A934B4-104A-4CA1-B631-2AC0A2B9A890}] => (Allow) C:\Program Files (x86)\Acer\clear.fi Media\WindowsUpnpMV.exe
FirewallRules: [{F46FC309-B669-4A3E-8A36-E0371DC99060}] => (Allow) C:\Program Files (x86)\Acer\clear.fi Media\WindowsUpnpMV.exe
FirewallRules: [{F12BDA6B-E6D6-4216-878C-A8875FCF241F}] => (Allow) C:\Program Files (x86)\Acer\clear.fi SDK21\Video\VideoPlayer.exe
FirewallRules: [{8049790E-6FDD-4BBF-AA00-5DE01E7C15B7}] => (Allow) C:\Program Files (x86)\Acer\clear.fi SDK21\Video\MusicPlayer.exe
FirewallRules: [{865905A4-41B4-4B5D-AB6F-B195AAD92643}] => (Allow) C:\Program Files (x86)\Acer\clear.fi SDK21\Movie\PlayMovie.exe
FirewallRules: [{B38C71C3-8F99-469A-B209-23EF344FD3A3}] => (Allow) C:\Program Files (x86)\Acer\clear.fi Photo\DMCDaemon.exe
FirewallRules: [{FB32EC3A-D253-4219-A21D-75C489FED5B2}] => (Allow) C:\Program Files (x86)\Acer\clear.fi Photo\DMCDaemon.exe
FirewallRules: [{A1A66ACE-8666-4C0A-AADA-E4334E18B3AA}] => (Allow) C:\Program Files (x86)\Acer\clear.fi Photo\WindowsUpnp.exe
FirewallRules: [{A02780C4-7714-4320-98E2-22C47A0752E9}] => (Allow) C:\Program Files (x86)\Acer\clear.fi Photo\WindowsUpnp.exe
FirewallRules: [{D6BC2BBF-F8E1-4797-8716-CB42E3F47BF4}] => (Allow) C:\Program Files (x86)\Acer\Acer Cloud\ccd.exe
FirewallRules: [{15F06401-625B-40B1-998A-356E3D22990A}] => (Allow) C:\Program Files (x86)\Acer\Acer Cloud\ccd.exe
FirewallRules: [{A942029F-D47E-4BDB-975F-04D99139618D}] => (Allow) C:\Users\Bicci\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{B6A84F9A-413E-4CB1-BB30-354D63A9A4FF}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{A0E52421-4F7F-4BAA-8F9B-BA7077226793}] => (Allow) LPort=2869
FirewallRules: [{781E39EE-07EE-477B-90DD-A9FB255A42FF}] => (Allow) LPort=1900
FirewallRules: [{640718D4-B453-4CB2-B500-1BB81DF52280}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [TCP Query User{F2766162-CB15-4433-9F2D-C41924B376BA}C:\program files (x86)\internet explorer\iexplore.exe] => (Block) C:\program files (x86)\internet explorer\iexplore.exe
FirewallRules: [UDP Query User{5613B04B-9B84-4593-AECC-486F70B8B539}C:\program files (x86)\internet explorer\iexplore.exe] => (Block) C:\program files (x86)\internet explorer\iexplore.exe
FirewallRules: [TCP Query User{30649AD0-9A6F-48FC-B7C2-8982B15BF2F7}C:\program files (x86)\internet explorer\iexplore.exe] => (Block) C:\program files (x86)\internet explorer\iexplore.exe
FirewallRules: [UDP Query User{EFC3335C-5180-4838-ACB5-C925411A947B}C:\program files (x86)\internet explorer\iexplore.exe] => (Block) C:\program files (x86)\internet explorer\iexplore.exe
FirewallRules: [{3928CC0C-E03C-40E2-8B49-3393B66DC177}] => (Allow) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe
FirewallRules: [{B9D070C8-372E-4FE7-A872-C4BC2F017256}] => (Allow) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe
FirewallRules: [{3D93997C-6414-41A9-AA7E-AA487F8486C4}] => (Allow) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
FirewallRules: [{2E5128D8-FDDA-4A93-B890-F54F652A6347}] => (Allow) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
FirewallRules: [TCP Query User{82FA1C50-FB30-496C-A98D-AEB5DC7FB854}C:\users\bicci\appdata\roaming\cacaoweb\cacaoweb.exe] => (Block) C:\users\bicci\appdata\roaming\cacaoweb\cacaoweb.exe
FirewallRules: [UDP Query User{6F47EAF5-D254-42EF-8561-37567BD7002B}C:\users\bicci\appdata\roaming\cacaoweb\cacaoweb.exe] => (Block) C:\users\bicci\appdata\roaming\cacaoweb\cacaoweb.exe
FirewallRules: [{1417680D-5472-4868-95D8-4E17A4CF2084}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (07/21/2016 08:51:08 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Les services de chiffrement ont échoué lors du traitement de l’appel OnIdentity() dans l’objet System Writer.

Details:
AddLegacyDriverFiles: Unable to back up image of binary Protocole LLDP (Link Layer Discovery Protocol) Microsoft.

System Error:
Accès refusé.
.

Error: (07/21/2016 08:05:41 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Acer)
Description: Échec de l’activation de l’application Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI avec l’erreur : -2144927141 Pour plus d’informations, voir le journal Microsoft-Windows-TWinUI/Opérationnel.

Error: (07/18/2016 03:51:00 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Nom de l’application défaillante LockApp.exe, version : 0.0.0.0, horodatage : 0x5632d5a5
Nom du module défaillant : combase.dll, version : 10.0.10586.103, horodatage : 0x56a849ab
Code d’exception : 0xc0000602
Décalage d’erreur : 0x000000000018d8cb
ID du processus défaillant : 0x28b0
Heure de début de l’application défaillante : 0xLockApp.exe0
Chemin d’accès de l’application défaillante : LockApp.exe1
Chemin d’accès du module défaillant: LockApp.exe2
ID de rapport : LockApp.exe3
Nom complet du package défaillant : LockApp.exe4
ID de l’application relative au package défaillant : LockApp.exe5

Error: (07/16/2016 12:16:36 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Les services de chiffrement ont échoué lors du traitement de l’appel OnIdentity() dans l’objet System Writer.

Details:
AddLegacyDriverFiles: Unable to back up image of binary Protocole LLDP (Link Layer Discovery Protocol) Microsoft.

System Error:
Accès refusé.
.

Error: (07/12/2016 08:03:53 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Le programme MicrosoftEdgeCP.exe version 11.0.10586.20 a cessé d'interagir avec Windows et a été fermé. Pour déterminer si des informations supplémentaires sont disponibles, consultez l'historique du problème dans le panneau de configuration Sécurité et maintenance.

ID de processus : 8c0

Heure de début : 01d1dc00eb7af385

Heure de fin : 14722

Chemin d'accès de l'application : C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

ID de rapport : 5b668ffb-47f6-11e6-8135-7427ea2adf72

Nom complet du package défaillant : Microsoft.MicrosoftEdge_25.10586.0.0_neutral__8wekyb3d8bbwe

ID de l'application relative au package défaillant : MicrosoftEdge

Error: (07/07/2016 03:58:35 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Nom de l’application défaillante LockApp.exe, version : 0.0.0.0, horodatage : 0x5632d5a5
Nom du module défaillant : combase.dll, version : 10.0.10586.103, horodatage : 0x56a849ab
Code d’exception : 0xc0000602
Décalage d’erreur : 0x000000000018d8cb
ID du processus défaillant : 0x1d58
Heure de début de l’application défaillante : 0xLockApp.exe0
Chemin d’accès de l’application défaillante : LockApp.exe1
Chemin d’accès du module défaillant: LockApp.exe2
ID de rapport : LockApp.exe3
Nom complet du package défaillant : LockApp.exe4
ID de l’application relative au package défaillant : LockApp.exe5

Error: (07/05/2016 09:10:22 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Les services de chiffrement ont échoué lors du traitement de l’appel OnIdentity() dans l’objet System Writer.

Details:
AddLegacyDriverFiles: Unable to back up image of binary Protocole LLDP (Link Layer Discovery Protocol) Microsoft.

System Error:
Accès refusé.
.

Error: (07/02/2016 09:50:14 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Acer)
Description: Échec de l’activation de l’application Microsoft.Windows.Photos_8wekyb3d8bbwe!App avec l’erreur : -2147023170 Pour plus d’informations, voir le journal Microsoft-Windows-TWinUI/Opérationnel.

Error: (06/30/2016 02:58:55 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Nom de l’application défaillante ShellExperienceHost.exe, version : 10.0.10586.306, horodatage : 0x571afaa5
Nom du module défaillant : StartUI.dll, version : 10.0.10586.306, horodatage : 0x571af976
Code d’exception : 0x80000003
Décalage d’erreur : 0x00000000002a52a3
ID du processus défaillant : 0x1408
Heure de début de l’application défaillante : 0xShellExperienceHost.exe0
Chemin d’accès de l’application défaillante : ShellExperienceHost.exe1
Chemin d’accès du module défaillant: ShellExperienceHost.exe2
ID de rapport : ShellExperienceHost.exe3
Nom complet du package défaillant : ShellExperienceHost.exe4
ID de l’application relative au package défaillant : ShellExperienceHost.exe5

Error: (06/28/2016 08:00:05 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2484) (User: Acer)
Description: Le package Microsoft.MicrosoftEdge_25.10586.0.0_neutral__8wekyb3d8bbwe+MicrosoftEdge#{43e71630-b987-4c87-826c-60787571e40f} a été interrompu, car sa suspension a été trop longue.

System errors:
=============
Error: (07/21/2016 10:18:56 AM) (Source: DCOM) (EventID: 10010) (User: AUTORITE NT)
Description: {784E29F4-5EBE-4279-9948-1E8FE941646D}

Error: (07/21/2016 10:01:28 AM) (Source: DCOM) (EventID: 10010) (User: AUTORITE NT)
Description: {784E29F4-5EBE-4279-9948-1E8FE941646D}

Error: (07/21/2016 09:46:39 AM) (Source: DCOM) (EventID: 10016) (User: AUTORITE NT)
Description: propres à l’applicationLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}AUTORITE NTSystèmeS-1-5-18LocalHost (avec LRPC)Non disponibleNon disponible

Error: (07/21/2016 09:32:02 AM) (Source: DCOM) (EventID: 10010) (User: AUTORITE NT)
Description: {784E29F4-5EBE-4279-9948-1E8FE941646D}

Error: (07/21/2016 09:29:47 AM) (Source: DCOM) (EventID: 10010) (User: AUTORITE NT)
Description: {784E29F4-5EBE-4279-9948-1E8FE941646D}

Error: (07/21/2016 09:12:08 AM) (Source: DCOM) (EventID: 10016) (User: AUTORITE NT)
Description: propres à l’applicationLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}AUTORITE NTSystèmeS-1-5-18LocalHost (avec LRPC)Non disponibleNon disponible

Error: (07/21/2016 08:05:41 AM) (Source: DCOM) (EventID: 10010) (User: Acer)
Description: CortanaUI.AppXtpp90jhw9p0njjb85kvhxpppgrqfp117.mca

Error: (07/21/2016 07:52:50 AM) (Source: DCOM) (EventID: 10010) (User: AUTORITE NT)
Description: {784E29F4-5EBE-4279-9948-1E8FE941646D}

Error: (07/21/2016 07:48:58 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Le service Garmin Device Interaction Service n’a pas pu démarrer en raison de l’erreur :
%%1053

Error: (07/21/2016 07:48:58 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Le dépassement de délai (30000 millisecondes) a été atteint lors de l’attente de la connexion du service Garmin Device Interaction Service.

Microsoft Office:
=========================

CodeIntegrity:
===================================
Date: 2016-06-20 07:56:53.696
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.

Date: 2016-06-18 03:57:44.975
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.

Date: 2016-06-17 14:40:10.909
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.

Date: 2016-06-16 11:59:56.686
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.

Date: 2016-06-07 13:50:09.594
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.

Date: 2016-05-31 13:31:28.356
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.

Date: 2016-05-31 11:41:11.195
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2016-05-31 10:16:07.132
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.

Date: 2016-05-31 10:10:10.176
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.

Date: 2016-05-31 09:39:47.902
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.

==================== Memory info ===========================

Processor: AMD E1-1200 APU with Radeon(tm) HD Graphics
Percentage of memory in use: 51%
Total physical RAM: 3800.02 MB
Available physical RAM: 1856.28 MB
Total Virtual: 4824.02 MB
Available Virtual: 2312.34 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:922.76 GB) (Free:720.45 GB) NTFS
Drive d: (DATA) (Fixed) (Total:924.01 GB) (Free:923.48 GB) NTFS

chantal11 · « **Réponse #5 le:** juillet 21, 2016, 11:32:10 »

Bonjour,

Je vais regarder les rapports, mais il est indiqué dans la procédure -> Tous les rapports doivent être hébergés sur ce site d'hébergement de fichiers et tu indiques les liens obtenus dans ta réponse -> Aide à l'utilisation

Les rapports postés sont incomplets, merci de les héberger comme indiqué et poster les liens obtenus.

D'autre part, la version FRST utilisée est obsolète.
Il faut supprimer FRST et recommencer la procédure depuis le début après avoir téléchargé la dernière version FRST.

@+

mehsmehsine · « **Réponse #6 le:** août 09, 2016, 14:58:36 »

bonjours les amis kelkun pour maidez?

chantal11 · « **Réponse #7 le:** août 09, 2016, 19:07:00 »

Bonjour,

@ mehsmehsine : Pour une prise en charge, merci d'ouvrir ton propre sujet en expliquant la nature de ton problème et en respectant les règles de politesse et la Charte du forum

Merci de ta compréhension,

@+

biccipeinture · « **Réponse #8 le:** août 29, 2016, 14:18:05 »

Bonjour Chantal , voici les rapports :

https://up.security-x.fr/file.php?h=Reace1632b3cb0076f597f0ba859125bf
https://up.security-x.fr/file.php?h=R1297331923b76aa9de689b8413b493bb

chantal11 · « **Réponse #9 le:** août 29, 2016, 16:34:21 »

Bonjour,

Il faut être plus vigilant sur ce qui est validé lors de l'installation ou la désinstallation de logiciels gratuits, bien lire les conditions d'utilisation et ne pas accepter tout ce qui est proposé avec. Il faut décocher les cases des sponsors.
Stop la pub !
Exemple sur l'Installation d'une application sponsorisée, les pièges à éviter !

Tu appliques les procédures dans l'ordre où elles sont présentées.

/!\ Les outils ne doivent être lancés qu'une seule fois afin de ne pas fausser les rapports demandés. /!\

--------------------------------------------------------------------------------------------------------------

Désinstalle via Panneau de configuration -> Désinstaller un programme (si présents) :

Adwares/Programmes indésirables :
WSE Rocket

Si un programme ne veut pas se désinstaller, tu passes au suivant.

--------------------------------------------------------------------------------------------------------------

FRST - Correctif :

Il est indiqué dans nos procédures que FRST doit être enregistré sur le Bureau.
Transfère par un couper/coller le fichier enregistré dans ton dossier Téléchargements sur ton Bureau.

Ouvre le Bloc-notes (Démarrer => Tous les programmes => Accessoires => Bloc-notes)
Copie/colle la totalité du contenu de la zone Code ci-dessous dans le Bloc-notes

Code: [Sélectionner]

start
CreateRestorePoint:
CloseProcesses:
SearchScopes: HKU\S-1-5-21-1759795422-2075537827-4017263716-1001 -> {31090377-0740-419E-BEFC-A56E50500D5B} URL =
SearchScopes: HKU\S-1-5-21-1759795422-2075537827-4017263716-1001 -> {6D23FB4D-FB77-E788-1DB8-4B44FEF34EE5} URL =
SearchScopes: HKU\S-1-5-21-1759795422-2075537827-4017263716-1001 -> {BB37CFB2-A0AA-458E-A9A2-1842FEA89F0A} URL = 
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK => non trouv?(e)
CHR StartupUrls: Default -> "hxxps://www.google.fr/","hxxp://rocket-find.com/?f=7&a=rckt_tele_14_29_ch&cd=2XzuyEtN2Y1L1QzuyByEtByB0E0AtB0A0D0FyBtBzyyB0A0AtN0D0Tzu0SzytByBtN1L2XzutBtFtBtCtFtCyEtFyEtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyDyDyDzy0BzytAyCtG0EyB0FzytG0C0FtA0AtG0A0B0AtDtGtDtD0A0F0FyE0C0D0AtDtB0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtD0DyBtByDyDtBtGtAyEtC0DtG0E0DzyzytGyD0DyBtCtGyDzy0DyB0AyDtBzz0C0FyDyC2Q&cr=719348947&ir=" 
CHR HKU\S-1-5-21-1759795422-2075537827-4017263716-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [bakijjialdiiboeaknfpmflphhmljfkd] - hxxps://clients2.google.com/service/update2/crx 
EmptyTemp:
end

Enregistre le fichier sur ton Bureau (au même endroit que FRST) sous le nom fixlist.txt
Ferme toutes les applications, y compris ton navigateur
Double-clique sur FRST64.exe
/!\ Sous Vista, Windows 7, 8 et 10, il faut lancer le fichier par clic-droit -> Exécuter en tant qu'administrateur
Sur le menu principal, clique une seule fois sur Corriger et patiente le temps de la correction
Accepte le redémarrage du système si demandé
L'outil va créer un rapport de correction Fixlog.txt. Poste ce rapport dans ta réponse.

/!\ Ce script a été établi pour cet utilisateur, il ne doit, en aucun cas, être appliqué sur un autre système, au risque de provoquer de graves dysfonctionnements et endommager Windows /!\

--------------------------------------------------------------------------------------------------------------

AdwCleaner - Analyser :

Télécharge AdwCleaner de Xplode et enregistre le fichier sur ton Bureau
Patiente le temps que ton navigateur te propose le téléchargement à enregistrer, sans cliquer nulle part, surtout pas sur les sponsors de la page
Ferme toutes les applications, y compris ton navigateur
Double-clique sur l'icône AdwCleaner.exe pour lancer l'outil
/!\ Sous Vista, Windows 7, 8 et 10, il faut lancer le fichier par clic-droit -> Exécuter en tant qu'administrateur
Sur le menu principal, clique sur Analyser
Les éléments détectés s'affichent dans les différents onglets. Clique sur Rapport
Un rapport AdwCleaner(Sx).txt s'ouvre. Poste ce rapport dans ta prochaine réponse
Le rapport se trouve sous C:\AdwCleaner\AdwCleaner(Sx).txt (ou C:\Program Files (x86)\AdwCleaner)

Sous Internet Explorer et Edge, le filtre SmartScreen peut déclencher une alerte. Cliquer sur Actions ou Informations complémentaires puis sur Exécuter quand même

Si ton antivirus émet une alerte ou bloque l'outil, il faut le désactiver temporairement (le fichier AdwCleaner.exe est sûr)

Tutoriel d'utilisation AdwCleaner en images

--------------------------------------------------------------------------------------------------------------

Sont attendus les rapports
Fixlog
AdwCleaner-Analyser

@+

biccipeinture · « **Réponse #10 le:** août 29, 2016, 18:56:06 »

Voici les rapports :

adw:https://up.security-x.fr/file.php?h=R648b0a19da156edf5efca9c8a340273f
fixlog:https://up.security-x.fr/file.php?h=Racff5b173e25d218e046f24ea1cbae51

chantal11 · « **Réponse #11 le:** août 29, 2016, 19:17:16 »

Re,

OK, nous continuons le nettoyage.

--------------------------------------------------------------------------------------------------------------

AdwCleaner - Nettoyer :

Ferme toutes les applications, y compris ton navigateur
Double-clique sur l'icône AdwCleaner.exe pour lancer l'outil
/!\ Sous Vista, Windows 7, 8 et 10, il faut lancer le fichier par clic-droit -> Exécuter en tant qu'administrateur
Sur le menu principal, clique sur Analyser
Les éléments détectés s'affichent dans les différents onglets. Clique sur Nettoyer et valide par OK la fermeture des programmes
Patiente le temps de l'analyse et valide le message d'informations
Un redémarrage est demandé, valider par OK
Au redémarrage, un rapport AdwCleaner(Cx).txt s'ouvre. Poste ce rapport dans ta prochaine réponse
Le rapport se trouve sous C:\AdwCleaner\AdwCleaner(Sx).txt (ou C:\Program Files (x86)\AdwCleaner)

Sous Internet Explorer et Edge, le filtre SmartScreen peut déclencher une alerte. Cliquer sur Actions ou Informations complémentaires puis sur Exécuter quand même

Si ton antivirus émet une alerte ou bloque l'outil, il faut le désactiver temporairement (le fichier AdwCleaner.exe est sûr)

Tutoriel d'utilisation AdwCleaner en images

En cas de perte de connexion internet après le passage de l'outil, appliquer une de ces procédures Perte de connexion internet après l'utilisation d'un outil[/url]

--------------------------------------------------------------------------------------------------------------

Malwarebytes Anti-Malware :

Télécharge Malwarebytes Anti-Malware (version gratuite) et enregistre le sur le Bureau
Double-clique sur le fichier mbam-setup.exe pour lancer l'installation
/!\ Sous Vista, Windows 7, 8 et 10, il faut lancer le fichier par clic-droit -> Exécuter en tant qu'administrateur
A la fin de l'installation, décoche l'option "Activer l'essai gratuit de Malwarebytes Anti-Malware Premium". La case Exécuter Malwarebytes Anti-Malware reste cochée.
Clique sur Terminer. Malwarebyte's s'ouvre
Pour mettre en français si ce n'est pas le cas, dans Settings, puis General Settings, dans Language, sélectionne French
Dans Version de la base de données, clique sur le lien Mettre à jour pour installer les mises à jour et laisse l'outil les installer
Dans Paramètres, puis Détection et protection, sélectionne Traiter les détections comme des malveillants pour les détections PUP et PUM
Dans Analyse, clique sur Analyse des Menaces puis clique sur Lancer l'analyse
Si l'outil te propose d'autres mises à jour, valide en cliquant sur Mettre à jour maintenant
Patiente le temps de l'analyse
Pour supprimer les éléments détectés, veille à ce que tous les éléments détectés soient cochés puis clique sur Supprimer la sélection
Si un redémarrage est demandé, clique sur Oui
Au redémarrage, relance Malwarebytes
Dans Historique, clique sur Journaux de l'application
Double-clique sur le Journal d'analyse le plus récent, le journal d'examen s'affiche
Clique sur Exporter puis sur Fichier texte (*.txt)
Enregistre le rapport sur ton Bureau. Poste ce rapport dans ta prochaine réponse

Le journal d'examen est aussi enregistré sous C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\Logs[/list]

Tutoriel d'utilisation Malwarebytes en images

--------------------------------------------------------------------------------------------------------------

Sont attendus les rapports
AdwCleaner-Nettoyer
Malwarebytes

Comment se comporte le système maintenant par rapport aux symptômes signalés au début ?

@+

biccipeinture · « **Réponse #12 le:** août 30, 2016, 10:10:49 »

rapports adw :https://up.security-x.fr/file.php?h=R8a1d7bf1b70192970b564984c4db8efb
rapports mlw :https://up.security-x.fr/file.php?h=Rfe2d95fd3cc72494dd42fc01472d56e5

chantal11 · « **Réponse #13 le:** août 30, 2016, 13:47:57 »

Bonjour,

OK pour les rapports.

Comment se comporte le système maintenant ?

@+

biccipeinture · « **Réponse #14 le:** août 31, 2016, 10:05:38 »

le système réponds mieux !

chantal11 · « **Réponse #15 le:** août 31, 2016, 13:19:16 »

Bonjour,

OK, nous pouvons donc finaliser la procédure.

---------------------------------------------------------------------------------------------

DelFix :

Télécharge DelFix de Xplode et enregistre le fichier sur ton Bureau
Double-clique sur l'icône Delfix.exe pour lancer l'outil
/!\ Sous Vista, Windows 7 et 8, il faut lancer le fichier par clic-droit -> Exécuter en tant qu'administrateur
Sur le menu principal, coche uniquement les options

- Supprimer les outils de désinfection
- Purger la restauration système

Clique ensuite sur Exécuter et laisse l'outil travailler
Un rapport DelFix.txt s'ouvre. Poste ce rapport dans ta prochaine réponse
Le rapport se trouve sous C:\DelFix.txt

---------------------------------------------------------------------------------------------

Quelques précisions et conseils :

D'une manière générale, il faut être prudent sur le net et ne pas cliquer sur tout ce qui paraît attrayant.

/!\ Toujours privilégier le téléchargement d'une application sur le site de l'éditeur

/!\ Bien lire les accords de licence avant toute installlation, des études ont montré que La France est championne du monde de malwares !

/!\ Etre vigilant au moment de l'installation d'une application, Stop la pub !
Installation d'une application sponsorisée, les pièges à éviter !

/!\ Sauvegarder régulièrement les données personnelles sur un support externe

/!\ Ne jamais ouvrir une pièce-jointe dans un mail d'un expéditeur inconnu

Maintenir son antivrus à jour et analyser le système régulièrement, avec en parallèle un scan avec Malwarebytes
Tenir son système à jour, au niveau des mises à jour Windows Update, sans oublier les logiciels installés.
Vérifier aussi d'avoir toujours la dernière version de Java et Flash Player
Il faut mettre à jour Flash Player sous chaque navigateur présent sur le système
Penser à décocher les options proposées en même temps que Java et Flash Player (Barre Google, Scan McAfee ....)
SX Check&Update - Vérifier et mettre à jour facilement les logiciels à risque ou son système
Au niveau de Firefox et Chrome, tu peux sécuriser ta navigation

/!\ Une attitude responsable sur le net est la meilleure protection pour ton système
Eviter les comportements à risques (cracks/keygens, P2P, streaming illégal, pornographie, etc.)

N'hésite pas si tu as des questions.

Pour en savoir plus, clique sur l'image pour télécharger ce PDF

-------------------------------------------------------------------------------------------

Pour mieux comprendre comment tu as infecté ton système avec des adwares que tu as toi-même validés et pour éviter ce type de piège lors de l'installation d'une application gratuite, fais un test avec cet utilitaire qui va simuler une installation "pourrie" :

Télécharge Adware Prevention de guigui0001 sur ton bureau.
Attention : en raison de la jeunesse du logiciel, ton navigateur ou ton antivirus peuvent le détecter à tort comme une menace ; ignore ces avertissements.
Lance-le en double-cliquant dessus (sous Windows 8, à l'activation de la protection SmartScreen, il faut cliquer sur Informations Complémentaires > Exécuter quand même)
Cet outil va simuler une installation bourrée d'adwares. Fais alors en sorte, tout au long de la pseudo-installation, de ne pas te faire piéger en étant vigilant.
A la fin de cette fausse installation, l'outil fait un bilan de tes décisions. Suis attentivement les conseils qu'il te donne.
Adopte alors la même vigilance lors de tes futures installations, qui seront réelles cette fois-ci !

Tutoriel en images

Bon entraînement :)

biccipeinture · « **Réponse #16 le:** août 31, 2016, 17:12:27 »

voici le rapport : https://up.security-x.fr/file.php?h=R839f220c91034baa270564e86b848dd9
par contre je ne trouve pas windows update ? ni dans explorer .. ( outils , windows update )

chantal11 · « **Réponse #17 le:** août 31, 2016, 18:04:17 »

Re,

OK pour le rapport Delfix.

Citer

par contre je ne trouve pas windows update ?

Sous Windows 10, il faut passer par Paramètres -> Mise à jour et Sécurité

@+

biccipeinture · « **Réponse #18 le:** septembre 02, 2016, 08:10:26 »

c'est bon ! merci chantal A +

chantal11 · « **Réponse #19 le:** septembre 02, 2016, 11:32:35 »

Bonne continuation .... et prudence sur le net