user75
Posts: 113 +0
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 08.11.2018
Ran by guillaume (administrator) on TEST (08-11-2018 20:26:09)
Running from D:\DownloadSSD
Loaded Profiles: guillaume (Available Profiles: guillaume)
Platform: Windows 8.1 (Update) (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-
recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Dropbox, Inc.) C:\Windows\System32\DbxSvc.exe
(Hi-Rez Studios) D:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
() C:\SteamLibrary\steamapps\common\wallpaper_engine\bin\wallpaperservice32_c.exe
(Toshiba Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(ExKode Co. Ltd.) C:\Program Files (x86)\ExKode\Dxtory2.0\Dxtory.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\SteamLibrary\steamapps\common\wallpaper_engine\wallpaper32.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
() C:\Windows\System32\igfxTray.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Druide informatique inc.) D:\DownloadSSD\antidote\Application\Bin32\AgentAntidote.exe
(Druide informatique inc.) D:\DownloadSSD\antidote\Application\Bin64\AgentAntidote.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe
(Greenshot) C:\Program Files\Greenshot\Greenshot.exe
(Pushbullet Inc) C:\Users\guillaume\AppData\Local\Pushbullet\bin\pushbullet_client.exe
(Apowersoft) D:\program ssd\dsadsa\Apowersoft Screen Recorder Pro 2\Apowersoft Screen Recorder Pro 2.exe
(Discord Inc.) C:\Users\guillaume\AppData\Local\Discord\app-0.0.301\Discord.exe
(Spotify Ltd) C:\Users\guillaume\AppData\Roaming\Spotify\Spotify.exe
(Spotify Ltd) C:\Users\guillaume\AppData\Roaming\Spotify\Spotify.exe
(Discord Inc.) C:\Users\guillaume\AppData\Local\Discord\app-0.0.301\Discord.exe
(Spotify Ltd) C:\Users\guillaume\AppData\Roaming\Spotify\Spotify.exe
(Mozilla Corporation) D:\program ssd\thunderbird\thunderbird.exe
(Spotify Ltd) C:\Users\guillaume\AppData\Roaming\Spotify\Spotify.exe
(SteelSeries ApS) C:\Program Files\SteelSeries\SteelSeries Engine 3\SteelSeriesEngine3.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe
(TOSHIBA) C:\Program Files\TOSHIBA\TOSHIBA Smart View Utility\TDUSrv64.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
(Mega Limited) C:\Users\guillaume\AppData\Local\MEGAsync\MEGAsync.exe
(Elaborate Bytes AG) D:\program ssd\iso\VirtualCloneDrive\VCDDaemon.exe
(Code Systems Corporation) C:\Users\guillaume\AppData\Local\Turbo\18.10.1788.0\Turbo-Sandbox.exe
(Corsair Components, Inc.) C:\Program Files (x86)\Corsair\Corsair Gaming Headset Software\HeadsetControlPanel.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Code Systems Corporation) C:\Users\guillaume\AppData\Local\Turbo\18.10.1788.0\Turbo-Launcher.exe
(Discord Inc.) C:\Users\guillaume\AppData\Local\Discord\app-0.0.301\Discord.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(ExKode Co. Ltd.) C:\Program Files (x86)\ExKode\Dxtory2.0\Dxtory64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe
(Valve Corporation) D:\program ssd\steam\Steam.exe
(Valve Corporation) D:\program ssd\steam\bin\cef\cef.win7\steamwebhelper.exe
(Valve Corporation) D:\program ssd\steam\bin\cef\cef.win7\steamwebhelper.exe
(Valve Corporation) D:\program ssd\steam\bin\cef\cef.win7\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Valve Corporation) D:\program ssd\steam\bin\cef\cef.win7\steamwebhelper.exe
(Valve Corporation) D:\program ssd\steam\bin\cef\cef.win7\steamwebhelper.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Farbar) D:\DownloadSSD\FRST64 (1).exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be
moved.)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [IgfxTray] => C:\Windows\system32\igfxtray.exe [400800 2018-04-20] ()
HKLM\...\Run: [HotKeysCmds] => "C:\Windows\system32\hkcmd.exe"
HKLM\...\Run: [Persistence] => "C:\Windows\system32\igfxpers.exe"
HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2556768 2013-10-08] (TOSHIBA Corporation)
HKLM\...\Run: [TecoResident] => C:\Program Files\TOSHIBA\Teco\TecoResident.exe [179288 2014-01-04] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [354144 2013-08-13] (TOSHIBA Corporation)
HKLM\...\Run: [TSSSrv] => C:\Program Files (x86)\TOSHIBA\System Setting\TSSSrv.exe [296008 2013-10-21] (TOSHIBA
Corporation)
HKLM\...\Run: [AgentAntidote32] => D:\DownloadSSD\antidote\Application\Bin32\AgentAntidote.exe [1653352 2017-09-12]
(Druide informatique inc.)
HKLM\...\Run: [AgentAntidote64] => D:\DownloadSSD\antidote\Application\Bin64\AgentAntidote.exe [1797736 2017-09-12]
(Druide informatique inc.)
HKLM\...\Run: [Greenshot] => C:\Program Files\Greenshot\Greenshot.exe [527792 2017-08-09] (Greenshot)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe
[500936 2015-04-28] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [KeNotify] => C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe [34160 2013-08-05] (TOSHIBA
CORPORATION)
HKLM-x32\...\Run: [TSVU] => c:\Program Files\TOSHIBA\TOSHIBA Smart View Utility\TosSmartViewLauncher.exe [516512 2013-07-
23] (TOSHIBA)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [3785536 2018-11-06] (Dropbox, Inc.)
HKLM-x32\...\Run: [VirtualCloneDrive] => D:\program ssd\iso\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate
Bytes AG)
HKLM-x32\...\Run: [Corsair Gaming Headset Software] => C:\Program Files (x86)\Corsair\Corsair Gaming Headset Software
\HeadsetControlPanel.exe [2916160 2015-09-21] (Corsair Components, Inc.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [601424 2018-
10-06] (Oracle Corporation)
Winlogon\Notify\igfxcui: igfxdev.dll [X]
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-3805808772-3452688692-1920293510-1001\...\Run: [Pushbullet] => D:\program ssd\psuhbullet\Pushbullet
\pushbullet.exe [345600 2015-07-01] (Pushbullet inc)
HKU\S-1-5-21-3805808772-3452688692-1920293510-1001\...\Run: [Dxtory Update Checker 2.0] => C:\Program Files (x86)\ExKode
\Dxtory2.0\UpdateChecker.exe [93696 2010-10-17] (Dxtory Software)
HKU\S-1-5-21-3805808772-3452688692-1920293510-1001\...\Run: [yyZxbkrUTU] => C:\Users\guillaume\AppData\Local\tdVNwznfWA
\activate.exe [413136 2018-08-31] (Microsoft Corporation)
HKU\S-1-5-21-3805808772-3452688692-1920293510-1001\...\Run: [ApowersoftScreenRecorder] => D:\program ssd\dsadsa\Apowersoft
Screen Recorder Pro 2\Apowersoft Screen Recorder Pro 2.exe [3617944 2017-02-07] (Apowersoft)
HKU\S-1-5-21-3805808772-3452688692-1920293510-1001\...\Run: [VoiceAttack] => C:\SteamLibrary\steamapps\common\VoiceAttack
\VoiceAttack.exe [5744120 2018-10-30] (VoiceAttack.com)
HKU\S-1-5-21-3805808772-3452688692-1920293510-1001\...\Run: [Spotify] => C:\Users\guillaume\AppData\Roaming\Spotify
\Spotify.exe [25162472 2018-10-22] (Spotify Ltd)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SteelSeries Engine 3.lnk [2018-10-24]
ShortcutTarget: SteelSeries Engine 3.lnk -> C:\Program Files\SteelSeries\SteelSeries Engine 3\SteelSeriesEngine3.exe
(SteelSeries ApS)
Startup: C:\Users\guillaume\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MEGAsync.lnk [2018-06-30]
ShortcutTarget: MEGAsync.lnk -> C:\Users\guillaume\AppData\Local\MEGAsync\MEGAsync.exe (Mega Limited)
Startup: C:\Users\guillaume\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Turbo Sandbox Manager.lnk [2018
-10-11]
ShortcutTarget: Turbo Sandbox Manager.lnk -> C:\Users\guillaume\AppData\Local\Turbo\18.10.1788.0\Turbo-Sandbox.exe (Code
Systems Corporation)
Startup: C:\Users\guillaume\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TurboLauncher.lnk [2018-10-11]
ShortcutTarget: TurboLauncher.lnk -> C:\Users\guillaume\AppData\Local\Turbo\18.10.1788.0\Turbo-Launcher.exe (Code Systems
Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Winsock: Catalog5 01 C:\Windows\SysWOW64\PrxerNsp.dll [56424 2012-11-22] ()
Winsock: Catalog5-x64 01 C:\Windows\system32\PrxerNsp.dll [57448 2012-11-22] ()
Tcpip\Parameters: [DhcpNameServer] 8.8.8.8 8.8.4.4
Tcpip\..\Interfaces\{36D2171C-A57F-46B4-B995-D6E62D4F80F7}: [DhcpNameServer] 8.8.8.8 8.8.4.4
Tcpip\..\Interfaces\{F456A0CD-13F2-4BD0-8E4A-B58889CF8AA9}: [DhcpNameServer] 10.12.12.3 192.168.4.3 192.168.4.5
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3805808772-3452688692-1920293510-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages =
hxxp://www.toshiba.ca/welcome/?w=23
SearchScopes: HKU\S-1-5-21-3805808772-3452688692-1920293510-1001 -> {F4ED0519-C584-4DDA-BE93-FA0B93D040F6} URL =
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office
\Office16\OCHelper.dll [2018-05-15] (Microsoft Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files
\Microsoft Office\Office16\GROOVEEX.DLL [2018-05-15] (Microsoft Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft
Office\Office16\OCHelper.dll [2018-05-15] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java
\jre1.8.0_191\bin\ssv.dll [2018-10-17] (Oracle Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files
(x86)\Microsoft Office\Office16\GROOVEEX.DLL [2018-05-15] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java
\jre1.8.0_191\bin\jp2ssv.dll [2018-10-17] (Oracle Corporation)
Handler: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files\Microsoft Office\Office16\MSOSB.DLL
[2018-05-15] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files (x86)\Microsoft Office
\Office16\MSOSB.DLL [2018-05-15] (Microsoft Corporation)
Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\Office16\MSOSB.DLL [2018-05-
15] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL
[2018-05-15] (Microsoft Corporation)
Ran by guillaume (administrator) on TEST (08-11-2018 20:26:09)
Running from D:\DownloadSSD
Loaded Profiles: guillaume (Available Profiles: guillaume)
Platform: Windows 8.1 (Update) (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-
recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Dropbox, Inc.) C:\Windows\System32\DbxSvc.exe
(Hi-Rez Studios) D:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
() C:\SteamLibrary\steamapps\common\wallpaper_engine\bin\wallpaperservice32_c.exe
(Toshiba Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(ExKode Co. Ltd.) C:\Program Files (x86)\ExKode\Dxtory2.0\Dxtory.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\SteamLibrary\steamapps\common\wallpaper_engine\wallpaper32.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
() C:\Windows\System32\igfxTray.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Druide informatique inc.) D:\DownloadSSD\antidote\Application\Bin32\AgentAntidote.exe
(Druide informatique inc.) D:\DownloadSSD\antidote\Application\Bin64\AgentAntidote.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe
(Greenshot) C:\Program Files\Greenshot\Greenshot.exe
(Pushbullet Inc) C:\Users\guillaume\AppData\Local\Pushbullet\bin\pushbullet_client.exe
(Apowersoft) D:\program ssd\dsadsa\Apowersoft Screen Recorder Pro 2\Apowersoft Screen Recorder Pro 2.exe
(Discord Inc.) C:\Users\guillaume\AppData\Local\Discord\app-0.0.301\Discord.exe
(Spotify Ltd) C:\Users\guillaume\AppData\Roaming\Spotify\Spotify.exe
(Spotify Ltd) C:\Users\guillaume\AppData\Roaming\Spotify\Spotify.exe
(Discord Inc.) C:\Users\guillaume\AppData\Local\Discord\app-0.0.301\Discord.exe
(Spotify Ltd) C:\Users\guillaume\AppData\Roaming\Spotify\Spotify.exe
(Mozilla Corporation) D:\program ssd\thunderbird\thunderbird.exe
(Spotify Ltd) C:\Users\guillaume\AppData\Roaming\Spotify\Spotify.exe
(SteelSeries ApS) C:\Program Files\SteelSeries\SteelSeries Engine 3\SteelSeriesEngine3.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe
(TOSHIBA) C:\Program Files\TOSHIBA\TOSHIBA Smart View Utility\TDUSrv64.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
(Mega Limited) C:\Users\guillaume\AppData\Local\MEGAsync\MEGAsync.exe
(Elaborate Bytes AG) D:\program ssd\iso\VirtualCloneDrive\VCDDaemon.exe
(Code Systems Corporation) C:\Users\guillaume\AppData\Local\Turbo\18.10.1788.0\Turbo-Sandbox.exe
(Corsair Components, Inc.) C:\Program Files (x86)\Corsair\Corsair Gaming Headset Software\HeadsetControlPanel.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Code Systems Corporation) C:\Users\guillaume\AppData\Local\Turbo\18.10.1788.0\Turbo-Launcher.exe
(Discord Inc.) C:\Users\guillaume\AppData\Local\Discord\app-0.0.301\Discord.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(ExKode Co. Ltd.) C:\Program Files (x86)\ExKode\Dxtory2.0\Dxtory64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe
(Valve Corporation) D:\program ssd\steam\Steam.exe
(Valve Corporation) D:\program ssd\steam\bin\cef\cef.win7\steamwebhelper.exe
(Valve Corporation) D:\program ssd\steam\bin\cef\cef.win7\steamwebhelper.exe
(Valve Corporation) D:\program ssd\steam\bin\cef\cef.win7\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Valve Corporation) D:\program ssd\steam\bin\cef\cef.win7\steamwebhelper.exe
(Valve Corporation) D:\program ssd\steam\bin\cef\cef.win7\steamwebhelper.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Farbar) D:\DownloadSSD\FRST64 (1).exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be
moved.)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [IgfxTray] => C:\Windows\system32\igfxtray.exe [400800 2018-04-20] ()
HKLM\...\Run: [HotKeysCmds] => "C:\Windows\system32\hkcmd.exe"
HKLM\...\Run: [Persistence] => "C:\Windows\system32\igfxpers.exe"
HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2556768 2013-10-08] (TOSHIBA Corporation)
HKLM\...\Run: [TecoResident] => C:\Program Files\TOSHIBA\Teco\TecoResident.exe [179288 2014-01-04] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [354144 2013-08-13] (TOSHIBA Corporation)
HKLM\...\Run: [TSSSrv] => C:\Program Files (x86)\TOSHIBA\System Setting\TSSSrv.exe [296008 2013-10-21] (TOSHIBA
Corporation)
HKLM\...\Run: [AgentAntidote32] => D:\DownloadSSD\antidote\Application\Bin32\AgentAntidote.exe [1653352 2017-09-12]
(Druide informatique inc.)
HKLM\...\Run: [AgentAntidote64] => D:\DownloadSSD\antidote\Application\Bin64\AgentAntidote.exe [1797736 2017-09-12]
(Druide informatique inc.)
HKLM\...\Run: [Greenshot] => C:\Program Files\Greenshot\Greenshot.exe [527792 2017-08-09] (Greenshot)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe
[500936 2015-04-28] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [KeNotify] => C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe [34160 2013-08-05] (TOSHIBA
CORPORATION)
HKLM-x32\...\Run: [TSVU] => c:\Program Files\TOSHIBA\TOSHIBA Smart View Utility\TosSmartViewLauncher.exe [516512 2013-07-
23] (TOSHIBA)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [3785536 2018-11-06] (Dropbox, Inc.)
HKLM-x32\...\Run: [VirtualCloneDrive] => D:\program ssd\iso\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate
Bytes AG)
HKLM-x32\...\Run: [Corsair Gaming Headset Software] => C:\Program Files (x86)\Corsair\Corsair Gaming Headset Software
\HeadsetControlPanel.exe [2916160 2015-09-21] (Corsair Components, Inc.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [601424 2018-
10-06] (Oracle Corporation)
Winlogon\Notify\igfxcui: igfxdev.dll [X]
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-3805808772-3452688692-1920293510-1001\...\Run: [Pushbullet] => D:\program ssd\psuhbullet\Pushbullet
\pushbullet.exe [345600 2015-07-01] (Pushbullet inc)
HKU\S-1-5-21-3805808772-3452688692-1920293510-1001\...\Run: [Dxtory Update Checker 2.0] => C:\Program Files (x86)\ExKode
\Dxtory2.0\UpdateChecker.exe [93696 2010-10-17] (Dxtory Software)
HKU\S-1-5-21-3805808772-3452688692-1920293510-1001\...\Run: [yyZxbkrUTU] => C:\Users\guillaume\AppData\Local\tdVNwznfWA
\activate.exe [413136 2018-08-31] (Microsoft Corporation)
HKU\S-1-5-21-3805808772-3452688692-1920293510-1001\...\Run: [ApowersoftScreenRecorder] => D:\program ssd\dsadsa\Apowersoft
Screen Recorder Pro 2\Apowersoft Screen Recorder Pro 2.exe [3617944 2017-02-07] (Apowersoft)
HKU\S-1-5-21-3805808772-3452688692-1920293510-1001\...\Run: [VoiceAttack] => C:\SteamLibrary\steamapps\common\VoiceAttack
\VoiceAttack.exe [5744120 2018-10-30] (VoiceAttack.com)
HKU\S-1-5-21-3805808772-3452688692-1920293510-1001\...\Run: [Spotify] => C:\Users\guillaume\AppData\Roaming\Spotify
\Spotify.exe [25162472 2018-10-22] (Spotify Ltd)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SteelSeries Engine 3.lnk [2018-10-24]
ShortcutTarget: SteelSeries Engine 3.lnk -> C:\Program Files\SteelSeries\SteelSeries Engine 3\SteelSeriesEngine3.exe
(SteelSeries ApS)
Startup: C:\Users\guillaume\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MEGAsync.lnk [2018-06-30]
ShortcutTarget: MEGAsync.lnk -> C:\Users\guillaume\AppData\Local\MEGAsync\MEGAsync.exe (Mega Limited)
Startup: C:\Users\guillaume\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Turbo Sandbox Manager.lnk [2018
-10-11]
ShortcutTarget: Turbo Sandbox Manager.lnk -> C:\Users\guillaume\AppData\Local\Turbo\18.10.1788.0\Turbo-Sandbox.exe (Code
Systems Corporation)
Startup: C:\Users\guillaume\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TurboLauncher.lnk [2018-10-11]
ShortcutTarget: TurboLauncher.lnk -> C:\Users\guillaume\AppData\Local\Turbo\18.10.1788.0\Turbo-Launcher.exe (Code Systems
Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Winsock: Catalog5 01 C:\Windows\SysWOW64\PrxerNsp.dll [56424 2012-11-22] ()
Winsock: Catalog5-x64 01 C:\Windows\system32\PrxerNsp.dll [57448 2012-11-22] ()
Tcpip\Parameters: [DhcpNameServer] 8.8.8.8 8.8.4.4
Tcpip\..\Interfaces\{36D2171C-A57F-46B4-B995-D6E62D4F80F7}: [DhcpNameServer] 8.8.8.8 8.8.4.4
Tcpip\..\Interfaces\{F456A0CD-13F2-4BD0-8E4A-B58889CF8AA9}: [DhcpNameServer] 10.12.12.3 192.168.4.3 192.168.4.5
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3805808772-3452688692-1920293510-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages =
hxxp://www.toshiba.ca/welcome/?w=23
SearchScopes: HKU\S-1-5-21-3805808772-3452688692-1920293510-1001 -> {F4ED0519-C584-4DDA-BE93-FA0B93D040F6} URL =
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office
\Office16\OCHelper.dll [2018-05-15] (Microsoft Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files
\Microsoft Office\Office16\GROOVEEX.DLL [2018-05-15] (Microsoft Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft
Office\Office16\OCHelper.dll [2018-05-15] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java
\jre1.8.0_191\bin\ssv.dll [2018-10-17] (Oracle Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files
(x86)\Microsoft Office\Office16\GROOVEEX.DLL [2018-05-15] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java
\jre1.8.0_191\bin\jp2ssv.dll [2018-10-17] (Oracle Corporation)
Handler: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files\Microsoft Office\Office16\MSOSB.DLL
[2018-05-15] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files (x86)\Microsoft Office
\Office16\MSOSB.DLL [2018-05-15] (Microsoft Corporation)
Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\Office16\MSOSB.DLL [2018-05-
15] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL
[2018-05-15] (Microsoft Corporation)