WindowsMangerProtect20.0.0.1064

HKCU\Software
HKCU\Software\AppDataLow /s
HKLM\Software
HKCU\Software\Microsoft\Command Processor /s
HKLM\Software\Microsoft\Command Processor /s
HKLM\Software\Microsoft\Windows\CurrentVersion\RunMRU /s
HKLM\System\CurrentControlSet\Control\Session Manager\AppcertDlls /s
%Homedrive%\*
%Homedrive%\*.
%Homedrive%\Recycler\*.exe /s
%Homedrive%\Recycler\*.scr /s
%Homedrive%\Recycler\*.pif /s
%Homedrive%\Recycler\*.vb* /s
%Homedrive%\$Recycle.bin\*.exe /s
%Homedrive%\$Recycle.bin\*.scr /s
%Homedrive%\$Recycle.bin\*.pif /s
%Homedrive%\$Recycle.bin\*.vb* /s
%Userprofile%\*
%Userprofile%\*.
%Allusersprofile%\*
%Allusersprofile%\*.
%LocalAppData%\*
%LocalAppData%\*.
%Userprofile%\Local Settings\*
%Userprofile%\Local Settings\*.
%Userprofile%\Local Settings\Application Data\*
%Userprofile%\Local Settings\Application Data\*.
%Userprofile%\AppData\Local\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*
%Userprofile%\AppData\Local\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*.
%Userprofile%\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*
%Userprofile%\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*.
%programFiles%\*
%programFiles%\*.
%programfiles%\Google\Desktop\*.
%ProgramFiles%\Common Files\*.
%ProgramFiles(X86)%\Common Files\*.
%Systemroot%\Installer\*.
%Systemroot%\Temp\*.exe /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\system32\*.exe /lockedfiles
%systemroot%\system32\*.in*
%systemroot%\PSS\* /s
%systemroot%\Tasks\*
%systemroot%\Tasks\*.
%systemroot%\system32\Tasks\*
%systemroot%\system32\Tasks\*.
%systemroot%\syswow64\Tasks\*
%systemroot%\syswow64\Tasks\*.
%systemroot%\system32\drivers\*.sy* /lockedfiles
%systemroot%\system32\config\*.exe /s
%Systemroot%\ServiceProfiles\*.exe /s
%systemroot%\system32\*.sys
dir %Homedrive%\* /S /A:L /C
msconfig
activex
/md5start
explorer.exe
winlogon.exe
wininit.exe
volsnap.sys
atapi.sys
ndis.sys
cdrom.sys
i8042prt.sys
iastor.sys
tdx.sys
netbt.sys
afd.sys
/md5stop
netsvcs
safebootminimal
safebootnetwork
CREATERESTOREPOINT

:OTL 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <-loopback>
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:49836;https=127.0.0.1:49836
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <-loopback>
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:49836;https=127.0.0.1:49836
IE - HKU\S-1-5-21-789589277-308726861-1305394003-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <-loopback>
CHR - homepage: https://www.trovi.com/?gd=&ctid=CT3332201&octid=EB_ORIGINAL_CTID&ISID=MFFEC4379-B0F8-4FB9-AD71-309F942FA861&SearchSource=55&CUI=&UM=6&UP=SPCBF6E0EC-0B25-417E-AEDB-17E8A8E3712C&SSPV=&SSPV=
C:\ProgramData\{01BD4FC9-2F86-4706-A62E-774BB7E9D308}

:files
%Temp%\*.*

:Commands 
[emptytemp] 
[emptyflash] 
[reboot]

Script ZHPFix
O23 - Service: Service Google Update (gupdate) (gupdate) . (...) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe (.not file.)
O23 - Service: SmdmF Service2 (SmdmFService2) . (...) - C:\Program Files (x86)\Settings Manager\smdmf\SmdmfService.exe (.not file.)  =>PUP.SystemK
[MD5.00000000000000000000000000000000] [APT] [GoogleUpdateTaskMachineCore] (...) -- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe (.not file.)   [0]
[MD5.00000000000000000000000000000000] [APT] [GoogleUpdateTaskMachineUA] (...) -- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe (.not file.)   [0]
[MD5.00000000000000000000000000000000] [APT] [{DAA1AFC2-835C-4495-BAEA-ED420A8174F8}] (...) -- C:\Users\Utilisateur\AppData\Roaming\webssearches\UninstallManager.exe (.not file.)   [0]  =>Hijacker.WebsSearches
[HKLM\SYSTEM\CurrentControlSet\Services\SmdmFService2]   =>PUP.SystemK^
C:\Program Files (x86)\Software   =>Adware.Boxore
C:\Users\Utilisateur\AppData\Local\Software   =>Adware.Boxore
[HKLM\Software\Wow6432Node\SPPDCOM]   =>Rogue.PCSpeedUp^
EmptyTemp
EmptyFlash
EMPTYCLSID