Start:: CreateRestorePoint EmptyCLSID EmptyFlash EmptyTracing EmptyPrefetch HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run]:McAfeeSafeConnect [HKEY_USERS\S-1-5-21-4050157430-2832638794-3304664986-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run]:McAfeeSafeConnect [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder]:McAfee Security Scan Plus.lnk =>.McAfee Inc. [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder]:McAfee Security Scan Plus.lnk =>.McAfee Inc. HKLM\SOFTWARE\McAfee.com =>.McAfee Inc. HKLM\SOFTWARE\WOW6432Node\McAfee NGI =>.McAfee Inc. HKU\.DEFAULT\SOFTWARE\McAfee =>.McAfee Inc. O4 - HKUS\S-1-5-21-4050157430-2832638794-3304664986-1001\..\Run: [HP ENVY 5540 series (NET)] . (. - .) -- 1. =>.SUP.Orphan O4 - HKCU\..\Run: [HP ENVY 5540 series (NET)] . (. - .) -- 1. =>.SUP.Orphan O38 - TASK: {A5E305FB-5940-4C28-9830-6130450EA9A5} [64Bits][\Avast Software\Overseer] - (.AVAST Software - Avast Overseer.) -- C:\Program Files\Common Files\AVAST Software\Overseer\overseer.exe [1873288] =>.AVAST Software C:\WINDOWS\System32\Tasks\Avast Software\Overseer - (.AVAST Software.) -- C:\Program Files\Common Files\AVAST Software\Overseer\overseer.exe [/from_scheduler:1] =>.AVAST Software [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run]:AvastUI.exe =>.Avast Software s.r.o [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run32]:AvastUI.exe =>.Avast Software s.r.o HKLM\SOFTWARE\AVAST Software =>.AVAST Software HKCU\SOFTWARE\AvastAdSDK =>.Avast Software s.r.o HKCU\SOFTWARE\Browser Cleanup =>.Avast Software s.r.o U\.DEFAULT\SOFTWARE\Browser Cleanup =>.Avast Software s.r.o HKU\S-1-5-21-4050157430-2832638794-3304664986-1001\SOFTWARE\AvastAdSDK =>.Avast Software s.r.o HKU\S-1-5-21-4050157430-2832638794-3304664986-1001\SOFTWARE\Browser Cleanup =>.Avast Software s.r.o C:\ProgramData\AVAST Software =>.AVAST Software C:\Users\Benoît\AppData\Roaming\AVAST Software =>.AVAST Software C:\Users\Benoît\AppData\Local\AVAST Software =>.AVAST Software C:\WINDOWS\System32\drivers\tapexpressvpn.sys C:\WINDOWS\System32\drivers\tap0901.sys C:\WINDOWS\System32\Config\systemprofile\AppData\Roaming\ExpressVPN EmptyRecycle EmptyTemp End::