start::
CreateRestorePoint:
CloseProcesses:
Hosts:
RemoveProxy:
EmptyTemp:
GroupPolicy: Restriction - Chrome <==== ATTENTION
GroupPolicy\User: Restriction <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
HKU\S-1-5-21-137484073-2298933724-79549711-1002\...\Run: [ExpressVPN4] => C:\Program Files (x86)\ExpressVPN\xvpn-ui\ExpressVpn.exe [812672 2018-02-07] (ExpressVPN)
HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings: [ProxySettingsPerUser] 0 <==== ATTENTION (Restriction - ProxySettings)
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://fr.yhs4.search.yahoo.com/yhs/search?hspart=
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://fr.yhs4.search.yahoo.com/yhs/search?hspart=
SearchScopes: HKU\S-1-5-21-137484073-2298933724-79549711-1002 -> DefaultScope {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/distib/ep/?q=
SearchScopes: HKU\S-1-5-21-137484073-2298933724-79549711-1002 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://fr.yhs4.search.yahoo.com/yhs/search?hspart=
SearchScopes: HKU\S-1-5-21-137484073-2298933724-79549711-1002 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/distib/ep/?q=
CHR HKLM-x32\...\Chrome\Extension: [bhjhnafpiilpffhglajcaepjbnbjemci] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ccjleegmemocfpghkhpjmiccjcacackp] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [hcadgijmedbfgciegjomfpjcdchlhnif] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lhemechcanjmilllmccjbjldonmnnjjj] - hxxps://clients2.google.com/service/update2/crx
CHR StartupUrls: Default -> "hxxps://www.google.com/","hxxp://istart.webssearches.com/?type=
2018-05-12 12:02 - 2018-05-12 12:02 - 000000000 ____D C:\ProgramData\ExpressVPN
2018-05-13 09:54 - 2015-07-23 13:29 - 000000000 ____D C:\Program Files\KMSpico
2018-05-14 09:20 - 2015-09-03 07:12 - 000000000 ____D C:\Program Files\Microsoft Office
2017-09-29 15:42 - 2017-09-29 15:42 - 000174592 ____N (Microsoft Corporation) C:\Users\gael_2\eVoovIiAueNjE.exe
2017-09-29 15:42 - 2017-09-29 15:42 - 000059904 ____N (Microsoft Corporation) C:\Users\gael_2\AppData\Roaming\banEEuwk.exe
2018-03-04 18:05 - 2018-03-04 18:05 - 000001439 _____ () C:\Users\gael_2\AppData\Roaming\uni.txt
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Pas de fichier
cmd: ipconfig /flushdns
end::