start::
CreateRestorePoint:
CloseProcesses:
Hosts:
CustomCLSID: HKU\S-1-5-21-2473113547-2899138397-595176656-1001_Classes\CLSID\{0E270DAA-1BE6-48F2-AC49-ACBFA6D68262}\InprocServer32 -> %%systemroot%%\system32\shell32.dll => Pas de fichier
ContextMenuHandlers1: [IObitUnstaler] -> {B19ED566-D419-470b-B111-3C89040BC027} => C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMenuRight.dll [2017-05-22] (IObit)
C:\Program Files (x86)\IObit
ContextMenuHandlers1: [Meo] -> {52E78CED-AA61-7C26-A51D-67C4D96349B9} => C:\Program Files (x86)\NCH Software\Meo\meodll64.dll -> Pas de fichier
ContextMenuHandlers4: [IObitUnstaler] -> {B19ED566-D419-470b-B111-3C89040BC027} => C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMenuRight.dll [2017-05-22] (IObit)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> Pas de fichier
ContextMenuHandlers6: [Meo] -> {52E78CED-AA61-7C26-A51D-67C4D96349B9} => C:\Program Files (x86)\NCH Software\Meo\meodll64.dll -> Pas de fichier
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\Windows\explorer.exe
IE trusted site: HKU\S-1-5-21-2473113547-2899138397-595176656-1001\...\atlassian.com -> hxxps://common-admin-cdn.atlassian.com
IE restricted site: HKU\S-1-5-21-2473113547-2899138397-595176656-1001\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-2473113547-2899138397-595176656-1001\...\008k.com -> 008k.com
IE restricted site: HKU\S-1-5-21-2473113547-2899138397-595176656-1001\...\00hq.com -> 00hq.com
IE restricted site: HKU\S-1-5-21-2473113547-2899138397-595176656-1001\...\0190-dialers.com -> 0190-dialers.com
IE restricted site: HKU\S-1-5-21-2473113547-2899138397-595176656-1001\...\01i.info -> 01i.info
IE restricted site: HKU\S-1-5-21-2473113547-2899138397-595176656-1001\...\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com
IE restricted site: HKU\S-1-5-21-2473113547-2899138397-595176656-1001\...\05p.com -> 05p.com
IE restricted site: HKU\S-1-5-21-2473113547-2899138397-595176656-1001\...\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com
IE restricted site: HKU\S-1-5-21-2473113547-2899138397-595176656-1001\...\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com
IE restricted site: HKU\S-1-5-21-2473113547-2899138397-595176656-1001\...\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com
IE restricted site: HKU\S-1-5-21-2473113547-2899138397-595176656-1001\...\0calories.net -> 0calories.net
IE restricted site: HKU\S-1-5-21-2473113547-2899138397-595176656-1001\...\0cj.net -> 0cj.net
IE restricted site: HKU\S-1-5-21-2473113547-2899138397-595176656-1001\...\0scan.com -> 0scan.com
IE restricted site: HKU\S-1-5-21-2473113547-2899138397-595176656-1001\...\1-britney-spears-nude.com -> 1-britney-spears-nude.com
IE restricted site: HKU\S-1-5-21-2473113547-2899138397-595176656-1001\...\1-domains-registrations.com -> 1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-2473113547-2899138397-595176656-1001\...\1-se.com -> 1-se.com
IE restricted site: HKU\S-1-5-21-2473113547-2899138397-595176656-1001\...\1001movie.com -> 1001movie.com
IE restricted site: HKU\S-1-5-21-2473113547-2899138397-595176656-1001\...\1001night.biz -> 1001night.biz
IE restricted site: HKU\S-1-5-21-2473113547-2899138397-595176656-1001\...\100gal.net -> 100gal.net
IE restricted site: HKU\S-1-5-21-2473113547-2899138397-595176656-1001\...\100sexlinks.com -> 100sexlinks.com
FirewallRules: [{1DD66F68-1F3E-49B6-A3B9-207D37B1A7A2}] => (Allow) C:\Program Files (x86)\IObit\Driver Booster\4.3.0\AutoUpdate.exe
FirewallRules: [{A7EA42BB-ACD7-4457-A742-DAA247EEED0D}] => (Allow) C:\Program Files (x86)\IObit\Driver Booster\4.3.0\AutoUpdate.exe
FirewallRules: [{80700662-E425-49FA-95F8-F4390A64D24A}] => (Allow) C:\Program Files (x86)\IObit\Driver Booster\4.3.0\DBDownloader.exe
FirewallRules: [{92A9BFD1-D8B2-436D-894B-E332DA504B16}] => (Allow) C:\Program Files (x86)\IObit\Driver Booster\4.3.0\DBDownloader.exe
FirewallRules: [{745A147D-CFA4-4AFA-B16C-2912BD18A9C8}] => (Allow) C:\Program Files (x86)\IObit\Driver Booster\4.3.0\DriverBooster.exe
FirewallRules: [{8A29C34F-25B4-4652-9112-B45E24DF80FA}] => (Allow) C:\Program Files (x86)\IObit\Driver Booster\4.3.0\DriverBooster.exe
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
HKU\S-1-5-21-2473113547-2899138397-595176656-1001\...\Run: [7 Taskbar Tweaker] => C:\Users\Cyril\AppData\Roaming\7+ Taskbar Tweaker\7+ Taskbar Tweaker.exe [447488 2018-05-20] (RaMMicHaeL)
HKU\S-1-5-21-2473113547-2899138397-595176656-1001\...\Run: [McAfeeSafeConnect] => C:\Program Files (x86)\McAfee Safe Connect\McAfee Safe Connect.exe [1112960 2018-03-14] (McAfee Inc.)
Lsa: [Notification Packages] scecli C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2018-07-20]
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.766\SSScheduler.exe (McAfee, Inc.)
GroupPolicy: Restriction - Chrome <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings: [ProxySettingsPerUser] 1 <==== ATTENTION (Restriction - ProxySettings)
ProxyEnable: [HKLM] => Proxy est activé.
ProxyEnable: [HKLM-x32] => Proxy est activé.
ProxyServer: [HKLM] => http=127.0.0.1:8080;https=127.0.0.1:8080
ProxyServer: [HKLM-x32] => http=127.0.0.1:8080;https=127.0.0.1:8080
AutoConfigURL: [HKLM] => http=127.0.0.1:8080;https=127.0.0.1:8080
ProxyEnable: [S-1-5-21-2473113547-2899138397-595176656-1001] => Proxy est activé.
ProxyServer: [S-1-5-21-2473113547-2899138397-595176656-1001] => http=127.0.0.1:8080;https=127.0.0.1:8080
Tcpip\..\Interfaces\{bb8cc8c3-a75f-405d-ae10-57e25b9f2d37}: [DhcpNameServer] 8.8.8.8 8.8.4.4
Tcpip\..\Interfaces\{df66ef14-febf-4692-b69e-959de53b7a0c}: [DhcpNameServer] 10.11.0.1
Tcpip\..\Interfaces\{e66d3b33-743b-48a4-8dd5-00aa91ba9531}: [NameServer] 77.234.40.79
ManualProxies: 1http=127.0.0.1:8080;https=127.0.0.1:8080
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer.dll [2017-05-22] (IObit)
BHO: Pas de nom -> {13D67BB7-DB5F-48AA-884D-7A5D94168509} -> Pas de fichier
BHO-x32: Pas de nom -> {13D67BB7-DB5F-48AA-884D-7A5D94168509} -> Pas de fichier
FF user.js: detected! => C:\Users\Cyril\AppData\Roaming\Mozilla\Firefox\Profiles\zx1ccens.default\user.js [2017-12-01]
CHR HKU\S-1-5-21-2473113547-2899138397-595176656-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [fcfenmboojpjinhpgggodefccipikbpd] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [daanglpcpkjjlkhcbladppjphglbigam] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [fcoadmpfijfcmokecmkgolhbaeclfage] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - hxxps://clients2.google.com/service/update2/crx
S4 TrueKey; C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe [995800 2017-01-05] (McAfee, Inc.)
S4 TrueKeyScheduler; C:\Program Files\TrueKey\McTkSchedulerService.exe [16248 2017-01-05] (McAfee, Inc.)
S4 TrueKeyServiceHelper; C:\Program Files\TrueKey\McAfee.TrueKey.ServiceHelper.exe [86864 2017-01-05] (McAfee, Inc.)
S3 McAfee Vpn Service; C:\Program Files (x86)\McAfee Safe Connect\service\VpnService.exe [314368 2018-03-06] (AnchorFree Inc.) [Fichier non signé]
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.766\McCHSvc.exe [405392 2018-07-11] (McAfee, Inc.)
2018-07-20 09:49 - 2018-07-20 09:49 - 000002022 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2018-07-20 09:49 - 2018-07-20 09:49 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
2018-07-20 09:49 - 2018-07-20 09:49 - 000000000 ____D C:\ProgramData\McAfee Security Scan
2018-08-12 16:25 - 2016-08-05 18:40 - 000000000 ____D C:\Users\Cyril\AppData\LocalLow\IObit
2018-08-12 16:25 - 2016-08-05 18:40 - 000000000 ____D C:\ProgramData\IObit
2018-08-12 16:25 - 2016-08-05 18:40 - 000000000 ____D C:\Program Files (x86)\IObit
2018-07-20 09:49 - 2018-04-25 10:19 - 000000000 ____D C:\Program Files\McAfee Security Scan
testsigning on:
RemoveProxy:
EmptyTemp:
cmd: ipconfig /flushdns
end::