start::
closeprocesses:
createrestorepoint:
virustotal: C:\Users\lucas\aAyToeYyMoaU.exe
virustotal: C:\WINDOWS\IecU.exe
virustotal: C:\Users\lucas\AppData\Local\FEPVwY.exe
ShellIconOverlayIdentifiers: [
MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => -> Pas de fichier
ShellIconOverlayIdentifiers: [
MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => -> Pas de fichier
ShellIconOverlayIdentifiers: [
MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => -> Pas de fichier
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Pas de fichier
ShellIconOverlayIdentifiers-x32: [
MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => -> Pas de fichier
ShellIconOverlayIdentifiers-x32: [
MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => -> Pas de fichier
ShellIconOverlayIdentifiers-x32: [
MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => -> Pas de fichier
ContextMenuHandlers1: [Glary Utilities] -> [CC]{B3C418F8-922B-4faf-915E-59BC14448CF7} => -> Pas de fichier
ContextMenuHandlers2: [Glary Utilities] -> [CC]{B3C418F8-922B-4faf-915E-59BC14448CF7} => -> Pas de fichier
Task: {78AD3DE3-B881-4235-9851-DB8189DEE6C6} - System32\Tasks\{371AF8B2-7BE1-4DA3-9213-A0A8FAAD02E1} => C:\WINDOWS\system32\pcalua.exe -a "C:\Program Files\ByteFence\ByteFence.exe" -c /uninstall
C:\Program Files\ByteFence
Task: {A2C52DCE-0E47-4772-935D-0881FAF85B1D} - System32\Tasks\{AEA03221-8B52-4D1B-A0FD-453B086C25DA} => C:\WINDOWS\system32\pcalua.exe -a C:\Users\lucas\AppData\Local\{60FE56A2-4456-3A1A-29CE-1FF20DA6E36A}\uninst.exe -c -P=/Uninstall /s /noun /DelSelfDir
AlternateDataStreams: C:\Users\lucas\Application Data:00e481b5e22dbe1f649fcddd505d3eb7 [362]
AlternateDataStreams: C:\Users\lucas\AppData\Roaming:00e481b5e22dbe1f649fcddd505d3eb7 [362]
AlternateDataStreams: C:\Users\Public\AppData:CSM [478]
AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [486]
IE trusted site: HKU\S-1-5-21-1502803900-1456481623-4139719044-1001\...\sharepoint.com -> hxxps://estaca-files.sharepoint.com
FirewallRules: [{754FFE54-2DAE-4559-B87F-9F2C6523062D}] => (Allow) C:\WINDOWS\IecU.exe
FirewallRules: [{3A464BF3-28CC-4289-B939-2173CA243044}] => (Allow) C:\Users\lucas\aAyToeYyMoaU.exe
FirewallRules: [{4EC08B24-C370-4C60-B539-30619115BFBE}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{41276AEB-E37B-408B-BCDD-36A5460FC289}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{246D0E7B-74FD-4EB5-B2E3-251B588ED8FC}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{D3E3ED09-DEE8-47CC-8209-0F792DEA8ABE}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{A8D7AD23-F991-4663-8142-74391EE17776}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{4A2EC05B-D47A-40F5-AAA8-AA2B34CC02E8}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{3194963F-D735-40A6-ACA8-A0C446F94B8C}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{3A51534D-BAD3-4779-AD37-FD5274C50137}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{B32818F8-21C3-45FD-A2D5-38C61FF30B6E}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{F3C1B32D-B270-4C1E-827A-A3D741392B6E}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{8A35F0CA-3603-4B5A-A892-C18D85A4936D}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{ECD80586-0C80-4A5B-852E-978AE370C5C5}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{BC69E728-7473-452F-8CF4-7F031BDE482D}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{67FC78C4-C3E7-4F79-BF65-F8606D6108C4}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{1903C27B-6E9C-4458-AD90-65FBF67BFAF4}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{F6F7ED19-F09B-40EE-A4CC-2B2F97FE37CA}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{7E7A17A2-EC54-4639-B9FC-84FE97B1EC77}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{7D5F5A0F-3523-45E3-BB41-F65334840841}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{605F55D1-9CE5-427B-A7D8-9BD87AA48164}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{1BDD4199-183E-435A-A93E-34561EF923F5}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{C34511CE-0D6D-40C7-9ADB-E70671394457}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{DAAE9CEB-A380-4BF7-AA4A-6DC59AFA9439}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{5FEEE410-F5A3-459E-B96E-D798C9A7A69B}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{2D0B0181-B9CF-4808-A128-28F135FC11AB}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{15BFF15E-8A66-4E12-840B-525CDD738B7F}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{C2CBC047-5D57-43DC-9997-DE2A8B3C67AB}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{F6FE1DB5-723B-4778-ABA6-91CE72043595}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{C901313B-EACF-4867-8378-409E525D0602}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{F9D9489F-4026-4C49-A731-831A0C566265}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{C3A620A2-C7F2-4829-B9ED-01572D35DC4E}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{30BDDAEA-E481-4C18-9836-824A2A8F8072}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{3FEF5A86-4429-4A5F-823C-5E5430E6BCCA}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{B49E7C3C-1734-424F-941A-22F8F4616CF6}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{9F596144-5118-47A9-95E4-6BE246398155}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{04737FC5-B489-49A7-9536-00C5B5C15DAE}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{94531C56-BF23-4FDF-BA8A-2B11E6F4375E}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{D31A0E00-1E88-4F0F-8849-5895E3C2262F}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{A7F7A2D0-748C-437B-9FCF-526681E7EDD5}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{68A02B87-7CE4-45E0-AFC2-478496C4BEBC}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{0BB35729-373B-454E-A5D1-147010C2C47D}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{D8019CDF-9B7F-4548-9788-7C379557A493}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{D66E4DC2-1608-409D-BABD-60C1E55BDCA1}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{1B2B91D7-37D7-4EF3-A58F-5E0057F56E96}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{B617A4EB-A636-4244-8B2D-F214347CF92E}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{D401BB8E-849D-45BA-A036-A04BABAAADCF}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{E1111606-C2AF-4EC9-AEBA-A21F22B404B8}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{06435CF6-3293-4986-909E-000E0D0669FB}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{1379485C-74E3-40D5-AD91-6AF7E8657C98}] => (Allow) C:\Users\lucas\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{00337488-602C-41A7-8E74-9C84B69D7820}] => (Allow) C:\Users\lucas\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{FC06BADD-2E1C-432E-A1A7-213BAD577D57}] => (Allow) C:\Program Files (x86)\uTorrent\uTorrent.exe
FirewallRules: [{C4CD0DE9-8925-4564-98DC-B3D5C56D36FD}] => (Allow) C:\Program Files (x86)\uTorrent\uTorrent.exe
FirewallRules: [{221B269E-3E01-4FC9-B80E-22E80D1223AF}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{0AFD6E6B-07DF-43E1-AEFE-D5EBDF96D862}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{2F6A897A-6F44-40FA-BBB2-E0E264595AFA}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{7E633056-7983-4047-968A-D7B328C2138C}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{0AD0FFE3-D926-4536-8BB9-80CEFA1B6ACB}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{506CF1D1-D40D-493D-BE9B-AA06801CF953}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
GroupPolicy: Restriction ? <==== ATTENTION
GroupPolicyUsers\S-1-5-21-1502803900-1456481623-4139719044-1001\User: Restriction <==== ATTENTION
SearchScopes: HKLM -> DefaultScope la valeur est absente
SearchScopes: HKLM-x32 -> DefaultScope la valeur est absente
BHO: Pas de nom -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> Pas de fichier
BHO-x32: Pas de nom -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> Pas de fichier
2018-11-04 23:58 - 2018-11-04 23:58 - 000000000 ____D C:\ProgramData\Kaspersky Lab Setup Files
2018-11-04 23:52 - 2017-01-24 19:10 - 000000000 ____D C:\Program Files (x86)\NortonInstaller
2018-10-18 15:31 - 2017-03-08 21:05 - 000000000 ____D C:\ProgramData\McAfee
2018-11-04 21:56 - 2018-11-04 21:56 - 000000180 _____ () C:\Users\lucas\AppData\Local\Temp\00e481b5e22dbe1f649fcddd505d3eb7.dll
2018-11-04 21:56 - 2018-11-04 21:56 - 000000017 _____ () C:\Users\lucas\AppData\Local\Temp\c2293a195ec08f84e2fbf9fb89cdbb2d.dll
StartBatch:
type C:\AdwCleaner\AdwCleaner[S*].txt
EndBatch:
emptytemp:
end::