start:: CreateRestorePoint: CloseProcesses: GroupPolicy: Restriction ? <==== ATTENTION GroupPolicy\User: Restriction ? <==== ATTENTION HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings: [ProxySettingsPerUser] 0 <==== ATTENTION (Restriction - ProxySettings) ProxyEnable: [HKLM] => Proxy est activé. ProxyEnable: [HKLM-x32] => Proxy est activé. ProxyServer: [HKLM] => http=127.0.0.1:6061;https=127.0.0.1:6061 ProxyServer: [HKLM-x32] => http=127.0.0.1:6061;https=127.0.0.1:6061 AutoConfigURL: [HKLM] => http=127.0.0.1:6061;https=127.0.0.1:6061 ManualProxies: 1http=127.0.0.1:6061;https=127.0.0.1:6061 HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.palikan.com/?f=1&a=plk_coinisreb_17_43_ssg02&cd=2XzuyEtN2Y1L1Qzu0DtDyDyByB0B0AyCtCtCtC0AzyyEtCyBtN0D0Tzu0StBtCtBtAtN1L2XzutAtFtByBtFyEtFyDyEtN1L1Czu1ByCtN1L1G1B1V1N2Y1L1Qzu2SyC0CtDtAzzyE0A0DtGyDyE0E0FtG0AyEyB0CtGtDyEtD0CtGyBtD0DtAtByDtD0BzzyEtByE2QtN1M1F1B2Z1V1N2Y1L1Qzu2StAtDyCtByB0DyD0AtGtByC0AyEtGyEyCzy0AtG0B0F0EtBtGtAzytAtDtDtAyBtCyB0D0FtB2QtN0A0LzuyE&cr=132281005&ir= HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.palikan.com/?f=1&a=plk_coinisreb_17_43_ssg02&cd=2XzuyEtN2Y1L1Qzu0DtDyDyByB0B0AyCtCtCtC0AzyyEtCyBtN0D0Tzu0StBtCtBtAtN1L2XzutAtFtByBtFyEtFyDyEtN1L1Czu1ByCtN1L1G1B1V1N2Y1L1Qzu2SyC0CtDtAzzyE0A0DtGyDyE0E0FtG0AyEyB0CtGtDyEtD0CtGyBtD0DtAtByDtD0BzzyEtByE2QtN1M1F1B2Z1V1N2Y1L1Qzu2StAtDyCtByB0DyD0AtGtByC0AyEtGyEyCzy0AtG0B0F0EtBtGtAzytAtDtDtAyBtCyB0D0FtB2QtN0A0LzuyE&cr=132281005&ir= SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.palikan.com/results.php?f=4&a=plk_coinisreb_17_43_ssg02&cd=2XzuyEtN2Y1L1Qzu0DtDyDyByB0B0AyCtCtCtC0AzyyEtCyBtN0D0Tzu0StBtCtBtAtN1L2XzutAtFtByBtFyEtFyDyEtN1L1Czu1ByCtN1L1G1B1V1N2Y1L1Qzu2SyC0CtDtAzzyE0A0DtGyDyE0E0FtG0AyEyB0CtGtDyEtD0CtGyBtD0DtAtByDtD0BzzyEtByE2QtN1M1F1B2Z1V1N2Y1L1Qzu2StAtDyCtByB0DyD0AtGtByC0AyEtGyEyCzy0AtG0B0F0EtBtGtAzytAtDtDtAyBtCyB0D0FtB2QtN0A0LzuyE&cr=132281005&ir=&q={searchTerms} SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.palikan.com/results.php?f=4&a=plk_coinisreb_17_43_ssg02&cd=2XzuyEtN2Y1L1Qzu0DtDyDyByB0B0AyCtCtCtC0AzyyEtCyBtN0D0Tzu0StBtCtBtAtN1L2XzutAtFtByBtFyEtFyDyEtN1L1Czu1ByCtN1L1G1B1V1N2Y1L1Qzu2SyC0CtDtAzzyE0A0DtGyDyE0E0FtG0AyEyB0CtGtDyEtD0CtGyBtD0DtAtByDtD0BzzyEtByE2QtN1M1F1B2Z1V1N2Y1L1Qzu2StAtDyCtByB0DyD0AtGtByC0AyEtGyEyCzy0AtG0B0F0EtBtGtAzytAtDtDtAyBtCyB0D0FtB2QtN0A0LzuyE&cr=132281005&ir=&q={searchTerms} SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.palikan.com/results.php?f=4&a=plk_coinisreb_17_43_ssg02&cd=2XzuyEtN2Y1L1Qzu0DtDyDyByB0B0AyCtCtCtC0AzyyEtCyBtN0D0Tzu0StBtCtBtAtN1L2XzutAtFtByBtFyEtFyDyEtN1L1Czu1ByCtN1L1G1B1V1N2Y1L1Qzu2SyC0CtDtAzzyE0A0DtGyDyE0E0FtG0AyEyB0CtGtDyEtD0CtGyBtD0DtAtByDtD0BzzyEtByE2QtN1M1F1B2Z1V1N2Y1L1Qzu2StAtDyCtByB0DyD0AtGtByC0AyEtGyEyCzy0AtG0B0F0EtBtGtAzytAtDtDtAyBtCyB0D0FtB2QtN0A0LzuyE&cr=132281005&ir=&q={searchTerms} SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.palikan.com/results.php?f=4&a=plk_coinisreb_17_43_ssg02&cd=2XzuyEtN2Y1L1Qzu0DtDyDyByB0B0AyCtCtCtC0AzyyEtCyBtN0D0Tzu0StBtCtBtAtN1L2XzutAtFtByBtFyEtFyDyEtN1L1Czu1ByCtN1L1G1B1V1N2Y1L1Qzu2SyC0CtDtAzzyE0A0DtGyDyE0E0FtG0AyEyB0CtGtDyEtD0CtGyBtD0DtAtByDtD0BzzyEtByE2QtN1M1F1B2Z1V1N2Y1L1Qzu2StAtDyCtByB0DyD0AtGtByC0AyEtGyEyCzy0AtG0B0F0EtBtGtAzytAtDtDtAyBtCyB0D0FtB2QtN0A0LzuyE&cr=132281005&ir=&q={searchTerms} SearchScopes: HKU\S-1-5-21-1796576296-477058736-2758871048-1002 -> {5e7797ae-5ca1-4b50-95d8-97e746340487} URL = hxxp://www.palikan.com/results.php?f=4&a=plk_coinisreb_17_43_ssg02&cd=2XzuyEtN2Y1L1Qzu0DtDyDyByB0B0AyCtCtCtC0AzyyEtCyBtN0D0Tzu0StBtCtBtAtN1L2XzutAtFtByBtFyEtFyDyEtN1L1Czu1ByCtN1L1G1B1V1N2Y1L1Qzu2SyC0CtDtAzzyE0A0DtGyDyE0E0FtG0AyEyB0CtGtDyEtD0CtGyBtD0DtAtByDtD0BzzyEtByE2QtN1M1F1B2Z1V1N2Y1L1Qzu2StAtDyCtByB0DyD0AtGtByC0AyEtGyEyCzy0AtG0B0F0EtBtGtAzytAtDtDtAyBtCyB0D0FtB2QtN0A0LzuyE&cr=132281005&ir=&q={searchTerms} SearchScopes: HKU\S-1-5-21-1796576296-477058736-2758871048-1002 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/distib/ep/?q={searchTerms}&fr=ntg&product_id=%7BA6C134DD-27C7-43C6-8D0B-E738D2720C9B%7D&gp=811610 BHO-x32: Search@Mail.Ru -> {8E8F97CD-60B5-456F-A201-73065652D099} -> C:\Users\mikecoco\AppData\Local\Mail.Ru\Sputnik\ie_addon_dll.dll [2019-02-12] (LLC Mail.Ru -> Mail.Ru) CHR HomePage: Default -> inline.go.mail.ru CHR StartupUrls: Default -> "hxxp://mail.ru/cnt/10445?gp=811610" CHR DefaultSearchURL: Default -> hxxp://go.mail.ru/distib/ep/?q={searchTerms}&fr=ntg&product_id=%7BC407AF56-2E94-49E6-AD37-90C562987EE7%7D&gp=811610 CHR DefaultSearchKeyword: Default -> go.mail.ru CHR DefaultSuggestURL: Default -> hxxp://suggests.go.mail.ru/chrome?q={searchTerms} CHR HKLM-x32\...\Chrome\Extension: [iepoegkaoeljnbhagabakjodgpfniimo] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [ikpcpgklmefncbfgbdifkaphbaapgafh] - hxxps://clients2.google.com/service/update2/crx R1 MDZjM; \??\C:\WINDOWS\system32\drivers\MDZjM [X] 2019-02-12 06:00 - 2019-02-12 06:03 - 000000000 ___DC C:\Users\mikecoco\AppData\Roaming\infoSiw 2019-02-12 06:00 - 2019-02-12 06:02 - 000000000 ___DC C:\Users\mikecoco\AppData\Roaming\ShopMore 2019-02-12 06:00 - 2019-02-12 06:02 - 000000000 ___DC C:\Users\mikecoco\AppData\Local\Mail.Ru 2019-02-12 06:00 - 2019-02-12 06:00 - 000001334 ___RS C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gоogle Сhromе.lnk 2019-02-12 06:00 - 2019-02-12 06:00 - 000000000 ___DC C:\Users\mikecoco\AppData\Roaming\SPI 2019-02-12 06:00 - 2019-02-12 06:00 - 000000000 ___DC C:\Users\mikecoco\AppData\Roaming\Browsers 2019-02-12 06:00 - 2019-02-12 06:00 - 000000000 ___DC C:\ProgramData\Mail.Ru 2019-02-11 09:49 - 2019-02-11 09:49 - 000151344 _____ C:\WINDOWS\system32\Drivers\MDZjM 2019-01-24 06:06 - 2017-02-26 12:46 - 000000000 ___DC C:\Users\mikecoco\AppData\Local\MSfree Inc 2019-02-12 06:00 - 2019-02-12 06:00 - 007970945 ____C () C:\Users\mikecoco\AppData\Local\Temp\s2s.exe 2019-02-12 06:00 - 2019-02-12 06:00 - 000586113 ____C (ZRFXRD ) C:\Users\mikecoco\AppData\Local\Temp\Setup.exe 2019-02-12 06:00 - 2019-02-12 06:00 - 009126360 ____C (Shop More ) C:\Users\mikecoco\AppData\Local\Temp\UpProSetup.exe 2019-02-02 22:14 - 2019-02-02 22:14 - 000000000 ____C () C:\Users\mikecoco\AppData\Local\Temp\_kcorpdt.dll CustomCLSID: HKU\S-1-5-21-1796576296-477058736-2758871048-1002_Classes\CLSID\{0E270DAA-1BE6-48F2-AC49-745CC8920C8C}\InprocServer32 -> %%systemroot%%\system32\shell32.dll => Pas de fichier Shortcut: C:\Users\mikecoco\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Intеrnеt Exрlorеr.lnk -> C:\Users\mikecoco\AppData\Roaming\Browsers\exe.erolpxei.bat (Pas de fichier) <==== Cyrillic Shortcut: C:\Users\mikecoco\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Gоogle Сhromе.lnk -> C:\Users\mikecoco\AppData\Roaming\Browsers\exe.emorhc.bat (Pas de fichier) <==== Cyrillic Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gоogle Сhromе.lnk -> C:\Users\mikecoco\AppData\Roaming\Browsers\exe.emorhc.bat (Pas de fichier) <==== Cyrillic ShortcutWithArgument: C:\Users\mikecoco\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --disable-quic ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --disable-quic C:\Users\mikecoco\AppData\Local\Temp\Setup.exe C:\WINDOWS\SECOH-QAD.dll C:\Program Files\KMSpico RemoveProxy: EmptyTemp: end::