start::
CreateRestorePoint:
CloseProcesses:
Hosts:
RemoveProxy:
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
HKLM\Software\...\AppCompatFlags\Custom\chrome.exe: [{cf2797aa-b7ec-e311-8ed9-005056c00008}.sdb] ->
HKLM\Software\...\AppCompatFlags\Custom\explorer.zza: [{cf2797aa-b7ec-e311-8ed9-005056c00008}.sdb] ->
HKLM\Software\...\AppCompatFlags\Custom\iexplore.exe: [{cf2797aa-b7ec-e311-8ed9-005056c00008}.sdb] ->
GroupPolicy: Restriction ? <==== ATTENTION
SearchScopes: HKLM -> DefaultScope {5034F8A6-1B58-434D-B864-2C9D62B7A209} URL =
SearchScopes: HKU\S-1-5-21-1339192657-55738155-1068533288-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1339192657-55738155-1068533288-1002 -> {2211d4a5-48d0-47f5-a7cd-81e861470f7f} URL =
BHO: McAfee WebAdvisor -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> C:\Program Files\McAfee\WebAdvisor\x64\IEPlugin.dll
BHO-x32: McAfee WebAdvisor -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> C:\Program Files\McAfee\WebAdvisor\win32\IEPlugin.dll
FF Extension: (McAfee® WebAdvisor) - C:\Program Files\McAfee\WebAdvisor\e10ssaffplg.xpi
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\9FF87861F5E7AFA58BA606A4644D22539FF8 [2015-12-05]
CHR DefaultSearchURL: Default -> hxxps://fr.search.yahoo.com/search?fr=mcafee&type=E210FR91082G0&p=
CHR DefaultSearchKeyword: Default -> mcafee
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - hxxps://clients2.google.com/service/update2/crx
R2 McAfee WebAdvisor; C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.500\McCHSvc.exe
S3 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [232656 2015-04-08]
S4 mfevtp; C:\Windows\system32\mfevtps.exe [250672 2015-04-08]
S3 cfwids; C:\WINDOWS\System32\drivers\cfwids.sys
S3 mfeapfk; C:\WINDOWS\System32\drivers\mfeapfk.sys [181584 2014-10-01]
R3 mfeavfk; C:\WINDOWS\System32\drivers\mfeavfk.sys [338272 2015-04-08]
S0 mfeelamk; C:\WINDOWS\System32\drivers\mfeelamk.sys [80160 2015-04-08]
R3 mfefirek; C:\WINDOWS\System32\drivers\mfefirek.sys [488000 2015-04-08]
R0 mfehidk; C:\WINDOWS\System32\drivers\mfehidk.sys [864200 2015-04-08]
R0 mfewfpk; C:\WINDOWS\System32\drivers\mfewfpk.sys [335944 2015-04-08]
2016-12-28 20:20 - 2016-12-28 20:20 - 003351566 _____ () C:\Users\Benoit\AppData\Roaming\tor.exe
Task: {1461AAF1-2B55-41B1-8C62-3262A6B653FE} - System32\Tasks\{DCA5339E-881A-463D-6082-8DEA89FEC837} => C:\Users\Benoit\AppData\Roaming\{D025D027-22BD-8CBA-BEF5-58811A55A2D5}\nlknrprqz.exe
Task: {14EDC992-780D-400F-A65F-8336BD4965D4} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Pas de fichier
Task: {1E24A56A-D5A0-4CB4-B111-60925A5CE43F} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Pas de fichier
Task: {2303B2DC-2072-4D16-B2A3-2303A9F5F6AC} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Pas de fichier
Task: {26FBF645-FC7A-457E-9E3E-770E9142EE79} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Pas de fichier
Task: {3E60D349-DA9F-4EC8-8AE1-2DEC89DA80A7} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Pas de fichier
Task: {6D60E760-7BA0-4F40-ADB2-A8A643DB03E1} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Pas de fichier
Task: {814B3429-01E0-4150-BDB8-7799CF3CD392} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Pas de fichier
Task: {A3F06141-21C4-47E8-9E33-2F621F12A70C} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Pas de fichier
Task: {AAD44015-743B-47D3-9E15-4163F1A884AA} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Pas de fichier
Task: {F324A25C-991C-4C75-BDC5-FE8232035066} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Pas de fichier
Task: {F6957DF7-37B6-4BCC-8F67-562D6F5CC884} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Pas de fichier
EmptyTemp:
cmd: ipconfig /flushdns
end::