start::
CreateRestorePoint:
CloseProcesses:
Hosts:
RemoveProxy:
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Pas de fichier
ContextMenuHandlers1: [SystemSpeedupFilesMenu] -> {ef263503-8f0e-3e6a-ae2e-fe0b4b441d52} => C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.UI.ShellExtension.DLL -> Pas de fichier
CustomCLSID: HKU\S-1-5-21-2398758679-504362968-1028138829-1001_Classes\CLSID\{62634D95-960B-4834-8E71-A70408AD8FD9}\InprocServer32 -> C:\Users\pauline\AppData\Local\Google\Update\1.3.34.7\psuser_64.dll => Pas de fichier
CustomCLSID: HKU\S-1-5-21-2398758679-504362968-1028138829-1001_Classes\CLSID\{A804CF1A-91E5-4F0C-9E8C-DB39E74056DD}\InprocServer32 -> C:\Users\pauline\AppData\Local\Google\Update\1.3.33.23\psuser_64.dll => Pas de fichier
CustomCLSID: HKU\S-1-5-21-2398758679-504362968-1028138829-1001_Classes\CLSID\{C591CFEA-E432-495d-A0BE-58E4CCD87B17}\Shell\Open\Command -> C:\Program Files\Synaptics\SynTP\SynTPCpl.dll (Synaptics Incorporated -> Synaptics Incorporated)
CustomCLSID: HKU\S-1-5-21-2398758679-504362968-1028138829-1001_Classes\CLSID\{EA724FD3-844D-43A9-A8C9-A5BC35FC20E4}\InprocServer32 -> C:\Users\pauline\AppData\Local\Google\Update\1.3.33.17\psuser_64.dll => Pas de fichier
AlternateDataStreams: C:\Users\alain\OneDrive:${3D0CE612-FDEE-43f7-8ACA-957BEC0CCBA0}.SyncRootIdentity [118]
AlternateDataStreams: C:\Users\pauline\OneDrive:${3D0CE612-FDEE-43f7-8ACA-957BEC0CCBA0}.SyncRootIdentity [108]
HKLM\...\RunOnce: [ZHPCleaner_Folder1] => CMD /c DEL "\Program Files (x86)\Segurazo" /F /Q
HKLM\...\RunOnce: [ZHPCleaner_Folder2] => CMD /c DEL "C:\Program Files (x86)\Segurazo" /F /Q
HKLM\...\RunOnce: [ZHPCleaner_Folder3] => CMD /c DEL "C:\ProgramData\Segurazo" /F /Q
HKLM\...\RunOnce: [ZHPCleaner_Folder4] => CMD /c DEL "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Segurazo" /F /Q
HKLM\...\RunOnce: [ZHPCleaner_Folder5] => CMD /c DEL "\Users\alain\AppData\Roaming\segurazoclient" /F /Q
HKLM\...\RunOnce: [ZHPCleaner] => C:\Users\pauline\AppData\Roaming\ZHP\ZHPCleaner.txt [1760 2019-11-04] () [Fichier non signé]
HKLM-x32\...\RunOnce: [*aswClear] => C:\WINDOWS\Temp\avastclear (1).exe [10823512 2019-11-01] (AVAST Software s.r.o. -> AVAST Software) <==== ATTENTION
HKLM-x32\...\RunOnce: [ZHPCleaner_Key1] => REG delete "HKLM\SOFTWARE\Segurazo" /F /reg:64
HKLM-x32\...\RunOnce: [ZHPCleaner_Key2] => REG delete "HKLM\SOFTWARE\Wow6432Node\Segurazo" /F /reg:64
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
C:\Program Files (x86)\Segurazo
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
CHR HKLM\...\Chrome\Extension: [bhoagceacaklimpcejjofabngcjkebfg] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [nccfgpamboionigdpfjmijhlgmgdbael] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-2398758679-504362968-1028138829-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [bhoagceacaklimpcejjofabngcjkebfg] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-2398758679-504362968-1028138829-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nccfgpamboionigdpfjmijhlgmgdbael] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [bhoagceacaklimpcejjofabngcjkebfg] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [nccfgpamboionigdpfjmijhlgmgdbael] - hxxps://clients2.google.com/service/update2/crx
S2 chromium; C:\Program Files (x86)\Chromium\Update\ChromiumUpdate.exe [102400 2019-10-28] (Chromium.) [Fichier non signé]
S3 chromiumm; C:\Program Files (x86)\Chromium\Update\ChromiumUpdate.exe [102400 2019-10-28] (Chromium.) [Fichier non signé]
C:\Program Files (x86)\Chromium
2019-10-28 21:25 - 2019-10-28 21:25 - 000002351 _____ C:\Users\pauline\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chromium.lnk
2019-10-28 21:25 - 2019-10-28 21:25 - 000002343 _____ C:\Users\pauline\Desktop\Chromium.lnk
2019-10-28 21:24 - 2019-10-28 21:25 - 000000000 ____D C:\Users\pauline\AppData\Local\Chromium
2019-10-28 21:24 - 2019-10-28 21:24 - 000000000 ____D C:\Users\alain\AppData\Local\chromium
2019-10-28 21:23 - 2019-11-02 21:08 - 000003368 _____ C:\WINDOWS\system32\Tasks\ChromiumUpdateTaskMachineUA
2019-10-28 21:23 - 2019-11-02 21:08 - 000003144 _____ C:\WINDOWS\system32\Tasks\ChromiumUpdateTaskMachineCore
2019-10-28 21:23 - 2019-10-28 21:23 - 000000000 ____D C:\ProgramData\{9490A8AC-BCB8-D0D4-E4E0-F8FC0C082024}
2019-10-28 21:23 - 2019-10-28 21:23 - 000000000 ____D C:\Program Files (x86)\Chromium
2019-10-28 19:52 - 2019-10-28 21:13 - 000000000 ____D C:\Users\alain\AppData\Local\WinZip
2019-10-09 08:59 - 2019-10-09 08:59 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth8.bin
2019-10-09 08:59 - 2019-10-09 08:59 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth7.bin
2019-10-09 08:59 - 2019-10-09 08:59 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth6.bin
2019-10-09 08:59 - 2019-10-09 08:59 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth5.bin
2019-10-09 08:59 - 2019-10-09 08:59 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth4.bin
2019-10-09 08:59 - 2019-10-09 08:59 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth3.bin
2019-10-09 08:59 - 2019-10-09 08:59 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth2.bin
2019-10-09 08:59 - 2019-10-09 08:59 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth1.bin
2019-11-04 18:03 - 2017-09-14 18:45 - 000000180 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
EmptyTemp:
cmd: ipconfig /flushdns
end::