start::
closeprocesses:
createrestorepoint:
AlternateDataStreams: C:\WINDOWS\SysWOW64\zlib.dll:DocumentSummaryInformation [63]
AlternateDataStreams: C:\WINDOWS\SysWOW64\zlib.dll:SummaryInformation [63]
AlternateDataStreams: C:\WINDOWS\SysWOW64\zlib.dll:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} [0]
AlternateDataStreams: C:\Users\Public\AppData:CSM [464]
AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [470]
HKLM\...\StartupApproved\Run: => "Malwarebytes TrayApp"
FirewallRules: [{A81294B7-CF43-4101-97FA-B12F2C04E92A}] => (Allow) E:\SteamLibrary\steamapps\common\RNR\ShooterGame\Binaries\Win64\RadicalHeights.exe Pas de fichier
FirewallRules: [{9A18A039-501F-45E4-89C6-035DCBC21697}] => (Allow) E:\SteamLibrary\steamapps\common\RNR\ShooterGame\Binaries\Win64\RadicalHeights.exe Pas de fichier
FirewallRules: [{2FF5AF82-AE21-4414-BAEB-F8212B120E6D}] => (Allow) E:\SteamLibrary\steamapps\common\FarCry5\bin\ArcadeEditor64.exe Pas de fichier
FirewallRules: [{7FBBA278-F3A3-4875-8BBD-0CFD86E65E9F}] => (Allow) E:\SteamLibrary\steamapps\common\FarCry5\bin\ArcadeEditor64.exe Pas de fichier
FirewallRules: [UDP Query User{F75C2AE9-50D3-4588-B9BD-0A1FBF421B60}C:\users\mohamed\desktop\nouveau dossier\exo7\tor browser\browser\firefox.exe] => (Block) C:\users\mohamed\desktop\nouveau dossier\exo7\tor browser\browser\firefox.exe Pas de fichier
FirewallRules: [TCP Query User{550BD4FB-9C8C-40B1-9600-8F3533A44D47}C:\users\mohamed\desktop\nouveau dossier\exo7\tor browser\browser\firefox.exe] => (Block) C:\users\mohamed\desktop\nouveau dossier\exo7\tor browser\browser\firefox.exe Pas de fichier
FirewallRules: [UDP Query User{AE429259-C583-4639-A592-863474B47791}C:\users\mohamed\desktop\nouveau dossier\mohhaa - copie\mohaa.exe] => (Allow) C:\users\mohamed\desktop\nouveau dossier\mohhaa - copie\mohaa.exe Pas de fichier
FirewallRules: [TCP Query User{7EDBD085-019C-41C3-ADE1-F14E15A462C1}C:\users\mohamed\desktop\nouveau dossier\mohhaa - copie\mohaa.exe] => (Allow) C:\users\mohamed\desktop\nouveau dossier\mohhaa - copie\mohaa.exe Pas de fichier
FirewallRules: [UDP Query User{561184D0-0F08-4DB6-92AE-0930E300C136}C:\users\mohamed\desktop\mohhaa\mohaa.exe] => (Allow) C:\users\mohamed\desktop\mohhaa\mohaa.exe Pas de fichier
FirewallRules: [TCP Query User{2B44358E-B7FD-4FD2-9108-0E51552E4F07}C:\users\mohamed\desktop\mohhaa\mohaa.exe] => (Allow) C:\users\mohamed\desktop\mohhaa\mohaa.exe Pas de fichier
FirewallRules: [{9655A730-448E-418D-A462-EEC0BD73F09E}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe Pas de fichier
FirewallRules: [{07C92C38-8B79-4D49-8FE7-25CDB1C6C10E}] => (Allow) C:\Program Files (x86)\steam\bin\cef\cef.win7\steamwebhelper.exe Pas de fichier
FirewallRules: [{7C0A335F-8D28-4914-A78C-5F80CA766A71}] => (Allow) C:\Program Files (x86)\steam\bin\cef\cef.win7\steamwebhelper.exe Pas de fichier
FirewallRules: [UDP Query User{A65C6EBF-F250-40D3-8D72-087D57AFEA8F}C:\users\mohamed\desktop\mohhaa\mohaa.exe] => (Block) C:\users\mohamed\desktop\mohhaa\mohaa.exe Pas de fichier
FirewallRules: [TCP Query User{23C33B97-25B2-403A-900E-7C31FCA7316D}C:\users\mohamed\desktop\mohhaa\mohaa.exe] => (Block) C:\users\mohamed\desktop\mohhaa\mohaa.exe Pas de fichier
FirewallRules: [UDP Query User{97C99292-3369-4D29-ACAE-598A27927C01}C:\users\mohamed\appdata\local\temp\rar$exa0.215\mohaa\mohaa.exe] => (Block) C:\users\mohamed\appdata\local\temp\rar$exa0.215\mohaa\mohaa.exe Pas de fichier
FirewallRules: [TCP Query User{42E23829-B863-4588-A2B0-F27345347AA7}C:\users\mohamed\appdata\local\temp\rar$exa0.215\mohaa\mohaa.exe] => (Block) C:\users\mohamed\appdata\local\temp\rar$exa0.215\mohaa\mohaa.exe Pas de fichier
FirewallRules: [UDP Query User{F8191FB2-0D8D-4650-B250-573CE21F1F14}C:\users\mohamed\appdata\local\temp\rar$exa0.066\mohaa\mohaa.exe] => (Allow) C:\users\mohamed\appdata\local\temp\rar$exa0.066\mohaa\mohaa.exe Pas de fichier
FirewallRules: [TCP Query User{77725CA9-82FC-41F5-BA25-4B11F200B9B6}C:\users\mohamed\appdata\local\temp\rar$exa0.066\mohaa\mohaa.exe] => (Allow) C:\users\mohamed\appdata\local\temp\rar$exa0.066\mohaa\mohaa.exe Pas de fichier
FirewallRules: [{75BAE6A3-9A9C-4817-8EE7-EA9C8F981BFA}] => (Allow) C:\Program Files\DriversCloud.com\MCDetection.exe Pas de fichier
FirewallRules: [{50CE14A3-311C-44E9-9DE9-A490E1104044}] => (Allow) C:\Program Files\DriversCloud.com\MCDetection.exe Pas de fichier
FirewallRules: [{7622AE58-12DF-4E75-A0F0-4F84623EA2D0}] => (Allow) C:\Users\Mohamed\Steam.exe Pas de fichier
FirewallRules: [{9B0FF3B0-7B76-4084-9F9C-9B7340CCC2D4}] => (Allow) C:\Users\Mohamed\Steam.exe Pas de fichier
FirewallRules: [{07C97CB5-54F3-47CF-BB16-BE01F58A84DB}] => (Allow) C:\Users\Mohamed\bin\steamwebhelper.exe Pas de fichier
FirewallRules: [{A669D5B8-3810-482F-A590-6A13517F5493}] => (Allow) C:\Users\Mohamed\bin\steamwebhelper.exe Pas de fichier
FirewallRules: [TCP Query User{6F8C4DBC-EEB0-4FB1-8AC7-CC31BDC8C736}E:\mohamed\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) E:\mohamed\runtime\jre-x64\1.8.0_25\bin\javaw.exe Pas de fichier
FirewallRules: [UDP Query User{36589716-4E68-4FFF-9BED-442219F0E892}E:\mohamed\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) E:\mohamed\runtime\jre-x64\1.8.0_25\bin\javaw.exe Pas de fichier
FirewallRules: [{F5D5DD4D-317F-4BD6-A2A4-7756682882F3}] => (Allow) E:\SteamLibrary\steamapps\common\Call of Duty Modern Warfare 2\iw4mp.exe Pas de fichier
FirewallRules: [{6FD99922-8AD0-4E00-B8FD-AE5780AF06F2}] => (Allow) E:\SteamLibrary\steamapps\common\Call of Duty Modern Warfare 2\iw4mp.exe Pas de fichier
FirewallRules: [{A43E62DB-64D2-4CF1-B754-3F002506B594}] => (Allow) E:\SteamLibrary\steamapps\common\Call of Duty Modern Warfare 2\iw4sp.exe Pas de fichier
FirewallRules: [{5B4706AA-3B11-4EDE-B3E4-C393124CC48E}] => (Allow) E:\SteamLibrary\steamapps\common\Call of Duty Modern Warfare 2\iw4sp.exe Pas de fichier
FirewallRules: [TCP Query User{37D19D1E-C877-49B8-A322-E590510CA81E}C:\program files\logitech gaming software\lcore.exe] => (Allow) C:\program files\logitech gaming software\lcore.exe Pas de fichier
FirewallRules: [UDP Query User{6E4450C6-1799-475A-97D4-BA514CC06ADF}C:\program files\logitech gaming software\lcore.exe] => (Allow) C:\program files\logitech gaming software\lcore.exe Pas de fichier
FirewallRules: [{19B77C19-DA31-4A8D-AE94-518A867939A3}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe Pas de fichier
FirewallRules: [{0A27A4BE-98D7-4A52-8DE6-D01D5771AE57}] => (Allow) E:\SteamLibrary\steamapps\common\Arma 3\arma3launcher.exe Pas de fichier
FirewallRules: [{A4816718-5331-4355-BCA4-63BD4CBB6CC3}] => (Allow) E:\SteamLibrary\steamapps\common\Arma 3\arma3launcher.exe Pas de fichier
FirewallRules: [TCP Query User{9A5C63DE-B6CE-47E4-A965-F4E67027E18A}E:\world_of_tanks\wotlauncher.exe] => (Allow) E:\world_of_tanks\wotlauncher.exe Pas de fichier
FirewallRules: [UDP Query User{86DE46A8-94C9-4E43-9ABF-CB5AFB5F0B88}E:\world_of_tanks\wotlauncher.exe] => (Allow) E:\world_of_tanks\wotlauncher.exe Pas de fichier
FirewallRules: [TCP Query User{B3BABB9D-B2A7-41DE-BB05-B27463C9136E}C:\program files\logitech gaming software\lcore.exe] => (Block) C:\program files\logitech gaming software\lcore.exe Pas de fichier
FirewallRules: [UDP Query User{7BDD36BB-5F96-4F74-B013-68CE6A4E3547}C:\program files\logitech gaming software\lcore.exe] => (Block) C:\program files\logitech gaming software\lcore.exe Pas de fichier
FirewallRules: [{B77680A0-F77F-4062-B496-08511131470D}] => (Allow) C:\Program Files (x86)\steam\bin\steamwebhelper.exe Pas de fichier
FirewallRules: [{623AEFBB-5B52-4D4A-A860-958E7B6FC98C}] => (Allow) C:\Program Files (x86)\steam\bin\steamwebhelper.exe Pas de fichier
FirewallRules: [{C4279291-1E1A-4B72-B9B9-8AAE2464DDAE}] => (Allow) E:\SteamLibrary\steamapps\common\H1Z1\LaunchPad.exe Pas de fichier
FirewallRules: [{421BED11-7782-4B44-9180-C46CBF2D4262}] => (Allow) E:\SteamLibrary\steamapps\common\H1Z1\LaunchPad.exe Pas de fichier
FirewallRules: [TCP Query User{C23AE792-277C-4930-8AB4-D714A7C419D7}E:\steamlibrary\steamapps\common\h1z1\h1z1.exe] => (Allow) E:\steamlibrary\steamapps\common\h1z1\h1z1.exe Pas de fichier
FirewallRules: [UDP Query User{4C2AEC23-BD95-4DCD-BDB0-D6FF02E2709E}E:\steamlibrary\steamapps\common\h1z1\h1z1.exe] => (Allow) E:\steamlibrary\steamapps\common\h1z1\h1z1.exe Pas de fichier
FirewallRules: [{E644A044-F734-4EB9-92D0-658452DA73EE}] => (Allow) E:\SteamLibrary\steamapps\common\RNR\ShooterGame\Binaries\Win64\RadicalHeights.exe Pas de fichier
FirewallRules: [{57EF2A53-3C9E-4E79-822B-177D7D94FD10}] => (Allow) E:\SteamLibrary\steamapps\common\RNR\ShooterGame\Binaries\Win64\RadicalHeights.exe Pas de fichier
FirewallRules: [{FF3D346E-24F8-47E3-AF21-BD63D4743894}] => (Allow) %systemroot%\system32\alg.exe Pas de fichier
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
HKU\S-1-5-21-1004484390-4179699781-4128157937-1001\...\Run: [FACEIT] => C:\Program Files\FACEIT\FACEIT.exe [81046232 2018-01-11] (FACE IT LIMITED -> FACEIT Ltd.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2019-11-19]
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.1512\SSScheduler.exe (McAfee, LLC -> McAfee, LLC.)
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
Task: {5D19C988-570A-478E-9092-95827BD4F463} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(1): schtasks.exe -> /Change /TN "\OneDrive Standalone Update Task-S-1-5-21-1004484390-4179699781-4128157937-1001" /ENABLE
Task: {5D19C988-570A-478E-9092-95827BD4F463} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(2): schtasks.exe -> /Change /TN "\AVAST Software\Gaming mode Task Scheduler recovery" /DISABLE
Task: {BEF5C94A-49BD-42DF-B759-FEA50AFCC8A9} - \Microsoft\Windows\UNP\RunCampaignManager -> Pas de fichier <==== ATTENTION
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_211\bin\ssv.dll [2019-11-09] (Oracle America, Inc. -> Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_211\bin\jp2ssv.dll [2019-11-09] (Oracle America, Inc. -> Oracle Corporation)
FF Extension: (Avast SafePrice | Comparaison, offres, coupons) - C:\Users\Mohamed\AppData\Roaming\Mozilla\Firefox\Profiles\t09m5q6p.default\Extensions\sp@avast.com.xpi [2019-02-07]
FF Extension: (Avast Online Security) - C:\Users\Mohamed\AppData\Roaming\Mozilla\Firefox\Profiles\t09m5q6p.default\Extensions\wrc@avast.com.xpi [2018-07-21]
FF Plugin: @java.com/DTPlugin,version=11.211.2 -> C:\Program Files\Java\jre1.8.0_211\bin\dtplugin\npDeployJava1.dll [2019-11-09] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.211.2 -> C:\Program Files\Java\jre1.8.0_211\bin\plugin2\npjp2.dll [2019-11-09] (Oracle America, Inc. -> Oracle Corporation)
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx <non trouvé(e)>
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl]
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.1512\McCHSvc.exe [408416 2019-11-13] (McAfee, LLC -> McAfee, LLC.)
S3 OverwolfUpdater; "C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe" /RunningFrom SCM [X]
S2 SkypeUpdate; "C:\Program Files (x86)\Skype\Updater\Updater.exe" [X]
C:\Program Files\McAfee Security Scan
cmd: DISM /Online /Cleanup-image /Restorehealth
cmd: sfc /scannow
emptytemp:
hosts:
end::