start::
closeprocesses:
createrestorepoint:
AS: Avast Antivirus (Enabled - Up to date) {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402}
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Pas de fichier
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> Pas de fichier
AlternateDataStreams: C:\Users\Public\AppData:CSM [470]
IE trusted site: HKU\S-1-5-21-3171075569-597420775-2699628640-1001\...\webcompanion.com -> hxxp://webcompanion.com
SearchScopes: HKU\S-1-5-21-3171075569-597420775-2699628640-1001 -> {6BE9E2B7-F2CB-4224-A355-C75913A40354} URL =
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\defaults\pref\dsengine.js [2018-01-30] <==== ATTENTION (Pointe vers un fichier *.cfg)
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\dsengine.cfg [2018-01-30] <==== ATTENTION
C:\Users\weina\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki]
S3 mracsvc; C:\WINDOWS\System32\mracsvc.exe [18534552 2019-10-09] (Mail.Ru LLC -> LLC Mail.Ru)
S3 mracdrv; C:\WINDOWS\System32\drivers\mracdrv.sys [17770920 2019-10-09] (Mail.Ru LLC -> LLC Mail.Ru)
C:\WINDOWS\System32\mracsvc.exe
C:\WINDOWS\System32\drivers\mracdrv.sys
2020-02-06 17:56 - 2018-02-18 05:24 - 000000000 ____D C:\Users\weina\AppData\Local\AVAST Software
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
GroupPolicy: Restriction ? <==== ATTENTION
Task: {D0A3F999-CC17-4957-8A45-80256F454957} - System32\Tasks\ACC => C:\Program Files\DriverSetupUtility\FUB\FUB_Send.bat
C:\Program Files\DriverSetupUtility
C:\Program Files\AVAST Software
S3 aswTap; C:\WINDOWS\System32\drivers\aswTap.sys [53904 2018-01-14] (AVAST Software s.r.o. -> The OpenVPN Project)
C:\WINDOWS\System32\drivers\aswTap.sys
2020-02-06 17:56 - 2018-02-18 05:24 - 000000000 ____D C:\Users\weina\AppData\Local\AVAST Software
2020-01-17 16:41 - 2018-01-14 19:02 - 000000000 ____D C:\ProgramData\AVAST Software
cmd: md C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database
C:\Windows\System32\SppExtComObj.Exe
emptytemp:
end::