start::
CreateRestorePoint:
CloseProcesses:
Hosts:
RemoveProxy:
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
HKU\S-1-5-21-4178424111-3086846748-1683071943-1001\...\RunOnce: [Application Restart #1] => C:\Users\GUERRA Dominique\AppData\Local\WebDefence\1.33.0\chromium\chromium.exe
SearchScopes: HKLM -> DefaultScope {38C138C3-8A17-4C5F-8F12-AAAB7425B86E} URL = hxxps://fr.search.yahoo.com/yhs/search?hspart=
SearchScopes: HKLM -> {38C138C3-8A17-4C5F-8F12-AAAB7425B86E} URL = hxxps://fr.search.yahoo.com/yhs/search?hspart=arh&hsimp=
SearchScopes: HKLM-x32 -> DefaultScope {38C138C3-8A17-4C5F-8F12-AAAB7425B86E} URL = hxxps://fr.search.yahoo.com/yhs/search?hspart=
SearchScopes: HKLM-x32 -> {38C138C3-8A17-4C5F-8F12-AAAB7425B86E} URL = hxxps://fr.search.yahoo.com/yhs/search?hspart=arh&hsimp=yhs-001&type=
SearchScopes: HKU\S-1-5-21-4178424111-3086846748-1683071943-1001 -> {2f23ab71-4ac6-41f2-a955-ea576e553146} URL = hxxps://fr.search.yahoo.com/yhs/search?hspart=
SearchScopes: HKU\S-1-5-21-4178424111-3086846748-1683071943-1001 -> {38C138C3-8A17-4C5F-8F12-AAAB7425B86E} URL = hxxps://fr.search.yahoo.com/yhs/search?hspart=
SearchScopes: HKU\S-1-5-21-4178424111-3086846748-1683071943-1001 -> {3AC138C3-8A17-4C5F-8F12-AAAB7425B86E} URL =
SearchScopes: HKU\S-1-5-21-4178424111-3086846748-1683071943-1001 -> {9AC90C18-E488-4B8E-977F-AD0D919D4871} URL =
SearchScopes: HKU\S-1-5-21-4178424111-3086846748-1683071943-1001 -> {f79e5d1c-5148-469e-9f98-a11d8d7863f4} URL = hxxps://fr.search.yahoo.com/yhs/search?hspart=
Edge HomePage: Default -> hxxps://fr.search.yahoo.com/yhs/web?hspart=omr&hsimp=yhs-001&type=87aeuhewiom1bdfhjlntz65m001720¶m1=
Edge StartupUrls: Default -> "hxxps://fr.search.yahoo.com/yhs/web?hspart=omr&hsimp=yhs-001&type=87aeuhewiom1bdfhjlntz65m001720¶m1=
Edge DefaultSearchURL: Default -> hxxps://fr.search.yahoo.com/yhs/search?hspart=omr&hsimp=yhs-001&type=87aeuhewiom1bdfhjlntz65m001720¶m1=
Edge DefaultSearchKeyword: Default -> search.yahoo.com
Edge DefaultSuggestURL: Default -> hxxps://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
FF Homepage: Mozilla\Firefox\Profiles\xdtly1f1.default -> hxxps://fr.search.yahoo.com/yhs/web?hspart=
FF NewTab: Mozilla\Firefox\Profiles\xdtly1f1.default -> hxxps://fr.search.yahoo.com/yhs/web?hspart=omr&hsimp=yhs-001&type=
FF SearchPlugin: C:\Users\GUERRA Dominique\AppData\Roaming\Mozilla\Firefox\Profiles\xdtly1f1.default\searchplugins\Yahoo powered search.xml
CHR HKLM\...\Chrome\Extension: [icmgebopaejnjlncllgmcenbbflikfjd]
CHR HKU\S-1-5-21-4178424111-3086846748-1683071943-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [icmgebopaejnjlncllgmcenbbflikfjd]
CHR HKLM-x32\...\Chrome\Extension: [icmgebopaejnjlncllgmcenbbflikfjd]
S2 ByteFenceService; "C:\Program Files\ByteFence\ByteFenceService.exe" [X] <==== ATTENTION
S3 QASvc; "C:\Program Files\Acer\Acer Quick Access\QASvc.exe" [X]
S2 rtop; "c:\program files\bytefence\rtop\bin\rtop_svc.exe" [X] <==== ATTENTION
S3 UEIPSvc; "C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe" [X]
R2 SAntivirusIC; C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusIC.exe [7057904 2020-04-25]
R2 SAntivirusSvc; C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusService.exe [192496 2020-04-25]
R1 SANTIVIRUSKD; C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusKD.sys [90096 2020-04-25]
2020-05-18 18:16 - 2020-05-18 18:16 - 000000000 ____D C:\Users\GUERRA Dominique\AppData\Roaming\santivirusclient
2020-05-09 15:52 - 2020-05-09 15:52 - 000000000 ____D C:\ProgramData\{20F51CC9-08DD-64B1-5085-4C99B86D9441}
2020-04-25 18:08 - 2020-04-25 18:08 - 000000000 ____D C:\ProgramData\ByteFence
2020-04-25 17:32 - 2020-04-25 17:32 - 000000000 ____D C:\ProgramData\{0DC431F8-25EC-4980-7DB4-61A8955CB970}
2020-04-25 17:30 - 2020-05-14 17:42 - 000000000 ____D C:\Users\GUERRA Dominique\AppData\Local\WebDefence
2020-04-25 17:29 - 2020-04-25 17:29 - 000000000 ____D C:\ProgramData\SAntivirus
2020-04-25 17:29 - 2020-04-25 17:29 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SAntivirus
2020-04-25 17:28 - 2020-05-14 18:31 - 000000000 ____D C:\ProgramData\Avast Software
2020-04-25 17:28 - 2020-04-25 17:37 - 000000000 ____D C:\ProgramData\mgeec
2020-05-14 18:31 - 2019-09-27 21:56 - 000000000 ____D C:\Users\GUERRA Dominique\AppData\Roaming\AVAST Software
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Pas de fichier
HKU\S-1-5-21-4178424111-3086846748-1683071943-1001\...\StartupApproved\Run: => "WebDefence"
cmd: md C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database
EmptyTemp:
cmd: ipconfig /flushdns
end::