start::
CreateRestorePoint:
CloseProcesses:
RemoveProxy:
Task: {1AF79834-EFD8-4E0A-8BE8-E6BC626644D6} - System32\Tasks\AutoPico Daily Restart => C:\Program Files\KMSpico\AutoPico.exe
Task: {91786B4F-A78A-453F-9D1F-E872D4A5198C} - System32\Tasks\Skype => C:\Users\duval\AppData\Roaming\Colis_disponible.vbs
AppInit_DLLs: C:\PROGRA~3\Wincert\WIN64C~1.DLL => Pas de fichier
AppInit_DLLs: C:\PROGRA~2\MOVIES~1\SAFETY~1\x64\SAFETY~2.DLL => Pas de fichier
AppInit_DLLs: C:\PROGRA~2\OPTIMI~1\OPTPRO~2.DLL => Pas de fichier
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2014-06-05]
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc. -> McAfee, Inc.)
BootExecute: autocheck autochk * SmartDefragBootTime.exe
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
Task: {369C3CE1-BD52-4F88-8390-582002865507} - System32\Tasks\SomotoUpdateCheckerAutoStart => C:\Users\duval\AppData\Local\FilesFrog Update Checker\update_checker.exe
Task: {B59B542F-12BF-4183-8802-D6583999BE43} - System32\Tasks\{797BA27C-3635-A396-3AEE-11486F7A077B} => C:\Users\duval\AppData\Roaming\797BA2~1\suhega.exe
Task: {B7992938-01F1-4F40-A0EC-0D23D2F0F152} - \Microsoft\Windows\TaskScheduler\Regular Maintenance -> Pas de fichier
Task: {E39B3A2D-572A-495F-8F4E-C4A7E819E3CB} - \Yahoo! Powered mecif -> Pas de fichier
SearchScopes: HKU\S-1-5-21-3872770883-2014139652-552975785-1001 -> DefaultScope {7E973E23-E09D-41D2-958E-E77AF94332D6} URL =
SearchScopes: HKU\S-1-5-21-3872770883-2014139652-552975785-1001 -> {10C7D3F7-8DBF-4C82-8A2D-CFD328389601} URL = hxxps://fr.search.yahoo.com/yhs/search?hspart=
SearchScopes: HKU\S-1-5-21-3872770883-2014139652-552975785-1001 -> {7E973E23-E09D-41D2-958E-E77AF94332D6} URL = hxxp://q.search-story.com/search?q=
BHO: Pas de nom -> {31ad400d-1b06-4e33-a59a-90c2c140cba0} -> Pas de fichier
BHO: McAfee WebAdvisor -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> C:\Program Files\McAfee\WebAdvisor\x64\IEPlugin.dll
BHO-x32: Pas de nom -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> Pas de fichier
Toolbar: HKLM - Pas de nom - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - Pas de fichier
Toolbar: HKLM - Pas de nom - {ae07101b-46d4-4a98-af68-0333ea26e113} - Pas de fichier
Toolbar: HKLM - Pas de nom - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - Pas de fichier
Toolbar: HKLM-x32 - Pas de nom - {ae07101b-46d4-4a98-af68-0333ea26e113} - Pas de fichier
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll Pas de fichier
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho]
CHR HKU\S-1-5-21-3872770883-2014139652-552975785-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce]
CHR HKU\S-1-5-21-3872770883-2014139652-552975785-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej]
CHR HKLM-x32\...\Chrome\Extension: [bopakagnckmlgajfccecajhnimjiiedh]
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck]
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl]
R2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe
AlternateDataStreams: C:\ProgramData\Temp:2CB9631F [134]
AlternateDataStreams: C:\ProgramData\Temp:70B3C619 [119]
AlternateDataStreams: C:\ProgramData\Temp:FACB65E7 [131]
IE trusted site: HKU\.DEFAULT\...\webcompanion.com -> hxxp://webcompanion.com
IE trusted site: HKU\S-1-5-21-3872770883-2014139652-552975785-1001\...\webcompanion.com -> hxxp://webcompanion.com
EmptyTemp:
cmd: ipconfig /flushdns
end::