start::
CreateRestorePoint:
CloseProcesses:
Hosts:
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Pas de fichier
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Pas de fichier
ContextMenuHandlers5: [Gadgets] -> {6B9228DA-9C15-419e-856C-19E768A13BDC} => -> Pas de fichier
HKLM\software\microsoft\Windows\CurrentVersion\Telephony\Providers => ProviderFileName2 -> ndptsp.tsp (Pas de fichier)
FirewallRules: [{B938594E-477F-4E37-A90E-AA529543D300}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe => Pas de fichier
FirewallRules: [{0AAB0B40-5525-40B8-9DBC-BE44AF1859CD}] => (Allow) C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fi.exe => Pas de fichier
FirewallRules: [{6A5305F2-B783-4F7F-8964-7A242F015272}] => (Allow) C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe => Pas de fichier
FirewallRules: [{D01A721D-9941-4D3F-907C-1C190B809703}] => (Allow) C:\Program Files (x86)\Acer\clear.fi\MVP\Kernel\CLML\CLMLSvc.exe => Pas de fichier
FirewallRules: [{5FC6F322-B891-4985-A38A-A57FFCA1724B}] => (Allow) C:\Program Files (x86)\Acer\clear.fi\MVP\Kernel\DMR\DMREngine.exe => Pas de fichier
FirewallRules: [{160A20CC-020E-40D5-A7C7-46EF06E36647}] => (Allow) C:\Program Files (x86)\Acer\clear.fi\MVP\Kernel\DMR\DMREngine.exe => Pas de fichier
FirewallRules: [{C42F2F89-971F-4DA5-8F9A-899599C85387}] => (Block) C:\Program Files (x86)\Acer\clear.fi\MVP\Kernel\DMR\DMREngine.exe => Pas de fichier
FirewallRules: [{781F4A50-BD3A-49E2-9842-BBAA9AD49BC8}] => (Allow) C:\Program Files (x86)\Acer\clear.fi\Movie\TouchMovie.exe => Pas de fichier
FirewallRules: [{46F5CF49-121F-4B3E-B191-ABA7FF5CF36C}] => (Allow) C:\Program Files (x86)\Acer\clear.fi\Movie\TouchMovieService.exe => Pas de fichier
FirewallRules: [{0214D1B9-68B3-449D-8508-3A7CFB60272E}] => (Allow) D:\fscommand\CKSocketServer.exe => Pas de fichier
FirewallRules: [{2C5A7C3B-1A88-4238-8B2A-01C335AA1BDC}] => (Allow) D:\fscommand\CKSocketServer.exe => Pas de fichier
FirewallRules: [{58FCAAB7-C826-426D-BD03-B7DEAF3B16F4}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe => Pas de fichier
FirewallRules: [{447F956C-7F76-4534-9C7B-AF7F4FE598E3}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe => Pas de fichier
FirewallRules: [{6C468EFB-8C33-47D6-9A0C-A4F86DA84577}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe => Pas de fichier
FirewallRules: [{53D63738-5C06-410A-AEF0-6F8983E180E6}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe => Pas de fichier
FirewallRules: [{6EED522E-F79C-41B0-988E-63BB6C091AF0}] => (Allow) C:\Program Files (x86)\Origin Games\FIFA 13\Game\fifa13.exe => Pas de fichier
FirewallRules: [{1C1E47DE-C861-48D9-86F7-F23B4DA892BF}] => (Allow) C:\Program Files (x86)\Origin Games\FIFA 13\Game\fifa13.exe => Pas de fichier
FirewallRules: [{7A1A8BA2-6F26-482E-A3F8-FC7BC6329DD6}] => (Allow) C:\Users\Jb\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe => Pas de fichier
FirewallRules: [TCP Query User{3F4C57E7-4DA1-4905-BD71-B8AAF3C7B1F7}C:\program files\windowsapps\xbmcfoundation.kodi_17.3.8.0_x86__4n2hpmxwrvr6p\kodi.exe] => (Block) C:\program files\windowsapps\xbmcfoundation.kodi_17.3.8.0_x86__4n2hpmxwrvr6p\kodi.exe => Pas de fichier
C:\program files\windowsapps\xbmcfoundation.kodi_17.3.8.0_x86__4n2hpmxwrvr6p
FirewallRules: [TCP Query User{0BF6AE6A-9915-43BD-AB24-36041CF044E4}C:\users\jb\appdata\local\citra\nightly-mingw\citra-qt.exe] => (Allow) C:\users\jb\appdata\local\citra\nightly-mingw\citra-qt.exe => Pas de fichier
FirewallRules: [UDP Query User{3BBAABD3-ED81-4193-9F63-0BFD081FF4F2}C:\users\jb\appdata\local\citra\nightly-mingw\citra-qt.exe] => (Allow) C:\users\jb\appdata\local\citra\nightly-mingw\citra-qt.exe => Pas de fichier
C:\users\jb\appdata\local\citra
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
GroupPolicy: Restriction ? <==== ATTENTION
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
Task: {329FC285-C2C1-48A9-A966-CA4F2AB3F172} - \OfficeSoftwareProtectionPlatform\SvcRestartTask -> Pas de fichier <==== ATTENTION
Task: {5B77A94F-6825-4D9B-AAB5-6E692E876BAE} - \{F91C4A1C-22E8-403D-9499-AC9E2857DD3F} -> Pas de fichier <==== ATTENTION
Task: {B4FD52B2-0E2B-40CA-9EF3-97BA2190C04B} - \Microsoft\Windows\UNP\RunCampaignManager -> Pas de fichier <==== ATTENTION
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
earchScopes: HKU\S-1-5-21-3996360981-1878509942-3273488272-1000 -> DefaultScope {015DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL =
SearchScopes: HKU\S-1-5-21-3996360981-1878509942-3273488272-1000 -> {73cd434e-8e1e-46b6-bb8d-7dd935140717} URL =
FF NewTab: Mozilla\Firefox\Profiles\actnd0fi.default-1409319162568 -> about:newtab
FF NetworkProxy: Mozilla\Firefox\Profiles\actnd0fi.default-1409319162568 -> autoconfig_url", "file://C:/Program Files (x86)/ChrisPC Anonymous Proxy Pro/chrispc_proxy_fox.pac"
FF Session Restore: Mozilla\Firefox\Profiles\actnd0fi.default-1409319162568 -> est activé.
FF Notifications: Mozilla\Firefox\Profiles\actnd0fi.default-1409319162568 -> hxxps://mail.google.com; hxxps://www.campings.com; hxxps://www1.ramirocampos.pro
FF Extension: (Facebook Container) - C:\Users\Jb\AppData\Roaming\Mozilla\Firefox\Profiles\actnd0fi.default-1409319162568\Extensions\@contain-facebook.xpi [2018-06-28]
FF Extension: (Avast SafePrice | Comparaison, offres, coupons) - C:\Users\Jb\AppData\Roaming\Mozilla\Firefox\Profiles\actnd0fi.default-1409319162568\Extensions\sp@avast.com.xpi [2019-02-10]
FF Extension: (Avast Online Security) - C:\Users\Jb\AppData\Roaming\Mozilla\Firefox\Profiles\actnd0fi.default-1409319162568\Extensions\wrc@avast.com.xpi [2020-04-23] [UpdateUrl:hxxps://firefoxext.avcdn.net/firefoxext/avast/aos/update.json]
FF HKLM-x32\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru => non trouvé(e)
C:\Program Files (x86)\Kaspersky Lab
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki]
U3 idsvc; pas de ImagePath
2020-07-12 20:29 - 2020-07-12 20:29 - 000008882 _____ C:\Users\Jb\Desktop\ZHPCleaner (S).html
2020-07-12 19:27 - 2020-07-12 19:37 - 000000911 _____ C:\Users\Jb\Desktop\ZHPCleaner.lnk
2020-07-12 19:19 - 2020-07-12 19:19 - 000000901 _____ C:\Users\Jb\Desktop\ZHPDiag.lnk
2020-07-12 19:17 - 2020-07-12 19:17 - 003308928 _____ (Nicolas Coolman) C:\Users\Jb\Desktop\ZHPCleaner.exe
2020-07-12 19:16 - 2020-07-12 19:16 - 003287936 _____ (Nicolas Coolman) C:\Users\Jb\Desktop\ZHPDiag3.exe
2020-07-13 13:58 - 2018-04-05 17:58 - 000000000 ____D C:\Users\Jb\AppData\Local\AVAST Software
2020-07-13 13:58 - 2017-01-13 18:30 - 000000000 ____D C:\ProgramData\AVAST Software
2020-07-13 13:06 - 2019-09-29 21:56 - 000000000 ____D C:\WINDOWS\system32\Tasks\AVAST Software
2020-07-12 20:29 - 2015-12-15 21:44 - 000000000 ____D C:\Users\Jb\AppData\Roaming\ZHP
2015-12-17 09:53 - 2020-06-07 10:55 - 003305856 _____ (Nicolas Coolman) C:\Users\Jb\ZHPCleaner.exe
2015-12-17 09:46 - 2020-06-07 10:55 - 003284864 _____ (Nicolas Coolman) C:\Users\Jb\ZHPDiag3.exe
cmd: md C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database
cmd: DISM /Online /Cleanup-image /Restorehealth
C:\Windows\Temp\*.*
C:\Users\CurrentUserName\AppData\Local\Temp\*.*
cmd: ipconfig /flushdns
end::