start::
CreateRestorePoint:
CloseProcesses:
Hosts:
RemoveProxy:
HKLM-x32\...\Run: [ProductUpdater] => C:\Program Files (x86)\Common Files\Freemake Shared\ProductUpdater\ProductUpdater.exe
HKU\S-1-5-21-1857130635-2784383269-3291584356-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-1857130635-2784383269-3291584356-1000\...\MountPoints2: {25eddacb-95a2-11e8-8c23-bcaec53ce597} - G:\OnePlus_setup.exe /s
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Avid Application Manager.lnk
ShortcutTarget: Avid Application Manager.lnk -> C:\Program Files\Avid\Application Manager\AvidApplicationManager.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\TVR Scheduler.lnk
ShortcutTarget: TVR Scheduler.lnk -> C:\Program Files (x86)\honestech\honestech TVR 2.5\scheduleTV.exe
GroupPolicyScripts: Restriction <==== ATTENTION
Task: {10DAABB1-E9B0-4220-BED3-0699B1D7BA4A} - pas de chemin du fichier
Task: {BE4E8C4B-DEA8-4728-879C-E877F1E30836} - pas de chemin du fichier
S1 Aspi32; pas de ImagePath
HKU\S-1-5-21-1857130635-2784383269-3291584356-1000\...\ChromeHTML: -> <==== ATTENTION
2020-09-26 16:00 - 2020-09-26 16:00 - 000000000 ____D C:\ProgramData\{BCE31F01-B7B0-8D5B-277A-9B4648687D11}
2020-09-26 15:51 - 2020-09-26 15:51 - 000000000 ____D C:\ProgramData\SystemAcCrux
FCheck: C:\Windows\SysWOW64\dlumd10.dll [2002-01-01]
FCheck: C:\Windows\SysWOW64\dlumd11.dll [2002-01-01]
FCheck: C:\Windows\SysWOW64\dlumd9.dll [2002-01-01]
FCheck: C:\Windows\system32\dlumd10.dll [2002-01-01]
FCheck: C:\Windows\system32\dlumd11.dll [2002-01-01]
FCheck: C:\Windows\system32\dlumd9.dll [2002-01-01]
AlternateDataStreams: C:\ProgramData\TEMP:0B3EF173 [256]
AlternateDataStreams: C:\Users\POSTE\Cookies:GDENYeDz22RVMAMhI6Bgqk5fSZ [2652]
AlternateDataStreams: C:\Users\POSTE\Local Settings:OB1xom75CxWIXhmNlimyeLxV [2590]
AlternateDataStreams: C:\Users\POSTE\AppData\Local:OB1xom75CxWIXhmNlimyeLxV [2590]
AlternateDataStreams: C:\Users\POSTE\AppData\Local\Application Data:OB1xom75CxWIXhmNlimyeLxV [2590]
AlternateDataStreams: C:\Users\POSTE\AppData\Local\Temp:eFvVJGUWI82ePX9xgCegNd [2484]
AlternateDataStreams: C:\Users\POSTE\AppData\Local\Temp:g9Gm2uLvKfz2A4AMEdR32I [2424]
AlternateDataStreams: C:\Users\POSTE\AppData\Local\TEZToWHMl:CTlIW6u9KWjD9ZRDkRxlWRP [2456]
S2 Sentinel64; C:\Windows\System32\Drivers\Sentinel64.sys
2020-09-28 14:59 - 2020-10-17 23:55 - 000000000 ____D C:\ProgramData\MAGIX
2020-09-28 14:59 - 2020-09-28 15:02 - 000000000 ____D C:\Users\POSTE\AppData\Roaming\MAGIX
2020-09-28 14:59 - 2020-09-28 15:02 - 000000000 ____D C:\Users\POSTE\AppData\Local\MAGIX
2020-10-18 16:37 - 2018-06-21 16:53 - 000000000 ____D C:\Program Files (x86)\Panda Security
2020-10-18 16:34 - 2018-06-23 18:28 - 000000000 ____D C:\Program Files (x86)\QuickTime
2020-10-18 16:28 - 2018-06-21 16:30 - 000000000 ____D C:\ProgramData\Panda Security
2020-10-18 16:27 - 2018-06-21 16:54 - 000000000 ____D C:\Users\POSTE\AppData\Roaming\Panda Security
EmptyTemp:
cmd: netsh advfirewall reset
cmd: ipconfig /flushdns
cmd: netsh winsock reset
cmd: sfc /scannow
end::