start::
closeprocesses:
createrestorepoint:
C:\Program Files\KMSpico
HKU\S-1-5-21-1863569326-408413421-836606265-1001\...\RunOnce: [Application Restart #3] => C:\Users\nathalie\AppData\Local\SweetLabs App Platform\Engine\ServiceHostApp.exe [9562344 2020-09-17] (Pokki, Inc. -> Pokki)
HKU\S-1-5-21-1863569326-408413421-836606265-1001\...\MountPoints2: F - "F:\Setup.exe"
HKU\S-1-5-21-1863569326-408413421-836606265-1001\...\MountPoints2: H - "H:\Autorun.exe"
HKU\S-1-5-21-1863569326-408413421-836606265-1001\...\MountPoints2: {251bd803-b993-11ea-8360-f80f41ee2df2} - "G:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1863569326-408413421-836606265-1001\...\MountPoints2: {3ee39e83-9865-11e5-8267-f80f41ee2df2} - "F:\Setup.exe"
HKU\S-1-5-21-1863569326-408413421-836606265-1001\...\MountPoints2: {3ee3a22b-9865-11e5-8267-f80f41ee2df2} - "H:\Autorun.exe"
HKU\S-1-5-21-1863569326-408413421-836606265-1001\...\MountPoints2: {6a4affe7-fd82-11e9-8331-f80f41ee2df2} - "G:\HiSuiteDownLoader.exe"
GroupPolicy: Restriction ? <==== ATTENTION
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
Task: {0D8A891D-890C-4808-84D8-2F436AB14653} - \Microsoft\Windows\Application Experience\AitAgent -> Pas de fichier <==== ATTENTION
Task: {1274336E-AB06-46B6-A48C-0671C5557CC6} - \Microsoft\Windows\TaskScheduler\Maintenance Configurator -> Pas de fichier <==== ATTENTION
Task: {1687544D-7247-4F5A-965A-A6E920E55278} - \Microsoft\Windows\TaskScheduler\Manual Maintenance -> Pas de fichier <==== ATTENTION
Task: {21A83BE3-EFF6-4B2A-B43A-1A90CB00463B} - \Optimize Thumbnail Cache Files -> Pas de fichier <==== ATTENTION
Task: {54A2DAAB-5199-44AE-AABC-CBF7C67865BC} - System32\Tasks\AutoPico Daily Restart => C:\Program Files\KMSpico\AutoPico.exe
Task: {5AE4DCF3-5B10-4809-9707-6EFEB4CD9D9F} - System32\Tasks\SweetLabs App Platform => C:\Users\nathalie\AppData\Local\SweetLabs App Platform\Engine\ServiceHostAppUpdater.exe [10627304 2020-09-17] (Pokki, Inc. -> Pokki)
Task: {6F02587F-8A2B-4552-97F6-DEEF229E335B} - \Microsoft\Windows\TaskScheduler\Idle Maintenance -> Pas de fichier <==== ATTENTION
Task: {B7992938-01F1-4F40-A0EC-0D23D2F0F152} - \Microsoft\Windows\TaskScheduler\Regular Maintenance -> Pas de fichier <==== ATTENTION
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - \Microsoft\Windows\SettingSync\BackupTask -> Pas de fichier <==== ATTENTION
Task: C:\Windows\Tasks\Yahoo! Powered fafef.job => Wscript exe
HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings: [ProxySettingsPerUser] 1 <==== ATTENTION (Restriction - ProxySettings)
ProxyEnable: [HKLM] => Proxy est activé.
ProxyEnable: [HKLM-x32] => Proxy est activé.
ProxyServer: [HKLM] => http=127.0.0.1:8080;https=127.0.0.1:8080
ProxyServer: [HKLM-x32] => http=127.0.0.1:8080;https=127.0.0.1:8080
ManualProxies: 1http=127.0.0.1:8080;https=127.0.0.1:8080
FF NetworkProxy: Mozilla\Firefox\Profiles\wb94sgml.default-release-1572785222952 -> type", 0
FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\e10ssaffplg.xpi => non trouvé(e)
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\e10ssaffplg.xpi => non trouvé(e)
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho]
CHR HKLM\...\Chrome\Extension: [ljibkigjccbegnbeojkoafejpoiachej]
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx <non trouvé(e)>
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx <non trouvé(e)>
CHR HKLM-x32\...\Chrome\Extension: [ljibkigjccbegnbeojkoafejpoiachej]
R2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [745664 2016-01-12] (@ByELDI -> @ByELDI) [Fichier non signé]
S2 avast! Tools; "C:\Program Files\AVAST Software\Avast\aswToolsSvc.exe" /runassvc [X]
S3 mfesapsn; \??\C:\Program Files (x86)\McAfee\SiteAdvisor\x64\mfesapsn.sys [X]
C:\Program Files (x86)\McAfee
2020-10-23 17:02 - 2015-10-27 17:22 - 000000000 ____D C:\Users\nathalie\AppData\Local\SweetLabs App Platform
2020-10-22 16:42 - 2019-08-19 16:51 - 000003316 _____ C:\Windows\system32\Tasks\SweetLabs App Platform
2020-10-22 16:42 - 2018-02-22 19:00 - 000003368 _____ C:\Windows\system32\Tasks\AutoPico Daily Restart
removeproxy:
emptytemp:
end::