start::
closeprocesses:
createrestorepoint:
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2133728 2017-09-12] (Wondershare Technology Co.,Ltd -> Wondershare)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [601424 2018-07-07] (Oracle America, Inc. -> Oracle Corporation)
HKLM\Software\...\Authentication\Credential Providers: [{503739d0-4c5e-4cfd-b3ba-d881334f0df2}] ->
HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
Task: {00FA98C7-4878-4911-977E-063C8994A139} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {043DAA29-DD3B-4736-97E3-03146E6D19B6} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\WINDOWS\ehome\mcupdate.exe
Task: {04A77687-73BD-4E14-936C-721EBC939BD2} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Pas de fichier <==== ATTENTION
Task: {075185DE-4275-4714-9215-03FE8629762A} - System32\Tasks\Microsoft\Windows\SideShow\SystemDataProviders => {7CCA6768-8373-4D28-8876-83E8B4E3A969}
Task: {10638249-8AE6-4FAD-893B-86705A203ABE} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {14457018-04AB-4060-9592-1FF0AD504E46} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {1FA43463-281F-4D76-B224-18347113ED0C} - System32\Tasks\Microsoft\Windows\SideShow\SessionAgent => {45F26E9E-6199-477F-85DA-AF1EDFE067B1}
Task: {2A9EE1BB-FAB3-46E9-A51B-F451EA1027CA} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Pas de fichier <==== ATTENTION
Task: {2E553C9F-A150-43FC-BB96-AF42C42C2B76} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {33279DED-B0AF-4F5B-8329-E61D63AEBD02} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\WINDOWS\ehome\MCUpdate.exe
Task: {3FF7DAD7-1D2E-423F-94B0-73E86DF8FA90} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {507A6E45-0C71-4240-AA1C-1FF2EC94B1D2} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {53756F56-86AA-4BD2-BAF8-B894BD96C0B8} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {5B937C67-201A-4996-A4BF-6430B44CF54F} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {60358AB0-4E7E-40AF-960C-7999885EFEE1} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\WINDOWS\ehome\ehrec.exe
Task: {62F06C65-E700-438F-A941-F407AF26B3D3} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {7555CFAE-4449-4EDC-B8C7-E6D0DE6D03C5} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {803D7695-B52D-4E62-A454-001ABA61A1BE} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {83F9864F-F5B6-4103-A156-D9FB1F3EAE89} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Pas de fichier <==== ATTENTION
Task: {970FE7AB-73A3-48FE-9651-92A2D0E6A204} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {B064B0A7-9536-40BF-99C1-EEF5D0EBF3EC} - \Microsoft\Windows\UNP\RunCampaignManager -> Pas de fichier <==== ATTENTION
Task: {B4323234-9F97-4368-93C0-A2237CC6B1F2} - \OfficeSoftwareProtectionPlatform\SvcRestartTask -> Pas de fichier <==== ATTENTION
Task: {B77AC9CB-020A-41AD-B0FC-EF9E599909D0} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {B8994EDD-4011-4268-9EC0-52F1A8F61849} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {B92DA8B1-A46D-4BA9-BF69-72835686FF97} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {BDDDEE0F-D010-4BE6-8271-30F122E5152B} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\WINDOWS\ehome\mcupdate.exe
Task: {CC84DBE4-28B4-40DB-B1E6-2CB9E6AF7908} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {D836C6AB-D52E-4493-9213-E0FCE1F98528} - System32\Tasks\Microsoft\Windows\SideShow\AutoWake => {E51DFD48-AA36-4B45-BB52-E831F02E8316}
Task: {E18829BE-E842-4673-9C02-F8FC9732E92E} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\WINDOWS\ehome\ehrec.exe
Task: {EF499D10-B240-4B2B-B315-F86CFB2ABB39} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Pas de fichier <==== ATTENTION
FF Plugin-x32: ZEON/PDF,version=2.0 -> C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll [Pas de fichier]
FF HKLM-x32\...\Firefox\Extensions: [{22C7F6C6-8D67-4534-92B5-529A0EC09405}] - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\firefoxextension => non trouvé(e)
R2 TiMiniService; C:\Program Files\Trend Micro\Titanium\TiMiniService.exe [241488 2010-09-17] (Trend Micro, Inc. -> Trend Micro Inc.)
C:\Program Files\Trend Micro
ContextMenuHandlers5: [Gadgets] -> {6B9228DA-9C15-419e-856C-19E768A13BDC} => -> Pas de fichier
BHO-x32: Pas de nom -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> Pas de fichier
HKU\S-1-5-21-4270432977-1324208516-1762384196-1000\...\StartupApproved\Run: => "cacaoweb"
HKU\S-1-5-21-4270432977-1324208516-1762384196-1000\...\StartupApproved\Run: => "DAEMON Tools Lite"
FirewallRules: [UDP Query User{B3A9BCC2-26B0-4E10-ABB4-F419E5986CD8}C:\users\utilisateur\appdata\roaming\cacaoweb\cacaoweb.exe] => (Block) C:\users\utilisateur\appdata\roaming\cacaoweb\cacaoweb.exe (CACAOWEB Ltd -> )
FirewallRules: [TCP Query User{40F1ADD9-E8F6-4E1B-8F5F-973AFC729B75}C:\users\utilisateur\appdata\roaming\cacaoweb\cacaoweb.exe] => (Block) C:\users\utilisateur\appdata\roaming\cacaoweb\cacaoweb.exe (CACAOWEB Ltd -> )
FirewallRules: [UDP Query User{1112AF09-091A-44EB-8D39-753FE07E9203}C:\program files (x86)\java\jre1.8.0_151\bin\java.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_151\bin\java.exe => Pas de fichier
FirewallRules: [TCP Query User{2D8F2631-F38A-4D32-947C-CC4EBB6121C8}C:\program files (x86)\java\jre1.8.0_151\bin\java.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_151\bin\java.exe => Pas de fichier
FirewallRules: [{7B14D0A5-9527-4C35-BE55-074E48C1565D}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe => Pas de fichier
FirewallRules: [{75A0BB83-AFF6-4C07-9035-9AD680BB1D12}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe => Pas de fichier
FirewallRules: [{CCF8F413-FC2A-40DE-A810-70BEEFA9295E}] => (Allow) C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe => Pas de fichier
FirewallRules: [{565DF4CD-689D-4ED3-B89B-F553445C222A}] => (Allow) C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe => Pas de fichier
FirewallRules: [{EADC6D49-0D31-4E90-A0DF-6F7F492CEA23}] => (Allow) C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe => Pas de fichier
FirewallRules: [{A4D289CB-96CF-4B71-BE3F-324E98082BA0}] => (Allow) C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe => Pas de fichier
FirewallRules: [{8B81A0EB-665F-4C92-8C37-32CB170CA6C0}] => (Allow) C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe => Pas de fichier
FirewallRules: [{4730A738-BC4C-442D-A8B0-4C590635B90E}] => (Allow) C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe => Pas de fichier
FirewallRules: [{471E2AC7-6DA6-420F-9419-80B1FF306758}] => (Allow) C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe => Pas de fichier
FirewallRules: [{FFA12778-25F2-40F1-B15E-676EE75B9299}] => (Allow) C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe => Pas de fichier
FirewallRules: [{32B5386B-3D9F-426B-854D-1C2DC893F2D9}] => (Allow) C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe => Pas de fichier
FirewallRules: [{8C083766-6B53-49BF-9C28-B771053BD7ED}] => (Allow) C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe => Pas de fichier
FirewallRules: [{723E2F34-45BB-4F26-AB98-D42D3283422F}] => (Allow) C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe => Pas de fichier
FirewallRules: [{8E8E0A0B-5993-479F-B784-9D3ECB48B33D}] => (Allow) C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe => Pas de fichier
FirewallRules: [{07742D87-A7A5-488A-8915-4F2F7643E506}] => (Allow) C:\Program Files (x86)\IncrediMail\Bin\ImApp.exe => Pas de fichier
FirewallRules: [{30ADA54E-CF93-4F7A-A4D2-384B422D0893}] => (Allow) C:\Program Files (x86)\IncrediMail\Bin\ImApp.exe => Pas de fichier
FirewallRules: [{D0ACC625-961D-45FD-B12B-B8B59B135A0D}] => (Allow) C:\Users\Utilisateur\AppData\Roaming\Zoom\bin\airhost.exe => Pas de fichier
cmd: md C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database
cmd: sfc /scannow
emptytemp:
end::