start::
closeprocesses:
createrestorepoint:
ContextMenuHandlers5: [Gadgets] -> {6B9228DA-9C15-419e-856C-19E768A13BDC} => -> Pas de fichier
SearchScopes: HKLM -> {8CDE19E6-71C2-4B46-89B7-35F6A18C571A} URL =
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> Pas de fichier
HKLM\...\StartupApproved\Run32: => "IObit Malware Fighter"
FirewallRules: [UDP Query User{626C9A6C-7F32-4B73-87BB-F81AEEC75ACE}D:\utilitaire courant porteur\scanner_cpl_wi-fi.exe] => (Allow) D:\utilitaire courant porteur\scanner_cpl_wi-fi.exe => Pas de fichier
FirewallRules: [TCP Query User{70BE4AD8-3725-48BF-A15E-8D43EF35A76B}D:\utilitaire courant porteur\scanner_cpl_wi-fi.exe] => (Allow) D:\utilitaire courant porteur\scanner_cpl_wi-fi.exe => Pas de fichier
HKU\S-1-5-21-2045724710-958281156-395746172-1013\...\Run: [5ED6D26C200FF71DA15C13B80E3CA1C3AB1BDD8D._service_run] => "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=service /prefetch:8
HKU\S-1-5-21-2045724710-958281156-395746172-1013\...\Policies\Explorer: [NolowDiskSpaceChecks] 1
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\87.0.4280.66\Installer\chrmstp.exe [2020-11-25] (Google LLC -> Google LLC)
HKLM\Software\...\Authentication\Credential Providers: [{503739d0-4c5e-4cfd-b3ba-d881334f0df2}] ->
HKLM\Software\...\Authentication\Credential Providers: [{D2EEC341-83A7-41BC-9407-FA6ED9991C09}] -> C:\Windows\system32\ldcred.dll [2014-06-19] () [Fichier non signé]
Startup: C:\Users\velly\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2017-09-09]
ShortcutTarget: Dropbox.lnk -> C:\Users\velly.PCNOELLE\AppData\Roaming\Dropbox\bin\Dropbox.exe (Pas de fichier)
GroupPolicy: Restriction - Chrome <==== ATTENTION
HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
Task: {48286DF0-2EE2-413E-92AB-9394A2196D59} - System32\Tasks\{72FF913C-574C-4D98-B34B-F35408FB1A05} => C:\Windows\system32\pcalua.exe -a C:\Users\velly\AppData\Roaming\sweet-page\UninstallManager.exe -c -ptid=cor
Task: {BFF17777-FB15-49E0-AC46-13C0B12FE4CC} - \CCleanerSkipUAC -> Pas de fichier <==== ATTENTION
ProxyServer: [S-1-5-21-2045724710-958281156-395746172-1013] => proxy:8080
Tcpip\..\Interfaces\{8BEA828E-C879-4850-8D22-0515744C88EB}: [DhcpNameServer] 10.10.0.1
FF user.js: detected! => C:\Users\velly.PCNOELLE\AppData\Roaming\Mozilla\Firefox\Profiles\6g6mlo9t.default-1538004543898\user.js [2018-11-17]
CHR StartupUrls: Default -> "hxxp://www.trovi.com/?gd=&ctid=CT3321486&octid=EB_ORIGINAL_CTID&ISID=ME8189314-602E-4D70-95F2-99F0185FBC91&SearchSource=55&CUI=&UM=8&UP=SP94B29520-7367-4A98-B6BB-6AB1B69A7EB7&D=031515&SSPV=","hxxp://www.istartsurf.com/?type=hp&ts=1426372483&from=face&uid=HitachiXHTS723232A7A364_E3834523GKB66NGKB66NX","hxxp://www.istartsurf.com/?type=hppp&ts=1426372524&from=face&uid=HitachiXHTS723232A7A364_E3834523GKB66NGKB66NX","hxxp://www.sweet-page.com/?type=hp&ts=1427410191&from=cor&uid=HitachiXHTS723232A7A364_E3834523GKB66NGKB66NX","hxxp://fr.yhs4.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wny_cmi_15_13¶m1=1¶m2=f%3D7%26b%3DChrome%26cc%3Dfr%26pa%3DWinYahoo%26cd%3D2XzuyEtN2Y1L1Qzu0EyEtCtCyD0ByDtCzy0ByCtCtDyD0AzytN0D0Tzu0StCtCzztCtN1L2XzutAtFzytFyEtFtCtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2SyDtDzz0Bzz0CyB0DtG0ByCtAyEtG0E0Azy0CtGyCzy0CyDtGtDzyyEyEzz0B0E0Bzz0B0Bzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2StCyCyBzytD0DyBtBtG0AtCyBtBtGyEtB0F0EtGzyzztByEtG0E0F0D0E0F0A0DyByE0ByDtD2QtN0A0LzuyE%26cr%3D835473221%26a%3Dwny_cmi_15_13%26os%3DWindows 7 Professional","hxxp://www.dregol.com/?f=7&a=drg_cmi_15_21&cd=2XzuyEtN2Y1L1Qzu0EyEtCtCyD0ByDtCzy0ByCtCtDyD0AzytN0D0Tzu0StCtBtAyDtN1L2XzutAtFtCtDtFtBtFtDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyE0B0C0EyC0B0BtDtG0AtDtB0EtGyBzy0A0AtGtC0E0DyEtGyEtBtCtA0EyByC0EzztByCtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyD0EtDyBtCyE0DtAtGtCyDyD0FtGyEzzyB0DtG0ByDtAtAtGtAtBtDtC0ByE0CzzyDyDyCyD2QtN0A0LzuyE&cr=640523269&ir=","hxxp://www.google.fr/","hxxp://www.facebook.com/home.php?","hxxps://www.google.com/"
CHR HKU\S-1-5-21-2045724710-958281156-395746172-1013\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\velly.PCNOELLE\AppData\Local\Google\Drive\user_default\apdfllckaahabafndbhieahigkjlhalf_live.crx [2018-04-10]
CHR HKU\S-1-5-21-2045724710-958281156-395746172-1013\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]
CHR HKLM-x32\...\Chrome\Extension: [jkfpchpiljkaemlpmpebnglgkomamfeo]
CHR DefaultSearchURL: Default -> hxxps://blobs.officehome.msocdn.com/versionless/webmanifestimages/OfficeDesktop_192.png
S3 ESETCleanersDriver; C:\Windows\system32\Drivers\ESETCleanersDriver.sys [170280 2018-01-01] (ESET, spol. s r.o. -> ESET)
removeproxy:
emptytemp:
end::