start::
CreateRestorePoint:
CloseProcesses:
RemoveProxy:
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe
HKLM-x32\...\Run: [ZoneAlarm] => C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe
HKU\S-1-5-18\...\Run: [ZoneAlarm Windows 10 Upgrader] => "C:\ProgramData\CheckPoint\ZoneAlarm\Data\Updates\unpacked==win10=update_win10.zip\upgrade.exe" /delay
HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components: [{30C521FB-255B-46C8-9F0D-EE5AE371C9AA}] -> C:\Program Files (x86)\AVAST Software\Browser\Application\86.1.6960.198\Installer\chrmstp.exe
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
Task: {0CB146B3-CA77-42BB-98C4-E9D375445548} - System32\Tasks\AvastUpdateTaskMachineCore => C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe
Task: {0D8A891D-890C-4808-84D8-2F436AB14653} - \Microsoft\Windows\Application Experience\AitAgent -> Pas de fichier
Task: {1274336E-AB06-46B6-A48C-0671C5557CC6} - \Microsoft\Windows\TaskScheduler\Maintenance Configurator -> Pas de fichier
Task: {1687544D-7247-4F5A-965A-A6E920E55278} - \Microsoft\Windows\TaskScheduler\Manual Maintenance -> Pas de fichier
Task: {388188DE-EB0A-45FB-A9E3-0C38CFA3E87B} - System32\Tasks\Avast Software\Overseer => C:\Program Files\Common Files\Avast Software\Overseer\overseer.exe
Task: {6F02587F-8A2B-4552-97F6-DEEF229E335B} - \Microsoft\Windows\TaskScheduler\Idle Maintenance -> Pas de fichier
Task: {8686A92D-2993-478A-AE03-533AAB86AE3F} - System32\Tasks\AvastUpdateTaskMachineUA => C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe
Task: {A8D046CB-5B7C-4B95-8934-6C172751F30A} - System32\Tasks\Avast Secure Browser Heartbeat Task (Hourly) => C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe
Task: {B7992938-01F1-4F40-A0EC-0D23D2F0F152} - \Microsoft\Windows\TaskScheduler\Regular Maintenance -> Pas de fichier
Task: {BA717F4E-6457-43BE-A0EC-3EE775649211} - System32\Tasks\Avast Emergency Update => C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe
Task: {CA8CFC37-0D63-4243-AAA3-A76494C5BABC} - System32\Tasks\Avast Secure Browser Heartbeat Task (Logon) => C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - \Microsoft\Windows\SettingSync\BackupTask -> Pas de fichier
FF Plugin-x32: @update.avastbrowser.com/Avast Browser;version=3 -> C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1065.0\npAvastBrowserUpdate3.dll
FF Plugin-x32: @update.avastbrowser.com/Avast Browser;version=9 -> C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1065.0\npAvastBrowserUpdate3.dll
CHR DefaultSearchURL: Default -> hxxps://search.yahoo.com/search?p=
CHR DefaultSuggestURL: Default -> hxxps://search.yahoo.com/sugg/ie?output=fxjson&command={searchTerms}&nResults=10
CHR HKU\S-1-5-21-2918662981-2240529743-1748773062-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]
CHR HKU\S-1-5-21-2918662981-2240529743-1748773062-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [hpacaholihkepnhgeeiipghhgonbhdfb]
R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\aswidsagent.exe
S2 avast; C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe
R2 avast! Tools; C:\Program Files\AVAST Software\Avast\aswToolsSvc.exe
S3 avastm; C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe
S3 AvastSecureBrowserElevationService; C:\Program Files (x86)\AVAST Software\Browser\Application\86.1.6960.198\elevation_service.exe
R2 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe
R2 ZA NET ICM Service; C:\Program Files (x86)\CheckPoint\ICM\ICM-Service-NET.exe
S3 ZAPrivacyService; C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZaPrivacyService.exe
S2 ZoneAlarm ICM Service; C:\Program Files (x86)\CheckPoint\ZoneAlarm\ICM-Service.exe
R0 aswArDisk; C:\Windows\System32\drivers\aswArDisk.sys
R1 aswArPot; C:\Windows\System32\drivers\aswArPot.sys
R1 aswbidsdriver; C:\Windows\System32\drivers\aswbidsdriver.sys
R0 aswbidsh; C:\Windows\System32\drivers\aswbidsh.sys
R0 aswbuniv; C:\Windows\System32\drivers\aswbuniv.sys
R1 aswKbd; C:\Windows\System32\drivers\aswKbd.sys
R1 aswMonFlt; C:\Windows\System32\drivers\aswMonFlt.sys
R1 aswNetHub; C:\Windows\System32\drivers\aswNetHub.sys
R1 aswRdr; C:\Windows\System32\drivers\aswRdr2.sys
R0 aswRvrt; C:\Windows\System32\drivers\aswRvrt.sys
R1 aswSnx; C:\Windows\System32\drivers\aswSnx.sys
R1 aswSP; C:\Windows\System32\drivers\aswSP.sys
R2 aswStm; C:\Windows\System32\drivers\aswStm.sys
R0 aswVmm; C:\Windows\System32\drivers\aswVmm.sys
R1 Vsdatant; C:\Windows\System32\drivers\vsdatant.sys
U3 iswSvc; pas de ImagePath
U3 McAPExe; pas de ImagePath
U3 McMPFSvc; pas de ImagePath
U3 McNaiAnn; pas de ImagePath
U3 mcpltsvc; pas de ImagePath
U3 McProxy; pas de ImagePath
U3 mfecore; pas de ImagePath
U3 MSK80Service; pas de ImagePath
2020-11-24 13:16 - 2020-11-24 13:15 - 000339552 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2020-11-24 13:16 - 2020-11-24 13:15 - 000217336 _____ (AVAST Software) C:\Windows\system32\Drivers\asw71de17fc48509dec.tmp
2020-11-03 18:26 - 2020-11-03 18:26 - 000007747 _____ C:\Users\valerie\Desktop\itch.io.html
2020-11-03 18:26 - 2020-11-03 18:26 - 000000000 ____D C:\Users\valerie\Desktop\itch.io_files
2020-11-24 13:15 - 2020-10-18 18:28 - 000176744 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2020-11-24 13:15 - 2020-07-29 11:46 - 000521752 _____ (AVAST Software) C:\Windows\system32\Drivers\aswNetHub.sys
2020-11-24 13:15 - 2019-01-14 20:11 - 000332368 _____ (AVAST Software) C:\Windows\system32\Drivers\aswbidsdriver.sys
2020-11-24 13:15 - 2019-01-07 11:19 - 000247888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswbidsh.sys
2020-11-24 13:15 - 2019-01-07 11:19 - 000097352 _____ (AVAST Software) C:\Windows\system32\Drivers\aswbuniv.sys
2020-11-24 13:15 - 2019-01-07 11:19 - 000037152 _____ (AVAST Software) C:\Windows\system32\Drivers\aswArDisk.sys
2020-11-24 13:15 - 2018-10-22 20:59 - 000042784 _____ (AVAST Software) C:\Windows\system32\Drivers\aswKbd.sys
2020-11-24 13:15 - 2017-11-16 20:17 - 000206408 _____ (AVAST Software) C:\Windows\system32\Drivers\aswArPot.sys
2020-11-24 13:15 - 2017-08-13 12:14 - 000851608 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2020-11-24 13:15 - 2017-08-13 12:14 - 000469832 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2020-11-24 13:15 - 2017-08-13 12:14 - 000326416 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys
2020-11-24 13:15 - 2017-08-13 12:14 - 000109280 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2020-11-24 13:15 - 2017-08-13 12:14 - 000084856 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
2020-11-23 20:06 - 2020-07-29 11:46 - 000518680 _____ (AVAST Software) C:\Windows\system32\Drivers\aswc45f8da0d9e04bf6.tmp
2020-11-23 20:03 - 2019-04-17 20:25 - 000003732 _____ C:\Windows\system32\Tasks\Avast Secure Browser Heartbeat Task (Hourly)
2020-11-23 20:03 - 2018-04-04 20:46 - 000002406 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast Secure Browser.lnk
2020-11-23 20:03 - 2018-04-04 20:46 - 000002371 _____ C:\Users\Public\Desktop\Avast Secure Browser.lnk
2020-11-23 20:03 - 2018-04-04 20:46 - 000002371 _____ C:\ProgramData\Desktop\Avast Secure Browser.lnk
2020-11-21 15:02 - 2017-12-08 20:17 - 000000000 ____D C:\Windows\system32\Tasks\Avast Software
2020-11-16 18:27 - 2015-03-30 13:37 - 000000000 ____D C:\ProgramData\AVAST Software
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll
ContextMenuHandlers1: [avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll
ContextMenuHandlers3: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll
ContextMenuHandlers6: [avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKU\S-1-5-21-2918662981-2240529743-1748773062-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.zonealarm.com/?src=
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2918662981-2240529743-1748773062-1001 -> DefaultScope {11A260F8-A2D1-451D-BC5B-801A044DCF89} URL = hxxp://search.zonealarm.com/search?src=
SearchScopes: HKU\S-1-5-21-2918662981-2240529743-1748773062-1001 -> {11A260F8-A2D1-451D-BC5B-801A044DCF89} URL = hxxp://search.zonealarm.com/search?src=
SearchScopes: HKU\S-1-5-21-2918662981-2240529743-1748773062-1001 -> {7210E9D7-DD3B-4022-B380-51433236C10F} URL = hxxps://search.yahoo.com/search?p=
BHO-x32: Zonealarm Helper Object -> {2A841F7A-A014-4DA5-B6D9-8B913DFB7A8C} -> C:\Program Files (x86)\Check Point Software Technologies LTD\zonealarm\1.8.29.17\bh\zonealarm.dll
EmptyTemp:
cmd: ipconfig /flushdns
cmd: netsh winsock reset
cmd: sfc /scannow
end::