start::
CreateRestorePoint:
CloseProcesses:
Hosts:
RemoveProxy:
HKU\S-1-5-21-14509393-2149453886-716767718-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
FF Extension: (IGRAAL - Cashback & codes promo) - C:\Users\phil86\AppData\Roaming\Mozilla\Firefox\Profiles\5omyb0b5.default-1464874773448\Extensions\{dbac9680-d559-4cd4-9765-059879e8c467}.xpi
FF Extension: (Pas de nom) - C:\Program Files (x86)\McAfee\SiteAdvisor\e10ssaffplg.xpi [non trouvé(e)]
FF Plugin HKU\S-1-5-21-14509393-2149453886-716767718-1001: @tools.google.com/Google Update;version=3 -> C:\Users\phil86\AppData\Local\Google\Update\1.3.35.422\npGoogleUpdate3.dll [Pas de fichier]
FF Plugin HKU\S-1-5-21-14509393-2149453886-716767718-1001: @tools.google.com/Google Update;version=9 -> C:\Users\phil86\AppData\Local\Google\Update\1.3.35.422\npGoogleUpdate3.dll [Pas de fichier]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk]
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk]
S4 McAfee WebAdvisor; C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe [953544 2020-10-15]
R0 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [253880 2018-03-05]
2020-12-22 15:02 - 2020-12-22 15:02 - 000000000 ____D C:\ProgramData\Avast Software
2020-12-22 15:01 - 2020-12-22 15:01 - 000222104 _____ (AVAST Software) C:\Users\phil86\Desktop\Microstub.exe
2020-12-23 09:37 - 2020-09-20 07:14 - 000003702 _____ C:\WINDOWS\system32\Tasks\Avira_Security_Update
2020-12-22 15:06 - 2015-07-16 05:15 - 000000000 ____D C:\Program Files\AVAST Software
2020-12-18 10:48 - 2020-11-26 08:57 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Pas de fichier
ContextMenuHandlers3: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Pas de fichier
SearchScopes: HKLM -> DefaultScope {47E1A4B2-B669-429C-B4DD-12AD949A491C} URL =
SearchScopes: HKLM-x32 -> DefaultScope {47E1A4B2-B669-429C-B4DD-12AD949A491C} URL =
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - Pas de fichier
MSCONFIG\Services: wuauserv => 3
HKLM\...\StartupApproved\Run32: => "Avira SystrayStartTrigger"
EmptyTemp:
cmd: net start wuauserv
cmd: ipconfig /flushdns
cmd: netsh winsock reset
cmd: cscript %windir%\System32\slmgr.vbs /dli 
cmd: sfc /scannow
end::