start::
closeprocesses:
createrestorepoint:
cmd: type C:\ProgramData\NTUSER.pol
ShellIconOverlayIdentifiers: [00avg] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Pas de fichier
AlternateDataStreams: C:\Users\nofio\AppData\Local\Temp:$DATA​ [16]
HKLM\...\Policies\Explorer: [HideSCAHealth] 1
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-537999074-4068753609-2318681685-1001\...\Run: [GalaxyClient] => [X]
GroupPolicy: Restriction ? <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
C:\ProgramData\NTUSER.pol
Task: {1D23EEEF-546B-4647-906B-03470F108CD6} - System32\Tasks\Microsoft\Windows\Wininet\Winlogui => winlogui.exe <==== ATTENTION
Task: {A9AE8F37-F443-484D-A6AB-EFF7C1C43355} - System32\Tasks\ASUS Live Update1 => "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" localdrive"."win
Task: {B9D2CA0C-2C70-4D21-8074-DAA3CB8BBEB6} - System32\Tasks\ASUS Live Update2 => "C:\Program Files\Google\Chrome\Application\chrome.exe" localdrive"."win
Task: {E335B24C-4717-4990-831C-76956782DA2D} - System32\Tasks\Microsoft\Windows\Application Experience\StartupCheckLibrary => rundll32.exe StartupCheckLibrary.dll,DllMainRunLibrary <==== ATTENTION
Task: {E8F6BAF8-80C2-418F-B953-1A39E920E0F3} - System32\Tasks\Microsoft\Windows\Windows Error Reporting\winrmsrv => winrmsrv.exe <==== ATTENTION
C:\WINDOWS\system32\winlogui.exe
C:\WINDOWS\system32\StartupCheckLibrary.dll
C:\WINDOWS\system32\winrmsrv.exe
C:\Users\nofio\AppData\Local\Google\Chrome\User Data\Default\Extensions\caljgklbbfbcjjanaijlacgncafpegll
C:\Users\nofio\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccbpbkebodcjkknkfkpmfeciinhidaeh
CHR HKLM-x32\...\Chrome\Extension: [caljgklbbfbcjjanaijlacgncafpegll]
CHR HKLM-x32\...\Chrome\Extension: [ccbpbkebodcjkknkfkpmfeciinhidaeh]
S4 Wondershare InstallAssist; C:\ProgramData\Wondershare\Service\InstallAssistService.exe [230176 2020-01-16] (Wondershare Technology Co.,Ltd -> Wondershare)
C:\ProgramData\Wondershare
S3 UcmCxUcsiNvppc; \SystemRoot\System32\DriverStore\FileRepository\nvppc.inf_amd64_25fb711132593303\UcmCxUcsiNvppc.sys [X]
S3 WinRing0_1_2_0; \??\C:\Users\nofio\Downloads\open-hardware-monitor_0-8-0-beta_en_435025\OpenHardwareMonitor\OpenHardwareMonitorLib.sys [X]
StartRegedit:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=dword:00000005
EndRegedit:
cmd: netsh advfirewall reset
emptytemp:
end::