start::
CreateRestorePoint:
CloseProcesses:
Hosts:
RemoveProxy:
HKLM\Software\...\Authentication\Credential Providers: [{503739d0-4c5e-4cfd-b3ba-d881334f0df2}] ->
GroupPolicy: Restriction - Chrome <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Edge: Restriction <==== ATTENTION
Task: {05574455-800F-44E7-AA41-70B02776ECF6} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Pas de fichier
Task: {0677394A-09C2-4AE7-AEAF-D9F039B8BECA} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Pas de fichier
Task: {280B0A91-B463-4243-AAB0-96490D9B271D} - \Microsoft\Windows\UNP\RunCampaignManager -> Pas de fichier
Task: {317D8BC6-9F20-43F1-860E-5884AB7D46C6} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Pas de fichier
Task: {64FEBE5E-362A-4646-BA31-177DE5CF839A} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Pas de fichier
Task: {775B88A9-431C-41CE-8733-E07AF59A6916} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Pas de fichier
Task: {9CEC433B-B00B-4C1E-B185-E23AC9E3E0AB} - \OfficeSoftwareProtectionPlatform\SvcRestartTask -> Pas de fichier
Task: {9D76A6C9-E136-4B6D-8D7B-ED0C2B7DC4E0} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Pas de fichier
Task: {9DD792A6-5362-4E7F-BF2A-EF3DE158BEFF} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Pas de fichier
Task: {B9E8CA9B-03F9-40FE-8287-F135C11E7407} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Pas de fichier
Task: {CD1B5BF5-F630-4EF6-8504-7C80BAD54C2D} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Pas de fichier
Task: {CF5CDAB4-F6B5-44C2-AA28-C21666159A7A} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Pas de fichier
Task: {D9ED02B4-189E-4A06-8B6A-994CC5388850} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Pas de fichier
Task: C:\WINDOWS\Tasks\Kaspersky_Upgrade_Launcher_{278ADC42-419D-4547-A6CA-5B74BE0AD901}.job => C:\Program Files\Common Files\AV\Kaspersky Lab\upgrade_launcher.exe
FF Plugin-x32: @videolan.org/vlc,version=2.1.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [Pas de fichier]
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [Pas de fichier]
FF Plugin-x32: @videolan.org/vlc,version=2.2.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [Pas de fichier]
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [Pas de fichier]
FF Plugin-x32: @videolan.org/vlc,version=2.2.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [Pas de fichier]
FF Plugin-x32: @videolan.org/vlc,version=2.2.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [Pas de fichier]
CHR HKLM\...\Chrome\Extension: [blbkdnmdcafmfhinpmnlhhddbepgkeaa] - hxxps://chrome.google.com/webstore/detail/blbkdnmdcafmfhinpmnlhhddbepgkeaa
CHR HKLM-x32\...\Chrome\Extension: [blbkdnmdcafmfhinpmnlhhddbepgkeaa] - hxxps://chrome.google.com/webstore/detail/blbkdnmdcafmfhinpmnlhhddbepgkeaa
2021-01-30 18:07 - 2021-01-30 18:07 - 000003072 _____ C:\WINDOWS\system32\Tasks\Kaspersky_Product_Update_{20C91119-626A-4305-906C-90F5A4B77B67}_KIS
2021-02-04 14:53 - 2015-10-15 10:05 - 000000000 ____D C:\Users\ESMAEL C\Desktop\Securité PC
2021-02-04 12:34 - 2013-02-18 21:58 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster
2021-02-03 17:04 - 2013-02-18 21:58 - 000000000 ____D C:\Program Files (x86)\SpywareBlaster
2021-01-25 12:36 - 2015-08-05 19:34 - 000000000 ____D C:\Program Files\Common Files\AV
CustomCLSID: HKU\S-1-5-21-3136113236-2489821390-277594644-1003_Classes\CLSID\{6D264B70-DA18-401D-910C-B202D89670C6}\InprocServer32 -> C:\Users\ESMAEL C\AppData\Local\Google\Update\1.3.36.32\psuser_64.dll => Pas de fichier
CustomCLSID: HKU\S-1-5-21-3136113236-2489821390-277594644-1003_Classes\CLSID\{CA919489-0396-4164-A6E7-94CDED45A707}\InprocServer32 -> C:\Users\ESMAEL C\AppData\Local\Google\Update\1.3.36.52\psuser_64.dll => Pas de fichier
ContextMenuHandlers5: [Gadgets] -> {6B9228DA-9C15-419e-856C-19E768A13BDC} => -> Pas de fichier
AlternateDataStreams: C:\ProgramData\TEMP:5C321E34 [136]
SearchScopes: HKU\S-1-5-21-3136113236-2489821390-277594644-1003 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
EmptyTemp:
cmd: ipconfig /flushdns
end::