start::
closeprocesses:
createrestorepoint:
cmd: type C:\Users\MOI\Desktop\Fixlog.txt
virustotal: C:\ProgramData\{1D7BD5EC-1EA9-44E8-9114-08DDFBD26AB9}\33A2E4F0.exe
virustotal: C:\Program Files (x86)\PDF24\pdf24.exe
virustotal: C:\Users\MOI\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
virustotal: C:\Users\MOI\AppData\Roaming\Smart Clock\SmartClock.exe
FirewallRules: [{E5CC6D6C-96B6-46F4-87C9-8859939A821C}] => (Allow) C:\Program Files\BlueStacks\HD-Player.exe => Pas de fichier
FirewallRules: [TCP Query User{472FDB5B-8EFF-4A8D-AFF3-1CEAFEDAD03D}C:\program files\java\jre1.8.0_271\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_271\bin\javaw.exe => Pas de fichier
FirewallRules: [UDP Query User{D1AE7D50-D147-4075-864C-9999F5C40CA6}C:\program files\java\jre1.8.0_271\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_271\bin\javaw.exe => Pas de fichier
FirewallRules: [TCP Query User{4D359BFF-F681-4C90-A6EA-9154D3115117}C:\program files\java\jre1.8.0_271\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_271\bin\javaw.exe => Pas de fichier
FirewallRules: [UDP Query User{5AE40529-2846-49A1-96BE-1E606540C0BC}C:\program files\java\jre1.8.0_271\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_271\bin\javaw.exe => Pas de fichier
FirewallRules: [{2AAC2D90-1F49-4D33-9573-6D1A3D5773A6}] => (Allow) C:\Users\MOI\AppData\Local\Temp\download\MiniThunderPlatform.exe => Pas de fichier
FirewallRules: [{A7F88E63-3DA9-4E16-A7DA-F5F2222B52B1}] => (Allow) C:\Users\MOI\AppData\Local\Temp\download\MiniThunderPlatform.exe => Pas de fichier
HKLM\...\Run: [{7C046CF8-759C-4301-A95C-2D5FD8AD23DE}] => C:\ProgramData\{1D7BD5EC-1EA9-44E8-9114-08DDFBD26AB9}\33A2E4F0.exe [372736 2021-04-29] () [Fichier non signé]
HKLM-x32\...\Run: [{7C046CF8-759C-4301-A95C-2D5FD8AD23DE}] => C:\ProgramData\{1D7BD5EC-1EA9-44E8-9114-08DDFBD26AB9}\33A2E4F0.exe [372736 2021-04-29] () [Fichier non signé]
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-2522260060-2712000912-4139239502-1003\...\Run: [Prun] => C:\windows\PublicGaming\prun.exe [708023808 2021-04-23] (DearMob, Inc.) [Fichier non signé]
C:\windows\PublicGaming
HKU\S-1-5-21-2522260060-2712000912-4139239502-1003\...\Run: [Windows Host] => C:\ProgramData\Windows Host\Windows Host.exe [99344 2021-04-27] (Sistem) [Fichier non signé] <==== ATTENTION
C:\ProgramData\Windows Host
Startup: C:\Users\MOI\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftEdgeCPS.lnk [2021-05-03]
ShortcutTarget: MicrosoftEdgeCPS.lnk -> C:\Users\MOI\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe () [Fichier non signé]
Startup: C:\Users\MOI\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk [2021-04-23] <==== ATTENTION
ShortcutTarget: SmartClock.lnk -> C:\Users\MOI\AppData\Roaming\Smart Clock\SmartClock.exe (Pas de fichier)
HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
Task: {5D17ABBE-A9D8-4627-BF74-390D6723B9EB} - \OneDrive Standalone Update Task-S-1-5-21-2522260060-2712000912-4139239502-1001 -> Pas de fichier <==== ATTENTION
Task: {BC0D827D-9B54-45F8-9F31-849DB3CFC369} - System32\Tasks\Firefox Default Browser Agent 1A1B719DF6BDA809 => C:\Users\MOI\AppData\Roaming\avfacad [280576 2020-09-20] () [Fichier non signé] [Fichier en cours d'utilisation]
C:\Users\MOI\AppData\Roaming\avfacad
Task: {CAEF2F7F-9842-4A21-B426-062866286C1C} - System32\Tasks\Firefox Default Browser Agent 7DC9C154FECA83EB => C:\Users\MOI\AppData\Roaming\refacad [237568 2020-09-20] () [Fichier non signé] [Fichier en cours d'utilisation]
C:\Users\MOI\AppData\Roaming\refacad
Task: C:\windows\Tasks\CTOptimizer.job => C:\Users\MOI\AppData\Roaming\Microsoft\Windows\Start Menu\CryptoTabUpdate\CTOptimizer.exe
FF user.js: detected! => C:\Users\MOI\AppData\Roaming\Mozilla\Firefox\Profiles\6wv6xxy9.default-release\user.js [2021-04-29]
FF Extension: (6053C6) - C:\Users\MOI\AppData\Roaming\Mozilla\Firefox\Profiles\6wv6xxy9.default-release\Extensions\{eac68ce4-0b9c-4c71-8a07-93c56283af5d}.xpi [2021-04-30]
FF ProfilePath: C:\Users\MOI\AppData\Roaming\Mozilla\Firefox\Profiles\6wv6xxy9.default-release [2021-05-01]
C:\Users\MOI\AppData\Local\Google\Chrome\User Data\Default\Extensions\jadflfollpojhpbanhbhkhdglakmdehp
R2 pubgame-updater; C:\windows\PublicGaming\appsetup.exe [723240448 2021-04-23] (Elaborate Bytes AG) [Fichier non signé]
S2 HotKeyServiceUWP; %SystemRoot%\System32\DriverStore\FileRepository\hpqkbsoftwarecompnent.inf_amd64_6743249544e6fa49\HotKeyServiceUWP.exe [X]
S2 LanWlanWwanSwitchingServiceUWP; %SystemRoot%\System32\DriverStore\FileRepository\hpqkbsoftwarecompnent.inf_amd64_6743249544e6fa49\LanWlanWwanSwitchingServiceUWP.exe [X]
2021-05-03 20:24 - 2021-05-03 20:24 - 000003712 _____ C:\windows\system32\Tasks\Firefox Default Browser Agent 7DC9C154FECA83EB
2021-05-03 20:24 - 2021-05-03 20:24 - 000003712 _____ C:\windows\system32\Tasks\Firefox Default Browser Agent 1A1B719DF6BDA809
emptytemp:
end::