start::
closeprocesses:
createrestorepoint:
HKLM-x32\...\Run: [Avira SystrayStartTrigger] => C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe [706192 2021-04-01] (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG)
C:\Program Files (x86)\Avira
Task: {6FDBC5AE-AF99-4021-9E2F-938B7FF293F4} - System32\Tasks\Avira_Antivirus_Systray => C:\Program Files (x86)\Avira\Antivirus\avgnt.exe
Task: {A17BB4FD-E943-4B74-A31E-5FF7320BBD1F} - System32\Tasks\Avira_Security_Update => C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Common.Updater.exe
Task: {F695C371-97BF-4EB7-BBA9-E8AF8677A28B} - System32\Tasks\AviraSystemSpeedupUpdate => C:\ProgramData\Avira\SystemSpeedup\Update\avira_speedup_setup_update.exe [137216 2021-02-11] () [Fichier non signé]
2021-05-03 09:51 - 2021-05-03 09:51 - 004585424 _____ (Avira Operations GmbH & Co. KG) C:\Users\olcou\Downloads\avira_fr_sptl1_c2f448454ba80a38__phpws.exe
2021-05-03 09:51 - 2021-05-03 09:51 - 000000000 ____D C:\Program Files (x86)\Avira
2021-05-01 23:50 - 2021-05-01 23:50 - 000002860 _____ C:\WINDOWS\system32\Tasks\AviraSystemSpeedupUpdate
2021-05-01 23:50 - 2021-05-01 23:50 - 000002786 _____ C:\WINDOWS\system32\Tasks\Avira_Security_Update
2021-05-01 23:50 - 2021-05-01 23:50 - 000002566 _____ C:\WINDOWS\system32\Tasks\Avira_Antivirus_Systray
ellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => -> Pas de fichier
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => -> Pas de fichier
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => -> Pas de fichier
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => -> Pas de fichier
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => -> Pas de fichier
ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => -> Pas de fichier
ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => -> Pas de fichier
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => -> Pas de fichier
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => -> Pas de fichier
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => -> Pas de fichier
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => -> Pas de fichier
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => -> Pas de fichier
ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => -> Pas de fichier
ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => -> Pas de fichier
ContextMenuHandlers1: [Shell Extension for Malware scanning] -> {45AC2688-0253-4ED8-97DE-B5370FA7D48A} => C:\Program Files (x86)\Avira\Antivirus\shlext64.dll -> Pas de fichier
ContextMenuHandlers1: [SystemSpeedupFilesMenu] -> {14cb2bd0-2375-3d10-9b5d-5e18865c8959} => C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.UI.ShellExtension.DLL -> Pas de fichier
ContextMenuHandlers4: [SystemSpeedupFoldersMenu] -> {700866bb-c8e9-3e71-b359-abb28baed0e8} => C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.UI.ShellExtension.DLL -> Pas de fichier
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> Pas de fichier
ContextMenuHandlers5: [SystemSpeedupDesktopMenu] -> {0cab5786-30e8-3185-9b3b-ccefbf1b8afe} => C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.UI.ShellExtension.DLL -> Pas de fichier
ContextMenuHandlers6: [Shell Extension for Malware scanning] -> {45AC2688-0253-4ED8-97DE-B5370FA7D48A} => C:\Program Files (x86)\Avira\Antivirus\shlext64.dll -> Pas de fichier
SearchScopes: HKU\S-1-5-21-140895167-3683696087-1739869668-1001 -> DefaultScope {987DB27A-8ED4-4A24-8288-C560211CEEA0} URL =
BHO: IEToEdge BHO -> {1FD49718-1D00-4B19-AF5F-070AF6D5D54C} -> C:\Program Files (x86)\Microsoft\Edge\Application\84.0.522.52\BHO\ie_to_edge_bho_64.dll => Pas de fichier
BHO-x32: IEToEdge BHO -> {1FD49718-1D00-4B19-AF5F-070AF6D5D54C} -> C:\Program Files (x86)\Microsoft\Edge\Application\84.0.522.52\BHO\ie_to_edge_bho.dll => Pas de fichier
HKLM\...\Policies\Explorer: [HideSCAHealth] 1
HKU\S-1-5-21-140895167-3683696087-1739869668-1001\...\Policies\Explorer: [DisallowRun] 1
HKU\S-1-5-21-140895167-3683696087-1739869668-1001\...\Policies\Explorer\DisallowRun: [1] 1.exe
HKU\S-1-5-21-140895167-3683696087-1739869668-1001\...\Policies\Explorer\DisallowRun: [2] irsetup.exe
Task: {006AD7F1-D94D-4ECD-8159-D565B6E07542} - System32\Tasks\Microsoft\Windows\WDI\SrvHost => rundll32.exe winscomrssrv.dll,SrvMainHost <==== ATTENTION
Task: {5DB8952F-DD04-4DB8-BDF8-B85F73F9D5C0} - System32\Tasks\Microsoft\Windows\Windows Error Reporting\winrmsrv => winrmsrv.exe <==== ATTENTION
Task: {70AFA10A-7FE8-4B9F-8597-39D2FF12F476} - System32\Tasks\Microsoft\Windows\Application Experience\StartupCheckLibrary => rundll32.exe StartupCheckLibrary.dll,DllMainRunLibrary <==== ATTENTION
S3 MicrosoftEdgeElevationService; "C:\Program Files (x86)\Microsoft\Edge\Application\84.0.522.52\elevation_service.exe" [X]
C:\WINDOWS\system32\winlogui.exe
C:\Windows\System32\StartupCheckLibrary.dll
C:\Windows\System32\winscomrssrv.dll
cmd: netsh advfirewall reset
emptytemp:
end::