start::
closeprocesses:
createrestorepoint:
ShellIconOverlayIdentifiers: [
MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\emy\AppData\Local\MEGAsync\ShellExtX64.dll -> Pas de fichier
ShellIconOverlayIdentifiers: [
MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\emy\AppData\Local\MEGAsync\ShellExtX64.dll -> Pas de fichier
ShellIconOverlayIdentifiers: [
MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\emy\AppData\Local\MEGAsync\ShellExtX64.dll -> Pas de fichier
ShellIconOverlayIdentifiers-x32: [
MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\emy\AppData\Local\MEGAsync\ShellExtX64.dll -> Pas de fichier
ShellIconOverlayIdentifiers-x32: [
MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\emy\AppData\Local\MEGAsync\ShellExtX64.dll -> Pas de fichier
ShellIconOverlayIdentifiers-x32: [
MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\emy\AppData\Local\MEGAsync\ShellExtX64.dll -> Pas de fichier
ContextMenuHandlers4: [PowerISO] -> {967B2D40-8B7D-4127-9049-61EA0C2C6DCE} => -> Pas de fichier
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> Pas de fichier
ContextMenuHandlers6: [PowerISO] -> {967B2D40-8B7D-4127-9049-61EA0C2C6DCE} => -> Pas de fichier
ContextMenuHandlers1_S-1-5-21-1566893408-2917321120-2319254493-1001: [SysMenuExt] -> {020B1D4B-5738-4C77-9E19-4F173DD9B486} => -> Pas de fichier
AlternateDataStreams: C:\ProgramData\Temp:538DC028 [120]
AlternateDataStreams: C:\ProgramData\Temp:77248999 [118]
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
IE trusted site: HKU\.DEFAULT\...\webcompanion.com -> hxxp://webcompanion.com
IE trusted site: HKU\S-1-5-21-1566893408-2917321120-2319254493-1001\...\webcompanion.com -> hxxp://webcompanion.com
HKLM\Software\...\AppCompatFlags\Custom\eudcedit.exe: [{d1e17d14-cabc-4f6f-9f46-c7ecf813645e}.sdb] -> 6E41Dd3
HKLM\Software\...\AppCompatFlags\InstalledSDB\{d1e17d14-cabc-4f6f-9f46-c7ecf813645e}: [DatabasePath] -> C:\Windows\AppPatch\Custom\{d1e17d14-cabc-4f6f-9f46-c7ecf813645e}.sdb [2015-05-23]
GroupPolicy: Restriction - Chrome <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
Policies: C:\Users\emy\NTUSER.pol: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
Task: {8A47B00E-5D59-4B17-BC82-72B662629E83} - System32\Tasks\AutoKMS => C:\Windows\AutoKMS\AutoKMS.exe
Task: C:\Windows\Tasks\AutoKMS.job => C:\Windows\AutoKMS\AutoKMS.exe
C:\Windows\AutoKMS
CHR StartupUrls: Default -> "hxxp://www.hohosearch.com/?mode=loadm&ptid=isr&uid=07B8B98819C0E7EBE49FAB6B4C7C6A96&v=20160504&ts=AHEqAXMmAnUsA0..","hxxp://www.hohosearch.com/?mode=loadm&ptid=clc&uid=07B8B98819C0E7EBE49FAB6B4C7C6A96&v=20160504&ts=AHEqAXMmC3MrB0..","search.mpc.am"
CHR DefaultSearchURL: Default -> hxxps://fr.search.yahoo.com/search?p={searchTerms}&fr=yset_chr_syc_oracle&type=orcl_default
CHR DefaultSearchKeyword: Default -> Yahoo
CHR DefaultSuggestURL: Default -> hxxps://fr.search.yahoo.com/sugg/ie?output=fxjson&command={searchTerms}&nResults=10
CHR HKLM\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce]
CHR HKU\S-1-5-21-1566893408-2917321120-2319254493-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce]
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx <non trouvé(e)>
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx <non trouvé(e)>
CHR HKLM-x32\...\Chrome\Extension: [kpdmjodecdegfglgaapafjleomjjlpnh]
CHR HKLM-x32\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce]
S4 kss; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe [919296 2015-06-03] (Kaspersky Lab -> Kaspersky Lab ZAO)
C:\Program Files (x86)\Kaspersky Lab
S2 Guntony_update; "C:\Program Files (x86)\Guntony\Guntony\bin\Guntony_server.exe" [X]
S3 BRDriver64_1_3_3_E02B25FC; \??\C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver64.sys [X]
S3 MBAMWebProtection; \??\C:\Windows\system32\drivers\mwac.sys [X]
2021-07-28 20:16 - 2016-03-12 20:38 - 000000288 _____ C:\Windows\Tasks\AutoKMS.job
2021-07-27 02:13 - 2016-03-12 20:38 - 000002898 _____ C:\Windows\system32\Tasks\AutoKMS
2015-01-19 23:56 - 2015-11-08 01:54 - 001873408 _____ () C:\Users\emy\ZHPCleaner.exe
cmd: netsh advfirewall reset
cmd: sfc /scannow
cmd: DISM /Online /Cleanup-image /Restorehealth
emptytemp:
end::