start::
CreateRestorePoint:
CloseProcesses:
Hosts:
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =
HKU\S-1-5-21-47672793-3177865422-1247247292-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://home.microsoft.com/access/allinone.asp
HKU\S-1-5-21-47672793-3177865422-1247247292-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-47672793-3177865422-1247247292-1000 -> {97DB41FD-6932-4388-908A-59FEA55BE562} URL = hxxp://www.google.com/custom?client=pub-3794288947762788&forid=1&channel=5369970905&ie=UTF-8&oe=UTF-8&safe=active&cof=GALT%3A%23008000%3BGL%3A1%3BDIV%3A%23336699%3BVLC%3A663399%3BAH%3Acenter%3BBGC%3AFFFFFF%3BLBGC%3A336699%3BALC%3A0000FF%3BLC%3A0000FF%3BT%3A000000%3BGFNT%3A0000FF%3BGIMP%3A0000FF%3BFORID%3A1&hl=en&q={searchTerms}
Toolbar: HKU\S-1-5-21-47672793-3177865422-1247247292-1000 -> Pas de nom - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - Pas de fichier
MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: SwitchBoard => 3
MSCONFIG\startupreg: Acrobat Assistant 8.0 => "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe"
MSCONFIG\startupreg: Adobe Acrobat Speed Launcher => "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: AdobeAAMUpdater-1.0 => "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
MSCONFIG\startupreg: AdobeCS6ServiceManager => "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
MSCONFIG\startupreg: SwitchBoard => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
HKLM\...\StartupApproved\StartupFolder: => "HP Button Manager.lnk"
HKLM\...\StartupApproved\Run: => "HotKeysCmds"
HKLM\...\StartupApproved\Run: => "USBestCR"
HKLM\...\StartupApproved\Run: => "IgfxTray"
HKLM\...\StartupApproved\Run: => "iTunesHelper"
HKLM\...\StartupApproved\Run: => "Persistence"
HKLM\...\StartupApproved\Run: => "WindowsDefender"
HKLM\...\StartupApproved\Run32: => "StartCCC"
HKLM\...\StartupApproved\Run32: => "Acrobat Assistant 8.0"
HKLM\...\StartupApproved\Run32: => "Adobe Acrobat Speed Launcher"
HKLM\...\StartupApproved\Run32: => "APSDaemon"
HKLM\...\StartupApproved\Run32: => "PPort12reminder"
HKLM\...\StartupApproved\Run32: => "RunAIShell"
HKLM\...\StartupApproved\Run32: => "USBestCR"
HKLM\...\StartupApproved\Run32: => "IndexSearch"
HKLM\...\StartupApproved\Run32: => "PaperPort PTD"
HKLM\...\StartupApproved\Run32: => "PDF5 Registry Controller"
HKLM\...\StartupApproved\Run32: => "PDFHook"
HKLM\...\StartupApproved\Run32: => "IMSS"
HKLM\...\StartupApproved\Run32: => "BrStsMon00"
HKLM\...\StartupApproved\Run32: => "HDAudDeck"
HKU\S-1-5-21-47672793-3177865422-1247247292-1000\...\StartupApproved\Run: => "ISUSPM"
HKU\S-1-5-21-47672793-3177865422-1247247292-1000\...\StartupApproved\Run: => "CCleaner Monitoring"
HKU\S-1-5-21-47672793-3177865422-1247247292-1000\...\StartupApproved\Run: => "OneDrive"
HKU\S-1-5-21-47672793-3177865422-1247247292-1000\...\StartupApproved\Run: => "Skype"
FirewallRules: [UDP Query User{F80D8C20-FA8C-4660-B0CF-E4E5F0E69BC5}C:\program files (x86)\wondershare\wondershare dr.fone para android(spanish es)\drfoneandroid.exe] => (Allow) C:\program files (x86)\wondershare\wondershare dr.fone para android(spanish es)\drfoneandroid.exe => Pas de fichier
FirewallRules: [TCP Query User{DA8D7276-FFCE-46DB-A02F-5EB6D38FD4BA}C:\program files (x86)\wondershare\wondershare dr.fone para android(spanish es)\drfoneandroid.exe] => (Allow) C:\program files (x86)\wondershare\wondershare dr.fone para android(spanish es)\drfoneandroid.exe => Pas de fichier
FirewallRules: [TCP Query User{FD4D06EC-1465-4C55-82C4-BA3A1E3D6330}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe => Pas de fichier
FirewallRules: [UDP Query User{0B415701-10F4-4756-ABDF-80ED47FCC5C0}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe => Pas de fichier
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl]
2021-08-21 18:16 - 2018-07-21 21:29 - 000000000 ____D C:\Users\LAVIGNE\AppData\Local\AVAST Software
FF Extension: (Avast Online Security) - C:\Users\LAVIGNE\AppData\Roaming\Mozilla\Firefox\Profiles\wip7327d.default-1429801129501-1544791178449\Extensions\wrc@avast.com.xpi [2021-02-18]
2021-08-21 18:16 - 2012-09-15 22:11 - 000000000 ____D C:\ProgramData\AVAST Software
C:\Program Files\AVAST Softwar
EmptyTemp:
cmd: ipconfig /flushdns
cmd: netsh advfirewall reset
cmd: netsh winsock reset
cmd: sfc /scannow
end::