start::
closeprocesses:
createrestorepoint:
CustomCLSID: HKU\S-1-5-21-4038837674-2118046203-14001886-1001_Classes\CLSID\{C47A7F16-0572-495A-BB96-89A825661722}\InprocServer32 -> C:\Program Files (x86)\Kingsoft\WPS Office\11.2.0.8888\office6\addons\knewdocshellext\knewdocshellext64.dll => Pas de fichier
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Pas de fichier
ContextMenuHandlers1: [ASZip] -> {d03d3e68-0f44-3d45-b15f-bcfd8a8b4c7e} => -> Pas de fichier
ContextMenuHandlers1: [ASZip64] -> {d03d3e78-0f44-3d45-b15f-bcfd8a8b4c7e} => -> Pas de fichier
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> Pas de fichier
ContextMenuHandlers6: [ASZip] -> {d03d3e68-0f44-3d45-b15f-bcfd8a8b4c7e} => -> Pas de fichier
ContextMenuHandlers6: [ASZip64] -> {d03d3e78-0f44-3d45-b15f-bcfd8a8b4c7e} => -> Pas de fichier
ContextMenuHandlers1_S-1-5-21-4038837674-2118046203-14001886-1001: [knewdocshellext] -> {C47A7F16-0572-495A-BB96-89A825661722} => C:\Program Files (x86)\Kingsoft\WPS Office\11.2.0.8888\office6\addons\knewdocshellext\knewdocshellext64.dll -> Pas de fichier
ContextMenuHandlers4_S-1-5-21-4038837674-2118046203-14001886-1001: [knewdocshellext] -> {C47A7F16-0572-495A-BB96-89A825661722} => C:\Program Files (x86)\Kingsoft\WPS Office\11.2.0.8888\office6\addons\knewdocshellext\knewdocshellext64.dll -> Pas de fichier
ContextMenuHandlers5_S-1-5-21-4038837674-2118046203-14001886-1001: [knewdocshellext] -> {C47A7F16-0572-495A-BB96-89A825661722} => C:\Program Files (x86)\Kingsoft\WPS Office\11.2.0.8888\office6\addons\knewdocshellext\knewdocshellext64.dll -> Pas de fichier
HKU\S-1-5-21-4038837674-2118046203-14001886-1001\...\StartupApproved\Run: => "Algotithom.vbs"
FirewallRules: [{E7B9F129-30D3-45C8-8A83-7925267B1FF9}] => (Allow) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe => Pas de fichier
FirewallRules: [{72AC032B-EF48-4E8B-936E-5D0618C19454}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe => Pas de fichier
FirewallRules: [{B0D28EEC-75C8-484D-8B4B-AE5C6CCD03FD}] => (Allow) C:\Users\evely\AppData\Local\Temp\EpInsNav\DL\3013\Network\EpsonNetSetup\Data\ENEasyApp.exe => Pas de fichier
FirewallRules: [{7C00AA4F-7C91-4FA5-9232-9F5FBC2B30BF}] => (Allow) C:\Users\evely\AppData\Local\Temp\EpInsNav\DL\3013\Network\EpsonNetSetup\Data\ENEasyApp.exe => Pas de fichier
Task: {5F839BD6-157E-4B1E-B824-15D3AB2931B4} - \Skype -> Pas de fichier <==== ATTENTION
Edge Notifications: HKU\S-1-5-21-4038837674-2118046203-14001886-1001 -> hxxps//mail.google.com; hxxps//web.whatsapp.com; hxxps//tps.download.land; hxxps//www.tomtop.com; hxxps//www.bons-plans-malins.com; hxxps//www.beaute-test.com; hxxps//fr.reimageplus.com; hxxps//www.vessiere-cristaux.fr; hxxps//www.remedes-de-grand-mere.com; hxxps//www.facebook.com; hxxps//www.linternaute.com; hxxps//www.lightinthebox.com; hxxps//www.doctissimo.fr; hxxps//www.youtube.com
Edge Extension: (Pas de nom) -> AutoFormFill_5ED10D46BD7E47DEB1F3685D2C0FCE08 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\AutoFormFill [non trouvé(e)]
Edge Extension: (Pas de nom) -> BookReader_B171F20233094AC88D05A8EF7B9763E8 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\BookViewer [non trouvé(e)]
Edge Extension: (Pas de nom) -> LearningTools_7706F933-971C-41D1-9899-8A026EB5D824 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\LearningTools [non trouvé(e)]
Edge Extension: (Pas de nom) -> PinJSAPI_EC01B57063BE468FAB6DB7EBFC3BF368 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\PinJSAPI [non trouvé(e)]
Edge Notifications: Default -> hxxps//eu.winnernotification.com; hxxps//fr.reimageplus.com; hxxps//mail.google.com; hxxps//tps.download.land; hxxps//web.whatsapp.com; hxxps//www.beaute-test.com; hxxps//www.bons-plans-malins.com; hxxps//www.doctissimo.fr; hxxps//www.facebook.com; hxxps//www.lightinthebox.com; hxxps//www.linternaute.com; hxxps//www.remedes-de-grand-mere.com; hxxps//www.tomtop.com; hxxps//www.vessiere-cristaux.fr; hxxps//www.youtube.com
FF Extension: (Pas de nom) - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi [non trouvé(e)]
FF HKLM\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSKHKLM => non trouvé(e)
CHR DefaultSearchURL: Default -> hxxps//fr.search.yahoo.com/search?fr=mcafee&type=E211FR1311G0&p={searchTerms}
CHR DefaultSearchKeyword: Default -> mcafee
CHR DefaultSuggestURL: Default -> hxxps//fr.search.yahoo.com/sugg/gossip/gossip-fr-partner?output=fxjson&appid=mca&source=yahoo_mcafee_searchassist&command={searchTerms}
S2 WinZip Compression Smart Monitor Service; "C:\Program Files\WinZip\WinZip Smart Monitor\WinZip Compression Smart Monitor Service.exe" [X]
emptytemp:
end::