start::
SystemRestore: on
CreateRestorePoint:
CloseProcesses:
Hosts:
RemoveProxy:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\WINDOWS\System32\AutoWorkplace.exe join (Pas de fichier)
FF Extension: (Multifox Toolbar Button) - C:\Users\MAC\AppData\Roaming\Mozilla\Firefox\Profiles\yf62nl8w.default\Extensions\multifox-toolbar-button@rbaldwin.xpi
FF Extension: (Avast SafePrice | Comparaison, offres, coupons) - C:\Users\MAC\AppData\Roaming\Mozilla\Firefox\Profiles\yf62nl8w.default\Extensions\sp@avast.com.xpi
FF Extension: (Avast Online Security & Privacy) - C:\Users\MAC\AppData\Roaming\Mozilla\Firefox\Profiles\yf62nl8w.default\Extensions\wrc@avast.com.xpi
FF Plugin HKU\.DEFAULT: @hola.org/FlashPlayer -> C:\Users\MAC\AppData\Local\Hola\firefox_hola\app\flash\NPSWF32_18_0_0_232.dll [Pas de fichier]
FF Plugin HKU\.DEFAULT: @hola.org/vlc -> C:\Users\MAC\AppData\Local\Hola\firefox_hola\app\vlc\npvlc.dll [Pas de fichier]
CHR Extension: (Avast SafePrice | Comparaison, offres, coupons) - C:\Users\MAC\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck
CHR Extension: (Avast Online Security) - C:\Users\MAC\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki
R2 HuaweiHiSuiteService64.exe; C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe
R2 ProtexisLicensing; C:\Windows\SysWOW64\PSIService.exe
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q=
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q=
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q=
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q=
HKLM\...\StartupApproved\Run32: => "Acrobat Assistant 8.0"
HKLM\...\StartupApproved\Run32: => "Adobe ARM"
HKU\S-1-5-21-3382590871-3823213782-2396755087-1002\...\StartupApproved\Run: => "CyberGhost"
EmptyTemp:
cmd: ipconfig /flushdns
cmd: DISM /Online /Cleanup-image /Restorehealth
end::