start::
closeprocesses:
createrestorepoint:
CustomCLSID: HKU\S-1-5-21-497646839-3136551522-714883716-1002_Classes\CLSID\{162C6FB5-44D3-435B-903D-E613FA093FB5}\InprocServer32 -> C:\Users\Bertrand\AppData\Local\Microsoft\OneDrive\17.3.6743.1212\amd64\FileCoAuthLib64.dll => Pas de fichier
AlternateDataStreams: C:\Users\Bertrand\AffichageResultats.pdf:$CmdZnID [26]
AlternateDataStreams: C:\Users\Bertrand\pole emploi jonathan.pdf:$CmdZnID [26]
AlternateDataStreams: C:\Users\Bertrand\Downloads\document(1).pdf:$CmdTcID [64]
AlternateDataStreams: C:\Users\Bertrand\Downloads\document(1).pdf:$CmdZnID [26]
AlternateDataStreams: C:\Users\Bertrand\Downloads\document.pdf:$CmdTcID [64]
AlternateDataStreams: C:\Users\Bertrand\Downloads\document.pdf:$CmdZnID [26]
AlternateDataStreams: C:\Users\Bertrand\Downloads\Décompte prestation maladie-26 novembre 2015.pdf:$CmdTcID [64]
AlternateDataStreams: C:\Users\Bertrand\Downloads\Décompte prestation maladie-26 novembre 2015.pdf:$CmdZnID [26]
AlternateDataStreams: C:\Users\Bertrand\Downloads\SkypeSetup(1).exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\Bertrand\Downloads\SkypeSetup(1).exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Bertrand\Downloads\SkypeSetup(2).exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\Bertrand\Downloads\SkypeSetup(2).exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Bertrand\Downloads\SkypeSetup.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Bertrand\Downloads\SkypeSetup.exe:$CmdZnID [26]
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
C:\Program Files\Common Files\mcafee
HKLM\...\Run: [HotKeysCmds] => "C:\WINDOWS\system32\hkcmd.exe" (Pas de fichier)
HKLM\...\Run: [WindowsDefender] => "%ProgramFiles%\Windows Defender\MSASCuiL.exe" (Pas de fichier)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" (Pas de fichier)
HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG -> Elaborate Bytes AG)
HKU\S-1-5-21-497646839-3136551522-714883716-1002\...\Run: [McAfeeSafeConnect] => C:\Program Files (x86)\McAfee Safe Connect\McAfee Safe Connect.exe (Pas de fichier)
Task: {40C82267-102D-4F6C-B41C-16C58FF4BB0A} - \Microsoft\Windows\Setup\EOSNotify -> Pas de fichier <==== ATTENTION
Task: {46636AA2-4F11-4B4B-A884-666A9DA36286} - System32\Tasks\{FF1C0E0A-F0F0-4223-9240-B62EDE8CF016} => C:\WINDOWS\system32\pcalua.exe -a C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_29_0_0_113_Plugin.exe -c -maintain plugin
C:\WINDOWS\SysWOW64\Macromed
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
S1 ESProtectionDriver; \??\C:\WINDOWS\system32\drivers\mbae64.sys [X]
S3 MBAMFarflt; system32\DRIVERS\farflt.sys [X]
S3 MBAMProtection; \??\C:\WINDOWS\system32\DRIVERS\mbam.sys [X]
S3 MBAMWebProtection; \SystemRoot\system32\DRIVERS\mwac.sys [X]
cmd: netsh advfirewall reset
cmd: sfc /scannow
emptytemp:
end::