start::
closeprocesses:
createrestorepoint:
HKLM\...\Run: [winlogui] => C:\WINDOWS\system32\winlogui.exe -o pool.minexmr.com:4444 -u 47KYx6QmWdbVotVxXTttQBQCQ2uX8vnkZNSnu6xuJNweYNC99pdCrk42ke5AeAMx1aYDyz8vbQKXs8oQkc9v9xMjBtN7R9W (Pas de fichier)
C:\WINDOWS\system32\winlogui.exe
HKLM\...\Policies\Explorer: [HideSCAHealth] 1
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
Task: {46F1CCBB-ACAA-41EF-8D7B-1B8ED3029FC9} - System32\Tasks\Microsoft\Windows\Application Experience\StartupCheckLibrary => rundll32.exe StartupCheckLibrary.dll,DllMainRunLibrary <==== ATTENTION
Task: {49879F0E-7FFF-41ED-97D5-9A147C6BA3C6} - System32\Tasks\ASR-Startup => C:\Program Files (x86)\Advanced System Repair Pro 1.9.7.4.0\AdvancedSystemRepairPro.exe /minimize (Pas de fichier)
C:\Program Files (x86)\Advanced System Repair Pro 1.9.7.4.0
HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3: <==== ATTENTION (Restriction - Zones)
Edge Extension: (Pas de nom) -> AutoFormFill_5ED10D46BD7E47DEB1F3685D2C0FCE08 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\AutoFormFill [non trouvé(e)]
Edge Extension: (Pas de nom) -> BookReader_B171F20233094AC88D05A8EF7B9763E8 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\BookViewer [non trouvé(e)]
Edge Extension: (Pas de nom) -> LearningTools_7706F933-971C-41D1-9899-8A026EB5D824 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\LearningTools [non trouvé(e)]
Edge Extension: (Pas de nom) -> PinJSAPI_EC01B57063BE468FAB6DB7EBFC3BF368 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\PinJSAPI [non trouvé(e)]
CHR HomePage: Default -> hxxp://www.trovi.com/?gd=&ctid=CT3331172&octid=EB_ORIGINAL_CTID&ISID=MA4C88DA3-284A-4930-BE1C-B2AB62610F4D&SearchSource=55&CUI=&UM=6&UP=SPE71A166E-77D2-48A3-A52D-9D67DEBB9621&SSPV=
CHR StartupUrls: Default -> "hxxp://www.trovi.com/?gd=&ctid=CT3331172&octid=EB_ORIGINAL_CTID&ISID=MA4C88DA3-284A-4930-BE1C-B2AB62610F4D&SearchSource=55&CUI=&UM=6&UP=SPE71A166E-77D2-48A3-A52D-9D67DEBB9621&SSPV="
CHR HKLM-x32\...\Chrome\Extension: [aegnopegbbhjeeiganiajffnalhlkkjb]
CHR HKLM-x32\...\Chrome\Extension: [caljgklbbfbcjjanaijlacgncafpegll]
CHR HKLM-x32\...\Chrome\Extension: [ccbpbkebodcjkknkfkpmfeciinhidaeh]
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk]
S3 wuauserv; C:\WINDOWS\system32\svchost.exe [57360 2021-06-25] (Microsoft Windows Publisher -> Microsoft Corporation) <==== ATTENTION (pas de ServiceDLL)
S3 wuauserv; C:\WINDOWS\SysWOW64\svchost.exe [47016 2021-06-25] (Microsoft Windows Publisher -> Microsoft Corporation) <==== ATTENTION (pas de ServiceDLL)
S3 asrrealtimesrv; C:\Program Files (x86)\Advanced System Repair Pro 1.9.7.4.0\asrrealtimesrv.exe [X]
S2 AviraUpdaterService; "C:\Program Files (x86)\Avira\SoftwareUpdater\Avira.SoftwareUpdater.ServiceHost.exe" [X]
emptytemp:
end::