Start::
CloseProcesses:
CreateRestorePoint:
Removeproxy:
Hosts:
Movie Maker (HKLM-x32\...\{14372C50-E940-4997-951D-9AA76725E5BF}) (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Movie Maker (HKLM-x32\...\{186312F7-5E94-4709-859E-8A91F97DC674}) (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Movie Maker (HKLM-x32\...\{21764A96-6748-4B83-89E7-7A5063BF156C}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Movie Maker (HKLM-x32\...\{26B1B294-44C5-473A-90B6-D387DE0A2B29}) (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Movie Maker (HKLM-x32\...\{6976BDFA-A849-4B58-BC15-CACA7C8040FD}) (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Movie Maker (HKLM-x32\...\{83ABE916-759A-49BE-BCEB-91F237E01502}) (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Movie Maker (HKLM-x32\...\{8E829CBE-9E2F-44D2-9A2C-437D9676038F}) (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Movie Maker (HKLM-x32\...\{990A01BF-4068-4723-9A84-CEC98E9DCC44}) (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Movie Maker (HKLM-x32\...\{BC411258-FE9D-4EC9-9559-392D5034D3C4}) (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Movie Maker (HKLM-x32\...\{C313F37C-71DB-4272-ADCE-E7CF7E3C8D87}) (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Movie Maker (HKLM-x32\...\{C40A1FAD-DBB0-4A8C-8263-2A7B74E4520A}) (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Movie Maker (HKLM-x32\...\{C95AEB53-7FAE-4257-97AF-7136E8D9F9CA}) (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Movie Maker (HKLM-x32\...\{DCA6C9A9-D593-4BF3-9AD2-C1AA69DFAB27}) (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Movie Maker (HKLM-x32\...\{DD67BE4B-7E62-4215-AFA3-F123A800A389}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Movie Maker (HKLM-x32\...\{DD76542A-5AD9-481C-9CA8-756F84A8FEAF}) (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Movie Maker (HKLM-x32\...\{FE9E9FC3-5F6E-4672-80C2-0032EC06169C}) (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Συλλογή φωτογραφιών (HKLM-x32\...\{511B359D-2859-4118-B6D2-781936F36920}) (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
影像中心 (HKLM-x32\...\{B56ADA3D-7E16-447C-AAC6-1E1EBEDEC505}) (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
照片库 (HKLM-x32\...\{408995B7-AAAE-4972-B60E-4C0E086A3952}) (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
AlternateDataStreams: C:\ProgramData\Reprise:wupeogjxlctlfudivq`qsp`28hfm [0]
ContextMenuHandlers6: [Shell Extension for Malware scanning] -> {45AC2688-0253-4ED8-97DE-B5370FA7D48A} => C:\Program Files (x86)\Avira\Antivirus\shlext64.dll [2021-09-18] (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG)
ContextMenuHandlers1: [Shell Extension for Malware scanning] -> {45AC2688-0253-4ED8-97DE-B5370FA7D48A} => C:\Program Files (x86)\Avira\Antivirus\shlext64.dll [2021-09-18] (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG)
C:\Program Files (x86)\Avira
AV: Avira Antivirus (Enabled - Up to date) {8A154ED8-4428-DB2D-0E3F-BD82C448FD94}
AS: Avira Antivirus (Enabled - Up to date) {33CF8AA2-FA06-4AD4-98AB-332D53DD7FFB}
HKLM\...\Run: [] => [X]
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-1271420549-3183862273-2381648090-1002\...\Run: [] => [X]
GroupPolicy: Restriction - Chrome <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
Task: {07A7E5A0-5B32-440B-A68E-FD1A8CA71E9C} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Pas de fichier <==== ATTENTION
Task: {541BDCAE-AA7C-4BE7-89FB-C5D340358A03} - \Microsoft\Windows\Setup\gwx\rundetector -> Pas de fichier <==== ATTENTION
Task: {61B54CA5-E3D1-4116-92C4-A17C3ACDF068} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Pas de fichier <==== ATTENTION
Task: {68F1632D-1C2D-4A8B-8B18-49621D977055} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task => {3519154C-227E-47F3-9CC9-12C3F05817F1}
Task: {6BCE0D4E-A434-4DEF-BDA3-325BC285DC41} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Pas de fichier <==== ATTENTION
Task: {7D3780C5-1554-4520-95A0-E34A983B94F7} - System32\Tasks\Avira_Antivirus_Systray => C:\Program Files (x86)\Avira\Antivirus\avgnt.exe [2648424 2021-11-22] (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG)
Task: {8A4BF379-6E02-4DA9-A890-39D11A2E0503} - \Microsoft\Windows\UNP\RunCampaignManager -> Pas de fichier <==== ATTENTION
Task: {C4BD691C-CB5F-4232-97D6-46829DFDB4B5} - \Microsoft\Windows\Setup\EOONotify -> Pas de fichier <==== ATTENTION
Task: {DA7146DB-328B-4103-80D5-314DB2C2BE33} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Pas de fichier <==== ATTENTION
HKU\S-1-5-21-1271420549-3183862273-2381648090-1002\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk]
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk]
2012-07-25 00:50 - 2012-07-25 00:50 - 000001261 _____ () C:\Program Files (x86)\Hercus Model A - Imperial Thread.lat
2012-05-25 02:43 - 2012-05-25 02:43 - 000001272 _____ () C:\Program Files (x86)\Hercus Model A - Metric Thread.lat
2012-05-23 05:41 - 2012-05-23 05:41 - 000001309 _____ () C:\Program Files (x86)\Hercus Model A.lat
2012-07-25 00:29 - 2012-07-25 00:29 - 007023616 _____ (Vernon van Duijnhoven) C:\Program Files (x86)\LatheGears.exe
2012-07-01 23:29 - 2012-07-01 23:29 - 000001490 _____ () C:\Program Files (x86)\Nuttal.lat
2010-05-27 02:47 - 2010-05-27 02:47 - 000000295 _____ () C:\Program Files (x86)\Toreb (Swedish).lat
2014-09-01 09:18 - 2014-09-01 09:18 - 000002086 _____ () C:\Users\titou\AppData\Roaming\IDFKR
2014-09-01 09:18 - 2014-09-01 09:18 - 000001248 _____ () C:\Users\titou\AppData\Roaming\ZRBMEL
2015-01-18 08:06 - 2016-07-25 14:29 - 001158182 _____ () C:\Users\titou\AppData\Local\BTServer.log
2017-04-12 13:09 - 2018-10-25 18:52 - 000013824 _____ () C:\Users\titou\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
cmd: powershell DISM.exe /Online /Cleanup-image /Restorehealth
cmd: powershell sfc /scannowPour la correction
cmd: ipconfig /flushdns
cmd: netsh advfirewall reset
cmd: netsh advfirewall set allprofiles state on
cmd: netsh winsock reset
Emptytemp:
End::