start::
closeprocesses:
createrestorepoint:
cmd: cscript %windir%\System32\slmgr.vbs /dli
ShellIconOverlayIdentifiers: [ IDM Shell Extension] -> {CDC95B92-E27C-4745-A8C5-64A52A78855D} => -> Pas de fichier
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Pas de fichier
ContextMenuHandlers1: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} => C:\Program Files (x86)\Notepad++\NppShell_06.dll -> Pas de fichier
ContextMenuHandlers4: [PowerISO] -> {967B2D40-8B7D-4127-9049-61EA0C2C6DCE} => -> Pas de fichier
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> Pas de fichier
ContextMenuHandlers6: [PowerISO] -> {967B2D40-8B7D-4127-9049-61EA0C2C6DCE} => -> Pas de fichier
DPF: HKLM-x32 {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_181-windows-i586.cab
DPF: HKLM-x32 {CAFEEFAC-0018-0000-00181-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_181-windows-i586.cab
DPF: HKLM-x32 {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_181-windows-i586.cab
HKLM\...\StartupApproved\Run32: => "SMΔRT-Protection"
HKU\S-1-5-21-2987775730-2434628737-2840101130-3813\...\StartupApproved\Run: => "Chromium"
HKU\S-1-5-21-2987775730-2434628737-2840101130-3813\...\Run: [Chromium] => "c:\users\gide.nkouka\appdata\local\chromium\application\chrome.exe" --auto-launch-at-startup --profile-directory="Default" --restore-last-session
c:\users\gide.nkouka\appdata\local\chromium
HKU\S-1-5-21-2987775730-2434628737-2840101130-3813\...\Policies\system: [NoDispScrSavPage] 0
HKU\S-1-5-21-2987775730-2434628737-2840101130-3813\Software\Policies\...\system: [GroupPolicyRefreshTime] 1
HKU\S-1-5-21-2987775730-2434628737-2840101130-3813\Software\Policies\...\system: [GroupPolicyRefreshTimeOffset] 8
HKU\S-1-5-21-3371038503-1723060537-3163575906-1001\...\MountPoints2: {12e09a51-17b1-11ec-8987-3863bb932759} - "G:\Setup.exe"
HKU\S-1-5-21-3371038503-1723060537-3163575906-1001\...\MountPoints2: {12e09a83-17b1-11ec-8987-3863bb932759} - "G:\Setup.exe"
Lsa: [Notification Packages] scecli "C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter"
GroupPolicy: Restriction ? <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
Task: {3BC53861-87D3-4B47-ADE6-B2355377881A} - System32\Tasks\Adobe Flash Player NPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_32_0_0_223_Plugin.exe [1457208 2019-08-01] (Adobe Inc. -> Adobe)
C:\WINDOWS\SysWOW64\Macromed
Task: {492080BC-3FA9-4A7B-9C66-9BF000C14BD1} - System32\Tasks\Microsoft\Windows\Setup\EOSNotify => C:\WINDOWS\system32\EOSNotify.exe (Pas de fichier)
Task: {56BB1A95-DA64-4468-81E0-FA4DBCDD4961} - System32\Tasks\Avast Software\Overseer => C:\Program Files\Common Files\AVAST Software\Overseer\overseer.exe [1790184 2021-05-26] (Avast Software s.r.o. -> Avast Software)
C:\Program Files\Common Files\AVAST Software
Task: {784CC4F5-3607-4521-A05B-965032970B43} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [335416 2019-08-01] (Adobe Inc. -> Adobe) .
Task: {8A008461-A73D-4DDF-BDD1-2872F6E421EF} - System32\Tasks\Microsoft\Windows\termsrv\RemoteFX\RemoteFXWarningTask => C:\WINDOWS\System32\RemoteFXvGPUDisablement.exe Warning (Pas de fichier)
Task: {E491C2F5-5F04-4DD3-9126-C0BDF290712D} - System32\Tasks\Microsoft\Windows\GroupPolicy\{3E0A038B-D834-4930-9981-E89C9BFF83AA} => C:\WINDOWS\system32\gpupdate.exe [30720 2021-06-28] (Microsoft Windows -> Microsoft Corporation)
ProxyServer: [S-1-5-21-2987775730-2434628737-2840101130-3813] => CG-BRA-01ISA01:8080
Edge Extension: (Pas de nom) -> AutoFormFill_5ED10D46BD7E47DEB1F3685D2C0FCE08 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\AutoFormFill [non trouvé(e)]
Edge Extension: (Pas de nom) -> BookReader_B171F20233094AC88D05A8EF7B9763E8 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\BookViewer [non trouvé(e)]
Edge Extension: (Pas de nom) -> LearningTools_7706F933-971C-41D1-9899-8A026EB5D824 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\LearningTools [non trouvé(e)]
Edge Extension: (Pas de nom) -> PinJSAPI_EC01B57063BE468FAB6DB7EBFC3BF368 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\PinJSAPI [non trouvé(e)]
FF Extension: (Avast SafePrice | Comparaison, offres, coupons) - C:\Users\gide.nkouka\AppData\Roaming\Mozilla\Firefox\Profiles\5qe08omz.default-1521556690407-1551945239472\Extensions\sp@avast.com.xpi [2022-02-09]
FF Extension: (Avast Online Security & Privacy) - C:\Users\gide.nkouka\AppData\Roaming\Mozilla\Firefox\Profiles\5qe08omz.default-1521556690407-1551945239472\Extensions\wrc@avast.com.xpi [2022-03-08]
FF HKU\S-1-5-21-2987775730-2434628737-2840101130-3813\...\Firefox\Extensions: [mozilla_cc2@internetdownloadmanager.com] - C:\Users\gide.nkouka\Desktop\idmmzcc2.xpi => non trouvé(e)
FF HKU\S-1-5-21-2987775730-2434628737-2840101130-3813\...\SeaMonkey\Extensions: [mozilla_cc2@internetdownloadmanager.com] - C:\Program Files (x86)\Internet Download Manager\idmmzcc2.xpi => non trouvé(e)
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_32_0_0_223.dll [2019-08-01] (Adobe Inc. -> )
FF Plugin: @java.com/DTPlugin,version=11.171.2 -> C:\Program Files\Java\jre1.8.0_171\bin\dtplugin\npDeployJava1.dll [2018-10-14] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.171.2 -> C:\Program Files\Java\jre1.8.0_171\bin\plugin2\npjp2.dll [2018-10-14] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin: Adobe Acrobat -> C:\Program Files\Adobe\Acrobat DC\Acrobat\Air\nppdf32.dll [2021-12-24] (Adobe Inc. -> Adobe Systems Inc.)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_32_0_0_223.dll [2019-08-01] (Adobe Inc. -> )
FF Plugin-x32: @java.com/DTPlugin,version=10.15.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2018-10-10] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.15.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2018-10-10] (Oracle America, Inc. -> Oracle Corporation)
CHR HKLM\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx <non trouvé(e)>
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]
CHR HKLM-x32\...\Chrome\Extension: [ihcjicgdanjaechkgeegckofjjedodee]
S3 AdobeFlashPlayerUpdateSvc; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [335416 2019-08-01] (Adobe Inc. -> Adobe)
S3 dtlitescsibus; C:\WINDOWS\System32\drivers\dtlitescsibus.sys [30264 2018-12-18] (Disc Soft Ltd -> Disc Soft Ltd)
S3 dtliteusbbus; C:\WINDOWS\System32\drivers\dtliteusbbus.sys [47672 2018-12-18] (Disc Soft Ltd -> Disc Soft Ltd)
S3 evserial9; C:\WINDOWS\System32\DRIVERS\evserial9.sys [40632 2017-07-24] (Element 5 Limited Liability Company -> ELTIMA Software)
S3 VSBC9; C:\WINDOWS\System32\drivers\evsbc9.sys [127160 2017-07-24] (Element 5 Limited Liability Company -> ELTIMA Software)
S3 intaud_WaveExtensible; \SystemRoot\system32\drivers\intelaud.sys [X]
S3 MpKslfd9db848; \??\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1F33DB71-E625-4A15-BDE2-0E3266212F1D}\MpKslDrv.sys [X]
S3 WinDivert1.1; \??\C:\Program Files\KMSpico\WinDivert.sys [X]
2022-03-08 15:55 - 2022-03-08 15:55 - 000000000 ____D C:\Users\gide.nkouka\Doctor Web
2022-03-08 15:44 - 2022-03-10 14:59 - 000000000 ____D C:\WINDOWS\system32\Tasks\Doctor Web
2022-03-08 15:05 - 2022-03-10 16:00 - 000000000 ____D C:\Program Files\DrWeb
2022-03-08 14:55 - 2022-03-10 16:00 - 000000000 ____D C:\ProgramData\Doctor Web
2018-07-06 19:22 - 2018-07-06 19:22 - 000000000 _____ () C:\Users\gide.nkouka\AppData\Local\{72B18FFA-53ED-4CCD-8227-933E487D6677}
2018-11-04 11:12 - 2018-11-04 11:12 - 000000000 _____ () C:\Users\gide.nkouka\AppData\Local\{D1D30045-3AD7-469A-83C8-8BC6A0B02602}
2018-10-09 06:09 - 2018-10-09 06:09 - 000000000 _____ () C:\Users\gide.nkouka\AppData\Local\{DC404463-DC0F-42C3-8A80-7339C2604A9D}
2018-10-20 11:44 - 2018-10-20 11:44 - 000000000 _____ () C:\Users\gide.nkouka\AppData\Local\{E3B1AA1F-719B-417C-8DC2-992F832E9B55}
cmd: netsh advfirewall reset
cmd: sfc /scannow
emptytemp:
end::