start::
CreateRestorePoint:
CloseProcesses:
RemoveProxy:
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKLM\Software\...\Authentication\Credential Providers: [{503739d0-4c5e-4cfd-b3ba-d881334f0df2}] ->
Task: {026C3DA4-0830-4D40-9C17-9B33DC8FFD4A} - \Microsoft\Windows\Setup\GWXTriggers\OnIdle-5d -> Pas de fichier
Task: {0346B53E-2535-42C0-92C7-1410271B0C77} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\WINDOWS\ehome\ehPrivJob.exe /DoUpdateRecordPath $(Arg0) (Pas de fichier)
Task: {2B1FB2BC-7AE8-4C59-9B2C-E2EA905582E0} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\WINDOWS\ehome\mcupdate.exe $(Arg0) (Pas de fichier)
Task: {2FB55B86-9423-48D3-B3F7-E360F7DD1439} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Pas de fichier
Task: {325271A8-7F7D-4AB4-9265-ACE6062F4C21} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Pas de fichier
Task: {34875839-4E90-4315-8E90-72190E0CBF06} - System32\Tasks\AvastUpdateTaskMachineUA => C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe /ua /installsource scheduler (Pas de fichier)
Task: {357511A0-9054-4477-87D7-76EF66DC3883} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\WINDOWS\ehome\ehPrivJob.exe /DoRegisterSearch $(Arg0) (Pas de fichier)
Task: {38927583-37F7-40E8-B298-B094BD61F6EF} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe -ObjectStoreRecoveryTask (Pas de fichier)
Task: {3F0DC8F0-D892-43F6-A0B3-771006328491} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\WINDOWS\ehome\ehPrivJob.exe /DRMInit (Pas de fichier)
Task: {3FF44E4F-7135-4EBA-98DF-0ED1E84DAFA8} - \Microsoft\Windows\Setup\GWXTriggers\Time-Weekend -> Pas de fichier
Task: {40F7E584-62D8-4040-8A9F-011D86307AD1} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\WINDOWS\ehome\ehPrivJob.exe /DoConfigureInternetTimeService (Pas de fichier)
Task: {4257F046-EBDA-49A7-B4AD-D108F28F3AF5} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: {49B334A2-DC84-498F-AF35-2480266309EF} - \Microsoft\Windows\UNP\RunCampaignManager -> Pas de fichier
Task: {4CF61E00-026A-4827-895B-F02A36512C01} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe /launch (Pas de fichier)
Task: {5009C248-DA09-43DF-868F-3D83BC05F949} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\WINDOWS\ehome\ehPrivJob.exe /DoRecoveryTasks $(Arg0) (Pas de fichier)
Task: {62283640-3650-4865-B9C9-7E6626355890} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe -PvrRecoveryTask (Pas de fichier)
Task: {681D8066-700B-4EF3-85CD-E681CB37DCDC} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\WINDOWS\ehome\ehPrivJob.exe /PBDADiscovery (Pas de fichier)
Task: {6B340D2E-C2EF-4817-8D1F-1433891425C3} - System32\Tasks\Avast Software\Overseer => C:\Program Files\Common Files\Avast Software\Overseer\overseer.exe [2296088 2022-03-08]
Task: {72DEB8D6-BB6C-4E86-B22B-7B5442945532} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime -> Pas de fichier
Task: {76BB2CFB-828D-4D67-BB07-65507A4A7B8B} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\WINDOWS\ehome\ehrec.exe /RestartRecording (Pas de fichier)
Task: {76FD29D8-FDA7-4970-9002-010D6383E943} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe -MediaCenterRecoveryTask (Pas de fichier)
Task: {78CAAFC1-F9BF-4719-B1CF-9A00F7C6592E} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\WINDOWS\ehome\mcupdate.exe -crl -hms -pscn 15 (Pas de fichier)
Task: {7E9DDCBB-71B5-450E-8733-A085AD095C31} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Pas de fichier
Task: {7ED94BF6-968F-4241-B42C-5A5CA0E2B0F9} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Pas de fichier
Task: {7F4BD970-DEF1-40A1-9775-DF29038E5653} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\WINDOWS\ehome\ehPrivJob.exe /wait:7 /PBDADiscovery (Pas de fichier)
Task: {827B18F3-B011-4327-A549-ADFE663E5657} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\WINDOWS\ehome\ehPrivJob.exe /DoActivateWindowsSearch (Pas de fichier)
Task: {8A819526-C421-47E0-8CAC-3A614F442A53} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\WINDOWS\ehome\ehPrivJob.exe /DoReindexSearchRoot (Pas de fichier)
Task: {9642BAC5-3632-49D9-B96C-A1EAAA2424C8} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Pas de fichier
Task: {9F8219FD-0E17-4D2B-A3F6-E07ED6FFD9AF} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Pas de fichier
Task: {A05A5CBC-7644-47FE-A0A4-D6A8FA88AD08} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\WINDOWS\ehome\ehPrivJob.exe /InstallPlayReady $(Arg0) (Pas de fichier)
Task: {A332165A-3C8A-46C4-977D-EF14F5DF40B7} - System32\Tasks\Adobe Flash Player NPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_32_0_0_465_Plugin.exe
Task: {A9765FBE-C790-4A31-87F6-1F3BCD06830D} - System32\Tasks\AvastUpdateTaskMachineCore => C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe /c (Pas de fichier)
Task: {AEBDE765-0F75-4DF9-B17A-B36E1FA7D8C0} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe -SqlLiteRecoveryTask (Pas de fichier)
Task: {B09F3091-8596-440C-A3E4-BDE83DCDD4CA} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe /backup /iavs (Pas de fichier)
Task: {B6C035CF-EDE2-4766-A615-F085D4EDDA23} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\WINDOWS\ehome\ehPrivJob.exe /OCURDiscovery $(Arg0) (Pas de fichier)
Task: {BD227C8B-8178-45C5-95FC-2ADC496A49DA} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\WINDOWS\ehome\ehPrivJob.exe /wait:90 /PBDADiscovery (Pas de fichier)
Task: {C3BD79D0-D32C-47E7-B249-F18B246CCE39} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Pas de fichier
Task: {CC5667AE-AF03-4949-9ED4-E58ADED75785} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\WINDOWS\ehome\mcupdate.exe -PvrSchedule (Pas de fichier)
Task: {CD2FA5EE-D44E-44E2-96BF-B5184AA41EFA} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime -> Pas de fichier
Task: {DDB1DD82-54CE-4DA3-8C6A-A944C15FD56C} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Pas de fichier
Task: {F5510182-3A4B-4EA0-B783-34FA9FB95FF7} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Pas de fichier
Task: {F95824EB-EB84-4F1B-B51F-DCD46F8FA9A0} - \Microsoft\Windows\Setup\gwx\rundetector -> Pas de fichier
Task: {FB631310-E538-4B6B-8006-8B7245538B85} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\WINDOWS\ehome\MCUpdate.exe -pscn 0 (Pas de fichier)
Task: {FB8AEB84-6461-4CF8-8243-650FD2072D0B} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Pas de fichier
Task: {FDC01BC2-49F4-4AD4-8ABE-03352BE14E00} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\WINDOWS\ehome\ehPrivJob.exe /OCURActivate (Pas de fichier)
FF Extension: (cacaoweb) - C:\Users\MARC\AppData\Roaming\Mozilla\Firefox\Profiles\3hiiob30.default\Extensions\cacaoweb@cacaoweb.org
FF Extension: (hotfix-update-xpi-intermediate) - C:\Users\MARC\AppData\Roaming\Mozilla\Firefox\Profiles\3hiiob30.default\Extensions\hotfix-update-xpi-intermediate@mozilla.com.xpi
U3 idsvc; pas de ImagePath
S3 MpKslc18d1926; \??\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{38A4166D-0042-4840-A9C0-6DA5FD097304}\MpKslDrv.sys [X]
2016-09-02 09:44 - 2016-09-02 09:46 - 002312192 _____ () C:\Users\Romane\ZHPDiag3.exe
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Pas de fichier
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Pas de fichier
WMI:subscription\CommandLineEventConsumer->BVTConsumer::[CommandLineTemplate => cscript KernCap.vbs][WorkingDirectory => C:\\tools\\kernrate]
SearchScopes: HKLM -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://fr.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://fr.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/709-111075-12437-3/4?mpre=hxxp://www.ebay.fr/sch/i.html?_nkw={searchTerms}
SearchScopes: HKLM -> {E2F3799C-66D3-4E63-A94A-852705019087} URL = hxxp://www.amazon.fr/s/ref=azs_osd_ieafr?ie=UTF-8&tag=hp-fr2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://fr.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://fr.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/709-111075-12437-3/4?mpre=hxxp://www.ebay.fr/sch/i.html?_nkw={searchTerms}
SearchScopes: HKLM-x32 -> {E2F3799C-66D3-4E63-A94A-852705019087} URL = hxxp://www.amazon.fr/s/ref=azs_osd_ieafr?ie=UTF-8&tag=hp-fr2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-2740142851-1224122599-804519661-1000 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://fr.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKU\S-1-5-21-2740142851-1224122599-804519661-1000 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://fr.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKU\S-1-5-21-2740142851-1224122599-804519661-1000 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/709-111075-12437-3/4?mpre=hxxp://www.ebay.fr/sch/i.html?_nkw={searchTerms}
SearchScopes: HKU\S-1-5-21-2740142851-1224122599-804519661-1000 -> {E2F3799C-66D3-4E63-A94A-852705019087} URL = hxxp://www.amazon.fr/s/ref=azs_osd_ieafr?ie=UTF-8&tag=hp-fr2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-2740142851-1224122599-804519661-1368 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Pas de nom -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> Pas de fichier
BHO: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
BHO: TrueSuite Website Log On -> {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} -> C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll
BHO: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll
BHO-x32: TrueSuite Website Log On -> {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} -> C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll [2011-08-19]
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-30]
BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - Pas de fichier
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll [2014-03-11]
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-30]
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll [2014-03-11]
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-30]
Toolbar: HKU\S-1-5-21-2740142851-1224122599-804519661-1000 -> Pas de nom - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Pas de fichier
EmptyTemp:
cmd: ipconfig /flushdns
end::