start::
closeprocesses:
createrestorepoint:
virustotal: C:\Users\SBS\AppData\Roaming\Microsoft\RegHost.exe
virustotal: C:\Program Files (x86)\Stickies\stickies.exe
virustotal: C:\Users\SBS\AppData\Local\cache\MoUSO.exe
ShellIconOverlayIdentifiers: [KzShlobj] -> {AAA0C5B8-933F-4200-93AD-B143D7FFF9F2} => -> Pas de fichier
ContextMenuHandlers1: [


KuaiZipShlExt] -> {6ADF19E3-77A3-4395-ADB4-9FD7D351EB3E} => C:\Program Files\¿ìѹ\X64\KZipShell.dll -> Pas de fichier
C:\Program Files\¿ìѹ
ContextMenuHandlers1: [ContextMenuExt] -> {6ADF19E3-77A3-4395-ADB4-9FD7D351EB3E} => C:\Program Files\¿ìѹ\X64\KZipShell.dll -> Pas de fichier
ContextMenuHandlers2: [


KuaiZipShlExt] -> {6ADF19E3-77A3-4395-ADB4-9FD7D351EB3E} => C:\Program Files\¿ìѹ\X64\KZipShell.dll -> Pas de fichier
ContextMenuHandlers4: [


KuaiZipShlExt] -> {6ADF19E3-77A3-4395-ADB4-9FD7D351EB3E} => C:\Program Files\¿ìѹ\X64\KZipShell.dll -> Pas de fichier
FolderExtensions: [] -> {27DD0F8B-3E0E-4ADC-A78A-66047E71ADC5} => C:\Users\SBS\Desktop\mac\OldNewExplorer64.dll -> Pas de fichier
WMI:subscription\__TimerInstruction->SethomePage Interval Timer:: <==== ATTENTION
WMI:subscription\__IntervalTimerInstruction->SethomePage Interval Timer:: <==== ATTENTION
WMI:subscription\__EventFilter->EventFilter sethomePage2::[Query => Select * From __timerevent Where TimerId = "SethomePage Interval Timer"] <==== ATTENTION
Shortcut: C:\Users\SBS\Desktop\Games\Fuser.lnk -> D:\FUSER\FUSER.ALL.DLC\FUSER\!Run.bat ()
Shortcut: C:\Users\SBS\Desktop\Games\SAO France.lnk -> C:\Users\SBS\Desktop\saominecraft\truc.bat (Pas de fichier)
AlternateDataStreams: C:\ProgramData\Reprise:wupeogjxldtlfudivq`qsp`27hfm [0]
AlternateDataStreams: C:\ProgramData\TEMP:D5AD7675 [120]
AlternateDataStreams: C:\Users\Public\AppData:CSM [476]
AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [462]
HKLM\...\.reg: Regedit.Document => c:\Winnt\Regedit.exe %1
SearchScopes: HKLM -> {2211d4a5-48d0-47f5-a7cd-81e861470f7f} URL =
SearchScopes: HKLM-x32 -> {2211d4a5-48d0-47f5-a7cd-81e861470f7f} URL =
SearchScopes: HKU\S-1-5-21-1266926671-3051167926-3897398671-1001 -> {2211d4a5-48d0-47f5-a7cd-81e861470f7f} URL =
BHO: Pas de nom -> {27DD0F8B-3E0E-4ADC-A78A-66047E71ADC5} -> C:\Users\SBS\Desktop\mac\OldNewExplorer64.dll => Pas de fichier
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_271\bin\ssv.dll [2021-06-15] (Oracle America, Inc. -> Oracle Corporation)
BHO: Pas de nom -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> Pas de fichier
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_271\bin\jp2ssv.dll [2021-06-15] (Oracle America, Inc. -> Oracle Corporation)
BHO-x32: Pas de nom -> {27DD0F8B-3E0E-4ADC-A78A-66047E71ADC5} -> C:\Users\SBS\Desktop\mac\OldNewExplorer32.dll => Pas de fichier
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2022-03-07] (Microsoft Corporation -> Microsoft Corporation)
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll Pas de fichier
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll Pas de fichier
HKLM\...\StartupApproved\StartupFolder: => "McAfee Security Scan Plus.lnk"
HKLM\...\StartupApproved\Run32: => "Wondershare Helper Compact.exe"
HKU\S-1-5-21-1266926671-3051167926-3897398671-1001\...\StartupApproved\Run: => "ozgklxwaob"
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2780112 2017-01-20] (Malwarebytes Corporation -> Malwarebytes)
HKLM-x32\...\Run: [ProductUpdater] => C:\Program Files (x86)\Common Files\Freemake Shared\ProductUpdater\ProductUpdater.exe [73216 2017-02-17] () [Fichier non signé]
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2133728 2017-09-12] (Wondershare Technology Co.,Ltd -> Wondershare)
C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [706680 2020-09-16] (Oracle America, Inc. -> Oracle Corporation)
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-1266926671-3051167926-3897398671-1001\...\Run: [ozgklxwaob] => C:\ozgklxwaobozgklxwaob\ozgklxwaob.vbs [190 2017-03-09] () [Fichier non signé]
C:\ozgklxwaobozgklxwaob
HKU\S-1-5-21-1266926671-3051167926-3897398671-1001\...\Run: [Windows Shutdown Assistant] => C:\Program Files (x86)\CompanyName\Windows Shutdown Assistant\Windows Shutdown Assistant.exe /autoStart (Pas de fichier)
HKU\S-1-5-21-1266926671-3051167926-3897398671-1001\...\Run: [Zoom] => [X]
HKU\S-1-5-21-1266926671-3051167926-3897398671-1001\...\Run: [WondershareFilmoraX] => C:\Users\SBS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wondershare Filmora X\WondershareFilmoraX.exe [572570032 2020-11-23] (Wondershare Technology Co.,Ltd -> ) [Fichier non signé]
HKU\S-1-5-21-1266926671-3051167926-3897398671-1001\...\Run: [RegHost] => C:\Users\SBS\AppData\Roaming\Microsoft\RegHost.exe [10869760 2022-03-14] (Nvidia Corporation -> ) [Fichier non signé]
Lsa: [Notification Packages] scecli C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter "C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter"
C:\Program Files\TrueKey
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
Task: {41C4408A-84EB-4891-AF99-598E4C5396FB} - System32\Tasks\ViGEmBusUpdater => C:\Program Files\Nefarius Software Solutions\ViGEm Bus Driver\ViGEmBusUpdater.exe (Pas de fichier)
Task: {4743B448-D566-4C0C-9C50-32BC7DF24F5B} - System32\Tasks\ASUS\ASUS Media Streamer DMR => C:\Program Files (x86)\ASUS\HomeCloud\Media Streamer\ASUS Media Streamer\DLNA\DMR\AODMR.exe (Pas de fichier)
Task: {4986B35F-40A6-4393-AFF0-0AB4150B5805} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe /backup /iavs (Pas de fichier)
Task: {5AC1CBE8-93F5-4B44-A459-62DBD757A8CB} - System32\Tasks\Cache-S-21-2946144819-3e21f723 => C:\Users\SBS\AppData\Local\cache\MoUSO.exe [124928 2022-03-14] () [Fichier non signé]
Task: {6D46E15C-C821-4923-8E94-57771067877B} - System32\Tasks\Opera scheduled Autoupdate 1548082604 => C:\Users\SBS\AppData\Local\Programs\Opera\launcher.exe --scheduledautoupdate $(Arg0) (Pas de fichier)
Task: {7F842AA7-39B7-42EC-93F3-5EA610192C9B} - System32\Tasks\Microsoft\Windows\rempl\shell => C:\Program Files\rempl\sedlauncher.exe (Pas de fichier)
Task: {8BBFBB19-77BE-42DE-8071-23856ED44798} - System32\Tasks\ProtectWindows => C:\Users\SBS\Downloads\ActivationWindows.exe (Pas de fichier)
Task: {9A6DB66B-13D6-41CC-A2C3-0F86C25D057A} - System32\Tasks\MicrosoftApi => C:\Users\SBS\AppData\Roaming\ServiceApi\MicrosoftApi.exe (Pas de fichier)
Task: {A394A46C-8531-4940-A977-79BB876A721E} - System32\Tasks\vsawef => C:\Users\SBS\AppData\Roaming\vsawef.exe (Pas de fichier) <==== ATTENTION
Task: {D16B7944-EF09-4E26-9167-8E7C342D9DE2} - \CarambisDriverUpdaterUACDisablingTask -> Pas de fichier <==== ATTENTION
Task: {D1BBD241-AA06-41DB-947B-95E8AA2784FB} - System32\Tasks\AutoPico Daily Restart => C:\Program Files\KMSpico\AutoPico.exe [745664 2016-01-11] (@ByELDI -> @ByELDI) [Fichier non signé]
C:\Program Files\KMSpico
Task: {F30FB5FC-5D83-4804-AAF5-6DB96052E825} - \Microsoft\Windows\UNP\RunCampaignManager -> Pas de fichier <==== ATTENTION
Task: {F47644CF-48B6-456B-ACF6-9103376B6F14} - System32\Tasks\Microsoft\Windows\CUAssistant\CULauncher => C:\Program Files\CUAssistant\culauncher.exe (Pas de fichier)
Edge Extension: (Pas de nom) -> AutoFormFill_5ED10D46BD7E47DEB1F3685D2C0FCE08 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\AutoFormFill [non trouvé(e)]
Edge Extension: (Pas de nom) -> LearningTools_7706F933-971C-41D1-9899-8A026EB5D824 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\LearningTools [non trouvé(e)]
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [Pas de fichier]
C:\Users\SBS\AppData\Local\Google\Chrome\User Data\ChromeDefaultData
CHR Notifications: ChromeDefaultData -> hxxps://aternos.org; hxxps://meet.google.com; hxxps://mp3pro.xyz; hxxps://www.facebook.com
CHR HomePage: ChromeDefaultData -> inline.go.mail.ru
CHR StartupUrls: ChromeDefaultData -> "hxxp://mail.ru/cnt/10445?gp=834424"
CHR NewTab: ChromeDefaultData -> Not-active:"chrome-extension://opgcmenojeaiflclbnnkcmjfnglpkaed/start/index.html", Not-active:"chrome-extension://beliehdniadoecbonbhlcgbdldccfigp/visual-bookmarks.html", Not-active:"chrome-extension://ikpcpgklmefncbfgbdifkaphbaapgafh/visual-bookmarks.html", Not-active:"chrome-extension://clgckgfbhciacomhlchmgdnplmdiadbj/newtab.html"
CHR DefaultSearchURL: ChromeDefaultData -> hxxps://fr.search.yahoo.com/search?fr=mcafee&type=E210FR91075G0&p={searchTerms}
CHR DefaultSearchKeyword: ChromeDefaultData -> mcafee
CHR DefaultSuggestURL: ChromeDefaultData -> hxxps://fr.search.yahoo.com/sugg/gossip/gossip-fr-partner?output=fxjson&appid=mca&source=yahoo_mcafee_searchassist&command={searchTerms}
CHR Session Restore: ChromeDefaultData -> est activé.
CHR DefaultSearchURL: Default -> hxxps://fr.search.yahoo.com/search?fr=mcafee&type=E210FR91075G0&p={searchTerms}
CHR DefaultSearchKeyword: Default -> mcafee
C:\Users\SBS\AppData\Local\Google\Chrome\User Data\Default\Extensions\nbeldjopgciegccabfohnefghfpinncn
CHR HKU\S-1-5-21-1266926671-3051167926-3897398671-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [beliehdniadoecbonbhlcgbdldccfigp]
CHR HKU\S-1-5-21-1266926671-3051167926-3897398671-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [bobeehhgpnppdghmfffdjadmbjbaeeod]
CHR HKU\S-1-5-21-1266926671-3051167926-3897398671-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [ebkgajjadgojjkgacfgjpnpgagpecpjp]
CHR HKU\S-1-5-21-1266926671-3051167926-3897398671-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [fppjhfcgnalgfiimdflmikpifodndljf]
CHR HKU\S-1-5-21-1266926671-3051167926-3897398671-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [gbnhehnpnbiioheicppmmmjaekcdfigc]
CHR HKU\S-1-5-21-1266926671-3051167926-3897398671-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [hnainbefehfglngmjpbmilfmlbmicacf]
CHR HKU\S-1-5-21-1266926671-3051167926-3897398671-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [ikpcpgklmefncbfgbdifkaphbaapgafh]
CHR HKU\S-1-5-21-1266926671-3051167926-3897398671-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nbifdkmdojgmpmopdebnjcobekgdoncn]
CHR HKLM-x32\...\Chrome\Extension: [bobeehhgpnppdghmfffdjadmbjbaeeod]
CHR HKLM-x32\...\Chrome\Extension: [clgckgfbhciacomhlchmgdnplmdiadbj]
CHR HKLM-x32\...\Chrome\Extension: [nbifdkmdojgmpmopdebnjcobekgdoncn]
CHR HKLM-x32\...\Chrome\Extension: [pfdkmljkneohogekmcdjpbffbcfpnkmp]
S3 dtlitescsibus; C:\WINDOWS\System32\drivers\dtlitescsibus.sys [30264 2016-12-09] (Disc Soft Ltd -> Disc Soft Ltd)
S3 dtliteusbbus; C:\WINDOWS\System32\drivers\dtliteusbbus.sys [47672 2016-12-09] (Disc Soft Ltd -> Disc Soft Ltd)
S3 dtproscsibus; C:\WINDOWS\System32\drivers\dtproscsibus.sys [30352 2016-08-11] (Disc Soft Ltd -> Disc Soft Ltd)
S3 R0RazerSynapseService; \??\C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.sys [X]
cmd: netsh advfirewall reset
hosts:
cmd: cscript %windir%\System32\slmgr.vbs /dli
emptytemp:
end::