start::
closeprocesses:
createrestorepoint:
ContextMenuHandlers4: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => -> Pas de fichier
ContextMenuHandlers4: [Offline Files] -> {474C98EE-CF3D-41f5-80E3-4AAB0AB04301} => -> Pas de fichier
ContextMenuHandlers5: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => -> Pas de fichier
ContextMenuHandlers6: [Offline Files] -> {474C98EE-CF3D-41f5-80E3-4AAB0AB04301} => -> Pas de fichier
virustotal: C:\Torch\Application\torch.exe
G:\MalwarebytesAntiMalwarePremium3.3.1.2183Repack
HKLM\...\Policies\Explorer: [NoWindowsUpdate] 1
HKU\S-1-5-21-3476965779-4002417778-2833460929-1002\...\Policies\Explorer: [NoSecurityTab] 1
HKU\S-1-5-21-3476965779-4002417778-2833460929-1002\...\MountPoints2: {985e5f0f-c601-11ec-910e-e4aaeab7ae24} - "L:\setup.exe"
HKU\S-1-5-21-3476965779-4002417778-2833460929-1002\...\MountPoints2: {c60cecc9-a9e0-11ec-90c5-e4aaeab7ae24} - "H:\HonorSuiteOnlineInstaller.exe"
HKU\S-1-5-21-3476965779-4002417778-2833460929-1002\...\MountPoints2: {d4d89037-b335-11ec-90f3-e4aaeab7ae24} - "L:\AutoRun.exe"
HKLM\Software\...\Authentication\Credential Providers: [{C885AA15-1764-4293-B82A-0586ADD46B35}] ->
IFEO\EOSNOTIFY.EXE: [Debugger] *
IFEO\InstallAgent.exe: [Debugger] *
IFEO\MusNotification.exe: [Debugger] *
IFEO\MUSNOTIFICATIONUX.EXE: [Debugger] *
IFEO\remsh.exe: [Debugger] *
IFEO\SIHClient.exe: [Debugger] *
IFEO\UpdateAssistant.exe: [Debugger] *
IFEO\UPFC.EXE: [Debugger] *
IFEO\UsoClient.exe: [Debugger] *
IFEO\WaaSMedic.exe: [Debugger] *
IFEO\WaasMedicAgent.exe: [Debugger] *
IFEO\Windows10Upgrade.exe: [Debugger] *
IFEO\WINDOWS10UPGRADERAPP.EXE: [Debugger] *
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Edge: Restriction <==== ATTENTION
Task: {105D676A-D551-4274-81E7-97AC52E4FD87} - \Microsoft\Windows\Speech\HeadsetButtonPress -> Pas de fichier <==== ATTENTION
Task: {1949073A-8FDA-4EA4-8E59-407CDB02440F} - \Microsoft\Windows\WindowsUpdate\sihpostreboot -> Pas de fichier <==== ATTENTION
Task: {1BCB74E7-70D0-4AD8-A8E2-24F7AEAD8A05} - System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-2385953145-3035334931-2036347764-500 => C:\Users\Y\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe (Pas de fichier)
Task: {45CF73C8-9A94-47C5-8E45-347738A58FC5} - \Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser -> Pas de fichier <==== ATTENTION
Task: {6831364F-0DD0-4E64-8E45-1EF32A6F497D} - System32\Tasks\AMDRyzenMasterSDKTask => C:\Program Files\AMD\CNext\CNext\cpumetricsserver.exe (Pas de fichier)
Task: {A8CB856A-C172-41A7-99B5-714A454621A6} - System32\Tasks\Avast Emergency Update => C:\Program Files\Avast Software\Avast\AvEmUpdate.exe (Pas de fichier)
Task: {B8F0DEC7-8392-4F57-9990-74FCB934033F} - \Microsoft\Windows\HelloFace\FODCleanupTask -> Pas de fichier <==== ATTENTION
Task: {CBFB6BE6-9828-4121-A91C-8ADE8B6B1C36} - \Microsoft\Windows\Management\Provisioning\PostResetBoot -> Pas de fichier <==== ATTENTION
Task: {FA65CE47-E3F0-4E72-B4F0-7751C735E45F} - System32\Tasks\Avast Software\Overseer => C:\Program Files\Common Files\Avast Software\Overseer\overseer.exe /from_scheduler:1 (Pas de fichier)
C:\Program Files\Common Files\Avast Software
C:\Program Files\Avast Software
Task: {E01653CB-353D-48D3-8078-223EFC4C65C4} - System32\Tasks\Tweaking.com - Windows Repair Tray Icon => C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\WR_Tray_Icon.exe [220816 2019-09-30] (Tweaking LLC -> Tweaking.com)
Winsock: Catalog9 17 %windir%\system32\vsocklib.dll => Pas de fichier
Winsock: Catalog9 18 %windir%\system32\vsocklib.dll => Pas de fichier
Winsock: Catalog9-x64 17 %windir%\system32\vsocklib.dll => Pas de fichier
Winsock: Catalog9-x64 18 %windir%\system32\vsocklib.dll => Pas de fichier
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
CHR Notifications: Default -> hxxps://notadsnow.com; hxxps://www11.freddyoctavio.pro; hxxps://www37.nathanaeldan.pro; hxxps://www41.freddyoctavio.pro,*"; hxxps://www65.nathanaeldan.pro; hxxps://www72.nathanaeldan.pro; hxxps://www79.nathanaeldan.pro; hxxps://www82.nathanaeldan.pro; hxxps://www84.freddyoctavio.pro; hxxps://www98.freddyoctavio.pro
cmd: sfc /scannow
emptytemp:
end::