start::
closeprocesses:
createrestorepoint:
AV: Spybot - Search and Destroy (Disabled - Out of date) {F77C7796-45C4-531E-0DAE-B4A8229B11C8}
HKU\S-1-5-21-1408885801-2503432436-1118140031-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://fr.search.yahoo.com/yhs/web?hspart=omr&hsimp=yhs-001&type=87dpyqptgki1320egikmoq9ay001320¶m1=y6bdVFVIsvuYsgEClQfz8GNAvS%2FuW585f43SFov1egEnLPxpPTiE%2FbXt5%2BAHq6dYsEE9gp469z2H02p8JXVKrcW5iCdrykXa5t7Ij5kUKr8fOcBhXZoC9bblIQ2%2B4Pq1rF9dBkv8yxfZ1nVcmgkBku0kvZErG2cv7b31rkcr3FcRQQqZMjC74pZ8PiI7CiY0MWWGJknN0mPesb%2FNNUaMahGMKKsUz3ojvETl8FF2vsQfVcQYJcB2vCWhlB3EN1WCccxh%2BgeOu6RfAxnXYmG%2B47VD61NjLjazEk6G4N2Rrmk5iLQwVXGb5DehUyuoEc3QfYnXq2dwEzOtMtyYxhg%2BKAA2QhFGTutYpjpHQpl7eJYO0THCiJlHkiiqXPCcmNxy8oekP%2FD9K4JIJ3ocPOqbjTeUBFcUWUWkfB6t8cjDoME%3D
SearchScopes: HKU\S-1-5-21-1408885801-2503432436-1118140031-1001 -> {2A23ab71-4ac6-41f2-a955-ea576e553146} URL =
SearchScopes: HKU\S-1-5-21-1408885801-2503432436-1118140031-1001 -> {2f23ab71-4ac6-41f2-a955-ea576e553146} URL = hxxps://fr.search.yahoo.com/yhs/search?hspart=omr&hsimp=yhs-001&type=87dpyqptgki1320egikmoq9ay001320¶m1=y6bdVFVIsvuYsgEClQfz8GNAvS%2FuW585f43SFov1egEnLPxpPTiE%2FbXt5%2BAHq6dYsEE9gp469z2H02p8JXVKrfpUJIUR%2Fcs9RRL0ebQvG8wgs7EV4gTRneO7k2DuqVQTTgxhu5wJlBLsNi9%2FLEz6%2BMwcbF81gvuF8xyQFIWfC971XHvVOp3JFtRvEB2KMKpmXWh3v9KRBrJygQ8dU6B%2B5p%2FaZJ08Za41VODrNTBmvtrDC75NMiFh6KlrFNBgUD3va0v9EzbicivGcCwp%2FAfXDV21y8vaZVK47SfKUsWeRiNQ7b6aoBiR9I5BBW1Ua10vHyhzvMDCMj9ygGL8YrAVj02yWWiiT%2BwlDN21t6egAUgEzYFYwg%2Fr2Nv%2Fzs4OHVs8q58sRdUt8pAhiraA%2BD8XLQ%3D%3D&p={searchTerms}
IE trusted site: HKU\.DEFAULT\...\webcompanion.com -> hxxp://webcompanion.com
HKU\S-1-5-21-1408885801-2503432436-1118140031-1001\...\StartupApproved\Run: => "Web Companion"
BootExecute: autocheck autochk * sdnclean64.exe
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
Task: {1E7C5CF9-1A83-4AB3-878E-D4483379A620} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Product Configurator => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\ProductConfig.exe /noreport (Pas de fichier)
Task: {31D0D909-7CA7-4293-9A2C-BCDE8ED582FD} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe /DeviceScanR6 (Pas de fichier)
Task: {5381C9E2-7191-4C1D-8683-33E6C5B70715} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe /L Analysis (Pas de fichier)
Task: {892F15D7-837F-40D8-9B8F-C1F393135B79} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe /taskrestart (Pas de fichier)
Task: {96E877AB-D167-4A52-B026-9C280464F990} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe (Pas de fichier)
Task: {9BFEBAD8-7153-4684-BC0E-8510D9C7B34F} - System32\Tasks\Hewlett-Packard\HP Active Health\HP Active Health Scan (HPSA) => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe -task -source HPSA (Pas de fichier)
Edge Extension: (Pas de nom) -> AutoFormFill_5ED10D46BD7E47DEB1F3685D2C0FCE08 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\AutoFormFill [non trouvé(e)]
Edge Extension: (Pas de nom) -> BookReader_B171F20233094AC88D05A8EF7B9763E8 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\BookViewer [non trouvé(e)]
Edge Extension: (Pas de nom) -> LearningTools_7706F933-971C-41D1-9899-8A026EB5D824 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\LearningTools [non trouvé(e)]
Edge Extension: (Pas de nom) -> PinJSAPI_EC01B57063BE468FAB6DB7EBFC3BF368 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\PinJSAPI [non trouvé(e)]
CHR HKLM\...\Chrome\Extension: [codhflfnidhlkphogdmhfhjmkehlfjjk]
CHR HKLM\...\Chrome\Extension: [gpggceimbegdiddifklmeponnmkppfho]
CHR HKU\S-1-5-21-1408885801-2503432436-1118140031-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [codhflfnidhlkphogdmhfhjmkehlfjjk]
CHR HKU\S-1-5-21-1408885801-2503432436-1118140031-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]
CHR HKU\S-1-5-21-1408885801-2503432436-1118140031-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [gpggceimbegdiddifklmeponnmkppfho]
CHR HKLM-x32\...\Chrome\Extension: [aegnopegbbhjeeiganiajffnalhlkkjb]
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki]
CHR HKLM-x32\...\Chrome\Extension: [ihcjicgdanjaechkgeegckofjjedodee]
CHR HKLM-x32\...\Chrome\Extension: [makcojoppodhcgmmchohadhpkicoafka]
CHR HKLM-x32\...\Chrome\Extension: [mfhcmdonhekjhfbjmeacdjbhlfgpjabp]
C:\Users\PC-051296\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfhcmdonhekjhfbjmeacdjbhlfgpjabp
2020-08-29 21:00 - 2020-08-29 21:00 - 000000000 _____ () C:\Users\PC-051296\AppData\Local\BIT32AB.tmp
2020-08-29 21:00 - 2020-08-29 21:00 - 000000000 _____ () C:\Users\PC-051296\AppData\Local\BIT330A.tmp
2020-12-13 15:29 - 2020-12-13 15:29 - 000000000 _____ () C:\Users\PC-051296\AppData\Local\BIT4002.tmp
2020-06-05 15:09 - 2020-06-05 15:09 - 000000000 _____ () C:\Users\PC-051296\AppData\Local\BIT4676.tmp
2020-08-26 18:24 - 2020-08-26 18:24 - 000000000 _____ () C:\Users\PC-051296\AppData\Local\BIT4D34.tmp
2020-12-06 11:54 - 2020-12-06 11:54 - 000000000 _____ () C:\Users\PC-051296\AppData\Local\BIT5B7F.tmp
2021-02-02 19:54 - 2021-02-02 19:54 - 000000000 _____ () C:\Users\PC-051296\AppData\Local\BIT73F3.tmp
2020-05-21 19:58 - 2020-05-21 19:58 - 000000000 _____ () C:\Users\PC-051296\AppData\Local\BIT8289.tmp
2020-08-27 20:27 - 2020-08-27 20:27 - 000000000 _____ () C:\Users\PC-051296\AppData\Local\BIT83FB.tmp
2020-04-04 15:06 - 2020-04-04 15:06 - 000000000 _____ () C:\Users\PC-051296\AppData\Local\BIT85E6.tmp
2020-12-30 11:31 - 2020-12-30 11:31 - 000000000 _____ () C:\Users\PC-051296\AppData\Local\BIT8A45.tmp
2020-04-03 10:19 - 2020-04-03 10:19 - 000000000 _____ () C:\Users\PC-051296\AppData\Local\BIT8E1D.tmp
2020-07-25 21:11 - 2020-07-25 21:11 - 000000000 _____ () C:\Users\PC-051296\AppData\Local\BIT9CD.tmp
2021-01-17 19:02 - 2021-01-17 19:02 - 000000000 _____ () C:\Users\PC-051296\AppData\Local\BITBB85.tmp
2021-01-17 19:02 - 2021-01-17 19:02 - 000000000 _____ () C:\Users\PC-051296\AppData\Local\BITBB95.tmp
2020-08-06 17:49 - 2020-08-06 17:49 - 000000000 _____ () C:\Users\PC-051296\AppData\Local\BITC66F.tmp
2020-11-19 23:55 - 2020-11-19 23:55 - 000000000 _____ () C:\Users\PC-051296\AppData\Local\BITDA2B.tmp
2020-05-11 19:18 - 2020-05-11 19:18 - 000000000 _____ () C:\Users\PC-051296\AppData\Local\BITF03B.tmp
2021-01-12 22:18 - 2021-01-12 22:18 - 000000000 _____ () C:\Users\PC-051296\AppData\Local\BITF177.tmp
2021-01-12 22:18 - 2021-01-12 22:18 - 000000000 _____ () C:\Users\PC-051296\AppData\Local\BITF236.tmp
2021-01-12 22:18 - 2021-01-12 22:18 - 000000000 _____ () C:\Users\PC-051296\AppData\Local\BITF266.tmp
2020-11-28 17:32 - 2020-11-28 17:32 - 000000000 _____ () C:\Users\PC-051296\AppData\Local\BITF427.tmp
2020-11-28 17:32 - 2020-11-28 17:32 - 000000000 _____ () C:\Users\PC-051296\AppData\Local\BITF476.tmp
2020-12-24 13:22 - 2020-12-24 13:22 - 000000000 _____ () C:\Users\PC-051296\AppData\Local\BITFE2A.tmp
2020-12-24 13:22 - 2020-12-24 13:22 - 000000000 _____ () C:\Users\PC-051296\AppData\Local\BITFE4A.tmp
emptytemp:
end::