start::
closeprocesses:
SystemRestore: On
createrestorepoint:
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
IE trusted site: HKU\S-1-5-21-3676721131-4119527676-797611277-1000\...\webcompanion.com -> hxxp://webcompanion.com
MSCONFIG\startupreg: Chromium => "c:\users\pc\appdata\local\chromium\application\chrome.exe" --auto-launch-at-startup --profile-directory="Default" --restore-last-session
MSCONFIG\startupreg: CyberGhost => "C:\Program Files\CyberGhost 6\CyberGhost.exe" /autostart /min
MSCONFIG\startupreg: GoogleChromeAutoLaunch_0B8CDF9298F7A85954CFC148EDF1CBD3 => "C:\Users\PC\AppData\Local\chromium\Application\chrome.exe" --no-startup-window /prefetch:5
C:\Users\PC\AppData\Local\chromium
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-3676721131-4119527676-797611277-1000\...\Run: [Advanced SystemCare] => C:\Program Files (x86)\IObit\Advanced SystemCare\ASCTray.exe [3634960 2019-12-13] (IObit Information Technology -> IObit)
HKU\S-1-5-21-3676721131-4119527676-797611277-1000\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe [9255120 2022-10-26] (Lavasoft Software Canada Inc. -> Lavasoft)
HKU\S-1-5-21-3676721131-4119527676-797611277-1000\...\Run: [Windscribe] => "C:\Program Files (x86)\Windscribe\Windscribe.exe" -os_restart (Pas de fichier)
C:\Program Files (x86)\Windscribe
C:\Program Files (x86)\Lavasoft
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
Task: {04361A41-8781-4453-8CA0-E02B9E3D047A} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [335416 2020-12-27] (Adobe Inc. -> Adobe)
C:\Windows\SysWOW64\Macromed
Task: {44813B16-FFA4-4082-87B7-836A75D2D937} - System32\Tasks\AviraSystemSpeedupRemoval => %comspec% [Argument = /C rmdir "C:\Program Files (x86)\Avira\System Speedup" /S /Q & schtasks /Delete /F /TN AviraSystemSpeedupRemoval]
C:\Program Files (x86)\Avira
Task: {7470CD60-BE15-4831-A9AF-350CCF701C46} - System32\Tasks\ASC_SkipUac_PC => C:\Program Files (x86)\IObit\Advanced SystemCare\ASC.exe [8797456 2019-12-18] (IObit Information Technology -> IObit)
Task: {8E0F7194-4B60-4E28-BBD4-A05E70AA8D6C} - System32\Tasks\ASC_PerformanceMonitor => C:\Program Files (x86)\IObit\Advanced SystemCare\Monitor.exe [3169552 2019-12-13] (IObit Information Technology -> IObit)
Task: {9E663138-8014-4165-98A2-B03E29CAB409} - System32\Tasks\Adobe Flash Player NPAPI Notifier => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_32_0_0_465_Plugin.exe [1504312 2020-12-27] (Adobe Inc. -> Adobe)
Task: {9EB72AB9-0097-43BE-B572-31EFB9DF7D67} - System32\Tasks\Driver Booster SkipUAC (PC) => C:\Program Files (x86)\IObit\Driver Booster\4.4.0\DriverBooster.exe /skipuac (Pas de fichier)
Task: {B393AB8C-0C37-4BA1-840B-6ED782D9A780} - System32\Tasks\Nakesitem\{37717865-14F7-424D-46AE-4C2DFD537C4A} => C:\PROGRA~2\COMMON~1\377178~1\NAKESI~1.EXE /Check (Pas de fichier)
Task: {F0F1B0C2-1A38-4FAC-A5EE-4A14B440DA29} - \Search Provided by Bing fasar -> Pas de fichier <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
FF NewTab: Mozilla\Firefox\Profiles\sgvqvgik.default -> hxxps://mysearchengine.co/homepage?hp=1&bitmask=9996&pId=JD180501&iDate=2022-10-26 07:01:04&bName=
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\sgvqvgik.default\searchplugins\My Bing Search.xml [2022-10-26]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_32_0_0_465.dll [2020-12-27] (Adobe Inc. -> )
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_32_0_0_465.dll [2020-12-27] (Adobe Inc. -> )
CHR DefaultSearchURL: Default -> hxxp://srchbar.com/?q={searchTerms}
CHR DefaultSuggestURL: Default -> hxxp://srch.bar/?s={searchTerms}
C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\olojcnagmcbplpdddabmpfehhlleobpb
CHR HKLM\...\Chrome\Extension: [olojcnagmcbplpdddabmpfehhlleobpb]
CHR HKU\S-1-5-21-3676721131-4119527676-797611277-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [olojcnagmcbplpdddabmpfehhlleobpb]
CHR HKLM-x32\...\Chrome\Extension: [olojcnagmcbplpdddabmpfehhlleobpb]
OPR Notifications: Opera Stable -> hxxps://s1.video.ru.net
S3 AdobeFlashPlayerUpdateSvc; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [335416 2020-12-27] (Adobe Inc. -> Adobe)
R2 DCIService; C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe [3413424 2022-10-26] (Lavasoft Software Canada Inc. -> )
R2 McAfee WebAdvisor; C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe [899640 2019-03-13] (McAfee, Inc. -> McAfee, Inc.)
R2 WCAssistantService; C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe [27864 2022-10-26] (Lavasoft Software Canada Inc. -> )
S3 BraveElevationService; "C:\Program Files\BraveSoftware\Brave-Browser\Application\107.1.45.113\elevation_service.exe" [X]
S2 CGVPNCliService; "C:\Program Files (x86)\CyberGhost 5\Service.exe" [X]
2022-10-27 21:15 - 2022-10-27 21:15 - 000003330 _____ C:\Windows\system32\Tasks\AviraSystemSpeedupRemoval
2022-10-27 21:14 - 2022-10-27 21:14 - 000000000 ____D C:\Windows\system32\Tasks\Avira
2022-10-26 21:01 - 2022-10-26 21:01 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
2022-10-26 21:00 - 2022-10-26 21:03 - 000000000 ____D C:\Users\PC\AppData\Local\Lavasoft
2022-10-26 20:59 - 2022-10-26 21:03 - 000000000 ____D C:\Users\PC\AppData\Roaming\Lavasoft
2022-10-26 20:59 - 2022-10-26 20:59 - 000367096 _____ (Bitdefender) C:\Windows\system32\Drivers\bddci.sys
2022-10-26 20:58 - 2022-10-26 20:58 - 000000000 ____D C:\Program Files (x86)\Lavasoft
2022-10-26 20:57 - 2022-10-26 21:03 - 000000000 ____D C:\ProgramData\Lavasoft
2022-10-26 20:49 - 2022-10-26 20:49 - 000000000 ____D C:\Users\PC\AppData\Local\Adaware
R2 BdDci; C:\Windows\System32\DRIVERS\bddci.sys [367096 2022-10-26] (Bitdefender SRL -> Bitdefender)
2022-10-27 21:19 - 2018-12-19 11:46 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2022-10-27 21:19 - 2018-12-19 11:45 - 000000000 ____D C:\ProgramData\Avira
2022-10-27 21:15 - 2018-12-19 11:45 - 000000000 ____D C:\Program Files (x86)\Avira
2022-10-26 13:02 - 2020-05-14 19:37 - 000004580 _____ C:\Windows\system32\Tasks\Adobe Flash Player NPAPI Notifier
2022-10-26 13:02 - 2018-09-08 19:39 - 000004496 _____ C:\Windows\system32\Tasks\Adobe Flash Player Updater
2022-10-26 13:02 - 2018-09-07 01:39 - 000000000 ____D C:\Windows\system32\Tasks\AVAST Software
2022-10-26 13:02 - 2018-07-19 08:35 - 000002874 _____ C:\Windows\system32\Tasks\Driver Booster SkipUAC (PC)
cmd: netsh advfirewall reset
emptytemp:
end::