start::
closeprocesses:
createrestorepoint:
AS: Avast Antivirus (Enabled - Up to date) {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402}
FW: Avast Antivirus (Enabled) {B693136B-F6EE-DD1C-A0EF-229B8B0B29C4}
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.delta-homes.com/?type=hp&ts=1435054786&z=d1a1cf2d2dc045ebea024e5g2zacawde4w7zam4b3c&from=ient06232&uid=ST500LT012-1DG142_W3P8B07VXXXXW3P8B07V
SearchScopes: HKLM -> {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://fr.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms}
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.delta-homes.com/web/?type=ds&ts=1432830085&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=wpm05283&uid=ST500LT012-1DG142_W3P8B07VXXXXW3P8B07V&q={searchTerms}
SearchScopes: HKLM-x32 -> {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://fr.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms}
SearchScopes: HKU\S-1-5-21-2476517391-808712733-578175583-1001 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=obw&utm_campaign=install_ie&utm_content=ds&from=obw&uid=ST500LT012-1DG142_W3P8B07VXXXXW3P8B07V&ts=1422032897&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2476517391-808712733-578175583-1001 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=obw&utm_campaign=install_ie&utm_content=ds&from=obw&uid=ST500LT012-1DG142_W3P8B07VXXXXW3P8B07V&ts=1422032897&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2476517391-808712733-578175583-1001 -> {4CA79A24-8028-4C56-986B-D025EEECF9E4} URL = hxxp://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=obw&utm_campaign=install_ie&utm_content=ds&from=obw&uid=ST500LT012-1DG142_W3P8B07VXXXXW3P8B07V&ts=1422032897&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2476517391-808712733-578175583-1001 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=obw&utm_campaign=install_ie&utm_content=ds&from=obw&uid=ST500LT012-1DG142_W3P8B07VXXXXW3P8B07V&ts=1422032897&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2476517391-808712733-578175583-1001 -> {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=obw&utm_campaign=install_ie&utm_content=ds&from=obw&uid=ST500LT012-1DG142_W3P8B07VXXXXW3P8B07V&ts=1422032897&type=default&q={searchTerms}
BHO-x32: Pas de nom -> {51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F} -> Pas de fichier
HKLM\...\Run: [WindowsDefender] => "%ProgramFiles%\Windows Defender\MSASCuiL.exe" (Pas de fichier)
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
HKLM Group Policy restriction on software: %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot% <==== ATTENTION
HKLM Group Policy restriction on software: %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir% <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION
HKU\S-1-5-21-2476517391-808712733-578175583-1001\...\Run: [Spotify Web Helper] => C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe [1168896 2014-08-16] (Spotify AB -> Spotify Ltd)
Task: {0945122B-D558-4311-9F90-3D6C49681117} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\BrowserChoice\browserchoice.exe /launch (Pas de fichier)
Task: {11D6C06A-8E61-45DB-AE69-8EF0B96C625D} - System32\Tasks\ALUAgent => C:\Program Files (x86)\Packard Bell\Live Updater\liveupdater_agent.exe [40352 2016-07-06] (Acer Incorporated -> )
Task: {1924AA42-08EF-47AC-9F2E-330FCE5F80E5} - \Microsoft\Windows\Setup\gwx\rundetector -> Pas de fichier <==== ATTENTION
Task: {254A9916-9029-4910-B471-5BB8166E57FB} - \Microsoft\Windows\UNP\RunCampaignManager -> Pas de fichier <==== ATTENTION
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\WINDOWS\System32\AutoWorkplace.exe join (Pas de fichier)
Task: {4236725F-9EE0-4C29-AC68-3ABA0BCA1F14} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Pas de fichier <==== ATTENTION
Task: {42DF1272-3A0F-4728-8B95-3ADA2369F13E} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyUpload => {EBF00FCB-0769-4B81-9BEC-6C05514111AA}
Task: {640BE84D-4A61-43BB-A269-DF7E7F49523F} - System32\Tasks\{4430986A-9EC4-415A-B28A-1D73B0B8848D} => C:\Windows\system32\pcalua.exe -a C:\Users\Martial\AppData\Roaming\omiga-plus\UninstallManager.exe -c -ptid=obw <==== ATTENTION
Task: {65EFA196-3E52-47AA-B838-41BBD5317924} - \Microsoft\Windows\Setup\EOONotify -> Pas de fichier <==== ATTENTION
Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task => {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Task: {71BEC42A-54E6-4A54-A80D-6A05A9400021} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe /backup /iavs (Pas de fichier)
C:\Program Files\Common Files\AV\avast! Antivirus
Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task => {1B1F472E-3221-4826-97DB-2C2324D389AE}
Task: {910A8C74-A05A-4E88-B59B-58864C25179C} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Pas de fichier <==== ATTENTION
Task: {C0C2CF92-0251-478D-A4E8-B718033A2819} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Pas de fichier <==== ATTENTION
Task: {C53FCB08-AA91-46E2-9579-7729871CF948} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Pas de fichier <==== ATTENTION
Task: {D27D1A47-269C-412D-955E-B48D8D314E3F} - \WPD\SqmUpload_S-1-5-21-2476517391-808712733-578175583-1001 -> Pas de fichier <==== ATTENTION
Task: {EA1A8F54-15E2-43BE-B8DC-8600541E98B7} - \GenericSettingsHandler\Windows-Credentials\RetrySyncTask_for_S-1-5-21-2476517391-808712733-578175583-1001 -> Pas de fichier <==== ATTENTION
Edge Extension: (Pas de nom) -> AutoFormFill_5ED10D46BD7E47DEB1F3685D2C0FCE08 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\AutoFormFill [non trouvé(e)]
Edge Extension: (Pas de nom) -> BookReader_B171F20233094AC88D05A8EF7B9763E8 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\BookViewer [non trouvé(e)]
Edge Extension: (Pas de nom) -> LearningTools_7706F933-971C-41D1-9899-8A026EB5D824 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\LearningTools [non trouvé(e)]
Edge Extension: (Pas de nom) -> PinJSAPI_EC01B57063BE468FAB6DB7EBFC3BF368 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\PinJSAPI [non trouvé(e)]
C:\Users\Martial\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\eofcbnmajmjmplflapaojjnihcjkigck
CHR HKU\S-1-5-21-2476517391-808712733-578175583-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [fcfenmboojpjinhpgggodefccipikbpd]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki]
S3 intaud_WaveExtensible; \SystemRoot\system32\drivers\intelaud.sys [X]
2022-11-02 11:35 - 2022-11-02 11:34 - 000270552 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2022-11-02 11:35 - 2022-11-02 11:34 - 000221944 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw555bdd4b85b80a82.tmp
2022-11-05 12:00 - 2014-10-21 12:56 - 000000000 ____D C:\ProgramData\AVAST Software
2022-11-05 11:52 - 2020-09-25 22:18 - 000000000 ____D C:\WINDOWS\system32\Tasks\AVAST Software
2022-11-02 11:35 - 2021-01-23 14:50 - 000327896 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw540ede46481f85bc.tmp
2022-11-02 11:34 - 2021-01-23 14:50 - 000862936 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw1719157fcda8ff3a.tmp
2022-11-02 11:34 - 2021-01-23 14:50 - 000672272 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw985f24780393be75.tmp
2022-11-02 11:34 - 2021-01-23 14:50 - 000564304 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw1e2d2718e368911c.tmp
2022-11-02 11:34 - 2021-01-23 14:50 - 000390096 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswe5e09cd19929a901.tmp
2022-11-02 11:34 - 2021-01-23 14:50 - 000306128 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw24a132222c058593.tmp
2022-11-02 11:34 - 2021-01-23 14:50 - 000276520 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswfa2ef5f5e76487a1.tmp
2022-11-02 11:34 - 2021-01-23 14:50 - 000238152 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswa83c898576c65e82.tmp
2022-11-02 11:34 - 2021-01-23 14:50 - 000114464 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswc4203e3944894e69.tmp
2022-11-02 11:34 - 2021-01-23 14:50 - 000105936 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw05355b000b4467d8.tmp
2022-11-02 11:34 - 2021-01-23 14:50 - 000090008 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw6d8e76961e6ca2e2.tmp
2022-11-02 11:34 - 2021-01-23 14:50 - 000048512 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswcdcd6b75b0a7c2d9.tmp
2022-11-02 11:34 - 2021-01-23 14:50 - 000042304 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswb08bbde0692dfbac.tmp
cmd: netsh advfirewall reset
cmd: sfc /scannow
emptytemp:
end::