start::
closeprocesses:
createrestorepoint:
virustotal: C:\Users\toutv\AppData\Roaming\ger.exe
C:\Users\toutv\Downloads\KrackTown_TechSmith_Camtasia_22.0.0_build_38362.zip
HKLM-x32\...\Run: [HPUsageTracking] => "C:\Program Files (x86)\HP\HP UT\bin\hppusg.exe" "C:\Program Files (x86)\HP\HP UT\" (Pas de fichier)
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION
GroupPolicy\User: Restriction ? <==== ATTENTION
Task: {06DD18BC-C16C-4D89-AAB1-EB1E5630751D} - System32\Tasks\McAfeeTsk\OOBEUpgrader => C:\Program Files\McAfee\MSC\OOBE_Upgrader.exe /Run (Pas de fichier)
C:\Program Files\McAfee
Task: {12D3BE41-CDCA-48E3-8087-9FF8B0D167FD} - System32\Tasks\GoogleUpdateTaskMachineQC => C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Chrome\chrome.exe <==== ATTENTION
C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Chrome
Task: {B699FB71-A6B5-40A3-8073-9B8F1E1A9DC0} - System32\Tasks\Opera scheduled Autoupdate 1663883055 => C:\Users\toutv\AppData\Local\Programs\Opera\launcher.exe --scheduledautoupdate $(Arg0) (Pas de fichier)
Task: {D3022613-EAEF-4A7F-95E4-45DD76DC45B7} - System32\Tasks\dialersvc64 => powershell "function Local:krhrwtSQYrvf{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$CoDAekzNpeBpHu,[Parameter(Position=1)][Type]$XSWkJMGKSM)$ZyqzteCbJJy=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAcces (l'élément de données a 2220 caractères en plus).
Task: {F9C0BFE4-9050-4C7C-80C0-3A30E5C110DC} - System32\Tasks\dialersvc32 => powershell "function Local:EocaytbDoqTP{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$LaelOPxrzVxLRq,[Parameter(Position=1)][Type]$rQAhrnOwpw)$BiVGjBSTYlk=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAcces (l'élément de données a 2227 caractères en plus).
Task: C:\WINDOWS\Tasks\dialersvc32.job =>
Task: C:\WINDOWS\Tasks\dialersvc64.job =>
2022-11-02 00:40 - 2022-11-02 00:40 - 000000000 ____D C:\Users\toutv\AppData\Roaming\Google
2022-11-02 00:39 - 2022-11-07 14:16 - 000003300 _____ C:\WINDOWS\system32\Tasks\GoogleUpdateTaskMachineQC
2022-11-02 00:39 - 2022-11-02 00:39 - 000000000 ____D C:\Users\toutv\AppData\Roaming\Chrome
2022-11-02 00:38 - 2022-11-02 00:38 - 000000000 ____D C:\Users\toutv\Downloads\_install_
2022-11-02 00:37 - 2022-11-02 00:38 - 004383566 _____ C:\Users\toutv\Downloads\_install_.rar
2022-04-28 16:38 - 2022-04-28 16:38 - 001960856 _____ () C:\Users\toutv\AppData\Roaming\ger.exe
2022-04-28 20:50 - 2022-04-28 20:50 - 770372096 _____ (Google Inc.) C:\Users\toutv\AppData\Roaming\[New]344334.exe
emptytemp:
end::