start::
CreateRestorePoint:
CloseProcesses:
RemoveProxy:
HKLM-x32\...\Run : [Babylon Client] => C:\Program Files (x86)\Babylon\Babylon-Pro\Babylon.exe
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate : Restriction
HKU\S-1-5-19\...\RunOnce : [mctadmin] => C:\Windows\System32\mctadmin.exe (Pas de fichier)
HKU\S-1-5-20\...\RunOnce : [mctadmin] => C:\Windows\System32\mctadmin.exe (Pas de fichier)
HKU\S-1-5-21-2855114065-1166786579-3754366426-1002\...\Run : [GoogleDriveFS] => C:\Program Files\Google\Drive File Stream\63.0.5.0\GoogleDriveFS.exe -- startup_mode (Pas de fichier)
HKU\S-1-5-21-2855114065-1166786579-3754366426-501\...\Run : [GoogleDriveFS] => C:\Program Files\Google\Drive File Stream\63.0.5.0\GoogleDriveFS.exe -- startup_mode (Pas de fichier)
Fournisseurs HKLM\Software\...\Authentication\Credential : [{503739d0-4c5e-4cfd-b3ba-d881334f0df2}] ->
BootExecute : autocheck autochk * bootdelete
GroupPolicy : Restriction - Chrome
Stratégies : C:\ProgramData\NTUSER.pol : Restriction
Tâche : {0451CE86-2B01-4DE6-A87C-279272F8CB51} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe -ObjectStoreRecoveryTask (Pas de fichier)
Tâche : {0FE76F41-0DD2-42E6-BCCC-3FBC5405607C} - System32\Tasks\TUDsDownloader => C:\Program Files\Norton Utilities Premium\activesync.exe -appexecutable nup.exe -tuds (Pas de fichier)
Tâche : {1A174671-6961-4EC8-B593-E2FF97DD8B4D} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\WINDOWS\ehome\MCUpdate.exe -pscn 0 (Pas de fichier)
Tâche : {1EE3480B-743B-4E51-B249-FB491A3D80EE} - System32\Tasks\Norton AntiVirus\Norton AntiVirus Error Processor => C:\Program Files (x86)\Norton AntiVirus\Engine\22.16.2.22\SymErr.exe /submit (Pas de fichier)
Tâche : {202D82F0-FED7-4415-9609-95DC88C36BEB} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\WINDOWS\ehome\ehPrivJob.exe /DoRegisterSearch $(Arg0) (Pas de fichier)
Tâche : {3172B81B-2BB8-4CF8-8CB3-C7B478E0C966} - System32\Tasks\{76CA20BC-2951-4B2B-AD49-59E57551EA3A} => C:\Program Files (x86)\Nero\Nero 12\Nero Welcome\WelcomeApplication. exe (Pas de fichier)
Tâche : {3F10937A-80E7-4353-8360-96FE767441FB} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\WINDOWS\ehome\mcupdate.exe -PvrSchedule (Pas de fichier)
Tâche : {45A7E32F-F252-46C0-B10C-9DC40D2EA5C1} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe -MediaCenterRecoveryTask (Pas de fichier)
Tâche : {4CEF9B62-661B-47F8-83DF-A0268A82F32D} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe -PvrRecoveryTask (Pas de fichier)
Tâche : {533863D3-C004-408A-A46A-778EF050325D} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\WINDOWS\ehome\ehPrivJob.exe /wait:7 /PBDADiscovery (Pas de fichier)
Tâche : {541E0EBF-7A64-4B89-8FDC-B76378ABA144} - System32\Tasks\Norton Security\Norton Security Error Processor => C:\Program Files (x86)\Norton AntiVirus\Engine\22.19.9.63\SymErr.exe /submit (Pas de fichier)
Tâche : {5493028E-80CB-4C69-9258-9F5AA5761B14} - System32\Tasks\Live Boost Process Governor => C:\Program Files\Norton Utilities Premium\x64\LBgovernor.exe (Pas de fichier)
Tâche : {5A1E92AB-C498-429E-8889-471A30B1D1B1} - System32\Tasks\Avast Software\Overser => C:\Program Files\Common Files\AVAST Software\Overser\overseer.exe
Tâche : {5EC445EA-B095-4937-81B9-70D1DBA117A1} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\WINDOWS\ehome\ehrec.exe /RestartRecording (Pas de fichier)
Tâche : {646165BB-7DDA-4523-89E6-A7CB058131AB} - System32\Tasks\ActiveSync-NortonUtility => C:\Program Files\Norton Utilities Premium\activesync.exe -appexecutable nup.exe -scheduler (Pas de fichier)
Tâche : {6FD40F85-40C1-4193-8F99-F989E02C6A82} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\WINDOWS\ehome\ehPrivJob.exe /OCURActivate (Pas de fichier)
Tâche : {7EAA9609-485B-42D0-86CA-AB42C2C368B0} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\WINDOWS\ehome\ehPrivJob.exe /OCURDiscovery $(Arg0) (Pas de fichier)
Tâche : {86225886-2058-401F-A8C9-CEB3F568F44E} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\WINDOWS\ehome\mcupdate.exe $(Arg0) (Pas de fichier)
Tâche : {88DD583C-CDF6-41C5-9EC9-1C7EB598980C} - System32\Tasks\Games\UpdateCheck_S-1-5-21-2855114065-1166786579-3754366426-1000 => {CA22F5B1-E06F-4A2B-94FC-531E87}
Tâche : {9224EE31-33EF-4DA7-A3F4-9AF2CA5603E6} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\WINDOWS\ehome\ehPrivJob.exe /DRMInit (Pas de fichier)
Tâche : {97C58736-72F1-4150-973E-F9505118C48E} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\WINDOWS\ehome\ehPrivJob.exe /PBDADiscovery (Pas de fichier)
Tâche : {9AB5085D-D233-4A61-820D-43E28D4258EF} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\WINDOWS\ehome\ehrec.exe /StartRecording (Pas de fichier)
Tâche : {A0D4DEF0-4CAF-41A9-B5EA-94960149D031} - System32\Tasks\AutomaticCare => C:\Program Files\Norton Utilities Premium\nup.exe /ActiveCare (Pas de fichier)
Tâche : {A1E5B572-72D3-4FEF-B4A4-B280C23CE1BC} - System32\Tasks\{9E89C98C-69DB-4537-96D9-11AEAB1D8536} => C:\Program Files (x86)\Nero\Nero 12\Nero Welcome\WelcomeApplication. exe (Pas de fichier)
Tâche : {B17AEA96-3A25-4A07-A50C-0E0FB72CEC48} - System32\Tasks\Norton Security\Norton Security Autofix => C:\Program Files (x86)\Norton AntiVirus\Engine\22.19.9.63\SymErr.exe /ui ( Pas de fichier)
Tâche : {B32C4EB8-2C65-49BE-A075-3EDA4CA3655C} - System32\Tasks\Microsoft\Windows\OrangeUpdate_Install => C:\Program Files (x86)\Orange Update\install.bat [0 2022-06-06]
Tâche : {C02888C4-D9C4-44B3-B933-0F19B9BBF176} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\WINDOWS\ehome\ehPrivJob.exe /DoUpdateRecordPath $(Arg0) (Pas de fichier)
Tâche : {D4BEE551-A408-4D91-9EB3-87263EC6D298} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe -SqlLiteRecoveryTask (Pas de fichier)
Tâche : {D64D6040-DA29-47A6-8C67-2F1A2833F6B0} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\WINDOWS\ehome\ehPrivJob.exe /DoActivateWindowsSearch (Pas de fichier)
Tâche : {DC5B7C7C-F492-4E22-A51E-E6F67369AC80} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\WINDOWS\ehome\ehPrivJob.exe /InstallPlayReady $(Arg0) (Pas de fichier)
Tâche : {E9F306CD-9B15-4D1C-8754-6C9D907F26E9} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\WINDOWS\ehome\ehPrivJob.exe /DoRecoveryTasks $(Arg0) (Pas de fichier)
Tâche : {EBABD01C-42B7-4969-A611-2701BD1B4C0F} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\WINDOWS\ehome\ehPrivJob.exe /DoReindexSearchRoot (Pas de fichier)
Tâche : {EEBCC429-9A5F-480D-B625-4920045451E4} - System32\Tasks\{1220EDA0-478E-4884-A94C-425E121FA409} => C:\Windows\system32\pcalua.exe -a "C:\Program Files ( x86)\YAYG\UninstallerData\Uninstall yayg2fr.exe"
Tâche : {F32C0751-2D5E-4833-BAFE-9D31F93DAC33} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\WINDOWS\ehome\ehPrivJob.exe /DoConfigureInternetTimeService (Pas de fichier)
Tâche : {FCC45A81-EDE6-40CA-9F3F-05431A007DFD} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\WINDOWS\ehome\ehPrivJob.exe /wait:90 /PBDADiscovery (Pas de fichier)
Tâche : {FD4103BF-E665-48FF-94A6-12E2134FF99D} - System32\Tasks\Norton Security\Norton Security Error Analyzer => C:\Program Files (x86)\Norton AntiVirus\Engine\22.19.9.63\SymErr.exe /analyze (Pas de fichier)
Tâche : {FF8B3060-91BC-43A5-9DAC-496ED7128309} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\WINDOWS\ehome\mcupdate.exe -crl -hms -pscn 15 (Pas de fichier)
FF HKLM-x32\...\Firefox\Extensions : [ocr@babylon.com] - C:\Program Files (x86)\Babylon\Babylon-Pro\Plugins\ocr@babylon.com
Extension FF : (Activation de la traduction Babylon) - C:\Program Files (x86)\Babylon\Babylon-Pro\Plugins\ocr@babylon.com
Plugin FF : @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/vnd.adobe.xfdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [Pas de fichier ]
Plugin FF : @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/vnd.fdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [Pas de fichier]
Plugin FF : adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [Pas de fichier]
FF Plugin-x32 : @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [Pas de fichier]
FF Plugin-x32 : @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [Pas de fichier]
Plugin FF-x32 : @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/vnd.adobe.xfdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x86.dll [Pas de fichier]
FF Plugin-x32 : @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/vnd.fdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x86.dll [Pas de fichier ]
FF Plugin-x32 : @unisys.com/npornap -> C:\Program Files (x86)\Orange\CAP Nap Plugin ActiveX [2017-01-03] () <==== ATTENTION [zéro octet Fichier/Dossier]
Plugin FF HKU\S-1-5-21-2855114065-1166786579-3754366426-1000 : @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software \PDF Editor\npPDFXEditPlugin.x64.dll [Pas de fichier]
Plugin FF HKU\S-1-5-21-2855114065-1166786579-3754366426-1000 : @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/vnd.adobe.xfdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [Pas de fichier]
Plugin FF HKU\S-1-5-21-2855114065-1166786579-3754366426-1000 : @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/vnd.fdf -> C:\Program Files\ Logiciel de suivi\PDF Editor\npPDFXEditPlugin.x64.dll [Pas de fichier]
CHR NewTab : Par défaut -> Non actif : "chrome-extension://mhffmephdchhhbfjmdpoaldedhhdanbn/homePageRedirect.html", Non actif :"chrome-extension://cdmnjcbpndldflhcncmcgagchmjdolbg/iframe_msn.html"
CHR HKLM\...\Chrome\Extension : [iikflkcanblccfahdhdonehdalibjnif]
CHR HKU\S-1-5-21-2855114065-1166786579-3754366426-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension : [hkecabaloghleaicfhefejdijblljpco]
CHR HKU\S-1-5-21-2855114065-1166786579-3754366426-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension : [lmjegmlicamnimmfhcmpkclmigmmcbeh]
CHR HKLM-x32\...\Chrome\Extension : [iikflkcanblccfahdhdonehdalibjnif]
EmptyTemp:
cmd: ipconfig /flushdns
end::