Start::
SystemRestore: on
CloseProcesses:
CreateRestorePoint:
Removeproxy:
Hosts:
IE trusted site: HKU\.DEFAULT\...\webcompanion.com -> hxxp://webcompanion.com
IE trusted site: HKU\S-1-5-21-945854890-2078425937-559493312-1001\...\localhost -> localhost
IE trusted site: HKU\S-1-5-21-945854890-2078425937-559493312-1001\...\webcompanion.com -> hxxp://webcompanion.com
IE trusted site: HKU\S-1-5-21-945854890-2078425937-559493312-500\...\localhost -> localhost
IE trusted site: HKU\S-1-5-21-945854890-2078425937-559493312-500\...\webcompanion.com -> hxxp://webcompanion.com
U2 DCIService; C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe [3413424 2023-02-27] (Lavasoft Software Canada Inc. -> ) <==== ATTENTION
R2 VPNService; C:\Program Files (x86)\Lavasoft\Web Companion\Application\VPNServiceHost.exe [20184 2023-02-27] (Lavasoft Software Canada Inc. -> ) <==== ATTENTION
R2 WCAssistantService; C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe [27864 2023-02-27] (Lavasoft Software Canada Inc. -> ) <==== ATTENTION
C:\Program Files (x86)\Lavasoft
S2 MyEpson Portal Service; "C:\Program Files (x86)\EPSON\MyEpson Portal\mepService.exe" [X]
ShortcutWithArgument: C:\Users\Jean-Pierre\Documents\Documents and Settings\Jean-Pierre\Application Data\DeviceVm\Browser Configuration Utility\plugins\ZyngaGames\fr-FR\Games.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation) -> /c "start hxxp://socialgames.splashtop.com/redirectGames/?oem=asusegbcu00^&os=Windows^&p=M4N68T-M-V2^&pv=1.0.12^&v=1^&flv=^&c=1036^&t=d41d8cd98f00b204e9800998ecf8427e^&l=fr-FR"
ShortcutWithArgument: C:\Users\Jean-Pierre\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\7634a48803fa655b\ASUS GIFTBOX.lnk -> C:\Program Files (x86)\ASUS\Giftbox\Asusgiftbox.exe (ASUSTek Computer Inc) -> --user-data-dir="C:\Users\Jean-Pierre\AppData\Local\ASUS GIFTBOX\User Data" --profile-directory=Default --app-id=gicdkbgeaegfghgkdgaejkfeppmlobel
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION
GroupPolicy: Restriction ? <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
Task: {1131B1E7-A3E0-43BD-958C-AA8C9F229215} - \Microsoft\Windows\UNP\RunCampaignManager -> Pas de fichier <====
ATTENTION
HKU\S-1-5-21-945854890-2078425937-559493312-500\...\RunOnce: [Delete Cached Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\Administrateur\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" (Pas de fichier)
HKU\S-1-5-21-945854890-2078425937-559493312-500\...\RunOnce: [Delete Cached Standalone Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\Administrateur\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" (Pas de fichier)
Task: {FD68B90E-C6A7-46B9-BC1D-C60D2427BC26} - System32\Tasks\Microsoft\Windows\rempl\shell => %ProgramFiles%\rempl\sedlauncher.exe (Pas de fichier)
Task: {77DBB980-4DD5-49DE-A580-3A243DF0E4AA} - System32\Tasks\Avast Software\Avast Cleanup BugReport => C:\Program Files\Avast Software\Cleanup\AvBugReport.exe [5029784 2023-05-07] (Avast Software s.r.o. -> AVAST Software) -> --send "dumps|report" --silent --product 62 --programpath "C:\Program Files\Avast Software\Cleanup\Setup\.." --configpath "C:\Program Files\Avast Software\Cleanup\Setup" --path "C:\ProgramData\Avast Software\Cleanup\log" --path "C:\ProgramData\Avast Software\Icarus\Logs" --logpath "C:\ProgramData\A (l'élément de données a 70 caractères en plus).
Task: {87078208-B89D-4993-A5C4-761D973D957A} - System32\Tasks\Avast Software\Avast Cleanup Update => C:\Program Files\Common Files\Avast Software\Icarus\avast-tu\icarus.exe [7092120 2023-05-03] (Avast Software s.r.o. -> Avast Software)
HKLM\...\Run: [TuneupUI.exe] => C:\Program Files\Avast Software\Cleanup\TuneupUI.exe [4499864 2023-05-07] (Avast Software s.r.o. -> AVAST Software)
C:\Program Files\Avast Software
cmd: ipconfig /flushdns
cmd: netsh advfirewall reset
cmd: netsh advfirewall set allprofiles state on
cmd: netsh winsock reset
EmptyEventLogs:
Emptytemp:
End::