start::
SystemRestore: on
CreateRestorePoint:
CloseProcesses:
Hosts:
RemoveProxy:
GroupPolicy\User: Restriction ?
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction
HKLM\SOFTWARE\Policies\Google: Restriction
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction
HKLM\...\StartupApproved\Run32: => "I16A"
HKLM\...\StartupApproved\Run32: => "IseUI"
HKU\S-1-5-21-1686056440-3441562365-1559230115-1001\...\StartupApproved\Run: => "CyberGhost"
FF Extension: (JavaScript Warning) - C:\Users\steph\AppData\Roaming\Mozilla\Firefox\Profiles\buw8dsry.default-release-1570177079339\Extensions\JavaScriptWarning@example.com.xpi
FF Extension: (JavaScript Warning) - C:\Users\steph\AppData\Roaming\Mozilla\Firefox\Profiles\6wko6hg9.default\Extensions\JavaScriptWarning@example.com.xpi
FF Extension: (Avast Online Security & Privacy) - C:\Users\steph\AppData\Roaming\Mozilla\Firefox\Profiles\buw8dsry.default-release-1570177079339\Extensions\wrc@avast.com.xpi
FF user.js: detected! => C:\Users\steph\AppData\Roaming\Mozilla\Firefox\Profiles\6wko6hg9.default\user.js
FF Extension: (Avast Online Security) - C:\Users\steph\AppData\Roaming\Mozilla\Firefox\Profiles\6wko6hg9.default\Extensions\wrc@avast.com.xpi
Edge Extension: (Pas de nom) -> AutoFormFill_5ED10D46BD7E47DEB1F3685D2C0FCE08 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\AutoFormFill [non trouvé(e)]
Edge Extension: (Pas de nom) -> BookReader_B171F20233094AC88D05A8EF7B9763E8 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\BookViewer [non trouvé(e)]
Edge Extension: (Pas de nom) -> LearningTools_7706F933-971C-41D1-9899-8A026EB5D824 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\LearningTools [non trouvé(e)]
Edge Extension: (Pas de nom) -> PinJSAPI_EC01B57063BE468FAB6DB7EBFC3BF368 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\PinJSAPI [non trouvé(e)]
Edge Extension: (NordVPN - VPN Proxy for Privacy and Security) - C:\Users\steph\AppData\Local\Microsoft\Edge\User Data\Profile 3\Extensions\fphgeikpdcdcheaochkhldmnfblfogla
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki]
2023-07-04 14:08 - 2023-07-04 14:11 - 000000000 ____D C:\ProgramData\F-Secure
2023-07-04 14:08 - 2023-07-04 14:08 - 000000000 ____D C:\Users\steph\AppData\Local\F-Secure
ContextMenuHandlers1: [IObitUnstaler] -> {836AB26C-2DE4-41D3-AC24-4C6C2699B960} => -> Pas de fichier
ContextMenuHandlers1: [WinRAR] -> [CC]{B41DB860-64E4-11D2-9906-E49FADC173CA} => -> Pas de fichier
ContextMenuHandlers1: [WinRAR32] -> [CC]{B41DB860-8EE4-11D2-9906-E49FADC173CA} => -> Pas de fichier
ContextMenuHandlers4: [IObitUnstaler] -> {836AB26C-2DE4-41D3-AC24-4C6C2699B960} => -> Pas de fichier
ContextMenuHandlers6: [IObitUnstaler] -> {836AB26C-2DE4-41D3-AC24-4C6C2699B960} => -> Pas de fichier
ContextMenuHandlers6: [WinRAR] -> [CC]{B41DB860-64E4-11D2-9906-E49FADC173CA} => -> Pas de fichier
ContextMenuHandlers6: [WinRAR32] -> [CC]{B41DB860-8EE4-11D2-9906-E49FADC173CA} => -> Pas de fichier
HKU\S-1-5-21-1686056440-3441562365-1559230115-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://fr.yahoo.com/?fr=yset_ie_syc_oracle&type=orcl_hpset
SearchScopes: HKU\S-1-5-21-1686056440-3441562365-1559230115-1001 -> DefaultScope {8EEAC88A-079B-4b2c-80C1-7836F79EB40A} URL = hxxp://fr.search.yahoo.com/search?p={searchTerms}&fr=chr-comodo&type=33050001005_10.2.0.6526_u_ds
SearchScopes: HKU\S-1-5-21-1686056440-3441562365-1559230115-1001 -> {8EEAC88A-079B-4b2c-80C1-7836F79EB40A} URL = hxxp://fr.search.yahoo.com/search?p={searchTerms}&fr=chr-comodo&type=33050001005_10.2.0.6526_u_ds
EmptyTemp:
cmd: ipconfig /flushdns
cmd: sfc /scannow
end::