start::
closeprocesses:
createrestorepoint:
IE trusted site: HKU\.DEFAULT\...\webcompanion.com -> hxxp://webcompanion.com
IE trusted site: HKU\S-1-5-21-1153286178-2078991708-2850192077-1001\...\webcompanion.com -> hxxp://webcompanion.com
HKLM\...\StartupApproved\Run: => "Wondershare Helper Compact.exe"
HKU\S-1-5-21-1153286178-2078991708-2850192077-1001\...\StartupApproved\Run: => "NTSystem"
HKU\S-1-5-21-1153286178-2078991708-2850192077-1001\...\StartupApproved\Run: => "XRJNZC"
HKU\S-1-5-21-1153286178-2078991708-2850192077-1001\...\StartupApproved\Run: => "Pinaview"
HKU\S-1-5-21-1153286178-2078991708-2850192077-1001\...\StartupApproved\Run: => "csrss"
HKU\S-1-5-21-1153286178-2078991708-2850192077-1001\...\StartupApproved\Run: => "num.exe"
HKU\S-1-5-21-1153286178-2078991708-2850192077-1001\...\StartupApproved\Run: => "kjhkhkhk"
HKLM\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe (Pas de fichier)
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2137744 2016-10-08] (Wondershare software CO., LIMITED -> Wondershare)
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\MRT: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center: Restriction <==== ATTENTION
HKLM\Software\Policies\...\system: [EnableSmartScreen] 0
HKU\S-1-5-21-1153286178-2078991708-2850192077-1001\...\Run: [NTSystem] => C:\Users\satronicx\AppData\Roaming\NTSystem\ntlhost.exe************************************************************************************************************************************************* (l'élément de données a 23 caractères en plus). (Pas de fichier) <==== ATTENTION
HKU\S-1-5-21-1153286178-2078991708-2850192077-1001\...\Run: [XRJNZC] => C:\ProgramData\pinterests\XRJNZC.exe\pinterests\XRJNZC.exe (Pas de fichier) <==== ATTENTION
HKU\S-1-5-21-1153286178-2078991708-2850192077-1001\...\Run: [Pinaview] => C:\Users\satronicx\AppData\Local\Programs\Pinaview\Pinaview.exe (Pas de fichier)
HKU\S-1-5-21-1153286178-2078991708-2850192077-1001\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe [9255128 2024-01-16] (Lavasoft Software Canada Inc. -> Lavasoft) <==== ATTENTION
HKU\S-1-5-21-1153286178-2078991708-2850192077-1001\...\Run: [RageMP131] => C:\Users\satronicx\AppData\Local\RageMP131\RageMP131.exe [1207808 2024-01-23] () [Fichier non signé] <==== ATTENTION
HKU\S-1-5-21-1153286178-2078991708-2850192077-1001\...\Run: [ExtreamFanV5] => C:\Users\satronicx\AppData\Local\ExtreamFanV5\ExtreamFanV5.exe [6521344 2024-01-23] (ESET) [Fichier non signé] <==== ATTENTION
HKU\S-1-5-21-1153286178-2078991708-2850192077-1001\...\Run: [RageMP1] => C:\Users\satronicx\AppData\Local\RageMP1\RageMP1.exe [4793856 2024-01-23] (INELO Polska spolka z ograniczona odpowiedzialnoscia) [Fichier non signé] <==== ATTENTION
HKU\S-1-5-21-1153286178-2078991708-2850192077-1001\...\Run: [csrss] => C:\WINDOWS\rss\csrss.exe [4322184 2024-01-24] (525d0b323423120e110456060e332e32311412140236333d57310b361108382b0633 -> ) [Fichier non signé] <==== ATTENTION
HKU\S-1-5-21-1153286178-2078991708-2850192077-1001\...\Run: [rback.exe] => C:\Users\satronicx\AppData\Local\Temp\1000567001\rback.exe [1207808 2024-01-23] () [Fichier non signé] <==== ATTENTION
HKU\S-1-5-21-1153286178-2078991708-2850192077-1001\...\Run: [FLWCUERA] => C:\Users\satronicx\AppData\Roaming\eyfisgalqlbk\iojmibhyhiws.exe [6731040 2024-01-24] (Google Chrome) [Fichier non signé]
HKU\S-1-5-21-1153286178-2078991708-2850192077-1001\...\Run: [num.exe] => C:\Users\SATRON~1\AppData\Local\Temp\1000564001\num.exe (Pas de fichier) <==== ATTENTION
HKU\S-1-5-21-1153286178-2078991708-2850192077-1001\...\Run: [kjhkhkhk] => C:\Users\satronicx\AppData\Roaming\kjhkhkhk.exe (Pas de fichier) <==== ATTENTION
HKU\S-1-5-21-1153286178-2078991708-2850192077-1001\...\Run: [stan.exe] => C:\Users\satronicx\AppData\Local\Temp\1000574001\stan.exe [1207296 2024-01-24] () [Fichier non signé] <==== ATTENTION
HKU\S-1-5-21-1153286178-2078991708-2850192077-1001\...\Run: [LegalHelper2] => C:\Users\satronicx\AppData\Local\LegalHelper2\LegalHelper2.exe [4603560 2024-01-24] (ActiveReports RDF document 2024 API -> ESET) [Fichier non signé] <==== ATTENTION
HKU\S-1-5-21-1153286178-2078991708-2850192077-1001\...\Run: [Pmhgyh] => C:\Users\satronicx\AppData\Roaming\Pmhgyh.exe [1121792 2024-01-24] () [Fichier non signé] <==== ATTENTION
HKU\S-1-5-21-1153286178-2078991708-2850192077-1001\...\MountPoints2: {64a60b4f-8e2a-11ee-9a68-dae9105168e1} - "K:\setup.EXE" /AUTORUN
HKU\S-1-5-21-1153286178-2078991708-2850192077-1001\...\Winlogon: [Shell] C:\WINDOWS\explorer.exe [5356616 2024-01-24] (Microsoft Windows -> Microsoft Corporation) <==== ATTENTION
StartupDir: C:\Users\SATRON~1\AppData\Local\Temp\d887ceb89d\ <==== ATTENTION
Startup: C:\Users\SATRON~1\AppData\Local\Temp\d887ceb89d\explorhe.exe [2024-01-23] () [Fichier non signé]
Startup: C:\Users\SATRON~1\AppData\Local\Temp\d887ceb89d\PowerExpertNT.lnk [2024-01-23] <==== ATTENTION
ShortcutTarget: PowerExpertNT.lnk -> C:\Users\satronicx\AppData\Local\Temp\PowerExpertNT\PowerExpertNT.exe (ESET) [Fichier non signé] <==== ATTENTION
Startup: C:\Users\SATRON~1\AppData\Local\Temp\d887ceb89d\qemu-ga.exe [2024-01-23] () [Fichier non signé]
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\$McRebootA5E6DEAA56$.lnk [2024-01-20]
ShortcutTarget: $McRebootA5E6DEAA56$.lnk -> (Pas de fichier)
BootExecute: autocheck autochk * Partizan
AlternateShell: <==== ATTENTION
GroupPolicy: Restriction - Chrome <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Edge: Restriction <==== ATTENTION
Task: {1A64948B-A147-4C6F-B0C0-CD61565499A1} - \Microsoft\spr41b -> Pas de fichier <==== ATTENTION
Task: {FAD8A4D7-0A7A-486A-9F98-CDD5D7FDB599} - System32\Tasks\bCYLiWEScClvaQj2 => C:\WINDOWS\system32\rundll32.exe [73728 2022-05-07] (Microsoft Windows -> Microsoft Corporation) -> "C:\Program Files (x86)\BpsybjNQU\GTYSGc.dll",#1 <==== ATTENTION
Task: {F847EB47-914B-439F-BC91-414D2B163578} - System32\Tasks\csrss => C:\WINDOWS\rss\csrss.exe [4322184 2024-01-24] (525d0b323423120e110456060e332e32311412140236333d57310b361108382b0633 -> ) [Fichier non signé] <==== ATTENTION
Task: {310C8A52-423B-48C5-8044-3580CF7E675C} - System32\Tasks\explorhe.exe => C:\Users\satronicx\AppData\Local\Temp\d887ceb89d\explorhe.exe [809984 2024-01-23] () [Fichier non signé] <==== ATTENTION
Task: {6A8A7F4D-337D-4518-9088-0871F800675D} - System32\Tasks\Firefox Default Browser Agent 6FB276C898C04DF5 => C:\Users\satronicx\AppData\Roaming\bvbivtv [242688 2024-01-10] () [Fichier non signé] [Fichier en cours d'utilisation] <==== ATTENTION
Task: {84F640E8-9F3D-4156-A92E-6BD801F62849} - System32\Tasks\GoogleSystem\GoogleUpdater\GoogleUpdaterTaskSystem122.0.6253.0{AD48684B-59E6-4B52-AA26-9165583A7249} => C:\Program Files (x86)\Google\GoogleUpdater\122.0.6253.0\updater.exe [4652320 2024-01-17] (Google LLC -> Google LLC) <==== ATTENTION
Task: {5490F4AA-521A-490B-A049-25FBE9E336DE} - System32\Tasks\IEUpdater2 HR => C:\ProgramData\IEUpdater2\IEUpdater2.exe [4603560 2024-01-24] (ActiveReports RDF document 2024 API -> ESET) [Fichier non signé] <==== ATTENTION
Task: {C03B8F5C-C86C-4132-896B-7C9EF6E83ECE} - System32\Tasks\IEUpdater2 LG => C:\ProgramData\IEUpdater2\IEUpdater2.exe [4603560 2024-01-24] (ActiveReports RDF document 2024 API -> ESET) [Fichier non signé] <==== ATTENTION
Task: {283C1836-B022-4ED4-804C-8C540FF849A7} - System32\Tasks\iqNcFoMEjOmfsJVQqYO2 => C:\WINDOWS\system32\rundll32.exe [73728 2022-05-07] (Microsoft Windows -> Microsoft Corporation) -> "C:\Program Files (x86)\ZUPgfZevCCtiC\aZYWemj.dll",#1 <==== ATTENTION
Task: {2B808850-CB7F-431E-8D37-C1813D6CE721} - System32\Tasks\MalayamaraUpdate => "C:\Users\SATRON~1\AppData\Local\Temp\Updater.exe" (Pas de fichier) <==== ATTENTION
Task: {B6668B11-BBEF-48CB-9B87-4059421A1D5D} - System32\Tasks\MPGPH1 HR => C:\ProgramData\MPGPH1\MPGPH1.exe [4793856 2024-01-23] (INELO Polska spolka z ograniczona odpowiedzialnoscia) [Fichier non signé] <==== ATTENTION
Task: {5F0FBA9E-9CA0-425C-9B0E-1D0B5EBEA559} - System32\Tasks\MPGPH1 LG => C:\ProgramData\MPGPH1\MPGPH1.exe [4793856 2024-01-23] (INELO Polska spolka z ograniczona odpowiedzialnoscia) [Fichier non signé] <==== ATTENTION
Task: {6F488F60-0A67-4C66-A68C-1527291221A5} - System32\Tasks\MPGPH131 HR => C:\ProgramData\MPGPH131\MPGPH131.exe [1207808 2024-01-23] () [Fichier non signé] <==== ATTENTION
Task: {5E115B85-58AF-4412-B87A-75BF9F785FF6} - System32\Tasks\MPGPH131 LG => C:\ProgramData\MPGPH131\MPGPH131.exe [1207808 2024-01-23] () [Fichier non signé] <==== ATTENTION
Task: {5306ECFC-33C3-4BCE-81D1-E7162DF53200} - System32\Tasks\QoVkcokdlrDusqKJZ2 => C:\WINDOWS\system32\rundll32.exe [73728 2022-05-07] (Microsoft Windows -> Microsoft Corporation) -> "C:\Program Files (x86)\aDqeZlkBPMvZpWtTAXR\kERIwuC.dll",#1 <==== ATTENTION
Task: {5FE7AA85-6B35-4DD2-AD8A-2EB5C3D2FFFF} - System32\Tasks\Timer => c:\windows\system\svchost.exe (Pas de fichier) <==== ATTENTION
Task: {53B5760C-5871-4474-AA96-814015BFEA4D} - System32\Tasks\Utsysc.exe => C:\Users\SATRON~1\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe (Pas de fichier) <==== ATTENTION
Task: {4E6AC0D8-D836-40B0-A0A0-9AA04D234A24} - System32\Tasks\WinTrackerSP HR => C:\ProgramData\WinTrackerSP\WinTrackerSP.exe [6521344 2024-01-23] (ESET) [Fichier non signé] <==== ATTENTION
Task: {4336368B-B407-449B-8315-E31DC2F0ED48} - System32\Tasks\WinTrackerSP LG => C:\ProgramData\WinTrackerSP\WinTrackerSP.exe [6521344 2024-01-23] (ESET) [Fichier non signé] <==== ATTENTION
Task: {CF2A3453-82CA-42FB-9CA3-3BB39EEF6D0B} - System32\Tasks\XjhDFyAzzRvuK2 => C:\WINDOWS\system32\forfiles.exe [69632 2022-05-07] (Microsoft Windows -> Microsoft Corporation) -> /p C:\WINDOWS\system32 /m wscript.exe /c "cmd /C @FNAME ^"C:\ProgramData\UHRLcidSjUHAYIVB\pLXwSXr.wsf^""
Task: {40765862-83B2-4D43-8ED7-6B6B7B959F25} - System32\Tasks\ZnhigynmywZWkz => C:\WINDOWS\system32\rundll32.exe [73728 2022-05-07] (Microsoft Windows -> Microsoft Corporation) -> "C:\Program Files (x86)\hHRShAVwkXYU2\gGtTqYWSoGscH.dll",#1 <==== ATTENTION
Edge HomePage: Default -> hxxps://www.google.co%21/
Edge DefaultSearchURL: Default -> hxxp://search-cdn.net/fip/?q={searchTerms}
Edge DefaultSearchKeyword: Default -> cdn
Edge DefaultSuggestURL: Default -> hxxps://www.google.ru/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&q={searchTerms}
CHR HomePage: Profile 1 -> hxxps://find-it.pro/?utm_source=distr_m
CHR StartupUrls: Profile 1 -> "hxxps://find-it.pro/?utm_source=distr_m"
CHR DefaultSearchKeyword: Profile 1 -> cdn
CHR DefaultSuggestURL: Profile 1 -> hxxps://www.google.ru/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&q={searchTerms}
CHR HomePage: Profile 2 -> hxxps://find-it.pro/?utm_source=distr_m
CHR StartupUrls: Profile 2 -> "hxxps://find-it.pro/?utm_source=distr_m"
CHR DefaultSearchKeyword: Profile 2 -> cdn
CHR DefaultSuggestURL: Profile 2 -> hxxps://www.google.ru/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&q={searchTerms}
CHR HomePage: Profile 4 -> hxxps://find-it.pro/?utm_source=distr_m
CHR StartupUrls: Profile 4 -> "hxxps://find-it.pro/?utm_source=distr_m"
CHR DefaultSearchKeyword: Profile 4 -> cdn
CHR DefaultSuggestURL: Profile 4 -> hxxps://www.google.ru/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&q={searchTerms}
CHR HomePage: System Profile -> hxxps://find-it.pro/?utm_source=distr_m
CHR StartupUrls: System Profile -> "hxxps://find-it.pro/?utm_source=distr_m"
CHR DefaultSearchKeyword: System Profile -> x-finder.pro
CHR DefaultSuggestURL: System Profile -> hxxps://x-finder.pro/search/suggest.php?q={searchTerms}
S4 VBoxGuest; VBoxGuest [X]
S4 VBoxMouse; VBoxMouse [X]
S4 VBoxService; VBoxService [X]
S4 VBoxSF; VBoxSF [X]
S4 VBoxVideo; VBoxVideo [X]
S4 VBoxWddm; VBoxWddm [X]
S3 WsDrvInst; C:\Users\satronicx\Desktop\Wondershare\DriverInstall.exe [X] <==== ATTENTION
S3 Winmon; C:\WINDOWS\System32\drivers\Winmon.sys [9352 2024-01-24] (WDKTestCert Admin,131480495282941941 -> ) [Fichier non signé] <==== ATTENTION
S3 DrvSnSht; \??\C:\Program Files (x86)\R-Drive Image\DrvSnSht64.sys [X]
S3 MpKsl4350c786; \??\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{9992F086-BBEC-432B-9825-CC5898848A7E}\MpKslDrv.sys [X]
S3 R-ImageDisk; \??\C:\Program Files (x86)\R-Drive Image\R-ImageDisk64.sys [X]
S1 WinSetupMon; system32\DRIVERS\WinSetupMon.sys [X]
R2 TVTunerClassic66; C:\ProgramData\TVTunerClassic66\TVTunerClassic66.exe [4956149 2024-01-23] (Thimeo Audio Technology B.V.) [Fichier non signé] <==== ATTENTION
S3 Winmon; C:\WINDOWS\System32\drivers\Winmon.sys [9352 2024-01-24] (WDKTestCert Admin,131480495282941941 -> ) [Fichier non signé] <==== ATTENTION
R3 WirelessButtonDriver64; C:\WINDOWS\System32\drivers\WirelessButtonDriver64.sys [40104 2022-06-17] (HP Inc. -> HP)
S3 DrvSnSht; \??\C:\Program Files (x86)\R-Drive Image\DrvSnSht64.sys [X]
S3 MpKsl4350c786; \??\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{9992F086-BBEC-432B-9825-CC5898848A7E}\MpKslDrv.sys [X]
S3 R-ImageDisk; \??\C:\Program Files (x86)\R-Drive Image\R-ImageDisk64.sys [X]
S1 WinSetupMon; system32\DRIVERS\WinSetupMon.sys [X]
2024-01-24 22:48 - 2024-01-24 22:48 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerShell
2024-01-24 22:48 - 2024-01-24 22:48 - 000000000 ____D C:\Program Files\PowerShell
2024-01-24 22:41 - 2024-01-24 22:41 - 000810954 _____ C:\WINDOWS\system32\perfh00C.dat
2024-01-24 22:41 - 2024-01-24 22:41 - 000157390 _____ C:\WINDOWS\system32\perfc00C.dat
2024-01-24 22:40 - 2024-01-24 22:40 - 000000000 ____D C:\Users\satronicx\Desktop\Nouveau dossier
2024-01-24 22:27 - 2024-01-24 22:27 - 002103296 ____H C:\WINDOWS\windefender.exe
2024-01-24 22:22 - 2024-01-24 22:22 - 000003356 _____ C:\WINDOWS\system32\Tasks\ZnhigynmywZWkz
2024-01-24 22:22 - 2024-01-24 22:22 - 000003164 _____ C:\WINDOWS\system32\Tasks\XjhDFyAzzRvuK2
2024-01-24 22:22 - 2024-01-24 22:22 - 000003034 _____ C:\WINDOWS\system32\Tasks\QoVkcokdlrDusqKJZ2
2024-01-24 22:22 - 2024-01-24 22:22 - 000003026 _____ C:\WINDOWS\system32\Tasks\iqNcFoMEjOmfsJVQqYO2
2024-01-24 22:22 - 2024-01-24 22:22 - 000003008 _____ C:\WINDOWS\system32\Tasks\bCYLiWEScClvaQj2
2024-01-24 22:22 - 2024-01-24 22:22 - 000000290 __RSH C:\ProgramData\ntuser.pol
2024-01-24 22:22 - 2024-01-24 22:22 - 000000000 ____D C:\ProgramData\UHRLcidSjUHAYIVB
2024-01-24 22:22 - 2024-01-24 22:22 - 000000000 ____D C:\Program Files (x86)\ZUPgfZevCCtiC
2024-01-24 22:22 - 2024-01-24 22:22 - 000000000 ____D C:\Program Files (x86)\jijxMVzcNGUn
2024-01-24 22:22 - 2024-01-24 22:22 - 000000000 ____D C:\Program Files (x86)\hHRShAVwkXYU2
2024-01-24 22:22 - 2024-01-24 22:22 - 000000000 ____D C:\Program Files (x86)\BpsybjNQU
2024-01-24 22:22 - 2024-01-24 22:22 - 000000000 ____D C:\Program Files (x86)\aDqeZlkBPMvZpWtTAXR
2024-01-24 22:22 - 2024-01-24 22:21 - 001121792 _____ () C:\Users\satronicx\AppData\Roaming\Pmhgyh.exe
2024-01-24 22:21 - 2024-01-24 22:34 - 000003744 _____ C:\WINDOWS\system32\Tasks\Firefox Default Browser Agent 6FB276C898C04DF5
2024-01-24 22:21 - 2024-01-24 22:21 - 000009352 _____ C:\WINDOWS\system32\Drivers\Winmon.sys
2024-01-24 22:21 - 2024-01-24 22:21 - 000003542 _____ C:\WINDOWS\system32\Tasks\IEUpdater2 HR
2024-01-24 22:21 - 2024-01-24 22:21 - 000003286 _____ C:\WINDOWS\system32\Tasks\IEUpdater2 LG
2024-01-24 22:21 - 2024-01-24 22:21 - 000000000 ___HD C:\WINDOWS\rss
2024-01-24 22:21 - 2024-01-24 22:21 - 000000000 ____D C:\Users\satronicx\AppData\Local\MonsterUpdateService
2024-01-24 22:21 - 2024-01-24 22:21 - 000000000 ____D C:\Users\satronicx\AppData\Local\LegalHelper2
2024-01-24 22:21 - 2024-01-24 22:21 - 000000000 ____D C:\ProgramData\IEUpdater2
2024-01-24 22:10 - 2024-01-25 01:21 - 000000235 _____ C:\Users\satronicx\Desktop\windows defender.txt
2024-01-24 16:40 - 2024-01-24 16:40 - 000364632 _____ C:\Users\satronicx\Downloads\LIFE-WebLogs-2024-01-24T15_40_55.731Z.zip
2024-01-24 15:09 - 2024-01-24 22:36 - 000000000 ____D C:\Users\satronicx\AppData\Roaming\006700e5a2ab05
2024-01-24 14:46 - 2024-01-24 14:46 - 000000000 ____D C:\Users\satronicx\Desktop\update
2024-01-24 14:03 - 2024-01-24 14:03 - 000000000 ____D C:\ProgramData\AOMEIPA
2024-01-24 03:03 - 2024-01-24 03:03 - 000000000 ____D C:\Users\satronicx\AppData\Local\ElevatedDiagnostics
2024-01-24 01:54 - 2024-01-24 01:54 - 000000000 ____D C:\WINDOWS\SoftwareDistribution-WinUpdFix-Old
2024-01-24 01:49 - 2024-01-24 01:49 - 000000000 ____D C:\Users\satronicx\AppData\Local\PC HelpSoft Driver Updater
2024-01-24 01:24 - 2024-01-24 01:24 - 000000000 ____D C:\Users\satronicx\AppData\Roaming\eyfisgalqlbk
cmd: netsh advfirewall reset
hosts:
emptytemp:
end::