start::
closeprocesses:
createrestorepoint:
HKLM\...\Run: [RtkAudUService] => "C:\WINDOWS\System32\RtkAudUService64.exe" -background (Pas de fichier)
HKLM-x32\...\Run: [PrivateFolder] => C:\Program Files (x86)\PrivateFolder\PF_Pass.exe (Pas de fichier)
HKLM\...\RunOnce: [!BCILauncher] => C:\WINDOWS\Temp\MUBSTemp\BCILauncher.EXE [18480 2024-04-01] (Microsoft Corporation -> ) <==== ATTENTION
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Restriction <==== ATTENTION
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION
HKLM\Software\Policies\...\system: [EnableSmartScreen] 0
HKU\S-1-5-21-3473668769-4128106765-2237959844-1001\...\Run: [YUR.fit] => "G:\Steam\steamapps\common\YUR\YUR.Fit.Windows.Service.exe" (Pas de fichier)
HKU\S-1-5-21-3473668769-4128106765-2237959844-1001\...\Run: [SignalRgb] => "C:\Users\Alex\AppData\Local\VortxEngine\SignalRgbLauncher.exe" --silent (Pas de fichier)
GroupPolicy: Restriction ? <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
Task: {0482CD34-87DE-47E6-B043-5B16D5B94A59} - System32\Tasks\ArcGIS Pro Indexing (DESKTOP-G3BSG5T_Alex) => G:\ArcGIS Pro City Builder\bin\ArcGISIndexingServer.exe (Pas de fichier)
Task: {5139EFD3-D3BD-4E51-9693-19E39EA58398} - System32\Tasks\JianShengYiZu-GmTaskPlan => "%ProgramFiles%\Luom-G10\luom.exe" (Pas de fichier)
Task: {8963DC98-644D-49D7-A019-6FE65CD3CD27} - System32\Tasks\KryptexElevation => "C:\Users\Alex\AppData\Local\Programs\kryptex-app\Kryptex.exe" (Pas de fichier)
Task: {F7EFDA82-05A8-4A52-96EB-7F29BD0F4BFF} - System32\Tasks\KryptexElevationFromStartup => "C:\Users\Alex\AppData\Local\Programs\kryptex-app\Kryptex.exe" --from-startup (Pas de fichier)
Task: {D50BD562-75AB-45E1-84CE-5BC956D8122D} - System32\Tasks\Microsoft\VisualStudio\Updates\BackgroundDownload => C:\Program Files (x86)\Microsoft Visual Studio\Installer.11dac1c3024a477ca43f3c06bd501020\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\BackgroundDownload.exe (Pas de fichier)
Task: {94932A89-0091-433A-A234-7A54C5A77B58} - System32\Tasks\Microsoft\Windows\Setup\EOSNotify => %windir%\system32\EOSNotify.exe (Pas de fichier)
Task: {38676C17-6021-4062-8426-15664858630C} - System32\Tasks\Mozilla\nnqup => "C:\Users\Alex\AppData\Roaming\vufodt\mchost.exe" -> "C:\Users\Alex\AppData\Roaming\vufodt\mchost.chm" <==== ATTENTION
Task: {889EA0FD-9211-4591-A901-37AF5F29089D} - System32\Tasks\NahimicSvc32Run => "C:\WINDOWS\SysWOW64\NahimicSvc32.exe" $(Arg0) $(Arg1) $(Arg2) $(Arg3) $(Arg4) $(Arg5) $(Arg6) $(Arg7) (Pas de fichier)
Task: {803967A3-7418-41C6-9183-A54DB32B4238} - System32\Tasks\NahimicSvc64Run => "C:\WINDOWS\System32\NahimicSvc64.exe" $(Arg0) $(Arg1) $(Arg2) $(Arg3) $(Arg4) $(Arg5) $(Arg6) $(Arg7) (Pas de fichier)
Task: {9D0F4D8F-AAB0-4EED-8612-920C1EB99D19} - System32\Tasks\NahimicTask32 => C:\WINDOWS\System32\..\SysWOW64\NahimicSvc32.exe $(Arg0) $(Arg1) $(Arg2) $(Arg3) $(Arg4) $(Arg5) $(Arg6) $(Arg7) (Pas de fichier)
Task: {02BC8AD9-9FE8-4CA8-AA8D-2547CDD40B00} - System32\Tasks\NahimicTask64 => C:\WINDOWS\System32\NahimicSvc64.exe $(Arg0) $(Arg1) $(Arg2) $(Arg3) $(Arg4) $(Arg5) $(Arg6) $(Arg7) (Pas de fichier)
ProxyServer: [S-1-5-21-3473668769-4128106765-2237959844-1001] => http=127.0.0.1:8888;https=127.0.0.1:8888
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
FF Extension: (Pas de nom) - C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\v76k74ul.default\extensions\{ea4637dc-e014-4c17-9c2c-879322d23268} [non trouvé(e)]
S3 CT20XUT.SYS; \SystemRoot\System32\drivers\CT20XUT.SYS [X]
S3 CTEXFIFX.SYS; \SystemRoot\System32\drivers\CTEXFIFX.SYS [X]
S3 CTHWIUT.SYS; \SystemRoot\System32\drivers\CTHWIUT.SYS [X]
U4 napagent; pas de ImagePath
S3 VBAudioVMAUXVAIOMME; \SystemRoot\system32\DRIVERS\vbaudio_vmauxvaio64_win10.sys [X]
S3 VBAudioVMVAIOMME; \SystemRoot\system32\DRIVERS\vbaudio_vmvaio64_win10.sys [X]
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2133728 2017-09-12] (Wondershare Technology Co.,Ltd -> Wondershare)
C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact
CustomCLSID: HKU\S-1-5-21-3473668769-4128106765-2237959844-1001_Classes\CLSID\{16dd9ecb-4d70-16ca-4664-a9612d63600a}\localserver32 -> "C:\Program Files\Artemis\Artemis.UI.Windows.exe" -ToastActivated => Pas de fichier
CustomCLSID: HKU\S-1-5-21-3473668769-4128106765-2237959844-1001_Classes\CLSID\{89b2b650-c4dd-d68b-46e7-3176f1973c8b}\localserver32 -> "C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe" -ToastActivated => Pas de fichier
CustomCLSID: HKU\S-1-5-21-3473668769-4128106765-2237959844-1001_Classes\CLSID\{ee2f2860-c246-6753-67a5-1d3d562bfa26}\localserver32 -> "C:\Users\Alex\AppData\Local\PowerToys\PowerToys.PowerLauncher.exe" -ToastActivated => Pas de fichier
ContextMenuHandlers1: [MagicISO] -> {DB85C504-C730-49DD-BEC1-7B39C6103B7A} => -> Pas de fichier
ContextMenuHandlers4: [MagicISO] -> {DB85C504-C730-49DD-BEC1-7B39C6103B7A} => -> Pas de fichier
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => -> Pas de fichier
ContextMenuHandlers6: [MagicISO] -> {DB85C504-C730-49DD-BEC1-7B39C6103B7A} => -> Pas de fichier
HKU\S-1-5-21-3473668769-4128106765-2237959844-1001\Software\Classes\regfile: <==== ATTENTION
HKU\S-1-5-21-3473668769-4128106765-2237959844-1001\Software\Classes\.reg: => <==== ATTENTION
HKU\S-1-5-21-3473668769-4128106765-2237959844-1001\Software\Classes\.bat: => <==== ATTENTION
HKU\S-1-5-21-3473668769-4128106765-2237959844-1001\Software\Classes\.cmd: => <==== ATTENTION
HKLM\...\StartupApproved\Run32: => "Wondershare Helper Compact.exe"
FirewallRules: [TCP Query User{E23EAF27-168A-43F0-8DF2-EFD3449B9F15}C:\program files\artemis\artemis.ui.windows.exe] => (Allow) C:\program files\artemis\artemis.ui.windows.exe => Pas de fichier
FirewallRules: [UDP Query User{001A005A-3988-4B54-B408-AE3BC89A0198}C:\program files\artemis\artemis.ui.windows.exe] => (Allow) C:\program files\artemis\artemis.ui.windows.exe => Pas de fichier
FirewallRules: [{AE909DBB-2FFA-49BC-87AD-1C074FB68327}] => (Block) C:\program files\artemis\artemis.ui.windows.exe => Pas de fichier
FirewallRules: [{D31D3B07-099D-41E0-9CB1-80ADA40894B0}] => (Block) C:\program files\artemis\artemis.ui.windows.exe => Pas de fichier
removeproxy:
emptytemp:
end::