start::
closeprocesses:
createrestorepoint:
HKLM\...\RunOnce: [Delete Cached Standalone Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Program Files\Microsoft OneDrive\StandaloneUpdater\OneDriveSetup.exe" (Pas de fichier)
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
Task: {8838475B-E456-4D12-83EA-36EC12328BC1} - \Microsoft\Windows\Setup\EOSNotify2 -> Pas de fichier <==== ATTENTION
Task: {9C91F200-3C32-40CE-8BC6-CF59D7F21215} - \Microsoft\Windows\Setup\EOSNotify -> Pas de fichier <==== ATTENTION
Task: {EDCB22C1-9985-4E18-B7BC-D3E4F914DC10} - System32\Tasks\AdwCleaner_onReboot => C:\Users\bureau\Desktop\adwcleaner_8.0.6.exe /r (Pas de fichier)
Task: {533B5016-D6C2-4485-A660-D9E04E7E4E89} - System32\Tasks\AVGPCTuneUp_Task_BkGndMaintenance => C:\Program Files\AVG\AVG PC TuneUp\tuscanx.exe $(Arg0) (Pas de fichier)
Task: {D85B8DE8-5509-4A26-A6EF-25FBF1D9C2BF} - System32\Tasks\G100 => C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe [435712 2024-02-14] (Microsoft Windows -> Microsoft Corporation) -> -WindowStyle Hidden -Command "Start-Process -WindowStyle hidden -FilePath \"C:\Users\bureau\AppData\Local\Temp\g100.bat\" -ArgumentList \"111\"" <==== ATTENTION
Task: {7B5CE5AA-0FEE-4378-AA08-FFF636F6A08A} - System32\Tasks\Microsoft\Windows\End Of Support\Notify1 => %windir%\system32\sipnotify.exe -LogonOrUnlock (Pas de fichier)
Task: {4EE2C9A0-9498-4CE7-B54A-362C49B10D8C} - System32\Tasks\Microsoft\Windows\End Of Support\Notify2 => %windir%\system32\sipnotify.exe -Daily (Pas de fichier)
Task: {7DA0E4EA-1C33-4051-B6EC-746E031932B5} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => %SystemRoot%\ehome\ehPrivJob.exe /DoActivateWindowsSearch (Pas de fichier)
Task: {38F779A6-B0DC-4692-B346-BDFD98F515A3} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => %SystemRoot%\ehome\ehPrivJob.exe /DoConfigureInternetTimeService (Pas de fichier)
Task: {A6983CEE-B7BA-4F86-BE0A-2B17B86D2FD1} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => %SystemRoot%\ehome\ehPrivJob.exe /DoRecoveryTasks $(Arg0) (Pas de fichier)
Task: {7F24A82D-0526-44EF-AAE4-F663887C1417} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => %SystemRoot%\ehome\ehPrivJob.exe /DRMInit (Pas de fichier)
Task: {D7424B20-5FAB-47C0-9A18-35151C01E715} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => %SystemRoot%\ehome\ehPrivJob.exe /InstallPlayReady $(Arg0) (Pas de fichier)
Task: {7CBF0044-794E-4557-9D28-6E26102271DF} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => %SystemRoot%\ehome\mcupdate $(Arg0) (Pas de fichier)
Task: {AEB73980-A7CC-478B-BEC7-5E7B475C65EC} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => %SystemRoot%\ehome\mcupdate.exe -MediaCenterRecoveryTask (Pas de fichier)
Task: {381309A9-BCFF-45A4-A4AC-BCF6B132E6B7} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => %SystemRoot%\ehome\mcupdate.exe -ObjectStoreRecoveryTask (Pas de fichier)
Task: {2C270895-FDF7-4EF3-86D8-BD9A853BAB92} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => %SystemRoot%\ehome\ehPrivJob.exe /OCURActivate (Pas de fichier)
Task: {F751CBD1-F099-4EE5-AF21-39D146C08376} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => %SystemRoot%\ehome\ehPrivJob.exe /OCURDiscovery $(Arg0) (Pas de fichier)
Task: {705F3AAA-EBC1-4C42-862F-34EBCE66EAB9} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => %SystemRoot%\ehome\ehPrivJob.exe /PBDADiscovery (Pas de fichier)
Task: {E6A89668-3D65-416A-8A9E-FF2810CA417D} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => %SystemRoot%\ehome\ehPrivJob.exe /wait:7 /PBDADiscovery (Pas de fichier)
Task: {C44B3A09-71AA-4A21-BFAC-D35B9DD3BA92} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => %SystemRoot%\ehome\ehPrivJob.exe /wait:90 /PBDADiscovery (Pas de fichier)
Task: {A79B8AE6-C710-48F9-92C3-AAA5F8F5DF62} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => %windir%\ehome\MCUpdate.exe -pscn 0 (Pas de fichier)
Task: {02F47EF5-E58E-4985-8925-BBAB426A1161} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => %SystemRoot%\ehome\mcupdate.exe -PvrRecoveryTask (Pas de fichier)
Task: {23049754-DFCF-4C51-80F0-7D3BD40B585D} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => %SystemRoot%\ehome\mcupdate.exe -PvrSchedule (Pas de fichier)
Task: {542BDC4B-2F1F-4D34-B80B-4E1BFC791553} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => %SystemRoot%\ehome\ehrec /RestartRecording (Pas de fichier)
Task: {D417415C-ECE1-4054-B831-BD9C82B8ABC7} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => %SystemRoot%\ehome\ehPrivJob.exe /DoRegisterSearch $(Arg0) (Pas de fichier)
Task: {F82F3867-05D0-49E0-9C18-086947ACE69B} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => %SystemRoot%\ehome\ehPrivJob.exe /DoReindexSearchRoot (Pas de fichier)
Task: {0DD5CE34-D1CC-4FE3-A573-DA9FC9F4F587} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => %SystemRoot%\ehome\mcupdate.exe -SqlLiteRecoveryTask (Pas de fichier)
Task: {84CFC9E8-AAC7-43A5-A222-BE6C4C7FCAAF} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => %SystemRoot%\ehome\ehrec /StartRecording (Pas de fichier)
Task: {46DAA195-8C41-492C-A213-5AC111533048} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => %SystemRoot%\ehome\ehPrivJob.exe /DoUpdateRecordPath $(Arg0) (Pas de fichier)
Task: {97F6AC42-2841-4D97-A54A-10905EC770E0} - System32\Tasks\Microsoft\Windows\MobilePC\HotStart => {06DA0625-9701-43DA-BFD7-FBEEA2180A1E}
Task: {24FA84A0-E087-48EC-BC51-2B9C4C815D78} - System32\Tasks\Microsoft\Windows\PerfTrack\BackgroundConfigSurveyor => {EA9155A3-8A39-40B4-8963-D3C761B18371}
Task: {367F930A-A3DB-4112-B1F1-50E92A171C88} - System32\Tasks\Microsoft\Windows\Shell\WindowsParentalControls => {DFA14C43-F385-4170-99CC-1B7765FA0E4A}
Task: {E79B2998-8F63-451A-A56D-26EDC0A5098A} - System32\Tasks\Microsoft\Windows\Shell\WindowsParentalControlsMigration => {343D770D-7788-47C2-B62A-B7C4CED925CB}
Task: {AD93935F-9DF0-4DFD-8F6B-BE96F28C17AE} - System32\Tasks\Microsoft\Windows\SideShow\AutoWake => {E51DFD48-AA36-4B45-BB52-E831F02E8316}
Task: {ED4705DE-6A0D-43FF-AB5E-4D8FEE54D6DC} - System32\Tasks\Microsoft\Windows\SideShow\GadgetManager => {FF87090D-4A9A-4F47-879B-29A80C355D61}
Task: {910C5AA8-E5A6-41E3-B45B-727A9D43BA5B} - System32\Tasks\Microsoft\Windows\SideShow\SessionAgent => {45F26E9E-6199-477F-85DA-AF1EDFE067B1}
Task: {46659DE8-5850-4A19-BC22-B8ADF23F4018} - System32\Tasks\Microsoft\Windows\SideShow\SystemDataProviders => {7CCA6768-8373-4D28-8876-83E8B4E3A969}
Hosts: 0.0.0.0 telemetry.malwarebytes.com
FF user.js: detected! => C:\Users\bureau\AppData\Roaming\Mozilla\Firefox\Profiles\nnoa1775.default\user.js [2018-10-20]
emptytemp:
end::