start
CloseProcesses:
CreateRestorePoint:
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
GroupPolicy: Restriction <==== ATTENTION
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FAH.lnk [2015-05-23]
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WinZip Préchargeur.lnk [2015-05-23]
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://fr.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_ir_17_23¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dfr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0A0Czy0EtCyBzytDzzyD0CyEzy0E0CyDtN0D0Tzu0StCzyzztBtN1L2XzutAtFtBzytFtAtFyByDtN1L1Czu1ByEtN1L1G1B1V1N2Y1L1Qzu2SyEtAyB0AtA0Bzy0BtGtD0EtA0BtGtC0BtD0FtGtCtAtDyEtGtBtD0CzzyE0EyEyEyEyB0E0C2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0C0CtCyD0E0FyByBtG0DyD0B0BtGyEyD0E0FtGzz0FtDtDtGtA0E0D0D0EtD0F0F0FzztB0D2QtN0A0LzuyE%26cr%3D423388675%26a%3Dwbf_ir_17_23%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://fr.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_ir_17_23¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dfr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0A0Czy0EtCyBzytDzzyD0CyEzy0E0CyDtN0D0Tzu0StCzyzztBtN1L2XzutAtFtBzytFtAtFyByDtN1L1Czu1ByEtN1L1G1B1V1N2Y1L1Qzu2SyEtAyB0AtA0Bzy0BtGtD0EtA0BtGtC0BtD0FtGtCtAtDyEtGtBtD0CzzyE0EyEyEyEyB0E0C2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0C0CtCyD0E0FyByBtG0DyD0B0BtGyEyD0E0FtGzz0FtDtDtGtA0E0D0D0EtD0F0F0FzztB0D2QtN0A0LzuyE%26cr%3D423388675%26a%3Dwbf_ir_17_23%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome
HKU\S-1-5-21-3720113905-2448826761-1402061820-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://fr.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_ir_17_23¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dfr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0A0Czy0EtCyBzytDzzyD0CyEzy0E0CyDtN0D0Tzu0StCzyzztBtN1L2XzutAtFtBzytFtAtFyByDtN1L1Czu1ByEtN1L1G1B1V1N2Y1L1Qzu2SyEtAyB0AtA0Bzy0BtGtD0EtA0BtGtC0BtD0FtGtCtAtDyEtGtBtD0CzzyE0EyEyEyEyB0E0C2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0C0CtCyD0E0FyByBtG0DyD0B0BtGyEyD0E0FtGzz0FtDtDtGtA0E0D0D0EtD0F0F0FzztB0D2QtN0A0LzuyE%26cr%3D423388675%26a%3Dwbf_ir_17_23%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome
SearchScopes: HKLM -> DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://fr.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_togoo_16_26¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dfr%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0A0Czy0EtCyBzytDzzyD0CyEzy0E0CyDtN0D0Tzu0StCyCyEtCtN1L2XzutAtFtBtAtFtCtFtBtN1L1Czu1ByEtN1L1G1B1V1N2Y1L1Qzu2StC0Bzz0AyD0DyB0BtGtDtDyDyEtGtAyEyByCtGyBtCyDtCtGyCyC0AtBtDtDzy0FyE0FtAtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0C0CtCyD0E0FyByBtG0DyD0B0BtGyEyD0E0FtGzz0FtDtDtGtA0E0D0D0EtD0F0F0FzztB0D2QtN0A0LzuyE%26cr%3D1750289360%26a%3Dwbf_togoo_16_26%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome&p={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://fr.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_togoo_16_26¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dfr%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0A0Czy0EtCyBzytDzzyD0CyEzy0E0CyDtN0D0Tzu0StCyCyEtCtN1L2XzutAtFtBtAtFtCtFtBtN1L1Czu1ByEtN1L1G1B1V1N2Y1L1Qzu2StC0Bzz0AyD0DyB0BtGtDtDyDyEtGtAyEyByCtGyBtCyDtCtGyCyC0AtBtDtDzy0FyE0FtAtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0C0CtCyD0E0FyByBtG0DyD0B0BtGyEyD0E0FtGzz0FtDtDtGtA0E0D0D0EtD0F0F0FzztB0D2QtN0A0LzuyE%26cr%3D1750289360%26a%3Dwbf_togoo_16_26%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome&p={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3720113905-2448826761-1402061820-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
CHR DefaultSearchURL: Default -> hxxps://fr.search.yahoo.com/search?p={searchTerms}&fr=yset_chr_syc_oracle&type=orcl_default
CHR DefaultSearchKeyword: Default -> Yahoo
CHR DefaultSuggestURL: Default -> hxxps://fr.search.yahoo.com/sugg/ie?output=fxjson&command={searchTerms}&nResults=10
CHR HKU\S-1-5-21-3720113905-2448826761-1402061820-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [fhoibnponjcgjgcnfacekaijdbbplhib] - hxxps://chrome.google.com/webstore/detail/fhoibnponjcgjgcnfacekaijdbbplhib
CHR HKLM-x32\...\Chrome\Extension: [kpdmjodecdegfglgaapafjleomjjlpnh] - hxxps://clients2.google.com/service/update2/crx
R2 ibtsiva; %SystemRoot%\system32\ibtsiva [X]
2017-05-19 20:14 - 2017-05-19 20:14 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2014-05-15 17:58 - 2012-09-07 13:40 - 0000256 _____ () C:\ProgramData\SetStretch.cmd
2014-05-15 17:58 - 2009-07-22 12:04 - 0024576 _____ () C:\ProgramData\SetStretch.exe
2014-05-15 17:58 - 2012-09-07 13:37 - 0000103 _____ () C:\ProgramData\SetStretch.VBS
CustomCLSID: HKU\S-1-5-21-3720113905-2448826761-1402061820-1001_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 -> C:\Users\Anthony\AppData\Local\Microsoft\OneDrive\17.3.6816.0313\amd64\FileSyncShell64.dll => Pas de fichier
CustomCLSID: HKU\S-1-5-21-3720113905-2448826761-1402061820-1001_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 -> C:\Users\Anthony\AppData\Local\Microsoft\OneDrive\17.3.6816.0313\amd64\FileSyncShell64.dll => Pas de fichier
CustomCLSID: HKU\S-1-5-21-3720113905-2448826761-1402061820-1001_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 -> C:\Users\Anthony\AppData\Local\Microsoft\OneDrive\17.3.6816.0313\amd64\FileSyncShell64.dll => Pas de fichier
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => -> Pas de fichier
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => -> Pas de fichier
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => -> Pas de fichier
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => -> Pas de fichier
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => -> Pas de fichier
ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => -> Pas de fichier
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Pas de fichier
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Pas de fichier
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => -> Pas de fichier
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => -> Pas de fichier
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => -> Pas de fichier
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => -> Pas de fichier
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => -> Pas de fichier
ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => -> Pas de fichier
ContextMenuHandlers01: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => -> Pas de fichier
ContextMenuHandlers06: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => -> Pas de fichier
ContextMenuHandlers06: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => -> Pas de fichier
Task: {29E6BFBD-8335-4F2F-9124-C90AAE25DEA2} - \WPD\SqmUpload_S-1-5-21-3720113905-2448826761-1402061820-1001 -> Pas de fichier <==== ATTENTION
Task: {65F6C11E-4E93-4152-A6A1-24905B09C73E} - \CCleanerSkipUAC -> Pas de fichier <==== ATTENTION
AlternateDataStreams: C:\ProgramData\Reprise:wupeogjxlctlfudivq`qsp`28hfm [0]

EmptyTemp:
end