start::
Hosts:
Removeproxy:
CreateRestorePoint:
CloseProcesses:
GroupPolicy: Restriction ? <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\WINDOWS\System32\AutoWorkplace.exe join (Pas de fichier)
2023-03-23 15:55 - 2023-03-23 17:37 - 000000000 ____D C:\ProgramData\scre..tion_2c2536e5112611c9_0006.0003_39c09fe61ab0e414
2020-06-05 15:17 - 2020-06-05 15:17 - 024166400 _____ () C:\Program Files (x86)\GUT11F6.tmp
2020-06-02 15:06 - 2020-06-02 15:06 - 024166400 _____ () C:\Program Files (x86)\GUT295C.tmp
2020-06-08 20:17 - 2020-06-08 20:17 - 024166400 _____ () C:\Program Files (x86)\GUT2F72.tmp
2020-06-05 21:17 - 2020-06-05 21:17 - 024166400 _____ () C:\Program Files (x86)\GUT5661.tmp
2020-06-04 14:01 - 2020-06-04 14:01 - 024166400 _____ () C:\Program Files (x86)\GUT6286.tmp
2020-06-06 11:31 - 2020-06-06 11:31 - 024166400 _____ () C:\Program Files (x86)\GUT6E62.tmp
2020-06-08 09:42 - 2020-06-08 09:42 - 024166400 _____ () C:\Program Files (x86)\GUT767C.tmp
2020-06-07 09:38 - 2020-06-07 09:38 - 024166400 _____ () C:\Program Files (x86)\GUT8ACE.tmp
2020-06-08 14:42 - 2020-06-08 14:42 - 024166400 _____ () C:\Program Files (x86)\GUTAB2F.tmp
2020-06-05 09:18 - 2020-06-05 09:18 - 024166400 _____ () C:\Program Files (x86)\GUTC151.tmp
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ScreenConnect Client (78114e27-c308-4bff-a57a-b38ea39f4f60) => ""="Service"
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPDSK14/3
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKLM -> {70621E24-04F6-4972-BB5A-D72A1C1F0B4D} URL = hxxp://www.amazon.fr/s/ref=azs_osd_ieafr?ie=UTF-8&tag=hp-fr1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKLM-x32 -> {70621E24-04F6-4972-BB5A-D72A1C1F0B4D} URL = hxxp://www.amazon.fr/s/ref=azs_osd_ieafr?ie=UTF-8&tag=hp-fr1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-2544813561-2288977645-303748543-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2544813561-2288977645-303748543-1001 -> {70621E24-04F6-4972-BB5A-D72A1C1F0B4D} URL = hxxp://www.amazon.fr/s/ref=azs_osd_ieafr?ie=UTF-8&tag=hp-fr1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
IE trusted site: HKU\S-1-5-21-2544813561-2288977645-303748543-1001\...\mozilla%20firefox -> hxxps://mozilla%20firefox
FirewallRules: [{A5E256AC-CDFC-48D7-B9D1-CE0CB8B6FFC9}] => (Allow) C:\Users\Jacques\AppData\Roaming\Zoom\bin\airhost.exe => Pas de fichier
FirewallRules: [{EACAB5F1-FA72-46B6-BE15-CB8BD62A0DE9}] => (Allow) C:\Users\Jacques\AppData\Roaming\Zoom\bin\airhost.exe => Pas de fichier
FirewallRules: [TCP Query User{2D9AEF26-AF40-452F-8881-5E5F0D1F4D5F}C:\program files (x86)\smart view\smart view.exe] => (Allow) C:\program files (x86)\smart view\smart view.exe => Pas de fichier
FirewallRules: [UDP Query User{4A01E5DF-1D82-44C9-B90C-AB88A6B9B8CE}C:\program files (x86)\smart view\smart view.exe] => (Allow) C:\program files (x86)\smart view\smart view.exe => Pas de fichier
FirewallRules: [TCP Query User{CFDD8DBB-0AF6-4944-8F8C-D77D41045904}C:\program files (x86)\smart view\smart view.exe] => (Allow) C:\program files (x86)\smart view\smart view.exe => Pas de fichier
FirewallRules: [UDP Query User{3D1C485F-F889-405B-9A43-F20B7A609909}C:\program files (x86)\smart view\smart view.exe] => (Allow) C:\program files (x86)\smart view\smart view.exe => Pas de fichier
FirewallRules: [{665DFBFB-F484-4E15-89C7-70204A98C62E}] => (Allow) C:\Users\Jacques\AppData\Roaming\Zoom\bin\airhost.exe => Pas de fichier
cmd: ipconfig /flushdns
cmd: netsh advfirewall reset
cmd: netsh winsock reset
cmd: sfc /scannow
EmptyEventLogs:
EmptyTemp:
end::