Custom search bar

Start::
CreateRestorePoint:
CloseProcesses:
HKLM-x32\...\RunOnce: [GrpConv] => grpconv -o (Pas de fichier)
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Restriction 
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Restriction
HKLM\Software\...\Authentication\Credential Providers: [{503739d0-4c5e-4cfd-b3ba-d881334f0df2}] -> 
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction 
HKLM\SOFTWARE\Policies\Google: Restriction 
HKLM\SOFTWARE\Policies\Microsoft\Edge: Restriction
Task: {06D937B3-7F89-4768-A0D2-AD88EE0AD282} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\WINDOWS\ehome\MCUpdate.exe -pscn 0 (Pas de fichier)
Task: {0B037F22-9BC0-412E-B195-B7E6E734EDBC} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\WINDOWS\ehome\ehPrivJob.exe /DoUpdateRecordPath $(Arg0) (Pas de fichier)
Task: {0FC1FD17-0672-40D4-8AFD-D843C8A8E8C8} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\WINDOWS\ehome\ehPrivJob.exe /OCURDiscovery $(Arg0) (Pas de fichier)
Task: {0FC50AE4-C9FD-4573-8C8F-671112F4C010} - System32\Tasks\MicrosoftWindowsUpdaterTask_PR1 => powershell -File C:/Windows/System32/WindowsUpdater1.ps1 
Task: {106D1B4E-1426-41E9-AF11-8E03CDAB1B3D} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\WINDOWS\ehome\ehPrivJob.exe /DRMInit (Pas de fichier)
Task: {121926EB-F853-4AC1-A99A-C60EF37F0D10} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\WINDOWS\ehome\ehPrivJob.exe /DoRecoveryTasks $(Arg0) (Pas de fichier)
Task: {17F83A28-0147-4C23-8975-0B1A62235762} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\WINDOWS\ehome\mcupdate.exe -crl -hms -pscn 15 (Pas de fichier)
Task: {1E5F3246-D2F4-47DB-8B75-8E4F8F70936A} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\WINDOWS\ehome\mcupdate.exe $(Arg0) (Pas de fichier)
Task: {2767EAC5-7479-4AA6-9050-AB6BFBD9DAD2} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\WINDOWS\ehome\ehPrivJob.exe /wait:90 /PBDADiscovery (Pas de fichier)
Task: {2BEB7698-FE9F-4FB9-828A-9503138BCA47} - \Microsoft\Windows\Setup\EOSNotify -> Pas de fichier 
Task: {2CA2734F-C90E-47AB-840A-C723CE7C7BC6} - System32\Tasks\{2B1F0CBB-788B-46A6-81DB-3E3B5024A173} => D:\MUSIQUE.EXE (Pas de fichier)
Task: {2D3A615F-039D-4236-A910-4C1F82D3C795} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\WINDOWS\ehome\mcupdate.exe -PvrSchedule (Pas de fichier)
Task: {33E912EE-70DB-4119-AA32-A34363A4B2A3} - \Microsoft\Windows\Setup\EOSNotify2 -> Pas de fichier 
Task: {38891046-8FBA-4D7B-8F98-D1F296010EF5} - System32\Tasks\{BB28C10B-8083-43E7-A619-13786657E75C} => D:\MUSIQUE.EXE (Pas de fichier)
Task: {388B110D-8461-45B2-BA94-B65F42AA9392} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe -MediaCenterRecoveryTask (Pas de fichier)
CHR DefaultSearchURL: Profile 1 -> hxxps://customsearchbar.me/search?q={searchTerms}&s=rg_om&u=%USERID%
CHR DefaultSearchURL: Profile 2 -> hxxps://customsearchbar.me/search?q={searchTerms}&s=rg_om&u=%USERID%
CHR DefaultSearchURL: Profile 3 -> hxxps://customsearchbar.me/search?q={searchTerms}&s=rg_om&u=%USERID%
CHR DefaultSearchURL: Profile 4 -> hxxps://customsearchbar.me/search?q={searchTerms}&s=rg_om&u=%USERID%
CHR DefaultSearchURL: Profile 5 -> hxxps://customsearchbar.me/search?q={searchTerms}&s=rg_om&u=%USERID%
Task: {49758AFA-28FB-43C5-865E-471EFF1E0128} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe -PvrRecoveryTask (Pas de fichier)
Task: {5FFCBF97-49D6-43E0-8668-E691E42766EB} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe -SqlLiteRecoveryTask (Pas de fichier)
Task: {615D6A78-4BE6-40F8-A65B-5B7D62EE9C60} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\WINDOWS\ehome\ehPrivJob.exe /wait:7 /PBDADiscovery (Pas de fichier)
Task: {638D4F3A-A5FA-4111-ADA7-0D95E916975C} - System32\Tasks\{9FE3856B-76D6-4538-A8AD-6835549B2C73} => D:\MUSIQUE.EXE (Pas de fichier)
Task: {6E2F65D9-F1E8-4B90-8EBA-E8DF6386BEDE} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe -ObjectStoreRecoveryTask (Pas de fichier)
Task: {6F65C162-5E83-42D1-8B32-5004AE7D1E6C} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\WINDOWS\ehome\ehPrivJob.exe /DoConfigureInternetTimeService (Pas de fichier)
Task: {744D49A3-4EBD-4D89-9CF8-17B4FACAFA14} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\WINDOWS\ehome\ehPrivJob.exe /DoRegisterSearch $(Arg0) (Pas de fichier)
Task: {7A072071-99D4-4839-A387-F1099197413D} - System32\Tasks\{9A7A6543-0168-45B5-9252-78C0AD2EC8D3} => "c:\program files (x86)\google\chrome\application\chrome.exe" hxxps://ui.skype.com/ui/0/7.39.0.102/fr/go/help.faq.installer?source=lightinstaller&LastError=1618
Task: {7EBDD1A7-CF58-4717-AC82-84FD661C02C9} - System32\Tasks\{1DBEB071-45B1-4337-9619-C57737C944F3} => D:\MUSIQUE.EXE (Pas de fichier)
Task: {840E0950-8CDD-46FC-813F-3BAF1503872C} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\WINDOWS\ehome\ehrec.exe /RestartRecording (Pas de fichier)
Task: {844AD330-B3D3-40AC-8AFF-BFAF3613A6E0} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\WINDOWS\ehome\ehrec.exe /StartRecording (Pas de fichier)
Task: {9364FEA9-11A6-4E20-8505-16DCBD6C7B80} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\WINDOWS\ehome\ehPrivJob.exe /InstallPlayReady $(Arg0) (Pas de fichier)
Task: {999F56FA-6D63-4018-AE09-58C1D7041545} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe /backup /iavs (Pas de fichier)
Task: {9D2AFC2D-B607-4F82-AA61-92AA875607E3} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\WINDOWS\ehome\ehPrivJob.exe /OCURActivate (Pas de fichier)
Task: {A0A8A9A5-A4D2-408E-8208-2E6B211CCBE0} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\WINDOWS\ehome\ehPrivJob.exe /DoActivateWindowsSearch (Pas de fichier)
Task: {AFF981C6-67F7-459B-9299-B0878CFA1E1B} - System32\Tasks\MicrosoftEdgeUpdateTaskMachineUA1d6abc21cea59d3 => C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe /ua /installsource scheduler (Pas de fichier)
Task: {C455BA62-8A19-4DBB-B741-0D7888F764DE} - System32\Tasks\{73A32D4F-19A0-4E7F-B620-DCAB1FCB6517} => D:\MUSIQUE.EXE (Pas de fichier)
Task: {C5FF64EC-77BB-427F-A8F3-78C73242DFA5} - System32\Tasks\MicrosoftWindowsUpdaterTask_PR1_2 => powershell -File C:/Windows/System32/WindowsUpdater1.ps1 
2022-06-04 18:36 - 2022-06-25 00:02 - 000002584 _____ C:\WINDOWS\system32\Tasks\MicrosoftWindowsUpdaterTask_PR1
2022-06-04 18:36 - 2022-06-25 00:02 - 000002550 _____ C:\WINDOWS\system32\Tasks\MicrosoftWindowsUpdaterTask_PR1_2
Task: {CBAC5F74-3476-4E54-9656-11B22108C19B} - System32\Tasks\{2732ED5A-7B1E-4852-B2E2-440C156E5A42} => D:\MUSIQUE.EXE (Pas de fichier)
Task: {CF1C0212-DC1C-4FE4-98CD-4EEABABD08C1} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\WINDOWS\ehome\ehPrivJob.exe /DoReindexSearchRoot (Pas de fichier)
Task: {CF2DD5EB-B5A4-4461-B9DB-66E1CD46D454} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\WINDOWS\ehome\ehPrivJob.exe /PBDADiscovery (Pas de fichier)
Task: {F1750AAE-2C7A-480D-A265-C3E9267B6E04} - System32\Tasks\MicrosoftEdgeUpdateTaskMachineCore => C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe /c (Pas de fichier)
Task: {F3F54A0C-EDAE-4450-9983-D7A4E5CFBA2B} - System32\Tasks\SafeZone scheduled Autoupdate 1477633769 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe --scheduledautoupdate $(Arg0) (Pas de fichier)
Edge DefaultSearchURL: Default -> hxxps://nortonsafe.search.ask.com/web?omnisearch=yes&q={searchTerms}
Edge DefaultSearchKeyword: Default -> nortonsafe
Edge DefaultSuggestURL: Default -> hxxps://ss-sym.search.ask.com/ss?q={searchTerms}&li=ff
HKLM\...\Run: [IntelTBRunOnce] => wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" (Pas de fichier)
HKLM-x32\...\RunOnce: [GrpConv] => grpconv -o (Pas de fichier)
HKU\S-1-5-21-1097109468-1890852260-1143116022-1000\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (Pas de fichier)
S2 edgeupdate; "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc [X]
S3 edgeupdatem; "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /medsvc [X]
U3 idsvc; pas de ImagePath
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> Pas de fichier
AlternateDataStreams: C:\2019 Nov3-9  Polar Bear Set TV:com.dropbox.attrs [54]
HKLM\software\microsoft\Windows\CurrentVersion\Telephony\Providers => ProviderFileName2 -> ndptsp.tsp (Pas de fichier)
FirewallRules: [{3DCBEE80-FDCA-4504-924A-A312C81A27F1}] => (Allow) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe => Pas de fichier
FirewallRules: [{80D2EB2C-BC9E-4690-9DB5-A5993339D8BF}] => (Allow) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe => Pas de fichier
FirewallRules: [{BFE5F3D1-1A60-44A9-BB30-34214B125225}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe => Pas de fichier
FirewallRules: [{FD1E5DA4-801D-4735-9BF0-F6665282F187}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe => Pas de fichier
FirewallRules: [{A1D15144-8C46-474D-A050-91A89D09CEF2}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe => Pas de fichier
FirewallRules: [{F92194BB-4956-4AEE-9B71-2F1C844E4AAB}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe => Pas de fichier
FirewallRules: [{916BB99E-E91D-4626-B42E-0802E69A1571}] => (Allow) C:\Users\Jean Paul\AppData\Roaming\Zoom\bin_00\Zoom.exe => Pas de fichier
FirewallRules: [{9DCD5000-4EAE-435F-BBBA-7596AED68F4D}] => (Allow) C:\Users\Jean Paul\AppData\Roaming\Zoom\bin_00\airhost.exe => Pas de fichier
FirewallRules: [{3F3659E1-AF9B-45F1-B6F6-AB646E31EEB1}] => (Allow) C:\Users\Jean Paul\AppData\Roaming\Zoom\bin_00\airhost.exe => Pas de fichier
SearchScopes: HKU\S-1-5-21-1097109468-1890852260-1143116022-1001 -> {AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} URL = hxxps://nortonsafe.search.ask.com/web?q={searchTerms}&l=dis&prt=NGC&chn=1000&geo=FR&ver=22.18.0.222&locale=FR_fr&guid=6AC7D26C-FE7B-4CC3-8C30-AD160E5519A7&doi=2019-06-24&o=APN11913&gct=kwd&qsrc=2869
C:/Windows/System32/WindowsUpdater1.ps1 
EmptyTemp:
End::

5- VÉRIFIE ET DIS-MOI SI TON PROBLÈME EST TOUJOURS PRÉSENT

Tous les scripts sont personnalisés et ne doivent pas être utilisés sur un autre pc que celui pour lequel je l'ai composé, donc fait l'analyse FRST et donne les liens des deux rapports.