start::
closeprocesses:
createrestorepoint:
CustomCLSID: HKU\S-1-5-21-3487870704-3176804824-3532619853-1001_Classes\CLSID\{0D327DA6-B4DF-4842-B833-2CFF84F0948F}\localserver32 -> C:\Program Files\Autodesk\AutoCAD 2017\acad.exe /Automation => Pas de fichier
CustomCLSID: HKU\S-1-5-21-3487870704-3176804824-3532619853-1001_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 -> C:\Users\holra\AppData\Local\Microsoft\OneDrive\18.065.0329.0002\amd64\FileSyncShell64.dll => Pas de fichier
CustomCLSID: HKU\S-1-5-21-3487870704-3176804824-3532619853-1001_Classes\CLSID\{720DB9AF-D62C-4ED0-A377-429C22312852}\localserver32 -> C:\Program Files\Autodesk\AutoCAD 2017\acad.exe => Pas de fichier
CustomCLSID: HKU\S-1-5-21-3487870704-3176804824-3532619853-1001_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 -> C:\Users\holra\AppData\Local\Microsoft\OneDrive\18.065.0329.0002\amd64\FileSyncShell64.dll => Pas de fichier
CustomCLSID: HKU\S-1-5-21-3487870704-3176804824-3532619853-1001_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 -> C:\Users\holra\AppData\Local\Microsoft\OneDrive\18.065.0329.0002\amd64\FileSyncShell64.dll => Pas de fichier
Task: {40338CC3-F748-4935-93D6-E2A27C92420E} - System32\Tasks\McAfee\McAfee Auto Maintenance Task Agent
Task: {41A848E0-33EF-4BCF-A5D5-E98F2028BF26} - System32\Tasks\McAfeeLogon => C:\Program Files\Common Files\McAfee\platform\McUICnt.exe [2017-05-31] (McAfee, Inc.)
Task: {4FA19A66-DF57-42D3-8C7C-F2AC1B635D76} - System32\Tasks\McAfee\McAfee Idle Detection Task
HKU\S-1-5-21-3487870704-3176804824-3532619853-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://fr.yahoo.com/?fr=yset_ie_syc_oracle&type=orcl_hpset
SearchScopes: HKU\S-1-5-21-3487870704-3176804824-3532619853-1001 -> DefaultScope {346A4930-695C-4B60-BEE4-CE249A028B89} URL =
SearchScopes: HKU\S-1-5-21-3487870704-3176804824-3532619853-1001 -> {346A4930-695C-4B60-BEE4-CE249A028B89} URL =
SearchScopes: HKU\S-1-5-21-3487870704-3176804824-3532619853-1001 -> {5E1FB75B-365B-4400-9629-9176E8B38EBA} URL = hxxps://fr.search.yahoo.com/search?p={searchTerms}&intl=fr&fr=yset_ie_syc_oracle&type=orcl_default&partnerexternal-oracle=external-oracle
CHR DefaultSearchURL: Default -> hxxps://fr.search.yahoo.com/search?p={searchTerms}&fr=yset_chr_syc_oracle&type=default
CHR DefaultSearchKeyword: Default -> Yahoo
CHR DefaultSuggestURL: Default -> hxxps://fr.search.yahoo.com/sugg/ie?output=fxjson&command={searchTerms}&nResults=10
cmd: ipconfig /flushdns
emptytemp:
end::