Start::
CreateRestorePoint:
CloseProcesses:
DeleteValue: HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run|Sidebar
DeleteValue: HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run|Sidebar
DeleteKey: HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Free RAR Extract Frog 1.00
DeleteKey: HKLM\SOFTWARE\WOW6432Node\Philipp Winterberg
DeleteKey: HKCU\SOFTWARE\Philipp Winterberg
DeleteKey: HKU\S-1-5-21-218192996-1932560055-4006761034-1000\SOFTWARE\Philipp Winterberg
DeleteKey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Free RAR Extract Frog 1.00
DeleteKey: HKLM\SOFTWARE\WOW6432Node\Babylon
C:\ProgramData\Babylon
C:\Users\Ron\AppData\Roaming\Babylon
C:\Users\Ron\AppData\Local\Babylon
C:\Users\Ron\AppData\Roaming\Mozilla\FireFox\Profiles\gfzt40tk.default\Pref.js
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
FF Plugin: @microsoft.com/GENUINE -> disabled [Pas de fichier]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Pas de fichier]
S3 EverestDriver; \??\C:\Users\Ron\AppData\Local\Temp\EverestDriver.sys [X] <==== ATTENTION
S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [X]
EmptyTemp:
Hosts:
End::