start::
CreateRestorePoint:
CloseProcesses:
Hosts:
RemoveProxy:
EmptyTemp:
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\e-Backup 1.42 Scheduler.lnk [2019-01-03]
ShortcutTarget: e-Backup 1.42 Scheduler.lnk -> C:\Windows\Installer\{CA217BDD-D941-454C-AA7E-C3ADA1648FE3}\_3e121a49.exe () [Fichier non signé]
SearchScopes: HKU\S-1-5-21-3027360337-4237922873-761848187-1000 -> DefaultScope {9131658F-1A2A-48AD-9174-C65016A4774B} URL = hxxps://www.google.com/search?q=
SearchScopes: HKU\S-1-5-21-3027360337-4237922873-761848187-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3027360337-4237922873-761848187-1000 -> {9131658F-1A2A-48AD-9174-C65016A4774B} URL = hxxps://www.google.com/search?q=
S3 gdrv; \??\C:\Windows\gdrv.sys [X]
S1 MpKsl9661fd38; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{9E0321D7-9469-4C7E-B545-1D9D6504F2C6}\MpKsl9661fd38.sys [X]
2019-03-19 11:47 - 2019-03-19 11:47 - 003115392 _____ C:\Users\Anne\ZHPCleaner.exe
2019-03-19 11:42 - 2019-03-19 13:50 - 000000000 ____D C:\Users\Anne\AppData\Roaming\ZHP
2019-03-17 08:17 - 2019-01-03 18:53 - 000000000 ____D C:\ProgramData\TuneUp Software
2019-03-15 09:56 - 2019-01-03 13:16 - 000000000 ____D C:\Program Files (x86)\Imbued
2019-03-19 11:47 - 2019-03-19 11:47 - 003115392 _____ () C:\Users\Anne\ZHPCleaner.exe
Task: {200F1863-2D7C-44FD-A225-C7DADA104508} - System32\Tasks\bierce_intercedesbierce_intercedes => C:\Users\Anne\AppData\Local\Runtime.exe
Task: {240326B0-086D-4254-A63B-0446D4675029} - System32\Tasks\immunizing-southwesternimmunizing-southwestern => C:\Program Files (x86)\addled\Runtime.exe
Task: {42A1548D-78DF-4F9E-88A1-5CC69F41C0FD} - System32\Tasks\majerusmajerus => C:\Program Files (x86)\finlayson\finlayson.exe
Task: {9B27F181-057E-4245-ACE1-C9297BB9BA25} - System32\Tasks\antedatedantedated => C:\Program Files (x86)\Newsletters\Groping.exe
Task: {CF162D65-1189-425E-8A02-BD220FE8AC19} - System32\Tasks\Eteindre PC => shutdown [Argument = /S]
Task: {D0B913AA-F01A-40A1-9509-935D4C42931F} - System32\Tasks\bouillon banjul nantucketbouillon banjul nantucket => C:\Users\Anne\AppData\Local\Groping.exe
Task: {F5460F1D-D9DA-4320-AEE7-7E795C5B7574} - System32\Tasks\Tweaking.com - Windows Repair Tray Icon => C:\Program Files (x86)\Tweaking.com\Windows Repair
Task: {FAF99EB3-2911-48AD-B32F-BAF0E4333657} - System32\Tasks\firefly_boormanfirefly_boorman => C:\Program Files (x86)\Bounces\Groping.exe
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppXSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BFE => ""="Service"
cmd: ipconfig /flushdns
end::