start::
closeprocesses:
createrestorepoint:
FF HKU\S-1-5-21-2008536419-425765924-1411247669-1001\...\Firefox\Extensions: [ISAllmytube@iSkysoft.com] - C:\Program Files (x86)\Aimersoft\Aimersoft iTube Studio\BrowserPlugin\isallmytube@iskysoft.com_xpi => non trouvé(e)
CHR StartupUrls: Default -> "hxxp://www.google.com/","hxxp://fr.yhs4.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_secureddownload_15_39¶m1=1¶m2=f%3D7%26b%3DChrome%26cc%3Dfr%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzuyCtDtDtBzytB0AyC0CtB0DtBtAzyzz0FtN0D0Tzu0StCtAyCtBtN1L2XzutAtFtCtBtFyDtFtAtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2Szz0B0CtAyB0C0FyCtG0DtDzztDtGyEtDtCtCtGzyzzyC0EtGyC0E0EyDyD0ByC0BtCyD0E0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyD0FyBtD0DzytB0BtGtCtC0F0DtGyE0E0BtDtGzytBtB0CtGyBtCyEyDtB0AtCyEyD0AtBtC2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCtDyEyB%26cr%3D518473886%26a%3Dwncy_secureddownload_15_39%26os%3DWindows%2B10%2BPro"
2020-01-28 14:46 - 2020-01-28 14:52 - 000003166 _____ C:\WINDOWS\System32\Tasks\AdBlock Master
2020-01-28 14:39 - 2020-01-30 11:30 - 000000000 ____D C:\Program Files (x86)\AdBlock Master
2020-01-28 14:33 - 2020-01-28 14:34 - 001273280 _____ (Major Share (MajorShare.com) ) C:\Users\cyril\Downloads\setup-remove-ads.exe
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Pas de fichier
Task: {8CC42657-DF81-46F6-B440-585AE7E76D29} - System32\Tasks\AdBlock Master => C:\Program Files (x86)\AdBlock Master\AdBlock.exe <==== ATTENTION
C:\Program Files (x86)\AdBlock Master
AlternateDataStreams: C:\Users\cyril\OneDrive\Documents\Rappel de votre commande_files:${3D0CE612-FDEE-43f7-8ACA-957BEC0CCBA0}.Metadata [194]
IE trusted site: HKU\S-1-5-21-2008536419-425765924-1411247669-1001\...\webcompanion.com -> hxxp://webcompanion.com
FirewallRules: [{9E7F4367-CA09-4AA6-AE71-89C8E9A567B7}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe Pas de fichier
FirewallRules: [{532515B1-F2C2-485F-B837-BF7EC62CEB6D}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe Pas de fichier
hosts:
cmd: DISM /Online /Cleanup-image /Restorehealth
emptytemp:
end::