start::
closeprocesses:
createrestorepoint:
AlternateDataStreams: C:\ProgramData\PACE:C0F4BB5C411D032C [217]
HKU\S-1-5-21-125089239-2678507515-3768125389-1001\...\Winlogon: [Shell] C:\Windows\explorer.exe [4615616 2019-11-14] (Microsoft Windows -> Microsoft Corporation) <==== ATTENTION
GroupPolicy: Restriction ? <==== ATTENTION
Task: {598C4977-2439-40A1-94AE-6F8340911B56} - System32\Tasks\Driver Booster Update => C:\Program Files (x86)\IObit\Driver Booster\7.2.0\AutoUpdate.exe
Task: {10CB6298-BA97-4A1B-B00C-D777339DBD75} - System32\Tasks\AdwCleaner_onReboot => C:\Users\Utilisateur\Downloads\adwcleaner_8.0.2.exe
C:\Program Files (x86)\IObit
Task: {A390E757-B32F-45DF-AD53-EE76432FA459} - System32\Tasks\Driver Booster SkipUAC (Utilisateur) => C:\Program Files (x86)\IObit\Driver Booster\7.2.0\DriverBooster.exe
SearchScopes: HKU\S-1-5-21-125089239-2678507515-3768125389-1001 -> DefaultScope {A02B6B18-F463-40D6-809C-087AC9171A6D} URL =
SearchScopes: HKU\S-1-5-21-125089239-2678507515-3768125389-1001 -> {A790FD3C-AD38-4E1E-8CA1-5CEEB3AB9C1E} URL =
R2 PaceLicenseDServices; "C:\Program Files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe" -u https://activation.paceap.com/InitiateActivation [X]
S3 QALSvc; "C:\Program Files\Acer\Acer Quick Access\QALSvc.exe" [X]
S3 QASvc; "C:\Program Files\Acer\Acer Quick Access\QASvc.exe" [X]
S3 UEIPSvc; "C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe" [X]
U4 AppMgmt; pas de ImagePath
U4 CscService; pas de ImagePath
U4 napagent; pas de ImagePath
U4 PeerDistSvc; pas de ImagePath
2020-02-11 00:33 - 2020-02-11 00:33 - 000003202 _____ C:\WINDOWS\system32\Tasks\Driver Booster Update
2020-02-11 00:33 - 2020-02-11 00:33 - 000002988 _____ C:\WINDOWS\system32\Tasks\Driver Booster SkipUAC (Utilisateur)
2020-02-11 00:27 - 2020-02-11 00:27 - 138825728 _____ C:\WINDOWS\system32\config\SOFTWARE.iobit
2020-02-11 00:27 - 2020-02-11 00:27 - 002916352 _____ C:\WINDOWS\system32\config\DEFAULT.iobit
2020-02-11 00:27 - 2020-02-11 00:27 - 000069632 _____ C:\WINDOWS\system32\config\SAM.iobit
2020-02-11 00:27 - 2020-02-11 00:27 - 000045056 _____ C:\WINDOWS\system32\config\SECURITY.iobit
2020-02-11 00:21 - 2020-02-11 01:22 - 000000000 ___DC C:\Users\Utilisateur\AppData\LocalLow\IObit
2020-02-11 00:21 - 2020-02-11 00:33 - 000000000 ____D C:\ProgramData\ProductData
2020-02-11 00:21 - 2020-02-11 00:21 - 000000000 ____D C:\WINDOWS\Tasks\ImCleanDisabled
2020-02-11 00:21 - 2020-02-11 00:21 - 000000000 ____D C:\ProgramData\{F86B0233-9A85-4589-8AAF-524CC4F8211B}
2020-02-11 00:20 - 2020-02-11 10:42 - 000000000 ____D C:\Users\Utilisateur\AppData\Roaming\IObit
2020-02-11 00:20 - 2020-02-11 10:42 - 000000000 ____D C:\ProgramData\IObit
2020-02-11 00:20 - 2020-02-11 01:33 - 000000000 ____D C:\Program Files (x86)\IObit
2020-02-11 10:54 - 2018-09-08 19:48 - 000000000 ____D C:\Program Files\N2JiZDRkMDkx
cmd: reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinHttpAutoProxySvc
cmd: md C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database
emptytemp:
end::