start::
closeprocesses:
createrestorepoint:
CHR StartupUrls: Default -> "hxxp://www.google.com/","hxxp://search.conduit.com/?ctid=CT3297124&SearchSource=48&CUI=UN18141551520652262&UM=2"
CustomCLSID: HKU\S-1-5-21-3945092751-3844765813-468830225-1000_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 -> C:\Users\Christian\AppData\Local\Microsoft\OneDrive\19.222.1110.0002\amd64\FileSyncShell64.dll => Pas de fichier
CustomCLSID: HKU\S-1-5-21-3945092751-3844765813-468830225-1000_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 -> C:\Users\Christian\AppData\Local\Microsoft\OneDrive\19.222.1110.0002\amd64\FileSyncShell64.dll => Pas de fichier
CustomCLSID: HKU\S-1-5-21-3945092751-3844765813-468830225-1000_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 -> C:\Users\Christian\AppData\Local\Microsoft\OneDrive\19.222.1110.0002\amd64\FileSyncShell64.dll => Pas de fichier
HKLM-x32\...\Run: [Updater] => C:\Program Files (x86)\Updater\updater.exe [6326784 2018-06-05] () [Fichier non signé] <==== ATTENTION
C:\Program Files (x86)\Updater
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2015-12-09] (Apple Inc.) [Fichier non signé]
C:\Program Files (x86)\QuickTime
cmd: DISM /Online /Cleanup-image /Restorehealth
cmd: sfc /scannow
emptytemp:
end::