start::
closeprocesses:
createrestorepoint:
cmd: type C:\Users\jpper\Desktop\ZHPFix.txt
cmd: type C:\Users\jpper\Desktop\ZHPCleaner (R).txt
ContextMenuHandlers1: [PDFCreator.ShellContextMenu] -> {d9cea52e-100d-4159-89ea-76e845bc13e1} => C:\Program Files\PDFCreator\PDFCreatorShell.DLL -> Pas de fichier
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> Pas de fichier
AlternateDataStreams: C:\Users\jpper\OneDrive:${3D0CE612-FDEE-43f7-8ACA-957BEC0CCBA0}.SyncRootIdentity [130]
FirewallRules: [{800750DE-3536-4143-8D1F-0EE84E9C19F5}] => (Allow) C:\Users\jpper\AppData\Local\Temp\DriverPack-2019101674449\tools\aria2c.exe Pas de fichier
FirewallRules: [TCP Query User{EC565F04-0F42-41D3-B1DD-E9087B5F8D40}C:\program files (x86)\java\jre1.8.0_221\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_221\bin\javaw.exe Pas de fichier
FirewallRules: [UDP Query User{8C596018-7A21-4BED-8668-0B99AC1AA19E}C:\program files (x86)\java\jre1.8.0_221\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_221\bin\javaw.exe Pas de fichier
FirewallRules: [{90077A2A-930D-4AE5-8496-49C0BC9A08D0}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14Agent.exe Pas de fichier
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
C:\Program Files (x86)\Common Files\Wondershare
Edge Extension: (AdBlock — best ad blocker) -> EdgeExtension_BetaFishAdBlock_c1wakc4j0nefm => C:\Program Files\WindowsApps\BetaFish.AdBlock_2.13.0.0_neutral__c1wakc4j0nefm [2020-01-10]
CHR Notifications: Default -> hxxps://calendar.google.com; hxxps://courselfan.pro; hxxps://francais.rt.com; hxxps://kulturegeek.fr; hxxps://membership.cyberlink.com; hxxps://mondafrique.com; hxxps://mp3pro.xyz; hxxps://pagesjaunes-by.accengage.net; hxxps://photos.google.com; hxxps://planetes360.fr; hxxps://positivr.fr; hxxps://putop.me; hxxps://smsmms.orange.fr; hxxps://sport.gentside.com; hxxps://twitter.com; hxxps://vf.dpstream.site; hxxps://www.astuces-pratiques.fr; hxxps://www.bonial.fr; hxxps://www.cnetfrance.fr; hxxps://www.conforama.fr; hxxps://www.consoglobe.com; hxxps://www.courrierinternational.com; hxxps://www.dailymercato.com; hxxps://www.duolingo.com; hxxps://www.epson.fr; hxxps://www.facebook.com; hxxps://www.fnac.com; hxxps://www.footballclubdemarseille.fr; hxxps://www.galerieslafayette.com; hxxps://www.igen.fr; hxxps://www.instagram.com; hxxps://www.justacote.com; hxxps://www.lesnumeriques.com; hxxps://www.letour.fr; hxxps://www.melty.fr; hxxps://www.ohmymag.com; hxxps://www.papergeek.fr; hxxps://www.pdfforge.org; hxxps://www.sodapdf.com; hxxps://www.sortir-en-bretagne.fr; hxxps://www.terre-net.fr; hxxps://www.teteamodeler.com; hxxps://www.tvlibertes.com
CHR HKU\S-1-5-21-3303111713-3478932978-1881297655-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh]
S3 WIMMount; \??\C:\Program Files\Macrium\Reflect\wimmount.sys [X]
cmd: md C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database
emptytemp:
end::