start::
CreateRestorePoint:
CloseProcesses:
Hosts:
C:\Program Files (x86)\AOMEI Backupper
(Shenzhen Yi Xing Investment Co., Ltd. -> iSkySoft) C:\Program Files (x86)\Common Files\iSkysoft\iSkysoft Helper Compact\ISHelper_IObitDel.exe
C:\Program Files (x86)\Common Files\iSkysoft
HKLM-x32\...\Run: [TrueImageMonitor.exe] => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files (x86)\Acronis
HKU\S-1-5-21-839415701-666322219-2596237878-1001\...\Policies\Explorer: [NoInstrumentation] 1
HKU\S-1-5-21-839415701-666322219-2596237878-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks]
GroupPolicy: Restriction ? <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
CHR HomePage: Default -> hxxps://mail.ru/cnt/10445?gp=811570
S0 ambakdrv; C:\WINDOWS\System32\ambakdrv.sys [51120 2016-12-21] (CHENGDU AOMEI Tech Co., Ltd. -> )
R2 ammntdrv; C:\WINDOWS\system32\ammntdrv.sys [171952 2016-12-21] (CHENGDU AOMEI Tech Co., Ltd. -> )
R2 amwrtdrv; C:\WINDOWS\System32\amwrtdrv.sys [31248 2021-03-09] (AOMEI International Network Limited -> )
R2 BdDci; C:\WINDOWS\system32\DRIVERS\bddci.sys [367096 2020-11-23] (Bitdefender SRL -> Bitdefender)
R2 file_protector; C:\WINDOWS\System32\DRIVERS\file_protector.sys [721536 2021-01-31] (Acronis International GmbH -> Acronis International GmbH)
R0 file_tracker; C:\WINDOWS\System32\DRIVERS\file_tracker.sys [392840 2021-01-31] (Acronis International GmbH -> Acronis International GmbH)
S3 Imf8HpRegFilter; C:\Program Files (x86)\IObit\IObit Malware Fighter\drivers\win10_amd64\ImfHpRegFilter.sys [41848 2019-12-17] (IObit Information Technology -> IObit)
S3 ImfHpFileFilter; C:\Program Files (x86)\IObit\IObit Malware Fighter\drivers\win10_amd64\ImfHpFileFilter.sys [45432 2019-12-17] (IObit Information Technology -> IObit)
S4 IObitUnlocker; C:\Program Files (x86)\IObit\IObit Unlocker\IObitUnlocker.sys [66824 2017-06-15] (IObit Information Technology -> IObit)
S3 tib; C:\WINDOWS\system32\DRIVERS\tib.sys [887032 2021-01-31] (Acronis International GmbH -> Acronis International GmbH)
R2 tib_mounter; C:\WINDOWS\system32\DRIVERS\tib_mounter.sys [176248 2021-01-31] (Acronis International GmbH -> Acronis International GmbH)
S3 tnd; C:\WINDOWS\system32\DRIVERS\tnd.sys [694920 2021-01-31] (Acronis International GmbH -> Acronis International GmbH)
R2 virtual_file; C:\WINDOWS\System32\DRIVERS\virtual_file.sys [334984 2021-01-31] (Acronis International GmbH -> Acronis International GmbH)
R0 volume_tracker; C:\WINDOWS\System32\DRIVERS\volume_tracker.sys [251016 2021-01-31] (Acronis International GmbH -> Acronis International GmbH)
2021-03-09 20:36 - 2021-03-09 20:36 - 001205312 _____ (AVG Technologies) C:\Users\moi\Downloads\avg_tuneup_online_setup.exe
2021-03-07 19:27 - 2018-07-17 18:06 - 000000000 ____D C:\Users\moi\Downloads\AOMEI OneKey Recovery Professional 1.6.2 - [Anglais] + Crack - [Win Xp .. Win 10] [Lirvaavril20]
2021-03-07 19:26 - 2021-03-07 19:26 - 018991630 _____ C:\Users\moi\Downloads\AOMEI OneKey Recovery Professional 1.6.2 - [Anglais] + Crack - [Win Xp .. Win 10] [Lirvaavril20]...wawacity.ec...zip
2021-03-03 22:27 - 2021-03-03 22:27 - 000012691 _____ C:\ProgramData\merjmevq.cmt
2021-03-02 08:24 - 2021-03-02 08:24 - 000000000 ____D C:\Users\moi\AppData\Local\JxBrowser
2021-03-02 08:24 - 2021-03-02 08:24 - 000000000 ____D C:\Users\moi\AppData\Local\Chromium
2021-03-09 20:22 - 2021-01-30 16:41 - 000000000 ____D C:\Users\moi\AppData\Roaming\IObit
2021-03-09 20:17 - 2021-01-30 17:05 - 000000000 ____D C:\Program Files (x86)\EaseUS
2021-03-09 20:16 - 2021-01-31 18:20 - 000000000 ____D C:\Program Files\EaseUS
2021-03-09 19:42 - 2021-01-30 16:43 - 000000000 ____D C:\Program Files (x86)\IObit
2021-03-09 19:39 - 2021-01-31 12:24 - 000000000 ____D C:\Program Files (x86)\AOMEI
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> Pas de fichier
FirewallRules: [{FD5FD832-7CDE-4E95-A5B6-47594AE3A8DA}] => (Allow) C:\Program Files (x86)\AOMEI\AOMEI Backupper 6.3.0\ABService.exe (AOMEI International Network Limited -> AOMEI International Network Limited)
FirewallRules: [{842F0B94-1C85-4BDE-929E-53C1861CB24A}] => (Allow) C:\Program Files (x86)\AOMEI\AOMEI Backupper 6.3.0\ABService.exe (AOMEI International Network Limited -> AOMEI International Network Limited)
FirewallRules: [{F589C1F3-D56B-4B77-8CAA-6CF42FFEDA0E}] => (Allow) C:\Program Files (x86)\AOMEI Backupper\AOMEI Backupper 6.3.0\ABService.exe (AOMEI International Network Limited -> AOMEI International Network Limited)
FirewallRules: [{BE8786EF-1093-4EC5-8BA1-C4D3B61960FF}] => (Allow) C:\Program Files (x86)\AOMEI Backupper\AOMEI Backupper 6.3.0\ABService.exe (AOMEI International Network Limited -> AOMEI International Network Limited)
C:\Program Files (x86)\AOMEI
FirewallRules: [{6A97A5B0-0D3A-45C5-A599-69B2D9FCCC26}] => (Allow) C:\Program Files (x86)\AOMEI Backupper\AOMEI Backupper 6.3.0\ABService.exe (AOMEI International Network Limited -> AOMEI International Network Limited)
FirewallRules: [{3A73F644-E053-474A-94F4-5BE8DFD320AB}] => (Allow) C:\Program Files (x86)\AOMEI Backupper\AOMEI Backupper 6.3.0\ABService.exe (AOMEI International Network Limited -> AOMEI International Network Limited)
EmptyTemp:
cmd: ipconfig /flushdns
cmd: netsh advfirewall reset
cmd: netsh winsock reset
end::