start::
closeprocesses:
createrestorepoint:
virustotal: C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
Task: {D8931923-F50B-44BC-92C2-26C45D786C1E} - System32\Tasks\Microsoft\Windows\Application Experience\StartupCheckLibrary => rundll32.exe StartupCheckLibrary.dll,DllMainRunLibrary
GroupPolicy: Restriction ? <==== ATTENTION
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
C:\Program Files (x86)\Common Files\Wondershare
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2137744 2016-10-08] (Wondershare software CO., LIMITED -> Wondershare)
HKLM\...\Policies\Explorer: [HideSCAHealth] 1
SearchScopes: HKU\S-1-5-21-2681328790-3857945367-2305706566-1001 -> DefaultScope {0B62DBC8-65D5-4869-AA17-739A5F1F7987} URL =
SearchScopes: HKU\S-1-5-21-2681328790-3857945367-2305706566-1001 -> {0B62DBC8-65D5-4869-AA17-739A5F1F7987} URL =
CHR StartupUrls: Default -> "hxxp://mystart.incredibar.com/?a=6PQAEC9PIz&loc=skw","","hxxps://fr.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_togoo_16_14&param1=1&param2=f%3D7%26b%3Dchmm%26cc%3Dfr%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0CzzyCtDtDtDtDtAyBtAyBtC0E0C0C0FtN0D0Tzu0StCyDyDyBtN1L2XzutAtFtBtDtFtDtFtDtN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2StC0D0CyEzytCyC0CtGtDyEtCtBtGyE0AtC0BtGtDyB0B0AtGtB0BzyzyyE0D0Ezy0F0F0F0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtD0ByC0DzyyB0EtGyE0BtA0EtGyEzz0FtAtG0AyBtB0DtGzz0BtB0C0C0D0FyE0AtAyEyB2QtN0A0LzuyE%26cr%3D1428426815%26a%3Dwbf_togoo_16_14%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome&uref=chmm"
HKLM\...\StartupApproved\Run32: => "Wondershare Helper Compact.exe"
emptytemp:
end::