start::
closeprocesses:
createrestorepoint:
AV: Symantec Endpoint Protection (Disabled - Up to date) {D13BD399-83A0-E2CF-BE1A-249478F15ABB}
ShellIconOverlayIdentifiers: [00avg] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKU\S-1-5-21-4103905783-786974986-1128566019-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.ask.com?o=10148&l=dis&tb=VDJ
HKU\S-1-5-21-4103905783-786974986-1128566019-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://hp17win10.msn.com/?pc=HCTE
SearchScopes: HKLM -> {1581BCEA-FB5E-4E8B-95E7-354A12945E04} URL = hxxp://www.amazon.co.uk/s/ref=azs_osd_ieauk?ie=UTF-8&tag=hp-uk1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {1581BCEA-FB5E-4E8B-95E7-354A12945E04} URL = hxxp://www.amazon.co.uk/s/ref=azs_osd_ieauk?ie=UTF-8&tag=hp-uk1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-4103905783-786974986-1128566019-1001 -> {140101E4-658E-4E3E-A41B-00CF6D97CA26} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=VDJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=&apn_uid=972CE5DF-F69F-4FB8-86C6-9B4EC9072C1E&apn_sauid=CFEC5448-8775-4B9C-91D3-825B56A1DF49&
SearchScopes: HKU\S-1-5-21-4103905783-786974986-1128566019-1001 -> {1581BCEA-FB5E-4E8B-95E7-354A12945E04} URL = hxxp://www.amazon.co.uk/s/ref=azs_osd_ieauk?ie=UTF-8&tag=hp-uk1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
FirewallRules: [{A0AFC818-28F1-4C4F-B9D9-9B5CF682306C}] => (Allow) C:\Program Files (x86)\Common Files\Mcafee\MMSSHost\MMSSHost.exe => No File
FirewallRules: [{07190EAC-1F89-4529-BE46-58506B966A07}] => (Allow) C:\Program Files\Common Files\McAfee\MMSSHost\MMSSHost.exe => No File
FirewallRules: [{D4071DE6-1899-4B05-94D0-29F52CC87A4F}] => (Allow) C:\Program Files\AVG\Antivirus\AvEmUpdate.exe => No File
FirewallRules: [{F5E80B87-D9E1-4D2F-B861-37E83B2F7070}] => (Allow) C:\Program Files\AVG\Antivirus\AvEmUpdate.exe => No File
FirewallRules: [{65EC659B-697F-44D0-9353-DAD5743BFD4F}] => (Allow) C:\Users\Patrick Anelia\AppData\Local\Programs\Opera\76.0.4017.107\opera.exe => No File
FirewallRules: [{32CED761-842B-49CA-860D-552823AF84C7}] => (Allow) C:\Users\Patrick Anelia\AppData\Roaming\Zoom\bin\airhost.exe => No File
FirewallRules: [{E7A05963-04C1-40A6-B3A1-0A598C48D5CA}] => (Allow) C:\Users\Patrick Anelia\AppData\Roaming\Zoom\bin\airhost.exe => No File
FirewallRules: [{EFD30FAA-59E7-4F43-A814-23AB3652618F}] => (Allow) C:\Users\Patrick Anelia\AppData\Local\Programs\Opera\78.0.4093.147\opera.exe => No File
HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings: [ProxySettingsPerUser] 1 <==== ATTENTION (Restriction - ProxySettings)
Tcpip\Parameters: [DhcpNameServer] 172.20.10.1
Tcpip\..\Interfaces\{f3134d4f-7685-45eb-91e9-8e2d64346268}: [DhcpNameServer] 172.20.10.1
Tcpip\..\Interfaces\{fbf1eaf6-e7b7-46e0-a527-ff79bd2117b1}: [DhcpNameServer] 172.20.10.1
Edge Extension: (No Name) -> AutoFormFill_5ED10D46BD7E47DEB1F3685D2C0FCE08 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\AutoFormFill [not found]
Edge Extension: (No Name) -> LearningTools_7706F933-971C-41D1-9899-8A026EB5D824 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\LearningTools [not found]
CHR Notifications: Default -> hxxps://fr.savefrom.net; hxxps://us05web.zoom.us
OPR Notifications: Opera Stable -> hxxps://push-decdbeb-4073.pushails.com; hxxps://www.youtube.com
S3 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe [359888 2018-04-24] (McAfee, Inc. -> McAfee, LLC)
R2 mfemms; C:\Program Files\Common Files\McAfee\SystemCore\mfemms.exe [519120 2018-04-24] (McAfee, Inc. -> McAfee, LLC)
R2 mfevtp; C:\windows\system32\mfevtps.exe [473552 2018-04-24] (McAfee, Inc. -> McAfee, LLC)
S2 McAPExe; "C:\Program Files\Common Files\McAfee\VSCore_18_5\McApExe.exe" [X]
S3 cfwids; C:\WINDOWS\System32\drivers\cfwids.sys [77216 2018-05-16] (McAfee, Inc. -> McAfee, LLC)
R3 mfeaack; C:\WINDOWS\System32\drivers\mfeaack.sys [497568 2018-05-16] (McAfee, Inc. -> McAfee, LLC)
R3 mfeavfk; C:\WINDOWS\System32\drivers\mfeavfk.sys [361888 2018-05-16] (McAfee, Inc. -> McAfee, LLC)
S0 mfeelamk; C:\WINDOWS\System32\drivers\mfeelamk.sys [83952 2018-05-16] (Microsoft Windows Early Launch Anti-malware Publisher -> McAfee, LLC)
R3 mfefirek; C:\WINDOWS\System32\drivers\mfefirek.sys [533408 2018-05-16] (McAfee, Inc. -> McAfee, LLC)
R0 mfehidk; C:\WINDOWS\System32\drivers\mfehidk.sys [954784 2018-05-16] (McAfee, Inc. -> McAfee, LLC)
R3 mfencbdc; C:\WINDOWS\System32\DRIVERS\mfencbdc.sys [550288 2018-05-03] (McAfee, Inc. -> McAfee LLC.)
S3 mfencrk; C:\WINDOWS\System32\DRIVERS\mfencrk.sys [108944 2018-05-03] (McAfee, Inc. -> McAfee LLC.)
R3 mfeplk; C:\WINDOWS\System32\drivers\mfeplk.sys [115616 2018-05-16] (McAfee, Inc. -> McAfee, LLC)
R0 mfewfpk; C:\WINDOWS\System32\drivers\mfewfpk.sys [252832 2018-05-16] (McAfee, Inc. -> McAfee, LLC)
2021-10-14 18:50 - 2021-01-18 04:16 - 000000000 ____D C:\WINDOWS\system32\Tasks\Symantec Endpoint Protection
2021-09-30 23:54 - 2021-09-30 23:54 - 000000012 _____ C:\Users\Patrick Anelia\AppData\Roaming\35cbb79ee5b98a8ca9c15ec3b0436646
2021-09-30 23:54 - 2021-09-30 23:54 - 000000000 ____D C:\Users\Patrick Anelia\AppData\Roaming\Y2mate
2021-09-30 23:51 - 2021-09-30 23:51 - 000002296 _____ C:\Users\Patrick Anelia\Desktop\Y2mate Downloader.lnk
2021-09-30 23:51 - 2021-09-30 23:51 - 000000000 ____D C:\Users\Patrick Anelia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Y2mate Downloader
2021-09-30 23:51 - 2021-09-30 23:51 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Y2mate Downloader
2021-09-30 23:36 - 2021-09-30 23:48 - 000000000 ____D C:\Program Files (x86)\Y2mate
2021-09-30 23:36 - 2021-09-30 23:36 - 000000000 ____D C:\Users\Patrick Anelia\Downloads\Y2mate
2021-09-30 23:35 - 2021-09-30 23:35 - 000000000 ____D C:\Users\Patrick Anelia\Documents\Y2mate
2021-09-30 23:31 - 2021-09-30 23:33 - 006893472 _____ (Y2mate Downloader) C:\Users\Patrick Anelia\Downloads\y2mate_downloader_online_1005_ba28b9c3.exe
removeproxy:
cmd: ipconfig /flushdns
emptytemp:
end::