Start::
CreateRestorePoint:
CloseProcesses:
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AnyDesk.lnk [2022-03-15]
ShortcutTarget: AnyDesk.lnk -> C:\Program Files (x86)\AnyDesk\AnyDesk.exe (philandro Software GmbH -> AnyDesk Software GmbH) 
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction
R2 AnyDesk; C:\Program Files (x86)\AnyDesk\AnyDesk.exe [3819648 2022-03-15] (philandro Software GmbH -> AnyDesk Software GmbH) 
S4 RestoroActiveProtection; "C:\Program Files\Restoro\bin\RestoroProtection.exe" [X] 
2022-03-15 12:33 - 2022-03-15 12:33 - 000016320 _____ C:\WINDOWS\system32\Drivers\WRBoot.sys
2022-03-15 12:32 - 2022-03-15 14:02 - 000000000 ____D C:\Users\cyren\AppData\Roaming\Wise Disk Cleaner
2022-03-15 12:32 - 2022-03-15 12:32 - 000004048 _____ C:\WINDOWS\system32\Tasks\Wise Disk Cleaner Schedule Task
2022-03-15 12:31 - 2022-03-15 12:31 - 000001277 _____ C:\Users\Public\Desktop\Wise Disk Cleaner.lnk
2022-03-15 12:31 - 2022-03-15 12:31 - 000000000 ____D C:\WINDOWS\system32\Tasks\WiseCleaner
2022-03-15 12:31 - 2022-03-15 12:31 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Disk Cleaner
2022-03-15 12:31 - 2022-03-15 12:31 - 000000000 ____D C:\Program Files (x86)\Wise
2022-03-15 12:24 - 2022-03-15 12:24 - 000000000 ____D C:\ProgramData\WRCore
2022-03-15 12:24 - 2022-03-15 12:24 - 000000000 ____D C:\Program Files\Webroot
2022-03-15 12:23 - 2022-03-17 09:27 - 000000819 _____ C:\Users\Public\Desktop\Webroot SecureAnywhere .lnk
2022-03-15 12:23 - 2022-03-17 09:27 - 000000000 _____ C:\WINDOWS\SysWOW64\WRusr.dll.new
2022-03-15 12:23 - 2022-03-17 09:27 - 000000000 _____ C:\WINDOWS\system32\WRusr.dll.new
2022-03-15 12:23 - 2022-03-15 12:27 - 000000000 ____D C:\Program Files\BLZxuwFT
2022-03-15 12:23 - 2022-03-15 12:23 - 000276880 _____ (Webroot) C:\WINDOWS\SysWOW64\WRusr.dll
2022-03-15 12:23 - 2022-03-15 12:23 - 000232520 _____ (Webroot) C:\WINDOWS\system32\WRusr.dll
2022-03-15 12:23 - 2022-03-15 12:23 - 000143184 _____ (Webroot) C:\WINDOWS\system32\Drivers\WRkrn.sys
2022-03-15 12:23 - 2022-03-15 12:23 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Webroot SecureAnywhere
2022-03-15 12:23 - 2022-03-15 12:23 - 000000000 ____D C:\Program Files\Common Files\Webroot
2022-03-15 12:22 - 2022-03-17 11:16 - 000000000 ____D C:\ProgramData\WRData
2022-03-15 12:14 - 2022-03-15 12:14 - 000000000 ____D C:\Users\cyren\AppData\Local\DBG
2022-03-15 12:10 - 2022-03-15 12:10 - 000007628 _____ C:\Users\cyren\AppData\Local\Resmon.ResmonCfg
2022-03-15 12:08 - 2022-03-15 12:09 - 000000000 ____D C:\ProgramData\AnyDesk
2022-03-15 12:08 - 2022-03-15 12:08 - 000001957 _____ C:\Users\Public\Desktop\AnyDesk.lnk
2022-03-15 12:08 - 2022-03-15 12:08 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AnyDesk
2022-03-15 12:08 - 2022-03-15 12:08 - 000000000 ____D C:\Program Files (x86)\AnyDesk
2022-03-15 11:45 - 2022-03-16 10:29 - 000000000 ____D C:\Users\cyren\AppData\Roaming\AnyDesk
2022-03-15 11:09 - 2022-03-15 12:14 - 000000000 ____D C:\WINDOWS\system32\Tasks\Remediation 
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Pas de fichier 
BHO: Pas de nom -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> Pas de fichier 
Toolbar: HKU\S-1-5-21-1431849725-775836398-2639892432-1001 -> Pas de nom - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Pas de fichier
Toolbar: HKU\S-1-5-21-1431849725-775836398-2639892432-1001 -> Pas de nom - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - Pas de fichier 
EmptyTemp:
End::