start::
closeprocesses:
createrestorepoint:
ContextMenuHandlers1: [SDECon32] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => -> Pas de fichier
ContextMenuHandlers1: [SDECon64] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => -> Pas de fichier
ContextMenuHandlers2: [SDECon32] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => -> Pas de fichier
ContextMenuHandlers2: [SDECon64] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => -> Pas de fichier
ContextMenuHandlers6: [SDECon32] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => -> Pas de fichier
ContextMenuHandlers6: [SDECon64] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => -> Pas de fichier
FirewallRules: [{C3869FF3-2D04-4841-9F07-80742F97DFE7}] => (Allow) C:\Program Files (x86)\FormatFactory\FormatFactory.exe => Pas de fichier
StartRegedit:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=dword:00000005
EndRegedit:
HKLM\...\Run: [UniConverterUpdateHelper] => C:\Program Files\Wondershare\UniConverter 14\WSVCUUpdateHelper.exe (Pas de fichier)
C:\Program Files\Wondershare
BootExecute: autocheck autochk *
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Restriction <==== ATTENTION
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Restriction <==== ATTENTION
CHR StartupUrls: Default -> "hxxp://websearch.searchdwebs.info/?pid=1173&r=2013/07/05&hid=1755569107&lg=EN&cc=FR&unqvl=22","torch://newtab","torch://start","hxxp://home.torchbrowser.com/?systemid=448&appid=0&ua=Torch","hxxp://websearch.allsearches.info/?pid=1318&r=2014/10/08&hid=3385166098678805217&lg=EN&cc=PA&unqvl=64","","hxxp://www.mystartsearch.com/?type=hp&ts=1416031762&from=wpc&uid=ST31000524AS_5VPAYW3KXXXX5VPAYW3K","hxxps://fr.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_fs_15_48&param1=1&param2=f%3D7%26b%3DChrome%26cc%3Dfr%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0D0CtD0E0AtCzz0ByEzyzz0AyEtAzzyBtN0D0Tzu0StCyEtByEtN1L2XzutAtFtCyDtFtAtFtBtN1L1Czu1ByEtN1L1G1B1V1N2Y1L1Qzu2SyBtCyDyDyEyEzytAtGtByDtDyCtGyDyE0E0FtGyE0Dzz0DtG0E0FyDyDyCtC0EtByEyC0BtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0Czy0EyByByEyEtBtG0DzytAyDtGyEzzzzyCtGzytB0DtCtG0F0E0DtCtDtB0A0AtD0CtDtA2QtN0A0LzutB%26cr%3D254298247%26a%3Dwncy_fs_15_48%26os%3DWindows%2B7%2BHome%2BPremium"
CHR NewTab: Default -> Not-active:"chrome-extension://oogmkbpkoblajkomflhkkdmbfggdmefd/inicio.html"
OPR Notifications: Opera Stable -> hxxps://mytopwords.com
C:\Users\Francis\AppData\Local\Vivaldi
S3 BraveElevationService; "C:\Program Files\BraveSoftware\Brave-Browser\Application\107.1.45.113\elevation_service.exe" [X]
2022-10-12 11:15 - 2022-10-12 11:16 - 000000000 ____D C:\Wondershare UniConverter 14
2022-10-12 11:15 - 2022-10-12 11:15 - 000000000 ____D C:\Program Files (x86)\WondershareUpdate
2022-10-12 11:14 - 2022-10-12 11:15 - 000000000 ____D C:\Users\Francis\AppData\Local\Wondershare
2022-10-12 11:14 - 2022-10-12 11:14 - 000000000 ____D C:\Users\Francis\AppData\Roaming\Wondershare
2022-10-12 11:14 - 2022-10-12 11:14 - 000000000 ____D C:\ProgramData\GraphicsType14
2022-10-12 11:13 - 2022-10-12 11:24 - 000000000 ____D C:\ProgramData\Wondershare
2022-10-12 11:13 - 2022-10-12 11:24 - 000000000 ____D C:\Program Files\Wondershare
2022-10-12 11:06 - 2022-10-12 11:06 - 000000000 ____D C:\Program Files (x86)\Freemake
emptytemp:
end::