start::
closeprocesses:
createrestorepoint:
virustotal: C:\Windows\System32\drivers\RoutePolicy.sys
Startup: C:\Users\asusb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FBrIwVqzUmO.lnk [2023-01-19]
ShortcutAndArgument: FBrIwVqzUmO.lnk -> C:\Windows\system32\wscript.exe => /E:jscript "C:\Users\asusb\AppData\Roaming\FBrIwVqzUmO" irgqQ9LmimNjC <==== ATTENTION
Startup: C:\Users\asusb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fEMVZknyCS.lnk [2023-01-19]
ShortcutAndArgument: fEMVZknyCS.lnk -> C:\Windows\system32\wscript.exe => /E:jscript "C:\Users\asusb\AppData\Roaming\fEMVZknyCS" irgqQ9LmimNjC <==== ATTENTION
Startup: C:\Users\asusb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IzcVvmtEqnGCA.lnk [2023-01-19]
ShortcutAndArgument: IzcVvmtEqnGCA.lnk -> C:\Windows\system32\wscript.exe => /E:jscript "C:\Users\asusb\AppData\Roaming\IzcVvmtEqnGCA" irgqQ9LmimNjC <==== ATTENTION
Startup: C:\Users\asusb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KdypjnibqJhiQ.lnk [2023-01-19]
ShortcutAndArgument: KdypjnibqJhiQ.lnk -> C:\Windows\system32\wscript.exe => /E:jscript "C:\Users\asusb\AppData\Roaming\KdypjnibqJhiQ" irgqQ9LmimNjC <==== ATTENTION
Startup: C:\Users\asusb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vWGSnnZe.lnk [2023-01-19]
ShortcutAndArgument: vWGSnnZe.lnk -> C:\Windows\system32\wscript.exe => /E:jscript "C:\Users\asusb\AppData\Roaming\vWGSnnZe" irgqQ9LmimNjC <==== ATTENTION
GroupPolicy: Restriction ? <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
Task: {070BCBD1-590A-49C6-9799-3D6EB75E5C7E} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe [96648 2010-05-21] (Ask.com -> ) <==== ATTENTION
C:\Program Files (x86)\Ask.com
Task: {E0F10DCF-44AD-40E8-9370-FB5DA59F93FB} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => C:\Windows\system32\MusNotification.exe (Pas de fichier)
2023-01-22 19:34 - 2023-01-22 20:04 - 000000000 ____D C:\Users\asusb\Desktop\SpyHunter_Portable
2023-01-22 19:23 - 2023-01-22 19:24 - 146378388 _____ C:\Users\asusb\Downloads\_Getintopc.com_SpyHunter_Portable.rar
2023-01-22 19:06 - 2023-01-22 19:06 - 006875112 _____ (EnigmaSoft Limited) C:\Users\asusb\Downloads\SpyHunter-5.13-89-11044-Installer.exe
2023-01-19 21:09 - 2023-01-19 21:08 - 000096906 _____ C:\Users\asusb\AppData\Roaming\vWGSnnZe
2023-01-19 20:51 - 2023-01-19 20:51 - 000096906 _____ C:\Users\asusb\AppData\Roaming\KdypjnibqJhiQ
2023-01-19 20:51 - 2023-01-19 20:50 - 000096906 _____ C:\Users\asusb\AppData\Roaming\IzcVvmtEqnGCA
2023-01-19 20:49 - 2023-01-19 20:49 - 000096906 _____ C:\Users\asusb\AppData\Roaming\FBrIwVqzUmO
2023-01-19 20:48 - 2023-01-19 20:47 - 000096906 _____ C:\Users\asusb\AppData\Roaming\fEMVZknyCS
2023-01-19 21:12 - 2023-01-19 21:12 - 000003916 _____ C:\Windows\system32\Tasks\Scheduled Update for Ask Toolbar
2023-01-19 21:12 - 2023-01-19 21:12 - 000000000 ____D C:\Program Files (x86)\Ask.com
BHO-x32: Ask Toolbar -> {D4027C7F-154A-4066-A1AD-4243D8127440} -> C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll [2010-05-21] (Ask.com -> Ask.com)
Toolbar: HKLM-x32 - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll [2010-05-21] (Ask.com -> Ask.com)
emptytemp:
end::