start::
CreateRestorePoint:
cmd: Net stop wuauserv
cmd: Rd /s /q %windir%\SoftwareDistribution\.
CloseProcesses:
EmptyTemp:
EmptyEventLogs:
Hosts:
RemoveProxy:
C:\Windows\Temp\*.*
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\*
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\*
C:\Users\CurrentUserName\Appdata\Local\Temp\*.*
C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\*.*
StartBatch:
rd /s /q "%userprofile%\AppData\Roaming\discord\Cache"
rd /s /q "%userprofile%\AppData\Roaming\discord\code cache"
rd /s /q "%userprofile%\AppData\Roaming\discord\gpucache"
Endbatch:
StartRegEdit:
Windows Registry Editor Version 5.00
[HKCU\SOFTWARE\Microsoft\Internet Explorer\Main]
"Start Page "="about:Blank"
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{8EEAC88A-079B-4b2c-80C1-7836F79EB40A} -]
"URL"=""
EndRegEdit:
DeleteValue: HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\StartupApproved\Run|OneDriveSetup
DeleteValue: HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\StartupApproved\Run|OneDriveSetup
DeleteKey: HKLM\Software\Classes\*\ShellEx\ContextMenuHandlers\WinRAR32
DeleteKey: HKLM\Software\Classes\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}
DeleteKey: HKLM\Software\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32
DeleteKey: HKLM\Software\Classes\Folder\ShellEx\ContextMenuHandlers\WinRAR32
DeleteValue: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache|C:\Users\Utilisateur\Documents\Shutter Encoder 16.2 Windows 64bits.exe.FriendlyAppName
DeleteValue: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache|C:\Users\Utilisateur\Documents\Shutter Encoder 16.2 Windows 64bits.exe.ApplicationCompany
DeleteValue: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache|C:\Users\Utilisateur\Desktop\delfix_1.013.exe.FriendlyAppName
DeleteValue: HKU\S-1-5-21-2889776991-1141790600-3297945274-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache|C:\Users\Utilisateur\Documents\Shutter Encoder 16.2 Windows 64bits.exe.FriendlyAppName
DeleteValue: HKU\S-1-5-21-2889776991-1141790600-3297945274-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache|C:\Users\Utilisateur\Documents\Shutter Encoder 16.2 Windows 64bits.exe.ApplicationCompany
DeleteValue: HKU\S-1-5-21-2889776991-1141790600-3297945274-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache|C:\Users\Utilisateur\Desktop\delfix_1.013.exe.FriendlyAppName
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Deluge
C:\ProgramData\Norton
DeleteValue: HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK|YahooMusicEngine.exe
C:\Users\Utilisateur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\4K Video Downloader+.lnk
C:\Users\Utilisateur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\4K Video Downloader.lnk
C:\Users\Utilisateur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lecteur de CD (E).lnk
C:\Users\Utilisateur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FlashGet3.7\whatsnew.lnk
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-2889776991-1141790600-3297945274-1001\...\Run: [CCleaner Smart Cleaning] => C:\Program Files\CCleaner\CCleaner64.exe [45882672 2025-04-09] (Gen Digital Inc. -> Gen Digital Inc.)
Task: {0FA65B72-AF59-454F-8F05-1A093D61BFF9} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [3480504 2025-04-09] (Gen Digital Inc. -> Gen Digital Inc.)
Task: {8DB18A7F-7647-4E68-80DC-F24374D145D3} - System32\Tasks\CCleanerCrashReporting => C:\Program Files\CCleaner\CCleanerBugReport.exe [6139696 2025-04-09] (Gen Digital Inc. -> Gen Digital Inc.) -> --product 90 --send dumps|report --path "C:\Program Files\CCleaner\LOG" --programpath "C:\Program Files\CCleaner" --guid "9f5de187-d7d0-47cd-93dd-98edcc9e33a7" --version "6.35.0.11488" --silent
Task: {FC971DC4-61E4-48C5-9B26-CE68F0825E85} - System32\Tasks\CCleanerSkipUAC - steph => C:\Program Files\CCleaner\CCleaner.exe [39622960 2025-04-09] (Gen Digital Inc. -> Gen Digital Inc.)
Task: C:\WINDOWS\Tasks\CCleanerCrashReporting.job => C:\Program Files\CCleaner\CCleanerBugReport.exe
2025-05-08 07:43 - 2024-09-26 13:17 - 000004210 _____ C:\WINDOWS\system32\Tasks\CCleaner Update
2025-05-07 09:59 - 2020-09-27 18:22 - 000000637 _____ C:\DelFix.txt
2025-05-08 08:51 - 2024-09-26 13:17 - 000000670 _____ C:\WINDOWS\Tasks\CCleanerCrashReporting.job
HKU\S-1-5-21-2889776991-1141790600-3297945274-1001\Software\Classes\regfile: <==== ATTENTION
HKU\S-1-5-21-2889776991-1141790600-3297945274-1001\Software\Classes\.reg: => <==== ATTENTION
HKU\S-1-5-21-2889776991-1141790600-3297945274-1001\Software\Classes\.bat: => <==== ATTENTION
HKU\S-1-5-21-2889776991-1141790600-3297945274-1001\Software\Classes\.cmd: => <==== ATTENTION
HKU\S-1-5-21-2889776991-1141790600-3297945274-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://fr.yahoo.com/?fr=fp-comodo&type=81_138430009005_132.0.6834.160_u_hp
SearchScopes: HKU\S-1-5-21-2889776991-1141790600-3297945274-1001 -> DefaultScope {8EEAC88A-079B-4b2c-80C1-7836F79EB40A} URL = hxxps://fr.search.yahoo.com/yhs/search?hspart=comodo&hsimp=yhs-com_chrome&type=81_138430009005_132.0.6834.160_u_ds&p={searchTerms}
SearchScopes: HKU\S-1-5-21-2889776991-1141790600-3297945274-1001 -> {8EEAC88A-079B-4b2c-80C1-7836F79EB40A} URL = hxxps://fr.search.yahoo.com/yhs/search?hspart=comodo&hsimp=yhs-com_chrome&type=81_138430009005_132.0.6834.160_u_ds&p={searchTerms}
StartRegedit:
Windows Registry Editor Version 5.00
[-HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]
@=""
[-HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains]
[-HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]
@=""
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P]
EndRegedit:
StartBatch:
del /s /q C:\Windows\prefetch\*.*
del /s /q "%userprofile%\AppData\Local\Temp\*.*"
del /s /q "%userprofile%\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\*.*"
del /s /q "%userprofile%\AppData\LocalLow\Microsoft\CryptnetUrlCache\Metada\*.*"
del /s /q "%userprofile%\AppData\Local\Microsoft\Windows\History\*.*"
del /s /q "%userprofile%\AppData\Local\Microsoft\Windows\Temporary Internet Files\*.*"
del /s /q "%userprofile%\AppData\Roaming\Microsoft\Windows\Recent\*.lnk"
For /D %%d In ("%userprofile%\AppData\Local\Mozilla\Firefox\Profiles\*") Do (If Exist "%%d\Cache2" Del /s /q "%%d\Cache2\*.*")
del /s /q "%userprofile%\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\Js\."
del /s /q "%userprofile%\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\."
del /s /q "%userprofile%\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\Js\."
del /s /q "%userprofile%\AppData\Roaming\Opera Software\Opera Stable\Code Cache\Js\."
del /s /q "%userprofile%\AppData\Roaming\Opera Software\*"
For /D %%d In ("%userprofile%\AppData\Local\Thunderbird\Profiles\*") Do (If Exist "%%d\Cache2" Del /s /q "%%d\Cache2\*.*")
For /D %%d In ("%userprofile%\AppData\Roaming\Mozilla\Firefox\Profiles\*") Do (If Exist "%%d\cookies.sqlite" Del /s /q "%%d\cookies.sqlite")
For /D %%d In ("%userprofile%\AppData\Roaming\Mozilla\Firefox\Profiles\*") Do (If Exist "%%d\Places.Sqlite" Del /s /q "%%d\Places.Sqlite")
del /s /q "%userprofile%\AppData\Local\Microsoft\Edge\User Data\Default\History"
del /s /q "%userprofile%\AppData\Roaming\Opera Software\Opera Stable\History"
del /s /q "%userprofile%\AppData\Roaming\Opera Software\Opera GX Stable\History"
ipconfig /release
ipconfig /renew
ipconfig /flushdns
ipconfig /registerdns
netsh winsock reset
netsh advfirewall reset
netsh advfirewall set allprofiles state on
netsh winhttp reset proxy
bitsadmin /reset /allusers
net start sdrsvc
net start vss
net start rpcss
net start eventsystem
net start winmgmt
net start msiserver
net start bfe
net start trustedinstaller
net start windefend
net start mpssvc
net start mpsdrv
Winmgmt /salvagerepository
Winmgmt /resetrepository
Winmgmt /resyncperf
Endbatch:
cmd: Net start wuauserv
Reboot:
end::