start
CreateRestorePoint:
CloseProcesses:
HKLM-x32\...\Run: [AdAnti] => C:\Program Files (x86)\AdAnti\AdAnti.exe [4291688 2016-08-15] ()
HKU\S-1-5-21-1028252891-896678091-2114287983-1003\...\Run: [lifsiy] => C:\Users\Sylvain.DESKTOP-4O5EE09\AppData\Local\lifsiy.dll [154112 2016-08-26] ()
ShellIconOverlayIdentifiers: [JzShlobj] -> {7B286609-DA97-47E1-AC6B-33B8B4732C95} => Pas de fichier
GroupPolicy: Restriction - Chrome
Tcpip\..\Interfaces\{5ef02855-726f-490b-b676-bbf3685af21e}: [NameServer] 188.120.239.115,8.8.8.8
SearchScopes: HKLM -> DefaultScope {ABE3A08E-3A1D-46BE-ADBE-D37DDF0A8C81} URL =
S3 CHNGTSvc; c:\exervice.exe
http://cloudfront.d5755fc9ca13d7af0d686 ... 218572.exe [X]
2016-08-26 21:12 - 2016-08-26 21:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\净广大师
2016-08-26 21:11 - 2016-08-26 21:12 - 00001055 _____ C:\Users\Public\Desktop\净广大师.lnk
2016-08-26 21:10 - 2016-08-26 21:22 - 00000000 ____D C:\ProgramData\{7F1F18B1-3A63-42b7-905F-308759E9E8E1}.tmp
2016-08-26 21:09 - 2016-08-26 21:11 - 00000000 ____D C:\Program Files (x86)\AdAnti
2016-08-26 20:57 - 2016-08-26 20:57 - 00000000 ____D C:\Program Files (x86)\UCBrowser
2016-08-26 20:45 - 2016-08-19 09:46 - 06765520 _____ (上饶市康格信息技术有限公司 ) C:\Users\Sylvain.DESKTOP-4O5EE09\AppData\Roaming\AdAnti13.exe
2016-08-26 20:40 - 2016-08-26 20:40 - 00000000 _____ C:\Users\Sylvain.DESKTOP-4O5EE09\AppData\Roaming\agent.dat
2016-08-26 20:35 - 2016-02-18 10:10 - 05267952 _____ () C:\Users\Sylvain.DESKTOP-4O5EE09\AppData\Roaming\ziptool_wc-9015_setup.exe
2016-08-26 20:26 - 2016-08-26 21:36 - 00001292 _____ C:\Users\Sylvain.DESKTOP-4O5EE09\Desktop\Continue Last version Installation.lnk
2016-08-26 20:25 - 2016-08-26 20:25 - 00154112 _____ C:\Users\Sylvain.DESKTOP-4O5EE09\AppData\Local\lifsiy.dll
2016-08-26 20:25 - 2016-08-26 20:25 - 00009106 _____ C:\Windows\System32\Tasks\Anerres Configuration
2016-08-26 20:25 - 2016-08-26 20:25 - 00000000 ___HD C:\Program Files (x86)\9cdDCD7
2016-08-26 20:25 - 2016-08-26 20:25 - 00000000 ____D C:\ProgramData\AVAST Software
2016-08-26 20:24 - 2016-08-26 21:24 - 00000000 ____D C:\Users\Sylvain.DESKTOP-4O5EE09\AppData\Local\Apps\2.0
2016-08-26 20:24 - 2016-08-26 21:14 - 00000000 ____D C:\Program Files (x86)\Shertuward
2016-08-26 20:24 - 2016-08-26 20:36 - 00138240 _____ C:\Users\Sylvain.DESKTOP-4O5EE09\AppData\Roaming\Installer.dat
2016-08-26 20:22 - 2016-08-26 20:20 - 00001006 _____ C:\Windows\system32\Drivers\etc\hp.bak
2016-08-26 20:20 - 2016-08-26 21:36 - 00001078 _____ C:\Users\Sylvain.DESKTOP-4O5EE09\Desktop\Play Travian.lnk
2016-08-26 20:18 - 2016-08-26 20:19 - 04984832 _____ C:\Users\Sylvain.DESKTOP-4O5EE09\Downloads\advanced_pokerstars_card_viewer_download.iso
2016-08-25 13:15 - 2016-08-25 13:15 - 00394752 ____H C:\Windows\system32\BITC47.tmp
2016-08-25 13:15 - 2016-08-25 13:15 - 00394752 ____H C:\Windows\system32\BIT65A.tmp
2016-08-25 13:15 - 2016-08-25 13:15 - 00394752 ____H C:\Windows\system32\BIT3E58.tmp
2016-08-25 13:15 - 2016-08-25 13:15 - 00394752 ____H C:\Windows\system32\BIT2F92.tmp
2016-08-09 20:05 - 2016-08-09 20:05 - 0028836 _____ () C:\Users\Sylvain.DESKTOP-4O5EE09\AppData\Roaming\ICSW_0D1P2X1C1L1H1T0D0L0MtJ1V0G0D1T2Z1T.txt
2016-08-26 20:24 - 2016-08-26 20:36 - 0138240 _____ () C:\Users\Sylvain.DESKTOP-4O5EE09\AppData\Roaming\Installer.dat
2016-08-26 20:35 - 2016-02-18 10:10 - 5267952 _____ () C:\Users\Sylvain.DESKTOP-4O5EE09\AppData\Roaming\ziptool_wc-9015_setup.exe
2016-08-26 20:25 - 2016-08-26 20:25 - 0154112 _____ () C:\Users\Sylvain.DESKTOP-4O5EE09\AppData\Local\lifsiy.dll
c:\exervice.exe
Task: {3FEE148C-0CC2-4857-AEF3-E5B296393F67} - System32\Tasks\Anerres Configuration => C:\Program Files (x86)\Shertuward\anerresCnfcqr.exe
Task: {A3043F25-6C5A-4CEF-86A0-741624156606} - \{0C080C47-0A0A-097E-0A11-087D0E08117A} -> Pas de fichier
WMI_ActiveScriptEventConsumer_ASEC:
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://yeabests.cc
FirewallRules: [{64CAAF6E-5768-4145-82A6-7400C685FC7D}] => (Allow) C:\Users\Sylvain.DESKTOP-4O5EE09\AppData\Local\Temp\14993\inst_buychannel_37.exe
FirewallRules: [{ECBAAE4F-DE71-42F0-916B-EFE9A376A697}] => (Allow) C:\Users\Sylvain.DESKTOP-4O5EE09\AppData\Local\Temp\14993\inst_buychannel_37.exe
FirewallRules: [{B3629D5E-A24D-4A6F-B5DF-537D32DEBD5E}] => (Allow) C:\Users\Sylvain.DESKTOP-4O5EE09\AppData\Local\Temp\MPCOnline\MPCDownload.exe
FirewallRules: [{905C2ABD-6E4F-4190-8E52-8D790500A761}] => (Allow) C:\Users\Sylvain.DESKTOP-4O5EE09\AppData\Local\Temp\MPCOnline\MPCDownload.exe
FirewallRules: [{8508EAE6-9078-4FDB-AF44-05FD38472D0F}] => (Allow) C:\Users\Sylvain.DESKTOP-4O5EE09\AppData\Local\Temp\16489\inst_buychannel_37.exe
FirewallRules: [{FCD45452-74F6-4FFF-93CA-85516D9A0837}] => (Allow) C:\Users\Sylvain.DESKTOP-4O5EE09\AppData\Local\Temp\16489\inst_buychannel_37.exe
Hosts:
cmd: ipconfig /flushdns
EmptyTemp:
end
