start
CloseProcesses:
CreateRestorePoint:

HKLM\...\RunOnce: [wd] => C:\WINDOWS\TEMP\g740B.tmp.exe [252416 2016-12-26] () <===== ATTENTION
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
CHR Profile: C:\Users\Romain Blanchet\AppData\Local\Google\Chrome\User Data\ChromeDefaultData [2016-12-23] <==== ATTENTION
C:\WINDOWS\TEMP\g740B.tmp.exe
C:\Users\Public\ASR.dat
Task: {E87A216A-CFE2-4982-B55A-2011EC00ED9C} - System32\Tasks\114q428c756g617 => Rundll32.exe "C:\ProgramData\114q428c756g617\114q428c756g617.dll",hcsopx <==== ATTENTION
Task: {F06172CA-31E8-4559-AD3B-4CF13ABE4621} - System32\Tasks\526q74c382g223 => Rundll32.exe "C:\ProgramData\526q74c382g223\526q74c382g223.dll",hcsopx <==== ATTENTION
2016-12-22 17:38 - 2016-12-26 01:04 - 00252416 _____ () C:\WINDOWS\TEMP\g740B.tmp.exe
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"


EmptyTemp:
end