CreateRestorePoint:
CloseProcesses:
C:\USERS\BAVARD\APPDATA\ROAMING\PROFILES\PHOLOT.DEFAULT\PREFS.JS
C:\USERS\BAVARD\APPDATA\ROAMING\PROFILES\PHOLOT.DEFAULT\PREFS.JS
C:\USERS\BAVARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\A1R1ZOGW.DEFAULT-1487872371983\PREFS.JS
C:\USERS\BAVARD\APPDATA\ROAMING\PROFILES\PHOLOT.DEFAULT\SEARCHPLUGINS\Y2EF69T3.XML
C:\PROGRAM FILES (X86)\EXPLORER\WINNSI.DLL
C:\PROGRAM FILES (X86)\EXPLORER\IEDVTOOLEX.DLL
C:\PROGRAM FILES (X86)\EXPLORER\IEDVUTILS.EXE
C:\WINDOWS\SVCHOST.EXE
C:\WINDOWS\SYSTEM32\TASKS\IVEGERUCERY CONTROLS
EmptyTemp: