start::
CreateRestorePoint:
CloseProcesses:
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
GroupPolicy: Restriction <==== ATTENTION
GroupPolicy\User: Restriction <==== ATTENTION
HKU\S-1-5-21-3216640126-3652434297-196920400-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://mail.ru/cnt/10445?gp=811141
SearchScopes: HKU\S-1-5-21-3216640126-3652434297-196920400-1001 -> DefaultScope {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/distib/ep/?q={searchTerms}&fr=ntg&product_id=%7BD5735059-BA37-4749-99C7-370758BA8384%7D&gp=811142
SearchScopes: HKU\S-1-5-21-3216640126-3652434297-196920400-1001 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/distib/ep/?q={searchTerms}&fr=ntg&product_id=%7BD5735059-BA37-4749-99C7-370758BA8384%7D&gp=811142
BHO-x32: Search@Mail.Ru -> {8E8F97CD-60B5-456F-A201-73065652D099} -> C:\Users\auron\AppData\Local\Mail.Ru\Sputnik\ie_addon_dll.dll [2018-01-03] (Mail.Ru)
2018-01-21 21:19 - 2018-02-07 00:43 - 000002346 _____ C:\WINDOWS\System32\Tasks\Win Update
Task: {12D6ABD2-786B-4AA5-A53C-8D24A0907C04} - System32\Tasks\Win Update => c:\Intell\POOL\russian.vbs
c:\Intell\POOL\russian.vbs
EmptyTemp:
end::