start::
CreateRestorePoint:
CloseProcesses:
Hosts:
RemoveProxy:
EmptyTemp:
CustomCLSID: HKU\S-1-5-21-2507382405-551696494-1844724230-500_Classes\CLSID\{0E270DAA-1BE6-48F2-AC49-A60F94A42F24}\InprocServer32 -> %%systemroot%%\system32\shell32.dll => No File
CustomCLSID: HKU\S-1-5-21-2507382405-551696494-1844724230-500_Classes\CLSID\{144DF3B2-2402-47AE-9583-5A045929A8D4}\InprocServer32 -> C:\Users\Administrator\AppData\Local\Google\Update\1.3.33.5\psuser_64.dll => No File
ContextMenuHandlers1: [IObitUnstaler] -> {B19ED566-D419-470b-B111-3C89040BC027} => C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMenuRight.dll [2017-05-22] (IObit)
C:\Program Files (x86)\IObit
ContextMenuHandlers4: [IObitUnstaler] -> {B19ED566-D419-470b-B111-3C89040BC027} => C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMenuRight.dll [2017-05-22] (IObit)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => -> No File
Task: {02475B4F-0109-40EC-AE36-8187E172F034} - \WPD\SqmUpload_S-1-5-21-2507382405-551696494-1844724230-1006 -> No File <==== ATTENTION
Task: {2F03A600-405B-4165-9D2F-1F7D5EED8CA5} - \WPD\SqmUpload_S-1-5-21-2507382405-551696494-1844724230-1005 -> No File <==== ATTENTION
Task: {92CA13DC-E1BF-4AA0-AD78-0712BE2512C8} - \WPD\SqmUpload_S-1-5-21-2507382405-551696494-1844724230-1001 -> No File <==== ATTENTION
Task: {E399F701-6728-4BC9-8FE5-8200AA831070} - System32\Tasks\Driver Booster SkipUAC (Administrator) => C:\Program Files (x86)\IObit\Driver Booster\DriverBooster.exe
Task: C:\Windows\Tasks\Обновление Браузера Яндекс .job => C:\Users\Administrator\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
C:\Users\Administrator\AppData\Local\Yandex
AlternateDataStreams: C:\ProgramData\TEMP:3F30E778 [144]
AlternateDataStreams: C:\ProgramData\TEMP:A9967A61 [139]
AlternateDataStreams: C:\ProgramData\TEMP:F4C624DE [123]
Shortcut: C:\Users\Administrator\AppData\Local\Microsoft\Windows\Application Shortcuts\Chrome\Яндекс.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) <==== Cyrillic
Shortcut: C:\Users\Administrator\AppData\Local\Microsoft\Windows\Application Shortcuts\Chrome\Яндекс.Почта.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) <==== Cyrillic
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\injector.vbs.vbs [2018-01-28] ()
SearchScopes: HKU\S-1-5-21-2507382405-551696494-1844724230-500 -> {2E00D31D-D171-423D-836D-1A4D7EA7F1A9} URL =
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer.dll [2017-05-22] (IObit)
Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
CHR HKLM\...\Chrome\Extension: [lbojggafdepnclikhiapkpinbfdhbdoi] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [lbojggafdepnclikhiapkpinbfdhbdoi] - hxxps://clients2.google.com/service/update2/crx
R2 IObitUnSvr; C:\Program Files (x86)\IObit\IObit Uninstaller\IUService.exe [206112 2017-06-14] (IObit)
2018-02-06 19:11 - 2018-02-06 19:11 - 000001451 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IObit Uninstaller.lnk
2018-01-17 15:59 - 2018-01-17 15:59 - 000000000 ____D C:\Users\Nicolas\AppData\Local\Tempzxpsignd0b25c732ea598c6
2018-01-17 15:57 - 2018-01-17 15:57 - 000000000 ____D C:\Users\Nicolas\AppData\Local\Tempzxpsign7b359de5092f3665
2018-01-17 15:57 - 2018-01-17 15:57 - 000000000 ____D C:\Users\Nicolas\AppData\Local\Tempzxpsign100eee8908ef81f6
2018-01-17 15:55 - 2018-01-17 15:55 - 000000000 ____D C:\Users\Carole\AppData\Local\Tempzxpsigna8d652636bc867c8
2018-01-17 15:55 - 2018-01-17 15:55 - 000000000 ____D C:\Users\Carole\AppData\Local\Tempzxpsign85c9ad03f8743a33
2018-01-17 15:55 - 2018-01-17 15:55 - 000000000 ____D C:\Users\Carole\AppData\Local\Tempzxpsign262d236622951c7f
2018-02-11 16:06 - 2016-11-04 01:33 - 000000000 ____D C:\ProgramData\IObit
2018-02-06 19:11 - 2017-08-10 18:18 - 000001439 _____ C:\Users\Public\Desktop\IObit Uninstaller.lnk
2018-02-06 19:11 - 2017-02-05 00:58 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IObit Uninstaller
2018-02-13 09:06 - 2018-02-13 09:07 - 001864256 _____ (Oracle Corporation) C:\Users\Richard\AppData\Local\Temp\jre-8u161-windows-au.exe
2014-04-25 18:03 - 2014-04-25 18:03 - 000461164 _____ () C:\Users\Administrator\AppData\Roaming\upc.exe
2014-04-07 13:14 - 2014-04-07 13:14 - 000000101 _____ () C:\Users\Administrator\AppData\Roaming\upc.vbs
2015-08-11 01:47 - 2015-08-11 01:47 - 000000136 _____ () C:\Users\Administrator\AppData\Local\configurator.xml
2014-08-05 23:29 - 2014-08-05 23:52 - 000000000 _____ () C:\Users\Administrator\AppData\Local\Temptable.xml
cmd: ipconfig /flushdns
end::