start::
CreateRestorePoint:
CloseProcesses:
Hosts:
Task: {E488A754-D783-498C-94F7-2C1591CD00C0} - System32\Tasks\diffiticnetjka => "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" diffitic.net/jka <==== ATTENTION
alternateDataStreams: C:\Users\Public\AppData:CSM [480]
FirewallRules: [{E3F745A8-FC7A-484A-9BC8-2379A21E7C3B}] => (Allow) C:\Users\drags\UsIrjIk.exe
FirewallRules: [{7E9024B6-78B6-49EE-9362-639F2B6FB170}] => (Allow) C:\Users\drags\AppData\Roaming\yjkUDb.exe
GroupPolicy: Restriction <==== ATTENTION
GroupPolicy\User: Restriction <==== ATTENTION
S1 kaikvnlb; \??\C:\WINDOWS\system32\drivers\kaikvnlb.sys [X]
2018-03-19 19:58 - 2018-03-19 19:58 - 000000000 ____D C:\ProgramData\Emsisoft
2018-03-19 19:56 - 2018-03-19 20:34 - 000000000 ____D C:\EEK
2017-09-29 17:42 - 2017-09-29 17:42 - 000059904 ____N (Microsoft Corporation) C:\Users\drags\UsIrjIk.exe
2017-09-29 17:42 - 2017-09-29 17:42 - 000059904 ____N (Microsoft Corporation) C:\Users\drags\AppData\Roaming\yjkUDb.exe
2017-09-29 17:42 - 2017-09-29 17:42 - 000174592 ____N (Microsoft Corporation) C:\Users\drags\AppData\Roaming\ZyoCwliKMCUkM.exe
2018-03-17 15:43 - 2018-03-17 15:43 - 000000002 _____ () C:\Users\drags\AppData\Local\WMI.ini
RemoveProxy:
EmptyTemp:
cmd: ipconfig /flushdns
end::