start::
CreateRestorePoint:
CloseProcesses:
Hosts:
Task: {FFFBC0D0-56EA-4E76-9F4C-F64FF81CAB42} - System32\Tasks\Avira\System Speedup\Delayed Startup\papyl\3 => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [2018-03-18] (Apple Inc.) <==== ATTENTION
Task: {DE25B80D-F025-4FBA-A173-0EA6DBB8F0F6} - System32\Tasks\Avira\System Speedup\Delayed Startup\papyl\1 => C:\Program Files\Mem Reduct\memreduct.exe [2017-10-19] (Henry++) <==== ATTENTION
Task: {E0BC4E36-DBB3-49A5-A52C-1955A932FF0E} - System32\Tasks\Avira\System Speedup\Delayed Startup\papyl\5 => C:\Program Files (x86)\steam\steam.exe [2018-04-03] (Valve Corporation) <==== ATTENTION
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
S3 GPUZ; \??\C:\Users\papyl\AppData\Local\Temp\GPUZ.sys [X] <==== ATTENTION
2018-05-02 00:20 - 2017-07-27 00:15 - 000061852 _____ C:\WINDOWS\system32\BMXState-{00000004-00000000-00000000-00001102-0000000B-00411102}.rfx
2018-05-02 00:20 - 2017-07-27 00:15 - 000000820 _____ C:\WINDOWS\system32\DVCState-{00000004-00000000-00000000-00001102-0000000B-00411102}.rfx
2018-05-02 00:20 - 2017-07-25 19:00 - 000061852 _____ C:\WINDOWS\system32\BMXStateBkp-{00000004-00000000-00000000-00001102-0000000B-00411102}.rfx
018-05-08 10:01 - 2018-05-07 14:07 - 000238425 _____ () C:\Users\papyl\AppData\Roaming\System.vbs
2018-04-14 19:12 - 2018-04-14 19:12 - 000007605 _____ () C:\Users\papyl\AppData\Local\resmon.resmoncfg
C:\Users\papyl\AppData\Roaming\System.vbs
RemoveProxy:
EmptyTemp:
cmd: ipconfig /flushdns
end::