start::
CreateRestorePoint:
CloseProcesses:
Hosts:
RemoveProxy:
EmptyTemp:
HKLM-x32\...\Run: [SM?RT-Protection] => C:\Program Files (x86)\Smadav\SM?RTP.exe
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-758945598-1810169347-2418366026-1000\...\Run: [SysinfYhX] => C:\WINDOWS\system32\cmd.exe /c start wscript /e:VBScript.Encode %temp%\SysinfYhX.db
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll [2018-06-05]
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll [2018-06-05]
CHR HKLM\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx [2016-09-21]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx [2016-09-21]
R2 McAfee SiteAdvisor Service; C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe
2018-07-09 01:17 - 2018-07-09 01:17 - 000000000 ____D C:\9c9428a4b14dd6a4dc73563846
2018-07-09 01:15 - 2018-07-09 01:15 - 000000000 ____D C:\bc351094128bc47534da0b2988
2018-07-09 01:10 - 2018-07-09 01:10 - 000000000 ____D C:\af8f1474bd62b654b6dcec535fdb3408
2018-07-09 00:29 - 2018-07-09 00:29 - 000000000 ___HD C:\Windows\AxInstSV
2018-07-08 23:20 - 2018-07-08 23:20 - 000000000 ____D C:\71538de68f56faaf41db
2018-07-08 23:19 - 2018-07-08 23:19 - 000000000 ____D C:\21718e6919d71a592c24
2018-07-08 21:13 - 2018-07-08 21:13 - 000000000 ____D C:\78b07b7b116dfbeefe
2018-07-08 21:09 - 2018-07-08 21:09 - 000000000 ____D C:\f3b4c57ff9ab44bf1bd0d4da
2018-07-08 16:41 - 2018-07-08 16:41 - 000000000 ____D C:\d9cc6c47cfe0ca99ce3a
2018-06-14 18:40 - 2018-01-02 01:42 - 000000000 ____D C:\Program Files (x86)\McAfee
2017-12-09 15:00 - 2017-12-09 15:00 - 000000037 ___SH () C:\Users\lenovo\AppData\Local\20986331705021ca58edc424.96250074
2018-06-01 21:47 - 2018-06-01 21:47 - 000000000 _____ () C:\Users\lenovo\AppData\Local\BIT2A1D.tmp
2018-06-01 21:47 - 2018-06-01 21:47 - 000000000 _____ () C:\Users\lenovo\AppData\Local\BIT2A5D.tmp
2018-06-09 00:37 - 2018-06-09 00:37 - 000000000 _____ () C:\Users\lenovo\AppData\Local\BIT8974.tmp
2018-06-05 22:47 - 2018-06-05 22:47 - 000000000 _____ () C:\Users\lenovo\AppData\Local\BITB49D.tmp
2018-06-05 22:47 - 2018-06-05 22:47 - 000000000 _____ () C:\Users\lenovo\AppData\Local\BITB588.tmp
2018-05-30 22:47 - 2018-05-30 22:47 - 000000000 _____ () C:\Users\lenovo\AppData\Local\BITDBC7.tmp
2018-05-30 22:47 - 2018-05-30 22:47 - 000000000 _____ () C:\Users\lenovo\AppData\Local\BITDC54.tmp
2018-05-29 19:30 - 2018-05-29 19:30 - 000000000 _____ () C:\Users\lenovo\AppData\Local\BITDC6F.tmp
Task: {65D7D302-6BF6-437E-B482-61BD2CBA03E2} - System32\Tasks\smadav => C:\Program Files (x86)\Smadav\SM?RTP.exe
cmd: ipconfig /flushdns
end::