start::
closeprocesses:
createrestorepoint:
HKLM\...\StartupApproved\Run32: => "Privoxy"
HKLM-x32\...\Run: [Privoxy] => C:\Program Files (x86)\privoxy\starthelp.exe
C:\Program Files (x86)\privoxy
Winlogon\Notify\GoToAssist: C:\Program Files (x86)\Citrix\GoToAssist Corporate\1084\G2AWinLogon_x64.dll (Citrix Online, a division of Citrix Systems, Inc.)
HKU\S-1-5-21-1147743041-4006948325-2397275055-1001\...\Run: [Chromium] => c:\users\heather\appdata\local\chromium\application\chrome.exe [828416 2017-01-20] (The Chromium Authors)
c:\users\heather\appdata\local\chromium
ShortcutTarget: $McRebootA5E6DEAA56$.lnk -> (No File)
GroupPolicy\User: Restriction ? <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
CHR HKU\S-1-5-21-1147743041-4006948325-2397275055-1001\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings: [ProxySettingsPerUser] 1 <==== ATTENTION (Restriction - ProxySettings)
ProxyEnable: [S-1-5-21-1147743041-4006948325-2397275055-1001] => Proxy is enabled.
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
SearchScopes: HKLM-x32 -> DefaultScope value is missing
SearchScopes: HKU\S-1-5-21-1147743041-4006948325-2397275055-1001 -> DefaultScope {2f23ab71-4ac6-41f2-a955-ea576e553146} URL =
SearchScopes: HKU\S-1-5-21-1147743041-4006948325-2397275055-1001 -> {B90B0EF6-2879-463C-A54D-936BE4BB4234} URL = hxxps://search.yahoo.com/search?p={searchTerms}&fr=yset_ie_syc_oracle&type=orcl_default
SearchScopes: HKU\S-1-5-21-1147743041-4006948325-2397275055-1001 -> {ED3D09D8-DA03-4F00-ABB9-45F998FFF211} URL =
FF Extension: (Search and New Tab by Yahoo) - C:\Users\heather\AppData\Roaming\Mozilla\Firefox\Profiles\fzirgbvb.default-1383869500935\Extensions\jid1-16aeif9OQIRKxA@jetpack.xpi [2017-11-10]
FF SearchPlugin: C:\Users\heather\AppData\Roaming\Mozilla\Firefox\Profiles\fzirgbvb.default-1383869500935\searchplugins\McSiteAdvisor.xml [2016-03-08]
FF Extension: (Yahoo! Toolbar) - C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2016-11-17] [Legacy] [not signed]
FF HKLM\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSKHKLM => not found
CHR DefaultSearchURL: Default -> hxxps://search.yahoo.com/search?p={searchTerms}&fr=yset_chr_syc_oracle&type=default
CHR DefaultSearchKeyword: Default -> Yahoo
CHR DefaultSuggestURL: Default -> hxxps://search.yahoo.com/sugg/ie?output=fxjson&command={searchTerms}&nResults=10
CHR HKLM-x32\...\Chrome\Extension: [mekghndhnjgkcbhajefnnidlnhceagce] - C:\Program Files (x86)\Web Protect\chrome-wp.crx <not found>
S2 0240821542409023mcinstcleanup; C:\Users\heather\AppData\Local\Temp\024082~1.EXE [904360 2018-09-16] (McAfee, Inc.) <==== ATTENTION
S3 GoToAssist; C:\Program Files (x86)\Citrix\GoToAssist Corporate\1084\G2AC_Service.exe [310080 2015-06-08] (Citrix Online, a division of Citrix Systems, Inc.)
S3 PCDSRVC{498B77D3-741DB767-06020300}_0; \??\c:\program files\dell\supportassistagent\pcdr\supportassist\6.0.6992.1236\pcdsrvc_x64.pkms [X]
2018-11-16 15:00 - 2015-06-08 08:20 - 000000000 ____D C:\Users\heather\AppData\Local\Citrix
emptytemp:
end::