start::
CreateRestorePoint:
CloseProcesses:
Hosts:
RemoveProxy:
EmptyTemp:
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll
HKLM\SYSTEM\CurrentControlSet\Services\aswSP
HKLM\SYSTEM\CurrentControlSet\Services\aswMonFlt
HKLM\SYSTEM\CurrentControlSet\Services\aswSnx
S3 WinDivert1.1; C:\Program Files\KMSpico\WinDivert.sys
2019-02-06 14:38 - 2019-02-06 14:38 - 000362888 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2019-02-20 00:17 - 2017-08-30 02:39 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpico
2019-02-20 00:17 - 2017-08-08 06:21 - 000000000 ____D C:\Program Files\KMSpico
2019-02-06 14:38 - 2019-01-04 14:44 - 000037104 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw06ad4cf50cfeb1b5.tmp
2019-02-06 14:38 - 2018-10-18 23:15 - 000042288 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw101fbcdff5a06de7.tmp
2019-02-06 14:38 - 2017-11-25 17:09 - 000205400 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswd60d12e1361a7324.tmp
2019-02-06 14:38 - 2017-08-09 04:24 - 001034432 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswfd747531ec5c0f94.tmp
2019-02-06 14:38 - 2017-08-09 04:24 - 000474456 ____N (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys.155025305393701
2019-02-06 14:38 - 2017-08-09 04:24 - 000379952 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswc8974b283731e2fe.tmp
2019-02-06 14:38 - 2017-08-09 04:24 - 000216784 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswb4e6a01cbaf2d8f5.tmp
2019-02-06 14:38 - 2017-08-09 04:24 - 000167304 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswdd7af92c9c75c6cf.tmp
2019-02-06 14:38 - 2017-08-09 04:24 - 000112312 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw15683f0515271af0.tmp
2019-02-06 14:38 - 2017-08-09 04:24 - 000087944 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw1c86114814db60aa.tmp
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File
Task: {29A8FA0C-5044-4656-9B79-B88D67494773} - System32\Tasks\Avast Software\Overseer => C:\Program Files\Common Files\Avast Software\Overseer\overseer.exe (AVAST Software s.r.o.
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
FirewallRules: [{CE0CB7D1-E13B-4759-9CF0-C53E07365649}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe No File
FirewallRules: [{D41F208C-3964-4D37-95E4-FEE0B2D43BC2}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe No File
FirewallRules: [{F3A538BB-3DB3-42C1-8EE4-EBAAA0A61E14}] => (Allow) C:\Program Files\KMSpico\KMSELDI.exe No File
FirewallRules: [{05AA039E-1238-4583-A2DF-BDE1C7F7B600}] => (Allow) C:\Program Files\KMSpico\KMSELDI.exe No File
FirewallRules: [{847180FB-1AF8-4D27-A907-3A49353BA28F}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe No File
FirewallRules: [{04C30B5D-6785-4030-9AFB-064E7F1C229F}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe No File
FirewallRules: [{E8CA4B8D-B628-444D-BB0A-63070B56FF52}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe No File
FirewallRules: [{0F956268-3D55-41C6-AECE-89959BFFC043}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe No File
cmd: ipconfig /flushdns
end::