start::
CreateRestorePoint:
CloseProcesses:
Hosts:
RemoveProxy:
HKU\S-1-5-21-3658386750-666024021-1030785675-1002\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO-x32: No Name -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> No File
BHO-x32: No Name -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> No File
R2 SegurazoIC; C:\Program Files (x86)\Segurazo\SegurazoIC.exe [4472936 2019-07-26]
R2 SegurazoSvc; C:\Program Files (x86)\Segurazo\SegurazoService.exe [251496 2019-07-26]
R1 SEGURAZOKD; C:\Program Files (x86)\Segurazo\SegurazoKD.sys [84256 2019-07-26]
U3 aswbdisk; no ImagePath
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
2019-08-02 19:10 - 2019-08-03 11:22 - 000000000 ____D C:\Program Files (x86)\Segurazo
2019-08-02 19:10 - 2019-08-02 19:33 - 000000000 ____D C:\ProgramData\Segurazo
2019-08-02 19:10 - 2019-08-02 19:11 - 000000000 ____D C:\Users\DRJMLAPS\AppData\Roaming\segurazoclient
2019-08-02 19:10 - 2019-08-02 19:10 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Segurazo
Task: {13817986-C0E5-40CB-AC16-61E140CF7273} - \Norton Internet Security\Norton Error Analyzer -> No File
Task: {568F2467-9781-485D-98BA-B03D21303B8A} - \Microsoft\Windows\Media Center\StartRecording -> No File
Task: {8456A254-5687-4810-AC50-0366106DABFE} - \Norton Internet Security\Norton Error Processor -> No File
Task: {8F5292FB-2C00-4538-A3FF-B4818F07B90A} - \Microsoft\Windows\Media Center\mcupdate_scheduled -> No File
Task: {9E2896AC-E89B-4402-99DE-FD6876D94009} - System32\Tasks\Avast Software\Overseer => C:\Program Files\Common Files\AVAST Software\Overseer\overseer.exe [2047368 2019-07-31]
Task: {EB02381F-D652-4B1C-894A-712498C62C51} - \Microsoft\Windows\MUI\LPRemove -> No File
Task: {7E1855EB-2A77-4553-AA14-B0424CA07B20} - System32\Tasks\{40E202FA-ABE9-4E32-930A-36F57CBCD9F5} => C:\Windows\system32\pcalua.exe -a C:\Users\DRJMLAPS\Downloads\JavaUninstallTool.exe -d C:\Users\DRJMLAPS\Downloads
EmptyTemp:
cmd: ipconfig /flushdns
end::