start::
CreateRestorePoint:
CloseProcesses:
Hosts:
RemoveProxy:
IE restricted site: HKU\.DEFAULT\...\123topsearch.com -> www.123topsearch.com
IE restricted site: HKU\.DEFAULT\...\125sms.co.uk -> www.125sms.co.uk
IE restricted site: HKU\.DEFAULT\...\125sms.com -> www.125sms.com
IE restricted site: HKU\.DEFAULT\...\12w.net -> download-video.12w.net
IE restricted site: HKU\.DEFAULT\...\132.com -> www.132.com
IE restricted site: HKU\.DEFAULT\...\1337-crew.to -> www.1337-crew.to
IE restricted site: HKU\.DEFAULT\...\1337crew.info -> www.1337crew.info
IE restricted site: HKU\.DEFAULT\...\136136.net -> down.136136.net
IE restricted site: HKU\.DEFAULT\...\150freesms.de -> www.150freesms.de
IE restricted site: HKU\.DEFAULT\...\163ns.com -> ert0003.e76.163ns.com
IE restricted site: HKU\.DEFAULT\...\17-plus.com -> 17-plus.com
IE restricted site: HKU\.DEFAULT\...\171203.com -> 171203.com
IE restricted site: HKU\.DEFAULT\...\17concepts.info -> www.17concepts.info
IE restricted site: HKU\.DEFAULT\...\1800searchonline.com -> www.1800searchonline.com
IE restricted site: HKU\.DEFAULT\...\180searchassistant.com -> www.180searchassistant.com
IE restricted site: HKU\.DEFAULT\...\180solutions.com -> bis.180solutions.com
IE restricted site: HKU\.DEFAULT\...\1987324.com -> www.1987324.com
IE restricted site: HKU\.DEFAULT\...\1gb.ru -> people.1gb.ru
IE restricted site: HKU\.DEFAULT\...\1ghporn.info -> www.1ghporn.info
IE restricted site: HKU\.DEFAULT\...\1importantiamreal.com -> www.1importantiamreal.com
IE restricted site: HKU\S-1-5-21-781925439-3447314515-940202416-1001\...\123topsearch.com -> www.123topsearch.com
IE restricted site: HKU\S-1-5-21-781925439-3447314515-940202416-1001\...\125sms.co.uk -> www.125sms.co.uk
IE restricted site: HKU\S-1-5-21-781925439-3447314515-940202416-1001\...\125sms.com -> www.125sms.com
IE restricted site: HKU\S-1-5-21-781925439-3447314515-940202416-1001\...\12w.net -> download-video.12w.net
IE restricted site: HKU\S-1-5-21-781925439-3447314515-940202416-1001\...\132.com -> www.132.com
IE restricted site: HKU\S-1-5-21-781925439-3447314515-940202416-1001\...\1337-crew.to -> www.1337-crew.to
IE restricted site: HKU\S-1-5-21-781925439-3447314515-940202416-1001\...\1337crew.info -> www.1337crew.info
IE restricted site: HKU\S-1-5-21-781925439-3447314515-940202416-1001\...\136136.net -> down.136136.net
IE restricted site: HKU\S-1-5-21-781925439-3447314515-940202416-1001\...\150freesms.de -> www.150freesms.de
IE restricted site: HKU\S-1-5-21-781925439-3447314515-940202416-1001\...\163ns.com -> ert0003.e76.163ns.com
IE restricted site: HKU\S-1-5-21-781925439-3447314515-940202416-1001\...\17-plus.com -> 17-plus.com
IE restricted site: HKU\S-1-5-21-781925439-3447314515-940202416-1001\...\171203.com -> 171203.com
IE restricted site: HKU\S-1-5-21-781925439-3447314515-940202416-1001\...\17concepts.info -> www.17concepts.info
IE restricted site: HKU\S-1-5-21-781925439-3447314515-940202416-1001\...\1800searchonline.com -> www.1800searchonline.com
IE restricted site: HKU\S-1-5-21-781925439-3447314515-940202416-1001\...\180searchassistant.com -> www.180searchassistant.com
IE restricted site: HKU\S-1-5-21-781925439-3447314515-940202416-1001\...\180solutions.com -> bis.180solutions.com
IE restricted site: HKU\S-1-5-21-781925439-3447314515-940202416-1001\...\1987324.com -> www.1987324.com
IE restricted site: HKU\S-1-5-21-781925439-3447314515-940202416-1001\...\1gb.ru -> people.1gb.ru
IE restricted site: HKU\S-1-5-21-781925439-3447314515-940202416-1001\...\1ghporn.info -> www.1ghporn.info
IE restricted site: HKU\S-1-5-21-781925439-3447314515-940202416-1001\...\1importantiamreal.com -> www.1importantiamreal.com
Task: {5FCAD7AD-02E5-46BD-8326-90F84DCB1E9A} - System32\Tasks\tIeEilnueoNE => C:\Users\alban\uhuYlc.bat
Task: {5FCAD7AD-02E5-46BD-8326-90F84DCB1E9A} - System32\Tasks\tIeEilnueoNE => C:\Users\alban\uhuYlc.bat
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
2020-04-03 18:17 - 2020-04-03 18:17 - 000000000 _____ C:\Users\alban\AppData\Local\{0C808841-E498-4C9C-9380-CE974AA4A279}
2020-04-03 16:58 - 2020-04-03 16:58 - 000000000 _____ C:\Users\alban\AppData\Local\{BF460CDE-0C20-48E3-BAE0-B0EFDE771FFA}
2020-04-03 16:42 - 2020-04-03 16:42 - 000000000 _____ C:\Users\alban\AppData\Local\{2C33EDEE-2329-4E0E-8052-40CCEA5CA13C}
2020-04-03 16:37 - 2020-04-03 16:37 - 000000000 _____ C:\Users\alban\AppData\Local\{3E64A887-D7D1-4761-9508-27BF34D3E416}
2020-04-03 15:47 - 2020-04-03 15:47 - 000000000 _____ C:\Users\alban\AppData\Local\{85AAC4A7-0C99-4FBE-AE1A-2AFF6FDCA4A8}
2020-04-03 15:39 - 2020-04-03 20:43 - 000000000 ____D C:\Users\alban\AppData\LocalLow\IObit
2020-04-03 15:39 - 2020-04-03 16:18 - 000000000 ____D C:\Users\alban\AppData\Roaming\IObit
2020-04-03 15:05 - 2020-04-03 15:05 - 000000000 _____ C:\Users\alban\AppData\Local\{D4AFD5BD-47B7-4CE3-9E3F-EB5200D92B5B}
2020-04-03 15:03 - 2020-04-03 15:03 - 000000000 _____ C:\Users\alban\AppData\Local\{0E67F056-77CB-418C-A21E-DD085B7B219E}
2020-04-03 14:47 - 2020-04-03 14:47 - 000000000 _____ C:\Users\alban\AppData\Local\{FC546602-3CB3-468C-861C-F853CAD87C28}
2020-04-03 14:45 - 2020-04-03 14:45 - 000000000 _____ C:\Users\alban\AppData\Local\{D561AB32-26EE-4AB4-8786-07273D77781C}
2020-04-03 14:37 - 2020-04-03 14:37 - 000000000 _____ C:\Users\alban\AppData\Local\{43034327-6243-4838-92C6-FF889F15BDBD}
2020-04-03 14:35 - 2020-04-03 14:35 - 000000000 _____ C:\Users\alban\AppData\Local\{E07404B7-AF39-4805-B9B9-6784F07CDF38}
2020-04-03 13:35 - 2020-04-03 13:35 - 000000000 _____ C:\Users\alban\AppData\Local\{5865B919-51D7-4D76-B52E-02376C58FEEF}
2020-04-03 13:28 - 2020-04-03 13:28 - 000000000 _____ C:\Users\alban\AppData\Local\{F3BA8020-847B-4A71-8CB6-1E01D6B50CEF}
2020-04-03 13:24 - 2020-04-03 13:24 - 000000000 _____ C:\Users\alban\AppData\Local\{50970E8B-F697-4ADC-B965-55A5351935B6}
2020-04-03 13:17 - 2020-04-03 13:17 - 000000000 _____ C:\Users\alban\AppData\Local\{3CAECFA1-C6FB-496F-831D-C48053F1F08E}
2020-04-03 13:15 - 2020-04-03 13:15 - 000000000 _____ C:\Users\alban\AppData\Local\{4B7EA148-47BB-4E66-ACDC-2BAC4EC7CFA1}
2020-04-03 13:13 - 2020-04-03 13:13 - 000000000 _____ C:\Users\alban\AppData\Local\{6CF875F4-0428-4F43-B89A-3AAE80326CA2}
2020-04-03 18:17 - 2020-04-03 18:17 - 000000000 _____ () C:\Users\alban\AppData\Local\{0C808841-E498-4C9C-9380-CE974AA4A279}
2020-04-03 15:03 - 2020-04-03 15:03 - 000000000 _____ () C:\Users\alban\AppData\Local\{0E67F056-77CB-418C-A21E-DD085B7B219E}
2020-04-03 16:42 - 2020-04-03 16:42 - 000000000 _____ () C:\Users\alban\AppData\Local\{2C33EDEE-2329-4E0E-8052-40CCEA5CA13C}
2020-04-03 13:17 - 2020-04-03 13:17 - 000000000 _____ () C:\Users\alban\AppData\Local\{3CAECFA1-C6FB-496F-831D-C48053F1F08E}
2020-04-03 16:37 - 2020-04-03 16:37 - 000000000 _____ () C:\Users\alban\AppData\Local\{3E64A887-D7D1-4761-9508-27BF34D3E416}
2020-04-03 14:37 - 2020-04-03 14:37 - 000000000 _____ () C:\Users\alban\AppData\Local\{43034327-6243-4838-92C6-FF889F15BDBD}
2020-04-03 13:15 - 2020-04-03 13:15 - 000000000 _____ () C:\Users\alban\AppData\Local\{4B7EA148-47BB-4E66-ACDC-2BAC4EC7CFA1}
2020-04-03 13:24 - 2020-04-03 13:24 - 000000000 _____ () C:\Users\alban\AppData\Local\{50970E8B-F697-4ADC-B965-55A5351935B6}
2020-04-03 13:35 - 2020-04-03 13:35 - 000000000 _____ () C:\Users\alban\AppData\Local\{5865B919-51D7-4D76-B52E-02376C58FEEF}
2020-04-03 13:13 - 2020-04-03 13:13 - 000000000 _____ () C:\Users\alban\AppData\Local\{6CF875F4-0428-4F43-B89A-3AAE80326CA2}
2020-04-03 15:47 - 2020-04-03 15:47 - 000000000 _____ () C:\Users\alban\AppData\Local\{85AAC4A7-0C99-4FBE-AE1A-2AFF6FDCA4A8}
2020-04-03 16:58 - 2020-04-03 16:58 - 000000000 _____ () C:\Users\alban\AppData\Local\{BF460CDE-0C20-48E3-BAE0-B0EFDE771FFA}
2020-04-03 15:05 - 2020-04-03 15:05 - 000000000 _____ () C:\Users\alban\AppData\Local\{D4AFD5BD-47B7-4CE3-9E3F-EB5200D92B5B}
2020-04-03 14:45 - 2020-04-03 14:45 - 000000000 _____ () C:\Users\alban\AppData\Local\{D561AB32-26EE-4AB4-8786-07273D77781C}
2020-04-03 14:35 - 2020-04-03 14:35 - 000000000 _____ () C:\Users\alban\AppData\Local\{E07404B7-AF39-4805-B9B9-6784F07CDF38}
2020-04-03 13:28 - 2020-04-03 13:28 - 000000000 _____ () C:\Users\alban\AppData\Local\{F3BA8020-847B-4A71-8CB6-1E01D6B50CEF}
2020-04-03 14:47 - 2020-04-03 14:47 - 000000000 _____ () C:\Users\alban\AppData\Local\{FC546602-3CB3-468C-861C-F853CAD87C28}
Tcpip\..\Interfaces\{887ffc04-d647-459f-a5c2-1b76408227f0}: [DhcpNameServer] 192.168.42.129
2020-03-20 16:37 - 2020-03-29 19:25 - 000000000 ____D C:\Users\alban\AppData\Roaming\VPN4Test
2020-03-20 16:36 - 2020-03-20 16:36 - 000000000 ____D C:\Users\alban\AppData\Local\vpn4test-updater
2020-04-04 20:56 - 2017-03-05 17:24 - 000000000 ____D C:\ProgramData\Spybot - Search & Destroy
SystemRestore: On
cmd: ipconfig /flushdns
emptytemp:
end::