start::
CreateRestorePoint:
CloseProcesses:
Hosts:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
GroupPolicy: Restriction ? <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Edge: Restriction <==== ATTENTION
HKU\S-1-5-21-1738157379-1143172302-2266402599-1001\SOFTWARE\Policies\Microsoft\Edge: Restriction <==== ATTENTION
HKU\S-1-5-21-1738157379-1143172302-2266402599-1001\Environment\\UserInitMprLogonScript: -> C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe [2016-12-06] (NetSupport Ltd -> NetSupport Ltd)
Task: {689E38C0-8E0C-4780-9629-7A8D7DEDB7AD} - System32\Tasks\SUPERAntiSpyware Scheduled Task fc812875-90e1-4df4-aa4d-49ca03833b44 => C:\Program Files\SUPERAntiSpyware\SASTask.exe [49944 2021-01-09] (SUPERAntiSpyware.com -> SUPERAdBlocker.com) -> "C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" /TASK:fc812875-90e1-4df4-aa4d-49ca03833b44
C:\Program Files\SUPERAntiSpyware
Task: {C599DD4E-5700-40F4-A3F2-F90BDA7F14A6} - System32\Tasks\gankbpsDCeCX => C:\Windows\system32\rundll32.exe "C:\Program Files (x86)\gankbpsDCeCX\gankbpsDCeCX.dll",gankbpsDCeCX <==== ATTENTION
C:\Program Files (x86)\gankbpsDCeCX
Task: {D2AE51F6-17C9-4151-ACFF-E3EE15CCD768} - System32\Tasks\SUPERAntiSpyware Scheduled Task 55fb90c3-8b40-4cd9-bedb-980a807504b8 => C:\Program Files\SUPERAntiSpyware\SASTask.exe [49944 2021-01-09] (SUPERAntiSpyware.com -> SUPERAdBlocker.com) -> "C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" /TASK:55fb90c3-8b40-4cd9-bedb-980a807504b8
Task: {E111F98C-008E-4F97-B8BD-4D69CF568218} - System32\Tasks\Microsoft\Windows\Windows Error Reporting\SystemInfoTool => C:\Users\i'll look so smart\AppData\Roaming\\sysinfotool\\sitool.exe <==== ATTENTION
Task: C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 55fb90c3-8b40-4cd9-bedb-980a807504b8.job => C:\Program Files\SUPERAntiSpyware\SASTask.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
Task: C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task fc812875-90e1-4df4-aa4d-49ca03833b44.job => C:\Program Files\SUPERAntiSpyware\SASTask.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
ProxyEnable: [S-1-5-21-1738157379-1143172302-2266402599-1001] => Proxy is enabled.
ProxyServer: [S-1-5-21-1738157379-1143172302-2266402599-1001] => 127.0.0.1:8003
ManualProxies: 1127.0.0.1:8003
AlternateDataStreams: C:\ProgramData\Reprise:jhqduwvxlctbqqijsf`usjbm`bfjhiqhqjm [0]
AlternateDataStreams: C:\ProgramData\Reprise:jhqduwvxlctbqqijsf`usjbm`bfjhjhhqkh [0]
FirewallRules: [{502E176A-EB8B-40CC-BEB9-267799885E74}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe => No File
FirewallRules: [{564F55E7-9544-4555-A752-6DAE541F5C5C}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe => No File
FirewallRules: [{6B021DBE-D602-4BFF-9084-5D57654B107A}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File
FirewallRules: [{48476A7B-DF4F-4D3A-8F0D-89801B0D3E5E}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File
FirewallRules: [TCP Query User{E0428F10-EE72-4EA0-BE32-154B6F36CC07}C:\program files\epic games\roguecompany\roguecompany\binaries\win64\roguecompany.exe] => (Allow) C:\program files\epic games\roguecompany\roguecompany\binaries\win64\roguecompany.exe => No File
FirewallRules: [UDP Query User{178B10EE-35DB-45FD-BE2D-ECF4A869C5AD}C:\program files\epic games\roguecompany\roguecompany\binaries\win64\roguecompany.exe] => (Allow) C:\program files\epic games\roguecompany\roguecompany\binaries\win64\roguecompany.exe => No File
FirewallRules: [TCP Query User{E83F2E8B-DD27-4064-957C-521E644A31D9}C:\users\i'll look so smart\appdata\local\programs\opera\75.0.3969.218\opera.exe] => (Allow) C:\users\i'll look so smart\appdata\local\programs\opera\75.0.3969.218\opera.exe => No File
FirewallRules: [UDP Query User{C6368932-C962-4685-B98E-B183A364AF48}C:\users\i'll look so smart\appdata\local\programs\opera\75.0.3969.218\opera.exe] => (Allow) C:\users\i'll look so smart\appdata\local\programs\opera\75.0.3969.218\opera.exe => No File
FirewallRules: [TCP Query User{7FACEAB9-5A22-4ABB-8EF9-942A5930A4D6}C:\users\i'll look so smart\appdata\local\programs\opera\75.0.3969.243\opera.exe] => (Allow) C:\users\i'll look so smart\appdata\local\programs\opera\75.0.3969.243\opera.exe => No File
FirewallRules: [UDP Query User{B18EC278-1D2C-4383-9FCF-AFD225667078}C:\users\i'll look so smart\appdata\local\programs\opera\75.0.3969.243\opera.exe] => (Allow) C:\users\i'll look so smart\appdata\local\programs\opera\75.0.3969.243\opera.exe => No File
FirewallRules: [TCP Query User{AF25AF36-CD0E-4562-8E9B-BFBF327D6618}C:\users\i'll look so smart\appdata\local\programs\opera\76.0.4017.107\opera.exe] => (Block) C:\users\i'll look so smart\appdata\local\programs\opera\76.0.4017.107\opera.exe => No File
FirewallRules: [UDP Query User{1566CC4D-6C20-47B3-90ED-4D5C7F57F96B}C:\users\i'll look so smart\appdata\local\programs\opera\76.0.4017.107\opera.exe] => (Block) C:\users\i'll look so smart\appdata\local\programs\opera\76.0.4017.107\opera.exe => No File
FirewallRules: [TCP Query User{D4BAC713-01B2-474E-BDAC-6803094AB553}C:\users\i'll look so smart\appdata\local\programs\opera\76.0.4017.123\opera.exe] => (Block) C:\users\i'll look so smart\appdata\local\programs\opera\76.0.4017.123\opera.exe => No File
FirewallRules: [UDP Query User{7599B71F-FE76-40D7-8D81-9AD3D9432634}C:\users\i'll look so smart\appdata\local\programs\opera\76.0.4017.123\opera.exe] => (Block) C:\users\i'll look so smart\appdata\local\programs\opera\76.0.4017.123\opera.exe => No File
FirewallRules: [TCP Query User{759230AB-BD73-425E-870C-DFD3F16D7988}C:\programdata\regid.1993-06.com.microsoft\svrwebui.exe] => (Block) C:\programdata\regid.1993-06.com.microsoft\svrwebui.exe (NetSupport Ltd -> NetSupport Ltd)
FirewallRules: [UDP Query User{410ABC63-0F17-49C5-ACB0-B3273C160744}C:\programdata\regid.1993-06.com.microsoft\svrwebui.exe] => (Block) C:\programdata\regid.1993-06.com.microsoft\svrwebui.exe (NetSupport Ltd -> NetSupport Ltd)
EmptyTemp:
cmd: ipconfig /flushdns
cmd: netsh advfirewall reset
cmd: netsh winsock reset
cmd: sfc /scannow
end::