Start::
CreateRestorePoint
EmptyCLSID
EmptyFlash
EmptyTemp
EmptyTracing
EmptyPrefetch
EmptyProxy
EmptyRecycle
HKCU\SOFTWARE\KasperskyLabSetup =>.Kaspersky Labs
HKU\.DEFAULT\SOFTWARE\KasperskyLab =>.Kaspersky Labs
HKU\S-1-5-21-1254648378-2022100744-2433976430-1001\SOFTWARE\KasperskyLabSetup =>.Kaspersky Labs
O43 - CFD: 24/06/2020 - [] D -- C:\ProgramData\Kaspersky Lab Setup Files =>.Kaspersky Lab
O43 - CFD: 22/06/2020 - [] D -- C:\Users\edwar\AppData\Local\Kaspersky Lab =>.Kaspersky Lab
O43 - CFD: 22/06/2020 - [] D -- C:\Users\Default\AppData\Local\Kaspersky Lab =>.Kaspersky Lab
O43 - CFD: 22/06/2020 - [] D -- C:\Users\Default User\AppData\Local\Kaspersky Lab =>.Kaspersky Lab
O43 - CFD: 22/06/2020 - [] -- C:\WINDOWS\System32\Config\systemprofile\AppData\Local\Kaspersky Lab =>.Kaspersky Lab
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run]:AvastUI.exe =>.Avast Software s.r.o
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder]:Avast Cleanup Premium.lnk =>.Avast Software s.r.o
HKLM\SOFTWARE\Avast Software =>.AVAST Software
HKLM\SOFTWARE\WOW6432Node\Avast Software =>.AVAST Software
HKCU\SOFTWARE\AVAST Software =>.AVAST Software
HKCU\SOFTWARE\AvastAdSDK =>.Avast Software s.r.o
HKU\.DEFAULT\SOFTWARE\AVAST Software =>.AVAST Software
HKU\S-1-5-21-1254648378-2022100744-2433976430-1001\SOFTWARE\AVAST Software =>.AVAST Software
HKU\S-1-5-21-1254648378-2022100744-2433976430-1001\SOFTWARE\AvastAdSDK =>.Avast Software s.r.o
O43 - CFD: 13/10/2022 - [] D -- C:\Users\edwar\AppData\Roaming\Avast Software =>.AVAST Software
P2 - FPN: [HKLM] [@update.ccleanerbrowser.com/CCleaner Browser;version=3] - (.Piriform Software.) -- C:\Program Files (x86)\CCleaner Browser\Update\1.6.607.0\npCCleanerBrowserUpdate3.dll =>.Piriform Software
P2 - FPN: [HKLM] [@update.ccleanerbrowser.com/CCleaner Browser;version=9] - (.Piriform Software.) -- C:\Program Files (x86)\CCleaner Browser\Update\1.6.607.0\npCCleanerBrowserUpdate3.dll =>.Piriform Software
C:\Program Files (x86)\CCleaner Browser
HKLM\SOFTWARE\WOW6432Node\Baidu_Drp_pos =>.Baidu Technology
HKCU\SOFTWARE\Baidu Security =>.Baidu Technology
HKU\S-1-5-21-1254648378-2022100744-2433976430-1001\SOFTWARE\Baidu Security =>.Baidu Technology
O43 - CFD: 06/09/2019 - [] D -- C:\ProgramData\Baidu Security =>.Baidu Technology
O43 - CFD: 06/11/2019 - [0] D -- C:\ProgramData\IObit =>.IObit
O43 - CFD: 02/11/2019 - [0] D -- C:\Users\edwar\AppData\Roaming\IObit =>.IObit
[HKEY_USERS\S-1-5-21-1254648378-2022100744-2433976430-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run]:PCPrivacyShield2020 =>.SUP.PCPrivacyShield
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run]:PCPrivacyShield2020 =>.SUP.PCPrivacyShield
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run32]:Aimersoft Helper Compact.exe =>.Aimersoft Software
HKLM\SOFTWARE\WOW6432Node\Aimersoft =>.Aimersoft Software
HKCU\SOFTWARE\Aimersoft =>.Aimersoft Software
HKU\S-1-5-21-1254648378-2022100744-2433976430-1001\SOFTWARE\Aimersoft =>.Aimersoft Software
O43 - CFD: 23/10/2020 - [] D -- C:\ProgramData\Aimersoft =>.Aimersoft Software
O43 - CFD: 23/10/2020 - [] D -- C:\Users\edwar\AppData\Local\Aimersoft =>.Aimersoft Software
HKCU\SOFTWARE\Chromium =>.Chromium
HKU\S-1-5-21-1254648378-2022100744-2433976430-1001\SOFTWARE\Chromium =>.Chromium
O4 - HKLM\..\Wow6432Node\Run: [Aimersoft Helper Compact.exe] . (. - .) -- C:\Program Files (x86)\Common Files\Aimersoft\Aimersoft Helper Compact\ASHelper.exe (.Not File.) =>.SUP.Orphan
O4 - HKLM\..\Wow6432Node\RunOnce: [GrpConv] . (. - .) -- grpconv -o.grpconv =>.SUP.Orphan
O4 - HKUS\.DEFAULT\..\StartupApproved\Run: [GoogleDriveFS] . (. - .) -- 0x020000000000000000000000 =>.SUP.Orphan
O4 - HKUS\S-1-5-18\..\StartupApproved\Run: [GoogleDriveFS] . (. - .) -- 0x020000000000000000000000 =>.SUP.Orphan
O4 - HKUS\S-1-5-19\..\StartupApproved\Run: [OneDriveSetup] . (. - .) -- 0x020000000000000000000000 =>.SUP.Orphan
O4 - HKUS\S-1-5-19\..\StartupApproved\Run: [GoogleDriveFS] . (. - .) -- 0x020000000000000000000000 =>.SUP.Orphan
O4 - HKUS\S-1-5-20\..\StartupApproved\Run: [OneDriveSetup] . (. - .) -- 0x020000000000000000000000 =>.SUP.Orphan
O4 - HKUS\S-1-5-20\..\StartupApproved\Run: [GoogleDriveFS] . (. - .) -- 0x020000000000000000000000 =>.SUP.Orphan
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run]:Discord =>.SUP.Discord
[HKEY_USERS\S-1-5-21-1254648378-2022100744-2433976430-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run]:Discord =>.SUP.Discord
O43 - CFD: 15/08/2021 - [] D -- C:\Users\edwar\AppData\Roaming\discord
O43 - CFD: 15/08/2021 - [] D -- C:\Users\edwar\AppData\Local\Discord
cmd: ipconfig /flushdns
cmd: netsh advfirewall reset
cmd: netsh advfirewall set allprofiles state on
WinsockFix
End::