---

start
CreateRestorePoint:
CloseProcesses:
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] => 0
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] => 0
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restore
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restore
HKLM\SOFTWARE\Policies\Microsoft\MRT: Restore
HKLM\Software\Policies\Microsoft\Windows\System: [EnableSmartScreen] => 1
HKLM\Software\Policies\Microsoft\Windows\System: [DisableAcrylicBackgroundOnLogon] => 0
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server: [fDenyTSConnections] => 1
Task: {49F0F704-EDA9-417E-819F-0C4B3DD909DA} - System32\Tasks\Microsoft\Windows\DataBaseR\RecoveryHosts => C:\ProgramData\Microsoft\MapData\avRGzE0wjNzoCDYpii\DataBaseR.bat
Task: {CDA1B8BC-FB06-40FC-93DD-2F534179AB5C} - System32\Tasks\Microsoft\Windows\WindowsBackup\CleanCash => C:\Programdata\ReaItekHD\taskhost.exe
Task: {50191CD0-67C1-4F85-96AA-B0D64707FB2C} - System32\Tasks\Microsoft\Windows\WindowsBackup\GlobalData => C:\Windows\SysWOW64\unsecapp.exe
Task: {C4974A60-F8B3-4E1F-9DB3-EE8553B8C7F7} - System32\Tasks\Microsoft\Windows\WindowsBackup\WinlogonCheck => C:\Programdata\ReaItekHD\taskhost.exe
Task: {762D65F2-1FEF-4DC9-B96C-B042C02AB898} - System32\Tasks\Microsoft\Windows\Wininet\winser => C:\ProgramData\Windows Tasks Service\winserv.exe
Task: {69A39666-6B44-49F0-AC98-F49082ABC4DA} - System32\Tasks\Microsoft\Windows\Wininet\winsers => C:\ProgramData\Windows Tasks Service\winserv.exe
C:\ProgramData\ReaItekHD
C:\ProgramData\Windows Tasks Service
C:\ProgramData\Microsoft\MapData
C:\Windows\SysWOW64\unsecapp.exe
C:\Users\i3\AppData\Roaming\emp.bin
EmptyTemp:
End