start
CreateRestorePoint:
CloseProcesses:
RemoveProxy:



HKU\S-1-5-21-4257737849-414334547-2173969701-1001\...\MountPoints2: {ed257b9e-6325-11e6-9ab9-94de808d5ab4} - "D:\AutoRun.exe"
S3 eapihdrv; \??\C:\Users\bLrS_BcB\AppData\Local\Temp\ehdrv.sys [X]


CMD: netsh winsock reset all
CMD: ipconfig /flushdns
hosts:
EmptyTemp:
Reboot:
end