start CloseProcesses: CreateRestorePoint: HKLM\...\Run: [ShadowPlay] => "C:\Windows\system32\rundll32.exe" C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM-x32\...\Run: [] => [X] HKU\S-1-5-21-2904963324-2752244586-844847528-1001\...\Run: [Nexus] => [X] R2 Winstep Xtreme Service; C:\Program Files (x86)\Winstep\WsxService [X] 2016-04-19 11:24 - 2016-04-19 11:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DxO ViewPoint 2 Task: C:\Windows\Tasks\TrackerAutoUpdate.job => C:\Program Files\Tracker Software\Update\TrackerUpdate.exe <==== ATTENTION EmptyTemp: end