Script ZHPFix 
FirewallRaz 
EmptyPrefetch 
EmptyTemp 


O87 - FAEL: "{E3830905-20E3-4F44-A935-DB84DCB61FE7}" [In-None-P6-TRUE] .(...) -- C:\Program Files (x86)\Common Files\MicroWorld\Agent\MWAGENT.EXE (.not file.) 
O87 - FAEL: "{709FA33F-40C4-40C9-8F4C-18498F6C3758}" [In-None-P17-TRUE] .(...) -- C:\Program Files (x86)\Common Files\MicroWorld\Agent\MWAGENT.EXE (.not file.) 
O87 - FAEL: "{3EF84653-D58B-4C77-9A33-3E7C578E6C53}" [In-None-P6-TRUE] .(...) -- C:\Program Files (x86)\Common Files\MicroWorld\Agent\MWAGENT.EXE (.not file.) 
O87 - FAEL: "{677D34CB-20E6-4040-B1E1-2913D6FCC03F}" [In-None-P17-TRUE] .(...) -- C:\Program Files (x86)\Common Files\MicroWorld\Agent\MWAGENT.EXE (.not file.) 
O39 - APT: Unknown - (...) -- C:\Windows\Tasks\899b65n58w930.job [1506] 
O39 - APT: Unknown - (...) -- C:\Windows\System32\Tasks\httphumanvevo12comsmartsm [3574] 
O39 - APT: Unknown - (.Microsoft Corporation.) -- C:\Windows\System32\Tasks\OneDrive Standalone Update Task v2 [3168] =>.Microsoft Corporation 
G0 - GCSP: Preferences [User Data\Default][HomePage] http://ui.ff.avast.com =>.Avast Software s.r.o 
G0 - GCSP: Preferences [User Data\Default][HomePage] http://cdn.adblockcdn.com 
G0 - GCSP: Preferences [User Data\Default][HomePage] http://docs.google.com =>.Google Inc. 
G0 - GCSP: Preferences [User Data\Default][HomePage] http://s2.googleusercontent.com =>.Google Inc. 
G0 - GCSP: Preferences [User Data\Default][HomePage] http://ssl.google-analytics.com =>.Google Inc. 
G0 - GCSP: Preferences [User Data\Default][HomePage] http://ssl.gstatic.com =>.Google Inc. 
G2 - GCE: Preference [User Data\Default] [cppnjmdljhemhdachecffocboniemifa] vidIQ for Chrome
G2 - GCE: Preference [User Data\Default] [iicapmagmhahddefgokbabbgieiogjop] Unseen =>.devunity.org 
G2 - GCE: Preference [User Data\Default] [oanhbddbfkjaphdibnebkklpplclomal] Subtitles For YouTube 
G2 - GCE: Preference [User Data\Default] [pachckjkecffpdphbpmfolblodfkgbhl] vidIQ Vision for YouTube 
R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http:// 
R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} Orphan =>.Microsoft Internet Explorer 
R4 - HKLM\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter,EnabledV9 = 1 
R4 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\PhishingFilter,EnabledV9 = 1 

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = uca.ma
O43 - CFD: 30/01/2017 - [] D -- C:\ProgramData\899b65n58w930 
O4 - HKCU\..\Run: [mailruhomesearch] C:\Users\acer pc\AppData\Local\Mail.Ru\Sputnik\ptls\mailruhomesearch.exe (.not file.) 
O4 - HKUS\S-1-5-21-861855363-829314862-1927938869-1003\..\Run: [mailruhomesearch] C:\Users\acer pc\AppData\Local\Mail.Ru\Sputnik\ptls\mailruhomesearch.exe (.not file.)