start createrestorepoint: emptytemp: HKLM-x32\...\Run: [] => [X] HKU\S-1-5-21-736287554-3709403269-3079134508-1001\...\MountPoints2: {0c8ea059-c550-11e3-a170-207c8f81d7e1} - E:\MotorolaDeviceManagerSetup.exe -a HKU\S-1-5-21-736287554-3709403269-3079134508-1001\...\MountPoints2: {6dfb850f-fd01-11e1-b56e-206a8a6fa9a7} - E:\PcOptions.exe HKU\S-1-5-21-736287554-3709403269-3079134508-1001\...\MountPoints2: {6dfb8511-fd01-11e1-b56e-206a8a6fa9a7} - E:\PcOptions.exe CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ProxyEnable: [S-1-5-21-736287554-3709403269-3079134508-1001] => Internet Explorer proxy is enabled SearchScopes: HKLM-x32 -> DefaultScope {BB82DE59-BC4C-4172-9AC4-73315F71CFFE} URL = http://websearch.goo...&cc=CA&unqvl=86 SearchScopes: HKLM-x32 -> {BB82DE59-BC4C-4172-9AC4-73315F71CFFE} URL = http://websearch.goo...&cc=CA&unqvl=86 SearchScopes: HKU\S-1-5-21-736287554-3709403269-3079134508-1001 -> {BB82DE59-BC4C-4172-9AC4-73315F71CFFE} URL = http://websearch.goo...&cc=CA&unqvl=86 R2 6135ae48; c:\Program Files (x86)\SustainerPlus\SustainerPlus.dll [1782784 2015-06-22] () [File not signed] c:\Program Files (x86)\SustainerPlus S2 862ff8a7; "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\afterguard\afterguard.dll",serv c:\Program Files (x86)\afterguard Task: {9EBDF0A2-24CD-454E-9843-AB14DAAC2B60} - System32\Tasks\Bidaily Synchronize Task[pr] => c:\programdata\{6601f041-7013-da3a-6601-1f041701c105}\backuptrans iphone whatsapp transfer.exe [2014-05-18] () <==== ATTENTION c:\programdata\{6601f041-7013-da3a-6601-1f041701c105} Task: C:\Windows\Tasks\Bidaily Synchronize Task[pr].job => c:\programdata\{6601f041-7013-da3a-6601-1f041701c105}\backuptrans iphone whatsapp transfer.exe <==== ATTENTION HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2072928 2014-10-31] (Wondershare) C:\Program Files (x86)\Common Files\Wondershare AlternateDataStreams: C:\Users\Crystal Narine\Desktop\DSC01654.JPG:Roxio EMC Stream AlternateDataStreams: C:\Users\Crystal Narine\Documents\10words.pps:Roxio EMC Stream AlternateDataStreams: C:\Users\Crystal Narine\Documents\A Glass of Milk.pps:Roxio EMC Stream AlternateDataStreams: C:\Users\Crystal Narine\Documents\Abortion.pps:Roxio EMC Stream AlternateDataStreams: C:\Users\Crystal Narine\Documents\Best Pictures.pps:Roxio EMC Stream AlternateDataStreams: C:\Users\Crystal Narine\Documents\Breath Taking Photos.pps:Roxio EMC Stream AlternateDataStreams: C:\Users\Crystal Narine\Documents\BreathTakingPhotos.pps:Roxio EMC Stream AlternateDataStreams: C:\Users\Crystal Narine\Documents\card.doc:Roxio EMC Stream AlternateDataStreams: C:\Users\Crystal Narine\Documents\cds.doc:Roxio EMC Stream AlternateDataStreams: C:\Users\Crystal Narine\Documents\cell fones.AVI:Roxio EMC Stream AlternateDataStreams: C:\Users\Crystal Narine\Documents\Chinese Proverb.pps:Roxio EMC Stream AlternateDataStreams: C:\Users\Crystal Narine\Documents\ChoicesWeMake_1.pps:Roxio EMC Stream AlternateDataStreams: C:\Users\Crystal Narine\Documents\circuit.pps:Roxio EMC Stream AlternateDataStreams: C:\Users\Crystal Narine\Documents\Copy of RBC consent electronic Jan 2009[1].doc:Roxio EMC Stream AlternateDataStreams: C:\Users\Crystal Narine\Documents\Crystal Narine.doc:Roxio EMC Stream AlternateDataStreams: C:\Users\Crystal Narine\Documents\Find.pps:Roxio EMC Stream AlternateDataStreams: C:\Users\Crystal Narine\Documents\fone numbers.doc:Roxio EMC Stream AlternateDataStreams: C:\Users\Crystal Narine\Documents\goodkarma12.pps:Roxio EMC Stream AlternateDataStreams: C:\Users\Crystal Narine\Documents\Kodak_moment.pps:Roxio EMC Stream AlternateDataStreams: C:\Users\Crystal Narine\Documents\Mobile Phone Recharge.pps:Roxio EMC Stream AlternateDataStreams: C:\Users\Crystal Narine\Documents\Mushroom Salad.doc:Roxio EMC Stream AlternateDataStreams: C:\Users\Crystal Narine\Documents\Nageur_ét...pps:Roxio EMC Stream AlternateDataStreams: C:\Users\Crystal Narine\Documents\New Sony En.PPS:Roxio EMC Stream AlternateDataStreams: C:\Users\Crystal Narine\Documents\Price of Gas.pps:Roxio EMC Stream AlternateDataStreams: C:\Users\Crystal Narine\Documents\PSLE0U-PSLC0U-Win7UpgradeInstructions.pdf:Roxio EMC Stream AlternateDataStreams: C:\Users\Crystal Narine\Documents\Put_the_Glass_Down__.pps:Roxio EMC Stream AlternateDataStreams: C:\Users\Crystal Narine\Documents\SalaryReview.pps:Roxio EMC Stream AlternateDataStreams: C:\Users\Crystal Narine\Documents\scheduleCN 2011.doc:Roxio EMC Stream AlternateDataStreams: C:\Users\Crystal Narine\Documents\scheduleCN.doc:Roxio EMC Stream AlternateDataStreams: C:\Users\Crystal Narine\Documents\thank you letter.doc:Roxio EMC Stream AlternateDataStreams: C:\Users\Crystal Narine\Documents\The Poem.pps:Roxio EMC Stream AlternateDataStreams: C:\Users\Crystal Narine\Documents\The Window.pps:Roxio EMC Stream AlternateDataStreams: C:\Users\Crystal Narine\Documents\The Woman.pps:Roxio EMC Stream AlternateDataStreams: C:\Users\Crystal Narine\Documents\TheParadoxofOurTimes.pps:Roxio EMC Stream AlternateDataStreams: C:\Users\Crystal Narine\Documents\TheWoman.pps:Roxio EMC Stream AlternateDataStreams: C:\Users\Crystal Narine\Documents\Two Choices.pps:Roxio EMC Stream AlternateDataStreams: C:\Users\Crystal Narine\Documents\WordsWomenUse1.pps:Roxio EMC Stream end: