CreateRestorePoint:
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-3578966673-3173021478-2160172042-1001\...\MountPoints2: I - "I:\AutoRun.exe" 
HKU\S-1-5-21-3578966673-3173021478-2160172042-1001\...\MountPoints2: {3f7b560c-6ab2-11e5-8260-cc3d82e2884d} - "H:\AutoRun.exe" 
HKU\S-1-5-21-3578966673-3173021478-2160172042-1001\...\MountPoints2: {3f7b564e-6ab2-11e5-8260-cc3d82e2884d} - "H:\AutoRun.exe" 
HKU\S-1-5-21-3578966673-3173021478-2160172042-1001\...\MountPoints2: {3f7b5bac-6ab2-11e5-8260-cc3d82e2884d} - "H:\AutoRun.exe" 
HKU\S-1-5-21-3578966673-3173021478-2160172042-1001\...\MountPoints2: {3f7b5d7b-6ab2-11e5-8260-cc3d82e2884d} - "I:\AutoRun.exe" 
HKU\S-1-5-21-3578966673-3173021478-2160172042-1001\...\MountPoints2: {8784b0b0-8a8b-11e5-8273-cc3d82e2884d} - "I:\AutoRun.exe" 
HKU\S-1-5-21-3578966673-3173021478-2160172042-1001\...\MountPoints2: {d91cd4ad-6b29-11e5-8262-cc3d82e2884d} - "H:\AutoRun.exe" 
EmptyTemp: