CloseProcesses:
CreateRestorePoint:

Task: {8BF00725-A8E9-4BB9-B5D1-AD44C989B2B8} - System32\Tasks\bak6717741k6717741 => C:\Program Files (x86)\jab\jab.exe

AlternateDataStreams: C:\ProgramData\TEMP:5C321E34 [125]

MSCONFIG\Services: 859d7d2e111c588668d48c8007e778f8 => 2
MSCONFIG\startupreg: panted => "C:\Program Files (x86)\Textual\aerate.exe"
MSCONFIG\startupreg: pantedpanted => "C:\Program Files (x86)\Purged\aerate.exe"
MSCONFIG\startupreg: pantedpenman => "C:\Program Files (x86)\disputing\brothers.exe"

C:\Program Files (x86)\jab
C:\Program Files (x86)\Textual
C:\Program Files (x86)\Purged
C:\Program Files (x86)\disputing

EmptyTemp: