CloseProcesses:
HKLM\...\Policies\Explorer\Run: [{2d6b6696-d62f-1077-d5ec-c6bf71045b39}] => "C:\ProgramData\Microsoft\{2d6b6696-d62f-1077-d5ec-c6bf71045b39}\{2d6b6696-d62f-1077-d5ec-c6bf71045b39}.exe" No File
HKLM\...\Policies\Explorer: [HideSCAHealth] 1
HKU\S-1-5-21-3904076736-4116430610-328848089-1000\...\Policies\Explorer: [HideSCAHealth] 1
HKU\S-1-5-21-3904076736-4116430610-328848089-1000\...\MountPoints2: G - G:\TL-Bootstrap.exe
HKU\S-1-5-21-3904076736-4116430610-328848089-1000\...\MountPoints2: {11848ce8-569d-11e3-bc6c-a0b3ccc3d4d1} - G:\menu.exe
HKU\S-1-5-21-3904076736-4116430610-328848089-1000\...\MountPoints2: {1184952c-569d-11e3-bc6c-a0b3ccc3d4d1} - G:\TL-Bootstrap.exe
HKU\S-1-5-21-3904076736-4116430610-328848089-1000\...\MountPoints2: {5fddabe5-44a2-11e3-ba79-a0b3ccc3d4d1} - G:\TL-Bootstrap.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {0E7F5DCC-5175-4ED9-AE82-C84450302BDC} URL =
SearchScopes: HKCU - {2fa28606-de77-4029-af96-b231e3b8f827} URL =
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2476} URL =
SearchScopes: HKCU - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL =
SearchScopes: HKCU - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL =
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL =
Task: {2DADDDFD-07D4-4FE2-BC87-46768232E9BA} - System32\Tasks\bench-sys => C:\Program Files (x86)\Bench\Updater\updater.exe [2013-12-20] () <==== ATTENTION
Task: {B1263FCB-9CB2-45D7-9698-3B5EF7435962} - System32\Tasks\bench-Updater removing
Task: C:\Windows\Tasks\bench-sys.job => C:\Program Files (x86)\Bench\Updater\updater.exe <==== ATTENTION
Task: C:\Windows\Tasks\bench-Updater removing.job => ? <==== ATTENTION
C:\Program Files (x86)\Bench
AlternateDataStreams: C:\Users\Carol\Local Settings:init
AlternateDataStreams: C:\Users\Carol\AppData\Local:init
AlternateDataStreams: C:\Users\Carol\AppData\Local\Application Data:init
EmptyTemp: