start CreateRestorePoint: Task: {82D5512B-DA35-4A82-AD09-594E95C8B9D8} - System32\Tasks\{FA9F4936-A1D4-44B4-8EDB-14877ABAA988} => C:\Windows\system32\pcalua.exe -a C:\Users\Rik\Desktop\wlsetup-all.exe -d C:\Users\Rik\Desktop Task: {906E1370-6DE1-40BD-90C0-433CE4F963D3} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2017-09-27] (Adobe Systems Incorporated) SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-870238790-3972679876-3293455752-1000 -> DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://mysearch.sweetpacks.com?src=6&q={searchTerms}&barid=1523566147773080386&crg=&ppd=na&st=23&i=48&did=10977 SearchScopes: HKU\S-1-5-21-870238790-3972679876-3293455752-1000 -> {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://mysearch.sweetpacks.com?src=6&q={searchTerms}&barid=1523566147773080386&crg=&ppd=na&st=23&i=48&did=10977 2018-01-02 13:53 - 2018-01-02 13:53 - 011201632 _____ (Piriform Ltd) C:\Users\Rik\Downloads\ccsetup538 (3).exe 2018-01-02 13:51 - 2018-01-02 13:51 - 011201632 _____ (Piriform Ltd) C:\Users\Rik\Downloads\ccsetup538 (2).exe 2018-01-02 13:50 - 2018-01-02 13:50 - 011201632 _____ (Piriform Ltd) C:\Users\Rik\Downloads\ccsetup538 (1).exe 2018-01-01 11:23 - 2018-01-03 13:49 - 000000000 ____D C:\Users\Rik\Downloads\FRST-OlderVersion EmptyTemp: end