GroupPolicy: Restriction ? <======= ATTENTION
GroupPolicy\User: Restriction ? <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
CHR Extension: (Smart Browser™) - C:\Users\user\AppData\Local\Google\Chrome\User Data\ChromeDefaultData2\Extensions\iabeihobmhlgpkcgjiloemdbofjbdcic [2016-04-26]
CHR Extension: (Smart Browser™) - C:\Users\user\AppData\Local\Google\Chrome\User Data\ChromeDefaultData2\Extensions\ihmgiclibbndffejedjimfjmfoabpcke [2016-04-29]
CHR Extension: (Ultimate Discounter) - C:\Users\user\AppData\Local\Google\Chrome\User Data\ChromeDefaultData2\Extensions\ckcmdpmhiekiihmfjffdehhbhgllpapg [2015-05-30]
CHR Extension: (blacount) - C:\Users\user\AppData\Local\Google\Chrome\User Data\ChromeDefaultData2\Extensions\ecljapgcebeghdgfjacldomhcnlemkmk [2016-04-14]
CHR Extension: (Clipmate media files saver) - C:\Users\user\AppData\Local\Google\Chrome\User Data\ChromeDefaultData2\Extensions\gocgbnckcebedcielkcikcjbmgejaknb [2016-05-16]
OPR Extension: (blacount) - C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Extensions\ecljapgcebeghdgfjacldomhcnlemkmk [2016-02-07]
OPR Extension: (Clipmate media files saver) - C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Extensions\gocgbnckcebedcielkcikcjbmgejaknb [2016-05-16]
Task: {3F7067B3-7E56-4E32-8561-49A5B889DAF8} - \SystemMonitor2016 -> No File <==== ATTENTION
Task: {67EF4013-AC87-4ED0-9EB0-9B649A4DD498} - System32\Tasks\Microsoft\Windows\Multimedia\FreeVPN => C:\Users\user\AppData\Roaming\FreeVPN\FreeVPN.exe <==== ATTENTION
Task: {71D8D5F0-C99D-415B-AB44-8F70DADD41D9} - System32\Tasks\{F768CA74-3C5C-4EFB-9612-A7A1BCD327BA} => pcalua.exe -a "C:\Program Files\Sound+\uninstaller.exe"

EmptyTemp:
Reboot:

;uVS v3.87.8 [http://dsrt.dyndns.org]
;Target OS: NTv6.1
OFFSGNSAVE

addsgn 1AF7E29A5583338CF42BFB3A8843570D73010D75EFFE1FBF83D797FE5010374423E8F3BF96559D49A046DAC2841249AFF63363375D1DB1387F35A4A4C78F6377 8 Win32/ELEX

zoo %SystemDrive%\PROGRAMDATA\UWINPU\WFINI.EXE
zoo %SystemDrive%\PROGRAMDATA\XWINPX\WFINI.EXE
zoo %Sys32%\_TSPM\WPM.EXE
addsgn 1ADA779B5583338CF42B627DA8044553AEFED8E602B63B6C0EBFE1B0DB17FA9D20D1F8A9485DA6B12402EC9C46164640583F303455DBC32BDED34D38C40622F2 8 Win32/Obfuscated

zoo %SystemDrive%\PROGRAM FILES\SSFK.EXE
;------------------------autoscript---------------------------

chklst
delvir

delref %SystemDrive%\PROGRAM FILES\SUNNYDAY\OTUTNETWORK.EXE
del %SystemDrive%\PROGRAM FILES\SUNNYDAY\OTUTNETWORK.EXE

delref %SystemDrive%\PROGRAM FILES\HOSTIFY\IDSCSERVICE.EXE
del %SystemDrive%\PROGRAM FILES\HOSTIFY\IDSCSERVICE.EXE

delref HTTP://WWW.NUESEARCH.COM/?TYPE=HP&TS=1466693350&Z=189EB53A7DEB2FFC8919735G6Z6Q0Q8QFT4CDC6W7W&FROM=WPM0616&UID=ST9250315AS_5VC348CLXXXX5VC348CL
delref HTTP://WWW.NUESEARCH.COM/SEARCH/?TYPE=DS&TS=1466693350&Z=189EB53A7DEB2FFC8919735G6Z6Q0Q8QFT4CDC6W7W&FROM=WPM0616&UID=ST9250315AS_5VC348CLXXXX5VC348CL&Q={SEARCHTERMS}
deltmp
delnfr

;-------------------------------------------------------------

czoo

restart