[ti]SOLVED[/ti]Yet another Kotver victim

Start
CreateRestorePoint:
CloseProcesses:
PCKeeper (Version: 2.2.2155 - Essentware) Hidden
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-26001085-875447989-177245938-1001\...\Run: [**xnsgltik<*>] => "C:\Users\Dan\AppData\Local\78f99\75a47.lnk" <===== ATTENTION (Value Name with invalid characters)
C:\Users\Dan\AppData\Local\78f99
Startup: C:\Users\Dan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\564cd.lnk [2016-10-12]
Startup: C:\Users\Dan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5d199.lnk [2016-10-13]
HKU\S-1-5-21-26001085-875447989-177245938-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-26001085-875447989-177245938-1001 -> DefaultScope {56F4DCD5-2515-44B2-8BBF-CF23A0B595BC} URL =
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
CHR Extension: (Google Slides) - C:\Users\Dan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-07-30]
CHR Extension: (Google Drive) - C:\Users\Dan\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-07-30]
CHR Extension: (VideoDownloadConverter) - C:\Users\Dan\AppData\Local\Google\Chrome\User Data\Default\Extensions\ikgjglmlehllifdekcggaapkaplbdpje [2016-07-30]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Dan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-07-30]
S3 dbx; system32\DRIVERS\dbx.sys [X]
C:\Windows\system32\DRIVERS\dbx.sys
2016-10-19 13:32 - 2016-10-19 13:32 - 00000000 ____D C:\Users\Dan\AppData\Local\78f99
2016-10-12 08:15 - 2016-10-19 13:33 - 00000000 ____D C:\Users\Dan\AppData\Roaming\2aa23
2016-10-12 08:10 - 2016-10-19 13:32 - 00000000 ____D C:\Users\Dan\AppData\Local\0adef
2016-10-06 05:46 - 2016-10-19 13:33 - 00000000 ____D C:\Users\Dan\AppData\Roaming\4cc24
2016-10-19 16:02 - 2016-07-30 14:01 - 00000284 _____ C:\Windows\Tasks\UpdaterEX.job
Task: {46319BBA-1CBA-4E1A-8262-2EAE54903F97} - System32\Tasks\UpdaterEX => C:\Users\Dan\AppData\Roaming\UPDATE~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
C:\Users\Dan\AppData\Roaming\UPDATE~1
Task: {4E370FB5-BD1E-4FA5-9B96-1CE7C65F1D2A} - System32\Tasks\{D6C3D78C-52CD-41FE-8206-01523002C8AB} => pcalua.exe -a C:\WINDOWS\twain_32\CyberViewX\CyberViewX.exe -d C:\Windows\twain_32\CyberViewX\
Task: {5719939B-C706-41CF-ABE4-28852DC86E1E} - \PCKeeper updater -> No File <==== ATTENTION
Task: C:\Windows\Tasks\UpdaterEX.job => C:\Users\Dan\AppData\Roaming\UPDATE~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
MSCONFIG\Services: AdobeActiveFileMonitor13.0 => 2
MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: AERTFilters => 2
MSCONFIG\Services: AGSService => 2
MSCONFIG\Services: Bonjour Service => 2
MSCONFIG\Services: bthserv => 3
MSCONFIG\Services: dbupdate => 2
MSCONFIG\Services: dbupdatem => 3
MSCONFIG\Services: DellDigitalDelivery => 2
MSCONFIG\Services: HPSupportSolutionsFrameworkService => 2
MSCONFIG\Services: NOBU => 2
MSCONFIG\Services: SftService => 2
MSCONFIG\Services: SkypeUpdate => 2
MSCONFIG\Services: Stereo Service => 2
MSCONFIG\Services: wlidsvc => 2
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WinZip Quick Pick.lnk => C:\Windows\pss\WinZip Quick Pick.lnk.CommonStartup
MSCONFIG\startupreg: Acrobat Assistant 8.0 => "C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: AdobeAAMUpdater-1.0 => "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
MSCONFIG\startupreg: AdobeCS4ServiceManager => "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
MSCONFIG\startupreg: AthBtTray => "C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AthBtTray.exe"
MSCONFIG\startupreg: AtherosBtStack => "C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe"
MSCONFIG\startupreg: Dell DataSafe Online => C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe
MSCONFIG\startupreg: Dropbox => "C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" /systemstartup
MSCONFIG\startupreg: HP Software Update => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: NvBackend => "C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
MSCONFIG\startupreg: PDF5 Registry Controller => C:\Program Files (x86)\Nuance\PDF Professional 5\RegistryController.exe
MSCONFIG\startupreg: PDFHook => C:\Program Files (x86)\Nuance\PDF Professional 5\pdfpro5hook.exe
cmd: ipconfig /flushdns
cmd: netsh advfirewall reset
cmd: netsh advfirewall set allprofiles state on
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
CMD: bitsadmin /reset /allusers
RemoveProxy:
EmptyTemp:
Reboot:
end