<?xml version="1.0" encoding="UTF-16" ?>
<mbam-log>
<header>
<date>2016/04/03 14:33:57 +0500</date>
<logfile>mbam-log-2016-04-03 (14-32-56).xml</logfile>
<isadmin>yes</isadmin>
</header>
<engine>
<version>2.2.1.1043</version>
<malware-database>v2016.04.03.02</malware-database>
<rootkit-database>v2016.03.30.01</rootkit-database>
<license>free</license>
<file-protection>disabled</file-protection>
<web-protection>disabled</web-protection>
<self-protection>disabled</self-protection>
</engine>
<system>
<hostname>ILYA</hostname>
<ip>192.168.0.49</ip>
<osversion>Windows 7 Service Pack 1</osversion>
<arch>x64</arch>
<username>gtx</username>
<filesys>NTFS</filesys>
</system>
<summary>
<type>threat</type>
<result>completed</result>
<objects>473262</objects>
<time>1042</time>
<processes>0</processes>
<modules>0</modules>
<keys>23</keys>
<values>9</values>
<datas>7</datas>
<folders>14</folders>
<files>77</files>
<sectors>0</sectors>
</summary>
<options>
<memory>enabled</memory>
<startup>enabled</startup>
<filesystem>enabled</filesystem>
<archives>enabled</archives>
<rootkits>disabled</rootkits>
<deeprootkit>disabled</deeprootkit>
<heuristics>enabled</heuristics>
<pup>enabled</pup>
<pum>enabled</pum>
</options>
<items>
<key><path>HKLM\SOFTWARE\CLASSES\APPID\3045035B-3C14-4698-8AC4-ADB18CC42C1E</path><vendor>PUP.Optional.Wajam</vendor><action></action><hash>97d707a316830135233deaf0d13141bf</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\3045035B-3C14-4698-8AC4-ADB18CC42C1E</path><vendor>PUP.Optional.Wajam</vendor><action></action><hash>97d707a316830135233deaf0d13141bf</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\WOW6432NODE\APPID\3045035B-3C14-4698-8AC4-ADB18CC42C1E</path><vendor>PUP.Optional.Wajam</vendor><action></action><hash>97d707a316830135233deaf0d13141bf</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\TYPELIB\{CCA2A357-CCB4-41C9-B6F5-4F202B8CDC82}</path><vendor>PUP.Optional.ContentDefender</vendor><action></action><hash>66083278e8b11b1b0954469e8979c43c</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\INTERFACE\{B28F9114-243E-4046-B173-11825352D18A}</path><vendor>PUP.Optional.ContentDefender</vendor><action></action><hash>66083278e8b11b1b0954469e8979c43c</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{B28F9114-243E-4046-B173-11825352D18A}</path><vendor>PUP.Optional.ContentDefender</vendor><action></action><hash>66083278e8b11b1b0954469e8979c43c</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{B28F9114-243E-4046-B173-11825352D18A}</path><vendor>PUP.Optional.ContentDefender</vendor><action></action><hash>66083278e8b11b1b0954469e8979c43c</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{CCA2A357-CCB4-41C9-B6F5-4F202B8CDC82}</path><vendor>PUP.Optional.ContentDefender</vendor><action></action><hash>66083278e8b11b1b0954469e8979c43c</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\WOW6432NODE\TYPELIB\{CCA2A357-CCB4-41C9-B6F5-4F202B8CDC82}</path><vendor>PUP.Optional.ContentDefender</vendor><action></action><hash>66083278e8b11b1b0954469e8979c43c</hash></key>
<key><path>HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\DAMFAX.EXE</path><vendor>PUP.Optional.Linkury</vendor><action></action><hash>a6c87337445569cd979a58c416eca957</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\DAMFAX.EXE</path><vendor>PUP.Optional.Linkury</vendor><action></action><hash>a6c87337445569cd979a58c416eca957</hash></key>
<key><path>HKLM\SOFTWARE\WNEN</path><vendor>PUP.Optional.Wajam</vendor><action></action><hash>95d91d8ddabf152142b0134c986c0000</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\CloudPrinter_RASAPI32</path><vendor>PUP.Optional.Linkury.ACMB1</vendor><action></action><hash>5816e6c4d6c3b482dda8a7f3f3117090</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\CloudPrinter_RASMANCS</path><vendor>PUP.Optional.Linkury.ACMB1</vendor><action></action><hash>71fd3b6f1a7fed497510950555af3ac6</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\WNEN</path><vendor>PUP.Optional.Wajam</vendor><action></action><hash>beb01793bbded165579be17e8a7a9c64</hash></key>
<key><path>HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\ContentProtectorUpdate</path><vendor>PUP.Optional.ContentProtector</vendor><action></action><hash>521c9f0b66332a0c4d6faee9966ecd33</hash></key>
<key><path>HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\Application Hosting</path><vendor>PUP.Optional.Linkury.ACMB1</vendor><action></action><hash>3c327733a8f19f97ca9f46555ba9cc34</hash></key>
<key><path>HKU\S-1-5-21-1886404636-2730876035-11984144-1000\SOFTWARE\WajIEnhance</path><vendor>PUP.Optional.Wajam</vendor><action></action><hash>1d5112987f1a9a9c5b9f0b3708fc0bf5</hash></key>
<key><path>HKU\S-1-5-21-1886404636-2730876035-11984144-1001\SOFTWARE\Ultimate-Discounter</path><vendor>PUP.Optional.UltimateDiscounter</vendor><action></action><hash>006ebaf02f6a181e0276612d7a8a07f9</hash></key>
<key><path>HKU\S-1-5-21-1886404636-2730876035-11984144-1001\SOFTWARE\WajIEnhance</path><vendor>PUP.Optional.Wajam</vendor><action></action><hash>cca23872aeeba1954fab2d1546be30d0</hash></key>
<key><path>HKU\S-1-5-21-1886404636-2730876035-11984144-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOWREGISTRY\AUDIO\POLICYCONFIG\PROPERTYSTORE\BA3C1F28_0</path><vendor>PUP.Optional.Zaxar</vendor><action></action><hash>006ed5d53b5ef640be4a27619470ca36</hash></key>
<key><path>HKU\S-1-5-21-1886404636-2730876035-11984144-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOWREGISTRY\AUDIO\POLICYCONFIG\PROPERTYSTORE\E9867220_0</path><vendor>PUP.Optional.Zaxar</vendor><action></action><hash>f47aaffbcfca63d38a7eb0d8699b6a96</hash></key>
<key><path>HKU\S-1-5-21-1886404636-2730876035-11984144-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{IELNKSRCH}</path><vendor>PUP.Optional.Linkury</vendor><action></action><hash>8ae44466aeeb251133ba4a4eda2a2fd1</hash></key>
<value><path>HKLM\SOFTWARE\WNEN</path><valuename>ts</valuename><vendor>PUP.Optional.Wajam</vendor><action></action><valuedata>1459272018</valuedata><hash>95d91d8ddabf152142b0134c986c0000</hash></value>
<value><path>HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHURL</path><valuename>Default</valuename><vendor>PUP.Optional.Linkury</vendor><action></action><valuedata>http://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBVfHKT0_PmcsKeqnIZqvsoDdJo7Sa_3j-XDwyfN6ubTmbcDMoAiYwS6lnGgzHQVEaI-oK0aFgDwFY3jPbB2Xh81QVVUMoHhGBijBK3LUPfx8v9hRFz35XxfIz04XUkExDivkSytdp9snDnhpN3c2SfZNyfHK7DAiw7u4Q3CXzSWmhvi87DfpBt8b7G&amp;q={searchTerms}</valuedata><hash>3d31aefc7425ba7ce4b712143ac9847c</hash></value>
<value><path>HKLM\SOFTWARE\WOW6432NODE\WNEN</path><valuename>ts</valuename><vendor>PUP.Optional.Wajam</vendor><action></action><valuedata>1459272018</valuedata><hash>beb01793bbded165579be17e8a7a9c64</hash></value>
<value><path>HKU\S-1-5-18\ENVIRONMENT</path><valuename>SNP</valuename><vendor>PUP.Optional.Linkury.ACMB1</vendor><action></action><valuedata>http://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D?publisher=APSFSmartSoft&amp;co=RU&amp;userid=2b513664-1200-a5ce-2381-ca76a1ebc637&amp;searchtype=sc&amp;installDate=29.03.2016&amp;barcodeid=51160003&amp;channelid=3&amp;av=windows</valuedata><hash>c3aba406aeebe1559d2a8019f1135ea2</hash></value>
<value><path>HKU\S-1-5-21-1886404636-2730876035-11984144-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURL</path><valuename>Default</valuename><vendor>PUP.Optional.Linkury.ACMB1</vendor><action></action><valuedata>http://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBVfHKT0_PmcsKeqnIZqvsoDdJo7Sa_3j-XDwyfN6ubTmbcDMoAiYwS6lnGgzHQVEaI-oK0aFgDwFY3jPbB2Xh81QVVUMoHhGBijBK3LUPfx8v9hRFz35XxfIz04XUkExDivkSytdp9snDnhpN3c2SfZNyfHK7DAiw7u4Q3CXzSWmhvi87DfpBt8b7G&amp;q={searchTerms}</valuedata><hash>3935a4066138bd79990dcad17094cc34</hash></value>
<value><path>HKU\S-1-5-21-1886404636-2730876035-11984144-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOWREGISTRY\AUDIO\POLICYCONFIG\PROPERTYSTORE\ba3c1f28_0</path><valuename></valuename><vendor>PUP.Optional.Zaxar</vendor><action></action><valuedata>{0.0.0.00000000}.{02b3786d-440f-4e32-a1b0-30c39bdd96d2}|\Device\HarddiskVolume2\Program Files (x86)\Zaxar\ZaxarGameBrowser.exe%b{00000000-0000-0000-0000-000000000000}</valuedata><hash>006ed5d53b5ef640be4a27619470ca36</hash></value>
<value><path>HKU\S-1-5-21-1886404636-2730876035-11984144-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOWREGISTRY\AUDIO\POLICYCONFIG\PROPERTYSTORE\e9867220_0</path><valuename></valuename><vendor>PUP.Optional.Zaxar</vendor><action></action><valuedata>{0.0.0.00000000}.{6904662f-1182-4473-bd52-fa8d42eda839}|\Device\HarddiskVolume2\Program Files (x86)\Zaxar\ZaxarGameBrowser.exe%b{00000000-0000-0000-0000-000000000000}</valuedata><hash>f47aaffbcfca63d38a7eb0d8699b6a96</hash></value>
<value><path>HKU\S-1-5-21-1886404636-2730876035-11984144-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{ielnksrch}</path><valuename>DisplayName</valuename><vendor>PUP.Optional.Linkury</vendor><action></action><valuedata>Search the web</valuedata><hash>8ae44466aeeb251133ba4a4eda2a2fd1</hash></value>
<value><path>HKU\S-1-5-21-1886404636-2730876035-11984144-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURL</path><valuename>Default</valuename><vendor>PUP.Optional.Linkury.ACMB1</vendor><action></action><valuedata>http://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBVfHKT0_PmcsKeqnIZqvsoDdJo7Sa_3j-XDwyfN6ubTmbcDMoAiYwS6lnGgzHQVEaI-oK0aFgDwFY3jPbB2Xh81QVVUMoHhGBijBK3LUPfx8v9hRFz35XxfIz04XUkExDivkSytdp9snDnhpN3c2SfZNyfHK7DAiw7u4Q3CXzSWmhvi87DfpBt8b7G&amp;q={searchTerms}</valuedata><hash>eb83eac05c3d0333198d3f5cc0447090</hash></value>
<data><path>HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES</path><valuename>DefaultScope</valuename><vendor>PUP.Optional.Linkury</vendor><action></action><valuedata>{ielnksrch}</valuedata><baddata>{ielnksrch}</baddata><gooddata>{0633EE93-D776-472f-A0FF-E1416B8B2E3A}</gooddata><hash>72fc2c7ecacf9c9a908974ba877ec53b</hash></data>
<data><path>HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER</path><valuename>UpdatesDisableNotify</valuename><vendor>PUM.Optional.DisabledSecurityCenter</vendor><action></action><valuedata>1</valuedata><baddata>1</baddata><gooddata>0</gooddata><hash>6c0232781b7e9c9a6fe3022bc243f50b</hash></data>
<data><path>HKU\S-1-5-21-1886404636-2730876035-11984144-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN</path><valuename>SearchAssistant</valuename><vendor>PUP.Optional.Linkury.ACMB1</vendor><action></action><valuedata>http://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBVfHKT0_PmcsKeqnIZqvsoDdJo7Sa_3j-XDwyfN6ubTmbcDMoAiYwS6lnGgzHQVEaI-oK0aFgDwFY3jPbB2Xh81QVVUMoHhGBijBK3LUPfx8v9hRFz35XxfIz04XUkExDivkSytdp9snDnhpN3c2SfZNyfHK7DAiw7u4Q3CXzSWmhvi87DfpBt8b7G&amp;q={searchTerms}</valuedata><baddata>http://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBVfHKT0_PmcsKeqnIZqvsoDdJo7Sa_3j-XDwyfN6ubTmbcDMoAiYwS6lnGgzHQVEaI-oK0aFgDwFY3jPbB2Xh81QVVUMoHhGBijBK3LUPfx8v9hRFz35XxfIz04XUkExDivkSytdp9snDnhpN3c2SfZNyfHK7DAiw7u4Q3CXzSWmhvi87DfpBt8b7G&amp;q={searchTerms}</baddata><gooddata>www.google.com</gooddata><hash>afbf1d8d5a3f072f9a8889a549bcdd23</hash></data>
<data><path>HKU\S-1-5-21-1886404636-2730876035-11984144-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH</path><valuename>Default_Search_URL</valuename><vendor>PUP.Optional.Linkury.ACMB1</vendor><action></action><valuedata>http://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBVfHKT0_PmcsKeqnIZqvsoDdJo7Sa_3j-XDwyfN6ubTmbcDMoAiYwS6lnGgzHQVEaI-oK0aFgDwFY3jPbB2Xh81QVVUMoHhGBijBK3LUPfx8v9hRFz35XxfIz04XUkExDivkSytdp9snDnhpN3c2SfZNyfHK7DAiw7u4Q3CXzSWmhvi87DfpBt8b7G&amp;q={searchTerms}</valuedata><baddata>http://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBVfHKT0_PmcsKeqnIZqvsoDdJo7Sa_3j-XDwyfN6ubTmbcDMoAiYwS6lnGgzHQVEaI-oK0aFgDwFY3jPbB2Xh81QVVUMoHhGBijBK3LUPfx8v9hRFz35XxfIz04XUkExDivkSytdp9snDnhpN3c2SfZNyfHK7DAiw7u4Q3CXzSWmhvi87DfpBt8b7G&amp;q={searchTerms}</baddata><gooddata>www.google.com</gooddata><hash>f579901a70291a1c1211e44ac73ecf31</hash></data>
<data><path>HKU\S-1-5-21-1886404636-2730876035-11984144-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES</path><valuename>DefaultScope</valuename><vendor>PUP.Optional.Linkury</vendor><action></action><valuedata>{ielnksrch}</valuedata><baddata>{ielnksrch}</baddata><gooddata>{0633EE93-D776-472f-A0FF-E1416B8B2E3A}</gooddata><hash>1f4f8426bedb4ee878a01b13b84db54b</hash></data>
<data><path>HKU\S-1-5-21-1886404636-2730876035-11984144-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN</path><valuename>SearchAssistant</valuename><vendor>PUP.Optional.Linkury.ACMB1</vendor><action></action><valuedata>http://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBVfHKT0_PmcsKeqnIZqvsoDdJo7Sa_3j-XDwyfN6ubTmbcDMoAiYwS6lnGgzHQVEaI-oK0aFgDwFY3jPbB2Xh81QVVUMoHhGBijBK3LUPfx8v9hRFz35XxfIz04XUkExDivkSytdp9snDnhpN3c2SfZNyfHK7DAiw7u4Q3CXzSWmhvi87DfpBt8b7G&amp;q={searchTerms}</valuedata><baddata>http://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBVfHKT0_PmcsKeqnIZqvsoDdJo7Sa_3j-XDwyfN6ubTmbcDMoAiYwS6lnGgzHQVEaI-oK0aFgDwFY3jPbB2Xh81QVVUMoHhGBijBK3LUPfx8v9hRFz35XxfIz04XUkExDivkSytdp9snDnhpN3c2SfZNyfHK7DAiw7u4Q3CXzSWmhvi87DfpBt8b7G&amp;q={searchTerms}</baddata><gooddata>www.google.com</gooddata><hash>c3ab4961b6e387afa37f171764a19a66</hash></data>
<data><path>HKU\S-1-5-21-1886404636-2730876035-11984144-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH</path><valuename>Default_Search_URL</valuename><vendor>PUP.Optional.Linkury.ACMB1</vendor><action></action><valuedata>http://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBVfHKT0_PmcsKeqnIZqvsoDdJo7Sa_3j-XDwyfN6ubTmbcDMoAiYwS6lnGgzHQVEaI-oK0aFgDwFY3jPbB2Xh81QVVUMoHhGBijBK3LUPfx8v9hRFz35XxfIz04XUkExDivkSytdp9snDnhpN3c2SfZNyfHK7DAiw7u4Q3CXzSWmhvi87DfpBt8b7G&amp;q={searchTerms}</valuedata><baddata>http://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBVfHKT0_PmcsKeqnIZqvsoDdJo7Sa_3j-XDwyfN6ubTmbcDMoAiYwS6lnGgzHQVEaI-oK0aFgDwFY3jPbB2Xh81QVVUMoHhGBijBK3LUPfx8v9hRFz35XxfIz04XUkExDivkSytdp9snDnhpN3c2SfZNyfHK7DAiw7u4Q3CXzSWmhvi87DfpBt8b7G&amp;q={searchTerms}</baddata><gooddata>www.google.com</gooddata><hash>8ae4971353463204c85b34fa679e1ee2</hash></data>
<folder><path>C:\Program Files\7c4a7d0bd73a7d1db7f3a416497fd858\755b821671e05a690e1e8af5d3c99446</path><vendor>PUP.Optional.Wajam.Gen</vendor><action></action><hash>640af7b370294ee8d8b4cfca57ad8c74</hash></folder>
<folder><path>C:\Program Files\7c4a7d0bd73a7d1db7f3a416497fd858</path><vendor>PUP.Optional.Wajam.Gen</vendor><action></action><hash>640af7b370294ee8d8b4cfca57ad8c74</hash></folder>
<folder><path>C:\Program Files\7c4a7d0bd73a7d1db7f3a416497fd858\ce91e3b6243e973d4dfe66b8605ed385</path><vendor>PUP.Optional.Wajam.Gen</vendor><action></action><hash>640af7b370294ee8d8b4cfca57ad8c74</hash></folder>
<folder><path>C:\ProgramData\CloudPrinter</path><vendor>PUP.Optional.Linkury.ACMB1</vendor><action></action><hash>4e206c3e8f0a5adc3484960343c1c040</hash></folder>
<folder><path>C:\Users\Илья\AppData\Roaming\OpenCandy</path><vendor>PUP.Optional.OpenCandy</vendor><action></action><hash>3f2f3a70c0d9d85e6a3fbe320bf74ab6</hash></folder>
<folder><path>C:\Users\Илья\AppData\Roaming\OpenCandy\OpenCandy_260595D8EE3A437AB4ED5A64EB114226</path><vendor>PUP.Optional.OpenCandy</vendor><action></action><hash>3f2f3a70c0d9d85e6a3fbe320bf74ab6</hash></folder>
<folder><path>C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZaxarGameBrowser</path><vendor>PUP.Optional.Zaxar</vendor><action></action><hash>78f6a00a584156e018e0d84809fa0df3</hash></folder>
<folder><path>C:\Program Files\ContentProtector</path><vendor>PUP.Optional.ContentProtector</vendor><action></action><hash>175783278c0d87afcbe68f96d72c18e8</hash></folder>
<folder><path>C:\Program Files\ContentProtector\cert</path><vendor>PUP.Optional.ContentProtector</vendor><action></action><hash>175783278c0d87afcbe68f96d72c18e8</hash></folder>
<folder><path>C:\Program Files\ContentProtector\cert\SSL</path><vendor>PUP.Optional.ContentProtector</vendor><action></action><hash>175783278c0d87afcbe68f96d72c18e8</hash></folder>
<folder><path>C:\Program Files\ContentProtector\nss</path><vendor>PUP.Optional.ContentProtector</vendor><action></action><hash>175783278c0d87afcbe68f96d72c18e8</hash></folder>
<folder><path>C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ContentProtector</path><vendor>PUP.Optional.ContentProtector</vendor><action></action><hash>1c526446fa9f12242f83d3525aa93bc5</hash></folder>
<folder><path>C:\Users\gtx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SaveYouTime</path><vendor>PUP.Optional.Coupruon</vendor><action></action><hash>cca2f8b28019082e4172b76e9c67946c</hash></folder>
<folder><path>C:\Program Files (x86)\Common Files\HotHathome</path><vendor>PUP.Optional.Linkury.ACMB1</vendor><action></action><hash>2648d3d71c7da78f4be0f168768f1be5</hash></folder>
<file><path>C:\ProgramData\CloudPrinter\CloudPrinter.exe</path><vendor>PUP.Optional.Linkury</vendor><action></action><hash>08668723edacab8bc0717aa204fe916f</hash></file>
<file><path>C:\ProgramData\Damfax\Damfax.exe</path><vendor>PUP.Optional.Linkury</vendor><action></action><hash>a6c87337445569cd979a58c416eca957</hash></file>
<file><path>C:\ProgramData\Damfax\Newsoft.dll</path><vendor>PUP.Optional.Linkury</vendor><action></action><hash>92dc5c4efc9d60d6b4f943d28979d927</hash></file>
<file><path>C:\ProgramData\Damfax\TreeOtcom.exe</path><vendor>PUP.Optional.Linkury</vendor><action></action><hash>521ce0ca0e8bc472f25920c900017d83</hash></file>
<file><path>C:\Users\gtx\AppData\Roaming\Silverlam.bin</path><vendor>PUP.Optional.Linkury</vendor><action></action><hash>204e9c0ec3d6b28408a1ee2b5baa3cc4</hash></file>
<file><path>C:\Users\gtx\AppData\Roaming\Geo-Zap.exe</path><vendor>PUP.Optional.Linkury</vendor><action></action><hash>75f9b4f6fb9ee551cd6478a459a99d63</hash></file>
<file><path>C:\Users\gtx\AppData\Roaming\GrooveFan.exe</path><vendor>PUP.Optional.Linkury</vendor><action></action><hash>c7a7e6c49efb42f4ca670616f50dca36</hash></file>
<file><path>C:\Users\gtx\Desktop\minecraftcheat.exe</path><vendor>Trojan.Winlock</vendor><action></action><hash>eb831595e3b62e08dc52f51ce11fb14f</hash></file>
<file><path>C:\Users\gtx\AppData\Roaming\Mozilla\Firefox\Profiles\lf00bzju.default-1448372809811\searchplugins\findit.xml</path><vendor>PUP.Optional.YesSearches</vendor><action></action><hash>c3abecbe96031e181d3d6cbd31d2ea16</hash></file>
<file><path>C:\Users\gtx\AppData\Roaming\ApplicationHosting.dat</path><vendor>PUP.Optional.Linkury</vendor><action></action><hash>a7c781295e3b231304f1a1f2fb09f808</hash></file>
<file><path>C:\Users\gtx\AppData\Roaming\md.xml</path><vendor>PUP.Optional.Linkury</vendor><action></action><hash>a8c6d5d5a8f1270fee08a8eb42c209f7</hash></file>
<file><path>C:\Users\gtx\AppData\Roaming\noah.dat</path><vendor>PUP.Optional.Linkury</vendor><action></action><hash>e28cefbbedac21156295e2b1669ebc44</hash></file>
<file><path>C:\Users\gtx\AppData\Roaming\uninstall_temp.ico</path><vendor>PUP.Optional.Linkury</vendor><action></action><hash>5d1105a5c2d7af877187870cf410e51b</hash></file>
<file><path>C:\Users\gtx\AppData\Roaming\lobby.dat</path><vendor>PUP.Optional.Linkury</vendor><action></action><hash>1e508b1fc4d53204c0ccd2c2c34125db</hash></file>
<file><path>C:\Program Files\7c4a7d0bd73a7d1db7f3a416497fd858\755b821671e05a690e1e8af5d3c99446\0929bfec4411d093c6e7c704fda45c6e.ico</path><vendor>PUP.Optional.Wajam.Gen</vendor><action></action><hash>640af7b370294ee8d8b4cfca57ad8c74</hash></file>
<file><path>C:\Program Files\7c4a7d0bd73a7d1db7f3a416497fd858\755b821671e05a690e1e8af5d3c99446\42088c236d9cbc393bba047a14d0a56e.ico</path><vendor>PUP.Optional.Wajam.Gen</vendor><action></action><hash>640af7b370294ee8d8b4cfca57ad8c74</hash></file>
<file><path>C:\Program Files\7c4a7d0bd73a7d1db7f3a416497fd858\755b821671e05a690e1e8af5d3c99446\195273185dbbef44a83c03429bd05c43.ico</path><vendor>PUP.Optional.Wajam.Gen</vendor><action></action><hash>640af7b370294ee8d8b4cfca57ad8c74</hash></file>
<file><path>C:\Program Files\7c4a7d0bd73a7d1db7f3a416497fd858\755b821671e05a690e1e8af5d3c99446\1be30c382d3e2308e91c56cc19f782b2.ico</path><vendor>PUP.Optional.Wajam.Gen</vendor><action></action><hash>640af7b370294ee8d8b4cfca57ad8c74</hash></file>
<file><path>C:\Program Files\7c4a7d0bd73a7d1db7f3a416497fd858\755b821671e05a690e1e8af5d3c99446\360eff8336167036541f53742146067f.ico</path><vendor>PUP.Optional.Wajam.Gen</vendor><action></action><hash>640af7b370294ee8d8b4cfca57ad8c74</hash></file>
<file><path>C:\Program Files\7c4a7d0bd73a7d1db7f3a416497fd858\755b821671e05a690e1e8af5d3c99446\37cf5adcd4dbd6090418d16878a900b3.ico</path><vendor>PUP.Optional.Wajam.Gen</vendor><action></action><hash>640af7b370294ee8d8b4cfca57ad8c74</hash></file>
<file><path>C:\Program Files\7c4a7d0bd73a7d1db7f3a416497fd858\755b821671e05a690e1e8af5d3c99446\39510f4d451d00fbf1ffd020364f694f.ico</path><vendor>PUP.Optional.Wajam.Gen</vendor><action></action><hash>640af7b370294ee8d8b4cfca57ad8c74</hash></file>
<file><path>C:\Program Files\7c4a7d0bd73a7d1db7f3a416497fd858\755b821671e05a690e1e8af5d3c99446\40f8b16633c598467a46faca0abc2dc2.ico</path><vendor>PUP.Optional.Wajam.Gen</vendor><action></action><hash>640af7b370294ee8d8b4cfca57ad8c74</hash></file>
<file><path>C:\Program Files\7c4a7d0bd73a7d1db7f3a416497fd858\755b821671e05a690e1e8af5d3c99446\4b05a70a54cfbcb1f8649488db8a47ae.ico</path><vendor>PUP.Optional.Wajam.Gen</vendor><action></action><hash>640af7b370294ee8d8b4cfca57ad8c74</hash></file>
<file><path>C:\Program Files\7c4a7d0bd73a7d1db7f3a416497fd858\755b821671e05a690e1e8af5d3c99446\5363adc8d5b407a61c88103a3bab9c15.ico</path><vendor>PUP.Optional.Wajam.Gen</vendor><action></action><hash>640af7b370294ee8d8b4cfca57ad8c74</hash></file>
<file><path>C:\Program Files\7c4a7d0bd73a7d1db7f3a416497fd858\755b821671e05a690e1e8af5d3c99446\5be9a5957969709c77f59e391ba4e682.ico</path><vendor>PUP.Optional.Wajam.Gen</vendor><action></action><hash>640af7b370294ee8d8b4cfca57ad8c74</hash></file>
<file><path>C:\Program Files\7c4a7d0bd73a7d1db7f3a416497fd858\755b821671e05a690e1e8af5d3c99446\61d8f19b51c869569f2db9703b5e4fb9.ico</path><vendor>PUP.Optional.Wajam.Gen</vendor><action></action><hash>640af7b370294ee8d8b4cfca57ad8c74</hash></file>
<file><path>C:\Program Files\7c4a7d0bd73a7d1db7f3a416497fd858\755b821671e05a690e1e8af5d3c99446\68d022105bbca25288171f7f974475ad.ico</path><vendor>PUP.Optional.Wajam.Gen</vendor><action></action><hash>640af7b370294ee8d8b4cfca57ad8c74</hash></file>
<file><path>C:\Program Files\7c4a7d0bd73a7d1db7f3a416497fd858\755b821671e05a690e1e8af5d3c99446\75d8f27f27c1eb053b75c972bfc6dddd.ico</path><vendor>PUP.Optional.Wajam.Gen</vendor><action></action><hash>640af7b370294ee8d8b4cfca57ad8c74</hash></file>
<file><path>C:\Program Files\7c4a7d0bd73a7d1db7f3a416497fd858\755b821671e05a690e1e8af5d3c99446\7d23a87f03869982af7ceddbe6be504f.ico</path><vendor>PUP.Optional.Wajam.Gen</vendor><action></action><hash>640af7b370294ee8d8b4cfca57ad8c74</hash></file>
<file><path>C:\Program Files\7c4a7d0bd73a7d1db7f3a416497fd858\755b821671e05a690e1e8af5d3c99446\7fcf2119d70cd62582023170d54acfef.ico</path><vendor>PUP.Optional.Wajam.Gen</vendor><action></action><hash>640af7b370294ee8d8b4cfca57ad8c74</hash></file>
<file><path>C:\Program Files\7c4a7d0bd73a7d1db7f3a416497fd858\755b821671e05a690e1e8af5d3c99446\9ddba727af27541baff90cf9fad6d8b6.ico</path><vendor>PUP.Optional.Wajam.Gen</vendor><action></action><hash>640af7b370294ee8d8b4cfca57ad8c74</hash></file>
<file><path>C:\Program Files\7c4a7d0bd73a7d1db7f3a416497fd858\755b821671e05a690e1e8af5d3c99446\a122dbc8c74665973303492860e7c50e.ico</path><vendor>PUP.Optional.Wajam.Gen</vendor><action></action><hash>640af7b370294ee8d8b4cfca57ad8c74</hash></file>
<file><path>C:\Program Files\7c4a7d0bd73a7d1db7f3a416497fd858\755b821671e05a690e1e8af5d3c99446\a46df7d39366870bbd5e97ec5dbaeef8.ico</path><vendor>PUP.Optional.Wajam.Gen</vendor><action></action><hash>640af7b370294ee8d8b4cfca57ad8c74</hash></file>
<file><path>C:\Program Files\7c4a7d0bd73a7d1db7f3a416497fd858\755b821671e05a690e1e8af5d3c99446\b145a1baebab3a62f6a9fff7a2b35710.ico</path><vendor>PUP.Optional.Wajam.Gen</vendor><action></action><hash>640af7b370294ee8d8b4cfca57ad8c74</hash></file>
<file><path>C:\Program Files\7c4a7d0bd73a7d1db7f3a416497fd858\755b821671e05a690e1e8af5d3c99446\b2da75b42f7a60aefb97528953428f74.ico</path><vendor>PUP.Optional.Wajam.Gen</vendor><action></action><hash>640af7b370294ee8d8b4cfca57ad8c74</hash></file>
<file><path>C:\Program Files\7c4a7d0bd73a7d1db7f3a416497fd858\755b821671e05a690e1e8af5d3c99446\bc1206a5669235d9940992b903b54abe.ico</path><vendor>PUP.Optional.Wajam.Gen</vendor><action></action><hash>640af7b370294ee8d8b4cfca57ad8c74</hash></file>
<file><path>C:\Program Files\7c4a7d0bd73a7d1db7f3a416497fd858\755b821671e05a690e1e8af5d3c99446\bcba784f7e3288a28542c37218ca662f.ico</path><vendor>PUP.Optional.Wajam.Gen</vendor><action></action><hash>640af7b370294ee8d8b4cfca57ad8c74</hash></file>
<file><path>C:\Program Files\7c4a7d0bd73a7d1db7f3a416497fd858\755b821671e05a690e1e8af5d3c99446\d71784a0b9a64abe7af7801a65103bf4.ico</path><vendor>PUP.Optional.Wajam.Gen</vendor><action></action><hash>640af7b370294ee8d8b4cfca57ad8c74</hash></file>
<file><path>C:\Program Files\7c4a7d0bd73a7d1db7f3a416497fd858\755b821671e05a690e1e8af5d3c99446\d9f01b53c1bb6a88d0c87b3610526892.ico</path><vendor>PUP.Optional.Wajam.Gen</vendor><action></action><hash>640af7b370294ee8d8b4cfca57ad8c74</hash></file>
<file><path>C:\Program Files\7c4a7d0bd73a7d1db7f3a416497fd858\3cafe33ef5342afa5fc3a3f4626f5d2f.exe</path><vendor>PUP.Optional.Wajam.Gen</vendor><action></action><hash>640af7b370294ee8d8b4cfca57ad8c74</hash></file>
<file><path>C:\Program Files\7c4a7d0bd73a7d1db7f3a416497fd858\40303fb383c549ae3fd1837af9e816f7.exe</path><vendor>PUP.Optional.Wajam.Gen</vendor><action></action><hash>640af7b370294ee8d8b4cfca57ad8c74</hash></file>
<file><path>C:\Program Files\7c4a7d0bd73a7d1db7f3a416497fd858\6fe9a36317b823747539c161c9b70df2</path><vendor>PUP.Optional.Wajam.Gen</vendor><action></action><hash>640af7b370294ee8d8b4cfca57ad8c74</hash></file>
<file><path>C:\Program Files\7c4a7d0bd73a7d1db7f3a416497fd858\b95b49115fefa4f875980d6dbac4629c</path><vendor>PUP.Optional.Wajam.Gen</vendor><action></action><hash>640af7b370294ee8d8b4cfca57ad8c74</hash></file>
<file><path>C:\Program Files\7c4a7d0bd73a7d1db7f3a416497fd858\d71784a0b9a64abe7af7801a65103bf4.ico</path><vendor>PUP.Optional.Wajam.Gen</vendor><action></action><hash>640af7b370294ee8d8b4cfca57ad8c74</hash></file>
<file><path>C:\Program Files\7c4a7d0bd73a7d1db7f3a416497fd858\ce91e3b6243e973d4dfe66b8605ed385\heabsq.dll</path><vendor>PUP.Optional.Wajam.Gen</vendor><action></action><hash>640af7b370294ee8d8b4cfca57ad8c74</hash></file>
<file><path>C:\Program Files\7c4a7d0bd73a7d1db7f3a416497fd858\ce91e3b6243e973d4dfe66b8605ed385\wagmqn.dll</path><vendor>PUP.Optional.Wajam.Gen</vendor><action></action><hash>640af7b370294ee8d8b4cfca57ad8c74</hash></file>
<file><path>C:\ProgramData\CloudPrinter\CloudPrinter.dat</path><vendor>PUP.Optional.Linkury.ACMB1</vendor><action></action><hash>4e206c3e8f0a5adc3484960343c1c040</hash></file>
<file><path>C:\ProgramData\CloudPrinter\Config.xml</path><vendor>PUP.Optional.Linkury.ACMB1</vendor><action></action><hash>4e206c3e8f0a5adc3484960343c1c040</hash></file>
<file><path>C:\Windows\SysWOW64\findit.xml</path><vendor>PUP.Optional.Linkury.ACMB1</vendor><action></action><hash>84ea5c4e4158171f823df7a2fc087090</hash></file>
<file><path>C:\Users\Илья\AppData\Roaming\OpenCandy\OpenCandy_260595D8EE3A437AB4ED5A64EB114226\dyesubd1_p3v0.exe</path><vendor>PUP.Optional.OpenCandy</vendor><action></action><hash>3f2f3a70c0d9d85e6a3fbe320bf74ab6</hash></file>
<file><path>C:\Program Files\ContentProtector\condefclean.exe</path><vendor>PUP.Optional.ContentProtector</vendor><action></action><hash>175783278c0d87afcbe68f96d72c18e8</hash></file>
<file><path>C:\Program Files\ContentProtector\condefupdatePS.dll</path><vendor>PUP.Optional.ContentProtector</vendor><action></action><hash>175783278c0d87afcbe68f96d72c18e8</hash></file>
<file><path>C:\Program Files\ContentProtector\ConProtSetup.exe</path><vendor>PUP.Optional.ContentProtector</vendor><action></action><hash>175783278c0d87afcbe68f96d72c18e8</hash></file>
<file><path>C:\Program Files\ContentProtector\ContentProtector.exe</path><vendor>PUP.Optional.ContentProtector</vendor><action></action><hash>175783278c0d87afcbe68f96d72c18e8</hash></file>
<file><path>C:\Program Files\ContentProtector\ContentProtectorConrol.exe</path><vendor>PUP.Optional.ContentProtector</vendor><action></action><hash>175783278c0d87afcbe68f96d72c18e8</hash></file>
<file><path>C:\Program Files\ContentProtector\ContentProtectorUpdate.exe</path><vendor>PUP.Optional.ContentProtector</vendor><action></action><hash>175783278c0d87afcbe68f96d72c18e8</hash></file>
<file><path>C:\Program Files\ContentProtector\import_root_cert.exe</path><vendor>PUP.Optional.ContentProtector</vendor><action></action><hash>175783278c0d87afcbe68f96d72c18e8</hash></file>
<file><path>C:\Program Files\ContentProtector\libeay32.dll</path><vendor>PUP.Optional.ContentProtector</vendor><action></action><hash>175783278c0d87afcbe68f96d72c18e8</hash></file>
<file><path>C:\Program Files\ContentProtector\nfregdrv.exe</path><vendor>PUP.Optional.ContentProtector</vendor><action></action><hash>175783278c0d87afcbe68f96d72c18e8</hash></file>
<file><path>C:\Program Files\ContentProtector\ssleay32.dll</path><vendor>PUP.Optional.ContentProtector</vendor><action></action><hash>175783278c0d87afcbe68f96d72c18e8</hash></file>
<file><path>C:\Program Files\ContentProtector\cert\SSL\cert.db</path><vendor>PUP.Optional.ContentProtector</vendor><action></action><hash>175783278c0d87afcbe68f96d72c18e8</hash></file>
<file><path>C:\Program Files\ContentProtector\cert\SSL\ContentProtector 2.cer</path><vendor>PUP.Optional.ContentProtector</vendor><action></action><hash>175783278c0d87afcbe68f96d72c18e8</hash></file>
<file><path>C:\Program Files\ContentProtector\nss\certutil.exe</path><vendor>PUP.Optional.ContentProtector</vendor><action></action><hash>175783278c0d87afcbe68f96d72c18e8</hash></file>
<file><path>C:\Program Files\ContentProtector\nss\mozcrt19.dll</path><vendor>PUP.Optional.ContentProtector</vendor><action></action><hash>175783278c0d87afcbe68f96d72c18e8</hash></file>
<file><path>C:\Program Files\ContentProtector\nss\nspr4.dll</path><vendor>PUP.Optional.ContentProtector</vendor><action></action><hash>175783278c0d87afcbe68f96d72c18e8</hash></file>
<file><path>C:\Program Files\ContentProtector\nss\nss3.dll</path><vendor>PUP.Optional.ContentProtector</vendor><action></action><hash>175783278c0d87afcbe68f96d72c18e8</hash></file>
<file><path>C:\Program Files\ContentProtector\nss\plc4.dll</path><vendor>PUP.Optional.ContentProtector</vendor><action></action><hash>175783278c0d87afcbe68f96d72c18e8</hash></file>
<file><path>C:\Program Files\ContentProtector\nss\plds4.dll</path><vendor>PUP.Optional.ContentProtector</vendor><action></action><hash>175783278c0d87afcbe68f96d72c18e8</hash></file>
<file><path>C:\Program Files\ContentProtector\nss\smime3.dll</path><vendor>PUP.Optional.ContentProtector</vendor><action></action><hash>175783278c0d87afcbe68f96d72c18e8</hash></file>
<file><path>C:\Program Files\ContentProtector\nss\softokn3.dll</path><vendor>PUP.Optional.ContentProtector</vendor><action></action><hash>175783278c0d87afcbe68f96d72c18e8</hash></file>
<file><path>C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ContentProtector\Settings.lnk</path><vendor>PUP.Optional.ContentProtector</vendor><action></action><hash>1c526446fa9f12242f83d3525aa93bc5</hash></file>
<file><path>C:\Program Files (x86)\Common Files\HotHathome\InstallationConfiguration.xml</path><vendor>PUP.Optional.Linkury.ACMB1</vendor><action></action><hash>2648d3d71c7da78f4be0f168768f1be5</hash></file>
<file><path>C:\Program Files (x86)\Common Files\HotHathome\uninstall.dat</path><vendor>PUP.Optional.Linkury.ACMB1</vendor><action></action><hash>2648d3d71c7da78f4be0f168768f1be5</hash></file>
<file><path>C:\Program Files (x86)\Common Files\HotHathome\uninstall.ico</path><vendor>PUP.Optional.Linkury.ACMB1</vendor><action></action><hash>2648d3d71c7da78f4be0f168768f1be5</hash></file>
<file><path>C:\Program Files (x86)\Google\Chrome\chrome.bat</path><vendor>PUP.Optional.BrowserHijack.ShrtCln</vendor><action></action><baddata>http://sealrche-nayity.ru</baddata><gooddata></gooddata><hash>e38b68424455f046186ab6a5c0450af6</hash></file>
<file><path>C:\Users\gtx\AppData\Roaming\Config.xml</path><vendor>PUP.Optional.Linkury.ACMB1</vendor><action></action><hash>e7875654ecad86b0c3634f0ade27639d</hash></file>
<file><path>C:\Users\gtx\AppData\Roaming\InstallationConfiguration.xml</path><vendor>PUP.Optional.Linkury.ACMB1</vendor><action></action><hash>016dcfdb37622511a38478e118edb64a</hash></file>
</items>
</mbam-log>
