Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 30-10-2016
Ran by 444 (administrator) on USER-76 (01-11-2016 04:05:57)
Running from C:\Users\444\Downloads
Loaded Profiles: 444 (Available Profiles: 444)
Platform: Microsoft Windows 7 Максимальная  Service Pack 1 (X86) Language: Русский (Россия)
Internet Explorer Version 9 (Default browser: Yandex Browser)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(QIHU 360 SOFTWARE CO. LIMITED) C:\Program Files\360\Total Security\safemon\QHActiveDefense.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\ProgramData\MobileBrServ\mbbService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Mail.Ru) C:\Program Files\Mail.Ru\Update Service\mrupdsrv.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\TeamViewer_Service.exe
(Pinnacle Systems GmbH) C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
(QIHU 360 SOFTWARE CO. LIMITED) C:\Program Files\360\Total Security\safemon\QHSafeTray.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(DT Soft Ltd) C:\Program Files\Daemon Tools Pro\DTShellHlp.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Mail.Ru) C:\Users\444\AppData\Local\Mail.Ru\MailRuUpdater.exe
(SSmaker.Ru) C:\Program Files\SSmaker\SSmaker.exe
(QIHU 360 SOFTWARE CO. LIMITED) C:\Program Files\360\Total Security\safemon\QHWatchdog.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
() C:\Users\444\Desktop\BenderSky (1)\BenderSkyP.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(YANDEX LLC) C:\Users\Default\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
() C:\Users\Default\AppData\Local\Yandex\YandexBrowser\Application\45.0.2454.3658\crash_service.exe
(YANDEX LLC) C:\Users\Default\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
(YANDEX LLC) C:\Users\Default\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
(YANDEX LLC) C:\Users\Default\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
(YANDEX LLC) C:\Users\Default\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
(YANDEX LLC) C:\Users\Default\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
(YANDEX LLC) C:\Users\Default\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MpCmdRun.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MpCmdRun.exe
(YANDEX LLC) C:\Users\Default\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
(YANDEX LLC) C:\Users\Default\AppData\Local\Yandex\YandexBrowser\Application\browser.exe


==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642728 2012-09-28] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI.exe [6106336 2012-12-25] (Realtek Semiconductor)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [947176 2012-09-12] (Microsoft Corporation)
HKLM\...\Run: [USBToolTip] => C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe [199752 2007-02-20] (Pinnacle Systems GmbH)
HKLM\...\Run: [QHSafeTray] => C:\Program Files\360\Total Security\safemon\QHSafeTray.exe [1894824 2016-10-24] (QIHU 360 SOFTWARE CO. LIMITED)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [164152 2016-07-05] (Apple Inc.)
HKLM\...\Run: [AlterGeoUpdater] => C:\Program Files\AlterGeo\Html5 geolocation provider\html5locsvc.exe
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1156824 2016-09-16] (Adobe Systems Incorporated)
HKU\S-1-5-21-3734083339-2470380424-662966135-1000\...\Run: [DAEMON Tools Pro Agent] => C:\Program Files\Daemon Tools Pro\DTAgent.exe [3111744 2012-04-26] (DT Soft Ltd)
HKU\S-1-5-21-3734083339-2470380424-662966135-1000\...\Run: [amigo] => C:\Users\444\AppData\Local\Amigo\Application\amigo.exe --no-startup-window
HKU\S-1-5-21-3734083339-2470380424-662966135-1000\...\Run: [MailRuUpdater] => C:\Users\444\AppData\Local\Mail.Ru\MailRuUpdater.exe [4157656 2016-09-23] (Mail.Ru)
HKU\S-1-5-21-3734083339-2470380424-662966135-1000\...\Run: [DevidAgent] => C:\Users\444\Downloads\Jeweell_Agent_Setup.exe /autorun
HKU\S-1-5-21-3734083339-2470380424-662966135-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [27004544 2016-10-17] (Skype Technologies S.A.)
HKU\S-1-5-21-3734083339-2470380424-662966135-1000\...\Run: [SSMaker] => C:\Program Files\SSmaker\SSmaker.exe [2960384 2015-10-12] (SSmaker.Ru)
HKU\S-1-5-21-3734083339-2470380424-662966135-1000\...\Run: [AlterGeoUpdater] => C:\ProgramData\AlterGeo\Update for Html5 geolocation provider\html5locsvc.exe
HKU\S-1-5-21-3734083339-2470380424-662966135-1000\...\MountPoints2: {0736640d-f18b-11e3-85a0-3c4a92ca7701} - F:\Lenovo_Suite.exe
HKU\S-1-5-21-3734083339-2470380424-662966135-1000\...\MountPoints2: {0736640f-f18b-11e3-85a0-3c4a92ca7701} - F:\Lenovo_Suite.exe
HKU\S-1-5-21-3734083339-2470380424-662966135-1000\...\MountPoints2: {15a94044-da82-11dd-aa02-3c4a92ca7701} - G:\LGAutoRun.exe
HKU\S-1-5-21-3734083339-2470380424-662966135-1000\...\MountPoints2: {232e4b01-60f1-11e6-8701-e02a827d9f2c} - F:\AutoRun.exe
HKU\S-1-5-21-3734083339-2470380424-662966135-1000\...\MountPoints2: {3ab314d2-dc1b-11e4-be5e-806e6f6e6963} - F:\AutoRun.exe
HKU\S-1-5-21-3734083339-2470380424-662966135-1000\...\MountPoints2: {3ab314fc-dc1b-11e4-be5e-364b50b7ef19} - F:\AutoRun.exe
HKU\S-1-5-21-3734083339-2470380424-662966135-1000\...\MountPoints2: {3dc2bca7-f229-11e3-860b-3c4a92ca7701} - F:\AutoRun.exe
HKU\S-1-5-21-3734083339-2470380424-662966135-1000\...\MountPoints2: {55287205-f80b-11e4-b07a-e02a827d9f2c} - G:\AutoRun.exe
HKU\S-1-5-21-3734083339-2470380424-662966135-1000\...\MountPoints2: {5528720c-f80b-11e4-b07a-e02a827d9f2c} - G:\AutoRun.exe
HKU\S-1-5-21-3734083339-2470380424-662966135-1000\...\MountPoints2: {5a1513ec-e6d5-11e3-b492-020a63613931} - G:\Lenovo_Suite.exe
HKU\S-1-5-21-3734083339-2470380424-662966135-1000\...\MountPoints2: {5ea4c5a1-cc1f-11e3-b92d-3c4a92ca7701} - F:\AutoRun.exe
HKU\S-1-5-21-3734083339-2470380424-662966135-1000\...\MountPoints2: {6b3f71ef-366a-11e3-8d7b-364b50b7efda} - F:\AutoRun.exe
HKU\S-1-5-21-3734083339-2470380424-662966135-1000\...\MountPoints2: {8c439890-47cf-11e4-b044-1c4bd6b517a2} - F:\AutoRun.exe
HKU\S-1-5-21-3734083339-2470380424-662966135-1000\...\MountPoints2: {941b01ed-6940-11e6-9f42-e02a827d9f2c} - F:\LGAutoRun.exe
HKU\S-1-5-21-3734083339-2470380424-662966135-1000\...\MountPoints2: {bbd1d4f4-cabc-11e3-8f7e-e02a827d9f2c} - F:\AutoRun.exe
HKU\S-1-5-21-3734083339-2470380424-662966135-1000\...\MountPoints2: {cfa50a48-c9da-11e3-bdc6-3c4a92ca7701} - F:\Lenovo_Suite.exe
HKU\S-1-5-21-3734083339-2470380424-662966135-1000\...\MountPoints2: {cfa50a4a-c9da-11e3-bdc6-3c4a92ca7701} - G:\Lenovo_Suite.exe
HKU\S-1-5-21-3734083339-2470380424-662966135-1000\...\MountPoints2: {cfa50a5c-c9da-11e3-bdc6-3c4a92ca7701} - G:\Lenovo_Suite.exe
HKU\S-1-5-21-3734083339-2470380424-662966135-1000\...\MountPoints2: {e29b4193-ecdd-11e3-b618-3c4a92ca7701} - F:\Lenovo_Suite.exe
HKU\S-1-5-18\...\Run: [AlterGeoUpdater] => C:\ProgramData\AlterGeo\Update for Html5 geolocation provider\html5locsvc.exe
GroupPolicy: Restriction ? <======= ATTENTION
GroupPolicy\User: Restriction ? <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Winsock: Catalog5 08 C:\Program Files\Bonjour\mdnsNSP.dll [122128 2015-08-12] (Apple Inc.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.43.1
Tcpip\..\Interfaces\{085DE7C8-A9E6-49A1-A750-E498B762665F}: [NameServer] 193.0.201.201,98.158.96.96,91.109.206.194
Tcpip\..\Interfaces\{08B1A82B-8AE5-47C8-82CB-F91CF265502D}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{0A9A42C9-9D77-4944-9030-043AAA91FBD2}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{154CFE24-B3B2-4F60-888A-011D18EBDB3B}: [NameServer] 193.0.201.201,91.109.206.194,98.158.96.96
Tcpip\..\Interfaces\{1EF68A45-7E4F-42EB-9A87-674F91DF314C}: [DhcpNameServer] 192.168.0.3
Tcpip\..\Interfaces\{21ADBFB0-7090-4188-AB6A-9F3ADFF4820B}: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{4A5EF249-D3B0-4E19-846E-02F3CFDFC603}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{4B2FCAD3-5264-4616-B414-8FF5E92ED91E}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{5ABF07CC-0C5B-4F60-8D12-DE9E5F220628}: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{65CB1AD1-824E-4654-A879-9F7AED02BCC4}: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{863AB8CC-3088-47AE-96B5-932677B0530C}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{93BD8657-58BD-445A-B59E-81064E32F5BB}: [NameServer] 193.0.201.201,98.158.96.96,91.109.206.194
Tcpip\..\Interfaces\{93BD8657-58BD-445A-B59E-81064E32F5BB}: [DhcpNameServer] 192.168.43.1
Tcpip\..\Interfaces\{B809D5D5-CAE7-4FB6-9196-CB7CE184FFA1}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{C8F5B831-3F06-49B0-8D4D-3480DBE53555}: [NameServer] 193.0.201.201,98.158.96.96,91.109.206.194
Tcpip\..\Interfaces\{C8F5B831-3F06-49B0-8D4D-3480DBE53555}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{e29ac6c2-7037-11de-816d-806e6f6e6963}: [NameServer] 193.0.201.201,98.158.96.96,91.109.206.194
Tcpip\..\Interfaces\{EE0F4FAD-5CDC-45C2-95B4-A142D525B4C9}: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{F843FB81-1257-48EA-AFD0-6C1918BB6C5E}: [NameServer] 193.0.201.201,98.158.96.96,91.109.206.194

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.bing.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = www.bing.com
HKU\S-1-5-21-3734083339-2470380424-662966135-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyuUxgwcNgwLuk-WbmOSV8B6K_0F_Y5T2N7UrmzzOoiQWZQQjGYcyM8NZjm9FyNbr0PZF4X5TNyGU1ZUmeyv_20M33PQAhZOZcKBvmEzsk0_WM25IDC3W0A47i7kNT2JPop857Bspntq42TrX7y4nNI__9VL_n2I&q={searchTerms}
HKU\S-1-5-21-3734083339-2470380424-662966135-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://%66%65%65%64.%73%6E%61%70%64%6F.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyuUxgwcNgwLuk-WbmOSV8B6K_0F_Y5T2N7UrmzzOoiQWZQQjGYcyM8NZjm9FyNbr0PZF4X5TNyGU1ZUlVA7tASOsbyrdzKuMPD3D7DxIy84O5nLZQXhdZlpB1ynYJ5VkQxPMjd13r-mj_HhFu_6oAy2XvOf-Vl1
HKU\S-1-5-21-3734083339-2470380424-662966135-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyuUxgwcNgwLuk-WbmOSV8B6K_0F_Y5T2N7UrmzzOoiQWZQQjGYcyM8NZjm9FyNbr0PZF4X5TNyGU1ZUmeyv_20M33PQAhZOZcKBvmEzsk0_WM25IDC3W0A47i7kNT2JPop857Bspntq42TrX7y4nNI__9VL_n2I&q={searchTerms}
HKU\S-1-5-21-3734083339-2470380424-662966135-1000\Software\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyuUxgwcNgwLuk-WbmOSV8B6K_0F_Y5T2N7UrmzzOoiQWZQQjGYcyM8NZjm9FyNbr0PZF4X5TNyGU1ZUmeyv_20M33PQAhZOZcKBvmEzsk0_WM25IDC3W0A47i7kNT2JPop857Bspntq42TrX7y4nNI__9VL_n2I&q={searchTerms}
SearchScopes: HKLM -> DefaultScope {ielnksrch} URL = 
SearchScopes: HKLM -> ielnksrch URL = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyuUxgwcNgwLuk-WbmOSV8B6K_0F_Y5T2N7UrmzzOoiQWZQQjGYcyM8NZjm9FyNbr0PZF4X5TNyGU1ZUmeyv_20M33PQAhZOZcKBvmEzsk0_WM25IDC3W0A47i7kNT2JPop857Bspntq42TrX7y4nNI__9VL_n2I&q={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE
SearchScopes: HKU\.DEFAULT -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE
SearchScopes: HKU\S-1-5-21-3734083339-2470380424-662966135-1000 -> DefaultScope {ielnksrch} URL = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyuUxgwcNgwLuk-WbmOSV8B6K_0F_Y5T2N7UrmzzOoiQWZQQjGYcyM8NZjm9FyNbr0PZF4X5TNyGU1ZUmeyv_20M33PQAhZOZcKBvmEzsk0_WM25IDC3W0A47i7kNT2JPop857Bspntq42TrX7y4nNI__9VL_n2I&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3734083339-2470380424-662966135-1000 -> 6493A406B61F173960CCF42BDFAC2B86 URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyuUxgwcNgwLuk-WbmOSV8B6K_0F_Y5T2N7UrmzzOoiQWZQQjGYcyM8NZjm9FyNbr0PZF4X5TNyGU1ZUmeyv_20M33PQAhZOZcKBvmEzsk0_WM25IDC3W0A47i7kNT2JPop857Bspntq42TrX7y4nNI__9VL_n2I&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3734083339-2470380424-662966135-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3734083339-2470380424-662966135-1000 -> {E88E0043-C9D4-4e33-8555-FEE4F5B63060} URL = hxxp://go.mail.ru/search?q={searchTerms}&utf8in=1&fr=ietb
SearchScopes: HKU\S-1-5-21-3734083339-2470380424-662966135-1000 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/distib/ep/?q={SearchTerms}&product_id=%7BDFEF45C7-7B26-4C19-B1C7-9EE56BA6A0D7%7D&gp=802821
SearchScopes: HKU\S-1-5-21-3734083339-2470380424-662966135-1000 -> {ielnksrch} URL = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyuUxgwcNgwLuk-WbmOSV8B6K_0F_Y5T2N7UrmzzOoiQWZQQjGYcyM8NZjm9FyNbr0PZF4X5TNyGU1ZUmeyv_20M33PQAhZOZcKBvmEzsk0_WM25IDC3W0A47i7kNT2JPop857Bspntq42TrX7y4nNI__9VL_n2I&q={searchTerms}
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2011-02-12] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-12-21] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_60\bin\jp2ssv.dll [2015-10-05] (Oracle Corporation)
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxps://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab

FireFox:
========
FF ProfilePath: C:\Users\444\AppData\Roaming\Mozilla\Firefox\Profiles\zxl0nrjc.default [2016-11-01]
FF NewTab: Mozilla\Firefox\Profiles\zxl0nrjc.default -> C:\ProgramData\xifs\ff.NT
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\zxl0nrjc.default -> Ask Search
FF DefaultSearchUrl: Mozilla\Firefox\Profiles\zxl0nrjc.default -> hxxp://go.mail.ru/search?fr=fftbob1&utf8in&q=
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\zxl0nrjc.default -> Поиск@Mail.Ru
FF Homepage: Mozilla\Firefox\Profiles\zxl0nrjc.default -> C:\ProgramData\xifs\ff.HP
FF Extension: (FirefixTab) - C:\Users\444\AppData\Roaming\Mozilla\Firefox\Profiles\zxl0nrjc.default\Extensions\deskCutv2@gmail.com [2016-02-04] [not signed]
FF Extension: (Free Games 111) - C:\Users\444\AppData\Roaming\Mozilla\Firefox\Profiles\zxl0nrjc.default\Extensions\freegames4357@BestOffers.xpi [2014-01-05] [not signed]
FF Extension: (Домашняя страница Mail.Ru) - C:\Users\444\AppData\Roaming\Mozilla\Firefox\Profiles\zxl0nrjc.default\Extensions\homepage@mail.ru [2016-03-15]
FF Extension: (Поиск@Mail.Ru) - C:\Users\444\AppData\Roaming\Mozilla\Firefox\Profiles\zxl0nrjc.default\Extensions\search@mail.ru [2016-03-15]
FF Extension: (Speed Test 127) - C:\Users\444\AppData\Roaming\Mozilla\Firefox\Profiles\zxl0nrjc.default\Extensions\speedtest4354@BestOffers.xpi [2014-01-05] [not signed]
FF Extension: (Visual Bookmarks) - C:\Users\444\AppData\Roaming\Mozilla\Firefox\Profiles\zxl0nrjc.default\Extensions\vb@yandex.ru.xpi [2016-07-29]
FF Extension: (&Yandex Elements&) - C:\Users\444\AppData\Roaming\Mozilla\Firefox\Profiles\zxl0nrjc.default\Extensions\yasearch@yandex.ru.xpi [2016-07-30]
FF Extension: (Zula Games) - C:\Users\444\AppData\Roaming\Mozilla\Firefox\Profiles\zxl0nrjc.default\Extensions\zulagames@ZulaGames.com.xpi [2014-01-05] [not signed]
FF Extension: (Спутник @Mail.Ru) - C:\Users\444\AppData\Roaming\Mozilla\Firefox\Profiles\zxl0nrjc.default\Extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D} [2016-01-22]
FF Extension: (The Safe Surfing) - C:\Users\444\AppData\Roaming\Mozilla\Firefox\Profiles\zxl0nrjc.default\Extensions\{3B4DE07A-DE43-4DBC-873F-05835FF67DCE} [2016-05-02] [not signed]
FF Extension: (TSearch) - C:\Users\444\AppData\Roaming\Mozilla\Firefox\Profiles\zxl0nrjc.default\Extensions\{6E727987-C8EA-44DA-8749-310C0FBE3C3E} [2016-02-03] [not signed]
FF Extension: (VK Media Wizard) - C:\Users\444\AppData\Roaming\Mozilla\Firefox\Profiles\zxl0nrjc.default\Extensions\{95778f0c-827d-4aba-b416-f07dd840fd6a} [2016-02-03] [not signed]
FF Extension: (Визуальные закладки @Mail.Ru) - C:\Users\444\AppData\Roaming\Mozilla\Firefox\Profiles\zxl0nrjc.default\Extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7} [2016-03-15]
FF Extension: (AlterGeo Addons) - C:\Users\444\AppData\Roaming\Mozilla\Firefox\Profiles\zxl0nrjc.default\Extensions\{B100D0FF-0001-8CE4-2790-AACE49B8AE35} [2016-09-11] [not signed]
FF SearchPlugin: C:\Users\444\AppData\Roaming\Mozilla\Firefox\Profiles\zxl0nrjc.default\searchplugins\ask-search.xml [2015-10-17]
FF SearchPlugin: C:\Users\444\AppData\Roaming\Mozilla\Firefox\Profiles\zxl0nrjc.default\searchplugins\findit.xml [2016-10-28]
FF SearchPlugin: C:\Users\444\AppData\Roaming\Mozilla\Firefox\Profiles\zxl0nrjc.default\searchplugins\mailru.xml [2016-03-15]
FF SearchPlugin: C:\Users\444\AppData\Roaming\Mozilla\Firefox\Profiles\zxl0nrjc.default\searchplugins\yandex.kz-164200.xml [2015-11-18]
FF SearchPlugin: C:\Users\444\AppData\Roaming\Mozilla\Firefox\Profiles\zxl0nrjc.default\searchplugins\yandex.kz-210445.xml [2013-12-11]
FF SearchPlugin: C:\Users\444\AppData\Roaming\Mozilla\Firefox\Profiles\zxl0nrjc.default\searchplugins\yqs-vbff-yandex.xml [2016-07-29]
FF HKLM\...\Firefox\Extensions: [deskCutv2@gmail.com] - C:\Users\444\AppData\Roaming\Mozilla\Firefox\Profiles\zxl0nrjc.default\extensions\deskCutv2@gmail.com
FF HKLM\...\Firefox\Extensions: [WebProtection@360safe.com] - C:\Program Files\360\Total Security\safemon\webprotection_firefox
FF Extension: (Защита от веб-угроз 360) - C:\Program Files\360\Total Security\safemon\webprotection_firefox [2016-07-19]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_23_0_0_205.dll [2016-10-26] ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2015-12-18] ()
FF Plugin: @java.com/DTPlugin,version=11.60.2 -> C:\Program Files\Java\jre1.8.0_60\bin\dtplugin\npDeployJava1.dll [2015-10-05] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.60.2 -> C:\Program Files\Java\jre1.8.0_60\bin\plugin2\npjp2.dll [2015-10-05] (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-29] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-29] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2016-10-01] (Adobe Systems Inc.)
FF Plugin HKU\.DEFAULT: @altergeo.ru/Html5loc -> C:\ProgramData\AlterGeo\Update for Html5 geolocation provider\npHtml5loc.dll [No File]
FF Plugin HKU\S-1-5-21-3734083339-2470380424-662966135-1000: @altergeo.ru/Html5loc -> C:\ProgramData\AlterGeo\Update for Html5 geolocation provider\npHtml5loc.dll [No File]
FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\itms.js [2016-06-28]

Chrome: 
=======
CHR DefaultProfile: Default
CHR HomePage: Default -> yandex.ru/?__PARAM__from=chromehp
CHR StartupUrls: Default -> "hxxp://mail.ru/cnt/10445?gp=802851","hxxp://www.mysites123.com/?type=hp&ts=1454601969&z=d5bce1ec57d4d5485e99d2ag5z6wdzcqce3g8tfqet&from=amt&uid=hitachixhts725032a9a364_101214pckc04bphjnubkx"
CHR Profile: C:\Users\444\AppData\Local\Google\Chrome\User Data\Default [2016-11-01]
CHR Extension: (Google Презентации) - C:\Users\444\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-10-06]
CHR Extension: (Ultimate Discounter) - C:\Users\444\AppData\Local\Google\Chrome\User Data\Default\Extensions\ckcmdpmhiekiihmfjffdehhbhgllpapg [2016-03-15]
CHR Extension: (Google Таблицы) - C:\Users\444\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-10-06]
CHR Extension: (Google Документы офлайн) - C:\Users\444\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-19]
CHR Extension: (Поиск по торрентам) - C:\Users\444\AppData\Local\Google\Chrome\User Data\Default\Extensions\ialilpegnnfigbcggpbbdecdgencbfge [2016-02-03]
CHR Extension: (Chrome Media Router) - C:\Users\444\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-10-31]
CHR HKLM\...\Chrome\Extension: [nhgcieglcpdegkhamigiokdphfhhnlhh] - C:\Program Files\AlterGeo\Html5 geolocation provider\altergeo.crx <not found>

Opera: 
=======
OPR Extension: (Ultimate Discounter) - C:\Users\444\AppData\Roaming\Opera Software\Opera Stable\Extensions\hnbekdjpdldejohkmdonijjglpohocgo [2016-03-15]
OPR Extension: (The Safe Surfing) - C:\Users\444\AppData\Roaming\Opera Software\Opera Stable\Extensions\kcknbenjnkkjknphmnidanjifbgphjke [2016-05-02]

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 defragsvc; C:\Windows\System32\defragsvc.dll [218624 2009-07-14] (Корпорация Майкрософт)
R2 Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [233864 2012-09-04] ()
R2 mrupdsrv; C:\Program Files\Mail.Ru\Update Service\mrupdsrv.exe [2187992 2016-06-01] (Mail.Ru)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [20472 2012-09-12] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [287824 2012-09-12] (Microsoft Corporation)
R2 QHActiveDefense; C:\Program Files\360\Total Security\safemon\QHActiveDefense.exe [926632 2016-09-28] (QIHU 360 SOFTWARE CO. LIMITED)
R2 TeamViewer; C:\Program Files\TeamViewer\TeamViewer_Service.exe [7032080 2016-05-12] (TeamViewer GmbH)
R2 themctrl; C:\Windows\System32\themctrl.dll [362496 2010-11-21] () [File not signed]
R2 wbiosrvp; C:\Windows\System32\wbiosrvp.dll [290304 2010-11-21] () [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2009-07-14] (Microsoft Corporation)
S3 WPCSvc; C:\Windows\System32\wpcsvc.dll [10752 2009-07-14] (Корпорация Майкрософт)
S2 afoir; C:\ProgramData\\afoir\\afoir.exe -f "C:\ProgramData\\afoir\\afoir.dat" -l -a
S2 BitTorrent; "C:\Program Files\BitTorrent\BitTorrent.exe" /s iid=4591247 did=APSnapdoAMRev sid=3 ref=ccf94c8c-a1ef-1945-4046-2957d3c97001-PolicyMac id=370b9a3bd3d91151873a4270c7a47c8ca1ce1150875b0bccf7ba8f8cb99df784 [X] <==== ATTENTION
S2 sulpnar; C:\ProgramData\\sulpnar\\sulpnar.exe -f "C:\ProgramData\\sulpnar\\sulpnar.dat" -l -a

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 360AntiHacker; C:\Windows\System32\Drivers\360AntiHacker.sys [135400 2016-07-11] (360.cn)
R3 360AvFlt; C:\Windows\System32\DRIVERS\360AvFlt.sys [74472 2016-09-28] (360.cn)
R1 360Box; C:\Windows\System32\DRIVERS\360Box.sys [212712 2016-09-28] (360.cn)
R1 360Camera; C:\Windows\System32\Drivers\360Camera.sys [34888 2016-07-11] (360.cn)
R1 360SelfProtection; C:\Windows\System32\drivers\360SelfProtection.sys [186728 2016-09-01] (360安全中心)
R1 BAPIDRV; C:\Windows\System32\DRIVERS\BAPIDRV.sys [186816 2016-09-15] (360.cn)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [242240 2013-08-20] (DT Soft Ltd)
R1 EfiMon; C:\Windows\System32\Drivers\Efimon.sys [23248 2016-07-11] (360.cn)
R0 HookPort; C:\Windows\System32\Drivers\Hookport.sys [69224 2016-09-01] (360安全中心)
R2 inpout32; C:\Windows\System32\Drivers\inpout32.sys [11936 2016-08-16] (Highresolution Enterprises [www.highrez.co.uk])
R3 intelkmd; C:\Windows\System32\DRIVERS\igdpmd32.sys [9023488 2010-07-28] (Intel Corporation)
R3 MarvinBus; C:\Windows\System32\DRIVERS\MarvinBus.sys [171520 2005-09-23] (Pinnacle Systems GmbH)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [170200 2016-10-31] (Malwarebytes)
R0 mountmgr; C:\Windows\System32\drivers\mountmgr.sys [78208 2010-11-21] (Корпорация Майкрософт)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [193552 2012-08-30] (Microsoft Corporation)
R1 MpKsl56e6606a; C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{25E01C44-B692-494E-9F19-01B053C83999}\MpKsl56e6606a.sys [39168 2016-10-31] (Microsoft Corporation)
R1 MpKsl6000cee4; C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{25E01C44-B692-494E-9F19-01B053C83999}\MpKsl6000cee4.sys [39168 2016-10-31] (Microsoft Corporation)
R1 MpKsl8f02d985; C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{25E01C44-B692-494E-9F19-01B053C83999}\MpKsl8f02d985.sys [39168 2016-10-31] (Microsoft Corporation)
R1 MpKslfa2f0ecd; C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{25E01C44-B692-494E-9F19-01B053C83999}\MpKslfa2f0ecd.sys [39168 2016-10-31] (Microsoft Corporation)
R1 qutmdserv; C:\Windows\System32\DRIVERS\qutmdrv.sys [313704 2016-09-01] (360.cn)
R1 qutmipc; C:\Windows\system32\drivers\qutmipc.sys [65512 2016-09-01] (360.cn)
R0 volmgrx; C:\Windows\System32\drivers\volmgrx.sys [297040 2009-07-14] (Корпорация Майкрософт)
S2 WCMVCAM; C:\Windows\System32\DRIVERS\wcmvcam.sys [1068216 2012-04-16] (Windows (R) Win 7 DDK provider)
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [X]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S1 nlaljhij; \??\C:\Windows\system32\drivers\nlaljhij.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X]

========================== Drivers MD5 =======================

C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit
C:\Windows\System32\Drivers\360AntiHacker.sys 9201A9B1FE682CCCF80201647EC15638
C:\Windows\System32\DRIVERS\360AvFlt.sys 81166941D40619CF56FBA5C03DF5D335
C:\Windows\System32\DRIVERS\360Box.sys CE43641F2D35F9415E849FB18E2AF632
C:\Windows\System32\Drivers\360Camera.sys 2255330A69644F179D0438666EEF1861
C:\Windows\System32\drivers\360SelfProtection.sys 1AFA197E5776B458D675571CC588C26E
C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit
C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit
C:\Windows\system32\drivers\adp94xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\adpahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\adpu320.sys ==> MD5 is legit
C:\Windows\system32\drivers\afd.sys ==> MD5 is legit
C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit
C:\Windows\system32\drivers\djsvs.sys ==> MD5 is legit
C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdagp.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\amdk8.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\atikmdag.sys C34523CE979F5520EBCD204F9CDA899E
C:\Windows\System32\DRIVERS\atikmpag.sys B4D7145A6ED40471C794D980F505D621
C:\Windows\system32\DRIVERS\amdppm.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdsata.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdsbs.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdxata.sys ==> MD5 is legit
C:\Windows\system32\drivers\appid.sys ==> MD5 is legit
C:\Windows\system32\drivers\arc.sys ==> MD5 is legit
C:\Windows\system32\drivers\arcsas.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit
C:\Windows\System32\drivers\atapi.sys ==> MD5 is legit
C:\Windows\System32\drivers\AtihdW73.sys 434192D027A6A11E32E1C74C7C43E1ED
C:\Windows\system32\DRIVERS\bxvbdx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\b57nd60x.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\BAPIDRV.sys 78D9FA3C621ADD62657B5179DC4C430A
C:\Windows\system32\Drivers\Beep.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\blbdrive.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bowser.sys FCAFAEF6798D7B51FF029F99A9898961
C:\Windows\system32\DRIVERS\BrFiltLo.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltUp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\BthEnum.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bthmodem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bthpan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BTHport.sys 195C41CC67E9E1CEDD960CCB74925920
C:\Windows\System32\Drivers\BTHUSB.sys 43B3206DD654E783AA7E4EAD340A43B8
C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdrom.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\circlass.sys ==> MD5 is legit
C:\Windows\System32\CLFS.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\CmBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cng.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\compbatt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\CompositeBus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\crcdisk.sys ==> MD5 is legit
C:\Windows\System32\drivers\csc.sys ==> MD5 is legit
C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit
C:\Windows\System32\drivers\discache.sys ==> MD5 is legit
C:\Windows\System32\drivers\disk.sys ==> MD5 is legit
C:\Windows\system32\drivers\dmvsc.sys 2A958EF85DB1B61FFCA65044FA4BCE9E
C:\Windows\System32\drivers\drmkaud.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\dtsoftbus01.sys 687AF6BB383885FF6A64071B189A7F3E
C:\Windows\System32\drivers\dxgkrnl.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\evbdx.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Efimon.sys 94C668C7A654EFCAB6689AA45BAF2A4F
C:\Windows\system32\drivers\elxstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit
C:\Windows\system32\Drivers\exfat.sys ==> MD5 is legit
C:\Windows\system32\Drivers\fastfat.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\fdc.sys ==> MD5 is legit
C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit
C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\flpydisk.sys ==> MD5 is legitB
C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit
C:\Windows\system32\Drivers\Fs_Rec.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\fvevol.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\gagp30kx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\GEARAspiWDM.sys 185ADA973B5020655CEE342059A86CBB
C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit
C:\Windows\System32\drivers\HdAudio.sys A5EF29D5315111C80A5C1ABAD14C8972
C:\Windows\System32\DRIVERS\HDAudBus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\HECI.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\HidBatt.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidbth.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidir.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Hookport.sys 414A137C0BE9B9CDFB666C60C1260F6B
C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit
C:\Windows\System32\drivers\HTTP.sys ==> MD5 is legit
C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\i8042prt.sys ==> MD5 is legit
C:\Windows\system32\drivers\iaStorV.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\igdkmd32.sys DB7413CF09D74231720F78737DCF4188
C:\Windows\system32\drivers\iirsp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\inpout32.sys F08EBAF4493E99F4F095A4F7696287D4
C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\igdpmd32.sys DB7413CF09D74231720F78737DCF4188
C:\Windows\System32\DRIVERS\intelppm.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit
C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit
C:\Windows\system32\drivers\msiscsi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ksecdd.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ksecpkg.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_fc.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_sas.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_sas2.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_scsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\MarvinBus.sys A3E700D78EEC390F1208098CDCA5C6B6
C:\Windows\system32\drivers\MBAMSwissArmy.sys 5023F594D5448E16F920157174C61358
C:\Windows\system32\drivers\megasas.sys ==> MD5 is legit
C:\Windows\system32\drivers\MegaSR.sys ==> MD5 is legit
C:\Windows\System32\drivers\modem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit
C:\Windows\System32\drivers\mountmgr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\MpFilter.sys EE728AF83850DDAD9A3FCAC0AAB3AD97
C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit
C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{25E01C44-B692-494E-9F19-01B053C83999}\MpKsl56e6606a.sys BB7BB66A8DAF16950F83AE7BF498AF8F
C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{25E01C44-B692-494E-9F19-01B053C83999}\MpKsl6000cee4.sys BB7BB66A8DAF16950F83AE7BF498AF8F
C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{25E01C44-B692-494E-9F19-01B053C83999}\MpKsl8f02d985.sys BB7BB66A8DAF16950F83AE7BF498AF8F
C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{25E01C44-B692-494E-9F19-01B053C83999}\MpKslfa2f0ecd.sys BB7BB66A8DAF16950F83AE7BF498AF8F
C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mrxdav.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mrxsmb.sys B272B4C3E085EA860C12F2E4FAF2FFA2
C:\Windows\System32\DRIVERS\mrxsmb10.sys 9AC33EF26C8A3AD0F117D00EB7301D03
C:\Windows\System32\DRIVERS\mrxsmb20.sys E0ABDB5ED7E199E242A7D028E76C1D3A
C:\Windows\System32\drivers\msahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit
C:\Windows\system32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit
C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit
C:\Windows\system32\Drivers\MsRPC.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mssmbios.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MTConfig.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit
C:\Windows\System32\drivers\ndis.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit
C:\Windows\system32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netr28.sys 652881F65B35564575255A0E05E23C55
C:\Windows\system32\drivers\nfrd960.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\NisDrvWFP.sys 2CD24A6AF497D0E9B9BF3DA924ED05E6
C:\Windows\system32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit
C:\Windows\system32\Drivers\Ntfs.sys ==> MD5 is legit
C:\Windows\system32\Drivers\Null.sys ==> MD5 is legit
C:\Windows\system32\drivers\nvraid.sys ==> MD5 is legit
C:\Windows\system32\drivers\nvstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit
C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit
C:\Windows\system32\drivers\parport.sys ==> MD5 is legit
C:\Windows\System32\drivers\partmgr.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\parvdm.sys ==> MD5 is legit
C:\Windows\System32\drivers\pci.sys ==> MD5 is legit
C:\Windows\system32\drivers\pciide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\pcmcia.sys ==> MD5 is legit
C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit
C:\Windows\System32\drivers\peauth.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\processr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit
C:\Windows\system32\drivers\ql2300.sys ==> MD5 is legit
C:\Windows\system32\drivers\ql40xx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\qutmdrv.sys 8125FDA67AD61DEC7DA74BD5EC38B003
C:\Windows\system32\drivers\qutmipc.sys 3769E8F5D3ACEDC6B39EE3CA6897F41F
C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdpbus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpdr.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpvideominiport.sys ==> MD5 is legit
C:\Windows\system32\Drivers\RDPWD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rfcomm.sys CB928D9E6DAF51879DD6BA8D02F01321
C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Rt86win7.sys 7DFD48E24479B68B258D8770121155A0
C:\Windows\system32\drivers\vms3cap.sys ==> MD5 is legit
C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit
C:\Windows\system32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\serenum.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\serial.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sermouse.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sfloppy.sys ==> MD5 is legit
C:\Windows\system32\drivers\sisagp.sys ==> MD5 is legit
C:\Windows\system32\drivers\SiSRaid2.sys ==> MD5 is legit
C:\Windows\system32\drivers\sisraid4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit
C:\Windows\system32\Drivers\spldr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\srv.sys 112127C3B2E64D7680CC39CD0A39DD7E
C:\Windows\System32\DRIVERS\srv2.sys E5DD784A4EE5EBC72A86C677C988FCDB
C:\Windows\System32\DRIVERS\srvnet.sys CDBE627E16CC9E98F343D73F8E81D258
C:\Windows\system32\drivers\stexstor.sys ==> MD5 is legit
C:\Windows\System32\drivers\vmstorfl.sys ==> MD5 is legit
C:\Windows\system32\drivers\storvsc.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\swenum.sys ==> MD5 is legit
C:\Windows\System32\drivers\synth3dvsc.sys F2AD8960812FD111E20E84659EF19D43
C:\Windows\System32\drivers\tcpip.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tcpip.sys ==> MD5 is legit
C:\Windows\System32\drivers\tcpipreg.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdtcp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tdx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\termdd.sys ==> MD5 is legit
C:\Windows\system32\drivers\terminpt.sys 052306FD76793D5D5AB5D9891FD1ADBB
C:\Windows\System32\DRIVERS\tssecsrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\tsusbflt.sys ==> MD5 is legit
C:\Windows\system32\drivers\TsUsbGD.sys 01246F0BAAD7B68EC0F472AA41E33282
C:\Windows\System32\drivers\tsusbhub.sys 045ACB987C650D8186C6B4A692223860
C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\uagp35.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\umbus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\umpass.sys ==> MD5 is legit
C:\Windows\System32\Drivers\usbaapl.sys A176718F0DF45F60F545CF3E14F4D108
C:\Windows\System32\drivers\usbaudio.sys 1D9F2BD026E8E2D45033A4DF3F16B78C
C:\Windows\System32\DRIVERS\usbccgp.sys ==> MD5 is legit
C:\Windows\system32\drivers\usbcir.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbehci.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbhub.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\usbohci.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\usbprint.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\USBSTOR.SYS ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbuhci.sys ==> MD5 is legit
C:\Windows\System32\Drivers\usbvideo.sys 45F4E7BF43DB40A6C6B4D92C76CBC3F2
C:\Windows\System32\DRIVERS\usb8023x.sys D82F43D15FDAA666856C0190CB73E7C9
C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaagp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\viac7.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit
C:\Windows\system32\drivers\vmbus.sys ==> MD5 is legit
C:\Windows\system32\drivers\VMBusHID.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit
C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit
C:\Windows\system32\drivers\vsmraid.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwifibus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwififlt.sys 7090D3436EEB4E7DA3373090A23448F7
C:\Windows\System32\DRIVERS\vwifimp.sys A3F04CBEA6C2A10E6CB01F8B47611882
C:\Windows\system32\DRIVERS\wacompen.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wcmvcam.sys 70FF13D0C853ACEA859737EC8A8D220F
C:\Windows\System32\drivers\wd.sys ==> MD5 is legit
C:\Windows\System32\drivers\Wdf01000.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit
C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\WinUsb.sys A67E5F9A400F3BD1BE3D80613B45F708
C:\Windows\System32\DRIVERS\wmiacpi.sys ==> MD5 is legit
C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit
C:\Windows\System32\drivers\WudfPf.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\WUDFRd.sys ==> MD5 is legit

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-11-01 04:05 - 2016-11-01 04:08 - 00046087 _____ C:\Users\444\Downloads\FRST.txt
2016-11-01 04:05 - 2016-11-01 04:05 - 00000000 ____D C:\FRST
2016-11-01 04:04 - 2016-11-01 04:04 - 01758208 _____ (Farbar) C:\Users\444\Downloads\FRST.exe
2016-10-31 02:57 - 2016-10-31 02:57 - 00547861 _____ C:\Users\444\Desktop\USER-76_2016-10-31_02-47-56.7z
2016-10-31 02:36 - 2016-10-31 18:21 - 00000000 ____D C:\Users\Все пользователи\Mail.Ru
2016-10-31 02:36 - 2016-10-31 18:21 - 00000000 ____D C:\ProgramData\Mail.Ru
2016-10-31 01:25 - 2016-10-31 02:15 - 00000000 ____D C:\AdwCleaner
2016-10-31 01:24 - 2016-10-31 01:25 - 03910208 _____ C:\Users\444\Downloads\adwcleaner_6.030.exe
2016-10-30 01:24 - 2016-10-30 01:24 - 00042331 _____ C:\Users\444\Desktop\лог.rar
2016-10-30 01:23 - 2016-10-30 01:23 - 00667401 _____ C:\Users\444\Desktop\лог.txt
2016-10-30 00:21 - 2016-10-31 00:37 - 00170200 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-10-30 00:20 - 2016-10-30 00:20 - 00001060 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-10-30 00:20 - 2016-10-30 00:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-10-30 00:19 - 2016-10-30 00:20 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Malware
2016-10-30 00:19 - 2016-10-30 00:19 - 00000000 ____D C:\Users\Все пользователи\Malwarebytes
2016-10-30 00:19 - 2016-10-30 00:19 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-10-30 00:19 - 2016-03-10 14:09 - 00053120 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-10-30 00:19 - 2016-03-10 14:08 - 00126336 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-10-30 00:19 - 2016-03-10 14:08 - 00024448 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-10-30 00:14 - 2016-10-30 00:17 - 22851472 _____ (Malwarebytes ) C:\Users\444\Downloads\mbam-setup-2.2.1.1043.exe
2016-10-29 04:24 - 2016-10-29 04:24 - 00572872 _____ C:\Users\444\Downloads\USER-76_2016-10-29_02-23-26.7z
2016-10-29 02:41 - 2016-10-29 02:41 - 00000000 ____D C:\Users\444\Downloads\avz4
2016-10-29 02:40 - 2016-10-29 02:41 - 10112832 _____ C:\Users\444\Downloads\avz4.zip
2016-10-29 02:38 - 2016-10-29 02:38 - 00000280 _____ C:\Users\444\Desktop\Документ Microsoft Word.zip
2016-10-29 02:37 - 2016-10-29 02:37 - 00572872 _____ C:\Users\444\Desktop\USER-76_2016-10-29_02-23-26.7z
2016-10-29 02:17 - 2016-10-31 02:44 - 00000000 ____D C:\Users\444\Downloads\uvs_latest
2016-10-29 02:15 - 2016-10-29 02:15 - 03371406 _____ C:\Users\444\Downloads\uvs_latest.zip
2016-10-28 22:04 - 2016-10-28 22:06 - 00000000 ____D C:\Users\Все пользователи\psgXuzT
2016-10-28 22:04 - 2016-10-28 22:06 - 00000000 ____D C:\ProgramData\psgXuzT
2016-10-28 00:56 - 2016-10-28 00:58 - 00000000 ____D C:\Users\Все пользователи\hwBvvm
2016-10-28 00:56 - 2016-10-28 00:58 - 00000000 ____D C:\ProgramData\hwBvvm
2016-10-26 21:49 - 2016-10-26 21:51 - 00000000 ____D C:\Users\Все пользователи\BwpynAXY
2016-10-26 21:49 - 2016-10-26 21:51 - 00000000 ____D C:\ProgramData\BwpynAXY
2016-10-26 19:31 - 2016-10-26 19:31 - 05488320 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerInstaller.exe
2016-10-25 23:01 - 2016-10-25 23:01 - 00000000 ____D C:\Program Files\Common Files\Skype
2016-10-25 04:01 - 2016-10-25 19:27 - 00000000 ____D C:\Users\Все пользователи\gZoTTbSD
2016-10-25 04:01 - 2016-10-25 19:27 - 00000000 ____D C:\ProgramData\gZoTTbSD
2016-10-23 20:50 - 2016-10-23 20:53 - 00000000 ____D C:\Users\Все пользователи\TkRrsDaP
2016-10-23 20:50 - 2016-10-23 20:53 - 00000000 ____D C:\ProgramData\TkRrsDaP
2016-10-22 21:30 - 2016-10-22 21:33 - 00000000 ____D C:\Users\Все пользователи\ExmBNDkI
2016-10-22 21:30 - 2016-10-22 21:33 - 00000000 ____D C:\ProgramData\ExmBNDkI
2016-10-22 02:48 - 2016-10-22 02:48 - 00000921 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\joxi.lnk
2016-10-22 02:48 - 2016-10-22 02:48 - 00000909 _____ C:\Users\Public\Desktop\joxi.lnk
2016-10-22 02:43 - 2016-10-22 02:45 - 23025392 _____ ( ) C:\Users\444\Downloads\Joxi.exe
2016-10-21 22:26 - 2016-10-21 22:35 - 00000000 ____D C:\Users\Все пользователи\dpyXVyaSQT
2016-10-21 22:26 - 2016-10-21 22:35 - 00000000 ____D C:\ProgramData\dpyXVyaSQT
2016-10-21 02:37 - 2016-10-25 20:47 - 00000000 ____D C:\Windows\system32\MpEngineStore
2016-10-20 23:06 - 2016-10-20 23:08 - 00000000 ____D C:\Users\Все пользователи\NsPCqJqgIr
2016-10-20 23:06 - 2016-10-20 23:08 - 00000000 ____D C:\ProgramData\NsPCqJqgIr
2016-10-18 22:57 - 2016-10-18 22:59 - 00000000 ____D C:\Users\Все пользователи\bVYMiuW
2016-10-18 22:57 - 2016-10-18 22:59 - 00000000 ____D C:\ProgramData\bVYMiuW
2016-10-17 22:38 - 2016-10-17 22:40 - 00000000 ____D C:\Users\Все пользователи\fwmgjY
2016-10-17 22:38 - 2016-10-17 22:40 - 00000000 ____D C:\ProgramData\fwmgjY
2016-10-15 19:26 - 2016-10-15 19:29 - 00000000 ____D C:\Users\Все пользователи\kZMnRvVHa
2016-10-15 19:26 - 2016-10-15 19:29 - 00000000 ____D C:\ProgramData\kZMnRvVHa
2016-10-14 18:50 - 2016-10-14 18:58 - 00000000 ____D C:\Users\Все пользователи\ApOLQth
2016-10-14 18:50 - 2016-10-14 18:58 - 00000000 ____D C:\ProgramData\ApOLQth
2016-10-13 21:47 - 2016-10-13 21:50 - 00000000 ____D C:\Users\Все пользователи\PNpwyG
2016-10-13 21:47 - 2016-10-13 21:50 - 00000000 ____D C:\ProgramData\PNpwyG
2016-10-11 21:53 - 2016-10-11 22:04 - 00000000 ____D C:\Users\Все пользователи\SRVmHhj
2016-10-11 21:53 - 2016-10-11 22:04 - 00000000 ____D C:\ProgramData\SRVmHhj
2016-10-10 07:34 - 2016-10-10 18:04 - 00000000 ____D C:\Users\Все пользователи\onZzoXa
2016-10-10 07:34 - 2016-10-10 18:04 - 00000000 ____D C:\ProgramData\onZzoXa
2016-10-09 23:00 - 2016-10-09 23:00 - 00011624 _____ C:\Users\444\Desktop\^64DDE4C5DD0150705790E28D33090BACCC090EBA52B038D619^pimgpsh_thumbnail_win_distr.jpg
2016-10-09 22:09 - 2016-10-09 22:10 - 00289964 _____ C:\Users\444\Downloads\2264.html
2016-10-09 21:59 - 2016-10-09 22:01 - 00000000 ____D C:\Users\Все пользователи\xLfdWyErZo
2016-10-09 21:59 - 2016-10-09 22:01 - 00000000 ____D C:\ProgramData\xLfdWyErZo
2016-10-09 17:26 - 2016-10-09 17:26 - 00467359 _____ C:\Users\444\Desktop\oboi-na-rabochiy-stol-1280h10242.rar
2016-10-08 20:47 - 2016-10-08 20:47 - 00001001 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 11.lnk
2016-10-08 20:47 - 2016-10-08 20:47 - 00000989 _____ C:\Users\Public\Desktop\TeamViewer 11.lnk
2016-10-06 22:04 - 2016-10-09 17:26 - 00140528 _____ C:\Users\444\AppData\Local\GDIPFONTCACHEV1.DAT
2016-10-06 22:03 - 2016-10-09 18:00 - 00483712 _____ C:\Windows\system32\FNTCACHE.DAT
2016-10-04 17:55 - 2014-05-14 22:23 - 01973728 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2016-10-04 17:55 - 2014-05-14 22:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2016-10-04 17:55 - 2014-05-14 22:23 - 00054240 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2016-10-04 17:55 - 2014-05-14 22:23 - 00045536 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2016-10-04 17:55 - 2014-05-14 22:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2016-10-04 17:55 - 2014-05-14 22:17 - 02425856 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2016-10-04 17:55 - 2014-05-14 22:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2016-10-04 17:54 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2016-10-04 17:54 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2016-10-04 02:58 - 2016-10-04 02:58 - 00000967 _____ C:\Users\Public\Desktop\SSmaker.lnk
2016-10-04 02:58 - 2016-10-04 02:58 - 00000000 ____D C:\Program Files\SSmaker

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-11-01 03:58 - 2016-09-11 22:48 - 00000356 _____ C:\Windows\Tasks\AlterGeoUpdaterS-1-5-18.job
2016-11-01 03:58 - 2015-10-19 16:23 - 00000888 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-11-01 03:56 - 2015-04-07 19:37 - 00000000 ____D C:\Users\444\AppData\Roaming\Skype
2016-11-01 03:52 - 2009-07-14 10:34 - 00026352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-11-01 03:52 - 2009-07-14 10:34 - 00026352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-11-01 03:30 - 2013-08-28 22:41 - 00000896 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-11-01 02:39 - 2009-07-14 08:37 - 00000000 ____D C:\Windows\tracing
2016-10-31 21:48 - 2016-09-01 20:02 - 00000000 ____D C:\Users\444\Desktop\BenderSky (1)
2016-10-31 17:32 - 2016-07-19 23:48 - 00000000 ____D C:\Users\444\AppData\LocalLow\360WD
2016-10-31 17:21 - 2013-11-07 23:42 - 00065536 _____ C:\Windows\system32\Ikeext.etl
2016-10-31 17:21 - 2009-07-14 10:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-10-31 01:32 - 2013-08-20 12:18 - 00000000 ____D C:\Users\444
2016-10-30 20:31 - 2016-07-19 23:47 - 00000000 _RSHD C:\360SANDBOX
2016-10-29 22:18 - 2016-03-08 23:46 - 00000000 ____D C:\Users\Все пользователи\afoir
2016-10-29 22:18 - 2016-03-08 23:46 - 00000000 ____D C:\ProgramData\afoir
2016-10-29 22:18 - 2016-02-03 21:02 - 00000000 ____D C:\Program Files\Wedsoft
2016-10-29 03:53 - 2016-02-06 22:21 - 00000000 ____D C:\Users\444\AppData\Local\ZpSabH
2016-10-29 03:52 - 2016-02-05 05:55 - 00000000 ____D C:\Users\444\AppData\Local\wwUdrzN
2016-10-29 03:51 - 2016-02-03 21:02 - 00000000 ____D C:\Users\444\AppData\Local\PJmSEe
2016-10-29 03:50 - 2016-02-07 10:19 - 00000000 ____D C:\Users\444\AppData\Local\NXbzfYTzEv
2016-10-29 03:50 - 2016-02-06 18:21 - 00000000 ____D C:\Users\444\AppData\Local\NueKIhQNe
2016-10-29 03:47 - 2016-06-24 22:29 - 00000000 ____D C:\Users\Все пользователи\wuzgqrD
2016-10-29 03:47 - 2016-06-24 22:29 - 00000000 ____D C:\ProgramData\wuzgqrD
2016-10-29 03:47 - 2016-06-19 23:39 - 00000000 ____D C:\Users\Все пользователи\qKYfzQbAE
2016-10-29 03:47 - 2016-06-19 23:39 - 00000000 ____D C:\ProgramData\qKYfzQbAE
2016-10-29 03:47 - 2016-06-19 16:29 - 00000000 ____D C:\Users\Все пользователи\ROaEpoQm
2016-10-29 03:47 - 2016-06-19 16:29 - 00000000 ____D C:\ProgramData\ROaEpoQm
2016-10-29 03:47 - 2016-06-19 16:19 - 00000000 ____D C:\Users\Все пользователи\OaiXZlHN
2016-10-29 03:47 - 2016-06-19 16:19 - 00000000 ____D C:\ProgramData\OaiXZlHN
2016-10-29 03:47 - 2016-06-19 14:17 - 00000000 ____D C:\Users\Все пользователи\XcAdbY
2016-10-29 03:47 - 2016-06-19 14:17 - 00000000 ____D C:\ProgramData\XcAdbY
2016-10-29 03:47 - 2016-06-19 00:07 - 00000000 ____D C:\Users\Все пользователи\QzLzMjv
2016-10-29 03:47 - 2016-06-19 00:07 - 00000000 ____D C:\ProgramData\QzLzMjv
2016-10-29 03:47 - 2016-06-12 18:48 - 00000000 ____D C:\Users\Все пользователи\xXTIpp
2016-10-29 03:47 - 2016-06-12 18:48 - 00000000 ____D C:\ProgramData\xXTIpp
2016-10-29 03:47 - 2016-06-12 04:16 - 00000000 ____D C:\Users\Все пользователи\NdaHGC
2016-10-29 03:47 - 2016-06-12 04:16 - 00000000 ____D C:\ProgramData\NdaHGC
2016-10-29 03:47 - 2016-06-11 11:59 - 00000000 ____D C:\Users\Все пользователи\RHLFIMJbA
2016-10-29 03:47 - 2016-06-11 11:59 - 00000000 ____D C:\ProgramData\RHLFIMJbA
2016-10-29 03:47 - 2016-06-11 11:54 - 00000000 ____D C:\Users\Все пользователи\NvtbqGhM
2016-10-29 03:47 - 2016-06-11 11:54 - 00000000 ____D C:\ProgramData\NvtbqGhM
2016-10-29 03:47 - 2016-06-04 18:31 - 00000000 ____D C:\Users\Все пользователи\UWsSXe
2016-10-29 03:47 - 2016-06-04 18:31 - 00000000 ____D C:\ProgramData\UWsSXe
2016-10-29 03:47 - 2016-05-28 18:04 - 00000000 ____D C:\Users\Все пользователи\UTdgwql
2016-10-29 03:47 - 2016-05-28 18:04 - 00000000 ____D C:\Users\Все пользователи\TVRgqYkD
2016-10-29 03:47 - 2016-05-28 18:04 - 00000000 ____D C:\Users\Все пользователи\rzrOheH
2016-10-29 03:47 - 2016-05-28 18:04 - 00000000 ____D C:\ProgramData\UTdgwql
2016-10-29 03:47 - 2016-05-28 18:04 - 00000000 ____D C:\ProgramData\TVRgqYkD
2016-10-29 03:47 - 2016-05-28 18:04 - 00000000 ____D C:\ProgramData\rzrOheH
2016-10-29 03:47 - 2016-05-27 23:02 - 00000000 ____D C:\Users\Все пользователи\YGCrAU
2016-10-29 03:47 - 2016-05-27 23:02 - 00000000 ____D C:\ProgramData\YGCrAU
2016-10-29 03:47 - 2016-05-26 20:35 - 00000000 ____D C:\Users\Все пользователи\OKTwZE
2016-10-29 03:47 - 2016-05-26 20:35 - 00000000 ____D C:\ProgramData\OKTwZE
2016-10-29 03:47 - 2016-05-26 20:32 - 00000000 ____D C:\Users\Все пользователи\uNRgGQnUx
2016-10-29 03:47 - 2016-05-26 20:32 - 00000000 ____D C:\Users\Все пользователи\pTdIye
2016-10-29 03:47 - 2016-05-26 20:32 - 00000000 ____D C:\ProgramData\uNRgGQnUx
2016-10-29 03:47 - 2016-05-26 20:32 - 00000000 ____D C:\ProgramData\pTdIye
2016-10-29 03:47 - 2016-05-24 08:44 - 00000000 ____D C:\Users\Все пользователи\NOfwhRRosu
2016-10-29 03:47 - 2016-05-24 08:44 - 00000000 ____D C:\ProgramData\NOfwhRRosu
2016-10-29 03:47 - 2016-05-24 02:22 - 00000000 ____D C:\Users\Все пользователи\XQgLaDgB
2016-10-29 03:47 - 2016-05-24 02:22 - 00000000 ____D C:\ProgramData\XQgLaDgB
2016-10-29 03:47 - 2016-05-23 15:57 - 00000000 ____D C:\Users\Все пользователи\OGLTiK
2016-10-29 03:47 - 2016-05-23 15:57 - 00000000 ____D C:\ProgramData\OGLTiK
2016-10-29 03:47 - 2016-05-20 19:45 - 00000000 ____D C:\Users\Все пользователи\YxLtvW
2016-10-29 03:47 - 2016-05-20 19:45 - 00000000 ____D C:\Users\Все пользователи\OsIcGKJbj
2016-10-29 03:47 - 2016-05-20 19:45 - 00000000 ____D C:\Users\Все пользователи\NvFlhp
2016-10-29 03:47 - 2016-05-20 19:45 - 00000000 ____D C:\ProgramData\YxLtvW
2016-10-29 03:47 - 2016-05-20 19:45 - 00000000 ____D C:\ProgramData\OsIcGKJbj
2016-10-29 03:47 - 2016-05-20 19:45 - 00000000 ____D C:\ProgramData\NvFlhp
2016-10-29 03:47 - 2016-05-17 20:26 - 00000000 ____D C:\Users\Все пользователи\xkMOpG
2016-10-29 03:47 - 2016-05-17 20:26 - 00000000 ____D C:\ProgramData\xkMOpG
2016-10-29 03:47 - 2016-05-05 17:50 - 00000000 ____D C:\Users\Все пользователи\wDYFqihDl
2016-10-29 03:47 - 2016-05-05 17:50 - 00000000 ____D C:\Users\Все пользователи\ufuWfAo
2016-10-29 03:47 - 2016-05-05 17:50 - 00000000 ____D C:\ProgramData\wDYFqihDl
2016-10-29 03:47 - 2016-05-05 17:50 - 00000000 ____D C:\ProgramData\ufuWfAo
2016-10-29 03:47 - 2016-05-03 23:07 - 00000000 ____D C:\Users\Все пользователи\vdtbiXcRit
2016-10-29 03:47 - 2016-05-03 23:07 - 00000000 ____D C:\ProgramData\vdtbiXcRit
2016-10-29 03:47 - 2016-05-02 15:49 - 00000000 ____D C:\Users\Все пользователи\TzclGXmwMu
2016-10-29 03:47 - 2016-05-02 15:49 - 00000000 ____D C:\ProgramData\TzclGXmwMu
2016-10-29 03:47 - 2016-05-02 11:49 - 00000000 ____D C:\Users\Все пользователи\UnedoDuLii
2016-10-29 03:47 - 2016-05-02 11:49 - 00000000 ____D C:\Users\Все пользователи\rORxbf
2016-10-29 03:47 - 2016-05-02 11:49 - 00000000 ____D C:\ProgramData\UnedoDuLii
2016-10-29 03:47 - 2016-05-02 11:49 - 00000000 ____D C:\ProgramData\rORxbf
2016-10-29 03:47 - 2016-05-02 05:24 - 00000000 ____D C:\Users\Все пользователи\SPRqGXfv
2016-10-29 03:47 - 2016-05-02 05:24 - 00000000 ____D C:\ProgramData\SPRqGXfv
2016-10-29 03:47 - 2016-05-01 13:01 - 00000000 ____D C:\Users\Все пользователи\TihpxLSqc
2016-10-29 03:47 - 2016-05-01 13:01 - 00000000 ____D C:\ProgramData\TihpxLSqc
2016-10-29 03:47 - 2016-05-01 04:42 - 00000000 ____D C:\Users\Все пользователи\qphxilKg
2016-10-29 03:47 - 2016-05-01 04:42 - 00000000 ____D C:\ProgramData\qphxilKg
2016-10-29 03:47 - 2016-04-10 22:34 - 00000000 ____D C:\Users\Все пользователи\pTTRYP
2016-10-29 03:47 - 2016-04-10 22:34 - 00000000 ____D C:\Users\Все пользователи\NEFyciIurA
2016-10-29 03:47 - 2016-04-10 22:34 - 00000000 ____D C:\ProgramData\pTTRYP
2016-10-29 03:47 - 2016-04-10 22:34 - 00000000 ____D C:\ProgramData\NEFyciIurA
2016-10-29 03:47 - 2016-04-06 23:10 - 00000000 ____D C:\Users\Все пользователи\tLegTRk
2016-10-29 03:47 - 2016-04-06 23:10 - 00000000 ____D C:\ProgramData\tLegTRk
2016-10-29 03:47 - 2016-04-03 20:30 - 00000000 ____D C:\Users\Все пользователи\tMOOjRFyT
2016-10-29 03:47 - 2016-04-03 20:30 - 00000000 ____D C:\ProgramData\tMOOjRFyT
2016-10-29 03:47 - 2016-03-26 06:10 - 00000000 ____D C:\Users\Все пользователи\VKaTwSAI
2016-10-29 03:47 - 2016-03-26 06:10 - 00000000 ____D C:\Users\Все пользователи\RoyCXcVH
2016-10-29 03:47 - 2016-03-26 06:10 - 00000000 ____D C:\ProgramData\VKaTwSAI
2016-10-29 03:47 - 2016-03-26 06:10 - 00000000 ____D C:\ProgramData\RoyCXcVH
2016-10-29 03:47 - 2016-03-26 00:01 - 00000000 ____D C:\Users\Все пользователи\wmygPfc
2016-10-29 03:47 - 2016-03-26 00:01 - 00000000 ____D C:\ProgramData\wmygPfc
2016-10-29 03:47 - 2016-03-22 11:37 - 00000000 ____D C:\Users\Все пользователи\tyhZnJ
2016-10-29 03:47 - 2016-03-22 11:37 - 00000000 ____D C:\ProgramData\tyhZnJ
2016-10-29 03:47 - 2016-03-21 02:09 - 00000000 ____D C:\Users\Все пользователи\ttPamuU
2016-10-29 03:47 - 2016-03-21 02:09 - 00000000 ____D C:\ProgramData\ttPamuU
2016-10-29 03:47 - 2016-03-20 19:05 - 00000000 ____D C:\Users\Все пользователи\XpVSXxjG
2016-10-29 03:47 - 2016-03-20 19:05 - 00000000 ____D C:\ProgramData\XpVSXxjG
2016-10-29 03:47 - 2016-03-19 16:18 - 00000000 ____D C:\Users\Все пользователи\XonjoLQRaw
2016-10-29 03:47 - 2016-03-19 16:18 - 00000000 ____D C:\ProgramData\XonjoLQRaw
2016-10-29 03:47 - 2016-03-19 12:18 - 00000000 ____D C:\Users\Все пользователи\ufMhGmx
2016-10-29 03:47 - 2016-03-19 12:18 - 00000000 ____D C:\Users\Все пользователи\UfewDNKvA
2016-10-29 03:47 - 2016-03-19 12:18 - 00000000 ____D C:\ProgramData\ufMhGmx
2016-10-29 03:47 - 2016-03-19 12:18 - 00000000 ____D C:\ProgramData\UfewDNKvA
2016-10-29 03:47 - 2016-03-18 23:49 - 00000000 ____D C:\Users\Все пользователи\RWAjCbb
2016-10-29 03:47 - 2016-03-18 23:49 - 00000000 ____D C:\Users\Все пользователи\qcamKJYaB
2016-10-29 03:47 - 2016-03-18 23:49 - 00000000 ____D C:\Users\Все пользователи\nJWCxkUU
2016-10-29 03:47 - 2016-03-18 23:49 - 00000000 ____D C:\ProgramData\RWAjCbb
2016-10-29 03:47 - 2016-03-18 23:49 - 00000000 ____D C:\ProgramData\qcamKJYaB
2016-10-29 03:47 - 2016-03-18 23:49 - 00000000 ____D C:\ProgramData\nJWCxkUU
2016-10-29 03:47 - 2016-03-13 15:37 - 00000000 ____D C:\Users\Все пользователи\xmUoPELuzS
2016-10-29 03:47 - 2016-03-13 15:37 - 00000000 ____D C:\Users\Все пользователи\RaKFwzcoX
2016-10-29 03:47 - 2016-03-13 15:37 - 00000000 ____D C:\ProgramData\xmUoPELuzS
2016-10-29 03:47 - 2016-03-13 15:37 - 00000000 ____D C:\ProgramData\RaKFwzcoX
2016-10-29 03:47 - 2016-03-09 19:09 - 00000000 ____D C:\Users\Все пользователи\tFNHZW
2016-10-29 03:47 - 2016-03-09 19:09 - 00000000 ____D C:\Users\Все пользователи\oBGeDl
2016-10-29 03:47 - 2016-03-09 19:09 - 00000000 ____D C:\ProgramData\tFNHZW
2016-10-29 03:47 - 2016-03-09 19:09 - 00000000 ____D C:\ProgramData\oBGeDl
2016-10-29 03:47 - 2016-03-08 23:45 - 00000000 ____D C:\Users\Все пользователи\ySBAwLG
2016-10-29 03:47 - 2016-03-08 23:45 - 00000000 ____D C:\Users\Все пользователи\ObmnEFz
2016-10-29 03:47 - 2016-03-08 23:45 - 00000000 ____D C:\ProgramData\ySBAwLG
2016-10-29 03:47 - 2016-03-08 23:45 - 00000000 ____D C:\ProgramData\ObmnEFz
2016-10-29 03:47 - 2016-03-07 16:10 - 00000000 ____D C:\Users\Все пользователи\xJtjKgFlG
2016-10-29 03:47 - 2016-03-07 16:10 - 00000000 ____D C:\ProgramData\xJtjKgFlG
2016-10-29 03:47 - 2016-03-07 12:10 - 00000000 ____D C:\Users\Все пользователи\vXLpsgxaV
2016-10-29 03:47 - 2016-03-07 12:10 - 00000000 ____D C:\ProgramData\vXLpsgxaV
2016-10-29 03:47 - 2016-03-07 08:11 - 00000000 ____D C:\Users\Все пользователи\nNIrYiwZ
2016-10-29 03:47 - 2016-03-07 08:11 - 00000000 ____D C:\ProgramData\nNIrYiwZ
2016-10-29 03:47 - 2016-03-07 01:10 - 00000000 ____D C:\Users\Все пользователи\zPtEmD
2016-10-29 03:47 - 2016-03-07 01:10 - 00000000 ____D C:\Users\Все пользователи\NnETmQ
2016-10-29 03:47 - 2016-03-07 01:10 - 00000000 ____D C:\ProgramData\zPtEmD
2016-10-29 03:47 - 2016-03-07 01:10 - 00000000 ____D C:\ProgramData\NnETmQ
2016-10-29 03:47 - 2016-03-06 21:10 - 00000000 ____D C:\Users\Все пользователи\wqQCwePuMt
2016-10-29 03:47 - 2016-03-06 21:10 - 00000000 ____D C:\ProgramData\wqQCwePuMt
2016-10-29 03:47 - 2016-03-06 17:10 - 00000000 ____D C:\Users\Все пользователи\WmBgRpGpM
2016-10-29 03:47 - 2016-03-06 17:10 - 00000000 ____D C:\ProgramData\WmBgRpGpM
2016-10-29 03:47 - 2016-03-06 13:10 - 00000000 ____D C:\Users\Все пользователи\whPguHK
2016-10-29 03:47 - 2016-03-06 13:10 - 00000000 ____D C:\ProgramData\whPguHK
2016-10-29 03:47 - 2016-03-06 03:00 - 00000000 ____D C:\Users\Все пользователи\wmdjlK
2016-10-29 03:47 - 2016-03-06 03:00 - 00000000 ____D C:\ProgramData\wmdjlK
2016-10-29 03:47 - 2016-03-03 19:54 - 00000000 ____D C:\Users\Все пользователи\PydLYnoE
2016-10-29 03:47 - 2016-03-03 19:54 - 00000000 ____D C:\ProgramData\PydLYnoE
2016-10-29 03:47 - 2016-03-02 21:20 - 00000000 ____D C:\Users\Все пользователи\zASdJLN
2016-10-29 03:47 - 2016-03-02 21:20 - 00000000 ____D C:\Users\Все пользователи\NrJONihpPy
2016-10-29 03:47 - 2016-03-02 21:20 - 00000000 ____D C:\ProgramData\zASdJLN
2016-10-29 03:47 - 2016-03-02 21:20 - 00000000 ____D C:\ProgramData\NrJONihpPy
2016-10-29 03:47 - 2016-02-28 21:00 - 00000000 ____D C:\Users\Все пользователи\SUHPUW
2016-10-29 03:47 - 2016-02-28 21:00 - 00000000 ____D C:\ProgramData\SUHPUW
2016-10-29 03:47 - 2016-02-28 17:00 - 00000000 ____D C:\Users\Все пользователи\xSfmqeYZ
2016-10-29 03:47 - 2016-02-28 17:00 - 00000000 ____D C:\Users\Все пользователи\TBGApIJxv
2016-10-29 03:47 - 2016-02-28 17:00 - 00000000 ____D C:\ProgramData\xSfmqeYZ
2016-10-29 03:47 - 2016-02-28 17:00 - 00000000 ____D C:\ProgramData\TBGApIJxv
2016-10-29 03:47 - 2016-02-28 13:00 - 00000000 ____D C:\Users\Все пользователи\RTApzW
2016-10-29 03:47 - 2016-02-28 13:00 - 00000000 ____D C:\ProgramData\RTApzW
2016-10-29 03:47 - 2016-02-25 09:55 - 00000000 ____D C:\Users\Все пользователи\NOyoZO
2016-10-29 03:47 - 2016-02-25 09:55 - 00000000 ____D C:\ProgramData\NOyoZO
2016-10-29 03:47 - 2016-02-24 19:48 - 00000000 ____D C:\Users\Все пользователи\RlVOsQ
2016-10-29 03:47 - 2016-02-24 19:48 - 00000000 ____D C:\ProgramData\RlVOsQ
2016-10-29 03:47 - 2016-02-20 19:33 - 00000000 ____D C:\Users\Все пользователи\rxRUTUi
2016-10-29 03:47 - 2016-02-20 19:33 - 00000000 ____D C:\Users\Все пользователи\reRpxLeYC
2016-10-29 03:47 - 2016-02-20 19:33 - 00000000 ____D C:\ProgramData\rxRUTUi
2016-10-29 03:47 - 2016-02-20 19:33 - 00000000 ____D C:\ProgramData\reRpxLeYC
2016-10-29 03:47 - 2016-02-19 20:25 - 00000000 ____D C:\Users\Все пользователи\yvspAGbOw
2016-10-29 03:47 - 2016-02-19 20:25 - 00000000 ____D C:\ProgramData\yvspAGbOw
2016-10-29 03:47 - 2016-02-17 13:02 - 00000000 ____D C:\Users\Все пользователи\NIGRqyPt
2016-10-29 03:47 - 2016-02-17 13:02 - 00000000 ____D C:\ProgramData\NIGRqyPt
2016-10-29 03:47 - 2016-02-16 13:09 - 00000000 ____D C:\Users\Все пользователи\xfOnhcKU
2016-10-29 03:47 - 2016-02-16 13:09 - 00000000 ____D C:\ProgramData\xfOnhcKU
2016-10-29 03:47 - 2016-02-15 19:29 - 00000000 ____D C:\Users\Все пользователи\QEqYxugw
2016-10-29 03:47 - 2016-02-15 19:29 - 00000000 ____D C:\ProgramData\QEqYxugw
2016-10-29 03:47 - 2016-02-15 15:29 - 00000000 ____D C:\Users\Все пользователи\MRXyOIs
2016-10-29 03:47 - 2016-02-15 15:29 - 00000000 ____D C:\ProgramData\MRXyOIs
2016-10-29 03:47 - 2016-02-14 18:09 - 00000000 ____D C:\Users\Все пользователи\ytJoptZrP
2016-10-29 03:47 - 2016-02-14 18:09 - 00000000 ____D C:\ProgramData\ytJoptZrP
2016-10-29 03:47 - 2016-02-14 00:01 - 00000000 ____D C:\Users\Все пользователи\yRRaeGDpz
2016-10-29 03:47 - 2016-02-14 00:01 - 00000000 ____D C:\ProgramData\yRRaeGDpz
2016-10-29 03:47 - 2016-02-13 16:01 - 00000000 ____D C:\Users\Все пользователи\vWdjxH
2016-10-29 03:47 - 2016-02-13 16:01 - 00000000 ____D C:\ProgramData\vWdjxH
2016-10-29 03:47 - 2016-02-11 16:53 - 00000000 ____D C:\Users\Все пользователи\WudlThYpRL
2016-10-29 03:47 - 2016-02-11 16:53 - 00000000 ____D C:\Users\Все пользователи\NagrKdCv
2016-10-29 03:47 - 2016-02-11 16:53 - 00000000 ____D C:\ProgramData\WudlThYpRL
2016-10-29 03:47 - 2016-02-11 16:53 - 00000000 ____D C:\ProgramData\NagrKdCv
2016-10-29 03:47 - 2016-02-09 15:56 - 00000000 ____D C:\Users\Все пользователи\sqzeEo
2016-10-29 03:47 - 2016-02-09 15:56 - 00000000 ____D C:\ProgramData\sqzeEo
2016-10-29 03:47 - 2016-02-07 02:21 - 00000000 ____D C:\Users\444\AppData\Local\baYwcw
2016-10-29 03:47 - 2016-02-06 22:21 - 00000000 ____D C:\Users\Все пользователи\yWwxBoQ
2016-10-29 03:47 - 2016-02-06 22:21 - 00000000 ____D C:\ProgramData\yWwxBoQ
2016-10-29 03:47 - 2016-02-05 13:08 - 00000000 ____D C:\Users\444\AppData\Local\EuyjvwBV
2016-10-29 03:47 - 2016-02-04 22:32 - 00000000 ____D C:\Users\Все пользователи\zAlXoaEe
2016-10-29 03:47 - 2016-02-04 22:32 - 00000000 ____D C:\Users\Все пользователи\OeOfVKsj
2016-10-29 03:47 - 2016-02-04 22:32 - 00000000 ____D C:\Users\444\AppData\Local\gHMavFgRTt
2016-10-29 03:47 - 2016-02-04 22:32 - 00000000 ____D C:\ProgramData\zAlXoaEe
2016-10-29 03:47 - 2016-02-04 22:32 - 00000000 ____D C:\ProgramData\OeOfVKsj
2016-10-29 03:47 - 2016-02-04 22:31 - 00000000 ____D C:\Users\Все пользователи\uELcfjiF
2016-10-29 03:47 - 2016-02-04 22:31 - 00000000 ____D C:\ProgramData\uELcfjiF
2016-10-29 03:47 - 2016-02-04 20:08 - 00000000 ____D C:\Users\Все пользователи\siWHrADk
2016-10-29 03:47 - 2016-02-04 20:08 - 00000000 ____D C:\Users\444\AppData\Local\joPDSL
2016-10-29 03:47 - 2016-02-04 20:08 - 00000000 ____D C:\ProgramData\siWHrADk
2016-10-29 03:47 - 2016-02-04 04:45 - 00000000 ____D C:\Users\444\AppData\Local\dwIJSyhJhM
2016-10-29 03:45 - 2016-06-19 16:05 - 00000000 ____D C:\Users\Все пользователи\HOBGdf
2016-10-29 03:45 - 2016-06-19 16:05 - 00000000 ____D C:\ProgramData\HOBGdf
2016-10-29 03:45 - 2016-06-18 20:07 - 00000000 ____D C:\Users\Все пользователи\EnndzotYEZ
2016-10-29 03:45 - 2016-06-18 20:07 - 00000000 ____D C:\ProgramData\EnndzotYEZ
2016-10-29 03:45 - 2016-06-18 14:55 - 00000000 ____D C:\Users\Все пользователи\cnECPDL
2016-10-29 03:45 - 2016-06-18 14:55 - 00000000 ____D C:\ProgramData\cnECPDL
2016-10-29 03:45 - 2016-06-15 16:44 - 00000000 ____D C:\Users\Все пользователи\lLlAOgU
2016-10-29 03:45 - 2016-06-15 16:44 - 00000000 ____D C:\ProgramData\lLlAOgU
2016-10-29 03:45 - 2016-06-13 01:35 - 00000000 ____D C:\Users\Все пользователи\McMtoOYM
2016-10-29 03:45 - 2016-06-13 01:35 - 00000000 ____D C:\ProgramData\McMtoOYM
2016-10-29 03:45 - 2016-06-12 10:40 - 00000000 ____D C:\Users\Все пользователи\HcdCJkWQMP
2016-10-29 03:45 - 2016-06-12 10:40 - 00000000 ____D C:\ProgramData\HcdCJkWQMP
2016-10-29 03:45 - 2016-06-11 22:57 - 00000000 ____D C:\Users\Все пользователи\BZcntFs
2016-10-29 03:45 - 2016-06-11 22:57 - 00000000 ____D C:\ProgramData\BZcntFs
2016-10-29 03:45 - 2016-06-11 18:57 - 00000000 ____D C:\Users\Все пользователи\MBalnYL
2016-10-29 03:45 - 2016-06-11 18:57 - 00000000 ____D C:\Users\Все пользователи\czMvUuE
2016-10-29 03:45 - 2016-06-11 18:57 - 00000000 ____D C:\Users\Все пользователи\cKCbkNQj
2016-10-29 03:45 - 2016-06-11 18:57 - 00000000 ____D C:\ProgramData\MBalnYL
2016-10-29 03:45 - 2016-06-11 18:57 - 00000000 ____D C:\ProgramData\czMvUuE
2016-10-29 03:45 - 2016-06-11 18:57 - 00000000 ____D C:\ProgramData\cKCbkNQj
2016-10-29 03:45 - 2016-06-11 14:57 - 00000000 ____D C:\Users\Все пользователи\hduhDuExf
2016-10-29 03:45 - 2016-06-11 14:57 - 00000000 ____D C:\ProgramData\hduhDuExf
2016-10-29 03:45 - 2016-06-11 11:54 - 00000000 ____D C:\Users\Все пользователи\mcXLLOTzH
2016-10-29 03:45 - 2016-06-11 11:54 - 00000000 ____D C:\Users\Все пользователи\CNhLnM
2016-10-29 03:45 - 2016-06-11 11:54 - 00000000 ____D C:\ProgramData\mcXLLOTzH
2016-10-29 03:45 - 2016-06-11 11:54 - 00000000 ____D C:\ProgramData\CNhLnM
2016-10-29 03:45 - 2016-05-28 22:04 - 00000000 ____D C:\Users\Все пользователи\mjWqMqoF
2016-10-29 03:45 - 2016-05-28 22:04 - 00000000 ____D C:\Users\Все пользователи\GuAGlOvOX
2016-10-29 03:45 - 2016-05-28 22:04 - 00000000 ____D C:\Users\Все пользователи\cXmjFXP
2016-10-29 03:45 - 2016-05-28 22:04 - 00000000 ____D C:\ProgramData\mjWqMqoF
2016-10-29 03:45 - 2016-05-28 22:04 - 00000000 ____D C:\ProgramData\GuAGlOvOX
2016-10-29 03:45 - 2016-05-28 22:04 - 00000000 ____D C:\ProgramData\cXmjFXP
2016-10-29 03:45 - 2016-05-27 16:26 - 00000000 ____D C:\Users\Все пользователи\mAlyOS
2016-10-29 03:45 - 2016-05-27 16:26 - 00000000 ____D C:\ProgramData\mAlyOS
2016-10-29 03:45 - 2016-05-27 12:26 - 00000000 ____D C:\Users\Все пользователи\jgYhJIMHFz
2016-10-29 03:45 - 2016-05-27 12:26 - 00000000 ____D C:\Users\Все пользователи\ipfyNv
2016-10-29 03:45 - 2016-05-27 12:26 - 00000000 ____D C:\ProgramData\jgYhJIMHFz
2016-10-29 03:45 - 2016-05-27 12:26 - 00000000 ____D C:\ProgramData\ipfyNv
2016-10-29 03:45 - 2016-05-26 20:35 - 00000000 ____D C:\Users\Все пользователи\kUuTaiVfhb
2016-10-29 03:45 - 2016-05-26 20:35 - 00000000 ____D C:\Users\Все пользователи\cGwthByo
2016-10-29 03:45 - 2016-05-26 20:35 - 00000000 ____D C:\ProgramData\kUuTaiVfhb
2016-10-29 03:45 - 2016-05-26 20:35 - 00000000 ____D C:\ProgramData\cGwthByo
2016-10-29 03:45 - 2016-05-26 20:32 - 00000000 ____D C:\Users\Все пользователи\JYwOHjSkv
2016-10-29 03:45 - 2016-05-26 20:32 - 00000000 ____D C:\ProgramData\JYwOHjSkv
2016-10-29 03:45 - 2016-05-24 20:32 - 00000000 ____D C:\Users\Все пользователи\eUeMwuspX
2016-10-29 03:45 - 2016-05-24 20:32 - 00000000 ____D C:\ProgramData\eUeMwuspX
2016-10-29 03:45 - 2016-05-23 19:56 - 00000000 ____D C:\Users\Все пользователи\lxldjql
2016-10-29 03:45 - 2016-05-23 19:56 - 00000000 ____D C:\Users\Все пользователи\kdIWFfkj
2016-10-29 03:45 - 2016-05-23 19:56 - 00000000 ____D C:\Users\Все пользователи\gwmKos
2016-10-29 03:45 - 2016-05-23 19:56 - 00000000 ____D C:\ProgramData\lxldjql
2016-10-29 03:45 - 2016-05-23 19:56 - 00000000 ____D C:\ProgramData\kdIWFfkj
2016-10-29 03:45 - 2016-05-23 19:56 - 00000000 ____D C:\ProgramData\gwmKos
2016-10-29 03:45 - 2016-05-23 15:57 - 00000000 ____D C:\Users\Все пользователи\JHDMdvnL
2016-10-29 03:45 - 2016-05-23 15:57 - 00000000 ____D C:\ProgramData\JHDMdvnL
2016-10-29 03:45 - 2016-05-23 15:56 - 00000000 ____D C:\Users\Все пользователи\KDHtqXqpn
2016-10-29 03:45 - 2016-05-23 15:56 - 00000000 ____D C:\ProgramData\KDHtqXqpn
2016-10-29 03:45 - 2016-05-17 20:26 - 00000000 ____D C:\Users\Все пользователи\HbaLqvA
2016-10-29 03:45 - 2016-05-17 20:26 - 00000000 ____D C:\Users\Все пользователи\gNCGDJrY
2016-10-29 03:45 - 2016-05-17 20:26 - 00000000 ____D C:\ProgramData\HbaLqvA
2016-10-29 03:45 - 2016-05-17 20:26 - 00000000 ____D C:\ProgramData\gNCGDJrY
2016-10-29 03:45 - 2016-05-05 17:50 - 00000000 ____D C:\Users\Все пользователи\hEYhqfAGhU
2016-10-29 03:45 - 2016-05-05 17:50 - 00000000 ____D C:\ProgramData\hEYhqfAGhU
2016-10-29 03:45 - 2016-05-02 19:49 - 00000000 ____D C:\Users\Все пользователи\MAgNWkn
2016-10-29 03:45 - 2016-05-02 19:49 - 00000000 ____D C:\ProgramData\MAgNWkn
2016-10-29 03:45 - 2016-05-02 11:50 - 00000000 ____D C:\Users\Все пользователи\hNFbxcvKkW
2016-10-29 03:45 - 2016-05-02 11:50 - 00000000 ____D C:\ProgramData\hNFbxcvKkW
2016-10-29 03:45 - 2016-05-02 05:24 - 00000000 ____D C:\Users\Все пользователи\GdNfZc
2016-10-29 03:45 - 2016-05-02 05:24 - 00000000 ____D C:\ProgramData\GdNfZc
2016-10-29 03:45 - 2016-05-01 21:17 - 00000000 ____D C:\Users\Все пользователи\jiOXcuGhpH
2016-10-29 03:45 - 2016-05-01 21:17 - 00000000 ____D C:\ProgramData\jiOXcuGhpH
2016-10-29 03:45 - 2016-05-01 04:42 - 00000000 ____D C:\Users\Все пользователи\DMVVTc
2016-10-29 03:45 - 2016-05-01 04:42 - 00000000 ____D C:\ProgramData\DMVVTc
2016-10-29 03:45 - 2016-04-10 22:34 - 00000000 ____D C:\Users\Все пользователи\dZAjLR
2016-10-29 03:45 - 2016-04-10 22:34 - 00000000 ____D C:\ProgramData\dZAjLR
2016-10-29 03:45 - 2016-04-03 20:30 - 00000000 ____D C:\Users\Все пользователи\CBUgUqAnZ
2016-10-29 03:45 - 2016-04-03 20:30 - 00000000 ____D C:\ProgramData\CBUgUqAnZ
2016-10-29 03:45 - 2016-04-03 16:31 - 00000000 ____D C:\Users\Все пользователи\KYlMNKvXes
2016-10-29 03:45 - 2016-04-03 16:31 - 00000000 ____D C:\Users\Все пользователи\kIbpqYnPm
2016-10-29 03:45 - 2016-04-03 16:31 - 00000000 ____D C:\Users\Все пользователи\cveUhiJx
2016-10-29 03:45 - 2016-04-03 16:31 - 00000000 ____D C:\ProgramData\KYlMNKvXes
2016-10-29 03:45 - 2016-04-03 16:31 - 00000000 ____D C:\ProgramData\kIbpqYnPm
2016-10-29 03:45 - 2016-04-03 16:31 - 00000000 ____D C:\ProgramData\cveUhiJx
2016-10-29 03:45 - 2016-03-26 06:10 - 00000000 ____D C:\Users\Все пользователи\iyFKJmSHaQ
2016-10-29 03:45 - 2016-03-26 06:10 - 00000000 ____D C:\ProgramData\iyFKJmSHaQ
2016-10-29 03:45 - 2016-03-26 00:01 - 00000000 ____D C:\Users\Все пользователи\IMNUANizJX
2016-10-29 03:45 - 2016-03-26 00:01 - 00000000 ____D C:\Users\Все пользователи\AvOkhewNr
2016-10-29 03:45 - 2016-03-26 00:01 - 00000000 ____D C:\ProgramData\IMNUANizJX
2016-10-29 03:45 - 2016-03-26 00:01 - 00000000 ____D C:\ProgramData\AvOkhewNr
2016-10-29 03:45 - 2016-03-21 21:33 - 00000000 ____D C:\Users\Все пользователи\GcaRPhO
2016-10-29 03:45 - 2016-03-21 21:33 - 00000000 ____D C:\ProgramData\GcaRPhO
2016-10-29 03:45 - 2016-03-20 15:05 - 00000000 ____D C:\Users\Все пользователи\MeMnrJF
2016-10-29 03:45 - 2016-03-20 15:05 - 00000000 ____D C:\ProgramData\MeMnrJF
2016-10-29 03:45 - 2016-03-20 14:41 - 00000000 ____D C:\Users\Все пользователи\BfgBayBHeK
2016-10-29 03:45 - 2016-03-20 14:41 - 00000000 ____D C:\ProgramData\BfgBayBHeK
2016-10-29 03:45 - 2016-03-20 00:18 - 00000000 ____D C:\Users\Все пользователи\fxEeWhL
2016-10-29 03:45 - 2016-03-20 00:18 - 00000000 ____D C:\Users\Все пользователи\CbaswrNXgc
2016-10-29 03:45 - 2016-03-20 00:18 - 00000000 ____D C:\Users\Все пользователи\bjwopLkv
2016-10-29 03:45 - 2016-03-20 00:18 - 00000000 ____D C:\ProgramData\fxEeWhL
2016-10-29 03:45 - 2016-03-20 00:18 - 00000000 ____D C:\ProgramData\CbaswrNXgc
2016-10-29 03:45 - 2016-03-20 00:18 - 00000000 ____D C:\ProgramData\bjwopLkv
2016-10-29 03:45 - 2016-03-19 20:18 - 00000000 ____D C:\Users\Все пользователи\ArAvGLZSwo
2016-10-29 03:45 - 2016-03-19 20:18 - 00000000 ____D C:\ProgramData\ArAvGLZSwo
2016-10-29 03:45 - 2016-03-15 11:33 - 00000000 ____D C:\Users\Все пользователи\HEayjibPx
2016-10-29 03:45 - 2016-03-15 11:33 - 00000000 ____D C:\ProgramData\HEayjibPx
2016-10-29 03:45 - 2016-03-13 15:37 - 00000000 ____D C:\Users\Все пользователи\AOxbYlwN
2016-10-29 03:45 - 2016-03-13 15:37 - 00000000 ____D C:\ProgramData\AOxbYlwN
2016-10-29 03:45 - 2016-03-12 22:10 - 00000000 ____D C:\Users\Все пользователи\LLfoLqB
2016-10-29 03:45 - 2016-03-12 22:10 - 00000000 ____D C:\ProgramData\LLfoLqB
2016-10-29 03:45 - 2016-03-08 23:45 - 00000000 ____D C:\Users\Все пользователи\fJsErrddc
2016-10-29 03:45 - 2016-03-08 23:45 - 00000000 ____D C:\ProgramData\fJsErrddc
2016-10-29 03:45 - 2016-03-07 01:10 - 00000000 ____D C:\Users\Все пользователи\ePSokQh
2016-10-29 03:45 - 2016-03-07 01:10 - 00000000 ____D C:\ProgramData\ePSokQh
2016-10-29 03:45 - 2016-03-06 03:00 - 00000000 ____D C:\Users\Все пользователи\DtnvNvH
2016-10-29 03:45 - 2016-03-06 03:00 - 00000000 ____D C:\Users\Все пользователи\bpLnkQIcT
2016-10-29 03:45 - 2016-03-06 03:00 - 00000000 ____D C:\ProgramData\DtnvNvH
2016-10-29 03:45 - 2016-03-06 03:00 - 00000000 ____D C:\ProgramData\bpLnkQIcT
2016-10-29 03:45 - 2016-03-05 23:01 - 00000000 ____D C:\Users\Все пользователи\ERvfasay
2016-10-29 03:45 - 2016-03-05 23:01 - 00000000 ____D C:\ProgramData\ERvfasay
2016-10-29 03:45 - 2016-03-03 19:54 - 00000000 ____D C:\Users\Все пользователи\gqJbyEndVt
2016-10-29 03:45 - 2016-03-03 19:54 - 00000000 ____D C:\Users\Все пользователи\gahMEWInZJ
2016-10-29 03:45 - 2016-03-03 19:54 - 00000000 ____D C:\ProgramData\gqJbyEndVt
2016-10-29 03:45 - 2016-03-03 19:54 - 00000000 ____D C:\ProgramData\gahMEWInZJ
2016-10-29 03:45 - 2016-03-03 15:55 - 00000000 ____D C:\Users\Все пользователи\bhhcPKugK
2016-10-29 03:45 - 2016-03-03 15:55 - 00000000 ____D C:\ProgramData\bhhcPKugK
2016-10-29 03:45 - 2016-03-02 21:20 - 00000000 ____D C:\Users\Все пользователи\aFAXGrdyW
2016-10-29 03:45 - 2016-03-02 21:20 - 00000000 ____D C:\ProgramData\aFAXGrdyW
2016-10-29 03:45 - 2016-03-01 23:35 - 00000000 ____D C:\Users\Все пользователи\aXQzGm
2016-10-29 03:45 - 2016-03-01 23:35 - 00000000 ____D C:\ProgramData\aXQzGm
2016-10-29 03:45 - 2016-02-28 17:00 - 00000000 ____D C:\Users\Все пользователи\FARcqxSTK
2016-10-29 03:45 - 2016-02-28 17:00 - 00000000 ____D C:\ProgramData\FARcqxSTK
2016-10-29 03:45 - 2016-02-25 02:02 - 00000000 ____D C:\Users\Все пользователи\GuLWHWRKcX
2016-10-29 03:45 - 2016-02-25 02:02 - 00000000 ____D C:\ProgramData\GuLWHWRKcX
2016-10-29 03:45 - 2016-02-24 19:48 - 00000000 ____D C:\Users\Все пользователи\dwUqqM
2016-10-29 03:45 - 2016-02-24 19:48 - 00000000 ____D C:\ProgramData\dwUqqM
2016-10-29 03:45 - 2016-02-22 15:13 - 00000000 ____D C:\Users\Все пользователи\CsKlmHLFVF
2016-10-29 03:45 - 2016-02-22 15:13 - 00000000 ____D C:\Users\Все пользователи\Bjjictg
2016-10-29 03:45 - 2016-02-22 15:13 - 00000000 ____D C:\Users\Все пользователи\aLIDKSVHd
2016-10-29 03:45 - 2016-02-22 15:13 - 00000000 ____D C:\ProgramData\CsKlmHLFVF
2016-10-29 03:45 - 2016-02-22 15:13 - 00000000 ____D C:\ProgramData\Bjjictg
2016-10-29 03:45 - 2016-02-22 15:13 - 00000000 ____D C:\ProgramData\aLIDKSVHd
2016-10-29 03:45 - 2016-02-21 14:52 - 00000000 ____D C:\Users\Все пользователи\iFloCA
2016-10-29 03:45 - 2016-02-21 14:52 - 00000000 ____D C:\Users\Все пользователи\gFaMbHeLEx
2016-10-29 03:45 - 2016-02-21 14:52 - 00000000 ____D C:\Users\Все пользователи\CfzdPAb
2016-10-29 03:45 - 2016-02-21 14:52 - 00000000 ____D C:\ProgramData\iFloCA
2016-10-29 03:45 - 2016-02-21 14:52 - 00000000 ____D C:\ProgramData\gFaMbHeLEx
2016-10-29 03:45 - 2016-02-21 14:52 - 00000000 ____D C:\ProgramData\CfzdPAb
2016-10-29 03:45 - 2016-02-20 19:33 - 00000000 ____D C:\Users\Все пользователи\FkCpmz
2016-10-29 03:45 - 2016-02-20 19:33 - 00000000 ____D C:\ProgramData\FkCpmz
2016-10-29 03:45 - 2016-02-17 13:02 - 00000000 ____D C:\Users\Все пользователи\FIriWDO
2016-10-29 03:45 - 2016-02-17 13:02 - 00000000 ____D C:\Users\Все пользователи\clQQxWdF
2016-10-29 03:45 - 2016-02-17 13:02 - 00000000 ____D C:\ProgramData\FIriWDO
2016-10-29 03:45 - 2016-02-17 13:02 - 00000000 ____D C:\ProgramData\clQQxWdF
2016-10-29 03:45 - 2016-02-16 17:09 - 00000000 ____D C:\Users\Все пользователи\HRPtrLJqmx
2016-10-29 03:45 - 2016-02-16 17:09 - 00000000 ____D C:\ProgramData\HRPtrLJqmx
2016-10-29 03:45 - 2016-02-16 04:36 - 00000000 ____D C:\Users\Все пользователи\AJchycJxC
2016-10-29 03:45 - 2016-02-16 04:36 - 00000000 ____D C:\ProgramData\AJchycJxC
2016-10-29 03:45 - 2016-02-15 19:29 - 00000000 ____D C:\Users\Все пользователи\lkoDkCAg
2016-10-29 03:45 - 2016-02-15 19:29 - 00000000 ____D C:\Users\Все пользователи\ktfqOZe
2016-10-29 03:45 - 2016-02-15 19:29 - 00000000 ____D C:\ProgramData\lkoDkCAg
2016-10-29 03:45 - 2016-02-15 19:29 - 00000000 ____D C:\ProgramData\ktfqOZe
2016-10-29 03:45 - 2016-02-15 15:29 - 00000000 ____D C:\Users\Все пользователи\ICkXdgI
2016-10-29 03:45 - 2016-02-15 15:29 - 00000000 ____D C:\Users\Все пользователи\DQhPtcglpu
2016-10-29 03:45 - 2016-02-15 15:29 - 00000000 ____D C:\ProgramData\ICkXdgI
2016-10-29 03:45 - 2016-02-15 15:29 - 00000000 ____D C:\ProgramData\DQhPtcglpu
2016-10-29 03:45 - 2016-02-14 12:19 - 00000000 ____D C:\Users\Все пользователи\IFHFfHZYS
2016-10-29 03:45 - 2016-02-14 12:19 - 00000000 ____D C:\ProgramData\IFHFfHZYS
2016-10-29 03:45 - 2016-02-13 20:01 - 00000000 ____D C:\Users\Все пользователи\JBPPGkiHs
2016-10-29 03:45 - 2016-02-13 20:01 - 00000000 ____D C:\Users\Все пользователи\iIltvI
2016-10-29 03:45 - 2016-02-13 20:01 - 00000000 ____D C:\Users\Все пользователи\bmgPqAAACl
2016-10-29 03:45 - 2016-02-13 20:01 - 00000000 ____D C:\ProgramData\JBPPGkiHs
2016-10-29 03:45 - 2016-02-13 20:01 - 00000000 ____D C:\ProgramData\iIltvI
2016-10-29 03:45 - 2016-02-13 20:01 - 00000000 ____D C:\ProgramData\bmgPqAAACl
2016-10-29 03:45 - 2016-02-11 16:53 - 00000000 ____D C:\Users\Все пользователи\DUajyysuWQ
2016-10-29 03:45 - 2016-02-11 16:53 - 00000000 ____D C:\ProgramData\DUajyysuWQ
2016-10-29 03:45 - 2016-02-11 14:14 - 00000000 ____D C:\Users\Все пользователи\hIOyUR
2016-10-29 03:45 - 2016-02-11 14:14 - 00000000 ____D C:\ProgramData\hIOyUR
2016-10-29 03:45 - 2016-02-09 21:37 - 00000000 ____D C:\Users\Все пользователи\bDjKxIKCq
2016-10-29 03:45 - 2016-02-09 21:37 - 00000000 ____D C:\ProgramData\bDjKxIKCq
2016-10-29 03:45 - 2016-02-07 14:19 - 00000000 ____D C:\Users\Все пользователи\HggZNO
2016-10-29 03:45 - 2016-02-07 14:19 - 00000000 ____D C:\ProgramData\HggZNO
2016-10-29 03:45 - 2016-02-06 22:21 - 00000000 ____D C:\Users\Все пользователи\JnvDimCwce
2016-10-29 03:45 - 2016-02-06 22:21 - 00000000 ____D C:\Users\Все пользователи\GpeGywuLO
2016-10-29 03:45 - 2016-02-06 22:21 - 00000000 ____D C:\ProgramData\JnvDimCwce
2016-10-29 03:45 - 2016-02-06 22:21 - 00000000 ____D C:\ProgramData\GpeGywuLO
2016-10-29 03:45 - 2016-02-06 18:21 - 00000000 ____D C:\Users\Все пользователи\AOGXTGoM
2016-10-29 03:45 - 2016-02-06 18:21 - 00000000 ____D C:\ProgramData\AOGXTGoM
2016-10-29 03:45 - 2016-02-03 21:02 - 00000000 ____D C:\Users\Все пользователи\eodEIj
2016-10-29 03:45 - 2016-02-03 21:02 - 00000000 ____D C:\Users\Все пользователи\EmbcSK
2016-10-29 03:45 - 2016-02-03 21:02 - 00000000 ____D C:\Users\Все пользователи\bgwEkRMcds
2016-10-29 03:45 - 2016-02-03 21:02 - 00000000 ____D C:\ProgramData\eodEIj
2016-10-29 03:45 - 2016-02-03 21:02 - 00000000 ____D C:\ProgramData\EmbcSK
2016-10-29 03:45 - 2016-02-03 21:02 - 00000000 ____D C:\ProgramData\bgwEkRMcds
2016-10-29 02:58 - 2016-08-13 21:30 - 00000000 ____D C:\Program Files\TeamViewer
2016-10-28 17:45 - 2016-02-03 22:07 - 00002378 _____ C:\Windows\system32\findit.xml
2016-10-28 17:45 - 2015-11-18 16:44 - 00002321 _____ C:\Users\Default\Desktop\Yandex.lnk
2016-10-28 17:45 - 2015-11-18 16:44 - 00002321 _____ C:\Users\Default User\Desktop\Yandex.lnk
2016-10-26 19:32 - 2013-08-28 22:41 - 00796352 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2016-10-26 19:32 - 2013-08-28 22:41 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2016-10-26 19:31 - 2013-08-28 22:41 - 00000000 ____D C:\Windows\system32\Macromed
2016-10-25 23:02 - 2015-04-07 19:37 - 00000000 ____D C:\Users\Все пользователи\Skype
2016-10-25 23:02 - 2015-04-07 19:37 - 00000000 ____D C:\ProgramData\Skype
2016-10-25 23:01 - 2016-08-12 22:33 - 00000000 ___RD C:\Program Files\Skype
2016-10-23 18:54 - 2016-08-14 22:41 - 00000000 ____D C:\Users\444\AppData\Local\Joxi
2016-10-22 02:48 - 2016-08-14 22:41 - 00000000 ____D C:\Program Files\Joxi
2016-10-20 16:15 - 2013-08-20 13:42 - 00000000 ____D C:\Users\444\AppData\Roaming\AIMP
2016-10-11 21:08 - 2015-03-30 20:30 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2016-10-09 17:27 - 2011-04-12 04:46 - 00684144 _____ C:\Windows\system32\perfh019.dat
2016-10-09 17:27 - 2011-04-12 04:46 - 00132680 _____ C:\Windows\system32\perfc019.dat
2016-10-09 17:27 - 2010-11-21 03:01 - 01533604 _____ C:\Windows\system32\PerfStringBackup.INI
2016-10-09 17:27 - 2009-07-14 08:37 - 00000000 ____D C:\Windows\inf
2016-10-08 20:42 - 2016-08-13 21:30 - 00000000 ____D C:\Users\444\AppData\Roaming\TeamViewer
2016-10-06 22:09 - 2016-07-21 23:12 - 00000000 __SHD C:\Users\Все пользователи\360Quarant
2016-10-06 22:09 - 2016-07-21 23:12 - 00000000 __SHD C:\ProgramData\360Quarant
2016-10-06 22:09 - 2016-07-21 23:12 - 00000000 __SHD C:\$360Section
2016-10-04 02:59 - 2016-08-16 19:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
2016-10-04 02:58 - 2016-09-11 01:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SSmaker

==================== Files in the root of some directories =======

2014-06-12 21:22 - 2014-06-12 21:22 - 0000160 _____ () C:\Users\444\AppData\Roaming\addDefaultValueForDevicePathKey.reg
2015-11-18 16:40 - 2016-01-13 11:31 - 0004611 _____ () C:\Users\444\AppData\Roaming\dj.log
2014-04-08 20:17 - 2014-04-08 20:17 - 0000000 _____ () C:\Users\444\AppData\Roaming\PDFConverterApp
2013-10-19 01:25 - 2013-10-19 01:24 - 0030894 _____ () C:\Users\444\AppData\Roaming\speedanalysis.ico
2015-03-18 22:43 - 2015-03-18 22:43 - 0007605 _____ () C:\Users\444\AppData\Local\Resmon.ResmonCfg
2016-02-03 22:08 - 2016-02-03 22:08 - 0041472 _____ () C:\Users\444\AppData\Local\tandrill.dat
2016-02-03 22:08 - 2016-02-03 22:08 - 0000187 _____ () C:\Users\444\AppData\Local\tandrill.exe.config
2016-09-02 19:30 - 2016-09-02 19:30 - 0000781 _____ () C:\Users\444\AppData\Local\uBar.lnk
2016-08-23 22:54 - 2016-08-23 22:54 - 0000003 _____ () C:\Users\444\AppData\Local\updater.log
2016-08-23 22:54 - 2016-08-23 22:54 - 0000412 _____ () C:\Users\444\AppData\Local\UserProducts.xml
2016-05-26 20:33 - 2016-05-26 20:33 - 0000000 _____ () C:\Users\444\AppData\Local\{0A0C5799-075B-462F-B0BC-6F9262C8417D}
2016-03-20 14:42 - 2016-03-20 14:42 - 0000000 _____ () C:\Users\444\AppData\Local\{8B351C83-ED39-4985-97B6-EDC4A4B5FDA0}
2016-05-02 05:25 - 2016-05-02 05:25 - 0000000 _____ () C:\Users\444\AppData\Local\{9C75403C-3930-45EB-AD67-12B9A6667F36}
2016-07-26 14:49 - 2016-07-26 14:49 - 0000000 _____ () C:\Users\444\AppData\Local\{BD5585E7-8B25-4DFB-A728-0623FD26AFB5}

Some files in TEMP:
====================
C:\Users\444\AppData\Local\Temp\8jnkkffr.dll
C:\Users\444\AppData\Local\Temp\amigo_setup.exe
C:\Users\444\AppData\Local\Temp\libeay32.dll
C:\Users\444\AppData\Local\Temp\msvcr120.dll
C:\Users\444\AppData\Local\Temp\Setup-yabrowser.exe
C:\Users\444\AppData\Local\Temp\sqlite3.dll
C:\Users\444\AppData\Local\Temp\yupdate-exec-yabrowser.exe


==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

==================== BCD ================================

Windows Boot Manager
--------------------
identifier              {bootmgr}
device                  partition=\Device\HarddiskVolume1
description             Windows Boot Manager
locale                  ru-RU
inherit                 {globalsettings}
default                 {current}
resumeobject            {14f520a2-0973-11e3-b994-a35c5f7f2039}
displayorder            {current}
toolsdisplayorder       {memdiag}
timeout                 30

Windows Boot Loader
-------------------
identifier              {current}
device                  partition=C:
path                    \Windows\system32\winload.exe
description             Windows 7
locale                  ru-RU
inherit                 {bootloadersettings}
recoverysequence        {14f520a4-0973-11e3-b994-a35c5f7f2039}
recoveryenabled         Yes
osdevice                partition=C:
systemroot              \Windows
resumeobject            {14f520a2-0973-11e3-b994-a35c5f7f2039}
nx                      OptIn

Windows Boot Loader
-------------------
identifier              {14f520a4-0973-11e3-b994-a35c5f7f2039}
device                  ramdisk=[C:]\Recovery\14f520a4-0973-11e3-b994-a35c5f7f2039\Winre.wim,{14f520a5-0973-11e3-b994-a35c5f7f2039}
path                    \windows\system32\winload.exe
description             Windows Recovery Environment
inherit                 {bootloadersettings}
osdevice                ramdisk=[C:]\Recovery\14f520a4-0973-11e3-b994-a35c5f7f2039\Winre.wim,{14f520a5-0973-11e3-b994-a35c5f7f2039}
systemroot              \windows
nx                      OptIn
winpe                   Yes

Resume from Hibernate
---------------------
identifier              {14f520a2-0973-11e3-b994-a35c5f7f2039}
device                  partition=C:
path                    \Windows\system32\winresume.exe
description             Windows Resume Application
locale                  ru-RU
inherit                 {resumeloadersettings}
filedevice              partition=C:
filepath                \hiberfil.sys
pae                     Yes
debugoptionenabled      No

Windows Memory Tester
---------------------
identifier              {memdiag}
device                  partition=\Device\HarddiskVolume1
path                    \boot\memtest.exe
description             ??????????? ??????
locale                  ru-RU
inherit                 {globalsettings}
badmemoryaccess         Yes

EMS Settings
------------
identifier              {emssettings}
bootems                 Yes

Debugger Settings
-----------------
identifier              {dbgsettings}
debugtype               Serial
debugport               1
baudrate                115200

RAM Defects
-----------
identifier              {badmemory}

Global Settings
---------------
identifier              {globalsettings}
inherit                 {dbgsettings}
                        {emssettings}
                        {badmemory}

Boot Loader Settings
--------------------
identifier              {bootloadersettings}
inherit                 {globalsettings}
                        {hypervisorsettings}

Hypervisor Settings
-------------------
identifier              {hypervisorsettings}
hypervisordebugtype     Serial
hypervisordebugport     1
hypervisorbaudrate      115200

Resume Loader Settings
----------------------
identifier              {resumeloadersettings}
inherit                 {globalsettings}

Device options
--------------
identifier              {14f520a5-0973-11e3-b994-a35c5f7f2039}
description             Ramdisk Options
ramdisksdidevice        partition=C:
ramdisksdipath          \Recovery\14f520a4-0973-11e3-b994-a35c5f7f2039\boot.sdi



LastRegBack: 2016-08-01 23:06

==================== End of FRST.txt ============================