HKU\S-1-5-21-1757981266-920026266-682003330-500\...\MountPoints2: {05587cc2-89e1-11e5-bca4-f54023c042b5} - G:\Windows\AutoRun.exe
HKU\S-1-5-21-1757981266-920026266-682003330-500\...\MountPoints2: {14145242-e1ba-11e4-8688-ef7f36282212} - G:\Windows\AutoRun.exe
HKU\S-1-5-21-1757981266-920026266-682003330-500\...\MountPoints2: {3efca742-e1b6-11e4-9c88-e4ce3993b5ea} - G:\Windows\AutoRun.exe
HKU\S-1-5-21-1757981266-920026266-682003330-500\...\MountPoints2: {9ac33242-e1ae-11e4-bf60-d6e9f8e832cf} - G:\Windows\AutoRun.exe
HKU\S-1-5-21-1757981266-920026266-682003330-500\...\MountPoints2: {cc3b1d42-0285-11e5-b2a4-d67a4e7b3c7f} - G:\Windows\AutoRun.exe
HKU\S-1-5-21-1757981266-920026266-682003330-500\...\MountPoints2: {db8e8b42-56fb-11e5-a4e0-af1c615e24e4} - G:\Windows\AutoRun.exe
HKU\S-1-5-21-1757981266-920026266-682003330-500\...\MountPoints2: {f47dc342-ba84-11e5-980e-8ed95bb815fc} - G:\Windows\AutoRun.exe
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-1757981266-920026266-682003330-500\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://securityresponse.symantec.com/avcenter/fix_homepage
SearchScopes: HKLM -> DefaultScope {E88E0043-C9D4-4E33-8555-FEE4F5B63060} URL = hxxp://go.mail.ru/search?q={searchTerms}&utf8in=1&fr=ietb
SearchScopes: HKLM -> {E88E0043-C9D4-4e33-8555-FEE4F5B63060} URL = hxxp://go.mail.ru/search?q={searchTerms}&utf8in=1&fr=ietb
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1757981266-920026266-682003330-500 -> DefaultScope {E88E0043-C9D4-4E33-8555-FEE4F5B63060} URL = hxxp://go.mail.ru/search?q={searchTerms}&utf8in=1&fr=ietb
SearchScopes: HKU\S-1-5-21-1757981266-920026266-682003330-500 -> {E88E0043-C9D4-4E33-8555-FEE4F5B63060} URL = hxxp://go.mail.ru/search?q={searchTerms}&utf8in=1&fr=ietb
SearchScopes: HKU\S-1-5-21-1757981266-920026266-682003330-500 -> {F4137D40-259A-4FB3-B780-F8C39B303C41} URL = 
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> No File
BHO: WebMoneyAdvisorBHO -> {E7D2CB77-6E2D-4C1F-B485-D50506B9FA6B} -> No File
Toolbar: HKLM - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -  No File
Toolbar: HKLM - WebMoney Advisor - {405DFEAE-1D2F-4649-BE08-C92313C3E1CE} -  No File
Toolbar: HKU\.DEFAULT -> No Name - {91397D20-1446-11D4-8AF4-0040CA1127B6} -  No File
Toolbar: HKU\S-1-5-21-1757981266-920026266-682003330-500 -> WebMoney Advisor - {405DFEAE-1D2F-4649-BE08-C92313C3E1CE} -  No File
FF Extension: No Name - C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\uohui1o3.default\Extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D} [2016-01-16] [not signed]
CHR HomePage: Default -> mysearch.avg.com/?rvt=1
CHR StartupUrls: Default -> "hxxp://mail.ru/cnt/10445?gp=811013" 
CHR NewTab: Default -> "chrome-extension://oelpkepjlgmehajehfeicfbjdiobdkfj/visual-bookmarks.html"
CHR DefaultSearchURL: Default -> hxxp://go.mail.ru/distib/ep/?q={searchTerms}&product_id=%7BE2A9C128-4EF9-4CB6-87D0-9AB612F0CDF4%7D&gp=811014
CHR DefaultSearchKeyword: Default -> mail.ru
CHR DefaultSuggestURL: Default -> hxxp://suggests.go.mail.ru/ff3?q={searchTerms}
CHR Extension: (Mail.Ru) - C:\Documents and Settings\Admin\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bgcifljfapbhgiehkjlckfjmgeojijcb [2016-06-04]
CHR Extension: (YouTube) - C:\Documents and Settings\Admin\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-25]
CHR Extension: (Google Sheets) - C:\Documents and Settings\Admin\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-05-08]
CHR Extension: (No Name) - C:\Documents and Settings\Admin\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\kneggodalbcmgdkkfhbhbicbbahnacjb [2016-06-04]
CHR Extension: (Chrome Web Store Payments) - C:\Documents and Settings\Admin\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-09-03]
CHR Extension: (Визуальные Закладки Mail.Ru) - C:\Documents and Settings\Admin\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\oelpkepjlgmehajehfeicfbjdiobdkfj [2016-06-04]
CHR HKLM\...\Chrome\Extension: [bgcifljfapbhgiehkjlckfjmgeojijcb] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [ehfjihahbphdpljpiadbkmgmhnfehhgi] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [oelpkepjlgmehajehfeicfbjdiobdkfj] - hxxps://clients2.google.com/service/update2/crx
R1 avgtp; C:\windows\system32\drivers\avgtpx86.sys [27496 2012-09-09] (AVG Technologies)
U3 a0m74btc; C:\windows\system32\Drivers\a0m74btc.sys [0 ] (Microsoft Corporation) <==== ATTENTION (zero byte File/Folder)
U3 a8zn9jr7; C:\windows\system32\Drivers\a8zn9jr7.sys [0 ] (Microsoft Corporation) <==== ATTENTION (zero byte File/Folder)
U3 DfSdkS; no ImagePath
S1 mnmdd; no ImagePath
U1 WS2IFSL; no ImagePath
U3 aq3fzkhn; no ImagePath
IE restricted site: HKU\S-1-5-21-1757981266-920026266-682003330-500\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-1757981266-920026266-682003330-500\...\008k.com -> 008k.com
IE restricted site: HKU\S-1-5-21-1757981266-920026266-682003330-500\...\00hq.com -> 00hq.com
IE restricted site: HKU\S-1-5-21-1757981266-920026266-682003330-500\...\0190-dialers.com -> 0190-dialers.com
IE restricted site: HKU\S-1-5-21-1757981266-920026266-682003330-500\...\01i.info -> 01i.info
IE restricted site: HKU\S-1-5-21-1757981266-920026266-682003330-500\...\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com
IE restricted site: HKU\S-1-5-21-1757981266-920026266-682003330-500\...\05p.com -> 05p.com
IE restricted site: HKU\S-1-5-21-1757981266-920026266-682003330-500\...\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com
IE restricted site: HKU\S-1-5-21-1757981266-920026266-682003330-500\...\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com
IE restricted site: HKU\S-1-5-21-1757981266-920026266-682003330-500\...\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com
IE restricted site: HKU\S-1-5-21-1757981266-920026266-682003330-500\...\0calories.net -> 0calories.net
IE restricted site: HKU\S-1-5-21-1757981266-920026266-682003330-500\...\0cj.net -> 0cj.net
IE restricted site: HKU\S-1-5-21-1757981266-920026266-682003330-500\...\0scan.com -> 0scan.com
IE restricted site: HKU\S-1-5-21-1757981266-920026266-682003330-500\...\1-britney-spears-nude.com -> 1-britney-spears-nude.com
IE restricted site: HKU\S-1-5-21-1757981266-920026266-682003330-500\...\1-domains-registrations.com -> 1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-1757981266-920026266-682003330-500\...\1-se.com -> 1-se.com
IE restricted site: HKU\S-1-5-21-1757981266-920026266-682003330-500\...\1001movie.com -> 1001movie.com
IE restricted site: HKU\S-1-5-21-1757981266-920026266-682003330-500\...\1001night.biz -> 1001night.biz
IE restricted site: HKU\S-1-5-21-1757981266-920026266-682003330-500\...\100gal.net -> 100gal.net
IE restricted site: HKU\S-1-5-21-1757981266-920026266-682003330-500\...\100sexlinks.com -> 100sexlinks.com
EmptyTemp:
Reboot:

;uVS v3.87.3 [http://dsrt.dyndns.org]
;Target OS: NTv5.1
OFFSGNSAVE

sreg
delref %Sys32%\DRIVERS\AVGTPX86.SYS
areg