;uVS v3.87.3 [http://dsrt.dyndns.org]
;Target OS: NTv6.1
OFFSGNSAVE
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\JKLGFIFAEFEDIFMPCJGMNCIAJGAHAADH\2016.6.4.60768_0\AWA0707OM.PDF
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DAMINLPMKFCDIBGPGFAJLGNAMICJCKKJF%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DPJFKGJLNOCFAKOHEOAPICNKNOGLIPAPD%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTP://LIBUMA.RU/?UTM_SOURCE=STARTPAGE03&UTM_CONTENT=6A71819910EF952598DBDA9FE4C13C2B
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DMFMJPFOGGIKOLKFILOFBPGCNHDCGAHIB%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DPFJGIBHMCGNCMJHDODPAOLFBJPJJAJAL%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DPGAIDLFGJKMEENDHKNAFAHPPLLBNIEJM%26INSTALLSOURCE%3DONDEMAND%26UC
zoo %SystemDrive%\PROGRAM FILES\TCPU60\PROGRAMM\MULTI_PASSWORD_RECOVERY\BLOCK_READER.SYS
delref %SystemDrive%\PROGRAM FILES\TCPU60\PROGRAMM\MULTI_PASSWORD_RECOVERY\BLOCK_READER.SYS
deltmp
delnfr
restart

CrackTool.KMSPico, C:\Program Files\KMSnano\KMSELDI.exe, , [46efcf30f9a069cd751a8822d72a5ea2], 
PUP.Optional.PCPerformer, C:\Windows\System32\roboot64.exe, , [e550e11e405937ff7b6646dbe21e926e],

HKU\S-1-5-21-3018718938-969226012-3389681019-1000\...\MountPoints2: {ce6d2219-2a8e-11e3-a497-240a6429671c} - G:\Autorun.exe
GroupPolicyUsers\S-1-5-21-3018718938-969226012-3389681019-1528\User: Restriction <======= ATTENTION
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer.dll [2015-11-12] (IObit)
BHO-x32: No Name -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> No File
BHO-x32: No Name -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> No File
Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKU\S-1-5-21-3018718938-969226012-3389681019-1000 -> No Name - {91397D20-1446-11D4-8AF4-0040CA1127B6} -  No File
FF user.js: detected! => C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\user.js [2016-06-20]
CHR Extension: (No Name) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\jklgfifaefedifmpcjgmnciajgahaadh [2016-06-20]
OPR StartupUrls: "hxxp://www.yandex.ru/?win=214&clid=2035188","hxxp://libuma.ru/?utm_source=startpage03&utm_content=6a71819910ef952598dbda9fe4c13c2b"
OPR Session Restore: -> is enabled.
S2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2945312 2016-01-14] (IObit)
R2 Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [239184 2013-01-28] ()
Task: {28BFCC6B-EAFC-4914-A4E9-0797EA8F6272} - \{EF7A9B37-CDC5-4C7D-B68E-DFCCCEC840AD} -> No File <==== ATTENTION
Task: {74396476-C88E-4F4D-85F9-D9F1A992C157} - \{FD862DC6-9650-4636-9E45-A83323E68717} -> No File <==== ATTENTION
Task: {8429FE40-9236-4D08-A564-28BF4B3822E7} - \{5A07C0C9-E477-4527-A14F-80ABCF582773} -> No File <==== ATTENTION
Task: {932ACDA1-91B1-4852-8448-748A002F6744} - \{8FC6685B-1B81-4D1B-89C6-204EC247DAE7} -> No File <==== ATTENTION
Task: {B424EDD8-E1B6-446F-B37A-B28C20CBF699} - \{6C06BA12-8062-43D9-ABD1-0E8CDD0F8CE8} -> No File <==== ATTENTION
Task: {BF67DBB2-F4B4-4B16-93FE-FBE94CBD11F5} - \{7695EC08-059A-44C5-BC96-970314CEFCB6} -> No File <==== ATTENTION
Task: {DA18238F-9C23-474C-B7CF-292CE52F3B66} - \{8E588D02-4AA5-4310-A8DB-FE0C4AD81D9D} -> No File <==== ATTENTION
EmptyTemp:
Reboot: