xtbl и ytbl

15 сентября, 2015

Помогите мне расшифровать файлы с расширением xtbl и ytbl.

CollectionLog-2015.09.16-01.36.zip

16 сентября, 2015

Скачайте Farbar Recovery Scan Tool

и сохраните на Рабочем столе.

Примечание: необходимо выбрать версию, совместимую с Вашей операционной системой. Если Вы не уверены, какая версия подойдет для Вашей системы, скачайте обе и попробуйте запустить. Только одна из них запустится на Вашей системе.

1. Запустите программу двойным щелчком. Когда программа запустится, нажмите Yes для соглашения с предупреждением.

2. Убедитесь, что в окне Optional Scan отмечены "List BCD" и "Driver MD5".

3. Нажмите кнопку Scan.

4. После окончания сканирования будет создан отчет (FRST.txt) в той же папке, откуда была запущена программа. Пожалуйста, прикрепите отчет в следующем сообщении.

5. Если программа была запущена в первый раз, также будет создан отчет (Addition.txt). Пожалуйста, прикрепите его в следующем сообщении.

16 сентября, 2015

Все сделала как Вы сказали.

Отчёты:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:15-09-2015

Ran by Людмила (administrator) on ЛЮДМИЛА-ПК (16-09-2015 13:35:26)

Running from C:\Users\Людмила\Desktop

Loaded Profiles: Людмила (Available Profiles: Людмила)

Platform: Microsoft Windows 7 Максимальная Service Pack 1 (X86) Language: Русский (Россия)

Internet Explorer Version 11 (Default browser: Yandex Browser)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe

(QIHU 360 SOFTWARE CO. LIMITED) C:\Program Files\360\Total Security\safemon\QHActiveDefense.exe

(AMD) C:\Windows\System32\atieclxx.exe

(ASUS) C:\Program Files\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe

(ASUS) C:\Program Files\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe

(Qihu Software Co. Limited) C:\Program Files\360\Total Security\safemon\QHWatchdog.exe

(ASUS) C:\Program Files\Common Files\InstantOn\InsOnSrv.exe

(ASUS) C:\Program Files\ASUS\SmartLogon\sensorsrv.exe

(ASUS) C:\Program Files\ASUS\Splendid\ACMON.exe

(ASUS) C:\Program Files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe

(CANON INC.) C:\Windows\System32\CAPRPCSK.EXE

(ASUS) C:\Program Files\P4G\BatteryLife.exe

(CANON INC.) C:\Windows\System32\spool\drivers\w32x86\3\CAPPSWK.EXE

(ASUSTeK) C:\Windows\System32\ACEngSvr.exe

(HP) C:\Windows\System32\HPSIsvc.exe

(ASUS) C:\Program Files\ASUS\ATK Package\ATK Hotkey\HControl.exe

() C:\ProgramData\DatacardService\HWDeviceService.exe

(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe

(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE

(ASUS) C:\Program Files\Common Files\InstantOn\InsOnWMI.exe

(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Alcor Micro Corp.) C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe

(ASUS) C:\Program Files\ASUS\Wireless Console 3\wcourier.exe

(ASUS) C:\Program Files\ASUS\ATK Package\ATK Media\DMedia.exe

(ASUS) C:\Program Files\ASUS\ATK Package\ATK Hotkey\HControlUser.exe

(Zbshareware Lab) C:\Program Files\USB Disk Security\USBGuard.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(ASUS) C:\Program Files\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe

(ASUS) C:\Program Files\ASUS\ATK Package\ATK Hotkey\WDC.exe

(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe

(LLC Mail.Ru) C:\Users\Людмила\AppData\Local\Mail.Ru\GameCenter\GameCenter@Mail.Ru.exe

(Ghisler Software GmbH) C:\Program Files\Total Commander\Totalcmd.exe

(CANON INC.) C:\Windows\System32\spool\drivers\w32x86\3\CAPPSWK.EXE

(YANDEX LLC) C:\Users\Людмила\AppData\Local\Yandex\YandexBrowser\Application\browser.exe

() C:\Users\Людмила\AppData\Local\Yandex\YandexBrowser\Application\43.0.2357.2877\crash_service.exe

(YANDEX LLC) C:\Users\Людмила\AppData\Local\Yandex\YandexBrowser\Application\browser.exe

(Intel Corporation) C:\Program Files\Intel\Intel® Management Engine Components\LMS\LMS.exe

(Intel Corporation) C:\Program Files\Intel\Intel® Management Engine Components\UNS\UNS.exe

(YANDEX LLC) C:\Users\Людмила\AppData\Local\Yandex\YandexBrowser\Application\browser.exe

(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe

() C:\Program Files\MegaFon Modem\MegaFon Modem.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [synTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2213160 2011-03-04] (Synaptics Incorporated)

HKLM\...\Run: [AmIcoSinglun] => C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe [258048 2011-03-18] (Alcor Micro Corp.)

HKLM\...\Run: [synAsusAcpi] => C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe [83240 2011-03-04] (Synaptics Incorporated)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [11430504 2011-10-17] (Realtek Semiconductor)

HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe [1571432 2011-10-14] (Realtek Semiconductor)

HKLM\...\Run: [sonicMasterTray] => C:\Program Files\ASUS\Sonic Focus\SonicFocusTray.exe [984400 2010-07-09] (Virage Logic Corporation / Sonic Focus)

HKLM\...\Run: [Wireless Console 3] => C:\Program Files\ASUS\Wireless Console 3\wcourier.exe [2317312 2011-09-13] (ASUS)

HKLM\...\Run: [Easy-PrintToolBox] => C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE [409600 2004-01-14] (CANON INC.)

HKLM\...\Run: [ATKOSD2] => C:\Program Files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [5716608 2011-07-21] (ASUS)

HKLM\...\Run: [ATKMEDIA] => C:\Program Files\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-10-07] (ASUS)

HKLM\...\Run: [HControlUser] => C:\Program Files\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)

HKLM\...\Run: [CAPON] => C:\Windows\system32\Spool\Drivers\w32x86\3\CAPONN.EXE [28288 2007-03-23] (CANON INC.)

HKLM\...\Run: [QHSafeTray] => C:\Program Files\360\Total Security\safemon\QHSafeTray.exe [1287800 2015-09-06] (QIHU 360 SOFTWARE CO. LIMITED)

HKLM\...\Run: [uSB Security] => C:\Program Files\USB Disk Security\USBGuard.exe [623520 2011-02-01] (Zbshareware Lab)

HKU\S-1-5-21-887322933-3475441419-2763790667-1000\...\Run: [ab26f79e1bfccfbdcc131b54aac888705b660e2e] => iexplore.exe

HKU\S-1-5-21-887322933-3475441419-2763790667-1000\...\Run: [AIMP3] => C:\Program Files\AIMP3\AIMP3.exe [1480192 2013-03-07] (AIMP DevTeam)

HKU\S-1-5-21-887322933-3475441419-2763790667-1000\...\Run: [GameCenterMailRu] => C:\Users\Людмила\AppData\Local\Mail.Ru\GameCenter\GameCenter@Mail.Ru.exe [4896720 2015-09-07] (LLC Mail.Ru)

HKU\S-1-5-18\...\RunOnce: [sPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2014-11-09] (Microsoft Corporation)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FancyStart daemon.lnk [2012-09-01]

ShortcutTarget: FancyStart daemon.lnk -> C:\Windows\Installer\{C944B4C5-1C4D-4D95-8AC0-7CEF13914131}\_77B5857C27147149171BE7.exe ()

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Total Commander.lnk [2012-10-17]

ShortcutTarget: Total Commander.lnk -> C:\Program Files\Total Commander\Totalcmd.exe (Ghisler Software GmbH)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Окно состояния Canon LBP-810.LNK [2013-02-05]

ShortcutTarget: Окно состояния Canon LBP-810.LNK -> C:\Windows\System32\spool\drivers\w32x86\3\CAPPSWK.EXE (CANON INC.)

CHR HKU\S-1-5-21-887322933-3475441419-2763790667-1000\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\..\Interfaces\{3C1B3DA7-2B19-4DF2-923D-6DCCFE0C7ED6}: [NameServer] 10.163.182.8 10.163.182.11

Tcpip\..\Interfaces\{89CEF61E-B43C-4BD2-8811-04CA414228D5}: [NameServer] 8.8.8.8,8.8.4.4

Tcpip\..\Interfaces\{8F579E4E-8A9E-4E84-8D36-4E47F1557090}: [NameServer] 10.163.182.8 10.163.182.11

Tcpip\..\Interfaces\{A3E02510-4A9A-48AD-B4B8-AD2E5D459C65}: [NameServer] 10.163.182.9 10.163.182.8

Tcpip\..\Interfaces\{B098C452-436F-401E-9503-3CCFC8BEB7C2}: [NameServer] 10.163.182.11 10.163.182.10

Tcpip\..\Interfaces\{D0CB78FC-C9BB-4EFA-B9F6-4B6ABDE3D57B}: [NameServer] 10.163.182.9 10.163.182.10

Tcpip\..\Interfaces\{E211947E-2780-46EA-BFEF-1507402FE527}: [NameServer] 10.163.182.9 10.163.182.10

Tcpip\..\Interfaces\{E70286F9-B202-4D9C-9308-AA534078CF02}: [NameServer] 8.8.8.8,8.8.4.4

Tcpip\..\Interfaces\{E70286F9-B202-4D9C-9308-AA534078CF02}: [DhcpNameServer] 192.168.1.1

Tcpip\..\Interfaces\{EC0E473F-AB4C-47E9-AE5B-1F14DCD816DA}: [NameServer] 10.163.182.9 10.163.182.10

Internet Explorer:

==================

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION

HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

HKU\S-1-5-21-887322933-3475441419-2763790667-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://webalta.ru/search

HKU\S-1-5-21-887322933-3475441419-2763790667-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://ru.msn.com/?ocid=iehp

HKU\S-1-5-21-887322933-3475441419-2763790667-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://webalta.ru/search

HKU\S-1-5-21-887322933-3475441419-2763790667-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://webalta.ru/search

HKU\S-1-5-21-887322933-3475441419-2763790667-1000\Software\Microsoft\Internet Explorer\Main,Start Page Restore = hxxp://www.yandex.ru/?win=42&clid=1872363

HKU\S-1-5-21-887322933-3475441419-2763790667-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.mail.ru/cnt/7824

SearchScopes: HKU\S-1-5-21-887322933-3475441419-2763790667-1000 -> DefaultScope {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?utf8in=1&fr=ietb&q={SearchTerms}

SearchScopes: HKU\S-1-5-21-887322933-3475441419-2763790667-1000 -> Moikrug URL = hxxp://moikrug.ru/persons/?clid=904347&charset=utf-8&keywords={searchTerms}&submitted=1

SearchScopes: HKU\S-1-5-21-887322933-3475441419-2763790667-1000 -> Yandex URL = hxxp://isearch.avg.com/search?cid={34CB7626-CE62-447D-9168-D5114838043F}&mid=54b513082a8c47d0b54a73587527a168-1f4854018150a663304a3108a4ed6bf43cf8aa63&lang=en&ds=AVG&pr=pr&d=&v=&sap=dsp&q={searchTerms}

SearchScopes: HKU\S-1-5-21-887322933-3475441419-2763790667-1000 -> yandex.ru-123923 URL = hxxp://go.mail.ru/search?utf8in=1&fr=ietb&q={SearchTerms}

SearchScopes: HKU\S-1-5-21-887322933-3475441419-2763790667-1000 -> {0388404D-6072-4CEB-B521-8F090FEAEE57} URL = hxxp://klit.startnow.com/s/?q={searchTerms}&src=defsearch&provider=&provider_name=yahoo&provider_code=&partner_id=693&product_id=741&affiliate_id=&channel=&toolbar_id=200&toolbar_version=2.4.0&install_country=RU&install_date=20121121&user_guid=FBD58D93604A4F25BEBAFC8CBFDFFF47&machine_id=fabe28d924cdd12ff3c18bd6a9247d87&browser=IE&os=win&os_version=6.1-x86-SP0&iesrc={referrer:source}

SearchScopes: HKU\S-1-5-21-887322933-3475441419-2763790667-1000 -> {61EB20A4-D4D5-4276-A2C9-DCCE8CE9F633} URL = hxxp://webalta.ru/search?q={searchTerms}&from=IE

SearchScopes: HKU\S-1-5-21-887322933-3475441419-2763790667-1000 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxps://mysearch.avg.com/search?cid={2C403796-E640-44EB-AC80-69496C249F22}&mid=54b513082a8c47d0b54a73587527a168-1f4854018150a663304a3108a4ed6bf43cf8aa63&lang=ru&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-11-22 09:35:10&v=4.0.0.19&pid=wtu&sg=&sap=dsp&q={searchTerms}

SearchScopes: HKU\S-1-5-21-887322933-3475441419-2763790667-1000 -> {EDCBE16C-384F-43FE-AD1F-006E94E2D855} URL = hxxp://nova.rambler.ru/search?query={searchTerms}&utm_source=r40&utm_medium=distribution&utm_content=e09&utm_campaign=3w28

SearchScopes: HKU\S-1-5-21-887322933-3475441419-2763790667-1000 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?utf8in=1&fr=ietb&q={SearchTerms}

BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21] (Adobe Systems Incorporated)

BHO: StartNow Toolbar Helper -> {6E13D095-45C3-4271-9475-F3B48227DD9F} -> C:\Program Files\StartNow Toolbar\Toolbar32.dll [2012-06-22] ()

BHO: No Name -> {8984B388-A5BB-4DF7-B274-77B879E179DB} -> No File

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)

BHO: No Name -> {D5FEC983-01DB-414a-9456-AF95AC9ED7B5} -> No File

BHO: DVDVideoSoft WebPageAdjuster Class -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll [2013-07-25] (DVDVideoSoft Ltd.)

Toolbar: HKLM - Поиск WebAlta - {fe704bf8-384b-44e1-8cf2-8dbeb3637a8a} - C:\Windows\system32\mscoree.dll [2010-11-05] (Microsoft Corporation)

Toolbar: HKLM - Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll [2004-08-26] ()

Toolbar: HKLM - StartNow Toolbar - {5911488E-9D1E-40ec-8CBB-06B231CC153F} - C:\Program Files\StartNow Toolbar\Toolbar32.dll [2012-06-22] ()

Toolbar: HKU\S-1-5-21-887322933-3475441419-2763790667-1000 -> No Name - {09900DE8-1DCA-443F-9243-26FF581438AF} - No File

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

FireFox:

========

FF ProfilePath: C:\Users\Людмила\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default

FF SelectedSearchEngine: Поиск@Mail.Ru

FF Homepage: hxxp://mail.ru/cnt/10445?gp=newcustom3

FF Keyword.URL: hxxp://go.mail.ru/search?fr=fftb&q=

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_246.dll [2014-12-20] ()

FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\PROGRAM FILES\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll [2011-07-19] (Foxit Corporation)

FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll [2012-09-02] (Microsoft Corporation)

FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-08-28] (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-08-28] (Google Inc.)

FF Plugin: @videolan.org/vlc,version=2.0.8 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)

FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)

FF Plugin HKU\S-1-5-21-887322933-3475441419-2763790667-1000: @mail.ru/GameCenter -> C:\Users\Людмила\AppData\Local\Mail.Ru\GameCenter\NPDetector.dll [2015-08-21] (LLC Mail.Ru)

FF SearchPlugin: C:\Users\Людмила\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\searchplugins\rambler.xml [2013-07-11]

FF SearchPlugin: C:\Users\Людмила\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\searchplugins\webalta-search.xml [2012-03-12]

FF SearchPlugin: C:\Users\Людмила\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\searchplugins\yandex.ru-123924.xml [2013-02-17]

FF Extension: Яндекс.Бар - C:\Users\Людмила\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\Extensions\yasearch@yandex.ru [2012-09-30]

FF Extension: Спутник @Mail.Ru - C:\Users\Людмила\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\Extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D} [2013-02-05]

Chrome:

=======

CHR StartupUrls: Default -> "hxxp://www.mail.ru/cnt/7824"

CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\45.0.2454.85\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll => No File

CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\45.0.2454.85\ppGoogleNaClPluginChrome.dll => No File

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\45.0.2454.85\pdf.dll => No File

CHR Plugin: (AVG Internet Security) - C:\Users\Людмила\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.2210_0\plugins/avgnpss.dll => No File

CHR Plugin: (Conduit Chrome Plugin) - C:\Users\Людмила\AppData\Local\Google\Chrome\User Data\Default\Extensions\ikloigadafpfgepigfclhbfehilnljkg\10.11.21.5_0\plugins/ConduitChromeApiPlugin.dll => No File

CHR Plugin: (Conduit Radio Plugin) - C:\Users\Людмила\AppData\Local\Google\Chrome\User Data\Default\Extensions\ikloigadafpfgepigfclhbfehilnljkg\10.11.21.5_0\plugins/np-cwmp.dll => No File

CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll => No File

CHR Plugin: (Windows Activation Technologies) - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)

CHR Profile: C:\Users\Людмила\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Radio W) - C:\Users\Людмила\AppData\Local\Google\Chrome\User Data\Default\Extensions\ikloigadafpfgepigfclhbfehilnljkg [2012-10-21]

CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Людмила\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-09-14]

CHR Extension: (Платежная система Интернет-магазина Chrome) - C:\Users\Людмила\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-23]

CHR HKLM\...\Chrome\Extension: [hcncjpganfocbfoenaemagjjopkkindp] - <no Path\update_url>

CHR HKLM\...\Chrome\Extension: [ikloigadafpfgepigfclhbfehilnljkg] - C:\Users\Людмила\AppData\Local\CRE\ikloigadafpfgepigfclhbfehilnljkg.crx [2012-10-17]

CHR HKLM\...\Chrome\Extension: [jggbjbmnfmipgcanidamjfpechdeekoi] - hxxps://clients2.google.com/service/update2/crx

CHR HKU\S-1-5-21-887322933-3475441419-2763790667-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [ikloigadafpfgepigfclhbfehilnljkg] - C:\Users\Людмила\AppData\Local\CRE\ikloigadafpfgepigfclhbfehilnljkg.crx [2012-10-17]

CHR HKU\S-1-5-21-887322933-3475441419-2763790667-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [incfcgceegpikennjoplhfghaaikdgei] - C:\Users\Людмила\AppData\Roaming\StartNow Toolbar\CR\zcrx.crx [2012-12-21]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 ASLDRService; C:\Program Files\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe [84536 2009-06-15] (ASUS)

R2 ASUS InstantOn; C:\Program Files\Common Files\InstantOn\InsOnSrv.exe [92800 2011-09-08] (ASUS)

R2 ATKGFNEXSrv; C:\Program Files\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe [96896 2009-12-15] (ASUS)

S3 defragsvc; C:\Windows\System32\defragsvc.dll [218624 2009-07-14] (Корпорация Майкрософт)

R2 HWDeviceService.exe; C:\ProgramData\DatacardService\HWDeviceService.exe [271712 2011-03-14] ()

R2 QHActiveDefense; C:\Program Files\360\Total Security\safemon\QHActiveDefense.exe [859768 2015-09-06] (QIHU 360 SOFTWARE CO. LIMITED)

S3 Updater Service for StartNow Toolbar; C:\Program Files\StartNow Toolbar\ToolbarUpdaterService.exe [265952 2012-06-22] ()

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)

S3 WPCSvc; C:\Windows\System32\wpcsvc.dll [10752 2009-07-14] (Корпорация Майкрософт)

S2 Guard.Mail.ru; "C:\Program Files\Mail.Ru\Guard\GuardMailRu.exe" [X]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 360AntiHacker; C:\Windows\System32\Drivers\360AntiHacker.sys [121936 2015-09-06] (360.cn)

R3 360AvFlt; C:\Windows\System32\DRIVERS\360AvFlt.sys [66128 2015-09-06] (360.cn)

R1 360Box; C:\Windows\System32\DRIVERS\360Box.sys [203856 2015-09-06] (360.cn)

R1 360Camera; C:\Windows\System32\Drivers\360Camera.sys [34888 2015-09-06] (360.cn)

R1 360SelfProtection; C:\Windows\System32\drivers\360SelfProtection.sys [178384 2015-09-06] (360????)

S3 4F97BC8E5817E699; C:\Users\1D1D~1\AppData\Local\Temp\20353AFDF2.sys [147400 2015-09-15] ()

S3 AmUStor; C:\Windows\System32\drivers\AmUStor.SYS [46680 2011-03-18] (Alcor Micro, Corp.)

R2 ASMMAP; C:\Program Files\ASUS\ATK Package\ATKGFNEX\ASMMAP.sys [13880 2009-07-02] (ASUS)

R3 asmthub3; C:\Windows\System32\DRIVERS\asmthub3.sys [102376 2011-09-28] (ASMedia Technology Inc)

R3 asmtxhci; C:\Windows\System32\DRIVERS\asmtxhci.sys [311784 2011-09-28] (ASMedia Technology Inc)

R1 ATKWMIACPIIO; C:\Program Files\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi.sys [14464 2011-09-07] (ASUS)

R1 BAPIDRV; C:\Windows\System32\DRIVERS\BAPIDRV.sys [174672 2015-09-06] (360.cn)

R1 EfiMon; C:\Windows\System32\Drivers\Efimon.sys [24296 2015-09-06] (360.cn)

R0 HookPort; C:\Windows\System32\Drivers\Hookport.sys [65872 2015-09-06] (360????)

R3 huawei_cdcacm; C:\Windows\System32\DRIVERS\ew_jucdcacm.sys [90368 2012-09-29] (Huawei Technologies Co., Ltd.)

R3 huawei_ext_ctrl; C:\Windows\System32\DRIVERS\ew_juextctrl.sys [26624 2012-09-29] (Huawei Technologies Co., Ltd.)

R3 huawei_wwanecm; C:\Windows\System32\DRIVERS\ew_juwwanecm.sys [181760 2012-09-29] (Huawei Technologies Co., Ltd.)

S3 hwdatacard; C:\Windows\System32\DRIVERS\ewusbmdm.sys [101632 2008-03-17] (Huawei Technologies Co., Ltd.) [File not signed]

R3 L1C; C:\Windows\System32\DRIVERS\L1C60x86.sys [68208 2011-03-23] (Atheros Communications, Inc.)

R3 MEI; C:\Windows\System32\DRIVERS\HECI.sys [41216 2011-09-22] (Intel Corporation)

R0 mountmgr; C:\Windows\System32\drivers\mountmgr.sys [78784 2015-02-03] (Корпорация Майкрософт)

R1 qutmdserv; C:\Windows\System32\DRIVERS\qutmdrv.sys [292560 2015-09-06] (360.cn)

R1 qutmipc; C:\Windows\system32\drivers\qutmipc.sys [53960 2015-09-06] (360.cn)

S2 RapidPort; C:\Windows\system32\Drivers\CAPLPTN.SYS [22912 2001-04-12] (CANON INC.)

R3 rtsuvc; C:\Windows\System32\DRIVERS\rtsuvc.sys [6333672 2010-12-15] (Realtek Semiconductor Corp.)

S3 ssudserd; C:\Windows\System32\DRIVERS\ssudserd.sys [184192 2014-01-22] (DEVGURU Co., LTD.(www.devguru.co.kr))

R3 uti4nzex; C:\Windows\system32\Drivers\uti4nzex.sys [7168 2015-09-16] () [File not signed]

R0 volmgrx; C:\Windows\System32\drivers\volmgrx.sys [297040 2009-07-14] (Корпорация Майкрософт)

S3 4F97BDB0071C4876; \?\C:\Users\1D1D~1\AppData\Local\Temp\2FFADC49.sys [X]

S3 4F97BDB1E074C3A6; \?\C:\Users\1D1D~1\AppData\Local\Temp\2EB8AA3C.sys [X]

S3 4F97BDB28BA9AA76; \?\C:\Users\1D1D~1\AppData\Local\Temp\FEAB4219.sys [X]

S3 4F97BDB8F2BE7976; \?\C:\Users\1D1D~1\AppData\Local\Temp\122C73B39.sys [X]

S3 massfilter; system32\drivers\massfilter.sys [X]

S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]

S3 tsusbhub; system32\drivers\tsusbhub.sys [X]

S3 VGPU; System32\drivers\rdvgkmd.sys [X]

S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X]

S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X]

S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X]

========================== Drivers MD5 =======================

C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit

C:\Windows\System32\Drivers\360AntiHacker.sys 148925140F53F63C8D1C991806F1E7EC

C:\Windows\System32\DRIVERS\360AvFlt.sys 53C05C1714177E3D1C548753E0691531

C:\Windows\System32\DRIVERS\360Box.sys 0C29455EBB4A8A8EE4E99833447570BA

C:\Windows\System32\Drivers\360Camera.sys 2255330A69644F179D0438666EEF1861

C:\Windows\System32\drivers\360SelfProtection.sys 637E29711905C87A49F4F367F50770B0

C:\Users\1D1D~1\AppData\Local\Temp\20353AFDF2.sys A9BB9571ED1013AC440062E4E45149E0

C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit

C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\adp94xx.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\adpahci.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\adpu320.sys ==> MD5 is legit

C:\Windows\system32\drivers\afd.sys D0B388DA1D111A34366E04EB4A5DD156

C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\djsvs.sys ==> MD5 is legit

C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit

C:\Windows\system32\drivers\amdagp.sys ==> MD5 is legit

C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\amdk8.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\atikmdag.sys FEF6346529B840AE859DE65A0F4773D2

C:\Windows\System32\DRIVERS\atikmpag.sys 0E245C8BE29BAF0084B95C4D16542A79

C:\Windows\system32\DRIVERS\amdppm.sys ==> MD5 is legit

C:\Windows\system32\drivers\amdsata.sys D320BF87125326F996D4904FE24300FC

C:\Windows\system32\DRIVERS\amdsbs.sys ==> MD5 is legit

C:\Windows\System32\drivers\amdxata.sys 46387FB17B086D16DEA267D5BE23A2F2

C:\Windows\System32\drivers\AmUStor.SYS 755D74BED450F7342F9D0AB01EFCF1AA

C:\Windows\system32\drivers\appid.sys 81F97D8F8B3FB94A451CC6F7CF8B2965

C:\Windows\system32\DRIVERS\arc.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\arcsas.sys ==> MD5 is legit

C:\Program Files\ASUS\ATK Package\ATKGFNEX\ASMMAP.sys B9FDFA552EBA5B4BF377F7CCEC9B8BC7

C:\Windows\System32\DRIVERS\asmthub3.sys 0A0FEA9D64CCA930E5AAE8E1458330D4

C:\Windows\System32\DRIVERS\asmtxhci.sys 68064F1BAAC47DFAE494895026CA5776

C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit

C:\Windows\System32\drivers\atapi.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\athr.sys AD0890EEBD1898E4A4F0C4D94060BFF7

C:\Windows\System32\drivers\AtihdW73.sys 95B1E9804CA10D096C0383F7C6684950

C:\Program Files\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi.sys B8BE87FF7942D1740ECBD6A9BB5DC0E0

C:\Windows\system32\DRIVERS\bxvbdx.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\b57nd60x.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\BAPIDRV.sys 1A922FC6D72CFC3634A079FF13D74DF3

C:\Windows\system32\Drivers\Beep.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\blbdrive.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\BrFiltLo.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\BrFiltUp.sys ==> MD5 is legit

C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit

C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit

C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit

C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\bthmodem.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\cdrom.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\circlass.sys ==> MD5 is legit

C:\Windows\System32\CLFS.sys 33A60554882FDF59CDA3E1806370BBA1

C:\Windows\System32\DRIVERS\CmBatt.sys ==> MD5 is legit

C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit

C:\Windows\System32\Drivers\cng.sys 3051724F223EA48968B19567DE2A81F4

C:\Windows\System32\DRIVERS\compbatt.sys ==> MD5 is legit

C:\Windows\system32\drivers\CompositeBus.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\crcdisk.sys ==> MD5 is legit

C:\Windows\System32\drivers\csc.sys ==> MD5 is legit

C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\ssudbus.sys 560B0DCE52DFED6623B27C9BAFA6F236

C:\Windows\System32\drivers\discache.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\disk.sys ==> MD5 is legit

C:\Windows\system32\drivers\drmkaud.sys ==> MD5 is legit

C:\Windows\System32\drivers\dxgkrnl.sys 3583A5A8CC2E682BFFBD4630D0FEC08B

C:\Windows\system32\DRIVERS\evbdx.sys ==> MD5 is legit

C:\Windows\System32\Drivers\Efimon.sys E6104BF5F23AEF2FD23E7271ED1E5D66

C:\Windows\system32\DRIVERS\elxstor.sys ==> MD5 is legit

C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\ewusbwwan.sys 026F6D48CC5293C7B8A696376618B9D2

C:\Windows\System32\DRIVERS\ew_hwusbdev.sys 57C171EA22F0A7F068FCB0CAEDD1E8E7

C:\Windows\System32\DRIVERS\ew_usbenumfilter.sys 61A973F60E94A551BA7B15F3460444FB

C:\Windows\system32\Drivers\exfat.sys ==> MD5 is legit

C:\Windows\system32\Drivers\fastfat.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\fdc.sys ==> MD5 is legit

C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit

C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\flpydisk.sys ==> MD5 is legitB

C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit

C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\fssfltr.sys 2262614848962DDB38FFB7C883E6FB55

C:\Windows\system32\Drivers\Fs_Rec.sys 7DAE5EBCC80E45D3253F4923DC424D05

C:\Windows\System32\DRIVERS\fvevol.sys E306A24D9694C724FA2491278BF50FDB

C:\Windows\system32\DRIVERS\gagp30kx.sys ==> MD5 is legit

C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit

C:\Windows\system32\drivers\HdAudio.sys A5EF29D5315111C80A5C1ABAD14C8972

C:\Windows\system32\drivers\HDAudBus.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\HidBatt.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\hidbth.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\hidir.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit

C:\Windows\System32\Drivers\Hookport.sys 2EFB89125842BBC686FCEA92B1F1C8EA

C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit

C:\Windows\System32\drivers\HTTP.sys 487569E5DA56A5A432FF8AF6D3599CF9

C:\Windows\System32\DRIVERS\ew_jucdcacm.sys 3170044AA8090F80839D3D4330BF733A

C:\Windows\System32\DRIVERS\ew_jubusenum.sys F44461E66F1B7DD267957FE9BAA63ED0

C:\Windows\System32\DRIVERS\ew_juextctrl.sys 69A103138B77AC0950EC3846E2E6F655

C:\Windows\System32\DRIVERS\ew_juwwanecm.sys 7DE001BAB4056257E1792AF1FCFA489F

C:\Windows\System32\DRIVERS\ewusbmdm.sys 19E6885A061011D8DABE8F64498423FA

C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit

C:\Windows\system32\drivers\i8042prt.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\iaStor.sys DB81F413FA4E3F328CAD7B5D59EF3F21

C:\Windows\system32\drivers\iaStorV.sys 5CD5F9A5444E6CDCB0AC89BD62D8B76E

C:\Windows\system32\DRIVERS\iirsp.sys ==> MD5 is legit

C:\Windows\System32\drivers\RTKVHDA.sys 345AC48D17F5C2F2AA1EE50D34C3978B

C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\intelppm.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit

C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit

C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit

C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit

C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit

C:\Windows\system32\drivers\msiscsi.sys EB34CE31FABD4DC4343FD2AD16D2CAF9

C:\Windows\System32\DRIVERS\kbdclass.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\kbdhid.sys ==> MD5 is legit

C:\Windows\System32\Drivers\ksecdd.sys A5B076011C853B4CAFD6296217A6E345

C:\Windows\System32\Drivers\ksecpkg.sys FD6A70D5D5B5BDF36AD265A232DAFB9A

C:\Windows\System32\DRIVERS\L1C60x86.sys 8F20749245DEA31D123E664E6F87E957

C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\lsi_fc.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\lsi_sas.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\lsi_sas2.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\lsi_scsi.sys ==> MD5 is legit

C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\megasas.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\MegaSR.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\HECI.sys 34A6E8BABFF9A3F5342976B9EA0E4899

C:\Windows\System32\drivers\modem.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit

C:\Windows\System32\drivers\mountmgr.sys 644905A19D0F37F2233DFCE53BC4BC19

C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit

C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit

C:\Windows\system32\drivers\mrxdav.sys 03F899F521D2AAED1C55008F734DF252

C:\Windows\System32\DRIVERS\mrxsmb.sys 5D16C921E3671636C0EBA3BBAAC5FD25

C:\Windows\System32\DRIVERS\mrxsmb10.sys 6D17A4791ACA19328C685D256349FEFC

C:\Windows\System32\DRIVERS\mrxsmb20.sys B81F204D146000BE76651A50670A5E9E

C:\Windows\System32\drivers\msahci.sys ==> MD5 is legit

C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit

C:\Windows\system32\Drivers\Msfs.sys ==> MD5 is legit

C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit

C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit

C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit

C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit

C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit

C:\Windows\system32\Drivers\MsRPC.sys ==> MD5 is legit

C:\Windows\system32\drivers\mssmbios.sys ==> MD5 is legit

C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\MTConfig.sys ==> MD5 is legit

C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit

C:\Windows\System32\Drivers\mvusbews.sys 6459E08514811CDEF51B3F635A7A2E78

C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit

C:\Windows\System32\drivers\ndis.sys 8C9C922D71F1CD4DEF73F186416B7896

C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit

C:\Windows\system32\Drivers\NDProxy.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\nfrd960.sys ==> MD5 is legit

C:\Windows\system32\Drivers\Npfs.sys ==> MD5 is legit

C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit

C:\Windows\system32\Drivers\Ntfs.sys C8DFF8D07755A66C7A4A738930F0FEAC

C:\Windows\system32\Drivers\Null.sys ==> MD5 is legit

C:\Windows\system32\drivers\nvraid.sys B3E25EE28883877076E0E1FF877D02E0

C:\Windows\system32\drivers\nvstor.sys 4380E59A170D88C4F1022EFF6719A8A4

C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit

C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\parport.sys ==> MD5 is legit

C:\Windows\System32\drivers\partmgr.sys 3F34A1B4C5F6475F320C275E63AFCE9B

C:\Windows\system32\DRIVERS\parvdm.sys ==> MD5 is legit

C:\Windows\System32\drivers\pci.sys ==> MD5 is legit

C:\Windows\system32\drivers\pciide.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\pcmcia.sys ==> MD5 is legit

C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit

C:\Windows\System32\drivers\peauth.sys AEBC369F7DC72AB3F5B9BDF34FA0D43F

C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\processr.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\ql2300.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\ql40xx.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\qutmdrv.sys 86AE3C2C621018B70155AFFC1DD763A6

C:\Windows\system32\drivers\qutmipc.sys C94FD2E64D92D1CEC22604D6802CF86C

C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit

C:\Windows\system32\Drivers\CAPLPTN.SYS F210E3B0FC9E4BA24EF682B18B0B2EA1

C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\rdpbus.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit

C:\Windows\System32\drivers\rdpdr.sys ==> MD5 is legit

C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit

C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit

C:\Windows\System32\drivers\rdpvideominiport.sys EAC76854C359D2534B25296AE425410D

C:\Windows\system32\Drivers\RDPWD.sys CD9214A6AE17D188D17C3CF8CB9CC693

C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\rtsuvc.sys 482904BEB1E6332DFDFC51E4C35EADC9

C:\Windows\system32\drivers\vms3cap.sys ==> MD5 is legit

C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit

C:\Windows\system32\Drivers\secdrv.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\serenum.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\serial.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\sermouse.sys ==> MD5 is legit

C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit

C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit

C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\sfloppy.sys ==> MD5 is legit

C:\Windows\system32\drivers\sisagp.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\SiSRaid2.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\sisraid4.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit

C:\Windows\system32\Drivers\spldr.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\srv.sys E4C2764065D66EA1D2D3EBC28FE99C46

C:\Windows\System32\DRIVERS\srv2.sys 03F0545BD8D4C77FA0AE1CEEDFCC71AB

C:\Windows\System32\DRIVERS\srvnet.sys BE6BD660CAA6F291AE06A718A4FA8ABC

C:\Windows\System32\DRIVERS\ssudmdm.sys 55AEB22380FB1002A5DB139429F43E97

C:\Windows\System32\DRIVERS\ssudserd.sys E0B86430E0B26C10B355B9E590FD25E0

C:\Windows\system32\DRIVERS\stexstor.sys ==> MD5 is legit

C:\Windows\System32\drivers\vmstorfl.sys ==> MD5 is legit

C:\Windows\system32\drivers\storvsc.sys ==> MD5 is legit

C:\Windows\system32\drivers\swenum.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\SynTP.sys 41D664DB5BFF4549D6F40ECA83A6AC20

C:\Windows\System32\drivers\tcpip.sys 5579DD18546999F5D0EC39D018726C6B

C:\Windows\System32\DRIVERS\tcpip.sys 5579DD18546999F5D0EC39D018726C6B

C:\Windows\System32\drivers\tcpipreg.sys 3EEBD3BD93DA46A26E89893C7AB2FF3B

C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit

C:\Windows\System32\drivers\tdtcp.sys 2C2C5AFE7EE4F620D69C23C0617651A8

C:\Windows\System32\DRIVERS\tdx.sys 7FE680A3DFA421C4A8E4879AE4C5AAB0

C:\Windows\system32\drivers\termdd.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\tssecsrv.sys 6C5139E4283249518F7743D7043775B3

C:\Windows\System32\drivers\tsusbflt.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\uagp35.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit

C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit

C:\Windows\system32\drivers\umbus.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\umpass.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\usbccgp.sys 0803FBA9FE829D61AE26EC0BCC910C46

C:\Windows\system32\drivers\usbcir.sys 2352AB5F9F8F097BF9D41D5A4718A041

C:\Windows\system32\drivers\usbehci.sys D40855F89B69305140BBD7E9A3BA2DA6

C:\Windows\System32\DRIVERS\usbhub.sys EDF2DF71C4F1E13A6AC75F5224DE655A

C:\Windows\system32\drivers\usbohci.sys 9828C8D14CC2676421778F0DE638CF97

C:\Windows\System32\DRIVERS\usbprint.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\USBSTOR.SYS F991AB9CC6B908DB552166768176896A

C:\Windows\system32\drivers\usbuhci.sys 800AABFD625EEFF899F7E5496BDE37AB

C:\Windows\System32\Drivers\usbvideo.sys DE014425522610BEDCA3821BB8C0F1D5

C:\Windows\system32\Drivers\uti4nzex.sys 524D8D450622DB4A7875B111C299A76B

C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit

C:\Windows\System32\drivers\vga.sys ==> MD5 is legit

C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit

C:\Windows\system32\drivers\viaagp.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\viac7.sys ==> MD5 is legit

C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit

C:\Windows\System32\drivers\vmbus.sys ==> MD5 is legit

C:\Windows\system32\drivers\VMBusHID.sys ==> MD5 is legit

C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit

C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit

C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\vsmraid.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\vwifibus.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\vwififlt.sys 7090D3436EEB4E7DA3373090A23448F7

C:\Windows\System32\DRIVERS\vwifimp.sys A3F04CBEA6C2A10E6CB01F8B47611882

C:\Windows\system32\DRIVERS\wacompen.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\wd.sys ==> MD5 is legit

C:\Windows\System32\drivers\Wdf01000.sys 25944D2CC49E0A6C581D02A74B7D6645

C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\wimfltr.sys 090A2B8F055343815556A01F725F6C35

C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit

C:\Windows\system32\drivers\WinUsb.sys A67E5F9A400F3BD1BE3D80613B45F708

C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit

C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit

C:\Windows\System32\drivers\WudfPf.sys 06E6F32C8D0A3F66D956F57B43A2E070

C:\Windows\System32\DRIVERS\WUDFRd.sys 867C301E8B790040AE9CF6486E8041DF

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-09-16 13:35 - 2015-09-16 13:36 - 00041836 _____ C:\Users\Людмила\Desktop\FRST.txt

2015-09-16 13:34 - 2015-09-16 13:35 - 00000000 ____D C:\FRST

2015-09-16 13:29 - 2015-09-16 13:34 - 01695232 _____ (Farbar) C:\Users\Людмила\Desktop\FRST.exe

2015-09-16 12:12 - 2015-09-16 12:21 - 02191360 _____ (Farbar) C:\Users\Людмила\Desktop\FRST64.exe

2015-09-16 01:26 - 2015-09-16 01:27 - 00000000 ____D C:\rsit

2015-09-16 01:26 - 2015-09-16 01:27 - 00000000 ____D C:\Program Files\trend micro

2015-09-16 01:17 - 2015-09-16 01:25 - 00007168 _____ C:\Windows\system32\Drivers\uti4nzex.sys

2015-09-16 01:08 - 2015-09-16 01:08 - 00000000 ____D C:\KVRT_Data

2015-09-15 23:10 - 2015-09-15 22:57 - 00047978 _____ C:\dberr.txt

2015-09-15 21:42 - 2015-09-15 21:42 - 00144944 _____ C:\Windows\Minidump\091515-28969-01.dmp

2015-09-15 21:41 - 2015-09-15 21:41 - 312063662 _____ C:\Windows\MEMORY.DMP

2015-09-15 21:02 - 2015-09-15 21:36 - 00000000 ____D C:\Users\Все пользователи\360Quarant

2015-09-15 21:02 - 2015-09-15 21:36 - 00000000 ____D C:\ProgramData\360Quarant

2015-09-14 18:23 - 2015-09-14 18:23 - 00144944 _____ C:\Windows\Minidump\091415-30388-01.dmp

2015-09-14 17:37 - 2015-09-14 17:37 - 00145088 _____ C:\Windows\Minidump\091415-32666-01.dmp

2015-09-14 17:28 - 2015-09-14 17:28 - 00145088 _____ C:\Windows\Minidump\091415-48999-01.dmp

2015-09-14 17:22 - 2015-09-14 17:22 - 00000000 ____D C:\Windows\Tasks\360Disabled

2015-09-14 17:16 - 2015-09-14 17:16 - 00000000 ____D C:\Users\Людмила\Doctor Web

2015-09-14 17:14 - 2015-06-11 20:57 - 00919552 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll

2015-09-14 17:14 - 2015-06-11 20:15 - 00134656 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll

2015-09-14 17:14 - 2015-06-11 20:15 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys

2015-09-14 17:12 - 2015-06-02 02:47 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\cewmdm.dll

2015-09-14 17:11 - 2015-05-09 06:14 - 00169984 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll

2015-09-14 17:11 - 2015-05-09 06:13 - 00868352 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll

2015-09-14 17:11 - 2015-05-09 06:13 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll

2015-09-14 17:11 - 2015-05-09 06:12 - 00271360 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe

2015-09-14 17:11 - 2015-05-09 06:08 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll

2015-09-14 17:11 - 2015-05-09 06:08 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll

2015-09-14 17:11 - 2015-05-09 06:08 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll

2015-09-14 17:11 - 2015-05-09 06:08 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll

2015-09-14 17:11 - 2015-05-09 06:08 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll

2015-09-14 17:11 - 2015-05-09 06:08 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll

2015-09-14 17:11 - 2015-05-09 06:08 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll

2015-09-14 17:11 - 2015-05-09 06:08 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll

2015-09-14 17:11 - 2015-05-09 06:08 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll

2015-09-14 17:11 - 2015-05-09 06:08 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll

2015-09-14 17:11 - 2015-05-09 06:08 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll

2015-09-14 17:11 - 2015-05-09 06:08 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll

2015-09-14 17:11 - 2015-05-09 06:08 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll

2015-09-14 17:11 - 2015-05-09 06:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll

2015-09-14 17:11 - 2015-05-09 06:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll

2015-09-14 17:11 - 2015-05-09 06:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll

2015-09-14 17:11 - 2015-05-09 06:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll

2015-09-14 17:11 - 2015-05-09 06:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll

2015-09-14 17:11 - 2015-05-09 06:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll

2015-09-14 17:11 - 2015-05-09 06:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll

2015-09-14 17:11 - 2015-05-09 06:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll

2015-09-14 17:11 - 2015-05-09 06:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll

2015-09-14 17:11 - 2015-05-09 06:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll

2015-09-14 17:11 - 2015-05-09 06:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll

2015-09-14 17:11 - 2015-05-09 04:59 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll

2015-09-14 17:11 - 2015-05-09 04:59 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll

2015-09-14 17:11 - 2015-05-09 04:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll

2015-09-14 17:11 - 2015-05-09 04:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll

2015-09-14 17:08 - 2015-04-24 20:56 - 00530432 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll

2015-09-14 17:07 - 2015-04-29 21:07 - 11411456 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll

2015-09-14 17:07 - 2015-04-29 21:07 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll

2015-09-14 17:07 - 2015-04-29 21:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx

2015-09-14 17:07 - 2015-04-29 21:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll

2015-09-14 17:07 - 2015-04-29 21:05 - 12625408 _____ (Корпорация Майкрософт (Microsoft Corp.)) C:\Windows\system32\wmploc.DLL

2015-09-14 17:04 - 2015-05-05 04:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2015-09-14 17:04 - 2015-04-18 05:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll

2015-09-14 17:04 - 2015-04-04 06:10 - 00137656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys

2015-09-14 17:04 - 2015-04-04 06:10 - 00067512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys

2015-09-14 17:04 - 2015-04-04 06:05 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2015-09-14 17:04 - 2015-04-04 06:05 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2015-09-14 17:04 - 2015-04-04 06:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2015-09-14 17:04 - 2015-04-04 06:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll

2015-09-14 17:04 - 2015-04-04 06:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll

2015-09-14 17:04 - 2015-04-04 06:05 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll

2015-09-14 17:04 - 2015-04-04 06:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2015-09-14 17:04 - 2015-04-04 06:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll

2015-09-14 17:04 - 2015-04-04 06:05 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2015-09-14 17:04 - 2015-04-04 06:05 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll

2015-09-14 17:04 - 2015-04-04 06:04 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe

2015-09-14 17:04 - 2015-04-04 06:04 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe

2015-09-14 17:04 - 2015-04-04 06:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll

2015-09-14 17:04 - 2015-04-04 06:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll

2015-09-14 17:04 - 2015-04-04 05:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll

2015-09-14 17:03 - 2015-04-13 06:19 - 00259072 _____ (Microsoft Corporation) C:\Windows\system32\services.exe

2015-09-14 17:02 - 2015-04-08 06:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll

2015-09-14 17:02 - 2015-04-08 06:14 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll

2015-09-14 17:01 - 2015-04-20 05:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

2015-09-14 17:01 - 2015-04-20 05:56 - 00909312 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll

2015-09-14 17:01 - 2015-04-20 05:03 - 02382336 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2015-09-14 17:00 - 2015-09-14 17:16 - 00000000 ___HT C:\Windows\wusa.lock

2015-09-14 16:51 - 2015-03-17 08:01 - 03976632 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe

2015-09-14 16:51 - 2015-03-17 08:01 - 03920824 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2015-09-14 16:51 - 2015-03-17 07:59 - 01306112 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2015-09-14 16:51 - 2015-03-17 07:57 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll

2015-09-14 16:51 - 2015-03-17 07:57 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll

2015-09-14 16:51 - 2015-03-17 07:56 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe

2015-09-14 16:51 - 2015-03-17 07:56 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe

2015-09-14 16:51 - 2015-03-17 07:56 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll

2015-09-14 16:51 - 2015-03-17 07:50 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll

2015-09-14 16:48 - 2015-03-04 07:16 - 00249784 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys

2015-09-14 16:48 - 2015-03-04 07:10 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll

2015-09-14 16:46 - 2015-02-25 06:03 - 00514560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys

2015-09-14 16:36 - 2015-09-14 16:43 - 00002460 _____ C:\Users\Людмила\Desktop\Yandex.lnk

2015-09-14 16:36 - 2015-09-14 16:36 - 00000000 ____D C:\Users\Людмила\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yandex

2015-09-14 16:35 - 2015-09-14 16:35 - 00257406 _____ C:\Windows\msxml4-KB2758694-chs.LOG

2015-09-14 16:21 - 2015-09-14 17:22 - 00000000 ____D C:\Users\Людмила\AppData\Roaming\360Safe

2015-09-14 16:20 - 2015-09-15 22:56 - 00000000 _RSHD C:\360SANDBOX

2015-09-14 16:20 - 2015-09-14 17:24 - 00000000 ____D C:\Users\Людмила\AppData\Roaming\360TotalSecurity

2015-09-14 16:20 - 2015-09-14 17:22 - 00000000 ____D C:\Users\Все пользователи\360safe

2015-09-14 16:20 - 2015-09-14 17:22 - 00000000 ____D C:\ProgramData\360safe

2015-09-14 16:20 - 2015-09-14 16:20 - 00001067 _____ C:\Users\Public\Desktop\360 Total Security.lnk

2015-09-14 16:20 - 2015-09-14 16:20 - 00000000 ____D C:\Users\Все пользователи\360TotalSecurity

2015-09-14 16:20 - 2015-09-14 16:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\360 Security Center

2015-09-14 16:20 - 2015-09-14 16:20 - 00000000 ____D C:\ProgramData\360TotalSecurity

2015-09-14 16:20 - 2015-09-06 09:43 - 00203856 _____ (360.cn) C:\Windows\system32\Drivers\360Box.sys

2015-09-14 16:20 - 2015-09-06 09:43 - 00178384 _____ (360????) C:\Windows\system32\Drivers\360SelfProtection.sys

2015-09-14 16:20 - 2015-09-06 09:43 - 00121936 _____ (360.cn) C:\Windows\system32\Drivers\360AntiHacker.sys

2015-09-14 16:20 - 2015-09-06 09:43 - 00053960 _____ (360.cn) C:\Windows\system32\Drivers\qutmipc.sys

2015-09-14 16:20 - 2015-09-06 09:43 - 00034888 _____ (360.cn) C:\Windows\system32\Drivers\360Camera.sys

2015-09-14 16:19 - 2015-09-06 09:43 - 00292560 _____ (360.cn) C:\Windows\system32\Drivers\qutmdrv.sys

2015-09-14 16:19 - 2015-09-06 09:43 - 00174672 _____ (360.cn) C:\Windows\system32\Drivers\BAPIDRV.SYS

2015-09-14 16:19 - 2015-09-06 09:43 - 00065872 _____ (360????) C:\Windows\system32\Drivers\hookport.sys

2015-09-14 16:18 - 2015-09-06 09:43 - 00066128 _____ (360.cn) C:\Windows\system32\Drivers\360AvFlt.sys

2015-09-14 16:18 - 2015-09-06 09:43 - 00024296 _____ (360.cn) C:\Windows\system32\Drivers\efimon.sys

2015-09-14 16:16 - 2015-09-14 16:16 - 00000000 ____D C:\Program Files\360

2015-09-11 19:51 - 2015-09-11 19:51 - 00001409 _____ C:\Users\Людмила\Desktop\MOHAA - Ярлык.lnk

2015-09-10 11:58 - 2015-09-10 11:58 - 00001485 _____ C:\Users\Людмила\Desktop\moh_spearhead - Ярлык.lnk

2015-09-07 18:34 - 2015-09-07 18:34 - 00001512 _____ C:\Users\Людмила\Desktop\moh_Breakthrough - Ярлык.lnk

2015-09-07 16:24 - 2005-03-24 22:31 - 00074802 _____ (Microsoft Corporation) C:\Windows\system32\temp.02E

2015-09-07 16:24 - 1999-03-08 13:50 - 00147728 _____ (Microsoft Corporation) C:\Windows\system32\temp.02F

2015-09-07 16:23 - 2005-03-25 16:00 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\temp.028

2015-09-07 16:23 - 2005-03-24 22:31 - 00995384 _____ (Microsoft Corporation) C:\Windows\system32\temp.02A

2015-09-07 16:23 - 2005-03-24 22:31 - 00995383 _____ (Microsoft Corporation) C:\Windows\system32\temp.02B

2015-09-07 16:23 - 2004-08-04 00:56 - 00848384 _____ (Intel Corporation) C:\Windows\system32\temp.02C

2015-09-07 16:23 - 2004-02-23 02:00 - 01386496 _____ (Microsoft Corporation) C:\Windows\system32\temp.029

2015-09-07 16:23 - 2000-04-12 15:00 - 00598288 _____ (Microsoft Corporation) C:\Windows\system32\temp.027

2015-09-07 16:23 - 2000-03-28 17:58 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\temp.025

2015-09-07 16:23 - 1999-03-08 13:50 - 00164112 _____ (Microsoft Corporation) C:\Windows\system32\temp.026

2015-09-07 16:23 - 1998-12-09 13:52 - 00022288 _____ (Microsoft Corporation) C:\Windows\system32\temp.02D

2015-09-07 16:21 - 1999-03-01 21:44 - 00266293 _____ (Microsoft Corporation) C:\Windows\system32\temp.024

2015-09-07 14:19 - 2015-09-07 16:29 - 00000000 ____D C:\Program Files\DirectX

2015-09-07 14:19 - 2005-03-25 16:00 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\temp.01C

2015-09-07 14:19 - 2005-03-24 22:31 - 00995384 _____ (Microsoft Corporation) C:\Windows\system32\temp.01E

2015-09-07 14:19 - 2005-03-24 22:31 - 00995383 _____ (Microsoft Corporation) C:\Windows\system32\temp.01F

2015-09-07 14:19 - 2005-03-24 22:31 - 00074802 _____ (Microsoft Corporation) C:\Windows\system32\temp.022

2015-09-07 14:19 - 2004-08-04 00:56 - 00848384 _____ (Intel Corporation) C:\Windows\system32\temp.020

2015-09-07 14:19 - 2004-02-23 02:00 - 01386496 _____ (Microsoft Corporation) C:\Windows\system32\temp.01D

2015-09-07 14:19 - 2000-04-12 15:00 - 00598288 _____ (Microsoft Corporation) C:\Windows\system32\temp.01B

2015-09-07 14:19 - 2000-03-28 17:58 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\temp.019

2015-09-07 14:19 - 1999-03-08 13:50 - 00164112 _____ (Microsoft Corporation) C:\Windows\system32\temp.01A

2015-09-07 14:19 - 1999-03-08 13:50 - 00147728 _____ (Microsoft Corporation) C:\Windows\system32\temp.023

2015-09-07 14:19 - 1998-12-09 13:52 - 00022288 _____ (Microsoft Corporation) C:\Windows\system32\temp.021

2015-09-07 14:17 - 1999-03-01 21:44 - 00266293 _____ (Microsoft Corporation) C:\Windows\system32\temp.018

2015-09-07 10:33 - 2015-09-07 10:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Triada

2015-08-21 20:51 - 2015-08-21 20:51 - 00000000 ____D C:\Users\Людмила\AppData\Local\CrashRpt

2015-08-21 20:44 - 2015-08-21 20:44 - 00000110 _____ C:\Users\Людмила\Desktop\Warface.url

2015-08-21 17:10 - 2015-08-21 20:44 - 00000000 ____D C:\Users\Людмила\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mail.Ru

2015-08-19 11:06 - 2015-08-19 11:06 - 00000000 ____D C:\Users\Людмила\AppData\Local\MFAData

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-09-16 13:27 - 2012-09-19 21:38 - 01924160 _____ C:\Windows\WindowsUpdate.log

2015-09-16 13:27 - 2012-09-02 00:03 - 00000000 ____D C:\Users\Все пользователи\DatacardService

2015-09-16 13:27 - 2012-09-02 00:03 - 00000000 ____D C:\ProgramData\DatacardService

2015-09-16 13:27 - 2009-07-14 05:37 - 00000000 ____D C:\Windows\tracing

2015-09-16 13:20 - 2012-10-21 17:09 - 00000954 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-09-16 13:09 - 2012-10-21 17:09 - 00000958 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-09-16 01:45 - 2013-03-07 16:21 - 00000000 ____D C:\Users\Людмила\AppData\Roaming\AIMP3

2015-09-16 01:30 - 2009-07-14 07:34 - 00016848 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-09-16 01:30 - 2009-07-14 07:34 - 00016848 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-09-16 01:29 - 2012-09-01 22:51 - 00006248 _____ C:\Windows\system32\PerfStringBackup.INI

2015-09-16 01:29 - 2009-07-14 11:41 - 02036666 _____ C:\Windows\system32\perfh019.dat

2015-09-16 01:29 - 2009-07-14 11:41 - 00609984 _____ C:\Windows\system32\perfc019.dat

2015-09-16 01:22 - 2013-09-22 16:20 - 00065536 _____ C:\Windows\system32\Ikeext.etl

2015-09-16 01:22 - 2012-09-01 23:24 - 00045056 _____ C:\Windows\system32\acovcnt.exe

2015-09-16 01:22 - 2012-06-04 19:18 - 00000000 ___HD C:\ASUS.DAT

2015-09-16 01:22 - 2009-07-14 07:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2015-09-16 01:22 - 2009-07-14 07:39 - 00116977 _____ C:\Windows\setupact.log

2015-09-15 23:03 - 2013-10-08 20:19 - 00107008 ___SH C:\Users\Людмила\Documents\Thumbs.db

2015-09-15 21:44 - 2014-06-21 17:54 - 00000000 ___RD C:\Users\Людмила\YandexDisk

2015-09-15 21:42 - 2013-02-05 13:51 - 00000000 ____D C:\Windows\Minidump

2015-09-15 21:37 - 2013-09-09 10:01 - 00000000 ____D C:\Users\Людмила\AppData\Roaming\FileZilla

2015-09-15 21:37 - 2013-02-02 18:50 - 00000000 ____D C:\Users\Людмила\AppData\Roaming\uTorrent

2015-09-15 21:37 - 2012-11-21 23:43 - 00000000 ____D C:\Users\Людмила\AppData\Roaming\vlc

2015-09-15 21:37 - 2012-09-02 18:36 - 00000000 ____D C:\Users\Людмила\AppData\Roaming\Babylon

2015-09-14 17:53 - 2009-07-14 05:37 - 00000000 ____D C:\Windows\Microsoft.NET

2015-09-14 17:30 - 2009-07-14 07:46 - 00001515 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk

2015-09-14 17:20 - 2009-07-14 07:33 - 00465072 _____ C:\Windows\system32\FNTCACHE.DAT

2015-09-14 17:18 - 2009-07-14 12:14 - 00000000 ____D C:\Program Files\Windows Journal

2015-09-14 17:18 - 2009-07-14 05:37 - 00000000 ____D C:\Windows\system32\ru-RU

2015-09-14 17:16 - 2012-09-01 22:47 - 00000000 ____D C:\Users\Людмила

2015-09-14 16:35 - 2014-11-05 14:08 - 00000000 ____D C:\Program Files\MSXML 4.0

2015-09-14 16:32 - 2014-11-22 09:35 - 07786680 _____ C:\Windows\system32\debug.log

2015-09-14 16:31 - 2012-10-07 22:12 - 00000000 ____D C:\Program Files\Mail.Ru

2015-09-14 16:30 - 2013-02-03 19:02 - 00000000 ____D C:\Program Files\Opera

2015-09-14 16:30 - 2012-09-30 19:17 - 00000000 ____D C:\Users\Людмила\AppData\Roaming\Opera

2015-09-14 16:30 - 2012-09-30 19:17 - 00000000 ____D C:\Users\Людмила\AppData\Local\Opera

2015-09-14 16:25 - 2012-09-01 23:45 - 00000000 ____D C:\Users\Все пользователи\MFAData

2015-09-14 16:25 - 2012-09-01 23:45 - 00000000 ____D C:\ProgramData\MFAData

2015-09-14 16:25 - 2012-09-01 23:23 - 00184274 _____ C:\Windows\PFRO.log

2015-09-14 16:23 - 2015-07-11 17:05 - 00000000 ____D C:\Program Files\Common Files\AV

2015-09-14 15:59 - 2014-07-14 10:19 - 00000000 ____D C:\Users\Людмила\AppData\Local\Amigo

2015-09-07 16:21 - 2013-08-12 21:04 - 00000000 ____D C:\Games

2015-09-07 10:35 - 2013-08-12 21:29 - 00000000 ____D C:\Users\Людмила\Documents\EA Games

2015-09-07 10:35 - 2013-07-08 12:16 - 00000000 ____D C:\Users\Людмила\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games

2015-09-06 16:59 - 2012-09-02 18:37 - 00000000 ____D C:\Users\Людмила\AppData\Roaming\DRPSu

2015-09-01 19:59 - 2013-02-02 18:31 - 00000374 _____ C:\Windows\system32\Drivers\etc\hosts.ics

2015-08-21 17:09 - 2014-01-06 12:58 - 00000000 ____D C:\Users\Людмила\AppData\Local\Mail.Ru

==================== Files in the root of some directories =======

2013-08-25 19:38 - 2013-08-25 19:36 - 0030894 _____ () C:\Users\Людмила\AppData\Roaming\speedanalysis.ico

2014-01-14 15:32 - 2014-02-04 14:04 - 0004096 ____H () C:\Users\Людмила\AppData\Local\keyfile3.drm

2015-01-04 12:08 - 2015-01-04 12:08 - 0000000 _____ () C:\Users\Людмила\AppData\Local\{4AFC9AED-64E6-4326-B9D6-435F021D51EF}

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\dnsapi.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

==================== BCD ================================

„ЁбЇҐвзҐа § Јаг§ЄЁ Windows

--------------------

Ё¤ҐвЁдЁЄ в®а {bootmgr}

device partition=\Device\HarddiskVolume1

description Windows Boot Manager

locale ru-RU

inherit {globalsettings}

default {current}

resumeobject {696771fb-ae65-11e1-8a20-f8b4474f7036}

displayorder {current}

toolsdisplayorder {memdiag}

timeout 30

‡ Јаг§Є Windows

-------------------

Ё¤ҐвЁдЁЄ в®а {current}

device partition=C:

path \Windows\system32\winload.exe

description Windows 7

locale ru-RU

inherit {bootloadersettings}

recoverysequence {696771ff-ae65-11e1-8a20-f8b4474f7036}

recoveryenabled Yes

osdevice partition=C:

systemroot \Windows

resumeobject {696771fb-ae65-11e1-8a20-f8b4474f7036}

nx OptIn

‡ Јаг§Є Windows

-------------------

Ё¤ҐвЁдЁЄ в®а {696771fd-ae65-11e1-8a20-f8b4474f7036}

device ramdisk=[C:]\Recovery\696771fd-ae65-11e1-8a20-f8b4474f7036\Winre.wim,{696771fe-ae65-11e1-8a20-f8b4474f7036}

path \windows\system32\winload.exe

description Windows Recovery Environment

inherit {bootloadersettings}

osdevice ramdisk=[C:]\Recovery\696771fd-ae65-11e1-8a20-f8b4474f7036\Winre.wim,{696771fe-ae65-11e1-8a20-f8b4474f7036}

systemroot \windows

nx OptIn

winpe Yes

‡ Јаг§Є Windows

-------------------

Ё¤ҐвЁдЁЄ в®а {696771ff-ae65-11e1-8a20-f8b4474f7036}

device ramdisk=[C:]\Recovery\696771ff-ae65-11e1-8a20-f8b4474f7036\Winre.wim,{69677200-ae65-11e1-8a20-f8b4474f7036}

path \windows\system32\winload.exe

description Windows Recovery Environment

inherit {bootloadersettings}

osdevice ramdisk=[C:]\Recovery\696771ff-ae65-11e1-8a20-f8b4474f7036\Winre.wim,{69677200-ae65-11e1-8a20-f8b4474f7036}

systemroot \windows

nx OptIn

winpe Yes

‚ле®¤ Ё§ аҐ¦Ё¬ ЈЁЎҐа жЁЁ

--------------------------

Ё¤ҐвЁдЁЄ в®а {696771fb-ae65-11e1-8a20-f8b4474f7036}

device partition=C:

path \Windows\system32\winresume.exe

description Windows Resume Application

locale ru-RU

inherit {resumeloadersettings}

filedevice partition=C:

filepath \hiberfil.sys

pae Yes

debugoptionenabled No

Џа®ўҐаЄ Ї ¬пвЁ Windows

---------------------

Ё¤ҐвЁдЁЄ в®а {memdiag}

device partition=\Device\HarddiskVolume1

path \boot\memtest.exe

description „Ё Ј®бвЁЄ Ї ¬пвЁ

locale ru-RU

inherit {globalsettings}

badmemoryaccess Yes

Џ а ¬Ґвал EMS

-------------

Ё¤ҐвЁдЁЄ в®а {emssettings}

bootems Yes

Џ а ¬Ґвал ®в« ¤зЁЄ

-------------------

Ё¤ҐвЁдЁЄ в®а {dbgsettings}

debugtype Serial

debugport 1

baudrate 115200

„ҐдҐЄвл Ћ‡“

-----------

Ё¤ҐвЁдЁЄ в®а {badmemory}

ѓ«®Ў «млҐ Ї а ¬Ґвал

--------------------

Ё¤ҐвЁдЁЄ в®а {globalsettings}

inherit {dbgsettings}

{emssettings}

{badmemory}

Џ а ¬Ґвал § Јаг§зЁЄ

--------------------

Ё¤ҐвЁдЁЄ в®а {bootloadersettings}

inherit {globalsettings}

{hypervisorsettings}

Џ а ¬Ґвал ЈЁЇҐаўЁ§®а

-------------------

Ё¤ҐвЁдЁЄ в®а {hypervisorsettings}

hypervisordebugtype Serial

hypervisordebugport 1

hypervisorbaudrate 115200

Џ а ¬Ґвал § Јаг§зЁЄ ў®ббв ®ў«ҐЁп

-----------------------------------

Ё¤ҐвЁдЁЄ в®а {resumeloadersettings}

inherit {globalsettings}

Џ а ¬Ґвал гбва®©бвў

-------------------

Ё¤ҐвЁдЁЄ в®а {696771fe-ae65-11e1-8a20-f8b4474f7036}

description Ramdisk Options

ramdisksdidevice partition=C:

ramdisksdipath \Recovery\696771fd-ae65-11e1-8a20-f8b4474f7036\boot.sdi

-------------------

Ё¤ҐвЁдЁЄ в®а {69677200-ae65-11e1-8a20-f8b4474f7036}

description Ramdisk Options

ramdisksdidevice partition=C:

ramdisksdipath \Recovery\696771ff-ae65-11e1-8a20-f8b4474f7036\boot.sdi

LastRegBack: 2014-12-16 20:07

==================== End of FRST.txt ============================

Additional scan result of Farbar Recovery Scan Tool (x86) Version:15-09-2015

Ran by Людмила (2015-09-16 13:36:40)

Running from C:\Users\Людмила\Desktop

Microsoft Windows 7 Максимальная Service Pack 1 (X86) (2012-09-01 19:46:53)

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

HomeGroupUser$ (S-1-5-21-887322933-3475441419-2763790667-1002 - Limited - Enabled)

Администратор (S-1-5-21-887322933-3475441419-2763790667-500 - Administrator - Disabled)

Гость (S-1-5-21-887322933-3475441419-2763790667-501 - Limited - Disabled)

Людмила (S-1-5-21-887322933-3475441419-2763790667-1000 - Administrator - Enabled) => C:\Users\Людмила

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: 360 Total Security (Disabled - Up to date) {2B66EE1E-E5C8-C2F7-648F-4E55AC68D37D}

AS: 360 Total Security (Disabled - Up to date) {90070FFA-C3F2-CD79-5E3F-7527D7EF99C0}

AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

360 Total Security (HKLM\...\360TotalSecurity) (Version: 7.6.0.1028 - 360 Security Center)

77zip (HKLM\...\77zip) (Version: - )

7-Zip 9.20 (HKLM\...\{23170F69-40C1-2701-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)

Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.246 - Adobe Systems Incorporated)

Adobe Reader 9.3 - Russian (HKLM\...\{AC76BA86-7AD7-1049-7B44-A93000000001}) (Version: 9.3.0 - Adobe Systems Incorporated)

AGEIA PhysX v7.07.24 (HKLM\...\{EFC1B35C-FFF2-41D8-A70A-CE6037F8040B}) (Version: 7.07.24 - AGEIA Technologies, Inc.)

AIMP3 (HKLM\...\AIMP3) (Version: v3.00.985 - AIMP DevTeam)

Alcor Micro USB Card Reader (HKLM\...\AmUStor) (Version: 1.2.0117.08443 - Alcor Micro Corp.)

Alcor Micro USB Card Reader (Version: 1.2.0117.08443 - Alcor Micro Corp.) Hidden

Asmedia ASM104x USB 3.0 Host Controller Driver (HKLM\...\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.12.5.0 - Asmedia Technology)

ASUS AI Recovery (HKLM\...\{D39F0676-163E-4595-A917-E28F99BBD4D2}) (Version: 1.0.16 - ASUS)

ASUS FancyStart (HKLM\...\{C944B4C5-1C4D-4D95-8AC0-7CEF13914131}) (Version: 1.1.1 - ASUSTeK Computer Inc.)

ASUS LifeFrame3 (HKLM\...\{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}) (Version: 3.0.25 - ASUS)

ASUS Power4Gear Hybrid (HKLM\...\{ED74696E-1781-469B-94F4-124A68B5F11C}) (Version: 1.1.45 - ASUS)

ASUS SmartLogon (HKLM\...\{64452561-169F-4A36-A2FF-B5E118EC65F5}) (Version: 1.0.0011 - ASUS)

ASUS Splendid Video Enhancement Technology (HKLM\...\{0969AF05-4FF6-4C00-9406-43599238DE0D}) (Version: 1.02.0033 - ASUS)

ASUS Virtual Camera (HKLM\...\{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}) (Version: 1.0.23 - asus)

ASUS_Screensaver (HKLM\...\ASUS_Screensaver) (Version: - )

ATK Package (HKLM\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version: 1.0.0014 - ASUS)

Canon PhotoRecord (HKLM\...\{D958FAC4-BAE0-4B1D-A42E-DE9BFDE7DDEE}) (Version: 02.02.00013 - Cisra)

Canon PIXMA iP1500 (HKLM\...\CANONBJ_Deinstall_CNMCP5y.DLL) (Version: - )

Canon Utilities Easy-PrintToolBox (HKLM\...\Easy-PrintToolBox) (Version: - )

D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden

DriverPack Solution Updater (HKU\S-1-5-21-887322933-3475441419-2763790667-1000\...\DRPSu Updater) (Version: 0.0.25 - DriverPack Solution)

Easy-WebPrint (HKLM\...\Easy-WebPrint) (Version: - )

FileZilla Client 3.7.3 (HKLM\...\FileZilla Client) (Version: 3.7.3 - Tim Kosse)

Foxit Reader (HKLM\...\{BDDF6AEE-7AD7-4CDA-B57F-5BDF9417AD4F}) (Version: 5.1.3.1201 - Foxit Corporation)

Free Studio version 2013 (HKLM\...\Free Studio_is1) (Version: 6.1.8.725 - DVDVideoSoft Ltd.)

Google Chrome (HKLM\...\Google Chrome) (Version: 45.0.2454.85 - Google Inc.)

Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden

Google Update Helper (Version: 1.3.28.13 - Google Inc.) Hidden

HP LaserJet Professional P1100-P1560-P1600 Series (HKLM\...\HP LaserJet Professional P1100-P1560-P1600 Series) (Version: - )

Indeo® Software (HKLM\...\Indeo® Software) (Version: - )

InstantOn for NB (HKLM\...\{749F674B-2674-47E8-879C-5626A06B2A91}) (Version: 2.1.5 - ASUS)

Intel® Control Center (HKLM\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)

Intel® Management Engine Components (HKLM\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)

Junk Mail filter update (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

K-Lite Codec Pack 9.4.0 (Full) (HKLM\...\KLiteCodecPack_is1) (Version: 9.4.0 - )

Kyocera Product Library (HKLM\...\Kyocera Product Library) (Version: 3.3.0728 - KYOCERA Document Solutions Inc.)

Medal of Honor - Pacific Assault (HKLM\...\Medal of Honor - Pacific Assault) (Version: - )

Medal of Honor Airborne (HKLM\...\Medal of Honor Airborne) (Version: - )

Medal Of Honour Allied Assault (HKLM\...\Medal Of Honour Allied Assault) (Version: - )

MegaFon Internet (HKLM\...\MegaFon Internet) (Version: 11.022.04.16.209 - Huawei Technologies Co.,Ltd)

MegaFon Modem (HKLM\...\MegaFon Modem) (Version: 22.001.18.20.209 - Huawei Technologies Co.,Ltd)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (Русский) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1049) (Version: 4.5.50938 - Корпорация Майкрософт)

Microsoft Office - профессиональный выпуск версии 2003 (HKLM\...\{90110419-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)

Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Office Outlook Connector (HKLM\...\{95140000-007A-0419-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)

Microsoft OneDrive (HKU\S-1-5-21-887322933-3475441419-2763790667-1000\...\OneDriveSetup.exe) (Version: 17.0.4035.0328 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

MPEG Video Wizard DVD 5.0.0.108 (06/2010) (HKLM\...\{9FD45917-95E6-449D-ACC9-01E634A34CBD}_is1) (Version: 5.0.0.108 - Womble Multimedia, Inc.)

MPEG Video Wizard DVD 5.0.0.108 (06/2010) (HKLM\...\Mpeg Video Wizard DVD 5.0) (Version: 5.0.0.108 (06/2010) - Womble Multimedia, Inc.)

MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

MSXML 4.0 SP3 Parser (KB2758694) (HKLM\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)

Qualcomm Atheros WiFi Driver Installation (HKLM\...\{7D916FA5-DAE9-4A25-B089-655C70EAF607}) (Version: 9.2 - Qualcomm Atheros)

Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6482 - Realtek Semiconductor Corp.)

SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.3.2000.0 - SAMSUNG Electronics Co., Ltd.)

Sonic Focus (HKLM\...\{09BCB9CE-964B-4BDA-AE46-B5A0ABEF1D3F}) (Version: 1.0.0.4 - Synopsys )

StartNow Toolbar (HKLM\...\StartNow Toolbar) (Version: 2.5.0 - StartNow.com) <==== ATTENTION

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.2.16.1 - Synaptics Incorporated)

Total Commander 7.50a ExtremePack (HKLM\...\Total Commander) (Version: - )

USB Disk Security 6.0.0.126 by vovansi (HKLM\...\USB Disk Security_is1) (Version: - vovansi)

USB2.0 UVC VGA WebCam (HKLM\...\{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}) (Version: 6.1.7600.0083 - Realtek Semiconductor Corp.)

Visual Studio 2012 x86 Redistributables (HKLM\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)

VKMusic 4 (HKLM\...\VKMusic 4_is1) (Version: 4.45 - )

VLC media player 2.1.3 (HKLM\...\VLC media player) (Version: 2.1.3 - VideoLAN)

Warface (HKU\S-1-5-21-887322933-3475441419-2763790667-1000\...\Warface) (Version: 1.113 - Mail.Ru)

Webalta Toolbar (HKU\S-1-5-21-887322933-3475441419-2763790667-1000\...\Webalta Toolbar) (Version: - )

WinDjView 1.0.3 (HKLM\...\WinDjView) (Version: 1.0.3 - Andrew Zhezherun)

WinFlash (HKLM\...\{8F21291E-0444-4B1D-B9F9-4370A73E346D}) (Version: 2.31.0 - ASUS)

Wireless Console 3 (HKLM\...\{C4BC5A5F-4A97-47CC-99C3-AB8E10572AFE}) (Version: 3.0.24 - ASUS)

Yandex (HKU\S-1-5-21-887322933-3475441419-2763790667-1000\...\YandexBrowser) (Version: 15.7.2357.2877 - ООО «ЯНДЕКС»)

Игровой центр (HKU\S-1-5-21-887322933-3475441419-2763790667-1000\...\GameCenterMailRu) (Version: 3.1123 - ООО "Мэйл.Ру Геймз")

Основные компоненты Windows Live (HKLM\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)

Основные компоненты Windows Live (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

Пакет обеспечения совместимости для выпуска 2007 системы Microsoft Office (HKLM\...\{90120000-0020-0419-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)

Почта Windows Live (Version: 16.4.3528.0331 - Корпорация Майкрософт) Hidden

Принтеры Canon CAPT (HKLM\...\Canon Advanced Printing Technology) (Version: - )

Фотографии (общедоступная версия) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

ФотоШОУ PRO 5.15 (HKLM\...\{B42C6524-D740-4AF2-831A-821AF5B17006}_is1) (Version: 5.15 - AMS Software)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-887322933-3475441419-2763790667-1000_Classes\CLSID\{4671DB2A-087D-4EB2-96DF-64AF0177FE1B}\localserver32 -> C:\Users\Людмила\AppData\Local\Yandex\Updater\yupdate-ctrl.exe (Yandex LLC)

CustomCLSID: HKU\S-1-5-21-887322933-3475441419-2763790667-1000_Classes\CLSID\{5A8FF410-F3CE-4844-B31B-F18D911239E8}\InprocServer32 -> C:\Users\Людмила\AppData\Local\Mail.Ru\GameCenter\NPDetector.dll (LLC Mail.Ru)

CustomCLSID: HKU\S-1-5-21-887322933-3475441419-2763790667-1000_Classes\CLSID\{A2DF06F9-A21A-44A8-8A99-8B9C84F29160}\localserver32 -> "C:\Users\Людмила\AppData\Local\Yandex\YandexBrowser\Application\25.0.1364.22194\delegate_execute.ex (the data entry has 10 more characters).

==================== Restore Points =========================

07-09-2015 14:17:19 Установлено: Microsoft Visual C++ 2005 Redistributable

14-09-2015 16:18:03 Removed AVG 2015

14-09-2015 16:23:00 Removed AVG 2015

14-09-2015 16:36:18 Центр обновления Windows

14-09-2015 16:45:47 Центр обновления Windows

14-09-2015 16:47:20 Центр обновления Windows

14-09-2015 16:50:27 Центр обновления Windows

14-09-2015 16:53:53 Центр обновления Windows

14-09-2015 16:55:14 Центр обновления Windows

14-09-2015 16:58:38 Центр обновления Windows

14-09-2015 17:00:59 Центр обновления Windows

14-09-2015 17:01:56 Центр обновления Windows

14-09-2015 17:03:02 Центр обновления Windows

14-09-2015 17:04:03 Центр обновления Windows

14-09-2015 17:06:09 Центр обновления Windows

14-09-2015 17:08:12 Центр обновления Windows

14-09-2015 17:10:31 Центр обновления Windows

14-09-2015 17:12:24 Центр обновления Windows

14-09-2015 17:13:57 Центр обновления Windows

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 05:04 - 2009-06-11 00:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {07570A2A-9CCC-4B6B-93E2-9F7D29314313} - System32\Tasks\ASUS SmartLogon Console Sensor => C:\Program Files\ASUS\SmartLogon\sensorsrv.exe [2010-11-15] (ASUS)

Task: {0CCD3EB6-8F05-4846-BE85-66F229CCCDF5} - System32\Tasks\ATKOSD2 => C:\Program Files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [2011-07-21] (ASUS)

Task: {3B52923B-E4DE-4C89-9B4D-37C506291AB7} - System32\Tasks\{9B2529C5-C430-4DDB-B2A6-F18889DC9575} => pcalua.exe -a E:\iv5setup.exe -d E:\

Task: {44CEDE77-CD58-442A-B4D1-5B46EB0ADD02} - System32\Tasks\Games\UpdateCheck_S-1-5-21-887322933-3475441419-2763790667-1000

Task: {46998EA4-0448-45D0-9940-C9ECB1C3000B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-20] (Adobe Systems Incorporated)

Task: {479041F9-C684-4357-B4C2-B9445DE17BEE} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)

Task: {4C2497C9-8D08-4DCC-8BA0-8038B0128BA8} - System32\Tasks\ACMON => C:\Program Files\ASUS\Splendid\ACMON.exe [2011-05-30] (ASUS)

Task: {4E062114-3497-4FE4-87DF-A51B9A8259FE} - System32\Tasks\ASUS P4G => C:\Program Files\P4G\BatteryLife.exe [2011-05-31] (ASUS)

Task: {582524F5-C729-448F-97AC-5FFDB6B2CDA6} - System32\Tasks\{30E56165-8E15-4F31-A794-779A917D8244} => pcalua.exe -a C:\Users\Людмила\Desktop\vkontaktedj.exe -d C:\Users\Людмила\Desktop

Task: {D21F6024-191F-4454-BBBC-09A650DA2549} - System32\Tasks\Microsoft\Windows\Application Experience\AitAgent => C:\Windows\system32\aitagent.exe [2010-11-20] (Корпорация Майкрософт (Microsoft Corp.))

Task: {EE275321-B1D5-45AF-88A9-F92DAA6CEDEA} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)

Task: {F3282426-8557-4345-8E41-5DA4F1313594} - System32\Tasks\MailRuUpdateTask => C:\Users\Людмила\AppData\Local\Mail.Ru\MailRuUpdater.exe

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2015-09-14 16:18 - 2015-09-06 09:43 - 00087672 _____ () C:\Program Files\360\Total Security\deepscan\qutmload.dll

2014-06-09 15:27 - 2011-04-02 16:03 - 00151552 _____ () C:\Windows\System32\HP1100LM.DLL

2014-06-09 15:28 - 2011-04-02 16:03 - 00069632 _____ () C:\Windows\system32\spool\PRTPROCS\W32X86\HP1100PP.DLL

2011-05-30 13:48 - 2011-05-30 13:48 - 00009216 _____ () C:\Program Files\ASUS\Splendid\GLCDdll.dll

2010-07-14 16:12 - 2010-07-14 16:12 - 00021120 _____ () C:\Program Files\P4G\DevMng.dll

2013-08-07 22:25 - 2013-08-07 22:25 - 00093696 _____ () C:\Program Files\FileZilla FTP Client\fzshellext.dll

2011-03-14 18:27 - 2011-03-14 18:27 - 00271712 _____ () C:\ProgramData\DatacardService\HWDeviceService.exe

2012-09-01 22:58 - 2011-03-04 06:41 - 00066856 _____ () C:\Program Files\Synaptics\SynTP\SynTPEnhPS.dll

2011-09-13 13:33 - 2011-09-13 13:33 - 01163264 _____ () C:\Program Files\ASUS\Wireless Console 3\acAuth.dll

2015-08-21 17:09 - 2015-08-21 17:09 - 00144896 _____ () C:\Users\Людмила\AppData\Local\Mail.Ru\GameCenter\zlib1.dll

2015-08-21 17:09 - 2015-08-21 17:09 - 00062464 _____ () C:\Users\Людмила\AppData\Local\Mail.Ru\GameCenter\pxd.dll

2015-08-21 17:09 - 2015-08-21 17:09 - 00179144 _____ () C:\Users\Людмила\AppData\Local\Mail.Ru\GameCenter\LightUpdate.dll

2015-08-21 17:09 - 2015-08-21 17:09 - 02419488 _____ () C:\Users\Людмила\AppData\Local\Mail.Ru\GameCenter\BigUp2.dll

2015-08-26 12:18 - 2015-08-26 12:18 - 50425344 _____ () C:\Users\Людмила\AppData\Local\Mail.Ru\GameCenter\Chrome\3.2454.1317\libcef.dll

2011-08-17 15:37 - 2011-08-17 15:37 - 00204800 _____ () C:\Program Files\asus\VirtualCamera\virtualCamera.ax

2015-09-14 16:43 - 2015-08-17 18:03 - 00397264 _____ () C:\Users\Людмила\AppData\Local\Yandex\YandexBrowser\Application\43.0.2357.2877\crash_service.exe

2015-09-14 16:43 - 2015-08-17 18:03 - 01282000 _____ () C:\Users\Людмила\AppData\Local\Yandex\YandexBrowser\Application\43.0.2357.2877\libglesv2.dll

2015-09-14 16:43 - 2015-08-17 18:03 - 00080848 _____ () C:\Users\Людмила\AppData\Local\Yandex\YandexBrowser\Application\43.0.2357.2877\libegl.dll

2015-09-14 16:43 - 2015-08-17 18:03 - 00310224 _____ () C:\Users\Людмила\AppData\Local\Yandex\YandexBrowser\Application\43.0.2357.2877\libexif.dll

2012-09-29 17:51 - 2012-09-29 17:52 - 00514560 _____ () C:\Program Files\MegaFon Modem\MegaFon Modem.exe

2012-09-29 17:51 - 2012-09-29 17:51 - 00413696 _____ () C:\Program Files\MegaFon Modem\core.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00270336 _____ () C:\Program Files\MegaFon Modem\sdk.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00011362 _____ () C:\Program Files\MegaFon Modem\mingwm10.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00043008 _____ () C:\Program Files\MegaFon Modem\libgcc_s_dw2-1.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 02415104 _____ () C:\Program Files\MegaFon Modem\QtCore4.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 09515520 _____ () C:\Program Files\MegaFon Modem\QtGui4.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00386048 _____ () C:\Program Files\MegaFon Modem\Proxy.DLL

2012-09-29 17:51 - 2012-09-29 17:51 - 00218624 _____ () C:\Program Files\MegaFon Modem\Common.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00135168 _____ () C:\Program Files\MegaFon Modem\Trace.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00545280 _____ () C:\Program Files\MegaFon Modem\PluginContainer.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00239104 _____ () C:\Program Files\MegaFon Modem\AtCodec.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00300544 _____ () C:\Program Files\MegaFon Modem\DeviceSrvPlugin.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00224256 _____ () C:\Program Files\MegaFon Modem\NetSrvPlugin.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00133632 _____ () C:\Program Files\MegaFon Modem\OSDialup.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00168960 _____ () C:\Program Files\MegaFon Modem\XCodec.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00157184 _____ () C:\Program Files\MegaFon Modem\DataServicePlugin.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00175616 _____ () C:\Program Files\MegaFon Modem\CallSrvPlugin.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00262656 _____ () C:\Program Files\MegaFon Modem\AddrBookSrvPlugin.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00218624 _____ () C:\Program Files\MegaFon Modem\SmsSrvPlugin.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00142336 _____ () C:\Program Files\MegaFon Modem\USSDSrvPlugin.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00157184 _____ () C:\Program Files\MegaFon Modem\STKSrvPlugin.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00123904 _____ () C:\Program Files\MegaFon Modem\ATR2SMgr.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00337408 _____ () C:\Program Files\MegaFon Modem\DeviceAppPlugin.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00065536 _____ () C:\Program Files\MegaFon Modem\OSPowerMgr.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00106496 _____ () C:\Program Files\MegaFon Modem\Win7Support.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 01084416 _____ () C:\Program Files\MegaFon Modem\AddrBookPlugin.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00673792 _____ () C:\Program Files\MegaFon Modem\SmsAppPlugin.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00556032 _____ () C:\Program Files\MegaFon Modem\CallAppPlugin.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00547328 _____ () C:\Program Files\MegaFon Modem\CallLogSrvPlugin.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00158720 _____ () C:\Program Files\MegaFon Modem\NetConnectSrvPlugin.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00211968 _____ () C:\Program Files\MegaFon Modem\DialUpPlugin.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00101888 _____ () C:\Program Files\MegaFon Modem\OSAdapt.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00178688 _____ () C:\Program Files\MegaFon Modem\NDISPlugin.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00131584 _____ () C:\Program Files\MegaFon Modem\OSNDIS.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 01101824 _____ () C:\Program Files\MegaFon Modem\NDISAPI.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00278528 _____ () C:\Program Files\MegaFon Modem\NetInfoSrvPlugin.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00062976 _____ () C:\Program Files\MegaFon Modem\OSCall.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00224256 _____ () C:\Program Files\MegaFon Modem\tdpcvoice.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00508928 _____ () C:\Program Files\MegaFon Modem\DeviceMgrUIPlugin.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00249344 _____ () C:\Program Files\MegaFon Modem\XFramePlugin.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00316928 _____ () C:\Program Files\MegaFon Modem\StatusBarMgrPlugin.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00366080 _____ () C:\Program Files\MegaFon Modem\NetConnectPlugin.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00097280 _____ () C:\Program Files\MegaFon Modem\NotifyServicePlugin.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00117248 _____ () C:\Program Files\MegaFon Modem\LayoutPlugin.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00419328 _____ () C:\Program Files\MegaFon Modem\DialupUIPlugin.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00804352 _____ () C:\Program Files\MegaFon Modem\MiniFramePlugin.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00398336 _____ () C:\Program Files\MegaFon Modem\QtXml4.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00263168 _____ () C:\Program Files\MegaFon Modem\MenuMgrPlugin.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00506880 _____ () C:\Program Files\MegaFon Modem\NetInfoUIExPlugin.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00855040 _____ () C:\Program Files\MegaFon Modem\SMSUIPlugin.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00869888 _____ () C:\Program Files\MegaFon Modem\AddrBookUIPlugin.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00497152 _____ () C:\Program Files\MegaFon Modem\USSDUIPlugin.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00269824 _____ () C:\Program Files\MegaFon Modem\LiveUpdateInterface.DLL

2012-09-29 17:51 - 2012-09-29 17:51 - 01148416 _____ () C:\Program Files\MegaFon Modem\QtNetwork4.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00082944 _____ () C:\Program Files\MegaFon Modem\plugins\imageformats\qgif4.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00081920 _____ () C:\Program Files\MegaFon Modem\plugins\imageformats\qico4.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00192000 _____ () C:\Program Files\MegaFon Modem\plugins\imageformats\qjpeg4.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00350720 _____ () C:\Program Files\MegaFon Modem\plugins\imageformats\qmng4.dll

2012-09-29 17:51 - 2012-09-29 17:51 - 00370176 _____ () C:\Program Files\MegaFon Modem\plugins\imageformats\qtiff4.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\Людмила\Local Settings:wa

AlternateDataStreams: C:\Users\Людмила\AppData\Local:wa

AlternateDataStreams: C:\Users\Людмила\AppData\Local\Application Data:wa

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-887322933-3475441419-2763790667-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Людмила\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

DNS Servers: 10.163.182.11 - 10.163.182.10

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)

Windows Firewall is disabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{CBEC79DF-D07E-4704-8B91-22BB6DACC28A}] => (Allow) C:\Program Files\Total Commander\Soft\uTorrent\utorrent.exe

FirewallRules: [{A2DD6744-FC0C-40ED-B50C-2F6BC7788AF7}] => (Allow) C:\Program Files\Total Commander\Soft\uTorrent\utorrent.exe

FirewallRules: [{6958A1EF-EA44-45CE-9F39-16CC45552224}] => (Allow) C:\Program Files\Opera\opera.exe

FirewallRules: [{22BA5B52-A43D-4494-B5C4-262E843A7F72}] => (Allow) C:\Program Files\Opera\opera.exe

FirewallRules: [{61457155-C831-46A6-8CF9-CC5A866CAC17}] => (Allow) C:\Program Files\AVG\AVG2012\avgmfapx.exe

FirewallRules: [{0BA84D0B-F45C-4A39-A154-47FE5536EEF7}] => (Allow) C:\Program Files\AVG\AVG2012\avgmfapx.exe

FirewallRules: [{EB2B3156-7615-4F5C-A030-ABBBC32A90EB}] => (Allow) C:\Users\Людмила\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe

FirewallRules: [{C3944C52-A92D-4DCB-9180-6A5EE581B1E3}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe

FirewallRules: [{53E7BECD-F1BB-48A1-BD14-262097C98D70}] => (Allow) C:\Program Files\Windows Live\Contacts\wlcomm.exe

FirewallRules: [{B30F92D0-1B50-434B-B79E-8C063F85B8C8}] => (Allow) LPort=2869

FirewallRules: [{1656755C-9CB4-45EB-972C-075A31DC1DF5}] => (Allow) LPort=1900

FirewallRules: [{01CBAB6A-D672-485F-A9C1-51A2E1A34879}] => (Allow) C:\Program Files\Windows Live\Messenger\msnmsgr.exe

FirewallRules: [{800BEF52-E6AA-4A05-8192-519E118707CC}] => (Allow) C:\Program Files\AVG\AVG2015\avgmfapx.exe

FirewallRules: [{E76D832E-73A8-4D37-90EB-6675CFCE443F}] => (Allow) C:\Program Files\AVG\AVG2015\avgmfapx.exe

FirewallRules: [{CBB53322-385D-4168-9FE7-918171B8FC5B}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe

FirewallRules: [{FF8669ED-494E-4F46-9CEE-6235EE4C6237}] => (Allow) C:\Users\Людмила\Downloads\360TS_Setup_Mini_RU_2002_1001.exe

FirewallRules: [{5EA1EFC5-CD05-420D-8542-1A08A1818544}] => (Allow) C:\Users\Людмила\Downloads\360TS_Setup_Mini_RU_2002_1001.exe

FirewallRules: [{BC942105-9893-4A6A-8863-92CEFF77AD74}] => (Allow) C:\Program Files\360\Total Security\LiveUpdate360.exe

FirewallRules: [{56501882-122A-4060-8049-5E705E99029D}] => (Allow) C:\Program Files\360\Total Security\LiveUpdate360.exe

FirewallRules: [{FE24BA98-B901-4897-A39A-50A8BFAAE5C9}] => (Allow) C:\Users\Людмила\AppData\Local\Yandex\YandexBrowser\Application\browser.exe

FirewallRules: [{7E46AF96-8F05-44E7-A5F5-4A5797D837BA}] => (Allow) C:\Program Files\360\Total Security\safemon\QHSafeTray.exe

FirewallRules: [{66A664C4-92CA-4304-A02A-D8590F814A29}] => (Allow) C:\Program Files\360\Total Security\safemon\QHSafeTray.exe

==================== Faulty Device Manager Devices =============

Name: Atheros AR9285 Wireless Network Adapter

Description: Atheros AR9285 Wireless Network Adapter

Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}

Manufacturer: Atheros Communications Inc.

Service: athr

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

==================== Event log errors: =========================

Application errors:

==================

Error: (09/16/2015 01:29:15 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)

Description: При выгрузке строк счетчиков производительности для службы WmiApRpl (WmiApRpl) произошел сбой. Первое двойное слово (DWORD) в секции данных содержит код ошибки.

Error: (09/16/2015 01:29:15 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)

Description: Строки производительности в значении реестра производительности были повреждены, когда выполнялась обработка поставщика расширенных счетчиков производительности Performance. Значение параметра BaseIndex из реестра производительности находится в первом двойном слове (DWORD) секции данных, значение LastCounter - во втором двойном слове (DWORD) секции данных, а значение LastHelp - в третьем двойном слове (DWORD) секции данных.

Error: (09/16/2015 01:29:15 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)

Description: Строки производительности в значении реестра производительности были повреждены, когда выполнялась обработка поставщика расширенных счетчиков производительности Performance. Значение параметра BaseIndex из реестра производительности находится в первом двойном слове (DWORD) секции данных, значение LastCounter - во втором двойном слове (DWORD) секции данных, а значение LastHelp - в третьем двойном слове (DWORD) секции данных.

Error: (09/16/2015 12:50:01 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)

Description: При выгрузке строк счетчиков производительности для службы WmiApRpl (WmiApRpl) произошел сбой. Первое двойное слово (DWORD) в секции данных содержит код ошибки.

Error: (09/16/2015 12:50:01 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)

Description: Строки производительности в значении реестра производительности были повреждены, когда выполнялась обработка поставщика расширенных счетчиков производительности Performance. Значение параметра BaseIndex из реестра производительности находится в первом двойном слове (DWORD) секции данных, значение LastCounter - во втором двойном слове (DWORD) секции данных, а значение LastHelp - в третьем двойном слове (DWORD) секции данных.

Error: (09/16/2015 12:50:01 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)

Description: Строки производительности в значении реестра производительности были повреждены, когда выполнялась обработка поставщика расширенных счетчиков производительности Performance. Значение параметра BaseIndex из реестра производительности находится в первом двойном слове (DWORD) секции данных, значение LastCounter - во втором двойном слове (DWORD) секции данных, а значение LastHelp - в третьем двойном слове (DWORD) секции данных.

Error: (09/15/2015 09:47:31 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)

Description: При выгрузке строк счетчиков производительности для службы WmiApRpl (WmiApRpl) произошел сбой. Первое двойное слово (DWORD) в секции данных содержит код ошибки.

Error: (09/15/2015 09:47:31 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)

Description: Строки производительности в значении реестра производительности были повреждены, когда выполнялась обработка поставщика расширенных счетчиков производительности Performance. Значение параметра BaseIndex из реестра производительности находится в первом двойном слове (DWORD) секции данных, значение LastCounter - во втором двойном слове (DWORD) секции данных, а значение LastHelp - в третьем двойном слове (DWORD) секции данных.

Error: (09/15/2015 09:47:31 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)

Description: Строки производительности в значении реестра производительности были повреждены, когда выполнялась обработка поставщика расширенных счетчиков производительности Performance. Значение параметра BaseIndex из реестра производительности находится в первом двойном слове (DWORD) секции данных, значение LastCounter - во втором двойном слове (DWORD) секции данных, а значение LastHelp - в третьем двойном слове (DWORD) секции данных.

Error: (09/15/2015 09:45:48 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)

Description: При выгрузке строк счетчиков производительности для службы WmiApRpl (WmiApRpl) произошел сбой. Первое двойное слово (DWORD) в секции данных содержит код ошибки.

System errors:

=============

Error: (09/15/2015 09:43:49 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Сбой при запуске службы "Windows Search" из-за ошибки

%%1053

Error: (09/15/2015 09:43:49 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: Превышение времени ожидания (30000 мс) при ожидании подключения службы "Windows Search".

Error: (09/15/2015 09:43:49 PM) (Source: DCOM) (EventID: 10005) (User: )

Description: 1053WSearch{9E175B6D-F52A-11D8-B9A5-505054503030}

Error: (09/15/2015 09:43:17 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Служба Windows Search была неожиданно завершена. Это произошло 1 раз(а). Следующее корректирующее действие будет предпринято через 30000 мсек: Перезапуск службы.

Error: (09/15/2015 09:43:17 PM) (Source: Service Control Manager) (EventID: 7024) (User: )

Description: Служба "Windows Search" завершена из-за внутренней ошибки %%-1073473535.

Error: (09/15/2015 09:42:49 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Сбой при запуске службы "HP SI Service" из-за ошибки

%%1053

Error: (09/15/2015 09:42:49 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: Превышение времени ожидания (30000 мс) при ожидании подключения службы "HP SI Service".

Error: (09/15/2015 09:42:08 PM) (Source: BugCheck) (EventID: 1001) (User: )

Description: 0x00000050 (0xd0c2cfda, 0x00000000, 0xa516b32b, 0x00000002)C:\Windows\MEMORY.DMP091515-28969-01

Error: (09/15/2015 09:42:03 PM) (Source: EventLog) (EventID: 6008) (User: )

Description: Предыдущее завершение работы системы в 21:40:50 на ?15.?09.?2015 было неожиданным.

Error: (09/15/2015 09:01:20 PM) (Source: Disk) (EventID: 11) (User: )

Description: Драйвер обнаружил ошибку контроллера \Device\Harddisk1\DR1.

==================== Memory info ===========================

Processor: Intel® Celeron® CPU B815 @ 1.60GHz

Percentage of memory in use: 67%

Total physical RAM: 2024.13 MB

Available physical RAM: 665.5 MB

Total Virtual: 4048.25 MB

Available Virtual: 2359.7 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:122.7 GB) (Free:63.81 GB) NTFS

Drive d: (D) (Fixed) (Total:175.3 GB) (Free:147.05 GB) NTFS

Drive f: (MegaFon Modem) (CDROM) (Total:0.07 GB) (Free:0 GB) CDFS

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 7C12E647)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=122.7 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=175.3 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

Сообщение от модератора Mark D. Pearlstone

Отчёты нужно прикреплять в том виде, в котором вас просят. Добавлен спойлер.

Все сделала как Вы сказали.

FRST.txt

Addition.txt

16 сентября, 2015

Логи в порядке.

С расшифровкой не поможем

16 сентября, 2015

И ЧТО МНЕ ТЕПЕРЬ ДЕЛАТЬ? У МЕНЯ ВСЕ ФАЛЫ ПОТИХОНЕЧКУ ПРОПАДАЮТ.

16 сентября, 2015

Что значит пропадают? Работающего шифровальщика в логах не видно

xtbl и ytbl

Рекомендуемые сообщения

Людмила13

Ссылка на комментарий

Поделиться на другие сайты

thyrex

Ссылка на комментарий

Поделиться на другие сайты

Людмила13

Ссылка на комментарий

Поделиться на другие сайты

thyrex

Ссылка на комментарий

Поделиться на другие сайты

Людмила13

Ссылка на комментарий

Поделиться на другие сайты

thyrex

Ссылка на комментарий

Поделиться на другие сайты

Пожалуйста, войдите, чтобы комментировать

Сайт

Активность

Магазин

Поддержка

Kaspersky Support Forum