Вирус блокирует AutoLogger

[regist]

 

 

Как все это убивать,панель управление или ревоанинсталер?

Как хотите и так и так можно.

 

 

D:\PROGRAM FILES\KPLAB\PARANOIA2 SAVIOR это компьютерная игра,я устанавливал.Удалю.

Если сами ставили, то можете не удалять.

 

 

какой именно игровой центр? там вроде 2,один мейл ру,а второй wargaming со всеми ихними ирами.оба убить?

Который от Mail.ru

И от mail.ru ещё чем-то пользуетесь?

И в браузере расширения от Яндекс сами ставили?

 

 

 

а Uplay это игровой портал для дорогих платных игр от Ubisoft его на всегда придеться удалить,или он поражен на данный момент?

Я же напротив него написал, что если сами не сами ставили. Так что раз ставили сами и нужен, то не удаляйте.

+ NiceHash Miner 2 0.1.11 - сами майнер ставили?

А также PandaViewer - сами поставили?

Если не сами, то деинсталируте их.

[Богдан1982]

в гугл хром ставил сам Steam Workshop Downloader,EX.ua без рекламы!,Ads Killer,AdBlock,Free Proxy to Unblock any sites | Touch VPN

для оперы  Adblock Plus DotVPN — a better way to VPN, 

 

Стараюсь не,чем мейловски м не пользоваться,разве,что то случайно пролезло.

Расширения и все связанное с яндексом не ставил,либо опять же были установлены случайно

в панели управления и рево по запросу яндекс. yand  мейл, mail нечего нету.

панду удалил, NiceHash я ставил,но тоже удалили на всякий случай)

[thyrex]

Теперь FRST тоже нормально не отрабатывает?

[regist]

Ответ ЛК по вашему карантину KLAN-7913674820:

Благодарим за обращение в Антивирусную Лабораторию

Присланные вами файлы были проверены в автоматическом режиме.

В следующих файлах обнаружен вредоносный код, определяемый продуктами с включенной технологией KSN:
0EMAJITD23O.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic
0EMAJITD23O.TMP._44ACCCBE6F8A8ECA82FB3F4A31328B2FA7B860DF - UDS:DangerousObject.Multi.Generic
1V3MEGKYRA2.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic
1V3MEGKYRA2.TMP._44ACCCBE6F8A8ECA82FB3F4A31328B2FA7B860DF - UDS:DangerousObject.Multi.Generic
2UJ5OF1G5R2.TMP._44ACCCBE6F8A8ECA82FB3F4A31328B2FA7B860DF - UDS:DangerousObject.Multi.Generic
3VPIKJZV2QC.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic
3VPIKJZV2QC.TMP._44ACCCBE6F8A8ECA82FB3F4A31328B2FA7B860DF - UDS:DangerousObject.Multi.Generic
3YTAQZ0HKXA.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic
3YTAQZ0HKXA.TMP._44ACCCBE6F8A8ECA82FB3F4A31328B2FA7B860DF - UDS:DangerousObject.Multi.Generic
4IVCJE25LMC.TMP._44ACCCBE6F8A8ECA82FB3F4A31328B2FA7B860DF - UDS:DangerousObject.Multi.Generic
53PQTKZKFNT.TMP._44ACCCBE6F8A8ECA82FB3F4A31328B2FA7B860DF - UDS:DangerousObject.Multi.Generic
5PQTW44QMFB.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic
5PQTW44QMFB.TMP._44ACCCBE6F8A8ECA82FB3F4A31328B2FA7B860DF - UDS:DangerousObject.Multi.Generic
AOENF0HTZEW.TMP._44ACCCBE6F8A8ECA82FB3F4A31328B2FA7B860DF - UDS:DangerousObject.Multi.Generic
D2YX03LNW14.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic
D2YX03LNW14.TMP._44ACCCBE6F8A8ECA82FB3F4A31328B2FA7B860DF - UDS:DangerousObject.Multi.Generic
FAQMIVLTC.EXE._8540E1CF29FF74A844B38344FB6057C4F9AE41FC - UDS:DangerousObject.Multi.Generic
FAQMIVLTC.TMP._F11BA968A5F555F95761498E96C659C8A64726F3 - UDS:DangerousObject.Multi.Generic
GRYNQFUENQL.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic
GRYNQFUENQL.TMP._44ACCCBE6F8A8ECA82FB3F4A31328B2FA7B860DF - UDS:DangerousObject.Multi.Generic
IA40TPOAS2M.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic
IA40TPOAS2M.TMP._44ACCCBE6F8A8ECA82FB3F4A31328B2FA7B860DF - UDS:DangerousObject.Multi.Generic
KVN5P425JRQ.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic
KVN5P425JRQ.TMP._44ACCCBE6F8A8ECA82FB3F4A31328B2FA7B860DF - UDS:DangerousObject.Multi.Generic
LBTNDKR4OH1.TMP._44ACCCBE6F8A8ECA82FB3F4A31328B2FA7B860DF - UDS:DangerousObject.Multi.Generic
MXL4XA2X5JR.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic
MXL4XA2X5JR.TMP._44ACCCBE6F8A8ECA82FB3F4A31328B2FA7B860DF - UDS:DangerousObject.Multi.Generic
NI8JOEAFK.EXE._8540E1CF29FF74A844B38344FB6057C4F9AE41FC - UDS:DangerousObject.Multi.Generic
NI8JOEAFK.TMP._F11BA968A5F555F95761498E96C659C8A64726F3 - UDS:DangerousObject.Multi.Generic
RFUOOOSG5VQ.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic
RFUOOOSG5VQ.TMP._44ACCCBE6F8A8ECA82FB3F4A31328B2FA7B860DF - UDS:DangerousObject.Multi.Generic
TYTHU0Y1JEC.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic
TYTHU0Y1JEC.TMP._44ACCCBE6F8A8ECA82FB3F4A31328B2FA7B860DF - UDS:DangerousObject.Multi.Generic
WEPSORARS.EXE._8540E1CF29FF74A844B38344FB6057C4F9AE41FC - UDS:DangerousObject.Multi.Generic
WEPSORARS.TMP._F11BA968A5F555F95761498E96C659C8A64726F3 - UDS:DangerousObject.Multi.Generic
XM3EFJ11FGM.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic
XM3EFJ11FGM.TMP._44ACCCBE6F8A8ECA82FB3F4A31328B2FA7B860DF - UDS:DangerousObject.Multi.Generic

В следующих файлах обнаружен вредоносный код:
0ODVZYYP3.EXE._0FCC2F36DF917E6F2DC130786D4D65D0CDAF02EB - HEUR:Trojan-Dropper.MSIL.Generic
3QF1EKIMW.EXE._0FCC2F36DF917E6F2DC130786D4D65D0CDAF02EB - HEUR:Trojan-Dropper.MSIL.Generic
717U0B6IL.EXE._0FCC2F36DF917E6F2DC130786D4D65D0CDAF02EB - HEUR:Trojan-Dropper.MSIL.Generic
7QP185YOP.EXE._0FCC2F36DF917E6F2DC130786D4D65D0CDAF02EB - HEUR:Trojan-Dropper.MSIL.Generic
7R2IZ1U9X.EXE._0FCC2F36DF917E6F2DC130786D4D65D0CDAF02EB - HEUR:Trojan-Dropper.MSIL.Generic
9BYTNGS31.EXE._0FCC2F36DF917E6F2DC130786D4D65D0CDAF02EB - HEUR:Trojan-Dropper.MSIL.Generic
TKP9ZV259.EXE._0FCC2F36DF917E6F2DC130786D4D65D0CDAF02EB - HEUR:Trojan-Dropper.MSIL.Generic
U2V3R2O8Y.EXE._0FCC2F36DF917E6F2DC130786D4D65D0CDAF02EB - HEUR:Trojan-Dropper.MSIL.Generic
UNINSTALLER.EXE._0738533D1FA01816FD5C7C46C0DA3FA4A8664F50 - HEUR:Trojan-Dropper.MSIL.Generic
UP.EXE._EFD5370EF483C7F0FD2D4FB54696B90D46F64343 - HEUR:Trojan-Dropper.MSIL.Generic

В перечисленных файлах обнаружена программа Adware, предназначенная для показа рекламных сообщений:
NVZJRKEFCEXFY.DLL._7A5C3B342F061C58D0CC7BA0F4CC2513AC04A165 - not-a-virus:HEUR:AdWare.Win32.Generic
VJKFEF.DLL._1B509F8145256B4B93C02121F0FBA85763BA1230 - not-a-virus:HEUR:AdWare.Win32.Generic

В антивирусных базах информация по присланным вами файлам отсутствует:
NVZJRKEFCEXFY.DLL._7A5C3B342F061C58D0CC7BA0F4CC2513AC04A165.txt
REAIR.DLL._30AB2E01D4589D0C12857BBCD35C088067C3B312
REAIR.DLL._30AB2E01D4589D0C12857BBCD35C088067C3B312.txt
UP.EXE._EFD5370EF483C7F0FD2D4FB54696B90D46F64343.txt

 

1)

• Закройте все программы, временно выгрузите антивирус, файрволл и прочее защитное ПО
• .

• Откройте папку с распакованной утилитой uVS и запустите файл start.exe. В открывшимся окне выберите пункт "Запустить под текущим пользователем".
• Выделите и правой кнопкой мыши скопируйте следующий скрипт в буфер обмена:
  

  ;uVS v4.0.11 [http://dsrt.dyndns.org]
  ;Target OS: NTv6.1
  v400c
  BREG
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\ARCOVPKXDBG\0ICDOZKB5JH.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\ARCOVPKXDBG\0ICDOZKB5JH.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\3GHCQWKUTXL\2AGTHRDJX21.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\3GHCQWKUTXL\2AGTHRDJX21.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\KBQ4QRNOGHX\34XNDIZYG3U.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\KBQ4QRNOGHX\34XNDIZYG3U.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\2ODL3FV1ACG\3HX4W1B1NYK.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\2ODL3FV1ACG\3HX4W1B1NYK.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\TATY4FO2ADX\3PJFVJGPH34.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\TATY4FO2ADX\3PJFVJGPH34.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\SYFVS1VGIQ1\3XKE52DN2OV.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\SYFVS1VGIQ1\3XKE52DN2OV.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\IGYLENXOBAY\4XPYT5OOPAR.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\IGYLENXOBAY\4XPYT5OOPAR.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\1MHOL2YSPCJ\5ZIBVRCQ03P.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\1MHOL2YSPCJ\5ZIBVRCQ03P.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\ICFSBNZUKAW\AB1B33OIBDZ.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\ICFSBNZUKAW\AB1B33OIBDZ.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\A4VMFGVY2QJ\AOIZKMY4QBR.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\A4VMFGVY2QJ\AOIZKMY4QBR.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\XPOS0HE03VM\B0YAZY3RQGU.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\XPOS0HE03VM\B0YAZY3RQGU.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\5P4NV200BQ0\BD0IICXDFYE.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\5P4NV200BQ0\BD0IICXDFYE.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\ZSFG3OOP55R\BIVTKSCN5LL.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\ZSFG3OOP55R\BIVTKSCN5LL.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\SRSDJSYANCB\BSL44XHD0UO.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\SRSDJSYANCB\BSL44XHD0UO.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\3OIDMPVVCRN\CC1OPVMXV1M.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\3OIDMPVVCRN\CC1OPVMXV1M.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\EQQXM1UAK3A\CL2HC5WD5RO.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\EQQXM1UAK3A\CL2HC5WD5RO.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\BYK0OCH1SMB\DHI10MTFBKY.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\BYK0OCH1SMB\DHI10MTFBKY.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\A5GBCPAQEOB\F5E3LA014Q3.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\A5GBCPAQEOB\F5E3LA014Q3.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\1P3DGAHOSOP\FP0ZBVTKZEM.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\1P3DGAHOSOP\FP0ZBVTKZEM.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\OGNB1DKPRBV\FQUIVSQ2Q5Q.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\OGNB1DKPRBV\FQUIVSQ2Q5Q.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\ZGLXBVKR2ZX\GJD04KHIMBD.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\ZGLXBVKR2ZX\GJD04KHIMBD.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\ZSR3QBOKMIX\HMFH5513QHX.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\ZSR3QBOKMIX\HMFH5513QHX.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\YMZDFGQ4FMP\HYHQZEJLEFK.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\YMZDFGQ4FMP\HYHQZEJLEFK.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\V2EE13TKCII\I3C1WTAEQVV.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\V2EE13TKCII\I3C1WTAEQVV.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\PMYVJMFAHZT\IRGVFHYK5EM.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\PMYVJMFAHZT\IRGVFHYK5EM.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\NJLFM5QVUMG\JV1TQINWMEA.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\NJLFM5QVUMG\JV1TQINWMEA.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\2L5BVHMNYKZ\JVF4FJOQNXO.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\2L5BVHMNYKZ\JVF4FJOQNXO.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\IK53RDCPKSF\MZ4FOOKYUXN.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\IK53RDCPKSF\MZ4FOOKYUXN.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\GARNPYXMYXD\NIVFH3ZED1Q.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\GARNPYXMYXD\NIVFH3ZED1Q.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\U12DNSGFAPR\OELNEVWX3UG.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\U12DNSGFAPR\OELNEVWX3UG.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\L4GC1KTF5NJ\OJ51FB0OGYR.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\L4GC1KTF5NJ\OJ51FB0OGYR.EXE
  delref %SystemDrive%\USERS\USER\APPDATA\ROAMING\ZGN02YCGNBY\PYWAZOUZR4Z.EXE
  delref %SystemDrive%\USERS\USER\APPDATA\ROAMING\4SS5YVWIJRV\QHIGQHFTFTH.EXE
  delref %SystemDrive%\USERS\USER\APPDATA\ROAMING\ZPBRYTIBD4I\QKYCNWNA3RS.EXE
  delref %SystemDrive%\USERS\USER\APPDATA\ROAMING\4T20S5J2PZY\RJA13CIXM4M.EXE
  delref %SystemDrive%\USERS\USER\APPDATA\ROAMING\FJTOXM1JJVB\SAUZE54GEED.EXE
  delref %SystemDrive%\USERS\USER\APPDATA\ROAMING\D21CJR0VLTR\TFZ5FBAW2MG.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\1O4H3O5M5TX\TMC203JSDQI.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\1O4H3O5M5TX\TMC203JSDQI.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\ESSKTCYQMVV\TOSHMWZXKJI.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\ESSKTCYQMVV\TOSHMWZXKJI.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\VKVKLWQ2QWO\UPP0J1LUKZ4.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\VKVKLWQ2QWO\UPP0J1LUKZ4.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\ILTTA4POSGD\V5P2SQLA0R2.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\ILTTA4POSGD\V5P2SQLA0R2.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\35HBQ1T1IXQ\WKYPM4F053E.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\35HBQ1T1IXQ\WKYPM4F053E.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\HF1VU3KNMTR\XCIKSRNPF4N.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\HF1VU3KNMTR\XCIKSRNPF4N.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\KZ4RONDUR24\XOIP3KON5DU.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\KZ4RONDUR24\XOIP3KON5DU.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\SFDQBIPOYGU\YSOWFW5SK5Z.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\SFDQBIPOYGU\YSOWFW5SK5Z.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\BFLGQI4QUV0\ZHERTFR5ZMN.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\BFLGQI4QUV0\ZHERTFR5ZMN.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\GVRKM0WQ20C\ZOHVSCTVW3X.EXE
  delall %SystemDrive%\USERS\USER\APPDATA\ROAMING\GVRKM0WQ20C\ZOHVSCTVW3X.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\LFF20IKXWTT\LF345L2YSL5.EXE
  bl C76D5EE1A333F4869DEF54BB1E41CFA7 531350
  addsgn A7679B1991AE1F245CE76E3821389B40F962D2707605F74D1D3C3A54CC4D8EB3CBA05CA8C1BDCBF6D47F6C72AEE9B6122935178D661AE54444C6E42FA3F91217 19 Win32/Adware.Agent.NSU [ESET-NOD32] 7
  
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\MTBRMOY3RMZ\KVPG1Q0DCGN.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\LOCAL\TEMP\IS-3FQHI.TMP\EKMZ2TK240T.TMP
  bl BAB0134180127E04322F368DEBE06FC6 709632
  addsgn A7679B19919E1F245C3C083F9237FAF8947C031EC545E9876DA4064AAF3E9BB4D5E82BAA58A262A14BE97360AEA1C10D8237229DA22558E9838F5BC71F50DB8C 64 UDS:DangerousObject.Multi.Generic 7
  
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\03MFJPE4HVB\C5AAWVTBVYM.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\B3ZTIWUK1IF\5FVSPNTU3IX.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\MHN3TVJ2SQ4\IRAJCRLNJBA.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\HG2JFM05TU3\EKMZ2TK240T.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\LOCAL\TEMP\IS-1SAP4.TMP\5FVSPNTU3IX.TMP
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\Z4AXTR3O0WZ\FO3VDY0FPRJ.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\LOCAL\TEMP\IS-4BMHN.TMP\IRAJCRLNJBA.TMP
  zoo %SystemDrive%\USERS\USER\APPDATA\LOCAL\TEMP\IS-3FQHH.TMP\FO3VDY0FPRJ.TMP
  zoo %SystemDrive%\USERS\USER\APPDATA\LOCAL\TEMP\IS-4BMHO.TMP\KVPG1Q0DCGN.TMP
  zoo %SystemDrive%\USERS\USER\APPDATA\LOCAL\TEMP\IS-L9MLV.TMP\C5AAWVTBVYM.TMP
  zoo %SystemDrive%\USERS\USER\APPDATA\LOCAL\TEMP\IS-H2ISU.TMP\LF345L2YSL5.TMP
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\JIKGXJCFMTE\MTGTQETODXF.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\LOCAL\TEMP\IS-5ESQ9.TMP\MTGTQETODXF.TMP
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\RY22ICGRKF3\FPJE53XMBAP.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\MJYQO4QCQRR\PFTSR52VGY2.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\DALHY1XZZDW\KQW3THF4NFG.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\JX5HBKM4C2H\S1WKP5U0PLM.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\LOCAL\TEMP\IS-3I31V.TMP\FPJE53XMBAP.TMP
  zoo %SystemDrive%\USERS\USER\APPDATA\LOCAL\TEMP\IS-4K529.TMP\PFTSR52VGY2.TMP
  zoo %SystemDrive%\USERS\USER\APPDATA\LOCAL\TEMP\IS-1HDPI.TMP\KQW3THF4NFG.TMP
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\C30SC5DRG2Y\T1KFOTEVYS2.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\FITP3MBMTFS\KXTB0NBDTFX.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\4SUXDJFC5OU\E3T42L15J4V.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\LOCAL\TEMP\IS-UEMGQ.TMP\T1KFOTEVYS2.TMP
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\YKCW3KM1LSV\4ODZLOKS1FM.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\LOCAL\TEMP\IS-2AV9P.TMP\S1WKP5U0PLM.TMP
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\LVIXRAXY55F\C3CRLZ030SZ.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\SXUA3AQPCSC\JLEARK3DY34.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\WOTIWQOMVAW\5BNVZQHTK4E.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\LOCAL\TEMP\IS-9783J.TMP\E3T42L15J4V.TMP
  zoo %SystemDrive%\USERS\USER\APPDATA\LOCAL\TEMP\IS-8UNJH.TMP\KXTB0NBDTFX.TMP
  zoo %SystemDrive%\USERS\USER\APPDATA\LOCAL\TEMP\IS-3CKI6.TMP\C3CRLZ030SZ.TMP
  zoo %SystemDrive%\USERS\USER\APPDATA\LOCAL\TEMP\IS-VI9H9.TMP\JLEARK3DY34.TMP
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\YSUPXOGQICI\FLF4YHB0AXM.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\LOCAL\TEMP\IS-JGME9.TMP\5BNVZQHTK4E.TMP
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\DIRKEDSPNNQ\I0VIUQ1KTAX.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\CALSYMVZAFT\CLNLLMKOVND.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\LOCAL\TEMP\IS-9NSBR.TMP\4ODZLOKS1FM.TMP
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\W2YDCYL24LX\JPG2YC3VKS1.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\LOCAL\TEMP\IS-0QHHM.TMP\FLF4YHB0AXM.TMP
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\B2HWD5PMNIW\SUZGVOU0MYV.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\LOCAL\TEMP\IS-FFBTE.TMP\I0VIUQ1KTAX.TMP
  zoo %SystemDrive%\USERS\USER\APPDATA\LOCAL\TEMP\IS-LSU72.TMP\CLNLLMKOVND.TMP
  zoo %SystemDrive%\USERS\USER\APPDATA\LOCAL\TEMP\IS-CGSSO.TMP\SUZGVOU0MYV.TMP
  zoo %SystemDrive%\USERS\USER\APPDATA\LOCAL\TEMP\IS-F26DD.TMP\JPG2YC3VKS1.TMP
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\AJJVKEAYCZJ\ESHZLRYGULS.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\D1HZBZIVZVX\W5NCF3FAYDW.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\LOCAL\TEMP\IS-70NJF.TMP\ESHZLRYGULS.TMP
  zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\3UJQGTII4JO\JJ0H43A3LAF.EXE
  zoo %SystemDrive%\USERS\USER\APPDATA\LOCAL\TEMP\IS-O0LFP.TMP\W5NCF3FAYDW.TMP
  zoo %SystemDrive%\USERS\USER\APPDATA\LOCAL\TEMP\IS-3U0AO.TMP\JJ0H43A3LAF.TMP
  chklst
  delvir
  
  dirzooex %SystemDrive%\PROGRAM FILES\1HKOWUVZTO
  zoo %SystemDrive%\PROGRAM FILES\LHUL05FN2U\Y61084LO2.EXE
  delall %SystemDrive%\PROGRAM FILES\LHUL05FN2U\Y61084LO2.EXE
  zoo %SystemDrive%\PROGRAM FILES\YD3FEH779S\YD3FEH779.EXE
  delall %SystemDrive%\PROGRAM FILES\YD3FEH779S\YD3FEH779.EXE
  zoo %SystemDrive%\PROGRAM FILES\YJS8N6739L\YJS8N6739.EXE
  delall %SystemDrive%\PROGRAM FILES\YJS8N6739L\YJS8N6739.EXE
  zoo %SystemDrive%\PROGRAM FILES\EZB67YY1FX\YR57F10M8.EXE
  delall %SystemDrive%\PROGRAM FILES\EZB67YY1FX\YR57F10M8.EXE
  zoo %SystemDrive%\PROGRAM FILES\8NNDY2AIHE\ZJ51688M4.EXE
  delall %SystemDrive%\PROGRAM FILES\8NNDY2AIHE\ZJ51688M4.EXE
  delref D:\PROGRAM FILES (X86)\AKELLA GAMES\ЗОНА\ZONA.EXE
  zoo %SystemDrive%\PROGRAM FILES\SH0S49A9SW\SH0S49A9S.EXE
  delall %SystemDrive%\PROGRAM FILES\SH0S49A9SW\SH0S49A9S.EXE
  zoo %SystemDrive%\PROGRAM FILES\ISU01V8GYZ\SH8OH386E.EXE
  delall %SystemDrive%\PROGRAM FILES\ISU01V8GYZ\SH8OH386E.EXE
  delref $2001C,268298,53760,C:\USERS\USER\APPDATA\ROAMING\JIKGXJCFMTE\MTGTQETODXF.EXE
  delref $301C0,268298,53760,C:\USERS\USER\APPDATA\ROAMING\MJYQO4QCQRR\PFTSR52VGY2.EXE
  delref $1022C,268298,53760,C:\USERS\USER\APPDATA\ROAMING\JX5HBKM4C2H\S1WKP5U0PLM.EXE
  delref $1013E,268298,53760,C:\USERS\USER\APPDATA\ROAMING\MHN3TVJ2SQ4\IRAJCRLNJBA.EXE
  delref $10140,268298,53760,C:\USERS\USER\APPDATA\ROAMING\03MFJPE4HVB\C5AAWVTBVYM.EXE
  delref $10142,268298,53760,C:\USERS\USER\APPDATA\ROAMING\MTBRMOY3RMZ\KVPG1Q0DCGN.EXE
  delref $10144,268298,53760,C:\USERS\USER\APPDATA\ROAMING\Z4AXTR3O0WZ\FO3VDY0FPRJ.EXE
  delref $1014A,268298,53760,C:\USERS\USER\APPDATA\ROAMING\HG2JFM05TU3\EKMZ2TK240T.EXE
  delref $1014C,268298,53760,C:\USERS\USER\APPDATA\ROAMING\B3ZTIWUK1IF\5FVSPNTU3IX.EXE
  delref $10156,268298,53760,C:\USERS\USER\APPDATA\ROAMING\LFF20IKXWTT\LF345L2YSL5.EXE
  delref $1021A,268298,53760,C:\USERS\USER\APPDATA\ROAMING\C30SC5DRG2Y\T1KFOTEVYS2.EXE
  delref $1023A,268298,53760,C:\USERS\USER\APPDATA\ROAMING\4SUXDJFC5OU\E3T42L15J4V.EXE
  delref $1024C,268298,53760,C:\USERS\USER\APPDATA\ROAMING\FITP3MBMTFS\KXTB0NBDTFX.EXE
  delref $1027A,268298,53760,C:\USERS\USER\APPDATA\ROAMING\LVIXRAXY55F\C3CRLZ030SZ.EXE
  delref $1028E,268298,53760,C:\USERS\USER\APPDATA\ROAMING\WOTIWQOMVAW\5BNVZQHTK4E.EXE
  delref $10290,268298,53760,C:\USERS\USER\APPDATA\ROAMING\SXUA3AQPCSC\JLEARK3DY34.EXE
  delref $102AA,268298,53760,C:\USERS\USER\APPDATA\ROAMING\YKCW3KM1LSV\4ODZLOKS1FM.EXE
  delref $102CE,268298,53760,C:\USERS\USER\APPDATA\ROAMING\YSUPXOGQICI\FLF4YHB0AXM.EXE
  delref $102EC,268298,53760,C:\USERS\USER\APPDATA\ROAMING\DIRKEDSPNNQ\I0VIUQ1KTAX.EXE
  delref $10304,268298,53760,C:\USERS\USER\APPDATA\ROAMING\CALSYMVZAFT\CLNLLMKOVND.EXE
  delref $10394,268298,53760,C:\USERS\USER\APPDATA\ROAMING\D1HZBZIVZVX\W5NCF3FAYDW.EXE
  delref $10398,268298,53760,C:\USERS\USER\APPDATA\ROAMING\3UJQGTII4JO\JJ0H43A3LAF.EXE
  delref $201EC,268298,53760,C:\USERS\USER\APPDATA\ROAMING\DALHY1XZZDW\KQW3THF4NFG.EXE
  delref $2031A,268298,53760,C:\USERS\USER\APPDATA\ROAMING\B2HWD5PMNIW\SUZGVOU0MYV.EXE
  delref $20322,268298,53760,C:\USERS\USER\APPDATA\ROAMING\W2YDCYL24LX\JPG2YC3VKS1.EXE
  delref $2033C,268298,53760,C:\USERS\USER\APPDATA\ROAMING\AJJVKEAYCZJ\ESHZLRYGULS.EXE
  delref $301BE,268298,53760,C:\USERS\USER\APPDATA\ROAMING\RY22ICGRKF3\FPJE53XMBAP.EXE
  delref HTTP://WAIT3SEC.ORG/ADULTDATING
  delref HTTP://WAIT3SEC.ORG/CROSSOUT
  delref HTTP://WAIT3SEC.ORG/IPHONEX
  delref HTTP://WAIT3SEC.ORG/NEVERWINTER
  delref HTTP://WAIT3SEC.ORG/WARCIS
  delref HTTP://WAIT3SEC.ORG/WARFRAMEWW
  delref HTTP://WAIT3SEC.ORG/WORLDOFTANKS
  delref HTTP://WAIT3SEC.ORG/WOWARSHIPS
  delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DBEJNPNKHFGFKCPGIKIINOJLMDCJIMOBI%26INSTALLSOURCE%3DONDEMAND%26UC
  zoo %SystemDrive%\PROGRAM FILES\1KZRZZEYNY\1KZRZZEYN.EXE
  delall %SystemDrive%\PROGRAM FILES\1KZRZZEYNY\1KZRZZEYN.EXE
  zoo %SystemDrive%\PROGRAM FILES\29P34VJQOU\08WCC4EE5.EXE
  delall %SystemDrive%\PROGRAM FILES\29P34VJQOU\08WCC4EE5.EXE
  zoo %SystemDrive%\PROGRAM FILES\2B7H20IW50\NL7B296JO.EXE
  delall %SystemDrive%\PROGRAM FILES\2B7H20IW50\NL7B296JO.EXE
  zoo %SystemDrive%\PROGRAM FILES\NM7KNIN7ZU\NM7KNIN7Z.EXE
  delall %SystemDrive%\PROGRAM FILES\NM7KNIN7ZU\NM7KNIN7Z.EXE
  delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\MAIL.RU\GAMECENTER\NPDETECTOR.DLL
  delref %SystemDrive%\USERS\USER\APPDATA\ROAMING\RAIDCALL\PLUGINS\NPRCPLUGIN.DLL
  zoo %SystemDrive%\PROGRAM FILES\K6R6EAF4LX\K6R6EAF4L.EXE
  delall %SystemDrive%\PROGRAM FILES\K6R6EAF4LX\K6R6EAF4L.EXE
  zoo %SystemDrive%\PROGRAM FILES\0IGE1UFS5R\MSH8043FN.EXE
  delall %SystemDrive%\PROGRAM FILES\0IGE1UFS5R\MSH8043FN.EXE
  zoo %SystemDrive%\PROGRAM FILES\R3DE91P48B\R3DE91P48.EXE
  delall %SystemDrive%\PROGRAM FILES\R3DE91P48B\R3DE91P48.EXE
  zoo %SystemDrive%\PROGRAM FILES\EE6Z02J38F\R3DE91P48.EXE
  delall %SystemDrive%\PROGRAM FILES\EE6Z02J38F\R3DE91P48.EXE
  zoo %SystemDrive%\PROGRAM FILES\Y61084LO2R\SLI708B7X.EXE
  delall %SystemDrive%\PROGRAM FILES\Y61084LO2R\SLI708B7X.EXE
  zoo %SystemDrive%\PROGRAM FILES\SLI708B7XA\SLI708B7X.EXE
  delall %SystemDrive%\PROGRAM FILES\SLI708B7XA\SLI708B7X.EXE
  zoo %SystemDrive%\PROGRAM FILES\B2AUMGD88O\B2AUMGD88.EXE
  delall %SystemDrive%\PROGRAM FILES\B2AUMGD88O\B2AUMGD88.EXE
  zoo %SystemDrive%\PROGRAM FILES\12QS74ZIGD\12QS74ZIG.EXE
  delall %SystemDrive%\PROGRAM FILES\12QS74ZIGD\12QS74ZIG.EXE
  zoo %SystemDrive%\PROGRAM FILES\R9FTEEBOFC\4YM8MDHOE.EXE
  delall %SystemDrive%\PROGRAM FILES\R9FTEEBOFC\4YM8MDHOE.EXE
  zoo %SystemDrive%\PROGRAM FILES\LHIDUHZR5K\5ACE2K2CY.EXE
  delall %SystemDrive%\PROGRAM FILES\LHIDUHZR5K\5ACE2K2CY.EXE
  zoo %SystemDrive%\PROGRAM FILES\6ZFYE4N0W2\6ZFYE4N0W.EXE
  delall %SystemDrive%\PROGRAM FILES\6ZFYE4N0W2\6ZFYE4N0W.EXE
  zoo %SystemDrive%\PROGRAM FILES\7E2CAC84HN\7E2CAC84H.EXE
  delall %SystemDrive%\PROGRAM FILES\7E2CAC84HN\7E2CAC84H.EXE
  zoo %SystemDrive%\PROGRAM FILES\8DR092IT0J\8DR092IT0.EXE
  delall %SystemDrive%\PROGRAM FILES\8DR092IT0J\8DR092IT0.EXE
  zoo %SystemDrive%\PROGRAM FILES\WPBVB18W50\9EHAJ1EX4.EXE
  delall %SystemDrive%\PROGRAM FILES\WPBVB18W50\9EHAJ1EX4.EXE
  zoo %SystemDrive%\PROGRAM FILES\9P4XJZ2PP4\9P4XJZ2PP.EXE
  delall %SystemDrive%\PROGRAM FILES\9P4XJZ2PP4\9P4XJZ2PP.EXE
  zoo %SystemDrive%\PROGRAM FILES\9TA49ANQW7\9TA49ANQW.EXE
  delall %SystemDrive%\PROGRAM FILES\9TA49ANQW7\9TA49ANQW.EXE
  zoo %SystemDrive%\PROGRAM FILES\U28CXCO0T1\U28CXCO0T.EXE
  delall %SystemDrive%\PROGRAM FILES\U28CXCO0T1\U28CXCO0T.EXE
  delref D:\ТАНКИ\WORLD_OF_TANKS\WGC_API.EXE
  delref D:\PROGRAM FILES (X86)\CAMELOT SYSTEMS\ARSENAL III\UNWISE.EXE
  delref D:\PROGRAM FILES (X86)\AKELLA GAMES\ЗОНА\UNINSTALL.EXE
  zoo %SystemDrive%\PROGRAM FILES\YYC61MJ0FQ\BNIL9LP1E.EXE
  delall %SystemDrive%\PROGRAM FILES\YYC61MJ0FQ\BNIL9LP1E.EXE
  delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\CHROME\APPLICATION\58.0.3029.81\INSTALLER\CHRMSTP.EXE
  delref D:\PROGRAM FILES (X86)\CHICAGO1930\CHICAGO 1930.EXE
  delref G:\K3G_SETUP.EXE
  delref E:\SETUP.EXE
  delref D:\GAMES\PANZAR\START.EXE
  delref %SystemDrive%\PROGRAM FILES (X86)\MIPED\QWIGET\THIS IS WIIIGET!.EXE
  zoo %SystemDrive%\PROGRAM FILES\J57ASUJDMR\J57ASUJDM.EXE
  delall %SystemDrive%\PROGRAM FILES\J57ASUJDMR\J57ASUJDM.EXE
  zoo %SystemDrive%\PROGRAM FILES\6WEOV15KYC\JLL330BLY.EXE
  delall %SystemDrive%\PROGRAM FILES\6WEOV15KYC\JLL330BLY.EXE
  zoo %SystemDrive%\PROGRAM FILES\JUFUHSGVUM\JUFUHSGVU.EXE
  delall %SystemDrive%\PROGRAM FILES\JUFUHSGVUM\JUFUHSGVU.EXE
  zoo %SystemDrive%\PROGRAM FILES\JV3N9Y2QJJ\JV3N9Y2QJ.EXE
  delall %SystemDrive%\PROGRAM FILES\JV3N9Y2QJJ\JV3N9Y2QJ.EXE
  zoo %SystemDrive%\PROGRAM FILES\IKDHTRI3ZV\IKDHTRI3Z.EXE
  delall %SystemDrive%\PROGRAM FILES\IKDHTRI3ZV\IKDHTRI3Z.EXE
  delref D:\PROGRAM FILES (X86)\ACTIVISION\RIOT POLICE\RPOLICE.EXE
  delref D:\PROGRAM FILES (X86)\ACTIVISION\RIOT POLICE\RPOLICERUS.EXE
  delref D:\MOP030B\POSTAL 2 + APOCALYPSE WEEKEND + ШТОПОР ЖЖ0Т!\SYSTEM\POSTAL2.EXE
  delref D:\MOP030B\POSTAL 2 + APOCALYPSE WEEKEND + ШТОПОР ЖЖ0Т!\APOCALYPSEWEEKEND\SYSTEM\POSTAL2.EXE
  zoo %SystemDrive%\PROGRAM FILES\GL24Y5BYY9\GL24Y5BYY.EXE
  delall %SystemDrive%\PROGRAM FILES\GL24Y5BYY9\GL24Y5BYY.EXE
  zoo %SystemDrive%\PROGRAM FILES\D23KE7JKRH\D23KE7JKR.EXE
  delall %SystemDrive%\PROGRAM FILES\D23KE7JKRH\D23KE7JKR.EXE
  delref D:\GAMES\THE SETTLERS 7 - PATHS TO A KINGDOM\DATA\BASE\_DBG\BIN\RELEASE\ORBIT\NPUPLAYPC.DLL
  zoo %SystemDrive%\PROGRAM FILES\S9R87G5G1Z\S9R87G5G1.EXE
  delall %SystemDrive%\PROGRAM FILES\S9R87G5G1Z\S9R87G5G1.EXE
  deldir %SystemDrive%\PROGRAM FILES\1HKOWUVZTO
  dirzoo %SystemDrive%\PROGRAM FILES\ZY8T7S114N
  deldir %SystemDrive%\PROGRAM FILES\ZY8T7S114N
  dirzooex %SystemDrive%\PROGRAM FILES\AL11OOXU6X
  deldir %SystemDrive%\PROGRAM FILES\AL11OOXU6X
  dirzooex %SystemDrive%\PROGRAM FILES\C2BEZVYV6Y
  deldir %SystemDrive%\PROGRAM FILES\C2BEZVYV6Y
  dirzooex %SystemDrive%\PROGRAM FILES (X86)\VJLJMRATOAUN
  deldir %SystemDrive%\PROGRAM FILES (X86)\VJLJMRATOAUN
  dirzooex %SystemDrive%\PROGRAM FILES\HNKPJOO04S
  deldir %SystemDrive%\\PROGRAMDATA\\VOYASOLLAMS
  bl 23C4754F6B2D4CE27832692AA584B1EC 666624
  deldir %SystemDrive%\PROGRAM FILES\HNKPJOO04S
  dirzooex %SystemDrive%\PROGRAM FILES\NA8GWN3V5T
  deldir D:\PROGRAM FILES\MOVAVI VIDEO EDITOR 14
  deldir %SystemDrive%\PROGRAM FILES\NA8GWN3V5T
  deldir %SystemDrive%\PROGRAM FILES\J5Z1ZYUF0E
  deldir %SystemDrive%\PROGRAM FILES\Q9NNZ1QYUT
  ;---------command-block---------
  zoo %SystemDrive%\PROGRAM FILES\QUQHFYZ5RE\RCWA75L8G.EXE
  delall %SystemDrive%\PROGRAM FILES\QUQHFYZ5RE\RCWA75L8G.EXE
  zoo %SystemDrive%\PROGRAM FILES\SRW6U92X9R\SRW6U92X9.EXE
  delall %SystemDrive%\PROGRAM FILES\SRW6U92X9R\SRW6U92X9.EXE
  zoo %SystemDrive%\PROGRAM FILES\UEW2WQZFZ9\UEW2WQZFZ.EXE
  delall %SystemDrive%\PROGRAM FILES\UEW2WQZFZ9\UEW2WQZFZ.EXE
  zoo %SystemDrive%\PROGRAM FILES\YO3K5YCF1M\YO3K5YCF1.EXE
  delall %SystemDrive%\PROGRAM FILES\YO3K5YCF1M\YO3K5YCF1.EXE
  bl 2055EA32C1621835906E67902E34B288 666112
  zoo %SystemDrive%\PROGRAM FILES\37JS8EQGFE\37JS8EQGF.EXE
  delall %SystemDrive%\PROGRAM FILES\37JS8EQGFE\37JS8EQGF.EXE
  zoo %SystemDrive%\PROGRAM FILES\90V49TPJ5Q\90V49TPJ5.EXE
  delall %SystemDrive%\PROGRAM FILES\90V49TPJ5Q\90V49TPJ5.EXE
  zoo %SystemDrive%\PROGRAM FILES\932AZ4ALDT\DORDFAERZ.EXE
  delall %SystemDrive%\PROGRAM FILES\932AZ4ALDT\DORDFAERZ.EXE
  zoo %SystemDrive%\PROGRAM FILES\IBPUHAXIW5\IBPUHAXIW.EXE
  delall %SystemDrive%\PROGRAM FILES\IBPUHAXIW5\IBPUHAXIW.EXE
  zoo %SystemDrive%\PROGRAM FILES\L6WG4DTU54\L6WG4DTU5.EXE
  delall %SystemDrive%\PROGRAM FILES\L6WG4DTU54\L6WG4DTU5.EXE
  zoo %SystemDrive%\PROGRAM FILES\WEVVR54KDX\WEVVR54KD.EXE
  delall %SystemDrive%\PROGRAM FILES\WEVVR54KDX\WEVVR54KD.EXE
  delref D:\GAMES\EMERGENCY 5 - DELUXE EDITION\BIN\EM5_LAUNCHER.EXE
  delref D:\GAMES\EMERGENCY 5 - DELUXE EDITION\UNINS000.EXE
  delref D:\HEROES OF THE STORM\HEROES OF THE STORM.EXE
  apply
  
  czoo
  restart     

• В uVS выберите пункт меню "Скрипт" => "Выполнить скрипт находящийся в буфере обмена..."
• Нажмите на кнопку "Выполнить" и дождитесь окончания работы программы. Прошу учесть, что компьютер может быть перезагружен.
• После выполнения скрипта зайдите в папку, где распакована утилита uVS найдите архив, имя которого соответствует дате и времени запуска скрипта с префиксом ZOO_ (например: ZOO_2013-06-30_22-04-27.7z)
  

  Если архив отсутствует, то заархивруйте папку ZOO

  с паролем virus.
• Полученный архив отправьте на этот отправьте по адресу newvirus@kaspersky.com
  Полученный ответ сообщите здесь (с указанием номера KLAN)
• 2) Остатки McAfee удалите по инструкции отсюда.
   
  3)
  • Скачайте AdwCleaner
  и сохраните его на Рабочем столе.
• Запустите его (в ОС Vista/Windows 7/8 необходимо запускать через правую кн. мыши от имени администратора), нажмите кнопку "Scan" ("Сканировать") и дождитесь окончания сканирования.
• Когда сканирование будет завершено, отчет будет сохранен в следующем расположении: C:\AdwCleaner\AdwCleaner[s0].txt.
• Прикрепите отчет к своему следующему сообщению.

Изменено 13 апреля, 2018 пользователем regist

[Богдан1982]

Сейчас перезапущю в обычном режиме,так как постоянно нахожусь в безопасном.

Zoo на почту отправил.

 

ответ Тирексу. Да, программа FRST64.exe не вылетает при запуске.

 

 

 

 отчет от AdwCleaner  прикладываю.

 

Браузер перестал открывать шлак.но при загрузке все равно пытаеться запустить систем хилер ,а так же выдает ряд ошибок ,что то вязанное с language

AdwCleanerS0.txt

[regist]

1) QWiget 1.0.1, QIPApp, FastDataX 1.20 - деинсталируйте.

 

2)

• Запустите повторно AdwCleaner (в ОС Vista/Windows 7/8 необходимо запускать через правую кн. мыши от имени администратора).
• В меню Tools ->Options (Инструменты ->Настройки) отметьте:
  
  • Сброс политик IE
  • Сброс политик Chrome
    

  [*]Нажмите кнопку "Scan" ("Сканировать"), а по окончанию сканирования нажмите кнопку "Cleaning" ("Очистка") и дождитесь окончания удаления. [*]Когда удаление будет завершено, отчет будет сохранен в следующем расположении: C:\AdwCleaner\AdwCleaner[C0].txt. [*]Прикрепите отчет к своему следующему сообщению

Внимание: Для успешного удаления нужна перезагрузка компьютера!!!.

 

 

3) Снова попробуйте

 

Автологером попробуйте собрать этой версией.

 

 

Zoo на почту отправил.

забыли ответ написать здесь и KLAN указать.

Изменено 11 апреля, 2018 пользователем regist

[thyrex]

Да, программа FRST64.exe не вылетает при запуске

Тогда жду новые логи с помощью этой программы

[Богдан1982]

FastDataX 1.20 .  QWiget 1.0.1   удалено
 QIPApp не найден не в рево не через панель управления.
 
 AdwCleaner клинер создал файл с номером [s1] прикладываю оба.
 
 

ответ на почту только что пришел. 
 
 
KLAN:

Благодарим за обращение в Антивирусную Лабораторию

Присланные вами файлы и ссылки были проверены в автоматическом режиме[/size]

В антивирусных базах информация по присланным вами файлам отсутствует:[/size]
08WCC4EE5.EXE.---.txt[/size]
0ICDOZKB5JH.EXE.---.txt[/size]
12QS74ZIG.EXE.---.txt[/size]
1KZRZZEYN.EXE.---.txt[/size]
2AGTHRDJX21.EXE.---.txt[/size]
34XNDIZYG3U.EXE.---.txt[/size]
37JS8EQGF.EXE._0FCC2F36DF917E6F2DC130786D4D65D0CDAF02EB.txt[/size]
3HX4W1B1NYK.EXE.---.txt[/size]
3PJFVJGPH34.EXE.---.txt[/size]
3XKE52DN2OV.EXE.---.txt[/size]
4ODZLOKS1FM.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
4XPYT5OOPAR.EXE.---.txt[/size]
4YM8MDHOE.EXE.---.txt[/size]
5ACE2K2CY.EXE.---.txt[/size]
5BNVZQHTK4E.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
5FVSPNTU3IX.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
5ZIBVRCQ03P.EXE.---.txt[/size]
6ZFYE4N0W.EXE.---.txt[/size]
7E2CAC84H.EXE.---.txt[/size]
8DR092IT0.EXE.---.txt[/size]
90V49TPJ5.EXE._0FCC2F36DF917E6F2DC130786D4D65D0CDAF02EB.txt[/size]
9EHAJ1EX4.EXE.---.txt[/size]
9P4XJZ2PP.EXE.---.txt[/size]
9TA49ANQW.EXE.---.txt[/size]
AB1B33OIBDZ.EXE.---.txt[/size]
AOIZKMY4QBR.EXE.---.txt[/size]
B0YAZY3RQGU.EXE.---.txt[/size]
B2AUMGD88.EXE.---.txt[/size]
BD0IICXDFYE.EXE.---.txt[/size]
BIVTKSCN5LL.EXE.---.txt[/size]
BNIL9LP1E.EXE.---.txt[/size]
BSL44XHD0UO.EXE.---.txt[/size]
C3CRLZ030SZ.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
C5AAWVTBVYM.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
CC1OPVMXV1M.EXE.---.txt[/size]
CL2HC5WD5RO.EXE.---.txt[/size]
CLNLLMKOVND.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
D23KE7JKR.EXE.---.txt[/size]
DHI10MTFBKY.EXE.---.txt[/size]
DORDFAERZ.EXE._0FCC2F36DF917E6F2DC130786D4D65D0CDAF02EB.txt[/size]
E3T42L15J4V.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
EKMZ2TK240T.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
ESHZLRYGULS.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
F5E3LA014Q3.EXE.---.txt[/size]
FLF4YHB0AXM.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
FO3VDY0FPRJ.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
FP0ZBVTKZEM.EXE.---.txt[/size]
FPJE53XMBAP.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
FQUIVSQ2Q5Q.EXE.---.txt[/size]
GJD04KHIMBD.EXE.---.txt[/size]
GL24Y5BYY.EXE.---.txt[/size]
HMFH5513QHX.EXE.---.txt[/size]
HYHQZEJLEFK.EXE.---.txt[/size]
I0VIUQ1KTAX.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
I3C1WTAEQVV.EXE.---.txt[/size]
IBPUHAXIW.EXE._0FCC2F36DF917E6F2DC130786D4D65D0CDAF02EB.txt[/size]
IKDHTRI3Z.EXE.---.txt[/size]
IRAJCRLNJBA.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
IRGVFHYK5EM.EXE.---.txt[/size]
J57ASUJDM.EXE.---.txt[/size]
JJ0H43A3LAF.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
JLEARK3DY34.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
JLL330BLY.EXE.---.txt[/size]
JPG2YC3VKS1.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
JUFUHSGVU.EXE.---.txt[/size]
JV1TQINWMEA.EXE.---.txt[/size]
JV3N9Y2QJ.EXE.---.txt[/size]
JVF4FJOQNXO.EXE.---.txt[/size]
K6R6EAF4L.EXE.---.txt[/size]
KQW3THF4NFG.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
KVPG1Q0DCGN.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
KXTB0NBDTFX.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
L6WG4DTU5.EXE._0FCC2F36DF917E6F2DC130786D4D65D0CDAF02EB.txt[/size]
LF345L2YSL5.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
MSH8043FN.EXE.---.txt[/size]
MTGTQETODXF.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
MZ4FOOKYUXN.EXE.---.txt[/size]
NIVFH3ZED1Q.EXE.---.txt[/size]
NL7B296JO.EXE.---.txt[/size]
NM7KNIN7Z.EXE.---.txt[/size]
OELNEVWX3UG.EXE.---.txt[/size]
OJ51FB0OGYR.EXE.---.txt[/size]
PFTSR52VGY2.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
R3DE91P48.EXE.---.txt[/size]
RCWA75L8G.EXE._38C3C3A68B77EFFC9919A11201D712BBD88D1589.txt[/size]
S1WKP5U0PLM.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
S9R87G5G1.EXE.---.txt[/size]
SH0S49A9S.EXE.---.txt[/size]
SH8OH386E.EXE.---.txt[/size]
SLI708B7X.EXE.---.txt[/size]
SRW6U92X9.EXE._38C3C3A68B77EFFC9919A11201D712BBD88D1589.txt[/size]
SUZGVOU0MYV.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
T1KFOTEVYS2.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
TMC203JSDQI.EXE.---.txt[/size]
TOSHMWZXKJI.EXE.---.txt[/size]
U28CXCO0T.EXE.---.txt[/size]
UEW2WQZFZ.EXE._38C3C3A68B77EFFC9919A11201D712BBD88D1589.txt[/size]
UPP0J1LUKZ4.EXE.---.txt[/size]
V5P2SQLA0R2.EXE.---.txt[/size]
W5NCF3FAYDW.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
WEVVR54KD.EXE._0FCC2F36DF917E6F2DC130786D4D65D0CDAF02EB.txt[/size]
WKYPM4F053E.EXE.---.txt[/size]
XCIKSRNPF4N.EXE.---.txt[/size]
XOIP3KON5DU.EXE.---.txt[/size]
Y61084LO2.EXE.---.txt[/size]
YD3FEH779.EXE.---.txt[/size]
YJS8N6739.EXE.---.txt[/size]
YO3K5YCF1.EXE._38C3C3A68B77EFFC9919A11201D712BBD88D1589.txt[/size]
YR57F10M8.EXE.---.txt[/size]
YSOWFW5SK5Z.EXE.---.txt[/size]
ZHERTFR5ZMN.EXE.---.txt[/size]
ZJ51688M4.EXE.---.txt[/size]
ZOHVSCTVW3X.EXE.---.txt[/size]

В следующих файлах обнаружен вредоносный код:[/size]
0KQVM5G01.EXE._38C3C3A68B77EFFC9919A11201D712BBD88D1589 - HEUR:Trojan.Win32.Generic[/size]
37JS8EQGF.EXE._0FCC2F36DF917E6F2DC130786D4D65D0CDAF02EB - HEUR:Trojan-Dropper.MSIL.Generic[/size]
90V49TPJ5.EXE._0FCC2F36DF917E6F2DC130786D4D65D0CDAF02EB - HEUR:Trojan-Dropper.MSIL.Generic[/size]
AL11OOXU6.EXE._38C3C3A68B77EFFC9919A11201D712BBD88D1589 - HEUR:Trojan.Win32.Generic[/size]
C2BEZVYV6.EXE._38C3C3A68B77EFFC9919A11201D712BBD88D1589 - HEUR:Trojan.Win32.Generic[/size]
DORDFAERZ.EXE._0FCC2F36DF917E6F2DC130786D4D65D0CDAF02EB - HEUR:Trojan-Dropper.MSIL.Generic[/size]
HNKPJOO04.EXE._38C3C3A68B77EFFC9919A11201D712BBD88D1589 - HEUR:Trojan.Win32.Generic[/size]
HPPNORTE0.EXE._38C3C3A68B77EFFC9919A11201D712BBD88D1589 - HEUR:Trojan.Win32.Generic[/size]
IBPUHAXIW.EXE._0FCC2F36DF917E6F2DC130786D4D65D0CDAF02EB - HEUR:Trojan-Dropper.MSIL.Generic[/size]
L6WG4DTU5.EXE._0FCC2F36DF917E6F2DC130786D4D65D0CDAF02EB - HEUR:Trojan-Dropper.MSIL.Generic[/size]
RCWA75L8G.EXE._38C3C3A68B77EFFC9919A11201D712BBD88D1589 - HEUR:Trojan.Win32.Generic[/size]
SRW6U92X9.EXE._38C3C3A68B77EFFC9919A11201D712BBD88D1589 - HEUR:Trojan.Win32.Generic[/size]
UEW2WQZFZ.EXE._38C3C3A68B77EFFC9919A11201D712BBD88D1589 - HEUR:Trojan.Win32.Generic[/size]
UNINSTALLER.EXE._32AE399D00FEA66C4CD9799EAAC64FDA1FE9E781 - HEUR:Trojan.Win32.Generic[/size]
WEVVR54KD.EXE._0FCC2F36DF917E6F2DC130786D4D65D0CDAF02EB - HEUR:Trojan-Dropper.MSIL.Generic[/size]
YO3K5YCF1.EXE._38C3C3A68B77EFFC9919A11201D712BBD88D1589 - HEUR:Trojan.Win32.Generic[/size]

В следующих файлах обнаружен вредоносный код, определяемый продуктами с включенной технологией KSN:[/size]
4ODZLOKS1FM.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
5BNVZQHTK4E.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
5FVSPNTU3IX.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
C3CRLZ030SZ.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
C5AAWVTBVYM.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
CLNLLMKOVND.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
E3T42L15J4V.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
EKMZ2TK240T.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
ESHZLRYGULS.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
FLF4YHB0AXM.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
FO3VDY0FPRJ.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
FPJE53XMBAP.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
I0VIUQ1KTAX.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
IRAJCRLNJBA.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
JJ0H43A3LAF.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
JLEARK3DY34.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
JPG2YC3VKS1.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
KQW3THF4NFG.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
KVPG1Q0DCGN.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
KXTB0NBDTFX.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
LF345L2YSL5.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
MTGTQETODXF.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
PFTSR52VGY2.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
S1WKP5U0PLM.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
SUZGVOU0MYV.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
T1KFOTEVYS2.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
W5NCF3FAYDW.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]

В антивирусных базах информация по присланным вами ссылкам отсутствует:[/size]
https://forum.kasperskyclub.ru/index.php?showtopic=59067&page=2

Файлы и ссылки переданы на исследование. Если результат исследования изменится, мы дополнительно сообщим вам по электронной почте.[/size]

Это сообщение сформировано автоматической системой обработки писем. Пожалуйста, не отвечайте на него.[/size]

Антивирусная Лаборатория, Kaspersky Lab HQ[/size]

"Ленинградское шоссе 39A/3, Москва, 125212, Russia[/size]
Телефон/Факс: + 7 (495) 797 8700 [/size]
http://www.kaspersky.com [/size]https://www.securelist.com"[/size]

--------------------------------------------------------------------------------[/size]

Sent: 4/11/2018 4:48:00 PM[/size]
To: [/size]newvirus@kaspersky.com
Subject: zoo лог[/size]
zoo лог по указанию специалистов из  [/size]https://forum.kasperskyclub.ru/index.php?showtopic=59067&page=2
 
Благодарим за обращение в Антивирусную Лабораторию[/size]

Присланные вами файлы и ссылки были проверены в автоматическом режиме[/size]

В антивирусных базах информация по присланным вами файлам отсутствует:[/size]
08WCC4EE5.EXE.---.txt[/size]
0ICDOZKB5JH.EXE.---.txt[/size]
12QS74ZIG.EXE.---.txt[/size]
1KZRZZEYN.EXE.---.txt[/size]
2AGTHRDJX21.EXE.---.txt[/size]
34XNDIZYG3U.EXE.---.txt[/size]
37JS8EQGF.EXE._0FCC2F36DF917E6F2DC130786D4D65D0CDAF02EB.txt[/size]
3HX4W1B1NYK.EXE.---.txt[/size]
3PJFVJGPH34.EXE.---.txt[/size]
3XKE52DN2OV.EXE.---.txt[/size]
4ODZLOKS1FM.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
4XPYT5OOPAR.EXE.---.txt[/size]
4YM8MDHOE.EXE.---.txt[/size]
5ACE2K2CY.EXE.---.txt[/size]
5BNVZQHTK4E.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
5FVSPNTU3IX.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
5ZIBVRCQ03P.EXE.---.txt[/size]
6ZFYE4N0W.EXE.---.txt[/size]
7E2CAC84H.EXE.---.txt[/size]
8DR092IT0.EXE.---.txt[/size]
90V49TPJ5.EXE._0FCC2F36DF917E6F2DC130786D4D65D0CDAF02EB.txt[/size]
9EHAJ1EX4.EXE.---.txt[/size]
9P4XJZ2PP.EXE.---.txt[/size]
9TA49ANQW.EXE.---.txt[/size]
AB1B33OIBDZ.EXE.---.txt[/size]
AOIZKMY4QBR.EXE.---.txt[/size]
B0YAZY3RQGU.EXE.---.txt[/size]
B2AUMGD88.EXE.---.txt[/size]
BD0IICXDFYE.EXE.---.txt[/size]
BIVTKSCN5LL.EXE.---.txt[/size]
BNIL9LP1E.EXE.---.txt[/size]
BSL44XHD0UO.EXE.---.txt[/size]
C3CRLZ030SZ.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
C5AAWVTBVYM.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
CC1OPVMXV1M.EXE.---.txt[/size]
CL2HC5WD5RO.EXE.---.txt[/size]
CLNLLMKOVND.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
D23KE7JKR.EXE.---.txt[/size]
DHI10MTFBKY.EXE.---.txt[/size]
DORDFAERZ.EXE._0FCC2F36DF917E6F2DC130786D4D65D0CDAF02EB.txt[/size]
E3T42L15J4V.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
EKMZ2TK240T.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
ESHZLRYGULS.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
F5E3LA014Q3.EXE.---.txt[/size]
FLF4YHB0AXM.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
FO3VDY0FPRJ.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
FP0ZBVTKZEM.EXE.---.txt[/size]
FPJE53XMBAP.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
FQUIVSQ2Q5Q.EXE.---.txt[/size]
GJD04KHIMBD.EXE.---.txt[/size]
GL24Y5BYY.EXE.---.txt[/size]
HMFH5513QHX.EXE.---.txt[/size]
HYHQZEJLEFK.EXE.---.txt[/size]
I0VIUQ1KTAX.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
I3C1WTAEQVV.EXE.---.txt[/size]
IBPUHAXIW.EXE._0FCC2F36DF917E6F2DC130786D4D65D0CDAF02EB.txt[/size]
IKDHTRI3Z.EXE.---.txt[/size]
IRAJCRLNJBA.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
IRGVFHYK5EM.EXE.---.txt[/size]
J57ASUJDM.EXE.---.txt[/size]
JJ0H43A3LAF.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
JLEARK3DY34.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
JLL330BLY.EXE.---.txt[/size]
JPG2YC3VKS1.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
JUFUHSGVU.EXE.---.txt[/size]
JV1TQINWMEA.EXE.---.txt[/size]
JV3N9Y2QJ.EXE.---.txt[/size]
JVF4FJOQNXO.EXE.---.txt[/size]
K6R6EAF4L.EXE.---.txt[/size]
KQW3THF4NFG.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
KVPG1Q0DCGN.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
KXTB0NBDTFX.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
L6WG4DTU5.EXE._0FCC2F36DF917E6F2DC130786D4D65D0CDAF02EB.txt[/size]
LF345L2YSL5.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
MSH8043FN.EXE.---.txt[/size]
MTGTQETODXF.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
MZ4FOOKYUXN.EXE.---.txt[/size]
NIVFH3ZED1Q.EXE.---.txt[/size]
NL7B296JO.EXE.---.txt[/size]
NM7KNIN7Z.EXE.---.txt[/size]
OELNEVWX3UG.EXE.---.txt[/size]
OJ51FB0OGYR.EXE.---.txt[/size]
PFTSR52VGY2.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
R3DE91P48.EXE.---.txt[/size]
RCWA75L8G.EXE._38C3C3A68B77EFFC9919A11201D712BBD88D1589.txt[/size]
S1WKP5U0PLM.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
S9R87G5G1.EXE.---.txt[/size]
SH0S49A9S.EXE.---.txt[/size]
SH8OH386E.EXE.---.txt[/size]
SLI708B7X.EXE.---.txt[/size]
SRW6U92X9.EXE._38C3C3A68B77EFFC9919A11201D712BBD88D1589.txt[/size]
SUZGVOU0MYV.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
T1KFOTEVYS2.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
TMC203JSDQI.EXE.---.txt[/size]
TOSHMWZXKJI.EXE.---.txt[/size]
U28CXCO0T.EXE.---.txt[/size]
UEW2WQZFZ.EXE._38C3C3A68B77EFFC9919A11201D712BBD88D1589.txt[/size]
UPP0J1LUKZ4.EXE.---.txt[/size]
V5P2SQLA0R2.EXE.---.txt[/size]
W5NCF3FAYDW.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C.txt[/size]
WEVVR54KD.EXE._0FCC2F36DF917E6F2DC130786D4D65D0CDAF02EB.txt[/size]
WKYPM4F053E.EXE.---.txt[/size]
XCIKSRNPF4N.EXE.---.txt[/size]
XOIP3KON5DU.EXE.---.txt[/size]
Y61084LO2.EXE.---.txt[/size]
YD3FEH779.EXE.---.txt[/size]
YJS8N6739.EXE.---.txt[/size]
YO3K5YCF1.EXE._38C3C3A68B77EFFC9919A11201D712BBD88D1589.txt[/size]
YR57F10M8.EXE.---.txt[/size]
YSOWFW5SK5Z.EXE.---.txt[/size]
ZHERTFR5ZMN.EXE.---.txt[/size]
ZJ51688M4.EXE.---.txt[/size]
ZOHVSCTVW3X.EXE.---.txt[/size]

В следующих файлах обнаружен вредоносный код:[/size]
0KQVM5G01.EXE._38C3C3A68B77EFFC9919A11201D712BBD88D1589 - HEUR:Trojan.Win32.Generic[/size]
37JS8EQGF.EXE._0FCC2F36DF917E6F2DC130786D4D65D0CDAF02EB - HEUR:Trojan-Dropper.MSIL.Generic[/size]
90V49TPJ5.EXE._0FCC2F36DF917E6F2DC130786D4D65D0CDAF02EB - HEUR:Trojan-Dropper.MSIL.Generic[/size]
AL11OOXU6.EXE._38C3C3A68B77EFFC9919A11201D712BBD88D1589 - HEUR:Trojan.Win32.Generic[/size]
C2BEZVYV6.EXE._38C3C3A68B77EFFC9919A11201D712BBD88D1589 - HEUR:Trojan.Win32.Generic[/size]
DORDFAERZ.EXE._0FCC2F36DF917E6F2DC130786D4D65D0CDAF02EB - HEUR:Trojan-Dropper.MSIL.Generic[/size]
HNKPJOO04.EXE._38C3C3A68B77EFFC9919A11201D712BBD88D1589 - HEUR:Trojan.Win32.Generic[/size]
HPPNORTE0.EXE._38C3C3A68B77EFFC9919A11201D712BBD88D1589 - HEUR:Trojan.Win32.Generic[/size]
IBPUHAXIW.EXE._0FCC2F36DF917E6F2DC130786D4D65D0CDAF02EB - HEUR:Trojan-Dropper.MSIL.Generic[/size]
L6WG4DTU5.EXE._0FCC2F36DF917E6F2DC130786D4D65D0CDAF02EB - HEUR:Trojan-Dropper.MSIL.Generic[/size]
RCWA75L8G.EXE._38C3C3A68B77EFFC9919A11201D712BBD88D1589 - HEUR:Trojan.Win32.Generic[/size]
SRW6U92X9.EXE._38C3C3A68B77EFFC9919A11201D712BBD88D1589 - HEUR:Trojan.Win32.Generic[/size]
UEW2WQZFZ.EXE._38C3C3A68B77EFFC9919A11201D712BBD88D1589 - HEUR:Trojan.Win32.Generic[/size]
UNINSTALLER.EXE._32AE399D00FEA66C4CD9799EAAC64FDA1FE9E781 - HEUR:Trojan.Win32.Generic[/size]
WEVVR54KD.EXE._0FCC2F36DF917E6F2DC130786D4D65D0CDAF02EB - HEUR:Trojan-Dropper.MSIL.Generic[/size]
YO3K5YCF1.EXE._38C3C3A68B77EFFC9919A11201D712BBD88D1589 - HEUR:Trojan.Win32.Generic[/size]

В следующих файлах обнаружен вредоносный код, определяемый продуктами с включенной технологией KSN:[/size]
4ODZLOKS1FM.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
5BNVZQHTK4E.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
5FVSPNTU3IX.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
C3CRLZ030SZ.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
C5AAWVTBVYM.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
CLNLLMKOVND.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
E3T42L15J4V.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
EKMZ2TK240T.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
ESHZLRYGULS.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
FLF4YHB0AXM.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
FO3VDY0FPRJ.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
FPJE53XMBAP.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
I0VIUQ1KTAX.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
IRAJCRLNJBA.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
JJ0H43A3LAF.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
JLEARK3DY34.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
JPG2YC3VKS1.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
KQW3THF4NFG.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
KVPG1Q0DCGN.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
KXTB0NBDTFX.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
LF345L2YSL5.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
MTGTQETODXF.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
PFTSR52VGY2.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
S1WKP5U0PLM.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
SUZGVOU0MYV.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
T1KFOTEVYS2.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]
W5NCF3FAYDW.EXE._62E132922B2889BCC8F0FD457A47B80E0FBF7C0C - UDS:DangerousObject.Multi.Generic[/size]

В антивирусных базах информация по присланным вами ссылкам отсутствует:[/size]
https://forum.kasperskyclub.ru/index.php?showtopic=59067&page=2

Файлы и ссылки переданы на исследование. Если результат исследования изменится, мы дополнительно сообщим вам по электронной почте.[/size]

Это сообщение сформировано автоматической системой обработки писем. Пожалуйста, не отвечайте на него.[/size]

Антивирусная Лаборатория, Kaspersky Lab HQ[/size]

"Ленинградское шоссе 39A/3, Москва, 125212, Russia[/size]
Телефон/Факс: + 7 (495) 797 8700 [/size]
http://www.kaspersky.com [/size]https://www.securelist.com"[/size]

--------------------------------------------------------------------------------[/size]
Sent: 4/11/2018 4:48:00 PM[/size]
To: [/size]newvirus@kaspersky.com
Subject: zoo лог[/size]
zoo лог по указанию специалистов из  [/size]https://forum.kasperskyclub.ru/index.php?showtopic=59067&page=2

 

автологер запустился и сам без каких либо указаний начал выполнять какой то скрипт,затем появился этот файл как я понял это то,что нужно.

 

Логи от FRST64.exe

AdwCleanerS0.txt

AdwCleanerS1.txt

CollectionLog-2018.04.11-17.41.zip

FRST.txt

Addition.txt

Изменено 12 апреля, 2018 пользователем regist
убрал адрес почты

[thyrex]

1. Откройте Блокнот и скопируйте в него приведенный ниже текст

CreateRestorePoint:
C:\USERS\USER\APPDATA\ROAMING\KF3JRZRAM0J\2UJ5OF1G5R2.EXE
HKLM Group Policy restriction on software: C:\USERS\USER\APPDATA\ROAMING\KF3JRZRAM0J\2UJ5OF1G5R2.EXE <==== ATTENTION
AppInit_DLLs: C:\ProgramData\Voyasollam\Reair.dll => C:\ProgramData\Voyasollam\Reair.dll [342528 2018-04-11] ()
GroupPolicy: Restriction - Chrome <==== ATTENTION
C:\Users\User\AppData\Roaming\nssm.exe
Toolbar: HKLM-x32 - No Name - {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} -  No File
CHR DefaultSearchURL: Default -> hxxps://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRHOjYN9_5EdL7qPpMxlKdUMxBQUYM9J6KcVfckp1YgwPTeIC1jWKdytdmv0XrghcOv30T6hpiEPXoSDJtBw1ULnHwsebGFMxMc6V8_MMsF7hrtBqVZxdQ06zw6ywAipOVH_I64e0ng6h2CLG_enKtyfcNE6nV_Zgbo3QqXtDo6-pLK_jgzm0MRHwmKQ,,&q={searchTerms}
CHR HKU\S-1-5-21-891954138-2169063185-1588103410-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [dhdgffkkebhmkfjojejmpbldmpobfkfo] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [dkekdlkmdpipihonapoleopfekmapadh] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [icanjjkadceebmhanpekkofdhclnoijl] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [jkfblcbjfojmgagikhldeppgmgdpjkpl] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [oelpkepjlgmehajehfeicfbjdiobdkfj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ojlcebdkbpjdpiligkdbbkdkfjmchbfd] - hxxps://clients2.google.com/service/update2/crx
U2 clr_optimization_v1.0; C:\Users\User\AppData\Roaming\nssm.exe [294912 2014-08-31] () [File not signed]
2099-05-30 11:27 - 30598-05-30 11:27 - 000186368 ____N (Microsoft Corporation) C:\Windows\SysWOW64\PxQFUEYAeYYEO.exe
2099-05-30 11:27 - 30598-05-30 11:27 - 000073216 ____N (Microsoft Corporation) C:\Windows\keWiE.exe
2099-05-30 11:27 - 30598-05-30 11:27 - 000073216 ____N (Microsoft Corporation) C:\Program Files (x86)\owAea.exe
2018-04-11 14:20 - 2018-04-11 16:41 - 000000000 ____D C:\Users\User\AppData\Roaming\ysupxogqici
2018-04-11 14:20 - 2018-04-11 16:41 - 000000000 ____D C:\Users\User\AppData\Roaming\w2ydcyl24lx
2018-04-11 14:20 - 2018-04-11 16:41 - 000000000 ____D C:\Users\User\AppData\Roaming\dirkedspnnq
2018-04-11 14:20 - 2018-04-11 16:41 - 000000000 ____D C:\Users\User\AppData\Roaming\d1hzbzivzvx
2018-04-11 14:20 - 2018-04-11 16:41 - 000000000 ____D C:\Users\User\AppData\Roaming\calsymvzaft
2018-04-11 14:20 - 2018-04-11 16:41 - 000000000 ____D C:\Users\User\AppData\Roaming\b2hwd5pmniw
2018-04-11 14:20 - 2018-04-11 16:41 - 000000000 ____D C:\Users\User\AppData\Roaming\ajjvkeayczj
2018-04-11 14:20 - 2018-04-11 16:41 - 000000000 ____D C:\Users\User\AppData\Roaming\3ujqgtii4jo
2018-04-11 14:20 - 2018-04-11 16:41 - 000000000 ____D C:\Program Files\SRW6U92X9R
2018-04-11 14:20 - 2018-04-11 16:41 - 000000000 ____D C:\Program Files\QUQHFYZ5RE
2018-04-11 14:18 - 2018-04-11 16:41 - 000000000 ____D C:\Users\User\AppData\Roaming\ykcw3km1lsv
2018-04-11 14:18 - 2018-04-11 16:41 - 000000000 ____D C:\Users\User\AppData\Roaming\wotiwqomvaw
2018-04-11 14:18 - 2018-04-11 16:41 - 000000000 ____D C:\Users\User\AppData\Roaming\sxua3aqpcsc
2018-04-11 14:18 - 2018-04-11 16:41 - 000000000 ____D C:\Users\User\AppData\Roaming\ry22icgrkf3
2018-04-11 14:18 - 2018-04-11 16:41 - 000000000 ____D C:\Users\User\AppData\Roaming\mjyqo4qcqrr
2018-04-11 14:18 - 2018-04-11 16:41 - 000000000 ____D C:\Users\User\AppData\Roaming\lvixraxy55f
2018-04-11 14:18 - 2018-04-11 16:41 - 000000000 ____D C:\Users\User\AppData\Roaming\jx5hbkm4c2h
2018-04-11 14:18 - 2018-04-11 16:41 - 000000000 ____D C:\Users\User\AppData\Roaming\fitp3mbmtfs
2018-04-11 14:18 - 2018-04-11 16:41 - 000000000 ____D C:\Users\User\AppData\Roaming\dalhy1xzzdw
2018-04-11 14:18 - 2018-04-11 16:41 - 000000000 ____D C:\Users\User\AppData\Roaming\c30sc5drg2y
2018-04-11 14:18 - 2018-04-11 16:41 - 000000000 ____D C:\Users\User\AppData\Roaming\4suxdjfc5ou
2018-04-11 14:18 - 2018-04-11 16:41 - 000000000 ____D C:\Program Files\YO3K5YCF1M
2018-04-11 14:18 - 2018-04-11 16:41 - 000000000 ____D C:\Program Files\UEW2WQZFZ9
2018-04-11 14:18 - 2018-04-11 14:18 - 000000000 ____D C:\Users\User\AppData\Roaming\h31tfun0ujp
2018-04-11 12:33 - 2018-04-11 16:41 - 000000000 ____D C:\Users\User\AppData\Roaming\z4axtr3o0wz
2018-04-11 12:33 - 2018-04-11 16:41 - 000000000 ____D C:\Users\User\AppData\Roaming\mtbrmoy3rmz
2018-04-11 12:33 - 2018-04-11 16:41 - 000000000 ____D C:\Users\User\AppData\Roaming\mhn3tvj2sq4
2018-04-11 12:33 - 2018-04-11 16:41 - 000000000 ____D C:\Users\User\AppData\Roaming\lff20ikxwtt
2018-04-11 12:33 - 2018-04-11 16:41 - 000000000 ____D C:\Users\User\AppData\Roaming\jikgxjcfmte
2018-04-11 12:33 - 2018-04-11 16:41 - 000000000 ____D C:\Users\User\AppData\Roaming\hg2jfm05tu3
2018-04-11 12:33 - 2018-04-11 16:41 - 000000000 ____D C:\Users\User\AppData\Roaming\b3ztiwuk1if
2018-04-11 12:33 - 2018-04-11 16:41 - 000000000 ____D C:\Users\User\AppData\Roaming\03mfjpe4hvb
2018-04-11 12:33 - 2018-04-11 16:41 - 000000000 ____D C:\Program Files\WEVVR54KDX
2018-04-11 12:33 - 2018-04-11 16:41 - 000000000 ____D C:\Program Files\L6WG4DTU54
2018-04-11 12:33 - 2018-04-11 16:41 - 000000000 ____D C:\Program Files\IBPUHAXIW5
2018-04-11 12:33 - 2018-04-11 16:41 - 000000000 ____D C:\Program Files\932AZ4ALDT
2018-04-11 12:33 - 2018-04-11 16:41 - 000000000 ____D C:\Program Files\90V49TPJ5Q
2018-04-11 12:33 - 2018-04-11 16:41 - 000000000 ____D C:\Program Files\37JS8EQGFE
2018-04-11 12:22 - 2018-04-11 14:24 - 000000000 ____D C:\Program Files\VALICZBJJ8
2018-04-11 12:22 - 2018-04-11 14:24 - 000000000 ____D C:\Program Files\RPWFWU7DWK
2018-04-11 12:22 - 2018-04-11 14:24 - 000000000 ____D C:\Program Files\G5O6S58DY4
2018-04-11 12:22 - 2018-04-11 14:24 - 000000000 ____D C:\Program Files\7QP185YOP1
2018-04-11 12:22 - 2018-04-11 14:24 - 000000000 ____D C:\Program Files\717U0B6ILV
2018-04-11 12:22 - 2018-04-11 12:22 - 000000000 ____D C:\Users\User\AppData\Roaming\yskneynnoy5
2018-04-11 12:22 - 2018-04-11 12:22 - 000000000 ____D C:\Users\User\AppData\Roaming\uqaypoatlgz
2018-04-11 12:22 - 2018-04-11 12:22 - 000000000 ____D C:\Users\User\AppData\Roaming\elfushhna0h
2018-04-11 12:22 - 2018-04-11 12:22 - 000000000 ____D C:\Users\User\AppData\Roaming\bmysv2ofyqh
2018-04-11 12:22 - 2018-04-11 12:22 - 000000000 ____D C:\Users\User\AppData\Roaming\4wenyrluu23
2018-04-11 12:22 - 2018-04-11 12:22 - 000000000 ____D C:\Users\User\AppData\Roaming\3wgo0ktybz0
2018-04-11 12:21 - 2018-04-11 14:24 - 000000000 ____D C:\Program Files\IC9ZPZ9X7U
2018-04-11 12:21 - 2018-04-11 14:24 - 000000000 ____D C:\Program Files\B9LDPVDDDF
2018-04-11 12:21 - 2018-04-11 14:24 - 000000000 ____D C:\Program Files\5N2KHZ3W7Y
2018-04-11 12:21 - 2018-04-11 12:21 - 000000000 ____D C:\Users\User\AppData\Roaming\xsjlgdnkewq
2018-04-11 12:21 - 2018-04-11 12:21 - 000000000 ____D C:\Users\User\AppData\Roaming\rvqpdnzwn4u
2018-04-11 12:21 - 2018-04-11 12:21 - 000000000 ____D C:\Users\User\AppData\Roaming\lozcydhx1k5
2018-04-11 12:21 - 2018-04-11 12:21 - 000000000 ____D C:\Users\User\AppData\Roaming\kf3jrzram0j
2018-04-11 12:21 - 2018-04-11 12:21 - 000000000 ____D C:\Users\User\AppData\Roaming\hzacf4wmu5w
2018-04-11 12:21 - 2018-04-11 12:21 - 000000000 ____D C:\Users\User\AppData\Roaming\h2ww3v4sv4p
2018-04-11 12:21 - 2018-04-11 12:21 - 000000000 ____D C:\Users\User\AppData\Roaming\d543a30pczy
2018-04-11 08:21 - 2018-04-11 16:51 - 000000270 _____ C:\Windows\Tasks\System HealerStartUp.job
2018-04-11 08:21 - 2018-04-11 09:46 - 000000270 _____ C:\Windows\Tasks\System HealerPeriod.job
2018-04-11 08:21 - 2018-04-11 08:34 - 000002844 _____ C:\Windows\System32\Tasks\System HealerPeriod
2018-04-11 08:21 - 2018-04-11 08:34 - 000002542 _____ C:\Windows\System32\Tasks\System HealerStartUp
2018-04-11 08:16 - 2018-04-11 14:27 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Healer
2018-04-11 08:16 - 2018-04-11 08:29 - 000003326 _____ C:\Windows\System32\Tasks\System Healer Monitor
2018-04-11 08:16 - 2018-04-11 08:29 - 000003318 _____ C:\Windows\System32\Tasks\System Healer Delayed
2018-04-11 08:16 - 2018-04-11 08:29 - 000000000 ____D C:\Program Files (x86)\SystemHealer
2018-04-11 03:55 - 2018-04-11 03:55 - 000002860 _____ C:\Windows\System32\Tasks\KlgKDPyHEeVbjwqnEgK2
2018-04-11 01:12 - 2018-04-11 01:13 - 000015610 _____ C:\Windows\SysWOW64\findit.xml
2018-04-11 01:12 - 2018-04-11 01:12 - 000000000 ____D C:\Users\Все пользователи\Voyasollams
2018-04-11 01:12 - 2018-04-11 01:12 - 000000000 ____D C:\ProgramData\Voyasollams
2018-04-11 01:11 - 2018-04-11 05:56 - 000000000 ____D C:\Users\Все пользователи\Voyasollam
2018-04-11 01:11 - 2018-04-11 05:56 - 000000000 ____D C:\ProgramData\Voyasollam
2018-04-11 01:11 - 2018-04-11 04:44 - 000000000 ____D C:\Users\Все пользователи\Logic Cramble
2018-04-11 01:11 - 2018-04-11 04:44 - 000000000 ____D C:\ProgramData\Logic Cramble
2018-04-11 01:11 - 2018-04-11 04:21 - 000000000 ____D C:\Users\Все пользователи\PrefsSecure
2018-04-11 01:11 - 2018-04-11 04:21 - 000000000 ____D C:\ProgramData\PrefsSecure
2018-04-11 01:11 - 2018-04-11 01:11 - 007601152 _____ C:\Users\User\AppData\Local\agent.dat
2018-04-11 01:11 - 2018-04-11 01:11 - 001986382 _____ C:\Users\User\AppData\Local\Zotcantone.tst
2018-04-11 01:11 - 2018-04-11 01:11 - 001895380 _____ C:\Users\User\AppData\Local\Lotjob.bin
2018-04-11 01:11 - 2018-04-11 01:11 - 000278508 _____ C:\Users\User\AppData\Local\Sumflex.bin
2018-04-11 01:11 - 2018-04-11 01:11 - 000126464 _____ C:\Users\User\AppData\Local\noah.dat
2018-04-11 01:11 - 2018-04-11 01:11 - 000070896 _____ C:\Users\User\AppData\Local\Config.xml
2018-04-11 01:11 - 2018-04-11 01:11 - 000018432 _____ C:\Users\User\AppData\Local\Main.dat
2018-04-11 01:11 - 2018-04-11 01:11 - 000005568 _____ C:\Users\User\AppData\Local\md.xml
2018-04-11 01:11 - 2018-04-11 01:09 - 001814528 _____ (TODO: <Company name>) C:\Users\User\AppData\Local\Zotcantone.exe
2018-04-11 01:10 - 2018-04-11 03:55 - 000003504 _____ C:\Windows\System32\Tasks\YoutubeDownloader
2018-04-11 01:10 - 2018-04-11 03:55 - 000003444 _____ C:\Windows\System32\Tasks\YoutubeDownloader2
2018-04-11 01:10 - 2018-04-11 01:10 - 000499712 ___SH C:\Users\Все пользователи\Service.exe
2018-04-11 01:10 - 2018-04-11 01:10 - 000499712 ___SH C:\ProgramData\Service.exe
2018-04-11 01:09 - 2018-04-11 04:21 - 000000000 ____D C:\Windows\System32\Tasks\System
2018-04-11 01:09 - 2018-04-11 02:20 - 000000000 ____D C:\Users\Все пользователи\yahoochrome_D
2018-04-11 01:09 - 2018-04-11 02:20 - 000000000 ____D C:\Users\Все пользователи\dahjService
2018-04-11 01:09 - 2018-04-11 02:20 - 000000000 ____D C:\Users\User\AppData\Local\Optimizer
2018-04-11 01:09 - 2018-04-11 02:20 - 000000000 ____D C:\ProgramData\yahoochrome_D
2018-04-11 01:09 - 2018-04-11 02:20 - 000000000 ____D C:\ProgramData\dahjService
2018-04-11 01:09 - 2018-04-11 02:04 - 000000000 ____D C:\Program Files (x86)\bestDownloader
2018-04-11 01:09 - 2018-04-11 01:10 - 000016080 _____ C:\Users\User\AppData\Local\InstallationConfiguration.xml
2018-04-11 01:09 - 2018-04-11 01:09 - 000929792 _____ C:\Users\User\AppData\Local\sham.db
2018-04-11 01:09 - 2018-04-11 01:09 - 000140800 _____ C:\Users\User\AppData\Local\installer.dat
2018-04-11 01:09 - 2018-04-11 01:09 - 000000003 _____ C:\Users\User\AppData\Local\wbem.ini
2018-04-11 01:09 - 2018-04-10 22:58 - 001097216 _____ C:\Users\Все пользователи\updater.exe
2018-04-11 01:09 - 2018-04-10 22:58 - 001097216 _____ C:\ProgramData\updater.exe
CustomCLSID: HKU\S-1-5-21-891954138-2169063185-1588103410-1000_Classes\CLSID\{182FB546-8596-4CEF-9CB5-E9505BF7F628}\InprocServer32 -> d:\Users\User\AppData\Local\HHD Software\Hex Editor Neo\hhdhexneo.dll => No File
CustomCLSID: HKU\S-1-5-21-891954138-2169063185-1588103410-1000_Classes\CLSID\{6DB27B2E-87AC-4354-927A-AD711A0ED77E}\InprocServer32 -> d:\Users\User\AppData\Local\HHD Software\Hex Editor Neo\FileDocument.dll => No File
CustomCLSID: HKU\S-1-5-21-891954138-2169063185-1588103410-1000_Classes\CLSID\{A244CEC5-DB63-4ED9-B0D7-A0527C064113}\InprocServer32 -> d:\Users\User\AppData\Local\HHD Software\Hex Editor Neo\FileDocument.dll => No File
CustomCLSID: HKU\S-1-5-21-891954138-2169063185-1588103410-1000_Classes\CLSID\{AE1514A4-5D7D-4D1B-BC7F-320E6962B0DD}\InprocServer32 -> d:\Users\User\AppData\Local\HHD Software\Hex Editor Neo\FileDocument.dll => No File
CustomCLSID: HKU\S-1-5-21-891954138-2169063185-1588103410-1000_Classes\CLSID\{B845012A-F05A-4EC8-816D-B033183B9CA5}\InprocServer32 -> d:\Users\User\AppData\Local\HHD Software\Hex Editor Neo\hhdhexneo.dll => No File
CustomCLSID: HKU\S-1-5-21-891954138-2169063185-1588103410-1000_Classes\CLSID\{F350F7C1-9F0E-4A97-8EEC-E690C7095BEF}\InprocServer32 -> d:\Users\User\AppData\Local\HHD Software\Hex Editor Neo\PatchAPI\dll\x64\hexpatch64.dll => No File
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
ShellIconOverlayIdentifiers: [00avg] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
Task: {0113DCFD-3E19-4CF8-9053-36A90BBC1E6A} - \xRZOrQVCBWPMscb2 -> No File <==== ATTENTION
Task: {06038508-FE1E-46D2-86E6-67274C4E1845} - System32\Tasks\{DFCFCF53-D744-8E79-6FAE-97525BE1E5B2} => C:\Windows\keWiE.exe [30598-05-30] (Microsoft Corporation)
Task: {135177D0-7720-42B7-844A-AE447AECBC8A} - \FastDataX Task -> No File <==== ATTENTION
Task: {18E25F21-73BA-4F57-BA13-54F673CE2E8F} - \{B79E2098-2C67-7B5D-0206-928D7D978F1C} -> No File <==== ATTENTION
Task: {1F5C428B-CD47-4483-8365-FC815F843844} - System32\Tasks\System HealerPeriod => C:\Program Files (x86)\SystemHealer\SystemHealer.exe [2018-03-29] () <==== ATTENTION
Task: {216775F2-661A-4257-935E-056A07DA4366} - System32\Tasks\YoutubeDownloader2 => C:\Users\User\AppData\Roaming\YoutubeDownloader\python\pythonw.exe <==== ATTENTION
Task: {371CDCDB-B3BF-43D0-8E9C-1B6A5F082948} - \KlAEYQtzmHgics -> No File <==== ATTENTION
Task: {3F45F7D3-E6C4-49F4-8B1B-12AFAC3B7639} - \GoogleUpdateTaskMachineCore -> No File <==== ATTENTION
Task: {43A88830-5244-4345-9D85-7A8CF7893843} - \Запуск Cezurity Antivirus Scanner во время простоя компьютера -> No File <==== ATTENTION
Task: {5DF5ACBD-DA72-40B9-8060-5659F50BC3DE} - \Microsoft Windows Mail -> No File <==== ATTENTION
Task: {76FFA053-0496-4354-ABD3-94DFFDE10513} - \GoogleUpdateTaskMachineUA -> No File <==== ATTENTION
Task: {8FF41493-FF97-4220-AA32-5679259AE987} - System32\Tasks\YoutubeDownloader => C:\Users\User\AppData\Roaming\YoutubeDownloader\python\pythonw.exe <==== ATTENTION
Task: {94FDFDE7-3BFA-4D48-BEE8-785CD089074C} - \{BEC3608B-2665-41FD-A96F-FA91F8E4E347} -> No File <==== ATTENTION
Task: {9C9CD26C-13C5-4A3D-9FC5-CDB26A546D7C} - \InstallShield Update Service -> No File <==== ATTENTION
Task: {B47B9A79-4196-4E67-86D7-5284EEED5DDD} - System32\Tasks\System HealerStartUp => C:\Program Files (x86)\SystemHealer\SystemHealer.exe [2018-03-29] () <==== ATTENTION
Task: {CAF12551-0BD4-44A9-A2A8-EE6C5E7DCF8B} - System32\Tasks\System Healer Delayed => C:\Program Files (x86)\SystemHealer\SystemHealer.exe [2018-03-29] () <==== ATTENTION
Task: {D1ECD6AF-EB87-4384-AA24-2E407233E291} - \SafeZone scheduled Autoupdate 1458721626 -> No File <==== ATTENTION
Task: {F422195A-BCD4-4565-8717-DE3F8BB2830D} - System32\Tasks\System Healer Monitor => C:\Program Files (x86)\SystemHealer\HealerConsole.exe [2018-03-29] () <==== ATTENTION
Task: {F9E67920-F2D9-48DF-ABFF-47EAAF5AB4AA} - System32\Tasks\KlgKDPyHEeVbjwqnEgK2 => rundll32 "C:\Program Files (x86)\IUpWUBcycmhgC\VTQuzIP.dll",#1
Task: C:\Windows\Tasks\System HealerPeriod.job => C:\Program Files (x86)\SystemHealer\SystemHealer.exe <==== ATTENTION
Task: C:\Windows\Tasks\System HealerStartUp.job => C:\Program Files (x86)\SystemHealer\SystemHealer.exe <==== ATTENTION
AlternateDataStreams: C:\Users\User:Heroes & Generals [38]
AlternateDataStreams: C:\Users\Public\DRM:احتضان [48]
MSCONFIG\startupreg: 0DDU7UV36YE0T2L => "C:\Program Files\S9VFEE8CWW\S9VFEE8CW.exe"
MSCONFIG\startupreg: 0Z2IINO96GWPSOK => "C:\Program Files\RBRBL7XR3T\2Z4Z0GYHK.exe"
MSCONFIG\startupreg: 1130600 => "C:\Users\User\AppData\Roaming\e1rcxb4qll4\bbwaqpi45n1.exe" /VERYSILENT
MSCONFIG\startupreg: 1150247 => "C:\Users\User\AppData\Roaming\aqklpbbozde\rbg3kbsa5uk.exe" /VERYSILENT
MSCONFIG\startupreg: 1157096 => "C:\Users\User\AppData\Roaming\pneu1wegiwj\3sfvxgfutoy.exe" /VERYSILENT
MSCONFIG\startupreg: 1167001 => "C:\Users\User\AppData\Roaming\rn1152zo2ra\xrwgbtnqdxj.exe" /VERYSILENT
MSCONFIG\startupreg: 1243389 => "C:\Users\User\AppData\Roaming\wjftvyvfvda\t0qe05basrl.exe" /VERYSILENT
MSCONFIG\startupreg: 128P2PCGD561TPP => "C:\Program Files\WISLYUSUXN\3LG8XXOER.exe"
MSCONFIG\startupreg: 1342974 => "C:\Users\User\AppData\Roaming\mtm5cus5lnp\erlhelmc1ev.exe" /VERYSILENT
MSCONFIG\startupreg: 1353605 => "C:\Users\User\AppData\Roaming\ayycxixdtyg\43nb130jzq2.exe" /VERYSILENT
MSCONFIG\startupreg: 13TFJY7RZN7S0N3 => "C:\Program Files\SXX8A83L5O\1LI7XPXZ3.exe"
MSCONFIG\startupreg: 1400097 => "C:\Users\User\AppData\Roaming\ywvr2oaf3zy\dc2qrpst0de.exe" /VERYSILENT
MSCONFIG\startupreg: 144950 => "C:\Users\User\AppData\Roaming\blu22typrsb\4c4rlap3xlh.exe" /VERYSILENT
MSCONFIG\startupreg: 1499353 => "C:\Users\User\AppData\Roaming\wyolxfbpka2\wu10ljrjqy1.exe" /VERYSILENT
MSCONFIG\startupreg: 1606192 => "C:\Users\User\AppData\Roaming\o21d1obmpsh\m5t4hgqz3ct.exe" /VERYSILENT
MSCONFIG\startupreg: 160KZRRAD95JGY8 => "C:\Program Files\NIUV0825PF\YZVXDLF3G.exe"
MSCONFIG\startupreg: 1632927 => "C:\Users\User\AppData\Roaming\gfi4zyws3av\123kxz4xcz5.exe" /VERYSILENT
MSCONFIG\startupreg: 1656617 => "C:\Users\User\AppData\Roaming\1alftidwk2h\1m1mk35eavl.exe" /VERYSILENT
MSCONFIG\startupreg: 1708417 => "C:\Users\User\AppData\Roaming\0blsjinlkbo\ohtpcqwsisv.exe" /VERYSILENT
MSCONFIG\startupreg: 1837451 => "C:\Users\User\AppData\Roaming\ay5405yadmu\fa4ecodlkgw.exe" /VERYSILENT
MSCONFIG\startupreg: 1853431 => "C:\Users\User\AppData\Roaming\n5mal3nhxu3\dc4qsqr1ifp.exe" /VERYSILENT
MSCONFIG\startupreg: 1895027 => "C:\Users\User\AppData\Roaming\qiiqcwvle0p\ro3zbmol2s5.exe" /VERYSILENT
MSCONFIG\startupreg: 1972154 => "C:\Users\User\AppData\Roaming\2bzm4vgez5b\4apft1tfxdp.exe" /VERYSILENT
MSCONFIG\startupreg: 1Q0QYM8VHVFEBSY => "C:\Program Files\OP2CXUW3MO\VSRYXXSNG.exe"
MSCONFIG\startupreg: 1SJP1FK35CLAQ7G => "C:\Program Files\WKS48KX17Q\3NGQ8NTL1.exe"
MSCONFIG\startupreg: 212261 => "C:\Users\User\AppData\Roaming\ooimcymkomu\cckpvflt4yx.exe" /VERYSILENT
MSCONFIG\startupreg: 2205130 => "C:\Users\User\AppData\Roaming\wm251mpypkh\orlj5dnuwe2.exe" /VERYSILENT
MSCONFIG\startupreg: 2260498 => "C:\Users\User\AppData\Roaming\r55cibpbg4j\tefejgtysw3.exe" /VERYSILENT
MSCONFIG\startupreg: 2289 => "C:\Users\User\AppData\Roaming\swpstcsvxjm\z1xfwnmywbx.exe" /VERYSILENT
MSCONFIG\startupreg: 2306914 => "C:\Users\User\AppData\Roaming\lokeb3vpmv1\o0uerqwy5ad.exe" /VERYSILENT
MSCONFIG\startupreg: 23HU032IPMO46N7 => "C:\Program Files\C2V8Z5CWXO\C2V8Z5CWX.exe"
MSCONFIG\startupreg: 266780 => "C:\Users\User\AppData\Roaming\tzaxvg4fg3u\rla1hraihr1.exe" /VERYSILENT
MSCONFIG\startupreg: 27MDD0F3NLXC5G6 => "C:\Program Files\WVOLTU60IV\WVOLTU60I.exe"
MSCONFIG\startupreg: 2WKYK7U6J1LX2P3 => "C:\Program Files\BDSIR2IG34\BDSIR2IG3.exe"
MSCONFIG\startupreg: 302269 => "C:\Users\User\AppData\Roaming\22mujs2hcb5\fisgm3ovgvm.exe" /VERYSILENT
MSCONFIG\startupreg: 3049233 => "C:\Users\User\AppData\Roaming\thgavwr5ara\p2k1v4dgf3o.exe" /VERYSILENT
MSCONFIG\startupreg: 306763 => "C:\Users\User\AppData\Roaming\2zlwdnuca33\4wmy0h0to1g.exe" /VERYSILENT
MSCONFIG\startupreg: 3069536 => "C:\Users\User\AppData\Roaming\kur5dkq00kc\dj0vfbtx0wd.exe" /VERYSILENT
MSCONFIG\startupreg: 3160368 => "C:\Users\User\AppData\Roaming\izatkelwe4e\ye23eqxx01n.exe" /VERYSILENT
MSCONFIG\startupreg: 3161671 => "C:\Users\User\AppData\Roaming\ghbrcbpc3pe\2g3qliqyqtq.exe" /VERYSILENT
MSCONFIG\startupreg: 3181120 => "C:\Users\User\AppData\Roaming\y2yzrriwztk\n1xkvpalfxr.exe" /VERYSILENT
MSCONFIG\startupreg: 3267184 => "C:\Users\User\AppData\Roaming\m0gizakcwcj\zlx4pe4awuv.exe" /VERYSILENT
MSCONFIG\startupreg: 329233 => "C:\Users\User\AppData\Roaming\2vwnx5xbjn0\p3d3z3g0x5r.exe" /VERYSILENT
MSCONFIG\startupreg: 3323772 => "C:\Users\User\AppData\Roaming\v0garu2kfvn\hp44nj2k15r.exe" /VERYSILENT
MSCONFIG\startupreg: 3381442 => "C:\Users\User\AppData\Roaming\s00p4i03sje\05vhkerb0mb.exe" /VERYSILENT
MSCONFIG\startupreg: 3427449 => "C:\Users\User\AppData\Roaming\5i501vzpxas\fzjee4yb5ag.exe" /VERYSILENT
MSCONFIG\startupreg: 3438227 => "C:\Users\User\AppData\Roaming\5jpi3k55zzz\k11rrh42etc.exe" /VERYSILENT
MSCONFIG\startupreg: 3461755 => "C:\Users\User\AppData\Roaming\fzbw00mqzjh\cmj2sn2nyky.exe" /VERYSILENT
MSCONFIG\startupreg: 3562308 => "C:\Users\User\AppData\Roaming\rs5us3cfumq\xpx2tu0tvsx.exe" /VERYSILENT
MSCONFIG\startupreg: 3565442 => "C:\Users\User\AppData\Roaming\2rzbytgn5fb\b3k52gfu0ob.exe" /VERYSILENT
MSCONFIG\startupreg: 3674294 => "C:\Users\User\AppData\Roaming\psvfv52niih\ck341yq50m5.exe" /VERYSILENT
MSCONFIG\startupreg: 3705180 => "C:\Users\User\AppData\Roaming\cdcneixkhmg\31yrsxgz1u1.exe" /VERYSILENT
MSCONFIG\startupreg: 3743486 => "C:\Users\User\AppData\Roaming\jzd2speu3j3\ovpnzw0hq1l.exe" /VERYSILENT
MSCONFIG\startupreg: 3865567 => "C:\Users\User\AppData\Roaming\rl5f1rjky3p\kjojvna3byi.exe" /VERYSILENT
MSCONFIG\startupreg: 3DCLUVHAR499Q3C => "C:\Program Files\TS7KMQBUWK\0FYRHH0XC.exe"
MSCONFIG\startupreg: 3GF6KOQ8ZEABFBK => "C:\Program Files\CE6CDUMG2W\CE6CDUMG2.exe"
MSCONFIG\startupreg: 3IT2OLYZT1MF4Q7 => "C:\Program Files\JA2VXE5LWA\JA2VXE5LW.exe"
MSCONFIG\startupreg: 3J0BOUWBOR0R0RC => "C:\Program Files\ANG1B3VYW0\ANG1B3VYW.exe"
MSCONFIG\startupreg: 4073518 => "C:\Users\User\AppData\Roaming\42fxeujoxak\hkxx5z5otpi.exe" /VERYSILENT
MSCONFIG\startupreg: 4087275 => "C:\Users\User\AppData\Roaming\peogxryztss\afe54wgyj4u.exe" /VERYSILENT
MSCONFIG\startupreg: 4157925 => "C:\Users\User\AppData\Roaming\5ycaoqwjsvd\2h02eakdjdp.exe" /VERYSILENT
MSCONFIG\startupreg: 4499897 => "C:\Users\User\AppData\Roaming\fzlkfzwnbtv\i5l0qlrdznx.exe" /VERYSILENT
MSCONFIG\startupreg: 4602580 => "C:\Users\User\AppData\Roaming\pys1uimzz5q\cdjw1kcr0af.exe" /VERYSILENT
MSCONFIG\startupreg: 4628834 => "C:\Users\User\AppData\Roaming\2dbvypqcdrw\m03zruwoiuw.exe" /VERYSILENT
MSCONFIG\startupreg: 4672397 => "C:\Users\User\AppData\Roaming\il0mbpgjnyp\4mvvklyib3n.exe" /VERYSILENT
MSCONFIG\startupreg: 4686264 => "C:\Users\User\AppData\Roaming\yfrkqykxlsw\5nzmbqc5t3z.exe" /VERYSILENT
MSCONFIG\startupreg: 4924917 => "C:\Users\User\AppData\Roaming\4mo0jx3hijv\l5ib0mv2pcg.exe" /VERYSILENT
MSCONFIG\startupreg: 4996666 => "C:\Users\User\AppData\Roaming\vk1vg2pjt41\u2anq3xj0ca.exe" /VERYSILENT
MSCONFIG\startupreg: 4ASZO48B6LS2ISZ => "C:\Program Files\MJU7P18XUI\MJU7P18XU.exe"
MSCONFIG\startupreg: 4GT2RDH24O20ZOJ => "C:\Program Files\BW8W5HZ16Y\CEEPXOL4V.exe"
MSCONFIG\startupreg: 4KIFUAHZQ57Y83R => "C:\Program Files\FIG5Y8I270\S7NK68O36.exe"
MSCONFIG\startupreg: 5016072 => "C:\Users\User\AppData\Roaming\ygiplw2abac\stxz11ovdhs.exe" /VERYSILENT
MSCONFIG\startupreg: 514535 => "C:\Users\User\AppData\Roaming\tk2xia1hj1r\44zam0kgxrb.exe" /VERYSILENT
MSCONFIG\startupreg: 5231631 => "C:\Users\User\AppData\Roaming\0mh2glr55qv\ro24ia1b2ob.exe" /VERYSILENT
MSCONFIG\startupreg: 5282897 => "C:\Users\User\AppData\Roaming\xi1ides3tzq\nitnvbwm42s.exe" /VERYSILENT
MSCONFIG\startupreg: 5283642 => "C:\Users\User\AppData\Roaming\tnc5uu0nig5\toh0a5hnewd.exe" /VERYSILENT
MSCONFIG\startupreg: 530148 => "C:\Users\User\AppData\Roaming\nadiewrtl22\owbynl54lev.exe" /VERYSILENT
MSCONFIG\startupreg: 53797 => "C:\Users\User\AppData\Roaming\dew4zkkfycr\of2phpvu0xc.exe" /VERYSILENT
MSCONFIG\startupreg: 5462406 => "C:\Users\User\AppData\Roaming\jrvumbqnqj4\cv0yvrjm433.exe" /VERYSILENT
MSCONFIG\startupreg: 547945 => "C:\Users\User\AppData\Roaming\jhco40fzpis\w44gdnabhdu.exe" /VERYSILENT
MSCONFIG\startupreg: 5492617 => "C:\Users\User\AppData\Roaming\lwrkenbibyw\32iyrtup23i.exe" /VERYSILENT
MSCONFIG\startupreg: 5525583 => "C:\Users\User\AppData\Roaming\ky2c11idigb\ng5ysnd3amw.exe" /VERYSILENT
MSCONFIG\startupreg: 5542047 => "C:\Users\User\AppData\Roaming\xcvchuujdpp\m1iaafa10av.exe" /VERYSILENT
MSCONFIG\startupreg: 5593678 => "C:\Users\User\AppData\Roaming\ccorplfgzwp\fnbsqruc1sw.exe" /VERYSILENT
MSCONFIG\startupreg: 5662047 => "C:\Users\User\AppData\Roaming\ohhu5k0b3gz\py10wre3hho.exe" /VERYSILENT
MSCONFIG\startupreg: 5736944 => "C:\Users\User\AppData\Roaming\mi3pwkordzt\hijljti1iya.exe" /VERYSILENT
MSCONFIG\startupreg: 5748630 => "C:\Users\User\AppData\Roaming\2ehgshirp5u\hnh3bq335fd.exe" /VERYSILENT
MSCONFIG\startupreg: 5796197 => "C:\Users\User\AppData\Roaming\a4dx0rgxfmj\j4jtprckt5u.exe" /VERYSILENT
MSCONFIG\startupreg: 57L3UR4G8DBR4V9 => "C:\Program Files\GUBYHTHAZJ\GUBYHTHAZ.exe"
MSCONFIG\startupreg: 5815875 => "C:\Users\User\AppData\Roaming\kdpxmlii2c1\kgbs0lbcrfk.exe" /VERYSILENT
MSCONFIG\startupreg: 586432 => "C:\Users\User\AppData\Roaming\ug1mguvazzk\j3o05lmw22b.exe" /VERYSILENT
MSCONFIG\startupreg: 590630 => "C:\Users\User\AppData\Roaming\tpjg4zanoav\kagdpv5xebf.exe" /VERYSILENT
MSCONFIG\startupreg: 5950494 => "C:\Users\User\AppData\Roaming\zkccgqlcfqj\iavc5qe1miu.exe" /VERYSILENT
MSCONFIG\startupreg: 5987502 => "C:\Users\User\AppData\Roaming\340ck10yhqo\3ttvbmcjpkt.exe" /VERYSILENT
MSCONFIG\startupreg: 5A5SYGT4V9KLGPJ => "C:\Program Files\1ET4JYM1M7\1ET4JYM1M.exe"
MSCONFIG\startupreg: 5B7XK3M6W0W61YN => "C:\Program Files\DOGK9WJ4Q7\DOGK9WJ4Q.exe"
MSCONFIG\startupreg: 6137098 => "C:\Users\User\AppData\Roaming\4ausuhmxrmk\btaqo2k50ab.exe" /VERYSILENT
MSCONFIG\startupreg: 6266922 => "C:\Users\User\AppData\Roaming\wnp2l33daw0\rdkg3fht3fu.exe" /VERYSILENT
MSCONFIG\startupreg: 64EQHYJGMAXU7DZ => "C:\Program Files\ZUDQ19GSEN\ZUDQ19GSE.exe"
MSCONFIG\startupreg: 6559020 => "C:\Users\User\AppData\Roaming\kk5bhy10hx4\o4stlmmydyt.exe" /VERYSILENT
MSCONFIG\startupreg: 6684532 => "C:\Users\User\AppData\Roaming\tchffjleqwl\flp40lt4jup.exe" /VERYSILENT
MSCONFIG\startupreg: 6708030 => "C:\Users\User\AppData\Roaming\qxzl1sxkl50\i1l43q4pitn.exe" /VERYSILENT
MSCONFIG\startupreg: 6711349 => "C:\Users\User\AppData\Roaming\rasphfkorm4\wqffgaauvlu.exe" /VERYSILENT
MSCONFIG\startupreg: 6903998 => "C:\Users\User\AppData\Roaming\pwfofzpaj5y\haulvv1f5kj.exe" /VERYSILENT
MSCONFIG\startupreg: 6957708 => "C:\Users\User\AppData\Roaming\apsiiwxygh5\y1p3q3lbl55.exe" /VERYSILENT
MSCONFIG\startupreg: 6987727 => "C:\Users\User\AppData\Roaming\bsvclqoaenz\gq33wqukiu1.exe" /VERYSILENT
MSCONFIG\startupreg: 6JL4ZN52YSRPFNV => "C:\Program Files\N3HA6MPWCB\N3HA6MPWC.exe"
MSCONFIG\startupreg: 718260 => "C:\Users\User\AppData\Roaming\sguo4y45z5i\w1o243urjpb.exe" /VERYSILENT
MSCONFIG\startupreg: 7293663 => "C:\Users\User\AppData\Roaming\kshtlcuecoz\cxoel2lx1iw.exe" /VERYSILENT
MSCONFIG\startupreg: 7309319 => "C:\Users\User\AppData\Roaming\qlcfrgq101j\yt5lfbp1frj.exe" /VERYSILENT
MSCONFIG\startupreg: 730K8EON0E1F34C => "C:\Program Files\B1GU3KF8UX\B1GU3KF8U.exe"
MSCONFIG\startupreg: 7328307 => "C:\Users\User\AppData\Roaming\54rc2gq0bf1\1l4aps41k3e.exe" /VERYSILENT
MSCONFIG\startupreg: 7333456 => "C:\Users\User\AppData\Roaming\abxa2vbsbaz\dlwulkcfph0.exe" /VERYSILENT
MSCONFIG\startupreg: 7342946 => "C:\Users\User\AppData\Roaming\mbrscacsm00\usqgse5xm0q.exe" /VERYSILENT
MSCONFIG\startupreg: 7428997 => "C:\Users\User\AppData\Roaming\mcmgox2xihv\54vq0sjnuij.exe" /VERYSILENT
MSCONFIG\startupreg: 7453835 => "C:\Users\User\AppData\Roaming\w10eaf5a11i\o332whdmgno.exe" /VERYSILENT
MSCONFIG\startupreg: 75621 => "C:\Users\User\AppData\Roaming\xyte2hasuou\kvknleoljme.exe" /VERYSILENT
MSCONFIG\startupreg: 7606753 => "C:\Users\User\AppData\Roaming\wguyd3ta0j3\vygdbe0oiue.exe" /VERYSILENT
MSCONFIG\startupreg: 7674616 => "C:\Users\User\AppData\Roaming\gxfuu51izqw\brgfbd20rmi.exe" /VERYSILENT
MSCONFIG\startupreg: 7737448 => "C:\Users\User\AppData\Roaming\ipe3e1uvcuz\1jevxkh3ckw.exe" /VERYSILENT
MSCONFIG\startupreg: 7743630 => "C:\Users\User\AppData\Roaming\kkfhcj3a3rw\v0e4s3k0rea.exe" /VERYSILENT
MSCONFIG\startupreg: 7877127 => "C:\Users\User\AppData\Roaming\zlgjuaka14l\svtls1qo0tn.exe" /VERYSILENT
MSCONFIG\startupreg: 7954941 => "C:\Users\User\AppData\Roaming\tgvqzcwgt15\2x2uzceoz4l.exe" /VERYSILENT
MSCONFIG\startupreg: 7Q2EDS01FHYP4DG => "C:\Program Files\QSOQHTXOQR\VUJMP6NW2.exe"
MSCONFIG\startupreg: 7U3KZGO0IRZ8R40 => "C:\Program Files\VP274XKQJD\VP274XKQJ.exe"
MSCONFIG\startupreg: 7Y1NA0LGESINCZ4 => "C:\Program Files\DK2LUSDFQW\K7TSPJ2I5.exe"
MSCONFIG\startupreg: 8045595 => "C:\Users\User\AppData\Roaming\jdbguy3semy\fmm1weh3hcw.exe" /VERYSILENT
MSCONFIG\startupreg: 8120065 => "C:\Users\User\AppData\Roaming\gwh2ufuqfhp\m3osqe2gkoh.exe" /VERYSILENT
MSCONFIG\startupreg: 8166760 => "C:\Users\User\AppData\Roaming\thguiakwjnx\fnnouygjrd4.exe" /VERYSILENT
MSCONFIG\startupreg: 8268422 => "C:\Users\User\AppData\Roaming\4tqknfxyf3k\devhitihriw.exe" /VERYSILENT
MSCONFIG\startupreg: 8279693 => "C:\Users\User\AppData\Roaming\bot5kggoflf\dv2wx5qxeeu.exe" /VERYSILENT
MSCONFIG\startupreg: 8338027 => "C:\Users\User\AppData\Roaming\bjoiv2yeakx\22hfeafqrqh.exe" /VERYSILENT
MSCONFIG\startupreg: 8348963 => "C:\Users\User\AppData\Roaming\pokpva2ix4f\jgpt0omj0gc.exe" /VERYSILENT
MSCONFIG\startupreg: 8352273 => "C:\Users\User\AppData\Roaming\m1r55fsunt1\5gn3b5o3y1k.exe" /VERYSILENT
MSCONFIG\startupreg: 8386612 => "C:\Users\User\AppData\Roaming\3vlov2bu0ld\yftqktdc3rl.exe" /VERYSILENT
MSCONFIG\startupreg: 8473383 => "C:\Users\User\AppData\Roaming\rwukdenkt0v\rjjar3bja5p.exe" /VERYSILENT
MSCONFIG\startupreg: 8499771 => "C:\Users\User\AppData\Roaming\rmiwlbs542q\4bus3h2d10h.exe" /VERYSILENT
MSCONFIG\startupreg: 8502310 => "C:\Users\User\AppData\Roaming\ryjxksuckam\tzoqembm3dt.exe" /VERYSILENT
MSCONFIG\startupreg: 8567816 => "C:\Users\User\AppData\Roaming\l4q0pw5i54y\n1jrfhn0tlc.exe" /VERYSILENT
MSCONFIG\startupreg: 8573638 => "C:\Users\User\AppData\Roaming\rnxnvx1ctjn\r5wnd2jjhab.exe" /VERYSILENT
MSCONFIG\startupreg: 8658293 => "C:\Users\User\AppData\Roaming\uas04wgqg53\aikkyuzh1vg.exe" /VERYSILENT
MSCONFIG\startupreg: 8739936 => "C:\Users\User\AppData\Roaming\tse1yev5vpf\ovptkpwqf03.exe" /VERYSILENT
MSCONFIG\startupreg: 8766955 => "C:\Users\User\AppData\Roaming\4xl40cew5lp\k4ywiwirwxt.exe" /VERYSILENT
MSCONFIG\startupreg: 8791438 => "C:\Users\User\AppData\Roaming\0samcxdpp30\cbsrsym4iuf.exe" /VERYSILENT
MSCONFIG\startupreg: 8839817 => "C:\Users\User\AppData\Roaming\1zwa3w30n1c\bgee0auuaui.exe" /VERYSILENT
MSCONFIG\startupreg: 896848 => "C:\Users\User\AppData\Roaming\5oqwmuvva5z\5jpclznodcc.exe" /VERYSILENT
MSCONFIG\startupreg: 8980464 => "C:\Users\User\AppData\Roaming\buj31ixpsdq\4jki4hu3gha.exe" /VERYSILENT
MSCONFIG\startupreg: 8987834 => "C:\Users\User\AppData\Roaming\ff0512a2qhw\sbpccdolk0u.exe" /VERYSILENT
MSCONFIG\startupreg: 899773 => "C:\Users\User\AppData\Roaming\hoxu1cgzg22\apqhyt14mrs.exe" /VERYSILENT
MSCONFIG\startupreg: 8DIZAC5TY7UOWBH => "C:\Program Files\N5ZI87GCX3\N5ZI87GCX.exe"
MSCONFIG\startupreg: 9048971 => "C:\Users\User\AppData\Roaming\rkuyurjppqf\c0n4kylljud.exe" /VERYSILENT
MSCONFIG\startupreg: 9056158 => "C:\Users\User\AppData\Roaming\jmvl4ifld1c\5d1vqmlsesb.exe" /VERYSILENT
MSCONFIG\startupreg: 9111428 => "C:\Users\User\AppData\Roaming\v4qmwvi24bq\zm5tapcv333.exe" /VERYSILENT
MSCONFIG\startupreg: 9112804 => "C:\Users\User\AppData\Roaming\acfcqgto2bb\ktbgipme2e0.exe" /VERYSILENT
MSCONFIG\startupreg: 9193066 => "C:\Users\User\AppData\Roaming\bxpjoqloi2x\k4gdy0xrxqt.exe" /VERYSILENT
MSCONFIG\startupreg: 9260405 => "C:\Users\User\AppData\Roaming\mo25ebdphrk\4qju50jj13s.exe" /VERYSILENT
MSCONFIG\startupreg: 9267701 => "C:\Users\User\AppData\Roaming\wptdpqb0p4z\uyamhjdr3pa.exe" /VERYSILENT
MSCONFIG\startupreg: 9381950 => "C:\Users\User\AppData\Roaming\0v1druailgm\0rmjka5e2mw.exe" /VERYSILENT
MSCONFIG\startupreg: 9409315 => "C:\Users\User\AppData\Roaming\1rspplaozhk\jygkpgvibfm.exe" /VERYSILENT
MSCONFIG\startupreg: 9427258 => "C:\Users\User\AppData\Roaming\kjompfogbax\wim1veczsti.exe" /VERYSILENT
MSCONFIG\startupreg: 9492636 => "C:\Users\User\AppData\Roaming\dyyabs030bi\njcxrujbwsp.exe" /VERYSILENT
MSCONFIG\startupreg: 9518080 => "C:\Users\User\AppData\Roaming\bmkbbjrswox\4lrba0ekip1.exe" /VERYSILENT
MSCONFIG\startupreg: 9644113 => "C:\Users\User\AppData\Roaming\akoa1qvb4aq\lfdw00j03fj.exe" /VERYSILENT
MSCONFIG\startupreg: 9702839 => "C:\Users\User\AppData\Roaming\aupbcby513l\o505niplvhm.exe" /VERYSILENT
MSCONFIG\startupreg: 9908202 => "C:\Users\User\AppData\Roaming\zdgxlabc1yy\x53ogas3tnf.exe" /VERYSILENT
MSCONFIG\startupreg: 9GZ6EBIHGN6984L => "C:\Program Files\LUUANMR1CF\LUUANMR1C.exe"
MSCONFIG\startupreg: 9I1BGE5YIGGU3XL => "C:\Program Files\ICS8PGIQN7\ICS8PGIQN.exe"
MSCONFIG\startupreg: 9NDMB64TYKEMERX => "C:\Program Files\2VPYF6YL7M\G216FCQPW.exe"
MSCONFIG\startupreg: 9Y2PORON2FE3J83 => "C:\Program Files\9F07SKIR2D\9F07SKIR2.exe"
MSCONFIG\startupreg: B7Y6SX3D1V77K2L => "C:\Program Files\2G82F4OXWH\2G82F4OXW.exe"
MSCONFIG\startupreg: BC8L5MMQ4YU3X7A => "C:\Program Files\Z311KRXEYG\Z311KRXEY.exe"
MSCONFIG\startupreg: BG8S13EVSZUHIZN => "C:\Program Files\EBBT6CTG3O\EBBT6CTG3.exe"
MSCONFIG\startupreg: BK0V42SHDHBZLKO => "C:\Program Files\XAIFEKECIJ\XAIFEKECI.exe"
MSCONFIG\startupreg: BZAJFKO7DL6Y6FS => "C:\Program Files\IWMSY1DOTT\IWMSY1DOT.exe"
MSCONFIG\startupreg: C7XS2ICRYZDKEYY => "C:\Program Files\BGP3YH8TFW\BGP3YH8TF.exe"
MSCONFIG\startupreg: C9J72EDFYFQAY4S => "C:\Program Files\FWO6YW7JOU\4RE3DBZCT.exe"
MSCONFIG\startupreg: CM1SB9W27T04YKG => "C:\Program Files\PR007QSUNE\PR007QSUN.exe"
MSCONFIG\startupreg: CNSLTQ386WOD3C0 => "C:\Program Files\1OXC7KBD4I\1OXC7KBD4.exe"
MSCONFIG\startupreg: CY72QIAZKU32J7A => "C:\Program Files\A0WPVW3UK8\8Z3Y35XI1.exe"
MSCONFIG\startupreg: D05OPAIX87LHYFB => "C:\Program Files\GNJEATFXU8\A10L2X5GO.exe"
MSCONFIG\startupreg: D31DRIJN8NUIZBU => "C:\Program Files\JS7I2MXORV\JS7I2MXOR.exe"
MSCONFIG\startupreg: D8SB86YLN48YQDW => "C:\Program Files (x86)\lcuwjwqbcus\5H16V.exe"
MSCONFIG\startupreg: DSJG4J0GN5Q6GJ2 => "C:\Program Files\CH755U3ZJ1\CH755U3ZJ.exe"
MSCONFIG\startupreg: EAMOMZ2MQ1FEJ2A => "C:\Program Files\PCUXA37QQ2\PCUXA37QQ.exe"
MSCONFIG\startupreg: EB0D8CW6CCG0H0A => "C:\Program Files\1ZK6FECLKB\1ZK6FECLK.exe"
MSCONFIG\startupreg: F0NQ6Y3RA3JFZ0I => "C:\Program Files\DXFXB2EHY0\DXFXB2EHY.exe"
MSCONFIG\startupreg: FCFQ4XTUG48CXZY => "C:\Program Files\5T6LMF30AD\5T6LMF30A.exe"
MSCONFIG\startupreg: FT89ESRE9KRS47V => "C:\Program Files\I9ALJPIBHE\95T8RVGF4.exe"
MSCONFIG\startupreg: FWQY7GKRHCOJGET => "C:\Program Files\1ZEFQ32BLF\1ZEFQ32BL.exe"
MSCONFIG\startupreg: FZSJ79VFAX8Z8ZY => "C:\Program Files\5ROOPFWZTE\Z9C27U7JV.exe"
MSCONFIG\startupreg: G901705KAR07YK9 => "C:\Program Files\3WTK43QVEC\3WTK43QVE.exe"
MSCONFIG\startupreg: GO3XU1T5WG4Y1S2 => "C:\Program Files\D18XATKMD7\K5WJAWG67.exe"
MSCONFIG\startupreg: HL90MQK563VAT9H => "C:\Program Files\JJNOCC7HVM\JJNOCC7HV.exe"
MSCONFIG\startupreg: I9EUV8J914I6X6Z => "C:\Program Files\FPWUCK8UEC\FPWUCK8UE.exe"
MSCONFIG\startupreg: JCTHX67G6QHQY6W => "C:\Program Files\5T86VVBFHO\5T86VVBFH.exe"
MSCONFIG\startupreg: JJYRBJTUQ9072HD => "C:\Program Files\PMW30NTBGC\PMW30NTBG.exe"
MSCONFIG\startupreg: JUGSTCOFZGI3O9P => "C:\Program Files\KHR1W3B761\KHR1W3B76.exe"
MSCONFIG\startupreg: K38QHPUAIQW5KXR => "C:\Program Files\JUWO4ADHP5\JUWO4ADHP.exe"
MSCONFIG\startupreg: KL1KK7RGF7UJTZA => "C:\Program Files\CW0NHRN8GD\CW0NHRN8G.exe"
MSCONFIG\startupreg: KMGMLJVGVCG10NT => "C:\Program Files\IV7WHIQIDA\IV7WHIQID.exe"
MSCONFIG\startupreg: KS0VD0ZGWPY94FX => "C:\Program Files\02SRKASXK0\02SRKASXK.exe"
MSCONFIG\startupreg: KT3B6M50MGUR92F => "C:\Program Files\CF4E8UC0NW\CF4E8UC0N.exe"
MSCONFIG\startupreg: LI43O8ZZAHLAIAC => "C:\Program Files\WIIQ8JQ0T2\Z6DZEZF8N.exe"
MSCONFIG\startupreg: LN1X1LVZT7OC4GS => "C:\Program Files\B16V5PA35T\B16V5PA35.exe"
MSCONFIG\startupreg: M0EIX92SWP7O7JX => "C:\Program Files\H0L8YEGVUX\ZSMIEPC55.exe"
MSCONFIG\startupreg: MXZ2NILGFMZV3QW => "C:\Program Files\J4IYWN2XMK\DJZ5ORSGH.exe"
MSCONFIG\startupreg: N66M2XJVLGVY1J8 => "C:\Program Files\MSP4DY0CA8\MBSQ8LTVV.exe"
MSCONFIG\startupreg: NDSG51OG8HXLIBP => "C:\Program Files\LZUNHCUE03\5ROOPFWZT.exe"
MSCONFIG\startupreg: NUPUADWXMF2010B => "C:\Program Files\0VW7NFS9PT\0VW7NFS9P.exe"
MSCONFIG\startupreg: OVH86DZ8TPP2KS3 => "C:\Program Files\4KN5KV1ZDS\4KN5KV1ZD.exe"
MSCONFIG\startupreg: P28JJYK6XB8H19B => "C:\Program Files\XHZK5WGA9P\XHZK5WGA9.exe"
MSCONFIG\startupreg: PR8FIGXM8CP5DRM => "C:\Program Files\QKV22TRJU5\QKV22TRJU.exe"
MSCONFIG\startupreg: PSGDT4XCHP6A2K6 => "C:\Program Files\H6ES3R140M\H6ES3R140.exe"
MSCONFIG\startupreg: QHUKO6ZK8ZOPL57 => "C:\Program Files\3TRXU01O7O\3TRXU01O7.exe"
MSCONFIG\startupreg: QIPApp => "C:\Users\User\AppData\Roaming\QIPApp\QIPApp.exe"
MSCONFIG\startupreg: QO56MVB9S7GRQR4 => "C:\Program Files\ZHWJLX6D95\9MLB0MNUW.exe"
MSCONFIG\startupreg: QPQJQM4RN7UF849 => "C:\Program Files\B7L43NXP1V\B7L43NXP1.exe"
MSCONFIG\startupreg: QWHSOQX1IYEC7WL => "C:\Program Files\97P5GIW1TZ\3PCJYX7MV.exe"
MSCONFIG\startupreg: R3HRP5G6ML2UE14 => "C:\Program Files\4YO7CH20JK\5IKJZV0UN.exe"
MSCONFIG\startupreg: RPCYEN83CDU8B4A => "C:\Program Files\R69BJDUPSI\R69BJDUPS.exe"
MSCONFIG\startupreg: RTHDVCPL => "C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe" -s
MSCONFIG\startupreg: S6A8OHGOHFI0FEF => "C:\Program Files\FTG7DMUR7M\97YE5QKA2.exe"
MSCONFIG\startupreg: SDSYFAAD56RDS3Z => "C:\Program Files\8EQXL05I7K\8EQXL05I7.exe"
MSCONFIG\startupreg: SFCFK7OMY6Y8I4T => "C:\Program Files\REM5A8SIUT\REM5A8SIU.exe"
MSCONFIG\startupreg: SIFOMSXF8GJA4J2 => "C:\Program Files\QBJJOO5KJM\2H21W4SDO.exe"
MSCONFIG\startupreg: SN3BKIV6CSOXWHW => "C:\Program Files\QZ0S6SCA1U\QZ0S6SCA1.exe"
MSCONFIG\startupreg: STFO0419Q049URH => "C:\Program Files\EWOHPNAJ2W\EWOHPNAJ2.exe"
MSCONFIG\startupreg: TW77986X7LHAS4J => "C:\Program Files\I31LAYKXEH\I31LAYKXE.exe"
MSCONFIG\startupreg: US6XDGWKC0SH8RZ => "C:\Program Files\LY9M9BV2ZJ\LY9M9BV2Z.exe"
MSCONFIG\startupreg: vnlgp => C:\Users\User\AppData\Roaming\vnlgp\vnlgp\start.cmd
MSCONFIG\startupreg: W2IQ3P7FGB5BTHI => "C:\Program Files\B1JXFUH96O\B1JXFUH96.exe"
MSCONFIG\startupreg: X05ENUTLCD9KI1A => "C:\Program Files\JTBB0JJZU6\Z6DZEZF8N.exe"
MSCONFIG\startupreg: XH0M5H058IR1KCV => "C:\Program Files\9I7ZIJXIAW\9I7ZIJXIA.exe"
MSCONFIG\startupreg: XHXN2S1FG9V6CB2 => "C:\Program Files\OQ7IOZLZBV\OQ7IOZLZB.exe"
MSCONFIG\startupreg: XLG5NGAA0ROXZI1 => "C:\Program Files\RDOKULM825\RDOKULM82.exe"
MSCONFIG\startupreg: XLMXZRP0BJ28MWU => "C:\Program Files\TDO3YN7AVQ\RDVC5W1YD.exe"
MSCONFIG\startupreg: XZWFCK9057WMDZE => "C:\Program Files\WQLDZ4S8CN\ZSMIEPC55.exe"
MSCONFIG\startupreg: Y7UNLAGYJOCW3AN => "C:\Program Files\25AXGG7IC7\WKS48KX17.exe"
MSCONFIG\startupreg: YM8OGBWTCT0YIF9 => "C:\Program Files\PNXRZ1WOI7\CHTXMPI64.exe"
MSCONFIG\startupreg: YoutubeDownloader => "C:\Users\User\AppData\Roaming\YoutubeDownloader\python\pythonw.exe" "C:\Users\User\AppData\Roaming\YoutubeDownloader\ml.py" --APPNAME="YoutubeDownloader"
MSCONFIG\startupreg: YYB0SGVUWF2V9AM => "C:\Program Files\S9A9BSLNM4\S9A9BSLNM.exe"
MSCONFIG\startupreg: Z28OB5EO49B285I => "C:\Program Files\XAAPX6DNIU\XAAPX6DNI.exe"
MSCONFIG\startupreg: Z2SLXAYXPN4BLJH => "C:\Program Files\NDON732446\NDON73244.exe"
MSCONFIG\startupreg: ZNYYQ9TXG669W8A => "C:\Program Files\L27OJVSIVJ\5E5BMMMMA.exe"
MSCONFIG\startupreg: ZS56I56XMZKKVZS => "C:\Program Files\PNYJGD8Y5E\PNYJGD8Y5.exe"
Reboot:

2. Нажмите Файл – Сохранить как

3. Выберите папку, откуда была запущена утилита Farbar Recovery Scan Tool

4. Укажите Тип файла – Все файлы (*.*)

5. Введите имя файла fixlist.txt и нажмите кнопку Сохранить

6. Запустите FRST, нажмите один раз на кнопку Fix и подождите. Программа создаст лог-файл (Fixlog.txt). Пожалуйста, прикрепите его в следующем сообщении.

• Обратите внимание: будет выполнена перезагрузка компьютера.

[Богдан1982]

при попытке сохранить с именем  fixlist.txt  выскочило сообщеие

 

этот файл содержит текст в формате Юникод,который будет потерян,если вы сохраните этот файл как файл в формате ANSI.что бы сохранить данные в формате Юникод нажмите кнопку Отмена,и выберите один из вариантов сохранения юникод. продолжить?

[thyrex]

Продолжайте

[Богдан1982]

Создал файл,как вы указали. Но при запуске FRST64.exe опять открываеться,и тут же исчезает.

[thyrex]

Пробуйте в безопасном режиме

[Богдан1982]

Выполнил в безопасном,выскочило сообщение о создании Fixlog.txt,перегрузился.

 

прикладываю файл.

Fixlog.txt

[thyrex]

SafeFinder

System Healer

 

удалите через Установку программ

 

В логе FRST.txt рекомендуется переустановка Хрома из-за заражения одного из файлов

CHR res: Infected resources.pak (Adware script). Reinstall Chrome. <==== ATTENTION

 

 

Удалите файл Addition.txt и пробуйте собрать новые логи Farbar в обычном режиме