после перезагр.пк, вирус создает папки с рекламой.Помогите!

This topic has 1 ответ, 2 участника, and was last updated 8 years, 8 months назад by Admin.

Просмотр 2 сообщений - с 1 по 2 (из 2 всего)

Автор

Сообщения
8 марта, 2016 в 11:02 пп #19109
Vien87
Participant
- Темы:1
- Сообщений:1
[attachment=0:35280vcc]Addition.txt[/attachment:35280vcc]Доброй ночи!

Помогите решить проблему! Не могу удалить вирус. Ни одна программа не видит его. Проблема заключается в том что при перезагрузке создается папка в C:ProgramData после чего при в ходе в интернет через Хром выкидывает на рекламу. Заметил если не создавать ярлык на рабочем столе то папка не создается. Как избавиться от этого вируса? Помогите пож-та!
Спасибо!

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:05-03-2016 01
Ran by Acer-1 (administrator) on ACER-PC (09-03-2016 01:48:31)
Running from C:UsersAcer-1Desktop
Loaded Profiles: Acer-1 (Available Profiles: UpdatusUser & Acer-1)
Platform: Windows 8.1 Single Language (X64) Language: Русский (Россия)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forums/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(ESET) C:Program FilesESETESET Smart Securityekrn.exe
(NVIDIA Corporation) C:WindowsSystem32nvvsvc.exe
(NVIDIA Corporation) C:Program FilesNVIDIA CorporationDisplaynvxdsync.exe
(NVIDIA Corporation) C:WindowsSystem32nvvsvc.exe
(Intel Corporation) C:WindowsSystem32igfxCUIService.exe
(Microsoft Corporation) C:WindowsSystem32rundll32.exe
(Apple Inc.) C:Program FilesCommon FilesAppleMobile Device SupportAppleMobileDeviceService.exe
(Qualcomm Atheros Commnucations) C:Program Files (x86)Qualcomm AtherosBluetooth SuiteAdminService.exe
(Microsoft Corporation) C:Program Files (x86)SkypeToolbarsAutoUpdateSkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:Program Files (x86)SkypeToolbarsPNRSvcSkypeC2CPNRSvc.exe
(Acer Incorporated) C:Program Files (x86)AcerAcer CloudCCDMonitorService.exe
(Dritek System Inc.) C:Program Files (x86)Launch Managerdsiwmis.exe
() C:Program Files (x86)HpDefQHC2DK.exe
(Google Inc.) C:Program Files (x86)GoogleUpdate1.3.29.5GoogleCrashHandler.exe
(Dritek System Inc.) C:Program Files (x86)Launch ManagerLMutilps32.exe
(Intel(R) Corporation) C:Program FilesInteliCLS ClientHeciServer.exe
(Intel Corporation) C:Program Files (x86)IntelIntel(R) Management Engine ComponentsDALJhi_service.exe
(Malwarebytes) C:Program Files (x86)Malwarebytes Anti-Malwarembamscheduler.exe
(Dritek System Inc.) C:Program Files (x86)Launch ManagerLManager.exe
(Google Inc.) C:Program Files (x86)GoogleUpdate1.3.29.5GoogleCrashHandler64.exe
(Malwarebytes) C:Program Files (x86)Malwarebytes Anti-Malwarembamservice.exe
(NTI Corporation) C:Program Files (x86)NTIAcer Backup ManagerIScheduleSvc.exe
(Dritek System INC.) C:WindowsRfBtnSvc64.exe
(Malwarebytes) C:Program Files (x86)Malwarebytes Anti-Malwarembam.exe
(Atheros) C:Program Files (x86)Qualcomm AtherosAth_WlanAgent.exe
(Microsoft Corporation) C:WindowsSystem32GWXGWX.exe
(NVIDIA Corporation) C:Program FilesNVIDIA CorporationDisplaynvtray.exe
(Microsoft Corporation) C:WindowsMicrosoft.NETFramework64v3.0WPFPresentationFontCache.exe
(Dritek System Inc.) C:Program Files (x86)Launch ManagerMMDx64Fx.exe
(ESET) C:Program FilesESETESET Smart Securityegui.exe
(Intel Corporation) C:WindowsSystem32igfxext.exe
(Intel Corporation) C:WindowsSystem32igfxEM.exe
(Intel Corporation) C:WindowsSystem32igfxHK.exe
(Realtek Semiconductor) C:Program FilesRealtekAudioHDARAVCpl64.exe
(Realtek Semiconductor) C:Program FilesRealtekAudioHDARAVBg64.exe
(Skype Technologies S.A.) C:Program Files (x86)SkypePhoneSkype.exe
(NTI Corporation) C:Program Files (x86)NTIAcer Backup ManagerBackupManagerTray.exe
(Dolby Laboratories Inc.) C:Dolby PCEE4pcee4.exe
(Oracle Corporation) C:Program Files (x86)Common FilesJavaJava Updatejusched.exe
(CyberLink) C:Program Files (x86)CyberLinkMediaEspressoDeviceDetectorDeviceDetector.exe
() C:Program FilesAcerAcer Instant ServiceInstantUpdateiuEmailOutlookAgent.exe
() C:Program FilesAcerAcer Instant ServiceInstantUpdateiuBrowserIEAgent.exe
(Google Inc.) C:Program Files (x86)GoogleChromeApplicationchrome.exe
(Google Inc.) C:Program Files (x86)GoogleChromeApplicationchrome.exe
(Google Inc.) C:Program Files (x86)GoogleChromeApplicationchrome.exe
(Google Inc.) C:Program Files (x86)GoogleChromeApplicationchrome.exe
(Google Inc.) C:Program Files (x86)GoogleChromeApplicationchrome.exe
(Realsil Microelectronics Inc.) C:Program Files (x86)RealtekRealtek PCIE Card ReaderRIconMan.exe
(Intel Corporation) C:Program Files (x86)IntelIntel(R) Management Engine ComponentsLMSLMS.exe
(Intel Corporation) C:Program Files (x86)IntelIntel(R) Management Engine ComponentsUNSUNS.exe
(Google Inc.) C:Program Files (x86)GoogleChromeApplicationchrome.exe
(Microsoft Corporation) C:WindowsSystem32dllhost.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM…Run: [RtHDVCpl] => C:Program FilesRealtekAudioHDARAVCpl64.exe [12937872 2012-07-27] (Realtek Semiconductor)
HKLM…Run: [RtHDVBg_Dolby] => C:Program FilesRealtekAudioHDARAVBg64.exe [1214608 2012-07-10] (Realtek Semiconductor)
HKLM…Run: [HotKeysCmds] => C:Windowssystem32hkcmd.exe
HKLM-x32…Run: [LManager] => [X]
HKLM-x32…Run: [Dolby Home Theater v4] => C:Dolby PCEE4pcee4.exe [508656 2012-07-25] (Dolby Laboratories Inc.)
HKLM-x32…Run: [VKSaver] => C:ProgramDataVKSaverVKSaver.exe
HKLM-x32…Run: [SunJavaUpdateSched] => C:Program Files (x86)Common FilesJavaJava Updatejusched.exe [334896 2015-06-08] (Oracle Corporation)
HKLM-x32…Run: [sun21] => [X]
HKUS-1-5-21-976431788-3078866539-2970655778-1002…Run: [uTorrent] => C:UsersAcer-1AppDataRoaminguTorrentuTorrent.exe [2065944 2016-02-14] (BitTorrent Inc.)
HKUS-1-5-21-976431788-3078866539-2970655778-1002…Run: [SyncManPath] => C:UsersAcer-1AppDataRoamingYandexYandexDiskYandexDisk.exe [23848800 2016-02-10] (Яндекс)
HKUS-1-5-21-976431788-3078866539-2970655778-1002…Run: [Skype] => C:Program Files (x86)SkypePhoneSkype.exe [50591872 2016-02-11] (Skype Technologies S.A.)
HKUS-1-5-21-976431788-3078866539-2970655778-1002…MountPoints2: {17046367-8744-11e3-bea1-7c0507136633} — «E:setup.exe»
HKUS-1-5-21-976431788-3078866539-2970655778-1002…MountPoints2: {e3d004ae-a63e-11e5-bf16-2cd05a9063d5} — «F:HTC_Sync_Manager_PC.exe»
HKUS-1-5-18…Run: [Adguard] => C:Program Files (x86)AdguardAdguard.exe
ShellIconOverlayIdentifiers: [ YndCase0Sync] -> {63D48440-63AB-44D0-B323-4731DFCDE9E9} => C:Program FilesYandexYandexDiskbinYandexDiskOverlays-2398.dll [2015-12-02] (Яндекс)
ShellIconOverlayIdentifiers: [ YndCase1Modified] -> {7E7DC279-E6BE-4D57-9DEC-14FA0339DBC0} => C:Program FilesYandexYandexDiskbinYandexDiskOverlays-2398.dll [2015-12-02] (Яндекс)
ShellIconOverlayIdentifiers: [ YndCase2Error] -> {FB2FE984-05F5-4512-9D9B-69D3DE61F6D9} => C:Program FilesYandexYandexDiskbinYandexDiskOverlays-2398.dll [2015-12-02] (Яндекс)
ShellIconOverlayIdentifiers: [ YndCase3Shared] -> {AF8D197E-7022-4c3d-BD88-68AD35C9C169} => C:Program FilesYandexYandexDiskbinYandexDiskOverlays-2398.dll [2015-12-02] (Яндекс)
Startup: C:ProgramDataMicrosoftWindowsStart MenuProgramsStartupAcer Backup Manager Tray.lnk [2016-03-09]
ShortcutTarget: Acer Backup Manager Tray.lnk -> C:Program Files (x86)NTIAcer Backup ManagerBackupManagerTray.exe (NTI Corporation)
BootExecute: autocheck autochk * sh4native Sh4Removal
CHR HKLMSOFTWAREPoliciesGoogle: Restriction <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) TcpipParameters: [DhcpNameServer] 192.168.0.1
Tcpip..Interfaces{1212F2A6-5CD2-4E40-8B9A-6C3BADCBB05F}: [DhcpNameServer] 192.168.0.1
Tcpip..Interfaces{D10979F6-AE46-4A01-A557-19F408CFE195}: [DhcpNameServer] 192.168.1.1
ManualProxies:

Internet Explorer:
==================
HKUS-1-5-21-976431788-3078866539-2970655778-1002SoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = hxxp://acer13.msn.com
URLSearchHook: [S-1-5-21-976431788-3078866539-2970655778-1002] ATTENTION => Default URLSearchHook is missing
SearchScopes: HKUS-1-5-21-976431788-3078866539-2970655778-1002 -> {AD832EFD-261F-4AF2-9536-91C256BE3CFE} URL = hxxp://nova.rambler.ru/search?query={searchTerms}&utm_source=r41&utm_medium=distribution&utm_content=e09&utm_campaign=3w33
SearchScopes: HKUS-1-5-21-976431788-3078866539-2970655778-1002 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/distib/ep/?q={SearchTerms}&product_id=%7B9681B404-6357-4CB9-A19E-D6B65F7F8298%7D&gp=789106
BHO: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:Program Files (x86)Qualcomm AtherosBluetooth SuiteIEPlugIn.dll [2012-11-09] (Qualcomm Atheros Commnucations)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:Program Files (x86)SkypeToolbarsInternet Explorer x64skypeieplugin.dll [2016-01-08] (Microsoft Corporation)
BHO: Визуальные закладки -> {D5FEC983-01DB-414a-9456-AF95AC9ED7B5} -> No File
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:Program Files (x86)Javajre1.8.0_51binssv.dll [2015-10-02] (Oracle Corporation)
BHO-x32: No Name -> {8984B388-A5BB-4DF7-B274-77B879E179DB} -> No File
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:Program Files (x86)SkypeToolbarsInternet ExplorerSkypeIEPlugin.dll [2016-01-08] (Microsoft Corporation)
BHO-x32: Визуальные закладки -> {D5FEC983-01DB-414a-9456-AF95AC9ED7B5} -> No File
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:Program Files (x86)Javajre1.8.0_51binjp2ssv.dll [2015-10-02] (Oracle Corporation)
Toolbar: HKUS-1-5-21-976431788-3078866539-2970655778-1002 -> No Name — {09900DE8-1DCA-443F-9243-26FF581438AF} — No File
Handler-x32: skype4com — {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} — C:Program Files (x86)Common FilesSkypeSkype4COM.dll [2014-05-02] (Skype Technologies)
Handler: skypec2c — {91774881-D725-4E58-B298-07617B9B86A8} — C:Program Files (x86)SkypeToolbarsInternet Explorer x64skypeieplugin.dll [2016-01-08] (Microsoft Corporation)
Handler-x32: skypec2c — {91774881-D725-4E58-B298-07617B9B86A8} — C:Program Files (x86)SkypeToolbarsInternet ExplorerSkypeIEPlugin.dll [2016-01-08] (Microsoft Corporation)

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:WINDOWSsystem32MacromedFlashNPSWF64_20_0_0_306.dll [2016-02-09] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:WINDOWSSysWOW64MacromedFlashNPSWF32_20_0_0_306.dll [2016-02-09] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:Program Files (x86)iTunesMozilla Pluginsnpitunes.dll [2014-10-30] ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:Program Files (x86)DivXDivX Web Playernpdivx32.dll [2007-05-02] (DivX,Inc.)
FF Plugin-x32: @divx.com/DivX Content Upload Plugin,version=1.0.0 -> C:Program Files (x86)DivXDivX Content UploadernpUpload.dll [2007-05-02] (DivX,Inc.)
FF Plugin-x32: @divx.com/DivX Player Plugin,version=1.0.0 -> C:Program Files (x86)DivXDivX PlayernpDivxPlayerPlugin.dll [2007-05-02] (DivX, Inc)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:Program Files (x86)IntelIntel(R) Management Engine ComponentsIPTnpIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:Program Files (x86)IntelIntel(R) Management Engine ComponentsIPTnpIntelWebAPIUpdater.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.51.2 -> C:WINDOWSSysWOW64npdeployJava1.dll [2015-10-02] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin -> C:Program Files (x86)Javajre1.8.0_51binplugin2npjp2.dll [2015-10-02] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.51.2 -> C:Program Files (x86)Javajre1.8.0_51binplugin2npjp2.dll [2015-10-02] (Oracle Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:Program Files (x86)GoogleUpdate1.3.29.5npGoogleUpdate3.dll [2016-03-09] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:Program Files (x86)GoogleUpdate1.3.29.5npGoogleUpdate3.dll [2016-03-09] (Google Inc.)
FF Plugin HKUS-1-5-21-976431788-3078866539-2970655778-1002: @unity3d.com/UnityPlayer,version=1.0 -> C:UsersAcer-1AppDataLocalLowUnityWebPlayerloadernpUnity3D32.dll [2015-06-08] (Unity Technologies ApS)
FF HKLM-x32…ThunderbirdExtensions: [msktbird@mcafee.com] — C:Program FilesMcAfeeMSK => not found

Chrome:
=======
CHR StartupUrls: Profile 2 -> «hxxp://www.yandex.ru/»
CHR DefaultSearchURL: Profile 2 -> hxxp://yandex.ru/search/?from=chromesearch&clid=2242348&text={searchTerms}
CHR DefaultSearchKeyword: Profile 2 -> yandex.ru
CHR DefaultSuggestURL: Profile 2 -> hxxp://suggest.yandex.net/suggest-ff.cgi?uil=ru&part={searchTerms}
CHR Profile: C:UsersAcer-1AppDataLocalGoogleChromeUser DataDefault
CHR Profile: C:UsersAcer-1AppDataLocalGoogleChromeUser DataProfile 1
CHR Extension: (Google Презентации) — C:UsersAcer-1AppDataLocalGoogleChromeUser DataProfile 1Extensionsaapocclcgogkmnckokdopfmhonfmgoek [2015-03-05]
CHR Extension: (Скачать музыку с Вконтакте (vk.com)) — C:UsersAcer-1AppDataLocalGoogleChromeUser DataProfile 1Extensionsafkpfjljjhhonjehpkmgonimjjgaheap [2015-12-24]
CHR Extension: (Документы Google) — C:UsersAcer-1AppDataLocalGoogleChromeUser DataProfile 1Extensionsaohghmighlieiainnegkcijnfilokake [2015-03-05]
CHR Extension: (Диск Google) — C:UsersAcer-1AppDataLocalGoogleChromeUser DataProfile 1Extensionsapdfllckaahabafndbhieahigkjlhalf [2015-10-23]
CHR Extension: (YouTube) — C:UsersAcer-1AppDataLocalGoogleChromeUser DataProfile 1Extensionsblpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-26]
CHR Extension: (Google Search) — C:UsersAcer-1AppDataLocalGoogleChromeUser DataProfile 1Extensionscoobgpohoikkiipiblmjeljniedjpjpf [2015-10-28]
CHR Extension: (Google Таблицы) — C:UsersAcer-1AppDataLocalGoogleChromeUser DataProfile 1Extensionsfelcaaldnbdncclmgdcncolpebgiejap [2015-03-05]
CHR Extension: (Новости от Яндекса) — C:UsersAcer-1AppDataLocalGoogleChromeUser DataProfile 1Extensionsggcgbfdofnkhamefohachilfjjgiapjh [2016-03-08]
CHR Extension: (Google Документы офлайн) — C:UsersAcer-1AppDataLocalGoogleChromeUser DataProfile 1Extensionsghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-11-18]
CHR Extension: (Стартовая — Яндекс) — C:UsersAcer-1AppDataLocalGoogleChromeUser DataProfile 1Extensionslalfiodohdgaejjccfgfmmngggpplmhp [2016-03-07]
CHR Extension: (VK Music Downloader (for Chrome)) — C:UsersAcer-1AppDataLocalGoogleChromeUser DataProfile 1Extensionsmdkjmmonioggoohkigoedolpehjhfalh [2015-04-10]
CHR Extension: (Платежная система Интернет-магазина Chrome) — C:UsersAcer-1AppDataLocalGoogleChromeUser DataProfile 1Extensionsnmmhkkegccagdldgiimedpiccmgmieda [2015-07-26]
CHR Extension: (Gmail) — C:UsersAcer-1AppDataLocalGoogleChromeUser DataProfile 1Extensionspjkljhegncpnkpknbcohdijeoejaedia [2015-03-29]
CHR Profile: C:UsersAcer-1AppDataLocalGoogleChromeUser DataProfile 2
CHR Extension: (Google Презентации) — C:UsersAcer-1AppDataLocalGoogleChromeUser DataProfile 2Extensionsaapocclcgogkmnckokdopfmhonfmgoek [2016-03-08]
CHR Extension: (Документы Google) — C:UsersAcer-1AppDataLocalGoogleChromeUser DataProfile 2Extensionsaohghmighlieiainnegkcijnfilokake [2016-03-08]
CHR Extension: (Яндекс) — C:UsersAcer-1AppDataLocalGoogleChromeUser DataProfile 2Extensionsaojoeckcmjghlchnnenfkbflndbepjpk [2016-03-08]
CHR Extension: (Диск Google) — C:UsersAcer-1AppDataLocalGoogleChromeUser DataProfile 2Extensionsapdfllckaahabafndbhieahigkjlhalf [2016-03-08]
CHR Extension: (YouTube) — C:UsersAcer-1AppDataLocalGoogleChromeUser DataProfile 2Extensionsblpcfgokakmgnkcojhhkbfbldkacnbeo [2016-03-08]
CHR Extension: (Google Таблицы) — C:UsersAcer-1AppDataLocalGoogleChromeUser DataProfile 2Extensionsfelcaaldnbdncclmgdcncolpebgiejap [2016-03-08]
CHR Extension: (Google Документы офлайн) — C:UsersAcer-1AppDataLocalGoogleChromeUser DataProfile 2Extensionsghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-08]
CHR Extension: (Платежная система Интернет-магазина Chrome) — C:UsersAcer-1AppDataLocalGoogleChromeUser DataProfile 2Extensionsnmmhkkegccagdldgiimedpiccmgmieda [2016-03-08]
CHR Extension: (Gmail) — C:UsersAcer-1AppDataLocalGoogleChromeUser DataProfile 2Extensionspjkljhegncpnkpknbcohdijeoejaedia [2016-03-08]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 appdrvrem01; C:WindowsSystem32appdrvrem01.exe [476072 2015-11-28] (Protection Technology)
R2 Apple Mobile Device Service; C:Program FilesCommon FilesAppleMobile Device SupportAppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)
R2 AtherosSvc; C:Program Files (x86)Qualcomm AtherosBluetooth Suiteadminservice.exe [231040 2012-11-09] (Qualcomm Atheros Commnucations) [File not signed]
R2 c2cautoupdatesvc; C:Program Files (x86)SkypeToolbarsAutoUpdateSkypeC2CAutoUpdateSvc.exe [1433216 2016-01-08] (Microsoft Corporation)
R2 c2cpnrsvc; C:Program Files (x86)SkypeToolbarsPNRSvcSkypeC2CPNRSvc.exe [1773696 2016-01-08] (Microsoft Corporation)
R2 CCDMonitorService; C:Program Files (x86)AcerAcer CloudCCDMonitorService.exe [2449552 2012-10-25] (Acer Incorporated)
S3 DeviceFastLaneService; C:Program FilesAcerAcer Device Fast-laneDeviceFastLaneSvc.exe [469648 2012-11-17] (Acer Incorporated)
R2 ekrn; C:Program FilesESETESET Smart Securityekrn.exe [2521080 2015-11-19] (ESET)
S3 ePowerSvc; C:Program FilesAcerAcer Power ManagementePowerSvc.exe [658064 2012-10-23] (Acer Incorporated)
R2 HSystem; C:Program Files (x86)HpDefQHC2DK.exe [181704 2016-03-06] () [File not signed]
R2 igfxCUIService1.0.0.0; C:Windowssystem32igfxCUIService.exe [314696 2014-05-20] (Intel Corporation)
R2 jhi_service; C:Program Files (x86)IntelIntel(R) Management Engine ComponentsDALjhi_service.exe [165760 2012-07-17] (Intel Corporation)
R2 MBAMScheduler; C:Program Files (x86)Malwarebytes Anti-Malwarembamscheduler.exe [1513784 2015-10-05] (Malwarebytes)
R2 MBAMService; C:Program Files (x86)Malwarebytes Anti-Malwarembamservice.exe [1135416 2015-10-05] (Malwarebytes)
R2 NTI IScheduleSvc; C:Program Files (x86)NTIAcer Backup ManagerIScheduleSvc.exe [259136 2012-11-03] (NTI Corporation)
R2 RfButtonDriverService; C:WindowsRfBtnSvc64.exe [93296 2013-03-21] (Dritek System INC.)
S3 WdNisSvc; C:Program FilesWindows DefenderNisSrv.exe [366552 2015-07-07] (Microsoft Corporation)
S3 WinDefend; C:Program FilesWindows DefenderMsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)
R2 ZAtheros Wlan Agent; C:Program Files (x86)Qualcomm AtherosAth_WlanAgent.exe [81536 2012-11-09] (Atheros) [File not signed]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 adgnetworktdidrv; C:WindowsSystem32driversadgnetworktdidrv.sys [61432 2015-06-02] ()
R1 appdrv01; C:WindowsSystem32Driversappdrv01.sys [2221400 2015-11-28] (Protection Technology)
S3 BTATH_LWFLT; C:Windowssystem32DRIVERSbtath_lwflt.sys [76952 2012-11-09] (Qualcomm Atheros)
S3 dot4; C:Windowssystem32DRIVERSDot4.sys [146856 2013-06-04] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:WindowsSystem32driversDot4Prt.sys [21928 2013-06-04] (Windows (R) Win 7 DDK provider)
R1 dtsoftbus01; C:WindowsSystem32driversdtsoftbus01.sys [283064 2014-02-02] (Disc Soft Ltd)
R1 eamonm; C:WindowsSystem32DRIVERSeamonm.sys [263528 2015-12-08] (ESET)
S0 ebdrv; C:WindowsSystem32driversevbda.sys [3357024 2013-08-22] (Broadcom Corporation)
S0 eelam; C:WindowsSystem32DRIVERSeelam.sys [14976 2015-11-27] (ESET)
R1 ehdrv; C:Windowssystem32DRIVERSehdrv.sys [186784 2015-11-27] (ESET)
R2 ekbdflt; C:Windowssystem32DRIVERSekbdflt.sys [142976 2015-11-27] (ESET)
R1 epfw; C:Windowssystem32DRIVERSepfw.sys [206312 2015-11-27] (ESET)
R1 EpfwLWF; C:Windowssystem32DRIVERSEpfwLWF.sys [52872 2015-11-27] (ESET)
R0 epfwwfp; C:WindowsSystem32DRIVERSepfwwfp.sys [69840 2015-11-27] (ESET)
S3 EsgScanner; C:WindowsSystem32DRIVERSEsgScanner.sys [22704 2016-03-07] ()
R0 kl1; C:WindowsSystem32DRIVERSkl1.sys [458336 2014-03-10] (Kaspersky Lab ZAO)
S0 klelam; C:WindowsSystem32DRIVERSklelam.sys [29792 2014-03-10] (Kaspersky Lab)
S4 klflt; C:WindowsSystem32DRIVERSklflt.sys [115296 2014-03-21] (Kaspersky Lab ZAO)
R1 KLIF; C:WindowsSystem32DRIVERSklif.sys [625760 2014-03-21] (Kaspersky Lab ZAO)
R1 KLIM6; C:Windowssystem32DRIVERSklim6.sys [30304 2013-10-11] (Kaspersky Lab ZAO)
R3 klkbdflt; C:Windowssystem32DRIVERSklkbdflt.sys [29280 2014-03-10] (Kaspersky Lab ZAO)
R3 klmouflt; C:Windowssystem32DRIVERSklmouflt.sys [29280 2013-10-11] (Kaspersky Lab ZAO)
R1 klpd; C:Windowssystem32DRIVERSklpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 klwfp; C:Windowssystem32DRIVERSklwfp.sys [65120 2014-03-21] (Kaspersky Lab ZAO)
R1 kneps; C:Windowssystem32DRIVERSkneps.sys [178272 2014-03-10] (Kaspersky Lab ZAO)
R3 MBAMProtector; C:WINDOWSsystem32driversmbam.sys [25816 2015-10-05] (Malwarebytes)
R3 MBAMSwissArmy; C:WINDOWSsystem32driversMBAMSwissArmy.sys [192216 2016-03-09] (Malwarebytes)
R3 MBAMWebAccessControl; C:WINDOWSsystem32driversmwac.sys [64216 2015-10-05] (Malwarebytes Corporation)
R3 Ps2Kb2Hid; C:WindowsSystem32driversaPs2Kb2Hid.sys [26736 2013-03-21] (Dritek System Inc.)
S3 WdBoot; C:Windowssystem32driversWdBoot.sys [44560 2015-07-07] (Microsoft Corporation)
R0 WdFilter; C:WindowsSystem32driversWdFilter.sys [270168 2015-07-07] (Microsoft Corporation)
R2 WdNisDrv; C:WindowsSystem32DriversWdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)
S3 ApfiltrService; SystemRootsystem32DRIVERSApfiltr.sys [X]
S3 esgiguard; ??C:UsersAcer-1AppDataLocalTempRar$EXa0.704SpyHunter 4.20.9.4533 Portableesgiguard.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-03-09 01:48 — 2016-03-09 01:48 — 00000000 ____D C:UsersAcer-1AppDataLocalqSXpEdA
2016-03-09 01:47 — 2016-03-09 01:48 — 00023114 _____ C:UsersAcer-1DesktopFRST.txt
2016-03-09 01:47 — 2016-03-09 01:47 — 00000000 ____D C:UsersAcer-1AppDataLocalxlnbGzcI
2016-03-09 01:47 — 2016-03-09 01:47 — 00000000 ____D C:UsersAcer-1AppDataLocalVnhWmQ
2016-03-09 01:46 — 2016-03-09 01:47 — 00041125 _____ C:UsersAcer-1DesktopAddition.txt
2016-03-09 01:46 — 2016-03-09 01:46 — 00000000 ____D C:UsersAcer-1AppDataLocalwaLShCHwR
2016-03-09 01:46 — 2016-03-09 01:46 — 00000000 ____D C:UsersAcer-1AppDataLocalkyZHTIB
2016-03-09 01:45 — 2016-03-09 01:45 — 00000000 ____D C:UsersAcer-1AppDataLocalfAvMzXmGjQ
2016-03-09 01:44 — 2016-03-09 01:44 — 00000000 ____D C:UsersAcer-1AppDataLocalNBfXyoko
2016-03-09 01:44 — 2016-03-09 01:44 — 00000000 ____D C:UsersAcer-1AppDataLocalabKpkhwVw
2016-03-09 01:43 — 2016-03-09 01:43 — 00000000 ____D C:UsersAcer-1AppDataLocalXAJtCvZ
2016-03-09 01:42 — 2016-03-09 01:42 — 00000000 ____D C:UsersAcer-1AppDataLocalWKNUsWgK
2016-03-09 01:42 — 2016-03-09 01:42 — 00000000 ____D C:UsersAcer-1AppDataLocalhaxliER
2016-03-09 01:41 — 2016-03-09 01:41 — 00000000 ____D C:UsersAcer-1AppDataLocaldVHABJ
2016-03-09 01:40 — 2016-03-09 01:40 — 00000000 ____D C:UsersAcer-1AppDataLocalZsBdfClD
2016-03-09 01:40 — 2016-03-09 01:40 — 00000000 ____D C:UsersAcer-1AppDataLocalnTzNpBJ
2016-03-09 01:39 — 2016-03-09 01:39 — 00000000 ____D C:UsersВсе пользователиxZQQUH
2016-03-09 01:39 — 2016-03-09 01:39 — 00000000 ____D C:UsersAcer-1AppDataLocaldEWOVgsie
2016-03-09 01:39 — 2016-03-09 01:39 — 00000000 ____D C:ProgramDataxZQQUH
2016-03-09 01:28 — 2016-03-09 01:28 — 00041250 _____ C:UsersAcer-1DownloadsAddition.txt
2016-03-09 01:27 — 2016-03-09 01:48 — 00000000 ____D C:FRST
2016-03-09 01:27 — 2016-03-09 01:28 — 00121268 _____ C:UsersAcer-1DownloadsFRST.txt
2016-03-09 01:26 — 2016-03-09 01:26 — 02374144 _____ (Farbar) C:UsersAcer-1DesktopFRST64.exe
2016-03-09 01:19 — 2016-03-09 01:39 — 00002235 _____ C:UsersPublicDesktopGoogle Chrome.lnk
2016-03-09 01:18 — 2016-03-09 01:38 — 00000980 _____ C:WINDOWSTasksGoogleUpdateTaskMachineCore.job
2016-03-09 01:18 — 2016-03-09 01:23 — 00000984 _____ C:WINDOWSTasksGoogleUpdateTaskMachineUA.job
2016-03-09 01:18 — 2016-03-09 01:19 — 00000000 ____D C:Program Files (x86)Google
2016-03-09 01:18 — 2016-03-09 01:18 — 00003956 _____ C:WINDOWSSystem32TasksGoogleUpdateTaskMachineUA
2016-03-09 01:18 — 2016-03-09 01:18 — 00003720 _____ C:WINDOWSSystem32TasksGoogleUpdateTaskMachineCore
2016-03-09 01:15 — 2016-03-09 01:15 — 00000000 ____D C:UsersAcer-1AppDataLocalDRZGLf
2016-03-09 01:14 — 2016-03-09 01:14 — 00000000 ____D C:UsersAcer-1AppDataLocalvPAARWETf
2016-03-09 01:13 — 2016-03-09 01:13 — 00000000 ____D C:UsersAcer-1AppDataLocalOjgNHOtQqc
2016-03-09 01:13 — 2016-03-09 01:13 — 00000000 ____D C:UsersAcer-1AppDataLocallvfXzHtD
2016-03-09 01:12 — 2016-03-09 01:12 — 00000000 ____D C:UsersAcer-1AppDataLocalrWsByrCuHf
2016-03-09 01:12 — 2016-03-09 01:12 — 00000000 ____D C:UsersAcer-1AppDataLocalaBRrfp
2016-03-09 01:11 — 2016-03-09 01:11 — 00000000 ____D C:UsersAcer-1AppDataLocalXrEMMbLM
2016-03-09 01:10 — 2016-03-09 01:10 — 00000000 ____D C:UsersAcer-1AppDataLocalTozXET
2016-03-09 01:10 — 2016-03-09 01:10 — 00000000 ____D C:UsersAcer-1AppDataLocalgclNgLPYr
2016-03-09 01:09 — 2016-03-09 01:09 — 00000000 ____D C:UsersAcer-1AppDataLocalWCVdlMdlJq
2016-03-09 01:08 — 2016-03-09 01:08 — 00000000 ____D C:UsersAcer-1AppDataLocalYOkvjdVQ
2016-03-09 01:08 — 2016-03-09 01:08 — 00000000 ____D C:UsersAcer-1AppDataLocalCEQQTNVuEt
2016-03-09 01:07 — 2016-03-09 01:07 — 00000000 ____D C:UsersAcer-1AppDataLocalLhCAxzmgf
2016-03-09 01:06 — 2016-03-09 01:06 — 00000000 ____D C:UsersAcer-1AppDataLocalHebXaUwc
2016-03-09 01:06 — 2016-03-09 01:06 — 00000000 ____D C:UsersAcer-1AppDataLocalExZUumn
2016-03-09 01:05 — 2016-03-09 01:05 — 00000000 ____D C:UsersAcer-1AppDataLocalSbbQGTT
2016-03-09 00:28 — 2016-03-09 00:28 — 00000000 ____D C:UsersAcer-1AppDataLocalYdxUCUs
2016-03-09 00:28 — 2016-03-09 00:28 — 00000000 ____D C:UsersAcer-1AppDataLocalCicSalzvF
2016-03-09 00:27 — 2016-03-09 00:27 — 00000000 ____D C:UsersAcer-1AppDataLocalLXNXqFV
2016-03-09 00:26 — 2016-03-09 00:26 — 00000000 ____D C:UsersAcer-1AppDataLocalGUztHq
2016-03-09 00:26 — 2016-03-09 00:26 — 00000000 ____D C:UsersAcer-1AppDataLocalEMHJSXFJhF
2016-03-09 00:25 — 2016-03-09 00:25 — 00000000 ____D C:UsersAcer-1AppDataLocalnDkoWhhBZ
2016-03-09 00:24 — 2016-03-09 00:24 — 00000000 ____D C:UsersAcer-1AppDataLocalZzVvFgqSYL
2016-03-09 00:24 — 2016-03-09 00:24 — 00000000 ____D C:UsersAcer-1AppDataLocalcnDlkEL
2016-03-09 00:23 — 2016-03-09 00:23 — 00000000 ____D C:UsersAcer-1AppDataLocalhtxdoURWA
2016-03-09 00:22 — 2016-03-09 00:22 — 00000000 ____D C:UsersAcer-1AppDataLocalQshWhH
2016-03-09 00:22 — 2016-03-09 00:22 — 00000000 ____D C:UsersAcer-1AppDataLocalakubLtzn
2016-03-09 00:21 — 2016-03-09 00:21 — 00000000 ____D C:UsersAcer-1AppDataLocalbNAStstdL
2016-03-09 00:20 — 2016-03-09 00:20 — 00000000 ____D C:UsersAcer-1AppDataLocalKkOAzYCqOz
2016-03-09 00:20 — 2016-03-09 00:20 — 00000000 ____D C:UsersAcer-1AppDataLocalirPHJkV
2016-03-09 00:19 — 2016-03-09 00:19 — 00000000 ____D C:UsersAcer-1AppDataLocalrJdMUD
2016-03-09 00:19 — 2016-03-09 00:19 — 00000000 ____D C:UsersAcer-1AppDataLocalbhOxuyk
2016-03-09 00:17 — 2016-03-09 00:17 — 00000000 ____D C:UsersAcer-1AppDataLocaleGMgGJJ
2016-03-09 00:16 — 2016-03-09 00:16 — 00000000 ____D C:UsersAcer-1AppDataLocalhgRELBzy
2016-03-09 00:15 — 2016-03-09 00:15 — 00000000 ____D C:UsersAcer-1AppDataLocalswuXJar
2016-03-09 00:15 — 2016-03-09 00:15 — 00000000 ____D C:UsersAcer-1AppDataLocalMWEURt
2016-03-09 00:14 — 2016-03-09 00:14 — 00000000 ____D C:UsersAcer-1AppDataLocalUOAqXkYq
2016-03-09 00:13 — 2016-03-09 00:13 — 00000000 ____D C:UsersAcer-1AppDataLocalRcylAT
2016-03-09 00:13 — 2016-03-09 00:13 — 00000000 ____D C:UsersAcer-1AppDataLocaljFWrYnYxiC
2016-03-09 00:12 — 2016-03-09 00:12 — 00000000 ____D C:UsersAcer-1AppDataLocalmoOWILAhbL
2016-03-09 00:12 — 2016-03-09 00:12 — 00000000 ____D C:UsersAcer-1AppDataLocalHePUVSL
2016-03-09 00:11 — 2016-03-09 00:11 — 00000000 ____D C:UsersAcer-1AppDataLocalXHdJDM
2016-03-09 00:11 — 2016-03-09 00:11 — 00000000 ____D C:UsersAcer-1AppDataLocalQewBgeOzi
2016-03-08 23:40 — 2016-03-08 23:40 — 00000000 ____D C:UsersAcer-1AppDataLocalZbYMYv
2016-03-08 23:40 — 2016-03-08 23:40 — 00000000 ____D C:UsersAcer-1AppDataLocalpkGtZjtmT
2016-03-08 23:39 — 2016-03-08 23:39 — 00000000 ____D C:UsersAcer-1AppDataLocalutpfPRH
2016-03-08 23:38 — 2016-03-08 23:38 — 00000000 ____D C:UsersAcer-1AppDataLocalrKDbmJ
2016-03-08 23:38 — 2016-03-08 23:38 — 00000000 ____D C:UsersAcer-1AppDataLocalJpopcLUZuH
2016-03-08 23:37 — 2016-03-08 23:37 — 00000000 ____D C:UsersAcer-1AppDataLocalbnjSSBZ
2016-03-08 23:36 — 2016-03-08 23:36 — 00000000 ____D C:UsersAcer-1AppDataLocalLPyAqlS
2016-03-08 23:36 — 2016-03-08 23:36 — 00000000 ____D C:UsersAcer-1AppDataLocaliTiIbdZGv
2016-03-08 23:35 — 2016-03-09 01:39 — 00192216 _____ (Malwarebytes) C:WINDOWSsystem32DriversMBAMSwissArmy.sys
2016-03-08 23:35 — 2016-03-09 00:49 — 00001078 _____ C:UsersPublicDesktopMalwarebytes Anti-Malware.lnk
2016-03-08 23:35 — 2016-03-08 23:35 — 00000000 ____D C:UsersВсе пользователиMalwarebytes
2016-03-08 23:35 — 2016-03-08 23:35 — 00000000 ____D C:UsersAcer-1AppDataLocaltjPMdmcV
2016-03-08 23:35 — 2016-03-08 23:35 — 00000000 ____D C:ProgramDataMicrosoftWindowsStart MenuProgramsMalwarebytes Anti-Malware
2016-03-08 23:35 — 2016-03-08 23:35 — 00000000 ____D C:ProgramDataMalwarebytes
2016-03-08 23:35 — 2016-03-08 23:35 — 00000000 ____D C:Program Files (x86)Malwarebytes Anti-Malware
2016-03-08 23:35 — 2015-10-05 09:50 — 00109272 _____ (Malwarebytes) C:WINDOWSsystem32Driversmbamchameleon.sys
2016-03-08 23:35 — 2015-10-05 09:50 — 00064216 _____ (Malwarebytes Corporation) C:WINDOWSsystem32Driversmwac.sys
2016-03-08 23:35 — 2015-10-05 09:50 — 00025816 _____ (Malwarebytes) C:WINDOWSsystem32Driversmbam.sys
2016-03-08 23:34 — 2016-03-08 23:34 — 22908888 _____ (Malwarebytes ) C:UsersAcer-1Desktopmbam-setup-2.2.0.1024.exe
2016-03-08 23:34 — 2016-03-08 23:34 — 00000000 ____D C:UsersAcer-1AppDataLocalwrtoeD
2016-03-08 23:34 — 2016-03-08 23:34 — 00000000 ____D C:UsersAcer-1AppDataLocalGvQXJFfjNP
2016-03-08 23:33 — 2016-03-08 23:33 — 00000000 ____D C:UsersAcer-1AppDataLocalNJIlLomsvH
2016-03-08 23:33 — 2016-03-08 23:33 — 00000000 ____D C:UsersAcer-1AppDataLocalcSObhZO
2016-03-08 23:32 — 2016-03-08 23:32 — 00000000 ____D C:UsersAcer-1AppDataLocalOCngTgmb
2016-03-08 23:31 — 2016-03-08 23:31 — 00000000 ____D C:UsersAcer-1AppDataLocalPJKPln
2016-03-08 23:31 — 2016-03-08 23:31 — 00000000 ____D C:UsersAcer-1AppDataLocaleReEOcea
2016-03-08 23:23 — 2016-03-09 01:37 — 00000000 ____D C:Program Files (x86)AdwCleaner
2016-03-08 23:23 — 2016-03-08 23:23 — 01524224 _____ C:UsersAcer-1Desktopadwcleaner_5.101.exe
2016-03-08 23:09 — 2016-03-08 23:09 — 00000000 ____D C:UsersAcer-1AppDataLocalImOiFzSG
2016-03-08 23:08 — 2016-03-08 23:08 — 00000000 ____D C:UsersAcer-1AppDataLocalwudcKQgER
2016-03-08 23:07 — 2016-03-08 23:07 — 00000000 ____D C:UsersAcer-1AppDataLocalNZHYIFJP
2016-03-08 23:07 — 2016-03-08 23:07 — 00000000 ____D C:UsersAcer-1AppDataLocalgUJAtINhob
2016-03-08 23:06 — 2016-03-08 23:06 — 00000000 ____D C:UsersAcer-1AppDataLocalszzZZXQbZ
2016-03-08 23:05 — 2016-03-08 23:05 — 00000000 ____D C:UsersAcer-1AppDataLocalhuGrPir
2016-03-08 23:05 — 2016-03-08 23:05 — 00000000 ____D C:UsersAcer-1AppDataLocalCUaHYo
2016-03-08 23:04 — 2016-03-08 23:04 — 00000000 ____D C:UsersAcer-1AppDataLocalzTbJbdx
2016-03-08 23:04 — 2016-03-08 23:04 — 00000000 ____D C:UsersAcer-1AppDataLocaliVZWzy
2016-03-08 23:03 — 2016-03-08 23:03 — 00000000 ____D C:UsersAcer-1AppDataLocalGswtPsBu
2016-03-08 23:02 — 2016-03-08 23:02 — 00000000 ____D C:UsersAcer-1AppDataLocalSNvfmU
2016-03-08 23:02 — 2016-03-08 23:02 — 00000000 ____D C:UsersAcer-1AppDataLocalqSYlFlIXV
2016-03-08 23:01 — 2016-03-08 23:01 — 00000000 ____D C:UsersAcer-1AppDataLocalISMYhXpfUE
2016-03-08 23:01 — 2016-03-08 23:01 — 00000000 ____D C:UsersAcer-1AppDataLocalcrckaFmQZ
2016-03-08 23:00 — 2016-03-08 23:00 — 00000000 ____D C:UsersAcer-1AppDataLocalkJJWqowI
2016-03-08 22:59 — 2016-03-08 22:59 — 00000000 ____D C:UsersAcer-1AppDataLocalymvlMJnFO
2016-03-08 22:56 — 2016-03-08 22:56 — 00000000 ____D C:UsersAcer-1AppDataLocaltmqCvpv
2016-03-08 22:56 — 2016-03-08 22:56 — 00000000 ____D C:UsersAcer-1AppDataLocalQSivdwCvII
2016-03-08 22:55 — 2016-03-08 22:55 — 00000000 ____D C:UsersAcer-1AppDataLocalUcthKgCUa
2016-03-08 22:54 — 2016-03-08 22:54 — 00000000 ____D C:UsersAcer-1AppDataLocalZeORVcUWBg
2016-03-08 22:54 — 2016-03-08 22:54 — 00000000 ____D C:UsersAcer-1AppDataLocalfAtKoz
2016-03-08 22:53 — 2016-03-08 22:53 — 00000000 ____D C:UsersAcer-1AppDataLocalQpOydQZ
2016-03-08 22:52 — 2016-03-08 22:52 — 00000000 ____D C:UsersAcer-1AppDataLocalTVshaGcaMn
2016-03-08 22:52 — 2016-03-08 22:52 — 00000000 ____D C:UsersAcer-1AppDataLocalavIwNHLgd
2016-03-08 22:51 — 2016-03-08 22:51 — 00000000 ____D C:UsersAcer-1AppDataLocalWPUmqpBaA
2016-03-08 22:51 — 2016-03-08 22:51 — 00000000 ____D C:UsersAcer-1AppDataLocalKRHRgX
2016-03-08 22:50 — 2016-03-08 22:50 — 00000000 ____D C:UsersAcer-1AppDataLocalGjaFtoOybc
2016-03-08 22:49 — 2016-03-08 22:49 — 00000000 ____D C:UsersAcer-1AppDataLocaloNGwjh
2016-03-08 22:49 — 2016-03-08 22:49 — 00000000 ____D C:UsersAcer-1AppDataLocalcYlhcf
2016-03-08 22:48 — 2016-03-08 22:48 — 00000000 ____D C:UsersAcer-1AppDataLocalyAksuEXqF
2016-03-08 22:47 — 2016-03-08 22:47 — 00000000 ____D C:UsersAcer-1AppDataLocalmPVWNz
2016-03-08 22:47 — 2016-03-08 22:47 — 00000000 ____D C:UsersAcer-1AppDataLocalklCmlPbGmb
2016-03-08 22:41 — 2016-03-08 22:42 — 00000000 ____D C:UsersAcer-1DesktopВирус
2016-03-08 22:31 — 2016-02-20 18:45 — 01373184 _____ (Microsoft Corporation) C:WINDOWSsystem32appraiser.dll
2016-03-08 22:31 — 2016-02-20 18:45 — 01168896 _____ (Microsoft Corporation) C:WINDOWSsystem32aeinv.dll
2016-03-08 22:31 — 2016-02-20 18:45 — 00696832 _____ (Microsoft Corporation) C:WINDOWSsystem32invagent.dll
2016-03-08 22:31 — 2016-02-20 18:45 — 00689152 _____ (Microsoft Corporation) C:WINDOWSsystem32generaltel.dll
2016-03-08 22:31 — 2016-02-20 18:45 — 00499200 _____ (Microsoft Corporation) C:WINDOWSsystem32devinv.dll
2016-03-08 22:31 — 2016-02-20 18:45 — 00076800 _____ (Microsoft Corporation) C:WINDOWSsystem32acmigration.dll
2016-03-08 22:31 — 2016-02-09 00:05 — 20352512 _____ (Microsoft Corporation) C:WINDOWSSysWOW64mshtml.dll
2016-03-08 22:31 — 2016-02-08 23:39 — 00496640 _____ (Microsoft Corporation) C:WINDOWSSysWOW64vbscript.dll
2016-03-08 22:31 — 2016-02-08 23:34 — 02280448 _____ (Microsoft Corporation) C:WINDOWSSysWOW64iertutil.dll
2016-03-08 22:31 — 2016-02-08 23:29 — 00099328 _____ (Microsoft Corporation) C:WINDOWSSysWOW64hlink.dll
2016-03-08 22:31 — 2016-02-08 23:28 — 00663552 _____ (Microsoft Corporation) C:WINDOWSSysWOW64jscript.dll
2016-03-08 22:31 — 2016-02-08 23:10 — 04611072 _____ (Microsoft Corporation) C:WINDOWSSysWOW64jscript9.dll
2016-03-08 22:31 — 2016-02-08 23:07 — 00880128 _____ (Microsoft Corporation) C:WINDOWSSysWOW64inetcomm.dll
2016-03-08 22:31 — 2016-02-08 23:05 — 25816576 _____ (Microsoft Corporation) C:WINDOWSsystem32mshtml.dll
2016-03-08 22:31 — 2016-02-08 23:03 — 00230400 _____ (Microsoft Corporation) C:WINDOWSSysWOW64webcheck.dll
2016-03-08 22:31 — 2016-02-08 23:02 — 13012480 _____ (Microsoft Corporation) C:WINDOWSSysWOW64ieframe.dll
2016-03-08 22:31 — 2016-02-08 23:02 — 00687104 _____ (Microsoft Corporation) C:WINDOWSSysWOW64msfeeds.dll
2016-03-08 22:31 — 2016-02-08 23:01 — 02050560 _____ (Microsoft Corporation) C:WINDOWSSysWOW64inetcpl.cpl
2016-03-08 22:31 — 2016-02-08 22:43 — 02121216 _____ (Microsoft Corporation) C:WINDOWSSysWOW64wininet.dll
2016-03-08 22:31 — 2016-02-08 22:39 — 01311744 _____ (Microsoft Corporation) C:WINDOWSSysWOW64urlmon.dll
2016-03-08 22:31 — 2016-02-08 22:38 — 00710144 _____ (Microsoft Corporation) C:WINDOWSSysWOW64ieapfltr.dll
2016-03-08 22:31 — 2016-02-08 21:27 — 02887680 _____ (Microsoft Corporation) C:WINDOWSsystem32iertutil.dll
2016-03-08 22:31 — 2016-02-08 21:26 — 00571904 _____ (Microsoft Corporation) C:WINDOWSsystem32vbscript.dll
2016-03-08 22:31 — 2016-02-08 21:16 — 06052352 _____ (Microsoft Corporation) C:WINDOWSsystem32jscript9.dll
2016-03-08 22:31 — 2016-02-08 21:14 — 00108544 _____ (Microsoft Corporation) C:WINDOWSsystem32hlink.dll
2016-03-08 22:31 — 2016-02-08 21:13 — 00817664 _____ (Microsoft Corporation) C:WINDOWSsystem32jscript.dll
2016-03-08 22:31 — 2016-02-08 20:51 — 00092160 _____ (Microsoft Corporation) C:WINDOWSsystem32mshtmled.dll
2016-03-08 22:31 — 2016-02-08 20:42 — 01032704 _____ (Microsoft Corporation) C:WINDOWSsystem32inetcomm.dll
2016-03-08 22:31 — 2016-02-08 20:37 — 00262144 _____ (Microsoft Corporation) C:WINDOWSsystem32webcheck.dll
2016-03-08 22:31 — 2016-02-08 20:34 — 00798720 _____ (Microsoft Corporation) C:WINDOWSsystem32msfeeds.dll
2016-03-08 22:31 — 2016-02-08 20:33 — 14613504 _____ (Microsoft Corporation) C:WINDOWSsystem32ieframe.dll
2016-03-08 22:31 — 2016-02-08 20:33 — 02123264 _____ (Microsoft Corporation) C:WINDOWSsystem32inetcpl.cpl
2016-03-08 22:31 — 2016-02-08 20:19 — 02597376 _____ (Microsoft Corporation) C:WINDOWSsystem32wininet.dll
2016-03-08 22:31 — 2016-02-08 20:15 — 02880000 _____ (Microsoft Corporation) C:WINDOWSsystem32actxprxy.dll
2016-03-08 22:31 — 2016-02-08 20:07 — 01546752 _____ (Microsoft Corporation) C:WINDOWSsystem32urlmon.dll
2016-03-08 22:31 — 2016-02-08 19:55 — 00800768 _____ (Microsoft Corporation) C:WINDOWSsystem32ieapfltr.dll
2016-03-08 22:31 — 2016-02-05 22:06 — 00046768 _____ (Microsoft Corporation) C:WINDOWSsystem32CompatTelRunner.exe
2016-03-08 22:31 — 2016-01-06 21:25 — 00416768 _____ (Microsoft Corporation) C:WINDOWSsystem32Driverssrv.sys
2016-03-08 22:31 — 2015-12-31 00:53 — 02017624 _____ (Microsoft Corporation) C:WINDOWSsystem32Driversntfs.sys
2016-03-08 22:30 — 2016-02-05 17:59 — 07784960 _____ (Microsoft Corporation) C:WINDOWSsystem32Windows.Data.Pdf.dll
2016-03-08 22:30 — 2016-02-05 17:55 — 05264384 _____ (Microsoft Corporation) C:WINDOWSSysWOW64Windows.Data.Pdf.dll
2016-03-08 22:30 — 2016-02-05 17:48 — 07075840 _____ (Microsoft Corporation) C:WINDOWSsystem32glcndFilter.dll
2016-03-08 22:30 — 2016-02-05 17:47 — 05268480 _____ (Microsoft Corporation) C:WINDOWSSysWOW64glcndFilter.dll
2016-03-08 22:30 — 2016-01-24 21:19 — 00419160 _____ (Microsoft Corporation) C:WINDOWSsystem32Driversspaceport.sys
2016-03-08 22:30 — 2016-01-24 21:19 — 00378712 _____ (Microsoft Corporation) C:WINDOWSsystem32Driversstorport.sys
2016-03-08 22:30 — 2016-01-24 21:19 — 00331608 _____ (Microsoft Corporation) C:WINDOWSsystem32DriversClasspnp.sys
2016-03-08 22:30 — 2016-01-24 14:57 — 01335296 _____ (Microsoft Corporation) C:WINDOWSsystem32mispace.dll
2016-03-08 22:30 — 2016-01-24 14:45 — 01063424 _____ (Microsoft Corporation) C:WINDOWSSysWOW64mispace.dll
2016-03-08 22:30 — 2016-01-09 04:49 — 00218448 _____ (Microsoft Corporation) C:WINDOWSsystem32rsaenh.dll
2016-03-08 22:30 — 2016-01-09 04:49 — 00192120 _____ (Microsoft Corporation) C:WINDOWSSysWOW64rsaenh.dll
2016-03-08 22:30 — 2016-01-09 04:38 — 00091992 _____ (Microsoft Corporation) C:WINDOWSsystem32Driversusbehci.sys
2016-03-08 22:29 — 2016-02-12 22:14 — 00136904 _____ (Microsoft Corporation) C:WINDOWSsystem32wuauclt.exe
2016-03-08 22:29 — 2016-02-12 18:14 — 03708416 _____ (Microsoft Corporation) C:WINDOWSsystem32wuaueng.dll
2016-03-08 22:29 — 2016-02-12 17:55 — 00409088 _____ (Microsoft Corporation) C:WINDOWSsystem32WUSettingsProvider.dll
2016-03-08 22:29 — 2016-02-12 17:54 — 00140288 _____ (Microsoft Corporation) C:WINDOWSsystem32wuwebv.dll
2016-03-08 22:29 — 2016-02-12 17:54 — 00095744 _____ (Microsoft Corporation) C:WINDOWSsystem32wudriver.dll
2016-03-08 22:29 — 2016-02-12 17:54 — 00035840 _____ (Microsoft Corporation) C:WINDOWSsystem32wuapp.exe
2016-03-08 22:29 — 2016-02-12 17:51 — 00124928 _____ (Microsoft Corporation) C:WINDOWSSysWOW64wuwebv.dll
2016-03-08 22:29 — 2016-02-12 17:51 — 00081920 _____ (Microsoft Corporation) C:WINDOWSSysWOW64wudriver.dll
2016-03-08 22:29 — 2016-02-12 17:51 — 00029696 _____ (Microsoft Corporation) C:WINDOWSSysWOW64wuapp.exe
2016-03-08 22:29 — 2016-02-12 17:48 — 02244096 _____ (Microsoft Corporation) C:WINDOWSsystem32wucltux.dll
2016-03-08 22:29 — 2016-02-12 17:47 — 00897024 _____ (Microsoft Corporation) C:WINDOWSsystem32wuapi.dll
2016-03-08 22:29 — 2016-02-12 17:46 — 00726528 _____ (Microsoft Corporation) C:WINDOWSSysWOW64wuapi.dll
2016-03-08 22:29 — 2016-02-11 17:21 — 00869576 _____ (Microsoft Corporation) C:WINDOWSsystem32msvcr120_clr0400.dll
2016-03-08 22:29 — 2016-02-11 17:21 — 00678600 _____ (Microsoft Corporation) C:WINDOWSsystem32msvcp120_clr0400.dll
2016-03-08 22:29 — 2016-02-11 17:20 — 00875720 _____ (Microsoft Corporation) C:WINDOWSSysWOW64msvcr120_clr0400.dll
2016-03-08 22:29 — 2016-02-11 17:20 — 00536776 _____ (Microsoft Corporation) C:WINDOWSSysWOW64msvcp120_clr0400.dll
2016-03-08 22:29 — 2016-02-06 21:08 — 00031744 _____ (Microsoft Corporation) C:WINDOWSsystem32seclogon.dll
2016-03-08 22:29 — 2016-02-06 19:58 — 00987648 _____ (Microsoft Corporation) C:WINDOWSsystem32kerberos.dll
2016-03-08 22:29 — 2016-02-06 19:32 — 00801792 _____ (Microsoft Corporation) C:WINDOWSSysWOW64kerberos.dll
2016-03-08 22:29 — 2016-02-05 22:07 — 00292696 _____ (Microsoft Corporation) C:WINDOWSsystem32WMASF.DLL
2016-03-08 22:29 — 2016-02-05 22:07 — 00243032 _____ (Microsoft Corporation) C:WINDOWSSysWOW64WMASF.DLL
2016-03-08 22:29 — 2016-02-05 18:03 — 15432704 _____ (Microsoft Corporation) C:WINDOWSsystem32wmp.dll
2016-03-08 22:29 — 2016-02-05 18:00 — 13318144 _____ (Microsoft Corporation) C:WINDOWSSysWOW64wmp.dll
2016-03-08 22:29 — 2016-02-04 21:18 — 04174336 _____ (Microsoft Corporation) C:WINDOWSsystem32win32k.sys
2016-03-08 22:29 — 2016-02-04 21:18 — 00358912 _____ (Adobe Systems Incorporated) C:WINDOWSsystem32atmfd.dll
2016-03-08 22:29 — 2016-02-04 21:12 — 00044032 _____ (Adobe Systems) C:WINDOWSsystem32atmlib.dll
2016-03-08 22:29 — 2016-02-04 20:44 — 00301568 _____ (Adobe Systems Incorporated) C:WINDOWSSysWOW64atmfd.dll
2016-03-08 22:29 — 2016-02-04 20:39 — 00035840 _____ (Adobe Systems) C:WINDOWSSysWOW64atmlib.dll
2016-03-08 22:29 — 2016-02-03 23:37 — 01661576 _____ (Microsoft Corporation) C:WINDOWSsystem32ole32.dll
2016-03-08 22:29 — 2016-02-03 23:36 — 01212248 _____ (Microsoft Corporation) C:WINDOWSSysWOW64ole32.dll
2016-03-08 22:29 — 2016-02-03 18:09 — 00086016 _____ (Microsoft Corporation) C:WINDOWSSysWOW64olepro32.dll
2016-03-08 22:29 — 2016-02-03 18:00 — 00091136 _____ (Microsoft Corporation) C:WINDOWSsystem32asycfilt.dll
2016-03-08 22:29 — 2016-02-03 18:00 — 00077824 _____ (Microsoft Corporation) C:WINDOWSSysWOW64asycfilt.dll
2016-03-08 22:29 — 2016-01-31 22:16 — 00148832 _____ (Microsoft Corporation) C:WINDOWSsystem32DriversUSBSTOR.SYS
2016-03-08 22:29 — 2016-01-10 19:41 — 01707008 _____ (Microsoft Corporation) C:WINDOWSsystem32comsvcs.dll
2016-03-08 22:29 — 2016-01-10 19:31 — 01344512 _____ (Microsoft Corporation) C:WINDOWSSysWOW64comsvcs.dll
2016-03-08 22:29 — 2016-01-07 02:46 — 00148752 _____ (Microsoft Corporation) C:WINDOWSSysWOW64wscapi.dll
2016-03-08 22:29 — 2016-01-07 02:45 — 00177712 _____ (Microsoft Corporation) C:WINDOWSsystem32wscapi.dll
2016-03-08 22:29 — 2016-01-06 19:47 — 00146944 _____ (Microsoft Corporation) C:WINDOWSsystem32wscsvc.dll
2016-03-08 22:29 — 2015-12-30 23:49 — 00470360 _____ (Microsoft Corporation) C:WINDOWSsystem32Driversnetio.sys
2016-03-08 22:29 — 2015-12-20 17:57 — 00839168 _____ (Microsoft Corporation) C:WINDOWSsystem32netlogon.dll
2016-03-08 22:29 — 2015-12-20 17:43 — 00696320 _____ (Microsoft Corporation) C:WINDOWSSysWOW64netlogon.dll
2016-03-08 22:29 — 2015-11-19 17:33 — 00994760 _____ (Microsoft Corporation) C:WINDOWSsystem32ucrtbase.dll
2016-03-08 22:29 — 2015-11-19 17:26 — 00922432 _____ (Microsoft Corporation) C:WINDOWSSysWOW64ucrtbase.dll
2016-03-08 22:28 — 2016-02-04 20:24 — 00603648 _____ (Microsoft Corporation) C:WINDOWSsystem32mfds.dll
2016-03-08 22:28 — 2016-02-04 20:02 — 00483328 _____ (Microsoft Corporation) C:WINDOWSSysWOW64mfds.dll
2016-03-08 22:28 — 2016-01-15 19:56 — 02487296 _____ (Microsoft Corporation) C:WINDOWSsystem32storagewmi.dll
2016-03-08 22:28 — 2016-01-15 19:45 — 01482240 _____ (Microsoft Corporation) C:WINDOWSSysWOW64storagewmi.dll
2016-03-08 22:28 — 2016-01-05 18:00 — 00570880 _____ (Microsoft Corporation) C:WINDOWSsystem32winlogon.exe
2016-03-08 22:28 — 2015-12-20 17:56 — 00616960 _____ (Microsoft Corporation) C:WINDOWSsystem32msra.exe
2016-03-08 21:32 — 2016-03-08 21:32 — 00000000 ____D C:UsersAcer-1AppDataLocalSJjfzzBi
2016-03-08 21:31 — 2016-03-08 21:31 — 00000000 ____D C:UsersAcer-1AppDataLocalRIfSXlT
2016-03-08 21:30 — 2016-03-08 21:30 — 00000000 ____D C:UsersAcer-1AppDataLocalIxJCLYuhEQ
2016-03-08 21:30 — 2016-03-08 21:30 — 00000000 ____D C:UsersAcer-1AppDataLocalfDdIUnTENR
2016-03-08 21:29 — 2016-03-08 21:29 — 00000000 ____D C:UsersAcer-1AppDataLocalTustOLKbg
2016-03-08 21:29 — 2016-03-08 21:29 — 00000000 ____D C:UsersAcer-1AppDataLocalpmIJvZuW
2016-03-08 21:28 — 2016-03-08 21:28 — 00000000 ____D C:UsersAcer-1AppDataLocalKGHzDMzsqY
2016-03-08 21:27 — 2016-03-08 21:27 — 00000000 ____D C:UsersAcer-1AppDataLocalsfzINu
2016-03-08 21:27 — 2016-03-08 21:27 — 00000000 ____D C:UsersAcer-1AppDataLocalCWlEAdCl
2016-03-08 21:26 — 2016-03-08 21:26 — 00000000 ____D C:UsersAcer-1AppDataLocaloqVKGzUuj
2016-03-08 21:25 — 2016-03-08 21:25 — 00000000 ____D C:UsersAcer-1AppDataLocalyFkqTUoy
2016-03-08 21:25 — 2016-03-08 21:25 — 00000000 ____D C:UsersAcer-1AppDataLocalLfFXQIb
2016-03-08 21:24 — 2016-03-08 21:24 — 00000000 ____D C:UsersAcer-1AppDataLocalmxChJFLwG
2016-03-08 21:23 — 2016-03-08 21:23 — 00000000 ____D C:UsersAcer-1AppDataLocalvinUUqx
2016-03-08 21:23 — 2016-03-08 21:23 — 00000000 ____D C:UsersAcer-1AppDataLocalDemReDcGQD
2016-03-08 21:22 — 2016-03-08 21:22 — 00000000 ____D C:UsersAcer-1AppDataLocalDKvsztC
2016-03-08 21:15 — 2016-03-08 21:15 — 00000000 ____D C:UsersAcer-1AppDataLocalougPSeYz
2016-03-08 21:14 — 2016-03-08 21:14 — 00000000 ____D C:UsersAcer-1AppDataLocalyLKZQb
2016-03-08 21:14 — 2016-03-08 21:14 — 00000000 ____D C:UsersAcer-1AppDataLocalRFLHBpjiL
2016-03-08 21:13 — 2016-03-08 21:13 — 00000000 ____D C:UsersAcer-1AppDataLocalQQciFvL
2016-03-08 21:12 — 2016-03-08 21:13 — 00000000 ___HD C:$SysReset
2016-03-08 21:12 — 2016-03-08 21:12 — 00000000 ____D C:UsersAcer-1AppDataLocalvfJkEKxvu
2016-03-08 21:12 — 2016-03-08 21:12 — 00000000 ____D C:UsersAcer-1AppDataLocalDiMcMR
2016-03-08 21:11 — 2016-03-08 21:11 — 00000000 ____D C:UsersAcer-1AppDataLocalKXxYHJyaZo
2016-03-08 21:10 — 2016-03-08 21:10 — 00000000 ____D C:UsersAcer-1AppDataLocalrENZZB
2016-03-08 21:09 — 2016-03-08 21:09 — 00000000 ____D C:UsersAcer-1AppDataLocalqgWrKapyp
2016-03-08 21:08 — 2016-03-08 21:08 — 00000000 ____D C:UsersAcer-1AppDataLocalywVdIbZd
2016-03-08 21:08 — 2016-03-08 21:08 — 00000000 ____D C:UsersAcer-1AppDataLocalcGykCkXLCl
2016-03-08 21:07 — 2016-03-08 21:07 — 00000000 ____D C:UsersAcer-1AppDataLocalMybQMg
2016-03-08 21:07 — 2016-03-08 21:07 — 00000000 ____D C:UsersAcer-1AppDataLocalhMnvfoEbV
2016-03-08 21:06 — 2016-03-08 21:06 — 00000000 ____D C:UsersAcer-1AppDataLocalYktIWlJuA
2016-03-08 21:00 — 2016-03-08 21:00 — 00000000 ____D C:UsersAcer-1DesktopНовая папка
2016-03-08 20:58 — 2016-03-08 20:58 — 00000000 ____D C:UsersAcer-1AppDataLocalPvTDdrMEWH
2016-03-08 20:57 — 2016-03-08 20:57 — 00000000 ____D C:UsersAcer-1AppDataLocalVrpqne
2016-03-08 20:56 — 2016-03-08 20:56 — 00000000 ____D C:UsersAcer-1AppDataLocalZORkgbtbMD
2016-03-08 20:56 — 2016-03-08 20:56 — 00000000 ____D C:UsersAcer-1AppDataLocalUoMrejEPd
2016-03-08 20:55 — 2016-03-08 20:55 — 00000000 ____D C:UsersAcer-1AppDataLocalRCEfMTtK
2016-03-08 20:55 — 2016-03-08 20:55 — 00000000 ____D C:UsersAcer-1AppDataLocalBcuWtAUT
2016-03-08 20:54 — 2016-03-08 20:54 — 00000000 ____D C:UsersAcer-1AppDataLocalOOBbHM
2016-03-08 20:53 — 2016-03-08 20:53 — 00000000 ____D C:UsersAcer-1AppDataLocalTcQIYdoNdE
2016-03-08 20:53 — 2016-03-08 20:53 — 00000000 ____D C:UsersAcer-1AppDataLocalaFVlWynam
2016-03-08 20:52 — 2016-03-08 20:52 — 00000000 ____D C:UsersAcer-1AppDataLocalgQmAjWo
2016-03-08 20:51 — 2016-03-08 20:51 — 00000000 ____D C:UsersAcer-1AppDataLocalsfZXuG
2016-03-08 20:51 — 2016-03-08 20:51 — 00000000 ____D C:UsersAcer-1AppDataLocalKYhUXIMDwc
2016-03-08 20:50 — 2016-03-08 20:50 — 00000000 ____D C:UsersAcer-1AppDataLocalClLJLeEZ
2016-03-08 20:49 — 2016-03-08 20:49 — 00000000 ____D C:UsersAcer-1AppDataLocalFpHgzqp
2016-03-08 20:19 — 2016-03-08 20:19 — 00000000 ____D C:UsersAcer-1AppDataLocalUvyYYJvCQw
2016-03-08 20:18 — 2016-03-08 20:18 — 00000000 ____D C:UsersAcer-1AppDataLocaljErQkyv
2016-03-08 20:17 — 2016-03-08 20:17 — 00000000 ____D C:UsersAcer-1AppDataLocalqHXvXzcPhZ
2016-03-08 20:17 — 2016-03-08 20:17 — 00000000 ____D C:UsersAcer-1AppDataLocaldgnAul
2016-03-08 20:16 — 2016-03-08 20:16 — 00000000 ____D C:UsersAcer-1AppDataLocalIVeNsmO
2016-03-08 20:15 — 2016-03-08 20:15 — 00000000 ____D C:UsersAcer-1AppDataLocalZhLBOXQ
2016-03-08 20:15 — 2016-03-08 20:15 — 00000000 ____D C:UsersAcer-1AppDataLocalkwweVFQTFJ
2016-03-08 20:14 — 2016-03-08 20:14 — 00000000 ____D C:UsersAcer-1AppDataLocalgGvsDweT
2016-03-08 20:13 — 2016-03-08 20:13 — 00000000 ____D C:UsersAcer-1AppDataLocalsWMcAgT
2016-03-08 20:13 — 2016-03-08 20:13 — 00000000 ____D C:UsersAcer-1AppDataLocalNZcinh
2016-03-08 20:12 — 2016-03-08 20:12 — 00000000 ____D C:UsersAcer-1AppDataLocalCUHkfETuq
2016-03-08 20:11 — 2016-03-08 20:11 — 00000000 ____D C:UsersAcer-1AppDataLocaligxYQWgZFS
2016-03-08 20:11 — 2016-03-08 20:11 — 00000000 ____D C:UsersAcer-1AppDataLocalECNZTO
2016-03-08 20:10 — 2016-03-08 20:10 — 00000000 ____D C:UsersAcer-1AppDataLocalGREiJHW
2016-03-08 20:10 — 2016-03-08 20:10 — 00000000 ____D C:UsersAcer-1AppDataLocalBgEtfaTP
2016-03-08 19:50 — 2016-03-08 19:50 — 00000000 ____D C:UsersAcer-1AppDataLocalmAcVsQuWA
2016-03-08 19:49 — 2016-03-08 19:49 — 00000000 ____D C:UsersAcer-1AppDataLocalmzWxXnFE
2016-03-08 19:48 — 2016-03-08 19:48 — 00000000 ____D C:UsersAcer-1AppDataLocalwUmjYF
2016-03-08 19:48 — 2016-03-08 19:48 — 00000000 ____D C:UsersAcer-1AppDataLocalcurTAXb
2016-03-08 19:47 — 2016-03-08 19:47 — 00000000 ____D C:UsersAcer-1AppDataLocaluzXQcqhVQ
2016-03-08 19:46 — 2016-03-08 19:46 — 00000000 ____D C:UsersAcer-1AppDataLocalOnZcihh
2016-03-08 19:46 — 2016-03-08 19:46 — 00000000 ____D C:UsersAcer-1AppDataLocalaPTdpyIAQ
2016-03-08 19:45 — 2016-03-08 19:45 — 00000000 ____D C:UsersAcer-1AppDataLocalXBxoXzm
2016-03-08 19:45 — 2016-03-08 19:45 — 00000000 ____D C:UsersAcer-1AppDataLocaluvNvMlp
2016-03-08 19:43 — 2016-03-08 19:43 — 00000000 ____D C:UsersAcer-1AppDataLocalWHVcvCwb
2016-03-08 19:43 — 2016-03-08 19:43 — 00000000 ____D C:UsersAcer-1AppDataLocalCvQPQXSsG
2016-03-08 19:42 — 2016-03-08 19:42 — 00000000 ____D C:UsersAcer-1AppDataLocalbEkYdo
2016-03-08 19:41 — 2016-03-08 19:41 — 00000000 ____D C:UsersAcer-1AppDataLocalLwCZnif
2016-03-08 19:41 — 2016-03-08 19:41 — 00000000 ____D C:UsersAcer-1AppDataLocalEgXHwvyFhd
2016-03-08 19:40 — 2016-03-08 19:40 — 00000000 ____D C:UsersAcer-1AppDataLocalFYjzAG
2016-03-08 19:38 — 2016-03-08 19:38 — 00000000 ____D C:UsersAcer-1AppDataLocalAepvJag
2016-03-08 19:37 — 2016-03-08 19:37 — 00000000 ____D C:UsersAcer-1AppDataLocalBAFAepKg
2016-03-08 19:36 — 2016-03-08 19:36 — 00000000 ____D C:UsersAcer-1AppDataLocalTKCdlvsHjx
2016-03-08 19:36 — 2016-03-08 19:36 — 00000000 ____D C:UsersAcer-1AppDataLocalpkkNghWeR
2016-03-08 19:35 — 2016-03-08 19:35 — 00000000 ____D C:UsersAcer-1AppDataLocalsutHPEn
2016-03-08 19:35 — 2016-03-08 19:35 — 00000000 ____D C:UsersAcer-1AppDataLocalKnQQYc
2016-03-08 19:34 — 2016-03-08 19:34 — 00000000 ____D C:UsersAcer-1AppDataLocalEnPKBDDq
2016-03-08 19:34 — 2016-03-08 19:34 — 00000000 ____D C:UsersAcer-1AppDataLocalCseAxJjSFk
2016-03-08 19:31 — 2016-03-09 01:04 — 00488120 _____ C:WINDOWSsystem32FNTCACHE.DAT
2016-03-08 18:33 — 2016-03-08 18:33 — 00000000 ____D C:UsersAcer-1AppDataLocalaBswgiYXm
2016-03-08 17:33 — 2016-03-08 17:33 — 00000000 ____D C:UsersAcer-1AppDataLocalFfOCfhP
2016-03-08 16:33 — 2016-03-08 16:33 — 00000000 ____D C:UsersAcer-1AppDataLocalGXUMAhZGWs
2016-03-08 15:33 — 2016-03-08 15:33 — 00000000 ____D C:UsersAcer-1AppDataLocaleDOreo
2016-03-08 14:33 — 2016-03-08 14:33 — 00000000 ____D C:UsersAcer-1AppDataLocaloTAjEohjRo
2016-03-08 14:17 — 2016-03-08 14:17 — 00000000 ____D C:UsersAcer-1AppDataLocalESET
10 марта, 2016 в 11:19 пп #32793
Admin
Keymaster
- Темы:40
- Сообщений:5676
Здравствуйте, Добро пожаловать на Spyware-ru форум.

Троян, которым заражён ваш компьютер нацелен на браузер Хром. Поэтому временно им не пользуйтесь.

Судя по содержимому лога вы ранее использовали антивирус Касперского, его части остались в системе.
Скачайте «Утилиту удаления продуктов Лаборатории Касперского (kavremover)» http://media.kaspersky.com/utilities/ConsumerUtilities/kavremvr.exe
Запустите и следуйте указаниям.

Запустите программу Блокнот и вставьте в открытое окно следующий текст
```
CreateRestorePoint:

HKLM-x32...Run: [LManager] => [X]

HKLM-x32...Run: [sun21] => [X]

CHR HKLMSOFTWAREPoliciesGoogle: Restriction <======= ATTENTION

URLSearchHook: [S-1-5-21-976431788-3078866539-2970655778-1002] ATTENTION => Default URLSearchHook is missing

BHO: Визуальные закладки -> {D5FEC983-01DB-414a-9456-AF95AC9ED7B5} -> No File

BHO-x32: No Name -> {8984B388-A5BB-4DF7-B274-77B879E179DB} -> No File

BHO-x32: Визуальные закладки -> {D5FEC983-01DB-414a-9456-AF95AC9ED7B5} -> No File

Toolbar: HKUS-1-5-21-976431788-3078866539-2970655778-1002 -> No Name - {09900DE8-1DCA-443F-9243-26FF581438AF} - No File

FF HKLM-x32...ThunderbirdExtensions: [msktbird@mcafee.com] - C:Program FilesMcAfeeMSK => not found

R2 HSystem; C:Program Files (x86)HpDefQHC2DK.exe [181704 2016-03-06] () [File not signed]

S3 ApfiltrService; SystemRootsystem32DRIVERSApfiltr.sys [X]

S3 esgiguard; ??C:UsersAcer-1AppDataLocalTempRar$EXa0.704SpyHunter 4.20.9.4533 Portableesgiguard.sys [X]

Task: {23CA9679-1C9C-44C5-AEDC-42C1F701B9D3} - System32Tasks{A531A62A-49D7-4C4E-9366-7FFC248F64EF} => pcalua.exe -a "C:UsersAcer-1AppDataRoamingD0S1L2Z1P1B0T1P1B2ZMipony Download Accelerator Packagesuninstaller.exe" -c /Uninstall /NM="Mipony Download Accelerator Packages" /AN="0D0S1L2Z1P1B0T1P1B2Z" /MBN="Mipony Download Accelerator Packages"

Task: {D524244E-6190-44CA-A103-BB5BCD99AC88} - Обновление Браузера Яндекс  -> No File <==== ATTENTION

Task: {DCE4ADF7-8BF8-45B8-9BE2-FFFBD686BEFE} - System32TasksSpyHunter4Startup => C:UsersAcer-1AppDataLocalTempRar$EXa0.704SpyHunter 4.20.9.4533 PortableSpyHunter4.exe <==== ATTENTION

Shortcut: C:UsersAcer-1AppDataRoamingMicrosoftInternet ExplorerQuick LaunchGoogle Chrome.lnk -> C:ProgramDataxZQQUHiqMZvnx0.exe ()

Shortcut: C:UsersAcer-1AppDataRoamingMicrosoftInternet ExplorerQuick LaunchUser PinnedTaskBarGoogle Chrome.lnk -> C:ProgramDataxZQQUHiqMZvnx0.exe ()

Shortcut: C:ProgramDataMicrosoftWindowsStart MenuProgramsGoogle Chrome.lnk -> C:ProgramDataxZQQUHiqMZvnx0.exe ()

Shortcut: C:UsersPublicDesktopGoogle Chrome.lnk -> C:ProgramDataxZQQUHiqMZvnx0.exe ()

AlternateDataStreams: C:UsersAcer-1Local Settings:wa [178]

AlternateDataStreams: C:UsersAcer-1AppDataLocal:wa [178]

AlternateDataStreams: C:UsersAcer-1AppDataLocalApplication Data:wa [178]

EmptyTemp:

Reboot:
```
Сохраните полученный файл в папку где находится программа FRST/FRST64 под именем fixlist

Запустите программу FRST и нажмите кнопку Fix.
Когда программа закончит работу появиться сообщение «Fix completed». Нажмите OK.
Откроется блокнот с содержимым файла fixlog.txt. Вставьте содержимое этого файла в ваш ответ.

Кроме этого выполните новую проверку программой FRST, только в главном меню поставьте галочку в пунктах Shortcut.txt и Addtion.txt, затем нажмите Scan. У вас откроется три лога FRST.txt, Shortcut.txt и Addtion.txt. Прикрепите их к вашему ответу.

Кроме этого проверьте на сайте virustotal следующие два файла:
```
C:ProgramDataxZQQUHiqMZvnx0.exe

C:Program Files (x86)HpDefQHC2DK.exe
```
Вставьте в ваш ответ результаты сканирования или ссылки на них.
Автор

Сообщения

Просмотр 2 сообщений - с 1 по 2 (из 2 всего)

Для ответа в этой теме необходимо авторизоваться.

после перезагр.пк, вирус создает папки с рекламой.Помогите!

Добро пожаловать

Поиск

Последние темы

СПАЙВАРЕ РУ

Нужна помощь?

Ссылки