Постоянно выскакивают окно при работе в Орбитуме. Доктор Вэб нашел более 300 угроз с вирусами. Установился браузер Амиго - не могу удалить. Помогите.
Printable View
Постоянно выскакивают окно при работе в Орбитуме. Доктор Вэб нашел более 300 угроз с вирусами. Установился браузер Амиго - не могу удалить. Помогите.
Уважаемый(ая) [B]OksanaDMD[/B], спасибо за обращение на наш форум!
Помощь при заражении комьютера на VirusInfo.Info оказывается абсолютно бесплатно. Хелперы, в самое ближайшее время, ответят на Ваш запрос. Для оказания помощи необходимо предоставить логи сканирования утилитами АВЗ и HiJackThis, подробнее можно прочитать в [URL="http://virusinfo.info/pravila.html"]правилах оформления запроса о помощи[/URL].
[INFORMATION]Если вы хотите получить персональную гарантированную помощь в приоритетном режиме, то воспользуйтесь платным сервисом [URL="http://virusinfo.info/content.php?r=613-sub_pomogite"]Помогите+[/URL].[/INFORMATION]
Если наш сайт окажется полезен Вам и у Вас будет такая возможность - пожалуйста [URL="http://virusinfo.info/content.php?r=113-virusinfo.info-donate"]поддержите проект[/URL].
Здравствуйте,
AVZ [URL=http://virusinfo.info/showthread.php?t=7239&p=88804&viewfull=1#post88804]выполнить следующий скрипт[/URL].
Важно на ОС: Windows Vista/7/8/8.1 AVZ запускайте через контекстное меню проводника от имени Администратора.
[CODE]
begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.'+#13#10+'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
then
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
end;
DelBHO('{2BC46CFA-4B00-4193-A7BD-6AD1D0BCB5BC}');
DelBHO('{8984B388-A5BB-4DF7-B274-77B879E179DB}');
QuarantineFile('C:\Program Files\Skillbrains\Updater\Updater.exe','');
QuarantineFile('C:\PROGRA~1\ONESYS~1\SYSTEM~1.EXE','');
QuarantineFile('C:\Users\Polaris\AppData\LocalLow\SearchGo\searchgo.dll','');
QuarantineFile('C:\Users\Polaris\AppData\Local\fupdate\fupdate.exe','');
QuarantineFile('c:\users\polaris\appdata\local\orbitum\application\chrome.exe','');
QuarantineFile('C:\Users\Polaris\AppData\Local\SaveYouTime\config.json','');
QuarantineFile('C:\Users\Polaris\AppData\Local\SaveYouTime\stub.exe','');
DeleteFile('C:\Users\Polaris\AppData\LocalLow\SearchGo\searchgo.dll','32');
DeleteFile('C:\Users\Polaris\AppData\Local\fupdate\fupdate.exe','32');
DeleteFile('C:\Users\Polaris\AppData\Local\SaveYouTime\config.json','32');
DeleteFile('C:\Users\Polaris\AppData\Local\SaveYouTime\stub.exe','32');
DeleteFile('C:\Windows\system32\Tasks\fupdate','32');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','SaveYouTime');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
ExecuteWizard('SCU', 2, 3, true);
RebootWindows(true);
end.
[/CODE]
После выполнения скрипта компьютер перезагрузится.
После перезагрузки:
- Выполните в AVZ:
[CODE]
begin
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.
[/CODE]
Файл quarantine.zip из папки AVZ загрузите по ссылке "[B][COLOR="#FF0000"]Прислать запрошенный карантин[/COLOR][/B]" вверху темы.
- Сделайте лог [URL="http://dragokas.com/tools/CheckBrowsersLNK_test.zip"]Check Browsers' LNK by Dragokas & regist[/URL].
- Подготовьте лог [URL="http://virusinfo.info/showthread.php?t=146192&p=1041844&viewfull=1#post1041844"]AdwCleaner[/URL] и приложите его в теме.
Выполнил
Файл сохранён как 160908_181034_quarantine_57d17f6a67dc4.zip
Размер файла 326426
MD5 aeb94c4e4b7b5b32b917aad8a78cfb20
Файл закачан, спасибо!
[url=http://virusinfo.info/showthread.php?t=146192&p=1041864&viewfull=1#post1041864]Удалите в AdwCleaner[/url] всё, кроме папок с названиями программ которыми вы пользуетесь (если ничем из перечисленного в логе не пользуетесь, то удалите всё). Отчет после удаления прикрепите.
Удалил всё.
- Скачайте [url=http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/][b]Farbar Recovery Scan Tool[/b][/url] [img]http://i.imgur.com/NAAC5Ba.png[/img] и сохраните на Рабочем столе.
[b]Примечание[/b]: необходимо выбрать версию, совместимую с Вашей операционной системой. Если Вы не уверены, какая версия подойдет для Вашей системы, скачайте обе и попробуйте запустить. Только одна из них запустится на Вашей системе.
[list][*]Запустите программу двойным щелчком. Когда программа запустится, нажмите [b]Yes[/b] для соглашения с предупреждением.[*]Убедитесь, что в окне [b]Optional Scan[/b] отмечены [i]"List BCD"[/i] и [i]"Driver MD5"[/i].
[img]http://i.imgur.com/B92LqRQ.png[/img][*]Нажмите кнопку [b]Scan[/b].[*]После окончания сканирования будет создан отчет ([b]FRST.txt[/b]) в той же папке, откуда была запущена программа. Пожалуйста, прикрепите отчет в следующем сообщении.[*]Если программа была запущена в первый раз, будет создан отчет ([b]Addition.txt[/b]). Пожалуйста, прикрепите его в следующем сообщении.[/list]
Выполнил
[LIST][*] Скопируйте приведенный ниже текст в Блокнот и сохраните файл как [b]fixlist.txt[/b] в ту же папку откуда была запущена утилита Farbar Recovery Scan Tool:
[CODE]
CreateRestorePoint:
CloseProcesses:
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {0261530e-66a0-11e0-bec9-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {0261531a-66a0-11e0-bec9-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {02b7e220-9cd4-11e0-8273-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {0338fc74-74be-11e1-963d-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {033c5da2-5ec9-11e0-aed9-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {033c5dac-5ec9-11e0-aed9-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {039a0bcc-aa22-11e0-ba65-806e6f6e6963} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {039a0c22-aa22-11e0-ba65-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {039a0c2d-aa22-11e0-ba65-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {039a0c43-aa22-11e0-ba65-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {039a0c4d-aa22-11e0-ba65-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {039a0c61-aa22-11e0-ba65-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {039a0c6a-aa22-11e0-ba65-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {039a0cf7-aa22-11e0-ba65-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {039a0d02-aa22-11e0-ba65-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {039a0d0d-aa22-11e0-ba65-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {039a0d27-aa22-11e0-ba65-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {039a0d37-aa22-11e0-ba65-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {039a0d43-aa22-11e0-ba65-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {039a0d4c-aa22-11e0-ba65-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {039a0d5e-aa22-11e0-ba65-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {039a0d69-aa22-11e0-ba65-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {039a0d74-aa22-11e0-ba65-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {039a0d7f-aa22-11e0-ba65-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {039a0d89-aa22-11e0-ba65-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {039a0d92-aa22-11e0-ba65-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {039a0d9d-aa22-11e0-ba65-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {039a0da7-aa22-11e0-ba65-4487fc53b679} - K:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {039a0db8-aa22-11e0-ba65-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {039a0dca-aa22-11e0-ba65-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {039a0dd2-aa22-11e0-ba65-4487fc53b679} - K:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {039a0dde-aa22-11e0-ba65-4487fc53b679} - K:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {04ca2e77-f131-11e1-9201-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {04ca2e8e-f131-11e1-9201-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {04ca2ea9-f131-11e1-9201-4487fc53b679} - K:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {04ca2ece-f131-11e1-9201-001e101f4e71} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {04ca2ed9-f131-11e1-9201-001e101f4e71} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {04ca2ee4-f131-11e1-9201-001e101f4e71} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {04ca2ef1-f131-11e1-9201-001e101f4e71} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {0518bfba-f1b7-11e0-9f53-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {0572b9ef-87a1-11e0-9c18-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {0ad31f44-c8a8-11e0-852d-806e6f6e6963} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {0ea36994-1c2a-11e1-9d3e-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {0ea369a0-1c2a-11e1-9d3e-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {10822e8e-62b0-11e0-ba27-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {10822ea0-62b0-11e0-ba27-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {11d8f355-4761-11e1-b3cc-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {13ecd64a-5c6a-11e0-a877-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {158404c9-cfc4-11e0-9ecf-806e6f6e6963} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {166b509a-3d05-11e1-a2dc-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {16fa829b-4dab-11e1-babd-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {174043f3-f8cb-11e0-8605-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {177d9454-aa59-11e0-b1cb-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {177d946b-aa59-11e0-b1cb-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {17f29331-9b5d-11e0-9dc9-806e6f6e6963} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {19e4fa70-76ac-11e0-96da-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {1d3c0212-9ce3-11e0-84b8-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {1d3c021e-9ce3-11e0-84b8-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {1d3c0228-9ce3-11e0-84b8-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {1d3c0240-9ce3-11e0-84b8-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {1d3c0249-9ce3-11e0-84b8-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {1d3c0254-9ce3-11e0-84b8-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {1d95bf4c-9396-11e1-85a8-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {1e20098f-13b0-11e2-a100-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {1ec0bdb2-aef4-11e0-913d-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {1fd7da68-7019-11e0-ba57-806e6f6e6963} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {1fd7daac-7019-11e0-ba57-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {24630bc6-2bb2-11e2-adf7-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {24630d6b-2bb2-11e2-adf7-001e101f7fb6} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {25077afa-9ee7-11e0-80f2-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {25077b04-9ee7-11e0-80f2-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {25d19b92-c7d8-11e0-86c0-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {28847b6e-9fca-11e0-825c-806e6f6e6963} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {28847bab-9fca-11e0-825c-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {29b9ee96-60ab-11e0-8c06-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {29b9eeb7-60ab-11e0-8c06-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {29b9eec1-60ab-11e0-8c06-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {2e093baf-872a-11e0-bef4-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {2e093bd7-872a-11e0-bef4-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {2e52a208-6c36-11e0-9040-806e6f6e6963} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {2fce362f-8c5f-11e0-b2f9-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {2fce3649-8c5f-11e0-b2f9-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {2fce3653-8c5f-11e0-b2f9-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {2fce366c-8c5f-11e0-b2f9-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {2fce3677-8c5f-11e0-b2f9-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {2fce3681-8c5f-11e0-b2f9-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {2fce368b-8c5f-11e0-b2f9-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {2fce3694-8c5f-11e0-b2f9-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {33a0dd6a-80e7-11e0-bc1f-806e6f6e6963} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {33a0ddbc-80e7-11e0-bc1f-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {36456adf-8fbc-11e1-bcb1-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {3726c0fd-307d-11e2-baac-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {38067cad-5850-11e0-89de-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {38067cb9-5850-11e0-89de-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {38067cd1-5850-11e0-89de-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {38067cde-5850-11e0-89de-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {38067cea-5850-11e0-89de-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {38067cf5-5850-11e0-89de-4487fc53b679} - K:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {385aefda-bfce-11e2-9e30-08606e62dc3b} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {385aefe8-bfce-11e2-9e30-08606e62dc3b} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {3888a8e8-6ed0-11e0-831f-806e6f6e6963} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {3a8f53d2-f4f4-11e0-b9ab-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {3f3bf7ad-5d34-11e0-842b-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {3f3bf7b9-5d34-11e0-842b-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {3f3bf7d2-5d34-11e0-842b-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {3f3bf7db-5d34-11e0-842b-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {3f3bf7e6-5d34-11e0-842b-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {3f3bf7f1-5d34-11e0-842b-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {3f3bf7fb-5d34-11e0-842b-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {3f3bf804-5d34-11e0-842b-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {3f3bf813-5d34-11e0-842b-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {42ac4e9e-65c6-11e1-a161-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {42ac4ea9-65c6-11e1-a161-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {42ac4eb9-65c6-11e1-a161-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {42ac4ed6-65c6-11e1-a161-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {44b47f8f-66f4-11e0-bb44-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {45e7031e-6a8c-11e0-80f0-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {460b3387-7c2b-11e0-a7ff-806e6f6e6963} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {467ba590-1f4e-11e1-97f9-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {467ba5a1-1f4e-11e1-97f9-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {47486a3e-7a95-11e2-9ce8-08606e62dc3b} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {491026a3-bfd3-11e2-af7e-08606e62dc3b} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {491026b2-bfd3-11e2-af7e-08606e62dc3b} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {491026c6-bfd3-11e2-af7e-08606e62dc3b} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {491026d5-bfd3-11e2-af7e-08606e62dc3b} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {51751d7d-63ce-11e1-8b04-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {55aa4b91-cfef-11e0-bf9b-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {56a33ca9-ce43-11e0-97f8-806e6f6e6963} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {57082872-84f1-11e0-ac62-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {5708287c-84f1-11e0-ac62-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {570b305c-07cb-11e1-9925-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {570b306a-07cb-11e1-9925-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {570b3074-07cb-11e1-9925-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {58c62a7d-6f7b-11e1-a334-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {59c24ddb-5a38-11e1-ba08-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {5a2995ba-4cc0-11e1-8c28-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {5a9deac1-0574-11e2-924d-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {5ae3dba9-c9a5-11e0-a150-806e6f6e6963} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {5b7c781b-f411-11e0-81f5-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {5cce788d-6d04-11e2-bb4d-4487fc53b679} - E:\Setup.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {5d6dfdea-6c28-11e0-b77b-806e6f6e6963} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {5d6dfe2e-6c28-11e0-b77b-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {5d6dfe37-6c28-11e0-b77b-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {5e2d5352-d16d-11e0-a1fa-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {5ebbdff2-e9da-11e0-90f0-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {6126febd-57b7-11e0-84a3-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {6126fec6-57b7-11e0-84a3-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {6126fed0-57b7-11e0-84a3-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {6126fee0-57b7-11e0-84a3-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {6126feea-57b7-11e0-84a3-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {6126fef9-57b7-11e0-84a3-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {62039ead-5a0a-11e0-a797-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {644494b2-d244-11e0-b3bf-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {644494bd-d244-11e0-b3bf-4487fc53b679} - F:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {661e8d24-5e11-11e0-a248-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {661e8d2e-5e11-11e0-a248-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {67ec4b30-b075-11e0-acb3-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {6949354c-2b44-11e2-8011-001e101f82a7} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {6a19bd5c-2d54-11e1-8d33-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {6a9fa7d2-125d-11e1-b5a9-001e101f2c0e} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {6a9fa7f2-125d-11e1-b5a9-001e101f2c0e} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {6eb2544f-7cf4-11e0-b2ac-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {6f103071-d0a5-11e0-8cbd-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {6f3c682e-63d0-11e0-a7af-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {6f689114-52ba-11e1-b8f8-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {6f8cfdfa-41e6-11e1-868c-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {711d2a6f-7bd8-11e0-a0da-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {71779eb2-c97b-11e0-b42e-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {764ec2ef-5e3d-11e0-be55-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {764ec2fa-5e3d-11e0-be55-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {792301b0-5df9-11e0-bf86-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {792301ba-5df9-11e0-bf86-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {792301d3-5df9-11e0-bf86-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {7923021e-5df9-11e0-bf86-4487fc53b679} - E:\AutoInstall.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {7ae278ae-650f-11e0-896a-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {7ae278b8-650f-11e0-896a-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {7b9919b0-7b64-11e0-bf83-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {7b9919b9-7b64-11e0-bf83-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {7d89218f-662c-11e0-a248-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {7d89219a-662c-11e0-a248-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {7d8921a3-662c-11e0-a248-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {800e5b8e-65d9-11e0-bf62-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {800e5b99-65d9-11e0-bf62-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {8321186f-9a67-11e0-88ea-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {83211879-9a67-11e0-88ea-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {83211883-9a67-11e0-88ea-4487fc53b679} - F:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {83753793-11ed-11e1-b386-001e101f1838} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {83884db7-5f19-11e0-8d5e-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {83884dc0-5f19-11e0-8d5e-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {85ab3011-db53-11e0-9700-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {8827adb6-72f1-11e1-b687-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {882fb7b6-4f3f-11e1-a788-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {8960449f-8b9e-11e0-bcb5-4487fc53b679} - F:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {896044b2-8b9e-11e0-bcb5-4487fc53b679} - F:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {896044c6-8b9e-11e0-bcb5-4487fc53b679} - F:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {896044cf-8b9e-11e0-bcb5-4487fc53b679} - F:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {8a41d126-74c4-11e0-aef7-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {8ac2304a-0bac-11e1-874a-001e101f4da1} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {8c35b9ac-f266-11e0-a014-806e6f6e6963} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {8d3456d0-653f-11e1-a138-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {8dfbeaf1-f158-11e0-9954-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {8ee15951-b931-11e0-8263-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {8fe00620-8ac6-11e0-ba31-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {91d7b90e-84ad-11e1-8550-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {937e1b73-9761-11e0-abef-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {940b8e70-578f-11e0-aeaf-806e6f6e6963} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {940b8eb6-578f-11e0-aeaf-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {9425c535-a112-11e1-ac74-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {9498d4da-75e4-11e0-bf3a-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {9498d4f2-75e4-11e0-bf3a-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {975f83a6-3798-11e2-a2b3-001e101f4e71} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {975f83c4-3798-11e2-a2b3-001e101f4e71} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {975f83dd-3798-11e2-a2b3-001e101f4e71} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {975f83e7-3798-11e2-a2b3-001e101f4e71} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {975f8429-3798-11e2-a2b3-001e101f4e71} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {975f8432-3798-11e2-a2b3-001e101f4e71} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {975f843c-3798-11e2-a2b3-001e101f4e71} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {975f8447-3798-11e2-a2b3-001e101f4e71} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {98cb1096-5fe1-11e0-ae0c-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {98cb10a6-5fe1-11e0-ae0c-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {993a5b0f-5f8e-11e0-bf49-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {993a5b18-5f8e-11e0-bf49-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {9d6b289d-2b39-11e2-a867-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {9d6b28ba-2b39-11e2-a867-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {9d9754ae-638a-11e0-a6be-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {9f899768-7061-11e0-a100-806e6f6e6963} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {a07d637e-f998-11e0-89d7-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {a0c5064b-dc50-11e0-96e3-806e6f6e6963} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {a205ce5b-4fd4-11e1-93a1-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {a289ba7d-a444-11e1-917b-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {a289ba88-a444-11e1-917b-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {a2ff1d6d-7e7f-11e1-a206-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {a4126daf-0486-11e2-b885-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {a4126e7e-0486-11e2-b885-001e101f4da1} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {a42d7106-3bbc-11e2-b068-001e101f1f81} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {a42d7110-3bbc-11e2-b068-001e101f1f81} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {a42d7129-3bbc-11e2-b068-001e101f1f81} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {a4670a35-03ce-11e1-a759-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {a4670a54-03ce-11e1-a759-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {a4670a60-03ce-11e1-a759-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {a489d2f7-87f3-11e1-b735-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {a6e9bc6a-20db-11e1-9e7a-001e101f8ed0} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {a6e9bc74-20db-11e1-9e7a-001e101f8ed0} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {a6faa42d-6173-11e0-8578-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {a6faa44d-6173-11e0-8578-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {a6faa458-6173-11e0-8578-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {a7f5d9b2-f299-11e0-92c1-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {a8bcf9a6-632a-11e0-a5bc-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {a8bcf9b1-632a-11e0-a5bc-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {a8bcf9bb-632a-11e0-a5bc-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {a8bcf9d8-632a-11e0-a5bc-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {a9ae8ccd-9b3c-11df-8a50-4487fc53b679} - I:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {a9ae8cdc-9b3c-11df-8a50-4487fc53b679} - I:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {ac1859b4-4991-11e1-b342-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {b034b91d-f1ea-11e1-b341-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {b034b921-f1ea-11e1-b341-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {b034b92d-f1ea-11e1-b341-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {b034b94b-f1ea-11e1-b341-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {b034b954-f1ea-11e1-b341-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {b066775b-0c7d-11e1-809d-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {b08b6833-6ae5-11e0-b245-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {b08b683d-6ae5-11e0-b245-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {b0c350ba-1e84-11e1-af51-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {b162f63b-aac9-11e0-9528-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {b162f655-aac9-11e0-9528-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {b162f65e-aac9-11e0-9528-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {b162f677-aac9-11e0-9528-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {b162f682-aac9-11e0-9528-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {b162f68a-aac9-11e0-9528-4487fc53b679} - K:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {b162f6ae-aac9-11e0-9528-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {b162f6b9-aac9-11e0-9528-4487fc53b679} - F:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {b50f53b4-4b68-11e1-b7ae-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {b6ba4a2e-5c94-11e0-acd4-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {b81818d0-8be7-11e0-8802-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {b81818db-8be7-11e0-8802-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {b81818e5-8be7-11e0-8802-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {b81818fc-8be7-11e0-8802-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {b8181906-8be7-11e0-8802-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {b8181911-8be7-11e0-8802-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {b818191a-8be7-11e0-8802-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {b8181924-8be7-11e0-8802-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {b8e89b31-cd7e-11e0-af3d-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {b9b91310-6c23-11e0-9181-806e6f6e6963} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {ba694651-9e4d-11df-8e76-4487fc53b679} - I:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {bdda5673-ccb0-11e0-8be1-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {bdf5a01c-f028-11e0-8d11-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {beea272e-7723-11e0-a345-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {c345cbf6-bde3-11e0-86b4-806e6f6e6963} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {c577f4a9-bce0-11e0-9cac-806e6f6e6963} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {c597fabc-aaab-11e0-912b-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {c597fadd-aaab-11e0-912b-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {c597faee-aaab-11e0-912b-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {c597faf9-aaab-11e0-912b-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {c597fb04-aaab-11e0-912b-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {c597fb0d-aaab-11e0-912b-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {c597fb19-aaab-11e0-912b-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {c597fb22-aaab-11e0-912b-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {c5eea755-73bb-11e1-b309-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {c64c5e2d-5aef-11e0-a853-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {c64c5e39-5aef-11e0-a853-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {c64c5e43-5aef-11e0-a853-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {c64c5e5c-5aef-11e0-a853-4487fc53b679} - F:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {caa465f2-a657-11e0-8ec1-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {caa46699-a657-11e0-8ec1-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {caa466a2-a657-11e0-8ec1-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {cbcf2af4-975c-11e0-93fe-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {cd89e75a-3cba-11e1-814d-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {ce01c7ab-d896-11e0-8b1b-806e6f6e6963} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {ce3fdacd-703e-11e1-8c69-806e6f6e6963} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {cfbe3d94-f233-11e0-b910-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {d0c94dbe-7d98-11e1-af50-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {d1211256-605d-11e1-b26a-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {d146302e-69c3-11e0-bff4-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {d1463038-69c3-11e0-bff4-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {d146304a-69c3-11e0-bff4-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {d1463062-69c3-11e0-bff4-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {d146306b-69c3-11e0-bff4-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {d1463076-69c3-11e0-bff4-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {d2373425-2b3e-11e2-b86d-001e101f1f81} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {d237342f-2b3e-11e2-b86d-001e101f1f81} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {d73db580-71f3-11e0-8f4a-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {d94fbec0-9ce6-11e0-8415-806e6f6e6963} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {da3c59ae-587c-11e0-a852-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {da3c59b9-587c-11e0-a852-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {da3c59e4-587c-11e0-a852-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {da3c59ee-587c-11e0-a852-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {da3c59f9-587c-11e0-a852-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {dabb2f7e-86d4-11e0-96bc-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {dabb2f88-86d4-11e0-96bc-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {db329cb7-70dd-11e1-8dea-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {ddb6ce74-53fa-11e1-bd00-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {dde0d4a8-aafa-11e0-b29f-806e6f6e6963} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {e0ba8c53-00a4-11e1-b567-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {e258c03e-81ac-11e0-9b1e-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {e4966a29-dc2e-11e0-adcd-806e6f6e6963} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {e521f114-d7c9-11e0-b4a4-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {e5bd3d78-975d-11e0-ab8f-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {e5bd3d84-975d-11e0-ab8f-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {e8bdc891-c747-11e0-8198-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {e94b7814-6f7a-11e1-a827-806e6f6e6963} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {ecd3c911-808f-11e0-b5ab-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {ecd3c91c-808f-11e0-b5ab-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {f3926f38-4922-11e2-8585-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {f3926f44-4922-11e2-8585-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {f546c026-a6ef-11e0-8731-806e6f6e6963} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {f55b5a23-d3de-11e0-84c6-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {f55b5a2e-d3de-11e0-84c6-4487fc53b679} - F:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {f55d3983-be88-11e0-9fb0-806e6f6e6963} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {f5f2ef5b-4130-11e1-a226-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {f6aa757d-07a6-11e2-ba82-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {f7e792f3-da26-11e0-b317-4487fc53b679} - E:\AutoRun.exe
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\...\MountPoints2: {ff038db1-f177-11e0-96ad-4487fc53b679} - E:\AutoRun.exe
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
Toolbar: HKU\S-1-5-21-1150826415-95550000-2728641265-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
CHR HKLM\...\Chrome\Extension: [kifonanmkilecibbfhmdcoeonomahncd] - {localappdata}\Google\Chrome\Application\Plugins\kifonanmkilecibbfhmdcoeonomahncd_0.0.2.crx <not found>
CustomCLSID: HKU\S-1-5-21-1150826415-95550000-2728641265-1000_Classes\CLSID\{06EEE834-461C-42C2-8DCF-1502B527B1F9}\InprocServer32 -> no filepath
CustomCLSID: HKU\S-1-5-21-1150826415-95550000-2728641265-1000_Classes\CLSID\{08244EE6-92F0-47F2-9FC9-929BAA2E7235}\InprocServer32 -> no filepath
CustomCLSID: HKU\S-1-5-21-1150826415-95550000-2728641265-1000_Classes\CLSID\{16F3DD56-1AF5-4347-846D-7C10C4192619}\InprocServer32 -> no filepath
CustomCLSID: HKU\S-1-5-21-1150826415-95550000-2728641265-1000_Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InprocServer32 -> no filepath
CustomCLSID: HKU\S-1-5-21-1150826415-95550000-2728641265-1000_Classes\CLSID\{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}\InprocServer32 -> no filepath
CustomCLSID: HKU\S-1-5-21-1150826415-95550000-2728641265-1000_Classes\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\InprocServer32 -> no filepath
CustomCLSID: HKU\S-1-5-21-1150826415-95550000-2728641265-1000_Classes\CLSID\{920E6DB1-9907-4370-B3A0-BAFC03D81399}\InprocServer32 -> no filepath
CustomCLSID: HKU\S-1-5-21-1150826415-95550000-2728641265-1000_Classes\CLSID\{942BC614-676C-464E-B384-D3202AAA02DA}\InprocServer32 -> no filepath
CustomCLSID: HKU\S-1-5-21-1150826415-95550000-2728641265-1000_Classes\CLSID\{99FD978C-D287-4F50-827F-B2C658EDA8E7}\InprocServer32 -> no filepath
CustomCLSID: HKU\S-1-5-21-1150826415-95550000-2728641265-1000_Classes\CLSID\{A2DF06F9-A21A-44A8-8A99-8B9C84F29162}\localserver32 -> "C:\Users\Polaris\AppData\Local\Orbitum\Application\43.0.2357.157\delegate_execute.exe" => No File
CustomCLSID: HKU\S-1-5-21-1150826415-95550000-2728641265-1000_Classes\CLSID\{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}\InprocServer32 -> no filepath
CustomCLSID: HKU\S-1-5-21-1150826415-95550000-2728641265-1000_Classes\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\InprocServer32 -> no filepath
CustomCLSID: HKU\S-1-5-21-1150826415-95550000-2728641265-1000_Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\InprocServer32 -> no filepath
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\Software\Classes\.exe: => <===== ATTENTION
HKU\S-1-5-21-1150826415-95550000-2728641265-1000\Software\Classes\regfile: regedit.exe "%1" <===== ATTENTION
Reboot:
[/CODE][*] Запустите FRST и нажмите один раз на кнопку [b]Fix[/b] и подождите. [*] Программа создаст лог-файл [b](Fixlog.txt)[/b]. Пожалуйста, прикрепите его в следующем сообщении![*]Обратите внимание, что компьютер будет [b]перезагружен[/b].[/LIST]
Выполнил
Сделайте лог [URL="http://virusinfo.info/showthread.php?t=53070&p=1104657&viewfull=1#post1104657"]полного сканирования МВАМ[/URL]
Лог готов. Долго делался.
Удалите в MBAM:
[CODE]Trojan.ProxyHijacker, HKLM\SOFTWARE\CLASSES\Pinnacle.Studio.17.DynamicNS, , [ca4eaac63c5ee056eb840e881ce6ea16],
PUP.Optional.MorePowerfulCleaner, HKLM\SOFTWARE\MPC DESKTOP, , [c2567ef26e2c9c9aae3e0df19b687e82],
PUP.Optional.Zaxar, HKU\S-1-5-21-1150826415-95550000-2728641265-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOWREGISTRY\AUDIO\POLICYCONFIG\PROPERTYSTORE\13D5A0DF_0, , [0e0ac6aa5e3ceb4b614c0ad99c677090],
PUP.Optional.Zaxar, HKU\S-1-5-21-1150826415-95550000-2728641265-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOWREGISTRY\AUDIO\POLICYCONFIG\PROPERTYSTORE\95EF7991_0, , [66b2234d18822e089c1105deeb18f808],
PUP.Optional.Zaxar, HKU\S-1-5-21-1150826415-95550000-2728641265-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOWREGISTRY\AUDIO\POLICYCONFIG\PROPERTYSTORE\AAA6F898_0, , [e335adc343571b1b04a9df04689b966a],
PUP.Optional.MorePowerfulCleaner, HKLM\SOFTWARE\MPC DESKTOP|Location, C:\Program Files\MPC Cleaner, , [c2567ef26e2c9c9aae3e0df19b687e82]
PUP.Optional.Zaxar, HKU\S-1-5-21-1150826415-95550000-2728641265-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOWREGISTRY\AUDIO\POLICYCONFIG\PROPERTYSTORE\13d5a0df_0, {0.0.0.00000000}.{df29dd1b-c873-4230-a94b-9b0a25e9f07c}|\Device\HarddiskVolume2\Program Files\Zaxar\ZaxarGameBrowser.exe%b{00000000-0000-0000-0000-000000000000}, , [0e0ac6aa5e3ceb4b614c0ad99c677090]
PUP.Optional.Zaxar, HKU\S-1-5-21-1150826415-95550000-2728641265-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOWREGISTRY\AUDIO\POLICYCONFIG\PROPERTYSTORE\95ef7991_0, {0.0.0.00000000}.{3142cfd1-ae7a-4ccd-b1ed-fef318390ac4}|\Device\HarddiskVolume2\Program Files\Zaxar\ZaxarGameBrowser.exe%b{00000000-0000-0000-0000-000000000000}, , [66b2234d18822e089c1105deeb18f808]
PUP.Optional.Zaxar, HKU\S-1-5-21-1150826415-95550000-2728641265-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOWREGISTRY\AUDIO\POLICYCONFIG\PROPERTYSTORE\aaa6f898_0, {0.0.0.00000000}.{204754e0-2876-4075-bdfc-e3df616962fa}|\Device\HarddiskVolume2\Program Files\Zaxar\ZaxarGameBrowser.exe%b{00000000-0000-0000-0000-000000000000}, , [e335adc343571b1b04a9df04689b966a]
PUP.Optional.Elex, C:\Program Files\Mozilla Firefox\browser\features\[email protected], , [f91f7af6d1c9b383828ee3f0f50f43bd],
PUP.Optional.Elex, C:\Program Files\Mozilla Firefox\browser\features\[email protected]\chrome, , [f91f7af6d1c9b383828ee3f0f50f43bd],
PUP.Optional.Elex, C:\Program Files\Mozilla Firefox\browser\features\[email protected]\chrome\content, , [f91f7af6d1c9b383828ee3f0f50f43bd],
PUP.Optional.MorePowerfulCleaner, C:\Users\Polaris\AppData\Roaming\Microsoft\Windows\SendTo\MPC Desktop.lnk, , [44d4bdb30f8b7bbb876448b65fa407f9],
PUP.Optional.Elex, C:\Program Files\Mozilla Firefox\browser\features\[email protected]\chrome.manifest, , [f91f7af6d1c9b383828ee3f0f50f43bd],
PUP.Optional.Elex, C:\Program Files\Mozilla Firefox\browser\features\[email protected]\install.rdf, , [f91f7af6d1c9b383828ee3f0f50f43bd],
PUP.Optional.Elex, C:\Program Files\Mozilla Firefox\browser\features\[email protected]\chrome\content\ff-overlay.xul, , [f91f7af6d1c9b383828ee3f0f50f43bd],
[/CODE]
Удалил. Тестирую.
Сообщите, что с проблемой?
Полет нормальный. Проблем пока не наблюдается. Спасибо!
Удалите MBAM через установку программ в панели управления.
1. Для удаления утилит, которые использовались в лечении скачайте [URL="https://toolslib.net/downloads/finish/2/"]DelFix[/URL] и сохраните утилиту на [B]Рабочем столе[/B].
2. Запустите [B]DelFix[/B].
[SIZE=1][B]Важно[/B], для работы утилиты необходимо запускать от имени Администратора. По умолчанию в[B] Windows XP[/B] так и есть. В [B]Windows Vista/7/8/8.1/10[/B] администратор понижен в правах по умолчанию, поэтому, не забудьте нажать правой кнопкой на программу, выбрать [B]Запуск от имени Администратора[/B], при необходимости укажите пароль администратора и нажмите [B]Да[/B][/SIZE]
3.В открывшемся окне программы поставьте галочки напротив пунктов [B]Remove desinfection tools[/B] и [B]Create registry backup[/B]
4. Нажмите на кнопку [B]Run[/B].
5. После окончания работы программы автоматически откроется блокнот с отчетом [B]delfix.txt[/B] (C:\delfix.txt)
6. Прикрепите этот отчет в вашей теме.
[URL=http://virusinfo.info/showthread.php?t=7239&p=88804&viewfull=1#post88804]Выполните скрипт[/URL] в AVZ при наличии доступа в интернет:
[CODE]
var
LogPath : string;
ScriptPath : string;
begin
LogPath := GetAVZDirectory + 'log\avz_log.txt';
if FileExists(LogPath) Then DeleteFile(LogPath);
ScriptPath := GetAVZDirectory +'ScanVuln.txt';
if DownloadFile('http://dataforce.ru/~kad/ScanVuln.txt', ScriptPath, 1) then ExecuteScript(ScriptPath) else
begin
if DownloadFile('http://dataforce.ru/~kad/ScanVuln.txt', ScriptPath, 0) then ExecuteScript(ScriptPath)
else begin
ShowMessage('Невозможно загрузить скрипт AVZ для обнаружения наиболее часто используемых уязвимостей!');
exit;
end;
end;
if FileExists(LogPath) Then ExecuteFile('notepad.exe', LogPath, 1, 0, false)
end.
[/CODE]
После его работы, если будут найдены уязвимости, в блокноте откроется файл avz_log.txt со ссылками на обновления системы и критичных к безопасности программ, которые нужно загрузить и установить. В первую очередь это относится к браузерам, Java, Adobe Acrobat/Reader и Adobe Flash Player.
Выполнил
На этом все!
Статистика проведенного лечения:
[LIST][*]Получено карантинов: [B]1[/B][*]Обработано файлов: [B]16[/B][*]В ходе лечения вредоносные программы в карантинах не обнаружены[/LIST]