Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 02-07-2016
Ran by 27972 (administrator) on AZIZA (05-07-2016 23:42:50)
Running from C:\Users\27972\Documents\Farber Recovery Scan Tool
Loaded Profiles: 27972 (Available Profiles: 27972 & Sonya & Aziza & DefaultAppPool)
Platform: Windows 10 Pro Version 1511 (X64) Language: Русский (Россия)
Internet Explorer Version 11 (Default browser: Yandex Browser)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Microsoft Corporation) C:\Windows\System32\mqsvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Free 16.0.1\avp.exe
(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Free 16.0.1\avpui.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_x64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Yandex) C:\Users\27972\AppData\Local\Yandex\Elements\elements.exe\8.1.3.6036\elements64.exe
(Yandex LLC) C:\Users\27972\AppData\Local\Yandex\BrowserManager\BrowserManager.exe
() C:\Users\27972\AppData\Local\Yandex\SearchBand\Application\1.7.0.391\searchbandapp64.exe
() C:\Users\27972\AppData\Local\Sippoint\Sippoint.exe
(Яндекс) C:\Users\27972\AppData\Roaming\Yandex\YandexDisk\YandexDisk.exe
(ООО Яндекс) C:\Program Files (x86)\Yandex\Punto Switcher\punto.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\onenotem.exe
(ООО Яндекс) C:\Program Files (x86)\Yandex\Punto Switcher\ps64ldr.exe
(Logitech Inc.) C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\csisyncclient.exe
() C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\csisyncclient.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
() C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
(YANDEX LLC) C:\Users\27972\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
(YANDEX LLC) C:\Users\27972\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
(YANDEX LLC) C:\Users\27972\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
(YANDEX LLC) C:\Users\27972\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
(YANDEX LLC) C:\Users\27972\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
(YANDEX LLC) C:\Users\27972\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
(YANDEX LLC) C:\Users\27972\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
(YANDEX LLC) C:\Users\27972\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
(YANDEX LLC) C:\Users\27972\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
(YANDEX LLC) C:\Users\27972\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
(YANDEX LLC) C:\Users\27972\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
(YANDEX LLC) C:\Users\27972\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
(YANDEX LLC) C:\Users\27972\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
(YANDEX LLC) C:\Users\27972\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
(YANDEX LLC) C:\Users\27972\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
(YANDEX LLC) C:\Users\27972\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(YANDEX LLC) C:\Users\27972\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
(YANDEX LLC) C:\Users\27972\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
(YANDEX LLC) C:\Users\27972\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe
(YANDEX LLC) C:\Users\27972\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
(Ghisler Software GmbH) C:\totalcmd\TOTALCMD.EXE
(YANDEX LLC) C:\Users\27972\AppData\Local\Yandex\YandexBrowser\Application\browser.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13885696 2015-06-24] (Realtek Semiconductor)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-08-21] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2109952 2014-10-07] (Dominik Reichl)
HKLM-x32\...\Run: [LWS] => C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe [204136 2012-09-13] (Logitech Inc.)
HKLM-x32\...\Run: [PlaysTV] => C:\Program Files (x86)\Raptr Inc\PlaysTV\playstv_launcher.exe [71440 2016-06-07] (Plays.tv, LLC)
HKLM-x32\...\Run: [Raptr] => C:\Program Files (x86)\Raptr Inc\Raptr\raptrstub.exe [58640 2016-05-23] (Raptr, Inc)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKU\S-1-5-21-2825347086-2981257662-4213469737-1000\...\Run: [NevoDRM] => C:\Users\27972\AppData\Roaming\NevoDRM\NevoDRM.exe [833864 2011-12-19] ()
HKU\S-1-5-21-2825347086-2981257662-4213469737-1000\...\Run: [YandexElements] => C:\Users\27972\AppData\Local\Yandex\Elements\elements.exe\8.1.3.6036\elements64.exe [1164576 2014-03-12] (Yandex)
HKU\S-1-5-21-2825347086-2981257662-4213469737-1000\...\Run: [Browser Manager] => C:\Users\27972\AppData\Local\Yandex\BrowserManager\BrowserManager.exe [1427752 2015-03-23] (Yandex LLC)
HKU\S-1-5-21-2825347086-2981257662-4213469737-1000\...\Run: [YandexSearchBand] => C:\Users\27972\AppData\Local\Yandex\SearchBand\Application\1.7.0.391\searchbandapp64.exe [2101568 2016-06-30] ()
HKU\S-1-5-21-2825347086-2981257662-4213469737-1000\...\Run: [Sippoint] => C:\Users\27972\AppData\Local\Sippoint\Sippoint.exe [7580160 2014-12-11] ()
HKU\S-1-5-21-2825347086-2981257662-4213469737-1000\...\Run: [SyncManPath] => C:\Users\27972\AppData\Roaming\Yandex\YandexDisk\YandexDisk.exe [24534336 2016-06-16] (Яндекс)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\27972\AppData\Local\Microsoft\OneDrive\17.3.6390.0509_1\amd64\FileSyncShell64.dll [2016-07-01] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\27972\AppData\Local\Microsoft\OneDrive\17.3.6390.0509_1\amd64\FileSyncShell64.dll [2016-07-01] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\27972\AppData\Local\Microsoft\OneDrive\17.3.6390.0509_1\amd64\FileSyncShell64.dll [2016-07-01] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [0YndCase0Sync] -> {63D48440-63AB-44D0-B323-4731DFCDE9E9} => C:\Program Files\Yandex\YandexDisk\bin\YandexDiskOverlays-2398.dll [2015-01-09] ()
ShellIconOverlayIdentifiers: [0YndCase1Modified] -> {7E7DC279-E6BE-4D57-9DEC-14FA0339DBC0} => C:\Program Files\Yandex\YandexDisk\bin\YandexDiskOverlays-2398.dll [2015-01-09] ()
ShellIconOverlayIdentifiers: [0YndCase2Error] -> {FB2FE984-05F5-4512-9D9B-69D3DE61F6D9} => C:\Program Files\Yandex\YandexDisk\bin\YandexDiskOverlays-2398.dll [2015-01-09] ()
ShellIconOverlayIdentifiers: [0YndCase3Shared] -> {AF8D197E-7022-4c3d-BD88-68AD35C9C169} => C:\Program Files\Yandex\YandexDisk\bin\YandexDiskOverlays-2398.dll [2015-01-09] ()
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\27972\AppData\Local\Microsoft\OneDrive\17.3.6390.0509_1\FileSyncShell.dll [2016-06-30] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\27972\AppData\Local\Microsoft\OneDrive\17.3.6390.0509_1\FileSyncShell.dll [2016-06-30] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\27972\AppData\Local\Microsoft\OneDrive\17.3.6390.0509_1\FileSyncShell.dll [2016-06-30] (Microsoft Corporation)
Startup: C:\Users\27972\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Punto Switcher.lnk [2016-07-05]
ShortcutTarget: Punto Switcher.lnk -> C:\Program Files (x86)\Yandex\Punto Switcher\punto.exe (ООО Яндекс)
Startup: C:\Users\27972\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Вырезка экрана и программа запуска для OneNote 2007.lnk [2016-06-07]
ShortcutTarget: Вырезка экрана и программа запуска для OneNote 2007.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\27972\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Отправка в OneNote.lnk [2015-08-19]
ShortcutTarget: Отправка в OneNote.lnk -> C:\Program Files\Microsoft Office 15\root\office15\onenotem.exe (Microsoft Corporation)
Startup: C:\Users\Aziza\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Punto Switcher.lnk [2016-07-05]
ShortcutTarget: Punto Switcher.lnk -> C:\Program Files (x86)\Yandex\Punto Switcher\punto.exe (ООО Яндекс)
Startup: C:\Users\Sonya\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Punto Switcher.lnk [2016-07-05]
ShortcutTarget: Punto Switcher.lnk -> C:\Program Files (x86)\Yandex\Punto Switcher\punto.exe (ООО Яндекс)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{1db4209b-00a7-4763-a63f-6d8371fb4ac5}: [NameServer] 82.163.142.7 95.211.158.134
Tcpip\..\Interfaces\{1db4209b-00a7-4763-a63f-6d8371fb4ac5}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = 
HKU\S-1-5-21-2825347086-2981257662-4213469737-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yandex.ru/?win=189&clid=1950377
HKU\S-1-5-21-2825347086-2981257662-4213469737-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
SearchScopes: HKU\S-1-5-21-2825347086-2981257662-4213469737-1000 -> DefaultScope {EC260E13-83E3-491E-A7F5-0EA6C82948C8} URL = hxxp://yandex.ru/search/?win=189&clid=1950378&text={searchTerms}
SearchScopes: HKU\S-1-5-21-2825347086-2981257662-4213469737-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.eshield.com/serp?guid={1ED4791B-A481-4AE8-89EE-AF6F81FDEFAD}&action=default_search&k={searchTerms}
SearchScopes: HKU\S-1-5-21-2825347086-2981257662-4213469737-1000 -> {5FBC36E2-AD3B-4E43-A2BC-E81DD96FE970} URL = hxxp://search.yahoo.com/search?p={searchTerms}&fr=tightropetb&type=11467
SearchScopes: HKU\S-1-5-21-2825347086-2981257662-4213469737-1000 -> {EC260E13-83E3-491E-A7F5-0EA6C82948C8} URL = hxxp://yandex.ru/search/?win=189&clid=1950378&text={searchTerms}
SearchScopes: HKU\S-1-5-21-2825347086-2981257662-4213469737-1000 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?q={SearchTerms}&fr=ntg&gp=custom2
BHO: Kaspersky Protection -> {03993315-5CE9-4F00-8790-D14A94F1D91A} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Free 16.0.1\x64\IEExt\ie_plugin.dll [2015-12-22] (AO Kaspersky Lab)
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2016-05-17] (Microsoft Corporation)
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll [2012-02-14] (Advanced Micro Devices)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-28] (Google Inc.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-05-25] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2016-05-17] (Microsoft Corporation)
BHO: Визуальные закладки -> {D5FEC983-01DB-414a-9456-AF95AC9ED7B5} -> C:\Program Files (x86)\Yandex\FastDial\fastdial64host.dll => No File
BHO-x32: Kaspersky Protection -> {03993315-5CE9-4F00-8790-D14A94F1D91A} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Free 16.0.1\IEExt\ie_plugin.dll [2015-12-22] (AO Kaspersky Lab)
BHO-x32: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll [2012-02-14] (Advanced Micro Devices)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-28] (Google Inc.)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-05-25] (Microsoft Corporation)
BHO-x32: Визуальные закладки -> {D5FEC983-01DB-414a-9456-AF95AC9ED7B5} -> C:\Program Files (x86)\Yandex\FastDial\fastdialhost.dll [2014-09-22] ()
Toolbar: HKLM - Элементы Яндекса - {91397D20-1446-11D4-8AF4-0040CA1127B6} - C:\Program Files (x86)\Yandex\Elements\bartab64host.dll [2014-03-25] ()
Toolbar: HKLM - eShield - {898E8883-5181-4959-B230-E3C01F807653} - C:\Program Files (x86)\TNT2\2.0.0.1995\IEToolbar64.dll No File
Toolbar: HKLM - Kaspersky Protection Toolbar - {001032CB-B0AC-4F2C-A650-AD4B2B26E5DA} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Free 16.0.1\x64\IEExt\ie_plugin.dll [2015-12-22] (AO Kaspersky Lab)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-28] (Google Inc.)
Toolbar: HKLM-x32 - Элементы Яндекса - {91397D20-1446-11D4-8AF4-0040CA1127B6} - C:\Program Files (x86)\Yandex\Elements\bartabhost.dll [2014-03-25] ()
Toolbar: HKLM-x32 - Kaspersky Protection Toolbar - {001032CB-B0AC-4F2C-A650-AD4B2B26E5DA} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Free 16.0.1\IEExt\ie_plugin.dll [2015-12-22] (AO Kaspersky Lab)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-28] (Google Inc.)
Toolbar: HKU\.DEFAULT -> Элементы Яндекса - {91397D20-1446-11D4-8AF4-0040CA1127B6} - C:\Program Files (x86)\Yandex\Elements\bartab64host.dll [2014-03-25] ()
Toolbar: HKU\S-1-5-21-2825347086-2981257662-4213469737-1000 -> Элементы Яндекса - {91397D20-1446-11D4-8AF4-0040CA1127B6} - C:\Program Files (x86)\Yandex\Elements\bartab64host.dll [2014-03-25] ()
Toolbar: HKU\S-1-5-21-2825347086-2981257662-4213469737-1000 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-28] (Google Inc.)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2016-04-20] (Microsoft Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-05-25] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-05-25] (Microsoft Corporation)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)

FireFox:
========
FF ProfilePath: C:\Users\27972\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_22_0_0_192.dll [2016-06-21] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_22_0_0_192.dll [2016-06-21] ()
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2015-10-13] (Google, Inc.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-12-13] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-05-27] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2825347086-2981257662-4213469737-1000: @tnt2npapi.com/Plugin -> C:\Users\27972\AppData\Local\TNT2\2.0.0.1995\npTNT2.dll [2015-08-12] (Eshield)
FF user.js: detected! => C:\Users\27972\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\user.js [2015-08-12]
FF SearchPlugin: C:\Users\27972\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\searchplugins\mailru.xml [2014-08-19]
FF SearchPlugin: C:\Users\27972\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\searchplugins\yandex.ru-202031.xml [2015-01-26]
FF Extension: eShield - C:\Users\27972\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\Extensions\toolbar11467@eshield.com [2015-08-12] [not signed]
FF HKLM-x32\...\Firefox\Extensions: [light_plugin_ACF0E80077C511E59DED005056C00008@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Free 16.0.1\FFExt\light_plugin_firefox\addon.xpi
FF Extension: Kaspersky Protection - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Free 16.0.1\FFExt\light_plugin_firefox\addon.xpi [2016-04-28]
FF HKLM-x32\...\Firefox\Extensions: [{C7AE725D-FA5C-4027-BB4C-787EF9F8248A}] - C:\Program Files (x86)\PremierOpinion\firefox => not found

Chrome: 
=======
CHR HomePage: Default -> yandex.ru/?__PARAM__from=chromehp
CHR StartupUrls: Default -> "hxxp://mail.ru/cnt/10445?gp=custom2"
CHR DefaultSearchURL: Default -> hxxp://yandex.ru/yandsearch?text={searchTerms}
CHR DefaultSearchKeyword: Default -> yandex.ru
CHR DefaultSuggestURL: Default -> hxxp://suggest.yandex.net/suggest-ff.cgi?part={searchTerms}
CHR Profile: C:\Users\27972\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Яндекс) - C:\Users\27972\AppData\Local\Google\Chrome\User Data\Default\Extensions\aminlpmkfcdibgpgfajlgnamicjckkjf [2016-05-27]
CHR Extension: (Kaspersky Protection) - C:\Users\27972\AppData\Local\Google\Chrome\User Data\Default\Extensions\blbkdnmdcafmfhinpmnlhhddbepgkeaa [2016-05-27]
CHR Extension: (YouTube) - C:\Users\27972\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-06-27]
CHR Extension: (Поиск Google) - C:\Users\27972\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-08-20]
CHR Extension: (eShield) - C:\Users\27972\AppData\Local\Google\Chrome\User Data\Default\Extensions\dkmjljdbbgogihjcapfhgkonfmccbffp [2016-05-27]
CHR Extension: (Советник Яндекс.Маркета) - C:\Users\27972\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdjdjkkjoiomafnihnobkinnfjnnlhdg [2016-06-27]
CHR Extension: (Стартовая — Яндекс) - C:\Users\27972\AppData\Local\Google\Chrome\User Data\Default\Extensions\gehngeifmelphpllncobkmimphfkckne [2016-05-27]
CHR Extension: (Стартовая — Яндекс) - C:\Users\27972\AppData\Local\Google\Chrome\User Data\Default\Extensions\jdkihdhlegcdggknokfekoemkjjnjhgi [2016-05-27]
CHR Extension: (Skype) - C:\Users\27972\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2016-05-27]
CHR Extension: (Kaspersky Protection) - C:\Users\27972\AppData\Local\Google\Chrome\User Data\Default\Extensions\lpeeaghdjmhlakojjcgfdhgcejdaefmi [2016-05-27]
CHR Extension: (Платежная система Интернет-магазина Chrome) - C:\Users\27972\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-05-27]
CHR Extension: (Gmail) - C:\Users\27972\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-06-27]
CHR HKLM\...\Chrome\Extension: [blbkdnmdcafmfhinpmnlhhddbepgkeaa] - hxxps://chrome.google.com/webstore/detail/blbkdnmdcafmfhinpmnlhhddbepgkeaa
CHR HKLM\...\Chrome\Extension: [lpeeaghdjmhlakojjcgfdhgcejdaefmi] - hxxps://chrome.google.com/webstore/detail/lpeeaghdjmhlakojjcgfdhgcejdaefmi
CHR HKLM-x32\...\Chrome\Extension: [aminlpmkfcdibgpgfajlgnamicjckkjf] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [blbkdnmdcafmfhinpmnlhhddbepgkeaa] - hxxps://chrome.google.com/webstore/detail/blbkdnmdcafmfhinpmnlhhddbepgkeaa
CHR HKLM-x32\...\Chrome\Extension: [dkmjljdbbgogihjcapfhgkonfmccbffp] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [fdjdjkkjoiomafnihnobkinnfjnnlhdg] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gehngeifmelphpllncobkmimphfkckne] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [jdkihdhlegcdggknokfekoemkjjnjhgi] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2016-05-25]
CHR HKLM-x32\...\Chrome\Extension: [lpeeaghdjmhlakojjcgfdhgcejdaefmi] - hxxps://chrome.google.com/webstore/detail/lpeeaghdjmhlakojjcgfdhgcejdaefmi
CHR HKLM-x32\...\Chrome\Extension: [mkndcbhcgphcfkkddanakjiepeknbgle] - C:\Program Files (x86)\PremierOpinion\pmcm.crx <not found>

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2015-08-21] (Advanced Micro Devices, Inc.) [File not signed]
R2 AVP16.0.1; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Free 16.0.1\avp.exe [236928 2015-12-22] (AO Kaspersky Lab)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1364096 2016-05-25] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1687680 2016-05-25] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [3009776 2016-05-27] (Microsoft Corporation)
S3 klvssbrigde64; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Free 16.0.1\x64\vssbridge64.exe [152488 2015-12-22] (AO Kaspersky Lab)
S2 PlaysService; C:\Program Files (x86)\Raptr Inc\PlaysTV\plays_service.exe [32528 2016-06-07] (Plays.tv, LLC)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364464 2015-10-30] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-10-30] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWT6.sys [111120 2016-03-01] (Advanced Micro Devices)
R0 cm_km; C:\Windows\System32\DRIVERS\cm_km.sys [389816 2015-07-06] (Kaspersky Lab ZAO)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [478392 2015-09-11] (Kaspersky Lab ZAO)
R0 klbackupdisk; C:\Windows\System32\DRIVERS\klbackupdisk.sys [53432 2015-06-06] (Kaspersky Lab ZAO)
R1 klbackupflt; C:\Windows\System32\DRIVERS\klbackupflt.sys [79752 2015-12-01] (AO Kaspersky Lab)
R2 kldisk; C:\Windows\system32\DRIVERS\kldisk.sys [78200 2015-12-02] (AO Kaspersky Lab)
S0 klelam; C:\Windows\System32\DRIVERS\klelam.sys [30328 2015-06-24] (Kaspersky Lab)
R3 klflt; C:\Windows\system32\DRIVERS\klflt.sys [182664 2015-12-11] (AO Kaspersky Lab)
R1 klhk; C:\Windows\System32\drivers\klhk.sys [237488 2016-04-28] (AO Kaspersky Lab)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [987568 2016-04-28] (AO Kaspersky Lab)
R1 KLIM6; C:\Windows\system32\DRIVERS\klim6.sys [51288 2016-03-04] (AO Kaspersky Lab)
R3 klkbdflt; C:\Windows\system32\DRIVERS\klkbdflt.sys [52608 2015-11-11] (AO Kaspersky Lab)
R3 klmouflt; C:\Windows\system32\DRIVERS\klmouflt.sys [41656 2015-06-07] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [45960 2015-12-07] (AO Kaspersky Lab)
S4 klwfp; C:\Windows\system32\DRIVERS\klwfp.sys [87944 2015-10-06] (Kaspersky Lab ZAO)
R1 Klwtp; C:\Windows\system32\DRIVERS\klwtp.sys [112520 2015-12-03] (AO Kaspersky Lab)
R1 kneps; C:\Windows\system32\DRIVERS\kneps.sys [194440 2015-12-03] (AO Kaspersky Lab)
R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [589824 2015-10-30] (Realtek                                            )
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)
U4 idsvc; no ImagePath

========================== Drivers MD5 =======================

C:\Windows\System32\drivers\1394ohci.sys DF1C3D7E6C7929AD83BE22852B5B08CB
C:\Windows\System32\drivers\3ware.sys 2C5B3035B86770ADD2FE9BFBAF5B35A4
C:\Windows\System32\drivers\ACPI.sys 469441BAE3FF8A16826FC62C51EF5E18
C:\Windows\System32\Drivers\acpiex.sys 7EADED8087C392876521F7EBCE846EF4
C:\Windows\System32\drivers\acpipagr.sys C498887123327CDFD73A05E7A2780920
C:\Windows\System32\drivers\acpipmi.sys C8DBE6EFFCF014CAA010B9BDDAC833EC
C:\Windows\System32\drivers\acpitime.sys 17039DBEB3B7B9ADCDB4B4533AA9771F
C:\Windows\System32\drivers\ADP80XX.SYS F7D0CD345D2DA42E7042ABCD73662403
C:\Windows\system32\drivers\afd.sys 70148EFA9A562E7185B75BBE7D376BF7
C:\Windows\System32\drivers\agp440.sys 870F1A2C936F92B5D053DF7EC75B352F
C:\Windows\System32\DRIVERS\ahcache.sys 3DF7751D5DC6525E7DC6617FBB45054F
C:\Windows\System32\drivers\amdk8.sys B70F0F2F54B4A4DB6E9C830454752F5A
C:\Windows\system32\DRIVERS\atikmdag.sys E42C714AA0924245C03C47564D2CB9AC
C:\Windows\system32\DRIVERS\atikmpag.sys B44E4A2ABBF61755E611A86D3B13B15F
C:\Windows\System32\drivers\amdppm.sys 35E890482C9728DD5C552B85DA8A5AB2
C:\Windows\System32\drivers\amdsata.sys 5B30BCFE6E02E45D3EE268FF001BC5E0
C:\Windows\System32\drivers\amdsbs.sys F20B30F35A5C7888441B4DCA001ECF8E
C:\Windows\System32\drivers\amdxata.sys AFE838D7576C581D6483529621AB10CC
C:\Windows\System32\drivers\appid.sys EDDB0D726DBECDFC1DBCC6DB464E5A13
C:\Windows\System32\drivers\arcsas.sys E3FE8F610B1CC12BC3B2E6BC43DC97E2
C:\Windows\System32\drivers\asyncmac.sys 5E00748A1AD246CAECBBB7553BED36CC
C:\Windows\System32\drivers\atapi.sys 492B99D2E3D5D7BFD5F0AE1BE7BD37DD
C:\Windows\system32\drivers\AtihdWT6.sys 2A38B5218A7BE3CE0E0B3D92E3844782
C:\Windows\System32\drivers\bxvbda.sys 6447BA6FA709514B6C803D159B4C7D1E
C:\Windows\System32\drivers\BasicDisplay.sys B4AC08B1D04D0CE085435E5CD0E663C5
C:\Windows\System32\drivers\BasicRender.sys 25B5BB369DEE2BAE4BF459C978FF9035
C:\Windows\System32\drivers\bcmfn.sys 3F5523DCEFE42B385659C5CB46A6B810
C:\Windows\System32\drivers\bcmfn2.sys 0B750A6A6D847E73CA48ADD7A0F5A393
C:\Windows\System32\Drivers\Beep.sys 5A88834AEE15D97695FAE0837B73B3E4
C:\Windows\System32\DRIVERS\bowser.sys DA2C6F7ACE392193C424FEA975C5BFFB
C:\Windows\System32\drivers\BthAvrcpTg.sys CAEC7BC11AF69A181AF7932E636E09E4
C:\Windows\System32\drivers\bthhfenum.sys 5F2B4B32E986C058525D3BA2A475A16C
C:\Windows\System32\drivers\BthHFHid.sys 5406289E8AE2CB52FC408154E0A64BA7
C:\Windows\System32\drivers\bthmodem.sys A76F20CCCA31895A1DA78A875E50F946
C:\Windows\System32\drivers\buttonconverter.sys BF89BDBA5D3A0B4256D3F6FC8D31880D
C:\Windows\System32\drivers\capimg.sys C24C27FDF93B85A4EFCF25F830253AA2
C:\Windows\System32\DRIVERS\cdfs.sys 7F9C7226D743B232907ED2537B8A574F
C:\Windows\System32\drivers\cdrom.sys 82D97776BF982AA143BDC7DFB5054EA8
C:\Windows\System32\drivers\circlass.sys 0505C1D991D0F9D47F3353BB98597C7E
C:\Windows\System32\drivers\CLFS.sys 8B4B39C507ABA09AAFE8E3932D1B392C
C:\Windows\System32\drivers\CmBatt.sys 95832B049E2833B9F5189823CDF946C7
C:\Windows\System32\DRIVERS\cm_km.sys B2A6D2A30E93B6F215F74AC7E1733C9C
C:\Windows\System32\Drivers\cng.sys A1105260EEEE3DBD8D38FD054B22BD00
C:\Windows\System32\DRIVERS\cnghwassist.sys 58D640BC2294C71BDE0953F12D4B432F
C:\Windows\System32\DriverStore\FileRepository\compositebus.inf_amd64_912dfdedc3d2f520\CompositeBus.sys 14F9883588398A1BDE49C75098C75DE6
C:\Windows\System32\drivers\condrv.sys 02B8E49148DE5E0A2F6FDF28CE94A6AC
C:\Windows\System32\drivers\csc.sys 5D578EAAFB6FD4F59523E5878B541296
C:\Windows\System32\drivers\dam.sys 2619DC483579DB9FE804044C1ADFFD1A
C:\Windows\System32\Drivers\dfsc.sys C9478D7DB7BE5D7ACE65CB1167F07320
C:\Windows\System32\drivers\disk.sys 4904B152E4942BF700F2D73228B4D477
C:\Windows\System32\drivers\dmvsc.sys 0197AE4B9790A4E73751CACFAA480126
C:\Windows\system32\DRIVERS\drmkaud.sys 25FA06D3B49D6ADF8E874FFCDCD76B50
C:\Windows\System32\drivers\dxgkrnl.sys F45665E77D11F3C1552EDBEAD1559DC8
C:\Windows\System32\drivers\evbda.sys 491275B864B704B54EC08168344E0F38
C:\Windows\System32\drivers\EhStorClass.sys CEF108FCE06892CFA5F1B49527D4BF49
C:\Windows\System32\drivers\EhStorTcgDrv.sys 5B1EAAE3001A7A320C106FC3859F4111
C:\Windows\System32\drivers\errdev.sys 7A2705148A4BB3CA255F81624338B461
C:\Windows\System32\Drivers\exfat.sys DFE8A33FBCF6F38182631A4D6097B92D
C:\Windows\System32\Drivers\fastfat.sys 03DE0EC072C5EBD5B018CAD83F1E522A
C:\Windows\System32\drivers\fdc.sys 9D299AE86D671488926126A84DF77BFD
C:\Windows\System32\drivers\filecrypt.sys 8F12AB59336143B680F71B217B495AD2
C:\Windows\System32\drivers\fileinfo.sys 92ECCFA58C8195B8EA33ED942469D4E6
C:\Windows\System32\drivers\filetrace.sys 87C51FDD50C17882BA93E28BBABB9847
C:\Windows\System32\drivers\flpydisk.sys E99261DD76D1C9E05AF575939CAE5AC5
C:\Windows\System32\drivers\fltmgr.sys 25D7A58625E1453E40D36825DE74E4F1
C:\Windows\System32\drivers\FsDepends.sys B4175E8BE60B099686FF55CA7D692316
C:\Windows\System32\Drivers\Fs_Rec.sys CC71372CEB811A72F1DC99089C5CBF53
C:\Windows\System32\DRIVERS\fvevol.sys 421497634C86EF4B8F86D0EBC076728F
C:\Windows\System32\drivers\gagp30kx.sys B9981A4CB9F728B3312A3885BFAA7204
C:\Windows\System32\drivers\vmgencounter.sys 77555B11B264991DDC26872FFCF1AB97
C:\Windows\System32\drivers\genericusbfn.sys F3AC9652D88BF87BA6596CBEA28CE10F
C:\Windows\System32\Drivers\msgpioclx.sys F802FBABF0C4DF1BAA733187B2E476F5
C:\Windows\System32\drivers\gpuenergydrv.sys D011B0ADB15F4815310CE1BF4780B33E
C:\Windows\System32\drivers\HDAudBus.sys 84BC034B6BB763733C1949B7B9BAF976
C:\Windows\System32\drivers\HidBatt.sys 6B8CB114B8E64C0636EB49F7B914D1FC
C:\Windows\System32\drivers\hidbth.sys D1AD197CCDAAC0CB4819DA1D6EB17BAE
C:\Windows\System32\drivers\hidi2c.sys 64909DECCFCC6FB5D9A5BAFDCCB31FEE
C:\Windows\System32\drivers\hidinterrupt.sys F510F7B7BF61DEAAC04E65C3B65E8D59
C:\Windows\System32\drivers\hidir.sys 90F3ED42D423C942BA5EA54E2FFE7AC7
C:\Windows\System32\drivers\hidusb.sys 128DEDDD61915DBA4D451D91D21F0513
C:\Windows\System32\drivers\HpSAMD.sys FF442DCDCE1F6E9FAA9C8AD0CD1D199B
C:\Windows\System32\drivers\HTTP.sys 318E816717431D3C23DC82779900C744
C:\Windows\System32\drivers\hwpolicy.sys CBA5E88A0F0475B7F49653BB72150BEF
C:\Windows\System32\drivers\hyperkbd.sys D668FAB4B0397B426EE3D41683B9A1C0
C:\Windows\system32\DRIVERS\HyperVideo.sys 40115A0F8E7FF9E786EBBD1D33D39AD7
C:\Windows\System32\drivers\i8042prt.sys 53FDD9E69189E546DE4740F8C4D8AB2F
C:\Windows\System32\drivers\iai2c.sys 9A2A2F3C69B9A30B6E78536F6D258BAD
C:\Windows\System32\drivers\iaLPSS2i_I2C.sys 59A20F5AD9F4AE54098154359519408E
C:\Windows\System32\drivers\iaLPSSi_GPIO.sys 16A10CCEDCF5AC4CAAE43DC9FC40392F
C:\Windows\System32\drivers\iaLPSSi_I2C.sys EB82A11613326691508D9ED9A4FE29E7
C:\Windows\System32\drivers\iaStorAV.sys 6B0029A0253098CCE28EACCFDB9E7208
C:\Windows\System32\drivers\iaStorV.sys 9652E1E35A92D8C75710C17A63B15796
C:\Windows\System32\drivers\ibbus.sys FFADF691F7BF727AF5C863454A372723
C:\Windows\system32\drivers\RTKVHD64.sys 622868E4BAE8FBCD22CB1A5901A2C824
C:\Windows\System32\drivers\intelide.sys ECDB27420D3A98424666904525A8562A
C:\Windows\System32\drivers\intelpep.sys 8FF1978643EFD219C5BA49690191D701
C:\Windows\System32\drivers\intelppm.sys B61B60F36E1C8022FA8166ABF0F66B07
C:\Windows\System32\drivers\ioqos.sys CA0D42029AFFC4514D295E1EF823D02D
C:\Windows\System32\DRIVERS\ipfltdrv.sys 6E3F9D95235DFC9417384080A216F310
C:\Windows\System32\drivers\IPMIDrv.sys 4F527ECB5EAB47D8EAF34A469666C469
C:\Windows\System32\drivers\ipnat.sys 9E5E8F2A1996F23B7E9687846AA81B01
C:\Windows\System32\drivers\irenum.sys C317EB660138BC9CBFE37CCDE56351AE
C:\Windows\System32\drivers\isapnp.sys 531994A6D9399D9B74BE12B5BB58A81E
C:\Windows\System32\drivers\msiscsi.sys 68D5354A4A9692EEC24664C60F47D4A2
C:\Windows\System32\drivers\kbdclass.sys 701D7DB13B0815E7076EF4CB4CE981F8
C:\Windows\System32\drivers\kbdhid.sys 884EBBDDBF5968003B40185BD96FF0E6
C:\Windows\System32\drivers\kdnic.sys 6B3A0C7902811E6372643447E41F7048
C:\Windows\System32\DRIVERS\kl1.sys 62EBD4202B505ACADE2FBC56CC73E0A2
C:\Windows\System32\DRIVERS\klbackupdisk.sys 86F40D79CE80ACBE6BEBAC8CE89D75A0
C:\Windows\System32\DRIVERS\klbackupflt.sys 1B321722C507A04E1EAFCFFD0F7B7EF9
C:\Windows\system32\DRIVERS\kldisk.sys B12242478186B62B2E214288B7DB3612
C:\Windows\System32\DRIVERS\klelam.sys E2097C8F18F1E8E3B7D09F12B51843A3
C:\Windows\system32\DRIVERS\klflt.sys C64655B935BCBB5AB39F87F79F5087A6
C:\Windows\System32\drivers\klhk.sys E06446CAB518D66247E8042B3FDC6CDB
C:\Windows\System32\DRIVERS\klif.sys D49C6C43CC00296BB942BD12764E707B
C:\Windows\system32\DRIVERS\klim6.sys 5D9960343E6866C420727727AFBE17BC
C:\Windows\system32\DRIVERS\klkbdflt.sys 36E044A2C64FCBCBC0F42ED5050F9CBD
C:\Windows\system32\DRIVERS\klmouflt.sys FD47C92A63B6EADEA830BFA96C06EAEE
C:\Windows\System32\DRIVERS\klpd.sys 26E1917517E613D07F2A122CEEBB8161
C:\Windows\system32\DRIVERS\klwfp.sys 26D3895A519220E94D241A8858D40CD9
C:\Windows\system32\DRIVERS\klwtp.sys 6B98C134815C9AB284F9DEA03B8BD5E8
C:\Windows\system32\DRIVERS\kneps.sys 58CD685752080EDAEB4EEC7E6428546D
C:\Windows\System32\Drivers\ksecdd.sys 982C795DE20CED7AEDD2E7899B5D9BC1
C:\Windows\System32\Drivers\ksecpkg.sys 7D8B9214692C4D0F1646215D9984E19A
C:\Windows\system32\drivers\ksthunk.sys E9BB0023D730701BB5D9839B44F5E6B5
C:\Windows\System32\drivers\lltdio.sys EC34EED89C34B27C292166B725AC7A7B
C:\Windows\System32\drivers\lsi_sas.sys 961F28D879D345BFA50AF51285C90F2E
C:\Windows\System32\drivers\lsi_sas2i.sys 6BFB8D1B3407518BE06B6F81F92FA0F5
C:\Windows\System32\drivers\lsi_sas3i.sys BE0E47988D78F731DEC2C0CB03E765CB
C:\Windows\System32\drivers\lsi_sss.sys F99BF02BE9219986817BF094981EEB18
C:\Windows\system32\drivers\luafv.sys 2FCF837196082864F66CFD9CAB256275
C:\Windows\system32\DRIVERS\lvuvc64.sys 415E344294D1C0D04627B29146F68481
C:\Windows\System32\drivers\megasas.sys 2ED29B635F35E31A1C0D3DDB7DD2AD03
C:\Windows\System32\drivers\megasr.sys 22E3CB85870879CBAE13C5095A8B12E3
C:\Windows\System32\drivers\mlx4_bus.sys D41920FBFFF2BBCBBC69A5B383AD022E
C:\Windows\system32\drivers\mmcss.sys 64BD0C87064EA20C2D3DC4199F9C239C
C:\Windows\System32\drivers\modem.sys 8D4B46FA84A3A3702EDADD37FAC6EDBA
C:\Windows\System32\drivers\monitor.sys 78FEC1BDB168370F131BFBFEA0A04E9D
C:\Windows\System32\drivers\mouclass.sys D1CC0833CFBC4222A95CAA5D0C8C78FF
C:\Windows\System32\drivers\mouhid.sys C2E05EC6B80BCF5AE362DA873E1BCE64
C:\Windows\System32\drivers\mountmgr.sys D5B7668A8F6C67C51FA5C6C513396D6C
C:\Windows\System32\drivers\mpsdrv.sys 5FBCB85D127BE21E3A9DAF11A13C00EA
C:\Windows\System32\drivers\mqac.sys 2B9A1FF2450BAF7A795941BE471F16EF
C:\Windows\system32\drivers\mrxdav.sys BF6CA7EA5ECD6CF72D3D76652A9B8280
C:\Windows\System32\DRIVERS\mrxsmb.sys 0B3B0C1D86050355676640488FA897D3
C:\Windows\System32\DRIVERS\mrxsmb10.sys 1A490555FD330CA2764D89191177C867
C:\Windows\System32\DRIVERS\mrxsmb20.sys 0F47A6C09F0A7FB5513D322A2B9BE4EC
C:\Windows\System32\drivers\bridge.sys A4411C522D41707D5BCA817A5BB9E30B
C:\Windows\System32\Drivers\Msfs.sys D123343DDB02E372B02BF2C4293F835F
C:\Windows\System32\drivers\msgpiowin32.sys B3358F380BA3F29F56BE0F7734C24D5F
C:\Windows\System32\drivers\mshidkmdf.sys B2044D5D125F249680508EC0B2AAEFAC
C:\Windows\System32\drivers\mshidumdf.sys 36ABE7FC80BED4FE44754AE5CFB51432
C:\Windows\System32\drivers\msisadrv.sys 59307FEAFC9E72EEEC56B7FD7D294F4C
C:\Windows\system32\DRIVERS\MSKSSRV.sys E9457EDFEBC774199F907395C6D09CA2
C:\Windows\System32\drivers\mslldp.sys C85D79735641D27C5821C35ECDDC2334
C:\Windows\system32\DRIVERS\MSPCLOCK.sys EF75184B64356850D0F04D049C253526
C:\Windows\system32\DRIVERS\MSPQM.sys 543933D166C618E7588EA77707EC1683
C:\Windows\System32\Drivers\MsRPC.sys 182711E9DDF70121A20EBB61B2DFB9E8
C:\Windows\System32\drivers\mssmbios.sys E887FFDD6734C496407E9219225CB6FF
C:\Windows\system32\DRIVERS\MSTEE.sys 83A2AB75951000D681FABDB80C07AEFC
C:\Windows\System32\drivers\MTConfig.sys 4FA0483896FC16583851EFB733FCB083
C:\Windows\System32\Drivers\mup.sys 60F88248608315E13391C2F1C3B4473F
C:\Windows\System32\drivers\mvumis.sys 218705233D02776AE4D19CC37D985C1B
C:\Windows\System32\DRIVERS\nwifi.sys 536A0806CE2061A2157E65D4D8ABF30C
C:\Windows\System32\drivers\ndfltr.sys B57CE307DA101C739885B7CC0678077F
C:\Windows\System32\drivers\ndis.sys AFAECF904F1C343EBD50F91BC8D0DBE8
C:\Windows\System32\drivers\ndiscap.sys 202260E7CDD731A32AF62ABD1ABEE008
C:\Windows\System32\drivers\NdisImPlatform.sys A1D473D0CF10561F29B58EA7C5412A92
C:\Windows\System32\DRIVERS\ndistapi.sys 1A0AE283B8DE6BB76412A0F8213D45AC
C:\Windows\System32\drivers\ndisuio.sys A74EE2D2C0BFF5EC3A6185791868C4CA
C:\Windows\System32\drivers\NdisVirtualBus.sys 32A9BD1342640D48AD85C8B3E812B984
C:\Windows\System32\drivers\ndiswan.sys 6A6A8CF5EE61801375A38EBB871D4057
C:\Windows\System32\DRIVERS\ndiswan.sys 6A6A8CF5EE61801375A38EBB871D4057
C:\Windows\System32\DRIVERS\NDProxy.sys 50AEF8EF0064A91ABB08D858D039C9DE
C:\Windows\System32\drivers\Ndu.sys D358DF634F52247CB43F0781218F4D6E
C:\Windows\System32\drivers\netbios.sys 026618ECF6C4BEBDCB7885D42EC0DBE4
C:\Windows\System32\DRIVERS\netbt.sys F51C02D992A8D6BC5EC4D990F227D4C7
C:\Windows\System32\drivers\netvsc.sys 2BB62723C835F75F0C7C9E6A736881FB
C:\Windows\System32\Drivers\Npfs.sys 465DC580170CD844206D7E3EF1DBF2A1
C:\Windows\System32\drivers\npsvctrig.sys 29395C214D2CD4C81F73166AB988A797
C:\Windows\System32\drivers\nsiproxy.sys 2871225495F832A8C8A7DD1A17EDB3DC
C:\Windows\System32\Drivers\NTFS.sys 58BFFEF692A47FCE3FAAEDBC8F3DCBBB
C:\Windows\System32\Drivers\Null.sys 6DBD703320484C37CEA9E4E2D266A8CE
C:\Windows\System32\drivers\nvraid.sys 604D27CC38CC23493F218D0BB834B3FF
C:\Windows\System32\drivers\nvstor.sys 8B50D897657AB4A15FD9E251BBF7D107
C:\Windows\System32\drivers\nv_agp.sys 31F990B2B6B91E9D7A667405CE12FCB1
C:\Windows\System32\drivers\parport.sys 7D0FC96264C0F8F2C1321E33E8EB646C
C:\Windows\System32\drivers\partmgr.sys 24AC0FD10325FBC2303B29A5F237AEB0
C:\Windows\System32\drivers\pci.sys 1D4E995955BDAE781C46CB97AE1CFB58
C:\Windows\System32\drivers\pciide.sys 2B4D98DF0CA57FB9536DBC80D2449D1F
C:\Windows\System32\drivers\pcmcia.sys F4D5793BF2E58AF15C6CF2FEEF9E73EB
C:\Windows\System32\drivers\pcw.sys 22A53744CEEADFFFD33BA010FAD95229
C:\Windows\System32\drivers\pdc.sys 48F3A3222CF340FE31535CB6D49C6D6F
C:\Windows\System32\drivers\peauth.sys E2F8376F9731D12A009C522036C6073A
C:\Windows\System32\drivers\percsas2i.sys 1398A85E59698067CBBE1D66A9C13ADF
C:\Windows\System32\drivers\percsas3i.sys 35F7C7AD709D909D618D9EDF987FC3ED
C:\Windows\System32\drivers\raspptp.sys 5BA6B9AD03B81546BA64E488C4EF9D17
C:\Windows\System32\drivers\processr.sys 21AECFF3EB5748CBE12538A2500EFDE5
C:\Windows\System32\drivers\pacer.sys 596FB6C5A72F34B7566930985E543806
C:\Windows\system32\drivers\qwavedrv.sys CFBA9C976CBF6796E5DC39EF59984021
C:\Windows\System32\DRIVERS\rasacd.sys 7B2AD8C55217B514C14281AB97B4E21D
C:\Windows\System32\drivers\AgileVpn.sys E15A9CE1E2E7D1C8DF97A4FC1FFE6289
C:\Windows\System32\drivers\rasl2tp.sys E3C82823B22463BC38AA4F8ADA852624
C:\Windows\System32\drivers\raspppoe.sys 3369023EB5790A75BA7DABA14B75D922
C:\Windows\System32\drivers\rassstp.sys 1E32A8CD65C4AD0A827CFEB13034DA29
C:\Windows\System32\DRIVERS\rdbss.sys 2B648363E4C5E34B469C58596F377DD9
C:\Windows\System32\drivers\rdpbus.sys D0221C13960E274CC539D72D5A842ED0
C:\Windows\System32\drivers\rdpdr.sys 1DC2CC74B51E4DC4CD5A20C1021E4010
C:\Windows\System32\drivers\rdpvideominiport.sys 177DF954D0DEC0465A380C75F6E7F65F
C:\Windows\System32\drivers\rdyboost.sys 5D1680871054D2B0B8A971BC8AB3B837
C:\Windows\System32\Drivers\ReFSv1.sys 341E6830DA70F65730300DAB4CB0B490
C:\Windows\System32\drivers\rspndr.sys 0AC5FCDC29ED97ECDEF1276425EE2059
C:\Windows\System32\drivers\rt640x64.sys FBEFF38DE03450E03E6CD9E8E37A8C74
C:\Windows\System32\drivers\vms3cap.sys 044890BB0D6CF1E23C1087234D320509
C:\Windows\System32\drivers\sbp2port.sys 530F797129776AA7E81994783A97E2AD
C:\Windows\System32\DRIVERS\scfilter.sys 9B6B1D4DB35A3D9BEAF023BC95E1F49D
C:\Windows\System32\drivers\sdbus.sys 70165A0A2653FB8AFDE3D85000727F29
C:\Windows\System32\drivers\sdstor.sys DE6D7DC78D956928F59F7415A0F41E13
C:\Windows\System32\drivers\SerCx.sys 67585C295FF2D221679E376B68893B35
C:\Windows\System32\drivers\SerCx2.sys B8C4852CBCAAC1374C08EC7445443824
C:\Windows\System32\drivers\serenum.sys D3A103944A8FCD78FD48B2B19092790C
C:\Windows\System32\drivers\serial.sys 88D58E1DAA6C5062DD3A26273106961F
C:\Windows\System32\drivers\sermouse.sys 0F5B43074AE731D2C6F061241C9D84A6
C:\Windows\System32\drivers\sfloppy.sys D9FE59276BD56A9643C32D5FACE2F251
C:\Windows\System32\drivers\SiSRaid2.sys ABBE803FE0BDAE0E5BE74DDEFBE62F23
C:\Windows\System32\drivers\sisraid4.sys 6043DF55CFE3C7ACF477645FA64DEA98
C:\Windows\System32\drivers\spaceport.sys 1A6CB30F0EFC1632E6F1B852CA892583
C:\Windows\System32\drivers\SpbCx.sys E1C158F6C00359278727A2CEE5D2ED71
C:\Windows\System32\DRIVERS\srv.sys ACC1709EC7FE6EB8999DBC91C50C2B34
C:\Windows\System32\DRIVERS\srv2.sys AFBCFC946FAE7483E27BD316D03F94A5
C:\Windows\System32\DRIVERS\srvnet.sys 107C1EBE79710E4A759449BD6604245A
C:\Windows\System32\drivers\stexstor.sys CCDA497C880AD16D87EDFAEFCFB2EDF5
C:\Windows\System32\drivers\storahci.sys BF8EA6FC3358C2F69678E3E94F764F84
C:\Windows\System32\drivers\vmstorfl.sys 32FF460DA8C1F370F5C08B7654899B73
C:\Windows\System32\drivers\stornvme.sys CC21DB3EF619B9480FE31A4EFE92CBEB
C:\Windows\System32\drivers\storqosflt.sys 390B8A75768E2689586539C224520895
C:\Windows\System32\drivers\storufs.sys 770A92D9D3A0BF61C97C3AFCB36847D9
C:\Windows\System32\drivers\storvsc.sys 736A2418E3E7F3DB3CF6EB0A55D1D581
C:\Windows\System32\drivers\swenum.sys BD98B0225BCD49E8A62F4F8EE1D1F613
C:\Windows\System32\drivers\Synth3dVsc.sys CAE4B27B469C583131EA5AAE622F5D76
C:\Windows\System32\drivers\tcpip.sys 892F30506DCCF230C5A57019C1D8D31B
C:\Windows\System32\drivers\tcpip.sys 892F30506DCCF230C5A57019C1D8D31B
C:\Windows\System32\drivers\tcpipreg.sys 17F37EC9042D84561C550620643D9A85
C:\Windows\system32\DRIVERS\tdx.sys 91D3F2A6253EF83EFBD7903028F58C4D
C:\Windows\System32\drivers\terminpt.sys E730D0EB1B84EBC98423FC8D285EDBC0
C:\Windows\System32\drivers\tpm.sys 169B0A246067457FEF8A18EED7EED9D5
C:\Windows\System32\drivers\TsUsbFlt.sys 48E828C66AB016E48F2CB4DD585315FD
C:\Windows\System32\drivers\TsUsbGD.sys 267C76EE60736EA5A1811A53FA02AABE
C:\Windows\System32\drivers\tunnel.sys 8CE72F094B822AD5EE9C3A3AFC0C16B6
C:\Windows\System32\drivers\uagp35.sys 42C546414F80BD6C0137FC3A106F8A69
C:\Windows\System32\drivers\uaspstor.sys 1686DBC81748B096232B15F16C302985
C:\Windows\System32\Drivers\UcmCx.sys 3995CC3DEDED258768B8EBC2F4C0DC73
C:\Windows\System32\drivers\UcmUcsi.sys 1C95F7CE37D9EFB90EBE987A9712356C
C:\Windows\System32\drivers\ucx01000.sys AED081772091C98173905E2DF28C223B
C:\Windows\System32\drivers\udecx.sys DCA34A111C29E4578DF2B8CEA3C7CDBD
C:\Windows\System32\DRIVERS\udfs.sys 718A956AE00CE086F381044AB66CC29C
C:\Windows\System32\drivers\UEFI.sys BA760F8E66428BA9FF1E8BFBC6248136
C:\Windows\System32\drivers\ufx01000.sys 5F0D997E6FC5A418D7673148CEF72887
C:\Windows\System32\drivers\UfxChipidea.sys 2B1DABA97DDF5365FC66EE7DEDD86A13
C:\Windows\System32\drivers\ufxsynopsys.sys DB630FC660443D63EBAB2C830C298EFE
C:\Windows\System32\drivers\uliagpkx.sys 6DE78C04BF32ECA7AF3064F53687C9A5
C:\Windows\System32\drivers\umbus.sys 67D1E0E6E4D5D33AF0AEF0E33B4DA0F4
C:\Windows\System32\drivers\umpass.sys 11680607944A719EF20E0E740785712A
C:\Windows\System32\drivers\urschipidea.sys 2410A0C20D21A25E6C01979FA886BE90
C:\Windows\System32\drivers\urscx01000.sys 6E59CE43B6BA5AA1ADCF36A4DBBB92BB
C:\Windows\System32\drivers\urssynopsys.sys E8A59FA109A22FC07E44BDFCC9727DBD
C:\Windows\System32\drivers\usbccgp.sys D8A44550ECE102B6443F5D54DCE7DAB3
C:\Windows\System32\drivers\usbcir.sys 66B3D22DAB5312FF238ABF5C6D9F8FAB
C:\Windows\System32\drivers\usbehci.sys 3E4F20DB902D2E2914F3FF3DB9772200
C:\Windows\System32\DRIVERS\usbfilter.sys 504901430B6E03B99EBB6BF26E0868C6
C:\Windows\System32\drivers\usbhub.sys 41F7F00D76904416EF1F9EFA1A4C37A2
C:\Windows\System32\drivers\UsbHub3.sys B7E1CAA9429E4C3E7E01CB35B97E1536
C:\Windows\System32\drivers\usbohci.sys DAB35CCA86F5FBE77D870A40089BC4A1
C:\Windows\System32\drivers\usbprint.sys 21162F65C7756AAECAEBED9E67D0A5FE
C:\Windows\System32\drivers\usbser.sys F259A45D6B555B14CC8365AA6BC8DC20
C:\Windows\System32\drivers\USBSTOR.SYS 8949F77132A4F8F3BA17C6727099F002
C:\Windows\System32\drivers\usbuhci.sys 8B3E458A8851F9A3B2109B1680EE1159
C:\Windows\System32\drivers\USBXHCI.SYS 325727F01F03C504CF788618A13DC266
C:\Windows\System32\drivers\vdrvroot.sys E1BE37312785A71862516F66B3FD24CE
C:\Windows\System32\drivers\VerifierExt.sys E42C0F2850735FF9D908B9DB581E6314
C:\Windows\System32\drivers\vhdmp.sys EC15FD6A28757793E2DA394CD94ABD52
C:\Windows\System32\drivers\vhf.sys D0C9632C350F46786643A069251BC249
C:\Windows\System32\drivers\vmbus.sys E886CB75DA2B6EB35469EF10135624C7
C:\Windows\System32\drivers\VMBusHID.sys 46D2EC27820EC0F798F85821E53C2942
C:\Windows\System32\drivers\volmgr.sys B9265F47E7A354BAAA0AF5CBA3F8F7CE
C:\Windows\System32\drivers\volmgrx.sys BEE9C8B72AB752B794F69C2B9B3678AA
C:\Windows\System32\drivers\volsnap.sys E1F91A727A04C9F8199D04FF3BBBF63C
C:\Windows\System32\drivers\vpci.sys F7B1B1101271E31F43CC76E890704F51
C:\Windows\System32\drivers\vsmraid.sys D48ED0A08BD2FD25A833E6AC99623091
C:\Windows\System32\drivers\vstxraid.sys 6990D4AFDF545669D4E6C232F26DE1FB
C:\Windows\System32\drivers\vwifibus.sys 1EE11F0508C58EF081F4176E66D6970B
C:\Windows\System32\drivers\vwififlt.sys 938E4EF58E42D252B742B0E243011B90
C:\Windows\System32\drivers\wacompen.sys 00C27B64C758C111E5D78A70DE6CA2B6
C:\Windows\System32\DRIVERS\wanarp.sys 8CB53620B2C2F0641DD7563EA0FDF491
C:\Windows\System32\DRIVERS\wanarp.sys 8CB53620B2C2F0641DD7563EA0FDF491
C:\Windows\system32\drivers\WdBoot.sys 069D3D6E20AD753B34FCE856F0436869
C:\Windows\System32\drivers\Wdf01000.sys 6CC727E94CD84E9720FDCDA8089CABCC
C:\Windows\system32\drivers\WdFilter.sys E3E97151A1D1E87BB2D5371F66C5F169
C:\Windows\System32\DRIVERS\wdiwifi.sys E70DDD8E2245CC67547B0861983912D8
C:\Windows\System32\Drivers\WdNisDrv.sys 07B043160399AF4009054E2EA3464BF4
C:\Windows\System32\drivers\wfplwfs.sys C11272713719922DE5711094333BD166
C:\Windows\System32\drivers\wimmount.sys EF536C54AB9281FDC4E83B07279FCFC4
C:\Windows\System32\drivers\WindowsTrustedRT.sys D8966A76408107224C6013993135DD78
C:\Windows\System32\drivers\WindowsTrustedRTProxy.sys 8B102A7B6CE326FD4208CC7C2D183343
C:\Windows\System32\drivers\winmad.sys 4A53441C1C4D2878BEF27E381138BB2D
C:\Windows\System32\drivers\WinUSB.SYS 260907CE034FE327AC99BDA4153AB22F
C:\Windows\System32\drivers\winverbs.sys 40A3E8D729F458B2C9A8BD9380FF83D5
C:\Windows\System32\drivers\wmiacpi.sys 8F010BF65238F3F822D22BA12831796E
C:\Windows\System32\Drivers\Wof.sys 2A9650FCC696DB28E45EA8B33B99B8E6
C:\Windows\System32\DRIVERS\wpcfltr.sys 22C52D7EE7C7D0E02C8EFD8CAE8E3A71
C:\Windows\System32\drivers\WpdUpFltr.sys 1C08E424CBDD5065BB7266F8C048C1B1
C:\Windows\system32\drivers\ws2ifsl.sys 638B43D39A3D0B47024555CF1095E6F1
C:\Windows\System32\drivers\WudfPf.sys A928F25CB62232F413EE655352856E10
C:\Windows\System32\drivers\WUDFRd.sys A932391623D5CEC4EF4A2A17D3CEBFCD
C:\Windows\system32\DRIVERS\WUDFRd.sys A932391623D5CEC4EF4A2A17D3CEBFCD
C:\Windows\System32\drivers\xboxgip.sys F279536122B83FD0D8E158AA753E1B7C
C:\Windows\System32\drivers\xinputhid.sys DBACD4E4FE191D0CE7C624ACA389535E

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-07-05 23:40 - 2016-07-05 23:42 - 00000000 ____D C:\FRST
2016-07-05 23:32 - 2016-07-05 23:42 - 00000000 ____D C:\Users\27972\Documents\Farber Recovery Scan Tool
2016-07-05 19:53 - 2016-07-05 19:53 - 08926236 _____ C:\Users\27972\Downloads\Survive_book.pdf
2016-07-05 15:59 - 2016-07-05 15:59 - 00000000 ____D C:\Users\27972\Desktop\LOG
2016-07-05 15:55 - 2016-07-05 15:59 - 00446488 _____ (Alex Dragokas) C:\Users\27972\Desktop\ClearLNK.exe
2016-07-05 15:54 - 2016-07-05 15:55 - 00194441 _____ C:\Users\27972\Downloads\ClearLNK.zip
2016-07-05 00:57 - 2016-07-05 00:58 - 04036781 _____ C:\Users\27972\Downloads\CATALOG_LADA_2107_2010.pdf
2016-07-04 12:48 - 2016-07-04 12:52 - 52909332 _____ C:\Users\27972\Downloads\W0704 (1).rar
2016-07-04 12:47 - 2016-07-04 12:52 - 52909332 _____ C:\Users\27972\Downloads\W0704.rar
2016-07-04 09:53 - 2016-07-04 09:53 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2016-07-01 20:28 - 2016-07-01 20:28 - 00000000 ____D C:\Users\27972\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Яндекс.Диск
2016-07-01 16:04 - 2016-07-01 17:00 - 00000000 ____D C:\Users\27972\Documents\Автосборщик логов
2016-07-01 16:00 - 2016-07-01 16:01 - 11949378 _____ C:\Users\27972\Downloads\AutoLogger.zip
2016-07-01 02:45 - 2016-07-01 02:45 - 00000000 ___HD C:\OneDriveTemp
2016-07-01 01:23 - 2016-07-01 01:23 - 00002568 _____ C:\Users\27972\Desktop\Yandex.lnk
2016-07-01 01:13 - 2016-07-01 01:15 - 00508736 _____ (YANDEX LLC) C:\Users\27972\Downloads\Yandex (1).exe
2016-07-01 00:07 - 2016-07-01 00:07 - 00000020 ___SH C:\Users\DefaultAppPool\ntuser.ini
2016-06-30 23:15 - 2016-06-30 23:15 - 00000020 ___SH C:\Users\27972\ntuser.ini
2016-06-30 23:13 - 2016-06-30 23:13 - 00000000 _SHDL C:\Users\Default\Шаблоны
2016-06-30 23:13 - 2016-06-30 23:13 - 00000000 _SHDL C:\Users\Default\Мои документы
2016-06-30 23:13 - 2016-06-30 23:13 - 00000000 _SHDL C:\Users\Default\главное меню
2016-06-30 23:13 - 2016-06-30 23:13 - 00000000 _SHDL C:\Users\Default\Documents\Моя музыка
2016-06-30 23:13 - 2016-06-30 23:13 - 00000000 _SHDL C:\Users\Default\Documents\мои рисунки
2016-06-30 23:13 - 2016-06-30 23:13 - 00000000 _SHDL C:\Users\Default\Documents\Мои видеозаписи
2016-06-30 23:13 - 2016-06-30 23:13 - 00000000 _SHDL C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Программы
2016-06-30 23:13 - 2016-06-30 23:13 - 00000000 _SHDL C:\Users\Default User\Documents\Моя музыка
2016-06-30 23:13 - 2016-06-30 23:13 - 00000000 _SHDL C:\Users\Default User\Documents\мои рисунки
2016-06-30 23:13 - 2016-06-30 23:13 - 00000000 _SHDL C:\Users\Default User\Documents\Мои видеозаписи
2016-06-30 23:13 - 2016-06-30 23:13 - 00000000 _SHDL C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Программы
2016-06-30 22:46 - 2016-06-30 22:46 - 00001519 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2016-06-30 22:46 - 2016-06-30 22:46 - 00000000 ____D C:\Users\Default\AppData\Roaming\Media Center Programs
2016-06-30 22:46 - 2016-06-30 22:46 - 00000000 ____D C:\Users\Default\AppData\Roaming\ATI
2016-06-30 22:46 - 2016-06-30 22:46 - 00000000 ____D C:\Users\Default\AppData\Local\Microsoft Help
2016-06-30 22:46 - 2016-06-30 22:46 - 00000000 ____D C:\Users\Default\AppData\Local\ATI
2016-06-30 22:46 - 2016-06-30 22:46 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Media Center Programs
2016-06-30 22:46 - 2016-06-30 22:46 - 00000000 ____D C:\Users\Default User\AppData\Roaming\ATI
2016-06-30 22:46 - 2016-06-30 22:46 - 00000000 ____D C:\Users\Default User\AppData\Local\Microsoft Help
2016-06-30 22:46 - 2016-06-30 22:46 - 00000000 ____D C:\Users\Default User\AppData\Local\ATI
2016-06-30 22:33 - 2016-06-30 22:33 - 00000000 ____D C:\Program Files\Common Files\SpeechEngines
2016-06-30 22:31 - 2016-06-30 22:48 - 00000000 ____D C:\WINDOWS\system32\config\bbimigrate
2016-06-30 22:23 - 2016-07-05 15:32 - 00000000 ____D C:\Users\27972
2016-06-30 22:23 - 2016-07-01 00:07 - 00000000 ____D C:\Users\DefaultAppPool
2016-06-30 22:23 - 2016-06-30 22:56 - 00000000 ____D C:\Users\Sonya
2016-06-30 22:23 - 2016-06-30 22:54 - 00000000 ____D C:\Users\Aziza
2016-06-30 22:23 - 2016-06-30 22:23 - 00000000 _SHDL C:\Users\Sonya\Шаблоны
2016-06-30 22:23 - 2016-06-30 22:23 - 00000000 _SHDL C:\Users\Sonya\Мои документы
2016-06-30 22:23 - 2016-06-30 22:23 - 00000000 _SHDL C:\Users\Sonya\главное меню
2016-06-30 22:23 - 2016-06-30 22:23 - 00000000 _SHDL C:\Users\Sonya\Documents\Моя музыка
2016-06-30 22:23 - 2016-06-30 22:23 - 00000000 _SHDL C:\Users\Sonya\Documents\мои рисунки
2016-06-30 22:23 - 2016-06-30 22:23 - 00000000 _SHDL C:\Users\Sonya\Documents\Мои видеозаписи
2016-06-30 22:23 - 2016-06-30 22:23 - 00000000 _SHDL C:\Users\Sonya\AppData\Roaming\Microsoft\Windows\Start Menu\Программы
2016-06-30 22:23 - 2016-06-30 22:23 - 00000000 _SHDL C:\Users\DefaultAppPool\Шаблоны
2016-06-30 22:23 - 2016-06-30 22:23 - 00000000 _SHDL C:\Users\DefaultAppPool\Мои документы
2016-06-30 22:23 - 2016-06-30 22:23 - 00000000 _SHDL C:\Users\DefaultAppPool\главное меню
2016-06-30 22:23 - 2016-06-30 22:23 - 00000000 _SHDL C:\Users\DefaultAppPool\Documents\Моя музыка
2016-06-30 22:23 - 2016-06-30 22:23 - 00000000 _SHDL C:\Users\DefaultAppPool\Documents\мои рисунки
2016-06-30 22:23 - 2016-06-30 22:23 - 00000000 _SHDL C:\Users\DefaultAppPool\Documents\Мои видеозаписи
2016-06-30 22:23 - 2016-06-30 22:23 - 00000000 _SHDL C:\Users\DefaultAppPool\AppData\Roaming\Microsoft\Windows\Start Menu\Программы
2016-06-30 22:23 - 2016-06-30 22:23 - 00000000 _SHDL C:\Users\Aziza\Шаблоны
2016-06-30 22:23 - 2016-06-30 22:23 - 00000000 _SHDL C:\Users\Aziza\Мои документы
2016-06-30 22:23 - 2016-06-30 22:23 - 00000000 _SHDL C:\Users\Aziza\главное меню
2016-06-30 22:23 - 2016-06-30 22:23 - 00000000 _SHDL C:\Users\Aziza\Documents\Моя музыка
2016-06-30 22:23 - 2016-06-30 22:23 - 00000000 _SHDL C:\Users\Aziza\Documents\мои рисунки
2016-06-30 22:23 - 2016-06-30 22:23 - 00000000 _SHDL C:\Users\Aziza\Documents\Мои видеозаписи
2016-06-30 22:23 - 2016-06-30 22:23 - 00000000 _SHDL C:\Users\Aziza\AppData\Roaming\Microsoft\Windows\Start Menu\Программы
2016-06-30 22:23 - 2016-06-30 22:23 - 00000000 _SHDL C:\Users\27972\Шаблоны
2016-06-30 22:23 - 2016-06-30 22:23 - 00000000 _SHDL C:\Users\27972\Мои документы
2016-06-30 22:23 - 2016-06-30 22:23 - 00000000 _SHDL C:\Users\27972\главное меню
2016-06-30 22:23 - 2016-06-30 22:23 - 00000000 _SHDL C:\Users\27972\Documents\Моя музыка
2016-06-30 22:23 - 2016-06-30 22:23 - 00000000 _SHDL C:\Users\27972\Documents\мои рисунки
2016-06-30 22:23 - 2016-06-30 22:23 - 00000000 _SHDL C:\Users\27972\Documents\Мои видеозаписи
2016-06-30 22:23 - 2016-06-30 22:23 - 00000000 _SHDL C:\Users\27972\AppData\Roaming\Microsoft\Windows\Start Menu\Программы
2016-06-30 22:22 - 2016-07-05 15:41 - 02101690 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-06-30 22:22 - 2016-06-30 22:22 - 02009944 _____ C:\WINDOWS\SysWOW64\PerfStringBackup.INI
2016-06-30 22:18 - 2016-06-30 22:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2016-06-30 22:17 - 2016-06-30 22:33 - 00000000 ____D C:\Users\Все пользователи\Package Cache
2016-06-30 22:17 - 2016-06-30 22:33 - 00000000 ____D C:\Users\Все пользователи\AMD
2016-06-30 22:17 - 2016-06-30 22:33 - 00000000 ____D C:\ProgramData\Package Cache
2016-06-30 22:17 - 2016-06-30 22:33 - 00000000 ____D C:\ProgramData\AMD
2016-06-30 22:17 - 2016-06-30 22:17 - 00000000 ____D C:\Program Files\ATI Technologies
2016-06-30 22:17 - 2016-06-30 22:17 - 00000000 ____D C:\Program Files (x86)\ATI Technologies
2016-06-30 22:16 - 2016-07-05 20:17 - 00000000 _____ C:\WINDOWS\system32\Drivers\lvuvc.hs
2016-06-30 22:16 - 2016-06-30 22:33 - 00000000 ____D C:\Program Files\Common Files\logishrd
2016-06-30 22:16 - 2016-06-30 22:33 - 00000000 ____D C:\Program Files\AMD
2016-06-30 22:16 - 2016-06-30 22:16 - 00000000 _____ C:\WINDOWS\ativpsrm.bin
2016-06-30 22:15 - 2016-06-30 22:15 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2016-06-30 22:15 - 2016-06-30 22:15 - 00000000 ____D C:\WINDOWS\SysWOW64\RTCOM
2016-06-30 22:15 - 2016-06-30 22:15 - 00000000 ____D C:\Program Files\Realtek
2016-06-30 22:12 - 2016-06-30 23:15 - 00000000 ___DC C:\WINDOWS\Panther
2016-06-30 22:06 - 2016-06-30 22:07 - 00000000 ____D C:\Windows.old
2016-06-30 21:56 - 2016-06-30 21:56 - 00008192 _____ C:\WINDOWS\system32\config\userdiff
2016-06-30 21:52 - 2016-06-30 22:48 - 00000000 ____D C:\Program Files (x86)\MSBuild
2016-06-30 21:52 - 2016-06-30 21:52 - 00000000 ____D C:\WINDOWS\SysWOW64\XPSViewer
2016-06-30 21:52 - 2016-06-30 21:52 - 00000000 ____D C:\WINDOWS\SysWOW64\BestPractices
2016-06-30 21:52 - 2016-06-30 21:52 - 00000000 ____D C:\WINDOWS\system32\msmq
2016-06-30 21:52 - 2016-06-30 21:52 - 00000000 ____D C:\WINDOWS\system32\BestPractices
2016-06-30 21:52 - 2016-06-30 21:52 - 00000000 ____D C:\Program Files\Reference Assemblies
2016-06-30 21:52 - 2016-06-30 21:52 - 00000000 ____D C:\Program Files\MSBuild
2016-06-30 21:52 - 2016-06-30 21:52 - 00000000 ____D C:\Program Files (x86)\Reference Assemblies
2016-06-30 21:52 - 2016-06-30 21:52 - 00000000 ____D C:\inetpub
2016-06-30 21:50 - 2015-10-23 17:47 - 00778936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationNative_v0300.dll
2016-06-30 21:50 - 2015-10-23 17:47 - 00103120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2016-06-30 21:50 - 2015-10-23 17:47 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe
2016-06-30 21:49 - 2015-10-23 17:46 - 01166520 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationNative_v0300.dll
2016-06-30 21:49 - 2015-10-23 17:46 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe
2016-06-30 21:49 - 2015-10-23 17:45 - 00124624 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2016-06-30 19:25 - 2016-06-30 21:06 - 00000000 ___HD C:\$WINDOWS.~BT
2016-06-30 19:12 - 2016-06-30 19:12 - 00000000 ____D C:\ESD
2016-06-30 18:55 - 2016-06-30 18:55 - 00000000 ___HD C:\$Windows.~WS
2016-06-30 18:54 - 2016-06-30 18:55 - 18447464 _____ (Microsoft Corporation) C:\Users\27972\Downloads\MediaCreationTool.exe
2016-06-30 17:26 - 2016-06-30 22:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PremierOpinion
2016-06-30 00:42 - 2016-06-30 00:43 - 00002013 _____ C:\Users\27972\Desktop\Pandora TV.lnk
2016-06-30 00:42 - 2016-06-30 00:42 - 00000671 _____ C:\Users\27972\Desktop\KMPlayer.lnk
2016-06-30 00:36 - 2016-07-05 15:34 - 00000000 ____D C:\Program Files (x86)\PremierOpinion
2016-06-30 00:36 - 2016-04-22 22:57 - 01092544 _____ (VoiceFive, Inc.) C:\WINDOWS\system32\pmls64.dll
2016-06-30 00:36 - 2016-04-22 22:57 - 00735680 _____ (VoiceFive, Inc.) C:\WINDOWS\SysWOW64\pmls.dll
2016-06-29 19:19 - 2016-06-29 19:23 - 772619295 _____ C:\Users\27972\Downloads\5000 в день.rar
2016-06-29 18:28 - 2016-06-29 18:29 - 270323497 _____ C:\Users\27972\Downloads\Практический+курс.+Легкие+деньги+на+Qnits.rar
2016-06-28 23:40 - 2016-06-29 19:24 - 00000000 ____D C:\Users\27972\Documents\Золотарёв-СРА
2016-06-28 23:14 - 2016-06-28 23:28 - 2120527180 _____ C:\Users\27972\Downloads\CPA_Золотарёв.rar
2016-06-27 17:52 - 2016-06-27 17:52 - 58346740 _____ C:\Users\27972\Downloads\W0627.rar
2016-06-27 00:23 - 2016-06-27 17:01 - 00000000 ____D C:\Program Files\Reimage
2016-06-27 00:22 - 2016-06-27 00:26 - 00000140 _____ C:\WINDOWS\Reimage.ini
2016-06-27 00:21 - 2016-06-27 00:21 - 00768416 _____ (Reimage) C:\Users\27972\Downloads\ReimageRepair.exe
2016-06-26 21:50 - 2016-06-26 21:50 - 00000000 ____D C:\Users\Все пользователи\db7f6d9d-75c1-0
2016-06-26 21:50 - 2016-06-26 21:50 - 00000000 ____D C:\ProgramData\db7f6d9d-75c1-0
2016-06-26 21:46 - 2016-06-30 23:02 - 00018732 _____ C:\WINDOWS\System32\Tasks\DNSPLUM
2016-06-26 21:45 - 2016-06-26 23:45 - 00000000 ____D C:\Program Files (x86)\DNSPLUM
2016-06-26 21:44 - 2016-06-26 21:44 - 00000000 ____D C:\Users\Все пользователи\db7f6d9d-02f3-0
2016-06-26 21:44 - 2016-06-26 21:44 - 00000000 ____D C:\Users\Все пользователи\{26866dc3-512c-1}
2016-06-26 21:44 - 2016-06-26 21:44 - 00000000 ____D C:\Users\Все пользователи\{09b7bbd4-712c-0}
2016-06-26 21:44 - 2016-06-26 21:44 - 00000000 ____D C:\Users\Все пользователи\{0162428d-412c-0}
2016-06-26 21:44 - 2016-06-26 21:44 - 00000000 ____D C:\ProgramData\db7f6d9d-02f3-0
2016-06-26 21:44 - 2016-06-26 21:44 - 00000000 ____D C:\ProgramData\{26866dc3-512c-1}
2016-06-26 21:44 - 2016-06-26 21:44 - 00000000 ____D C:\ProgramData\{09b7bbd4-712c-0}
2016-06-26 21:44 - 2016-06-26 21:44 - 00000000 ____D C:\ProgramData\{0162428d-412c-0}
2016-06-21 23:50 - 2016-05-28 07:35 - 00123392 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdlrecover.exe
2016-06-21 23:49 - 2016-05-28 07:35 - 00031744 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsdport.sys
2016-06-21 23:49 - 2016-05-28 07:31 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdlrecover.exe
2016-06-21 02:36 - 2016-07-04 12:57 - 00000186 ____H C:\Users\27972\Downloads\descript.ion
2016-06-21 02:32 - 2016-06-21 02:33 - 39730164 _____ C:\Users\27972\Downloads\W0620.rar
2016-06-13 14:56 - 2016-06-13 14:57 - 28552660 _____ C:\Users\27972\Downloads\W0613 (1).rar
2016-06-13 14:55 - 2016-06-13 11:03 - 28552660 _____ C:\Users\27972\Downloads\W0613.rar
2016-06-13 14:53 - 2016-06-13 14:53 - 28552812 _____ C:\Users\27972\Downloads\W0613 (1).zip
2016-06-13 14:52 - 2016-06-13 14:53 - 28552812 _____ C:\Users\27972\Downloads\W0613.zip
2016-06-10 16:06 - 2016-06-30 22:48 - 00000000 ____D C:\Users\27972\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sippoint
2016-06-10 16:06 - 2016-06-10 16:07 - 00000000 ____D C:\Users\27972\AppData\Roaming\Sippoint
2016-06-10 16:06 - 2016-06-10 16:06 - 00001164 _____ C:\Users\27972\Desktop\Sippoint.lnk
2016-06-10 16:06 - 2016-06-10 16:06 - 00001148 _____ C:\Users\27972\AppData\Roaming\Sippoint.lnk
2016-06-10 16:06 - 2016-06-10 16:06 - 00000000 ____D C:\Users\27972\AppData\Local\Sippoint
2016-06-10 15:39 - 2016-06-10 15:40 - 68093301 _____ C:\Users\27972\Downloads\E0610.rar
2016-06-07 16:48 - 2016-06-07 16:48 - 00031794 _____ C:\Users\27972\Documents\check-3W75Y8.pdf
2016-06-05 23:01 - 2016-06-30 22:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteForex MT4 Terminal
2016-06-05 23:01 - 2016-06-05 23:01 - 00000000 ____D C:\Program Files (x86)\LiteForex MT4 Terminal
2016-06-05 22:57 - 2016-06-05 23:00 - 00542128 _____ (MetaQuotes Software Corp.) C:\Users\27972\Downloads\liteforex4setup.exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-07-05 23:16 - 2014-06-03 13:15 - 00000988 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2016-07-05 23:05 - 2014-12-14 13:59 - 00000896 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2016-07-05 23:03 - 2015-10-11 11:03 - 00000410 _____ C:\WINDOWS\Tasks\Обновление Браузера Яндекс.job
2016-07-05 22:30 - 2016-02-08 21:33 - 00000000 ____D C:\Users\Все пользователи\Kaspersky Lab
2016-07-05 22:30 - 2016-02-08 21:33 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2016-07-05 20:44 - 2015-11-07 08:44 - 00000410 _____ C:\WINDOWS\Tasks\Обновление Браузера Яндекс .job
2016-07-05 19:56 - 2014-08-13 18:27 - 00000000 ___RD C:\Users\27972\YandexDisk
2016-07-05 19:41 - 2015-08-14 14:51 - 00004170 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{275D8E04-42C2-4195-9BA6-33B95776E141}
2016-07-05 17:00 - 2015-10-30 10:11 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-07-05 16:37 - 2015-10-30 10:24 - 00000000 ____D C:\WINDOWS\AppReadiness
2016-07-05 15:59 - 2015-11-04 09:12 - 00000000 ____D C:\Users\Aziza\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Амиго
2016-07-05 15:59 - 2015-03-31 20:04 - 00000000 ____D C:\Users\Aziza\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Приложения Амиго
2016-07-05 15:41 - 2016-04-27 08:10 - 00901450 _____ C:\WINDOWS\system32\perfh019.dat
2016-07-05 15:41 - 2016-04-27 08:10 - 00197588 _____ C:\WINDOWS\system32\perfc019.dat
2016-07-05 15:41 - 2015-10-30 10:21 - 00000000 ____D C:\WINDOWS\INF
2016-07-05 15:39 - 2015-08-11 20:18 - 00000000 ___RD C:\Users\27972\OneDrive
2016-07-05 15:38 - 2014-06-03 13:15 - 00000984 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2016-07-05 15:34 - 2016-04-27 08:40 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-07-05 15:33 - 2015-10-30 09:28 - 00524288 ___SH C:\WINDOWS\system32\config\BBI
2016-07-04 22:18 - 2014-06-24 20:10 - 00000000 ____D C:\Users\27972\AppData\Roaming\Skype
2016-07-04 09:34 - 2015-10-30 10:24 - 00000000 ___HD C:\Program Files\WindowsApps
2016-07-03 17:38 - 2016-04-26 22:36 - 00351232 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2016-07-02 16:32 - 2014-06-21 23:11 - 00000000 ____D C:\Users\27972\AppData\Roaming\KeePass
2016-07-02 08:32 - 2015-10-30 10:24 - 00000000 ____D C:\WINDOWS\system32\NDF
2016-07-01 14:49 - 2015-10-30 10:24 - 00000000 ____D C:\WINDOWS\appcompat
2016-07-01 02:45 - 2015-08-11 20:18 - 00002450 _____ C:\Users\27972\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2016-06-30 23:49 - 2015-10-30 10:24 - 00000000 ____D C:\WINDOWS\rescache
2016-06-30 23:26 - 2015-10-30 10:24 - 00000000 __RHD C:\Users\Public\Libraries
2016-06-30 23:22 - 2015-08-11 20:09 - 00000000 ____D C:\Users\27972\AppData\Local\Packages
2016-06-30 23:17 - 2016-04-27 08:49 - 00000000 __RHD C:\Users\Public\AccountPictures
2016-06-30 23:13 - 2015-10-30 10:24 - 00000000 ____D C:\Program Files\Windows NT
2016-06-30 23:12 - 2015-08-11 17:56 - 00020958 _____ C:\WINDOWS\diagwrn.xml
2016-06-30 23:12 - 2015-08-11 17:56 - 00020958 _____ C:\WINDOWS\diagerr.xml
2016-06-30 23:07 - 2015-10-30 10:24 - 00000000 ____D C:\WINDOWS\system32\WinBioDatabase
2016-06-30 23:07 - 2015-10-30 10:24 - 00000000 ____D C:\WINDOWS\Registration
2016-06-30 23:02 - 2016-05-11 00:01 - 00003764 _____ C:\WINDOWS\System32\Tasks\AMD Updater
2016-06-30 23:02 - 2016-01-23 18:26 - 00003490 _____ C:\WINDOWS\System32\Tasks\Opera scheduled Autoupdate 1427635019
2016-06-30 23:02 - 2015-10-11 11:03 - 00003002 _____ C:\WINDOWS\System32\Tasks\Обновление Браузера Яндекс
2016-06-30 23:02 - 2015-08-30 20:34 - 00003276 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2016-06-30 23:02 - 2015-08-29 16:02 - 00002954 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2016-06-30 23:02 - 2015-08-20 21:18 - 00003312 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{420BA241-F1AE-4448-9E94-E6F30A575949}
2016-06-30 23:02 - 2015-08-11 20:01 - 00023848 _____ C:\WINDOWS\system32\emptyregdb.dat
2016-06-30 23:02 - 2015-02-25 19:33 - 00002228 _____ C:\WINDOWS\System32\Tasks\{E9C5E3D6-0CAA-4AFB-BBA9-DD0CE5033497}
2016-06-30 23:02 - 2014-12-14 13:59 - 00003154 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2016-06-30 23:02 - 2014-06-03 13:15 - 00003500 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2016-06-30 23:01 - 2015-10-30 10:24 - 00000000 __RSD C:\WINDOWS\Media
2016-06-30 22:48 - 2016-05-25 23:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Snagit 10
2016-06-30 22:48 - 2016-05-25 22:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2016-06-30 22:48 - 2016-05-10 23:57 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Gaming Evolved
2016-06-30 22:48 - 2016-04-27 08:27 - 00000000 ____D C:\WINDOWS\ShellNew
2016-06-30 22:48 - 2016-02-09 17:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Picasa 3
2016-06-30 22:48 - 2016-02-08 21:35 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Free
2016-06-30 22:48 - 2015-10-30 10:24 - 00000000 ___SD C:\WINDOWS\Downloaded Program Files
2016-06-30 22:48 - 2015-10-30 10:24 - 00000000 ____D C:\Users\Все пользователи\regid.1991-06.com.microsoft
2016-06-30 22:48 - 2015-10-30 10:24 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2016-06-30 22:48 - 2015-10-30 09:28 - 00032768 ___SH C:\WINDOWS\system32\config\ELAM
2016-06-30 22:48 - 2015-08-22 16:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2016-06-30 22:48 - 2015-08-17 22:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FBS Trader 4
2016-06-30 22:48 - 2015-08-13 19:22 - 00000000 ____D C:\Users\27972\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Saxo Bank
2016-06-30 22:48 - 2015-08-12 21:39 - 00000000 ____D C:\Users\27972\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Codecs
2016-06-30 22:48 - 2015-08-12 21:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UpdateAdmin
2016-06-30 22:48 - 2015-08-12 20:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech
2016-06-30 22:48 - 2014-12-14 14:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FlvPlayer
2016-06-30 22:48 - 2014-12-13 20:10 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PROMT
2016-06-30 22:48 - 2014-12-05 12:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AusLogics BoostSpeed
2016-06-30 22:48 - 2014-08-20 10:28 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Мастер настройки
2016-06-30 22:48 - 2014-08-19 18:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack
2016-06-30 22:48 - 2014-08-19 18:15 - 00000000 ____D C:\Users\27972\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\The KMPlayer
2016-06-30 22:48 - 2014-08-19 17:36 - 00000000 ____D C:\Users\27972\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2016-06-30 22:48 - 2014-08-19 17:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2016-06-30 22:48 - 2014-06-24 19:59 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Total Commander
2016-06-30 22:48 - 2014-06-22 21:37 - 00000000 ____D C:\WINDOWS\ru
2016-06-30 22:46 - 2015-10-30 09:28 - 00000000 ____D C:\Users\Default.migrated
2016-06-30 22:36 - 2016-05-27 00:43 - 00000000 ____D C:\WINDOWS\SysWOW64\%Data%
2016-06-30 22:36 - 2016-04-27 08:10 - 00000000 ____D C:\WINDOWS\SysWOW64\slmgr
2016-06-30 22:36 - 2016-04-27 08:10 - 00000000 ____D C:\WINDOWS\system32\slmgr
2016-06-30 22:36 - 2015-10-30 10:24 - 00000000 ___SD C:\WINDOWS\SysWOW64\Configuration
2016-06-30 22:36 - 2015-10-30 10:24 - 00000000 ____D C:\WINDOWS\SysWOW64\SMI
2016-06-30 22:36 - 2015-10-30 10:24 - 00000000 ____D C:\WINDOWS\SysWOW64\migwiz
2016-06-30 22:36 - 2015-10-30 10:24 - 00000000 ____D C:\WINDOWS\SysWOW64\IME
2016-06-30 22:35 - 2015-10-30 10:24 - 00000000 ___SD C:\WINDOWS\system32\Configuration
2016-06-30 22:35 - 2015-10-30 10:24 - 00000000 ____D C:\WINDOWS\system32\IME
2016-06-30 22:35 - 2014-06-22 01:30 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-06-30 22:34 - 2015-10-30 10:24 - 00000000 ___RD C:\WINDOWS\PurchaseDialog
2016-06-30 22:34 - 2015-10-30 10:24 - 00000000 ___HD C:\WINDOWS\ELAMBKUP
2016-06-30 22:34 - 2015-10-30 10:24 - 00000000 ____D C:\WINDOWS\schemas
2016-06-30 22:34 - 2015-10-30 10:24 - 00000000 ____D C:\WINDOWS\PolicyDefinitions
2016-06-30 22:34 - 2015-10-30 10:24 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2016-06-30 22:34 - 2015-10-30 10:24 - 00000000 ____D C:\WINDOWS\InputMethod
2016-06-30 22:34 - 2015-10-30 10:24 - 00000000 ____D C:\WINDOWS\Help
2016-06-30 22:33 - 2016-05-25 22:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Visual Studio 2005
2016-06-30 22:33 - 2016-02-08 22:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2016-06-30 22:33 - 2015-10-30 10:24 - 00000000 __SHD C:\Program Files\Windows Sidebar
2016-06-30 22:33 - 2015-10-30 10:24 - 00000000 __SHD C:\Program Files (x86)\Windows Sidebar
2016-06-30 22:33 - 2015-10-30 10:24 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2016-06-30 22:33 - 2015-08-26 00:00 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FinalWire
2016-06-30 22:33 - 2014-06-21 21:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Яндекс
2016-06-30 22:29 - 2015-08-12 21:40 - 00000000 ____D C:\Users\27972\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Яндекс
2016-06-30 22:29 - 2015-06-24 11:43 - 00000000 ____D C:\Users\27972\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Игры
2016-06-30 22:29 - 2014-06-21 21:30 - 00000000 ____D C:\Users\27972\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yandex
2016-06-30 22:27 - 2015-08-15 14:05 - 00000000 ____D C:\Users\Sonya\AppData\Local\Packages
2016-06-30 22:27 - 2014-06-22 20:20 - 00000000 ____D C:\Users\Sonya\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yandex
2016-06-30 22:25 - 2015-08-13 17:29 - 00000000 ____D C:\Users\Aziza\AppData\Local\Packages
2016-06-30 22:25 - 2014-12-14 14:22 - 00000000 ____D C:\Users\Aziza\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Яндекс
2016-06-30 22:25 - 2014-06-24 19:17 - 00000000 ____D C:\Users\Aziza\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yandex
2016-06-30 22:20 - 2015-10-30 09:28 - 00000000 ____D C:\WINDOWS\system32\Sysprep
2016-06-30 22:16 - 2015-08-11 19:27 - 00000000 ____D C:\AMD
2016-06-30 22:12 - 2015-10-30 10:24 - 00028672 _____ C:\WINDOWS\system32\config\BCD-Template
2016-06-30 21:52 - 2015-10-30 10:24 - 00000000 ____D C:\WINDOWS\SysWOW64\MUI
2016-06-30 21:52 - 2015-10-30 10:24 - 00000000 ____D C:\WINDOWS\SysWOW64\inetsrv
2016-06-30 21:52 - 2015-10-30 10:24 - 00000000 ____D C:\WINDOWS\system32\MUI
2016-06-30 21:52 - 2015-10-30 10:24 - 00000000 ____D C:\WINDOWS\system32\inetsrv
2016-06-30 21:52 - 2015-10-30 10:19 - 00635904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqsnap.dll
2016-06-30 21:52 - 2015-10-30 10:19 - 00168960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iisRtl.dll
2016-06-30 21:52 - 2015-10-30 10:19 - 00096768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqoa.tlb
2016-06-30 21:52 - 2015-10-30 10:19 - 00091136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqoa30.tlb
2016-06-30 21:52 - 2015-10-30 10:19 - 00055808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqoa20.tlb
2016-06-30 21:52 - 2015-10-30 10:19 - 00037376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqoa10.tlb
2016-06-30 21:52 - 2015-10-30 10:19 - 00014848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqcertui.dll
2016-06-30 21:52 - 2015-10-30 10:18 - 00202240 _____ (Microsoft Corporation) C:\WINDOWS\system32\iisRtl.dll
2016-06-30 21:52 - 2015-10-30 10:18 - 00175616 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mqac.sys
2016-06-30 21:52 - 2015-10-30 10:18 - 00056320 _____ (Microsoft Corporation) C:\WINDOWS\system32\admwprox.dll
2016-06-30 21:52 - 2015-10-30 10:18 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\system32\ahadmin.dll
2016-06-30 21:52 - 2015-10-30 10:18 - 00019456 _____ (Microsoft Corporation) C:\WINDOWS\system32\iisreset.exe
2016-06-30 21:52 - 2015-10-30 10:18 - 00015360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wamregps.dll
2016-06-30 21:52 - 2015-10-30 10:18 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\iisrstap.dll
2016-06-30 21:51 - 2015-10-30 10:19 - 00562176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqutil.dll
2016-06-30 21:51 - 2015-10-30 10:19 - 00266240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqoa.dll
2016-06-30 21:51 - 2015-10-30 10:19 - 00161792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqrt.dll
2016-06-30 21:51 - 2015-10-30 10:19 - 00051200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\admwprox.dll
2016-06-30 21:51 - 2015-10-30 10:19 - 00026112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ahadmin.dll
2016-06-30 21:51 - 2015-10-30 10:19 - 00017408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iisreset.exe
2016-06-30 21:51 - 2015-10-30 10:19 - 00011264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wamregps.dll
2016-06-30 21:51 - 2015-10-30 10:19 - 00010240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iisrstap.dll
2016-06-30 21:51 - 2015-10-30 10:19 - 00009096 _____ C:\WINDOWS\SysWOW64\msmqtrc.mof
2016-06-30 21:51 - 2015-10-30 10:18 - 01417728 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqqm.dll
2016-06-30 21:51 - 2015-10-30 10:18 - 00813056 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqsnap.dll
2016-06-30 21:51 - 2015-10-30 10:18 - 00564224 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqutil.dll
2016-06-30 21:51 - 2015-10-30 10:18 - 00317440 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqoa.dll
2016-06-30 21:51 - 2015-10-30 10:18 - 00229888 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqrt.dll
2016-06-30 21:51 - 2015-10-30 10:18 - 00130048 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqlogmgr.dll
2016-06-30 21:51 - 2015-10-30 10:18 - 00096768 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqoa.tlb
2016-06-30 21:51 - 2015-10-30 10:18 - 00091136 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqoa30.tlb
2016-06-30 21:51 - 2015-10-30 10:18 - 00055808 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqoa20.tlb
2016-06-30 21:51 - 2015-10-30 10:18 - 00052736 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqbkup.exe
2016-06-30 21:51 - 2015-10-30 10:18 - 00037376 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqoa10.tlb
2016-06-30 21:51 - 2015-10-30 10:18 - 00026624 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqsvc.exe
2016-06-30 21:51 - 2015-10-30 10:18 - 00018944 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqcertui.dll
2016-06-30 21:51 - 2015-10-30 10:18 - 00009096 _____ C:\WINDOWS\system32\msmqtrc.mof
2016-06-30 00:53 - 2014-08-19 18:14 - 00000000 ____D C:\The KMPlayer
2016-06-26 22:19 - 2016-05-25 22:28 - 00000000 ____D C:\Users\Все пользователи\Microsoft Help
2016-06-26 21:46 - 2016-05-27 00:26 - 00000000 ____D C:\Users\Все пользователи\3126b259-4237-0
2016-06-26 21:46 - 2016-05-27 00:26 - 00000000 ____D C:\ProgramData\3126b259-4237-0
2016-06-26 21:44 - 2016-05-27 00:26 - 00000000 ____D C:\Users\Все пользователи\3126b259-3dd3-1
2016-06-26 21:44 - 2016-05-27 00:26 - 00000000 ____D C:\ProgramData\3126b259-3dd3-1
2016-06-22 02:20 - 2014-06-22 01:30 - 142482544 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-06-21 02:58 - 2014-06-03 13:16 - 00002268 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-06-21 01:11 - 2014-12-13 23:00 - 00000000 ____D C:\Program Files\Microsoft Office 15
2016-06-21 01:06 - 2016-04-08 20:05 - 09717952 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerInstaller.exe
2016-06-14 21:33 - 2015-10-30 10:26 - 00828408 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2016-06-14 21:33 - 2015-10-30 10:26 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2016-06-13 15:15 - 2014-08-14 22:27 - 00000000 ____D C:\Users\27972\AppData\Local\ElevatedDiagnostics
2016-06-09 04:49 - 2016-05-10 23:56 - 00000000 ____D C:\Users\27972\AppData\Roaming\PlaysTV
2016-06-09 04:47 - 2016-05-10 23:54 - 00000000 ____D C:\Users\27972\AppData\Roaming\Raptr
2016-06-08 18:19 - 2015-08-26 00:28 - 00000000 ____D C:\Users\27972\Documents\AIDA64 Reports
2016-06-08 17:55 - 2014-06-21 18:42 - 00000000 ____D C:\Users\27972\AppData\Local\AMD
2016-06-07 15:28 - 2014-06-22 20:32 - 00000000 ____D C:\Users\Все пользователи\Skype
2016-06-07 15:28 - 2014-06-22 20:32 - 00000000 ____D C:\ProgramData\Skype
2016-06-07 00:18 - 2015-08-19 23:18 - 00000000 ____D C:\Users\27972\Documents\Записные книжки OneNote
2016-06-05 22:38 - 2016-05-11 00:30 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-06-05 22:14 - 2015-01-26 20:26 - 00144974 _____ C:\Users\27972\Database.kdbx

==================== Files in the root of some directories =======

2015-06-24 11:42 - 2016-05-27 00:47 - 0684032 ____H () C:\Users\27972\AppData\Roaming\aflbase.db
2016-06-10 16:06 - 2016-06-10 16:06 - 0001148 _____ () C:\Users\27972\AppData\Roaming\Sippoint.lnk
2014-09-04 23:23 - 2014-09-04 23:28 - 0007597 _____ () C:\Users\27972\AppData\Local\resmon.resmoncfg

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

==================== BCD ================================

„ЁбЇҐвзҐа § Јаг§ЄЁ Windows
--------------------
Ё¤Ґ­вЁдЁЄ в®а           {bootmgr}
device                  partition=\Device\HarddiskVolume1
description             Windows Boot Manager
locale                  ru-RU
inherit                 {globalsettings}
default                 {current}
resumeobject            {cc6227f5-3ef5-11e6-86ab-d6661d0ec525}
displayorder            {current}
toolsdisplayorder       {memdiag}
timeout                 30

‡ Јаг§Є  Windows
-------------------
Ё¤Ґ­вЁдЁЄ в®а           {462d47ba-eb2b-11e3-86db-bfcabac2e0c2}
device                  ramdisk=[C:]\Recovery\462d47ba-eb2b-11e3-86db-bfcabac2e0c2\Winre.wim,{462d47bb-eb2b-11e3-86db-bfcabac2e0c2}
path                    \windows\system32\winload.exe
description             Windows Recovery Environment
inherit                 {bootloadersettings}
osdevice                ramdisk=[C:]\Recovery\462d47ba-eb2b-11e3-86db-bfcabac2e0c2\Winre.wim,{462d47bb-eb2b-11e3-86db-bfcabac2e0c2}
systemroot              \windows
nx                      OptIn
winpe                   Yes

‡ Јаг§Є  Windows
-------------------
Ё¤Ґ­вЁдЁЄ в®а           {7ac813cb-3ef6-11e6-86ab-d6661d0ec525}
device                  ramdisk=[\Device\HarddiskVolume3]\Recovery\WindowsRE\Winre.wim,{7ac813cc-3ef6-11e6-86ab-d6661d0ec525}
path                    \windows\system32\winload.exe
description             Windows Recovery Environment
locale                  ru-RU
inherit                 {bootloadersettings}
displaymessage          Recovery
displaymessageoverride  Recovery
osdevice                ramdisk=[\Device\HarddiskVolume3]\Recovery\WindowsRE\Winre.wim,{7ac813cc-3ef6-11e6-86ab-d6661d0ec525}
systemroot              \windows
nx                      OptIn
bootmenupolicy          Standard
winpe                   Yes

‡ Јаг§Є  Windows
-------------------
Ё¤Ґ­вЁдЁЄ в®а           {8ec4985a-4041-11e5-88c7-c444cd796ecb}
device                  ramdisk=[\Device\HarddiskVolume3]\Recovery\WindowsRE\Winre.wim,{8ec4985b-4041-11e5-88c7-c444cd796ecb}
path                    \windows\system32\winload.exe
description             Windows Recovery Environment
locale                  ru-RU
inherit                 {bootloadersettings}
displaymessage          Recovery
displaymessageoverride  Recovery
osdevice                ramdisk=[\Device\HarddiskVolume3]\Recovery\WindowsRE\Winre.wim,{8ec4985b-4041-11e5-88c7-c444cd796ecb}
systemroot              \windows
nx                      OptIn
bootmenupolicy          Standard
winpe                   Yes

‡ Јаг§Є  Windows
-------------------
Ё¤Ґ­вЁдЁЄ в®а           {a6ad6e6d-ac33-11e5-9065-ae7786708eeb}
device                  ramdisk=[\Device\HarddiskVolume3]\Recovery\WindowsRE\Winre.wim,{a6ad6e6e-ac33-11e5-9065-ae7786708eeb}
path                    \windows\system32\winload.exe
description             Windows Recovery Environment
locale                  ru-RU
inherit                 {bootloadersettings}
displaymessage          Recovery
displaymessageoverride  Recovery
osdevice                ramdisk=[\Device\HarddiskVolume3]\Recovery\WindowsRE\Winre.wim,{a6ad6e6e-ac33-11e5-9065-ae7786708eeb}
systemroot              \windows
nx                      OptIn
bootmenupolicy          Standard
winpe                   Yes

“бв ­®ўЄ  Windows
-------------
Ё¤Ґ­вЁдЁЄ в®а           {cbd971bf-b7b8-4885-951a-fa03044f5d71}
device                  ramdisk=[C:]\$WINDOWS.~BT\Sources\SafeOS\winre.wim,{3accaba9-3ef1-11e6-9c3e-74d4351c78e5}
path                    \windows\system32\winload.exe
description             Windows Rollback
locale                  ru-RU
inherit                 {bootloadersettings}
osdevice                ramdisk=[C:]\$WINDOWS.~BT\Sources\SafeOS\winre.wim,{3accaba9-3ef1-11e6-9c3e-74d4351c78e5}
systemroot              \windows
nx                      OptIn
bootmenupolicy          Standard
winpe                   Yes

‡ Јаг§Є  Windows
-------------------
Ё¤Ґ­вЁдЁЄ в®а           {current}
device                  partition=C:
path                    \WINDOWS\system32\winload.exe
description             Windows 10
locale                  ru-RU
inherit                 {bootloadersettings}
recoverysequence        {7ac813cb-3ef6-11e6-86ab-d6661d0ec525}
recoveryenabled         Yes
allowedinmemorysettings 0x15000075
osdevice                partition=C:
systemroot              \WINDOWS
resumeobject            {cc6227f5-3ef5-11e6-86ab-d6661d0ec525}
nx                      OptIn
bootmenupolicy          Standard

‚л室 Ё§ ०Ё¬  ЈЁЎҐа­ жЁЁ
--------------------------
Ё¤Ґ­вЁдЁЄ в®а           {462d47b8-eb2b-11e3-86db-bfcabac2e0c2}
device                  partition=C:
path                    \Windows\system32\winresume.exe
description             Windows Resume Application
locale                  ru-RU
inherit                 {resumeloadersettings}
filedevice              partition=C:
filepath                \hiberfil.sys
debugoptionenabled      No

‚л室 Ё§ ०Ё¬  ЈЁЎҐа­ жЁЁ
--------------------------
Ё¤Ґ­вЁдЁЄ в®а           {cc6227f5-3ef5-11e6-86ab-d6661d0ec525}
device                  partition=C:
path                    \WINDOWS\system32\winresume.exe
description             Windows Resume Application
locale                  ru-RU
inherit                 {resumeloadersettings}
recoverysequence        {7ac813cb-3ef6-11e6-86ab-d6661d0ec525}
recoveryenabled         Yes
allowedinmemorysettings 0x15000075
filedevice              partition=C:
filepath                \hiberfil.sys
bootmenupolicy          Standard
debugoptionenabled      No

‚л室 Ё§ ०Ё¬  ЈЁЎҐа­ жЁЁ
--------------------------
Ё¤Ґ­вЁдЁЄ в®а           {d747d471-4040-11e5-88c7-c444cd796ecb}
device                  partition=C:
path                    \WINDOWS\system32\winresume.exe
description             Windows Resume Application
locale                  ru-RU
inherit                 {resumeloadersettings}
recoverysequence        {8ec4985a-4041-11e5-88c7-c444cd796ecb}
recoveryenabled         Yes
allowedinmemorysettings 0x15000075
filedevice              partition=C:
filepath                \hiberfil.sys
bootmenupolicy          Standard
debugoptionenabled      No

‚л室 Ё§ ०Ё¬  ЈЁЎҐа­ жЁЁ
--------------------------
Ё¤Ґ­вЁдЁЄ в®а           {ffbf728d-ac32-11e5-9065-ae7786708eeb}
device                  partition=C:
path                    \WINDOWS\system32\winresume.exe
description             Windows Resume Application
locale                  ru-RU
inherit                 {resumeloadersettings}
recoverysequence        {a6ad6e6d-ac33-11e5-9065-ae7786708eeb}
recoveryenabled         Yes
allowedinmemorysettings 0x15000075
filedevice              partition=C:
filepath                \hiberfil.sys
bootmenupolicy          Standard
debugoptionenabled      No

Џа®ўҐаЄ  Ї ¬пвЁ Windows
---------------------
Ё¤Ґ­вЁдЁЄ в®а           {memdiag}
device                  partition=\Device\HarddiskVolume1
path                    \boot\memtest.exe
description             „Ё Ј­®бвЁЄ  Ї ¬пвЁ
locale                  ru-RU
inherit                 {globalsettings}
badmemoryaccess         Yes

Џ а ¬Ґвал EMS
-------------
Ё¤Ґ­вЁдЁЄ в®а           {emssettings}
bootems                 No

Џ а ¬Ґвал ®в« ¤зЁЄ 
-------------------
Ё¤Ґ­вЁдЁЄ в®а           {dbgsettings}
debugtype               Serial
debugport               1
baudrate                115200

„ҐдҐЄвл Ћ‡“
-----------
Ё¤Ґ­вЁдЁЄ в®а           {badmemory}

ѓ«®Ў «м­лҐ Ї а ¬Ґвал
--------------------
Ё¤Ґ­вЁдЁЄ в®а           {globalsettings}
inherit                 {dbgsettings}
                        {emssettings}
                        {badmemory}

Џ а ¬Ґвал § Јаг§зЁЄ 
--------------------
Ё¤Ґ­вЁдЁЄ в®а           {bootloadersettings}
inherit                 {globalsettings}
                        {hypervisorsettings}

Џ а ¬Ґвал ЈЁЇҐаўЁ§®а 
-------------------
Ё¤Ґ­вЁдЁЄ в®а           {hypervisorsettings}
hypervisordebugtype     Serial
hypervisordebugport     1
hypervisorbaudrate      115200

Џ а ¬Ґвал § Јаг§зЁЄ  ў®ббв ­®ў«Ґ­Ёп
-----------------------------------
Ё¤Ґ­вЁдЁЄ в®а           {resumeloadersettings}
inherit                 {globalsettings}

Џ а ¬Ґвал гбва®©бвў
-------------------
Ё¤Ґ­вЁдЁЄ в®а           {094de075-ac2f-11e5-9bf6-74d4351c78e5}
description             Windows Setup
ramdisksdidevice        partition=C:
ramdisksdipath          \$WINDOWS.~BT\Sources\SafeOS\boot.sdi

Џ а ¬Ґвал гбва®©бвў
-------------------
Ё¤Ґ­вЁдЁЄ в®а           {3accaba9-3ef1-11e6-9c3e-74d4351c78e5}
description             Windows Setup
ramdisksdidevice        partition=C:
ramdisksdipath          \$WINDOWS.~BT\Sources\SafeOS\boot.sdi

Џ а ¬Ґвал гбва®©бвў
-------------------
Ё¤Ґ­вЁдЁЄ в®а           {462d47bb-eb2b-11e3-86db-bfcabac2e0c2}
description             Ramdisk Options
ramdisksdidevice        partition=C:
ramdisksdipath          \Recovery\462d47ba-eb2b-11e3-86db-bfcabac2e0c2\boot.sdi

Џ а ¬Ґвал гбва®©бвў
-------------------
Ё¤Ґ­вЁдЁЄ в®а           {462d47bc-eb2b-11e3-86db-bfcabac2e0c2}
description             Windows Setup
ramdisksdidevice        partition=C:
ramdisksdipath          \$WINDOWS.~BT\Sources\SafeOS\boot.sdi

Џ а ¬Ґвал гбва®©бвў
-------------------
Ё¤Ґ­вЁдЁЄ в®а           {7ac813cc-3ef6-11e6-86ab-d6661d0ec525}
description             Windows Recovery
ramdisksdidevice        partition=\Device\HarddiskVolume3
ramdisksdipath          \Recovery\WindowsRE\boot.sdi

Џ а ¬Ґвал гбва®©бвў
-------------------
Ё¤Ґ­вЁдЁЄ в®а           {8ec4985b-4041-11e5-88c7-c444cd796ecb}
description             Windows Recovery
ramdisksdidevice        partition=\Device\HarddiskVolume3
ramdisksdipath          \Recovery\WindowsRE\boot.sdi

Џ а ¬Ґвал гбва®©бвў
-------------------
Ё¤Ґ­вЁдЁЄ в®а           {a6ad6e6e-ac33-11e5-9065-ae7786708eeb}
description             Windows Recovery
ramdisksdidevice        partition=\Device\HarddiskVolume3
ramdisksdipath          \Recovery\WindowsRE\boot.sdi



LastRegBack: 2016-07-02 06:11

==================== End of FRST.txt ============================