Opera - редирект открытых страниц

start
CreateRestorePoint:
HKLM\...\Policies\Explorer\Run: [0FDA44DC-20C5-4A15-8B42-97E7769670E6] => C:\ProgramData\Microsoft\Macromed\Flash Player\0FDA44DC-20C5-4A15-8B42-97E7769670E6\419F0D64-E84D-4096-886B-BAA8DAD6A1E3.exe
C:\ProgramData\Microsoft\Macromed\Flash Player\0FDA44DC-20C5-4A15-8B42-97E7769670E6\419F0D64-E84D-4096-886B-BAA8DAD6A1E3.exe
HKU\S-1-5-21-2332147243-3701152189-237777505-1000\...\Policies\Explorer: [] 
ShellIconOverlayIdentifiers: [    YndCase0Sync] -> {63D48440-63AB-44D0-B323-4731DFCDE9E9} =>  -> No File
ShellIconOverlayIdentifiers: [    YndCase1Modified] -> {7E7DC279-E6BE-4D57-9DEC-14FA0339DBC0} =>  -> No File
ShellIconOverlayIdentifiers: [    YndCase2Error] -> {FB2FE984-05F5-4512-9D9B-69D3DE61F6D9} =>  -> No File
ShellIconOverlayIdentifiers: [    YndCase3Shared] -> {AF8D197E-7022-4c3d-BD88-68AD35C9C169} =>  -> No File
ShellIconOverlayIdentifiers: [KAVOverlayIcon] -> {014F27E2-6D75-4E42-A0E9-2A2C68498AFA} =>  -> No File
ShellIconOverlayIdentifiers-x32: [KAVOverlayIcon] -> {014F27E2-6D75-4E42-A0E9-2A2C68498AFA} =>  -> No File
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
CHR HKU\S-1-5-21-2332147243-3701152189-237777505-1000\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-2332147243-3701152189-237777505-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-2332147243-3701152189-237777505-1000\Software\Microsoft\Internet Explorer\Main,Start Page = 
SearchScopes: HKLM-x32 -> DefaultScope value is missing
FF Plugin HKU\S-1-5-21-2332147243-3701152189-237777505-1000: @tools.sputnik.ru/Sputnik Update;version=3 -> C:\Users\Сергей\AppData\Local\Sputnik\Update\1.3.27.5\npSputnikUpdate3.dll [No File]
FF Plugin HKU\S-1-5-21-2332147243-3701152189-237777505-1000: @tools.sputnik.ru/Sputnik Update;version=9 -> C:\Users\Сергей\AppData\Local\Sputnik\Update\1.3.27.5\npSputnikUpdate3.dll [No File]
CHR HKLM\...\Chrome\Extension: [lpeeaghdjmhlakojjcgfdhgcejdaefmi] - hxxps://chrome.google.com/webstore/detail/lpeeaghdjmhlakojjcgfdhgcejdaefmi
OPR Extension: (News Tab) - C:\Users\Сергей\AppData\Roaming\Opera Software\Opera Stable\Extensions\jolakggdcbngpflcjfaencffnenhlddl [2016-07-28]
OPR Extension: (Opera Addons Portal) - C:\Users\Сергей\AppData\Roaming\Opera Software\Opera Stable\Extensions\kphnccinngbmjgpipjlmffcakegnbkdf [2014-08-10]
OPR Extension: (getchrome) - C:\Users\Сергей\AppData\Roaming\Opera Software\Opera Stable\Extensions\npknnddabjhdijgmmbocdicnknegobkm [2016-08-28]
OPR Extension: (OperaWebViewer) - C:\Users\Сергей\AppData\Roaming\extensions\extension_opera [2016-12-27]
OPR Extension: (Opera Solutions) - C:\Users\Сергей\AppData\Roaming\extensions\extensions_opera [2016-12-27]
Task: {1013134D-0EEF-4334-8FCC-F8DC58B91A94} - System32\Tasks\Microsoft\Windows\328D6E080CF3F8C847D9B850BF3B84BARunOnce => C:\Users\Сергей\AppData\Local\Microsoft\4789B8C8AF08D934104F6BADD240A0C8\3B84BAFB058B9D748C8F3FC080328D6E.exe
C:\Users\Сергей\AppData\Local\Microsoft\4789B8C8AF08D934104F6BADD240A0C8\3B84BAFB058B9D748C8F3FC080328D6E.exe
Task: {5408BE3B-AC41-4339-8058-3EE81C2EABA9} - System32\Tasks\Microsoft\Windows\328D6E080CF3F8C847D9B850BF3B84BA => C:\Users\Сергей\AppData\Local\Microsoft\4789B8C8AF08D934104F6BADD240A0C8\3B84BAFB058B9D748C8F3FC080328D6E.exe
Task: {93FF4761-D7F1-40D6-80A5-198C2081DE01} - System32\Tasks\SputnikUpdateTaskUserS-1-5-21-2332147243-3701152189-237777505-1000Core => C:\Users\Сергей\AppData\Local\Sputnik\Update\SputnikUpdate.exe
Task: {C16B8C37-F4D4-4574-87D1-CCBE8C63AE8C} - System32\Tasks\Microsoft\328D6E080CF3F8C847D9B850BF3B84BARunOnce => C:\Users\Сергей\AppData\Local\Microsoft\4789B8C8AF08D934104F6BADD240A0C8\3B84BAFB058B9D748C8F3FC080328D6E.exe
Task: {D04069DB-BD88-421D-ACED-D00C57CADAA0} - System32\Tasks\Microsoft\Windows\A0FDA44DC-20C5-4A15-8B42-97E7769670E6 => C:\ProgramData\Microsoft\Macromed\Flash Player\0FDA44DC-20C5-4A15-8B42-97E7769670E6\419F0D64-E84D-4096-886B-BAA8DAD6A1E3.exe <==== ATTENTION
Task: {D55013E4-483C-4216-9595-85A2DE748B4F} - System32\Tasks\SputnikUpdateTaskUserS-1-5-21-2332147243-3701152189-237777505-1000UA => C:\Users\Сергей\AppData\Local\Sputnik\Update\SputnikUpdate.exe
Task: {EC12BEED-0DEF-456F-A97C-74E08B9F66E3} - System32\Tasks\Microsoft\328D6E080CF3F8C847D9B850BF3B84BA => C:\Users\Сергей\AppData\Local\Microsoft\4789B8C8AF08D934104F6BADD240A0C8\3B84BAFB058B9D748C8F3FC080328D6E.exe
Task: C:\WINDOWS\Tasks\SputnikUpdateTaskUserS-1-5-21-2332147243-3701152189-237777505-1000Core.job => C:\Users\Сергей\AppData\Local\Sputnik\Update\SputnikUpdate.exe
Task: C:\WINDOWS\Tasks\SputnikUpdateTaskUserS-1-5-21-2332147243-3701152189-237777505-1000UA.job => C:\Users\Сергей\AppData\Local\Sputnik\Update\SputnikUpdate.exe
Shortcut: C:\Users\Сергей\AppData\Local\Microsoft\Start Menu\Вoйти в Интeрнeт.lnk -> C:\Users\Сергей\AppData\Local\Microsoft\Start Menu\Вoйти в Интeрнeт.exe (No File) <===== Cyrillic
ShortcutWithArgument: C:\Users\Сергей\Desktop\О.lnk -> C:\Program Files (x86)\Opera\launcher.exe (Opera Software) -> --load-extension="C:\Users\Сергей\AppData\Roaming\extensions\extensions_opera","C:\Users\Сергей\AppData\Roaming\extensions\extension_opera" <===== Cyrillic
MSCONFIG\startupreg: Войти в ИнтeрнeтRemoveAppchrome => cmd /Q /C del /Q "C:\Users\Сергей\AppData\Local\Temp\NETE30~1.EXE"
MSCONFIG\startupreg: Войти в ИнтeрнeтRemoveAppopera => cmd /Q /C del /Q "C:\Users\Сергей\AppData\Local\Temp\NETE30~2.EXE"
MSCONFIG\startupreg: Войти в ИнтeрнeтRemoveAppoperaold => cmd /Q /C del /Q "C:\Users\Сергей\AppData\Local\Temp\NETE30~3.EXE"
MSCONFIG\startupreg: Войти в ИнтeрнeтRemovePngchrome => cmd /Q /C del /Q "C:\Users\Сергей\AppData\Local\Temp\NETE30~1.EXE"
MSCONFIG\startupreg: Войти в ИнтeрнeтRemovePngopera => cmd /Q /C del /Q "C:\Users\Сергей\AppData\Local\Temp\NETE30~2.EXE"
 
Hosts:
EmptyTemp:
Reboot:
end

start
CreateRestorePoint:
CHR HKLM\...\Chrome\Extension: [lpeeaghdjmhlakojjcgfdhgcejdaefmi] - hxxps://chrome.google.com/webstore/detail/lpeeaghdjmhlakojjcgfdhgcejdaefmi
CHR HKLM-x32\...\Chrome\Extension: [lpeeaghdjmhlakojjcgfdhgcejdaefmi] - hxxps://chrome.google.com/webstore/detail/lpeeaghdjmhlakojjcgfdhgcejdaefmi
U4 idsvc; no ImagePath
C:\Users\Сергей\IP_Log_Data.js
C:\Users\Сергей\Network_Meter_Data.js
 
EmptyTemp:
Reboot:
end