MEM:Rootkit.Win64.EquationDrug.a

start
CreateRestorePoint:
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-3493131990-2338554848-777839221-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-3493131990-2338554848-777839221-1000\...\MountPoints2: G - G:\AUTOPLAY.EXE "ЛогоМиры 3.exe" "{9E66AC06-B476-4CDC-9F8C-E36D43FEE48C}"
HKU\S-1-5-21-3493131990-2338554848-777839221-1000\...\MountPoints2: {0cda43a1-1f7b-11e7-9ee9-00e052fe8ad9} - "I:\Install Rostelecom Internet.exe"
HKU\S-1-5-21-3493131990-2338554848-777839221-1000\...\MountPoints2: {3d07a0c4-cc48-11e6-bb90-00e052fe8ad9} - H:\DTVP_Launcher.exe
HKU\S-1-5-21-3493131990-2338554848-777839221-1000\...\MountPoints2: {46e6cc32-1fbe-11e6-bacf-00e052fe8ad9} - G:\AUTOPLAY.EXE "ЛогоМиры 3.exe" "{9E66AC06-B476-4CDC-9F8C-E36D43FEE48C}"
HKU\S-1-5-21-3493131990-2338554848-777839221-1000\...\MountPoints2: {46e6cc39-1fbe-11e6-bacf-00e052fe8ad9} - H:\autorun.exe
HKU\S-1-5-21-3493131990-2338554848-777839221-1000\...\MountPoints2: {6761e3d8-1f28-11e6-8831-806e6f6e6963} - F:\AUTORUN.EXE
HKU\S-1-5-21-3493131990-2338554848-777839221-1000\...\MountPoints2: {b2b84d2a-8621-11e2-ba67-00138fd7996f} - F:\autorun\autorun.exe
HKU\S-1-5-21-3493131990-2338554848-777839221-1000\...\MountPoints2: {b77afb10-08c2-11e2-b29b-806e6f6e6963} - G:\AUTORUN.EXE
GroupPolicy: Restriction <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
URLSearchHook: [S-1-5-21-3493131990-2338554848-777839221-1000] ATTENTION => Default URLSearchHook is missing
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
Toolbar: HKU\S-1-5-21-3493131990-2338554848-777839221-1000 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
Handler: WSISVCUchrome - No CLSID Value
CHR HKU\S-1-5-21-3493131990-2338554848-777839221-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [jndeiekmdhemaggmkgljlpdeaomeplbp] - C:\Users\uk\AppData\Local\CRE\jndeiekmdhemaggmkgljlpdeaomeplbp.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [jndeiekmdhemaggmkgljlpdeaomeplbp] - C:\Users\uk\AppData\Local\CRE\jndeiekmdhemaggmkgljlpdeaomeplbp.crx <not found>
StartMenuInternet: Google Chrome.E334SMIPEPFKQX4YD5X7EV7ZMQ - C:\Users\uk\AppData\Local\Google\Chrome\Application\chrome.exe
AlternateDataStreams: C:\Program Files\Common Files\System:n8LU57H82hctYlkora2iUKO [2188]
AlternateDataStreams: C:\ProgramData\Microsoft:6NsOTWvCY1DeKhre6DkbkHjBC [2046]
AlternateDataStreams: C:\ProgramData\Microsoft:DjiYA1jDgbZOvxWUehQO8 [2282]
AlternateDataStreams: C:\ProgramData\Microsoft:qpLoQhjrWtfBj5XjZpXvY [1980]
AlternateDataStreams: C:\ProgramData\TEMP:07BB519E [140]
AlternateDataStreams: C:\ProgramData\TEMP:516550B9 [228]
AlternateDataStreams: C:\ProgramData\TEMP:55B41E6A [282]
AlternateDataStreams: C:\ProgramData\TEMP:93C2F41D [187]
AlternateDataStreams: C:\ProgramData\TEMP:F4CA4D70 [458]
AlternateDataStreams: C:\Users\Все пользователи\Microsoft:6NsOTWvCY1DeKhre6DkbkHjBC [2046]
AlternateDataStreams: C:\Users\Все пользователи\Microsoft:DjiYA1jDgbZOvxWUehQO8 [2282]
AlternateDataStreams: C:\Users\Все пользователи\Microsoft:qpLoQhjrWtfBj5XjZpXvY [1980]
AlternateDataStreams: C:\Users\Все пользователи\TEMP:07BB519E [140]
AlternateDataStreams: C:\Users\Все пользователи\TEMP:516550B9 [228]
AlternateDataStreams: C:\Users\Все пользователи\TEMP:55B41E6A [282]
AlternateDataStreams: C:\Users\Все пользователи\TEMP:93C2F41D [187]
AlternateDataStreams: C:\Users\Все пользователи\TEMP:F4CA4D70 [458]
CMD: ipconfig /flushdns
CMD: IPCONFIG /release
CMD: IPCONFIG /renew
CMD: bitsadmin /reset /allusers
EmptyTemp:
Reboot:
end