Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
FF Extension: (No Name) - D:\Браузер К-мелон\browser\extensions\{899DF1F8-2F43-4394-8315-37F6744E6319}.xpi [not found]
EmptyTemp:
Reboot:

  

AV: Avast Antivirus (Enabled - Up to date) {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}
AV: AVG Antivirus (Disabled - Up to date) {4FC75CA5-1654-5411-7CFB-1893D506BCF4}
AS: Avast Antivirus (Enabled - Up to date) {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402}
FW: Avast Antivirus (Enabled) {B693136B-F6EE-DD1C-A0EF-229B8B0B29C4}
AlternateDataStreams: C:\ProgramData\Reprise:jhqduwvxlctbqqijsf`usjbm`bfjhioihinfh [0]
AlternateDataStreams: C:\Users\Public\AppData:CSM [478]
AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [470]
AlternateDataStreams: C:\Users\Все пользователи\Reprise:jhqduwvxlctbqqijsf`usjbm`bfjhioihinfh [0]
AlternateDataStreams: C:\Users\ПК\Application Data:00e481b5e22dbe1f649fcddd505d3eb7 [394]
AlternateDataStreams: C:\Users\ПК\AppData\Roaming:00e481b5e22dbe1f649fcddd505d3eb7 [394]
HKLM\...\StartupApproved\Run32: => "SecurityHealth"
HKU\S-1-5-21-282081067-1870339625-3958985120-1001\...\StartupApproved\Run: => "WinPatchZ1857_upd"
HKU\S-1-5-21-282081067-1870339625-3958985120-1001\...\StartupApproved\Run: => "WinPatchZ1857"
FirewallRules: [OpenSSH-Server-In-TCP] => (Allow) %SystemRoot%\system32\OpenSSH\sshd.exe No File
FirewallRules: [UDP Query User{3D1EB14A-EFB9-4CE5-935B-3D1402FCBE3F}C:\program files (x86)\java\jre1.8.0_211\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_211\bin\javaw.exe No File
FirewallRules: [TCP Query User{067DB165-2C96-474E-8F27-B52B0B92D2B3}C:\program files (x86)\java\jre1.8.0_211\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_211\bin\javaw.exe No File
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\SIHClient.exe) attempted to load \Device\HarddiskVolume5\Avast\aswAMSI.dll that did not meet the Windows signing level requirements.
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\SIHClient.exe) attempted to load \Device\HarddiskVolume5\Avast\aswAMSI.dll that did not meet the Windows signing level requirements.
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\SIHClient.exe) attempted to load \Device\HarddiskVolume5\Avast\aswAMSI.dll that did not meet the Windows signing level requirements.
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\SIHClient.exe) attempted to load \Device\HarddiskVolume5\Avast\aswAMSI.dll that did not meet the Windows signing level requirements.
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\SIHClient.exe) attempted to load \Device\HarddiskVolume5\Avast\aswAMSI.dll that did not meet the Windows signing level requirements.
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume5\Avast\aswAMSI.dll that did not meet the Windows signing level requirements.
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume5\Avast\aswAMSI.dll that did not meet the Windows signing level requirements.
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume5\Avast\aswAMSI.dll that did not meet the Windows signing level requirements.
Lsa: [Authentication Packages] msv1_0 SshdPinAuthLsa
HKLM\...\Policies\Explorer: [DisallowRun] 0
HKLM\...\Policies\Explorer: [RestrictRun] 0
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-19\...\Policies\Explorer: [DisallowRun] 0
HKU\S-1-5-19\...\Policies\Explorer: [RestrictRun] 0
HKU\S-1-5-20\...\Policies\Explorer: [DisallowRun] 0
HKU\S-1-5-20\...\Policies\Explorer: [RestrictRun] 0
HKU\S-1-5-21-282081067-1870339625-3958985120-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-282081067-1870339625-3958985120-1001\...\Policies\Explorer: [DisallowRun] 0
HKU\S-1-5-21-282081067-1870339625-3958985120-1001\...\Policies\Explorer: [RestrictRun] 0
HKU\S-1-5-18\...\Policies\Explorer: [DisallowRun] 0
HKU\S-1-5-18\...\Policies\Explorer: [RestrictRun] 0
GroupPolicy: Restriction ? <==== ATTENTION
GroupPolicy\User: Restriction ? <==== ATTENTION
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
Task: {2BB692C1-F60F-479E-ADC2-1CAF9422A2AC} - \Microsoft\Windows\Shell\FamilySafetyMonitorToastTask -> No File <==== ATTENTION
Task: {4520E8A9-AF06-4122-859B-E4B655B29B36} - \Microsoft\Windows\AppID\SmartScreenSpecific -> No File <==== ATTENTION
Task: {4D77E7DF-932E-4AC5-B820-F553CE145942} - \Microsoft\Windows\ErrorDetails\EnableErrorDetailsUpdate -> No File <==== ATTENTION
Task: {B537E300-6EE8-48C3-B550-84B5C13C357A} - System32\Tasks\USER_ESRV_SVC_QUEENCREEK => "C:\WINDOWS\System32\Wscript.exe" //B //NoLogo "C:\Program Files\Intel\SUR\QUEENCREEK\x64\task.vbs"
Task: {C9ACBFD2-20AA-4A3F-BE1A-A3D5279BB1BB} - \Microsoft\Windows\Plug and Play\Plug and Play Cleanup -> No File <==== ATTENTION
Task: {CE30065B-2753-46E1-A23D-EF472C97CD3F} - \Microsoft\Windows\ErrorDetails\ErrorDetailsUpdate -> No File <==== ATTENTION
Task: {D0D6B152-FC25-4B0F-966F-CEA2785E1B95} - \Microsoft\Windows\BrokerInfrastructure\BgTaskRegistrationMaintenanceTask -> No File <==== ATTENTION
Edge Notifications: HKU\S-1-5-21-282081067-1870339625-3958985120-1001 -> hxxps://funpay.ru
FF Plugin: @unity3d.com/UnityPlayer64,version=1.0 -> C:\Program Files\Unity\WebPlayer64\loader-x64\npUnity3D64.dll [2015-06-08] (Unity Technologies ApS -> Unity Technologies ApS)
CHR StartupUrls: Default -> "hxxp://www.yandex.ru/?win=130&clid=1985535","hxxps://www.google.com/","hxxp://ru.msn.com/?pc=UP97&ocid=UP97DHP","hxxp://mail.ru/cnt/10445?gp=anvir3","hxxp://go.mail.ru/?chverfix=1&fr=chverfix_sg","hxxps://www.google.com/","hxxp://mail.ru/cnt/10445?gp=blackbear3","hxxp://mail.ru/cnt/10445","hxxp://startface.net/","hxxps://www.google.com/","hxxp://www.yandex.ru/?win=87&clid=1872363","hxxp://mail.ru/cnt/7993/",""
CHR Extension: (0) - C:\Users\ПК\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmedhionkhpnakcndndgjdbohmhepckk [2020-03-23]
CHR Extension: (Avast Passwords) - C:\Users\ПК\AppData\Local\Google\Chrome\User Data\Default\Extensions\emhginjpijfggbofeediiojmdlmlkoik [2020-03-14]
CHR Extension: (vidIQ Vision for YouTube) - C:\Users\ПК\AppData\Local\Google\Chrome\User Data\Default\Extensions\pachckjkecffpdphbpmfolblodfkgbhl [2020-03-20]
OPR StartupUrls: "hxxps:\/\/www.yandex.ru\/?win=428&clid=1961774"
R3 esihdrv; C:\Users\ПК\AppData\Local\Temp\esihdrv.sys [191664 2020-03-23] (ESET, spol. s r.o. -> ESET) <==== ATTENTION
2020-03-23 13:30 - 2020-03-23 13:30 - 000000000 ___DC C:\Program Files\Unity
2020-03-14 13:04 - 2020-03-15 11:33 - 000000000 ____D C:\Users\ПК\AppData\Local\AVAST Software
2020-03-12 18:11 - 2020-03-14 12:46 - 000000000 ____D C:\Users\Все пользователи\Kaspersky Lab
2020-03-12 18:11 - 2020-03-14 12:46 - 000000000 ____D C:\ProgramData\Kaspersky Lab
2020-03-12 16:22 - 2020-03-12 16:49 - 000000000 ____D C:\Users\ПК\Doctor Web
2020-03-12 16:15 - 2020-03-12 17:11 - 000000000 ____D C:\Program Files (x86)\NortonInstaller
2020-03-12 16:15 - 2020-03-12 16:17 - 000000000 ____D C:\Users\Все пользователи\NortonInstaller
2020-03-12 16:15 - 2020-03-12 16:17 - 000000000 ____D C:\ProgramData\NortonInstaller
2020-03-05 18:20 - 2020-03-05 18:20 - 107773952 _____ C:\WINDOWS\system32\config\SOFTWARE.iobit
2020-03-05 18:20 - 2020-03-05 18:20 - 007102464 _____ C:\WINDOWS\system32\config\DRIVERS.iobit
2020-03-05 18:20 - 2020-03-05 18:20 - 001200128 _____ C:\WINDOWS\system32\config\DEFAULT.iobit
2020-03-05 18:20 - 2020-03-05 18:20 - 000086016 _____ C:\WINDOWS\system32\config\SAM.iobit
2020-03-05 18:20 - 2020-03-05 18:20 - 000032768 _____ C:\WINDOWS\system32\config\SECURITY.iobit
2020-03-23 18:24 - 2019-09-27 17:12 - 000000000 ____D C:\WINDOWS\system32\Tasks\AVG
2020-03-15 11:40 - 2018-12-09 20:07 - 000000000 __SHD C:\Users\Все пользователи\AVAST Software
2020-03-15 11:40 - 2018-12-09 20:07 - 000000000 __SHD C:\ProgramData\AVAST Software
2020-03-14 13:12 - 2019-06-09 15:41 - 000000000 __SHD C:\Program Files (x86)\AVAST Software
2020-03-12 16:22 - 2019-06-09 15:41 - 000000000 __SHD C:\Users\Все пользователи\Doctor Web
2020-03-12 16:22 - 2019-06-09 15:41 - 000000000 __SHD C:\ProgramData\Doctor Web
2020-03-12 15:10 - 2018-08-21 14:17 - 000000000 ___DC C:\Program Files (x86)\IObit

EmptyTemp:
Reboot: