AV: ESET Security (Enabled - Out of date) {89B55CC4-3881-78B2-11E2-479AE0371896}
AV: ESET Security (Enabled - Up to date) {885D845F-AF19-0124-FECE-FFF49D00F440}
AV: ESET Security (Enabled - Up to date) {EC1D6F37-E411-475A-DF50-12FF7FE4AC70}
AS: ESET Security (Enabled - Up to date) {577C8ED3-C22B-48D4-E5E0-298D0463E6CD}
FW: ESET Файервол (Enabled) {B066057A-E576-007C-D591-56C163D3B33B}
FW: ESET Файервол (Enabled) {D426EE12-AE7E-4602-F40F-BBCA8137EB0B}
FW: ESET Файервол (Enabled) {B18EDDE1-72EE-79EA-3ABD-EEAF1EE45FED}
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} =>  -> No File
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} =>  -> No File
ContextMenuHandlers1: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} =>  -> No File
ContextMenuHandlers1: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} =>  -> No File
ContextMenuHandlers1: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} =>  -> No File
ContextMenuHandlers1: [ESET Security Shell] -> {B089FE88-FB52-11D3-BDF1-0050DA34150D} => C:\Program Files\ESET\ESET Security\shellExt.dll -> No File
ContextMenuHandlers2: [ESET Security Shell] -> {B089FE88-FB52-11D3-BDF1-0050DA34150D} => C:\Program Files\ESET\ESET Security\shellExt.dll -> No File
ContextMenuHandlers3: [{4A7C4306-57E0-4C0C-83A9-78C1528F618C}] -> {4A7C4306-57E0-4C0C-83A9-78C1528F618C} =>  -> No File
ContextMenuHandlers4: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} =>  -> No File
ContextMenuHandlers6: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} =>  -> No File
ContextMenuHandlers6: [ESET Security Shell] -> {B089FE88-FB52-11D3-BDF1-0050DA34150D} => C:\Program Files\ESET\ESET Security\shellExt.dll -> No File
Shortcut: C:\Users\Andrey\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ESET Защита банковской оплаты.lnk -> C:\Program Files\ESET\ESET Security\ecmd.exe (No File) <==== Cyrillic
Shortcut: C:\Users\Andrey\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JustCause3 - Ярлык.lnk -> E:\Games\Just Cause 3\JustCause3.exe (No File) <==== Cyrillic
Shortcut: C:\Users\Andrey\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Swag and Sorcery - Ярлык.lnk -> D:\Games\Swag_and_Sorcery\Swag and Sorcery.exe (No File) <==== Cyrillic
Shortcut: C:\Users\Andrey\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mail.ru\Игровой центр.lnk -> C:\Users\Andrey\AppData\Local\GameCenter\GameCenter.exe (No File) <==== Cyrillic
Shortcut: C:\Users\Andrey\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Jets'n'Guns Gold\Запустить Jets'n'Guns Gold.lnk -> D:\Games\Jets'n'Guns Gold\jng_gold.exe (No File) <==== Cyrillic
Shortcut: C:\Users\Andrey\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Jets'n'Guns Gold\Переключить язык Jets'n'Guns Gold на английский.lnk -> D:\Games\Jets'n'Guns Gold\SetLangEn.bat (No File)
Shortcut: C:\Users\Andrey\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Jets'n'Guns Gold\Переключить язык Jets'n'Guns Gold на русский.lnk -> D:\Games\Jets'n'Guns Gold\SetLangRu.bat (No File)
Shortcut: C:\Users\Andrey\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Jets'n'Guns Gold\Руководство пользователя Jets'n'Guns Gold (англ).lnk -> D:\Games\Jets'n'Guns Gold\manual\index.html (No File) <==== Cyrillic
Shortcut: C:\Users\Andrey\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Jets'n'Guns Gold\Руководство пользователя Jets'n'Guns Gold (рус).lnk -> D:\Games\Jets'n'Guns Gold\manual_ru\manual.html (No File) <==== Cyrillic
AlternateDataStreams: C:\Users\Andrey\Application Data:77a575add9465d78c606d381e5f202fb [394]
AlternateDataStreams: C:\Users\Andrey\AppData\Roaming:77a575add9465d78c606d381e5f202fb [394]
FirewallRules: [{86D94A76-67D1-41AB-AD15-8B62EA5C2CF7}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe => No File
FirewallRules: [{4201D097-A29B-4715-8FBF-2BB6E4834D15}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe => No File
FirewallRules: [{C785E246-F729-43C7-9B2E-40C1B6BB0C4B}] => (Allow) D:\Games\Steam\steamapps\common\Don't Starve Together\bin\dontstarve_steam.exe => No File
FirewallRules: [{5F4D5221-4D8C-4B63-8467-3A41B2F037C0}] => (Allow) D:\Games\Steam\steamapps\common\Don't Starve Together\bin\dontstarve_steam.exe => No File
FirewallRules: [{9D210468-F878-4885-B0BF-044DB0D9937E}] => (Allow) C:\Users\Andrey\AppData\Roaming\BitTorrent\BitTorrent.exe => No File
FirewallRules: [{BB9A70BD-1BAE-4092-8055-56689C1D3C54}] => (Allow) C:\Users\Andrey\AppData\Roaming\BitTorrent\BitTorrent.exe => No File
FirewallRules: [{D7CC50C4-57EC-4C1C-B17A-5F0DAD945557}] => (Allow) C:\Users\Andrey\AppData\Local\GameCenter\GameCenter.exe => No File
FirewallRules: [{587269E7-D3C6-4D01-8A6E-31237D5E350F}] => (Allow) C:\Users\Andrey\AppData\Local\GameCenter\GameCenter.exe => No File
HKLM-x32\...\Run: [CMD] => cmd.exe /k if %date:~6,4%%date:~3,2%%date:~0,2% LEQ 20130903 (exit) else (start hxxp://alt-rutor.org && exit) <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-975233315-3009743164-2083225452-1001\...\Run: [Андрей] => explorer.exe hxxp://dinoraptzor.org <==== ATTENTION
HKU\S-1-5-21-975233315-3009743164-2083225452-1001\...\MountPoints2: F - "F:\setup.exe" 
HKU\S-1-5-21-975233315-3009743164-2083225452-1001\...\MountPoints2: J - "J:\setup.exe" 
HKU\S-1-5-21-975233315-3009743164-2083225452-1001\...\MountPoints2: {92c43624-ea91-11e9-878c-10bf48bcd0e0} - "F:\setup.exe" 
GroupPolicy: Restriction ? <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
Policies: C:\Users\Все пользователи\NTUSER.pol: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
Task: {D6620E44-E751-47BB-86C3-FA033BB12CC3} - System32\Tasks\Андрей => cmd.exe /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v Андрей /t REG_SZ /d "explorer.exe http://dinoraptzor.org" <==== ATTENTION
Task: {F99BC27C-9521-461B-9ACD-0A253846DA76} - System32\Tasks\Avast Software\Overseer => C:\Program Files\Common Files\AVAST Software\Overseer\overseer.exe [1741416 2020-09-18] (Avast Software s.r.o. -> Avast Software)
HKU\S-1-5-19\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
HKU\S-1-5-20\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
HKU\S-1-5-21-975233315-3009743164-2083225452-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
FF Homepage: Mozilla\Firefox\Profiles\f0lqs1d8.default-1542206034104 -> hxxp://norwifi.com/tracker/tracker.php|hxxp://freezone.norwifi.com/browse.php|hxxp://hdtracker.local/
FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\eset_security_config_overlay.js [2020-12-08]
S3 ekrnEpfw; "C:\Program Files\ESET\ESET Security\ekrn.exe" [X]
S3 WdNisSvc; "%ProgramFiles%\Windows Defender\NisSrv.exe" [X]
S2 WinDefend; "%ProgramFiles%\Windows Defender\MsMpEng.exe" [X]


EmptyTemp:
Reboot: