CloseProcesses: SystemRestore: On CreateRestorePoint: HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION HKLM\SOFTWARE\Policies\Microsoft\MRT: Restriction <==== ATTENTION File: C:\WINDOWS\system32\AutoGreenCP.dll; C:\Users\Lara\AppData\Roaming\utorrent\pro\uTorrentClient.exe Task: {E458911C-EE71-4D3C-BCC4-3AB9F549BE70} - System32\Tasks\Intelligent StandbyList Cleaner => C:\Users\Lara\Downloads\ISLC v1.0.3.0\Intelligent standby list cleaner ISLC.exe (No File) Task: {7F189E8E-87A3-4733-8391-17827562C1A2} - System32\Tasks\UpdateTorrent => C:\Users\Lara\AppData\Roaming\utorrent\pro\uTorrentClient.exe [205985280 2025-09-05] (GitHub, Inc.) [File not signed] <==== ATTENTION Task: {3385B556-18C3-4C3E-91A6-0F6E04B33C1F} - System32\Tasks\Обновление Браузера Яндекс => C:\Users\Lara\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --background-update --noerrdialogs (No File) Edge Extension: (No Name) - C:\Users\Lara\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\gdaklcangmaacealgmgpdibnafeijgmm [2025-11-25] [UpdateUrl:0] <==== ATTENTION Edge Extension: (No Name) - C:\Users\Lara\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2025-12-03] [UpdateUrl:0] <==== ATTENTION Edge Extension: (No Name) - C:\Users\Lara\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha [2024-01-24] [UpdateUrl:0] <==== ATTENTION Edge Extension: (No Name) - C:\Users\Lara\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ndcileolkflehcjpmjnfbnaibdcgglog [2025-12-17] [UpdateUrl:0] <==== ATTENTION Edge Extension: (No Name) - C:\Users\Lara\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\nkapkmklnmidbbgjaipbgpcnbomnaakc [2025-12-25] [UpdateUrl:0] <==== ATTENTION CHR Extension: (Adblock - бесплатный блокировщик рекламы) - C:\Users\Lara\AppData\Local\Google\Chrome\User Data\Default\Extensions\hkcbjkjfonpnpojdokmhfhnkdndkjeha [2025-10-08] [UpdateUrl:0] <==== ATTENTION CHR Extension: (saveVPN) - C:\Users\Lara\AppData\Local\Google\Chrome\User Data\Default\Extensions\jddeddikaibbhgbkbgfodionolddonga [2022-11-23] [UpdateUrl:0] <==== ATTENTION CHR Extension: (saveVPN) - C:\Users\Lara\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\mmeianjnblahdbonelhjbmoalppfkohg [2022-11-23] [UpdateUrl:0] <==== ATTENTION CHR HKLM-x32\...\Chrome\Extension: [aegnopegbbhjeeiganiajffnalhlkkjb] S3 cpuz149; \??\C:\Users\Lara\AppData\Local\Temp\cpuz149\cpuz149_x64.sys [X] <==== ATTENTION S2 MozillaVPNSplitTunnel; \??\C:\Program Files\Mozilla\Mozilla VPN\mullvad-split-tunnel.sys [X] S4 NvModuleTracker; \SystemRoot\System32\DriverStore\FileRepository\nvmoduletracker.inf_amd64_ea6cec41fc5b2a8b\NvModuleTracker.sys [X] IFEO\aswidsagent.exe: [MinimumStackCommitInBytes] 1099466887 IFEO\autoruns.exe: [MinimumStackCommitInBytes] 1099466887 IFEO\autorunsc.exe: [MinimumStackCommitInBytes] 1099466887 IFEO\AvastSvc.exe: [MinimumStackCommitInBytes] 1099466887 IFEO\AvastUI.exe: [MinimumStackCommitInBytes] 1099466887 IFEO\avpui.exe: [MinimumStackCommitInBytes] 1099466887 IFEO\bcdedit.exe: [MinimumStackCommitInBytes] 1099466887 IFEO\GlassWire.exe: [MinimumStackCommitInBytes] 1099466887 IFEO\GlassWireSetup.exe: [MinimumStackCommitInBytes] 1099466887 IFEO\klwtblfs.exe: [MinimumStackCommitInBytes] 1099466887 IFEO\KVRT.exe: [MinimumStackCommitInBytes] 1099466887 IFEO\mbamagent.exe: [MinimumStackCommitInBytes] 1099466887 IFEO\mbamservice.exe: [MinimumStackCommitInBytes] 1099466887 IFEO\mbamtray.exe: [MinimumStackCommitInBytes] 1099466887 IFEO\MediaCreationTool22H2.exe: [MinimumStackCommitInBytes] 1099466887 IFEO\mmc.exe: [MinimumStackCommitInBytes] 1099466887 IFEO\mstsc.exe: [MinimumStackCommitInBytes] 1099466887 IFEO\PowerTool.exe: [MinimumStackCommitInBytes] 1099466887 IFEO\PowerTool64.exe: [MinimumStackCommitInBytes] 1099466887 IFEO\ReAgentc.exe: [MinimumStackCommitInBytes] 1099466887 IFEO\recoverydrive.exe: [MinimumStackCommitInBytes] 1099466887 IFEO\rstrui.exe: [MinimumStackCommitInBytes] 1099466887 IFEO\systemreset.exe: [MinimumStackCommitInBytes] 1099466887 IFEO\SystemSettingsAdminFlows.exe: [MinimumStackCommitInBytes] 1099466887 IFEO\tcpview.exe: [MinimumStackCommitInBytes] 1099466887 IFEO\tcpview64.exe: [MinimumStackCommitInBytes] 1099466887 IFEO\vssadmin.exe: [MinimumStackCommitInBytes] 1099466887 IFEO\Wireshark.exe: [MinimumStackCommitInBytes] 1099466887 IFEO\wuapihost.exe: [MinimumStackCommitInBytes] 1099466887 IFEO\wuauclt.exe: [MinimumStackCommitInBytes] 1099466887 IFEO\x32dbg.exe: [MinimumStackCommitInBytes] 1099466887 IFEO\x64dbg.exe: [MinimumStackCommitInBytes] 1099466887 IFEO\xcopy.exe: [MinimumStackCommitInBytes] 1099466887 HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION CustomCLSID: HKU\S-1-5-21-3844586854-2832619778-3748133936-1001_Classes\CLSID\{4AC6DFE1-607B-45B2-B289-D7FBCD44169C}\localserver32 -> C:\Program Files\Autodesk\AutoCAD 2019\acad.exe /Automation => No File CustomCLSID: HKU\S-1-5-21-3844586854-2832619778-3748133936-1001_Classes\CLSID\{74D0CE91-F931-4FAC-BEA9-EE32E43EAD37}\localserver32 -> C:\Program Files\Autodesk\AutoCAD 2019\acad.exe => No File CustomCLSID: HKU\S-1-5-21-3844586854-2832619778-3748133936-1001_Classes\CLSID\{E2C40589-DE61-11ce-BAE0-0020AF6D7005}\InprocServer32 -> C:\Program Files\Autodesk\AutoCAD 2019\ru-RU\acadficn.dll => No File Shortcut: C:\Users\Lara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Яндекс.lnk -> C:\Users\Lara\AppData\Local\Yandex\YandexBrowser\Application\browser.exe (No File) <==== Cyrillic Shortcut: C:\Users\Lara\AppData\Roaming\Microsoft\Windows\Start Menu\CIVILIZATION IV Полное Издание\Запустить CIVILIZATION IV Warlords.lnk -> C:\Program Files (x86)\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe (No File) <==== Cyrillic Shortcut: C:\Users\Lara\AppData\Roaming\Microsoft\Windows\Start Menu\CIVILIZATION IV Полное Издание\Запустить CIVILIZATION IV Колонизация.lnk -> C:\Program Files (x86)\Sid Meier's Civilization 4 Complete\Colonization\Colonization.exe (No File) <==== Cyrillic Shortcut: C:\Users\Lara\AppData\Roaming\Microsoft\Windows\Start Menu\CIVILIZATION IV Полное Издание\Запустить CIVILIZATION IV Эпоха Огня.lnk -> C:\Program Files (x86)\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe (No File) <==== Cyrillic Shortcut: C:\Users\Lara\AppData\Roaming\Microsoft\Windows\Start Menu\CIVILIZATION IV Полное Издание\Запустить CIVILIZATION IV.lnk -> C:\Program Files (x86)\Sid Meier's Civilization 4 Complete\Civilization4.exe (No File) <==== Cyrillic Shortcut: C:\Users\Lara\AppData\Roaming\Microsoft\Windows\Start Menu\CIVILIZATION IV Полное Издание\Удалить Игру.lnk -> C:\Program Files (x86)\Sid Meier's Civilization 4 Complete\Unistall.bat (No File) Shortcut: C:\Users\Lara\AppData\Roaming\Microsoft\Windows\Start Menu\CIVILIZATION IV Полное Издание\Установить Фанатскую Русификацию для Колонизации.lnk -> C:\Program Files (x86)\Sid Meier's Civilization 4 Complete\CIV4Col_Rus_1_01_1b.exe (No File) <==== Cyrillic Shortcut: C:\Users\Lara\AppData\Roaming\Microsoft\Windows\Start Menu\CIVILIZATION IV Полное Издание\Установить Фанатскую Русификацию.lnk -> C:\Program Files (x86)\Sid Meier's Civilization 4 Complete\CIV4BtS_Rus_3_19_2.exe (No File) <==== Cyrillic Shortcut: C:\Users\Lara\AppData\Roaming\Microsoft\Windows\Start Menu\CIVILIZATION IV Полное Издание\Руководства\Древо Технологий часть 1.lnk -> C:\Program Files (x86)\Sid Meier's Civilization 4 Complete\Manual\TECHTREE_1.PDF (No File) <==== Cyrillic Shortcut: C:\Users\Lara\AppData\Roaming\Microsoft\Windows\Start Menu\CIVILIZATION IV Полное Издание\Руководства\Древо Технологий часть 2.lnk -> C:\Program Files (x86)\Sid Meier's Civilization 4 Complete\Manual\TECHTREE_2.PDF (No File) <==== Cyrillic Shortcut: C:\Users\Lara\AppData\Roaming\Microsoft\Windows\Start Menu\CIVILIZATION IV Полное Издание\Руководства\Руководство Пользователя.lnk -> C:\Program Files (x86)\Sid Meier's Civilization 4 Complete\Manual\Civ_Complete_manual.pdf (No File) <==== Cyrillic Shortcut: C:\Users\Lara\AppData\Roaming\Microsoft\Windows\Start Menu\CIVILIZATION IV Полное Издание\Руководства\Хроники Цивилизаций.lnk -> C:\Program Files (x86)\Sid Meier's Civilization 4 Complete\Manual\Chronics Book.pdf (No File) <==== Cyrillic Shortcut: C:\Users\Lara\AppData\Roaming\Microsoft\Windows\Start Menu\CIVILIZATION IV Полное Издание\WEB-Ресурсы\Поддержка.lnk -> C:\Program Files (x86)\Sid Meier's Civilization 4 Complete\support.URL (No File) <==== Cyrillic Shortcut: C:\Users\Lara\AppData\Roaming\Microsoft\Windows\Start Menu\CIVILIZATION IV Полное Издание\WEB-Ресурсы\Фанатский сайт.lnk -> C:\Program Files (x86)\Sid Meier's Civilization 4 Complete\fanat.URL (No File) <==== Cyrillic Shortcut: C:\Users\Lara\AppData\Roaming\Microsoft\Windows\Start Menu\CIVILIZATION IV Полное Издание\WEB-Ресурсы\Фанатский форум.lnk -> C:\Program Files (x86)\Sid Meier's Civilization 4 Complete\forum.URL (No File) <==== Cyrillic Shortcut: C:\Users\Lara\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Яндекс.lnk -> C:\Users\Lara\AppData\Local\Yandex\YandexBrowser\Application\browser.exe (No File) <==== Cyrillic AlternateDataStreams: C:\ProgramData:MHD [252] AlternateDataStreams: C:\Users\All Users:MHD [252] AlternateDataStreams: C:\Users\Все пользователи:MHD [252] AlternateDataStreams: C:\ProgramData\Application Data:MHD [252] AlternateDataStreams: C:\Users\Lara\Local Settings:MHD [53] AlternateDataStreams: C:\Users\Lara\AppData\Local:MHD [53] AlternateDataStreams: C:\Users\Lara\AppData\Local\Application Data:MHD [53] AlternateDataStreams: C:\Users\Lara\AppData\Local\Temp:MHD [240] FirewallRules: [TCP Query User{C2170C1B-C6D8-4766-8C4E-34DAD372F769}C:\users\lara\appdata\local\yandex\yandexbrowser\application\browser.exe] => (Block) C:\users\lara\appdata\local\yandex\yandexbrowser\application\browser.exe => No File FirewallRules: [UDP Query User{A9972BF4-7EB7-483B-8BF3-848C6EA6CDE2}C:\users\lara\appdata\local\yandex\yandexbrowser\application\browser.exe] => (Block) C:\users\lara\appdata\local\yandex\yandexbrowser\application\browser.exe => No File FirewallRules: [TCP Query User{1770C235-0FD0-4E81-9425-62C938FB35E9}C:\users\lara\appdata\roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\bin\javaw.exe] => (Allow) C:\users\lara\appdata\roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\bin\javaw.exe => No File FirewallRules: [UDP Query User{8B0C98E1-AF5D-4916-80E7-18E62AA3599A}C:\users\lara\appdata\roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\bin\javaw.exe] => (Allow) C:\users\lara\appdata\roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\bin\javaw.exe => No File FirewallRules: [TCP Query User{943FB041-43D4-4377-B560-BC89D871783B}C:\users\lara\appdata\local\faceit\app-2.0.44\faceit.exe] => (Block) C:\users\lara\appdata\local\faceit\app-2.0.44\faceit.exe => No File FirewallRules: [UDP Query User{3F1422C8-28C7-47FD-875E-8E20AEEB059B}C:\users\lara\appdata\local\faceit\app-2.0.44\faceit.exe] => (Block) C:\users\lara\appdata\local\faceit\app-2.0.44\faceit.exe => No File FirewallRules: [TCP Query User{E93F690C-FE1D-4C13-BBD4-75A54102C481}C:\users\lara\appdata\local\faceit\app-2.0.47\faceit.exe] => (Block) C:\users\lara\appdata\local\faceit\app-2.0.47\faceit.exe => No File FirewallRules: [UDP Query User{AAD42E6F-5202-48A4-92BD-AF0A2A1C0A83}C:\users\lara\appdata\local\faceit\app-2.0.47\faceit.exe] => (Block) C:\users\lara\appdata\local\faceit\app-2.0.47\faceit.exe => No File FirewallRules: [{2F138490-05A3-4011-8BDF-68FF7A81450D}] => (Allow) C:\Users\Lara\AppData\Local\Yandex\YandexBrowser\Application\browser.exe => No File FirewallRules: [TCP Query User{15D87CA4-0AAF-4AAD-AA49-C1E86C337AEE}C:\program files\mozilla\mozilla vpn\mozilla vpn.exe] => (Allow) C:\program files\mozilla\mozilla vpn\mozilla vpn.exe => No File FirewallRules: [UDP Query User{51F5668F-9C14-4FCF-9B50-7AE3788FA915}C:\program files\mozilla\mozilla vpn\mozilla vpn.exe] => (Allow) C:\program files\mozilla\mozilla vpn\mozilla vpn.exe => No File FirewallRules: [{0B981798-5135-4698-8F78-AE52BDC8E1D4}] => (Block) C:\program files\mozilla\mozilla vpn\mozilla vpn.exe => No File FirewallRules: [{E8CE43E2-990B-4684-B038-6BAB251B529D}] => (Block) C:\program files\mozilla\mozilla vpn\mozilla vpn.exe => No File FirewallRules: [{A14CD161-4D4B-4E1B-9086-1E1EC11B14F0}] => (Allow) D:\SteamLibrary\steamapps\common\Icarus\Icarus.exe => No File FirewallRules: [{3555A5B1-8317-4952-847C-B5D0DB7C27E4}] => (Allow) D:\SteamLibrary\steamapps\common\Icarus\Icarus.exe => No File C:\Windows\SoftwareDistribution\DataStore C:\Windows\SoftwareDistribution\Download cmd: del "%temp%\*.*" /s /q cmd: del c:\windows\temp\*.* /s /q Reboot: