Task: {C12078A1-0AC2-4AC3-A333-1D1E57B4A9BF} - \Microsoft\Windows\Wininet\RealtekHDStartUP -> No File <==== ATTENTION
FF NewTab: Mozilla\Firefox\Profiles\6njd0tak.default -> hxxps://securesearch.org/homepage?hp=2&pId=BT170603&iDate=2020-02-11 07:29:54&bName=
2020-05-29 23:04 - 2020-05-29 23:04 - 000000000 ____D C:\Users\Bamik\AppData\Local\mbam
2020-05-29 23:04 - 2020-05-29 23:04 - 000000000 ____D C:\ProgramData\Malwarebytes
2020-05-29 23:04 - 2020-05-29 23:04 - 000000000 ____D C:\Program Files\Malwarebytes
2020-05-29 17:29 - 2020-05-29 17:29 - 000000000 ____D C:\Program Files\Malw
EmptyTemp:
Reboot:

HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-57249860-2843950866-1147634639-1001\...\Policies\Explorer: [DisallowRun] 1
HKU\S-1-5-21-57249860-2843950866-1147634639-1001\...\Policies\Explorer\DisallowRun: [1] eav_trial_rus.exe
HKU\S-1-5-21-57249860-2843950866-1147634639-1001\...\Policies\Explorer\DisallowRun: [2] avast_free_antivirus_setup_online.exe
HKU\S-1-5-21-57249860-2843950866-1147634639-1001\...\Policies\Explorer\DisallowRun: [3] eis_trial_rus.exe
HKU\S-1-5-21-57249860-2843950866-1147634639-1001\...\Policies\Explorer\DisallowRun: [4] essf_trial_rus.exe
HKU\S-1-5-21-57249860-2843950866-1147634639-1001\...\Policies\Explorer\DisallowRun: [5] hitmanpro_x64.exe
HKU\S-1-5-21-57249860-2843950866-1147634639-1001\...\Policies\Explorer\DisallowRun: [6] ESETOnlineScanner_UKR.exe
HKU\S-1-5-21-57249860-2843950866-1147634639-1001\...\Policies\Explorer\DisallowRun: [7] ESETOnlineScanner_RUS.exe
HKU\S-1-5-21-57249860-2843950866-1147634639-1001\...\Policies\Explorer\DisallowRun: [8] HitmanPro.exe
HKU\S-1-5-21-57249860-2843950866-1147634639-1001\...\Policies\Explorer\DisallowRun: [9] 360TS_Setup_Mini.exe
HKU\S-1-5-21-57249860-2843950866-1147634639-1001\...\Policies\Explorer\DisallowRun: [10] Cezurity_Scanner_Pro_Free.exe
HKU\S-1-5-21-57249860-2843950866-1147634639-1001\...\Policies\Explorer\DisallowRun: [11] Cube.exe
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
Task: {041652E0-9B9B-4B7D-B5ED-FA0409194064} - \Microsoft\Windows\Wininet\RealtekHDControl -> No File <==== ATTENTION
Task: {0FCDA765-CE60-435B-903F-C4F0015EEDED} - \Microsoft\Windows\Wininet\Cleaner -> No File <==== ATTENTION
Task: {26BB6194-1C64-4CE3-99C2-372A3DE58968} - \Microsoft\Windows\Wininet\Taskhostw -> No File <==== ATTENTION
Task: {41E4F1BA-ACF4-468F-B5B0-ACAA6BDC3D96} - \Microsoft\Windows\Wininet\Taskhost -> No File <==== ATTENTION
Task: {49957BEE-B6E4-4F99-8951-0B903315681C} - \Opera scheduled assistant Autoupdate 1590688856 -> No File <==== ATTENTION
Task: {51F19D54-6A32-4DE3-A16D-A705060D25E6} - \Microsoft\Windows\BrokerInfrastructure\BgTaskRegistrationMaintenanceTask -> No File <==== ATTENTION
Task: {6222D7B4-FCF2-4997-AB14-B2BF23EA60A8} - \Opera scheduled Autoupdate 1590688846 -> No File <==== ATTENTION
2020-05-25 21:22 - 2020-05-29 02:39 - 000000000 __SHD C:\AdwCleaner
2020-05-25 21:22 - 2020-05-28 20:02 - 000000000 __SHD C:\ProgramData\install
2020-05-25 21:22 - 2020-05-25 21:41 - 000000000 __SHD C:\ProgramData\Setup
2020-05-25 21:22 - 2020-05-25 21:23 - 000000000 __SHD C:\rdp
2020-05-25 21:22 - 2020-05-25 21:22 - 000000000 __SHD C:\ProgramData\Norton
2020-05-25 21:22 - 2020-05-25 21:22 - 000000000 __SHD C:\ProgramData\Kaspersky Lab Setup Files
2020-05-25 21:22 - 2020-05-25 21:22 - 000000000 __SHD C:\ProgramData\Kaspersky Lab
2020-05-25 21:22 - 2020-05-25 21:22 - 000000000 __SHD C:\ProgramData\ESET
2020-05-25 21:22 - 2020-05-25 21:22 - 000000000 __SHD C:\ProgramData\Doctor Web
2020-05-25 21:22 - 2020-05-25 21:22 - 000000000 __SHD C:\ProgramData\360safe
2020-05-25 21:22 - 2020-05-25 21:22 - 000000000 __SHD C:\Program Files\Malwarebytes
2020-05-25 21:22 - 2020-05-25 21:22 - 000000000 __SHD C:\Program Files\Kaspersky Lab
2020-05-25 21:22 - 2020-05-25 21:22 - 000000000 __SHD C:\Program Files\ESET
2020-05-25 21:22 - 2020-05-25 21:22 - 000000000 __SHD C:\Program Files\COMODO
2020-05-25 21:22 - 2020-05-25 21:22 - 000000000 __SHD C:\Program Files\Cezurity
2020-05-25 21:22 - 2020-05-25 21:22 - 000000000 __SHD C:\Program Files\ByteFence
2020-05-25 21:22 - 2020-05-25 21:22 - 000000000 __SHD C:\Program Files\AVG
2020-05-25 21:22 - 2020-05-25 21:22 - 000000000 __SHD C:\Program Files (x86)\Panda Security
2020-05-25 21:22 - 2020-05-25 21:22 - 000000000 __SHD C:\Program Files (x86)\Microsoft JDX
2020-05-25 21:22 - 2020-05-25 21:22 - 000000000 __SHD C:\Program Files (x86)\Kaspersky Lab
2020-05-25 21:22 - 2020-05-25 21:22 - 000000000 __SHD C:\Program Files (x86)\GRIZZLY Antivirus
2020-05-25 21:22 - 2020-05-25 21:22 - 000000000 __SHD C:\Program Files (x86)\Cezurity
2020-05-25 21:22 - 2020-05-25 21:22 - 000000000 __SHD C:\Program Files (x86)\AVG
2020-05-25 21:22 - 2020-05-25 21:22 - 000000000 __SHD C:\Program Files (x86)\AVAST Software
2020-05-25 21:22 - 2020-05-25 21:22 - 000000000 __SHD C:\Program Files (x86)\360
2020-05-25 21:22 - 2020-05-25 21:22 - 000000000 __SHD C:\KVRT_Data
2020-05-25 10:30 - 2020-05-29 01:53 - 000000000 __SHD C:\ProgramData\RealtekHD
FirewallRules: [{B8C21B19-26B9-4251-83AA-245F0BDA8D6E}] => (Allow) C:\ProgramData\WindowsTask\AppModule.exe => No File
FirewallRules: [{3D820624-D5A6-4ABB-BD99-8CA5D3B67502}] => (Allow) C:\ProgramData\WindowsTask\AppModule.exe => No File
FirewallRules: [{3BC6FD79-29A7-42DC-9D56-CE7173D1EE62}] => (Allow) C:\ProgramData\WindowsTask\MicrosoftHost.exe => No File
FirewallRules: [{F62BC5FF-9709-4341-B639-C98B77BB65B3}] => (Allow) C:\ProgramData\WindowsTask\AMD.exe => No File
FirewallRules: [{DDF3AE8D-1D55-4E17-A72B-2F7CE03790E6}] => (Allow) C:\ProgramData\WindowsTask\AMD.exe => No File
FirewallRules: [{2E186DC8-2B74-43ED-B1AB-839D5FD5284A}] => (Allow) C:\ProgramData\WindowsTask\MicrosoftHost.exe => No File
FirewallRules: [{A7FD420D-77FA-403B-ACEB-786A2DADE3FC}] => (Allow) C:\ProgramData\Windows\rutserv.exe => No File
FirewallRules: [{7936860D-D362-4969-8743-510589AB5113}] => (Block) LPort=445
FirewallRules: [{AE603DE9-EFEF-4126-84AB-7C6797C18865}] => (Block) LPort=445
FirewallRules: [{1B35195E-CDA9-4B8A-98BE-426F89FC4CAF}] => (Block) LPort=139
FirewallRules: [{50610225-5A01-40A8-98FC-0C7E188F6F19}] => (Block) LPort=139
FirewallRules: [{245626DB-574D-4F13-B435-018B7887D086}] => (Allow) C:\Users\Bamik\AppData\Local\MediaGet2\mediaget.exe => No File
FirewallRules: [{DEC1AA6D-F3B6-4EF7-B91C-146E2D3629DC}] => (Allow) C:\Users\Bamik\AppData\Local\MediaGet2\mediaget.exe => No File
EmptyTemp:
Reboot:

;uVS v4.1.9 [http://dsrt.dyndns.org:8888]
;Target OS: NTv10.0
v400c
OFFSGNSAVE
;------------------------autoscript---------------------------

delall %SystemDrive%\PROGRAMDATA\WINDOWSTASK\WINLOGON.EXE
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DGOMEKMIDLODGLBBMALCNEEGIEACBDMKI%26INSTALLSOURCE%3DONDEMAND%26UC
apply

deltmp
delref %Sys32%\DRIVERSTORE\FILEREPOSITORY\NV_DISPI.INF_AMD64_3FBB9BB1983B9ED9\DISPLAY.NVCONTAINER\NVDISPLAY.CONTAINER.EXE -S NVDISPLAY.CONTAINERLOCALSYSTEM -F C:\PROGRAMDATA\NVDISPLAY.CONTAINERLOCALSYSTEM.LOG -L 3 -D C:\WINDOWS\SYSTEM32\DRIVERSTORE\FILEREPOSITORY\NV_DISPI.INF_AMD64_3FBB9BB1983B9ED9\DISPLAY.NVCONTAINER\PLUGINS\LOCALSYSTEM -R -P 30000 -CFG NVDISPLAY.CONTAINERLOCALSYSTEM\LOCALSYSTEM
delref %SystemDrive%\PROGRAMDATA\DISPLAYSESSIONCONTAINER%D.LOG
delref {E984D939-0E00-4DD9-AC3A-7ACA04745521}\[CLSID]
delref %SystemDrive%\USERS\BAMIK\APPDATA\LOCAL\PROGRAMS\OPERA\LAUNCHER.EXE
delref %SystemRoot%\SYSWOW64\COMPMGMTLAUNCHER.EXE
delref %SystemRoot%\SYSWOW64\VID.DLL
delref %SystemRoot%\SYSWOW64\WEVTSVC.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\DXGMMS2.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\WINNAT.SYS
delref %SystemRoot%\SYSWOW64\BTHSERV.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\SMBDIRECT.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\REFS.SYS
delref {8AD9C840-044E-11D1-B3E9-00805F499D93}\[CLSID]
delref %SystemRoot%\SYSWOW64\BLANK.HTM
delref %Sys32%\DRIVERS\UMDF\USBCCIDDRIVER.DLL
delref %Sys32%\BLANK.HTM
delref {472083B0-C522-11CF-8763-00608CC02F24}\[CLSID]
delref %Sys32%\DRIVERS\HDAUDADDSERVICE.SYS
delref BROWSER\[SERVICE]
delref %Sys32%\DRIVERS\MFEVTP.SYS
delref %Sys32%\DRIVERS\RDPENCDD.SYS
delref %Sys32%\DRIVERS\SMARTCARDSIMULATOR.SYS
delref %Sys32%\DRIVERS\VIRTUALSMARTCARDREADER.SYS
delref %Sys32%\DRIVERS\WUDFUSBCCIDDRIVER.SYS
delref %Sys32%\DRIVERS\MFEAVFK01.SYS
delref %Sys32%\DRIVERSTORE\FILEREPOSITORY\NV_DISPI.INF_AMD64_3FBB9BB1983B9ED9\DISPLAY.NVCONTAINER\NVDISPLAY.CONTAINER.EXE -S NVDISPLAY.CONTAINERLOCALSYSTEM -F %PROGRAMDATA%\NVDISPLAY.CONTAINERLOCALSYSTEM.LOG -L 3 -D C:\WINDOWS\SYSTEM32\DRIVERSTORE\FILEREPOSITORY\NV_DISPI.INF_AMD64_3FBB9BB1983B9ED9\DISPLAY.NVCONTAINER\PLUGINS\LOCALSYSTEM -R -P 30000 -CFG NVDISPLAY.CONTAINERLOCALSYSTEM\LOCALSYSTEM
delref IRENUM\[SERVICE]
delref %SystemDrive%\PROGRAM FILES\AUTODESK\3DS MAX 2021\INVENTOR SERVER\BIN\TESTSERVER.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\TOTALAV\TOTALAV.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\DAO\DAO350.DLL
delref %SystemDrive%\PROGRAM FILES\ADOBE\ADOBE ILLUSTRATOR CC 2019SUPPORT FILES\CONTENTS\WINDOWS\ILLUSTRATOR.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.35.442\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES\ADOBE\ADOBE PHOTOSHOP CC 2019\PHOTOSHOP.EXE\AUTOMATION
delref %SystemDrive%\PROGRAM FILES\ADOBE\ADOBE ILLUSTRATOR CC 2019\ADOBE ILLUSTRATOR CC\SUPPORT FILES\CONTENTS\WINDOWS\ILLUSTRATOR.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\COMMON FILES\AUTODESK SHARED\REVIT SHARED\ASHRAEDUCT.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.35.442\PSMACHINE.DLL
delref %SystemRoot%\SYSWOW64\PERCEPTIONSIMULATIONEXTENSIONS.DLL
delref %SystemRoot%\SYSWOW64\AUTHHOST.EXE
delref %SystemRoot%\SYSWOW64\COMPPKGSRV.EXE
delref %SystemRoot%\SYSWOW64\RSTRUI.EXE
delref %SystemRoot%\SYSWOW64\DRIVERSTORE\FILEREPOSITORY\NV_DISPI.INF_AMD64_3FBB9BB1983B9ED9\NVENCMFTH264.DLL
delref %SystemRoot%\SYSWOW64\WPCREFRESHTASK.DLL
delref %SystemRoot%\SYSWOW64\DRIVERSTORE\FILEREPOSITORY\NV_DISPI.INF_AMD64_3FBB9BB1983B9ED9\NVDECMFTMJPEG.DLL
delref %SystemRoot%\SYSWOW64\RMSROAMINGSECURITY.DLL
delref %SystemRoot%\SYSWOW64\SYSTEMSETTINGSBROKER.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\ACRORD32INFO.EXE
delref %SystemRoot%\SYSWOW64\SPEECH_ONECORE\COMMON\SAPI_EXTENSIONS.DLL
delref %SystemRoot%\SYSWOW64\WIREDNETWORKCSP.DLL
delref %SystemDrive%\USERS\BAMIK\APPDATA\ROAMING\UTORRENT\UTORRENT.EXE
delref %SystemDrive%\USERS\BAMIK\APPDATA\ROAMING\UTORRENT WEB\UTWEB.EXE
delref %SystemDrive%\PROGRAM FILES\SPYHUNTER\SPYHUNTER4.EXE
delref %SystemDrive%\PROGRAM FILES\SPYHUNTER\УДАЛИТЬ SPYHUNTER.EXE
;-------------------------------------------------------------

restart