HKLM\...\Run: [Realtek HD Audio] => C:\ProgramData\RealtekHD\taskhostw.exe <==== ВНИМАНИЕ
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Ограничение <==== ВНИМАНИЕ
HKU\S-1-5-21-533093311-1531349430-323674345-1001\...\Policies\Explorer: [DisallowRun] 1
HKU\S-1-5-21-533093311-1531349430-323674345-1001\...\Policies\Explorer\DisallowRun: [1] eav_trial_rus.exe
HKU\S-1-5-21-533093311-1531349430-323674345-1001\...\Policies\Explorer\DisallowRun: [2] avast_free_antivirus_setup_online.exe
HKU\S-1-5-21-533093311-1531349430-323674345-1001\...\Policies\Explorer\DisallowRun: [3] eis_trial_rus.exe
HKU\S-1-5-21-533093311-1531349430-323674345-1001\...\Policies\Explorer\DisallowRun: [4] essf_trial_rus.exe
HKU\S-1-5-21-533093311-1531349430-323674345-1001\...\Policies\Explorer\DisallowRun: [5] hitmanpro_x64.exe
HKU\S-1-5-21-533093311-1531349430-323674345-1001\...\Policies\Explorer\DisallowRun: [6] ESETOnlineScanner_UKR.exe
HKU\S-1-5-21-533093311-1531349430-323674345-1001\...\Policies\Explorer\DisallowRun: [7] ESETOnlineScanner_RUS.exe
HKU\S-1-5-21-533093311-1531349430-323674345-1001\...\Policies\Explorer\DisallowRun: [8] HitmanPro.exe
HKU\S-1-5-21-533093311-1531349430-323674345-1001\...\Policies\Explorer\DisallowRun: [9] 360TS_Setup_Mini.exe
HKU\S-1-5-21-533093311-1531349430-323674345-1001\...\Policies\Explorer\DisallowRun: [10] Cezurity_Scanner_Pro_Free.exe
HKU\S-1-5-21-533093311-1531349430-323674345-1001\...\Policies\Explorer\DisallowRun: [11] Cube.exe
Task: {2263BE8D-8EB3-461B-AFF8-E822D9D19C8E} - System32\Tasks\Microsoft\Windows\Wininet\RealtekHDControl => C:\Programdata\RealtekHD\taskhost.exe <==== ВНИМАНИЕ
Task: {4137E121-98CF-4999-9D16-173D000F4E5B} - System32\Tasks\Microsoft\Windows\Wininet\Taskhost => C:\Programdata\RealtekHD\taskhostw.exe <==== ВНИМАНИЕ
Task: {77E89627-326E-4028-A775-25753567BF93} - \Microsoft\Windows\UNP\RunCampaignManager -> Нет файла <==== ВНИМАНИЕ
Task: {7CD171B6-4E01-442F-B4B0-A32C2102BC69} - System32\Tasks\Microsoft\Windows\Wininet\Taskhostw => C:\Programdata\RealtekHD\taskhostw.exe <==== ВНИМАНИЕ
Task: {BEDF3580-DB74-4D58-8A09-9DEF8123F9AE} - System32\Tasks\Microsoft\Windows\Wininet\Cleaner => C:\Programdata\WindowsTask\winlogon.exe <==== ВНИМАНИЕ
Task: {E4DAF598-67DE-48C3-87D8-DF762A22ED3E} - System32\Tasks\Microsoft\Windows\Wininet\RealtekHDStartUP => C:\Programdata\RealtekHD\taskhost.exe <==== ВНИМАНИЕ
S3 WinRing0_1_2_0; C:\ProgramData\WindowsTask\WinRing0x64.sys [14544 2020-06-08] (Noriyuki MIYAZAKI -> OpenLibSys.org)
2021-02-24 14:12 - 2021-02-24 14:12 - 000000000 __SHD C:\Program Files\Malwarebytes
2021-02-24 14:12 - 2021-02-24 14:12 - 000000000 __SHD C:\Program Files\Kaspersky Lab
2021-02-24 14:12 - 2021-02-24 14:12 - 000000000 __SHD C:\Program Files\ESET
2021-02-24 14:12 - 2021-02-24 14:12 - 000000000 __SHD C:\Program Files\COMODO
2021-02-24 14:12 - 2021-02-24 14:12 - 000000000 __SHD C:\Program Files\Cezurity
2021-02-24 14:12 - 2021-02-24 14:12 - 000000000 __SHD C:\Program Files\ByteFence
2021-02-24 14:12 - 2021-02-24 14:12 - 000000000 __SHD C:\Program Files\AVG
2021-02-24 14:12 - 2021-02-24 14:12 - 000000000 __SHD C:\Program Files\AVAST Software
2021-02-24 14:12 - 2021-02-24 14:12 - 000000000 __SHD C:\Program Files (x86)\Microsoft JDX
2021-02-24 14:12 - 2021-02-24 14:12 - 000000000 __SHD C:\Program Files (x86)\Kaspersky Lab
2021-02-24 14:12 - 2021-02-24 14:12 - 000000000 ____D C:\WINDOWS\speechstracing
2021-02-24 14:12 - 2021-02-24 14:12 - 000000000 ____D C:\ProgramData\MB3Install
2021-02-24 14:12 - 2021-02-24 14:12 - 000000000 ____D C:\ProgramData\Malwarebytes
2021-02-24 14:12 - 2021-02-24 14:12 - 000000000 ____D C:\ProgramData\Indus
2021-02-24 14:11 - 2021-02-25 13:36 - 000000000 __SHD C:\ProgramData\WindowsTask
2021-02-24 14:11 - 2021-02-25 13:36 - 000000000 __SHD C:\ProgramData\Windows
2021-02-24 14:11 - 2021-02-25 13:36 - 000000000 ____D C:\ProgramData\install
2021-02-24 14:11 - 2021-02-24 14:11 - 000000000 __SHD C:\ProgramData\RunDLL
2021-02-24 14:11 - 2021-02-24 14:11 - 000000000 ____D C:\ProgramData\System32

EmptyTemp:
Reboot:

;uVS v4.11.3 [http://dsrt.dyndns.org:8888]
;Target OS: NTv10.0
v400c
OFFSGNSAVE
;------------------------autoscript---------------------------

delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DEFAIDNBMNNNIBPCAJPCGLCLEFINDMKAJ%26INSTALLSOURCE%3DONDEMAND%26UC
delref %SystemDrive%\PROGRAMDATA\REALTEKHD\TASKHOSTW.EXE
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DMJMPFDKMPOJOEEMJMFIDDLHKKNDCDPNO%26INSTALLSOURCE%3DONDEMAND%26UC
apply


deltmp
delref %SystemRoot%\SYSWOW64\TILTWHEELMOUSE.EXE
delref %SystemDrive%\USERS\EVGEN\APPDATA\LOCAL\TEMP\CHROME_BITS_4312_1845273386\AIBKUV7JOLTWO_MRBTI1W_4
delref %SystemDrive%\USERS\EVGEN\APPDATA\LOCAL\TEMP\EDGE_BITS_8732_1588635793\9C839662-0AE0-4A3D-ABF2-EDBA1AF63603
delref %SystemDrive%\WEBSERVERS\DENWER\BOOT.EXE
delref {9F2B0085-9218-42A1-88B0-9F0E65851666}\[CLSID]
delref {E984D939-0E00-4DD9-AC3A-7ACA04745521}\[CLSID]
delref {FE285C8C-5360-41C1-A700-045501C740DE}\[CLSID]
delref {9CDA66BE-3271-4723-8D35-DD834C58AD92}\[CLSID]
delref %SystemRoot%\SYSWOW64\MAPSTOASTTASK.DLL
delref %SystemRoot%\SYSWOW64\MAPSUPDATETASK.DLL
delref {DEF03232-9688-11E2-BE7F-B4B52FD966FF}\[CLSID]
delref %SystemDrive%\PROGRAM FILES\REMPL\SEDLAUNCHER.EXE
delref {D2CBF5F7-5702-440B-8D8F-8203034A6B82}\[CLSID]
delref %SystemDrive%\USERS\EVGEN\APPDATA\LOCAL\MICROSOFT\ONEDRIVE\ONEDRIVESTANDALONEUPDATER.EXE
delref %SystemRoot%\SYSWOW64\GPSVC.DLL
delref %SystemRoot%\SYSWOW64\VID.DLL
delref %SystemRoot%\SYSWOW64\WEVTSVC.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\TCPIP.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\MRXSMB.SYS
delref %SystemRoot%\SYSWOW64\W32TIME.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\NDIS.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\USBXHCI.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\SRV2.SYS
delref %SystemRoot%\SYSWOW64\RDPCORETS.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\DXGMMS2.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\HTTP.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\WINNAT.SYS
delref %SystemRoot%\SYSWOW64\UMPOEXT.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\VMBUSR.SYS
delref %SystemRoot%\SYSWOW64\BTHSERV.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\DMVSC.SYS
delref %SystemRoot%\SYSWOW64\IPHLPSVC.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\VMBKMCL.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\REFS.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\SPACEPORT.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\FVEVOL.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\AFD.SYS
delref %SystemRoot%\SYSWOW64\PNRPSVC.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\PACER.SYS
delref %SystemRoot%\SYSWOW64\HVHOSTSVC.DLL
delref %SystemRoot%\SYSWOW64\LSM.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\SYNTH3DVSC.SYS
delref {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}\[CLSID]
delref {166B1BCA-3F9C-11CF-8075-444553540000}\[CLSID]
delref {233C1507-6A77-46A4-9443-F871F945D258}\[CLSID]
delref {4063BE15-3B08-470D-A0D5-B37161CFFD69}\[CLSID]
delref {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA}\[CLSID]
delref %SystemRoot%\SYSWOW64\IE4USHOWIE.EXE
delref %SystemRoot%\SYSWOW64\IE4UINIT.EXE
delref %SystemRoot%\SYSWOW64\BLANK.HTM
delref {0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48}\[CLSID]
delref {E6FB5E20-DE35-11CF-9C87-00AA005127ED}\[CLSID]
delref {23170F69-40C1-278A-1000-000100020000}\[CLSID]
delref {474C98EE-CF3D-41F5-80E3-4AAB0AB04301}\[CLSID]
delref {7EFA68C6-086B-43E1-A2D2-55A113531240}\[CLSID]
delref {B298D29A-A6ED-11DE-BA8C-A68E55D89593}\[CLSID]
delref {748F920F-FB24-4D09-B360-BAF6F199AD6D}\[CLSID]
delref {4A7C4306-57E0-4C0C-83A9-78C1528F618C}\[CLSID]
delref {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4}\[CLSID]
delref %Sys32%\DRIVERS\VMBUSR.SYS
delref {2D8B3101-E025-480D-917C-835522C7F628}\[CLSID]
delref {A910D941-9DA9-4656-8933-AA1EAE01F76E}\[CLSID]
delref {E8C77137-E224-5791-B6E9-FF0305797A13}\[CLSID]
delref %SystemDrive%\PROGRAM FILES (X86)\MICROSOFT OFFICE\ROOT\OFFICE16\MSOETWRES.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\MICROSOFT OFFICE\ROOT\OFFICE16\WWLIB.DLL
delref %Sys32%\DRIVERS\INTCAUDIOBUS.SYS
delref %SystemDrive%\PROGRAM FILES (X86)\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX86\MICROSOFT SHARED\OFFICE16\MSO.DLL
delref %Sys32%\DRIVERS\UMDF\USBCCIDDRIVER.DLL
delref %Sys32%\UNP\UNPCAMPAIGNMANAGER.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\COMMON FILES\ADOBE\OOBE\PDAPP\CCM\UTILITIES\NPADOBEAAMDETECT64.DLL
delref %Sys32%\BLANK.HTM
delref APPMGMT\[SERVICE]
delref %Sys32%\DRIVERS\HDAUDADDSERVICE.SYS
delref HELPSVC\[SERVICE]
delref SACSVR\[SERVICE]
delref SWPRV\[SERVICE]
delref TBS\[SERVICE]
delref VMMS\[SERVICE]
delref MESSENGER\[SERVICE]
delref RDSESSMGR\[SERVICE]
delref %Sys32%\DRIVERS\SSUDBUS.SYS
delref %Sys32%\DRIVERS\EFAVDRV.SYS
delref IRENUM\[SERVICE]
delref %SystemDrive%\USERS\EVGEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3QM2PR3I.DEFAULT\EXTENSIONS\ASCSURFINGPROTECTIONNEW@IOBIT.COM.XPI
delref %SystemDrive%\USERS\EVGEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3QM2PR3I.DEFAULT\EXTENSIONS\SOVETNIK@METABAR.RU.XPI
delref %SystemDrive%\PROGRAM FILES\MOZILLA FIREFOX\BROWSER\FEATURES\WEBCOMPAT@MOZILLA.ORG.XPI
delref %SystemDrive%\PROGRAM FILES\MOZILLA FIREFOX\BROWSER\FEATURES\SCREENSHOTS@MOZILLA.ORG.XPI
delref %SystemDrive%\PROGRAM FILES\MOZILLA FIREFOX\BROWSER\FEATURES\FORMAUTOFILL@MOZILLA.ORG.XPI
delref %SystemDrive%\PROGRAM FILES\MOZILLA FIREFOX\BROWSER\FEATURES\WEBCOMPAT-REPORTER@MOZILLA.ORG.XPI
delref %SystemDrive%\PROGRAM FILES\FIREFOX NIGHTLY\BROWSER\FEATURES\SCREENSHOTS@MOZILLA.ORG.XPI
delref %SystemDrive%\PROGRAM FILES\FIREFOX NIGHTLY\BROWSER\FEATURES\WEBCOMPAT-REPORTER@MOZILLA.ORG.XPI
delref %SystemDrive%\PROGRAM FILES\FIREFOX NIGHTLY\BROWSER\FEATURES\WEBCOMPAT@MOZILLA.ORG.XPI
delref %SystemDrive%\PROGRAM FILES\FIREFOX NIGHTLY\BROWSER\FEATURES\FXMONITOR@MOZILLA.ORG.XPI
delref %SystemDrive%\PROGRAM FILES\FIREFOX NIGHTLY\BROWSER\FEATURES\FORMAUTOFILL@MOZILLA.ORG.XPI
delref %SystemDrive%\GAMES\WARGAMING.NET\GAMECENTER\DLLS\PLUGINHOSTPS.DLL
delref %SystemDrive%\GAMES\WARGAMING.NET\GAMECENTER\DLLS\PLUGINHOST.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\JAVA\JRE1.8.0_201\BIN\JP2IEXP.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE\1.3.135.41\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE\1.3.137.99\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE\1.3.137.93\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.35.442\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE\1.3.135.37\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.32\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.52\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE\1.3.139.59\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE\1.3.139.65\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.35.452\PSMACHINE_64.DLL
delref %Sys32%\TETHERINGSETTINGHANDLER.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE\1.3.139.71\PSMACHINE_64.DLL
delref %Sys32%\QUICKACTIONSPS.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE\1.3.135.49\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE\1.3.133.5\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE\1.3.135.29\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\DAO\DAO360.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE\1.3.135.41\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE\1.3.137.99\PSMACHINE.DLL
delref %SystemRoot%\SYSWOW64\SPEECH_ONECORE\COMMON\SPEECHRUNTIME.EXE
delref %SystemRoot%\SYSWOW64\TAPILUA.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE\1.3.137.93\PSMACHINE.DLL
delref %SystemRoot%\SYSWOW64\LOCATIONFRAMEWORK.DLL
delref %SystemRoot%\SYSWOW64\MAPSBTSVCPROXY.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.35.442\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE\1.3.135.37\PSMACHINE.DLL
delref %SystemRoot%\SYSWOW64\DRIVERSTORE\FILEREPOSITORY\IGDLH64.INF_AMD64_CEBA516BAEA4BED9\IGFXEXPS32.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.32\PSMACHINE.DLL
delref %SystemRoot%\SYSWOW64\COMPPKGSRV.EXE
delref %SystemRoot%\SYSWOW64\EAPPCFGUI.DLL
delref %SystemRoot%\SYSWOW64\LISTSVC.DLL
delref %SystemRoot%\SYSWOW64\AUTHHOSTPROXY.DLL
delref %SystemRoot%\SYSWOW64\DRIVERSTORE\FILEREPOSITORY\NVAMI.INF_AMD64_856EC29E64962CFB\NVENCMFTH264.DLL
delref %SystemRoot%\SYSWOW64\WPCREFRESHTASK.DLL
delref %SystemRoot%\SYSWOW64\DRIVERSTORE\FILEREPOSITORY\NVAMI.INF_AMD64_856EC29E64962CFB\NVDECMFTMJPEG.DLL
delref %SystemRoot%\SYSWOW64\WBEM\NLMCIM.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.52\PSMACHINE.DLL
delref %SystemRoot%\SYSWOW64\RMSROAMINGSECURITY.DLL
delref %SystemRoot%\SYSWOW64\SYSTEMSETTINGSBROKER.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE\1.3.139.59\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE\1.3.139.65\PSMACHINE.DLL
delref %SystemRoot%\SYSWOW64\DRIVERSTORE\FILEREPOSITORY\NVAMI.INF_AMD64_856EC29E64962CFB\NVENCMFTHEVC.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\ACRORD32INFO.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.35.452\PSMACHINE.DLL
delref %SystemRoot%\SYSWOW64\SPEECH_ONECORE\COMMON\SAPI_EXTENSIONS.DLL
delref %SystemRoot%\SYSWOW64\SMARTSCREEN.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE\1.3.139.71\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE\1.3.135.49\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE\1.3.133.5\PSMACHINE.DLL
delref %SystemRoot%\SYSWOW64\IDLISTEN.DLL
delref %SystemRoot%\SYSWOW64\WIFICONFIGSP.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE\1.3.135.29\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES\COMMON FILES\SYSTEM\OLE DB\MSDAORA.DLL
delref %SystemRoot%\SYSWOW64\WIREDNETWORKCSP.DLL
delref E:\AUTORUN.EXE
delref %SystemDrive%\USERS\EVGEN\APPDATA\LOCAL\MICROSOFT\ONEDRIVE\ONEDRIVE.EXE
delref %SystemDrive%\USERS\EVGEN\DESKTOP\ESETONLINESCANNER_RUS.EXE
delref %SystemDrive%\PROGRAM FILES\BLUESTACKS\HD-MULTIINSTANCEMANAGER.EXE
delref %SystemDrive%\PROGRAMDATA\BLUESTACKS\CLIENT\BLUESTACKS.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\ASUS\SPLENDID\ACVT.EXE
;-------------------------------------------------------------

restart