Благодаря,Лека вечер и на Вас.

Фикс с Farbar Recovery Scan Tool

 

• Щракнете с десния бутон върху иконата FRST и изберете Изпълнете като администратор
• Маркирайте  информацията от карето по долу , след което натиснете клавишите Ctrl + C едновременно и текстът ще бъде копиран
• Няма нужда да поставяте информацията , FRST ще я направи вместо вас.

Start::
CreateRestorePoint:
CloseProcesses:

(C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusService.exe ->) (Digital Communications Inc -> DlGlTAL COMMUNICATIONS INC) C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusClient.exe
(services.exe ->) (Digital Communications Inc -> DlGlTAL COMMUNICATIONS INC) C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusIC.exe
(services.exe ->) (Digital Communications Inc -> DlGlTAL COMMUNICATIONS INC) C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusService.exe
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-176537593-2728283085-4065151155-1001\...\Run: [Windows Defender] => '% ProgramFiles%  Windows Defender  MSASCui.exe'-runkey (No File)
HKU\S-1-5-21-176537593-2728283085-4065151155-1001\...\MountPoints2: {976dc93c-74a2-11ec-832b-2cf05d810562} - "F:\setup.exe" 
GroupPolicy: Restriction ? <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
"SAntivirusIC" => service was unlocked. <==== ATTENTION
R2 SAntivirusIC; C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusIC.exe [6941200 2022-01-13] (Digital Communications Inc -> DlGlTAL COMMUNICATIONS INC) <==== ATTENTION
R2 SAntivirusSvc; C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusService.exe [690704 2022-01-13] (Digital Communications Inc -> DlGlTAL COMMUNICATIONS INC) <==== ATTENTION
R1 TASANTIVIRUSKD; C:\Program Files (x86)\Digital Communications\SAntivirus\TASAntivirusKD.sys [86024 2022-01-13] (Digital Communications Inc -> DlGlTAL COMMUNICATIONS INC) <==== ATTENTION
HKLM\...\.scr:  =>  <==== ATTENTION
FirewallRules: [{A10D29EB-4836-4F32-9AE3-1F3D24645E97}] => (Block) powershell.exe => No File
FirewallRules: [{DF70BC14-8A16-48DD-BD7D-1F437E606307}] => (Block) powershell.exe => No File

C:\Program Files (x86)\Digital Communications\SAntivirus

CMD: netsh int ip reset
CMD: ipconfig /flushDNS

C:\Windows\Temp\*.*
C:\WINDOWS\system32\*.tmp
C:\WINDOWS\syswow64\*.tmp
Hosts:
Removeproxy:
EmptyTemp:
Reboot:
End::

ЗАБЕЛЕЖКА: Този скрипт е написан специално за този потребител,и за тази конкретна машина. Изпълнението на фикса, на друг компютър може да доведе до увреждане на  операционната ви система

Следните директории се изпразват:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Flash Player cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin

Натиснете бутона Fix само веднъж и изчакайте.

Забележка:    Не е необходимо да поставяте скрипта в FRST .
Рестартирайте компютъра, ако бъдете подканени.
Когато поправката е завършена, FRST ще генерира дневник на същото място, от което е стартиран (Fixlog.txt)
Моля, копирайте и поставете съдържанието му във вашия отговор.

 

След това:

• Копирайте/поставете следното в полето Search:

SearchAll: SAntivirus;360 Total Security

 

• Щракнете върху бутона Search Files
• Когато приключите, щракнете върху OK и на вашия работен плот ще се отвори документ Search.txt
• Моля, копирайте и поставете съдържанието му във вашия отговор.

Забележка:  Ако файла е много голям и не може да се публикува във форума , архивирайте и качете отчета на външен сървър (например File Dropper , DOX.bg   и включете връзката за изтегляне във вашия следващ отговор.

И тази програма не се деинсталира.За какво е не знам.

Здравейте..! Мисля че тази програма ви е най-малкия проблем сега ...! Моля да се придържате към инструкциите ми ..! Очаквам резултатите от фикса от горния ми пост..! Благодаря..! 

Farbar Recovery Scan Tool (x64) Version: 27-02-2022
Ran by Pancho (03-03-2022 15:21:31)
Running from C:\Users\Pancho\OneDrive\Работен плот
Boot Mode: Normal

================== Search Files: "SearchAll: SAntivirus;360 Total Security" =============

File:
========
C:\Windows\WinSxS\Manifests\amd64_c_fsantivirus.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_e8a3ad9373ab26d0.manifest
[2019-12-07 11:49][2019-12-07 11:49] 000000275 _____ () 9EB9B0156A46FA45672CAAE78723F928 [File not signed]

C:\Windows\WinSxS\Manifests\amd64_dual_c_fsantivirus.inf_31bf3856ad364e35_10.0.19041.1_none_8d76b37cccda75a1.manifest
[2019-12-07 11:04][2019-12-07 11:04] 000000924 _____ () 30B3BA1056ED257141646946CF2BA47F [File not signed]

C:\Windows\WinSxS\amd64_dual_c_fsantivirus.inf_31bf3856ad364e35_10.0.19041.1_none_8d76b37cccda75a1\c_fsantivirus.inf
[2019-12-07 11:07][2019-12-07 11:07] 000001168 _____ () C530FABE9B69DAE04AE7BED25E42877C [File is digitally signed]

C:\Windows\WinSxS\amd64_c_fsantivirus.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_e8a3ad9373ab26d0\c_fsantivirus.inf_loc
[2019-12-07 11:49][2019-12-07 11:49] 000000316 _____ () 9D6CE702E9BD0413FF3C8C2BF43543B7 [File is digitally signed]

C:\Windows\System32\DriverStore\FileRepository\c_fsantivirus.inf_amd64_632d2ac0d68cf3ed\c_fsantivirus.inf
[2019-12-07 11:07][2019-12-07 11:07] 000001168 _____ () C530FABE9B69DAE04AE7BED25E42877C [File is digitally signed]

C:\Windows\System32\DriverStore\en-US\c_fsantivirus.inf_loc
[2019-12-07 11:49][2019-12-07 11:49] 000000316 _____ () 9D6CE702E9BD0413FF3C8C2BF43543B7 [File is digitally signed]

C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\SAntivirusService.exe.3900.dmp
[2022-02-12 18:44][2022-02-12 18:44] 028296445 _____ () 27EFFED0C856ABCA102DCA58F94D007B [File not signed]

C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\SAntivirusService.exe.3948.dmp
[2022-03-03 00:21][2022-03-03 00:21] 026396832 _____ () 32C604BFD5CA0FEA086D77F3652FC8E7 [File not signed]

C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\SAntivirusService.exe.4204.dmp
[2022-02-27 18:37][2022-02-27 18:37] 028037183 _____ () C8548C85F9B41FCF4E490ABA6111B2E0 [File not signed]

C:\Windows\Prefetch\SANTIVIRUSCLIENT.EXE-40143D30.pf
[2022-03-02 22:22][2022-03-03 02:16] 000045134 _____ () 2EE5BFD542A9910E5DE5F6AC7C8532CC [File not signed]

C:\Windows\Prefetch\SANTIVIRUSSERVICE.EXE-16AB7442.pf
[2022-03-03 00:21][2022-03-03 00:21] 000035017 _____ () 9E059CD531E81503CB87BA6BB16E70DA [File not signed]

C:\Windows\INF\c_fsantivirus.inf
[2019-12-07 11:07][2019-12-07 11:07] 000001168 _____ () C530FABE9B69DAE04AE7BED25E42877C [File is digitally signed]

C:\Windows\INF\c_fsantivirus.PNF
[2022-01-14 00:46][2022-01-14 00:46] 000004644 _____ () 03D34C93240AAAC5850BFC92F7844DD7 [File not signed]

C:\Users\Pancho\AppData\Roaming\santivirusclient\santivirusclientConfig.xml
[2022-01-13 16:55][2022-03-03 02:14] 000001236 _____ () 6DF5CC429D53BD7D56BECC748AC2A32B [File not signed]

C:\Users\Pancho\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\125\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_Digital Communications_SAntivirus_SAntivirusClient_exe
[2022-03-01 01:23][2022-03-01 01:23] 000037014 _____ () EDD4089BBB4CD6821D598F6640B2B5DF [File not signed]

C:\Users\Pancho\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\santivirusclient.exe.log
[2022-03-03 00:22][2022-03-03 00:22] 000001687 _____ () C6A83FC6F8703BA27F6324A6A6E79763 [File not signed]

C:\ProgramData\SAntivirus\b\SAntivirusClient.exe
[2022-01-13 16:55][2022-01-13 16:55] 001132048 _____ (DlGlTAL COMMUNICATIONS INC) EDD563AB3CEE528457F49A162785BB1C [File is digitally signed]

C:\ProgramData\SAntivirus\b\SAntivirusClient.exe.config
[2022-01-13 16:55][2022-01-13 16:55] 000000408 _____ () DD8BD7791066435FC64D1947E31922FD [File not signed]

C:\ProgramData\SAntivirus\b\SAntivirusEngine.dll
[2022-01-13 16:55][2022-01-13 16:55] 001077776 _____ (DlGlTAL COMMUNICATIONS INC) 531C4C0A13092F32905C64BFE044E325 [File is digitally signed]

C:\ProgramData\SAntivirus\b\SAntivirusIC.exe
[2022-01-13 16:55][2022-01-13 16:55] 006941200 _____ (DlGlTAL COMMUNICATIONS INC) 24847EA7FC1F259193FC6BA1D9E10666 [File is digitally signed]

C:\ProgramData\SAntivirus\b\SAntivirusService.exe
[2022-01-13 16:55][2022-01-13 16:55] 000690704 _____ (DlGlTAL COMMUNICATIONS INC) 9278B2B61CF503E85F57CEDBC1FE1436 [File is digitally signed]

C:\ProgramData\SAntivirus\b\SAntivirusService.exe.config
[2022-01-13 16:55][2022-01-13 16:55] 000000408 _____ () DD8BD7791066435FC64D1947E31922FD [File not signed]

C:\ProgramData\SAntivirus\b\SAntivirusShell64_v102232.dll
[2022-01-13 16:55][2022-01-13 16:55] 000187920 _____ (DlGlTAL COMMUNICATIONS INC) 6FFF29E5A168F18EF10E2319EF46AB51 [File is digitally signed]

C:\ProgramData\SAntivirus\b\SAntivirusShell86_v102232.dll
[2022-01-13 16:55][2022-01-13 16:55] 000157712 _____ (DlGlTAL COMMUNICATIONS INC) EEA3F3AB04DD1573B0A9C378385B1148 [File is digitally signed]

C:\ProgramData\SAntivirus\b\SAntivirusUninstaller.exe
[2022-01-13 16:55][2022-01-13 16:55] 001398288 _____ (DlGlTAL COMMUNICATIONS INC) 455368D3E786204BA635B1C746ED7606 [File is digitally signed]

C:\ProgramData\SAntivirus\b\SAntivirusUninstaller.exe.config
[2022-01-13 16:55][2022-01-13 16:55] 000000408 _____ () DD8BD7791066435FC64D1947E31922FD [File not signed]

C:\ProgramData\SAntivirus\b\TASAntivirusKD.sys
[2022-01-13 16:55][2022-01-13 16:55] 000086024 _____ (DlGlTAL COMMUNICATIONS INC) 20C349B1CAFC94F2B49624AAD9193278 [File is digitally signed]

C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusClient.exe
[2022-01-13 16:55][2022-01-13 16:55] 001132048 _____ (DlGlTAL COMMUNICATIONS INC) EDD563AB3CEE528457F49A162785BB1C [File is digitally signed]

C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusClient.exe.config
[2022-01-13 16:55][2022-01-13 16:55] 000000408 _____ () DD8BD7791066435FC64D1947E31922FD [File not signed]

C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusEngine.dll
[2022-01-13 16:55][2022-01-13 16:55] 001077776 _____ (DlGlTAL COMMUNICATIONS INC) 531C4C0A13092F32905C64BFE044E325 [File is digitally signed]

C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusIC.config
[2022-01-13 16:55][2022-03-03 15:18] 000000001 _____ () C4CA4238A0B923820DCC509A6F75849B [File not signed]

C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusIC.exe
[2022-01-13 16:55][2022-01-13 16:55] 006941200 _____ (DlGlTAL COMMUNICATIONS INC) 24847EA7FC1F259193FC6BA1D9E10666 [File is digitally signed]

C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusService.config
[2022-01-13 16:55][2022-03-03 15:17] 000005280 _____ () 775077B62D6F4E7755DC9FB8BA68F051 [File not signed]

C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusService.exe
[2022-01-13 16:55][2022-01-13 16:55] 000690704 _____ (DlGlTAL COMMUNICATIONS INC) 9278B2B61CF503E85F57CEDBC1FE1436 [File is digitally signed]

C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusService.exe.config
[2022-01-13 16:55][2022-01-13 16:55] 000000408 _____ () DD8BD7791066435FC64D1947E31922FD [File not signed]

C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusShell64_v102232.dll
[2022-01-13 16:55][2022-01-13 16:55] 000187920 _____ (DlGlTAL COMMUNICATIONS INC) 6FFF29E5A168F18EF10E2319EF46AB51 [File is digitally signed]

C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusShell86_v102232.dll
[2022-01-13 16:55][2022-01-13 16:55] 000157712 _____ (DlGlTAL COMMUNICATIONS INC) EEA3F3AB04DD1573B0A9C378385B1148 [File is digitally signed]

C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusUninstaller.exe
[2022-01-13 16:55][2022-01-13 16:55] 001398288 _____ (DlGlTAL COMMUNICATIONS INC) 455368D3E786204BA635B1C746ED7606 [File is digitally signed]

C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusUninstaller.exe.config
[2022-01-13 16:55][2022-01-13 16:55] 000000408 _____ () DD8BD7791066435FC64D1947E31922FD [File not signed]

C:\Program Files (x86)\Digital Communications\SAntivirus\TASAntivirusKD.sys
[2022-01-13 16:55][2022-01-13 16:55] 000086024 _____ (DlGlTAL COMMUNICATIONS INC) 20C349B1CAFC94F2B49624AAD9193278 [File is digitally signed]

folder:
========
2019-12-07 11:49 - 2019-12-07 11:49 _____ C:\Windows\WinSxS\amd64_c_fsantivirus.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_e8a3ad9373ab26d0
2019-12-07 11:07 - 2019-12-07 11:31 _____ C:\Windows\WinSxS\amd64_dual_c_fsantivirus.inf_31bf3856ad364e35_10.0.19041.1_none_8d76b37cccda75a1
2019-12-07 11:13 - 2019-12-07 11:13 _____ C:\Windows\System32\DriverStore\FileRepository\c_fsantivirus.inf_amd64_632d2ac0d68cf3ed
2022-01-13 16:55 - 2022-01-13 16:55 _____ C:\Users\Pancho\AppData\Roaming\santivirusclient
2022-02-27 19:00 - 2022-02-27 19:00 _____ C:\Users\Pancho\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\360 Total Security-27022022-190044
2022-01-13 17:16 - 2022-01-13 17:16 _____ C:\Users\Pancho\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\SAntivirus Realtime Protection Lite-13012022-171621
2022-01-13 16:55 - 2022-01-13 16:55 _____ C:\ProgramData\SAntivirus
2022-03-03 00:21 - 2022-03-03 00:21 ____C C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_SAntivirusServic_9456866a2cc78cc8ac54ffe46a5b4350d7fdb8_b53eb8a5_1179d8c6-accf-40e6-830e-e9052d597793
2022-01-13 16:55 - 2022-01-13 16:55 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SAntivirus
2022-01-13 16:55 - 2022-03-03 15:15 _____ C:\Program Files (x86)\Digital Communications\SAntivirus

Registry:
========

===================== Search result for "SAntivirus" ==========

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\{b1d1a169-c54f-4379-81db-bee7d88d7454}]
"c_fsantivirus.inf"=""

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DriverInfFiles\c_fsantivirus.inf]

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DriverInfFiles\c_fsantivirus.inf]
""="c_fsantivirus.inf_amd64_632d2ac0d68cf3ed"

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DriverInfFiles\c_fsantivirus.inf]
"Active"="c_fsantivirus.inf_amd64_632d2ac0d68cf3ed"

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DriverPackages\c_fsantivirus.inf_amd64_632d2ac0d68cf3ed]

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DriverPackages\c_fsantivirus.inf_amd64_632d2ac0d68cf3ed]
""="c_fsantivirus.inf"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION]
"santivirusclient.exe"="11001"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION]
"santivirusclient.vshost.exe"="11001"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SAntivirusService_RASAPI32]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SAntivirusService_RASMANCS]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SAntivirusUninstaller_RASAPI32]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SAntivirusUninstaller_RASMANCS]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_c_fsantivirus.inf.resources_31bf3856ad364e35_en-us_9a8c17af29671973]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_dual_c_fsantivirus.inf_31bf3856ad364e35_none_b570512174d39eea]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\SAntivirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\SAntivirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\SAntivirus]
"ServicePipe"="SAntivirus1"

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION]
"santivirusclient.exe"="11001"

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION]
"santivirusclient.vshost.exe"="11001"

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\SAntivirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\SAntivirus]
"InstallDir"="C:\Program Files (x86)\Digital Communications\SAntivirus"

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\SAntivirusProduct]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{b1d1a169-c54f-4379-81db-bee7d88d7454}]
"ClassDesc"="@c_fsantivirus.inf,%ClassDesc%;FS Anti-virus filters"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\S-1-5-21-176537593-2728283085-4065151155-1001]
"\Device\HarddiskVolume3\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusClient.exe"="0x4211C5D6932ED80100000000000000000000000002000000"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\SAntivirusSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SAntivirusIC]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SAntivirusSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SAntivirusSvc]
"ImagePath"="C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusService.exe"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SAntivirusSvc]
"DisplayName"="SAntivirusSvc"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TASANTIVIRUSKD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TASANTIVIRUSKD]
"ImagePath"="\??\C:\Program Files (x86)\Digital Communications\SAntivirus\TASAntivirusKD.sys"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TASANTIVIRUSKD]
"DisplayName"="SAntivirus Kernel DriverTA"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TASANTIVIRUSKD]
"Group"="SAntivirus Kernel DriverTA"

[HKEY_USERS\S-1-5-21-176537593-2728283085-4065151155-1001\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION]
"santivirusclient.exe"="11001"

[HKEY_USERS\S-1-5-21-176537593-2728283085-4065151155-1001\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION]
"santivirusclient.vshost.exe"="11001"

[HKEY_USERS\S-1-5-21-176537593-2728283085-4065151155-1001\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store]
"C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusUninstaller.exe"="0x5341435001000000000000000700000028000000105615001429160001000000000000000000000A0021000050BB64EDDDACD5010000000000000000050000001000000000000000000000000000000000000000020000002800000000000000000000000000000000000000000000000000000032650000000000000100000001000000"

[HKEY_USERS\S-1-5-21-176537593-2728283085-4065151155-1001\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store]
"C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusIC.exe"="0x534143500100000000000000070000002800000010EA690087326A0001000000000000000000000A7322000050BB64EDDDACD501000000000000000002000000280000000000000000000000000000000000000000000000000000003E000000000000000200000002000000"

[HKEY_USERS\S-1-5-21-176537593-2728283085-4065151155-1001\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store]
"C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusService.exe"="0x5341435001000000000000000700000028000000108A0A003E490B0001000000000000000000000A7522000050BB64EDDDACD5010000000000000000020000002800000000000000000000000082000000000000008000000000000023290000000000000100000001000000010000000400000001000000"

===================== Search result for "360 Total Security" ==========

====== End of Search ======

Само Search.txt ... а основния от фикса - Fixlog.txt , къде е ...? 

Виждате ли за какво става въпрос .....само колко остатъци от това нещо наречено SAntivirus..! 

Fix result of Farbar Recovery Scan Tool (x64) Version: 27-02-2022
Ran by Pancho (03-03-2022 17:52:36) Run:2
Running from C:\Users\Pancho\OneDrive\Работен плот
Loaded Profiles: Pancho
Boot Mode: Normal
==============================================

fixlist content:
*****************
CreateRestorePoint:
CloseProcesses:
(C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusService.exe ->) (Digital Communications Inc -> DlGlTAL COMMUNICATIONS INC) C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusClient.exe
(services.exe ->) (Digital Communications Inc -> DlGlTAL COMMUNICATIONS INC) C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusIC.exe
(services.exe ->) (Digital Communications Inc -> DlGlTAL COMMUNICATIONS INC) C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusService.exe
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-176537593-2728283085-4065151155-1001\...\Run: [Windows Defender] => '% ProgramFiles%  Windows Defender  MSASCui.exe'-runkey (No File)
HKU\S-1-5-21-176537593-2728283085-4065151155-1001\...\MountPoints2: {976dc93c-74a2-11ec-832b-2cf05d810562} - "F:\setup.exe"
GroupPolicy: Restriction ? <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
"SAntivirusIC" => service was unlocked. <==== ATTENTION
R2 SAntivirusIC; C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusIC.exe [6941200 2022-01-13] (Digital Communications Inc -> DlGlTAL COMMUNICATIONS INC) <==== ATTENTION
R2 SAntivirusSvc; C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusService.exe [690704 2022-01-13] (Digital Communications Inc -> DlGlTAL COMMUNICATIONS INC) <==== ATTENTION
R1 TASANTIVIRUSKD; C:\Program Files (x86)\Digital Communications\SAntivirus\TASAntivirusKD.sys [86024 2022-01-13] (Digital Communications Inc -> DlGlTAL COMMUNICATIONS INC) <==== ATTENTION
HKLM\...\.scr:  =>  <==== ATTENTION
FirewallRules: [{A10D29EB-4836-4F32-9AE3-1F3D24645E97}] => (Block) powershell.exe => No File
FirewallRules: [{DF70BC14-8A16-48DD-BD7D-1F437E606307}] => (Block) powershell.exe => No File
C:\Program Files (x86)\Digital Communications\SAntivirus
CMD: netsh int ip reset
CMD: ipconfig /flushDNS
C:\Windows\Temp\*.*
C:\WINDOWS\system32\*.tmp
C:\WINDOWS\syswow64\*.tmp
Hosts:
Removeproxy:
EmptyTemp:
Reboot:

*****************

Restore point was successfully created.
Processes closed successfully.
(C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusService.exe ->) (Digital Communications Inc -> DlGlTAL COMMUNICATIONS INC) C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusClient.exe => Error: No automatic fix found for this entry.
C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusIC.exe => Could not close process
C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusService.exe => Could not close process
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender => could not remove, key could be protected
"HKU\S-1-5-21-176537593-2728283085-4065151155-1001\Software\Microsoft\Windows\CurrentVersion\Run\\Windows Defender" => not found
HKU\S-1-5-21-176537593-2728283085-4065151155-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{976dc93c-74a2-11ec-832b-2cf05d810562} => removed successfully
C:\Windows\system32\GroupPolicy\Machine => moved successfully
C:\Windows\system32\GroupPolicy\GPT.ini => moved successfully
"C:\ProgramData\NTUSER.pol" => not found
"SAntivirusIC" => service was unlocked. <==== ATTENTION => Error: No automatic fix found for this entry.
SAntivirusIC => Unable to stop service.
HKLM\System\CurrentControlSet\Services\SAntivirusIC => could not remove, key could be protected
SAntivirusSvc => Unable to stop service.
HKLM\System\CurrentControlSet\Services\SAntivirusSvc => could not remove, key could be protected
TASANTIVIRUSKD => Unable to stop service.
HKLM\System\CurrentControlSet\Services\TASANTIVIRUSKD => could not remove, key could be protected
HKLM\Software\Classes\.scr\\"Default"="scrfile" => value restored successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{A10D29EB-4836-4F32-9AE3-1F3D24645E97}" => not found
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{DF70BC14-8A16-48DD-BD7D-1F437E606307}" => not found

"C:\Program Files (x86)\Digital Communications\SAntivirus" folder move:

Could not move "C:\Program Files (x86)\Digital Communications\SAntivirus" => Scheduled to move on reboot.

========= netsh int ip reset =========

Resetting Compartment Forwarding, OK!
Resetting Compartment, OK!
Resetting Control Protocol, OK!
Resetting Echo Sequence Request, OK!
Resetting Global, OK!
Resetting Interface, OK!
Resetting Anycast Address, OK!
Resetting Multicast Address, OK!
Resetting Unicast Address, OK!
Resetting Neighbor, OK!
Resetting Path, OK!
Resetting Potential, OK!
Resetting Prefix Policy, OK!
Resetting Proxy Neighbor, OK!
Resetting Route, OK!
Resetting Site Prefix, OK!
Resetting Subinterface, OK!
Resetting Wakeup Pattern, OK!
Resetting Resolve Neighbor, OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , failed.
Access is denied.

Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Restart the computer to complete this action.

========= End of CMD: =========

========= ipconfig /flushDNS =========

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========

=========== "C:\Windows\Temp\*.*" ==========

C:\Windows\Temp\FXSAPIDebugLogFile.txt => moved successfully
C:\Windows\Temp\FXSTIFFDebugLogFile.txt => moved successfully
C:\Windows\Temp\MpCmdRun.log => moved successfully
C:\Windows\Temp\MpSigStub.log => moved successfully
C:\Windows\Temp\Tmp1947.tmp => moved successfully
C:\Windows\Temp\Tmp253F.tmp => moved successfully
C:\Windows\Temp\Tmp4936.tmp => moved successfully
C:\Windows\Temp\Tmp4D94.tmp => moved successfully
C:\Windows\Temp\Tmp668F.tmp => moved successfully
C:\Windows\Temp\Tmp6690.tmp => moved successfully
C:\Windows\Temp\Tmp6734.tmp => moved successfully
C:\Windows\Temp\Tmp6735.tmp => moved successfully
C:\Windows\Temp\Tmp6766.tmp => moved successfully
C:\Windows\Temp\Tmp67C7.tmp => moved successfully
C:\Windows\Temp\Tmp67C8.tmp => moved successfully
C:\Windows\Temp\Tmp67D9.tmp => moved successfully
C:\Windows\Temp\Tmp685F.tmp => moved successfully
C:\Windows\Temp\Tmp6E49.tmp => moved successfully
C:\Windows\Temp\Tmp6E79.tmp => moved successfully
C:\Windows\Temp\Tmp6EF1.tmp => moved successfully
C:\Windows\Temp\Tmp6F01.tmp => moved successfully
C:\Windows\Temp\Tmp6F22.tmp => moved successfully
C:\Windows\Temp\Tmp6F43.tmp => moved successfully
C:\Windows\Temp\Tmp6F44.tmp => moved successfully
C:\Windows\Temp\Tmp6F75.tmp => moved successfully
C:\Windows\Temp\Tmp71A0.tmp => moved successfully
C:\Windows\Temp\Tmp8834.tmp => moved successfully
C:\Windows\Temp\Tmp90C0.tmp => moved successfully
C:\Windows\Temp\Tmp97F.tmp => moved successfully
C:\Windows\Temp\Tmp990D.tmp => moved successfully
C:\Windows\Temp\Tmp99EE.tmp => moved successfully
C:\Windows\Temp\Tmp99FF.tmp => moved successfully
C:\Windows\Temp\Tmp9AEA.tmp => moved successfully
C:\Windows\Temp\Tmp9B69.tmp => moved successfully
C:\Windows\Temp\TmpA13A.tmp => moved successfully
C:\Windows\Temp\TmpA16A.tmp => moved successfully
C:\Windows\Temp\TmpA1C2.tmp => moved successfully
C:\Windows\Temp\TmpA1D2.tmp => moved successfully
C:\Windows\Temp\TmpA203.tmp => moved successfully
C:\Windows\Temp\TmpA224.tmp => moved successfully
C:\Windows\Temp\TmpA225.tmp => moved successfully
C:\Windows\Temp\TmpA246.tmp => moved successfully
C:\Windows\Temp\TmpA5D.tmp => moved successfully
C:\Windows\Temp\TmpAB5.tmp => moved successfully
C:\Windows\Temp\TmpAD01.tmp => moved successfully
C:\Windows\Temp\TmpCC64.tmp => moved successfully
C:\Windows\Temp\TmpCC84.tmp => moved successfully
C:\Windows\Temp\TmpCCE4.tmp => moved successfully
C:\Windows\Temp\TmpCD18.tmp => moved successfully
C:\Windows\Temp\TmpCD4B.tmp => moved successfully
C:\Windows\Temp\TmpCDBB.tmp => moved successfully
C:\Windows\Temp\TmpCDBC.tmp => moved successfully
C:\Windows\Temp\TmpCDDD.tmp => moved successfully
C:\Windows\Temp\TmpCFF1.tmp => moved successfully
C:\Windows\Temp\TmpD3C4.tmp => moved successfully
C:\Windows\Temp\TmpE013.tmp => moved successfully
C:\Windows\Temp\TmpE0C2.tmp => moved successfully
C:\Windows\Temp\TmpE1C0.tmp => moved successfully
C:\Windows\Temp\TmpE422.tmp => moved successfully
C:\Windows\Temp\TmpE470.tmp => moved successfully
C:\Windows\Temp\TmpE576.tmp => moved successfully
C:\Windows\Temp\TmpE5B7.tmp => moved successfully
C:\Windows\Temp\TmpE5B9.tmp => moved successfully
C:\Windows\Temp\TmpE5D9.tmp => moved successfully
C:\Windows\Temp\TmpEA02.tmp => moved successfully
C:\Windows\Temp\TmpEA31.tmp => moved successfully
C:\Windows\Temp\TmpEAB8.tmp => moved successfully
C:\Windows\Temp\TmpEAC9.tmp => moved successfully
C:\Windows\Temp\TmpEAEA.tmp => moved successfully
C:\Windows\Temp\TmpEAF6.tmp => moved successfully
C:\Windows\Temp\TmpEB0B.tmp => moved successfully
C:\Windows\Temp\TmpEB0C.tmp => moved successfully

========= End -> "C:\Windows\Temp\*.*" ========

=========== "C:\WINDOWS\system32\*.tmp" ==========

not found

========= End -> "C:\WINDOWS\system32\*.tmp" ========

=========== "C:\WINDOWS\syswow64\*.tmp" ==========

not found

========= End -> "C:\WINDOWS\syswow64\*.tmp" ========

C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.

========= RemoveProxy: =========

"HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => removed successfully

========= End of RemoveProxy: =========

=========== EmptyTemp: ==========

BITS transfer queue => 786432 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 43349143 B
Java, Flash, Steam htmlcache => 0 B
Windows/system/drivers => 0 B
Edge => 0 B
Firefox => 680958073 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 0 B
NetworkService => 13114 B
Pancho => 54645512 B

RecycleBin => 220113 B
EmptyTemp: => 743.8 MB temporary data Removed.

================================

Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 03-03-2022 17:54:08)

C:\Program Files (x86)\Digital Communications\SAntivirus => Could not move

Result of scheduled keys to remove after reboot:

HKLM\SOFTWARE\Policies\Microsoft\Windows Defender => removed successfully
HKLM\System\CurrentControlSet\Services\SAntivirusIC => could not remove, key could be protected
HKLM\System\CurrentControlSet\Services\SAntivirusSvc => could not remove, key could be protected
HKLM\System\CurrentControlSet\Services\TASANTIVIRUSKD => could not remove, key could be protected

==== End of Fixlog 17:54:21 ====

Мммм , няма да стане така..! Голяма напаст е това ...! Трябва да бъде премахната в безопасен режим.Да направим така:

Стартирайте Malwarebytes от безопасен режим с работа в мрежа  (Run Malwarebytes from Safe Mode with Networking )

Първо:

Стартирайте в безопасен режим с работа в мрежа:

• Рестартирайте компютъра си.

How to Start Windows 10 in Safe Mode with Networking (bleepingcomputer.com)

• Веднага започнете да натискате клавиша F8 веднъж в секунда, докато се появи менюто Advanced Boot Menu (Разширени опции за стартиране) .
• Изберете опцията за безопасен режим с работа в мрежа с помощта на клавишите със стрелки.
• След това натиснете Enter на клавиатурата си, за да стартирате безопасен режим.
• Ако бъдете подканени да изберете потребителски акаунт за влизане, щракнете върху нормалното си потребителско име (не Администратор освен ако това не е нормалния ви потребителски акаунт), за да влезете в Windows

 

След това:

Моля, изтеглете Malwarebytes for Windows на вашия работен плот.

• Щракнете двукратно върху MBSetup.exe и следвайте подканите, за да инсталирате програмата.
• Когато инсталацията на Malwarebytes за Windows завърши, програмата се отваря на екрана Добре дошли в Malwarebytes.
• Кликнете върху бутона Първи стъпки (Get started)
• Щракнете върху Сканиране (Scan) за да започнете Сканиране на заплахи (Threat Scan).
• Когато сканирането приключи, кликнете върху Карантина ( Quarantine), за да премахнете намерените заплахи.
• след като карантината приключи, щракнете върху бутона Преглед на отчета, След това щракнете върху падащото меню Експортиране, след това бутона Експортиране в TXT и запазете файла като текстов файл на вашия работен плот или друго място, което можете да намерите и Прикачете този дневник към следващия си отговор.
• Ако компютърът се рестартира на етап карантиниране, можете да получите достъп до регистрационните файлове от историята на откриване, а след това раздела История. Маркирайте най-новото сканиране и щракнете двукратно, за да го отворите. След това щракнете върху падащото меню Експортиране, след това върху бутона Експортиране в TXT и запазете файла като текстов файл на вашия работен плот или на друго място, което можете да намерите и прикачите към този дневник при следващия си отговор.
• Рестартирайте системата обратно в нормален режим.

 

Malwarebytes
www.malwarebytes.com

-Детайли за регистъра-
Дата на сканиране: 3.03.22 г.
Час на сканиране: 18:53 ч.
Файл на регистъра: 79646bd4-9b12-11ec-b2bc-2cf05d810562.json

-Информация за софтуера-
Версия: 4.5.5.175
Версия на компонентите: 1.0.1621
Актуализирай версията на пакета: 1.0.51797
Лиценз: Пробен период

-Системна информация-
OS: Windows 10 (Build 19044.1566)
CPU: x64
Файлова система: NTFS
Потребител: Pancho\Pancho

-Резюме на сканирането-
Тип сканиране: Сканиране за заплахи
Сканирането е стартирано от: Ръчно
Резултат: Завършено
Сканирани обекти: 288254
Открити заплахи: 29
Заплахи под карантина: 29
Изтекло време: 1 мин, 0 сек

-Опции за сканиране-
Памет: Разрешено
Стартиране: Разрешено
Файлова система: Разрешено
Архиви: Разрешено
руткитове: Забранено
Евристика: Разрешено
PUP: Открий
PUM: Открий

-Детайли за сканирането-
Процес: 0
(Не бяха открити зловредни елементи)

Модул: 0
(Не бяха открити зловредни елементи)

Ключ на регистъра: 12
PUP.Optional.Segurazo, HKLM\SOFTWARE\MICROSOFT\WINDOWS\SAntivirus, Под карантина, 640, 783948, 1.0.51797, , ame, , ,
PUP.Optional.Segurazo, HKLM\SOFTWARE\WOW6432NODE\SAntivirus, Под карантина, 640, 783949, 1.0.51797, , ame, , ,
PUP.Optional.Segurazo, HKLM\SOFTWARE\WOW6432NODE\SAntivirusProduct, Под карантина, 640, 783951, 1.0.51797, , ame, , ,
PUP.Optional.Segurazo, HKLM\SOFTWARE\SAntivirus, Под карантина, 640, 783949, 1.0.51797, , ame, , ,
PUP.Optional.Segurazo, HKLM\SOFTWARE\SegOption, Под карантина, 640, 757809, 1.0.51797, , ame, , ,
PUP.Optional.Segurazo, HKLM\SOFTWARE\MICROSOFT\TRACING\SAntivirusService_RASAPI32, Под карантина, 640, 783947, 1.0.51797, , ame, , ,
PUP.Optional.Segurazo, HKLM\SOFTWARE\MICROSOFT\TRACING\SAntivirusService_RASMANCS, Под карантина, 640, 783947, 1.0.51797, , ame, , ,
PUP.Optional.Segurazo, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SAntivirusIC, Под карантина, 640, 783952, 1.0.51797, , ame, , ,
PUP.Optional.Segurazo, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SAntivirusSvc, Под карантина, 640, 783954, 1.0.51797, , ame, , ,
PUP.Optional.Segurazo, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TASANTIVIRUSKD, Под карантина, 640, 1012991, , , , , ,
Adware.SpecialSearchOffer, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\NymphwellDadapy, Под карантина, 503, 1009509, , , , , ,
PUP.Optional.BundleInstaller, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\uTorrent, Под карантина, 508, 963173, , , , , ,

Стойност на регистъра: 1
PUP.Optional.BundleInstaller, HKU\S-1-5-21-176537593-2728283085-4065151155-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|uTorrent, Под карантина, 508, 963173, , , , , ,

Данни на регистъра: 0
(Не бяха открити зловредни елементи)

Поток данни: 0
(Не бяха открити зловредни елементи)

Папка: 3
PUP.Optional.Segurazo, C:\PROGRAMDATA\SANTIVIRUS, Под карантина, 640, 783940, 1.0.51797, , ame, , ,
PUP.Optional.Segurazo, C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\SANTIVIRUS, Под карантина, 640, 788609, 1.0.51797, , ame, , ,
PUP.Optional.Segurazo, C:\USERS\PANCHO\APPDATA\ROAMING\SANTIVIRUSCLIENT, Под карантина, 640, 788610, 1.0.51797, , ame, , ,

Файл: 13
PUP.Optional.Segurazo, C:\PROGRAM FILES (X86)\DIGITAL COMMUNICATIONS\SANTIVIRUS\SANTIVIRUSIC.EXE, Под карантина, 640, 783952, , , , , 24847EA7FC1F259193FC6BA1D9E10666, 5D08C0FBC5641ECF5AA5DFF067FE86BF0D3C6B477C803FD44589268B435D1C9A
PUP.Optional.Segurazo, C:\PROGRAM FILES (X86)\DIGITAL COMMUNICATIONS\SANTIVIRUS\SANTIVIRUSSERVICE.EXE, Под карантина, 640, 783954, , , , , 9278B2B61CF503E85F57CEDBC1FE1436, 284A426B3CFD7C1C691BA3352AA4E0B1D04E7E81DA2197C12522E4874DCCF8AD
PUP.Optional.Segurazo, C:\PROGRAM FILES (X86)\DIGITAL COMMUNICATIONS\SANTIVIRUS\TASANTIVIRUSKD.SYS, Под карантина, 640, 1012991, 1.0.51797, , ame, , 20C349B1CAFC94F2B49624AAD9193278, 03FFEBE34198E13525575386D5B5DD464211EF5D6FFBFE62007A3A58AC084165
Adware.SpecialSearchOffer, C:\PROGRAM FILES (X86)\NYMPHWELLDADAPY\NYMPHWELLDADAPY.EXE, Под карантина, 503, 1009509, 1.0.51797, , ame, , 00CEB283F90EAAF07F268D0EAE068523, 54B1CF1A3B48C3D3EBCF289EF8843E26C7EDD571AA0721029145CF6CCFBAB601
PUP.Optional.BundleInstaller, C:\DOCUMENTS AND SETTINGS\PUBLIC\Desktop\µTorrent.lnk, Под карантина, 508, 963173, , , , , 0D7EAF2BD97B43896B676F19E11DCF95, 7F249FF3C972098DBFC44946BE93141D1C11B75371612BF0248C03E46E38BB3D
PUP.Optional.BundleInstaller, C:\PROGRAMDATA\Microsoft\Windows\Start Menu\µTorrent.lnk, Под карантина, 508, 963173, , , , , D5A9F4A8C7E505785F9A6D8F8CE8519A, 029415884AB1AC0E8CCE3D036193DE71137E7E0E88C56DA96AA939C4B37A88DF
PUP.Optional.BundleInstaller, C:\USERS\PANCHO\APPDATA\ROAMING\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk, Под карантина, 508, 963173, , , , , 479C64CB95801F157E4E01D2CE1781F6, 3E7BAC8D208C80AE0BB94CC74529598AEB2B6E5A3B06F11FA8B9582FC91F197E
PUP.Optional.BundleInstaller, C:\PROGRAM FILES (X86)\UTORRENT\UTORRENT.EXE, Под карантина, 508, 963173, 1.0.51797, , ame, , 22DA0DDAF1BF9E0FB5C705319024429B, EC2C086FF784B06E4FF05243164DDB768B81EE32096AFED6D5E574FF350B619E
PUP.Optional.Segurazo, C:\PROGRAM FILES (X86)\DIGITAL COMMUNICATIONS\SANTIVIRUS\SANTIVIRUSCLIENT.EXE, Под карантина, 640, 1012991, 1.0.51797, , ame, , EDD563AB3CEE528457F49A162785BB1C, CB6FF55C40C6566B19F1505E5D9820E96DAA62F2895DD5C047E2D904D5E858E6
PUP.Optional.Segurazo, C:\PROGRAM FILES (X86)\DIGITAL COMMUNICATIONS\SANTIVIRUS\SANTIVIRUSSHELL64_V102232.DLL, Под карантина, 640, 1012991, 1.0.51797, , ame, , 6FFF29E5A168F18EF10E2319EF46AB51, 0A56023CC8D185134DF79D848D7296F2F71E755E2E8920204300511F716DB20D
PUP.Optional.Segurazo, C:\PROGRAM FILES (X86)\DIGITAL COMMUNICATIONS\SANTIVIRUS\SANTIVIRUSENGINE.DLL, Под карантина, 640, 1012991, 1.0.51797, , ame, , 531C4C0A13092F32905C64BFE044E325, F73601A2CAECFBE47C27441DBE1067E09FD092041FC8E3F8371F025BF48EA1E6
PUP.Optional.Segurazo, C:\PROGRAM FILES (X86)\DIGITAL COMMUNICATIONS\SANTIVIRUS\SANTIVIRUSUNINSTALLER.EXE, Под карантина, 640, 1012991, 1.0.51797, , ame, , 455368D3E786204BA635B1C746ED7606, FF9163E36A908B9D181E049D09A1ED4A1EC5C2B7DE585FAC110AA3E8E16BD513
PUP.Optional.Segurazo, C:\PROGRAM FILES (X86)\DIGITAL COMMUNICATIONS\SANTIVIRUS\SANTIVIRUSSHELL86_V102232.DLL, Под карантина, 640, 1012991, 1.0.51797, , ame, , EEA3F3AB04DD1573B0A9C378385B1148, 6D8791D8B5EDC2EF6C82C452A1E7C077EB668854ACD9D007303AC92BB56FD659

Физически сектор: 0
(Не бяха открити зловредни елементи)

WMI: 0
(Не бяха открити зловредни елементи)

(end)

Да изляза ли от безопасен режим?

преди 1 минута, pancho1960 написа:

Да изляза ли от безопасен режим?

Да ...! Спипахме я тази гад..!  

Но войната не е свършила....Моля за свежо сканиране с:

FRST сканиране

    Щракнете двукратно върху FRST.exe / FRST64.exe, за да го стартирате.
    Натиснете бутона за  сканиране.
    Когато приключи, той ще създаде  два лог файла с името FRST.txt и Addition.txt, в същата директория, от която е стартиран инструментът.
    Моля, копирайте и поставете двата файла в следващия си отговор.

 

След това:

• Копирайте/поставете следното в полето Search:

SearchAll: SAntivirus;360 Total Security;AviSynth

• Щракнете върху бутона Search Files
• Когато приключите, щракнете върху OK и на вашия работен плот ще се отвори документ Search.txt
• Моля, копирайте и поставете съдържанието му във вашия отговор.

Забележка:  Ако файла е много голям и не може да се публикува във форума , архивирайте и качете отчета на външен сървър (например File Dropper , DOX.bg   и включете връзката за изтегляне във вашия следващ отговор.

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 27-02-2022
Ran by Pancho (administrator) on PANCHO (Micro-Star International Co., Ltd. MS-7B89) (03-03-2022 19:15:55)
Running from C:\Users\Pancho\OneDrive\Работен плот
Loaded Profiles: Pancho
Platform: Microsoft Windows 10 Pro Version 21H2 19044.1566 (X64) Language: Английски (Съединени щати) -> Български (България)
Default browser: FF
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe ->) (Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Eclipse.org Foundation, Inc. -> Temurin) C:\Program Files (x86)\Universal Media Server\jre8\bin\javaw.exe
(explorer.exe ->) (PARAMOUNT SOFTWARE UK LIMITED -> Paramount Software UK Ltd) C:\Program Files\Macrium\Common\ReflectMonitor.exe
(explorer.exe ->) (PARAMOUNT SOFTWARE UK LIMITED -> Paramount Software UK Ltd) C:\Program Files\Macrium\Common\ReflectUI.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe <8>
(Nvidia Corporation -> Node.js) C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe
(services.exe ->) (Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(services.exe ->) (Nvidia Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe <3>
(services.exe ->) (Nvidia Corporation -> NVIDIA Corporation) C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_3b12ac0f95b18b9d\Display.NvContainer\NVDisplay.Container.exe <2>
(services.exe ->) (PARAMOUNT SOFTWARE UK LIMITED -> Paramount Software UK Ltd) C:\Program Files\Macrium\Common\MacriumService.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe

==================== Registry (Whitelisted) ===================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Reflect UI] => C:\Program Files\Macrium\Common\ReflectUI.exe [9336528 2022-02-15] (PARAMOUNT SOFTWARE UK LIMITED -> Paramount Software UK Ltd)
HKLM\...\Policies\Explorer: [NoAutorun] 1
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-176537593-2728283085-4065151155-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-176537593-2728283085-4065151155-1001\...\Policies\Explorer: [NoAutorun] 1
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Universal Media Server.lnk [2022-01-13]
ShortcutTarget: Universal Media Server.lnk -> C:\Program Files (x86)\Universal Media Server\UMS.exe (Universal Media Server) [File not signed]

==================== Scheduled Tasks (Whitelisted) ============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {042BED6D-2A5A-4D59-92C6-2BDC651E7B16} - System32\Tasks\NvTmRep_CrashReport3_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvBackend\NvTmRep.exe [1656320 2022-01-28] (Nvidia Corporation -> NVIDIA Corporation)
Task: {0BAB7644-FFA1-4E37-8ED8-407F4602162B} - System32\Tasks\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\default-browser-agent.exe do-task "308046B0AF4A39CB"
Task: {14392B30-5500-4F1C-9410-ADB797A07440} - System32\Tasks\NvTmRep_CrashReport1_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvBackend\NvTmRep.exe [1656320 2022-01-28] (Nvidia Corporation -> NVIDIA Corporation)
Task: {2B27EA45-7EFA-4ECF-AE98-0573AC3059E0} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [906752 2022-01-28] (Nvidia Corporation -> NVIDIA Corporation)
Task: {48E5C71B-F87B-43BA-AE6C-387D1BE5C1E0} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [906752 2022-01-28] (Nvidia Corporation -> NVIDIA Corporation)
Task: {51BB9AC7-9B1B-40AF-AA7A-613779803F0C} - System32\Tasks\Mozilla\Firefox Background Update 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\firefox.exe --MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask backgroundupdate
Task: {890B7231-4947-4FC4-AF0A-552D858109C7} - System32\Tasks\NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA GeForce Experience.exe [3339472 2022-02-03] (Nvidia Corporation -> NVIDIA Corporation)
Task: {A96D59CC-0E8D-4E02-BE48-610EE138FB1D} - System32\Tasks\NvTmRep_CrashReport2_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvBackend\NvTmRep.exe [1656320 2022-01-28] (Nvidia Corporation -> NVIDIA Corporation)
Task: {AC9A99FC-4672-4C97-8F38-5A1C30269770} - System32\Tasks\NvTmRep_CrashReport4_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvBackend\NvTmRep.exe [1656320 2022-01-28] (Nvidia Corporation -> NVIDIA Corporation)
Task: {E0D9E82A-DEE2-4177-A80F-C12CA454E8E0} - System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe [647376 2022-01-28] (Nvidia Corporation -> NVIDIA Corporation)
Task: {E6254BE0-B6D8-4F6B-B56A-FA14E8779B7C} - System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [1009872 2021-11-02] (Nvidia Corporation -> NVIDIA Corporation) -> -d "C:\Program Files\NVIDIA Corporation\NvDriverUpdateCheck" -l 3 -f C:\ProgramData\NVIDIA\NvContainerDriverUpdateCheck.log

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\CreateExplorerShellUnelevatedTask.job => C:\Windows\explorer.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.100.1
Tcpip\..\Interfaces\{ca2ec9f2-e047-4daf-b11d-6bac02f97cf9}: [DhcpNameServer] 192.168.100.1

Edge:
=======
Edge Profile: C:\Users\Pancho\AppData\Local\Microsoft\Edge\User Data\Default [2022-03-03]
Edge Extension: (Malwarebytes Browser Guard) - C:\Users\Pancho\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ihcjicgdanjaechkgeegckofjjedodee [2022-03-03]
Edge HKLM-x32\...\Edge\Extension: [ihcjicgdanjaechkgeegckofjjedodee]

FireFox:
========
FF DefaultProfile: tx3x9c32.default
FF ProfilePath: C:\Users\Pancho\AppData\Roaming\Mozilla\Firefox\Profiles\tx3x9c32.default [2022-01-13]
FF ProfilePath: C:\Users\Pancho\AppData\Roaming\Mozilla\Firefox\Profiles\2ql37ue6.default-release [2022-03-03]
FF Homepage: Mozilla\Firefox\Profiles\2ql37ue6.default-release -> hxxps://homepage.bg/|hxxps://***/bananas
FF Session Restore: Mozilla\Firefox\Profiles\2ql37ue6.default-release -> is enabled.
FF Notifications: Mozilla\Firefox\Profiles\2ql37ue6.default-release -> hxxps://www.kaldata.com
FF Extension: (АБВ Уведомител) - C:\Users\Pancho\AppData\Roaming\Mozilla\Firefox\Profiles\2ql37ue6.default-release\Extensions\[email protected] [2022-01-12]
FF Extension: (AdBlocker Ultimate) - C:\Users\Pancho\AppData\Roaming\Mozilla\Firefox\Profiles\2ql37ue6.default-release\Extensions\[email protected] [2022-01-12]
FF Extension: (Fire Fox, The Anime Girl: Nebula Space [Red]) - C:\Users\Pancho\AppData\Roaming\Mozilla\Firefox\Profiles\2ql37ue6.default-release\Extensions\[email protected] [2022-01-12]
FF Extension: (Fire Fox, The Anime Girl: Nebula Space [Blue]) - C:\Users\Pancho\AppData\Roaming\Mozilla\Firefox\Profiles\2ql37ue6.default-release\Extensions\[email protected] [2022-01-12]
FF Extension: (Google Translator for Firefox) - C:\Users\Pancho\AppData\Roaming\Mozilla\Firefox\Profiles\2ql37ue6.default-release\Extensions\[email protected] [2022-01-12]
FF Extension: (theme2) - C:\Users\Pancho\AppData\Roaming\Mozilla\Firefox\Profiles\2ql37ue6.default-release\Extensions\{02326643-97e1-4c77-9c06-d8662ab54ba9}.xpi [2022-01-12]
FF Extension: (FireFox Quantum - Blue) - C:\Users\Pancho\AppData\Roaming\Mozilla\Firefox\Profiles\2ql37ue6.default-release\Extensions\{04d24a4c-761a-4dac-bcf4-d7c6c2bed9ce}.xpi [2022-01-12]
FF Extension: (FIRE2) - C:\Users\Pancho\AppData\Roaming\Mozilla\Firefox\Profiles\2ql37ue6.default-release\Extensions\{38eace05-4183-4109-a66e-63d3998a8c1f}.xpi [2022-01-12]
FF Extension: (Blue Glow Theme) - C:\Users\Pancho\AppData\Roaming\Mozilla\Firefox\Profiles\2ql37ue6.default-release\Extensions\{4dd9d8d5-b091-48e9-a092-74e30d6864f4}.xpi [2022-01-12]
FF Extension: (pink polkadots theme <3) - C:\Users\Pancho\AppData\Roaming\Mozilla\Firefox\Profiles\2ql37ue6.default-release\Extensions\{52cdd758-87e2-43e1-85e9-6361d58a3f9b}.xpi [2022-01-12]
FF Extension: (RED) - C:\Users\Pancho\AppData\Roaming\Mozilla\Firefox\Profiles\2ql37ue6.default-release\Extensions\{5d8f3509-5bf8-4e9a-b374-38b1c3abf1f1}.xpi [2022-01-12]
FF Extension: (Vintage plain ) - C:\Users\Pancho\AppData\Roaming\Mozilla\Firefox\Profiles\2ql37ue6.default-release\Extensions\{62cfd93d-1046-406b-8823-85717ef40b0c}.xpi [2022-01-12]
FF Extension: (ANIMATED  FIREFOX) - C:\Users\Pancho\AppData\Roaming\Mozilla\Firefox\Profiles\2ql37ue6.default-release\Extensions\{68637f4d-f924-4aae-b062-b929b20e5ead}.xpi [2022-01-12]
FF Extension: (YouTube High Definition) - C:\Users\Pancho\AppData\Roaming\Mozilla\Firefox\Profiles\2ql37ue6.default-release\Extensions\{7b1bf0b6-a1b9-42b0-b75d-252036438bdc}.xpi [2022-01-12]
FF Extension: (Purple and Gold) - C:\Users\Pancho\AppData\Roaming\Mozilla\Firefox\Profiles\2ql37ue6.default-release\Extensions\{84de84a5-1a8c-40fe-b138-1aa8a529ca46}.xpi [2022-01-12]
FF Extension: (YouTube Converter Button) - C:\Users\Pancho\AppData\Roaming\Mozilla\Firefox\Profiles\2ql37ue6.default-release\Extensions\{8f4bbf79-5514-4d04-a901-d5fabfe91d73}.xpi [2022-01-12]
FF Extension: (theme) - C:\Users\Pancho\AppData\Roaming\Mozilla\Firefox\Profiles\2ql37ue6.default-release\Extensions\{95f95f17-aa65-4d42-9fce-d73aae667674}.xpi [2022-01-12]
FF Extension: (DarkTheme) - C:\Users\Pancho\AppData\Roaming\Mozilla\Firefox\Profiles\2ql37ue6.default-release\Extensions\{99c277af-d778-4a0b-9faa-b1d8165f0a55}.xpi [2022-01-12]
FF Extension: (Firefox Quantum by M♥Donna) - C:\Users\Pancho\AppData\Roaming\Mozilla\Firefox\Profiles\2ql37ue6.default-release\Extensions\{9e05d9a4-a9ac-48a6-8e0d-e599cbc4498b}.xpi [2022-01-12]
FF Extension: (A Color Within Another Color) - C:\Users\Pancho\AppData\Roaming\Mozilla\Firefox\Profiles\2ql37ue6.default-release\Extensions\{9e420261-1c2f-4eb7-a9f0-dc7292f17459}.xpi [2022-01-12]
FF Extension: (solar system by candelora) - C:\Users\Pancho\AppData\Roaming\Mozilla\Firefox\Profiles\2ql37ue6.default-release\Extensions\{a6237f6d-0674-4dc8-a59f-a010c2758d4c}.xpi [2022-01-12]
FF Extension: (Red Tiles) - C:\Users\Pancho\AppData\Roaming\Mozilla\Firefox\Profiles\2ql37ue6.default-release\Extensions\{a91f90b0-9320-4464-a2d4-3f229c575915}.xpi [2022-01-12]
FF Extension: (Casino Time) - C:\Users\Pancho\AppData\Roaming\Mozilla\Firefox\Profiles\2ql37ue6.default-release\Extensions\{aac9360d-e5f1-4e02-b90f-3cea960f76dc}.xpi [2022-01-12]
FF Extension: (Speed Tweaks) - C:\Users\Pancho\AppData\Roaming\Mozilla\Firefox\Profiles\2ql37ue6.default-release\Extensions\{c541dcb6-72ed-450d-8186-680e9d12b305}.xpi [2022-01-12]
FF Extension: (Adblock Plus — безплатен блокер на реклами) - C:\Users\Pancho\AppData\Roaming\Mozilla\Firefox\Profiles\2ql37ue6.default-release\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2022-01-12]
FF Extension: (Web Apps by 123apps) - C:\Users\Pancho\AppData\Roaming\Mozilla\Firefox\Profiles\2ql37ue6.default-release\Extensions\{e662576a-2f73-4069-bcca-ddf440fea62b}.xpi [2022-01-12]
FF Extension: (Red Firefox Theme) - C:\Users\Pancho\AppData\Roaming\Mozilla\Firefox\Profiles\2ql37ue6.default-release\Extensions\{fa85c84a-45ce-4fe9-96b5-0d0b10cb039c}.xpi [2022-01-12]
FF Extension: (Animated Stars at Night [Blue]) - C:\Users\Pancho\AppData\Roaming\Mozilla\Firefox\Profiles\2ql37ue6.default-release\Extensions\{fde51127-2a91-4ea0-99d3-ea07e8d18726}.xpi [2022-01-12]
FF Plugin: @videolan.org/vlc,version=3.0.10 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2021-06-18] (VideoLAN -> VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.16 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2021-06-18] (VideoLAN -> VideoLAN)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit PDF Reader\plugins\npFoxitReaderPlugin.dll [2021-07-21] (FOXIT SOFTWARE INC. -> Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.cpdf -> C:\Program Files (x86)\Foxit Software\Foxit PDF Reader\plugins\npFoxitReaderPlugin.dll [2021-07-21] (FOXIT SOFTWARE INC. -> Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit PDF Reader\plugins\npFoxitReaderPlugin.dll [2021-07-21] (FOXIT SOFTWARE INC. -> Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit Software\Foxit PDF Reader\plugins\npFoxitReaderPlugin.dll [2021-07-21] (FOXIT SOFTWARE INC. -> Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit Software\Foxit PDF Reader\plugins\npFoxitReaderPlugin.dll [2021-07-21] (FOXIT SOFTWARE INC. -> Foxit Corporation)

Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [ihcjicgdanjaechkgeegckofjjedodee]

==================== Services (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 EasyAntiCheat; C:\Windows\SysWOW64\EasyAntiCheat.exe [383016 2017-07-18] (EasyAntiCheat Oy -> EasyAntiCheat Ltd)
S4 FoxitReaderUpdateService; C:\Program Files (x86)\Foxit Software\Foxit PDF Reader\FoxitPDFReaderUpdateService.exe [2357880 2021-07-21] (FOXIT SOFTWARE INC. -> Foxit Software Inc.)
R2 MacriumService; C:\Program Files\Macrium\Common\MacriumService.exe [10722832 2022-02-15] (PARAMOUNT SOFTWARE UK LIMITED -> Paramount Software UK Ltd)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [8019640 2022-03-03] (Malwarebytes Inc -> Malwarebytes)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [6133448 2022-02-15] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2201.10-0\NisSrv.exe [2909208 2022-02-26] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2201.10-0\MsMpEng.exe [128376 2022-02-26] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 NVDisplay.ContainerLocalSystem; C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_3b12ac0f95b18b9d\Display.NvContainer\NVDisplay.Container.exe -s NVDisplay.ContainerLocalSystem -f %ProgramData%\NVIDIA\NVDisplay.ContainerLocalSystem.log -l 3 -d C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_3b12ac0f95b18b9d\Display.NvContainer\plugins\LocalSystem -r -p 30000 -cfg NVDisplay.ContainerLocalSystem\LocalSystem

===================== Drivers (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 BthA2dp; C:\Windows\System32\drivers\BthA2dp.sys [279040 2021-10-06] (Microsoft Corporation) [File not signed]
S3 dg_ssudbus; C:\Windows\system32\DRIVERS\ssudbus2.sys [160376 2021-10-08] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [160176 2022-03-03] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
S4 IObitUnlocker; C:\Program Files (x86)\IObit\IObit Unlocker\IObitUnlocker.sys [39000 2020-10-10] (IObit CO., LTD -> IObit Information Technology)
R2 MBAMChameleon; C:\Windows\System32\Drivers\MbamChameleon.sys [221096 2022-03-03] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
S0 MbamElam; C:\Windows\System32\DRIVERS\MbamElam.sys [19912 2022-03-03] (Microsoft Windows Early Launch Anti-malware Publisher -> Malwarebytes)
R3 MBAMFarflt; C:\Windows\System32\DRIVERS\farflt.sys [194480 2022-03-03] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R3 MBAMProtection; C:\Windows\system32\DRIVERS\mbam.sys [69040 2022-03-03] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [248992 2022-03-03] (Malwarebytes Inc -> Malwarebytes)
R3 MBAMWebProtection; C:\Windows\system32\DRIVERS\mwac.sys [156792 2022-03-03] (Malwarebytes Inc -> Malwarebytes)
R0 mrcbt; C:\Windows\System32\drivers\mrcbt.sys [101032 2022-03-02] (Paramount Software UK Ltd -> Windows (R) Win 7 DDK provider)
R0 mrigflt; C:\Windows\System32\drivers\mrigflt.sys [74120 2022-02-10] (PARAMOUNT SOFTWARE UK LIMITED -> Windows (R) Win 7 DDK provider)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [48552 2022-01-11] (Microsoft Windows Hardware Compatibility Publisher -> NVIDIA Corporation)
S3 Revoflt; C:\Windows\System32\DRIVERS\revoflt.sys [38400 2020-10-14] (Microsoft Windows Hardware Compatibility Publisher -> VS Revo Group)
S3 ssudmdm; C:\Windows\system32\DRIVERS\ssudmdm.sys [167544 2021-10-08] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
S3 WdBoot; C:\Windows\system32\drivers\wd\WdBoot.sys [48536 2022-02-26] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\wd\WdFilter.sys [438520 2022-02-26] (Microsoft Windows -> Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\drivers\wd\WdNisDrv.sys [90360 2022-02-26] (Microsoft Windows -> Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One month (created) (Whitelisted) =========

(If an entry is included in the fixlist, the file/folder will be moved.)

2022-03-03 19:13 - 2022-03-03 19:13 - 000194480 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
2022-03-03 19:13 - 2022-03-03 19:13 - 000156792 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
2022-03-03 19:13 - 2022-03-03 19:13 - 000069040 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2022-03-03 19:13 - 2022-03-03 19:13 - 000000000 ____D C:\Users\Pancho\AppData\LocalLow\IGDump
2022-03-03 18:52 - 2022-03-03 18:52 - 000000000 ____D C:\Users\Pancho\AppData\Local\mbam
2022-03-03 18:51 - 2022-03-03 19:13 - 000248992 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys
2022-03-03 18:51 - 2022-03-03 18:53 - 000221096 _____ (Malwarebytes) C:\Windows\system32\Drivers\MbamChameleon.sys
2022-03-03 18:51 - 2022-03-03 18:51 - 000160176 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbae64.sys
2022-03-03 18:51 - 2022-03-03 18:51 - 000019912 _____ (Malwarebytes) C:\Windows\system32\Drivers\MbamElam.sys
2022-03-03 18:51 - 2022-03-03 18:51 - 000001993 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes.lnk
2022-03-03 18:51 - 2022-03-03 18:51 - 000000000 ____D C:\ProgramData\Malwarebytes
2022-03-03 18:51 - 2022-03-03 18:51 - 000000000 ____D C:\Program Files\Malwarebytes
2022-03-03 18:45 - 2022-03-03 18:51 - 000297172 _____ C:\Windows\ntbtlog.txt
2022-03-03 18:45 - 2022-03-03 18:45 - 000000214 _____ C:\Windows\Tasks\CreateExplorerShellUnelevatedTask.job
2022-03-02 22:56 - 2022-03-02 22:56 - 000018492 _____ C:\Windows\Macrium Reflect Patch Log.txt
2022-03-02 22:52 - 2022-03-02 22:52 - 000101032 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\mrcbt.sys
2022-03-02 22:52 - 2022-03-02 22:52 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Macrium
2022-03-02 22:52 - 2022-03-02 22:52 - 000000000 ____D C:\Program Files\Macrium
2022-03-02 22:44 - 2022-03-02 23:03 - 000000000 ____D C:\ProgramData\Macrium
2022-03-02 19:48 - 2022-03-03 19:16 - 000000000 ____D C:\FRST
2022-03-01 00:52 - 2022-03-01 00:52 - 000481408 _____ C:\Windows\system32\FNTCACHE.DAT
2022-02-28 10:45 - 2022-03-03 19:13 - 077070336 _____ C:\Windows\system32\config\SOFTWARE
2022-02-28 04:26 - 2022-03-03 02:14 - 000000000 ____D C:\Users\Pancho\AppData\Local\ElevatedDiagnostics
2022-02-27 08:36 - 2022-02-28 10:45 - 000000000 ____D C:\Windows\Microsoft Antimalware
2022-02-26 11:28 - 2022-02-26 11:28 - 000000000 ____D C:\Users\Pancho\AppData\Local\Viber
2022-02-25 17:25 - 2022-02-25 17:25 - 000000000 ____D C:\Users\Pancho\AppData\Roaming\dvdcss
2022-02-22 22:06 - 2022-02-22 22:06 - 000000000 ____D C:\Windows\pss
2022-02-21 22:30 - 2020-11-23 08:22 - 000372224 _____ (EasternGraphics GmbH) C:\Windows\system32\emp.dll
2022-02-21 04:14 - 2022-02-21 21:08 - 000000000 ____D C:\Windows\SysWOW64\directx
2022-02-21 02:13 - 2022-02-20 16:39 - 002653184 _____ (EA PopCap) C:\Windows\SysWOW64\dbdataEA.dll
2022-02-21 02:08 - 2022-02-21 02:08 - 000000000 ____D C:\Windows\SysWOW64\dbdataEA
2022-02-21 01:56 - 2022-02-21 01:56 - 000000000 ____D C:\Users\Pancho\AppData\Local\DBG
2022-02-21 01:48 - 2022-02-20 16:39 - 002653184 _____ (EA PopCap) C:\Windows\system32\dbdataEA.dll
2022-02-21 01:46 - 2022-02-21 01:46 - 000000000 ____D C:\Windows\system32\dbdataEA
2022-02-20 20:57 - 2022-02-21 20:32 - 000000000 ____D C:\Windows\Minidump
2022-02-20 20:55 - 2022-02-26 18:34 - 003517448 _____ (EasyAntiCheat Oy) C:\Windows\system32\Drivers\EasyAntiCheat.sys
2022-02-20 20:55 - 2017-07-18 11:14 - 000383016 _____ (EasyAntiCheat Ltd) C:\Windows\SysWOW64\EasyAntiCheat.exe
2022-02-20 05:50 - 2022-02-20 05:50 - 000000000 ____D C:\Users\Pancho\AppData\Roaming\EasyAntiCheat
2022-02-20 05:49 - 2022-02-20 05:50 - 000000000 ____D C:\Program Files (x86)\EasyAntiCheat
2022-02-17 21:42 - 2022-02-17 21:42 - 000000000 ____D C:\Users\Pancho\AppData\Local\Yandex
2022-02-17 20:19 - 2022-02-18 20:22 - 000000000 ____D C:\Program Files\Mozilla Firefox
2022-02-15 20:11 - 2022-02-15 20:11 - 000195584 _____ C:\Windows\system32\uwfcfgmgmt.dll
2022-02-15 20:10 - 2022-02-15 20:10 - 002260992 _____ C:\Windows\system32\TextInputMethodFormatter.dll
2022-02-15 20:10 - 2022-02-15 20:10 - 002254336 _____ C:\Windows\system32\dwmscene.dll
2022-02-15 20:10 - 2022-02-15 20:10 - 000272896 _____ C:\Windows\system32\TpmTool.exe
2022-02-15 20:10 - 2022-02-15 20:10 - 000223744 _____ C:\Windows\SysWOW64\TpmTool.exe
2022-02-15 20:10 - 2022-02-15 20:10 - 000011821 _____ C:\Windows\system32\DrtmAuthTxt.wim
2022-02-15 19:42 - 2022-02-10 14:55 - 000074120 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\mrigflt.sys
2022-02-14 22:00 - 2022-02-10 20:42 - 001905936 _____ C:\Windows\system32\vulkaninfo-1-999-0-0-0.exe
2022-02-14 22:00 - 2022-02-10 20:42 - 001905936 _____ C:\Windows\system32\vulkaninfo.exe
2022-02-14 22:00 - 2022-02-10 20:42 - 001478416 _____ C:\Windows\SysWOW64\vulkaninfo-1-999-0-0-0.exe
2022-02-14 22:00 - 2022-02-10 20:42 - 001478416 _____ C:\Windows\SysWOW64\vulkaninfo.exe
2022-02-14 22:00 - 2022-02-10 20:42 - 001467840 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2022-02-14 22:00 - 2022-02-10 20:42 - 001432336 _____ C:\Windows\system32\vulkan-1-999-0-0-0.dll
2022-02-14 22:00 - 2022-02-10 20:42 - 001432336 _____ C:\Windows\system32\vulkan-1.dll
2022-02-14 22:00 - 2022-02-10 20:42 - 001209280 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2022-02-14 22:00 - 2022-02-10 20:42 - 001145616 _____ C:\Windows\SysWOW64\vulkan-1-999-0-0-0.dll
2022-02-14 22:00 - 2022-02-10 20:42 - 001145616 _____ C:\Windows\SysWOW64\vulkan-1.dll
2022-02-14 22:00 - 2022-02-10 20:39 - 001531872 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2022-02-14 22:00 - 2022-02-10 20:39 - 001176704 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2022-02-14 22:00 - 2022-02-10 20:39 - 000797112 _____ C:\Windows\system32\nvofapi64.dll
2022-02-14 22:00 - 2022-02-10 20:39 - 000717760 _____ (NVIDIA Corporation) C:\Windows\system32\nvml.dll
2022-02-14 22:00 - 2022-02-10 20:39 - 000636032 _____ C:\Windows\SysWOW64\nvofapi.dll
2022-02-14 22:00 - 2022-02-10 20:38 - 002120320 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2022-02-14 22:00 - 2022-02-10 20:38 - 001602728 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2022-02-14 22:00 - 2022-02-10 20:38 - 000983992 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2022-02-14 22:00 - 2022-02-10 20:38 - 000795584 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2022-02-14 22:00 - 2022-02-10 20:38 - 000711608 _____ (NVIDIA Corporation) C:\Windows\system32\nvidia-smi.exe
2022-02-14 22:00 - 2022-02-10 20:37 - 008612496 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2022-02-14 22:00 - 2022-02-10 20:37 - 007714960 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2022-02-14 22:00 - 2022-02-10 20:37 - 005727376 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2022-02-14 22:00 - 2022-02-10 20:37 - 005099152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2022-02-14 22:00 - 2022-02-10 20:37 - 002935744 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2022-02-14 22:00 - 2022-02-10 20:37 - 000456848 _____ (NVIDIA Corporation) C:\Windows\system32\nvdebugdump.exe
2022-02-14 22:00 - 2022-02-10 20:35 - 000849024 _____ (NVIDIA Corporation) C:\Windows\system32\MCU.exe
2022-02-14 22:00 - 2022-02-10 20:34 - 006461040 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2022-02-14 22:00 - 2022-02-10 08:18 - 000089251 _____ C:\Windows\system32\nvinfo.pb
2022-02-12 21:41 - 2022-02-12 21:41 - 000000000 ____D C:\Users\Pancho\OneDrive\Документи\DyingLight
2022-02-12 19:20 - 2022-02-12 19:20 - 000000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2022-02-12 19:20 - 2021-10-08 11:00 - 000167544 _____ (Samsung Electronics Co., Ltd.) C:\Windows\system32\Drivers\ssudmdm.sys
2022-02-12 19:20 - 2021-10-08 11:00 - 000160376 _____ (Samsung Electronics Co., Ltd.) C:\Windows\system32\Drivers\ssudbus2.sys
2022-02-10 09:42 - 2022-03-03 19:14 - 000000000 ____D C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38
2022-02-08 20:27 - 2022-02-21 22:15 - 000000000 __SHD C:\$360Section
2022-02-01 23:07 - 2022-02-01 23:07 - 000000000 ____D C:\Users\Pancho\OneDrive\Документи\Stranglehold
2022-02-01 23:07 - 2022-02-01 23:07 - 000000000 ____D C:\Users\Pancho\AppData\Local\Midway
2022-02-01 23:02 - 2022-02-01 23:02 - 000000000 ____D C:\Users\Pancho\OneDrive\Документи\Manhunt User Files
2022-02-01 21:54 - 2022-01-28 13:28 - 000040920 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhdap64.dll

==================== One month (modified) ==================

(If an entry is included in the fixlist, the file/folder will be moved.)

2022-03-03 19:13 - 2022-01-14 17:02 - 000000000 ____D C:\ProgramData\NVIDIA
2022-03-03 19:13 - 2022-01-13 23:21 - 000000000 ____D C:\ProgramData\UMS
2022-03-03 19:13 - 2022-01-13 08:45 - 000008192 ___SH C:\DumpStack.log.tmp
2022-03-03 19:13 - 2022-01-13 08:45 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2022-03-03 19:13 - 2022-01-12 23:25 - 000000000 ____D C:\Users\Pancho\AppData\LocalLow\Mozilla
2022-03-03 19:13 - 2019-12-07 11:14 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2022-03-03 19:13 - 2019-12-07 11:03 - 000524288 _____ C:\Windows\system32\config\BBI
2022-03-03 18:55 - 2022-01-14 01:38 - 000000000 ____D C:\Program Files (x86)\uTorrent
2022-03-03 18:55 - 2022-01-13 16:54 - 000000000 ____D C:\Program Files (x86)\NymphwellDadapy
2022-03-03 18:51 - 2019-12-07 11:14 - 000000000 ___HD C:\Windows\ELAMBKUP
2022-03-03 18:49 - 2022-01-12 22:51 - 000795738 _____ C:\Windows\system32\PerfStringBackup.INI
2022-03-03 18:49 - 2019-12-07 11:13 - 000000000 ____D C:\Windows\INF
2022-03-03 18:45 - 2019-12-07 11:14 - 000000000 ___HD C:\Windows\system32\GroupPolicy
2022-03-03 18:35 - 2022-01-13 08:45 - 000000000 ____D C:\Windows\system32\SleepStudy
2022-03-03 18:09 - 2019-12-07 11:14 - 000000000 ____D C:\Windows\AppReadiness
2022-03-03 17:47 - 2022-01-14 01:38 - 000000000 ____D C:\Users\Pancho\AppData\Roaming\uTorrent
2022-03-02 17:27 - 2019-12-07 11:14 - 000000000 ___HD C:\Program Files\WindowsApps
2022-03-01 18:50 - 2022-01-13 21:17 - 000000000 ____D C:\Users\Pancho\AppData\Roaming\vlc
2022-03-01 00:52 - 2022-01-30 21:08 - 000000000 ____D C:\Users\Pancho\AppData\Roaming\ViberPC
2022-03-01 00:49 - 2022-01-13 21:39 - 000000000 ____D C:\Users\Pancho\AppData\Roaming\Wise Disk Cleaner
2022-03-01 00:43 - 2022-01-13 21:39 - 000001289 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Disk Cleaner.lnk
2022-03-01 00:34 - 2022-01-13 17:02 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro
2022-02-28 18:44 - 2019-12-07 11:14 - 000000000 ____D C:\Windows\Registration
2022-02-28 00:43 - 2022-01-12 22:50 - 000000000 ____D C:\Users\Pancho
2022-02-27 23:10 - 2022-01-12 22:51 - 000000000 ____D C:\Users\Pancho\AppData\Local\D3DSCache
2022-02-27 19:05 - 2019-12-07 11:03 - 000032768 _____ C:\Windows\system32\config\ELAM
2022-02-27 18:59 - 2022-01-13 17:30 - 000000000 ____D C:\Users\Pancho\AppData\Roaming\360DesktopLite
2022-02-26 23:51 - 2022-01-13 08:45 - 000002450 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
2022-02-26 22:32 - 2019-12-07 11:03 - 000000000 ____D C:\Windows\CbsTemp
2022-02-26 21:48 - 2022-01-13 08:45 - 000000000 ____D C:\Windows\system32\Drivers\wd
2022-02-26 11:28 - 2022-01-30 21:08 - 000000000 ____D C:\Users\Pancho\OneDrive\Документи\ViberDownloads
2022-02-24 11:46 - 2019-12-07 11:14 - 000000000 ____D C:\Windows\system32\NDF
2022-02-21 03:40 - 2022-01-16 20:49 - 000000000 ____D C:\ProgramData\Package Cache
2022-02-20 05:30 - 2022-01-12 22:51 - 000000000 ____D C:\Users\Pancho\AppData\Local\Packages
2022-02-20 00:13 - 2022-01-12 22:53 - 000000000 ____D C:\Users\Pancho\AppData\Local\PlaceholderTileLogoFolder
2022-02-20 00:13 - 2022-01-12 22:51 - 000000000 ____D C:\ProgramData\Packages
2022-02-18 20:44 - 2022-01-13 00:12 - 000000000 ____D C:\Program Files\Microsoft Update Health Tools
2022-02-18 20:22 - 2022-01-13 08:45 - 000000000 ____D C:\Windows\Panther
2022-02-18 20:22 - 2022-01-12 23:25 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2022-02-17 20:23 - 2022-01-12 23:25 - 000001005 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2022-02-17 20:23 - 2022-01-12 23:25 - 000000000 ____D C:\Windows\system32\Tasks\Mozilla
2022-02-17 20:22 - 2022-01-19 23:02 - 000000000 ____D C:\Users\Pancho\AppData\Local\CrashDumps
2022-02-15 20:13 - 2019-12-07 11:54 - 000000000 ___SD C:\Windows\system32\AppV
2022-02-15 20:13 - 2019-12-07 11:54 - 000000000 ____D C:\Program Files\Windows Defender Advanced Threat Protection
2022-02-15 20:13 - 2019-12-07 11:14 - 000000000 ___RD C:\Windows\ImmersiveControlPanel
2022-02-15 20:13 - 2019-12-07 11:14 - 000000000 ____D C:\Windows\SystemResources
2022-02-15 20:13 - 2019-12-07 11:14 - 000000000 ____D C:\Windows\system32\WinBioPlugIns
2022-02-15 20:13 - 2019-12-07 11:14 - 000000000 ____D C:\Windows\system32\oobe
2022-02-15 20:13 - 2019-12-07 11:14 - 000000000 ____D C:\Windows\system32\migwiz
2022-02-15 20:13 - 2019-12-07 11:14 - 000000000 ____D C:\Windows\PolicyDefinitions
2022-02-15 20:13 - 2019-12-07 11:14 - 000000000 ____D C:\Windows\bcastdvr
2022-02-15 20:13 - 2019-12-07 11:03 - 000000000 ____D C:\Windows\servicing
2022-02-15 08:56 - 2022-01-13 21:29 - 000000000 ____D C:\Users\Pancho\AppData\Local\NVIDIA
2022-02-13 22:39 - 2022-01-13 23:21 - 000001997 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Universal Media Server.lnk
2022-02-13 22:38 - 2022-01-13 23:20 - 000000000 ____D C:\Program Files (x86)\Universal Media Server
2022-02-12 21:39 - 2019-12-07 11:14 - 000000000 ____D C:\Program Files\Common Files\microsoft shared
2022-02-10 21:56 - 2022-01-16 20:49 - 000004308 _____ C:\Windows\system32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2022-02-10 21:56 - 2022-01-16 20:49 - 000003976 _____ C:\Windows\system32\Tasks\NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2022-02-10 21:56 - 2022-01-16 20:49 - 000003940 _____ C:\Windows\system32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2022-02-10 21:56 - 2022-01-16 20:49 - 000003894 _____ C:\Windows\system32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2022-02-10 21:56 - 2022-01-16 20:49 - 000003858 _____ C:\Windows\system32\Tasks\NvTmRep_CrashReport4_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2022-02-10 21:56 - 2022-01-16 20:49 - 000003858 _____ C:\Windows\system32\Tasks\NvTmRep_CrashReport3_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2022-02-10 21:56 - 2022-01-16 20:49 - 000003858 _____ C:\Windows\system32\Tasks\NvTmRep_CrashReport2_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2022-02-10 21:56 - 2022-01-16 20:49 - 000003858 _____ C:\Windows\system32\Tasks\NvTmRep_CrashReport1_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2022-02-10 21:56 - 2022-01-16 20:49 - 000003654 _____ C:\Windows\system32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2022-02-10 21:56 - 2022-01-16 20:49 - 000000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2022-02-10 21:56 - 2022-01-12 22:50 - 000000000 ____D C:\ProgramData\NVIDIA Corporation
2022-02-10 21:56 - 2022-01-12 22:50 - 000000000 ____D C:\Program Files\NVIDIA Corporation
2022-02-10 20:34 - 2022-01-12 22:50 - 007613344 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2022-02-09 20:20 - 2022-01-13 00:11 - 000000000 ____D C:\Windows\system32\MRT
2022-02-09 20:18 - 2022-01-13 00:11 - 149611728 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2022-02-01 23:02 - 2019-12-07 11:10 - 000383488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnet.dll
2022-02-01 23:02 - 2019-12-07 11:10 - 000215552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dplayx.dll
2022-02-01 23:02 - 2019-12-07 11:10 - 000060928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnathlp.dll
2022-02-01 23:02 - 2019-12-07 11:10 - 000045568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpwsockx.dll
2022-02-01 23:02 - 2019-12-07 11:10 - 000023552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpmodemx.dll
2022-02-01 23:02 - 2019-12-07 11:10 - 000022528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnsvr.exe
2022-02-01 23:02 - 2019-12-07 11:10 - 000020480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dplaysvr.exe
2022-02-01 23:02 - 2019-12-07 11:10 - 000008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnhupnp.dll
2022-02-01 23:02 - 2019-12-07 11:10 - 000008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnhpast.dll
2022-02-01 23:02 - 2019-12-07 11:10 - 000005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnlobby.dll
2022-02-01 23:02 - 2019-12-07 11:10 - 000005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnaddr.dll
2022-02-01 23:02 - 2019-12-07 11:09 - 000494592 _____ (Microsoft Corporation) C:\Windows\system32\dpnet.dll
2022-02-01 23:02 - 2019-12-07 11:09 - 000070656 _____ (Microsoft Corporation) C:\Windows\system32\dpnathlp.dll
2022-02-01 23:02 - 2019-12-07 11:09 - 000028672 _____ (Microsoft Corporation) C:\Windows\system32\dpnsvr.exe
2022-02-01 23:02 - 2019-12-07 11:09 - 000010240 _____ (Microsoft Corporation) C:\Windows\system32\dpnhupnp.dll
2022-02-01 23:02 - 2019-12-07 11:09 - 000010240 _____ (Microsoft Corporation) C:\Windows\system32\dpnhpast.dll
2022-02-01 23:02 - 2019-12-07 11:09 - 000006144 _____ (Microsoft Corporation) C:\Windows\system32\dpnlobby.dll
2022-02-01 23:02 - 2019-12-07 11:09 - 000006144 _____ (Microsoft Corporation) C:\Windows\system32\dpnaddr.dll
2022-02-01 21:51 - 2022-01-16 20:49 - 000000000 ____D C:\Users\Pancho\AppData\Local\NVIDIA Corporation

==================== SigCheck ============================

(There is no automatic fix for files that do not pass verification.)

==================== End of FRST.txt ========================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-02-2022
Ran by Pancho (03-03-2022 19:16:36)
Running from C:\Users\Pancho\OneDrive\Работен плот
Microsoft Windows 10 Pro Version 21H2 19044.1566 (X64) (2022-01-12 20:46:56)
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

(If an entry is included in the fixlist, it will be removed.)

Administrator (S-1-5-21-176537593-2728283085-4065151155-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-176537593-2728283085-4065151155-503 - Limited - Disabled)
Guest (S-1-5-21-176537593-2728283085-4065151155-501 - Limited - Enabled)
Pancho (S-1-5-21-176537593-2728283085-4065151155-1001 - Administrator - Enabled) => C:\Users\Pancho
WDAGUtilityAccount (S-1-5-21-176537593-2728283085-4065151155-504 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

AviSynth (HKLM-x32\...\AviSynth) (Version: 2.6.0 MT - )
CrystalDiskInfo 8.9.0 (HKLM\...\CrystalDiskInfo_is1) (Version: 8.9.0 - Crystal Dew World)
Foxit PDF Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 11.0.1.49938 - Foxit Software Inc.)
IObit Unlocker (HKLM-x32\...\IObit Unlocker_is1) (Version: 1.2.0.1 - IObit)
LibreOffice 7.2.5.2 (HKLM\...\{4EF63F1E-7ADF-4D6E-8F9F-5E1D5CE231D1}) (Version: 7.2.5.2 - The Document Foundation)
Macrium Reflect Home (HKLM\...\{9D8A6003-548D-4D4D-BFB4-00059CE8EC6D}) (Version: 8.0.6560 - Paramount Software (UK) Ltd.) Hidden
Macrium Reflect Home (HKLM\...\MacriumReflect) (Version: v8.0.6560 - Paramount Software (UK) Ltd.)
Malwarebytes version 4.5.5.175 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 4.5.5.175 - Malwarebytes)
Microsoft Edge (HKLM-x32\...\Microsoft Edge) (Version: 98.0.1108.62 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-176537593-2728283085-4065151155-1001\...\OneDriveSetup.exe) (Version: 21.230.1107.0004 - Microsoft Corporation)
Microsoft Update Health Tools (HKLM\...\{16E50919-B07A-4B4E-994A-476D4773F5BF}) (Version: 3.65.0.0 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2015-2019 Redistributable (x64) - 14.29.30139 (HKLM-x32\...\{2c673fb6-3e65-4751-965d-33d30b68a8a6}) (Version: 14.29.30139.0 - Microsoft Corporation)
Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.22.27821 (HKLM-x32\...\{5bfc1380-fd35-4b85-9715-7351535d077e}) (Version: 14.22.27821.0 - Microsoft Corporation)
Mozilla Firefox (x64 bg) (HKLM\...\Mozilla Firefox 97.0.1 (x64 bg)) (Version: 97.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 96.0 - Mozilla)
NVIDIA FrameView SDK 1.2.7321.30900954 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_FrameViewSdk) (Version: 1.2.7321.30900954 - NVIDIA Corporation)
NVIDIA GeForce Experience 3.25.0.84 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 3.25.0.84 - NVIDIA Corporation)
NVIDIA Graphics Driver 511.79 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 511.79 - NVIDIA Corporation)
NVIDIA HD Audio Driver 1.3.39.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.39.3 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.21.0713 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.21.0713 - NVIDIA Corporation)
NVIDIA USBC Driver 1.46.831.832 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_USBC) (Version: 1.46.831.832 - NVIDIA Corporation)
Revo Uninstaller Pro 4.5.5 (HKLM\...\{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1) (Version: 4.5.5 - VS Revo Group, Ltd.)
Universal Media Server (HKLM-x32\...\Universal Media Server) (Version: 10.16.0 - Universal Media Server)
Viber (HKLM-x32\...\{D20F4645-C2CF-43AC-A2DD-C9AEA937EF93}) (Version: 16.8.1.0 - Viber Media S.a.r.l) Hidden
Viber (HKU\S-1-5-21-176537593-2728283085-4065151155-1001\...\{9118c1ad-5945-45d1-91c4-b5f8234b9e82}) (Version: 16.8.1.0 - 2010-2022 Viber Media S.a.r.l)
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version:  - Elaborate Bytes)
VLC media player (HKLM\...\VLC media player) (Version: 3.0.16 - VideoLAN)
WinRAR 6.00 (64-bit) (HKLM\...\WinRAR archiver) (Version: 6.00.0 - win.rar GmbH)
Wise Disk Cleaner 10.8.3 (HKLM-x32\...\Wise Disk Cleaner_is1) (Version: 10.8.3 - WiseCleaner.com, Inc.)

Packages:
=========
Microsoft Solitaire Collection -> C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.12.2180.0_x64__8wekyb3d8bbwe [2022-02-25] (Microsoft Studios) [MS Ad]
NVIDIA Control Panel -> C:\Program Files\WindowsApps\NVIDIACorp.NVIDIAControlPanel_8.1.962.0_x64__56jybvy8sckqj [2022-02-14] (NVIDIA Corp.)
Spotify Music -> C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.179.763.0_x86__zpdnekdrzrea0 [2022-02-20] (Spotify AB) [Startup Task]

==================== Custom CLSID (Whitelisted): ==============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-176537593-2728283085-4065151155-1001_Classes\CLSID\{227C9E8F-71A1-4B23-9076-682A1A8EAAED}\localserver32 -> c:\program files\macrium\common\reflectmonitor.exe (PARAMOUNT SOFTWARE UK LIMITED -> Paramount Software UK Ltd)
ContextMenuHandlers1: [ReflectShellExt] -> {DEBB9B79-B3DD-47F4-9E5C-EA6975BAB611} => D:\Programi\Macrium\Reflect\RContextMenu.dll [2022-02-15] (PARAMOUNT SOFTWARE UK LIMITED -> Paramount Software UK Ltd)
ContextMenuHandlers1: [UnLockerMenu] -> {410BF280-86EF-4E0F-8279-EC5848546AD3} => C:\Program Files (x86)\IObit\IObit Unlocker\IObitUnlockerExtension.dll [2020-10-10] (IObit Information Technology -> IObit Information Technology)
ContextMenuHandlers1: [VirtualCloneDrive] -> {B7056B8E-4F99-44f8-8CBD-282390FE5428} => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\ElbyVCDShell.dll [2009-12-14] (Elaborate Bytes AG -> Elaborate Bytes AG)
ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2020-12-01] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2020-12-01] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers2: [ReflectShellExt] -> {DEBB9B79-B3DD-47F4-9E5C-EA6975BAB611} => D:\Programi\Macrium\Reflect\RContextMenu.dll [2022-02-15] (PARAMOUNT SOFTWARE UK LIMITED -> Paramount Software UK Ltd)
ContextMenuHandlers2: [VirtualCloneDrive] -> {B7056B8E-4F99-44f8-8CBD-282390FE5428} => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\ElbyVCDShell.dll [2009-12-14] (Elaborate Bytes AG -> Elaborate Bytes AG)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2022-03-03] (Malwarebytes Corporation -> Malwarebytes)
ContextMenuHandlers4: [UnLockerMenu] -> {410BF280-86EF-4E0F-8279-EC5848546AD3} => C:\Program Files (x86)\IObit\IObit Unlocker\IObitUnlockerExtension.dll [2020-10-10] (IObit Information Technology -> IObit Information Technology)
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_3b12ac0f95b18b9d\nvshext.dll [2022-02-10] (Nvidia Corporation -> NVIDIA Corporation)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2022-03-03] (Malwarebytes Corporation -> Malwarebytes)
ContextMenuHandlers6: [RUShellExt] -> {2C5515DC-2A7E-4BFD-B813-CACC2B685EB7} => C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll [2020-09-28] (VS Revo Group Ltd. -> VS Revo Group)
ContextMenuHandlers6: [UnLockerMenu] -> {410BF280-86EF-4E0F-8279-EC5848546AD3} => C:\Program Files (x86)\IObit\IObit Unlocker\IObitUnlockerExtension.dll [2020-10-10] (IObit Information Technology -> IObit Information Technology)
ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2020-12-01] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2020-12-01] (win.rar GmbH -> Alexander Roshal)

==================== Codecs (Whitelisted) ====================

==================== Shortcuts & WMI ========================

==================== Loaded Modules (Whitelisted) =============

2022-03-03 19:13 - 2022-03-03 19:13 - 000254464 ____N (Java(TM) Native Access (JNA)) [File not signed] C:\Users\Pancho\AppData\Local\Temp\jna--1911678195\jna6887883367324055190.dll

==================== Alternate Data Streams (Whitelisted) ========

==================== Safe Mode (Whitelisted) ==================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Association (Whitelisted) =================

==================== Internet Explorer (Whitelisted) ==========

==================== Hosts content: =========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2019-12-07 11:14 - 2022-03-03 17:53 - 000000027 _____ C:\Windows\system32\drivers\etc\hosts
127.0.0.1       localhost

==================== Other Areas ===========================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-176537593-2728283085-4065151155-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Pancho\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\img0.jpg
DNS Servers: 192.168.100.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(If an entry is included in the fixlist, it will be removed.)

HKU\S-1-5-21-176537593-2728283085-4065151155-1001\...\StartupApproved\Run: => "OneDrive"
HKU\S-1-5-21-176537593-2728283085-4065151155-1001\...\StartupApproved\Run: => "uTorrent"
HKU\S-1-5-21-176537593-2728283085-4065151155-1001\...\StartupApproved\Run: => "Windows Defender"

==================== FirewallRules (Whitelisted) ================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [TCP Query User{D644AE17-656A-4EED-97ED-69357A7AEB19}C:\program files (x86)\universal media server\jre8\bin\javaw.exe] => (Allow) C:\program files (x86)\universal media server\jre8\bin\javaw.exe
FirewallRules: [UDP Query User{6C0B5FD1-8FE3-477D-B773-C5BAF8A4D443}C:\program files (x86)\universal media server\jre8\bin\javaw.exe] => (Allow) C:\program files (x86)\universal media server\jre8\bin\javaw.exe
FirewallRules: [TCP Query User{39F2218F-761C-498B-828C-BBAF62C19F00}C:\program files (x86)\utorrent\utorrent.exe] => (Allow) C:\program files (x86)\utorrent\utorrent.exe => No File
FirewallRules: [UDP Query User{DFE52D42-8B36-4B17-B547-98824D13821F}C:\program files (x86)\utorrent\utorrent.exe] => (Allow) C:\program files (x86)\utorrent\utorrent.exe => No File
FirewallRules: [{D45A5C54-EB1C-4B28-92D3-C4CC3252953D}] => (Block) C:\Windows\system32\Attrib.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{90245B3C-197D-4252-B432-0E2D5262B239}] => (Block) C:\Windows\SysWOW64\Attrib.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{60BD7094-B855-4EF6-8835-C01F59603263}] => (Block) C:\Windows\system32\AtBroker.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{C42F18C1-7B03-454F-A590-66A6BE6AD181}] => (Block) C:\Windows\SysWOW64\AtBroker.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{3B12725C-5620-4C59-9288-43AF47C58333}] => (Block) C:\Windows\system32\Certutil.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{93B23C1F-F355-4EFA-B11F-B68A84C12D7F}] => (Block) C:\Windows\SysWOW64\Certutil.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{3C1BE7BD-BA65-4606-8F3A-6DB8137650CF}] => (Block) C:\Windows\system32\Cmstp.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{E6385C24-CA41-4A7E-81F8-74BD6E3FC709}] => (Block) C:\Windows\SysWOW64\Cmstp.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{3885170D-641B-4CFC-A957-EF31246FDF15}] => (Block) C:\Windows\system32\Esentutl.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{C16A86DF-4E39-42E2-94E2-41A707665BA1}] => (Block) C:\Windows\SysWOW64\Esentutl.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{85E01359-6C42-4D32-9DDA-A17D343464C3}] => (Block) C:\Windows\system32\Extrac32.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{E46580A9-001A-4D61-9EF5-1898E00161A1}] => (Block) C:\Windows\SysWOW64\Extrac32.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{75FC0014-F40D-46AE-9260-6C38EBA6BBBC}] => (Block) C:\Windows\system32\Makecab.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{83C4D570-C228-4FD4-B197-263F5CC863B0}] => (Block) C:\Windows\SysWOW64\Makecab.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{1C32C096-3BDC-4A1D-A8AF-E826CEAF9DC7}] => (Block) C:\Windows\system32\Pcalua.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{913B5975-B608-4D99-AA78-6BEA367FC21E}] => (Block) C:\Windows\system32\ScriptRunner.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{248B1C06-9F4E-4A4C-AE6B-80161C80A019}] => (Block) C:\Windows\system32\wbem\Scrcons.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{5DB2F58C-41D4-42CF-B08E-4F2491D814A3}] => (Block) C:\Windows\system32\CompatTelRunner.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{F5834ED2-87E8-4896-B863-9681A775F091}] => (Block) C:\Windows\system32\Control.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{D60C6FE8-B624-4984-A758-D4133B3D0E54}] => (Block) C:\Windows\SysWOW64\Control.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{CFDD9CAE-5541-442D-BFD2-66EBBF8A4B1F}] => (Block) C:\Windows\system32\Cscript.exe
FirewallRules: [{C409AF14-DA3F-4EC7-A081-AEAED3BFCCD1}] => (Block) C:\Windows\SysWOW64\Cscript.exe
FirewallRules: [{E3A34137-5163-4671-8FEF-36DC65C1AF10}] => (Block) C:\Windows\system32\Csrss.exe (Microsoft Windows Publisher -> Microsoft Corporation)
FirewallRules: [{B0868CA6-A991-466D-96E5-6F17DF103963}] => (Block) C:\Windows\system32\Ctfmon.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{0B75643C-6739-4ED0-A288-45EA7B2A229A}] => (Block) C:\Windows\SysWOW64\Ctfmon.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{0D028D90-3B5E-4A57-98FB-572EDFFD65FD}] => (Block) C:\Windows\system32\Dwm.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{CF910839-AD84-4279-902C-A18BEDDBD043}] => (Block) C:\Windows\system32\Eventvwr.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{1839247B-9D1A-467B-8CDB-83BAB1348F59}] => (Block) C:\Windows\SysWOW64\Eventvwr.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{0F4E4E1C-2F78-491C-A317-30A2989BDFD5}] => (Block) C:\Windows\Explorer.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{A37C5360-E261-418F-9FF6-0F79DD569289}] => (Block) C:\Windows\HH.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{2A0A39DE-FAB9-482C-A7DF-0B5C2D3ADBAC}] => (Block) C:\Windows\system32\MMC.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{B62F7187-3843-45D3-A0F9-C497E1FE39F8}] => (Block) C:\Windows\SysWOW64\MMC.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{E6E67A08-98FF-4804-8768-3EE790E4580F}] => (Block) C:\Windows\system32\Odbcconf.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{6E2F270B-3893-4539-BCD5-324E5ECA733D}] => (Block) C:\Windows\SysWOW64\Odbcconf.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{BB267AEA-E8BF-4490-A671-EC1A8A30E6AC}] => (Block) C:\Windows\system32\Services.exe (Microsoft Windows Publisher -> Microsoft Corporation)
FirewallRules: [{5A3E5EA5-BDF9-424C-98AD-05427DF939CD}] => (Block) C:\Windows\system32\Winlogon.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{17CD3122-7553-48D5-939E-5B1A0133F1CA}] => (Block) C:\Windows\system32\Wininit.exe (Microsoft Windows Publisher -> Microsoft Corporation)
FirewallRules: [{E1143CA3-0782-4CD4-8A32-F5D99B599067}] => (Block) C:\Windows\system32\wbem\Wmic.exe
FirewallRules: [{D880A230-868D-4752-AD44-648C3384212C}] => (Block) C:\Windows\SysWOW64\wbem\Wmic.exe
FirewallRules: [{FDBDB16E-E21E-4494-8B16-4DF40CACF662}] => (Block) C:\Program Files\Windows NT\Accessories\Wordpad.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{533EA8FC-3CE7-4EA6-9D7C-B73075348D60}] => (Block) C:\Windows\system32\Wscript.exe
FirewallRules: [{BA342E99-B320-41F0-9266-6C78DC12B0DE}] => (Block) C:\Windows\SysWOW64\Wscript.exe

==================== Restore Points =========================

28-02-2022 09:44:15 Scheduled Checkpoint
01-03-2022 00:45:31 Created by Wise Disk Cleaner
01-03-2022 21:52:25 Restore Point
01-03-2022 22:00:52 Restore Point
02-03-2022 22:51:57 [IDS_MSI_ERROR_1715]

==================== Faulty Device Manager Devices ============

==================== Event log errors: ========================

Application errors:
==================
Error: (03/03/2022 05:52:42 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine QueryFullProcessImageNameW.  hr = 0x8007001f, A device attached to the system is not functioning.
.

Operation:
   Executing Asynchronous Operation

Context:
   Current State: DoSnapshotSet

Error: (03/03/2022 05:52:36 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005, Access is denied.
.
This is often caused by incorrect security settings in either the writer or requestor process.

Operation:
   Gathering Writer Data

Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {dca522f3-6861-47e6-ba0b-779bb37125e4}

Error: (03/03/2022 12:21:43 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Име на приложение с грешки: SAntivirusService.exe, версия: 1.0.22.32, времево клеймо: 0x6076a44b
Име на модул с грешки: clr.dll, версия: 4.8.4470.0, времево клеймо: 0x61b72dcc
Код на изключение: 0xc0000005
Отместване на грешка: 0x0000000000073b7a
ИД на процес на грешка: 0xf6c
Начален час на приложението с грешки: 0x01d82e78209a4e3e
Път на приложението с грешки: C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusService.exe
Път на модула с грешки: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll
ИД на доклад: 78b0fcb9-a5e6-4767-a407-0eb5f41409bc
Пълно име на пакета с грешка:
ИД на свързаното с пакета с грешка приложение:

Error: (03/03/2022 12:21:43 AM) (Source: .NET Runtime) (EventID: 1023) (User: )
Description: Application: SAntivirusService.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an internal error in the .NET Runtime at IP 00007FFBB0483B7A (00007FFBB0410000) with exit code 80131506.

Error: (03/02/2022 10:19:47 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine QueryFullProcessImageNameW.  hr = 0x8007001f, A device attached to the system is not functioning.
.

Operation:
   Executing Asynchronous Operation

Context:
   Current State: DoSnapshotSet

Error: (03/02/2022 10:19:39 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005, Access is denied.
.
This is often caused by incorrect security settings in either the writer or requestor process.

Operation:
   Gathering Writer Data

Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {67b7a1a7-64ad-4837-9ec2-609bbd922eff}

Error: (03/02/2022 10:11:53 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program ConfigureDefender_x64.exe version 3.0.1.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

Process ID: f8c

Start Time: 01d82e705b3d266d

Termination Time: 4294967295

Application Path: C:\Windows\Temp\101749311059017213\5915\ConfigureDefender_x64.exe

Report Id: cfd23467-7089-4b67-a2a2-751213ead1f7

Faulting package full name:

Faulting package-relative application ID:

Hang type: Cross-process

Error: (03/02/2022 07:49:05 PM) (Source: VSS) (EventID: 12289) (User: )
Description: Volume Shadow Copy Service error: Unexpected error DeviceIoControl(\\?\Volume{81d01049-9552-414d-ae79-9deeb3d3e7d1} - 0000000000000260,0x0053c008,00000274C4C068C0,0,00000274C4C078F0,4096,[0]).  hr = 0x80070005, Access is denied.
.

Operation:
   Processing EndPrepareSnapshots

Context:
   Execution Context: System Provider

System errors:
=============
Error: (03/03/2022 07:13:24 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Услуга NcaSvc зависи от услуга iphlpsvc, която не може да бъде стартирана поради следната грешка:
The dependency service or group failed to start.

Error: (03/03/2022 07:13:24 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Услуга iphlpsvc зависи от услуга WinHttpAutoProxySvc, която не може да бъде стартирана поради следната грешка:
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

Error: (03/03/2022 07:13:21 PM) (Source: Application Popup) (EventID: 56) (User: )
Description: not terminated, too long or invalid number of separators

Error: (03/03/2022 07:13:01 PM) (Source: DCOM) (EventID: 10005) (User: PANCHO)
Description: DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "Unavailable" in order to run the server:
{DD522ACC-F821-461A-A407-50B198B896DC}

Error: (03/03/2022 07:12:57 PM) (Source: DCOM) (EventID: 10005) (User: PANCHO)
Description: DCOM got error "1084" attempting to start the service WSearch with arguments "Unavailable" in order to run the server:
{E48EDA45-43C6-48E0-9323-A7B2067D9CD5}

Error: (03/03/2022 07:12:57 PM) (Source: DCOM) (EventID: 10005) (User: PANCHO)
Description: DCOM got error "1084" attempting to start the service WSearch with arguments "Unavailable" in order to run the server:
{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

Error: (03/03/2022 07:12:56 PM) (Source: DCOM) (EventID: 10005) (User: PANCHO)
Description: DCOM got error "1084" attempting to start the service camsvc with arguments "Unavailable" in order to run the server:
Windows.Internal.CapabilityAccess.CapabilityAccess

Error: (03/03/2022 07:12:00 PM) (Source: DCOM) (EventID: 10005) (User: NT AUTHORITY)
Description: DCOM got error "1084" attempting to start the service UsoSvc with arguments "Unavailable" in order to run the server:
{B91D5831-B1BD-4608-8198-D72E155020F7}

Windows Defender:
================
Date: 2022-03-03 15:13:00
Description:
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=VirTool:Win32/DefenderTamperingRestore&threatid=2147741622&enterprise=0
Name: VirTool:Win32/DefenderTamperingRestore
Severity: Много високо
Category: Инструмент
Path: regkeyvalue:_hklm\software\policies\microsoft\windows defender\\DisableAntiSpyware
Detection Origin: Unknown
Detection Type: Concrete
Detection Source: System
Process Name: Unknown
Security intelligence Version: AV: 1.359.1256.0, AS: 1.359.1256.0, NIS: 1.359.1256.0
Engine Version: AM: 1.1.18900.3, NIS: 1.1.18900.3

Date: 2022-03-03 15:12:39
Description:
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=HackTool:Win32/Keygen&threatid=2147593794&enterprise=0
Name: HackTool:Win32/Keygen
Severity: Високо
Category: Инструмент
Path: file:_D:\Filmi\Macrium Reflect 8.0.6584 + WinPE\Patch.And.Custom-MPT\macrium.reflect.(all.editions).7.2.3825.[x64]-MPT.exe; file:_D:\Filmi\Macrium Reflect 8.0.6584 + WinPE\Patch.And.Custom-MPT\macrium.reflect.(all.editions).7.2.3825.[x86]-MPT.exe
Detection Origin: Local machine
Detection Type: Concrete
Detection Source: Real-Time Protection
Process Name: C:\Program Files (x86)\Universal Media Server\jre8\bin\javaw.exe
Security intelligence Version: AV: 1.359.1256.0, AS: 1.359.1256.0, NIS: 1.359.1256.0
Engine Version: AM: 1.1.18900.3, NIS: 1.1.18900.3

Date: 2022-03-03 15:12:39
Description:
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=HackTool:Win32/Keygen&threatid=2147593794&enterprise=0
Name: HackTool:Win32/Keygen
Severity: Високо
Category: Инструмент
Path: file:_D:\Filmi\Macrium Reflect 8.0.6584 + WinPE\Patch.And.Custom-MPT\macrium.reflect.(all.editions).7.2.3825.[x64]-MPT.exe
Detection Origin: Local machine
Detection Type: Concrete
Detection Source: Real-Time Protection
Process Name: C:\Program Files (x86)\Universal Media Server\jre8\bin\javaw.exe
Security intelligence Version: AV: 1.359.1256.0, AS: 1.359.1256.0, NIS: 1.359.1256.0
Engine Version: AM: 1.1.18900.3, NIS: 1.1.18900.3

Date: 2022-03-03 00:03:51
Description:
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=VirTool:Win32/Obfuscator.XZ&threatid=2147625929&enterprise=0
Name: VirTool:Win32/Obfuscator.XZ
Severity: Много високо
Category: Инструмент
Path: file:_D:\Save Games\Crysis3\Crysis.3.Crackfix.INTERNAL-RELOADED\Bin32\CryEA.dll
Detection Origin: Local machine
Detection Type: Heuristics
Detection Source: Real-Time Protection
Process Name: C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusService.exe
Security intelligence Version: AV: 1.359.1239.0, AS: 1.359.1239.0, NIS: 0.0.0.0
Engine Version: AM: 1.1.18900.3, NIS: 0.0.0.0

Date: 2022-03-03 00:02:06
Description:
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=VirTool:Win32/Obfuscator.XZ&threatid=2147625929&enterprise=0
Name: VirTool:Win32/Obfuscator.XZ
Severity: Много високо
Category: Инструмент
Path: file:_D:\Save Games\Crysis3\Crysis.3.Crackfix.INTERNAL-RELOADED\Bin32\CryEA.dll
Detection Origin: Local machine
Detection Type: Heuristics
Detection Source: Real-Time Protection
Process Name: C:\Windows\explorer.exe
Security intelligence Version: AV: 1.359.1239.0, AS: 1.359.1239.0, NIS: 0.0.0.0
Engine Version: AM: 1.1.18900.3, NIS: 0.0.0.0
Event[0]:

Date: 2022-03-03 18:55:16
Description:
Microsoft Defender Antivirus has encountered an error trying to update security intelligence.
New security intelligence Version:
Previous security intelligence Version: 1.359.1291.0
Update Source: Microsoft Update Server
Security intelligence Type: AntiVirus
Update Type: Full
Current Engine Version:
Previous Engine Version: 1.1.18900.3
Error code: 0x8007043c
Error description: This service cannot be started in Safe Mode

Date: 2022-03-03 18:45:14
Description:
Microsoft Defender Antivirus Real-Time Protection feature has encountered an error and failed.
Feature: On Access
Error Code: 0x8007043c
Error description: This service cannot be started in Safe Mode
Reason: Antimalware security intelligence has stopped functioning for an unknown reason. In some instances, restarting the service may resolve the problem.

CodeIntegrity:
===============
Date: 2022-02-28 04:34:34
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\msra.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\nvspcap64.dll that did not meet the Microsoft signing level requirements.

Date: 2022-02-27 18:59:52
Description:
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\360\Total Security\safemon\WscReg.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2022-02-27 00:12:13
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files (x86)\Microsoft\Edge\Application\msedge.exe) attempted to load \Device\HarddiskVolume3\Program Files (x86)\360\Total Security\safemon\SafeWrapper.dll that did not meet the Microsoft signing level requirements.

==================== Memory info ===========================

BIOS: American Megatrends Inc. 2.80 06/10/2020
Motherboard: Micro-Star International Co., Ltd. B450M MORTAR MAX (MS-7B89)
Processor: AMD Ryzen 5 3600X 6-Core Processor
Percentage of memory in use: 23%
Total physical RAM: 16333.16 MB
Available physical RAM: 12415.91 MB
Total Virtual: 32717.16 MB
Available Virtual: 26812.7 MB

==================== Drives ================================

Drive 😄 () (Fixed) (Total:476.33 GB) (Free:411.81 GB) NTFS
Drive d: () (Fixed) (Total:931.5 GB) (Free:406.7 GB) NTFS

\\?\Volume{0fd938b6-4a27-48ad-bcd5-3b63c9a118a6}\ () (Fixed) (Total:0.5 GB) (Free:0.08 GB) NTFS
\\?\Volume{0fda4880-f08c-4d34-8af6-ecac1159f6fe}\ () (Fixed) (Total:0.09 GB) (Free:0.07 GB) FAT32

==================== MBR & Partition Table ====================

==========================================================
Disk: 0 (Protective MBR) (Size: 931.5 GB) (Disk ID: 00000000)

Partition: GPT.

==========================================================
Disk: 1 (Size: 476.9 GB) (Disk ID: AB29CA33)

Partition: GPT.

==================== End of Addition.txt =======================

Farbar Recovery Scan Tool (x64) Version: 27-02-2022
Ran by Pancho (03-03-2022 19:24:17)
Running from C:\Users\Pancho\OneDrive\Работен плот
Boot Mode: Normal

================== Search Files: "SearchAll: SAntivirus;360 Total Security;AviSynth" =============

File:
========
C:\Windows\WinSxS\Manifests\amd64_c_fsantivirus.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_e8a3ad9373ab26d0.manifest
[2019-12-07 11:49][2019-12-07 11:49] 000000275 _____ () 9EB9B0156A46FA45672CAAE78723F928 [File not signed]

C:\Windows\WinSxS\Manifests\amd64_dual_c_fsantivirus.inf_31bf3856ad364e35_10.0.19041.1_none_8d76b37cccda75a1.manifest
[2019-12-07 11:04][2019-12-07 11:04] 000000924 _____ () 30B3BA1056ED257141646946CF2BA47F [File not signed]

C:\Windows\WinSxS\amd64_dual_c_fsantivirus.inf_31bf3856ad364e35_10.0.19041.1_none_8d76b37cccda75a1\c_fsantivirus.inf
[2019-12-07 11:07][2019-12-07 11:07] 000001168 _____ () C530FABE9B69DAE04AE7BED25E42877C [File is digitally signed]

C:\Windows\WinSxS\amd64_c_fsantivirus.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_e8a3ad9373ab26d0\c_fsantivirus.inf_loc
[2019-12-07 11:49][2019-12-07 11:49] 000000316 _____ () 9D6CE702E9BD0413FF3C8C2BF43543B7 [File is digitally signed]

C:\Windows\SysWOW64\avisynth.dll
[2012-05-16 01:35][2012-05-16 01:35] 001734656 _____ (The Public) A59FF80A5B67703026399E61C379BC53 [File not signed]

C:\Windows\System32\DriverStore\FileRepository\c_fsantivirus.inf_amd64_632d2ac0d68cf3ed\c_fsantivirus.inf
[2019-12-07 11:07][2019-12-07 11:07] 000001168 _____ () C530FABE9B69DAE04AE7BED25E42877C [File is digitally signed]

C:\Windows\System32\DriverStore\en-US\c_fsantivirus.inf_loc
[2019-12-07 11:49][2019-12-07 11:49] 000000316 _____ () 9D6CE702E9BD0413FF3C8C2BF43543B7 [File is digitally signed]

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SAntivirusService.exe.log
[2022-03-03 17:52][2022-03-03 17:52] 000003098 _____ () 569FFA011F025C1EA9ED1F611A423C2C [File not signed]

C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\SAntivirusService.exe.3900.dmp
[2022-02-12 18:44][2022-02-12 18:44] 028296445 _____ () 27EFFED0C856ABCA102DCA58F94D007B [File not signed]

C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\SAntivirusService.exe.3948.dmp
[2022-03-03 00:21][2022-03-03 00:21] 026396832 _____ () 32C604BFD5CA0FEA086D77F3652FC8E7 [File not signed]

C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\SAntivirusService.exe.4204.dmp
[2022-02-27 18:37][2022-02-27 18:37] 028037183 _____ () C8548C85F9B41FCF4E490ABA6111B2E0 [File not signed]

C:\Windows\Prefetch\SANTIVIRUSCLIENT.EXE-40143D30.pf
[2022-03-02 22:22][2022-03-03 17:54] 000045322 _____ () 8C5E0FF4782A38DC86B9F0820735E4D9 [File not signed]

C:\Windows\Prefetch\SANTIVIRUSSERVICE.EXE-16AB7442.pf
[2022-03-03 17:53][2022-03-03 17:53] 000033280 _____ () 7E749457D080EDC5F7D4468E0628FE4B [File not signed]

C:\Windows\INF\c_fsantivirus.inf
[2019-12-07 11:07][2019-12-07 11:07] 000001168 _____ () C530FABE9B69DAE04AE7BED25E42877C [File is digitally signed]

C:\Windows\INF\c_fsantivirus.PNF
[2022-01-14 00:46][2022-01-14 00:46] 000004644 _____ () 03D34C93240AAAC5850BFC92F7844DD7 [File not signed]

C:\Users\Pancho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AviSynth\Uninstall AviSynth.lnk
[2022-01-25 19:53][2022-01-25 19:53] 000001180 _____ () B56C45AD669D3DDA42CBDE2CC647B4E9 [File not signed]

C:\Users\Pancho\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\http___www_avisynth_org
[2022-03-03 18:45][2022-03-03 18:45] 000037014 _____ () 98B77228E3699DE9F5F16EADF003DC5E [File not signed]

C:\Users\Pancho\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\http___www_avisynth_org_warpenterprises_
[2022-03-03 18:45][2022-03-03 18:45] 000037014 _____ () 98B77228E3699DE9F5F16EADF003DC5E [File not signed]

C:\Users\Pancho\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AviSynth_Docs_English_index_htm
[2022-03-03 18:45][2022-03-03 18:45] 000037014 _____ () 98B77228E3699DE9F5F16EADF003DC5E [File not signed]

C:\Users\Pancho\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AviSynth_Examples
[2022-03-03 18:45][2022-03-03 18:45] 000037014 _____ () 3B6A6056910488C2F2D94B954B66C6F9 [File not signed]

C:\Users\Pancho\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AviSynth_gpl_txt
[2022-03-03 18:45][2022-03-03 18:45] 000037014 _____ () 968E7D1AA993EF1052B35A95C51946D5 [File not signed]

C:\Users\Pancho\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AviSynth_plugins
[2022-03-03 18:45][2022-03-03 18:45] 000037014 _____ () 3B6A6056910488C2F2D94B954B66C6F9 [File not signed]

C:\Users\Pancho\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_Digital Communications_SAntivirus_SAntivirusClient_exe
[2022-03-03 18:45][2022-03-03 18:45] 000037014 _____ () D182782B5B62C8B8D9366C028816C443 [File not signed]

C:\Users\Pancho\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\santivirusclient.exe.log
[2022-03-03 00:22][2022-03-03 00:22] 000001687 _____ () C6A83FC6F8703BA27F6324A6A6E79763 [File not signed]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviSynth\AviSynth Documentation.lnk
[2022-01-25 19:53][2022-01-25 19:53] 000001296 _____ () 76FC7A00C11680414544E1548B2E5A43 [File not signed]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviSynth\AviSynth Online.url
[2022-01-25 19:53][2022-01-25 19:53] 000000049 _____ () 0963A0A93A4D5112E5637FBDF55F527E [File not signed]

C:\Program Files (x86)\Universal Media Server\win32\avisynth\avisynth.exe
[2014-11-23 05:39][2014-11-23 05:39] 002742489 _____ (The Public) AD08D9A07F0157782D9E2D8D04DC3C70 [File not signed]

C:\Program Files (x86)\Universal Media Server\documentation\avisynth.html
[2021-04-22 06:47][2021-04-22 06:47] 000005928 _____ () E2BBC3580B90E40804A422B7A3D908DA [File not signed]

C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusClient.exe.config
[2022-01-13 16:55][2022-01-13 16:55] 000000408 _____ () DD8BD7791066435FC64D1947E31922FD [File not signed]

C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusIC.config
[2022-01-13 16:55][2022-03-03 18:43] 000000001 _____ () CFCD208495D565EF66E7DFF9F98764DA [File not signed]

C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusService.config
[2022-01-13 16:55][2022-03-03 18:43] 000005280 _____ () 53A8CD4736FD397DDE997BAC2D0617EB [File not signed]

C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusService.exe.config
[2022-01-13 16:55][2022-01-13 16:55] 000000408 _____ () DD8BD7791066435FC64D1947E31922FD [File not signed]

C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusUninstaller.exe.config
[2022-01-13 16:55][2022-01-13 16:55] 000000408 _____ () DD8BD7791066435FC64D1947E31922FD [File not signed]

C:\Program Files (x86)\AviSynth\Docs\avisynth.css
[2006-12-17 02:56][2006-12-17 02:56] 000003089 _____ () 53CA1D0DE5F602ADE8B0C647CE5826A6 [File not signed]

C:\Program Files (x86)\AviSynth\Docs\English\externalfilters\ffavisynth.htm
[2007-11-25 03:32][2007-11-25 03:32] 000003471 _____ () B4C2222693D52DBD40FBF62B963EA675 [File not signed]

folder:
========
2019-12-07 11:49 - 2019-12-07 11:49 _____ C:\Windows\WinSxS\amd64_c_fsantivirus.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_e8a3ad9373ab26d0
2019-12-07 11:07 - 2019-12-07 11:31 _____ C:\Windows\WinSxS\amd64_dual_c_fsantivirus.inf_31bf3856ad364e35_10.0.19041.1_none_8d76b37cccda75a1
2019-12-07 11:13 - 2019-12-07 11:13 _____ C:\Windows\System32\DriverStore\FileRepository\c_fsantivirus.inf_amd64_632d2ac0d68cf3ed
2022-01-25 19:53 - 2022-01-25 19:53 _____ C:\Users\Pancho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AviSynth
2022-01-13 22:28 - 2022-01-13 22:28 _____ C:\Users\Pancho\AppData\Local\VS Revo Group\Revo Uninstaller Pro\Logs\AviSynth
2022-02-27 19:00 - 2022-02-27 19:00 _____ C:\Users\Pancho\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\360 Total Security-27022022-190044
2022-01-13 22:29 - 2022-01-13 22:29 _____ C:\Users\Pancho\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\AviSynth-13012022-222910
2022-01-14 01:36 - 2022-01-14 01:36 _____ C:\Users\Pancho\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\AviSynth-14012022-013606
2022-01-13 17:16 - 2022-01-13 17:16 _____ C:\Users\Pancho\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\SAntivirus Realtime Protection Lite-13012022-171621
2022-03-03 00:21 - 2022-03-03 00:21 ____C C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_SAntivirusServic_9456866a2cc78cc8ac54ffe46a5b4350d7fdb8_b53eb8a5_1179d8c6-accf-40e6-830e-e9052d597793
2022-01-25 19:53 - 2022-01-25 19:53 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviSynth
2022-01-25 19:53 - 2022-01-25 19:53 _____ C:\Program Files (x86)\AviSynth
2022-01-13 23:20 - 2022-01-13 23:20 _____ C:\Program Files (x86)\Universal Media Server\win32\avisynth
2022-01-13 16:55 - 2022-03-03 18:55 _____ C:\Program Files (x86)\Digital Communications\SAntivirus

Registry:
========

===================== Search result for "SAntivirus" ==========

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\{b1d1a169-c54f-4379-81db-bee7d88d7454}]
"c_fsantivirus.inf"=""

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DriverInfFiles\c_fsantivirus.inf]

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DriverInfFiles\c_fsantivirus.inf]
""="c_fsantivirus.inf_amd64_632d2ac0d68cf3ed"

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DriverInfFiles\c_fsantivirus.inf]
"Active"="c_fsantivirus.inf_amd64_632d2ac0d68cf3ed"

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DriverPackages\c_fsantivirus.inf_amd64_632d2ac0d68cf3ed]

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DriverPackages\c_fsantivirus.inf_amd64_632d2ac0d68cf3ed]
""="c_fsantivirus.inf"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION]
"santivirusclient.exe"="11001"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION]
"santivirusclient.vshost.exe"="11001"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SAntivirusUninstaller_RASAPI32]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SAntivirusUninstaller_RASMANCS]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_c_fsantivirus.inf.resources_31bf3856ad364e35_en-us_9a8c17af29671973]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_dual_c_fsantivirus.inf_31bf3856ad364e35_none_b570512174d39eea]

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION]
"santivirusclient.exe"="11001"

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION]
"santivirusclient.vshost.exe"="11001"

[HKEY_USERS\S-1-5-21-176537593-2728283085-4065151155-1001\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION]
"santivirusclient.exe"="11001"

[HKEY_USERS\S-1-5-21-176537593-2728283085-4065151155-1001\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION]
"santivirusclient.vshost.exe"="11001"

[HKEY_USERS\S-1-5-21-176537593-2728283085-4065151155-1001\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store]
"C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusUninstaller.exe"="0x5341435001000000000000000700000028000000105615001429160001000000000000000000000A0021000050BB64EDDDACD5010000000000000000050000001000000000000000000000000000000000000000020000002800000000000000000000000000000000000000000000000000000032650000000000000100000001000000"

[HKEY_USERS\S-1-5-21-176537593-2728283085-4065151155-1001\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store]
"C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusIC.exe"="0x534143500100000000000000070000002800000010EA690087326A0001000000000000000000000A7322000050BB64EDDDACD501000000000000000002000000280000000000000000000000000000000000000000000000000000003E000000000000000200000002000000"

[HKEY_USERS\S-1-5-21-176537593-2728283085-4065151155-1001\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store]
"C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusService.exe"="0x5341435001000000000000000700000028000000108A0A003E490B0001000000000000000000000A7522000050BB64EDDDACD5010000000000000000020000002800000000000000000000000082000000000000008000000000000023290000000000000100000001000000010000000400000001000000"

===================== Search result for "360 Total Security" ==========

===================== Search result for "AviSynth" ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\avsfile]
""="AviSynth Script"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\avsfile\DefaultIcon]
""="C:\Windows\SysWow64\AviSynth.dll,0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\avs_auto_file]
""="AviSynth Autoload Script"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\avs_auto_file\DefaultIcon]
""="C:\Windows\SysWow64\AviSynth.dll,0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6D6B700-124D-11D4-86F3-DB80AFD98778}]
""="AviSynth"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6D6B700-124D-11D4-86F3-DB80AFD98778}\InProcServer32]
""="AviSynth.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\AviSynth]

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\AviSynth]
""="C:\Program Files (x86)\AviSynth"

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\AviSynth]
"plugindir2_5"="C:\Program Files (x86)\AviSynth\plugins"

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AviSynth]

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AviSynth]
"DisplayName"="AviSynth"

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AviSynth]
"UninstallString"=""C:\Program Files (x86)\AviSynth\Uninstall.exe""

[HKEY_USERS\S-1-5-21-176537593-2728283085-4065151155-1001\SOFTWARE\VS Revo Group\Revo Uninstaller Pro\Uninstaller\Traced\LogsUSs\AviSynth]

[HKEY_USERS\S-1-5-21-176537593-2728283085-4065151155-1001\SOFTWARE\VS Revo Group\Revo Uninstaller Pro\Uninstaller\Traced\LogsUSs\AviSynth\AviSynth]

[HKEY_USERS\S-1-5-21-176537593-2728283085-4065151155-1001\SOFTWARE\VS Revo Group\Revo Uninstaller Pro\Uninstaller\Traced\LogsUSs\AviSynth\AviSynth]
"DisplayName"="AviSynth 2.6"

[HKEY_USERS\S-1-5-21-176537593-2728283085-4065151155-1001\SOFTWARE\VS Revo Group\Revo Uninstaller Pro\Uninstaller\Traced\LogsUSs\AviSynth\AviSynth]
"UninstallString"=""C:\Program Files (x86)\AviSynth\Uninstall.exe""

====== End of Search ======

Фикс с Farbar Recovery Scan Tool

 

• Щракнете с десния бутон върху иконата FRST и изберете Изпълнете като администратор
• Маркирайте  информацията от карето по долу , след което натиснете клавишите Ctrl + C едновременно и текстът ще бъде копиран
• Няма нужда да поставяте информацията , FRST ще я направи вместо вас.

Start::
CreateRestorePoint:
CloseProcesses:

C:\Windows\WinSxS\Manifests\amd64_c_fsantivirus.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_e8a3ad9373ab26d0.manifest
C:\Windows\WinSxS\Manifests\amd64_dual_c_fsantivirus.inf_31bf3856ad364e35_10.0.19041.1_none_8d76b37cccda75a1.manifest
C:\Windows\WinSxS\amd64_dual_c_fsantivirus.inf_31bf3856ad364e35_10.0.19041.1_none_8d76b37cccda75a1\c_fsantivirus.inf
C:\Windows\WinSxS\amd64_c_fsantivirus.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_e8a3ad9373ab26d0\c_fsantivirus.inf_loc
C:\Windows\SysWOW64\avisynth.dll
C:\Windows\System32\DriverStore\en-US\c_fsantivirus.inf_loc
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SAntivirusService.exe.log
C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\SAntivirusService.exe.3900.dmp
C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\SAntivirusService.exe.3948.dmp
C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\SAntivirusService.exe.4204.dmp
C:\Windows\Prefetch\SANTIVIRUSCLIENT.EXE-40143D30.pf
C:\Windows\Prefetch\SANTIVIRUSSERVICE.EXE-16AB7442.pf
C:\Windows\INF\c_fsantivirus.inf
C:\Windows\INF\c_fsantivirus.PNF
C:\Users\Pancho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AviSynth\Uninstall AviSynth.lnk
C:\Users\Pancho\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\http___www_avisynth_org
C:\Users\Pancho\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\http___www_avisynth_org_warpenterprises_
C:\Users\Pancho\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AviSynth_Docs_English_index_htm
C:\Users\Pancho\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AviSynth_Examples
C:\Users\Pancho\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AviSynth_gpl_txt
C:\Users\Pancho\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AviSynth_plugins
C:\Users\Pancho\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_Digital Communications_SAntivirus_SAntivirusClient_exe
C:\Users\Pancho\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\santivirusclient.exe.log
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviSynth\AviSynth Documentation.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviSynth\AviSynth Online.url
C:\Program Files (x86)\Universal Media Server\win32\avisynth\avisynth.exe
C:\Program Files (x86)\Universal Media Server\documentation\avisynth.html
C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusClient.exe.config
C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusIC.config
C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusService.config
C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusService.exe.config
C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusUninstaller.exe.config
C:\Program Files (x86)\AviSynth\Docs\avisynth.css
C:\Program Files (x86)\AviSynth\Docs\English\externalfilters\ffavisynth.htm
C:\Windows\WinSxS\amd64_c_fsantivirus.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_e8a3ad9373ab26d0
C:\Windows\WinSxS\amd64_dual_c_fsantivirus.inf_31bf3856ad364e35_10.0.19041.1_none_8d76b37cccda75a1
C:\Windows\System32\DriverStore\FileRepository\c_fsantivirus.inf_amd64_632d2ac0d68cf3ed
C:\Users\Pancho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AviSynth
C:\Users\Pancho\AppData\Local\VS Revo Group\Revo Uninstaller Pro\Logs\AviSynth
C:\Users\Pancho\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\360 Total Security-27022022-190044
C:\Users\Pancho\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\AviSynth-13012022-222910
C:\Users\Pancho\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\AviSynth-14012022-013606
C:\Users\Pancho\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\SAntivirus Realtime Protection Lite-13012022-171621
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_SAntivirusServic_9456866a2cc78cc8ac54ffe46a5b4350d7fdb8_b53eb8a5_1179d8c6-accf-40e6-830e-e9052d597793
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviSynth
C:\Program Files (x86)\AviSynth
C:\Program Files (x86)\AviSynth\plugins
C:\Program Files (x86)\AviSynth\Uninstall.exe
C:\Program Files (x86)\Universal Media Server\win32\avisynth
C:\Program Files (x86)\Digital Communications\SAntivirus
C:\Windows\SysWow64\AviSynth.dll,0

DeleteKey: HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DriverInfFiles\c_fsantivirus.inf
DeleteKey: HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DriverPackages\c_fsantivirus.inf_amd64_632d2ac0d68cf3ed
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SAntivirusUninstaller_RASAPI32
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SAntivirusUninstaller_RASMANCS
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_c_fsantivirus.inf.resources_31bf3856ad364e35_en-us_9a8c17af29671973
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_dual_c_fsantivirus.inf_31bf3856ad364e35_none_b570512174d39eea
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\avsfile
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\avsfile\DefaultIcon
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\avs_auto_file
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\avs_auto_file\DefaultIcon]
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\AviSynth
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AviSynth
DeleteKey: HKEY_USERS\S-1-5-21-176537593-2728283085-4065151155-1001\SOFTWARE\VS Revo Group\Revo Uninstaller Pro\Uninstaller\Traced\LogsUSs\AviSynth
DeleteKey: HKEY_USERS\S-1-5-21-176537593-2728283085-4065151155-1001\SOFTWARE\VS Revo Group\Revo Uninstaller Pro\Uninstaller\Traced\LogsUSs\AviSynth\AviSynth
DeleteValue: HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\{b1d1a169-c54f-4379-81db-bee7d88d7454}""
DeleteValue: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION""
DeleteValue: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6D6B700-124D-11D4-86F3-DB80AFD98778}""
DeleteValue: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6D6B700-124D-11D4-86F3-DB80AFD98778}\InProcServer32]""

Reboot:
End::

ЗАБЕЛЕЖКА: Този скрипт е написан специално за този потребител,и за тази конкретна машина. Изпълнението на фикса, на друг компютър може да доведе до увреждане на  операционната ви система

Натиснете бутона Fix само веднъж и изчакайте.

Забележка:    Не е необходимо да поставяте скрипта в FRST .
Рестартирайте компютъра, ако бъдете подканени.
Когато поправката е завършена, FRST ще генерира дневник на същото място, от което е стартиран (Fixlog.txt)
Моля, копирайте и поставете съдържанието му във вашия отговор.

Fix result of Farbar Recovery Scan Tool (x64) Version: 27-02-2022
Ran by Pancho (03-03-2022 21:49:01) Run:3
Running from C:\Users\Pancho\OneDrive\Работен плот
Loaded Profiles: Pancho
Boot Mode: Normal
==============================================

fixlist content:
*****************
CreateRestorePoint:
CloseProcesses:
C:\Windows\WinSxS\Manifests\amd64_c_fsantivirus.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_e8a3ad9373ab26d0.manifest
C:\Windows\WinSxS\Manifests\amd64_dual_c_fsantivirus.inf_31bf3856ad364e35_10.0.19041.1_none_8d76b37cccda75a1.manifest
C:\Windows\WinSxS\amd64_dual_c_fsantivirus.inf_31bf3856ad364e35_10.0.19041.1_none_8d76b37cccda75a1\c_fsantivirus.inf
C:\Windows\WinSxS\amd64_c_fsantivirus.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_e8a3ad9373ab26d0\c_fsantivirus.inf_loc
C:\Windows\SysWOW64\avisynth.dll
C:\Windows\System32\DriverStore\en-US\c_fsantivirus.inf_loc
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SAntivirusService.exe.log
C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\SAntivirusService.exe.3900.dmp
C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\SAntivirusService.exe.3948.dmp
C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\SAntivirusService.exe.4204.dmp
C:\Windows\Prefetch\SANTIVIRUSCLIENT.EXE-40143D30.pf
C:\Windows\Prefetch\SANTIVIRUSSERVICE.EXE-16AB7442.pf
C:\Windows\INF\c_fsantivirus.inf
C:\Windows\INF\c_fsantivirus.PNF
C:\Users\Pancho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AviSynth\Uninstall AviSynth.lnk
C:\Users\Pancho\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\http___www_avisynth_org
C:\Users\Pancho\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\http___www_avisynth_org_warpenterprises_
C:\Users\Pancho\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AviSynth_Docs_English_index_htm
C:\Users\Pancho\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AviSynth_Examples
C:\Users\Pancho\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AviSynth_gpl_txt
C:\Users\Pancho\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AviSynth_plugins
C:\Users\Pancho\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_Digital Communications_SAntivirus_SAntivirusClient_exe
C:\Users\Pancho\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\santivirusclient.exe.log
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviSynth\AviSynth Documentation.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviSynth\AviSynth Online.url
C:\Program Files (x86)\Universal Media Server\win32\avisynth\avisynth.exe
C:\Program Files (x86)\Universal Media Server\documentation\avisynth.html
C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusClient.exe.config
C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusIC.config
C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusService.config
C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusService.exe.config
C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusUninstaller.exe.config
C:\Program Files (x86)\AviSynth\Docs\avisynth.css
C:\Program Files (x86)\AviSynth\Docs\English\externalfilters\ffavisynth.htm
C:\Windows\WinSxS\amd64_c_fsantivirus.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_e8a3ad9373ab26d0
C:\Windows\WinSxS\amd64_dual_c_fsantivirus.inf_31bf3856ad364e35_10.0.19041.1_none_8d76b37cccda75a1
C:\Windows\System32\DriverStore\FileRepository\c_fsantivirus.inf_amd64_632d2ac0d68cf3ed
C:\Users\Pancho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AviSynth
C:\Users\Pancho\AppData\Local\VS Revo Group\Revo Uninstaller Pro\Logs\AviSynth
C:\Users\Pancho\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\360 Total Security-27022022-190044
C:\Users\Pancho\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\AviSynth-13012022-222910
C:\Users\Pancho\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\AviSynth-14012022-013606
C:\Users\Pancho\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\SAntivirus Realtime Protection Lite-13012022-171621
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_SAntivirusServic_9456866a2cc78cc8ac54ffe46a5b4350d7fdb8_b53eb8a5_1179d8c6-accf-40e6-830e-e9052d597793
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviSynth
C:\Program Files (x86)\AviSynth
C:\Program Files (x86)\AviSynth\plugins
C:\Program Files (x86)\AviSynth\Uninstall.exe
C:\Program Files (x86)\Universal Media Server\win32\avisynth
C:\Program Files (x86)\Digital Communications\SAntivirus
C:\Windows\SysWow64\AviSynth.dll,0
DeleteKey: HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DriverInfFiles\c_fsantivirus.inf
DeleteKey: HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DriverPackages\c_fsantivirus.inf_amd64_632d2ac0d68cf3ed
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SAntivirusUninstaller_RASAPI32
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SAntivirusUninstaller_RASMANCS
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_c_fsantivirus.inf.resources_31bf3856ad364e35_en-us_9a8c17af29671973
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_dual_c_fsantivirus.inf_31bf3856ad364e35_none_b570512174d39eea
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\avsfile
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\avsfile\DefaultIcon
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\avs_auto_file
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\avs_auto_file\DefaultIcon]
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\AviSynth
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AviSynth
DeleteKey: HKEY_USERS\S-1-5-21-176537593-2728283085-4065151155-1001\SOFTWARE\VS Revo Group\Revo Uninstaller Pro\Uninstaller\Traced\LogsUSs\AviSynth
DeleteKey: HKEY_USERS\S-1-5-21-176537593-2728283085-4065151155-1001\SOFTWARE\VS Revo Group\Revo Uninstaller Pro\Uninstaller\Traced\LogsUSs\AviSynth\AviSynth
DeleteValue: HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\{b1d1a169-c54f-4379-81db-bee7d88d7454}""
DeleteValue: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION""
DeleteValue: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6D6B700-124D-11D4-86F3-DB80AFD98778}""
DeleteValue: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6D6B700-124D-11D4-86F3-DB80AFD98778}\InProcServer32]""
Reboot:

*****************

Restore point was successfully created.
Processes closed successfully.
C:\Windows\WinSxS\Manifests\amd64_c_fsantivirus.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_e8a3ad9373ab26d0.manifest => moved successfully
C:\Windows\WinSxS\Manifests\amd64_dual_c_fsantivirus.inf_31bf3856ad364e35_10.0.19041.1_none_8d76b37cccda75a1.manifest => moved successfully
C:\Windows\WinSxS\amd64_dual_c_fsantivirus.inf_31bf3856ad364e35_10.0.19041.1_none_8d76b37cccda75a1\c_fsantivirus.inf => moved successfully
C:\Windows\WinSxS\amd64_c_fsantivirus.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_e8a3ad9373ab26d0\c_fsantivirus.inf_loc => moved successfully
C:\Windows\SysWOW64\avisynth.dll => moved successfully
C:\Windows\System32\DriverStore\en-US\c_fsantivirus.inf_loc => moved successfully
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SAntivirusService.exe.log => moved successfully
C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\SAntivirusService.exe.3900.dmp => moved successfully
C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\SAntivirusService.exe.3948.dmp => moved successfully
C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\SAntivirusService.exe.4204.dmp => moved successfully
C:\Windows\Prefetch\SANTIVIRUSCLIENT.EXE-40143D30.pf => moved successfully
C:\Windows\Prefetch\SANTIVIRUSSERVICE.EXE-16AB7442.pf => moved successfully
C:\Windows\INF\c_fsantivirus.inf => moved successfully
C:\Windows\INF\c_fsantivirus.PNF => moved successfully
C:\Users\Pancho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AviSynth\Uninstall AviSynth.lnk => moved successfully
C:\Users\Pancho\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\http___www_avisynth_org => moved successfully
C:\Users\Pancho\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\http___www_avisynth_org_warpenterprises_ => moved successfully
C:\Users\Pancho\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AviSynth_Docs_English_index_htm => moved successfully
C:\Users\Pancho\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AviSynth_Examples => moved successfully
C:\Users\Pancho\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AviSynth_gpl_txt => moved successfully
C:\Users\Pancho\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AviSynth_plugins => moved successfully
C:\Users\Pancho\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_Digital Communications_SAntivirus_SAntivirusClient_exe => moved successfully
C:\Users\Pancho\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\santivirusclient.exe.log => moved successfully
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviSynth\AviSynth Documentation.lnk => moved successfully
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviSynth\AviSynth Online.url => moved successfully
C:\Program Files (x86)\Universal Media Server\win32\avisynth\avisynth.exe => moved successfully
C:\Program Files (x86)\Universal Media Server\documentation\avisynth.html => moved successfully
C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusClient.exe.config => moved successfully
C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusIC.config => moved successfully
C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusService.config => moved successfully
C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusService.exe.config => moved successfully
C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusUninstaller.exe.config => moved successfully
C:\Program Files (x86)\AviSynth\Docs\avisynth.css => moved successfully
C:\Program Files (x86)\AviSynth\Docs\English\externalfilters\ffavisynth.htm => moved successfully
C:\Windows\WinSxS\amd64_c_fsantivirus.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_e8a3ad9373ab26d0 => moved successfully
C:\Windows\WinSxS\amd64_dual_c_fsantivirus.inf_31bf3856ad364e35_10.0.19041.1_none_8d76b37cccda75a1 => moved successfully
C:\Windows\System32\DriverStore\FileRepository\c_fsantivirus.inf_amd64_632d2ac0d68cf3ed => moved successfully
C:\Users\Pancho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AviSynth => moved successfully
C:\Users\Pancho\AppData\Local\VS Revo Group\Revo Uninstaller Pro\Logs\AviSynth => moved successfully
C:\Users\Pancho\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\360 Total Security-27022022-190044 => moved successfully
C:\Users\Pancho\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\AviSynth-13012022-222910 => moved successfully
C:\Users\Pancho\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\AviSynth-14012022-013606 => moved successfully
C:\Users\Pancho\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\SAntivirus Realtime Protection Lite-13012022-171621 => moved successfully
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_SAntivirusServic_9456866a2cc78cc8ac54ffe46a5b4350d7fdb8_b53eb8a5_1179d8c6-accf-40e6-830e-e9052d597793 => moved successfully
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviSynth => moved successfully
C:\Program Files (x86)\AviSynth => moved successfully
"C:\Program Files (x86)\AviSynth\plugins" => not found
"C:\Program Files (x86)\AviSynth\Uninstall.exe" => not found
C:\Program Files (x86)\Universal Media Server\win32\avisynth => moved successfully
C:\Program Files (x86)\Digital Communications\SAntivirus => moved successfully
"C:\Windows\SysWow64\AviSynth.dll,0" => not found
HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DriverInfFiles\c_fsantivirus.inf => could not remove. Access Denied.
HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DriverPackages\c_fsantivirus.inf_amd64_632d2ac0d68cf3ed => could not remove. Access Denied.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SAntivirusUninstaller_RASAPI32 => removed successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SAntivirusUninstaller_RASMANCS => removed successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_c_fsantivirus.inf.resources_31bf3856ad364e35_en-us_9a8c17af29671973 => removed successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_dual_c_fsantivirus.inf_31bf3856ad364e35_none_b570512174d39eea => removed successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\avsfile => removed successfully
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\avsfile\DefaultIcon" => not found
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\avs_auto_file => removed successfully
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\avs_auto_file\DefaultIcon" => not found
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\AviSynth => removed successfully
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AviSynth => removed successfully
HKEY_USERS\S-1-5-21-176537593-2728283085-4065151155-1001\SOFTWARE\VS Revo Group\Revo Uninstaller Pro\Uninstaller\Traced\LogsUSs\AviSynth => removed successfully
"HKEY_USERS\S-1-5-21-176537593-2728283085-4065151155-1001\SOFTWARE\VS Revo Group\Revo Uninstaller Pro\Uninstaller\Traced\LogsUSs\AviSynth\AviSynth" => not found
"DeleteValue: HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\{b1d1a169-c54f-4379-81db-bee7d88d7454}"\\DeleteValue: HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\{b1d1a169-c54f-4379-81db-bee7d88d7454}""" => not found
"DeleteValue: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION"\\DeleteValue: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION""" => not found
"DeleteValue: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6D6B700-124D-11D4-86F3-DB80AFD98778}"\\DeleteValue: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6D6B700-124D-11D4-86F3-DB80AFD98778}""" => not found
"DeleteValue: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6D6B700-124D-11D4-86F3-DB80AFD98778}\InProcServer32]"\\DeleteValue: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6D6B700-124D-11D4-86F3-DB80AFD98778}\InProcServer32]""" => not found

Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 03-03-2022 21:49:51)

Result of scheduled keys to remove after reboot:

HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DriverInfFiles\c_fsantivirus.inf => could not remove. Access Denied.
HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DriverPackages\c_fsantivirus.inf_amd64_632d2ac0d68cf3ed => could not remove. Access Denied.

==== End of Fixlog 21:49:51 ====

Чудесно..! Сега как е компютъра ....? 

Контролни сканирания и сме на финал....:

 

Сканиране с Malwarebytes Anti-Malware (MBAM)

• Ако вече имате инсталиран Malwarebytes, отворете Malwarebytes и кликнете върху бутона Сканиране. Той автоматично ще провери за актуализации и ще стартира сканиране на заплахи.
• Ако все още нямате инсталиран Malwarebytes, моля, изтеглете го от тук и го инсталирайте..... !
• След като инсталирате, отворете Malwarebytes и изберете Сканиране и го оставете да работи....!
• След като сканирането приключи, уверете се, че сте поставили под карантина на всички открити обекти
• Ако не са открити никакви заплахи, щракнете върху падащото меню Запазване на резултатите, след това бутона Експортиране в TXT и запазете файла като текстов файл на работния плот или на друго място, което можете да намерите и прикачите  този дневник при следващия си отговор.
• Ако е имало засечени заплахи, след като карантината приключи, щракнете върху бутона Преглед на отчета, След това щракнете върху падащото меню Експортиране, след това бутона Експортиране в TXT и запазете файла като текстов файл на вашия работен плот или друго място, което можете да намерите и Прикачете този дневник към следващия си отговор.
• Ако компютърът се рестартира на етап карантиниране, можете да получите достъп до регистрационните файлове от историята на откриване, а след това раздела История. Маркирайте най-новото сканиране и щракнете двукратно, за да го отворите. След това щракнете върху падащото меню Експортиране, след това върху бутона Експортиране в TXT и запазете файла като текстов файл на вашия работен плот или на друго място, което можете да намерите и прикачите към този дневник при следващия си отговор.

+

Сканиране с AdwCleaner (режим на сканиране (Scan mode)

Изтеглете AdwCleaner и го запазете на вашия работен плот.

• Щракнете двукратно върху AdwCleaner.exe, за да го стартирате.
• Щракнете върху Сканиране сега (Scan Now)
• Когато сканирането приключи, ще се отвори прозорец с резултати от сканиране.
• Щракнете върху Отказ ( Cancel) (в този момент не се опитвайте да поставите под карантина нищо, което е намерено)
• Сега щракнете върху раздела Log Files.
• Щракнете двукратно върху последния дневник за сканиране (регистрационните файлове за сканиране имат префикс [S0*], където * се заменя с число. Последното сканиране ще има най-голямо число)
• Ще се отвори файл на Notepad, съдържащ резултатите от сканирането.

Моля, публикувайте съдържанието на файла в следващия си отговор.

Malwarebytes
www.malwarebytes.com

-Детайли за регистъра-
Дата на сканиране: 3.03.22 г.
Час на сканиране: 22:01 ч.
Файл на регистъра: ba1466a6-9b2c-11ec-bf73-2cf05d810562.json

-Информация за софтуера-
Версия: 4.5.5.175
Версия на компонентите: 1.0.1621
Актуализирай версията на пакета: 1.0.51805
Лиценз: Пробен период

-Системна информация-
OS: Windows 10 (Build 19044.1566)
CPU: x64
Файлова система: NTFS
Потребител: Pancho\Pancho

-Резюме на сканирането-
Тип сканиране: Сканиране за заплахи
Сканирането е стартирано от: Ръчно
Резултат: Завършено
Сканирани обекти: 289509
Открити заплахи: 0
Заплахи под карантина: 0
Изтекло време: 0 мин, 37 сек

-Опции за сканиране-
Памет: Разрешено
Стартиране: Разрешено
Файлова система: Разрешено
Архиви: Разрешено
руткитове: Забранено
Евристика: Разрешено
PUP: Открий
PUM: Открий

-Детайли за сканирането-
Процес: 0
(Не бяха открити зловредни елементи)

Модул: 0
(Не бяха открити зловредни елементи)

Ключ на регистъра: 0
(Не бяха открити зловредни елементи)

Стойност на регистъра: 0
(Не бяха открити зловредни елементи)

Данни на регистъра: 0
(Не бяха открити зловредни елементи)

Поток данни: 0
(Не бяха открити зловредни елементи)

Папка: 0
(Не бяха открити зловредни елементи)

Файл: 0
(Не бяха открити зловредни елементи)

Физически сектор: 0
(Не бяха открити зловредни елементи)

WMI: 0
(Не бяха открити зловредни елементи)

(end)

# -------------------------------
# Malwarebytes AdwCleaner 8.3.1.0
# -------------------------------
# Build:    11-18-2021
# Database: 2022-02-03.4 (Cloud)
# Support:  https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Scan
# -------------------------------
# Start:    03-03-2022
# Duration: 00:00:03
# OS:       Windows 10 Pro
# Scanned:  32049
# Detected: 11

***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

PUP.Optional.Segurazo           C:\Program Files (x86)\Digital Communications

***** [ Files ] *****

No malicious files found.

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

No malicious tasks found.

***** [ Registry ] *****

PUP.Optional.Legacy             HKCU\Software\APN PIP
PUP.Optional.Legacy             HKCU\Software\Classes\.bgl
PUP.Optional.Legacy             HKLM\Software\Wow6432Node\PIP
PUP.Optional.SAntivirus         HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION|santivirusclient.exe
PUP.Optional.SAntivirus         HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION|santivirusclient.vshost.exe
PUP.Optional.SAntivirus         HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION|santivirusclient.exe
PUP.Optional.SAntivirus         HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION|santivirusclient.vshost.exe
PUP.Optional.SAntivirus         HKLM\Software\Wow6432Node\\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION|santivirusclient.exe
PUP.Optional.SAntivirus         HKLM\Software\Wow6432Node\\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION|santivirusclient.vshost.exe
PUP.Optional.Segurazo           HKLM\System\CurrentControlSet\Services\EventLog\Application\SAntivirusSvc

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries found.

***** [ Chromium URLs ] *****

No malicious Chromium URLs found.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries found.

***** [ Firefox URLs ] *****

No malicious Firefox URLs found.

***** [ Hosts File Entries ] *****

No malicious hosts file entries found.

***** [ Preinstalled Software ] *****

No Preinstalled Software found.

 

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S00].txt ##########

 

AdwCleaner (режим на почистване) (Clean mode)

• Щракнете двукратно върху AdwCleaner.exe на вашия работен плот, за да го стартирате отново.
• Щракнете върху Сканиране сега (Scan Now.)
• Когато сканирането приключи, ще се отвори прозорец с резултати от сканиране (Scan Results.)
• Моля, отметнете всичко намерено  и след това щракнете върху Карантина. (Quarantine.)

Щракнете върху Напред (Next)

• Ще се появи подкана за рестартиране на компютъра.
• Щракнете върху Рестартиране сега (Restart Now).

След като компютърът ви се рестартира:

• Ако не се отвори автоматично, стартирайте AdwCleaner.
• Щракнете върху раздела Регистрационни файлове ( Log Files)
• Щракнете двукратно върху последния Clean log  ( регистрационни файлове имат префикс [C0*], където * се заменя с число, последното сканиране ще има най-голямо число)
• Ще се отвори файл на Notepad, съдържащ резултатите от премахването.

Моля, публикувайте съдържанието на файла в следващия си отговор.

 

Компютъра не се рестартира след като дадох напред.Има два файла 01 качвам последния,който програмата изкара.

# -------------------------------
# Malwarebytes AdwCleaner 8.3.1.0
# -------------------------------
# Build:    11-18-2021
# Database: 2022-02-03.4 (Cloud)
# Support:  https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start:    03-03-2022
# Duration: 00:00:01
# OS:       Windows 10 Pro
# Cleaned:  11
# Failed:   0

***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

Deleted       C:\Program Files (x86)\Digital Communications

***** [ Files ] *****

No malicious files cleaned.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

Deleted       HKCU\Software\APN PIP
Deleted       HKCU\Software\Classes\.bgl
Deleted       HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION|santivirusclient.exe
Deleted       HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION|santivirusclient.vshost.exe
Deleted       HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION|santivirusclient.exe
Deleted       HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION|santivirusclient.vshost.exe
Deleted       HKLM\Software\Wow6432Node\PIP
Deleted       HKLM\Software\Wow6432Node\\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION|santivirusclient.exe
Deleted       HKLM\Software\Wow6432Node\\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION|santivirusclient.vshost.exe
Deleted       HKLM\System\CurrentControlSet\Services\EventLog\Application\SAntivirusSvc

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

No malicious Chromium URLs cleaned.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.

***** [ Hosts File Entries ] *****

No malicious hosts file entries cleaned.

***** [ Preinstalled Software ] *****

No Preinstalled Software cleaned.

*************************

[+] Delete Tracing Keys
[+] Reset Winsock

*************************

AdwCleaner[S00].txt - [2602 octets] - [03/03/2022 22:07:14]
AdwCleaner[S01].txt - [2663 octets] - [03/03/2022 22:22:16]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C01].txt ##########

 

Изчезна uTorrenta от Revo Uninstaller Pro и програмата:AviSynth

Здравейте..! Програмата AviSynth нали вие казахте че не може да се деинсталира и не знаете за какво е ...Сега я търсите..?!? 

uTorrenta - Malwarebytes е поставил под карантина 

Цитат

PUP.Optional.BundleInstaller, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\uTorrent, Под карантина

PUP.Optional.BundleInstaller, HKU\S-1-5-21-176537593-2728283085-4065151155-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|uTorrent, Под карантина

PUP.Optional.BundleInstaller, C:\DOCUMENTS AND SETTINGS\PUBLIC\Desktop\µTorrent.lnk, Под карантина

PUP.Optional.BundleInstaller, C:\PROGRAMDATA\Microsoft\Windows\Start Menu\µTorrent.lnk, Под карантина,

PUP.Optional.BundleInstaller, C:\USERS\PANCHO\APPDATA\ROAMING\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk, Под карантина, 

PUP.Optional.BundleInstaller, C:\PROGRAM FILES (X86)\UTORRENT\UTORRENT.EXE, Под карантина,

Защо ..вие си отговорете на този въпрос...! Изтеглете си чисто копие и си го инсталирайте отново ..или си го възстановете от карантината ..но това отново ще зарази компютъра ви ...! 

Другия вариант е да направите като мен - използвам като алтернатива  qBittorrent ..върши ми работа , няма реклами , обновява се редовно ...!

 Много благодаря за всичко.Свикнал съм с uTorrenta v.2.2.1 даже от форума ми го предложиха,но ако има съмнение за вирус според вас няма да го слагам.Имам го на др.място. Няма да го вадя от.карантината.Сега искам да попитам има папка в Локален диск (C:) FRST там има логове и карантина на SAntiwirus и  AviSynth да я изтрия ли?И какво да правя с програмите които ми дадохте за намиране на вирус да ги махам ли и как? Или да оставя някоя за проверка на системата за вируси заедно с дефендъра ,както вие прецените.

След като всичко е наред следва да премахнем всичко което използвахме в почистването ..освен Malwarebytes ...!

 

KpRm 
 
Изтеглете  KpRm от kernel-panik и го запишете на вашия работен плот. 

• Щракнете с десния бутон върху kprm_ (версия) .exe и изберете Изпълни като администратор. 
• Когато инструментът се отвори, уверете се, че всички квадратчета са отметнати и изберете Изпълни ( Run ).

• След като приключите, щракнете върху OK. 
• В Notepad ще се отвори журнал, озаглавен kprm- (date) .txt. 
• Моля, копирайте и поставете съдържанието му в следващия си отговор.

 

# Run at 4.3.2022 'г.' 16:41:07
# KpRm (Kernel-panik) version 2.9.3
# Website https://kernel-panik.me/tool/kprm/
# Run by Pancho from C:\Users\Pancho\OneDrive\Работен плот
# Computer Name: PANCHO
# OS: Windows 10 X64 (19044)
# Number of passes: 1

- Checked options -

    ~ Registry Backup
    ~ Delete Tools
    ~ Restore System Settings
    ~ UAC Restore
    ~ Delete Restore Points
    ~ Create Restore Point
    ~ Delete Quarantines after 7 days

- Create Registry Backup -

   ~ [OK] Hive C:\Windows\System32\config\SOFTWARE backed up
   ~ [OK] Hive C:\Users\Pancho\NTUSER.dat backed up

     [OK] Registry Backup: C:\KPRM\backup\2022-03-04-16-41-07

- Delete Tools -

  ## AdwCleaner
     [OK] C:\Users\Pancho\OneDrive\Работен плот\AdwCleaner.exe deleted

  ## FRST
     [OK] C:\Users\Pancho\OneDrive\Работен плот\Addition.txt deleted
     [OK] C:\Users\Pancho\OneDrive\Работен плот\Fixlog.txt deleted
     [OK] C:\Users\Pancho\OneDrive\Работен плот\FRST.txt deleted
     [OK] C:\Users\Pancho\OneDrive\Работен плот\FRST64.exe deleted
     [OK] C:\Users\Pancho\OneDrive\Работен плот\Search.txt deleted

- Other Lines -

  ## Quarantines that will be deleted in 7 days (2022/03/11)
    ~ C:\AdwCleaner (AdwCleaner)
    ~ C:\FRST (FRST)

- Restore System Settings -

     [OK] Reset WinSock
     [OK] FLUSHDNS
     [OK] Hide Hidden file.
     [OK] Show Extensions for known file types
     [OK] Hide protected operating system files

- Restore UAC -

     [OK] Set EnableLUA with default (1) value
     [OK] Set ConsentPromptBehaviorAdmin with default (5) value
     [OK] Set ConsentPromptBehaviorUser with default (3) value
     [OK] Set EnableInstallerDetection with default (0) value
     [OK] Set EnableSecureUIAPaths with default (1) value
     [OK] Set EnableUIADesktopToggle with default (0) value
     [OK] Set EnableVirtualization with default (1) value
     [OK] Set FilterAdministratorToken with default (0) value
     [OK] Set PromptOnSecureDesktop with default (1) value
     [OK] Set ValidateAdminCodeSignatures with default (0) value

- Clear Restore Points -

     [I] No system recovery points were found

- Create Restore Point -

     [OK] System Restore Point created

- Display System Restore Point -

   ~ [I] RP named KpRm created at 03/04/2022 14:41:14

-- KPRM finished in 15.18s --